@mstar-harness/cli 1.8.8 → 1.8.9

package/dist/mstar-harness.js

@@ -2343,6 +2343,10 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// src/index.ts
+import fs9 from "fs";
+import path11 from "path";
+
 // ../../node_modules/@inquirer/core/dist/lib/key.js
 var isUpKey = (key, keybindings = []) => key.name === "up" || keybindings.includes("vim") && key.name === "k" || keybindings.includes("emacs") && key.ctrl && key.name === "p";
 var isDownKey = (key, keybindings = []) => key.name === "down" || keybindings.includes("vim") && key.name === "j" || keybindings.includes("emacs") && key.ctrl && key.name === "n";
@@ -3969,6 +3973,442 @@ var {
   Help
 } = import__.default;
 
+// src/agent-plugins.ts
+import fs2 from "node:fs";
+import path3 from "node:path";
+
+// src/utils.ts
+import fs from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+function ensureObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  return {};
+}
+function readJson(filePath) {
+  if (!fs.existsSync(filePath))
+    return {};
+  const content = fs.readFileSync(filePath, "utf8").trim();
+  if (!content)
+    return {};
+  try {
+    return JSON.parse(content);
+  } catch (error) {
+    throw new Error(`Invalid JSON in ${filePath}: ${error.message}`);
+  }
+}
+function writeJson(filePath, value) {
+  const parent = path2.dirname(filePath);
+  if (!fs.existsSync(parent))
+    fs.mkdirSync(parent, { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function resolveProjectRoot() {
+  const candidate = process.env.MSTAR_CLI_PROJECT_ROOT || process.env.INIT_CWD || process.env.PWD;
+  if (candidate && candidate.trim())
+    return path2.resolve(candidate);
+  return process.cwd();
+}
+function readHarnessVersion() {
+  const packageJsonPath = path2.resolve(path2.dirname(fileURLToPath(import.meta.url)), "../package.json");
+  try {
+    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+    return parsed.version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+// src/agent-plugins.ts
+var PLUGIN_SCHEMA_URL = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+var MCP_SCHEMA_URL = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+var PLUGIN_TOP_LEVEL_FIELDS = {
+  $schema: true,
+  name: true,
+  version: true,
+  description: true,
+  author: true,
+  homepage: true,
+  repository: true,
+  license: true,
+  keywords: true,
+  extensions: true
+};
+var PLUGIN_NAME_PATTERN = /^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
+function stripMcpPathPrefix(raw) {
+  if (raw.startsWith("./"))
+    return raw.slice(2);
+  if (raw.startsWith("${PLUGIN_ROOT}/"))
+    return raw.slice("${PLUGIN_ROOT}/".length);
+  if (raw.startsWith("${PLUGIN_DATA}/"))
+    return raw.slice("${PLUGIN_DATA}/".length);
+  if (raw === "${PLUGIN_ROOT}" || raw === "${PLUGIN_DATA}")
+    return "";
+  return null;
+}
+function escapesPluginRoot(remainder) {
+  const normalized = path3.posix.normalize(remainder);
+  return normalized.startsWith("..") || path3.posix.isAbsolute(normalized);
+}
+var SKILL_NAME_PATTERN = /^(?!.*--)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var MCP_SERVER_TYPES = {
+  stdio: true,
+  "streamable-http": true,
+  sse: true
+};
+var STDIO_FIELDS = { type: true, command: true, args: true, env: true, cwd: true };
+var REMOTE_FIELDS = { type: true, url: true, headers: true };
+var AUTHOR_FIELDS = { name: true, email: true, url: true };
+function describeType(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  return typeof value;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseScalar(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function parseFrontmatter(filePath) {
+  const content = fs2.readFileSync(filePath, "utf8");
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n/);
+  if (!match)
+    return null;
+  const result = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    const field = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (!field)
+      continue;
+    result[field[1]] = parseScalar(field[2]);
+  }
+  return result;
+}
+function isValidMcpUrl(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return false;
+  if (!parsed.hostname)
+    return false;
+  if (parsed.username || parsed.password || parsed.hash)
+    return false;
+  const host = parsed.hostname;
+  const isLoopback = host === "localhost" || host === "::1" || host === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(host);
+  if (!isLoopback && parsed.protocol !== "https:")
+    return false;
+  return true;
+}
+function validateManifest(manifest, errors2, warnings) {
+  if (!isPlainObject2(manifest)) {
+    errors2.push("plugin.json: manifest must be a JSON object");
+    return;
+  }
+  const doc = manifest;
+  for (const key of Object.keys(doc)) {
+    if (!Object.hasOwn(PLUGIN_TOP_LEVEL_FIELDS, key)) {
+      warnings.push(`plugin.json: unknown top-level field "${key}" (ignored; client-specific data belongs under "extensions")`);
+    }
+  }
+  const schema = doc["$schema"];
+  if (typeof schema !== "string") {
+    errors2.push(`plugin.json: "$schema" is required and must be the string ${PLUGIN_SCHEMA_URL}`);
+  } else if (schema !== PLUGIN_SCHEMA_URL) {
+    errors2.push(`plugin.json: unsupported "$schema" ${JSON.stringify(schema)} (expected ${PLUGIN_SCHEMA_URL})`);
+  }
+  const name = doc.name;
+  if (typeof name !== "string" || name.length === 0) {
+    errors2.push('plugin.json: "name" is required and must be a non-empty string');
+  } else {
+    if (name.length > 64) {
+      errors2.push(`plugin.json: "name" must be 1-64 characters (got ${name.length})`);
+    }
+    if (!PLUGIN_NAME_PATTERN.test(name)) {
+      errors2.push(`plugin.json: "name" ${JSON.stringify(name)} violates Agent Plugins name rules ` + `(lowercase alphanumerics, hyphens, periods; no "--" or ".."; must start and end alphanumeric)`);
+    }
+  }
+  for (const field of ["version", "description", "homepage", "repository", "license"]) {
+    const value = doc[field];
+    if (value === undefined)
+      continue;
+    if (typeof value !== "string") {
+      errors2.push(`plugin.json: "${field}" must be a string (got ${describeType(value)})`);
+    }
+  }
+  if (doc.author !== undefined) {
+    if (!isPlainObject2(doc.author)) {
+      errors2.push('plugin.json: "author" must be an object with optional string fields name/email/url');
+    } else {
+      const author = doc.author;
+      for (const key of Object.keys(author)) {
+        if (!Object.hasOwn(AUTHOR_FIELDS, key)) {
+          errors2.push(`plugin.json: "author" has unknown field "${key}" (only name, email, url are allowed)`);
+        }
+      }
+      for (const key of ["name", "email", "url"]) {
+        const value = author[key];
+        if (value !== undefined && typeof value !== "string") {
+          errors2.push(`plugin.json: "author.${key}" must be a string (got ${describeType(value)})`);
+        }
+      }
+    }
+  }
+  if (doc.keywords !== undefined) {
+    if (!Array.isArray(doc.keywords) || doc.keywords.some((entry) => typeof entry !== "string")) {
+      errors2.push('plugin.json: "keywords" must be an array of strings');
+    }
+  }
+  if (doc.extensions !== undefined) {
+    if (!isPlainObject2(doc.extensions)) {
+      warnings.push('plugin.json: "extensions" is not an object — ignored');
+    } else {
+      for (const [namespace, value] of Object.entries(doc.extensions)) {
+        if (!isPlainObject2(value)) {
+          warnings.push(`plugin.json: "extensions.${namespace}" is not an object — ignored`);
+        }
+      }
+    }
+  }
+}
+function validateMcpServer(name, entry, errors2) {
+  const prefix = `mcp.json: mcpServers.${name}`;
+  if (!isPlainObject2(entry)) {
+    errors2.push(`${prefix} must be an object`);
+    return;
+  }
+  const server = entry;
+  const type = server.type;
+  if (typeof type !== "string" || !Object.hasOwn(MCP_SERVER_TYPES, type)) {
+    errors2.push(`${prefix}: "type" must be one of "stdio" | "streamable-http" | "sse" (got ${JSON.stringify(type)})`);
+    return;
+  }
+  if (type === "stdio") {
+    for (const key of Object.keys(server)) {
+      if (!Object.hasOwn(STDIO_FIELDS, key)) {
+        errors2.push(`${prefix}: unknown field "${key}" for stdio server (allowed: type, command, args, env, cwd)`);
+      }
+    }
+    const command = server.command;
+    if (typeof command !== "string" || command.length === 0) {
+      errors2.push(`${prefix}: "command" is required and must be a non-empty string`);
+    } else {
+      if (/\s/.test(command)) {
+        errors2.push(`${prefix}: "command" must be a single executable token, not a shell command string`);
+      } else if (command.includes("/") && !command.startsWith("./")) {
+        errors2.push(`${prefix}: "command" must be a bare executable name or a plugin-relative path beginning with "./"`);
+      } else if (command.startsWith("./") && escapesPluginRoot(command.slice(2))) {
+        errors2.push(`${prefix}: "command" must remain within the plugin root (got "${command}")`);
+      }
+    }
+    if (server.args !== undefined) {
+      if (!Array.isArray(server.args) || server.args.some((arg) => typeof arg !== "string")) {
+        errors2.push(`${prefix}: "args" must be an array of strings`);
+      }
+    }
+    if (server.env !== undefined) {
+      if (!isPlainObject2(server.env)) {
+        errors2.push(`${prefix}: "env" must be an object of strings`);
+      } else {
+        for (const [key, value] of Object.entries(server.env)) {
+          if (key === "PLUGIN_ROOT" || key === "PLUGIN_DATA") {
+            errors2.push(`${prefix}: "env" must not set reserved variable "${key}" (clients supply it themselves)`);
+          }
+          if (typeof value !== "string") {
+            errors2.push(`${prefix}: "env.${key}" must be a string`);
+          }
+        }
+      }
+    }
+    if (server.cwd !== undefined) {
+      if (typeof server.cwd !== "string") {
+        errors2.push(`${prefix}: "cwd" must be a string`);
+      } else {
+        const remainder = stripMcpPathPrefix(server.cwd);
+        if (remainder === null) {
+          errors2.push(`${prefix}: "cwd" must be "./…", "${"${PLUGIN_ROOT}"}…", or "${"${PLUGIN_DATA}"}…"`);
+        } else if (escapesPluginRoot(remainder)) {
+          errors2.push(`${prefix}: "cwd" must remain within the plugin root (got "${server.cwd}")`);
+        }
+      }
+    }
+    return;
+  }
+  for (const key of Object.keys(server)) {
+    if (!Object.hasOwn(REMOTE_FIELDS, key)) {
+      errors2.push(`${prefix}: unknown field "${key}" for ${type} server (allowed: type, url, headers)`);
+    }
+  }
+  const url = server.url;
+  if (typeof url !== "string" || url.length === 0) {
+    errors2.push(`${prefix}: "url" is required and must be a non-empty string`);
+  } else if (!isValidMcpUrl(url)) {
+    errors2.push(`${prefix}: "url" must be an absolute http(s) URL without user info or fragment; non-loopback endpoints must use https`);
+  }
+  if (server.headers !== undefined) {
+    if (!isPlainObject2(server.headers)) {
+      errors2.push(`${prefix}: "headers" must be an object of strings`);
+    } else {
+      const seen = new Set;
+      for (const [key, value] of Object.entries(server.headers)) {
+        if (typeof value !== "string") {
+          errors2.push(`${prefix}: "headers.${key}" must be a string`);
+          continue;
+        }
+        if (value.includes("\r") || value.includes(`
+`)) {
+          errors2.push(`${prefix}: "headers.${key}" value must be a single HTTP header value`);
+        }
+        if (!HTTP_HEADER_NAME_PATTERN.test(key)) {
+          errors2.push(`${prefix}: "headers.${key}" is not a valid HTTP header name`);
+        } else {
+          const lower = key.toLowerCase();
+          if (seen.has(lower)) {
+            errors2.push(`${prefix}: header "${key}" is duplicated (case-insensitive)`);
+          }
+          seen.add(lower);
+        }
+      }
+    }
+  }
+}
+function validateMcp(root, manifestSchema, errors2) {
+  const mcpPath = path3.join(root, "mcp.json");
+  if (!fs2.existsSync(mcpPath))
+    return;
+  let parsed;
+  try {
+    parsed = readJson(mcpPath);
+  } catch (error) {
+    errors2.push(`mcp.json: ${error.message}`);
+    return;
+  }
+  if (!isPlainObject2(parsed)) {
+    errors2.push("mcp.json: configuration must be a JSON object");
+    return;
+  }
+  const doc = parsed;
+  for (const key of Object.keys(doc)) {
+    if (key !== "$schema" && key !== "mcpServers") {
+      errors2.push(`mcp.json: unknown top-level field "${key}" (only "$schema" and "mcpServers" allowed)`);
+    }
+  }
+  const schema = doc["$schema"];
+  if (typeof schema !== "string") {
+    errors2.push(`mcp.json: "$schema" is required and must be the string ${MCP_SCHEMA_URL}`);
+  } else if (schema !== MCP_SCHEMA_URL) {
+    errors2.push(`mcp.json: unsupported "$schema" ${JSON.stringify(schema)} (expected ${MCP_SCHEMA_URL})`);
+  } else {
+    const manifestVersion = typeof manifestSchema === "string" ? manifestSchema.match(/^https:\/\/agent-plugins\.org\/schemas\/([^/]+)\/plugin\.schema\.json$/)?.[1] : undefined;
+    const mcpVersion = schema.match(/^https:\/\/agent-plugins\.org\/schemas\/([^/]+)\/mcp\.schema\.json$/)?.[1];
+    if (manifestVersion && mcpVersion && manifestVersion !== mcpVersion) {
+      errors2.push(`mcp.json: "$schema" targets Agent Plugins ${mcpVersion} but plugin.json targets ${manifestVersion} (versions must match)`);
+    }
+  }
+  const servers = doc.mcpServers;
+  if (!isPlainObject2(servers)) {
+    errors2.push('mcp.json: "mcpServers" is required and must be an object');
+    return;
+  }
+  for (const [serverName, entry] of Object.entries(servers)) {
+    validateMcpServer(serverName, entry, errors2);
+  }
+}
+function validateSkills(root, errors2, warnings) {
+  const skillsPath = path3.join(root, "skills");
+  try {
+    if (!fs2.existsSync(skillsPath))
+      return;
+    if (!fs2.statSync(skillsPath).isDirectory()) {
+      errors2.push("skills: skills/ is not a directory (component type invalid)");
+      return;
+    }
+    const entries = fs2.readdirSync(skillsPath, { withFileTypes: true });
+    const realRoot = fs2.realpathSync(root);
+    for (const entry of entries) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink())
+        continue;
+      const skillDir = entry.name;
+      let realSkillPath;
+      try {
+        realSkillPath = fs2.realpathSync(path3.join(skillsPath, skillDir));
+      } catch (error) {
+        warnings.push(`skills: ${skillDir}/ cannot be resolved (${error.message}; skill skipped)`);
+        continue;
+      }
+      const relative = path3.relative(realRoot, realSkillPath);
+      if (relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
+        warnings.push(`skills: ${skillDir}/ resolves outside the plugin root (${realSkillPath}; skill skipped)`);
+        continue;
+      }
+      const skillMdPath = path3.join(skillsPath, skillDir, "SKILL.md");
+      if (!fs2.existsSync(skillMdPath) || !fs2.statSync(skillMdPath).isFile()) {
+        warnings.push(`skills: ${skillDir}/ has no SKILL.md (directory is not a skill; ignored)`);
+        continue;
+      }
+      const frontmatter = parseFrontmatter(skillMdPath);
+      if (!frontmatter) {
+        warnings.push(`skills: ${skillDir}/SKILL.md is missing YAML frontmatter (name and description are required; skill skipped)`);
+        continue;
+      }
+      const skillName = frontmatter.name;
+      const problems = [];
+      if (skillName !== skillDir) {
+        problems.push(`frontmatter "name" ${JSON.stringify(skillName)} must equal the directory name "${skillDir}"`);
+      } else if (!SKILL_NAME_PATTERN.test(skillName)) {
+        problems.push(`frontmatter "name" violates Agent Skills name rules ` + `(lowercase alphanumerics and hyphens, no "--", no leading or trailing hyphen)`);
+      }
+      if (typeof skillName === "string" && skillName.length > 64) {
+        problems.push(`frontmatter "name" must be at most 64 characters (got ${skillName.length})`);
+      }
+      const description = frontmatter.description;
+      if (typeof description !== "string" || description.trim().length === 0) {
+        problems.push(`frontmatter "description" is required and must be non-empty`);
+      } else if (description.length > 1024) {
+        problems.push(`frontmatter "description" must be at most 1024 characters (got ${description.length})`);
+      }
+      for (const problem of problems) {
+        warnings.push(`skills: ${skillDir}/SKILL.md ${problem} (skill skipped)`);
+      }
+    }
+  } catch (error) {
+    errors2.push(`skills: ${error.message}`);
+  }
+}
+function validateAgentPlugin(root) {
+  const errors2 = [];
+  const warnings = [];
+  const manifestPath = path3.join(root, "plugin.json");
+  if (!fs2.existsSync(manifestPath)) {
+    errors2.push(`plugin.json: manifest not found at ${manifestPath} (plugin root must contain plugin.json)`);
+    return { ok: false, errors: errors2, warnings };
+  }
+  let manifest;
+  try {
+    manifest = readJson(manifestPath);
+  } catch (error) {
+    errors2.push(`plugin.json: ${error.message}`);
+    return { ok: false, errors: errors2, warnings };
+  }
+  validateManifest(manifest, errors2, warnings);
+  const manifestSchema = isPlainObject2(manifest) ? manifest["$schema"] : undefined;
+  validateMcp(root, manifestSchema, errors2);
+  validateSkills(root, errors2, warnings);
+  return { ok: errors2.length === 0, errors: errors2, warnings };
+}
+
 // src/constants.ts
 var ALL_ROLES = [
   "project-manager",
@@ -4019,62 +4459,18 @@ function buildModelAssignments(selections) {
 }
 
 // src/adapters/codex.ts
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import os2 from "node:os";
-import path4 from "node:path";
-
-// src/utils.ts
-import fs from "node:fs";
-import path2 from "node:path";
-import { fileURLToPath } from "node:url";
-function ensureObject(value) {
-  if (value && typeof value === "object" && !Array.isArray(value))
-    return value;
-  return {};
-}
-function readJson(filePath) {
-  if (!fs.existsSync(filePath))
-    return {};
-  const content = fs.readFileSync(filePath, "utf8").trim();
-  if (!content)
-    return {};
-  try {
-    return JSON.parse(content);
-  } catch (error) {
-    throw new Error(`Invalid JSON in ${filePath}: ${error.message}`);
-  }
-}
-function writeJson(filePath, value) {
-  const parent = path2.dirname(filePath);
-  if (!fs.existsSync(parent))
-    fs.mkdirSync(parent, { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function resolveProjectRoot() {
-  const candidate = process.env.MSTAR_CLI_PROJECT_ROOT || process.env.INIT_CWD || process.env.PWD;
-  if (candidate && candidate.trim())
-    return path2.resolve(candidate);
-  return process.cwd();
-}
-function readHarnessVersion() {
-  const packageJsonPath = path2.resolve(path2.dirname(fileURLToPath(import.meta.url)), "../package.json");
-  try {
-    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
-    return parsed.version || "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
+import path5 from "node:path";
 
 // src/adapters/shared-install.ts
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 import os from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 import { execFileSync } from "node:child_process";
 var REPO_URL = "https://github.com/btspoony/mstar-harness.git";
 var PLUGIN_NAME = "morning-star-harness";
-var HARNESS_REPO_PATH = path3.join(os.homedir(), ".mstar", "harness");
+var HARNESS_REPO_PATH = path4.join(os.homedir(), ".mstar", "harness");
 var HARNESS_MARKERS = [
   ".codex-plugin/plugin.json",
   ".zcode-plugin/plugin.json",
@@ -4082,15 +4478,15 @@ var HARNESS_MARKERS = [
 ];
 function harnessMarkerPath() {
   for (const marker of HARNESS_MARKERS) {
-    const candidate = path3.join(HARNESS_REPO_PATH, marker);
-    if (fs2.existsSync(candidate))
+    const candidate = path4.join(HARNESS_REPO_PATH, marker);
+    if (fs3.existsSync(candidate))
       return candidate;
   }
-  return path3.join(HARNESS_REPO_PATH, HARNESS_MARKERS[0]);
+  return path4.join(HARNESS_REPO_PATH, HARNESS_MARKERS[0]);
 }
 function pathOrSymlinkExists(filePath) {
   try {
-    fs2.lstatSync(filePath);
+    fs3.lstatSync(filePath);
     return true;
   } catch {
     return false;
@@ -4099,8 +4495,8 @@ function pathOrSymlinkExists(filePath) {
 function ensureDir(dirPath, dryRun) {
   if (dryRun)
     return;
-  if (!fs2.existsSync(dirPath))
-    fs2.mkdirSync(dirPath, { recursive: true });
+  if (!fs3.existsSync(dirPath))
+    fs3.mkdirSync(dirPath, { recursive: true });
 }
 function runCommand(command, cwd, dryRun) {
   if (dryRun)
@@ -4109,7 +4505,7 @@ function runCommand(command, cwd, dryRun) {
 }
 function ensureLocalHarnessRepo(dryRun) {
   const notes = [];
-  if (fs2.existsSync(HARNESS_REPO_PATH)) {
+  if (fs3.existsSync(HARNESS_REPO_PATH)) {
     const errors2 = validateLocalHarnessRepo();
     if (errors2.length) {
       throw new Error(errors2.join(`
@@ -4118,34 +4514,34 @@ function ensureLocalHarnessRepo(dryRun) {
     notes.push(`Using existing local harness repo at ${HARNESS_REPO_PATH}`);
     return notes;
   }
-  ensureDir(path3.dirname(HARNESS_REPO_PATH), dryRun);
-  runCommand(["git", "clone", REPO_URL, HARNESS_REPO_PATH], path3.dirname(HARNESS_REPO_PATH), dryRun);
+  ensureDir(path4.dirname(HARNESS_REPO_PATH), dryRun);
+  runCommand(["git", "clone", REPO_URL, HARNESS_REPO_PATH], path4.dirname(HARNESS_REPO_PATH), dryRun);
   notes.push(`Cloned ${REPO_URL} to ${HARNESS_REPO_PATH}`);
   return notes;
 }
 function validateLocalHarnessRepo() {
   const errors2 = [];
-  if (!fs2.existsSync(HARNESS_REPO_PATH)) {
+  if (!fs3.existsSync(HARNESS_REPO_PATH)) {
     errors2.push(`Missing local harness repo: ${HARNESS_REPO_PATH}`);
     return errors2;
   }
   const marker = harnessMarkerPath();
-  if (!fs2.existsSync(marker)) {
+  if (!fs3.existsSync(marker)) {
     errors2.push(`Local harness repo is missing a plugin marker (expected one of: ${HARNESS_MARKERS.join(", ")}).`);
   }
   return errors2;
 }
 function ensureGitCheckout(repoUrl, checkoutPath, dryRun) {
   const notes = [];
-  const parentDir = path3.dirname(checkoutPath);
+  const parentDir = path4.dirname(checkoutPath);
   if (pathOrSymlinkExists(checkoutPath)) {
-    const stat = fs2.lstatSync(checkoutPath);
+    const stat = fs3.lstatSync(checkoutPath);
     if (stat.isSymbolicLink()) {
       notes.push(dryRun ? `Would remove symlink at ${checkoutPath} and clone ${repoUrl}` : `Removed symlink at ${checkoutPath} (Cursor requires a real directory)`);
       if (dryRun)
         return notes;
-      fs2.unlinkSync(checkoutPath);
-    } else if (fs2.existsSync(path3.join(checkoutPath, ".git"))) {
+      fs3.unlinkSync(checkoutPath);
+    } else if (fs3.existsSync(path4.join(checkoutPath, ".git"))) {
       if (!dryRun) {
         runCommand(["git", "-C", checkoutPath, "pull", "--ff-only"], checkoutPath, dryRun);
       }
@@ -4168,39 +4564,39 @@ function validateGitCheckout(checkoutPath, markerRelativePath) {
     errors2.push(`Missing checkout directory: ${checkoutPath}`);
     return errors2;
   }
-  const stat = fs2.lstatSync(checkoutPath);
+  const stat = fs3.lstatSync(checkoutPath);
   if (stat.isSymbolicLink()) {
     errors2.push(`Path must be a real directory, not a symlink: ${checkoutPath}. Run: mstar-harness init --target cursor`);
     return errors2;
   }
-  if (!fs2.existsSync(path3.join(checkoutPath, ".git"))) {
+  if (!fs3.existsSync(path4.join(checkoutPath, ".git"))) {
     errors2.push(`Path is not a git checkout: ${checkoutPath}`);
   }
-  const marker = path3.join(checkoutPath, markerRelativePath);
-  if (!fs2.existsSync(marker)) {
+  const marker = path4.join(checkoutPath, markerRelativePath);
+  if (!fs3.existsSync(marker)) {
     errors2.push(`Missing marker file: ${marker}`);
   }
   return errors2;
 }
 function ensureSymlink(target, linkPath, dryRun) {
   if (pathOrSymlinkExists(linkPath)) {
-    const stat = fs2.lstatSync(linkPath);
+    const stat = fs3.lstatSync(linkPath);
     if (!stat.isSymbolicLink()) {
       throw new Error(`Path exists and is not a symlink: ${linkPath}`);
     }
-    if (!fs2.existsSync(target)) {
+    if (!fs3.existsSync(target)) {
       throw new Error(`Symlink target is missing: ${target}`);
     }
-    const actual = fs2.realpathSync(linkPath);
-    const expected = fs2.realpathSync(target);
+    const actual = fs3.realpathSync(linkPath);
+    const expected = fs3.realpathSync(target);
     if (actual !== expected) {
       throw new Error(`Symlink ${linkPath} points to ${actual}, expected ${expected}`);
     }
     return `Symlink already exists: ${linkPath} -> ${target}`;
   }
-  ensureDir(path3.dirname(linkPath), dryRun);
+  ensureDir(path4.dirname(linkPath), dryRun);
   if (!dryRun)
-    fs2.symlinkSync(target, linkPath);
+    fs3.symlinkSync(target, linkPath);
   return `Linked ${linkPath} -> ${target}`;
 }
 function validateSymlink(target, linkPath) {
@@ -4209,17 +4605,17 @@ function validateSymlink(target, linkPath) {
     errors2.push(`Missing symlink: ${linkPath}`);
     return errors2;
   }
-  const stat = fs2.lstatSync(linkPath);
+  const stat = fs3.lstatSync(linkPath);
   if (!stat.isSymbolicLink()) {
     errors2.push(`Path exists but is not a symlink: ${linkPath}`);
     return errors2;
   }
-  if (!fs2.existsSync(target)) {
+  if (!fs3.existsSync(target)) {
     errors2.push(`Symlink target is missing: ${target}`);
     return errors2;
   }
-  const actual = fs2.realpathSync(linkPath);
-  const expected = fs2.realpathSync(target);
+  const actual = fs3.realpathSync(linkPath);
+  const expected = fs3.realpathSync(target);
   if (actual !== expected) {
     errors2.push(`Symlink ${linkPath} points to ${actual}, expected ${expected}`);
   }
@@ -4244,8 +4640,8 @@ function missingHarnessProcessGitignoreEntries(gitignoreContent) {
   return HARNESS_PROCESS_GITIGNORE.filter((entry) => !lines.includes(entry));
 }
 function appendGitignore(projectRoot, entries, dryRun) {
-  const gitignorePath = path3.join(projectRoot, ".gitignore");
-  const current = fs2.existsSync(gitignorePath) ? fs2.readFileSync(gitignorePath, "utf8") : "";
+  const gitignorePath = path4.join(projectRoot, ".gitignore");
+  const current = fs3.existsSync(gitignorePath) ? fs3.readFileSync(gitignorePath, "utf8") : "";
   const lines = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = entries.filter((entry) => !lines.has(entry));
   if (!missing.length)
@@ -4254,7 +4650,7 @@ function appendGitignore(projectRoot, entries, dryRun) {
     const prefix = current && !current.endsWith(`
 `) ? `
 ` : "";
-    fs2.appendFileSync(gitignorePath, `${prefix}${missing.join(`
+    fs3.appendFileSync(gitignorePath, `${prefix}${missing.join(`
 `)}
 `, "utf8");
   }
@@ -4264,14 +4660,14 @@ function appendHarnessProjectGitignore(projectRoot, dryRun) {
   return appendGitignore(projectRoot, HARNESS_PROCESS_GITIGNORE, dryRun);
 }
 function homeRelativeSourcePath(targetPath) {
-  const rel = path3.relative(os.homedir(), targetPath).split(path3.sep).join("/");
+  const rel = path4.relative(os.homedir(), targetPath).split(path4.sep).join("/");
   return rel.startsWith("..") ? targetPath : `./${rel}`;
 }
 
 // src/adapters/codex.ts
 var MARKETPLACE_NAME = "personal";
 var MARKETPLACE_DISPLAY_NAME = "Personal";
-var GLOBAL_MARKETPLACE_PATH = path4.join(os2.homedir(), ".agents", "plugins", "marketplace.json");
+var GLOBAL_MARKETPLACE_PATH = path5.join(os2.homedir(), ".agents", "plugins", "marketplace.json");
 var PLUGIN_CATEGORY = "Productivity";
 var CODEX_PLUGIN_LINK = ".codex/plugins/mstar-harness";
 var CODEX_AGENT_NAMES = [
@@ -4299,16 +4695,16 @@ function globalMarketplacePath() {
   return GLOBAL_MARKETPLACE_PATH;
 }
 function projectMarketplacePath() {
-  return path4.join(resolveProjectRoot(), ".agents", "plugins", "marketplace.json");
+  return path5.join(resolveProjectRoot(), ".agents", "plugins", "marketplace.json");
 }
 function agentSourcePath(agentName) {
-  return path4.join(HARNESS_REPO_PATH, "codex", "agents", `${agentName}.toml`);
+  return path5.join(HARNESS_REPO_PATH, "codex", "agents", `${agentName}.toml`);
 }
 function globalAgentLinkPath(agentName) {
-  return path4.join(os2.homedir(), ".codex", "agents", `${agentName}.toml`);
+  return path5.join(os2.homedir(), ".codex", "agents", `${agentName}.toml`);
 }
 function projectAgentLinkPath(agentName) {
-  return path4.join(resolveProjectRoot(), ".codex", "agents", `${agentName}.toml`);
+  return path5.join(resolveProjectRoot(), ".codex", "agents", `${agentName}.toml`);
 }
 function mstarEntry(scope) {
   const sourcePath = scope === "global" ? homeRelativeSourcePath(HARNESS_REPO_PATH) : `./${CODEX_PLUGIN_LINK}`;
@@ -4399,10 +4795,10 @@ function validateAgentLinks(scope) {
   return errors2;
 }
 function iterationCommandSourcePath(skillName) {
-  return path4.join(HARNESS_REPO_PATH, "commands", `${skillName}.md`);
+  return path5.join(HARNESS_REPO_PATH, "commands", `${skillName}.md`);
 }
 function projectIterationSkillLinkPath(skillName) {
-  return path4.join(resolveProjectRoot(), ".agents", "skills", skillName, "SKILL.md");
+  return path5.join(resolveProjectRoot(), ".agents", "skills", skillName, "SKILL.md");
 }
 function iterationSkillGitignoreEntry(skillName) {
   return `.agents/skills/${skillName}`;
@@ -4423,8 +4819,8 @@ function ensureIterationSkillLinks(dryRun) {
 function validateIterationSkillLinks() {
   const errors2 = [];
   const projectRoot = resolveProjectRoot();
-  const gitignorePath = path4.join(projectRoot, ".gitignore");
-  const gitignore = fs3.existsSync(gitignorePath) ? fs3.readFileSync(gitignorePath, "utf8") : "";
+  const gitignorePath = path5.join(projectRoot, ".gitignore");
+  const gitignore = fs4.existsSync(gitignorePath) ? fs4.readFileSync(gitignorePath, "utf8") : "";
   const lines = gitignore.split(/\r?\n/);
   for (const skillName of CODEX_PROJECT_COMMAND_NAMES) {
     const source = iterationCommandSourcePath(skillName);
@@ -4444,7 +4840,7 @@ function runInit(scope, dryRun) {
   const notes = ensureLocalHarnessRepo(dryRun);
   if (scope === "project") {
     const projectRoot = resolveProjectRoot();
-    notes.push(ensureSymlink(HARNESS_REPO_PATH, path4.join(projectRoot, CODEX_PLUGIN_LINK), dryRun));
+    notes.push(ensureSymlink(HARNESS_REPO_PATH, path5.join(projectRoot, CODEX_PLUGIN_LINK), dryRun));
     notes.push(...appendGitignore(projectRoot, [CODEX_PLUGIN_LINK, ".codex/agents/*.toml"], dryRun));
     notes.push(...appendHarnessProjectGitignore(projectRoot, dryRun));
     notes.push(...ensureIterationSkillLinks(dryRun));
@@ -4465,7 +4861,7 @@ function runInit(scope, dryRun) {
 function runDoctor(scope) {
   const pathToMarketplace = marketplacePath(scope);
   const errors2 = validateLocalHarnessRepo();
-  if (!fs3.existsSync(pathToMarketplace)) {
+  if (!fs4.existsSync(pathToMarketplace)) {
     return { location: pathToMarketplace, errors: [...errors2, `Missing Codex marketplace: ${pathToMarketplace}`] };
   }
   const marketplace = readJson(pathToMarketplace);
@@ -4475,9 +4871,9 @@ function runDoctor(scope) {
   errors2.push(...validateEntryShape(findEntry(marketplace), scope, pathToMarketplace));
   if (scope === "project") {
     const projectRoot = resolveProjectRoot();
-    errors2.push(...validateSymlink(HARNESS_REPO_PATH, path4.join(projectRoot, CODEX_PLUGIN_LINK)));
-    const gitignorePath = path4.join(projectRoot, ".gitignore");
-    const gitignore = fs3.existsSync(gitignorePath) ? fs3.readFileSync(gitignorePath, "utf8") : "";
+    errors2.push(...validateSymlink(HARNESS_REPO_PATH, path5.join(projectRoot, CODEX_PLUGIN_LINK)));
+    const gitignorePath = path5.join(projectRoot, ".gitignore");
+    const gitignore = fs4.existsSync(gitignorePath) ? fs4.readFileSync(gitignorePath, "utf8") : "";
     const lines = gitignore.split(/\r?\n/);
     if (!lines.includes(CODEX_PLUGIN_LINK))
       errors2.push(`Missing .gitignore entry: ${CODEX_PLUGIN_LINK}`);
@@ -4499,33 +4895,33 @@ var codexAdapter = {
 };
 
 // src/adapters/cursor.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import os3 from "node:os";
-import path5 from "node:path";
+import path6 from "node:path";
 var CURSOR_PLUGIN_NAME = "morning-star-harness";
 var CURSOR_PLUGIN_MARKER = ".cursor-plugin/plugin.json";
 var CURSOR_PLUGIN_LINK = ".cursor/plugins/morning-star-harness";
 var CURSOR_AGENT_SMOKE_NAMES = ["fullstack-dev", "qc-specialist"];
 function globalInstallPath() {
-  return path5.join(os3.homedir(), ".cursor", "plugins", "local", CURSOR_PLUGIN_NAME);
+  return path6.join(os3.homedir(), ".cursor", "plugins", "local", CURSOR_PLUGIN_NAME);
 }
 function projectInstallPath() {
-  return path5.join(resolveProjectRoot(), CURSOR_PLUGIN_LINK);
+  return path6.join(resolveProjectRoot(), CURSOR_PLUGIN_LINK);
 }
 function validatePluginAgents(pluginRoot) {
   const errors2 = [];
-  const agentsDir = path5.join(pluginRoot, "agents");
-  if (!fs4.existsSync(agentsDir)) {
+  const agentsDir = path6.join(pluginRoot, "agents");
+  if (!fs5.existsSync(agentsDir)) {
     errors2.push(`Missing plugin agents directory: ${agentsDir}`);
     return errors2;
   }
   for (const agentName of CURSOR_AGENT_SMOKE_NAMES) {
-    const agentPath = path5.join(agentsDir, `${agentName}.md`);
-    if (!fs4.existsSync(agentPath)) {
+    const agentPath = path6.join(agentsDir, `${agentName}.md`);
+    if (!fs5.existsSync(agentPath)) {
       errors2.push(`Missing plugin agent file: ${agentPath}`);
       continue;
     }
-    const content = fs4.readFileSync(agentPath, "utf8");
+    const content = fs5.readFileSync(agentPath, "utf8");
     if (!/^---\nname:\s/m.test(content)) {
       errors2.push(`Plugin agent ${agentName}.md must use Cursor-first frontmatter (name, description, model before OpenCode fields).`);
     }
@@ -4562,8 +4958,8 @@ function projectDoctor() {
   const location = projectInstallPath();
   const errors2 = validateLocalHarnessRepo();
   errors2.push(...validateGitCheckout(location, CURSOR_PLUGIN_MARKER));
-  const gitignorePath = path5.join(projectRoot, ".gitignore");
-  const gitignore = fs4.existsSync(gitignorePath) ? fs4.readFileSync(gitignorePath, "utf8") : "";
+  const gitignorePath = path6.join(projectRoot, ".gitignore");
+  const gitignore = fs5.existsSync(gitignorePath) ? fs5.readFileSync(gitignorePath, "utf8") : "";
   if (!gitignore.split(/\r?\n/).includes(CURSOR_PLUGIN_LINK)) {
     errors2.push(`Missing .gitignore entry: ${CURSOR_PLUGIN_LINK}`);
   }
@@ -4589,8 +4985,8 @@ var cursorAdapter = {
 };
 
 // src/adapters/omp.ts
-import fs5 from "node:fs";
-import path6 from "node:path";
+import fs6 from "node:fs";
+import path7 from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 var OMP_PLUGIN_MARKER = ".omp-plugin/plugin.json";
 var CLAUDE_PLUGIN_MARKER = ".claude-plugin/plugin.json";
@@ -4652,7 +5048,7 @@ function findInstalledPlugin(plugins) {
       return true;
     if (name.includes("morning-star") || manifestName.includes("morning-star"))
       return true;
-    if (pathValue.includes("mstar-harness") || pathValue.includes(`${path6.sep}morning-star`))
+    if (pathValue.includes("mstar-harness") || pathValue.includes(`${path7.sep}morning-star`))
       return true;
     return false;
   });
@@ -4660,30 +5056,30 @@ function findInstalledPlugin(plugins) {
 function validatePluginTree(pluginRoot) {
   const errors2 = [];
   for (const marker of [OMP_PLUGIN_MARKER, CLAUDE_PLUGIN_MARKER]) {
-    const markerPath = path6.join(pluginRoot, marker);
-    if (!fs5.existsSync(markerPath)) {
+    const markerPath = path7.join(pluginRoot, marker);
+    if (!fs6.existsSync(markerPath)) {
       errors2.push(`Missing omp plugin marker: ${markerPath}`);
     }
   }
   for (const skill of SKILL_SMOKE) {
-    const skillPath = path6.join(pluginRoot, "skills", skill, "SKILL.md");
-    if (!fs5.existsSync(skillPath))
+    const skillPath = path7.join(pluginRoot, "skills", skill, "SKILL.md");
+    if (!fs6.existsSync(skillPath))
       errors2.push(`Missing skill: ${skillPath}`);
   }
   for (const command of COMMAND_SMOKE) {
-    const commandPath = path6.join(pluginRoot, "commands", `${command}.md`);
-    if (!fs5.existsSync(commandPath))
+    const commandPath = path7.join(pluginRoot, "commands", `${command}.md`);
+    if (!fs6.existsSync(commandPath))
       errors2.push(`Missing command: ${commandPath}`);
   }
-  const hostRef = path6.join(pluginRoot, "skills", "mstar-host", "references", "omp.md");
-  if (!fs5.existsSync(hostRef))
+  const hostRef = path7.join(pluginRoot, "skills", "mstar-host", "references", "omp.md");
+  if (!fs6.existsSync(hostRef))
     errors2.push(`Missing omp host reference: ${hostRef}`);
   return errors2;
 }
 function runInit2(scope, dryRun) {
   const notes = ensureLocalHarnessRepo(dryRun);
   const projectRoot = resolveProjectRoot();
-  if (fs5.existsSync(path6.join(HARNESS_REPO_PATH, ".git"))) {
+  if (fs6.existsSync(path7.join(HARNESS_REPO_PATH, ".git"))) {
     if (dryRun) {
       notes.push(`Would update local harness repo: git -C ${HARNESS_REPO_PATH} pull --ff-only`);
     } else {
@@ -4757,8 +5153,8 @@ function runDoctor2(scope) {
   }
   if (scope === "project") {
     const projectRoot = resolveProjectRoot();
-    const gitignorePath = path6.join(projectRoot, ".gitignore");
-    const gitignore = fs5.existsSync(gitignorePath) ? fs5.readFileSync(gitignorePath, "utf8") : "";
+    const gitignorePath = path7.join(projectRoot, ".gitignore");
+    const gitignore = fs6.existsSync(gitignorePath) ? fs6.readFileSync(gitignorePath, "utf8") : "";
     for (const entry of missingHarnessProcessGitignoreEntries(gitignore)) {
       errors2.push(`Missing .gitignore entry: ${entry}`);
     }
@@ -4774,7 +5170,7 @@ var ompAdapter = {
 
 // src/adapters/opencode.ts
 import os4 from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 var OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 var MSTAR_OPENCODE_PLUGIN = "@mstar-harness/opencode@latest";
 function isLegacyMorningStarGitPlugin(plugin) {
@@ -4795,11 +5191,11 @@ function isAnyMstarHarnessOpencodeSlot(plugin) {
 function resolveOpencodeConfigPath(scope, outputPath) {
   if (outputPath && outputPath.trim()) {
     const raw = outputPath.trim();
-    return path7.isAbsolute(raw) ? raw : path7.join(resolveProjectRoot(), raw);
+    return path8.isAbsolute(raw) ? raw : path8.join(resolveProjectRoot(), raw);
   }
   if (scope === "global")
-    return path7.join(os4.homedir(), ".config", "opencode", "opencode.json");
-  return path7.join(resolveProjectRoot(), "opencode.json");
+    return path8.join(os4.homedir(), ".config", "opencode", "opencode.json");
+  return path8.join(resolveProjectRoot(), "opencode.json");
 }
 function ensureConfigSchema(config) {
   const next = ensureObject(config);
@@ -4892,9 +5288,9 @@ var opencodeAdapter = {
 };
 
 // src/adapters/zcode.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 import os5 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 var MARKETPLACE_ID = "mstar-local";
 var MARKETPLACE_NAME2 = "mstar-local";
 var MARKETPLACE_DESCRIPTION = "Morning Star harness marketplace (GitHub source).";
@@ -4905,10 +5301,10 @@ var GITHUB_REF = "main";
 var ZCODE_PLUGIN_MARKER = ".zcode-plugin/plugin.json";
 var ZCODE_PLUGIN_CHECKOUT_PROJECT = ".zcode/plugin-checkout";
 var ZCODE_AGENT_SMOKE_NAMES = ["fullstack-dev", "qc-specialist"];
-var ZCODE_PLUGINS_ROOT = path8.join(os5.homedir(), ".zcode", "cli", "plugins");
-var KNOWN_MARKETPLACES_PATH = path8.join(ZCODE_PLUGINS_ROOT, "known_marketplaces.json");
-var MARKETPLACE_DIR = path8.join(ZCODE_PLUGINS_ROOT, "marketplaces", MARKETPLACE_ID);
-var MARKETPLACE_JSON_PATH = path8.join(MARKETPLACE_DIR, "marketplace.json");
+var ZCODE_PLUGINS_ROOT = path9.join(os5.homedir(), ".zcode", "cli", "plugins");
+var KNOWN_MARKETPLACES_PATH = path9.join(ZCODE_PLUGINS_ROOT, "known_marketplaces.json");
+var MARKETPLACE_DIR = path9.join(ZCODE_PLUGINS_ROOT, "marketplaces", MARKETPLACE_ID);
+var MARKETPLACE_JSON_PATH = path9.join(MARKETPLACE_DIR, "marketplace.json");
 var GITHUB_SOURCE = { source: "github", repo: GITHUB_REPO, ref: GITHUB_REF };
 function nowIso() {
   return new Date().toISOString();
@@ -4964,7 +5360,7 @@ function findMarketplacePlugin(raw) {
 }
 function validateMarketplaceJson() {
   const errors2 = [];
-  if (!fs6.existsSync(MARKETPLACE_JSON_PATH)) {
+  if (!fs7.existsSync(MARKETPLACE_JSON_PATH)) {
     errors2.push(`Missing ZCode marketplace: ${MARKETPLACE_JSON_PATH}`);
     return errors2;
   }
@@ -4993,7 +5389,7 @@ function validateMarketplaceJson() {
 }
 function validateKnownMarketplaces() {
   const errors2 = [];
-  if (!fs6.existsSync(KNOWN_MARKETPLACES_PATH)) {
+  if (!fs7.existsSync(KNOWN_MARKETPLACES_PATH)) {
     errors2.push(`Missing ZCode known_marketplaces.json: ${KNOWN_MARKETPLACES_PATH}`);
     return errors2;
   }
@@ -5016,14 +5412,14 @@ function validateKnownMarketplaces() {
 }
 function validatePluginAgents2(pluginRoot) {
   const errors2 = [];
-  const agentsDir = path8.join(pluginRoot, "agents");
-  if (!fs6.existsSync(agentsDir)) {
+  const agentsDir = path9.join(pluginRoot, "agents");
+  if (!fs7.existsSync(agentsDir)) {
     errors2.push(`Missing plugin agents directory: ${agentsDir}`);
     return errors2;
   }
   for (const agentName of ZCODE_AGENT_SMOKE_NAMES) {
-    const agentPath = path8.join(agentsDir, `${agentName}.md`);
-    if (!fs6.existsSync(agentPath)) {
+    const agentPath = path9.join(agentsDir, `${agentName}.md`);
+    if (!fs7.existsSync(agentPath)) {
       errors2.push(`Missing plugin agent file: ${agentPath}`);
     }
   }
@@ -5040,15 +5436,15 @@ function runInit3(scope, dryRun) {
   const notes = ensureLocalHarnessRepo(dryRun);
   const projectRoot = resolveProjectRoot();
   if (scope === "project") {
-    const checkoutPath = path8.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
+    const checkoutPath = path9.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
     notes.push(...ensureGitCheckout(REPO_URL, checkoutPath, dryRun));
     notes.push(...appendGitignore(projectRoot, [ZCODE_PLUGIN_CHECKOUT_PROJECT], dryRun));
     notes.push(...appendHarnessProjectGitignore(projectRoot, dryRun));
     notes.push(`Materialized local ZCode plugin checkout at ${ZCODE_PLUGIN_CHECKOUT_PROJECT} for smoke checks (the registered marketplace still points at the github repo).`);
   }
   if (!dryRun) {
-    if (!fs6.existsSync(MARKETPLACE_DIR))
-      fs6.mkdirSync(MARKETPLACE_DIR, { recursive: true });
+    if (!fs7.existsSync(MARKETPLACE_DIR))
+      fs7.mkdirSync(MARKETPLACE_DIR, { recursive: true });
     writeJson(MARKETPLACE_JSON_PATH, buildMarketplaceJson());
   }
   notes.push(`Wrote ZCode marketplace: ${MARKETPLACE_JSON_PATH}`);
@@ -5068,10 +5464,10 @@ function runDoctor3(scope) {
   errors2.push(...validateLocalHarnessRepo());
   if (scope === "project") {
     const projectRoot = resolveProjectRoot();
-    const checkoutPath = path8.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
+    const checkoutPath = path9.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
     errors2.push(...validateGitCheckout(checkoutPath, ZCODE_PLUGIN_MARKER));
-    const gitignorePath = path8.join(projectRoot, ".gitignore");
-    const gitignore = fs6.existsSync(gitignorePath) ? fs6.readFileSync(gitignorePath, "utf8") : "";
+    const gitignorePath = path9.join(projectRoot, ".gitignore");
+    const gitignore = fs7.existsSync(gitignorePath) ? fs7.readFileSync(gitignorePath, "utf8") : "";
     if (!gitignore.split(/\r?\n/).includes(ZCODE_PLUGIN_CHECKOUT_PROJECT)) {
       errors2.push(`Missing .gitignore entry: ${ZCODE_PLUGIN_CHECKOUT_PROJECT}`);
     }
@@ -5112,8 +5508,8 @@ function getAdapter(target) {
 var SUPPORTED_TARGETS = ["opencode", "cursor", "codex", "zcode", "omp"];
 
 // src/utils.ts
-import fs7 from "node:fs";
-import path9 from "node:path";
+import fs8 from "node:fs";
+import path10 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function parseCsv(raw) {
   if (!raw)
@@ -5121,9 +5517,9 @@ function parseCsv(raw) {
   return raw.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function readJson2(filePath) {
-  if (!fs7.existsSync(filePath))
+  if (!fs8.existsSync(filePath))
     return {};
-  const content = fs7.readFileSync(filePath, "utf8").trim();
+  const content = fs8.readFileSync(filePath, "utf8").trim();
   if (!content)
     return {};
   try {
@@ -5133,16 +5529,22 @@ function readJson2(filePath) {
   }
 }
 function writeJson2(filePath, value) {
-  const parent = path9.dirname(filePath);
-  if (!fs7.existsSync(parent))
-    fs7.mkdirSync(parent, { recursive: true });
-  fs7.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+  const parent = path10.dirname(filePath);
+  if (!fs8.existsSync(parent))
+    fs8.mkdirSync(parent, { recursive: true });
+  fs8.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
+function resolveProjectRoot2() {
+  const candidate = process.env.MSTAR_CLI_PROJECT_ROOT || process.env.INIT_CWD || process.env.PWD;
+  if (candidate && candidate.trim())
+    return path10.resolve(candidate);
+  return process.cwd();
+}
 function readHarnessVersion2() {
-  const packageJsonPath = path9.resolve(path9.dirname(fileURLToPath2(import.meta.url)), "../package.json");
+  const packageJsonPath = path10.resolve(path10.dirname(fileURLToPath2(import.meta.url)), "../package.json");
   try {
-    const parsed = JSON.parse(fs7.readFileSync(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(fs8.readFileSync(packageJsonPath, "utf8"));
     return parsed.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -5289,6 +5691,33 @@ function runDoctor4(options) {
     console.log(`  - ${issue}`);
   process.exitCode = 1;
 }
+function resolvePluginRoot(options) {
+  if (options.root)
+    return path11.resolve(options.root);
+  let candidate = resolveProjectRoot2();
+  while (!fs9.existsSync(path11.join(candidate, "plugin.json"))) {
+    const parent = path11.dirname(candidate);
+    if (parent === candidate)
+      break;
+    candidate = parent;
+  }
+  return candidate;
+}
+function runPluginValidate(options) {
+  const root = resolvePluginRoot(options);
+  const result = validateAgentPlugin(root);
+  for (const warning of result.warnings) {
+    console.warn(import_picocolors.default.yellow(warning));
+  }
+  if (result.ok) {
+    console.log(import_picocolors.default.green(`OK ${root}: Agent Plugins v1.0.0 conformant`));
+    return;
+  }
+  for (const error of result.errors) {
+    console.error(import_picocolors.default.red(error));
+  }
+  process.exitCode = 1;
+}
 program2.name("mstar-harness").description("Morning Star harness CLI for target-based agent bootstrap").version(packageVersion);
 program2.command("init").description("Interactive/non-interactive setup for target agent bootstrap").option("-y, --yes", "Non-interactive mode").option("--target <target>", "Install target", "opencode").option("--scope <scope>", "Config scope: global|project (default: project)").option("--output <path>", "Config file path override, relative to project root").option("--dry-run", "Preview result without writing config").option("--pm-model <model>", "Optional: model for project-manager (advanced override)").option("--strategic-models <a,b,c>", "Optional: models for architect/product-manager/prompt-engineer").option("--dev-models <a,b,c>", "Optional: models for fullstack-dev/fullstack-dev-2/frontend-dev").option("--qc-models <a,b,c>", "Optional: models for qc trio").option("--other-models <a,b,c>", "Optional: models for remaining roles").action(async (options) => {
   await runInit4(options);
@@ -5296,6 +5725,10 @@ program2.command("init").description("Interactive/non-interactive setup for targ
 program2.command("doctor").description("Validate Morning Star setup for a target agent config").option("--target <target>", "Target agent for doctor checks", "opencode").option("--scope <scope>", "Config scope: global|project", "project").option("--output <path>", "Config file path override, relative to project root").action((options) => {
   runDoctor4(options);
 });
+var pluginCommand = program2.command("plugin").description("Agent Plugins v1.0.0 portable package commands");
+pluginCommand.command("validate").description("Validate a plugin package against Agent Plugins v1.0.0").option("--root <path>", "Plugin root directory to validate (default: project root)").action((options) => {
+  runPluginValidate(options);
+});
 program2.parseAsync(process.argv).catch((error) => {
   console.error(import_picocolors.default.red(`Setup failed: ${error.message}`));
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/cli",
-  "version": "1.8.8",
+  "version": "1.8.9",
   "description": "Morning Star harness installer CLI (OpenCode, Cursor, Codex, ZCode, omp).",
   "license": "MIT",
   "repository": {