@mc-and-his-agents/loom-installer 0.1.1

package/README.md

@@ -0,0 +1,47 @@
+# @mc-and-his-agents/loom-installer
+
+Loom 的 npm / npx 安装入口。
+
+它负责两件事：
+
+- 把 Loom 作为完整 plugin 接到 Codex 或 Claude
+- 把某个单独 Loom skill 接到对应宿主
+
+它不替代 Loom 当前的 Python runtime；真正的执行面仍然是仓库里的 Python 脚本与已发布的 skill / plugin 产物。
+
+## 命令面
+
+```bash
+npx @mc-and-his-agents/loom-installer add plugin
+npx @mc-and-his-agents/loom-installer add skill loom-init
+```
+
+也可以先安装再执行：
+
+```bash
+npm install -D @mc-and-his-agents/loom-installer
+npx loom-installer add plugin
+npx loom-installer add skill loom-init
+```
+
+可选参数：
+
+- `--host codex|claude|auto`
+- `--target <repo-root>`
+- `--force`
+- `--json`
+
+## 运行时要求
+
+- Node `>=20`
+- Python `>=3.10`，推荐 `3.11+`
+
+## 发布说明
+
+本包支持 `npm publish`，但发布只在 `main` 上进行。
+
+发布模型：
+
+- PR 只做门禁，不直接发布 npm
+- `main` 是唯一发布真相源
+- publish 成功后再创建同版本 git tag

package/dist/src/claude.js

@@ -0,0 +1,157 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { InstallerError, copyTree, dirExists, ensureDirectory, fileExists, readJson, replaceTree, runCommand, writeJson } from './utils.js';
+function claudeEnv(env) {
+    return {
+        ...process.env,
+        CLAUDE_CONFIG_DIR: env.claudeConfigDir,
+    };
+}
+function claudeMarketplaceRoot(targetRoot) {
+    return join(targetRoot, '.claude', 'marketplaces', 'loom-local');
+}
+function claudeMarketplaceManifest() {
+    return {
+        $schema: 'https://anthropic.com/claude-code/marketplace.schema.json',
+        name: 'loom-local',
+        description: 'Repo-local Loom marketplace for plugin installation.',
+        owner: {
+            name: 'MC and his Agents',
+            email: 'opensource@mc-and-his-agents.dev',
+        },
+        plugins: [
+            {
+                name: 'loom',
+                description: 'Loom repo-local plugin entry',
+                source: './plugins/loom',
+                category: 'productivity',
+                homepage: 'https://github.com/MC-and-his-Agents/Loom',
+            },
+        ],
+    };
+}
+function runClaude(env, args) {
+    return runCommand(env.claudeBin, args, claudeEnv(env));
+}
+function synthesizeClaudePluginManifest(pluginTarget) {
+    const codexManifestPath = join(pluginTarget, '.codex-plugin', 'plugin.json');
+    if (!fileExists(codexManifestPath)) {
+        throw new InstallerError(`Claude plugin install is missing source plugin manifest: ${codexManifestPath}`);
+    }
+    const codexManifest = readJson(codexManifestPath);
+    const claudeManifestPath = join(pluginTarget, '.claude-plugin', 'plugin.json');
+    writeJson(claudeManifestPath, {
+        name: codexManifest.name,
+        description: codexManifest.description ?? 'Loom repo-local plugin entry',
+        version: codexManifest.version ?? '0.0.0',
+        author: codexManifest.author ?? {
+            name: 'MC and his Agents',
+            email: 'opensource@mc-and-his-agents.dev',
+        },
+    });
+    return claudeManifestPath;
+}
+function verifyClaudePluginInstalled(env) {
+    const result = runClaude(env, ['plugin', 'list', '--json']);
+    if (result.status !== 0) {
+        throw new InstallerError(`claude plugin list failed: ${result.stderr || result.stdout}`.trim());
+    }
+    let payload;
+    try {
+        payload = JSON.parse(result.stdout || '[]');
+    }
+    catch {
+        throw new InstallerError('claude plugin list --json returned invalid JSON');
+    }
+    if (!Array.isArray(payload)) {
+        throw new InstallerError('claude plugin list --json must return an array');
+    }
+    const found = payload.some((entry) => {
+        if (typeof entry === 'string') {
+            return entry === 'loom';
+        }
+        if (typeof entry !== 'object' || entry === null) {
+            return false;
+        }
+        return entry.name === 'loom';
+    });
+    if (!found) {
+        throw new InstallerError('claude plugin verify failed: loom is not listed as installed');
+    }
+}
+export function installClaudePlugin(env, targetRoot, packageRoot, manifest, force) {
+    const marketplaceRoot = claudeMarketplaceRoot(targetRoot);
+    const marketplaceManifestPath = join(marketplaceRoot, '.claude-plugin', 'marketplace.json');
+    const pluginTarget = join(marketplaceRoot, 'plugins', 'loom');
+    const pluginSource = join(packageRoot, 'payload', manifest.plugin.relative_path);
+    ensureDirectory(join(marketplaceRoot, '.claude-plugin'));
+    ensureDirectory(join(marketplaceRoot, 'plugins'));
+    if (dirExists(pluginTarget)) {
+        if (!force && !fileExists(join(pluginTarget, '.codex-plugin', 'plugin.json'))) {
+            throw new InstallerError(`existing Claude marketplace plugin is not Loom-managed: ${pluginTarget}`, `refusing to take over non-Loom Claude marketplace plugin: ${pluginTarget}`);
+        }
+        replaceTree(pluginSource, pluginTarget);
+    }
+    else {
+        copyTree(pluginSource, pluginTarget, true);
+    }
+    const claudePluginManifestPath = synthesizeClaudePluginManifest(pluginTarget);
+    writeJson(marketplaceManifestPath, claudeMarketplaceManifest());
+    const addResult = runClaude(env, ['plugin', 'marketplace', 'add', marketplaceRoot]);
+    const addOutput = `${addResult.stdout}\n${addResult.stderr}`;
+    if (addResult.status !== 0 && !/already exists|already added|already configured/i.test(addOutput)) {
+        throw new InstallerError(`claude plugin marketplace add failed: ${addOutput.trim()}`);
+    }
+    const installResult = runClaude(env, ['plugin', 'install', 'loom@loom-local']);
+    const installOutput = `${installResult.stdout}\n${installResult.stderr}`;
+    if (installResult.status !== 0 && !/already installed/i.test(installOutput)) {
+        throw new InstallerError(`claude plugin install failed: ${installOutput.trim()}`);
+    }
+    verifyClaudePluginInstalled(env);
+    return {
+        mode: 'plugin',
+        host: 'claude',
+        status: /already installed/i.test(installOutput) ? 'already-installed' : 'installed',
+        installed_paths: [marketplaceRoot, marketplaceManifestPath, pluginTarget, claudePluginManifestPath],
+        verification: [
+            `verified marketplace source at ${marketplaceRoot}`,
+            `verified Claude plugin manifest at ${claudePluginManifestPath}`,
+            'verified `claude plugin list --json` contains loom',
+        ],
+        warnings: ['Claude plugin install goes through the official CLI and does not replace the Python runtime.'],
+        fail_closed_reason: null,
+    };
+}
+export function installClaudeSkill(targetRoot, packageRoot, skill, force) {
+    const sourceDir = join(packageRoot, 'payload', skill.relative_path);
+    const targetDir = join(targetRoot, '.claude', 'skills', skill.id);
+    const skillMarkdownPath = join(targetDir, 'SKILL.md');
+    ensureDirectory(join(targetRoot, '.claude', 'skills'));
+    if (dirExists(targetDir)) {
+        if (!force && !fileExists(skillMarkdownPath)) {
+            throw new InstallerError(`existing Claude skill directory is not Loom-managed: ${targetDir}`, `refusing to take over non-Loom Claude skill directory: ${targetDir}`);
+        }
+        replaceTree(sourceDir, targetDir);
+    }
+    else {
+        copyTree(sourceDir, targetDir, true);
+    }
+    if (!fileExists(skillMarkdownPath)) {
+        throw new InstallerError(`Claude skill install is missing SKILL.md: ${skillMarkdownPath}`);
+    }
+    if (!readFileSync(skillMarkdownPath, 'utf8').startsWith('---\n')) {
+        throw new InstallerError(`Claude skill install must keep YAML frontmatter in ${skillMarkdownPath}`);
+    }
+    return {
+        mode: 'skill',
+        host: 'claude',
+        status: 'installed',
+        installed_paths: [targetDir],
+        verification: [
+            `verified skill payload at ${targetDir}`,
+            `verified discoverable SKILL.md at ${skillMarkdownPath}`,
+        ],
+        warnings: ['Claude single-skill install relies on project-level `.claude/skills` discovery and does not expose the full Loom plugin surface.'],
+        fail_closed_reason: null,
+    };
+}

package/dist/src/cli.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { formatResult, parseCli, runInstaller } from './index.js';
+import { InstallerError } from './utils.js';
+function errorResult(message) {
+    return {
+        mode: 'plugin',
+        host: 'codex',
+        status: 'installed',
+        installed_paths: [],
+        verification: [],
+        warnings: [],
+        fail_closed_reason: message,
+    };
+}
+try {
+    const parsed = parseCli(process.argv.slice(2));
+    const result = runInstaller(parsed);
+    if (parsed.options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${formatResult(result)}\n`);
+    }
+}
+catch (error) {
+    const message = error instanceof InstallerError ? error.failClosedReason : error instanceof Error ? error.message : String(error);
+    const parsedJson = process.argv.includes('--json');
+    if (parsedJson) {
+        process.stdout.write(`${JSON.stringify(errorResult(message), null, 2)}\n`);
+    }
+    else {
+        process.stderr.write(`loom-installer: ${message}\n`);
+    }
+    process.exit(1);
+}

package/dist/src/codex.js

@@ -0,0 +1,191 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { InstallerError, copyTree, dirExists, ensureDirectory, fileExists, readJson, replaceTree, writeJson } from './utils.js';
+function codexMarketplacePath(targetRoot) {
+    return join(targetRoot, '.agents', 'plugins', 'marketplace.json');
+}
+function parseMarketplace(path) {
+    if (!fileExists(path)) {
+        return null;
+    }
+    return readJson(path);
+}
+function defaultMarketplace() {
+    return {
+        name: 'loom-local',
+        interface: {
+            displayName: 'Loom Local Plugins',
+        },
+        plugins: [],
+    };
+}
+function loomMarketplaceEntry() {
+    return {
+        name: 'loom',
+        source: {
+            source: 'local',
+            path: './plugins/loom',
+        },
+        policy: {
+            installation: 'AVAILABLE',
+            authentication: 'ON_INSTALL',
+        },
+        category: 'Productivity',
+    };
+}
+function ensureMarketplace(targetRoot, force) {
+    const marketplacePath = codexMarketplacePath(targetRoot);
+    const marketplace = parseMarketplace(marketplacePath) ?? defaultMarketplace();
+    if (!Array.isArray(marketplace.plugins)) {
+        throw new InstallerError('Codex marketplace.json must contain a plugins array');
+    }
+    const expectedPath = './plugins/loom';
+    const existing = marketplace.plugins.find((entry) => typeof entry === 'object' && entry !== null && entry.name === 'loom');
+    if (existing && existing.source?.path && existing.source.path !== expectedPath) {
+        throw new InstallerError(`Codex marketplace already declares loom from a different path: ${existing.source.path}`, `refusing to take over non-Loom marketplace entry for loom: ${existing.source.path}`);
+    }
+    if (!existing) {
+        marketplace.plugins.push(loomMarketplaceEntry());
+    }
+    else if (force) {
+        const index = marketplace.plugins.indexOf(existing);
+        marketplace.plugins[index] = loomMarketplaceEntry();
+    }
+    writeJson(marketplacePath, marketplace);
+    return [marketplacePath];
+}
+function parseSkillBlocks(content) {
+    const lines = content.split('\n');
+    const blocks = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        if (lines[index].trim() !== '[[skills.config]]') {
+            continue;
+        }
+        const blockLines = [lines[index]];
+        index += 1;
+        while (index < lines.length && !lines[index].trim().startsWith('[[')) {
+            blockLines.push(lines[index]);
+            index += 1;
+        }
+        index -= 1;
+        const raw = blockLines.join('\n');
+        const pathMatch = raw.match(/^path\s*=\s*"([^"]+)"/m);
+        const enabledMatch = raw.match(/^enabled\s*=\s*(true|false)/m);
+        blocks.push({
+            raw,
+            path: pathMatch?.[1] ?? null,
+            enabled: enabledMatch ? enabledMatch[1] === 'true' : null,
+        });
+    }
+    return blocks;
+}
+function upsertSkillBlock(configPath, desiredSkillPath, skillId, force) {
+    const content = fileExists(configPath) ? readFileSync(configPath, 'utf8') : '';
+    const blocks = parseSkillBlocks(content);
+    const skillDir = skillId.startsWith('loom-') ? skillId : `loom-${skillId}`;
+    const conflicting = blocks.filter((block) => {
+        if (!block.path) {
+            return false;
+        }
+        return block.path.endsWith(`/${skillDir}/SKILL.md`) && block.path !== desiredSkillPath;
+    });
+    if (conflicting.length > 0 && !force) {
+        throw new InstallerError(`Codex already has ${skillId} from a different path`, `Codex already has ${skillId} from a different path`);
+    }
+    let nextContent = content;
+    for (const block of conflicting) {
+        nextContent = nextContent.replace(`${block.raw}\n`, '').replace(block.raw, '');
+    }
+    const existingBlock = parseSkillBlocks(nextContent).find((block) => block.path === desiredSkillPath);
+    if (existingBlock) {
+        const enabledBlock = existingBlock.raw.match(/^enabled\s*=\s*false/m)
+            ? existingBlock.raw.replace(/^enabled\s*=\s*false/m, 'enabled = true')
+            : existingBlock.enabled === null
+                ? `${existingBlock.raw}\nenabled = true`
+                : existingBlock.raw;
+        nextContent = nextContent.replace(existingBlock.raw, enabledBlock);
+    }
+    else {
+        if (nextContent && !nextContent.endsWith('\n')) {
+            nextContent += '\n';
+        }
+        nextContent += `\n[[skills.config]]\npath = ${JSON.stringify(desiredSkillPath)}\nenabled = true\n`;
+    }
+    ensureDirectory(join(configPath, '..'));
+    writeFileSync(configPath, nextContent.replace(/^\n+/, ''), 'utf8');
+}
+function verifySkillEnabled(configPath, desiredSkillPath) {
+    const content = fileExists(configPath) ? readFileSync(configPath, 'utf8') : '';
+    return parseSkillBlocks(content).some((block) => block.path === desiredSkillPath && block.enabled !== false);
+}
+export function installCodexPlugin(targetRoot, packageRoot, manifest, force) {
+    const pluginSource = join(packageRoot, 'payload', manifest.plugin.relative_path);
+    const pluginTarget = join(targetRoot, 'plugins', 'loom');
+    const pluginManifestPath = join(pluginTarget, '.codex-plugin', 'plugin.json');
+    const installedPaths = [];
+    const warnings = [];
+    if (dirExists(pluginTarget) && !force) {
+        if (!fileExists(pluginManifestPath)) {
+            throw new InstallerError(`target already contains plugins/loom but it is not a Loom plugin: ${pluginTarget}`, `refusing to take over non-Loom plugin directory: ${pluginTarget}`);
+        }
+    }
+    if (dirExists(pluginTarget)) {
+        replaceTree(pluginSource, pluginTarget);
+    }
+    else {
+        copyTree(pluginSource, pluginTarget, true);
+    }
+    installedPaths.push(pluginTarget);
+    installedPaths.push(...ensureMarketplace(targetRoot, force));
+    const pluginManifest = readJson(pluginManifestPath);
+    if (pluginManifest.name !== 'loom') {
+        throw new InstallerError('Codex plugin installation drifted: plugin name must stay `loom`');
+    }
+    warnings.push('Codex plugin install remains repo-local; it does not replace the Python runtime.');
+    return {
+        mode: 'plugin',
+        host: 'codex',
+        status: 'installed',
+        installed_paths: installedPaths,
+        verification: [
+            `verified plugin payload at ${pluginTarget}`,
+            `verified marketplace entry at ${codexMarketplacePath(targetRoot)}`,
+        ],
+        warnings,
+        fail_closed_reason: null,
+    };
+}
+export function installCodexSkill(env, packageRoot, skill, force) {
+    const skillDirName = skill.id.startsWith('loom-') ? skill.id : `loom-${skill.id}`;
+    const sourceDir = join(packageRoot, 'payload', skill.relative_path);
+    const targetDir = join(env.codexHome, 'skills', skillDirName);
+    const skillMarkdownPath = join(targetDir, 'SKILL.md');
+    const configPath = join(env.codexHome, 'config.toml');
+    ensureDirectory(join(env.codexHome, 'skills'));
+    if (dirExists(targetDir)) {
+        if (!force && !fileExists(skillMarkdownPath)) {
+            throw new InstallerError(`existing Codex skill directory is not Loom-managed: ${targetDir}`, `refusing to take over non-Loom Codex skill directory: ${targetDir}`);
+        }
+        replaceTree(sourceDir, targetDir);
+    }
+    else {
+        copyTree(sourceDir, targetDir, true);
+    }
+    ensureDirectory(env.codexHome);
+    upsertSkillBlock(configPath, skillMarkdownPath, skill.id, force);
+    if (!verifySkillEnabled(configPath, skillMarkdownPath)) {
+        throw new InstallerError(`Codex config did not enable ${skill.id}`);
+    }
+    return {
+        mode: 'skill',
+        host: 'codex',
+        status: 'installed',
+        installed_paths: [targetDir, configPath],
+        verification: [
+            `verified skill payload at ${targetDir}`,
+            `verified skills.config entry for ${skill.id}`,
+        ],
+        warnings: ['Codex single-skill install exposes only the named skill, not the full Loom plugin surface.'],
+        fail_closed_reason: null,
+    };
+}

package/dist/src/index.js

@@ -0,0 +1,175 @@
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { InstallerError, assert, dirExists, ensureTargetWritable, runCommand } from './utils.js';
+import { loadPayloadManifest, resolveSkillRecord, verifyPayload } from './payload.js';
+import { installCodexPlugin, installCodexSkill } from './codex.js';
+import { installClaudePlugin, installClaudeSkill } from './claude.js';
+const DEFAULT_OPTIONS = {
+    host: 'auto',
+    target: '.',
+    force: false,
+    json: false,
+};
+export function packageRootFromUrl(moduleUrl) {
+    return resolve(dirname(fileURLToPath(moduleUrl)), '..', '..');
+}
+export function resolveEnvironment(env = process.env) {
+    const homeDir = env.HOME ?? '';
+    assert(homeDir, 'HOME is required');
+    return {
+        homeDir,
+        codexHome: env.CODEX_HOME ?? join(homeDir, '.codex'),
+        claudeConfigDir: env.CLAUDE_CONFIG_DIR ?? join(homeDir, '.claude'),
+        pythonBin: env.LOOM_INSTALLER_PYTHON_BIN ?? 'python3',
+        claudeBin: env.LOOM_INSTALLER_CLAUDE_BIN ?? 'claude',
+    };
+}
+export function detectHosts(env) {
+    const hosts = [];
+    if (dirExists(env.codexHome)) {
+        hosts.push('codex');
+    }
+    if (dirExists(env.claudeConfigDir)) {
+        hosts.push('claude');
+    }
+    return hosts;
+}
+export function selectHost(requested, env) {
+    if (requested !== 'auto') {
+        return requested;
+    }
+    const detected = detectHosts(env);
+    if (detected.length === 1) {
+        return detected[0];
+    }
+    if (detected.length === 0) {
+        throw new InstallerError('auto host detection failed: no supported host was detected');
+    }
+    throw new InstallerError('auto host detection found both Codex and Claude; pass --host explicitly');
+}
+export function parseCli(argv) {
+    const command = argv[0];
+    const subject = argv[1];
+    const third = argv[2];
+    const rest = subject === 'plugin' ? argv.slice(2) : argv.slice(3);
+    if (command !== 'add') {
+        throw new InstallerError('usage: loom-installer add plugin|skill <skill-id> [--host ...] [--target ...] [--force] [--json]');
+    }
+    const options = { ...DEFAULT_OPTIONS };
+    for (let index = 0; index < rest.length; index += 1) {
+        const token = rest[index];
+        if (token === '--host') {
+            const next = rest[index + 1];
+            if (next !== 'auto' && next !== 'codex' && next !== 'claude') {
+                throw new InstallerError(`unsupported --host value: ${String(next)}`);
+            }
+            options.host = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--target') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new InstallerError('--target requires a value');
+            }
+            options.target = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--force') {
+            options.force = true;
+            continue;
+        }
+        if (token === '--json') {
+            options.json = true;
+            continue;
+        }
+        throw new InstallerError(`unknown option: ${token}`);
+    }
+    if (subject === 'plugin') {
+        return {
+            mode: 'plugin',
+            options,
+        };
+    }
+    if (subject === 'skill') {
+        if (!third) {
+            throw new InstallerError('usage: loom-installer add skill <skill-id>');
+        }
+        return {
+            mode: 'skill',
+            skillId: third,
+            options,
+        };
+    }
+    throw new InstallerError(`unknown add target: ${String(subject)}`);
+}
+export function checkPython(env) {
+    const result = runCommand(env.pythonBin, ['-c', 'import sys; print(f"{sys.version_info[0]}.{sys.version_info[1]}.{sys.version_info[2]}")'], process.env);
+    if (result.status !== 0) {
+        throw new InstallerError(`python preflight failed: ${result.stderr || result.stdout}`.trim());
+    }
+    const match = result.stdout.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!match) {
+        throw new InstallerError(`python preflight returned an invalid version: ${result.stdout.trim()}`);
+    }
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    if (major < 3 || (major === 3 && minor < 10)) {
+        throw new InstallerError(`python ${result.stdout.trim()} is unsupported; require >= 3.10`);
+    }
+    const warnings = [];
+    if (major === 3 && minor < 11) {
+        warnings.push(`python ${result.stdout.trim()} is supported, but 3.11+ is recommended`);
+    }
+    return warnings;
+}
+export function ensureClaudeCliWhenNeeded(host, mode, env) {
+    if (host !== 'claude' || mode !== 'plugin') {
+        return;
+    }
+    const result = runCommand(env.claudeBin, ['--version'], process.env);
+    if (result.status !== 0) {
+        throw new InstallerError(`claude CLI preflight failed: ${result.stderr || result.stdout}`.trim());
+    }
+}
+export function formatResult(result) {
+    return [
+        `${result.host} ${result.mode}: ${result.status}`,
+        ...result.verification.map((line) => `- ${line}`),
+        ...result.warnings.map((line) => `! ${line}`),
+    ].join('\n');
+}
+export function runInstaller(parsed, envSource = process.env, packageRoot) {
+    const resolvedEnv = resolveEnvironment(envSource);
+    const host = selectHost(parsed.options.host, resolvedEnv);
+    const resolvedPackageRoot = packageRoot ?? packageRootFromUrl(import.meta.url);
+    const targetRoot = resolve(parsed.options.target);
+    ensureTargetWritable(targetRoot);
+    const manifest = loadPayloadManifest(resolvedPackageRoot);
+    verifyPayload(resolvedPackageRoot, manifest);
+    const warnings = checkPython(resolvedEnv);
+    ensureClaudeCliWhenNeeded(host, parsed.mode, resolvedEnv);
+    const result = installForHost({
+        host,
+        parsed,
+        env: resolvedEnv,
+        packageRoot: resolvedPackageRoot,
+        targetRoot,
+        manifest,
+    });
+    result.warnings.unshift(...warnings);
+    return result;
+}
+function installForHost(input) {
+    const { host, parsed, env, packageRoot, targetRoot, manifest } = input;
+    if (parsed.mode === 'plugin') {
+        return host === 'codex'
+            ? installCodexPlugin(targetRoot, packageRoot, manifest, parsed.options.force)
+            : installClaudePlugin(env, targetRoot, packageRoot, manifest, parsed.options.force);
+    }
+    const skill = resolveSkillRecord(manifest, parsed.skillId ?? '');
+    return host === 'codex'
+        ? installCodexSkill(env, packageRoot, skill, parsed.options.force)
+        : installClaudeSkill(targetRoot, packageRoot, skill, parsed.options.force);
+}

package/dist/src/payload.js

@@ -0,0 +1,42 @@
+import { join } from 'node:path';
+import { InstallerError, dirExists, fileExists, readJson, sha256 } from './utils.js';
+export function loadPayloadManifest(packageRoot) {
+    const manifestPath = join(packageRoot, 'payload', 'manifest.json');
+    if (!fileExists(manifestPath)) {
+        throw new InstallerError(`payload manifest is missing: ${manifestPath}`);
+    }
+    return readJson(manifestPath);
+}
+export function verifyPayload(packageRoot, manifest) {
+    if (manifest.schema_version !== 'loom-installer-payload/v1') {
+        throw new InstallerError(`unsupported payload schema: ${manifest.schema_version}`);
+    }
+    const payloadRoot = join(packageRoot, 'payload');
+    const pluginPath = join(payloadRoot, manifest.plugin.relative_path);
+    if (!dirExists(pluginPath)) {
+        throw new InstallerError(`plugin payload is missing: ${pluginPath}`);
+    }
+    for (const skill of manifest.skills) {
+        const skillPath = join(payloadRoot, skill.relative_path);
+        if (!dirExists(skillPath)) {
+            throw new InstallerError(`skill payload is missing: ${skillPath}`);
+        }
+    }
+    for (const file of manifest.files) {
+        const absolute = join(payloadRoot, file.path);
+        if (!fileExists(absolute)) {
+            throw new InstallerError(`payload file is missing: ${file.path}`);
+        }
+        const actualSha = sha256(absolute);
+        if (actualSha !== file.sha256) {
+            throw new InstallerError(`payload checksum drift detected for ${file.path}`);
+        }
+    }
+}
+export function resolveSkillRecord(manifest, skillId) {
+    const skill = manifest.skills.find((candidate) => candidate.id === skillId);
+    if (!skill) {
+        throw new InstallerError(`unknown skill id: ${skillId}`, `unknown skill id: ${skillId}`);
+    }
+    return skill;
+}

package/dist/src/types.js

@@ -0,0 +1 @@
+export {};