@vellumai/assistant 0.12.2-staging.1 → 0.12.2-staging.3

package/src/oauth/seed-providers.ts

@@ -90,6 +90,13 @@ export const PROVIDER_SEED_DATA: Record<
     }>;
     appType?: string;
     setupNotes?: string[];
+    /**
+     * Per-tenant providers only: the host the user supplies at connect time,
+     * which the platform substitutes into `{tenant_host}` URL placeholders.
+     * `pattern` mirrors the platform registry's validation so clients can
+     * reject a malformed host before the request leaves the browser.
+     */
+    tenantHost?: { pattern: string; label: string; placeholder: string };
     identityUrl?: string;
     identityMethod?: string;
     identityHeaders?: Record<string, string>;
@@ -1003,7 +1010,12 @@ export const PROVIDER_SEED_DATA: Record<
     // default, because Figma rejects the whole authorization request if the
     // app cannot grant a requested scope. `selections:read` is withheld for
     // that same reason: it is not offered in the app's OAuth scope list, so
-    // requesting it would fail the entire authorization.
+    // requesting it would fail the entire authorization. `folders:read` is
+    // withheld likewise: Figma documents it, but the app's scope picker only
+    // offers `folder_metadata:read` under Folders. `file_code_connect:write`
+    // is withheld because Figma only offers it to apps owned by an
+    // Organization-plan team, which not every managed app is, and nothing
+    // here uses Code Connect; it stays in availableScopes for BYO apps.
     defaultScopes: [
       "current_user:read",
       "file_content:read",
@@ -1013,7 +1025,6 @@ export const PROVIDER_SEED_DATA: Record<
       "file_comments:write",
       "file_dev_resources:read",
       "file_dev_resources:write",
-      "folders:read",
       "folder_metadata:read",
       "library_content:read",
       "library_assets:read",
@@ -1053,6 +1064,10 @@ export const PROVIDER_SEED_DATA: Record<
         scope: "file_dev_resources:write",
         description: "Write dev resources to files",
       },
+      {
+        scope: "file_code_connect:write",
+        description: "Write and change component code (Code Connect)",
+      },
       {
         scope: "folders:read",
         description: "List folders and files in folders",
@@ -1388,6 +1403,12 @@ export const PROVIDER_SEED_DATA: Record<
       "read_discounts",
       "write_discounts",
       "read_price_rules",
+      // write_themes covers listing, duplicating, and publishing themes.
+      // Writing theme files (settings, JSON templates, Liquid) also requires
+      // Shopify's theme-code exemption on the app itself, which is granted
+      // per app in the Shopify dashboard rather than through a scope.
+      "read_themes",
+      "write_themes",
     ],
     availableScopes: [
       {
@@ -1440,6 +1461,11 @@ export const PROVIDER_SEED_DATA: Record<
         scope: "write_price_rules",
         description: "Create and update price rules",
       },
+      { scope: "read_themes", description: "Read themes and theme files" },
+      {
+        scope: "write_themes",
+        description: "Create, publish, and edit themes and theme files",
+      },
       { scope: "read_files", description: "Read files uploaded to the store" },
       { scope: "write_files", description: "Upload and update files" },
       { scope: "read_gift_cards", description: "Read gift cards" },
@@ -1485,6 +1511,12 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     loopbackPort: 17341,
     managedServiceConfigKey: "shopify-oauth",
+    // Mirrors `extra_config.tenant_host` in the platform provider registry.
+    tenantHost: {
+      pattern: "^[a-z0-9][a-z0-9-]*\\.myshopify\\.com$",
+      label: "Shop domain",
+      placeholder: "your-store.myshopify.com",
+    },
     injectionTemplates: [
       {
         hostPattern: "*.myshopify.com",
@@ -1508,6 +1540,93 @@ export const PROVIDER_SEED_DATA: Record<
     // cannot complete.
     featureFlag: "shopify-oauth",
   },
+
+  quickbooks: {
+    provider: "quickbooks",
+    authorizeUrl: "https://appcenter.intuit.com/connect/oauth2",
+    tokenExchangeUrl:
+      "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
+    // Access tokens live an hour; refresh tokens 100 days and are rotated on
+    // every refresh, which the platform persists. Both token endpoints
+    // authenticate the client with HTTP Basic.
+    refreshUrl: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
+    tokenEndpointAuthMethod: "client_secret_basic",
+    // No revokeUrl: Intuit's revocation endpoint wants a JSON body under HTTP
+    // Basic client auth, and the daemon's revoke helper only posts an
+    // unauthenticated form body, so a seeded URL would fail silently on every
+    // your-own disconnect. The platform registry revokes managed tokens itself.
+    // Every Accounting API path is scoped to the company (realm) the user
+    // picked on Intuit's consent screen. The realm arrives only as the
+    // callback's `realmId` query parameter; the platform captures it into the
+    // connection's `provider_params` and fills the `{realm_id}` placeholder
+    // server-side, so managed callers send paths relative to the company
+    // (`/query`, `/customer/123`). Production and sandbox keys use different
+    // hosts; the platform picks the host per environment.
+    baseUrl: "https://quickbooks.api.intuit.com/v3/company/{realm_id}",
+    // No pingUrl: the only company-independent probe would still need the
+    // realm in its path, which the ping route cannot fill in (it sends the
+    // URL's origin as a per-request base override, which would also pin a
+    // managed sandbox connection to the production host).
+    displayLabel: "QuickBooks",
+    description: "Invoices, customers, vendors, and accounting data",
+    dashboardUrl: "https://developer.intuit.com/app/developer/dashboard",
+    clientIdPlaceholder: null,
+    logoUrl: "https://cdn.simpleicons.org/quickbooks",
+    // The Accounting scope covers the QuickBooks Online API. Payments is a
+    // separate product the app must be enabled for, and the OpenID scopes
+    // only add the signing-in user's profile, so none are on by default.
+    defaultScopes: ["com.intuit.quickbooks.accounting"],
+    availableScopes: [
+      {
+        scope: "com.intuit.quickbooks.accounting",
+        description:
+          "Read and write QuickBooks Online accounting data: customers, vendors, invoices, bills, payments, items, accounts, and reports",
+      },
+      {
+        scope: "com.intuit.quickbooks.payment",
+        description:
+          "QuickBooks Payments: charges, refunds, bank accounts, and cards (requires a Payments-enabled app)",
+      },
+      { scope: "openid", description: "Sign in with Intuit (OpenID Connect)" },
+      { scope: "profile", description: "The signing-in user's name" },
+      { scope: "email", description: "The signing-in user's email address" },
+      { scope: "phone", description: "The signing-in user's phone number" },
+      { scope: "address", description: "The signing-in user's address" },
+    ],
+    loopbackPort: 17342,
+    managedServiceConfigKey: "quickbooks-oauth",
+    injectionTemplates: [
+      {
+        hostPattern: "quickbooks.api.intuit.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bearer ",
+      },
+      {
+        hostPattern: "sandbox-quickbooks.api.intuit.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bearer ",
+      },
+    ],
+    appType: "App",
+    setupNotes: [
+      "QuickBooks scopes every Accounting API call to the company (realm) chosen on Intuit's consent screen. Managed connections carry the realm as provider_params.realm_id and requests are sent relative to /v3/company/{realmId}.",
+      "Intuit development keys only authorize sandbox companies, which live on sandbox-quickbooks.api.intuit.com; production keys use quickbooks.api.intuit.com.",
+      "The Accounting API returns XML unless the request carries Accept: application/json.",
+    ],
+    // CompanyInfo does not repeat the realm (its Id is always "1"); the
+    // platform keys the connection on the captured realm and labels it with
+    // the company name.
+    identityUrl:
+      "https://quickbooks.api.intuit.com/v3/company/{realm_id}/companyinfo/{realm_id}",
+    identityHeaders: { Accept: "application/json" },
+    identityResponsePaths: ["CompanyInfo.CompanyName", "CompanyInfo.LegalName"],
+    // Gated like figma/shopify: the platform side lands separately, and until
+    // the client ids are live a visible tile would offer a connect flow that
+    // cannot complete.
+    featureFlag: "quickbooks-oauth",
+  },
 };
 
 export const SEEDED_PROVIDER_KEYS = new Set(Object.keys(PROVIDER_SEED_DATA));

package/src/onboarding/checkin-event.ts

@@ -69,7 +69,8 @@ export function buildCheckinTitle({
  * Google Calendar strips nearly all styling, so the body relies only on the
  * tags that survive (`<p>`, `<strong>`, `<a>`, emoji) and makes the CTA a bold
  * link rather than a styled button. The deep link opens a fresh conversation
- * (`uuid`) pre-seeded with the first-week prompt.
+ * (`uuid`) with the first-week prompt staged in the composer; the user sends
+ * it. A clicked link never auto-sends (`clients/web/src/utils/auto-send-prompt.ts`).
  */
 export function buildCheckinDescription(uuid: string): string {
   // `vref` is an app-owned attribution param, NOT a marketing `utm_*`: the

package/src/plugins/__tests__/installed-plugin-dirs.test.ts

@@ -45,10 +45,23 @@ beforeEach(() => {
 describe("listInstalledPluginDirs", () => {
   test("lists real plugin directories and skips dot entries", () => {
     makePluginDir(pluginsDir, "alpha");
+    const standard = join(pluginsDir, "standard");
+    mkdirSync(standard, { recursive: true });
+    writeFileSync(
+      join(standard, "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "standard",
+      }),
+    );
     makePluginDir(pluginsDir, ".hidden");
     mkdirSync(join(pluginsDir, "no-manifest"), { recursive: true });
 
-    expect(listInstalledPluginDirs().map((p) => p.name)).toEqual(["alpha"]);
+    expect(
+      listInstalledPluginDirs()
+        .map((p) => p.name)
+        .sort(),
+    ).toEqual(["alpha", "standard"]);
   });
 
   test("skips a symlinked plugin root that points outside the plugins dir", () => {

package/src/plugins/__tests__/mcp-servers.test.ts

@@ -24,17 +24,27 @@ import {
 function makePluginsDir(
   plugins: Record<
     string,
-    { mcpJson?: string; packageJson?: string; disabled?: boolean }
+    {
+      mcpJson?: string;
+      packageJson?: string | null;
+      pluginJson?: string;
+      disabled?: boolean;
+    }
   >,
 ): string {
   const root = mkdtempSync(join(tmpdir(), "vellum-plugin-mcp-"));
   for (const [name, spec] of Object.entries(plugins)) {
     const dir = join(root, name);
     mkdirSync(dir, { recursive: true });
-    writeFileSync(
-      join(dir, "package.json"),
-      spec.packageJson ?? JSON.stringify({ name, version: "1.0.0" }),
-    );
+    if (spec.packageJson !== null) {
+      writeFileSync(
+        join(dir, "package.json"),
+        spec.packageJson ?? JSON.stringify({ name, version: "1.0.0" }),
+      );
+    }
+    if (spec.pluginJson !== undefined) {
+      writeFileSync(join(dir, "plugin.json"), spec.pluginJson);
+    }
     if (spec.mcpJson !== undefined) {
       writeFileSync(join(dir, "mcp.json"), spec.mcpJson);
     }
@@ -137,6 +147,26 @@ describe("readPluginMcpServers", () => {
     });
   });
 
+  test("reads MCP servers from a standard-only plugin", () => {
+    const dir = makePluginsDir({
+      unabyss: {
+        packageJson: null,
+        pluginJson: JSON.stringify({
+          $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+          name: "unabyss",
+        }),
+        mcpJson: VALID_MANIFEST,
+      },
+    });
+
+    const { servers, issues } = readPluginMcpServers({
+      workspacePluginsDir: dir,
+    });
+
+    expect(issues).toEqual([]);
+    expect(servers.map((server) => server.id)).toEqual(["unabyss"]);
+  });
+
   test("defaults an omitted type to streamable-http", () => {
     const dir = makePluginsDir({
       openseo: {
@@ -205,7 +235,7 @@ describe("readPluginMcpServers", () => {
       workspacePluginsDir: root,
     });
     expect(servers).toEqual([]);
-    expect(issues[0].message).toContain("package.json");
+    expect(issues[0].message).toContain("selected plugin manifest");
   });
 
   test("ignores a directory whose package.json is unparseable", () => {
@@ -216,7 +246,7 @@ describe("readPluginMcpServers", () => {
       workspacePluginsDir: dir,
     });
     expect(servers).toEqual([]);
-    expect(issues[0].message).toContain("package.json");
+    expect(issues[0].message).toContain("selected plugin manifest");
   });
 
   test("ignores a directory whose package.json has no name", () => {
@@ -230,7 +260,7 @@ describe("readPluginMcpServers", () => {
       workspacePluginsDir: dir,
     });
     expect(servers).toEqual([]);
-    expect(issues[0].message).toContain("package.json");
+    expect(issues[0].message).toContain("selected plugin manifest");
   });
 
   test("skips plugins with no mcp.json without complaining", () => {

package/src/plugins/external-plugin-loader.ts

@@ -10,12 +10,12 @@
  * need to be renamed when the convention shifts.
  *
  *     <pluginDir>/
- *       package.json              ← manifest.name comes from `name`
- *                                   (npm scope stripped);
+ *       package.json              ← legacy Vellum manifest, selected first;
  *                                   peerDependencies["@vellumai/plugin-api"]
  *                                   semver range is checked against the
  *                                   running assistant version and rejects
  *                                   the plugin if unsatisfied
+ *       plugin.json               ← standard fallback when package.json is absent
  *       hooks/
  *         <name>.ts               ← default export → plugin.hooks[<name>]
  *                                   (today the runtime invokes "init" at
@@ -41,7 +41,6 @@
  */
 
 import { existsSync, readdirSync, statSync } from "node:fs";
-import { readFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { pathToFileURL } from "node:url";
 
@@ -53,6 +52,10 @@ import { PLUGIN_SECRET_PATTERN_LIMITS } from "../security/plugin-secret-patterns
 import { finalizeTool } from "../tools/tool-defaults.js";
 import type { Tool, ToolDefinition } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
+import {
+  LEGACY_PLUGIN_MANIFEST,
+  readPluginManifest,
+} from "../util/plugin-manifest.js";
 import { registerPlugin } from "./registry.js";
 import type {
   HookFunction,
@@ -69,39 +72,12 @@ const log = getLogger("external-plugin-loader");
 /** Default upper bound on how long a single plugin load may take. */
 const DEFAULT_IMPORT_TIMEOUT_MS = 10_000;
 
-/**
- * Zod schema for the subset of `package.json` the external loader reads.
- *
- * - `name` is the only required field; everything else is best-effort.
- * - `peerDependencies["@vellumai/plugin-api"]` is the canonical host-compat
- *   declaration. If present, the loader checks `semver.satisfies(host, range)`
- *   against the running assistant version and rejects the plugin on
- *   mismatch. If absent, the plugin loads without a host-compat claim
- *   (with a warning).
- * - `credentialKeyPatterns` is typed `unknown` here and shape-validated
- *   separately ({@link parseCredentialKeyPatterns}) so a malformed
- *   declaration degrades to `undefined` instead of failing the whole
- *   `safeParse` and blocking plugin load.
- * - Unknown fields pass through (`passthrough`) so the loader does not
- *   destructively reshape the file when the rest of the npm ecosystem
- *   writes to it.
- */
-const PluginPackageJsonSchema = z
-  .object({
-    name: z.string().min(1, "package.json `name` must be a non-empty string"),
-    version: z.string().optional(),
-    peerDependencies: z.record(z.string(), z.string()).optional(),
-    credentialKeyPatterns: z.unknown().optional(),
-    /** Human title, when the package name is not one ("@vellumai/imessage"). */
-    displayName: z.string().min(1).optional(),
-    /** Standard npm field, reused as the one-line description clients show. */
-    description: z.string().min(1).optional(),
-    /** Lucide icon name without the `lucide-` prefix, matching `ChannelInfo`. */
-    icon: z.string().min(1).optional(),
-  })
-  .passthrough();
-
-type PluginPackageJson = z.infer<typeof PluginPackageJsonSchema>;
+interface LegacyPluginFields extends Record<string, unknown> {
+  readonly peerDependencies?: Record<string, string>;
+  readonly credentialKeyPatterns?: unknown;
+  readonly displayName?: string;
+  readonly icon?: string;
+}
 
 /**
  * Shape-level caps for the `credentialKeyPatterns` manifest field. The
@@ -270,23 +246,8 @@ async function loadHooks(
  * timeout/try-catch/register triple.
  */
 async function buildPluginFromDir(pluginDir: string): Promise<Plugin> {
-  const pkgPath = join(pluginDir, "package.json");
-  let rawPkg: unknown;
-  try {
-    rawPkg = JSON.parse(await readFile(pkgPath, "utf8"));
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `package.json at ${pluginDir} could not be read or parsed: ${reason}`,
-    );
-  }
-  const parsed = PluginPackageJsonSchema.safeParse(rawPkg);
-  if (!parsed.success) {
-    throw new Error(
-      `package.json at ${pluginDir} failed schema validation: ${parsed.error.message}`,
-    );
-  }
-  const pkg: PluginPackageJson = parsed.data;
+  const resolvedManifest = readPluginManifest(pluginDir);
+  const legacyFields = resolvedManifest.raw as LegacyPluginFields;
   // A plugin's identity is its install directory name — the slug the plugin
   // was installed under (a marketplace slug or a GitHub path leaf). This is
   // the identity every other surface uses: `plugins list`, enable/disable,
@@ -296,7 +257,10 @@ async function buildPluginFromDir(pluginDir: string): Promise<Plugin> {
   // registry from the identity the user toggles and the scope filters match.
   // The manifest is still required (schema-validated above) as the load gate.
   const name = basename(pluginDir);
-  const version = pkg.version && pkg.version.length > 0 ? pkg.version : "0.0.0";
+  const version =
+    resolvedManifest.version && resolvedManifest.version.length > 0
+      ? resolvedManifest.version
+      : "0.0.0";
 
   // Host-compat negotiation: plugins declare their plugin-api version
   // range via standard `peerDependencies["@vellumai/plugin-api"]`. We
@@ -310,7 +274,7 @@ async function buildPluginFromDir(pluginDir: string): Promise<Plugin> {
   //
   // If the peerDep is absent, the plugin loads without a host-compat
   // claim; we log a warning so the omission is visible at boot.
-  const range = pkg.peerDependencies?.[PLUGIN_API_PEER_DEP];
+  const range = legacyFields.peerDependencies?.[PLUGIN_API_PEER_DEP];
   if (range !== undefined) {
     if (!semver.validRange(range)) {
       log.error(
@@ -333,7 +297,7 @@ async function buildPluginFromDir(pluginDir: string): Promise<Plugin> {
         `external plugin ${name}: peerDependencies["${PLUGIN_API_PEER_DEP}"] requires "${range}" but assistant is ${assistantPkg.version} — loading anyway`,
       );
     }
-  } else {
+  } else if (resolvedManifest.source === LEGACY_PLUGIN_MANIFEST) {
     log.warn(
       { pluginDir, plugin: name, peerDep: PLUGIN_API_PEER_DEP },
       "external plugin missing plugin-api peerDependency — loading without host-compat claim",
@@ -342,7 +306,9 @@ async function buildPluginFromDir(pluginDir: string): Promise<Plugin> {
 
   const manifest: PluginManifest = { name, version };
   const credentialKeyPatterns = parseCredentialKeyPatterns(
-    pkg.credentialKeyPatterns,
+    resolvedManifest.source === LEGACY_PLUGIN_MANIFEST
+      ? legacyFields.credentialKeyPatterns
+      : undefined,
     pluginDir,
   );
   if (credentialKeyPatterns !== undefined) {
@@ -459,9 +425,9 @@ export async function loadExternalPlugin(
 }
 
 /**
- * Parse a plugin's `package.json` manifest from disk. Returns the plugin
+ * Parse a plugin's selected manifest from disk. Returns the plugin
  * identity (its install directory name), version, and any declared
- * `credentialKeyPatterns`, or `undefined` when the `package.json` is
+ * legacy `credentialKeyPatterns`, or `undefined` when the manifest is
  * missing, unparseable, or fails schema validation.
  *
  * Exported so the mtime cache can discover plugin identity without going
@@ -497,20 +463,23 @@ export interface PluginPresentation {
 export async function parsePluginPresentation(
   pluginDir: string,
 ): Promise<PluginPresentation | undefined> {
-  let rawPkg: unknown;
   try {
-    rawPkg = JSON.parse(
-      await readFile(join(pluginDir, "package.json"), "utf8"),
-    );
+    const manifest = readPluginManifest(pluginDir);
+    const legacyFields = manifest.raw as LegacyPluginFields;
+    return {
+      displayName:
+        manifest.source === LEGACY_PLUGIN_MANIFEST
+          ? legacyFields.displayName
+          : manifest.name,
+      description: manifest.description,
+      icon:
+        manifest.source === LEGACY_PLUGIN_MANIFEST
+          ? legacyFields.icon
+          : undefined,
+    };
   } catch {
     return undefined;
   }
-  const parsed = PluginPackageJsonSchema.safeParse(rawPkg);
-  if (!parsed.success) {
-    return undefined;
-  }
-  const { displayName, description, icon } = parsed.data;
-  return { displayName, description, icon };
 }
 
 export async function parsePluginManifest(
@@ -519,35 +488,29 @@ export async function parsePluginManifest(
 ): Promise<
   Pick<PluginManifest, "name" | "version" | "credentialKeyPatterns"> | undefined
 > {
-  const pkgPath = join(pluginDir, "package.json");
-  let rawPkg: unknown;
+  let resolvedManifest: ReturnType<typeof readPluginManifest>;
   try {
-    rawPkg = JSON.parse(await readFile(pkgPath, "utf8"));
+    resolvedManifest = readPluginManifest(pluginDir);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     if (!opts.quiet) {
       log.error(
         { err, pluginDir },
-        `package.json at ${pluginDir} could not be read or parsed: ${reason}`,
-      );
-    }
-    return undefined;
-  }
-  const parsed = PluginPackageJsonSchema.safeParse(rawPkg);
-  if (!parsed.success) {
-    if (!opts.quiet) {
-      log.error(
-        { err: parsed.error, pluginDir },
-        `package.json at ${pluginDir} failed schema validation: ${parsed.error.message}`,
+        `Plugin manifest at ${pluginDir} could not be read or validated: ${reason}`,
       );
     }
     return undefined;
   }
-  const pkg: PluginPackageJson = parsed.data;
+  const legacyFields = resolvedManifest.raw as LegacyPluginFields;
   const name = basename(pluginDir);
-  const version = pkg.version && pkg.version.length > 0 ? pkg.version : "0.0.0";
+  const version =
+    resolvedManifest.version && resolvedManifest.version.length > 0
+      ? resolvedManifest.version
+      : "0.0.0";
   const credentialKeyPatterns = parseCredentialKeyPatterns(
-    pkg.credentialKeyPatterns,
+    resolvedManifest.source === LEGACY_PLUGIN_MANIFEST
+      ? legacyFields.credentialKeyPatterns
+      : undefined,
     pluginDir,
   );
   if (credentialKeyPatterns !== undefined) {

package/src/plugins/installed-plugin-dirs.ts

@@ -1,8 +1,9 @@
 /**
  * Enumerate installed plugin directories under the workspace plugins dir.
  *
- * An installed plugin is a non-hidden directory carrying a `package.json`,
- * whose realpath stays under the realpath of the plugins directory. This walk
+ * An installed plugin is a non-hidden directory carrying a `package.json` or
+ * root `plugin.json` whose realpath stays under the realpath of the plugins
+ * directory. This walk
  * is shared by the plugin source-version collector
  * (`./collect-source-versions.ts`) and the schedule reconciler
  * (`../schedule/plugin-schedule-reconciler.ts`) so both agree on what counts
@@ -17,10 +18,11 @@
  * declaration is available to run.
  */
 
-import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { readdirSync, realpathSync, statSync } from "node:fs";
 import { join, sep } from "node:path";
 
 import { getWorkspacePluginsDir } from "../util/platform.js";
+import { hasPluginManifest } from "../util/plugin-manifest.js";
 
 export interface InstalledPluginDir {
   /** Directory basename: the plugin's install identity. */
@@ -92,7 +94,7 @@ export function listInstalledPluginDirs(): InstalledPluginDir[] {
     if (!isInsidePluginRoot(dir, pluginsDir)) {
       continue;
     }
-    if (!existsSync(join(dir, "package.json"))) {
+    if (!hasPluginManifest(dir)) {
       continue;
     }
     out.push({ name: entry, dir });

package/src/plugins/mcp-servers.ts

@@ -21,19 +21,11 @@
  * disables only that entry. Neither ever throws, because a malformed file
  * in one plugin must not remove another plugin's servers from a listing.
  *
- * Authentication is deliberately absent. Agent Plugins 1.0.0 defines no
- * portable OAuth or credential-reference fields; authentication is
- * client-managed, and any `headers` in the file are literal package data.
- * A plugin therefore cannot ship a credential, and the assistant's own
- * credential store stays the only place secrets live.
- *
- * Consumers must not resolve a plugin server's id against the
- * `mcp:<serverId>:*` credential namespace. Those keys belong to
- * workspace-configured servers, and a plugin controls both its server key
- * and its URL, so honoring them for a plugin-declared server would send a
- * workspace credential to an endpoint the plugin chose. Every config built
- * here carries `source: "plugin"`, which is what `McpClient` reads to
- * decide, so the rule travels with the server rather than with the caller.
+ * Authentication is client-managed. Agent Plugins 1.0.0 defines no portable
+ * OAuth or credential-reference fields, and any `headers` in the file are
+ * literal package data. Runtime configs carry the declaring plugin directory
+ * name and original server key so OAuth credentials can be isolated from the
+ * public server id and from workspace credentials.
  */
 
 import { existsSync, readFileSync } from "node:fs";
@@ -141,7 +133,7 @@ export function interpolatePluginPaths(
  *
  * `listAllPlugins` is an inventory of directories and reports a malformed
  * entry rather than dropping it, so it happily returns a directory with no
- * usable `package.json`. The runtime loader rejects those in
+ * usable selected manifest. The runtime loader rejects those in
  * `parsePluginManifest`: the manifest must parse and carry a non-empty
  * `name`. Applying the same gate here keeps `mcp.json` from being honored
  * for a directory that will never load as a plugin.
@@ -192,7 +184,7 @@ export function readPluginMcpServers(
     if (!hasLoadableManifest(plugin)) {
       issues.push({
         pluginName: plugin.name,
-        message: `${PLUGIN_MCP_MANIFEST} ignored: package.json is missing, unparseable, or has no name, so the runtime will not load this directory as a plugin`,
+        message: `${PLUGIN_MCP_MANIFEST} ignored: the selected plugin manifest is missing or invalid, so the runtime will not load this directory as a plugin`,
       });
       continue;
     }
@@ -257,6 +249,8 @@ export function readPluginMcpServers(
         config: {
           transport: projectTransport(entry.data, plugin.target),
           source: "plugin",
+          pluginName: plugin.name,
+          serverKey,
         },
       });
     }

package/src/plugins/mtime-cache.ts

@@ -59,6 +59,7 @@ import {
   getWorkspaceHooksDir,
   getWorkspacePluginsDir,
 } from "../util/platform.js";
+import { hasPluginManifest } from "../util/plugin-manifest.js";
 import { collectSourceVersions } from "./collect-source-versions.js";
 import {
   deriveToolName,
@@ -768,7 +769,7 @@ async function scanPlugins(): Promise<void> {
       );
       continue;
     }
-    if (!existsSync(join(pluginDir, "package.json"))) {
+    if (!hasPluginManifest(pluginDir)) {
       continue;
     }
 

package/src/plugins/user-loader.ts

@@ -2,7 +2,8 @@
  * User plugin loader — discovers plugins under `<workspaceDir>/plugins/*` and
  * populates the mtime cache.
  *
- * A plugin directory is recognized by a `package.json` manifest. The loader
+ * A plugin directory is recognized by a legacy `package.json` or standard
+ * `plugin.json` manifest. The loader
  * delegates to the mtime cache's `populateCacheAtBoot`, which builds each
  * plugin via `buildExternalPlugin` and stores it keyed by mtime. The cache
  * is the single source of truth for user plugin state — the registry is no