@stigmer/plugin-package 3.34.0 → 3.36.0

package/src/__tests__/files.test.ts

@@ -1,119 +0,0 @@
-/**
- * Pins the reader contract and the path discipline: lexical containment of
- * listed and declared paths, the sorted in-memory reader, the index's
- * directory queries, BOM stripping, and the two-sided document cap (the
- * declared size before a read, the returned length after, so a reader that
- * under-declares cannot smuggle bytes past the cap).
- */
-
-import { describe, expect, it } from "vitest";
-
-import {
-  decodeUtf8,
-  inMemoryPluginFiles,
-  isContainedPath,
-  PLUGIN_DOCUMENT_LIMITS,
-  PluginFileIndex,
-  type PluginFiles,
-  resolveDeclaredPath,
-} from "../files.js";
-import { readPluginPackage } from "../read-plugin-package.js";
-import { openPlugin } from "../testing.js";
-import { kindsOf, read } from "../__test-utils__/read.js";
-
-describe("isContainedPath", () => {
-  it("accepts plugin-relative POSIX paths", () => {
-    expect(isContainedPath("plugin.json")).toBe(true);
-    expect(isContainedPath("skills/a/SKILL.md")).toBe(true);
-    expect(isContainedPath(".cursor-plugin/plugin.json")).toBe(true);
-  });
-
-  it("refuses absolute, parent, dot, empty-segment and backslash paths", () => {
-    for (const path of ["", "/etc/passwd", "../x", "a/../b", "a/./b", "a//b", "a\\b", "a/"]) {
-      expect(isContainedPath(path), path).toBe(false);
-    }
-  });
-});
-
-describe("resolveDeclaredPath", () => {
-  it("normalises ./-prefixed directories and files, and the root spellings", () => {
-    expect(resolveDeclaredPath("./skills/")).toEqual({ ok: true, path: "skills" });
-    expect(resolveDeclaredPath("./agents/reviewer.md")).toEqual({ ok: true, path: "agents/reviewer.md" });
-    expect(resolveDeclaredPath(".")).toEqual({ ok: true, path: "" });
-    expect(resolveDeclaredPath("./")).toEqual({ ok: true, path: "" });
-  });
-
-  it("refuses a bare, an escaping and a glob path, each with its own kind", () => {
-    expect(resolveDeclaredPath("skills/")).toEqual({ ok: false, kind: "path-not-relative" });
-    expect(resolveDeclaredPath("./../other")).toEqual({ ok: false, kind: "path-escapes-root" });
-    expect(resolveDeclaredPath("./skills/**/*.md")).toEqual({ ok: false, kind: "path-glob-unsupported" });
-  });
-});
-
-describe("inMemoryPluginFiles and PluginFileIndex", () => {
-  const files = inMemoryPluginFiles(
-    new Map<string, string>([
-      ["skills/b/SKILL.md", "b"],
-      ["skills/a/SKILL.md", "a"],
-      ["skills/a/scripts/run.sh", "run"],
-      ["plugin.json", "{}"],
-      ["agents/x.md", "x"],
-    ]),
-  );
-  const index = new PluginFileIndex(files);
-
-  it("lists entries sorted by path with their byte sizes", () => {
-    expect(files.entries.map((e) => e.path)).toEqual([
-      "agents/x.md",
-      "plugin.json",
-      "skills/a/SKILL.md",
-      "skills/a/scripts/run.sh",
-      "skills/b/SKILL.md",
-    ]);
-    expect(files.entries.find((e) => e.path === "skills/a/scripts/run.sh")?.size).toBe(3);
-  });
-
-  it("answers directory queries from the sorted list", () => {
-    expect(index.childDirectories("")).toEqual(["agents", "skills"]);
-    expect(index.childDirectories("skills")).toEqual(["a", "b"]);
-    expect(index.childFiles("")).toEqual(["plugin.json"]);
-    expect(index.filesUnder("skills/a")).toEqual(["skills/a/SKILL.md", "skills/a/scripts/run.sh"]);
-    expect(index.isDirectory("skills/a/scripts")).toBe(true);
-    expect(index.isDirectory("nope")).toBe(false);
-  });
-
-  it("throws on a read of an unlisted path (a reader contract violation, not plugin content)", () => {
-    expect(() => files.read("missing")).toThrow(/not listed/);
-  });
-});
-
-describe("decodeUtf8", () => {
-  it("strips a leading byte-order mark and nothing else", () => {
-    expect(decodeUtf8(new Uint8Array([0xef, 0xbb, 0xbf, 0x7b, 0x7d]))).toBe("{}");
-    expect(decodeUtf8(new TextEncoder().encode("a\ufeffb"))).toBe("a\ufeffb");
-  });
-});
-
-describe("document caps", () => {
-  it("refuses a manifest over its declared-size cap before reading it", () => {
-    const huge = `{"name":"x","pad":"${"a".repeat(PLUGIN_DOCUMENT_LIMITS.manifest)}"}`;
-    const files = openPlugin({ files: { "plugin.json": huge } });
-    const outcome = read(files);
-    expect(kindsOf(outcome).errors).toEqual(["document-too-large", "manifest-name-missing"]);
-  });
-
-  it("refuses a document whose reader returned more bytes than it declared", () => {
-    const manifest = JSON.stringify({ $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", name: "x" });
-    const lying: PluginFiles = {
-      entries: [{ path: "plugin.json", size: 1 }],
-      read: () => new TextEncoder().encode(manifest.padEnd(PLUGIN_DOCUMENT_LIMITS.manifest + 1, " ")),
-    };
-    const outcome = readPluginPackage(lying);
-    expect(kindsOf(outcome).errors).toEqual(["document-too-large", "manifest-name-missing"]);
-  });
-
-  it("refuses a listed path outside the root", () => {
-    const files = openPlugin({ files: { "../escape.txt": "x" } });
-    expect(kindsOf(read(files)).errors).toEqual(["path-uncontained"]);
-  });
-});

package/src/__tests__/fixtures/cursor-plugins/.cursor-plugin/marketplace.json

@@ -1,412 +0,0 @@
-{
-  "name": "cursor-plugins",
-  "owner": {
-    "name": "Cursor",
-    "email": "plugins@cursor.com"
-  },
-  "metadata": {
-    "description": "Official Cursor plugin marketplace: developer tools, framework rules, MCP integrations, and agent skills"
-  },
-  "plugins": [
-    {
-      "name": "teaching",
-      "source": "teaching",
-      "description": "Skill mapping, practice plans, and learning retrospectives."
-    },
-    {
-      "name": "continual-learning",
-      "source": "continual-learning",
-      "description": "Incremental transcript-driven memory updates for AGENTS.md using high-signal bullet points only."
-    },
-    {
-      "name": "cursor-team-kit",
-      "source": "cursor-team-kit",
-      "description": "Internal team workflows for CI, code review, shipping, local automation, and verification."
-    },
-    {
-      "name": "thermos",
-      "source": "thermos",
-      "description": "Thermo-nuclear branch review: deep security/correctness audits, harsh code-quality rubrics, parallel subagents, thermos orchestration, and optional merge-ready PR flows."
-    },
-    {
-      "name": "create-plugin",
-      "source": "create-plugin",
-      "description": "Scaffold and validate new agent plugins."
-    },
-    {
-      "name": "ralph-loop",
-      "source": "ralph-loop",
-      "description": "Iterative self-referential AI loops using the Ralph Wiggum technique."
-    },
-    {
-      "name": "agent-compatibility",
-      "source": "agent-compatibility",
-      "description": "CLI-backed repo compatibility scans plus agents that audit startup, validation, and docs against reality."
-    },
-    {
-      "name": "cli-for-agent",
-      "source": "cli-for-agent",
-      "description": "Patterns for designing CLIs that coding agents can run reliably: flags, help with examples, pipelines, errors, idempotency, dry-run."
-    },
-    {
-      "name": "pr-review-canvas",
-      "source": "pr-review-canvas",
-      "description": "Render PR diffs as review canvases grouped by importance."
-    },
-    {
-      "name": "docs-canvas",
-      "source": "docs-canvas",
-      "description": "Render documentation as a navigable canvas."
-    },
-    {
-      "name": "cursor-sdk",
-      "source": "cursor-sdk",
-      "description": "Build apps, scripts, and automations with the TypeScript SDK."
-    },
-    {
-      "name": "orchestrate",
-      "source": "orchestrate",
-      "description": "Fan large tasks out across parallel cloud agents with planners, workers, verifiers, and structured handoffs."
-    },
-    {
-      "name": "pstack",
-      "source": "pstack",
-      "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence."
-    },
-    {
-      "name": "grok-voice",
-      "source": "grok-voice",
-      "description": "Add Grok voice to an app: realtime speech-to-speech, speech-to-text dictation, text-to-speech read-aloud, and a log-driven fix loop for voice sessions."
-    },
-    {
-      "name": "advisor",
-      "source": "advisor",
-      "description": "Consult a stronger model before major decisions, when stuck, and before declaring done."
-    },
-    {
-      "name": "gmail",
-      "source": "third_party/gmail",
-      "description": "Search, read, draft, and manage email."
-    },
-    {
-      "name": "google-drive",
-      "source": "third_party/google-drive",
-      "description": "Search, read, create, and share files."
-    },
-    {
-      "name": "google-calendar",
-      "source": "third_party/google-calendar",
-      "description": "Search events and schedule meetings."
-    },
-    {
-      "name": "gong",
-      "source": "third_party/gong",
-      "description": "Pull account summaries, deal insights, and call briefs."
-    },
-    {
-      "name": "salesforce",
-      "source": "third_party/salesforce",
-      "description": "Query, create, and update records in your org."
-    },
-    {
-      "name": "playwright",
-      "source": "third_party/playwright",
-      "description": "Navigate, click, screenshot, and test in a real browser."
-    },
-    {
-      "name": "github",
-      "source": "third_party/github",
-      "description": "Manage repos, issues, pull requests, and Actions."
-    },
-    {
-      "name": "ashby",
-      "source": "third_party/ashby",
-      "description": "Search candidates, prep interviews, and manage pipeline tasks."
-    },
-    {
-      "name": "hubspot",
-      "source": "third_party/hubspot",
-      "description": "Search and update contacts, companies, deals, and tickets."
-    },
-    {
-      "name": "intercom",
-      "source": "third_party/intercom",
-      "description": "Search conversations, contacts, and Help Center articles."
-    },
-    {
-      "name": "zoom",
-      "source": "third_party/zoom",
-      "description": "Search meetings, pull transcripts, and work with Zoom Docs."
-    },
-    {
-      "name": "x",
-      "source": "third_party/x",
-      "description": "Search posts, read timelines, pull trends, manage bookmarks, and access X Chat."
-    },
-    {
-      "name": "clay",
-      "source": "third_party/clay",
-      "description": "Enrich people and companies, run AI research agents."
-    },
-    {
-      "name": "circleback",
-      "source": "third_party/circleback",
-      "description": "Search meetings, transcripts, action items, and emails."
-    },
-    {
-      "name": "docusign",
-      "source": "third_party/docusign",
-      "description": "Manage envelopes, templates, workflows, and agreements."
-    },
-    {
-      "name": "navan",
-      "source": "third_party/navan",
-      "description": "Query expenses, travel bookings, policies, and cards."
-    },
-    {
-      "name": "profound",
-      "source": "third_party/profound",
-      "description": "Track AI visibility, sentiment, and citations."
-    },
-    {
-      "name": "juicebox",
-      "source": "third_party/juicebox",
-      "description": "Query recruiting analytics, shortlists, and sourcing agents."
-    },
-    {
-      "name": "outreach",
-      "source": "third_party/outreach",
-      "description": "Search sequences, prospects, and Kaia meetings."
-    },
-    {
-      "name": "amplemarket",
-      "source": "third_party/amplemarket",
-      "description": "Search people and companies, enrich leads, run sequences."
-    },
-    {
-      "name": "klaviyo",
-      "source": "third_party/klaviyo",
-      "description": "Manage profiles, segments, campaigns, and flows."
-    },
-    {
-      "name": "customer-io",
-      "source": "third_party/customer-io",
-      "description": "Build campaigns, manage segments, and query people."
-    },
-    {
-      "name": "mailerlite",
-      "source": "third_party/mailerlite",
-      "description": "Manage subscribers, groups, campaigns, and automations."
-    },
-    {
-      "name": "brevo",
-      "source": "third_party/brevo",
-      "description": "Manage contacts, email and SMS campaigns, and CRM deals."
-    },
-    {
-      "name": "typeform",
-      "source": "third_party/typeform",
-      "description": "Build forms, analyze responses, and manage contacts."
-    },
-    {
-      "name": "jotform",
-      "source": "third_party/jotform",
-      "description": "Create and edit forms, then read submissions."
-    },
-    {
-      "name": "semrush",
-      "source": "third_party/semrush",
-      "description": "Research keywords, backlinks, traffic, and competitors."
-    },
-    {
-      "name": "ahrefs",
-      "source": "third_party/ahrefs",
-      "description": "Research keywords, backlinks, rankings, and site health."
-    },
-    {
-      "name": "godaddy",
-      "source": "third_party/godaddy",
-      "description": "Brainstorm domain names and check availability."
-    },
-    {
-      "name": "upwork",
-      "source": "third_party/upwork",
-      "description": "Search talent, post jobs, and manage contracts."
-    },
-    {
-      "name": "workable",
-      "source": "third_party/workable",
-      "description": "Search candidates, move pipelines, and manage HR records."
-    },
-    {
-      "name": "brex",
-      "source": "third_party/brex",
-      "description": "Query expenses, receipts, bills, cards, and travel."
-    },
-    {
-      "name": "mercury",
-      "source": "third_party/mercury",
-      "description": "Read balances, transactions, statements, and cards."
-    },
-    {
-      "name": "todoist",
-      "source": "third_party/todoist",
-      "description": "Create, find, and complete tasks and projects."
-    },
-    {
-      "name": "calendly",
-      "source": "third_party/calendly",
-      "description": "Check availability and book, cancel, or reschedule."
-    },
-    {
-      "name": "smartsheet",
-      "source": "third_party/smartsheet",
-      "description": "Query and update sheets, rows, and workspaces."
-    },
-    {
-      "name": "wrike",
-      "source": "third_party/wrike",
-      "description": "Search projects, create tasks, and post comments."
-    },
-    {
-      "name": "coda",
-      "source": "third_party/coda",
-      "description": "Search docs, read pages, and update tables."
-    },
-    {
-      "name": "guru",
-      "source": "third_party/guru",
-      "description": "Search company knowledge and draft verified answers."
-    },
-    {
-      "name": "fireflies",
-      "source": "third_party/fireflies",
-      "description": "Search meeting transcripts, summaries, and action items."
-    },
-    {
-      "name": "otter",
-      "source": "third_party/otter",
-      "description": "Search meeting history and pull full transcripts."
-    },
-    {
-      "name": "fathom",
-      "source": "third_party/fathom",
-      "description": "Search meetings and pull transcripts and summaries."
-    },
-    {
-      "name": "craft",
-      "source": "third_party/craft",
-      "description": "Search, create, and update documents and daily notes."
-    },
-    {
-      "name": "mem",
-      "source": "third_party/mem",
-      "description": "Capture, search, and organize notes and collections."
-    },
-    {
-      "name": "readwise",
-      "source": "third_party/readwise",
-      "description": "Search highlights and Reader documents, save articles."
-    },
-    {
-      "name": "similarweb",
-      "source": "third_party/similarweb",
-      "description": "Analyze website traffic, audiences, and competitors."
-    },
-    {
-      "name": "xero",
-      "source": "third_party/xero",
-      "description": "Read and write invoices, contacts, reports, and payroll."
-    },
-    {
-      "name": "outlook",
-      "source": "third_party/outlook",
-      "description": "Search, read, and send Microsoft Outlook email, and look up contacts."
-    },
-    {
-      "name": "outlook-calendar",
-      "source": "third_party/outlook-calendar",
-      "description": "List, create, update, and cancel Microsoft Outlook calendar events."
-    },
-    {
-      "name": "onedrive",
-      "source": "third_party/onedrive",
-      "description": "Browse, search, and read Microsoft OneDrive files."
-    },
-    {
-      "name": "sharepoint",
-      "source": "third_party/sharepoint",
-      "description": "Search and read Microsoft SharePoint sites, document libraries, files, and lists."
-    },
-    {
-      "name": "teams",
-      "source": "third_party/teams",
-      "description": "Search, read, and send Microsoft Teams chats and channel messages."
-    },
-    {
-      "name": "finance",
-      "source": "third_party/finance",
-      "description": "Securely connect your accounts so Grok can help with questions about your spending, subscriptions, balances, and investments.",
-      "minClientVersions": {
-        "cursor": "never",
-        "grokbot": "0.49.0",
-        "sand": "0.49.0"
-      }
-    },
-    {
-      "name": "x-ads",
-      "source": "third_party/x-ads",
-      "description": "Manage ad campaigns, create ads, track conversions, and pull performance stats."
-    },
-    {
-      "name": "attio",
-      "source": "third_party/attio",
-      "description": "Search and update CRM records, lists, notes, and tasks."
-    },
-    {
-      "name": "hunter",
-      "source": "third_party/hunter",
-      "description": "Find and verify emails, discover companies, and save leads."
-    },
-    {
-      "name": "gamma",
-      "source": "third_party/gamma",
-      "description": "Generate presentations, documents, and webpages."
-    },
-    {
-      "name": "webull",
-      "source": "third_party/webull",
-      "description": "View accounts, positions, orders, watchlists, and market data."
-    },
-    {
-      "name": "sp-global",
-      "source": "third_party/sp-global",
-      "description": "Query S&P Capital IQ financials, prices, and transcripts."
-    },
-    {
-      "name": "interactive-brokers",
-      "source": "third_party/interactive-brokers",
-      "description": "Review positions, balances, P&L, and draft trade instructions."
-    },
-    {
-      "name": "meltwater",
-      "source": "third_party/meltwater",
-      "description": "Search media and social mentions and pull analytics."
-    },
-    {
-      "name": "daloopa",
-      "source": "third_party/daloopa",
-      "description": "Pull source-linked fundamentals, KPIs, filings, and prices."
-    },
-    {
-      "name": "excalidraw",
-      "source": "third_party/excalidraw",
-      "description": "Draw and export hand-drawn diagrams from chat."
-    },
-    {
-      "name": "google-cloud-bigquery",
-      "source": "third_party/google-cloud-bigquery",
-      "description": "Explore datasets and tables and run SQL queries."
-    }
-  ]
-}

package/src/__tests__/fixtures/cursor-plugins/NOTICE

@@ -1,27 +0,0 @@
-Vendored test fixtures from the Cursor plugins repository.
-
-Source:  https://github.com/cursor/plugins
-Commit:  c1c0a32
-License: each plugin directory carries its own LICENSE file (MIT License,
-         Copyright Cursor), vendored beside it unchanged.
-
-Directories and their paths in the source repository:
-
-  thermos/     <- thermos/
-  advisor/     <- advisor/
-  github/      <- third_party/github/
-  xero/        <- third_party/xero/
-  playwright/  <- third_party/playwright/
-  salesforce/  <- third_party/salesforce/
-
-  .cursor-plugin/marketplace.json <- .cursor-plugin/marketplace.json
-    (the whole 79-entry catalogue; the marketplace tests mount the six
-    directories above at their source paths and expect the other 73 entries
-    to be reported as directories the tree does not hold)
-
-Every text file is a byte-for-byte copy of the source at that commit. The
-image files (assets/*.png, assets/*.svg) are zero-byte placeholders of the
-same name: the reader never opens them (a logo is an ignored component), and
-the tests pin only that they are listed and never read. Nothing under this
-directory is formatted, linted or edited; a change here is a re-vendoring at
-a new commit and updates this notice.

package/src/__tests__/fixtures/cursor-plugins/advisor/.cursor-plugin/plugin.json

@@ -1,33 +0,0 @@
-{
-  "name": "advisor",
-  "displayName": "Advisor",
-  "version": "1.0.0",
-  "description": "Consult a stronger model at key checkpoints: before major decisions, when stuck on an error, and before declaring a task done. The advisor gets a full briefing plus the conversation transcript, returns guidance, and the main model keeps doing the work.",
-  "author": {
-    "name": "Cursor",
-    "email": "plugins@cursor.com"
-  },
-  "homepage": "https://github.com/cursor/plugins/tree/main/advisor",
-  "repository": "https://github.com/cursor/plugins",
-  "license": "MIT",
-  "logo": "assets/avatar.png",
-  "keywords": [
-    "advisor",
-    "second-opinion",
-    "grok",
-    "multi-model",
-    "subagents",
-    "review",
-    "quality"
-  ],
-  "category": "developer-tools",
-  "tags": [
-    "agents",
-    "quality",
-    "review",
-    "automation"
-  ],
-  "skills": "./skills/",
-  "agents": "./agents/",
-  "hooks": "./hooks/hooks.json"
-}

package/src/__tests__/fixtures/cursor-plugins/advisor/CHANGELOG.md

@@ -1,8 +0,0 @@
-# Changelog
-
-## 1.0.0
-
-- Initial Advisor plugin release.
-- Skill: `advisor` (`/advisor [model|off|status|ask ...|nudge on|off]`), usable as a Custom Mode.
-- Agent: `advisor-subagent`, a read-only subagent pinned to Grok 4.6 at xhigh effort by default (any model via `/advisor <model>`) that returns a verdict and guidance.
-- Hooks: track edits since the last consult, log each consult to `.cursor/advisor/log.md`, and nudge a pre-completion consult at the end of a turn.

package/src/__tests__/fixtures/cursor-plugins/advisor/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Cursor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.