@onlooker-community/ecosystem 0.9.0 → 0.14.0

package/test/bats/tribunal-stop-hook.bats

@@ -0,0 +1,73 @@
+#!/usr/bin/env bats
+
+# Exercises the Stop hook's gating behavior. Does not run `claude -p` (the
+# script bails when claude is not on PATH or when conditions don't apply), so
+# these tests verify the SHORT-CIRCUIT branches: disabled, no-git, no-changes.
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	HOOK="${PLUGIN_ROOT}/scripts/hooks/tribunal-stop-gate.sh"
+
+	REPO="${BATS_TEST_TMPDIR}/repo"
+	mkdir -p "$REPO"
+	git -C "$REPO" init -q
+	git -C "$REPO" config user.email test@example.com
+	git -C "$REPO" config user.name test
+	(cd "$REPO" && printf 'initial\n' > README.md && git add README.md && git commit -q -m init)
+
+	TRANSCRIPT="${BATS_TEST_TMPDIR}/transcript.jsonl"
+	printf '{"role":"user","content":"hi"}\n' > "$TRANSCRIPT"
+}
+
+_make_input() {
+	local cwd="$1" tp="$2" sid="${3:-test-session}"
+	jq -n --arg cwd "$cwd" --arg tp "$tp" --arg sid "$sid" \
+		'{cwd: $cwd, transcript_path: $tp, session_id: $sid}'
+}
+
+@test "hook exits 0 silently when stop_hook.enabled is false (default)" {
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	[ -z "$output" ]
+	# No verdict files written
+	! find "${ONLOOKER_DIR}/tribunal" -name 'stop-*.json' 2>/dev/null | grep -q .
+}
+
+@test "hook exits 0 when enabled but no git context" {
+	mkdir -p "${REPO}/.claude"
+	printf '%s\n' '{"tribunal":{"stop_hook":{"enabled":true,"skip_if_no_file_changes":false}}}' \
+		> "${REPO}/.claude/settings.json"
+	# cwd outside any repo
+	local non_repo="${BATS_TEST_TMPDIR}/not-a-repo"
+	mkdir -p "$non_repo"
+	local input
+	input=$(_make_input "$non_repo" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+}
+
+@test "hook skips when enabled + skip_if_no_file_changes + clean tree" {
+	mkdir -p "${REPO}/.claude"
+	printf '%s\n' '{"tribunal":{"stop_hook":{"enabled":true,"skip_if_no_file_changes":true}}}' \
+		> "${REPO}/.claude/settings.json"
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	# No verdict files written (no changes to evaluate)
+	! find "${ONLOOKER_DIR}/tribunal" -name 'stop-*.json' 2>/dev/null | grep -q .
+}
+
+@test "hook never prints to stdout (Stop must not break the contract)" {
+	local input
+	input=$(_make_input "$REPO" "$TRANSCRIPT")
+	run bash -c "printf '%s' '$input' | '$HOOK'"
+	[ "$status" -eq 0 ]
+	[ -z "$output" ]
+}

package/test/bats/tribunal-verdict.bats

@@ -0,0 +1,71 @@
+#!/usr/bin/env bats
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/tribunal"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-ulid.sh"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/tribunal-verdict.sh"
+
+	KEY="abc123def456"
+	TASK_ID=$(tribunal_ulid)
+	ITER_ID=$(tribunal_ulid)
+}
+
+@test "ulid is 26 chars" {
+	local u
+	u=$(tribunal_ulid)
+	[ "${#u}" -eq 26 ]
+}
+
+@test "init_task creates task directory" {
+	tribunal_init_task "$KEY" "$TASK_ID"
+	[ -d "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}" ]
+}
+
+@test "init_iteration creates iteration + verdicts dirs" {
+	tribunal_init_iteration "$KEY" "$TASK_ID" "$ITER_ID"
+	[ -d "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/verdicts" ]
+}
+
+@test "write_project_manifest stores remote + repo_root" {
+	tribunal_write_project_manifest "$KEY" "https://example.com/r.git" "/tmp/repo"
+	local m
+	m=$(jq -r '.remote_url' "${ONLOOKER_DIR}/tribunal/${KEY}/manifest.json")
+	[ "$m" = "https://example.com/r.git" ]
+	[ "$(jq -r '.source' "${ONLOOKER_DIR}/tribunal/${KEY}/manifest.json")" = "local" ]
+}
+
+@test "write_task_manifest stores rubric snapshot" {
+	local rubric='{"id":"default","criteria":[{"name":"a","weight":1.0,"min_pass":0.5}],"score_threshold":0.75,"max_iterations":3,"judge_types":["standard"],"gate_policy":"majority","aggregation_method":"mean"}'
+	tribunal_write_task_manifest "$KEY" "$TASK_ID" "do the thing" "default" "$rubric"
+	local path="${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/manifest.json"
+	[ -f "$path" ]
+	[ "$(jq -r '.task_summary' "$path")" = "do the thing" ]
+	[ "$(jq -r '.rubric.gate_policy' "$path")" = "majority" ]
+}
+
+@test "write_actor_output writes actor.md" {
+	tribunal_write_actor_output "$KEY" "$TASK_ID" "$ITER_ID" "# work"
+	local path="${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/actor.md"
+	[ -f "$path" ]
+	[[ "$(cat "$path")" == "# work" ]]
+}
+
+@test "write_judge_verdict writes one file per judge_id" {
+	local v='{"score":0.8,"passed":true,"judge_type":"standard"}'
+	tribunal_write_judge_verdict "$KEY" "$TASK_ID" "$ITER_ID" "judge-1" "$v"
+	tribunal_write_judge_verdict "$KEY" "$TASK_ID" "$ITER_ID" "judge-2" "$v"
+	local count
+	count=$(find "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/verdicts" -name '*.json' -type f | wc -l | tr -d ' ')
+	[ "$count" = "2" ]
+}
+
+@test "write_iteration_artifact persists named JSON files" {
+	tribunal_write_iteration_artifact "$KEY" "$TASK_ID" "$ITER_ID" "consensus" '{"aggregated_score":0.8,"passed":true}'
+	[ -f "${ONLOOKER_DIR}/tribunal/${KEY}/${TASK_ID}/iteration-${ITER_ID}/consensus.json" ]
+}

package/test/bats/validate-path.bats

@@ -96,7 +96,7 @@ setup() {
   export _HOOK_SESSION_ID="emit-session"
   export ONLOOKER_HOOK_TYPE="PreToolUse"
   export ONLOOKER_TOOL_NAME="Read"
-  local payload='{"path":"/tmp/example.txt"}'
+  local payload='{"path":"/tmp/example.txt","read_mode":"full"}'
   safe_emit "tool.file.read" "$payload"
   [ "$?" -eq 0 ]
   [ -f "$ONLOOKER_EVENTS_LOG" ]

package/test/fixtures/hook-inputs/post-tool-use-read-chunked.json

@@ -0,0 +1,15 @@
+{
+  "session_id": "history-session-001",
+  "hook_event_name": "PostToolUse",
+  "tool_name": "Read",
+  "tool_use_id": "toolu_read_002",
+  "duration_ms": 18,
+  "tool_input": {
+    "file_path": "/project/src/large-module.ts",
+    "offset": 400,
+    "limit": 80
+  },
+  "tool_response": {
+    "content": "// chunk line 1\n// chunk line 2\n"
+  }
+}

package/test/fixtures/hook-inputs/user-prompt-submit-rule-match.json

@@ -0,0 +1,8 @@
+{
+  "session_id": "rule-session-001",
+  "transcript_path": "/tmp/transcript.jsonl",
+  "cwd": "/project/repo",
+  "permission_mode": "default",
+  "hook_event_name": "UserPromptSubmit",
+  "prompt": "let's just run git commit -m 'wip' --no-verify and move on"
+}

package/test/fixtures/hook-inputs/user-prompt-submit-rule-nomatch.json

@@ -0,0 +1,8 @@
+{
+  "session_id": "rule-session-002",
+  "transcript_path": "/tmp/transcript.jsonl",
+  "cwd": "/project/repo",
+  "permission_mode": "default",
+  "hook_event_name": "UserPromptSubmit",
+  "prompt": "what does this function do?"
+}

package/test/helpers/setup.bash

@@ -20,6 +20,15 @@ setup_test_env() {
   export ONLOOKER_DIR="${TEST_HOME}/.onlooker"
   export CLAUDE_HOME="${TEST_HOME}/.claude"
   export CLAUDE_PLUGIN_ROOT="${REPO_ROOT}"
+
+  # Sever git from the developer's global config. Otherwise XDG_CONFIG_HOME
+  # (which is exported by the parent shell and not affected by reassigning
+  # HOME) leaks `commit.gpgsign = true` and the per-test signingkey path
+  # into git-driven tests like worktree-tracker, where there's no SSH key
+  # in the isolated $TEST_HOME and `git worktree add` fails to sign.
+  export GIT_CONFIG_GLOBAL=/dev/null
+  export GIT_CONFIG_SYSTEM=/dev/null
+  unset XDG_CONFIG_HOME
 }
 
 # Source validate-path.sh with test env vars already set.

package/test/node/check-manifests.test.mjs

@@ -0,0 +1,173 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, '..', '..');
+const LINTER = join(REPO_ROOT, 'scripts', 'lint', 'check-manifests.mjs');
+
+function scaffold() {
+  const root = mkdtempSync(join(tmpdir(), 'check-manifests-'));
+  mkdirSync(join(root, '.claude-plugin'), { recursive: true });
+  return root;
+}
+
+function writeJson(p, data) {
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`);
+}
+
+function run(root, ...args) {
+  const r = spawnSync('node', [LINTER, '--root', root, ...args], { encoding: 'utf8' });
+  return { code: r.status, stdout: r.stdout, stderr: r.stderr };
+}
+
+const VALID_PLUGIN_JSON = (overrides = {}) => ({
+  name: 'sample',
+  version: '0.1.0',
+  description: 'A sample plugin used by tests.',
+  ...overrides,
+});
+
+const VALID_MARKETPLACE = (overrides = {}) => ({
+  name: 'tm',
+  owner: { name: 'Onlooker' },
+  plugins: [{ name: 'sample', source: './' }],
+  ...overrides,
+});
+
+describe('check-manifests', () => {
+  it('passes a minimally valid marketplace + plugin', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+    assert.match(r.stdout, /ok \(1 plugin/);
+  });
+
+  it('errors if marketplace plugin entry carries a version field (drift hazard)', () => {
+    const root = scaffold();
+    writeJson(
+      join(root, '.claude-plugin', 'marketplace.json'),
+      VALID_MARKETPLACE({
+        plugins: [{ name: 'sample', source: './', version: '0.1.0' }],
+      }),
+    );
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /MUST NOT be set in marketplace\.json/);
+  });
+
+  it('errors when plugin.json name does not match marketplace name', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'mismatched' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /does not match marketplace entry name/);
+  });
+
+  it('errors on non-kebab-case names', () => {
+    const root = scaffold();
+    writeJson(
+      join(root, '.claude-plugin', 'marketplace.json'),
+      VALID_MARKETPLACE({ plugins: [{ name: 'Bad_Name', source: './' }] }),
+    );
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'Bad_Name' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /must be kebab-case/);
+  });
+
+  it('errors on a non-semver version', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ version: 'v1' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /not semver-shaped/);
+  });
+
+  it('errors when required plugin.json fields are missing', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), { name: 'sample' });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /`version` is required/);
+    assert.match(r.stderr, /`description` is required/);
+  });
+
+  it('warns on unknown fields (typo detection)', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(
+      join(root, '.claude-plugin', 'plugin.json'),
+      VALID_PLUGIN_JSON({ descripton: 'typo' }), // misspelled
+    );
+    const r = run(root);
+    // Warnings alone do not fail.
+    assert.equal(r.code, 0);
+    assert.match(r.stderr, /unknown field "descripton"/);
+  });
+
+  it('--strict turns warnings into errors', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ descripton: 'typo' }));
+    const r = run(root, '--strict');
+    assert.equal(r.code, 1);
+  });
+
+  it('errors when skills field is not an array', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ skills: 'oops' }));
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /`skills` must be an array/);
+  });
+
+  it('validates hooks.json shape when present', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    writeJson(join(root, 'hooks', 'hooks.json'), { wrong: true });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /must contain a `hooks` object/);
+  });
+
+  it('warns on hook events not recognized by claude code', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), VALID_MARKETPLACE());
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON());
+    writeJson(join(root, 'hooks', 'hooks.json'), {
+      hooks: { GibberishEvent: [{ hooks: [] }] },
+    });
+    const r = run(root);
+    assert.equal(r.code, 0);
+    assert.match(r.stderr, /declares unknown event "GibberishEvent"/);
+  });
+
+  it('--plugin filters validation to a single plugin', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [
+        { name: 'good', source: './good' },
+        { name: 'bad', source: './bad' },
+      ],
+    });
+    writeJson(join(root, 'good', '.claude-plugin', 'plugin.json'), VALID_PLUGIN_JSON({ name: 'good' }));
+    writeJson(join(root, 'bad', '.claude-plugin', 'plugin.json'), { name: 'bad' }); // missing version + description
+    const r = run(root, '--plugin', 'good');
+    assert.equal(r.code, 0, r.stderr);
+  });
+});

package/test/node/check-references.test.mjs

@@ -0,0 +1,279 @@
+// Tests for scripts/lint/check-references.mjs. Each test stands up a
+// scratch marketplace under BATS_TEST_TMPDIR-style isolation, runs the
+// linter as a subprocess, and asserts on exit code + emitted output.
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, '..', '..');
+const LINTER = join(REPO_ROOT, 'scripts', 'lint', 'check-references.mjs');
+
+function scaffold() {
+  const root = mkdtempSync(join(tmpdir(), 'check-refs-'));
+  mkdirSync(join(root, '.claude-plugin'), { recursive: true });
+  return root;
+}
+
+function writeJson(p, data) {
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`);
+}
+
+function writeFile(p, text) {
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, text);
+}
+
+function run(root, ...args) {
+  const r = spawnSync('node', [LINTER, '--root', root, ...args], { encoding: 'utf8' });
+  return { code: r.status, stdout: r.stdout, stderr: r.stderr };
+}
+
+function writeSkill(root, pluginDir, fileRelPath, frontmatter, body = '') {
+  const fmLines = ['---', ...Object.entries(frontmatter).map(([k, v]) => `${k}: ${v}`), '---', body];
+  writeFile(join(root, pluginDir, fileRelPath), fmLines.join('\n'));
+}
+
+describe('check-references', () => {
+  it('passes on an empty marketplace', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+    });
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+  });
+
+  it('passes when skills and commands resolve and have frontmatter', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/think.md'],
+      commands: ['./commands/commit.md'],
+    });
+    writeSkill(root, '.', 'skills/think.md', { name: 'think', description: 'muse' });
+    writeSkill(root, '.', 'commands/commit.md', { name: 'commit', description: 'git commit' });
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+    assert.match(r.stdout, /ok \(2 records/);
+  });
+
+  it('fails when a referenced path does not exist', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/missing.md'],
+    });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /points to a missing file/);
+  });
+
+  it('fails when a markdown file has no frontmatter', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/bare.md'],
+    });
+    writeFile(join(root, 'skills/bare.md'), 'no frontmatter here\n');
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /missing YAML frontmatter/);
+  });
+
+  it('fails when required frontmatter fields are missing', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/half.md'],
+    });
+    writeSkill(root, '.', 'skills/half.md', { name: 'half' });
+    const r = run(root);
+    assert.equal(r.code, 1);
+    assert.match(r.stderr, /missing required frontmatter field "description"/);
+  });
+
+  it('warns on body references to unknown slash commands', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/refs.md'],
+    });
+    writeSkill(
+      root,
+      '.',
+      'skills/refs.md',
+      { name: 'refs', description: 'x' },
+      'Use the /nonexistent-command to bootstrap.',
+    );
+    const r = run(root);
+    // Warnings alone do not fail by default.
+    assert.equal(r.code, 0);
+    assert.match(r.stderr, /unknown command "\/nonexistent-command"/);
+  });
+
+  it('does not warn on built-in slash commands', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/refs.md'],
+    });
+    writeSkill(root, '.', 'skills/refs.md', { name: 'refs', description: 'x' }, 'Run /help and /clear to reset.');
+    const r = run(root);
+    assert.equal(r.code, 0);
+    assert.doesNotMatch(r.stderr, /unknown command/);
+  });
+
+  it('does not warn on commands declared elsewhere in the same marketplace', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [
+        { name: 'ecosystem', source: './' },
+        { name: 'archivist', source: './plugins/archivist' },
+      ],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      commands: ['./commands/pin.md'],
+      skills: ['./skills/uses-pin.md'],
+    });
+    writeSkill(root, '.', 'commands/pin.md', { name: 'pin', description: 'pin a memory' });
+    writeSkill(
+      root,
+      '.',
+      'skills/uses-pin.md',
+      { name: 'uses-pin', description: 'x' },
+      'Call /pin to mark an item as important.',
+    );
+    writeJson(join(root, 'plugins/archivist/.claude-plugin/plugin.json'), {
+      name: 'archivist',
+      version: '0.0.1',
+    });
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /unknown command/);
+  });
+
+  it('--strict turns warnings into errors', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/refs.md'],
+    });
+    writeSkill(root, '.', 'skills/refs.md', { name: 'refs', description: 'x' }, 'Run /nothing-here.');
+    const r = run(root, '--strict');
+    assert.equal(r.code, 1);
+  });
+
+  it('--plugin filters to a single plugin', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [
+        { name: 'ecosystem', source: './' },
+        { name: 'archivist', source: './plugins/archivist' },
+      ],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/missing.md'],
+    });
+    writeJson(join(root, 'plugins/archivist/.claude-plugin/plugin.json'), {
+      name: 'archivist',
+      version: '0.0.1',
+    });
+    const r = run(root, '--plugin', 'archivist');
+    // ecosystem has a broken path, but we filtered it out, so this passes.
+    assert.equal(r.code, 0, r.stderr);
+  });
+
+  it('treats a directory entry as a tree of markdown files', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills'],
+    });
+    writeSkill(root, '.', 'skills/a.md', { name: 'a', description: 'x' });
+    writeSkill(root, '.', 'skills/nested/b.md', { name: 'b', description: 'y' });
+    const r = run(root);
+    assert.equal(r.code, 0, r.stderr);
+    assert.match(r.stdout, /ok \(2 records/);
+  });
+
+  it('ignores slash-command-like strings inside backtick spans', () => {
+    const root = scaffold();
+    writeJson(join(root, '.claude-plugin', 'marketplace.json'), {
+      name: 'tm',
+      plugins: [{ name: 'ecosystem', source: './' }],
+    });
+    writeJson(join(root, '.claude-plugin', 'plugin.json'), {
+      name: 'ecosystem',
+      version: '0.0.1',
+      skills: ['./skills/code.md'],
+    });
+    writeSkill(
+      root,
+      '.',
+      'skills/code.md',
+      { name: 'code', description: 'x' },
+      'Inline `/should-not-warn` should be ignored.',
+    );
+    const r = run(root);
+    assert.equal(r.code, 0);
+    assert.doesNotMatch(r.stderr, /unknown command/);
+  });
+});