@vellumai/assistant 0.12.2-staging.2 → 0.12.2-staging.4

package/src/cli/lib/__tests__/install-from-github.test.ts

@@ -22,6 +22,8 @@ import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
+import { readPluginMcpServers } from "../../../plugins/mcp-servers.js";
+import { PluginManifestError } from "../../../util/plugin-manifest.js";
 import type { FetchLike } from "../fetch-like.js";
 import {
   type GitRunner,
@@ -1225,6 +1227,115 @@ describe("installPlugin — direct (untrusted) install", () => {
     expect(meta?.commit).toBe("a".repeat(40));
   });
 
+  test("installs a standard-only plugin without synthesizing package.json", async () => {
+    const fetch = makeContentsFetch({ tree: {} });
+    const runGit = fakeGitRunner({
+      tree: {
+        "plugin.json": JSON.stringify({
+          $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+          name: "standard-plugin",
+          version: "1.4.0",
+        }),
+        "mcp.json": JSON.stringify({
+          $schema: "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+          mcpServers: {
+            "standard-plugin": {
+              type: "streamable-http",
+              url: "https://mcp.example.com",
+            },
+          },
+        }),
+      },
+      commit: "9".repeat(40),
+    });
+
+    const result = await installPlugin(
+      {
+        name: "standard-plugin",
+        directSource: {
+          owner: "owner",
+          repo: "standard-plugin",
+          rootPath: "",
+          ref: "HEAD",
+        },
+      },
+      { fetch, runGit, workspacePluginsDir: pluginsDir },
+    );
+
+    expect(existsSync(join(result.target, "plugin.json"))).toBe(true);
+    expect(existsSync(join(result.target, "package.json"))).toBe(false);
+    expect(readInstallMeta(result.target)?.version).toBe("1.4.0");
+    const mcp = readPluginMcpServers({ workspacePluginsDir: pluginsDir });
+    expect(mcp.issues).toEqual([]);
+    expect(mcp.servers.map((server) => server.id)).toEqual(["standard-plugin"]);
+  });
+
+  test("synthesizes package.json beside a foreign plugin.json", async () => {
+    const fetch = makeContentsFetch({ tree: {} });
+    const runGit = fakeGitRunner({
+      tree: {
+        "plugin.json": JSON.stringify({ name: "foreign-plugin" }),
+        "mcp.json": JSON.stringify({
+          mcpServers: {
+            "foreign-plugin": {
+              type: "streamable-http",
+              url: "https://mcp.example.com",
+            },
+          },
+        }),
+      },
+      commit: "8".repeat(40),
+    });
+
+    const result = await installPlugin(
+      {
+        name: "foreign-plugin",
+        directSource: {
+          owner: "owner",
+          repo: "foreign-plugin",
+          rootPath: "",
+          ref: "HEAD",
+        },
+      },
+      { fetch, runGit, workspacePluginsDir: pluginsDir },
+    );
+
+    expect(existsSync(join(result.target, "plugin.json"))).toBe(true);
+    expect(existsSync(join(result.target, "package.json"))).toBe(true);
+    const mcp = readPluginMcpServers({ workspacePluginsDir: pluginsDir });
+    expect(mcp.issues).toEqual([]);
+    expect(mcp.servers.map((server) => server.id)).toEqual(["foreign-plugin"]);
+  });
+
+  test("rejects a malformed claimed standard manifest before install", async () => {
+    const fetch = makeContentsFetch({ tree: {} });
+    const runGit = fakeGitRunner({
+      tree: {
+        "plugin.json": JSON.stringify({
+          $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+          name: "Invalid Standard Name",
+        }),
+      },
+      commit: "7".repeat(40),
+    });
+
+    await expect(
+      installPlugin(
+        {
+          name: "invalid-standard",
+          directSource: {
+            owner: "owner",
+            repo: "invalid-standard",
+            rootPath: "",
+            ref: "HEAD",
+          },
+        },
+        { fetch, runGit, workspacePluginsDir: pluginsDir },
+      ),
+    ).rejects.toBeInstanceOf(PluginManifestError);
+    expect(existsSync(join(pluginsDir, "invalid-standard"))).toBe(false);
+  });
+
   test("never overlays a curated adapter stub, even if one matches the name", async () => {
     // GIVEN a fetch that WOULD serve an adapter stub for the name, and a
     // postinstall runner that fails the test if it is ever invoked

package/src/cli/lib/__tests__/install-from-platform.test.ts

@@ -14,6 +14,8 @@ import { join } from "node:path";
 import { gzipSync } from "node:zlib";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
+import { readPluginMcpServers } from "../../../plugins/mcp-servers.js";
+import { PluginManifestError } from "../../../util/plugin-manifest.js";
 import type { FetchLike } from "../fetch-like.js";
 import {
   PluginInstallDeclinedError,
@@ -145,7 +147,13 @@ const noSleep = async () => {};
 describe("installPluginFromPlatform — success", () => {
   test("downloads, verifies, and extracts files at the plugin root", async () => {
     const entries: TarEntry[] = [
-      { name: "plugin.json", content: '{"name":"reading-pal"}' },
+      {
+        name: "plugin.json",
+        content: JSON.stringify({
+          $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+          name: "reading-pal",
+        }),
+      },
       { name: "README.md", content: "# reading pal" },
       { name: "skills/read/SKILL.md", content: "skill body" },
     ];
@@ -177,7 +185,7 @@ describe("installPluginFromPlatform — success", () => {
     );
     expect(existsSync(join(target, "README.md"))).toBe(true);
     expect(existsSync(join(target, "skills", "read", "SKILL.md"))).toBe(true);
-    expect(existsSync(join(target, "package.json"))).toBe(true);
+    expect(existsSync(join(target, "package.json"))).toBe(false);
 
     // Provenance records the pinned commit and the verified ETag.
     const meta = readInstallMeta(target);
@@ -227,6 +235,73 @@ describe("installPluginFromPlatform — success", () => {
     expect(pkg.peerDependencies["@vellumai/plugin-api"]).toBeDefined();
   });
 
+  test("synthesizes package.json beside a foreign plugin.json", async () => {
+    const fetchFn = makeInstallFetch({
+      entries: [
+        {
+          name: "plugin.json",
+          content: JSON.stringify({ name: "foreign-plugin" }),
+        },
+        {
+          name: "mcp.json",
+          content: JSON.stringify({
+            mcpServers: {
+              "foreign-plugin": {
+                type: "streamable-http",
+                url: "https://mcp.example.com",
+              },
+            },
+          }),
+        },
+      ],
+      ref: "d".repeat(40),
+      repo: "example-org/foreign-plugin",
+    });
+
+    const result = await installPluginFromPlatform(
+      { name: "foreign-plugin" },
+      {
+        fetch: fetchFn,
+        platformBaseUrl: PLATFORM,
+        workspacePluginsDir: pluginsDir,
+      },
+    );
+
+    expect(existsSync(join(result.target, "plugin.json"))).toBe(true);
+    expect(existsSync(join(result.target, "package.json"))).toBe(true);
+    const mcp = readPluginMcpServers({ workspacePluginsDir: pluginsDir });
+    expect(mcp.issues).toEqual([]);
+    expect(mcp.servers.map((server) => server.id)).toEqual(["foreign-plugin"]);
+  });
+
+  test("rejects a malformed claimed standard manifest before install", async () => {
+    const fetchFn = makeInstallFetch({
+      entries: [
+        {
+          name: "plugin.json",
+          content: JSON.stringify({
+            $schema:
+              "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+          }),
+        },
+      ],
+      ref: "e".repeat(40),
+      repo: "example-org/invalid-standard",
+    });
+
+    await expect(
+      installPluginFromPlatform(
+        { name: "invalid-standard" },
+        {
+          fetch: fetchFn,
+          platformBaseUrl: PLATFORM,
+          workspacePluginsDir: pluginsDir,
+        },
+      ),
+    ).rejects.toBeInstanceOf(PluginManifestError);
+    expect(existsSync(join(pluginsDir, "invalid-standard"))).toBe(false);
+  });
+
   test("leaves an upstream package.json in place", async () => {
     const fetchFn = makeInstallFetch({
       entries: [

package/src/cli/lib/__tests__/list-installed-plugins.test.ts

@@ -93,6 +93,46 @@ describe("listInstalledPlugins", () => {
     expect(result[0]!.packageJson?.icon).toBe("🚀");
   });
 
+  test("lists metadata from a standard-only plugin.json", () => {
+    mkdirSync(join(pluginsDir, "standard"));
+    writeFileSync(
+      join(pluginsDir, "standard", "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "standard",
+        version: "3.0.0",
+        description: "standard plugin",
+      }),
+    );
+
+    const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
+
+    expect(result[0]!.packageJson).toEqual({
+      name: "standard",
+      version: "3.0.0",
+      description: "standard plugin",
+      peerDependencies: undefined,
+    });
+    expect(result[0]!.issues).toEqual([]);
+  });
+
+  test("does not validate an unselected plugin.json beside package.json", () => {
+    mkdirSync(join(pluginsDir, "legacy"));
+    writeFileSync(
+      join(pluginsDir, "legacy", "package.json"),
+      JSON.stringify({ name: "legacy", version: "1.0.0" }),
+    );
+    writeFileSync(
+      join(pluginsDir, "legacy", "plugin.json"),
+      "{ foreign and malformed }",
+    );
+
+    const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
+
+    expect(result[0]!.packageJson?.version).toBe("1.0.0");
+    expect(result[0]!.issues).toEqual([]);
+  });
+
   test.each([
     ["missing vellum block", { name: "p", version: "1.0.0" }],
     ["non-string icon", { name: "p", version: "1.0.0", vellum: { icon: 42 } }],
@@ -120,7 +160,9 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues).toEqual(["missing package.json"]);
+    expect(result[0]!.issues[0]).toContain(
+      "missing package.json and plugin.json",
+    );
   });
 
   test("reports malformed JSON as an issue rather than failing", () => {
@@ -130,7 +172,7 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues[0]).toMatch(/invalid JSON/);
+    expect(result[0]!.issues[0]).toContain("could not be read or parsed");
   });
 
   test("reports non-object package.json as an issue", () => {
@@ -143,7 +185,7 @@ describe("listInstalledPlugins", () => {
     const result = listInstalledPlugins({ workspacePluginsDir: pluginsDir });
     expect(result).toHaveLength(1);
     expect(result[0]!.packageJson).toBeNull();
-    expect(result[0]!.issues).toContain("package.json is not an object");
+    expect(result[0]!.issues[0]).toContain("failed schema validation");
   });
 
   test("skips hidden entries and non-directories", () => {

package/src/cli/lib/__tests__/plugin-details.test.ts

@@ -302,6 +302,32 @@ describe("getPluginDetails (bundled catalog, offline)", () => {
     expect(details.icon).toBeNull();
   });
 
+  test("reads metadata from an installed standard-only plugin.json", async () => {
+    const target = join(workspace, "caveman");
+    mkdirSync(target, { recursive: true });
+    writeFileSync(
+      join(target, "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "caveman",
+        version: "4.0.0",
+        description: "Installed standard plugin",
+        homepage: "https://example.com/plugin",
+        license: "MIT",
+      }),
+    );
+
+    const details = await getPluginDetails(
+      { name: "caveman" },
+      { fetch: makeFetch({}), workspacePluginsDir: workspace },
+    );
+
+    expect(details.version).toBe("4.0.0");
+    expect(details.description).toBe("Installed standard plugin");
+    expect(details.homepage).toBe("https://example.com/plugin");
+    expect(details.license).toBe("MIT");
+  });
+
   test("surfaces the installed copy's vellum.icon", async () => {
     // GIVEN an installed copy whose package.json declares vellum.icon
     const target = join(workspace, "caveman");

package/src/cli/lib/__tests__/uninstall-plugin.test.ts

@@ -21,15 +21,34 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  mock,
+  test,
+} from "bun:test";
+
+const deletePluginMcpOAuthCredentials = jest.fn(async () => ({
+  ok: true,
+  unreachable: false,
+  matchedKeys: [] as string[],
+  failedKeys: [] as string[],
+}));
+
+mock.module("../../../mcp/mcp-oauth-provider.js", () => ({
+  deletePluginMcpOAuthCredentials,
+}));
 
 import { resetHookCacheForTests } from "../../../hooks/hook-loader.js";
 import { getWorkspacePluginsDir } from "../../../util/platform.js";
 import { InvalidPluginNameError } from "../install-from-github.js";
-import {
-  PluginNotInstalledError,
-  uninstallPlugin,
-} from "../uninstall-plugin.js";
+const { PluginNotInstalledError, uninstallPlugin } =
+  await import("../uninstall-plugin.js");
+const { PLUGIN_UNINSTALL_WARNING_KEYS } =
+  await import("../uninstall-plugin.js");
 
 let pluginsDir: string;
 
@@ -38,6 +57,13 @@ beforeEach(() => {
   rmSync(pluginsDir, { recursive: true, force: true });
   mkdirSync(pluginsDir, { recursive: true });
   resetHookCacheForTests();
+  deletePluginMcpOAuthCredentials.mockReset();
+  deletePluginMcpOAuthCredentials.mockImplementation(async () => ({
+    ok: true,
+    unreachable: false,
+    matchedKeys: [],
+    failedKeys: [],
+  }));
 });
 
 afterEach(() => {
@@ -164,6 +190,97 @@ describe("uninstallPlugin", () => {
     expect(existsSync(marker)).toBe(false);
   });
 
+  test("preserves the plugin when credential deletion fails", async () => {
+    const target = writePlugin("cleanup-fails");
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: false,
+      matchedKeys: ["mcp-plugin/v1/key"],
+      failedKeys: ["mcp-plugin/v1/key"],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "cleanup-fails",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("MCP OAuth credentials could not be deleted");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("preserves an MCP plugin when credential storage is unavailable", async () => {
+    const target = writePlugin("offline-mcp");
+    writeFileSync(join(target, "mcp.json"), JSON.stringify({ mcpServers: {} }));
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "offline-mcp",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("credential storage is unavailable");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("uses the install fingerprint as MCP evidence when the file was removed", async () => {
+    const target = writePlugin("recorded-mcp");
+    writeFileSync(
+      join(target, "install-meta.json"),
+      JSON.stringify({
+        name: "recorded-mcp",
+        source: {
+          kind: "github",
+          owner: "example",
+          repo: "plugin",
+          ref: "main",
+        },
+        fingerprint: {
+          algorithm: "sha256",
+          files: { "mcp.json": "digest" },
+        },
+      }),
+    );
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    await expect(
+      uninstallPlugin({
+        name: "recorded-mcp",
+        workspacePluginsDir: pluginsDir,
+      }),
+    ).rejects.toThrow("credential storage is unavailable");
+    expect(existsSync(target)).toBe(true);
+  });
+
+  test("removes a non-MCP plugin offline and returns a visible warning", async () => {
+    const target = writePlugin("offline-simple");
+    deletePluginMcpOAuthCredentials.mockImplementationOnce(async () => ({
+      ok: false,
+      unreachable: true,
+      matchedKeys: [],
+      failedKeys: [],
+    }));
+
+    const result = await uninstallPlugin({
+      name: "offline-simple",
+      workspacePluginsDir: pluginsDir,
+    });
+
+    expect(existsSync(target)).toBe(false);
+    expect(result.warnings).toEqual([
+      PLUGIN_UNINSTALL_WARNING_KEYS.MCP_OAUTH_CREDENTIALS_UNCHECKED,
+    ]);
+  });
+
   test.each([
     ["../escape"],
     ["/abs/path"],

package/src/cli/lib/bundled-marketplace.json

@@ -135,6 +135,19 @@
       "homepage": "https://github.com/topoteretes/cognee-integrations/tree/main/integrations/vellum-assistant",
       "icon": "\ud83d\udd78\ufe0f"
     },
+    {
+      "name": "contractor-voice-invoicer",
+      "description": "Converts 20-second truck voice memos and job photos into itemized client invoices with custom labor rates, material markups, and one-click accounting staging.",
+      "category": "commerce",
+      "icon": "🔧",
+      "license": "MIT",
+      "homepage": "https://github.com/ZeebBoyBlue/contractor-voice-invoicer",
+      "source": {
+        "source": "github",
+        "repo": "ZeebBoyBlue/contractor-voice-invoicer",
+        "ref": "31e21ea1aa90b3ba462ed7208988931411226daa"
+      }
+    },
     {
       "name": "creatorland",
       "source": {

package/src/cli/lib/install-from-github.ts

@@ -52,6 +52,10 @@ import {
   getWorkspacePluginsDir,
   isWindows,
 } from "../../util/platform.js";
+import {
+  getPluginManifestInstallAction,
+  readPluginManifest,
+} from "../../util/plugin-manifest.js";
 import type { FetchLike } from "./fetch-like.js";
 import {
   type DependencyInstaller,
@@ -860,16 +864,18 @@ export async function materializePluginTree(
   // stub for it, overlay the stub and run its transform so the materialized
   // tree is a valid Vellum plugin. Raw clones (no stub) are left untouched,
   // except for a minimal package.json synthesis when the upstream repo shipped
-  // none — the Vellum loader hard-requires one and would silently skip the
-  // plugin without it. The synthesis is deterministic (name + fixed version +
-  // fixed peer-dep range), so it produces the same bytes on initial install
+  // no recognized manifest. The synthesis is deterministic (name + fixed
+  // version + fixed peer-dep range), so it produces the same bytes on initial install
   // and upgrade re-materialization; the fingerprint is computed after
   // materialization, so the synthesized file is present in both baselines and
   // the comparison stays clean.
   if (cloned.fileCount > 0 && opts.stubRef !== null) {
     await applyAdapterStub(opts.name, opts.stubRef, opts.destDir, deps);
   }
-  if (cloned.fileCount > 0 && !existsSync(join(opts.destDir, "package.json"))) {
+  if (
+    cloned.fileCount > 0 &&
+    getPluginManifestInstallAction(opts.destDir) === "synthesize-legacy"
+  ) {
     synthesizeMinimalPackageJson(opts.name, opts.destDir);
   }
   return cloned;
@@ -1557,22 +1563,15 @@ interface WriteInstallMetaParams {
 }
 
 /**
- * Read the `version` field from a staged plugin's `package.json`. Lenient — a
- * missing or malformed manifest simply yields `undefined` so provenance is
+ * Read the `version` field from a staged plugin's selected manifest. A
+ * missing or malformed manifest yields `undefined` so provenance is
  * recorded without it rather than failing the install.
  */
-function readStagedPackageVersion(stagingDir: string): string | undefined {
-  const pkgPath = join(stagingDir, "package.json");
-  if (!existsSync(pkgPath)) {
-    return undefined;
-  }
+function readStagedManifestVersion(stagingDir: string): string | undefined {
   try {
-    const parsed: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
-    if (typeof parsed === "object" && parsed !== null) {
-      const version = (parsed as Record<string, unknown>).version;
-      if (typeof version === "string" && version.length > 0) {
-        return version;
-      }
+    const version = readPluginManifest(stagingDir).version;
+    if (version && version.length > 0) {
+      return version;
     }
   } catch {
     // fall through to undefined
@@ -1602,7 +1601,7 @@ function writeInstallMeta(
   const meta: InstallMeta = {
     origin: "vellum",
     installedAt: new Date().toISOString(),
-    version: readStagedPackageVersion(stagingDir),
+    version: readStagedManifestVersion(stagingDir),
     sourceRepo: `${source.owner}/${source.repo}`,
     contentHash,
     author: "user",

package/src/cli/lib/install-from-platform.ts

@@ -8,9 +8,9 @@
  * and extracts it into the plugin's install directory — it does NOT clone the
  * plugin from GitHub itself, and it does NOT emit `plugin_installed` telemetry
  * (hitting this endpoint *is* the recorded install; the server rejects that
- * event type on the usual ingest path). A tarball that ships no
- * `package.json` gets the same synthesized manifest the GitHub clone path
- * writes, so the loader still registers the plugin's skills.
+ * event type on the usual ingest path). A tarball that ships neither supported
+ * manifest gets the same synthesized manifest the GitHub clone path writes, so
+ * the loader still registers the plugin's skills.
  *
  *     GET {PLATFORM_BASE_URL}/v1/plugins/{name}/install/
  *
@@ -36,6 +36,7 @@ import {
 import { getPlatformBaseUrl } from "../../config/env.js";
 import { getExistingDeviceId } from "../../util/device-id.js";
 import { getWorkspacePluginsDir } from "../../util/platform.js";
+import { getPluginManifestInstallAction } from "../../util/plugin-manifest.js";
 import { APP_VERSION } from "../../version.js";
 import type { FetchLike } from "./fetch-like.js";
 import {
@@ -205,12 +206,16 @@ export async function installPluginFromPlatform(
     throw new PluginNotFoundError(name, meta.ref ?? "", meta.repo ?? name);
   }
 
-  // Same default as the GitHub clone path: a marketplace tarball that
-  // ships skills/mcp.json but no Vellum package.json still has to load.
-  // The loader skips a directory with no manifest, so synthesize one
-  // before the fingerprint and swap.
-  if (!existsSync(join(stagingDir, "package.json"))) {
-    synthesizeMinimalPackageJson(name, stagingDir);
+  // Same default as the GitHub clone path: a marketplace tarball without a
+  // recognized manifest still has to load. A claimed standard manifest is
+  // validated before the fingerprint and swap.
+  try {
+    if (getPluginManifestInstallAction(stagingDir) === "synthesize-legacy") {
+      synthesizeMinimalPackageJson(name, stagingDir);
+    }
+  } catch (err) {
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw err;
   }
 
   await confirmStagedOrAbort(name, stagingDir, deps.confirmStaged);