@kb-labs/cli-commands 2.3.0 → 2.5.0

package/dist/registry/index.js

@@ -0,0 +1,1712 @@
+import { createRequire } from 'module';
+import path2 from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { existsSync, promises } from 'fs';
+import { createHash } from 'crypto';
+import { parse } from 'yaml';
+import { glob } from 'glob';
+import { toPosixPath } from '@kb-labs/shared-cli-ui';
+import { z } from 'zod';
+import Ajv from 'ajv';
+import { platform } from '@kb-labs/core-runtime';
+import { getLogLevel } from '@kb-labs/cli-runtime';
+
+// src/registry/availability.ts
+var req = createRequire(import.meta.url);
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path2.dirname(__filename$1);
+function resolveFromCwd(spec, cwd) {
+  const cliRoot = path2.resolve(__dirname$1, "../../..");
+  let monorepoRoot = cwd;
+  while (monorepoRoot !== path2.dirname(monorepoRoot)) {
+    if (existsSync(path2.join(monorepoRoot, "pnpm-workspace.yaml"))) {
+      break;
+    }
+    monorepoRoot = path2.dirname(monorepoRoot);
+  }
+  const pathsToTry = [
+    cwd,
+    // Current working directory (user's project)
+    cliRoot,
+    // CLI installation directory
+    monorepoRoot,
+    // Monorepo root (if found)
+    path2.join(monorepoRoot, "../kb-labs-cli"),
+    // Explicit kb-labs-cli path
+    path2.join(monorepoRoot, "../kb-labs-mind")
+    // Explicit kb-labs-mind path
+  ].filter(Boolean);
+  for (const searchPath of pathsToTry) {
+    try {
+      return req.resolve(spec, { paths: [searchPath] });
+    } catch (_e) {
+    }
+  }
+  throw new Error(`Cannot resolve ${spec} from any of: ${pathsToTry.join(", ")}`);
+}
+function checkRequires(manifest, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  if (!manifest.requires || manifest.requires.length === 0) {
+    return { available: true };
+  }
+  let isInMonorepo = false;
+  let monorepoRoot = cwd;
+  while (monorepoRoot !== path2.dirname(monorepoRoot)) {
+    if (existsSync(path2.join(monorepoRoot, "pnpm-workspace.yaml"))) {
+      isInMonorepo = true;
+      break;
+    }
+    monorepoRoot = path2.dirname(monorepoRoot);
+  }
+  for (const dep of manifest.requires) {
+    try {
+      const resolved = resolveFromCwd(dep, cwd);
+      if (!resolved.includes("node_modules")) {
+        continue;
+      }
+    } catch (err) {
+      if (isInMonorepo) {
+        continue;
+      }
+      const errorMessage = err.message || "";
+      const hasExportsError = errorMessage.includes("exports") || errorMessage.includes("main");
+      if (hasExportsError || errorMessage.includes("Cannot resolve")) {
+        const parts = dep.startsWith("@") ? dep.slice(1).split("/") : [dep];
+        if (parts.length === 0) {
+          continue;
+        }
+        const scope = parts.length >= 2 ? parts[0] : "";
+        const packageName = parts.length >= 2 ? parts[1] : parts[0];
+        if (!packageName) {
+          continue;
+        }
+        const cliRoot = path2.resolve(__dirname$1, "../../..");
+        const packagePath = scope ? path2.join(cliRoot, "node_modules", "@" + scope, packageName, "package.json") : path2.join(cliRoot, "node_modules", packageName, "package.json");
+        if (existsSync(packagePath)) {
+          continue;
+        }
+      }
+      const isKbLabsPackage = dep.startsWith("@kb-labs/");
+      const hint = isKbLabsPackage ? `Run: pnpm add ${dep}` : `Run: npm install ${dep}`;
+      return {
+        available: false,
+        reason: `Missing dependency: ${dep}`,
+        hint
+      };
+    }
+  }
+  return { available: true };
+}
+var semverPattern = /^[\^~]?[\d]+\.[\d]+(\.[\d]+)?(-[\w\.-]+)?(\+[\w\.-]+)?$/;
+var FlagDefinitionSchema = z.object({
+  name: z.string().min(1).regex(/^[a-z0-9-]+$/, "Flag name must be lowercase alphanumeric with hyphens"),
+  type: z.enum(["string", "boolean", "number", "array"]),
+  alias: z.string().length(1).regex(/^[a-z]$/i, "Alias must be a single letter").optional(),
+  default: z.any().optional(),
+  description: z.string().optional(),
+  choices: z.array(z.string()).optional(),
+  required: z.boolean().optional()
+}).refine(
+  (data) => {
+    if (data.choices && data.type !== "string") {
+      return false;
+    }
+    return true;
+  },
+  { message: "Choices are only allowed for string type flags" }
+);
+var EngineSchema = z.object({
+  node: z.string().optional(),
+  // e.g., ">=18", "^18.0.0"
+  kbCli: z.string().optional(),
+  // e.g., "^1.5.0"
+  module: z.enum(["esm", "cjs"]).optional()
+}).optional();
+var CommandManifestSchema = z.object({
+  manifestVersion: z.literal("1.0"),
+  // Legacy fields (still supported)
+  id: z.string().min(1).regex(/^[a-z0-9-]+:[a-z0-9-]+(?:[:a-z0-9-]+)*$/, 'Command ID must be in format "namespace:command"'),
+  aliases: z.array(z.string()).optional(),
+  group: z.string().min(1),
+  describe: z.string().min(1),
+  longDescription: z.string().optional(),
+  requires: z.array(z.string()).optional(),
+  // Package names with optional semver
+  flags: z.array(FlagDefinitionSchema).optional(),
+  examples: z.array(z.string()).optional(),
+  loader: z.any(),
+  // Function validation happens at runtime
+  // New fields (optional for backward compatibility)
+  package: z.string().optional(),
+  // Full package name
+  namespace: z.string().optional(),
+  // Derived from id if not provided
+  engine: EngineSchema,
+  permissions: z.array(z.string()).optional(),
+  // e.g., ["fs.read", "git.read", "net.fetch"]
+  telemetry: z.enum(["opt-in", "off"]).optional(),
+  manifestV2: z.any().optional(),
+  // Full ManifestV3 for sandbox execution
+  // Internal flags for auto-generated commands
+  isSetup: z.boolean().optional(),
+  // Auto-generated setup command
+  isSetupRollback: z.boolean().optional(),
+  // Auto-generated setup rollback command
+  pkgRoot: z.string().optional()
+  // Package root path for handler resolution
+}).refine(
+  (data) => {
+    if (data.namespace && data.group && data.namespace !== data.group) {
+      return false;
+    }
+    return true;
+  },
+  { message: "namespace must match group" }
+).refine(
+  (data) => {
+    if (data.requires) {
+      for (const req2 of data.requires) {
+        if (req2.includes("@")) {
+          const parts = req2.split("@");
+          if (parts.length === 2) {
+            const version = parts[1];
+            if (version && !semverPattern.test(version) && !version.startsWith("^") && !version.startsWith("~") && !version.match(/^[\^~>=<]?[\d\.]+/)) {
+              return false;
+            }
+          }
+        }
+      }
+    }
+    return true;
+  },
+  { message: "requires entries must use valid semver ranges" }
+);
+function validateManifests(manifests) {
+  const errors = [];
+  const validated = [];
+  for (let i = 0; i < manifests.length; i++) {
+    const result = CommandManifestSchema.safeParse(manifests[i]);
+    if (result.success) {
+      validated.push(result.data);
+    } else {
+      const errorWithIndex = new z.ZodError([
+        ...result.error.issues.map((issue) => ({
+          ...issue,
+          path: [`[${i}]`, ...issue.path]
+        }))
+      ]);
+      errors.push(errorWithIndex);
+    }
+  }
+  if (errors.length === 0) {
+    return { success: true, data: validated };
+  }
+  return { success: false, errors };
+}
+function normalizeManifest(manifest, packageName, namespace) {
+  const normalized = { ...manifest };
+  if (!normalized.namespace && normalized.group) {
+    normalized.namespace = normalized.group;
+  } else if (!normalized.namespace && namespace) {
+    normalized.namespace = namespace;
+  }
+  if (!normalized.group && normalized.namespace) {
+    normalized.group = normalized.namespace;
+  }
+  if (!normalized.package) {
+    normalized.package = packageName;
+  }
+  return normalized;
+}
+
+// src/registry/discover.ts
+var DEBUG_MODE = process.env.DEBUG_SANDBOX === "1" || process.env.NODE_ENV === "development";
+var log = (level, message, fields) => {
+  if (!DEBUG_MODE) {
+    return;
+  }
+  const prefix = level === "error" ? "\u2717" : level === "warn" ? "\u26A0" : level === "info" ? "\u2139" : "\u{1F50D}";
+  const logFn = level === "error" ? console.error : level === "warn" ? console.warn : console.log;
+  {
+    logFn(`${prefix} [discover] ${message}`);
+  }
+};
+function createManifestV3Loader(commandId) {
+  return async () => {
+    throw new Error(
+      `Loader should not be called for ManifestV3 command ${commandId}. Use plugin-adapter-cli executeCommand instead.`
+    );
+  };
+}
+function ensureManifestLoader(manifest) {
+  if (typeof manifest.loader !== "function") {
+    const commandId = manifest.id || manifest.group || "unknown";
+    log("debug", `[plugins][cache] Rehydrated loader for ${commandId}`);
+    manifest.loader = createManifestV3Loader(commandId);
+  }
+}
+var __test = {
+  ensureManifestLoader,
+  createManifestV3Loader
+};
+function createUnavailableManifest(pkgName, error) {
+  const rawMsg = (error?.message || String(error) || "").toString();
+  let missing = null;
+  const m1 = rawMsg.match(/Cannot find (?:module|package) '([^']+)'/);
+  const m2 = rawMsg.match(/from ['"]([^'"]+)['"]/);
+  if (m1 && m1[1]) {
+    missing = m1[1];
+  } else if (m2 && m2[1] && m2[1].startsWith("@")) {
+    missing = m2[1];
+  }
+  const seg = pkgName.includes("/") ? pkgName.split("/")[1] : pkgName;
+  const group = (seg || pkgName).replace(/-cli$/, "");
+  const short = seg || pkgName;
+  const requires = missing ? [missing] : [];
+  const manifest = {
+    manifestVersion: "1.0",
+    id: `${group}:manifest:${short}`,
+    group,
+    describe: `Commands from ${pkgName} are unavailable`,
+    requires,
+    loader: async () => {
+      throw new Error(`Cannot load ${pkgName} CLI manifest. ${rawMsg}`);
+    }
+  };
+  return manifest;
+}
+var PACKAGE_JSON = "package.json";
+var MANIFEST_LOAD_TIMEOUT = 1500;
+var IN_PROC_CACHE_TTL_MS = 6e4;
+var DISK_CACHE_TTL_MS = 5 * 6e4;
+var inProcDiscoveryCache = null;
+async function computeManifestHash(manifestPath) {
+  try {
+    const content = await promises.readFile(manifestPath, "utf8");
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return "unknown";
+  }
+}
+async function computeLockfileHash(cwd) {
+  const lockfilePath = path2.join(cwd, "pnpm-lock.yaml");
+  try {
+    const content = await promises.readFile(lockfilePath, "utf8");
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return "";
+  }
+}
+async function computeConfigHash(cwd) {
+  const configPath = path2.join(cwd, ".kb", "kb.config.json");
+  try {
+    const content = await promises.readFile(configPath, "utf8");
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return "";
+  }
+}
+async function computePluginsStateHash(cwd) {
+  const pluginsPath = path2.join(cwd, ".kb", "plugins.json");
+  try {
+    const content = await promises.readFile(pluginsPath, "utf8");
+    return createHash("sha256").update(content).digest("hex");
+  } catch {
+    return "";
+  }
+}
+async function detectNewWorkspacePackages(cwd, cachedPackages) {
+  if (!cachedPackages) {
+    return true;
+  }
+  try {
+    const workspaceYaml = path2.join(cwd, "pnpm-workspace.yaml");
+    const content = await promises.readFile(workspaceYaml, "utf8");
+    const parsed = parse(content);
+    if (!Array.isArray(parsed.packages)) {
+      return false;
+    }
+    const knownPackages = new Set(Object.keys(cachedPackages));
+    for (const pattern of parsed.packages) {
+      const pkgPattern = path2.join(pattern, PACKAGE_JSON);
+      const pkgFiles = await glob(pkgPattern, {
+        cwd,
+        absolute: false,
+        ignore: [".kb/**", "node_modules/**", "**/node_modules/**"]
+      });
+      for (const pkgFile of pkgFiles) {
+        const pkgRoot = path2.dirname(path2.join(cwd, pkgFile));
+        const pkg = await readPackageJson(path2.join(cwd, pkgFile));
+        if (!pkg || !pkg.name) {
+          continue;
+        }
+        if (knownPackages.has(pkg.name)) {
+          continue;
+        }
+        const manifestInfo = await findManifestPath(pkgRoot, pkg);
+        if (manifestInfo.path) {
+          log("debug", `[plugins][cache] New workspace package detected: ${pkg.name}`);
+          return true;
+        }
+      }
+    }
+  } catch (error) {
+    log("debug", `[plugins][cache] Workspace scan skipped: ${error?.message || "unknown error"}`);
+  }
+  return false;
+}
+async function loadManifestWithTimeout(manifestPath, pkgName, pkgRoot) {
+  const timeout = new Promise((_, reject) => {
+    setTimeout(() => reject(new Error("Timeout")), MANIFEST_LOAD_TIMEOUT);
+  });
+  try {
+    return await Promise.race([loadManifest(manifestPath, pkgName, pkgRoot), timeout]);
+  } catch (err) {
+    if (err.message === "Timeout") {
+      log("warn", `Timeout loading manifest from ${pkgName}`);
+      return [];
+    }
+    throw err;
+  }
+}
+function getNamespaceFromManifest(manifestV2, packageName) {
+  const manifestId = manifestV2?.id;
+  if (typeof manifestId === "string" && manifestId.length > 0) {
+    const seg = manifestId.split("/").pop() || manifestId;
+    return seg.replace(/^@/, "");
+  }
+  const parts = packageName.split("/");
+  const last = parts[parts.length - 1] || packageName;
+  return last.replace(/^@/, "");
+}
+async function loadManifest(manifestPath, pkgName, pkgRoot) {
+  const fileUrl = pathToFileURL(manifestPath).href;
+  const mod = await import(fileUrl);
+  const manifest = mod.manifest || mod.default;
+  if (!manifest || typeof manifest !== "object" || manifest.schema !== "kb.plugin/3") {
+    throw new Error(`Unsupported manifest format in ${pkgName}. Only kb.plugin/3 schema is supported.`);
+  }
+  const namespace = getNamespaceFromManifest(manifest, pkgName);
+  const manifestDir = path2.dirname(manifestPath);
+  const baseRoot = pkgRoot || manifestDir;
+  const cliCommands = Array.isArray(manifest.cli?.commands) ? manifest.cli.commands : [];
+  if (cliCommands.length === 0 && !manifest.setup) {
+    log("warn", `ManifestV3 ${manifest.id || pkgName} has no CLI commands or setup entry`);
+  }
+  const commandManifests = cliCommands.map((cmd) => {
+    const commandId = cmd.id;
+    const commandManifest = {
+      manifestVersion: "1.0",
+      id: commandId,
+      group: cmd.group || namespace,
+      subgroup: cmd.subgroup,
+      describe: cmd.describe || "",
+      longDescription: cmd.longDescription,
+      aliases: cmd.aliases,
+      flags: cmd.flags,
+      examples: cmd.examples,
+      loader: createManifestV3Loader(commandId),
+      package: pkgName,
+      namespace: cmd.group || namespace
+    };
+    commandManifest.manifestV2 = manifest;
+    commandManifest.pkgRoot = baseRoot;
+    return commandManifest;
+  });
+  const validation = validateManifests(commandManifests);
+  if (!validation.success) {
+    const errorMessages = validation.errors.map(
+      (err) => err.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(", ")
+    ).join("; ");
+    log("warn", `ManifestV3 validation warnings for ${pkgName}: ${errorMessages}`);
+  }
+  return (validation.success ? validation.data : commandManifests).map(
+    (m) => normalizeManifest(m, pkgName, namespace)
+  );
+}
+async function readPackageJson(pkgPath) {
+  try {
+    const content = await promises.readFile(pkgPath, "utf8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function loadConfig(cwd) {
+  const configPath = path2.join(cwd, ".kb", "kb.config.json");
+  try {
+    const content = await promises.readFile(configPath, "utf8");
+    const config = JSON.parse(content);
+    return {
+      allow: config.plugins?.allow,
+      block: config.plugins?.block,
+      linked: config.plugins?.linked
+    };
+  } catch {
+    return {};
+  }
+}
+async function findManifestPath(pkgRoot, pkg) {
+  if (pkg.kb?.manifest) {
+    const manifestPath = path2.join(pkgRoot, pkg.kb.manifest);
+    try {
+      await promises.access(manifestPath);
+      return { path: manifestPath, deprecated: false };
+    } catch {
+      return { path: null, deprecated: false };
+    }
+  }
+  if (pkg.exports?.["./kb/commands"]) {
+    const exportPath = pkg.exports["./kb/commands"];
+    const manifestPath = typeof exportPath === "string" ? exportPath : exportPath.default || exportPath.import;
+    if (manifestPath) {
+      const resolved = path2.resolve(pkgRoot, manifestPath);
+      try {
+        await promises.access(resolved);
+        return { path: resolved, deprecated: false };
+      } catch {
+        const withExt = resolved.endsWith(".js") ? resolved : `${resolved}.js`;
+        try {
+          await promises.access(withExt);
+          return { path: withExt, deprecated: false };
+        } catch {
+        }
+      }
+    }
+  }
+  return { path: null, deprecated: false };
+}
+function isPluginPackage(pkg) {
+  if (!pkg) {
+    return false;
+  }
+  if (pkg.kb?.plugin === true) {
+    return true;
+  }
+  const keywords = Array.isArray(pkg.keywords) ? pkg.keywords : [];
+  return keywords.includes("kb-cli-plugin");
+}
+function validateUniqueIds(manifests, pkgName) {
+  const ids = /* @__PURE__ */ new Set();
+  const aliases = /* @__PURE__ */ new Set();
+  for (const m of manifests) {
+    if (ids.has(m.id)) {
+      throw new Error(`Duplicate command ID "${m.id}" in package ${pkgName}`);
+    }
+    ids.add(m.id);
+    if (m.aliases) {
+      for (const alias of m.aliases) {
+        if (aliases.has(alias) || ids.has(alias)) {
+          throw new Error(`Alias collision "${alias}" in package ${pkgName}`);
+        }
+        aliases.add(alias);
+      }
+    }
+  }
+}
+async function discoverWorkspace(cwd) {
+  const workspaceYaml = path2.join(cwd, "pnpm-workspace.yaml");
+  const content = await promises.readFile(workspaceYaml, "utf8");
+  const parsed = parse(content);
+  if (!parsed.packages || !Array.isArray(parsed.packages)) {
+    throw new Error("Invalid pnpm-workspace.yaml: missing packages array");
+  }
+  const packageInfos = [];
+  for (const pattern of parsed.packages) {
+    const pkgPattern = path2.join(pattern, PACKAGE_JSON);
+    const pkgFiles = await glob(pkgPattern, {
+      cwd,
+      absolute: false,
+      ignore: [".kb/**", "node_modules/**", "**/node_modules/**"]
+      // Ignore .kb, node_modules
+    });
+    for (const pkgFile of pkgFiles) {
+      const pkgRoot = path2.dirname(path2.join(cwd, pkgFile));
+      const pkg = await readPackageJson(path2.join(cwd, pkgFile));
+      if (!pkg) {
+        continue;
+      }
+      const manifestInfo = await findManifestPath(pkgRoot, pkg);
+      if (manifestInfo.path) {
+        if (manifestInfo.deprecated) {
+          log("warn", `[DEPRECATED] ${pkg.name} uses legacy manifest path: ${manifestInfo.path}`);
+          log("warn", `  \u2192 Migrate to exports["./kb/commands"] or set kb.commandsManifest in package.json`);
+        }
+        packageInfos.push({ pkgRoot, pkg, manifestPath: manifestInfo.path });
+      }
+    }
+  }
+  const loadPromises = packageInfos.map(async ({ pkgRoot, pkg, manifestPath }) => {
+    const pkgStart = Date.now();
+    try {
+      const manifests = await loadManifestWithTimeout(manifestPath, pkg.name, pkgRoot);
+      const pkgTime = Date.now() - pkgStart;
+      if (pkgTime > 30) {
+        log("debug", `[plugins][perf] ${pkg.name} manifest parse: ${pkgTime}ms (budget: 30ms)`);
+      }
+      if (manifests.length > 0) {
+        validateUniqueIds(manifests, pkg.name);
+        return {
+          manifests,
+          source: "workspace",
+          packageName: pkg.name,
+          manifestPath: toPosixPath(manifestPath),
+          pkgRoot: toPosixPath(pkgRoot)
+        };
+      }
+      return null;
+    } catch (err) {
+      const pkgTime = Date.now() - pkgStart;
+      log("debug", `[plugins][perf] ${pkg.name} failed after ${pkgTime}ms`);
+      log("warn", JSON.stringify({
+        code: "DISCOVERY_MANIFEST_LOAD_FAIL",
+        packageName: pkg.name,
+        manifestPath: toPosixPath(manifestPath),
+        errorCode: err.code || "UNKNOWN",
+        errorMessage: err.message,
+        hint: err.message.includes("Cannot find package") ? "Run: kb devlink apply && pnpm -w build" : "Check manifest syntax and dependencies"
+      }));
+      const synthetic = createUnavailableManifest(pkg.name, err);
+      return {
+        manifests: [synthetic],
+        source: "workspace",
+        packageName: pkg.name,
+        manifestPath: toPosixPath(manifestPath),
+        pkgRoot: toPosixPath(pkgRoot)
+      };
+    }
+  });
+  const settledResults = await Promise.allSettled(loadPromises);
+  const results = [];
+  for (const settled of settledResults) {
+    if (settled.status === "fulfilled" && settled.value) {
+      results.push(settled.value);
+    }
+  }
+  return results;
+}
+async function discoverCurrentPackage(cwd) {
+  try {
+    const pkg = await readPackageJson(path2.join(cwd, PACKAGE_JSON));
+    if (!pkg) {
+      return null;
+    }
+    const manifestInfo = await findManifestPath(cwd, pkg);
+    if (manifestInfo.path) {
+      if (manifestInfo.deprecated) {
+        log("warn", `[DEPRECATED] ${pkg.name} uses legacy manifest path: ${manifestInfo.path}`);
+        log("warn", `  \u2192 Migrate to exports["./kb/commands"] or set kb.commandsManifest in package.json`);
+      }
+      const manifests = await loadManifestWithTimeout(manifestInfo.path, pkg.name, cwd);
+      if (manifests.length > 0) {
+        validateUniqueIds(manifests, pkg.name);
+        return {
+          manifests,
+          source: "workspace",
+          packageName: pkg.name,
+          manifestPath: toPosixPath(manifestInfo.path),
+          pkgRoot: toPosixPath(cwd)
+        };
+      }
+    }
+  } catch (err) {
+    log("debug", `No CLI manifest in current package: ${err.message}`);
+  }
+  return null;
+}
+async function discoverNodeModules(cwd) {
+  const nmDir = path2.join(cwd, "node_modules");
+  const config = await loadConfig(cwd);
+  try {
+    const entries = await promises.readdir(nmDir, { withFileTypes: true });
+    const packageInfos = [];
+    const scanPromises = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      const scanEntry = async () => {
+        let pkgRoot;
+        let pkg;
+        if (entry.name.startsWith("@")) {
+          const scopeDir = path2.join(nmDir, entry.name);
+          try {
+            const scopedDirs = await promises.readdir(scopeDir, { withFileTypes: true });
+            for (const scopedEntry of scopedDirs.filter((d) => d.isDirectory())) {
+              pkgRoot = path2.join(scopeDir, scopedEntry.name);
+              pkg = await readPackageJson(path2.join(pkgRoot, PACKAGE_JSON));
+              if (!pkg) {
+                continue;
+              }
+              const isPlugin = isPluginPackage(pkg);
+              if (pkg.name?.startsWith("@kb-labs/")) {
+                const manifestInfo = await findManifestPath(pkgRoot, pkg);
+                if (manifestInfo.path) {
+                  packageInfos.push({ pkgRoot, pkg, manifestPath: manifestInfo.path });
+                }
+              } else if (isPlugin) {
+                if (config.block?.includes(pkg.name)) {
+                  log("debug", `Plugin ${pkg.name} blocked by config`);
+                  return;
+                }
+                const isAllowlisted = config.allow?.includes(pkg.name) || config.linked?.includes(pkg.name);
+                if (!isAllowlisted) {
+                  log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb marketplace enable'`);
+                  return;
+                }
+                const manifestInfo = await findManifestPath(pkgRoot, pkg);
+                if (manifestInfo.path) {
+                  if (manifestInfo.deprecated) {
+                    log("warn", `[DEPRECATED] ${pkg.name} uses legacy manifest path: ${manifestInfo.path}`);
+                    log("warn", `  \u2192 Migrate to exports["./kb/commands"] or set kb.commandsManifest in package.json`);
+                  }
+                  const isLinked = config.linked?.includes(pkg.name);
+                  packageInfos.push({ pkgRoot, pkg, manifestPath: manifestInfo.path, isLinked });
+                }
+              }
+            }
+          } catch {
+          }
+        } else {
+          pkgRoot = path2.join(nmDir, entry.name);
+          pkg = await readPackageJson(path2.join(pkgRoot, PACKAGE_JSON));
+          if (!pkg) {
+            return;
+          }
+          const isPlugin = isPluginPackage(pkg);
+          if (isPlugin) {
+            if (config.block?.includes(pkg.name)) {
+              log("debug", `Plugin ${pkg.name} blocked by config`);
+              return;
+            }
+            const isAllowlisted = config.allow?.includes(pkg.name) || config.linked?.includes(pkg.name);
+            if (!isAllowlisted) {
+              log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb marketplace enable'`);
+              return;
+            }
+            const manifestInfo = await findManifestPath(pkgRoot, pkg);
+            if (manifestInfo.path) {
+              if (manifestInfo.deprecated) {
+                log("warn", `[DEPRECATED] ${pkg.name} uses legacy manifest path: ${manifestInfo.path}`);
+                log("warn", `  \u2192 Migrate to exports["./kb/commands"] or set kb.commandsManifest in package.json`);
+              }
+              const isLinked = config.linked?.includes(pkg.name);
+              packageInfos.push({ pkgRoot, pkg, manifestPath: manifestInfo.path, isLinked });
+            }
+          }
+        }
+      };
+      scanPromises.push(scanEntry());
+    }
+    await Promise.allSettled(scanPromises);
+    const loadPromises = packageInfos.map(async ({ pkgRoot, pkg, manifestPath, isLinked }) => {
+      try {
+        const manifests = await loadManifestWithTimeout(manifestPath, pkg.name, pkgRoot);
+        if (manifests.length > 0) {
+          validateUniqueIds(manifests, pkg.name);
+          return {
+            manifests,
+            source: isLinked ? "linked" : "node_modules",
+            packageName: pkg.name,
+            manifestPath: toPosixPath(manifestPath),
+            pkgRoot: toPosixPath(pkgRoot)
+          };
+        }
+        return null;
+      } catch (err) {
+        log("warn", JSON.stringify({
+          code: "DISCOVERY_MANIFEST_LOAD_FAIL",
+          packageName: pkg.name,
+          manifestPath: toPosixPath(manifestPath),
+          errorCode: err.code || "UNKNOWN",
+          errorMessage: err.message,
+          hint: err.message.includes("Cannot find package") ? "Run: kb devlink apply && pnpm -w build" : "Check manifest syntax and dependencies"
+        }));
+        const synthetic = createUnavailableManifest(pkg.name, err);
+        return {
+          manifests: [synthetic],
+          source: isLinked ? "linked" : "node_modules",
+          packageName: pkg.name,
+          manifestPath: toPosixPath(manifestPath),
+          pkgRoot: toPosixPath(pkgRoot)
+        };
+      }
+    });
+    const settledResults = await Promise.allSettled(loadPromises);
+    const results = [];
+    for (const settled of settledResults) {
+      if (settled.status === "fulfilled" && settled.value) {
+        results.push(settled.value);
+      }
+    }
+    return results;
+  } catch (err) {
+    log("debug", `Could not scan node_modules: ${err.message}`);
+    return [];
+  }
+}
+function deduplicateManifests(all) {
+  const byPackageName = /* @__PURE__ */ new Map();
+  const priority = {
+    workspace: 3,
+    linked: 2,
+    node_modules: 1,
+    builtin: 0
+  };
+  for (const result of all) {
+    const existing = byPackageName.get(result.packageName);
+    if (!existing) {
+      byPackageName.set(result.packageName, result);
+    } else {
+      const existingPriority = priority[existing.source] || 0;
+      const newPriority = priority[result.source] || 0;
+      if (newPriority > existingPriority) {
+        byPackageName.set(result.packageName, result);
+      }
+    }
+  }
+  return Array.from(byPackageName.values());
+}
+async function loadCache(cwd) {
+  const cachePath = path2.join(cwd, ".kb", "cache", "cli-manifests.json");
+  try {
+    const content = await promises.readFile(cachePath, "utf8");
+    const cache = JSON.parse(content);
+    if (cache.mtimes && cache.results) {
+      log("debug", "Old cache format detected, ignoring");
+      return null;
+    }
+    if (!cache.packages) {
+      log("debug", "Invalid cache format, ignoring");
+      return null;
+    }
+    if (cache.version !== process.version) {
+      log("debug", "Cache invalidated: Node version changed");
+      return null;
+    }
+    const currentCliVersion = process.env.CLI_VERSION || "0.1.0";
+    if (cache.cliVersion !== currentCliVersion) {
+      log("debug", "Cache invalidated: CLI version changed");
+      return null;
+    }
+    const currentLockfileHash = await computeLockfileHash(cwd);
+    if (currentLockfileHash && cache.lockfileHash && cache.lockfileHash !== currentLockfileHash) {
+      log("debug", "Cache invalidated: lockfile changed");
+      return null;
+    }
+    const currentConfigHash = await computeConfigHash(cwd);
+    if (currentConfigHash && cache.configHash && cache.configHash !== currentConfigHash) {
+      log("debug", "Cache invalidated: kb-labs.config.json changed");
+      return null;
+    }
+    const currentPluginsStateHash = await computePluginsStateHash(cwd);
+    if (currentPluginsStateHash && cache.pluginsStateHash && cache.pluginsStateHash !== currentPluginsStateHash) {
+      log("debug", "Cache invalidated: .kb/plugins.json changed");
+      return null;
+    }
+    const parsedCache = cache;
+    parsedCache.ttlMs = parsedCache.ttlMs ?? DISK_CACHE_TTL_MS;
+    for (const entry of Object.values(parsedCache.packages)) {
+      for (const manifest of entry.result.manifests) {
+        ensureManifestLoader(manifest);
+      }
+      entry.cachedAt = entry.cachedAt ?? parsedCache.timestamp ?? Date.now();
+    }
+    return parsedCache;
+  } catch {
+    return null;
+  }
+}
+async function isPackageCacheStale(entry, options) {
+  const manifestFsPath = entry.manifestPath.split("/").join(path2.sep);
+  const pkgJsonPath = path2.join(entry.result.pkgRoot.split("/").join(path2.sep), PACKAGE_JSON);
+  try {
+    const pkgStat = await promises.stat(pkgJsonPath);
+    if (pkgStat.mtimeMs !== entry.pkgJsonMtime) {
+      log("debug", `Package cache invalidated: package.json changed for ${entry.result.packageName}`);
+      return true;
+    }
+  } catch (error) {
+    log("debug", `Package cache invalidated: missing package.json for ${entry.result.packageName} (${error?.message || "unknown"})`);
+    return true;
+  }
+  let manifestStat;
+  try {
+    manifestStat = await promises.stat(manifestFsPath);
+    if (manifestStat.mtimeMs !== entry.manifestMtime) {
+      log("debug", `Package cache invalidated: manifest mtime changed for ${entry.result.packageName}`);
+      return true;
+    }
+  } catch (error) {
+    log("debug", `Package cache invalidated: manifest deleted for ${entry.result.packageName} (${error?.message || "unknown"})`);
+    return true;
+  }
+  if (options.validateHash) {
+    try {
+      const currentHash = await computeManifestHash(manifestFsPath);
+      if (currentHash !== entry.manifestHash) {
+        log("debug", `Package cache invalidated: manifest hash changed for ${entry.result.packageName}`);
+        return true;
+      }
+    } catch (error) {
+      log("debug", `Package cache hash validation failed for ${entry.result.packageName}: ${error?.message || "unknown"}`);
+      return true;
+    }
+  }
+  return false;
+}
+async function saveCache(cwd, results) {
+  const cachePath = path2.join(cwd, ".kb", "cache", "cli-manifests.json");
+  await promises.mkdir(path2.dirname(cachePath), { recursive: true });
+  const packages = {};
+  const now = Date.now();
+  const stateHasher = createHash("sha256");
+  for (const result of results) {
+    try {
+      const manifestHash = await computeManifestHash(result.manifestPath);
+      const pkgJsonPath = path2.join(result.pkgRoot.split("/").join(path2.sep), PACKAGE_JSON);
+      const pkgStat = await promises.stat(pkgJsonPath);
+      const pkg = await readPackageJson(pkgJsonPath);
+      const version = pkg?.version || "0.1.0";
+      const manifestStat = await promises.stat(result.manifestPath.split("/").join(path2.sep));
+      const manifestsForCache = result.manifests.map((manifest) => {
+        const manifestCopy = { ...manifest };
+        delete manifestCopy.loader;
+        return manifestCopy;
+      });
+      const resultForCache = {
+        ...result,
+        manifests: manifestsForCache
+      };
+      packages[result.packageName] = {
+        version,
+        manifestHash,
+        manifestPath: result.manifestPath,
+        pkgJsonMtime: pkgStat.mtimeMs,
+        manifestMtime: manifestStat.mtimeMs,
+        cachedAt: now,
+        result: resultForCache
+      };
+      stateHasher.update(result.packageName);
+      stateHasher.update(manifestHash);
+    } catch (err) {
+      log("debug", `Failed to cache package ${result.packageName}: ${err.message}`);
+    }
+  }
+  const lockfileHash = await computeLockfileHash(cwd);
+  const configHash = await computeConfigHash(cwd);
+  const pluginsStateHash = await computePluginsStateHash(cwd);
+  if (lockfileHash) {
+    stateHasher.update(lockfileHash);
+  }
+  if (configHash) {
+    stateHasher.update(configHash);
+  }
+  if (pluginsStateHash) {
+    stateHasher.update(pluginsStateHash);
+  }
+  const cache = {
+    version: process.version,
+    cliVersion: process.env.CLI_VERSION || "0.1.0",
+    timestamp: now,
+    ttlMs: DISK_CACHE_TTL_MS,
+    stateHash: stateHasher.digest("hex"),
+    lockfileHash: lockfileHash || void 0,
+    configHash: configHash || void 0,
+    pluginsStateHash: pluginsStateHash || void 0,
+    packages
+  };
+  try {
+    await promises.writeFile(cachePath, JSON.stringify(cache), "utf8");
+  } catch (err) {
+    log("debug", `Failed to save cache: ${err.message}`);
+  }
+}
+async function discoverManifests(cwd, noCache = false, options = {}) {
+  const startTime = Date.now();
+  const timings = {};
+  if (noCache) {
+    inProcDiscoveryCache = null;
+  } else if (inProcDiscoveryCache) {
+    const age = Date.now() - inProcDiscoveryCache.timestamp;
+    if (age < IN_PROC_CACHE_TTL_MS) {
+      const cachedResults = inProcDiscoveryCache.results;
+      cachedResults.reduce((acc, r) => {
+        acc[r.source] = (acc[r.source] || 0) + 1;
+        return acc;
+      }, {});
+      log("debug", `[plugins][discover] in-proc cache hit (${cachedResults.length} packages, age ${age}ms)`);
+      return cachedResults;
+    }
+  }
+  if (!noCache) {
+    const cacheStart = Date.now();
+    const cached = await loadCache(cwd);
+    timings.cacheLoad = Date.now() - cacheStart;
+    if (cached) {
+      log("debug", "Using cached manifests");
+      const freshResults = [];
+      const cacheAge = Date.now() - cached.timestamp;
+      const ttlMs = cached.ttlMs ?? DISK_CACHE_TTL_MS;
+      const enforceHashValidation = cacheAge >= ttlMs;
+      log("debug", `[plugins][cache] hit age=${cacheAge}ms ttl=${ttlMs}ms validateHash=${enforceHashValidation}`);
+      let staleCount = 0;
+      for (const entry of Object.values(cached.packages)) {
+        const stale = await isPackageCacheStale(entry, { validateHash: enforceHashValidation });
+        if (!stale) {
+          freshResults.push(entry.result);
+        } else {
+          staleCount += 1;
+        }
+      }
+      const hasNewWorkspacePackages = await detectNewWorkspacePackages(
+        cwd,
+        cached.packages
+      );
+      if (staleCount === 0 && freshResults.length > 0 && !hasNewWorkspacePackages) {
+        const totalTime2 = Date.now() - startTime;
+        const sourceCounts2 = freshResults.reduce((acc, r) => {
+          acc[r.source] = (acc[r.source] || 0) + 1;
+          return acc;
+        }, {});
+        log("info", `[plugins][discover] ${totalTime2}ms (cached: ${Object.entries(sourceCounts2).map(([s, c]) => `${s}:${c}`).join(", ")})`);
+        inProcDiscoveryCache = { timestamp: Date.now(), results: freshResults };
+        return freshResults;
+      }
+      if (hasNewWorkspacePackages) {
+        log("debug", "[plugins][cache] invalidated: new workspace packages detected");
+      }
+      if (staleCount > 0) {
+        log("debug", `[plugins][cache] invalidated: ${staleCount} stale package(s) detected`);
+      }
+    }
+  }
+  let workspace = [];
+  try {
+    const wsStart = Date.now();
+    workspace = await discoverWorkspace(cwd);
+    timings.workspace = Date.now() - wsStart;
+    log("info", `Discovered ${workspace.length} workspace packages with CLI manifests`);
+  } catch (_err) {
+    log("info", "No workspace file found, checking current package");
+    const currentStart = Date.now();
+    const currentPkg = await discoverCurrentPackage(cwd);
+    timings.currentPackage = Date.now() - currentStart;
+    if (currentPkg) {
+      workspace = [currentPkg];
+      log("info", `Discovered current package with CLI manifest: ${currentPkg.packageName}`);
+    }
+  }
+  const nmStart = Date.now();
+  const nodeModulesRoot = options.platformRoot ?? cwd;
+  const installed = await discoverNodeModules(nodeModulesRoot);
+  timings.nodeModules = Date.now() - nmStart;
+  if (installed.length > 0) {
+    log("info", `Discovered ${installed.length} installed packages with CLI manifests`);
+  }
+  const dedupStart = Date.now();
+  const results = deduplicateManifests([...workspace, ...installed]);
+  timings.deduplicate = Date.now() - dedupStart;
+  const saveStart = Date.now();
+  await saveCache(cwd, results);
+  timings.cacheSave = Date.now() - saveStart;
+  const totalTime = Date.now() - startTime;
+  const sourceCounts = results.reduce((acc, r) => {
+    acc[r.source] = (acc[r.source] || 0) + 1;
+    return acc;
+  }, {});
+  const timingDetails = Object.entries(timings).filter(([_, t]) => t > 0).map(([k, v]) => `${k}:${v}ms`).join(", ");
+  log("info", `[plugins][discover] ${totalTime}ms (${Object.entries(sourceCounts).map(([s, c]) => `${s}:${c}`).join(", ")})${timingDetails ? ` | ${timingDetails}` : ""}`);
+  if (totalTime > 150) {
+    log("warn", `[plugins][perf] Discovery took ${totalTime}ms (budget: 150ms)`);
+  }
+  inProcDiscoveryCache = { timestamp: Date.now(), results };
+  return results;
+}
+async function discoverManifestsByNamespace(cwd, namespace, noCache = false) {
+  const allResults = await discoverManifests(cwd, noCache);
+  return allResults.filter((result) => {
+    return result.manifests.some((m) => {
+      const manifestNamespace = m.namespace || m.group;
+      return manifestNamespace === namespace;
+    });
+  });
+}
+var ajv = new Ajv();
+var flagSchema = {
+  type: "object",
+  required: ["name", "type"],
+  additionalProperties: false,
+  properties: {
+    name: { type: "string" },
+    type: { enum: ["string", "boolean", "number", "array"] },
+    alias: { type: "string", pattern: "^[a-z]$" },
+    // single letter
+    description: { type: "string" },
+    choices: { type: "array", items: { type: "string" } },
+    required: { type: "boolean" },
+    default: {}
+    // must match type
+  }
+};
+var manifestSchema = {
+  type: "object",
+  required: ["manifestVersion", "id", "group", "describe", "loader"],
+  additionalProperties: true,
+  properties: {
+    manifestVersion: { type: "string", enum: ["1.0"] },
+    id: { type: "string", pattern: "^[a-z0-9-]+(?::[a-z0-9-]+)*$" },
+    // Simple or namespaced (colon-separated)
+    aliases: { type: "array", items: { type: "string" } },
+    group: { type: "string" },
+    describe: { type: "string" },
+    longDescription: { type: "string" },
+    requires: { type: "array", items: { type: "string" } },
+    flags: {
+      type: "array",
+      items: flagSchema
+    },
+    examples: { type: "array", items: { type: "string" } }
+  }
+};
+var validateManifest = ajv.compile(manifestSchema);
+var validateFlag = ajv.compile(flagSchema);
+function validateFlagDef(flag, manifestId) {
+  if (!validateFlag(flag)) {
+    throw new Error(
+      `Invalid flag "${flag.name}" in ${manifestId}: ${ajv.errorsText(validateFlag.errors)}`
+    );
+  }
+  if (flag.choices && flag.type !== "string") {
+    throw new Error(`Flag "${flag.name}" in ${manifestId}: choices allowed only for string type`);
+  }
+  if (flag.default !== void 0) {
+    const typeMatches = flag.type === "string" && typeof flag.default === "string" || flag.type === "boolean" && typeof flag.default === "boolean" || flag.type === "number" && typeof flag.default === "number" || flag.type === "array" && Array.isArray(flag.default);
+    if (!typeMatches) {
+      throw new Error(
+        `Flag "${flag.name}" in ${manifestId}: default value type mismatch (expected ${flag.type})`
+      );
+    }
+  }
+}
+function validateManifestStructure(manifest) {
+  if (!validateManifest(manifest)) {
+    throw new Error(`Invalid manifest ${manifest.id}: ${ajv.errorsText(validateManifest.errors)}`);
+  }
+  if (manifest.manifestVersion !== "1.0") {
+    throw new Error(
+      `Unsupported manifestVersion "${manifest.manifestVersion}" in ${manifest.id} (expected "1.0")`
+    );
+  }
+  if (manifest.flags && Array.isArray(manifest.flags) && manifest.id) {
+    for (const flag of manifest.flags) {
+      if (flag && typeof flag === "object" && flag.name) {
+        validateFlagDef(flag, manifest.id);
+      }
+    }
+  }
+}
+var SOURCE_PRIORITY = {
+  builtin: 4,
+  workspace: 3,
+  linked: 2,
+  node_modules: 1
+};
+function normalizeCommandId(id, _namespace) {
+  return id;
+}
+function generateWhitespaceAliases(id) {
+  if (!id.includes(":")) {
+    return [];
+  }
+  return [id.replace(":", " ")];
+}
+function normalizeAliases(manifest, logger) {
+  const log2 = logger ?? platform.logger;
+  const aliases = /* @__PURE__ */ new Set();
+  manifest.namespace || manifest.group;
+  if (manifest.aliases) {
+    for (const alias of manifest.aliases) {
+      if (!/^[a-z0-9-:]+$/i.test(alias)) {
+        log2.warn(`Invalid alias "${alias}" in ${manifest.id}: aliases must be alphanumeric with hyphens or colons`);
+        continue;
+      }
+      aliases.add(alias);
+    }
+  }
+  const whitespaceAliases = generateWhitespaceAliases(manifest.id);
+  for (const alias of whitespaceAliases) {
+    aliases.add(alias);
+  }
+  return Array.from(aliases);
+}
+function checkNamespaceCollision(manifest, existing, namespace) {
+  const existingGroup = existing.manifest.group || "";
+  const currentGroup = manifest.group || "";
+  if (existingGroup === currentGroup && existingGroup === namespace && existing.manifest.id === manifest.id) {
+    throw new Error(
+      `Command collision in group "${namespace}": "${manifest.id}" conflicts with existing "${existing.manifest.id}". Rename one of the commands to use a different ID (e.g., "${manifest.id}2" or use --alias to create a different alias).`
+    );
+  }
+}
+function getSourcePriority(source) {
+  return SOURCE_PRIORITY[source] || 0;
+}
+function checkCollision(manifest, existing, currentSource, namespace) {
+  const existingPriority = getSourcePriority(existing.source);
+  const currentPriority = getSourcePriority(currentSource);
+  checkNamespaceCollision(manifest, existing, namespace);
+  if (currentSource === "workspace" && existing.source === "workspace") {
+    throw new Error(
+      `Command ID collision: "${manifest.id}" is exported by multiple workspace packages. This is not allowed. Please rename one of the commands to use a different ID.`
+    );
+  }
+  if (currentPriority > existingPriority) {
+    return { shouldShadow: true };
+  } else if (currentPriority < existingPriority) {
+    return { shouldShadow: false };
+  }
+  return { shouldShadow: false };
+}
+function preflightManifests(discoveryResults, logger) {
+  const log2 = logger ?? platform.logger;
+  const valid = [];
+  const skipped = [];
+  for (const result of discoveryResults) {
+    const allowed = [];
+    for (const manifest of result.manifests) {
+      try {
+        validateManifestStructure(manifest);
+        allowed.push(manifest);
+      } catch (error) {
+        const reason = error?.message ? String(error.message) : "Validation failed";
+        const manifestId = manifest?.id || manifest?.group || result.packageName || "unknown";
+        skipped.push({
+          id: manifestId,
+          source: result.source,
+          reason
+        });
+        log2.warn(`Preflight skipped manifest ${manifestId}: ${reason}`);
+      }
+    }
+    if (allowed.length > 0) {
+      valid.push({
+        ...result,
+        manifests: allowed
+      });
+    }
+  }
+  return { valid, skipped };
+}
+async function registerManifests(discoveryResults, registry2, options = {}) {
+  const log2 = options.logger ?? platform.logger;
+  const registered = [];
+  const skipped = [];
+  const globalIds = /* @__PURE__ */ new Map();
+  const globalAliases = /* @__PURE__ */ new Map();
+  const logLevel = getLogLevel();
+  let collisions = 0;
+  let errors = 0;
+  const sorted = [...discoveryResults].sort((a, b) => {
+    const priorityA = getSourcePriority(a.source);
+    const priorityB = getSourcePriority(b.source);
+    return priorityB - priorityA;
+  });
+  for (const result of sorted) {
+    for (const manifest of result.manifests) {
+      const manifestId = manifest.id || manifest.group || "unknown";
+      const namespace = manifest.namespace || manifest.group;
+      try {
+        try {
+          validateManifestStructure(manifest);
+        } catch (err) {
+          throw new Error(`Validation failed: ${err.message}`);
+        }
+        const normalizedId = normalizeCommandId(manifest.id, namespace);
+        if (normalizedId !== manifest.id) {
+          log2.warn(`Command ID "${manifest.id}" normalized to "${normalizedId}"`);
+          manifest.id = normalizedId;
+        }
+        const normalizedAliases = normalizeAliases(manifest, log2);
+        if (normalizedAliases.length > 0) {
+          manifest.aliases = normalizedAliases;
+        }
+        const availability = checkRequires(manifest, {
+          cwd: options.cwd ?? result.pkgRoot
+        });
+        const cmd = {
+          manifest,
+          v3Manifest: manifest.manifestV2,
+          // Extract V3 manifest from legacy field
+          available: availability.available,
+          unavailableReason: availability.available ? void 0 : availability.reason,
+          hint: availability.available ? void 0 : availability.hint,
+          source: result.source,
+          shadowed: false,
+          pkgRoot: result.pkgRoot,
+          packageName: result.packageName
+        };
+        try {
+          const manifestModule = await import(result.manifestPath);
+          if (manifestModule.init && typeof manifestModule.init === "function") {
+            await manifestModule.init({
+              cwd: result.pkgRoot,
+              package: result.packageName,
+              manifest: cmd.manifest
+            });
+          }
+          if (manifestModule.register && typeof manifestModule.register === "function") {
+            await manifestModule.register({
+              registry: registry2,
+              command: cmd,
+              cwd: result.pkgRoot,
+              package: result.packageName
+            });
+          }
+          if (manifestModule.dispose && typeof manifestModule.dispose === "function") {
+            cmd._disposeHook = manifestModule.dispose;
+          }
+        } catch (hookError) {
+          log2.debug(`Lifecycle hooks unavailable for ${manifest.id}: ${hookError.message}`);
+        }
+        const existing = globalIds.get(manifest.id);
+        if (existing) {
+          const collision = checkCollision(manifest, existing, result.source, namespace);
+          if (collision.shouldShadow) {
+            existing.shadowed = true;
+            globalIds.set(manifest.id, cmd);
+            if (logLevel === "info" || logLevel === "debug") {
+              log2.info(`${manifest.id} from ${result.source} shadows ${existing.source} version`);
+            }
+          } else {
+            cmd.shadowed = true;
+            if (logLevel === "info" || logLevel === "debug") {
+              log2.info(`${manifest.id} from ${result.source} shadowed by ${existing.source} version`);
+            }
+          }
+        } else {
+          globalIds.set(manifest.id, cmd);
+        }
+        const aliasesToCheck = manifest.aliases || [];
+        for (const alias of aliasesToCheck) {
+          const existingAlias = globalAliases.get(alias);
+          if (existingAlias) {
+            if (existingAlias.manifest.id === manifest.id) {
+              continue;
+            }
+            const existingPriority = getSourcePriority(existingAlias.source);
+            const currentPriority = getSourcePriority(result.source);
+            if (currentPriority > existingPriority) {
+              existingAlias.shadowed = true;
+              globalAliases.set(alias, cmd);
+              if (logLevel === "info" || logLevel === "debug") {
+                log2.info(`Alias "${alias}" from ${result.source} shadows ${existingAlias.source} version`);
+              }
+            } else if (currentPriority < existingPriority) {
+              if (logLevel === "info" || logLevel === "debug") {
+                log2.info(`Alias "${alias}" from ${result.source} shadowed by ${existingAlias.source} version`);
+              }
+              continue;
+            } else {
+              collisions++;
+              throw new Error(
+                `Alias collision: "${alias}" used by both ${manifest.id} and ${existingAlias.manifest.id}. Rename one alias or use a different namespace.`
+              );
+            }
+          }
+          if (globalIds.has(alias)) {
+            const conflictingCmd = globalIds.get(alias);
+            const existingPriority = getSourcePriority(conflictingCmd.source);
+            const currentPriority = getSourcePriority(result.source);
+            if (currentPriority > existingPriority) {
+              log2.warn(`Alias "${alias}" conflicts with command ID "${alias}". Alias will shadow command.`);
+              globalAliases.set(alias, cmd);
+            } else {
+              throw new Error(
+                `Alias "${alias}" conflicts with existing command ID "${alias}". Rename the alias or use a different name.`
+              );
+            }
+          } else {
+            globalAliases.set(alias, cmd);
+          }
+        }
+        if (!cmd.shadowed) {
+          registry2.registerManifest(cmd);
+        }
+        registered.push(cmd);
+      } catch (error) {
+        errors++;
+        const reason = error?.message ? String(error.message) : String(error);
+        skipped.push({
+          id: manifestId,
+          source: result.source,
+          reason
+        });
+        log2.error(`Skipped manifest ${manifestId} (${result.source}): ${reason}`);
+        continue;
+      }
+    }
+  }
+  if (skipped.length > 0) {
+    log2.warn(`Skipped ${skipped.length} manifest(s) during registration`);
+    for (const skip of skipped) {
+      log2.warn(`  \u2022 ${skip.id} [${skip.source}] \u2192 ${skip.reason}`);
+    }
+  }
+  return {
+    registered,
+    skipped,
+    collisions,
+    errors
+  };
+}
+async function disposeAllPlugins(registry2, logger) {
+  const log2 = logger ?? platform.logger;
+  const manifests = registry2.listManifests();
+  const disposePromises = [];
+  for (const cmd of manifests) {
+    const disposeHook = cmd._disposeHook;
+    if (disposeHook && typeof disposeHook === "function") {
+      disposePromises.push(
+        Promise.resolve(disposeHook({
+          registry: registry2,
+          command: cmd
+        })).catch((err) => {
+          log2.warn(`Dispose hook failed for ${cmd.manifest.id}: ${err.message}`);
+        })
+      );
+    }
+  }
+  await Promise.allSettled(disposePromises);
+}
+
+// src/registry/run.ts
+async function runCommand(cmd, ctx, argv, flags) {
+  if (!cmd.available) {
+    if (ctx.presenter?.json) {
+      ctx.presenter.json({
+        ok: false,
+        available: false,
+        command: cmd.manifest.id,
+        reason: cmd.unavailableReason,
+        hint: cmd.hint
+      });
+    }
+    return 2;
+  }
+  if (!cmd.manifest.loader) {
+    return 1;
+  }
+  const implementation = await cmd.manifest.loader();
+  const result = await implementation.run(ctx, argv, flags);
+  return typeof result === "number" ? result : 0;
+}
+
+// src/registry/service.ts
+function manifestToCommand(registered) {
+  return {
+    name: registered.manifest.id,
+    category: registered.manifest.group,
+    describe: registered.manifest.describe,
+    longDescription: registered.manifest.longDescription,
+    aliases: registered.manifest.aliases || [],
+    flags: registered.manifest.flags,
+    examples: registered.manifest.examples,
+    async run() {
+      throw new Error(`Command ${registered.manifest.id} should be executed via plugin-executor, not via legacy run() path.`);
+    }
+  };
+}
+var InMemoryRegistry = class {
+  // Separate collections for security isolation
+  systemCommands = /* @__PURE__ */ new Map();
+  // System commands (in-process)
+  pluginCommands = /* @__PURE__ */ new Map();
+  // Plugin commands (subprocess)
+  // Legacy unified collection for backward compatibility
+  byName = /* @__PURE__ */ new Map();
+  groups = /* @__PURE__ */ new Map();
+  manifests = /* @__PURE__ */ new Map();
+  partial = false;
+  register(cmd) {
+    this.systemCommands.set(cmd.name, cmd);
+    this.byName.set(cmd.name, cmd);
+    for (const a of cmd.aliases || []) {
+      this.systemCommands.set(a, cmd);
+      this.byName.set(a, cmd);
+    }
+  }
+  registerGroup(group) {
+    this.groups.set(group.name, group);
+    this.byName.set(group.name, group);
+    for (const cmd of group.commands) {
+      this.systemCommands.set(cmd.name, cmd);
+      const fullName = `${group.name} ${cmd.name}`;
+      this.systemCommands.set(fullName, cmd);
+      this.byName.set(fullName, cmd);
+      for (const alias of cmd.aliases || []) {
+        this.systemCommands.set(alias, cmd);
+        this.byName.set(alias, cmd);
+      }
+    }
+    if (group.subgroups) {
+      for (const sub of group.subgroups) {
+        const subName = `${group.name} ${sub.name}`;
+        this.groups.set(subName, sub);
+        this.byName.set(subName, sub);
+        for (const cmd of sub.commands) {
+          const fullName = `${group.name} ${sub.name} ${cmd.name}`;
+          this.systemCommands.set(fullName, cmd);
+          this.byName.set(fullName, cmd);
+          for (const alias of cmd.aliases || []) {
+            this.systemCommands.set(alias, cmd);
+            this.byName.set(alias, cmd);
+          }
+        }
+      }
+    }
+  }
+  registerManifest(cmd) {
+    const cmdId = cmd.manifest.id;
+    const hasCollision = this.systemCommands.has(cmdId);
+    if (hasCollision) {
+      console.warn(`[registry] Plugin command "${cmdId}" collides with system command. System command takes priority.`);
+      cmd.shadowed = true;
+    }
+    const collisionAliases = /* @__PURE__ */ new Set();
+    for (const alias of cmd.manifest.aliases || []) {
+      if (this.systemCommands.has(alias)) {
+        console.warn(`[registry] Plugin alias "${alias}" collides with system command. System command takes priority.`);
+        collisionAliases.add(alias);
+      }
+    }
+    this.pluginCommands.set(cmdId, cmd);
+    this.manifests.set(cmdId, cmd);
+    if (!hasCollision) {
+      const commandAdapter = manifestToCommand(cmd);
+      this.byName.set(cmdId, commandAdapter);
+      this.byName.set(commandAdapter.name, commandAdapter);
+      if (cmdId.includes(":")) {
+        const spaceSeparated = cmdId.replace(/:/g, " ");
+        this.byName.set(spaceSeparated, commandAdapter);
+      }
+      if (cmd.manifest.group && cmd.manifest.subgroup) {
+        const fullPath = `${cmd.manifest.group} ${cmd.manifest.subgroup} ${cmd.manifest.id}`;
+        const colonPath = `${cmd.manifest.group}:${cmd.manifest.subgroup}:${cmd.manifest.id}`;
+        this.byName.set(fullPath, commandAdapter);
+        this.byName.set(colonPath, commandAdapter);
+        this.manifests.set(fullPath, cmd);
+        this.manifests.set(colonPath, cmd);
+        this.pluginCommands.set(fullPath, cmd);
+        this.pluginCommands.set(colonPath, cmd);
+        const twoPartName = `${cmd.manifest.group} ${cmd.manifest.id}`;
+        if (!this.byName.has(twoPartName)) {
+          this.byName.set(twoPartName, commandAdapter);
+        }
+        const subgroupKey = `${cmd.manifest.group} ${cmd.manifest.subgroup}`;
+        if (!this.groups.has(subgroupKey)) {
+          this.groups.set(subgroupKey, {
+            name: subgroupKey,
+            describe: cmd.manifest.subgroup,
+            commands: []
+          });
+          this.byName.set(subgroupKey, this.groups.get(subgroupKey));
+        }
+        this.groups.get(subgroupKey).commands.push(commandAdapter);
+      } else if (cmd.manifest.group) {
+        const fullName = `${cmd.manifest.group} ${cmd.manifest.id}`;
+        const colonName = `${cmd.manifest.group}:${cmd.manifest.id}`;
+        this.byName.set(fullName, commandAdapter);
+        this.byName.set(colonName, commandAdapter);
+        this.manifests.set(fullName, cmd);
+        this.manifests.set(colonName, cmd);
+        this.pluginCommands.set(fullName, cmd);
+        this.pluginCommands.set(colonName, cmd);
+      }
+      if (cmd.manifest.aliases) {
+        for (const alias of cmd.manifest.aliases) {
+          if (!collisionAliases.has(alias)) {
+            this.byName.set(alias, commandAdapter);
+          }
+        }
+      }
+    }
+  }
+  markPartial(partial) {
+    this.partial = partial;
+  }
+  isPartial() {
+    return this.partial;
+  }
+  getManifest(id) {
+    return this.manifests.get(id);
+  }
+  listManifests() {
+    const unique = /* @__PURE__ */ new Set();
+    for (const cmd of this.manifests.values()) {
+      unique.add(cmd);
+    }
+    return Array.from(unique);
+  }
+  has(name) {
+    return this.byName.has(name);
+  }
+  /**
+   * Get command with type information for secure routing
+   *
+   * Returns type='system' for commands from registerGroup() - execute in-process
+   * Returns type='plugin' for commands from registerManifest() - execute in subprocess
+   *
+   * This separation prevents malicious plugins from escaping the sandbox.
+   */
+  getWithType(nameOrPath) {
+    const cmd = this.get(nameOrPath);
+    if (!cmd) {
+      return void 0;
+    }
+    if ("commands" in cmd) {
+      return { cmd, type: "system" };
+    }
+    const normalizedName = typeof nameOrPath === "string" ? nameOrPath : nameOrPath.join(" ");
+    if (this.systemCommands.has(normalizedName)) {
+      return { cmd, type: "system" };
+    }
+    if (normalizedName.includes(":")) {
+      const spaceVersion = normalizedName.replace(":", " ");
+      if (this.systemCommands.has(spaceVersion)) {
+        return { cmd, type: "system" };
+      }
+    }
+    const manifestCmd = this.getManifestCommand(normalizedName);
+    if (manifestCmd) {
+      return { cmd, type: "plugin" };
+    }
+    return { cmd, type: "system" };
+  }
+  get(nameOrPath) {
+    if (typeof nameOrPath === "string") {
+      if (this.byName.has(nameOrPath)) {
+        return this.byName.get(nameOrPath);
+      }
+      if (nameOrPath.includes(":")) {
+        const parts = nameOrPath.split(":");
+        if (parts.length === 2) {
+          const exactMatch = this.byName.get(nameOrPath);
+          if (exactMatch) {
+            return exactMatch;
+          }
+          const spaceKey = parts.join(" ");
+          if (this.byName.has(spaceKey)) {
+            return this.byName.get(spaceKey);
+          }
+        }
+      }
+    }
+    const key = Array.isArray(nameOrPath) ? nameOrPath.join(" ") : nameOrPath;
+    if (this.byName.has(key)) {
+      return this.byName.get(key);
+    }
+    if (Array.isArray(nameOrPath) && nameOrPath.length === 1 && nameOrPath[0]?.includes(":")) {
+      if (this.byName.has(nameOrPath[0])) {
+        return this.byName.get(nameOrPath[0]);
+      }
+      const [group, command] = nameOrPath[0].split(":");
+      const legacyKey = `${group} ${command}`;
+      if (this.byName.has(legacyKey)) {
+        return this.byName.get(legacyKey);
+      }
+    }
+    if (Array.isArray(nameOrPath)) {
+      const dot = nameOrPath.join(".");
+      if (this.byName.has(dot)) {
+        return this.byName.get(dot);
+      }
+    }
+    if (Array.isArray(nameOrPath) && nameOrPath.length >= 2) {
+      const [groupPrefix, ...cmdParts] = nameOrPath;
+      const cmdName = cmdParts.join(" ");
+      for (const group of this.groups.values()) {
+        if (group.name === groupPrefix || group.name.startsWith(groupPrefix + ":")) {
+          const fullName = `${group.name} ${cmdName}`;
+          if (this.byName.has(fullName)) {
+            return this.byName.get(fullName);
+          }
+        }
+      }
+    }
+    return void 0;
+  }
+  list() {
+    const commands = /* @__PURE__ */ new Set();
+    for (const value of this.byName.values()) {
+      if ("run" in value) {
+        commands.add(value);
+      }
+    }
+    return Array.from(commands);
+  }
+  listGroups() {
+    return Array.from(this.groups.values());
+  }
+  getGroupsByPrefix(prefix) {
+    const result = [];
+    for (const group of this.groups.values()) {
+      if (group.name === prefix || group.name.startsWith(prefix + ":")) {
+        result.push(group);
+      }
+    }
+    return result;
+  }
+  getCommandsByGroupPrefix(prefix) {
+    const result = [];
+    for (const group of this.groups.values()) {
+      if (group.name === prefix || group.name.startsWith(prefix + ":")) {
+        result.push(...group.commands);
+      }
+    }
+    return result;
+  }
+  listProductGroups() {
+    const groups = /* @__PURE__ */ new Map();
+    for (const cmd of this.listManifests()) {
+      const groupName = cmd.manifest.group;
+      if (!groups.has(groupName)) {
+        groups.set(groupName, {
+          name: groupName,
+          describe: cmd.manifest.group,
+          commands: []
+        });
+      }
+      groups.get(groupName).commands.push(cmd);
+    }
+    return Array.from(groups.values());
+  }
+  getCommandsByGroup(group) {
+    return this.listManifests().filter((cmd) => cmd.manifest.group === group).sort((a, b) => a.manifest.id.localeCompare(b.manifest.id));
+  }
+  getManifestCommand(idOrAlias) {
+    if (this.manifests.has(idOrAlias)) {
+      return this.manifests.get(idOrAlias);
+    }
+    for (const cmd of this.manifests.values()) {
+      if (cmd.manifest.aliases?.includes(idOrAlias)) {
+        return cmd;
+      }
+      if (cmd.manifest.id.replace(/:/g, " ") === idOrAlias) {
+        return cmd;
+      }
+    }
+    return void 0;
+  }
+};
+var registry = new InMemoryRegistry();
+function findCommand(nameOrPath) {
+  return registry.get(nameOrPath);
+}
+function findCommandWithType(nameOrPath) {
+  return registry.getWithType(nameOrPath);
+}
+
+export { __test, checkRequires, discoverManifests, discoverManifestsByNamespace, disposeAllPlugins, findCommand, findCommandWithType, preflightManifests, registerManifests, registry, runCommand };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map