@unbrained/pm-cli 2026.6.21 → 2026.6.22

package/dist/cli/commands/extension/scaffold.js

@@ -4,7 +4,7 @@
  * Implements extension package-management support for Scaffold.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3abac9c3-3fc0-575e-8f5d-d2624fe7a20c")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="61e2eb79-305a-5636-b5ca-ab0c6aa4afcc")}catch(e){}}();
 import fs from "node:fs/promises";
 import path from "node:path";
 import { pathExists } from "../../../core/fs/fs-utils.js";
@@ -17,18 +17,453 @@ import { normalizeManagedDirectoryName } from "./shared.js";
 // tracks the manifest schema generation (currently 1).
 const SCAFFOLD_MANIFEST_VERSION = 1;
 const SCAFFOLD_PM_MIN_VERSION = "2026.5.0";
+const SCAFFOLD_DECLARED_PERMISSIONS = {
+    fs_read: false,
+    fs_write: false,
+    network: false,
+    env_read: false,
+    env_write: false,
+    process_spawn: false,
+};
+/**
+ * Capability shapes the package/extension scaffolder can target via the
+ * `--capability` selector. `commands` emits the default command-only starter;
+ * `hooks` additionally wires an `after_command` lifecycle reactor, `search`
+ * wires an in-memory provider/adapter pair, and `importers` wires importer and
+ * exporter command primitives so authors can customize project context movement
+ * without starting from a blank extension.
+ */
+export const SCAFFOLD_CAPABILITIES = ["commands", "hooks", "search", "importers"];
+const SCAFFOLD_MANIFEST_CAPABILITIES = {
+    commands: ["commands"],
+    hooks: ["commands", "hooks"],
+    search: ["commands", "search"],
+    importers: ["commands", "schema", "importers"],
+};
+const SAMPLE_TEST_CAPABILITIES_LITERAL = {
+    commands: '["commands"]',
+    hooks: '["commands", "hooks"]',
+    search: '["commands", "search"]',
+    importers: '["commands", "schema", "importers"]',
+};
+const ENTRYPOINT_BULLETS = {
+    commands: "- `index.js`: starter command registration plus a `deactivate` teardown stub.",
+    hooks: "- `index.js`: starter command registration, an `after_command` lifecycle hook, and a `deactivate` teardown stub.",
+    search: "- `index.js`: starter command registration, a search provider, a vector-store adapter, and a `deactivate` teardown stub.",
+    importers: "- `index.js`: starter command registration, importer/exporter command registrations, and a `deactivate` teardown stub.",
+};
+const SAMPLE_TEST_BULLETS = {
+    commands: "- `index.test.js`: sample `node:test` suite covering activation, command invocation, and teardown via the SDK testing helpers.",
+    hooks: "- `index.test.js`: sample `node:test` suite covering activation, command invocation, the after_command hook, and teardown via the SDK testing helpers.",
+    search: "- `index.test.js`: sample `node:test` suite covering activation, command invocation, search provider/vector adapter invocation, and teardown via the SDK testing helpers.",
+    importers: "- `index.test.js`: sample `node:test` suite covering activation, command invocation, importer/exporter invocation, and teardown via the SDK testing helpers.",
+};
+const PACKAGE_CAPABILITY_README_SECTIONS = {
+    commands: [],
+    hooks: [
+        "",
+        "## Lifecycle Hook",
+        "`index.js` registers an `after_command` hook via `api.hooks.afterCommand`.",
+        "pm fires it once a command finishes, passing the command outcome and the",
+        "items it mutated (`context.affected`). React there to keep external context",
+        "in sync - sync records, emit telemetry, or refresh derived state. The",
+        "`hooks` capability in `manifest.json` is what grants the hook registration;",
+        "remove it (and the hook) if your package only needs commands.",
+    ],
+    search: [
+        "",
+        "## Search Provider",
+        "`index.js` registers a deterministic in-memory search provider and",
+        "vector-store adapter through `api.registerSearchProvider` and",
+        "`api.registerVectorStoreAdapter`. Replace the sample scoring,",
+        "embedding, and storage behavior with your project-specific retrieval",
+        "logic. The `search` capability in `manifest.json` grants both",
+        "registrations.",
+    ],
+    importers: [
+        "",
+        "## Importer and Exporter",
+        "`index.js` registers paired project-context import/export commands through",
+        "`api.registerImporter` and `api.registerExporter`. Replace the starter",
+        "payloads with your domain adapter: GitHub issues, CSV rows, documents,",
+        "tickets, or another project-management source of truth. The `importers`",
+        "capability grants both registrations, and `schema` grants the example",
+        "command flag metadata.",
+    ],
+};
+const EXTENSION_CAPABILITY_README_SECTIONS = {
+    commands: [],
+    hooks: [
+        "",
+        "## Lifecycle Hook",
+        "`index.js` registers an `after_command` hook via `api.hooks.afterCommand`.",
+        "pm fires it once a command finishes, passing the command outcome and the",
+        "items it mutated (`context.affected`). React there to keep external context",
+        "in sync. The `hooks` capability in `manifest.json` grants the registration;",
+        "remove it (and the hook) if your extension only needs commands.",
+    ],
+    search: [
+        "",
+        "## Search Provider",
+        "`index.js` registers a deterministic in-memory search provider and",
+        "vector-store adapter through `api.registerSearchProvider` and",
+        "`api.registerVectorStoreAdapter`. Replace the sample scoring, embedding,",
+        "and storage behavior with your project-specific retrieval logic. The",
+        "`search` capability in `manifest.json` grants both registrations.",
+    ],
+    importers: [
+        "",
+        "## Importer and Exporter",
+        "`index.js` registers paired project-context import/export commands through",
+        "`api.registerImporter` and `api.registerExporter`. Replace the starter",
+        "payloads with your domain adapter. The `importers` capability grants both",
+        "registrations, and `schema` grants the example command flag metadata.",
+    ],
+};
+/**
+ * Build the `activate` body lines for the starter entrypoint. The base body
+ * always registers the starter command; capability-specific variants append
+ * the matching SDK surface so generated packages demonstrate one runnable
+ * customization primitive end to end.
+ */
+function buildActivateBodyLines(extensionName, commandName, capability) {
+    const searchProviderName = `${extensionName}-search`;
+    const vectorAdapterName = `${extensionName}-vector`;
+    const adapterName = `${extensionName.replace(/-/g, " ")} items`;
+    const commandLines = [
+        "  api.registerCommand({",
+        `    name: ${JSON.stringify(commandName)},`,
+        '    description: "Starter scaffold command. Replace with your own behavior.",',
+        "    run: async (context) => ({",
+        "      ok: true,",
+        `      source: ${JSON.stringify(extensionName)},`,
+        "      command: context.command,",
+        '      message: "Starter extension scaffold is active.",',
+        "    }),",
+        "  });",
+    ];
+    if (capability === "commands") {
+        return commandLines;
+    }
+    if (capability === "search") {
+        return [
+            ...commandLines,
+            "",
+            "  // Search providers let packages customize how pm ranks and retrieves",
+            "  // project context. This starter is deterministic and dependency-free:",
+            "  // replace the scoring with your domain retrieval, embedding, or rerank",
+            "  // logic as the package grows.",
+            "  api.registerSearchProvider({",
+            `    name: ${JSON.stringify(searchProviderName)},`,
+            "    query: async (context) => {",
+            "      const needle = context.query.toLowerCase();",
+            "      const hits = context.documents",
+            "        .filter((document) => {",
+            "          const title = String(document.metadata.title ?? \"\").toLowerCase();",
+            "          return title.includes(needle);",
+            "        })",
+            "        .map((document) => ({",
+            "          id: document.metadata.id,",
+            "          score: 1,",
+            '          matched_fields: ["title"],',
+            "        }));",
+            "      return { hits };",
+            "    },",
+            "    embed: async (context) => [context.input.length],",
+            "  });",
+            "",
+            "  // Vector-store adapters let packages own semantic index storage. This",
+            "  // starter returns a stable in-memory hit so generated tests can exercise",
+            "  // the adapter without external services.",
+            "  api.registerVectorStoreAdapter({",
+            `    name: ${JSON.stringify(vectorAdapterName)},`,
+            "    query: async (context) => [{ id: \"starter-vector-hit\", score: context.limit }],",
+            "    upsert: async (context) => ({ upserted: context.points.length }),",
+            "    delete: async (context) => ({ deleted: context.ids.length }),",
+            "  });",
+        ];
+    }
+    if (capability === "importers") {
+        return [
+            ...commandLines,
+            "",
+            "  // Importers/exporters are the bridge between pm's context graph and",
+            "  // another project-management system. Keep the starter deterministic so",
+            "  // package tests can run without touching the network or filesystem; replace",
+            "  // these payloads with your adapter's real mapping as the package grows.",
+            "  api.registerImporter(",
+            `    ${JSON.stringify(adapterName)},`,
+            "    async (context) => ({",
+            "      imported: 1,",
+            "      source: context.options.source ?? \"starter\",",
+            "      args: context.args,",
+            "    }),",
+            "    {",
+            `      action: ${JSON.stringify(`${adapterName} import`)},`,
+            '      description: "Import starter records into pm context.",',
+            "      flags: [",
+            "        {",
+            '          long: "--source",',
+            '          value_name: "name",',
+            '          value_type: "string",',
+            '          description: "Source name or path to import from.",',
+            "        },",
+            "      ],",
+            "    },",
+            "  );",
+            "",
+            "  api.registerExporter(",
+            `    ${JSON.stringify(adapterName)},`,
+            "    async (context) => ({",
+            "      exported: true,",
+            "      destination: context.options.destination ?? \"stdout\",",
+            "      args: context.args,",
+            "    }),",
+            "    {",
+            `      action: ${JSON.stringify(`${adapterName} export`)},`,
+            '      description: "Export pm context into starter records.",',
+            "      flags: [",
+            "        {",
+            '          long: "--destination",',
+            '          value_name: "name",',
+            '          value_type: "string",',
+            '          description: "Destination name or path to export to.",',
+            "        },",
+            "      ],",
+            "    },",
+            "  );",
+        ];
+    }
+    return [
+        ...commandLines,
+        "",
+        "  // after_command hooks fire once pm finishes a command, receiving the items",
+        "  // it mutated. This is the natural place to react to every change - sync to",
+        "  // an external system, emit telemetry, or refresh derived context",
+        '  // ("project management = context management"). This starter is a documented',
+        "  // no-op on the success path; replace the body with your own reaction.",
+        "  api.hooks.afterCommand((context) => {",
+        "    if (!context.ok) {",
+        "      return;",
+        "    }",
+        "    // `context.affected` lists the items pm mutated (id, status,",
+        "    // changed_fields). React here, e.g.:",
+        "    //   for (const item of context.affected ?? []) { /* ...item.id... */ }",
+        "  });",
+    ];
+}
+/**
+ * Build the colocated `node:test` sample suite for the chosen capability. Every
+ * variant covers activation, command invocation, and teardown via the SDK
+ * testing helpers; the `hooks` variant adds a test that asserts the
+ * `after_command` hook is registered and fires cleanly through the public SDK
+ * testing helper `runRegisteredHookForTest`.
+ */
+function buildSampleTestSource(extensionName, commandName, capability) {
+    const hooksEnabled = capability === "hooks";
+    const searchEnabled = capability === "search";
+    const importersEnabled = capability === "importers";
+    const capabilitiesLiteral = SAMPLE_TEST_CAPABILITIES_LITERAL[capability];
+    const searchProviderName = `${extensionName}-search`;
+    const vectorAdapterName = `${extensionName}-vector`;
+    const adapterName = `${extensionName.replace(/-/g, " ")} items`;
+    const importNames = [
+        "  activateExtensionForTest,",
+        "  assertExtensionDeactivated,",
+        "  assertRegisteredCommandContract,",
+        ...(hooksEnabled ? ["  assertRegisteredHook,"] : []),
+        ...(searchEnabled ? ["  assertRegisteredSearchProvider,", "  assertRegisteredVectorStoreAdapter,"] : []),
+        ...(importersEnabled ? ["  assertRegisteredImporter,", "  assertRegisteredExporter,"] : []),
+        "  deactivateExtensionForTest,",
+        "  runRegisteredCommandForTest,",
+        ...(hooksEnabled ? ["  runRegisteredHookForTest,"] : []),
+        ...(searchEnabled ? ["  runRegisteredSearchProviderForTest,", "  runRegisteredVectorStoreAdapterForTest,"] : []),
+        ...(importersEnabled ? ["  runRegisteredImporterForTest,", "  runRegisteredExporterForTest,"] : []),
+    ];
+    const hookTestLines = hooksEnabled
+        ? [
+            `test(${JSON.stringify(`${extensionName} reacts to commands via its after_command hook`)}, async () => {`,
+            "  const activation = await activateExtensionForTest(extension, {",
+            `    name: ${JSON.stringify(extensionName)},`,
+            `    capabilities: ${capabilitiesLiteral},`,
+            "  });",
+            "  // assertRegisteredHook throws unless an after_command hook is registered,",
+            "  // so reaching the next line already proves the hook is wired.",
+            "  assertRegisteredHook(activation.hooks, {",
+            '    kind: "after_command",',
+            `    extensionName: ${JSON.stringify(extensionName)},`,
+            "  });",
+            "  // runRegisteredHookForTest fires the hook through pm's real runner with a",
+            "  // synthetic context and returns the warnings it produced; a clean hook",
+            "  // returns none. Replace the context/assertions as your hook grows.",
+            "  const warnings = await runRegisteredHookForTest(activation.hooks, {",
+            '    kind: "after_command",',
+            "    context: {",
+            `      command: ${JSON.stringify(commandName)},`,
+            "      args: [],",
+            '      pm_root: "",',
+            "      ok: true,",
+            "      affected: [],",
+            "    },",
+            "  });",
+            "  assert.deepEqual(warnings, []);",
+            "});",
+            "",
+        ]
+        : [];
+    const searchTestLines = searchEnabled
+        ? [
+            `test(${JSON.stringify(`${extensionName} registers and invokes search primitives`)}, async () => {`,
+            "  const activation = await activateExtensionForTest(extension, {",
+            `    name: ${JSON.stringify(extensionName)},`,
+            `    capabilities: ${capabilitiesLiteral},`,
+            "  });",
+            "  assertRegisteredSearchProvider(activation.registrations, {",
+            `    provider: ${JSON.stringify(searchProviderName)},`,
+            `    extensionName: ${JSON.stringify(extensionName)},`,
+            "  });",
+            "  assertRegisteredVectorStoreAdapter(activation.registrations, {",
+            `    adapter: ${JSON.stringify(vectorAdapterName)},`,
+            `    extensionName: ${JSON.stringify(extensionName)},`,
+            "  });",
+            "",
+            "  const query = await runRegisteredSearchProviderForTest(activation.registrations, {",
+            `    provider: ${JSON.stringify(searchProviderName)},`,
+            '    operation: "query",',
+            "    context: {",
+            '      query: "sync",',
+            '      mode: "semantic",',
+            '      tokens: ["sync"],',
+            "      options: {},",
+            "      settings: {},",
+            "      documents: [",
+            '        { metadata: { id: "pm-1", title: "Sync external context" }, body: "" },',
+            '        { metadata: { id: "pm-2", title: "Unrelated task" }, body: "" },',
+            "      ],",
+            "    },",
+            "  });",
+            '  assert.deepEqual(query, { hits: [{ id: "pm-1", score: 1, matched_fields: ["title"] }] });',
+            "",
+            "  const embedding = await runRegisteredSearchProviderForTest(activation.registrations, {",
+            `    provider: ${JSON.stringify(searchProviderName)},`,
+            '    operation: "embed",',
+            '    context: { input: "abc", settings: {}, model: "starter-model" },',
+            "  });",
+            "  assert.deepEqual(embedding, [3]);",
+            "",
+            "  const vectorHits = await runRegisteredVectorStoreAdapterForTest(activation.registrations, {",
+            `    adapter: ${JSON.stringify(vectorAdapterName)},`,
+            '    operation: "query",',
+            "    context: { vector: [0.1, 0.2], limit: 2, settings: {} },",
+            "  });",
+            '  assert.deepEqual(vectorHits, [{ id: "starter-vector-hit", score: 2 }]);',
+            "});",
+            "",
+        ]
+        : [];
+    const importerTestLines = importersEnabled
+        ? [
+            `test(${JSON.stringify(`${extensionName} registers and invokes import/export primitives`)}, async () => {`,
+            "  const activation = await activateExtensionForTest(extension, {",
+            `    name: ${JSON.stringify(extensionName)},`,
+            `    capabilities: ${capabilitiesLiteral},`,
+            "  });",
+            "  assertRegisteredImporter(activation.registrations, {",
+            `    importer: ${JSON.stringify(adapterName)},`,
+            `    extensionName: ${JSON.stringify(extensionName)},`,
+            "  });",
+            "  assertRegisteredExporter(activation.registrations, {",
+            `    exporter: ${JSON.stringify(adapterName)},`,
+            `    extensionName: ${JSON.stringify(extensionName)},`,
+            "  });",
+            "",
+            "  const imported = await runRegisteredImporterForTest(activation, {",
+            `    importer: ${JSON.stringify(adapterName)},`,
+            '    options: { source: "tickets" },',
+            '    args: ["batch-1"],',
+            "  });",
+            "  assert.equal(imported.handled, true);",
+            '  assert.deepEqual(imported.result, { imported: 1, source: "tickets", args: ["batch-1"] });',
+            "",
+            "  const exported = await runRegisteredExporterForTest(activation, {",
+            `    exporter: ${JSON.stringify(adapterName)},`,
+            '    options: { destination: "archive" },',
+            '    args: ["done"],',
+            "  });",
+            "  assert.equal(exported.handled, true);",
+            '  assert.deepEqual(exported.result, { exported: true, destination: "archive", args: ["done"] });',
+            "});",
+            "",
+        ]
+        : [];
+    return [
+        'import assert from "node:assert/strict";',
+        'import { test } from "node:test";',
+        "import {",
+        ...importNames,
+        '} from "@unbrained/pm-cli/sdk/testing";',
+        'import extension from "./index.js";',
+        "",
+        `test(${JSON.stringify(`${extensionName} registers its starter command`)}, async () => {`,
+        "  // `capabilities` mirrors manifest.json so the in-memory activation grants",
+        "  // the capabilities the entrypoint relies on.",
+        "  const activation = await activateExtensionForTest(extension, {",
+        `    name: ${JSON.stringify(extensionName)},`,
+        `    capabilities: ${capabilitiesLiteral},`,
+        "  });",
+        "  // assertRegisteredCommandContract throws if the command is not",
+        "  // registered, so reaching here already proves the wiring; assert on the",
+        "  // returned definition to demonstrate inspecting registered metadata.",
+        "  const registered = assertRegisteredCommandContract(activation.registrations, {",
+        `    command: ${JSON.stringify(commandName)},`,
+        `    extensionName: ${JSON.stringify(extensionName)},`,
+        "  });",
+        '  assert.equal(typeof registered.command.description, "string");',
+        "",
+        "  // runRegisteredCommandForTest invokes the handler through pm's real",
+        "  // dispatch engine, so this asserts behavior - not just that the command",
+        "  // is wired. Replace these assertions as you flesh out your command.",
+        "  const invocation = await runRegisteredCommandForTest(activation.commands, {",
+        `    command: ${JSON.stringify(commandName)},`,
+        "  });",
+        "  assert.equal(invocation.handled, true);",
+        "  assert.equal(invocation.result.ok, true);",
+        `  assert.equal(invocation.result.command, ${JSON.stringify(commandName)});`,
+        "});",
+        "",
+        ...hookTestLines,
+        ...searchTestLines,
+        ...importerTestLines,
+        `test(${JSON.stringify(`${extensionName} tears down cleanly via deactivate`)}, async () => {`,
+        "  // deactivateExtensionForTest runs pm's real teardown engine over the",
+        "  // module, so this proves your `deactivate` hook runs without throwing.",
+        "  const teardown = await deactivateExtensionForTest(extension, {",
+        `    name: ${JSON.stringify(extensionName)},`,
+        "  });",
+        "  // assertExtensionDeactivated throws unless exactly one extension tore down",
+        "  // with no failures, so reaching the next line already proves teardown ran.",
+        "  assertExtensionDeactivated(teardown);",
+        "  assert.equal(teardown.deactivated, 1);",
+        "});",
+        "",
+    ].join("\n");
+}
 /**
  * Implements build starter extension scaffold files for the public runtime surface of this module.
  */
-export function buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary) {
+export function buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary, capability = "commands") {
     const packageName = `pm-${extensionName}`;
+    const capabilities = SCAFFOLD_MANIFEST_CAPABILITIES[capability];
     const manifest = `${JSON.stringify({
         name: extensionName,
         version: "0.1.0",
         entry: "./index.js",
-        capabilities: ["commands"],
         manifest_version: SCAFFOLD_MANIFEST_VERSION,
         pm_min_version: SCAFFOLD_PM_MIN_VERSION,
+        trusted: true,
+        sandbox_profile: "strict",
+        permissions: { ...SCAFFOLD_DECLARED_PERMISSIONS },
+        capabilities,
     }, null, 2)}\n`;
     // Keep scaffolds dependency-light by default: even package mode can be
     // installed before peer dependencies are materialized in the generated root.
@@ -37,23 +472,24 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
     const entrypoint = [
         '/** @param {import("@unbrained/pm-cli/sdk").ExtensionApi} api */',
         "export function activate(api) {",
-        "  api.registerCommand({",
-        `    name: ${JSON.stringify(commandName)},`,
-        '    description: "Starter scaffold command. Replace with your own behavior.",',
-        "    run: async (context) => ({",
-        "      ok: true,",
-        `      source: ${JSON.stringify(extensionName)},`,
-        "      command: context.command,",
-        '      message: "Starter extension scaffold is active.",',
-        "    }),",
-        "  });",
+        ...buildActivateBodyLines(extensionName, commandName, capability),
         "}",
         "",
+        "// `deactivate` is the teardown counterpart to `activate`: pm runs it on host",
+        "// shutdown/reload (e.g. the MCP server between requests) to release anything",
+        "// `activate` opened - timers, connections, caches. This starter holds no such",
+        "// resources, so it stays a documented no-op; add cleanup here as you grow.",
+        "export function deactivate() {}",
+        "",
         "export default {",
         "  activate,",
+        "  deactivate,",
         "};",
         "",
     ].join("\n");
+    // README bullet describing what index.js wires, kept in sync with the chosen
+    // capability so the generated docs match the generated code.
+    const entrypointBullet = ENTRYPOINT_BULLETS[capability];
     if (vocabulary === "package") {
         const packageJson = `${JSON.stringify({
             name: packageName,
@@ -82,33 +518,12 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
                 },
             },
         }, null, 2)}\n`;
-        // node:test sample: demonstrates validating command registration with the
-        // SDK testing helpers without adding a third-party test runner. Uses the
-        // package's own `commands` capability scaffold as the unit under test.
-        const sampleTest = [
-            'import assert from "node:assert/strict";',
-            'import { test } from "node:test";',
-            'import { activateExtensionForTest, assertRegisteredCommandContract } from "@unbrained/pm-cli/sdk/testing";',
-            'import extension from "./index.js";',
-            "",
-            `test(${JSON.stringify(`${extensionName} registers its starter command`)}, async () => {`,
-            "  // `capabilities` mirrors manifest.json so the in-memory activation grants",
-            "  // the `commands` capability the entrypoint relies on.",
-            "  const activation = await activateExtensionForTest(extension, {",
-            `    name: ${JSON.stringify(extensionName)},`,
-            '    capabilities: ["commands"],',
-            "  });",
-            "  // assertRegisteredCommandContract throws if the command is not",
-            "  // registered, so reaching here already proves the wiring; assert on the",
-            "  // returned definition to demonstrate inspecting registered metadata.",
-            "  const registered = assertRegisteredCommandContract(activation.registrations, {",
-            `    command: ${JSON.stringify(commandName)},`,
-            `    extensionName: ${JSON.stringify(extensionName)},`,
-            "  });",
-            '  assert.equal(typeof registered.command.description, "string");',
-            "});",
-            "",
-        ].join("\n");
+        // node:test sample: demonstrates validating the package with the SDK testing
+        // helpers without adding a third-party test runner. The suite covers the
+        // capability the scaffold targets (command invocation, and for the hooks
+        // capability, the after_command lifecycle hook).
+        const sampleTest = buildSampleTestSource(extensionName, commandName, capability);
+        const sampleTestBullet = SAMPLE_TEST_BULLETS[capability];
         const gitignore = ["node_modules/", "*.log", ""].join("\n");
         const packageReadme = [
             `# ${packageName}`,
@@ -118,8 +533,8 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
             "## Included Files",
             "- `package.json`: package metadata, `test` script, and `pm` resource manifest.",
             "- `manifest.json`: extension metadata and capabilities.",
-            "- `index.js`: starter command registration using the `commands` capability.",
-            "- `index.test.js`: sample `node:test` suite using the SDK testing helpers.",
+            entrypointBullet,
+            sampleTestBullet,
             "- `.gitignore`: ignores `node_modules/` and log files.",
             "",
             "## Quick Start",
@@ -136,7 +551,8 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
             "npm test",
             "```",
             "`npm test` runs `node --test`, which executes `index.test.js` against the",
-            "`@unbrained/pm-cli/sdk/testing` helpers — no extra test runner required.",
+            "`@unbrained/pm-cli/sdk/testing` helpers - no extra test runner required.",
+            ...PACKAGE_CAPABILITY_README_SECTIONS[capability],
             "",
             "## Compatibility Bounds",
             "`manifest.json` cannot hold comments, so the version-compatibility fields are documented here:",
@@ -144,6 +560,9 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
             `- \`pm_min_version\` (string): lowest pm CLI version that may load this package. Scaffolded as \`${SCAFFOLD_PM_MIN_VERSION}\`. The loader blocks the package on older CLIs.`,
             "- `pm_max_version` (string, optional): highest pm CLI version that may load this package. Add it to block CLIs that are newer than the version you have validated against. The loader blocks the package when the CLI exceeds this bound.",
             "",
+            "## Policy Metadata",
+            "The starter command is pure compute, so `manifest.json` declares `trusted: true`, `sandbox_profile: \"strict\"`, and all six permission keys as `false`. Keep that least-privilege shape for pure packages; relax only the specific permission your package actually needs and verify with `pm package doctor --project --detail deep --trace`.",
+            "",
             "## Notes",
             "- Keep simple starter runtime behavior at the package root so local installs work without dependency bootstrapping.",
             "- Move larger runtimes into subdirectories only after adding package dependencies and validating `pm package doctor`.",
@@ -167,7 +586,7 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
         "",
         "## Included Files",
         "- `manifest.json`: extension metadata and capabilities.",
-        "- `index.js`: starter command registration using the `commands` capability.",
+        entrypointBullet,
         "",
         "## Quick Start",
         "```bash",
@@ -175,6 +594,7 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
         `pm ${commandName}`,
         "pm extension --doctor --project --detail summary",
         "```",
+        ...EXTENSION_CAPABILITY_README_SECTIONS[capability],
         "",
         "## Compatibility Bounds",
         "`manifest.json` cannot hold comments, so the version-compatibility fields are documented here:",
@@ -182,9 +602,13 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
         `- \`pm_min_version\` (string): lowest pm CLI version that may load this extension. Scaffolded as \`${SCAFFOLD_PM_MIN_VERSION}\`. The loader blocks the extension on older CLIs.`,
         "- `pm_max_version` (string, optional): highest pm CLI version that may load this extension. Add it to block CLIs that are newer than the version you have validated against. The loader blocks the extension when the CLI exceeds this bound.",
         "",
+        "## Policy Metadata",
+        "The starter command is pure compute, so `manifest.json` declares `trusted: true`, `sandbox_profile: \"strict\"`, and all six permission keys as `false`. Keep that least-privilege shape for pure extensions; relax only the specific permission your extension actually needs and verify with `pm extension --doctor --project --detail deep --trace`.",
+        "",
         "## Notes",
         "- This scaffold uses ESM exports so it works in package scopes with `type: module`.",
         "- Update `manifest.json` capabilities and `index.js` command behavior as your extension evolves.",
+        "- Release any resources `activate` opens (timers, connections, caches) in the `deactivate` teardown hook.",
         "",
     ].join("\n");
     return {
@@ -196,12 +620,20 @@ export function buildStarterExtensionScaffoldFiles(extensionName, commandName, v
 /**
  * Implements scaffold extension project for the public runtime surface of this module.
  */
-export async function scaffoldExtensionProject(target, vocabulary = "extension") {
+export async function scaffoldExtensionProject(target, vocabulary = "extension", capability = "commands") {
+    const normalizedCapability = capability.trim().toLowerCase();
+    if (!SCAFFOLD_CAPABILITIES.includes(normalizedCapability)) {
+        throw new PmCliError(`Unknown scaffold capability "${capability}". Supported capabilities: ${SCAFFOLD_CAPABILITIES.join(", ")}.`, EXIT_CODE.USAGE);
+    }
+    const resolvedCapability = normalizedCapability;
     const normalizedTarget = target.trim();
     const targetPath = path.resolve(process.cwd(), normalizedTarget);
     const extensionName = normalizeManagedDirectoryName(path.basename(targetPath));
-    const commandName = `${extensionName} ping`;
-    const scaffoldFiles = buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary);
+    // Hyphenated top-level command groups can surface in help but fail dispatch in
+    // Commander, so generated starters use space-separated command words while the
+    // manifest and package identity keep their normalized directory names.
+    const commandName = `${extensionName.replace(/-/g, " ")} ping`;
+    const scaffoldFiles = buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary, resolvedCapability);
     let createdDirectory = false;
     if (await pathExists(targetPath)) {
         const existingTargetStats = await fs.stat(targetPath);
@@ -243,10 +675,11 @@ export async function scaffoldExtensionProject(target, vocabulary = "extension")
     return {
         extension_name: extensionName,
         command_name: commandName,
+        capability: resolvedCapability,
         target_path: targetPath,
         created_directory: createdDirectory,
         files,
     };
 }
 //# sourceMappingURL=scaffold.js.map
-//# debugId=3abac9c3-3fc0-575e-8f5d-d2624fe7a20c
+//# debugId=61e2eb79-305a-5636-b5ca-ab0c6aa4afcc