@lesliechan721/aw 0.1.0-beta.4 → 0.1.0-beta.40

package/dist/authoring/scripts/lib/plugin-version-check.mjs

@@ -1,20 +1,23 @@
-import { execFile } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import crypto from 'node:crypto';
 import * as fs from 'node:fs/promises';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 import { promisify } from 'node:util';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { compareStrictSemVer, parseStrictSemVer } from './semver.mjs';
 import { assertAuthoringPluginPathFence, resolveAuthoringPluginRoot, } from './plugin-root.mjs';
 const execFileAsync = promisify(execFile);
-const EXPECTED_MANIFEST_CONTRACT_VERSION = 7;
-const CLI_PACKAGE_NAME = '@lesliechan721/aw';
+const EXPECTED_MANIFEST_CONTRACT_VERSION = 16;
 const PLUGIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const CLI_REGISTRY_RELATIVE_PATHS = [
-    'src/utils/skill-frontmatter-capabilities.json',
-    'src/utils/plugin-authoring-capabilities.json',
-];
+const GIT_OBJECT_ID_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+const MAX_GIT_BLOB_BYTES = 50 * 1024 * 1024;
+const MAX_GIT_BATCH_HEADER_BYTES = 1024;
+const GIT_BATCH_OPERATION_TIMEOUT_MS = 30_000;
+const GIT_BATCH_TERM_GRACE_MS = 250;
+const GIT_BATCH_CLOSE_TIMEOUT_MS = 2_000;
 const CLI_PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
 export class PluginVersionCheckError extends Error {
     constructor(code, message) {
@@ -26,14 +29,14 @@ export class PluginVersionCheckError extends Error {
 function codedError(code, message) {
     return new PluginVersionCheckError(code, message);
 }
-function parseStablePluginVersion(version, fieldName) {
+export function parseStablePluginVersion(version, fieldName) {
     const parsed = parseStrictSemVer(version, fieldName);
     if (parsed.prerelease.length > 0 || parsed.build.length > 0) {
         throw codedError('invalidPlugin', `${fieldName} must be a stable SemVer without prerelease or build metadata.`);
     }
     return parsed;
 }
-async function runGit(repoRoot, args, options = {}) {
+export async function runGit(repoRoot, args, options = {}) {
     try {
         const result = await execFileAsync('git', args, {
             cwd: repoRoot,
@@ -49,7 +52,7 @@ async function runGit(repoRoot, args, options = {}) {
         throw codedError(options.code ?? 'gitFailed', `${options.label ?? `git ${args.join(' ')}`} failed${detail ? `: ${detail}` : '.'}`);
     }
 }
-async function resolveBaseCommit(repoRoot, base) {
+export async function resolveBaseCommit(repoRoot, base) {
     await runGit(repoRoot, ['rev-parse', '--show-toplevel'], {
         code: 'gitUnavailable',
         label: 'Git repository discovery',
@@ -109,7 +112,16 @@ async function loadProductionBundler(cliPackageRoot) {
 }
 function parseTreeRecord(record) {
     const tabIndex = record.indexOf('\t');
+    if (tabIndex < 0) {
+        throw codedError('gitFailed', 'Git authoring source tree returned a malformed record.');
+    }
     const metadata = record.slice(0, tabIndex).split(' ');
+    if (metadata.length !== 3
+        || !metadata[0]
+        || !metadata[1]
+        || !GIT_OBJECT_ID_PATTERN.test(metadata[2] ?? '')) {
+        throw codedError('gitFailed', 'Git authoring source tree returned malformed metadata.');
+    }
     return {
         mode: metadata[0],
         type: metadata[1],
@@ -117,20 +129,221 @@ function parseTreeRecord(record) {
         filePath: record.slice(tabIndex + 1),
     };
 }
+function createBatchReader(stream) {
+    const iterator = stream[Symbol.asyncIterator]();
+    let chunk = Buffer.alloc(0);
+    let offset = 0;
+    let ended = false;
+    async function nextChunk() {
+        if (offset < chunk.length)
+            return true;
+        const next = await iterator.next();
+        if (next.done) {
+            ended = true;
+            chunk = Buffer.alloc(0);
+            offset = 0;
+            return false;
+        }
+        chunk = Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value);
+        offset = 0;
+        return true;
+    }
+    return {
+        async readLine() {
+            const parts = [];
+            let size = 0;
+            while (await nextChunk()) {
+                const newline = chunk.indexOf(0x0a, offset);
+                const end = newline < 0 ? chunk.length : newline;
+                const part = chunk.subarray(offset, end);
+                parts.push(part);
+                size += part.length;
+                if (size > MAX_GIT_BATCH_HEADER_BYTES) {
+                    throw codedError('gitFailed', 'Git cat-file batch returned an oversized header.');
+                }
+                offset = newline < 0 ? chunk.length : newline + 1;
+                if (newline >= 0)
+                    return Buffer.concat(parts, size).toString('ascii');
+            }
+            if (size === 0 && ended)
+                return null;
+            throw codedError('gitFailed', 'Git cat-file batch stdout ended during a header.');
+        },
+        async readExact(size) {
+            const output = Buffer.allocUnsafe(size);
+            let written = 0;
+            while (written < size && await nextChunk()) {
+                const available = Math.min(size - written, chunk.length - offset);
+                chunk.copy(output, written, offset, offset + available);
+                offset += available;
+                written += available;
+            }
+            if (written !== size) {
+                throw codedError('gitFailed', 'Git cat-file batch stdout ended during a blob.');
+            }
+            return output;
+        },
+    };
+}
+export async function readGitBlobsBatch(repoRoot, objectIds, options = {}) {
+    const uniqueObjectIds = [...new Set(objectIds)];
+    for (const objectId of uniqueObjectIds) {
+        if (!GIT_OBJECT_ID_PATTERN.test(objectId)) {
+            throw codedError('gitFailed', `Git authoring source tree returned an invalid object ID.`);
+        }
+    }
+    if (uniqueObjectIds.length === 0)
+        return new Map();
+    const child = spawn('git', ['cat-file', '--batch'], {
+        cwd: repoRoot,
+        env: options.env ?? process.env,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let cleanupStarted = false;
+    let operationTimedOut = false;
+    let operationTimeoutTimer;
+    let forceKillTimer;
+    let closeTimeoutTimer;
+    let settleExit;
+    let onStderrData;
+    const exitTask = new Promise((resolve, reject) => {
+        const finish = (settle, value) => {
+            if (!settleExit)
+                return;
+            settleExit = null;
+            clearTimeout(operationTimeoutTimer);
+            clearTimeout(forceKillTimer);
+            clearTimeout(closeTimeoutTimer);
+            child.removeListener('error', onError);
+            child.removeListener('close', onClose);
+            if (onStderrData)
+                child.stderr.removeListener('data', onStderrData);
+            settle(value);
+        };
+        const onError = (error) => finish(reject, error);
+        const onClose = (code, signal) => finish(resolve, { code, signal });
+        settleExit = (error) => finish(reject, error);
+        child.once('error', onError);
+        child.once('close', onClose);
+    });
+    function requestCleanup() {
+        if (cleanupStarted || !settleExit)
+            return;
+        cleanupStarted = true;
+        child.stdin.destroy();
+        child.kill('SIGTERM');
+        forceKillTimer = setTimeout(() => child.kill('SIGKILL'), GIT_BATCH_TERM_GRACE_MS);
+        closeTimeoutTimer = setTimeout(() => {
+            child.kill('SIGKILL');
+            child.stdin.destroy();
+            child.stdout.destroy();
+            child.stderr.destroy();
+            child.unref();
+            settleExit(codedError('gitFailed', 'Git cat-file batch did not exit after forced termination.'));
+        }, GIT_BATCH_CLOSE_TIMEOUT_MS);
+    }
+    operationTimeoutTimer = setTimeout(() => {
+        operationTimedOut = true;
+        requestCleanup();
+    }, options.operationTimeoutMs ?? GIT_BATCH_OPERATION_TIMEOUT_MS);
+    const stderrChunks = [];
+    let stderrBytes = 0;
+    onStderrData = (value) => {
+        const valueBuffer = Buffer.isBuffer(value) ? value : Buffer.from(value);
+        stderrBytes += valueBuffer.length;
+        if (stderrBytes <= MAX_GIT_BLOB_BYTES)
+            stderrChunks.push(valueBuffer);
+        requestCleanup();
+    };
+    child.stderr.on('data', onStderrData);
+    const readTask = (async () => {
+        const reader = createBatchReader(child.stdout);
+        const contents = new Map();
+        for (const expectedObjectId of uniqueObjectIds) {
+            const header = await reader.readLine();
+            if (header === null) {
+                throw codedError('gitFailed', 'Git cat-file batch stdout ended before all blobs were returned.');
+            }
+            if (header === `${expectedObjectId} missing`) {
+                throw codedError('gitFailed', `Git blob ${expectedObjectId} is missing.`);
+            }
+            const match = /^(\S+) (\S+) (\S+)$/u.exec(header);
+            if (!match || match[1] !== expectedObjectId) {
+                throw codedError('gitFailed', 'Git cat-file batch returned a malformed header.');
+            }
+            if (match[2] !== 'blob') {
+                throw codedError('gitFailed', `Git object ${expectedObjectId} is not a blob.`);
+            }
+            if (!/^(?:0|[1-9][0-9]*)$/u.test(match[3])) {
+                throw codedError('gitFailed', `Git blob ${expectedObjectId} has an invalid size.`);
+            }
+            const size = Number(match[3]);
+            if (!Number.isSafeInteger(size) || size > MAX_GIT_BLOB_BYTES) {
+                throw codedError('gitFailed', `Git blob ${expectedObjectId} exceeds the size limit.`);
+            }
+            const content = await reader.readExact(size);
+            const separator = await reader.readExact(1);
+            if (separator[0] !== 0x0a) {
+                throw codedError('gitFailed', `Git blob ${expectedObjectId} has an invalid separator.`);
+            }
+            contents.set(expectedObjectId, content);
+        }
+        if (await reader.readLine() !== null) {
+            throw codedError('gitFailed', 'Git cat-file batch returned unexpected output.');
+        }
+        return contents;
+    })();
+    const writeTask = pipeline(Readable.from(uniqueObjectIds.map((objectId) => `${objectId}\n`)), child.stdin);
+    for (const task of [readTask, writeTask]) {
+        task.catch(requestCleanup);
+    }
+    const [readResult, writeResult, exitResult] = await Promise.allSettled([
+        readTask,
+        writeTask,
+        exitTask,
+    ]);
+    if (operationTimedOut) {
+        throw codedError('gitFailed', 'Git cat-file batch timed out.');
+    }
+    if (exitResult.status === 'rejected'
+        && exitResult.reason instanceof PluginVersionCheckError) {
+        throw exitResult.reason;
+    }
+    if (readResult.status === 'rejected')
+        throw readResult.reason;
+    if (writeResult.status === 'rejected') {
+        throw codedError('gitFailed', `Git cat-file batch input failed: ${writeResult.reason.message}`);
+    }
+    if (exitResult.status === 'rejected') {
+        throw codedError('gitFailed', `Git cat-file batch failed: ${exitResult.reason.message}`);
+    }
+    const stderr = Buffer.concat(stderrChunks).toString('utf8').trim();
+    if (stderrBytes > MAX_GIT_BLOB_BYTES) {
+        throw codedError('gitFailed', 'Git cat-file batch stderr exceeded the size limit.');
+    }
+    if (exitResult.value.signal) {
+        throw codedError('gitFailed', `Git cat-file batch ended from signal ${exitResult.value.signal}${stderr ? `: ${stderr}` : '.'}`);
+    }
+    if (exitResult.value.code !== 0 || stderr) {
+        throw codedError('gitFailed', `Git cat-file batch failed${stderr ? `: ${stderr}` : ` with exit code ${exitResult.value.code}.`}`);
+    }
+    return readResult.value;
+}
 async function materializeBaseAuthoringSourceSet(repoRoot, baseCommit, outputRoot, pluginRootPath) {
     const sourcePaths = [
         'plugins',
-        'packages/cli/package.json',
-        'packages/cli/src/utils/skill-frontmatter-capabilities.json',
-        'packages/cli/src/utils/plugin-authoring-capabilities.json',
     ];
     if (pluginRootPath && !sourcePaths.includes(pluginRootPath))
         sourcePaths.push(pluginRootPath);
     const output = await runGit(repoRoot, ['ls-tree', '-r', '-z', baseCommit, '--', ...sourcePaths], { buffer: true, label: 'Git authoring source tree' });
     const records = output.toString('utf8').split('\0').filter(Boolean).map(parseTreeRecord);
     for (const record of records) {
-        if (record.type !== 'blob')
-            continue;
+        if (record.type !== 'blob') {
+            throw codedError('gitFailed', `Git authoring source object ${record.objectId} is not a blob.`);
+        }
+    }
+    const contentsByObjectId = await readGitBlobsBatch(repoRoot, records.map((record) => record.objectId));
+    for (const record of records) {
         const normalizedPath = path.posix.normalize(record.filePath);
         if (normalizedPath !== record.filePath
             || normalizedPath === '..'
@@ -140,10 +353,10 @@ async function materializeBaseAuthoringSourceSet(repoRoot, baseCommit, outputRoo
         }
         const targetPath = path.join(outputRoot, ...normalizedPath.split('/'));
         await fs.mkdir(path.dirname(targetPath), { recursive: true });
-        const content = await runGit(repoRoot, ['cat-file', 'blob', record.objectId], {
-            buffer: true,
-            label: `Git blob ${record.objectId}`,
-        });
+        const content = contentsByObjectId.get(record.objectId);
+        if (!content) {
+            throw codedError('gitFailed', `Git blob ${record.objectId} was not returned.`);
+        }
         if (record.mode === '120000') {
             await fs.symlink(content.toString('utf8'), targetPath);
         }
@@ -162,203 +375,7 @@ async function lstatOrNull(filePath) {
         throw error;
     });
 }
-async function assertRegularFilePath(rootDir, relativePath, label) {
-    const rootStat = await lstatOrNull(rootDir);
-    if (!rootStat || rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-        throw codedError('invalidPlugin', `${label} root must be a non-symbolic-link directory.`);
-    }
-    let currentPath = rootDir;
-    const segments = relativePath.split('/');
-    for (const [index, segment] of segments.entries()) {
-        currentPath = path.join(currentPath, segment);
-        const stat = await lstatOrNull(currentPath);
-        if (!stat) {
-            throw codedError('invalidPlugin', `${label} is missing ${JSON.stringify(relativePath)}.`);
-        }
-        if (stat.isSymbolicLink()) {
-            throw codedError('invalidPlugin', `${label} contains a symbolic-link node: ${currentPath}`);
-        }
-        if (index < segments.length - 1 && !stat.isDirectory()) {
-            throw codedError('invalidPlugin', `${label} contains a non-directory path node: ${currentPath}`);
-        }
-        if (index === segments.length - 1 && !stat.isFile()) {
-            throw codedError('invalidPlugin', `${label} must use a regular file: ${currentPath}`);
-        }
-    }
-    return currentPath;
-}
-async function assertDirectoryPathChain(boundaryRoot, targetRoot, label) {
-    const relative = path.relative(boundaryRoot, targetRoot);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        throw codedError('invalidPlugin', `${label} source root must stay inside its workspace.`);
-    }
-    let currentPath = boundaryRoot;
-    for (const segment of relative.split(path.sep).filter(Boolean)) {
-        currentPath = path.join(currentPath, segment);
-        const stat = await lstatOrNull(currentPath);
-        if (!stat)
-            return;
-        if (stat.isSymbolicLink()) {
-            throw codedError('invalidPlugin', `${label} contains a symbolic-link path node: ${currentPath}`);
-        }
-        if (!stat.isDirectory()) {
-            throw codedError('invalidPlugin', `${label} contains a non-directory path node: ${currentPath}`);
-        }
-    }
-}
-function calculateCliSourceSetDigest(packageBytes, registryEntries) {
-    const hash = crypto.createHash('sha256').update('package.json\0').update(packageBytes);
-    for (const [relativePath, bytes] of registryEntries) {
-        hash.update(`\0${relativePath}\0`).update(bytes);
-    }
-    return `sha256:${hash.digest('hex')}`;
-}
-async function inspectWorkspaceCliSourceSet(cliRoot, label, boundaryRoot) {
-    if (boundaryRoot)
-        await assertDirectoryPathChain(boundaryRoot, cliRoot, label);
-    const packagePath = path.join(cliRoot, 'package.json');
-    const registryPaths = CLI_REGISTRY_RELATIVE_PATHS.map((relativePath) => path.join(cliRoot, ...relativePath.split('/')));
-    const [packageStat, ...registryStats] = await Promise.all([
-        lstatOrNull(packagePath),
-        ...registryPaths.map((registryPath) => lstatOrNull(registryPath)),
-    ]);
-    if (!packageStat && registryStats.every((stat) => !stat)) {
-        const cliRootStat = await lstatOrNull(cliRoot);
-        if (cliRootStat?.isSymbolicLink() || (cliRootStat && !cliRootStat.isDirectory())) {
-            throw codedError('invalidPlugin', `${label} @aw/cli source root has an invalid node: ${cliRoot}`);
-        }
-        return { state: 'none', root: cliRoot };
-    }
-    if (!packageStat || !registryStats[0]) {
-        return { state: 'partial', root: cliRoot };
-    }
-    const availableRegistryRelativePaths = CLI_REGISTRY_RELATIVE_PATHS
-        .filter((_relativePath, index) => registryStats[index]);
-    await Promise.all([
-        assertRegularFilePath(cliRoot, 'package.json', `${label} @aw/cli source set`),
-        ...availableRegistryRelativePaths.map((relativePath) => assertRegularFilePath(cliRoot, relativePath, `${label} @aw/cli source set`)),
-    ]);
-    const availableRegistryPaths = availableRegistryRelativePaths.map((relativePath) => path.join(cliRoot, ...relativePath.split('/')));
-    const [packageBytes, ...registryBytes] = await Promise.all([
-        fs.readFile(packagePath),
-        ...availableRegistryPaths.map((registryPath) => fs.readFile(registryPath)),
-    ]);
-    let packageDocument;
-    try {
-        packageDocument = JSON.parse(packageBytes.toString('utf8'));
-        for (const bytes of registryBytes)
-            JSON.parse(bytes.toString('utf8'));
-    }
-    catch (error) {
-        throw codedError('invalidPlugin', `${label} @aw/cli source set contains invalid JSON: ${error.message}`);
-    }
-    if (typeof packageDocument?.name !== 'string' || packageDocument.name.trim() === '') {
-        throw codedError('invalidPlugin', `${label} @aw/cli package name is missing.`);
-    }
-    parseStrictSemVer(packageDocument.version, `${label} @aw/cli package version`);
-    return {
-        state: 'complete',
-        root: cliRoot,
-        packageName: packageDocument.name,
-        providerVersion: packageDocument.version,
-        digest: calculateCliSourceSetDigest(packageBytes, availableRegistryRelativePaths.map((relativePath, index) => [relativePath, registryBytes[index]])),
-        registryRelativePaths: availableRegistryRelativePaths,
-    };
-}
-async function materializeCliSourceSet(source, outputRoot, label) {
-    await fs.mkdir(path.join(outputRoot, 'src', 'utils'), { recursive: true });
-    await Promise.all([
-        fs.copyFile(path.join(source.root, 'package.json'), path.join(outputRoot, 'package.json')),
-        ...source.registryRelativePaths.map((relativePath) => fs.copyFile(path.join(source.root, ...relativePath.split('/')), path.join(outputRoot, ...relativePath.split('/')))),
-    ]);
-    const materialized = await inspectWorkspaceCliSourceSet(outputRoot, label);
-    if (materialized.state !== 'complete'
-        || materialized.packageName !== source.packageName
-        || materialized.providerVersion !== source.providerVersion
-        || materialized.digest !== source.digest) {
-        throw codedError('invalidPlugin', `${label} @aw/cli source identity changed during materialization.`);
-    }
-    return materialized;
-}
-async function inspectExternalCliProvider(cliPackageRoot) {
-    const canonicalRoot = await fs.realpath(cliPackageRoot).catch(() => null);
-    if (!canonicalRoot) {
-        throw codedError('bundlerUnavailable', 'Plugin version checking cannot resolve the installed CLI package root.');
-    }
-    const packagePath = await assertRegularFilePath(canonicalRoot, 'package.json', 'Installed CLI provider');
-    const registryPaths = await Promise.all(CLI_REGISTRY_RELATIVE_PATHS.map((relativePath) => assertRegularFilePath(canonicalRoot, `dist/${relativePath}`, 'Installed CLI provider')));
-    const [packageBytes, ...registryBytes] = await Promise.all([
-        fs.readFile(packagePath),
-        ...registryPaths.map((registryPath) => fs.readFile(registryPath)),
-    ]);
-    let packageDocument;
-    try {
-        packageDocument = JSON.parse(packageBytes.toString('utf8'));
-        for (const bytes of registryBytes)
-            JSON.parse(bytes.toString('utf8'));
-    }
-    catch (error) {
-        throw codedError('bundlerUnavailable', `Installed CLI provider contains invalid JSON: ${error.message}`);
-    }
-    if (packageDocument?.name !== CLI_PACKAGE_NAME) {
-        throw codedError('bundlerUnavailable', `Installed CLI provider package name must be ${JSON.stringify(CLI_PACKAGE_NAME)}.`);
-    }
-    parseStrictSemVer(packageDocument.version, 'installed CLI provider version');
-    return {
-        root: canonicalRoot,
-        packagePath,
-        registryPaths,
-        packageName: packageDocument.name,
-        providerVersion: packageDocument.version,
-        digest: calculateCliSourceSetDigest(packageBytes, CLI_REGISTRY_RELATIVE_PATHS.map((relativePath, index) => [relativePath, registryBytes[index]])),
-    };
-}
-async function materializeExternalCliProvider(provider, outputRoot, label) {
-    await fs.mkdir(path.join(outputRoot, 'src', 'utils'), { recursive: true });
-    await Promise.all([
-        fs.copyFile(provider.packagePath, path.join(outputRoot, 'package.json')),
-        ...CLI_REGISTRY_RELATIVE_PATHS.map((relativePath, index) => fs.copyFile(provider.registryPaths[index], path.join(outputRoot, ...relativePath.split('/')))),
-    ]);
-    return inspectWorkspaceCliSourceSet(outputRoot, label);
-}
-async function resolveCliVirtualSourceSets(options) {
-    const baseSource = await inspectWorkspaceCliSourceSet(path.join(options.baseSourceRoot, 'packages', 'cli'), 'Git base', options.baseSourceRoot);
-    const currentSource = await inspectWorkspaceCliSourceSet(path.join(options.repoRoot, 'packages', 'cli'), 'current workspace', options.repoRoot);
-    if (baseSource.state === 'partial') {
-        throw codedError('invalidPlugin', 'Git base contains an incomplete @aw/cli virtual authoring source set.');
-    }
-    if (currentSource.state === 'partial') {
-        throw codedError('invalidPlugin', 'Found an incomplete current workspace @aw/cli source set.');
-    }
-    if (baseSource.state !== currentSource.state) {
-        throw codedError('invalidPlugin', 'Git base and current workspace CLI source ownership differs; version checking cannot mix workspace and external providers.');
-    }
-    if (baseSource.state === 'complete') {
-        const currentMaterialized = await materializeCliSourceSet(currentSource, path.join(options.tempRoot, 'current-cli-workspace'), 'current workspace materialization');
-        return {
-            base: baseSource,
-            current: currentMaterialized,
-        };
-    }
-    const externalProvider = await inspectExternalCliProvider(options.cliPackageRoot);
-    const [baseExternal, currentExternal] = await Promise.all([
-        materializeExternalCliProvider(externalProvider, path.join(options.tempRoot, 'base-cli-external'), 'base external CLI provider'),
-        materializeExternalCliProvider(externalProvider, path.join(options.tempRoot, 'current-cli-external'), 'current external CLI provider'),
-    ]);
-    for (const materialized of [baseExternal, currentExternal]) {
-        if (materialized.state !== 'complete'
-            || materialized.packageName !== externalProvider.packageName
-            || materialized.providerVersion !== externalProvider.providerVersion
-            || materialized.digest !== externalProvider.digest) {
-            throw codedError('invalidPlugin', 'External CLI provider identity changed during independent materialization.');
-        }
-    }
-    if (baseExternal.root === currentExternal.root || baseExternal.digest !== currentExternal.digest) {
-        throw codedError('invalidPlugin', 'External CLI provider materializations are not independent and identical.');
-    }
-    return { base: baseExternal, current: currentExternal };
-}
-async function readManifestDocument(pluginRoot) {
+export async function readManifestDocument(pluginRoot) {
     const manifestPath = path.join(pluginRoot, '.agents-plugin', 'plugin.json');
     let manifest;
     try {
@@ -401,16 +418,13 @@ function compareBundleEntries(baseEntries, currentEntries) {
         .filter((filePath) => baseEntries.get(filePath) !== currentEntries.get(filePath))
         .sort();
 }
-async function bundlePlugin(bundler, sourceSetRoot, cliVirtualExportRoot, cliProviderVersion, pluginRoot, outputRoot, runtimeSkillClosureValidation = 'current') {
+async function bundlePlugin(bundler, sourceSetRoot, pluginRoot, outputRoot, runtimeSkillClosureValidation = 'current') {
     const sourceSetPlugins = await bundler.discoverPlugins(sourceSetRoot);
     const plugin = await bundler.readPluginManifest(pluginRoot);
     if (!sourceSetPlugins.some((candidate) => candidate.manifest.name === plugin.manifest.name)) {
         sourceSetPlugins.push(plugin);
     }
-    const runtimeResolver = bundler.createRuntimeResolver(sourceSetPlugins, {
-        cliVirtualExportRoot,
-        cliProviderVersion,
-    });
+    const runtimeResolver = bundler.createRuntimeResolver(sourceSetPlugins);
     await bundler.bundleLocalPlugin(plugin, outputRoot, {
         buildMode: 'staging',
         runtimeResolver,
@@ -439,7 +453,7 @@ function createCheckResult(pluginName, values = {}) {
     };
 }
 async function checkOnePlugin(options) {
-    const { repoRoot, pluginName, bundler, tempRoot, baseSourceRoot, cliVirtualSources, currentRoot, baseRoot, } = options;
+    const { repoRoot, pluginName, bundler, tempRoot, baseSourceRoot, currentRoot, baseRoot, } = options;
     if (!PLUGIN_NAME_PATTERN.test(pluginName)) {
         return createCheckResult(pluginName, {
             ok: false,
@@ -476,7 +490,7 @@ async function checkOnePlugin(options) {
     if (!baseRoot) {
         let currentBundle;
         try {
-            currentBundle = await bundlePlugin(bundler, repoRoot, cliVirtualSources.current.root, cliVirtualSources.current.providerVersion, currentRoot, path.join(tempRoot, 'bundles', pluginName, 'current'));
+            currentBundle = await bundlePlugin(bundler, repoRoot, currentRoot, path.join(tempRoot, 'bundles', pluginName, 'current'));
         }
         catch (error) {
             return createCheckResult(pluginName, {
@@ -520,8 +534,8 @@ async function checkOnePlugin(options) {
     let bundleResults;
     try {
         bundleResults = await Promise.allSettled([
-            bundlePlugin(bundler, baseSourceRoot, cliVirtualSources.base.root, cliVirtualSources.base.providerVersion, baseRoot, path.join(tempRoot, 'bundles', pluginName, 'base'), 'historical'),
-            bundlePlugin(bundler, repoRoot, cliVirtualSources.current.root, cliVirtualSources.current.providerVersion, currentRoot, path.join(tempRoot, 'bundles', pluginName, 'current')),
+            bundlePlugin(bundler, baseSourceRoot, baseRoot, path.join(tempRoot, 'bundles', pluginName, 'base'), 'historical'),
+            bundlePlugin(bundler, repoRoot, currentRoot, path.join(tempRoot, 'bundles', pluginName, 'current')),
         ]);
     }
     finally {
@@ -702,12 +716,6 @@ export async function checkPluginVersions(options = {}) {
             }
             currentRoots.set(pluginName, currentRoot);
         }
-        const cliVirtualSources = await resolveCliVirtualSourceSets({
-            baseSourceRoot,
-            repoRoot,
-            cliPackageRoot,
-            tempRoot,
-        });
         const checks = [];
         for (const pluginName of pluginNames) {
             const currentRoot = currentRoots.get(pluginName);
@@ -730,7 +738,6 @@ export async function checkPluginVersions(options = {}) {
                 bundler,
                 tempRoot,
                 baseSourceRoot,
-                cliVirtualSources,
                 currentRoot,
                 baseRoot,
             }));