@neurodock/cli 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @neurodock/cli changelog
 
+## 0.7.2
+
+### Fixed — `npx @neurodock/cli install-all` failed on `init` with "Could not locate template: profile.example.yaml"
+
+The 0.7.x tarball only shipped `dist/`, but `init`, `validate`, and
+`plugin validate` all resolved their templates and JSON schemas through
+relative paths into the workspace `packages/core/schemas/` folder. That
+folder is not part of the cli tarball, so every fresh `npx` install
+failed the moment `install-all` finished wiring the MCP servers and
+tried to scaffold a profile.
+
+Fix: `scripts/copy-assets.mjs` now also copies `packages/core/schemas/`
+into `dist/assets/schemas/` at build time, and the three resolvers
+(`commands/init.ts`, `profile/validator.ts`, `lib/plugin-schema.ts`)
+check that bundled location first before falling back to the workspace
+candidates used during local development. No behaviour change in the
+monorepo; published tarball now contains the schemas required by every
+first-run code path.
+
+## 0.7.1
+
+### Fixed — Windows: daemon autostart no longer flashes a black console window
+
+The 0.7.0 HKCU Run entry used `python.exe` (console subsystem) which
+flashed a visible terminal window on every Windows login. Switched to
+`pythonw.exe` (windows subsystem — same interpreter, no console).
+The post-install detached spawn in `install-hooks` does the same and
+also passes `windowsHide: true` on the spawn options. No behavioural
+change on macOS or Linux. Existing 0.7.0 installs should re-run
+`neurodock install-hooks --install-daemon` to refresh the Run entry.
+
 ## 0.7.0
 
 ### Fixed — proactive-guardrail wiring after 2026-05-26 silent-failure incident

package/dist/assets/hooks/neurodock_daemon.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2026 NeuroDock contributors.
 """NeuroDock proactive-guardrail daemon (Phase 3).
 
 A long-running poller that watches the same state files the Phase 1
@@ -342,7 +344,14 @@ def _uninstall_autostart() -> int:
 def _install_windows_autostart(daemon_script: Path) -> int:
     # Register an HKCU Run entry so the daemon launches at user logon.
     # No admin rights required.
-    cmd = f'python "{str(daemon_script).replace(chr(92), "/")}" run'
+    #
+    # Use `pythonw.exe` (windows-subsystem) not `python.exe` (console-
+    # subsystem) so the daemon runs invisibly. With `python.exe` the
+    # Run-key launch flashes a black console window on every login
+    # because the binary is linked against the console subsystem.
+    # `pythonw.exe` ships alongside `python.exe` in every Windows
+    # Python install — same interpreter, same site-packages, no console.
+    cmd = f'pythonw "{str(daemon_script).replace(chr(92), "/")}" run'
     try:
         subprocess.run(
             [

package/dist/assets/hooks/proactive_guardrail.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2026 NeuroDock contributors.
 """NeuroDock proactive guardrail — Claude Code hook (self-contained).
 
 Bundled with `@neurodock/cli`; copied to `~/.neurodock/hooks/` by

package/dist/assets/hooks/test_daemon_escape.py

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2026 NeuroDock contributors.
 """Tests for the M5 notification-text escape functions in neurodock_daemon.py.
 
 Security regression test: verify that shell-injection characters in title/

package/dist/assets/schemas/plugin.example.yaml

@@ -0,0 +1,193 @@
+# ==============================================================================
+# WELCOME — THIS IS A WORKED EXAMPLE OF A PLUGIN MANIFEST
+# ==============================================================================
+# Plugins are how NeuroDock grows without us having to change the core. This
+# file shows every field you can put in your own plugin's "plugin.yaml" file.
+#
+# You don't need to use every field. Most of them are optional. Copy this
+# file as a starting point and delete anything you don't need.
+#
+# WHERE THE CONTRACT LIVES (for the curious):
+#   packages/core/schemas/plugin.schema.json     — the machine-checkable rules
+#   docs/decisions/0007-plugin-protocol.md       — the "why" behind the rules
+#
+# HOW PLUGINS GET FOUND:
+#   When NeuroDock starts, it looks in two places for plugins:
+#     1. plugins/<your-plugin>/plugin.yaml   (lives inside this repo)
+#     2. ~/.local/share/neurodock/plugins/<your-plugin>/plugin.yaml
+#        (lives on your own computer, just for you)
+#   No central server. No sign-up. No registry to publish to.
+#
+# WILL UPGRADING BREAK MY PLUGIN?
+#   No. If we add new fields in a future version, older versions of NeuroDock
+#   will leave them alone instead of stripping them out. You can edit your
+#   plugin on a new install, swap back to an old one, and not lose anything.
+# ==============================================================================
+
+# Leave this as "0.1.0". It just tells NeuroDock which version of the plugin
+# format you're using. If you're newer than NeuroDock, you'll get a warning,
+# not an error.
+schema_version: "0.1.0"
+
+# ------------------------------------------------------------------------------
+# 1. WHO THIS PLUGIN IS (Required)
+# ------------------------------------------------------------------------------
+# A short, unique name. Lowercase, dashes between words.
+# Tip: starting it with your handle (e.g. "org-eobrien-...") helps avoid
+# clashes with other contributors' plugins. Not required.
+name: "ie-corporate-translation"
+
+# What kind of plugin is this? Pick one:
+#   skill              — adds a Claude skill (a markdown file with triggers)
+#   mcp-server         — adds a new MCP server with new tools
+#   profile            — adds a profile preset users can copy
+#   translation-pack   — adds translation prompts for a domain (legal, sales...)
+#   language-pack      — adds prompts for a non-US-English workplace culture
+#   theme              — adds a visual theme for UI surfaces
+type: "language-pack"
+
+# Your plugin's version number. Use semver (e.g. "0.2.1"). Bumping the
+# patch (third) number means "small fix, nothing broke". Bumping the minor
+# (middle) means "added a new feature, nothing broke". Bumping the major
+# (first) means "I changed something that might break people". Try not to
+# bump the major in 0.1.x unless you really have to.
+version: "0.2.1"
+
+# A one-sentence description of what this plugin does. This is what people
+# see in plugin listings. Don't make clinical claims here — say what the
+# plugin DOES, not what it TREATS.
+description: "Hiberno-English to neutral corporate English for ND professionals — direct decoding of indirect Irish workplace register without flattening voice."
+
+# ------------------------------------------------------------------------------
+# 2. WHO MADE IT (Optional but appreciated)
+# ------------------------------------------------------------------------------
+# Listing at least one maintainer helps when something needs fixing.
+# "role" is whatever makes sense — maintainer, reviewer, lived-experience reviewer.
+authors:
+  - name: "Eoin O'Brien"
+    handle: "@eobrien"
+    role: "maintainer"
+  - name: "Síofra Ní Bhriain"
+    handle: "@sionb"
+    role: "reviewer" # lived-experience reviewer
+
+# ------------------------------------------------------------------------------
+# 3. WHO IS THIS PLUGIN FOR? (Optional)
+# ------------------------------------------------------------------------------
+# Which neurotypes does this plugin help? Leave the list empty (or remove
+# this block) if it works for everyone — most plugins do.
+#
+# If a user's profile lists any of these neurotypes, NeuroDock turns this
+# plugin on for them automatically. If not, they can still turn it on by
+# hand — your plugin isn't blocked, just not on by default.
+neurotypes:
+  - "adhd"
+  - "audhd"
+  - "asd"
+
+# Which spoken-language / workplace cultures is this plugin for?
+# REQUIRED if type is "language-pack" or "translation-pack".
+# Use BCP 47 tags ("en-IE" = Irish English, "ja-JP" = Japanese, etc.)
+locale:
+  - "en-IE"
+  - "en-GB" # Irish-English register often shows up in UK workplaces too
+
+# ------------------------------------------------------------------------------
+# 4. WHAT THIS PLUGIN NEEDS TO RUN (Optional)
+# ------------------------------------------------------------------------------
+# If your plugin needs a specific version of NeuroDock or another MCP server,
+# say so here. NeuroDock will skip loading your plugin (cleanly) if any of
+# these aren't around.
+requires:
+  substrate_version: ">=0.1.0"
+  mcp_servers:
+    - name: "mcp-translation"
+      version: ">=0.1.0"
+  skills: []
+  plugins: []
+
+# ------------------------------------------------------------------------------
+# 5. WHAT YOUR PLUGIN PROVIDES
+# ------------------------------------------------------------------------------
+# This is the actual content your plugin ships. Each entry points at a file
+# inside your plugin's directory. All paths are relative — your plugin can't
+# reach outside its own folder. That's a deliberate safety rule.
+provides:
+  - type: "language-prompt-override"
+    id: "translate-incoming-en-ie"
+    path: "./prompts/translate-incoming.md"
+    # You can narrow when a single file applies, separate from the
+    # whole-plugin neurotypes/locale settings above.
+    applies_to:
+      locale: ["en-IE", "en-GB"]
+
+  - type: "language-prompt-override"
+    id: "check-tone-en-ie"
+    path: "./prompts/check-tone.md"
+
+  - type: "language-prompt-override"
+    id: "brief-meeting-en-ie"
+    path: "./prompts/brief-meeting.md"
+
+  - type: "translation-prompt"
+    id: "decode-grand"
+    path: "./prompts/idioms/decode-grand.md"
+    # "Grand" in Hiberno-English can mean anything from "excellent" to
+    # "this is not fine and we are not going to discuss it further." It
+    # earns its own prompt.
+
+# ------------------------------------------------------------------------------
+# 6. WHERE THIS PLUGIN CAME FROM (Required)
+# ------------------------------------------------------------------------------
+# This is the "trust" block. It tells NeuroDock how much social process has
+# touched this plugin so it knows whether to prompt the user before activating.
+#
+# Levels:
+#   official     — published by the NeuroDock maintainer; installs silently
+#   verified     — signed against the maintainer keyring; installs silently
+#   community    — your own plugin, author-signed; user gets a one-time prompt
+#   experimental — unsigned; NeuroDock refuses by default unless user opts in
+#
+# Most contributor plugins are "community". That's a good thing.
+trust:
+  level: "community"
+  signature: |
+    -----BEGIN PGP SIGNATURE-----
+    (detached signature over sha256(plugin.yaml + provides[].path contents))
+    -----END PGP SIGNATURE-----
+  keyring_fingerprint: "A1B2 C3D4 E5F6 7890 1234 5678 9ABC DEF0 1234 5678"
+  source_url: "https://github.com/eobrien/ie-corporate-translation"
+
+# ------------------------------------------------------------------------------
+# 7. LICENSE (Required)
+# ------------------------------------------------------------------------------
+# Your plugin's licence. Must be one of the allowed-list licences (they all
+# play nicely with AGPL-3.0). If you pick one that isn't on the list,
+# NeuroDock will refuse to load the plugin with a clear "license_not_allowed"
+# error so nothing silently fails.
+license: "AGPL-3.0-or-later"
+
+# ------------------------------------------------------------------------------
+# 8. WHERE PEOPLE CAN LEARN MORE (Optional)
+# ------------------------------------------------------------------------------
+homepage: "https://hiberno-translate.example.org"
+repository: "https://github.com/eobrien/ie-corporate-translation"
+keywords:
+  - "translation"
+  - "hiberno-english"
+  - "corporate"
+  - "indirect-speech"
+
+# ------------------------------------------------------------------------------
+# 9. LIFECYCLE HOOKS (Optional, advanced)
+# ------------------------------------------------------------------------------
+# Scripts that run on install/uninstall. For safety, NeuroDock will only
+# run these for "official" or "verified" plugins right now. You can declare
+# them for a community plugin — they'll just sit there politely ignored
+# until the safer hook sandbox lands.
+hooks:
+  on_install: "./install.sh" # idempotent; no network, no writing outside the plugin dir
+  on_uninstall: "./uninstall.sh" # clean up anything you created locally
+
+# Reserved for future use. Leave empty.
+compatibility: {}

package/dist/assets/schemas/plugin.minimal.yaml

@@ -0,0 +1,30 @@
+# ==============================================================================
+# THE SMALLEST POSSIBLE PLUGIN MANIFEST
+# ==============================================================================
+# This file contains ONLY the required fields for a NeuroDock plugin. Every
+# other field is optional. If you're just starting out, this is the shape to
+# copy.
+#
+# For the full version with every option explained, see:
+#   packages/core/schemas/plugin.example.yaml
+#
+# For the design rationale behind why these fields exist:
+#   docs/decisions/0007-plugin-protocol.md
+#
+# The "neurodock plugin scaffold" command would write something close to
+# this file. Every required field is present, no optional ones are.
+# ==============================================================================
+
+schema_version: "0.1.0"
+name: "minimal-example"
+type: "skill"
+version: "0.1.0"
+description: "Minimal valid plugin manifest — replace with your one-sentence summary."
+license: "AGPL-3.0-or-later"
+trust:
+  level: "experimental"
+  # Heads up: with trust.level = "experimental" NeuroDock will refuse to
+  # load this plugin by default — that's a safety feature, not a bug.
+  # To get it loading, do one of:
+  #   (a) bump trust.level to "community" and add a "source_url", or
+  #   (b) opt in just this once: `neurodock plugin trust <name> --once`