@stigmer/cli 3.15.3-dev.20260914121148 → 3.15.3-dev.20260916211208

package/src/commands/validate.test.ts

@@ -1,10 +1,13 @@
-// Command-level exit-code contract for `validate`. Drives the real commander
-// program against temp YAML files and asserts the classified exit code. The
-// contract: 0 = valid, 2 = invalid input (bad path, bad YAML, unknown kind,
-// schema failure), 1 = unexpected. This is a deliberate, documented refinement
-// over the Go CLI, which returns a generic exit 1 for all validate failures.
+// Command-level contract for `validate`. Drives the real commander program
+// against temp files and asserts the classified exit code and, for the plugin
+// route, the rendered output. The contract: 0 = valid (a plugin with warnings
+// is still 0), 2 = invalid input (bad path, bad YAML, unknown kind, schema
+// failure, a plugin the reader refuses), 1 = unexpected. This is a
+// deliberate, documented refinement over the Go CLI, which returned a
+// generic exit 1 for all validate failures. The YAML cases are unchanged by
+// the plugin route and pin that it stays out of their way.
 
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
@@ -12,6 +15,14 @@ import { classify, ExitCode } from "../errors/index.js";
 import { buildProgram } from "../program.js";
 
 let dir: string;
+let plugin: string;
+let brokenPlugin: string;
+
+function write(root: string, rel: string, content: string): void {
+  const full = join(root, rel);
+  mkdirSync(join(full, ".."), { recursive: true });
+  writeFileSync(full, content);
+}
 
 beforeAll(() => {
   dir = mkdtempSync(join(tmpdir(), "stigmer-validate-"));
@@ -31,49 +42,127 @@ beforeAll(() => {
   );
   writeFileSync(join(dir, "bad-schema.yaml"), ["kind: Agent", "metadata: not-an-object", ""].join("\n"));
   writeFileSync(join(dir, "unknown.yaml"), ["kind: Banana", "metadata:", "  name: x", ""].join("\n"));
+
+  // A Cursor plugin with a header token the manifest does not declare: valid,
+  // with one warning, and an ai.stigmer/ document that must not be validated
+  // as a loose resource.
+  plugin = mkdtempSync(join(tmpdir(), "stigmer-validate-plugin-"));
+  write(plugin, ".cursor-plugin/plugin.json", JSON.stringify({ name: "github", version: "1.0.0", mcpServers: "./mcp.json", logo: "assets/logo.svg" }));
+  write(plugin, "mcp.json", JSON.stringify({ mcpServers: { github: { type: "http", url: "https://api.example.com/mcp/", headers: { Authorization: "Bearer ${GITHUB_TOKEN}" } } } }));
+  write(plugin, "ai.stigmer/agent.yaml", "not: a valid resource document\n");
+  write(plugin, "assets/logo.svg", "<svg/>");
+
+  // The same plugin with the URL made a variable: the one refusal.
+  brokenPlugin = mkdtempSync(join(tmpdir(), "stigmer-validate-broken-"));
+  write(brokenPlugin, ".cursor-plugin/plugin.json", JSON.stringify({ name: "Broken Name", mcpServers: "./mcp.json" }));
+  write(brokenPlugin, "mcp.json", JSON.stringify({ mcpServers: { crm: { type: "http", url: "${CRM_URL}", auth: { scopes: ["a"] } } } }));
 });
 
 afterAll(() => {
-  rmSync(dir, { recursive: true, force: true });
+  for (const path of [dir, plugin, brokenPlugin]) rmSync(path, { recursive: true, force: true });
 });
 
-// Runs `validate <args>` with output suppressed, returning the classified exit
-// code (0 on success).
-async function runValidate(...args: string[]): Promise<number> {
+interface Run {
+  readonly exitCode: number;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly error: unknown;
+}
+
+// Runs `validate <args>` with output captured, returning the classified exit
+// code (0 on success) and what reached each stream.
+async function runValidate(...args: string[]): Promise<Run> {
   const program = buildProgram();
   program.exitOverride();
-  const outSpy = vi.spyOn(process.stdout, "write").mockReturnValue(true);
-  const errSpy = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+  let stdout = "";
+  let stderr = "";
+  const outSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk) => {
+    stdout += String(chunk);
+    return true;
+  });
+  const errSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk) => {
+    stderr += String(chunk);
+    return true;
+  });
   try {
     await program.parseAsync(["node", "stigmer", "validate", ...args]);
-    return ExitCode.Success;
+    return { exitCode: ExitCode.Success, stdout, stderr, error: undefined };
   } catch (err) {
-    return classify(err)?.exitCode ?? -1;
+    return { exitCode: classify(err)?.exitCode ?? -1, stdout, stderr, error: err };
   } finally {
     outSpy.mockRestore();
     errSpy.mockRestore();
   }
 }
 
-describe("validate exit codes", () => {
+describe("validate exit codes (YAML)", () => {
   it("exits 0 for a valid resource", async () => {
-    expect(await runValidate("-f", join(dir, "valid.yaml"))).toBe(ExitCode.Success);
+    expect((await runValidate("-f", join(dir, "valid.yaml"))).exitCode).toBe(ExitCode.Success);
   });
 
-  it("exits 0 when validating a directory of valid resources", async () => {
-    expect(await runValidate("-f", dir)).not.toBe(ExitCode.Success);
-    // The dir also contains invalid files; a single bad file fails the batch.
+  it("fails the batch when a directory holds an invalid file", async () => {
+    expect((await runValidate("-f", dir)).exitCode).not.toBe(ExitCode.Success);
   });
 
   it("exits 2 for a schema-invalid resource", async () => {
-    expect(await runValidate("-f", join(dir, "bad-schema.yaml"))).toBe(ExitCode.Usage);
+    expect((await runValidate("-f", join(dir, "bad-schema.yaml"))).exitCode).toBe(ExitCode.Usage);
   });
 
   it("exits 2 for an unknown resource kind", async () => {
-    expect(await runValidate("-f", join(dir, "unknown.yaml"))).toBe(ExitCode.Usage);
+    expect((await runValidate("-f", join(dir, "unknown.yaml"))).exitCode).toBe(ExitCode.Usage);
   });
 
   it("exits 2 for a path that does not exist", async () => {
-    expect(await runValidate("-f", join(dir, "missing.yaml"))).toBe(ExitCode.Usage);
+    expect((await runValidate("-f", join(dir, "missing.yaml"))).exitCode).toBe(ExitCode.Usage);
+  });
+});
+
+describe("validate on a plugin directory", () => {
+  it("accepts the plugin with a warning status, exit 0, everything on stderr", async () => {
+    const run = await runValidate("-f", plugin);
+    expect(run.exitCode).toBe(ExitCode.Success);
+    expect(run.stdout).toBe("");
+    expect(run.stderr).toContain("Plugin 'github' is valid with 1 warning");
+    expect(run.stderr).toContain("Cursor plugin");
+    // Section keys are padded to the widest key, so match key and value loosely.
+    expect(run.stderr).toMatch(/MCP servers\s+1: github \(http\)/);
+    expect(run.stderr).toMatch(/Variables\s+1: GITHUB_TOKEN \(inferred\)/);
+    expect(run.stderr).toMatch(/Files\s+4 read, 0 excluded by ignore rules/);
+    expect(run.stderr).toMatch(/Stigmer overlay\s+agent/);
+    expect(run.stderr).toContain("variable 'GITHUB_TOKEN' is referenced by MCP server 'github' but not declared");
+    expect(run.stderr).toContain("- logo (.cursor-plugin/plugin.json#logo)");
+  });
+
+  it("emits the normalised package as JSON data on stdout with --json", async () => {
+    const run = await runValidate("-f", plugin, "--json");
+    expect(run.exitCode).toBe(ExitCode.Success);
+    expect(run.stderr).toBe("");
+    const parsed = JSON.parse(run.stdout);
+    expect(parsed.status).toBe("warning");
+    expect(parsed.data.plugin).toMatchObject({
+      name: "github",
+      dialect: "cursor",
+      mcpServers: [{ name: "github", transport: "http", env: ["GITHUB_TOKEN"] }],
+      variables: [{ name: "GITHUB_TOKEN", isSecret: true, optional: false, declaredBy: "inferred" }],
+      overlay: { agent: "ai.stigmer/agent.yaml", workflows: [], mcpServers: [] },
+    });
+    expect(parsed.data.warnings.map((w: { kind: string }) => w.kind)).toEqual(["variable-inferred"]);
+  });
+
+  it("prints only the status line with --quiet", async () => {
+    const run = await runValidate("-f", plugin, "--quiet");
+    expect(run.stderr.trim()).toBe("⚠ Plugin 'github' is valid with 1 warning");
+  });
+
+  it("refuses with exit 2 and every problem's sentence", async () => {
+    const run = await runValidate("-f", brokenPlugin);
+    expect(run.exitCode).toBe(ExitCode.Usage);
+    const message = (run.error as Error).message;
+    expect(message).toContain("plugin cannot be installed, 2 problems found:");
+    expect(message).toContain("plugin name 'Broken Name' in '.cursor-plugin/plugin.json' is invalid");
+    expect(message).toContain("MCP server 'crm' in 'mcp.json' has a variable in its 'url'");
+    // Warnings ride along under the refusal so one run says everything.
+    expect(message).toContain("and 1 warning:");
+    expect(message).toContain("MCP server 'crm' in 'mcp.json' has an 'auth' block Stigmer does not read");
   });
 });

package/src/commands/validate.ts

@@ -1,12 +1,28 @@
-// `stigmer validate -f <file|dir>` — offline validation of resource YAML.
+// `stigmer validate -f <file|dir>` — offline validation of resource YAML, or
+// of a plugin directory.
 //
-// Auto-detects each document's kind, checks it supports validation, and parses
-// it into its proto schema (structural validation, no server). Supports single
-// files, directories, and multi-document YAML.
+// Two inputs, one verb. A YAML file or a directory of YAML files is parsed
+// document by document into its proto schema (structural validation, no
+// server). A directory holding a plugin manifest (`plugin.json`,
+// `.cursor-plugin/plugin.json`, `.claude-plugin/plugin.json` or
+// `.codex-plugin/plugin.json`) is read with `@stigmer/plugin-package`, the
+// same reader the server installs with, so what validates here installs
+// there and what is refused here is refused there with the same sentence.
+// The plugin check runs BEFORE the YAML walk: a plugin's `ai.stigmer/*.yaml`
+// documents would otherwise be validated as loose resources.
+//
+// A plugin refusal is a `UsageError` (exit 2) listing every problem at once;
+// an accepted plugin renders as `success`, or `warning` when the reader had
+// something to say, both exit 0. `--json` carries the normalised package as
+// the result's `data`.
 
 import type { Command } from "commander";
 import { UsageError } from "../errors/index.js";
-import { CommandResult, type OutputFlags, renderResult } from "../output/index.js";
+import {
+  CommandResult,
+  type OutputFlags,
+  renderResult,
+} from "../output/index.js";
 import { defaultRegistry, Verb } from "../registry/index.js";
 import { loadDocuments, resolveYamlFiles } from "../resources/documents.js";
 import { addResultFlags, resultFormat } from "./shared.js";
@@ -18,8 +34,11 @@ interface ValidateFlags extends OutputFlags {
 export function registerValidate(program: Command): void {
   const validate = program
     .command("validate")
-    .description("validate resource YAML files offline")
-    .requiredOption("-f, --file <path>", "path to a YAML file or directory")
+    .description("validate resource YAML files or a plugin directory offline")
+    .requiredOption(
+      "-f, --file <path>",
+      "path to a YAML file, a directory of YAML files, or a plugin directory",
+    )
     .action(async (options: ValidateFlags) => {
       renderResult(await runValidate(options), resultFormat(options));
     });
@@ -32,12 +51,18 @@ async function runValidate(options: ValidateFlags): Promise<CommandResult> {
     throw new UsageError("file path is required: use -f <file>");
   }
 
+  const { isPluginDirectory } = await import("../resources/plugin.js");
+  if (isPluginDirectory(path)) {
+    return runValidatePlugin(path);
+  }
+
   const files = resolveYamlFiles(path);
   if (files.length === 0) {
     throw new UsageError(`no YAML files found in ${path}`);
   }
 
-  const { schemaForValidate, validateDocument } = await import("../resources/validate.js");
+  const { schemaForValidate, validateDocument } =
+    await import("../resources/validate.js");
   const registry = defaultRegistry();
   const validated: string[] = [];
 
@@ -49,25 +74,56 @@ async function runValidate(options: ValidateFlags): Promise<CommandResult> {
         throw new UsageError(`unknown resource kind '${kind}' in ${file}`);
       }
       if (!info.supportedVerbs.has(Verb.Validate)) {
-        throw new UsageError(`${info.displayName} does not support validation (in ${file})`);
+        throw new UsageError(
+          `${info.displayName} does not support validation (in ${file})`,
+        );
       }
       const schema = schemaForValidate(info.kind);
       if (schema === undefined) {
         // The kind declares validate support but the CLI lacks a schema binding
         // — a CLI gap, not bad user input, so this is a general (exit 1) error.
-        throw new Error(`validation is not implemented for ${info.displayName}`);
+        throw new Error(
+          `validation is not implemented for ${info.displayName}`,
+        );
       }
       try {
         validateDocument(schema, document);
       } catch (err) {
-        throw new UsageError(`${file}: invalid ${info.displayName}: ${(err as Error).message}`);
+        throw new UsageError(
+          `${file}: invalid ${info.displayName}: ${(err as Error).message}`,
+        );
       }
       validated.push(`${file}: ${info.displayName} is valid`);
     }
   }
 
-  const result = CommandResult.success(`Validation complete: ${validated.length} resource(s) valid`);
+  const result = CommandResult.success(
+    `Validation complete: ${validated.length} resource(s) valid`,
+  );
   const section = result.addSection("");
   for (const item of validated) section.item(item);
   return result;
 }
+
+async function runValidatePlugin(dir: string): Promise<CommandResult> {
+  const { readPluginPackage } = await import("@stigmer/plugin-package");
+  const { count, describePackageOn, pluginRefusal, readPluginDirectory } =
+    await import("../resources/plugin.js");
+
+  const directory = readPluginDirectory(dir);
+  const outcome = readPluginPackage(directory.files);
+  if (!outcome.ok) {
+    // Warnings ride along under the refusal so the author fixes everything
+    // in one pass, not the errors now and the warnings on the next run.
+    throw pluginRefusal(dir, outcome.errors, outcome.warnings);
+  }
+
+  const { plugin, warnings } = outcome;
+  const result =
+    warnings.length === 0
+      ? CommandResult.success(`Plugin '${plugin.name}' is valid`)
+      : CommandResult.warning(
+          `Plugin '${plugin.name}' is valid with ${count(warnings.length, "warning")}`,
+        );
+  return describePackageOn(result, plugin, warnings, directory.stats);
+}

package/src/output/command-result.test.ts

@@ -32,6 +32,15 @@ describe("resultToJson", () => {
     expect(parsed.sections[1]).toEqual({ title: "Items", items: ["first", "second"] });
     expect(parsed.hints).toEqual(["try this", "and that"]);
   });
+
+  it("emits the data payload in JSON only, and omits it when unset", () => {
+    const result = CommandResult.warning("Plugin is valid").withData({ plugin: { name: "x" }, warnings: [] });
+    const parsed = JSON.parse(resultToJson(result));
+    expect(parsed.data).toEqual({ plugin: { name: "x" }, warnings: [] });
+    expect(JSON.parse(resultToJson(CommandResult.success("ok")))).not.toHaveProperty("data");
+    expect(resultToHuman(result, false)).not.toContain("plugin");
+    expect(resultToQuiet(result, false)).toBe("⚠ Plugin is valid\n");
+  });
 });
 
 describe("resultToHuman (plain, no color)", () => {

package/src/output/command-result.ts

@@ -43,6 +43,13 @@ export class CommandResult {
   readonly message: string;
   readonly sections: Section[] = [];
   readonly hints: string[] = [];
+  /**
+   * A machine-readable payload for the JSON form only: the thing the command
+   * computed, in full, where the sections carry its human summary (a
+   * validated plugin's normalised description, for example). Human and quiet
+   * output never render it; `undefined` omits it from the JSON.
+   */
+  data: unknown = undefined;
 
   private constructor(status: ResultStatus, message: string) {
     this.status = status;
@@ -71,6 +78,11 @@ export class CommandResult {
     this.hints.push(text);
     return this;
   }
+
+  withData(data: unknown): this {
+    this.data = data;
+    return this;
+  }
 }
 
 const ICONS: Record<ResultStatus, string> = {
@@ -84,6 +96,7 @@ interface JsonResult {
   message: string;
   sections?: JsonSection[];
   hints?: string[];
+  data?: unknown;
 }
 
 interface JsonSection {
@@ -109,6 +122,7 @@ export function resultToJson(result: CommandResult): string {
   }
 
   if (result.hints.length > 0) out.hints = [...result.hints];
+  if (result.data !== undefined) out.data = result.data;
 
   return JSON.stringify(out, null, 2) + "\n";
 }

package/src/registry/aliases.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from "vitest";
-import { generateAliases, normalizeAlias, pluralize, toKebabCase, toSnakeCase } from "./aliases.js";
+import {
+  generateAliases,
+  normalizeAlias,
+  pluralize,
+  toKebabCase,
+  toSnakeCase,
+} from "./aliases.js";
 
 function normalized(aliases: string[]): Set<string> {
   return new Set(aliases.map(normalizeAlias));
@@ -7,7 +13,9 @@ function normalized(aliases: string[]): Set<string> {
 
 describe("generateAliases", () => {
   it("derives the full McpServer alias set", () => {
-    const found = normalized(generateAliases("McpServer", "MCP Server", "mcp", "mcp_server"));
+    const found = normalized(
+      generateAliases("McpServer", "MCP Server", "mcp", "mcp_server"),
+    );
     for (const exp of [
       "mcpserver",
       "mcp-server",
@@ -30,7 +38,9 @@ describe("generateAliases", () => {
   });
 
   it("derives the Workflow alias set", () => {
-    const found = normalized(generateAliases("Workflow", "Workflow", "wfl", "workflow"));
+    const found = normalized(
+      generateAliases("Workflow", "Workflow", "wfl", "workflow"),
+    );
     for (const exp of ["workflow", "wfl", "workflows", "wfls"]) {
       expect(found).toContain(exp);
     }
@@ -42,7 +52,9 @@ describe("generateAliases", () => {
     // enum name (oauth_app). Both families must be accepted: the canonical
     // spellings via protoName (stigmer/stigmer#470), and the historical
     // split-derived spellings for backward compatibility.
-    const found = normalized(generateAliases("OAuthApp", "OAuth App", "oapp", "oauth_app"));
+    const found = normalized(
+      generateAliases("OAuthApp", "OAuth App", "oapp", "oauth_app"),
+    );
     for (const exp of [
       "oauth_app",
       "oauth-app",
@@ -61,7 +73,14 @@ describe("generateAliases", () => {
 
   it("does not let a multi-word display name steal the parent's name", () => {
     // "Agent Instance" must NOT register "agent" (that belongs to Agent).
-    const found = normalized(generateAliases("AgentInstance", "Agent Instance", "ain", "agent_instance"));
+    const found = normalized(
+      generateAliases(
+        "AgentInstance",
+        "Agent Instance",
+        "ain",
+        "agent_instance",
+      ),
+    );
     expect(found).not.toContain("agent");
     expect(found).toContain("agentinstance");
     expect(found).toContain("agent-instance");

package/src/registry/aliases.ts

@@ -15,7 +15,12 @@
  *                              "OAuthApp" it contributes "oauth_app"/"oauth-app"
  * Plus the plural of every form above.
  */
-export function generateAliases(name: string, displayName: string, idPrefix: string, protoName: string): string[] {
+export function generateAliases(
+  name: string,
+  displayName: string,
+  idPrefix: string,
+  protoName: string,
+): string[] {
   const seen = new Set<string>();
   const aliases: string[] = [];
 

package/src/registry/index.ts

@@ -1,7 +1,23 @@
 // Public surface of the type-registry module.
 
-export { generateAliases, normalizeAlias, pluralize, toKebabCase, toSnakeCase } from "./aliases.js";
+export {
+  generateAliases,
+  normalizeAlias,
+  pluralize,
+  toKebabCase,
+  toSnakeCase,
+} from "./aliases.js";
 export { CLI_RELEVANT_KINDS, type KindMeta, KIND_META } from "./metadata.js";
-export { defaultRegistry, type Registry, supportsVerb, type TypeInfo } from "./registry.js";
-export { ALL_VERBS, isFileBasedVerb, isReferenceBasedVerb, Verb } from "./verbs.js";
+export {
+  defaultRegistry,
+  type Registry,
+  supportsVerb,
+  type TypeInfo,
+} from "./registry.js";
+export {
+  ALL_VERBS,
+  isFileBasedVerb,
+  isReferenceBasedVerb,
+  Verb,
+} from "./verbs.js";
 export { VERB_SUPPORT, verbsForKind } from "./verb-support.js";

package/src/registry/metadata.ts

@@ -22,24 +22,90 @@ export interface KindMeta {
 }
 
 export const KIND_META: ReadonlyMap<ApiResourceKind, KindMeta> = new Map([
-  [ApiResourceKind.organization, { name: "Organization", displayName: "Organization", idPrefix: "org" }],
-  [ApiResourceKind.agent, { name: "Agent", displayName: "Agent", idPrefix: "agt" }],
-  [ApiResourceKind.workflow, { name: "Workflow", displayName: "Workflow", idPrefix: "wfl" }],
-  [ApiResourceKind.skill, { name: "Skill", displayName: "Skill", idPrefix: "skl" }],
-  [ApiResourceKind.mcp_server, { name: "McpServer", displayName: "MCP Server", idPrefix: "mcp" }],
-  [ApiResourceKind.project, { name: "Project", displayName: "Project", idPrefix: "prj" }],
-  [ApiResourceKind.api_key, { name: "ApiKey", displayName: "API Key", idPrefix: "key" }],
-  [ApiResourceKind.identity_provider, { name: "IdentityProvider", displayName: "Identity Provider", idPrefix: "idp" }],
-  [ApiResourceKind.oauth_app, { name: "OAuthApp", displayName: "OAuth App", idPrefix: "oapp" }],
-  [ApiResourceKind.environment, { name: "Environment", displayName: "Environment", idPrefix: "env" }],
-  [ApiResourceKind.agent_share, { name: "AgentShare", displayName: "Agent Share", idPrefix: "ash" }],
-  [ApiResourceKind.agent_channel, { name: "AgentChannel", displayName: "Agent Channel", idPrefix: "ach" }],
-  [ApiResourceKind.channel_app, { name: "ChannelApp", displayName: "Channel App", idPrefix: "chapp" }],
-  [ApiResourceKind.schedule, { name: "Schedule", displayName: "Schedule", idPrefix: "sch" }],
-  [ApiResourceKind.agent_instance, { name: "AgentInstance", displayName: "Agent Instance", idPrefix: "ain" }],
-  [ApiResourceKind.workflow_instance, { name: "WorkflowInstance", displayName: "Workflow Instance", idPrefix: "win" }],
-  [ApiResourceKind.session, { name: "Session", displayName: "Session", idPrefix: "ses" }],
-  [ApiResourceKind.agent_execution, { name: "AgentExecution", displayName: "Agent Execution", idPrefix: "aex" }],
+  [
+    ApiResourceKind.organization,
+    { name: "Organization", displayName: "Organization", idPrefix: "org" },
+  ],
+  [
+    ApiResourceKind.agent,
+    { name: "Agent", displayName: "Agent", idPrefix: "agt" },
+  ],
+  [
+    ApiResourceKind.workflow,
+    { name: "Workflow", displayName: "Workflow", idPrefix: "wfl" },
+  ],
+  [
+    ApiResourceKind.skill,
+    { name: "Skill", displayName: "Skill", idPrefix: "skl" },
+  ],
+  [
+    ApiResourceKind.plugin,
+    { name: "Plugin", displayName: "Plugin", idPrefix: "plg" },
+  ],
+  [
+    ApiResourceKind.mcp_server,
+    { name: "McpServer", displayName: "MCP Server", idPrefix: "mcp" },
+  ],
+  [
+    ApiResourceKind.project,
+    { name: "Project", displayName: "Project", idPrefix: "prj" },
+  ],
+  [
+    ApiResourceKind.api_key,
+    { name: "ApiKey", displayName: "API Key", idPrefix: "key" },
+  ],
+  [
+    ApiResourceKind.identity_provider,
+    {
+      name: "IdentityProvider",
+      displayName: "Identity Provider",
+      idPrefix: "idp",
+    },
+  ],
+  [
+    ApiResourceKind.oauth_app,
+    { name: "OAuthApp", displayName: "OAuth App", idPrefix: "oapp" },
+  ],
+  [
+    ApiResourceKind.environment,
+    { name: "Environment", displayName: "Environment", idPrefix: "env" },
+  ],
+  [
+    ApiResourceKind.agent_share,
+    { name: "AgentShare", displayName: "Agent Share", idPrefix: "ash" },
+  ],
+  [
+    ApiResourceKind.agent_channel,
+    { name: "AgentChannel", displayName: "Agent Channel", idPrefix: "ach" },
+  ],
+  [
+    ApiResourceKind.channel_app,
+    { name: "ChannelApp", displayName: "Channel App", idPrefix: "chapp" },
+  ],
+  [
+    ApiResourceKind.schedule,
+    { name: "Schedule", displayName: "Schedule", idPrefix: "sch" },
+  ],
+  [
+    ApiResourceKind.agent_instance,
+    { name: "AgentInstance", displayName: "Agent Instance", idPrefix: "ain" },
+  ],
+  [
+    ApiResourceKind.workflow_instance,
+    {
+      name: "WorkflowInstance",
+      displayName: "Workflow Instance",
+      idPrefix: "win",
+    },
+  ],
+  [
+    ApiResourceKind.session,
+    { name: "Session", displayName: "Session", idPrefix: "ses" },
+  ],
+  [
+    ApiResourceKind.agent_execution,
+    { name: "AgentExecution", displayName: "Agent Execution", idPrefix: "aex" },
+  ],
 ]);
 
 // Kinds that are user-facing in the CLI and therefore registered as addressable
@@ -54,6 +120,7 @@ export const CLI_RELEVANT_KINDS: readonly ApiResourceKind[] = [
   ApiResourceKind.agent,
   ApiResourceKind.workflow,
   ApiResourceKind.skill,
+  ApiResourceKind.plugin,
   ApiResourceKind.mcp_server,
   ApiResourceKind.project,
   ApiResourceKind.api_key,