@the-agenticflow/openflows 0.1.3 → 0.1.6

package/bin/orchestration/plugin/hooks/sentinel/pre_bash_readonly_guard.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# SENTINEL Pre-Bash Guard Hook
+# Enforces read-only mode - SENTINEL cannot modify source files
+#
+# Environment:
+#   SPRINTLESS_WORKTREE - the worktree path (source code)
+#   SPRINTLESS_SHARED - the shared directory (allowed writes)
+#   CLAUDE_BASH_COMMAND - the command about to run (injected by Claude Code)
+
+WORKTREE="${SPRINTLESS_WORKTREE:-}"
+SHARED="${SPRINTLESS_SHARED:-}"
+CMD="${CLAUDE_BASH_COMMAND:-}"
+
+# If no command, allow
+if [ -z "$CMD" ]; then
+  exit 0
+fi
+
+# Blocked commands - SENTINEL cannot use these at all
+BLOCKED_PATTERNS=(
+  "git "
+  "git"
+  "rm "
+  "rm"
+  "sudo "
+  "npm install"
+  "pip install"
+  "cargo install"
+  "mv "
+  "cp "
+  "chmod"
+  "chown"
+)
+
+for pattern in "${BLOCKED_PATTERNS[@]}"; do
+  if [[ "$CMD" == *"$pattern"* ]]; then
+    echo "=============================================="
+    echo "  BLOCKED: Command not allowed for SENTINEL"
+    echo "=============================================="
+    echo ""
+    echo "Command: ${CMD}"
+    echo ""
+    echo "SENTINEL is read-only. You cannot:"
+    echo "  - Use git commands"
+    echo "  - Delete files (rm)"
+    echo "  - Move or copy files"
+    echo "  - Install packages"
+    echo "  - Modify permissions"
+    echo ""
+    echo "You CAN:"
+    echo "  - Read files (cat, head, tail, less)"
+    echo "  - Run tests and linters"
+    echo "  - Search code (grep, find)"
+    echo "  - Write to shared/ directory"
+    echo ""
+    exit 2
+  fi
+done
+
+# Check if command writes to source tree
+if [ -n "$WORKTREE" ]; then
+  # Patterns that write files
+  WRITE_PATTERNS=(
+    " > "
+    " >> "
+    " 2> "
+    " | tee "
+    "sed -i"
+    "awk -i"
+    "truncate"
+    "dd if="
+  )
+  
+  for pattern in "${WRITE_PATTERNS[@]}"; do
+    if [[ "$CMD" == *"$pattern"* ]]; then
+      # Check if the redirect target is in worktree
+      # Extract the file path after the redirect
+      REDIRECT_FILE=$(echo "$CMD" | grep -oP '(?<=[<>])\s*\S+' | head -1 | tr -d ' ')
+      
+      if [ -n "$REDIRECT_FILE" ]; then
+        # Get absolute path
+        if [[ "$REDIRECT_FILE" != /* ]]; then
+          REDIRECT_FILE="${WORKTREE}/${REDIRECT_FILE}"
+        fi
+        
+        # Check if it's inside worktree but NOT in shared
+        if [[ "$REDIRECT_FILE" == "$WORKTREE"* ]] && [[ "$REDIRECT_FILE" != *"$SHARED"* ]]; then
+          echo "=============================================="
+          echo "  BLOCKED: Cannot write to source tree"
+          echo "=============================================="
+          echo ""
+          echo "Command: ${CMD}"
+          echo ""
+          echo "SENTINEL can only write to: ${SHARED}"
+          echo "Attempted write to: ${REDIRECT_FILE}"
+          echo ""
+          echo "All your outputs (eval files, reviews) go in shared/."
+          echo ""
+          exit 2
+        fi
+      fi
+    fi
+  done
+fi
+
+# Allow the command
+exit 0

package/bin/orchestration/plugin/hooks/sentinel/session_start.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# SENTINEL Session Start Hook
+# Determines segment mode and reads the correct input artifacts
+#
+# Environment:
+#   SPRINTLESS_SHARED - the shared directory
+#   SPRINTLESS_SEGMENT - segment number (set by harness)
+
+SHARED="${SPRINTLESS_SHARED}"
+SEGMENT="${SPRINTLESS_SEGMENT:-1}"
+
+echo "=============================================="
+echo "  SENTINEL SESSION STARTED"
+echo "=============================================="
+echo ""
+echo "Segment: ${SEGMENT}"
+echo ""
+
+# Determine mode based on what files exist
+if [ "${SEGMENT}" = "final" ] || [ -f "${SHARED}/DONE.md" ]; then
+  echo "MODE: FINAL_REVIEW"
+  echo ""
+  echo "Reading DONE.md to verify completion..."
+  if [ -f "${SHARED}/DONE.md" ]; then
+    echo "--- DONE.md ---"
+    head -50 "${SHARED}/DONE.md"
+    echo "..."
+  else
+    echo "ERROR: DONE.md not found. Cannot perform final review."
+    exit 1
+  fi
+elif [ -f "${SHARED}/PLAN.md" ]; then
+  echo "MODE: SEGMENT_REVIEW"
+  echo ""
+  echo "Reading PLAN.md and segment inputs..."
+  echo ""
+  echo "--- PLAN.md (first 30 lines) ---"
+  head -30 "${SHARED}/PLAN.md"
+  echo "..."
+  echo ""
+  if [ -f "${SHARED}/WORKLOG.md" ]; then
+    echo "--- WORKLOG.md (last 20 lines) ---"
+    tail -20 "${SHARED}/WORKLOG.md"
+    echo ""
+  fi
+else
+  echo "MODE: UNKNOWN - No PLAN.md found"
+  echo "This may be an initial setup. Check TICKET.md and TASK.md."
+  if [ -f "${SHARED}/TICKET.md" ]; then
+    echo ""
+    echo "--- TICKET.md ---"
+    cat "${SHARED}/TICKET.md"
+  fi
+fi
+
+echo ""
+echo "=============================================="
+echo "  YOUR MISSION"
+echo "=============================================="
+echo ""
+echo "1. Read the segment changes from WORKLOG.md"
+echo "2. Run tests and linters to verify quality"
+echo "3. Write your evaluation to segment-${SEGMENT}-eval.md"
+echo ""
+echo "Evaluation must include:"
+echo "  - ## Summary"
+echo "  - ## Tests Run"
+echo "  - ## Issues Found (if any)"
+echo "  - ## Verdict (APPROVED / NEEDS_WORK)"
+echo ""
+echo "If NEEDS_WORK, list specific issues that must be fixed."
+echo ""
+
+exit 0

package/bin/orchestration/plugin/hooks/sentinel/stop_require_eval.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# SENTINEL Stop Hook
+# Ensures SENTINEL writes an eval file before exiting
+#
+# Environment:
+#   SPRINTLESS_SHARED - the shared directory
+#   SPRINTLESS_SEGMENT - segment number (set by harness)
+
+SHARED="${SPRINTLESS_SHARED}"
+SEGMENT="${SPRINTLESS_SEGMENT:-1}"
+
+# Determine expected eval file
+if [ "${SEGMENT}" = "final" ]; then
+  EVAL_FILE="${SHARED}/final-review.md"
+else
+  EVAL_FILE="${SHARED}/segment-${SEGMENT}-eval.md"
+fi
+
+# Check if eval file exists
+if [ -f "$EVAL_FILE" ]; then
+  # Validate it has a verdict
+  if grep -q "## Verdict" "$EVAL_FILE"; then
+    VERDICT=$(grep -A1 "## Verdict" "$EVAL_FILE" | tail -1 | tr -d ' ')
+    
+    if [ "$VERDICT" = "APPROVED" ] || [ "$VERDICT" = "NEEDS_WORK" ]; then
+      echo "Evaluation complete: ${VERDICT}"
+      exit 0
+    else
+      echo "ERROR: Invalid verdict in ${EVAL_FILE}"
+      echo "Verdict must be APPROVED or NEEDS_WORK, got: ${VERDICT}"
+      exit 2
+    fi
+  else
+    echo "ERROR: ${EVAL_FILE} missing ## Verdict section"
+    exit 2
+  fi
+fi
+
+# No eval file - block exit
+echo "=============================================="
+echo "  BLOCKED: Cannot exit without evaluation"
+echo "=============================================="
+echo ""
+echo "You must write your evaluation to:"
+echo "  ${EVAL_FILE}"
+echo ""
+echo "Required sections:"
+echo "  - ## Summary"
+echo "  - ## Tests Run"
+echo "  - ## Issues Found (if any)"
+echo "  - ## Verdict (APPROVED or NEEDS_WORK)"
+echo ""
+echo "If NEEDS_WORK, include:"
+echo "  - ## Required Fixes (specific, actionable items)"
+echo ""
+
+exit 2

package/bin/orchestration/plugin/hooks/vessel/log-merge-status.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# VESSEL Stop Hook
+# Logs merge status on exit
+
+echo "VESSEL session ending. Merge status logged."
+
+exit 0

package/bin/orchestration/plugin/hooks/vessel/session-start.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# VESSEL Session Start Hook
+# Initializes the deployer session
+
+echo "=========================================="
+echo "VESSEL Session Starting"
+echo "=========================================="
+echo ""
+echo "Checking for open PRs from forge branches..."
+
+# Vessel monitors open PRs and CI status
+# This would typically query GitHub API
+
+exit 0

package/bin/orchestration/plugin/mcp/mcp.json.template

@@ -0,0 +1,26 @@
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${SPRINTLESS_GITHUB_TOKEN}"
+      }
+    },
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem",
+        "${SPRINTLESS_WORKTREE}"
+      ]
+    },
+    "shell": {
+      "command": "shell-mcp-server",
+      "args": [
+        "--allowlist",
+        "orchestration/agent/tooling/run-tests.sh,cargo clippy,cargo test,npx eslint,npx jest,ruff check"
+      ]
+    }
+  }
+}

package/bin/orchestration/plugin/plugin.json

@@ -0,0 +1,66 @@
+{
+  "name": "orchestration",
+  "version": "3.0.0",
+  "description": "Autonomous agent pair tooling for AgentFlow FORGE-SENTINEL architecture",
+  "skills": {
+    "forge": [
+      "skills/forge-coding.md",
+      "skills/forge-planning.md",
+      "skills/forge-frontend-design.md",
+      "skills/forge-mcp-builder.md",
+      "skills/forge-skill-creator.md",
+      "skills/forge-canvas-design.md",
+      "skills/forge-web-artifacts-builder.md",
+      "skills/forge-algorithmic-art.md",
+      "skills/shared-claude-api.md"
+    ],
+    "sentinel": [
+      "skills/sentinel-review.md",
+      "skills/sentinel-criteria.md",
+      "skills/sentinel-webapp-testing.md",
+      "skills/sentinel-frontend-design.md",
+      "skills/sentinel-web-artifacts-builder.md",
+      "skills/sentinel-algorithmic-art.md",
+      "skills/shared-claude-api.md"
+    ],
+    "nexus": [
+      "skills/nexus-orchestration.md",
+      "skills/nexus-triage.md",
+      "skills/nexus-internal-comms.md",
+      "skills/nexus-doc-coauthoring.md",
+      "skills/nexus-skill-creator.md",
+      "skills/nexus-xlsx.md",
+      "skills/nexus-slack-gif-creator.md",
+      "skills/shared-claude-api.md"
+    ],
+    "vessel": [
+      "skills/vessel-ci-gate.md",
+      "skills/vessel-merge-protocol.md",
+      "skills/vessel-webapp-testing.md",
+      "skills/vessel-internal-comms.md",
+      "skills/vessel-mcp-builder.md",
+      "skills/vessel-pdf.md",
+      "skills/shared-claude-api.md"
+    ],
+    "lore": [
+      "skills/lore-documentation.md",
+      "skills/lore-changelog.md",
+      "skills/lore-doc-coauthoring.md",
+      "skills/lore-brand-guidelines.md",
+      "skills/lore-theme-factory.md",
+      "skills/lore-docx.md",
+      "skills/lore-pptx.md",
+      "skills/lore-xlsx.md",
+      "skills/lore-pdf.md",
+      "skills/shared-claude-api.md"
+    ]
+  },
+  "hooks": {
+    "forge": "hooks/forge/",
+    "sentinel": "hooks/sentinel/",
+    "nexus": "hooks/nexus/",
+    "vessel": "hooks/vessel/",
+    "lore": "hooks/lore/"
+  },
+  "commands": "commands/"
+}

package/bin/orchestration/plugin/skills/forge-algorithmic-art.md

@@ -0,0 +1,24 @@
+---
+name: algorithmic-art
+description: Create generative, code-based art and visualizations using P5.JS and algorithmic principles.
+---
+
+# FORGE Algorithmic Art Skill
+
+Use this skill to create unique, generative visual artifacts or to visualize complex data structures algorithmically.
+
+## Algorithmic Philosophy
+
+- **Conceptual Seed**: Start with a mathematical or natural phenomenon (e.g., "Voronoi Diagrams", "Lindenmayer Systems", "Fluid Dynamics").
+- **Deduce Style**: Choose an aesthetic (e.g., Generative Minimalism, Digital Brutalism, Organic Complexity).
+- **Technical Implementation**: Use P5.JS to implement the visual logic.
+
+## Craftsmanship Requirements
+
+- **Efficiency**: Favor procedural generation over static assets.
+- **Interactivity**: Where appropriate, make the art responsive to user input.
+- **Clean Code**: Structure your P5.JS scripts for readability and modularity.
+
+## Output Format
+
+Deliver your implementation in a self-contained HTML/JS artifact.

package/bin/orchestration/plugin/skills/forge-canvas-design.md

@@ -0,0 +1,25 @@
+---
+name: canvas-design
+description: Visual philosophy and design principles for creating impactful visual content.
+---
+
+# FORGE Canvas Design Skill
+
+Use this skill to establish a strong visual philosophy before creating visual artifacts, posters, or UI layouts.
+
+## Visual Philosophy Creation
+
+- **Deduce the Conceptual Seed**: What is the core idea? (e.g., "The Precision of a Swiss Watch", "The Organic Flow of Water").
+- **Establish Principles**: define constraints (e.g., "Only 3 colors", "Strict Grid", "Asymmetric Balance").
+- **Deduce Style**: Use specific visual descriptors (e.g., Brutalist, Geometric, Soft Minimalism).
+
+## Essential Principles
+
+- **Contrast**: Use size, color, and weight to create impact.
+- **Hierarchy**: Guide the viewer's eye to the most important element first.
+- **Negative Space**: Give your design room to breathe. Don't crowd the canvas.
+- **Intentionality**: Every element must have a purpose. If it doesn't add value, remove it.
+
+## Execution
+
+Once the philosophy is established, apply it consistently across all components of the artifact.

package/bin/orchestration/plugin/skills/forge-coding.md

@@ -0,0 +1,161 @@
+# FORGE Coding Skill
+
+## Your role
+
+You are FORGE, the generator in a FORGE-SENTINEL pair.
+Your job is to produce correct, complete, well-tested implementations.
+You work in segments. After each segment you submit to SENTINEL.
+Quality comes from the pair loop, not from you alone.
+
+## Before writing any code
+
+1. Read `TICKET.md` from `${SPRINTLESS_SHARED}/TICKET.md` - understand what you are building
+2. Read `CONTRACT.md` from `${SPRINTLESS_SHARED}/CONTRACT.md` - this is your definition of done
+3. Search the codebase - find existing patterns before inventing new ones
+   - Use Glob and Grep tools to find relevant files
+   - Look for similar functionality in existing code
+
+## Coding standards
+
+- All standards are in `orchestration/agent/standards/CODING.md` (if it exists)
+- All architecture patterns are in `orchestration/agent/arch/patterns.md` (if it exists)
+- API contracts are in `orchestration/agent/arch/api-contracts.md` (if it exists)
+- **READ these before implementing. They are not optional.**
+
+## Testing discipline
+
+- Every new function needs a test
+- Every changed file needs updated tests
+- Run tests after every segment: `orchestration/agent/tooling/run-tests.sh`
+- Do not submit a segment with failing tests
+
+## Error handling
+
+- Never throw raw Error - use the project's error type (e.g., `AppError` from `src/errors/`)
+- Every async function must have explicit error handling
+- Network calls must have timeout and retry logic
+
+## Submitting a segment
+
+When you believe a segment is complete:
+
+1. Run tests - all must pass
+2. Run linter - zero warnings
+3. Use `/segment-done` command to commit and notify SENTINEL
+4. Wait for `segment-N-eval.md` to appear in `${SPRINTLESS_SHARED}/`
+
+## Handling SENTINEL feedback
+
+If SENTINEL returns `CHANGES_REQUESTED`:
+
+- Read the `## Specific feedback` section carefully
+- Each item has: `file:line:problem:fix`
+- Fix **only** the specific items listed - do not refactor beyond what's requested
+- Re-run tests and linter
+- Re-submit with `/segment-done`
+
+## File locking
+
+Before writing to any file, the `pre_write_check.sh` hook validates ownership.
+
+- If you get `BLOCKED: File locked by pair-X`, you must:
+  1. Find an alternative implementation that avoids this file, OR
+  2. Set STATUS.json to `BLOCKED` with reason `FILE_LOCK_CONFLICT`
+
+## Context reset
+
+If you receive a "CONTEXT RESET REQUIRED" message:
+
+1. Run `/handoff` command immediately
+2. This writes `HANDOFF.md` with your current state
+3. Exit cleanly - a fresh FORGE will continue from your handoff
+
+## Valid STATUS.json Status Values
+
+When writing `STATUS.json`, you MUST use one of these exact status strings.
+Any other value will be treated as `BLOCKED` and your work will be wasted.
+
+| Status | When to use |
+|---|---|
+| `PR_OPENED` | Work complete and PR created (include `pr_url`, `pr_number`, `branch`) |
+| `COMPLETE` | All work done but PR creation deferred to harness |
+| `BLOCKED` | Cannot proceed (include `reason` and `blockers`) |
+| `FUEL_EXHAUSTED` | Budget/tokens exhausted |
+| `PENDING_REVIEW` | Work paused, waiting for review |
+| `AWAITING_SENTINEL_REVIEW` | Segment done, waiting for SENTINEL evaluation |
+| `APPROVED_READY` | Changes requested by SENTINEL have been addressed |
+| `SEGMENT_N_DONE` | Segment N complete (e.g. `SEGMENT_1_DONE`) |
+
+Do NOT invent status values. If you need review use `PENDING_REVIEW`. If you need help use `BLOCKED`.
+
+## When work is complete
+
+When SENTINEL approves all segments and you're ready to finish:
+
+1. **Push the branch to remote:**
+   ```bash
+   git push -u origin forge-${SPRINTLESS_PAIR_ID}/${SPRINTLESS_TICKET_ID}
+   ```
+   
+   NOTE: Direct `git push` is blocked. Instead, use the GitHub MCP tool:
+   - Get the current commit SHA
+   - Create a new branch reference on the remote
+
+2. **Create a Pull Request using GitHub MCP tool:**
+   - Use `create_pull_request` from the GitHub MCP server
+   - Set title: `[T-{id}] Brief description of the change`
+   - Set body: Use the PR description from `final-review.md`
+     - MUST include `Closes #<issue_number>` to auto-close the issue on merge
+     - Extract issue number from `SPRINTLESS_TICKET_ID`: `T-004` → `Closes #4`
+     - DO NOT use `Closes: T-004` (invalid - will not close the issue)
+   - Set head: `forge-${SPRINTLESS_PAIR_ID}/${SPRINTLESS_TICKET_ID}`
+   - Set base: `main`
+
+3. **Write STATUS.json with PR_OPENED:**
+   ```json
+   {
+     "status": "PR_OPENED",
+     "pair": "${SPRINTLESS_PAIR_ID}",
+     "ticket_id": "${SPRINTLESS_TICKET_ID}",
+     "branch": "forge-${SPRINTLESS_PAIR_ID}/${SPRINTLESS_TICKET_ID}",
+     "pr_url": "https://github.com/owner/repo/pull/42",
+     "pr_number": 42,
+     "files_changed": ["list", "of", "files"],
+     "segments_completed": N,
+     "timestamp": "2025-03-24T10:00:00Z"
+   }
+   ```
+
+4. **Exit** - The harness will detect STATUS.json and complete the lifecycle.
+
+## If you cannot create a PR
+
+If you encounter issues pushing or creating a PR:
+
+1. Write STATUS.json with `BLOCKED` status:
+   ```json
+   {
+     "status": "BLOCKED",
+     "pair": "${SPRINTLESS_PAIR_ID}",
+     "ticket_id": "${SPRINTLESS_TICKET_ID}",
+     "branch": "forge-${SPRINTLESS_PAIR_ID}/${SPRINTLESS_TICKET_ID}",
+     "reason": "Could not push/create PR: <specific error>",
+     "blockers": [],
+     "files_changed": ["list", "of", "files"]
+   }
+   ```
+
+2. Exit - NEXUS will be alerted for human intervention.
+
+## Branch naming
+
+Your branch is: `forge-${SPRINTLESS_PAIR_ID}/${SPRINTLESS_TICKET_ID}`
+
+Example: `forge-pair-1/T-42`
+
+## Environment variables
+
+- `SPRINTLESS_PAIR_ID` - your pair identifier (e.g., "pair-1")
+- `SPRINTLESS_TICKET_ID` - the ticket you're working on (e.g., "T-42")
+- `SPRINTLESS_WORKTREE` - your working directory
+- `SPRINTLESS_SHARED` - the shared directory for FORGE-SENTINEL communication

package/bin/orchestration/plugin/skills/forge-frontend-design.md

@@ -0,0 +1,30 @@
+---
+name: frontend-design
+description: Create distinctive, production-grade frontend interfaces with high design quality. Focuses on premium aesthetics and avoiding "AI slop".
+---
+
+# FORGE Frontend Design Skill
+
+Use this skill when tasked with building web components, pages, artifacts, or applications. Your goal is to create distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics.
+
+## Design Principles
+
+- **Commit to BOLD Aesthetics**: Pick a clear conceptual direction (e.g., minimal, maximalist, retro-futuristic, etc.) and execute it with precision.
+- **Memorable & Polished**: What is the one thing someone will remember? Ensure meticulous refinement in every detail.
+- **Technical Excellence**: Framework compatibility, performance, and accessibility are baseline requirements.
+
+## Guidelines
+
+- **Typography**: Pair a distinctive display font with a refined body font. Avoid Inter, Roboto, and Arial.
+- **Color & Theme**: Use CSS variables for a cohesive theme. Choose accents that pop.
+- **Motion**: Orchestrate high-impact animations. Use CSS transitions or library-specific motion (e.g., Framer Motion for React).
+- **Composition**: Break the grid. Use asymmetry, negative space, and overlapping elements for depth.
+- **Background Content**: Use meshes, noise, geometric patterns, or layered transparencies to create atmosphere.
+
+## What to Avoid
+
+- Purple gradients on white backgrounds.
+-系統 default font stacks.
+- Predictive layouts and cookie-cutter component patterns.
+
+MATCH implementation complexity to the aesthetic vision. Elegance comes from executing the vision well.

package/bin/orchestration/plugin/skills/forge-mcp-builder.md

@@ -0,0 +1,37 @@
+---
+name: mcp-builder
+description: Comprehensive guide for developing and extending Model Context Protocol (MCP) servers.
+---
+
+# FORGE MCP Builder Skill
+
+Use this skill when you need to build or extend MCP servers to provide new capabilities to the AgentFlow system.
+
+## High-Level Workflow
+
+### Phase 1: Research and Planning
+
+- Understand the external system or data source you are integrating.
+- Define the necessary tools and resources.
+- Choose the appropriate language/SDK (Rust, Python, Node.js).
+
+### Phase 2: Implementation
+
+- Implement the core protocol (Tools, Resources, Prompts).
+- Follow the official [MCP Specification](https://modelcontextprotocol.io/).
+- Ensure robust error handling and type safety.
+
+### Phase 3: Review and Test
+
+- Verify transport layers (Stdio, HTTP/SSE).
+- Test tool execution and resource retrieval.
+- Check for protocol compliance.
+
+### Phase 4: Integration
+
+- Create evaluations and documentation.
+- Add components to the `.claude-plugin/plugin.json` or `.mcp.json`.
+
+## Documentation Reference
+
+Consult the official SDK documentation for the language you choose. Prioritize security and minimal permission sets when exposing system capabilities via tools.