@unbrained/pm-cli 2026.5.11 → 2026.5.12

package/dist/cli/commands/extension.js

@@ -2,11 +2,12 @@ import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { activateExtensions, loadExtensions, nextExtensionReloadToken } from "../../core/extensions/index.js";
 import { EXTENSION_CAPABILITY_CONTRACT, KNOWN_EXTENSION_CAPABILITIES, parseLegacyExtensionCapabilityAliasWarning, parseUnknownExtensionCapabilityWarning, resolveExtensionRoots, } from "../../core/extensions/loader.js";
 import { pathExists } from "../../core/fs/fs-utils.js";
+import { collectPackageExtensionDirectories } from "../../core/packages/manifest.js";
 import { EXIT_CODE } from "../../core/shared/constants.js";
 import { PmCliError } from "../../core/shared/errors.js";
 import { nowIso } from "../../core/shared/time.js";
@@ -17,10 +18,17 @@ const DEFAULT_EXTENSION_PRIORITY = 100;
 const MANAGED_EXTENSION_STATE_FILENAME = ".managed-extensions.json";
 const MANAGED_EXTENSION_STATE_VERSION = 1;
 const PM_PACKAGE_ROOT_ENV = "PM_CLI_PACKAGE_ROOT";
-const BUNDLED_EXTENSION_ALIASES = {
-    beads: "beads",
-    todos: "todos",
+const BUNDLED_PACKAGE_ALIASES = {
+    beads: {
+        package_directory: "pm-beads",
+        legacy_extension_directory: "beads",
+    },
+    todos: {
+        package_directory: "pm-todos",
+        legacy_extension_directory: "todos",
+    },
 };
+const BUNDLED_PACKAGE_INSTALL_ALL_TARGETS = new Set(["*", "all"]);
 function resolvePackageRootCandidates() {
     const candidates = [];
     const envRoot = process.env[PM_PACKAGE_ROOT_ENV];
@@ -33,18 +41,28 @@ function resolvePackageRootCandidates() {
 }
 async function resolveBundledExtensionAliasSource(input) {
     const normalized = input.trim().toLowerCase();
-    const alias = BUNDLED_EXTENSION_ALIASES[normalized];
+    const alias = BUNDLED_PACKAGE_ALIASES[normalized];
     if (!alias) {
         return null;
     }
     for (const packageRoot of resolvePackageRootCandidates()) {
-        const bundledPath = path.join(packageRoot, ".agents", "pm", "extensions", alias);
-        if (await pathExists(path.join(bundledPath, "manifest.json"))) {
-            return bundledPath;
+        const packagePath = path.join(packageRoot, "packages", alias.package_directory);
+        if (await pathExists(path.join(packagePath, "package.json"))) {
+            return packagePath;
+        }
+        const legacyExtensionPath = path.join(packageRoot, ".agents", "pm", "extensions", alias.legacy_extension_directory);
+        if (await pathExists(path.join(legacyExtensionPath, "manifest.json"))) {
+            return legacyExtensionPath;
         }
     }
     return null;
 }
+function isBundledPackageInstallAllTarget(input) {
+    return BUNDLED_PACKAGE_INSTALL_ALL_TARGETS.has(input.trim().toLowerCase());
+}
+function listBundledPackageAliases() {
+    return Object.keys(BUNDLED_PACKAGE_ALIASES).sort((left, right) => left.localeCompare(right));
+}
 function normalizeStringList(values) {
     return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))].sort((left, right) => left.localeCompare(right));
 }
@@ -273,7 +291,7 @@ function normalizeManagedState(raw) {
             continue;
         }
         const source = entry.source;
-        if ((source.kind !== "local" && source.kind !== "github") ||
+        if ((source.kind !== "local" && source.kind !== "github" && source.kind !== "npm") ||
             typeof source.input !== "string" ||
             typeof source.location !== "string") {
             continue;
@@ -291,6 +309,8 @@ function normalizeManagedState(raw) {
                 kind: source.kind,
                 input: source.input,
                 location: source.location,
+                package: typeof source.package === "string" ? source.package : undefined,
+                version: typeof source.version === "string" ? source.version : undefined,
                 repository: typeof source.repository === "string" ? source.repository : undefined,
                 owner: typeof source.owner === "string" ? source.owner : undefined,
                 repo: typeof source.repo === "string" ? source.repo : undefined,
@@ -366,7 +386,11 @@ async function resolveBundledAliasManifestName(input) {
         return null;
     }
     try {
-        const validated = await validateExtensionDirectory(bundledAliasSource);
+        const extensionDirectories = await collectPackageExtensionDirectories(bundledAliasSource);
+        if (extensionDirectories.length !== 1) {
+            return null;
+        }
+        const validated = await validateExtensionDirectory(extensionDirectories[0]);
         return validated.manifest.name;
     }
     catch {
@@ -527,6 +551,23 @@ export function parseExtensionInstallSource(input, options = {}) {
         throw new PmCliError("Extension source is required for --install.", EXIT_CODE.USAGE);
     }
     const refOverride = typeof options.ref === "string" && options.ref.trim().length > 0 ? options.ref.trim() : undefined;
+    if (normalizedInput.startsWith("npm:")) {
+        const spec = normalizedInput.slice("npm:".length).trim();
+        if (spec.length === 0) {
+            throw new PmCliError('npm package source must include a package spec after "npm:".', EXIT_CODE.USAGE);
+        }
+        if (options.forceGithub) {
+            throw new PmCliError('Options "--gh/--github" cannot be combined with npm: package sources.', EXIT_CODE.USAGE);
+        }
+        if (refOverride) {
+            throw new PmCliError('Option "--ref" cannot be combined with npm: package sources.', EXIT_CODE.USAGE);
+        }
+        return {
+            kind: "npm",
+            input: normalizedInput,
+            spec,
+        };
+    }
     const maybeGithubByUrl = (() => {
         try {
             const parsed = new URL(normalizedInput);
@@ -578,22 +619,123 @@ async function runGitCommand(args) {
         throw new PmCliError(`Git command failed: git ${args.join(" ")}\n${message}`, EXIT_CODE.GENERIC_FAILURE);
     }
 }
-async function listManifestDirectories(parentDirectory) {
-    if (!(await pathExists(parentDirectory))) {
-        return [];
+async function runNpmCommand(args, cwd) {
+    try {
+        const result = await execFileAsync("npm", args, { cwd, encoding: "utf8" });
+        return (result.stdout ?? "").trim();
     }
-    const entries = await fs.readdir(parentDirectory, { withFileTypes: true });
-    const candidates = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory()) {
-            continue;
+    catch (error) {
+        const stderr = typeof error === "object" && error !== null && "stderr" in error ? String(error.stderr) : "";
+        const message = stderr.trim().length > 0 ? stderr.trim() : error instanceof Error ? error.message : String(error);
+        throw new PmCliError(`npm command failed: npm ${args.join(" ")}\n${message}`, EXIT_CODE.GENERIC_FAILURE);
+    }
+}
+async function resolveLocalNpmPackagePath(spec) {
+    if (path.isAbsolute(spec) || spec.startsWith(".") || spec.startsWith("..")) {
+        const absolutePath = path.resolve(process.cwd(), spec);
+        return (await pathExists(absolutePath)) ? absolutePath : null;
+    }
+    try {
+        const parsed = new URL(spec);
+        if (parsed.protocol === "file:") {
+            const absolutePath = fileURLToPath(parsed);
+            return (await pathExists(absolutePath)) ? absolutePath : null;
         }
-        const directory = path.join(parentDirectory, entry.name);
-        if (await pathExists(path.join(directory, "manifest.json"))) {
-            candidates.push(directory);
+    }
+    catch {
+        // Registry package specs are not URLs.
+    }
+    return null;
+}
+async function resolveNpmPackSpec(spec) {
+    const localPath = await resolveLocalNpmPackagePath(spec);
+    if (localPath) {
+        return pathToFileURL(localPath).href;
+    }
+    if (/^[a-z][a-z0-9+.-]*:/i.test(spec)) {
+        return spec;
+    }
+    return spec;
+}
+function parsePackedNpmPackage(stdout, packDirectory) {
+    try {
+        const parsed = JSON.parse(stdout);
+        const first = Array.isArray(parsed) ? parsed[0] : undefined;
+        if (first && typeof first.filename === "string" && first.filename.trim().length > 0) {
+            return {
+                tarball: path.resolve(packDirectory, first.filename),
+                package: typeof first.name === "string" ? first.name : undefined,
+                version: typeof first.version === "string" ? first.version : undefined,
+            };
         }
     }
-    return candidates.sort((left, right) => left.localeCompare(right));
+    catch {
+        // Fall back to the last stdout line for older npm output.
+    }
+    const lastLine = stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .at(-1);
+    if (!lastLine) {
+        throw new PmCliError("npm pack did not report a tarball filename.", EXIT_CODE.GENERIC_FAILURE);
+    }
+    return {
+        tarball: path.resolve(packDirectory, lastLine),
+    };
+}
+async function resolveNpmSourceDirectory(source) {
+    const localPackageRoot = await resolveLocalNpmPackagePath(source.spec);
+    if (localPackageRoot) {
+        const packageJsonPath = path.join(localPackageRoot, "package.json");
+        const packageJson = (await pathExists(packageJsonPath))
+            ? JSON.parse(await fs.readFile(packageJsonPath, "utf8"))
+            : {};
+        return {
+            directory: await resolvePackageExtensionDirectory(localPackageRoot, source.input),
+            package: typeof packageJson.name === "string" ? packageJson.name : undefined,
+            version: typeof packageJson.version === "string" ? packageJson.version : undefined,
+            cleanup: async () => { },
+        };
+    }
+    const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "pm-npm-package-source-"));
+    const packDirectory = path.join(tempRoot, "pack");
+    const extractDirectory = path.join(tempRoot, "extract");
+    await fs.mkdir(packDirectory, { recursive: true });
+    await fs.mkdir(extractDirectory, { recursive: true });
+    try {
+        const packSpec = await resolveNpmPackSpec(source.spec);
+        const packStdout = await runNpmCommand(["pack", packSpec, "--json", "--pack-destination", packDirectory]);
+        const packed = parsePackedNpmPackage(packStdout, packDirectory);
+        await execFileAsync("tar", ["-xzf", packed.tarball, "-C", extractDirectory], { encoding: "utf8" });
+        const packageRoot = path.join(extractDirectory, "package");
+        const directory = await resolvePackageExtensionDirectory(packageRoot, source.input);
+        return {
+            directory,
+            package: packed.package,
+            version: packed.version,
+            cleanup: async () => {
+                await fs.rm(tempRoot, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        await fs.rm(tempRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+async function resolvePackageExtensionDirectory(packageRoot, sourceLabel) {
+    const discovered = await collectPackageExtensionDirectories(packageRoot);
+    if (discovered.length === 1) {
+        return discovered[0];
+    }
+    if (discovered.length > 1) {
+        const choices = discovered
+            .map((entry) => path.relative(packageRoot, entry).replaceAll(path.sep, "/"))
+            .sort((left, right) => left.localeCompare(right));
+        throw new PmCliError(`Package source "${sourceLabel}" contains multiple extension manifests. Provide an explicit extension path. Candidates: ${choices.join(", ")}`, EXIT_CODE.USAGE);
+    }
+    throw new PmCliError(`Unable to locate a pm extension manifest in package source "${sourceLabel}". Add package.json pm.extensions or an extensions/ directory.`, EXIT_CODE.USAGE);
 }
 async function resolveGithubSourceDirectory(cloneDirectory, source) {
     const candidatePaths = [];
@@ -612,25 +754,11 @@ async function resolveGithubSourceDirectory(cloneDirectory, source) {
     if (await pathExists(path.join(cloneDirectory, "manifest.json"))) {
         return { directory: cloneDirectory, resolved_subpath: "." };
     }
-    const defaultRoots = [
-        path.join(cloneDirectory, ".agents", "pm", "extensions"),
-        path.join(cloneDirectory, ".custom", "pm-extensions"),
-        path.join(cloneDirectory, ".custom", "pm-extension"),
-    ];
-    const discovered = (await Promise.all(defaultRoots.map((defaultRoot) => listManifestDirectories(defaultRoot)))).flat();
-    if (discovered.length === 1) {
-        return {
-            directory: discovered[0],
-            resolved_subpath: path.relative(cloneDirectory, discovered[0]).replaceAll(path.sep, "/"),
-        };
-    }
-    if (discovered.length > 1) {
-        const choices = discovered
-            .map((entry) => path.relative(cloneDirectory, entry).replaceAll(path.sep, "/"))
-            .sort((left, right) => left.localeCompare(right));
-        throw new PmCliError(`GitHub source "${source.input}" contains multiple extension manifests. Provide an explicit path. Candidates: ${choices.join(", ")}`, EXIT_CODE.USAGE);
-    }
-    throw new PmCliError(`Unable to locate extension manifest in GitHub source "${source.input}". Provide an explicit extension path.`, EXIT_CODE.USAGE);
+    const discoveredDirectory = await resolvePackageExtensionDirectory(cloneDirectory, source.input);
+    return {
+        directory: discoveredDirectory,
+        resolved_subpath: path.relative(cloneDirectory, discoveredDirectory).replaceAll(path.sep, "/"),
+    };
 }
 async function resolveInstallSource(source) {
     if (source.kind === "local") {
@@ -641,9 +769,21 @@ async function resolveInstallSource(source) {
         if (!stats.isDirectory()) {
             throw new PmCliError(`Local extension source must be a directory: "${source.absolute_path}".`, EXIT_CODE.USAGE);
         }
+        const directory = await resolvePackageExtensionDirectory(source.absolute_path, source.input);
         return {
             source,
-            directory: source.absolute_path,
+            directory,
+        };
+    }
+    if (source.kind === "npm") {
+        const resolved = await resolveNpmSourceDirectory(source);
+        return {
+            source,
+            directory: resolved.directory,
+            cleanup: resolved.cleanup,
+            resolved_subpath: path.relative(path.dirname(resolved.directory), resolved.directory).replaceAll(path.sep, "/"),
+            npm_package: resolved.package,
+            npm_version: resolved.version,
         };
     }
     const cloneDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "pm-extension-source-"));
@@ -1001,19 +1141,21 @@ function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
         capabilities: ["commands"],
     }, null, 2)}\n`;
     const entrypoint = [
-        "module.exports = {",
-        "  activate(api) {",
-        "    api.registerCommand({",
-        `      name: ${JSON.stringify(commandName)},`,
-        '      description: "Starter scaffold command. Replace with your own behavior.",',
-        "      run: async (context) => ({",
-        "        ok: true,",
-        `        source: ${JSON.stringify(extensionName)},`,
-        "        command: context.command,",
-        '        message: "Starter extension scaffold is active.",',
-        "      }),",
-        "    });",
-        "  },",
+        "export function activate(api) {",
+        "  api.registerCommand({",
+        `    name: ${JSON.stringify(commandName)},`,
+        '    description: "Starter scaffold command. Replace with your own behavior.",',
+        "    run: async (context) => ({",
+        "      ok: true,",
+        `      source: ${JSON.stringify(extensionName)},`,
+        "      command: context.command,",
+        '      message: "Starter extension scaffold is active.",',
+        "    }),",
+        "  });",
+        "}",
+        "",
+        "export default {",
+        "  activate,",
         "};",
         "",
     ].join("\n");
@@ -1034,7 +1176,7 @@ function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
         "```",
         "",
         "## Notes",
-        "- This scaffold uses CommonJS (`module.exports`) for zero-config runtime compatibility.",
+        "- This scaffold uses ESM exports so it works in package scopes with `type: module`.",
         "- Update `manifest.json` capabilities and `index.js` command behavior as your extension evolves.",
         "",
     ].join("\n");
@@ -1443,6 +1585,36 @@ export async function runExtension(target, options, global) {
     if (action === "install") {
         const githubOption = resolveGithubOption(options);
         const explicitSourceInput = githubOption ?? requireTarget(normalizedTarget, action);
+        if (typeof githubOption !== "string" && isBundledPackageInstallAllTarget(explicitSourceInput)) {
+            if (typeof options.ref === "string" && options.ref.trim().length > 0) {
+                throw new PmCliError('Action "install all" does not accept --ref.', EXIT_CODE.USAGE);
+            }
+            const aliases = listBundledPackageAliases();
+            const packages = [];
+            for (const alias of aliases) {
+                packages.push({
+                    alias,
+                    result: await runExtension(alias, { ...options, install: true }, global),
+                });
+            }
+            for (const entry of packages) {
+                warnings.push(...entry.result.warnings);
+            }
+            return withResult({
+                installed_all: true,
+                installed_count: packages.length,
+                packages: packages.map((entry) => ({
+                    alias: entry.alias,
+                    ok: entry.result.ok,
+                    extension: entry.result.details.extension,
+                    source: entry.result.details.source,
+                    destination_path: entry.result.details.destination_path,
+                    activated: entry.result.details.activated,
+                    settings_changed: entry.result.details.settings_changed,
+                    warnings: entry.result.warnings,
+                })),
+            });
+        }
         const bundledAliasSource = typeof githubOption === "string" ? null : await resolveBundledExtensionAliasSource(explicitSourceInput);
         const sourceInput = bundledAliasSource ?? explicitSourceInput;
         const installSource = parseExtensionInstallSource(sourceInput, {
@@ -1472,17 +1644,25 @@ export async function runExtension(target, options, global) {
                     input: installSource.input,
                     location: installSource.absolute_path,
                 }
-                : {
-                    kind: "github",
-                    input: installSource.input,
-                    location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
-                    repository: installSource.repository,
-                    owner: installSource.owner,
-                    repo: installSource.repo,
-                    ref: installSource.ref,
-                    subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
-                    commit: resolvedSource.commit,
-                };
+                : installSource.kind === "npm"
+                    ? {
+                        kind: "npm",
+                        input: installSource.input,
+                        location: resolvedSource.resolved_subpath ?? ".",
+                        package: resolvedSource.npm_package,
+                        version: resolvedSource.npm_version,
+                    }
+                    : {
+                        kind: "github",
+                        input: installSource.input,
+                        location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
+                        repository: installSource.repository,
+                        owner: installSource.owner,
+                        repo: installSource.repo,
+                        ref: installSource.ref,
+                        subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
+                        commit: resolvedSource.commit,
+                    };
             const now = nowIso();
             const existingManagedEntry = managedStateRead.state.entries.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name));
             const managedState = upsertManagedEntry(managedStateRead.state, {