@onlooker-community/ecosystem 0.10.0 → 0.15.0

package/test/bats/tribunal-gate.bats

@@ -0,0 +1,95 @@
+#!/usr/bin/env bats
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-gate.sh"
+}
+
+ALL_PASSED='[{"judge_id":"a","score":0.85,"passed":true},{"judge_id":"b","score":0.80,"passed":true}]'
+ONE_FAILED='[{"judge_id":"a","score":0.85,"passed":true},{"judge_id":"b","score":0.40,"passed":false}]'
+ALL_FAILED='[{"judge_id":"a","score":0.30,"passed":false},{"judge_id":"b","score":0.40,"passed":false}]'
+NO_META='{}'
+
+@test "strict: all judges pass + score >= threshold → passed" {
+	local out
+	out=$(tribunal_gate_decide "strict" "$ALL_PASSED" "0.82" "0.75" "$NO_META" "0.05" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "true" ]
+}
+
+@test "strict: one judge fails → blocked with dissent_unresolved or low_score" {
+	local out
+	out=$(tribunal_gate_decide "strict" "$ONE_FAILED" "0.62" "0.75" "$NO_META" "0.45" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	# dissent + no meta override → dissent_unresolved
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "dissent_unresolved" ]
+}
+
+@test "majority: more than half pass + score clears → passed" {
+	local three='[{"judge_id":"a","score":0.9,"passed":true},{"judge_id":"b","score":0.8,"passed":true},{"judge_id":"c","score":0.4,"passed":false}]'
+	local out
+	out=$(tribunal_gate_decide "majority" "$three" "0.78" "0.75" "$NO_META" "0.20" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "true" ]
+}
+
+@test "majority: split 1-1 with low score → blocked low_score" {
+	local out
+	out=$(tribunal_gate_decide "majority" "$ONE_FAILED" "0.62" "0.75" "$NO_META" "0.20" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "low_score" ]
+}
+
+@test "unanimous: identical to strict when count > 1" {
+	local out
+	out=$(tribunal_gate_decide "unanimous" "$ALL_PASSED" "0.82" "0.75" "$NO_META" "0.05" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "true" ]
+
+	out=$(tribunal_gate_decide "unanimous" "$ONE_FAILED" "0.62" "0.75" "$NO_META" "0.05" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+}
+
+@test "meta_override accept beats failing jury" {
+	local meta='{"override_recommendation":"accept","bias_detected":false}'
+	local out
+	out=$(tribunal_gate_decide "meta_override" "$ALL_FAILED" "0.30" "0.75" "$meta" "0.10" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "true" ]
+}
+
+@test "meta_override reject blocks even with passing jury" {
+	local meta='{"override_recommendation":"reject","bias_detected":false}'
+	local out
+	out=$(tribunal_gate_decide "meta_override" "$ALL_PASSED" "0.82" "0.75" "$meta" "0.05" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "meta_override" ]
+}
+
+@test "bias_detected + meta says reject → bias_detected reason" {
+	local meta='{"override_recommendation":"reject","bias_detected":true,"bias_types":["verbosity"]}'
+	local out
+	out=$(tribunal_gate_decide "majority" "$ONE_FAILED" "0.60" "0.75" "$meta" "0.45" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "bias_detected" ]
+}
+
+@test "dissent above threshold + no meta override → dissent_unresolved" {
+	local meta='{"bias_detected":false}'
+	local out
+	out=$(tribunal_gate_decide "majority" "$ONE_FAILED" "0.62" "0.50" "$meta" "0.45" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "dissent_unresolved" ]
+}
+
+@test "score clears threshold but jury says no → meta_override or dissent reason" {
+	# All judges marked passed=false but aggregated_score is above threshold
+	# (contrived to exercise the "score_ok + jury_fail" branch).
+	local odd='[{"judge_id":"a","score":0.9,"passed":false},{"judge_id":"b","score":0.8,"passed":false}]'
+	local meta='{"override_recommendation":"reject","bias_detected":false}'
+	local out
+	out=$(tribunal_gate_decide "majority" "$odd" "0.85" "0.75" "$meta" "0.10" "0.25")
+	[ "$(printf '%s' "$out" | jq -r '.passed')" = "false" ]
+	[ "$(printf '%s' "$out" | jq -r '.reason')" = "meta_override" ]
+}

package/test/bats/tribunal-jury.bats

@@ -0,0 +1,80 @@
+#!/usr/bin/env bats
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-config.sh"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-ulid.sh"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-jury.sh"
+
+	tribunal_config_load ""
+}
+
+@test "default empanel produces standard + adversarial" {
+	local panel
+	panel=$(tribunal_jury_empanel '["standard","adversarial"]')
+	[ "$(printf '%s' "$panel" | jq 'length')" = "2" ]
+	[ "$(printf '%s' "$panel" | jq -r '.[0].judge_type')" = "standard" ]
+	[ "$(printf '%s' "$panel" | jq -r '.[1].judge_type')" = "adversarial" ]
+}
+
+@test "each panel member gets a distinct judge_id" {
+	local panel
+	panel=$(tribunal_jury_empanel '["standard","adversarial","security"]')
+	local distinct
+	distinct=$(printf '%s' "$panel" | jq -r '[.[].judge_id] | unique | length')
+	[ "$distinct" = "3" ]
+}
+
+@test "panel members get model from config" {
+	local panel m
+	panel=$(tribunal_jury_empanel '["standard"]')
+	m=$(printf '%s' "$panel" | jq -r '.[0].model')
+	[ "$m" = "claude-opus-4-7" ]
+}
+
+@test "maintainability degrades to standard with warning" {
+	run bash -c '
+		source "${REPO_ROOT}/plugins/tribunal/scripts/lib/tribunal-config.sh"
+		source "${REPO_ROOT}/plugins/tribunal/scripts/lib/tribunal-ulid.sh"
+		source "${REPO_ROOT}/plugins/tribunal/scripts/lib/tribunal-jury.sh"
+		CLAUDE_PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal" tribunal_config_load ""
+		tribunal_jury_empanel "[\"maintainability\"]" 2>&1
+	'
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"degrading to standard"* ]]
+	[[ "$output" == *"standard"* ]]
+}
+
+@test "meta type is refused in jury panel" {
+	local panel
+	panel=$(tribunal_jury_empanel '["standard","meta"]' 2>/dev/null)
+	[ "$(printf '%s' "$panel" | jq 'length')" = "1" ]
+	[ "$(printf '%s' "$panel" | jq -r '.[0].judge_type')" = "standard" ]
+}
+
+@test "subagent mapping is canonical per judge_type" {
+	local panel
+	panel=$(tribunal_jury_empanel '["standard","security","adversarial"]')
+	[ "$(printf '%s' "$panel" | jq -r '.[0].subagent')" = "tribunal-judge-standard" ]
+	[ "$(printf '%s' "$panel" | jq -r '.[1].subagent')" = "tribunal-judge-security" ]
+	[ "$(printf '%s' "$panel" | jq -r '.[2].subagent')" = "tribunal-judge-adversarial" ]
+}
+
+@test "to_schema_judges strips internal subagent field" {
+	local panel schema
+	panel=$(tribunal_jury_empanel '["standard"]')
+	schema=$(tribunal_jury_to_schema_judges "$panel")
+	# subagent must NOT appear in the schema-shape output
+	[ "$(printf '%s' "$schema" | jq -r '.[0] | has("subagent")')" = "false" ]
+	# but judge_id, judge_type, model_id must
+	[ "$(printf '%s' "$schema" | jq -r '.[0] | has("judge_id")')" = "true" ]
+	[ "$(printf '%s' "$schema" | jq -r '.[0] | has("judge_type")')" = "true" ]
+	[ "$(printf '%s' "$schema" | jq -r '.[0] | has("model_id")')" = "true" ]
+}

package/test/bats/tribunal-rubric.bats

@@ -0,0 +1,119 @@
+#!/usr/bin/env bats
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-config.sh"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-rubric.sh"
+
+	tribunal_config_load ""
+}
+
+@test "default rubric loads from builtins" {
+	tribunal_rubric_load ""
+	local r id
+	r=$(tribunal_rubric_get "default")
+	[ -n "$r" ]
+	id=$(printf '%s' "$r" | jq -r '.id')
+	[ "$id" = "default" ]
+}
+
+@test "default rubric id resolves to 'default'" {
+	local id
+	id=$(tribunal_rubric_default_id)
+	[ "$id" = "default" ]
+}
+
+@test "default rubric passes validation" {
+	tribunal_rubric_load ""
+	local r
+	r=$(tribunal_rubric_get "default")
+	run tribunal_rubric_validate "$r"
+	[ "$status" -eq 0 ]
+}
+
+@test "project rubric override by id replaces builtin" {
+	local repo="${BATS_TEST_TMPDIR}/repo"
+	mkdir -p "${repo}/.claude"
+	cat > "${repo}/.claude/tribunal.json" <<'EOF'
+{
+  "rubrics": [
+    {
+      "id": "default",
+      "criteria": [
+        { "name": "tests", "weight": 1.0, "min_pass": 0.9 }
+      ],
+      "score_threshold": 0.9,
+      "max_iterations": 5,
+      "judge_types": ["standard"],
+      "gate_policy": "strict",
+      "aggregation_method": "min"
+    }
+  ]
+}
+EOF
+	tribunal_rubric_load "$repo"
+	local r mi gp
+	r=$(tribunal_rubric_get "default")
+	mi=$(printf '%s' "$r" | jq -r '.max_iterations')
+	gp=$(printf '%s' "$r" | jq -r '.gate_policy')
+	[ "$mi" = "5" ]
+	[ "$gp" = "strict" ]
+}
+
+@test "named rubric from project file is reachable by id" {
+	local repo="${BATS_TEST_TMPDIR}/repo"
+	mkdir -p "${repo}/.claude"
+	cat > "${repo}/.claude/tribunal.json" <<'EOF'
+{
+  "rubrics": [
+    {
+      "id": "security-tight",
+      "criteria": [
+        { "name": "security", "weight": 1.0, "min_pass": 0.95 }
+      ],
+      "score_threshold": 0.95,
+      "max_iterations": 3,
+      "judge_types": ["standard", "security"],
+      "gate_policy": "unanimous",
+      "aggregation_method": "min"
+    }
+  ]
+}
+EOF
+	tribunal_rubric_load "$repo"
+	local r
+	r=$(tribunal_rubric_get "security-tight")
+	[ -n "$r" ]
+	[ "$(printf '%s' "$r" | jq -r '.id')" = "security-tight" ]
+}
+
+@test "missing rubric id returns empty" {
+	tribunal_rubric_load ""
+	local r
+	r=$(tribunal_rubric_get "does-not-exist")
+	[ -z "$r" ]
+}
+
+@test "validate rejects weights summing != 1" {
+	local r='{"id":"bad","criteria":[{"name":"a","weight":0.4,"min_pass":0.5},{"name":"b","weight":0.4,"min_pass":0.5}],"score_threshold":0.75,"max_iterations":3,"judge_types":["standard"],"gate_policy":"majority","aggregation_method":"mean"}'
+	run tribunal_rubric_validate "$r"
+	[ "$status" -ne 0 ]
+}
+
+@test "validate rejects invalid gate_policy" {
+	local r='{"id":"bad","criteria":[{"name":"a","weight":1.0,"min_pass":0.5}],"score_threshold":0.75,"max_iterations":3,"judge_types":["standard"],"gate_policy":"democracy","aggregation_method":"mean"}'
+	run tribunal_rubric_validate "$r"
+	[ "$status" -ne 0 ]
+}
+
+@test "validate rejects out-of-range score_threshold" {
+	local r='{"id":"bad","criteria":[{"name":"a","weight":1.0,"min_pass":0.5}],"score_threshold":1.5,"max_iterations":3,"judge_types":["standard"],"gate_policy":"majority","aggregation_method":"mean"}'
+	run tribunal_rubric_validate "$r"
+	[ "$status" -ne 0 ]
+}

package/test/bats/tribunal-stop-hook.bats

@@ -0,0 +1,73 @@
+#!/usr/bin/env bats
+
+# Exercises the Stop hook's gating behavior. Does not run `claude -p` (the
+# script bails when claude is not on PATH or when conditions don't apply), so
+# these tests verify the SHORT-CIRCUIT branches: disabled, no-git, no-changes.
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	HOOK="${PLUGIN_ROOT}/scripts/hooks/tribunal-stop-gate.sh"
+
+	REPO="${BATS_TEST_TMPDIR}/repo"
+	mkdir -p "$REPO"
+	git -C "$REPO" init -q
+	git -C "$REPO" config user.email test@example.com
+	git -C "$REPO" config user.name test
+	(cd "$REPO" && printf 'initial\n' > README.md && git add README.md && git commit -q -m init)
+
+	TRANSCRIPT="${BATS_TEST_TMPDIR}/transcript.jsonl"
+	printf '{"role":"user","content":"hi"}\n' > "$TRANSCRIPT"
+}
+
+_make_input() {
+	local cwd="$1" tp="$2" sid="${3:-test-session}"
+	jq -n --arg cwd "$cwd" --arg tp "$tp" --arg sid "$sid" \
+		'{cwd: $cwd, transcript_path: $tp, session_id: $sid}'
+}
+
+@test "hook exits 0 silently when stop_hook.enabled is false (default)" {
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	[ -z "$output" ]
+	# No verdict files written
+	! find "${ONLOOKER_DIR}/tribunal" -name 'stop-*.json' 2>/dev/null | grep -q .
+}
+
+@test "hook exits 0 when enabled but no git context" {
+	mkdir -p "${REPO}/.claude"
+	printf '%s\n' '{"tribunal":{"stop_hook":{"enabled":true,"skip_if_no_file_changes":false}}}' \
+		> "${REPO}/.claude/settings.json"
+	# cwd outside any repo
+	local non_repo="${BATS_TEST_TMPDIR}/not-a-repo"
+	mkdir -p "$non_repo"
+	local input
+	input=$(_make_input "$non_repo" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+}
+
+@test "hook skips when enabled + skip_if_no_file_changes + clean tree" {
+	mkdir -p "${REPO}/.claude"
+	printf '%s\n' '{"tribunal":{"stop_hook":{"enabled":true,"skip_if_no_file_changes":true}}}' \
+		> "${REPO}/.claude/settings.json"
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	# No verdict files written (no changes to evaluate)
+	! find "${ONLOOKER_DIR}/tribunal" -name 'stop-*.json' 2>/dev/null | grep -q .
+}
+
+@test "hook never prints to stdout (Stop must not break the contract)" {
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	[ -z "$output" ]
+}

package/test/bats/tribunal-verdict.bats

@@ -0,0 +1,71 @@
+#!/usr/bin/env bats
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-ulid.sh"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-verdict.sh"
+
+	KEY="abc123def456"
+	TASK_ID=$(tribunal_ulid)
+	ITER_ID=$(tribunal_ulid)
+}
+
+@test "ulid is 26 chars" {
+	local u
+	u=$(tribunal_ulid)
+	[ "${#u}" -eq 26 ]
+}
+
+@test "init_task creates task directory" {
+	tribunal_init_task "$KEY" "$TASK_ID"
+	[ -d "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}" ]
+}
+
+@test "init_iteration creates iteration + verdicts dirs" {
+	tribunal_init_iteration "$KEY" "$TASK_ID" "$ITER_ID"
+	[ -d "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/verdicts" ]
+}
+
+@test "write_project_manifest stores remote + repo_root" {
+	tribunal_write_project_manifest "$KEY" "https://example.com/r.git" "/tmp/repo"
+	local m
+	m=$(jq -r '.remote_url' "${ONLOOKER_DIR}/tribunal/${KEY}/manifest.json")
+	[ "$m" = "https://example.com/r.git" ]
+	[ "$(jq -r '.source' "${ONLOOKER_DIR}/tribunal/${KEY}/manifest.json")" = "local" ]
+}
+
+@test "write_task_manifest stores rubric snapshot" {
+	local rubric='{"id":"default","criteria":[{"name":"a","weight":1.0,"min_pass":0.5}],"score_threshold":0.75,"max_iterations":3,"judge_types":["standard"],"gate_policy":"majority","aggregation_method":"mean"}'
+	tribunal_write_task_manifest "$KEY" "$TASK_ID" "do the thing" "default" "$rubric"
+	local path="${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/manifest.json"
+	[ -f "$path" ]
+	[ "$(jq -r '.task_summary' "$path")" = "do the thing" ]
+	[ "$(jq -r '.rubric.gate_policy' "$path")" = "majority" ]
+}
+
+@test "write_actor_output writes actor.md" {
+	tribunal_write_actor_output "$KEY" "$TASK_ID" "$ITER_ID" "# work"
+	local path="${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/actor.md"
+	[ -f "$path" ]
+	[[ "$(cat "$path")" == "# work" ]]
+}
+
+@test "write_judge_verdict writes one file per judge_id" {
+	local v='{"score":0.8,"passed":true,"judge_type":"standard"}'
+	tribunal_write_judge_verdict "$KEY" "$TASK_ID" "$ITER_ID" "judge-1" "$v"
+	tribunal_write_judge_verdict "$KEY" "$TASK_ID" "$ITER_ID" "judge-2" "$v"
+	local count
+	count=$(find "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/verdicts" -name '*.json' -type f | wc -l | tr -d ' ')
+	[ "$count" = "2" ]
+}
+
+@test "write_iteration_artifact persists named JSON files" {
+	tribunal_write_iteration_artifact "$KEY" "$TASK_ID" "$ITER_ID" "consensus" '{"aggregated_score":0.8,"passed":true}'
+	[ -f "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/consensus.json" ]
+}

package/test/fixtures/hook-inputs/user-prompt-submit-rule-match.json

@@ -0,0 +1,8 @@
+{
+  "session_id": "rule-session-001",
+  "transcript_path": "/tmp/transcript.jsonl",
+  "cwd": "/project/repo",
+  "permission_mode": "default",
+  "hook_event_name": "UserPromptSubmit",
+  "prompt": "let's just run git commit -m 'wip' --no-verify and move on"
+}

package/test/fixtures/hook-inputs/user-prompt-submit-rule-nomatch.json

@@ -0,0 +1,8 @@
+{
+  "session_id": "rule-session-002",
+  "transcript_path": "/tmp/transcript.jsonl",
+  "cwd": "/project/repo",
+  "permission_mode": "default",
+  "hook_event_name": "UserPromptSubmit",
+  "prompt": "what does this function do?"
+}

package/test/helpers/setup.bash

@@ -20,6 +20,15 @@ setup_test_env() {
   export ONLOOKER_DIR="${TEST_HOME}/.onlooker"
   export CLAUDE_HOME="${TEST_HOME}/.claude"
   export CLAUDE_PLUGIN_ROOT="${REPO_ROOT}"
+
+  # Sever git from the developer's global config. Otherwise XDG_CONFIG_HOME
+  # (which is exported by the parent shell and not affected by reassigning
+  # HOME) leaks `commit.gpgsign = true` and the per-test signingkey path
+  # into git-driven tests like worktree-tracker, where there's no SSH key
+  # in the isolated $TEST_HOME and `git worktree add` fails to sign.
+  export GIT_CONFIG_GLOBAL=/dev/null
+  export GIT_CONFIG_SYSTEM=/dev/null
+  unset XDG_CONFIG_HOME
 }
 
 # Source validate-path.sh with test env vars already set.

package/test/node/check-manifests.test.mjs

@@ -0,0 +1,173 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, '..', '..');
+const LINTER = join(REPO_ROOT, 'scripts', 'lint', 'check-manifests.mjs');
+
+function scaffold() {
+  const root = mkdtempSync(join(tmpdir(), 'check-manifests-'));
+  mkdirSync(join(root, '.claude-plugin'), { recursive: true });
+  return root;
+}
+
+function writeJson(p, data) {
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`);
+}
+
+function run(root, ...args) {
+  const r = spawnSync('node', [LINTER, '--root', root, ...args], { encoding: 'utf8' });
+  return { code: r.status, stdout: r.stdout, stderr: r.stderr };
+}
+
+const VALID_PLUGIN_JSON = (overrides = {}) => ({
+  name: 'sample',
+  version: '0.1.0',
+  description: 'A sample plugin used by tests.',
+  ...overrides,
+});
+
+const VALID_MARKETPLACE = (overrides = {}) => ({
+  name: 'tm',
+  owner: { name: 'Onlooker' },
+  plugins: [{ name: 'sample', source: './' }],
+  ...overrides,
+});
+
+describe('check-manifests', () => {
+  it('passes a minimally valid marketplace + plugin', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+    assert.match(r.stdout, /ok \(1 plugin/);
+  });
+
+  it('errors if marketplace plugin entry carries a version field (drift hazard)', () => {
+    const root = scaffold();
+    writeJson(
+      join(root, '.claude-plugin', 'marketplace.json'),
+      VALID_MARKETPLACE({
+        plugins: [{ name: 'sample', source: './', version: '0.1.0' }],
+      }),
+    );
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /MUST NOT be set in marketplace\.json/);
+  });
+
+  it('errors when plugin.json name does not match marketplace name', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'mismatched' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /does not match marketplace entry name/);
+  });
+
+  it('errors on non-kebab-case names', () => {
+    const root = scaffold();
+    writeJson(
+      join(root, '.claude-plugin', 'marketplace.json'),
+      VALID_MARKETPLACE({ plugins: [{ name: 'Bad_Name', source: './' }] }),
+    );
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'Bad_Name' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /must be kebab-case/);
+  });
+
+  it('errors on a non-semver version', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ version: 'v1' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /not semver-shaped/);
+  });
+
+  it('errors when required plugin.json fields are missing', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), { name: 'sample' });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /`version` is required/);
+    assert.match(r.stderr, /`description` is required/);
+  });
+
+  it('warns on unknown fields (typo detection)', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(
+      join(root, '.claude-plugin', 'plugin.json'),
+      VALID_PLUGIN_JSON({ descripton: 'typo' }), // misspelled
+    );
+    const r = run(root);
+    // Warnings alone do not fail.
+    assert.equal(r.code, 0);
+    assert.match(r.stderr, /unknown field "descripton"/);
+  });
+
+  it('--strict turns warnings into errors', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ descripton: 'typo' }));
+    const r = run(root, '--strict');
+    assert.equal(r.code, 1);
+  });
+
+  it('errors when skills field is not an array', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ skills: 'oops' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /`skills` must be an array/);
+  });
+
+  it('validates hooks.json shape when present', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    writeJson(join(root, 'hooks', 'hooks.json'), { wrong: true });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /must contain a `hooks` object/);
+  });
+
+  it('warns on hook events not recognized by claude code', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    writeJson(join(root, 'hooks', 'hooks.json'), {
+      hooks: { GibberishEvent: [{ hooks: [] }] },
+    });
+    const r = run(root);
+    assert.equal(r.code, 0);
+    assert.match(r.stderr, /declares unknown event "GibberishEvent"/);
+  });
+
+  it('--plugin filters validation to a single plugin', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [
+        { name: 'good', source: './good' },
+        { name: 'bad', source: './bad' },
+      ],
+    });
+    writeJson(join(root, 'good', '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'good' }));
+    writeJson(join(root, 'bad', '.claude-plugin', 'plugin.json'), { name: 'bad' }); // missing version + description
+    const r = run(root, '--plugin', 'good');
+    assert.equal(r.code, 0, r.stderr);
+  });
+});