@nexrall/code-core 1.4.67 → 1.4.69

package/dist/plugins/installer.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePluginDependencies = parsePluginDependencies;
 exports.searchRegistry = searchRegistry;
 exports.getRegistryPlugin = getRegistryPlugin;
 exports.reportInstall = reportInstall;
@@ -44,14 +45,46 @@ exports.installPlugin = installPlugin;
 exports.readReceipt = readReceipt;
 exports.removePlugin = removePlugin;
 exports.updatePlugin = updatePlugin;
+exports.planPluginPrune = planPluginPrune;
+exports.prunePlugins = prunePlugins;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const client_1 = require("../api/client");
 const index_1 = require("./index");
+const data_1 = require("./data");
 const sources_1 = require("./sources");
 const frontmatter_1 = require("../util/frontmatter");
+/** Read a manifest's `dependencies` list (either spelling), dropping malformed entries. */
+function parsePluginDependencies(dir) {
+    const file = (0, index_1.resolvePluginFile)(dir, 'manifest');
+    if (!file)
+        return [];
+    try {
+        const j = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        if (!Array.isArray(j.dependencies))
+            return [];
+        const out = [];
+        const seen = new Set();
+        for (const raw of j.dependencies) {
+            const obj = raw && typeof raw === 'object' ? raw : null;
+            const name = typeof raw === 'string' ? raw : typeof obj?.name === 'string' ? obj.name : '';
+            const trimmed = name.trim();
+            // Same rule as an install name: a dependency can never escape the plugins
+            // directory, and a repeat entry adds nothing.
+            if (!/^[\w.-]+$/.test(trimmed) || seen.has(trimmed))
+                continue;
+            seen.add(trimmed);
+            const version = typeof obj?.version === 'string' ? obj.version : undefined;
+            out.push(version ? { name: trimmed, version } : { name: trimmed });
+        }
+        return out;
+    }
+    catch {
+        return []; // unreadable/malformed manifest — an install will report the real problem
+    }
+}
 const RECEIPT_FILE = '_install.json';
 /** Search the registry (empty query = list all, official first). */
 async function searchRegistry(query, limit = 50) {
@@ -170,6 +203,7 @@ function inspectPluginDir(dir) {
         hasHooks: (0, index_1.resolvePluginFile)(dir, 'hooks') !== null,
         hasMcp: (0, index_1.resolvePluginFile)(dir, 'mcp') !== null,
         meta,
+        dependencies: parsePluginDependencies(dir),
     };
 }
 /** Read a flat `commands/*.md` or `agents/*.md` directory, returning name + frontmatter description. */
@@ -428,6 +462,42 @@ function pluginsRoot(scope, workDir) {
         ? path.join(workDir || process.cwd(), '.nexrall', 'plugins')
         : path.join(os.homedir(), '.nexrall', 'plugins');
 }
+/**
+ * Directory of an installed plugin of this name, from EITHER scope (project first,
+ * matching loader precedence), or null. Used to decide that a dependency is already
+ * satisfied: the loader serves both scopes into one session, so an install in either
+ * one is a plugin the plugin can actually use.
+ */
+function installedPluginDir(name, workDir) {
+    if (!/^[\w.-]+$/.test(name))
+        return null;
+    for (const scope of ['project', 'global']) {
+        const dir = path.join(pluginsRoot(scope, workDir), name);
+        if (fs.existsSync(dir))
+            return dir;
+    }
+    return null;
+}
+/**
+ * Where would installing dependency `name` come from? A declared source alias wins
+ * (the more specific, locally-declared intent), then the registry — the same order
+ * `nex plugin install <name>` uses, so the two can never disagree about what a name
+ * means.
+ */
+async function resolveDependencySpec(name, workDir) {
+    const alias = (0, sources_1.resolveSourceAlias)(name, workDir ?? process.cwd(), { includeProject: true });
+    if (alias)
+        return { spec: alias.spec };
+    try {
+        const entry = await getRegistryPlugin(name);
+        if (entry)
+            return { spec: entry.source };
+    }
+    catch (err) {
+        return { error: `the registry could not be reached (${err.message})` };
+    }
+    return { error: 'it is not a declared source and not in the registry' };
+}
 async function installPlugin(spec, opts = {}) {
     const source = parsePluginSource(spec);
     const scope = opts.scope ?? 'global';
@@ -496,6 +566,7 @@ async function installPlugin(spec, opts = {}) {
                 sha: sha ?? undefined,
                 previousSha: opts._previousSha,
                 isUpdate: Boolean(opts._previousSha) || Boolean(opts.force),
+                ...(opts._auto ? { requiredBy: opts._auto.requiredBy } : {}),
             });
             if (!ok)
                 throw new Error('Installation cancelled.');
@@ -509,6 +580,52 @@ async function installPlugin(spec, opts = {}) {
             fs.rmSync(dest, { recursive: true, force: true });
         }
         copyPluginDir(pluginRoot, dest);
+        // 5b. Dependencies — install the ones that are missing, at the same scope.
+        // A plugin that calls another plugin's MCP server or skill is broken unless its
+        // dependency is present, and "install A, then go read A's manifest to find out
+        // what else to install" is exactly the step users skip. The safety gate still
+        // runs for each dependency: a dependency can ship hooks of its own.
+        const manifestDeps = parsePluginDependencies(pluginRoot).filter((d) => d.name !== name);
+        const dependencyWarnings = [];
+        const installedDependencies = [];
+        // Every directory this call wrote, newest last. A failed install removes them
+        // again — the point of a failure is that nothing changed, and a half-installed
+        // plugin directory is worse than no plugin at all: it LOADS.
+        const writtenDirs = [dest];
+        try {
+            for (const dep of manifestDeps) {
+                if (dep.version) {
+                    dependencyWarnings.push(`"${dep.name}" declares version "${dep.version}", which is not enforced yet (sources are git specs, not versioned registry entries) — its default branch is used.`);
+                }
+                if ((opts._auto?.stack ?? []).includes(dep.name))
+                    continue; // cycle: A → B → A
+                if (installedPluginDir(dep.name, opts.workDir))
+                    continue; // satisfied by either scope
+                const resolved = await resolveDependencySpec(dep.name, opts.workDir);
+                if ('error' in resolved) {
+                    throw new Error(`Dependency "${dep.name}" of "${name}": ${resolved.error}. Install it first:  nex plugin install ${dep.name}`);
+                }
+                const child = await installPlugin(resolved.spec, {
+                    scope,
+                    workDir: opts.workDir,
+                    name: dep.name,
+                    confirm: opts.confirm,
+                    _auto: { requiredBy: name, stack: [...(opts._auto?.stack ?? []), name] },
+                });
+                writtenDirs.push(...(child.writtenDirs ?? [child.dir]));
+                installedDependencies.push(dep.name, ...(child.installedDependencies ?? []));
+                dependencyWarnings.push(...(child.dependencyWarnings ?? []));
+            }
+        }
+        catch (err) {
+            for (const d of writtenDirs.reverse()) {
+                try {
+                    fs.rmSync(d, { recursive: true, force: true });
+                }
+                catch { /* best effort */ }
+            }
+            throw err;
+        }
         // 6. Receipt for `nex plugin update`
         const receipt = {
             source: source.raw,
@@ -517,9 +634,21 @@ async function installPlugin(spec, opts = {}) {
             subdir: source.subdir,
             installedAt: new Date().toISOString(),
             ...(sha ? { sha } : {}),
+            ...(opts._auto ? { auto: true, requiredBy: opts._auto.requiredBy } : {}),
+            ...(manifestDeps.length ? { dependencies: manifestDeps.map((d) => d.name) } : {}),
         };
         fs.writeFileSync(path.join(dest, RECEIPT_FILE), JSON.stringify(receipt, null, 2));
-        return { name, dir: dest, scope, inspection, sha: sha ?? undefined, previousSha: opts._previousSha };
+        return {
+            name,
+            dir: dest,
+            scope,
+            inspection,
+            sha: sha ?? undefined,
+            previousSha: opts._previousSha,
+            ...(installedDependencies.length ? { installedDependencies } : {}),
+            ...(dependencyWarnings.length ? { dependencyWarnings } : {}),
+            writtenDirs,
+        };
     }
     finally {
         fs.rmSync(tmpBase, { recursive: true, force: true });
@@ -543,6 +672,11 @@ function removePlugin(name, opts = {}) {
         const dir = path.join(pluginsRoot(s, opts.workDir), name);
         if (fs.existsSync(dir)) {
             fs.rmSync(dir, { recursive: true, force: true });
+            // Data goes with the plugin unless --keep-data: the install directory is gone,
+            // and leaving a database/cache behind with no owner is how a later reinstall
+            // silently inherits state nobody meant to keep.
+            if (!opts.keepData)
+                (0, data_1.removePluginData)(name);
             return dir;
         }
     }
@@ -576,4 +710,76 @@ async function updatePlugin(name, opts = {}) {
     }
     throw new Error(`Plugin "${name}" is not installed.`);
 }
+/** What would `nex plugin prune` remove? Pure inspection — installs/removes nothing. */
+function planPluginPrune(opts = {}) {
+    const scopes = opts.scope ? [opts.scope] : ['project', 'global'];
+    const rows = [];
+    for (const s of scopes) {
+        let entries;
+        try {
+            entries = fs.readdirSync(pluginsRoot(s, opts.workDir), { withFileTypes: true });
+        }
+        catch {
+            continue; // scope has no plugins directory — nothing to prune there
+        }
+        for (const e of entries) {
+            if (!e.isDirectory())
+                continue;
+            const dir = path.join(pluginsRoot(s, opts.workDir), e.name);
+            rows.push({ name: e.name, scope: s, dir, receipt: readReceipt(dir) });
+        }
+    }
+    const byName = new Map();
+    for (const r of rows)
+        byName.set(r.name, [...(byName.get(r.name) ?? []), r]);
+    const needed = new Set();
+    const stack = rows.filter((r) => !r.receipt?.auto).map((r) => r.name);
+    while (stack.length) {
+        const n = stack.pop();
+        if (needed.has(n))
+            continue;
+        needed.add(n);
+        for (const r of byName.get(n) ?? []) {
+            // Union of the receipt (what was installed) and the manifest as it stands now
+            // (a hand-edited manifest must not lead to pruning something it still names).
+            const deps = new Set([
+                ...(r.receipt?.dependencies ?? []),
+                ...parsePluginDependencies(r.dir).map((d) => d.name),
+            ]);
+            for (const d of deps)
+                if (!needed.has(d))
+                    stack.push(d);
+        }
+    }
+    const orphans = [];
+    const kept = [];
+    for (const r of rows) {
+        if (r.receipt?.auto && !needed.has(r.name)) {
+            orphans.push({ name: r.name, scope: r.scope, dir: r.dir, requiredBy: r.receipt.requiredBy });
+        }
+        else {
+            kept.push({ name: r.name, scope: r.scope, reason: r.receipt?.auto ? 'needed' : 'manual' });
+        }
+    }
+    return { orphans, kept };
+}
+/**
+ * Remove a plan's orphans. Returns what was actually removed — a directory that
+ * could not be deleted is left in the plan AND out of the result, so the caller
+ * reports reality rather than the intention.
+ */
+function prunePlugins(plan, opts = {}) {
+    const removed = [];
+    for (const o of plan.orphans) {
+        try {
+            fs.rmSync(o.dir, { recursive: true, force: true });
+            removed.push(o);
+            // Same rule as removePlugin: uninstalling takes the data unless told to keep it.
+            if (!opts.keepData)
+                (0, data_1.removePluginData)(o.name);
+        }
+        catch { /* locked directory, permissions — leave it and report the rest */ }
+    }
+    return removed;
+}
 //# sourceMappingURL=installer.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.67",
+  "version": "1.4.69",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",