@pi-harness/pi-harness 0.1.13 → 0.1.15

package/packages/api-gateway/test/marketplace.test.ts

@@ -13,6 +13,19 @@ import {
 } from "../src/marketplace.js";
 
 describe("plugin marketplace registry", () => {
+  test.each(MARKETPLACE_PLUGINS)(
+    "imports $id from its published package entry point",
+    async (plugin) => {
+      const entryUrl = import.meta.resolve(plugin.packageName);
+      const module = (await import(/* @vite-ignore */ entryUrl)) as { default?: unknown };
+      const entry = module.default as { apply?: unknown } | undefined;
+
+      expect(entry).toBeDefined();
+      expect(typeof entry?.apply).toBe("function");
+    },
+    30_000,
+  );
+
   test("contains reviewable, uniquely identified entries", () => {
     expect(MARKETPLACE_PLUGINS.length).toBeGreaterThan(0);
     expect(new Set(MARKETPLACE_PLUGINS.map((plugin) => plugin.id)).size).toBe(MARKETPLACE_PLUGINS.length);
@@ -25,48 +38,357 @@ describe("plugin marketplace registry", () => {
     const official = new Map(MARKETPLACE_PLUGINS.filter((plugin) => plugin.source === "official").map((plugin) => [plugin.id, plugin]));
     expect(official.get("agent-teams")?.category.id).toBe("collaboration");
     expect(official.get("plugin-stars")?.category.id).toBe("discovery");
+    expect(official.get("plugin-stars")?.description).toMatch(
+      /curated.*raw\.githubusercontent\.com.*descriptor-safe.*bounded.*cancellable.*fail-closed.*panel/iu,
+    );
+    expect(official.get("plugin-stars")?.capabilities).toEqual([
+      "curated GitHub ranking search",
+      "strict bounded snapshot validation",
+      "redirect-free source fetch",
+      "cancellable request lifecycle",
+      "bounded panel inventory",
+      "validated fail-closed panel reporting",
+    ]);
+    expect(official.get("plugin-stars")?.hooks).toEqual(["ranking search tool", "raw GitHub snapshot", "plugin UI"]);
+    expect(official.get("plugin-stars")?.profile.config).toEqual({
+      sourceUrl: "https://raw.githubusercontent.com/ywsldxk/dsh-plugin-stars/main/data/plugins.json",
+      limit: 10,
+      timeoutMs: 15_000,
+    });
     expect(official.get("vision-toolkit")?.category.id).toBe("multimodal");
+    expect(official.get("vision-toolkit")?.description).toMatch(/signature-verified.*PNG.*JPEG.*GIF.*WebP.*bounded header.*cancellable.*local/iu);
+    expect(official.get("vision-toolkit")?.capabilities).toEqual([
+      "bounded workspace image catalog",
+      "signature-verified image metadata",
+      "PNG JPEG GIF and WebP dimensions",
+      "cancellable bounded traversal",
+      "bounded normalized panel",
+    ]);
+    expect(official.get("vision-toolkit")?.hooks).toEqual(["image metadata tools", "workspace access", "plugin UI"]);
+    expect(official.get("vision-toolkit")?.profile.config).toEqual({});
     expect(official.get("session-bridge")?.category.id).toBe("workflow");
-    expect(official.get("session-bridge")?.capabilities).toContain("five-part preview");
+    expect(official.get("session-bridge")?.description).toMatch(/preview.*export.*confirmed import.*strictly validated.*bounded.*LLM context.*duplicate/iu);
+    expect(official.get("session-bridge")?.capabilities).toEqual([
+      "strict bounded handoff format",
+      "five-part review preview",
+      "confirmed context import",
+      "active-session targeting",
+      "duplicate import protection",
+      "bounded operation status",
+      "bounded normalized panel",
+    ]);
+    expect(official.get("session-bridge")?.hooks).toEqual(["session bridge tools", "active session manager", "custom context messages", "plugin UI"]);
+    expect(official.get("session-bridge")?.profile.config).toEqual({});
     expect(official.get("skill-guard")?.category.id).toBe("security");
+    expect(official.get("skill-guard")?.description).toMatch(/loaded Skill entry.*bounded heuristic.*does not disable/iu);
+    expect(official.get("skill-guard")?.capabilities).toEqual([
+      "bounded loaded-entry audit",
+      "instruction-override heuristics",
+      "secret-exfiltration heuristics",
+      "destructive-command and obfuscation heuristics",
+      "descriptor-safe cancellable scans",
+      "bounded normalized panel",
+    ]);
+    expect(official.get("skill-guard")?.hooks).toEqual(["skill scan tool", "resource loader", "plugin UI"]);
+    expect(official.get("skill-guard")?.profile.config).toEqual({});
     expect(official.get("cost-meter")?.category.id).toBe("observability");
+    expect(official.get("cost-meter")?.description).toMatch(/runtime-reported.*UTC daily increments.*bounded local ledger/iu);
+    expect(official.get("cost-meter")?.capabilities).toEqual([
+      "UTC daily cost ledger",
+      "session cost snapshots",
+      "daily budget monitoring",
+      "bounded local persistence",
+    ]);
+    expect(official.get("cost-meter")?.hooks).toEqual(["agent end", "cost report tool", "plugin UI"]);
+    expect(official.get("cost-meter")?.profile.config).toEqual({ dailyBudget: 0, maxEntries: 365 });
     expect(official.get("skill-catalog")?.category.id).toBe("discovery");
     expect(official.get("prompt-guard")?.category.id).toBe("security");
     expect(official.get("browser-fetch")?.category.id).toBe("web");
+    expect(official.get("browser-fetch")?.description).toMatch(/bounded.*text.*descriptor-safe.*DNS.*pinn.*redirect.*private.*timeout.*validated.*panel/iu);
+    expect(official.get("browser-fetch")?.capabilities).toEqual([
+      "bounded textual HTTP fetch",
+      "DNS rebinding protection",
+      "per-hop SSRF validation",
+      "cancellable request lifecycle",
+      "bounded browser preview",
+      "validated fail-closed panel reporting",
+    ]);
+    expect(official.get("browser-fetch")?.profile.config).toEqual({ allowPrivate: false, timeoutMs: 20_000 });
     expect(official.get("web-research")?.category.id).toBe("web");
     expect(official.get("mcp-client")?.category.id).toBe("tools");
+    expect(official.get("mcp-client")?.description).toMatch(/MCP stdio.*bounded.*pagination.*tool.*resource.*prompt.*cancellable.*lifecycle/iu);
+    expect(official.get("mcp-client")?.capabilities).toEqual([
+      "bounded MCP stdio transport",
+      "bounded inventory pagination",
+      "tool resource and prompt bridging",
+      "persistent server lifecycle",
+      "cancellable queued requests",
+    ]);
+    expect(official.get("mcp-client")?.hooks).toEqual(["MCP stdio tools", "managed server lifecycle", "plugin UI"]);
+    expect(official.get("mcp-client")?.profile.config).toEqual({ servers: [] });
     expect(official.get("at-file")?.category.id).toBe("context");
-    expect(official.get("dependency-checker")?.category.id).toBe("workflow");
+    expect(official.get("at-file")?.description).toMatch(/bounded 256 KiB.*UTF-8.*canonical.*untrusted.*closing-tag.*cancellable.*sequential/iu);
+    expect(official.get("at-file")?.capabilities).toEqual([
+      "256 KiB strict UTF-8 text attachments",
+      "canonical workspace path confinement",
+      "no-follow regular-file reads",
+      "untrusted context framing",
+      "closing-tag neutralization",
+      "cancellable sequential execution",
+      "descriptor-safe normalized panel",
+    ]);
+    expect(official.get("at-file")?.hooks).toEqual(["file context tool", "workspace file read", "plugin UI"]);
+    expect(official.get("at-file")?.profile.config).toEqual({});
+    expect(official.get("dependency-checker")?.category.id).toBe("developer");
+    expect(official.get("dependency-checker")?.description).toMatch(/bounded.*offline.*read-only.*package\.json.*requirements.*presence.*unresolved/iu);
+    expect(official.get("dependency-checker")?.capabilities).toEqual([
+      "2000-declaration local presence scan",
+      "4096-entry workspace-contained virtualenv scan",
+      "npm common-intersection conflict detection",
+      "bounded Python numeric constraint analysis",
+      "unresolved constraint and directive reporting",
+      "optional dependency reporting",
+      "descriptor-safe normalized panel",
+    ]);
+    expect(official.get("dependency-checker")?.hooks).toEqual(["dependency check tool", "workspace manifest read", "plugin UI"]);
     expect(official.get("token-guard")?.category.id).toBe("observability");
+    expect(official.get("token-guard")?.description).toMatch(/descriptor-safe.*one abort.*per run.*context.*billed run-token.*cached.*normalized panel/iu);
+    expect(official.get("token-guard")?.capabilities).toEqual([
+      "strict context percentage budget",
+      "optional billed run-token budget",
+      "one abort request per run",
+      "resilient descriptor-safe monitoring",
+      "bounded streaming inspection cadence",
+      "bounded abort error status",
+      "cached normalized panel",
+    ]);
+    expect(official.get("token-guard")?.hooks).toEqual(["Pi session lifecycle", "active runtime abort", "session usage and statistics", "plugin UI"]);
+    expect(official.get("token-guard")?.profile.config).toEqual({ maxPercent: 90, maxRunTokens: 0 });
     expect(official.get("recall-unread")?.category.id).toBe("workflow");
+    expect(official.get("recall-unread")?.description).toMatch(/read-only.*bounded.*strict UTF-8.*current workspace.*unanswered.*cached/iu);
+    expect(official.get("recall-unread")?.capabilities).toEqual([
+      "bounded current-workspace JSONL discovery",
+      "strict UTF-8 no-follow session reads",
+      "unanswered-tail detection",
+      "cached startup and manual rescans",
+      "descriptor-safe cancellable queries",
+      "bounded normalized panel",
+    ]);
+    expect(official.get("recall-unread")?.hooks).toEqual(["recall unread tool", "native session storage", "active session manager", "plugin UI"]);
+    expect(official.get("recall-unread")?.profile.config).toEqual({});
     expect(official.get("turn-rewind")?.category.id).toBe("workflow");
+    expect(official.get("turn-rewind")?.description).toMatch(/bounded.*current branch.*queued.*cancellable.*native session tree/iu);
+    expect(official.get("turn-rewind")?.capabilities).toEqual([
+      "bounded current-branch candidate scan",
+      "settled-state queued navigation",
+      "preserved native session branches",
+      "optional branch summarization",
+      "cancellable serialized rewinds",
+      "bounded normalized operation panel",
+    ]);
+    expect(official.get("turn-rewind")?.hooks).toEqual(["session rewind tool", "active session tree", "agent settled lifecycle", "plugin UI"]);
+    expect(official.get("turn-rewind")?.profile.config).toEqual({});
     expect(official.get("context-doctor")?.category.id).toBe("observability");
     expect(official.get("history-compressor")?.category.id).toBe("context");
     expect(official.get("reviewer-bot")?.category.id).toBe("workflow");
     expect(official.get("auto-mode")?.category.id).toBe("security");
     expect(official.get("plan-execute")?.category.id).toBe("workflow");
     expect(official.get("canvas-draw")?.category.id).toBe("multimodal");
+    expect(official.get("canvas-draw")?.description).toMatch(/Mermaid flowchart source/iu);
+    expect(official.get("canvas-draw")?.hooks).toEqual(["plugin UI"]);
     expect(official.get("image-compressor")?.category.id).toBe("multimodal");
     expect(official.get("code2skill")?.category.id).toBe("tools");
+    expect(official.get("code2skill")?.description).toMatch(/selected workspace source files/iu);
+    expect(official.get("code2skill")?.capabilities).toEqual(["bounded skill packaging", "source file preservation", "SKILL.md generation"]);
     expect(official.get("workspace-search")?.category.id).toBe("context");
     expect(official.get("plugin-check")?.category.id).toBe("security");
     expect(official.get("test-harness")?.category.id).toBe("testing");
+    expect(official.get("test-harness")?.description).toMatch(
+      /five fixed npm script.*trusted workspace.*12 KiB.*UTF-8.*untrusted.*timeout.*cancellable process-tree/iu,
+    );
+    expect(official.get("test-harness")?.capabilities).toEqual([
+      "five-script verification allowlist",
+      "real npm exit status and signal reporting",
+      "12 KiB UTF-8-safe output tail",
+      "terminal-control sanitization and untrusted framing",
+      "configurable bounded timeout",
+      "cancellable process-tree cleanup",
+      "descriptor-safe normalized panel",
+    ]);
+    expect(official.get("test-harness")?.hooks).toEqual(["project verification tool", "workspace npm scripts", "plugin UI"]);
+    expect(official.get("test-harness")?.profile.config).toEqual({ timeoutMs: 120_000 });
     expect(official.get("git-time-capsule")?.category.id).toBe("workflow");
+    expect(official.get("git-time-capsule")?.description).toMatch(/unstaged tracked Git diff.*byte.*validated.*reverse/iu);
+    expect(official.get("git-time-capsule")?.capabilities).toEqual([
+      "byte-exact validated unstaged diff capture",
+      "exclusive no-clobber capsule publication",
+      "confirmed deterministic reverse apply",
+      "bounded 256-capsule inventory",
+      "cancellable serialized Git operations",
+      "descriptor-safe normalized panel",
+    ]);
+    expect(official.get("git-time-capsule")?.hooks).toEqual(["Git snapshot tool", "Git restore tool", "plugin UI"]);
+    expect(official.get("git-time-capsule")?.profile.config).toEqual({ timeoutMs: 15_000 });
+    expect(official.get("graph-memory")?.description).toMatch(/bounded typed.*directed relations.*atomic.*cross-session/iu);
+    expect(official.get("graph-memory")?.capabilities).toEqual([
+      "bounded typed nodes",
+      "validated directed relations",
+      "ranked graph search",
+      "atomic locked persistence",
+    ]);
+    expect(official.get("graph-memory")?.hooks).toEqual(["graph memory tools", "local graph file", "plugin UI"]);
+    expect(official.get("graph-memory")?.profile.config).toEqual({ fileName: "graph-memory.json", maxNodes: 2_000, maxRelations: 5_000 });
     expect(official.get("yaml-validator")?.category.id).toBe("developer");
+    expect(official.get("yaml-validator")?.description).toMatch(/workspace-contained.*UTF-8.*multi-document.*bounded.*cancellable/iu);
+    expect(official.get("yaml-validator")?.capabilities).toEqual([
+      "workspace-contained bounded reads",
+      "strict UTF-8 multi-document YAML",
+      "line-aware error and warning diagnostics",
+      "cancellable validation lifecycle",
+      "bounded panel previews",
+    ]);
+    expect(official.get("yaml-validator")?.hooks).toEqual(["YAML validation tool", "workspace files", "plugin UI"]);
+    expect(official.get("yaml-validator")?.profile.config).toEqual({});
     expect(official.get("browser-session")?.category.id).toBe("web");
+    expect(official.get("browser-session")?.category).toEqual(official.get("browser-fetch")?.category);
+    expect(official.get("browser-session")?.description).toMatch(/loopback-only.*descriptor-safe.*bounded.*cancellable.*screenshot.*validated.*panel/iu);
+    expect(official.get("browser-session")?.capabilities).toEqual([
+      "loopback-only CDP endpoint",
+      "bounded tab discovery",
+      "navigation read click and screenshot tools",
+      "cancellable request lifecycle",
+      "bounded panel previews",
+      "validated fail-closed panel reporting",
+    ]);
+    expect(official.get("browser-session")?.hooks).toEqual(["browser session tools", "Chrome DevTools Protocol", "plugin UI"]);
+    expect(official.get("browser-session")?.profile.config).toEqual({ endpoint: "http://127.0.0.1:9222" });
     expect(official.get("docker-sandbox")?.category.id).toBe("security");
+    expect(official.get("docker-sandbox")?.description).toMatch(
+      /descriptor-safe.*local-only.*no container network.*read-only workspace.*CPU.*memory.*PID.*sanitized output.*strict panel.*cancellation cleanup/iu,
+    );
+    expect(official.get("docker-sandbox")?.capabilities).toEqual([
+      "local-only image execution",
+      "no-network containers",
+      "read-only workspace by default",
+      "CPU memory and PID limits",
+      "sanitized bounded output",
+      "strict panel reporting",
+      "cancellation cleanup",
+    ]);
+    expect(official.get("docker-sandbox")?.hooks).toEqual(["sandbox execution tool", "Docker CLI", "plugin UI"]);
+    expect(official.get("docker-sandbox")?.profile.config).toEqual({});
     expect(official.get("mock-server")?.category.id).toBe("tools");
     expect(official.get("sql-lens")?.category.id).toBe("tools");
+    expect(official.get("sql-lens")?.description).toMatch(
+      /workspace.*SQLite.*strict.*descriptor-safe.*single.*read-only.*bounded.*symlink.*timed.*cancellation.*fail-closed.*panel/iu,
+    );
+    expect(official.get("sql-lens")?.capabilities).toEqual([
+      "single-statement SQLite inspection",
+      "isolated read-only query worker",
+      "bounded rows cells and result bytes",
+      "workspace and symlink safety checks",
+      "timeout and cancellation termination",
+      "validated fail-closed panel reporting",
+    ]);
+    expect(official.get("sql-lens")?.hooks).toEqual(["SQL read-only tool", "workspace SQLite files", "plugin UI"]);
+    expect(official.get("sql-lens")?.profile.config).toEqual({ timeoutMs: 5_000 });
     expect(official.get("i18n-pair")?.category.id).toBe("workflow");
+    expect(official.get("i18n-pair")?.description).toMatch(
+      /strict read-only.*bounded JSON locale.*no-follow workspace.*collision-safe missing.*extra.*stable failures.*cancellation.*validated panel/iu,
+    );
+    expect(official.get("i18n-pair")?.capabilities).toEqual([
+      "collision-safe locale key parity",
+      "strict bounded workspace-only JSON reads",
+      "no-follow symbolic-link safety",
+      "stable sequential cancellable inspection",
+      "validated bounded panel reporting",
+    ]);
+    expect(official.get("i18n-pair")?.hooks).toEqual(["i18n check tool", "workspace locale files", "plugin UI"]);
+    expect(official.get("i18n-pair")?.profile.config).toEqual({});
     expect(official.get("plugin-finder")?.category.id).toBe("discovery");
     expect(official.get("readme-gen")?.category.id).toBe("developer");
+    expect(official.get("readme-gen")?.description).toMatch(
+      /strictly bounded manifest.*descriptor-safe loader.*Markdown-safe.*confirmed.*no-clobber atomic.*explicit overwrite.*cancellable/iu,
+    );
+    expect(official.get("readme-gen")?.capabilities).toEqual([
+      "bounded manifest metadata",
+      "descriptor-safe loader inventory",
+      "Markdown-safe rendering",
+      "confirmed no-clobber atomic writes",
+      "explicit overwrite confirmation",
+      "cancellable sequential tools",
+      "bounded normalized operation panel",
+    ]);
+    expect(official.get("readme-gen")?.hooks).toEqual([
+      "README report and write tools",
+      "workspace manifest and files",
+      "Cordis loader inventory",
+      "plugin UI",
+    ]);
+    expect(official.get("readme-gen")?.profile.config).toEqual({});
     expect(official.get("anchored-standard")?.category.id).toBe("security");
+    expect(official.get("annotation")?.hooks).toEqual(["plugin UI"]);
     expect(official.get("change-verifier")?.category.id).toBe("workflow");
     expect(official.get("openpets")?.category.id).toBe("web");
+    expect(official.get("openpets")?.description).toMatch(
+      /bounded.*companion state.*validated.*session entr.*without retaining message contents.*persistence/iu,
+    );
+    expect(official.get("openpets")?.capabilities).toEqual([
+      "bounded durable companion state",
+      "validated session recovery",
+      "descriptor-safe pet actions",
+      "session event reactions",
+      "persistence health panel",
+    ]);
+    expect(official.get("openpets")?.hooks).toEqual(["session events", "pet reaction tool", "session storage", "plugin UI"]);
+    expect(official.get("openpets")?.profile.config).toEqual({});
     expect(official.get("session-insights")?.category.id).toBe("observability");
+    expect(official.get("session-insights")?.description).toMatch(
+      /descriptor-safe.*validated.*cached.*session.*statistics.*confirmed.*settled.*compaction.*model.*usage.*cost.*cancellable/iu,
+    );
+    expect(official.get("session-insights")?.capabilities).toEqual([
+      "validated detached session statistics",
+      "message token cache cost and context accounting",
+      "cached active-session panel",
+      "confirmed settled-session compaction",
+      "dedicated compaction cancellation",
+      "single-flight bounded operation status",
+      "normalized fail-closed browser view",
+    ]);
+    expect(official.get("session-insights")?.hooks).toEqual(["session report tool", "active runtime session", "Pi session lifecycle", "plugin UI"]);
+    expect(official.get("session-insights")?.profile.config).toEqual({});
     expect(official.get("mcp-panel")?.category.id).toBe("tools");
     expect(official.get("fail-logger")?.category.id).toBe("observability");
+    expect(official.get("fail-logger")?.description).toMatch(
+      /bounded.*extension.*Agent.*non-aborted compaction.*descriptor-safe event inspection.*safe diagnostic.*occurrence counts/iu,
+    );
+    expect(official.get("fail-logger")?.capabilities).toEqual([
+      "bounded failure aggregation",
+      "descriptor-safe event inspection",
+      "abort-aware compaction diagnostics",
+      "occurrence counting",
+      "safe diagnostic summaries",
+      "capacity visibility",
+    ]);
+    expect(official.get("fail-logger")?.hooks).toEqual(["extension error", "agent end", "compaction end", "plugin UI"]);
+    expect(official.get("genui")?.description).toMatch(/bounded.*text, badge, and decimal progress.*plain text/iu);
+    expect(official.get("genui")?.capabilities).toEqual([
+      "bounded structured cards",
+      "typed text badge and progress blocks",
+      "decimal progress validation",
+      "plain-text HTML handling",
+    ]);
+    expect(official.get("genui")?.hooks).toEqual(["GenUI render tool", "plugin UI"]);
     expect(official.get("plugin-dev")?.category.id).toBe("developer");
+    expect(official.get("plugin-dev")?.description).toMatch(/defer.*session resource.*agent.*settled.*single.*reload.*bounded.*trusted.*development/iu);
+    expect(official.get("plugin-dev")?.capabilities).toEqual([
+      "settled-session resource reload",
+      "single-flight reload guard",
+      "bounded reload status",
+      "cancellable caller wait",
+    ]);
+    expect(official.get("plugin-dev")?.hooks).toEqual(["session resource reload tool", "Pi session lifecycle", "plugin UI"]);
+    expect(official.get("plugin-dev")?.profile.config).toEqual({});
     expect(official.get("session-export")?.category.id).toBe("workflow");
     expect(official.get("session-search")?.category.id).toBe("discovery");
     expect(official.get("session-compare")?.category.id).toBe("discovery");
@@ -77,9 +399,74 @@ describe("plugin marketplace registry", () => {
     expect(official.get("workspace-navigator")?.category.id).toBe("developer");
     expect(official.get("reverse-skill")?.category.id).toBe("security");
     expect(official.get("colleague-skill")?.category.id).toBe("workflow");
+    expect(official.get("colleague-skill")?.hooks).toEqual(["session storage", "plugin UI"]);
+    expect(official.get("context-insights")?.category.id).toBe("context");
+    expect(official.get("context-insights")?.description).toMatch(
+      /descriptor-safe.*bounded message composition.*cached.*active-session.*lifecycle.*normalized browser/iu,
+    );
+    expect(official.get("context-insights")?.capabilities).toEqual([
+      "descriptor-safe bounded message composition",
+      "resilient context usage inspection",
+      "active-session lifecycle counters",
+      "cached session-aware panel",
+      "bounded normalized browser view",
+    ]);
+    expect(official.get("context-insights")?.hooks).toEqual(["context inspection tool", "active runtime session", "Pi session lifecycle", "plugin UI"]);
+    expect(official.get("context-insights")?.profile.config).toEqual({});
+    expect(official.get("context-doctor")?.category.id).toBe("observability");
+    expect(official.get("context-doctor")?.description).toMatch(/descriptor-safe.*bounded.*queued.*agent.*settled.*confirmed.*model.*cost.*cancellable/iu);
+    expect(official.get("context-doctor")?.capabilities).toEqual([
+      "descriptor-safe bounded context audit",
+      "pressure oversized uninspectable and tool-error diagnostics",
+      "confirmed settled-session compaction",
+      "dedicated compaction cancellation",
+      "single-flight bounded operation status",
+      "cached normalized panel",
+    ]);
+    expect(official.get("context-doctor")?.hooks).toEqual([
+      "context doctor tool",
+      "session messages and usage",
+      "Pi session lifecycle",
+      "manual compaction",
+      "plugin UI",
+    ]);
+    expect(official.get("context-doctor")?.profile.config).toEqual({});
+    expect(official.get("cordis-group")?.category.id).toBe("composition");
+    expect(official.get("cordis-group")?.capabilities).toEqual(["nested plugin composition", "transactional rollback", "lifecycle ownership"]);
+    expect(official.get("cordis-group")?.hooks).toEqual(["loader entry tree"]);
+    expect(official.get("cordis-logger-console")?.category.id).toBe("observability");
+    expect(official.get("cordis-logger-console")?.capabilities).toEqual(["bounded console logging", "per-logger severity filtering", "safe recent-log panel"]);
+    expect(official.get("cordis-logger-console")?.hooks).toEqual(["Cordis logger exporter", "plugin UI"]);
+    expect(official.get("cordis-logger-console")?.profile.config).toEqual({ levels: { default: 2 }, maxLength: 8_192 });
+    expect(official.get("cordis-timer")?.category.id).toBe("runtime");
+    expect(official.get("cordis-timer")?.capabilities).toEqual([
+      "scheduling",
+      "lifecycle-owned cancellation",
+      "async interval iteration",
+      "throttle and debounce",
+    ]);
+    expect(official.get("cordis-timer")?.hooks).toEqual(["Cordis timer service", "plugin UI"]);
     expect(official.get("prompt-library")?.category.id).toBe("workflow");
     expect(official.get("cleaner")?.category.id).toBe("developer");
+    expect(official.get("cleaner")?.description).toMatch(
+      /strict.*descriptor-safe.*display-safe.*bounded.*Git capsule.*explicit confirmation.*retention.*symlink.*replacement.*cancellable.*fail-closed/iu,
+    );
+    expect(official.get("cleaner")?.capabilities).toEqual([
+      "strict configuration and parameters",
+      "bounded capsule inventory",
+      "display-safe capsule filtering",
+      "confirmed retention cleanup",
+      "symlink and replacement defenses",
+      "cancellable serialized cleanup",
+      "fail-closed normalized panel",
+    ]);
+    expect(official.get("cleaner")?.hooks).toEqual(["capsule cleanup tool", "agent capsule directory", "plugin UI"]);
+    expect(official.get("cleaner")?.profile.config).toEqual({});
     expect(official.get("cli-notifier")?.category.id).toBe("workflow");
+    expect(official.get("cli-notifier")?.description).toMatch(/local desktop notifications/iu);
+    expect(official.get("cli-notifier")?.description).not.toMatch(/webhook/iu);
+    expect(official.get("cli-notifier")?.capabilities).toEqual(["desktop notification", "completion notice", "failure and abort notice"]);
+    expect(official.get("cli-notifier")?.hooks).toEqual(["agent end", "compaction error", "plugin UI"]);
     expect(official.get("obsidian-sync")?.category.id).toBe("workflow");
     expect(official.get("tab-manager")?.category.id).toBe("workflow");
     expect(official.get("telemetry-blocker")?.category.id).toBe("security");

package/packages/api-gateway/test/release-package.test.ts

@@ -3,22 +3,16 @@ import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
 const repositoryRoot = resolve(import.meta.dirname, "../../..");
-const bundledWorkspacePaths = ["api-gateway", "cli", "core", "host-webserver", "bundle-web-app"] as const;
+const bundledWorkspacePaths = ["api-gateway", "cli", "host-webserver", "bundle-web-app"] as const;
 const bundledRuntimePackageNames = ["@earendil-works/pi-agent-core", "@earendil-works/pi-ai", "@earendil-works/pi-coding-agent"] as const;
-const bundledWorkspacePackageNames = [
-  "@pi-harness/api-gateway",
-  "@pi-harness/cli",
-  "@pi-harness/core",
-  "@pi-harness/host-webserver",
-  "@pi-harness/web-app",
-] as const;
+const bundledWorkspacePackageNames = ["@pi-harness/api-gateway", "@pi-harness/cli", "@pi-harness/host-webserver", "@pi-harness/web-app"] as const;
 const bundledPackageNames = [...bundledRuntimePackageNames, ...bundledWorkspacePackageNames];
 
 const readJson = async (path: string): Promise<Record<string, unknown>> =>
   JSON.parse(await readFile(resolve(repositoryRoot, path), "utf8")) as Record<string, unknown>;
 
 describe("release package", () => {
-  it("publishes one self-contained public package", async () => {
+  it("publishes the launcher and keeps core independently installable", async () => {
     const rootManifest = await readJson("package.json");
     const dependencies = rootManifest.dependencies as Record<string, string>;
 
@@ -36,8 +30,9 @@ describe("release package", () => {
     expect(clientManifest.private).toBe(true);
 
     const workflow = await readFile(resolve(repositoryRoot, ".github/workflows/release.yml"), "utf8");
-    expect(workflow).not.toContain("npm publish --workspace");
-    expect(workflow.match(/npm publish --access public/g)).toHaveLength(1);
+    expect(workflow).toContain("npm publish --workspace @pi-harness/core --access public");
+    expect(workflow).toContain("npm publish --access public");
     expect(workflow).toContain("Verify package availability");
+    expect(workflow).toContain("RELEASE_TAG_EXISTS: ${{ steps.release.outputs.tag_exists }}");
   });
 });

package/packages/api-gateway/test/release-version.test.ts

@@ -62,11 +62,11 @@ describe("release version preparation", () => {
       await readFile(resolve(fixture, "packages/api-gateway/dist/marketplace-entries/official/external.json"), "utf8"),
     ) as Record<string, unknown>;
 
-    expect(rootManifest).toMatchObject({ version: "0.1.3", dependencies: { "@pi-harness/core": "0.1.3" } });
+    expect(rootManifest).toMatchObject({ version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } });
     expect(packageLock).toMatchObject({
       version: "0.1.3",
       packages: {
-        "": { version: "0.1.3", dependencies: { "@pi-harness/core": "0.1.3" } },
+        "": { version: "0.1.3", dependencies: { "@pi-harness/core": "^0.1.3" } },
         "packages/core": { version: "0.1.3" },
         "packages/api-gateway": { version: "0.1.3" },
       },

package/packages/bundle-web-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/web-app",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "private": true,
   "description": "Patchable Web application bundle for Pi Harness",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/cli/dist/node-stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-stdio.d.ts","sourceRoot":"","sources":["../src/node-stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIrF,qBAAa,SAAU,YAAW,cAAc;;gBAQlC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;IAQxD,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAgDnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAexB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB5B,KAAK,IAAI,IAAI;CAMd"}
+{"version":3,"file":"node-stdio.d.ts","sourceRoot":"","sources":["../src/node-stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAwD,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAK7G,qBAAa,SAAU,YAAW,cAAc;;gBASlC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;IAOxD,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAwFnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA6BxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB5B,KAAK,IAAI,IAAI;CAMd"}