@vibe-agent-toolkit/cli 0.1.33 → 0.1.34-rc.2

package/dist/commands/claude/plugin/plugin-validators.js

@@ -0,0 +1,59 @@
+/**
+ * Build-time validators for plugin declarations.
+ *
+ * - verifyPluginDirCaseMatch: guards against macOS/Windows case-insensitive FS drift
+ *   (plugin: "foo-bar" -> plugins/Foo-Bar/ locally would break on Linux CI).
+ * - verifyNoCaseCollidingPluginNames: rejects pairs whose toLowerCase() collides.
+ * - parsePluginJsonFiles: parse-only JSON validation of hooks.json + .mcp.json
+ *   (deep schema validation is Claude runtime's job).
+ */
+import { existsSync } from 'node:fs';
+import { readFile, readdir } from 'node:fs/promises';
+import { safePath } from '@vibe-agent-toolkit/utils';
+export async function verifyPluginDirCaseMatch(projectRoot, pluginName) {
+    const pluginsBase = safePath.join(projectRoot, 'plugins');
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- controlled path
+    if (!existsSync(pluginsBase))
+        return;
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- controlled path
+    const entries = await readdir(pluginsBase, { withFileTypes: true });
+    const matchInsensitive = entries.find((e) => e.isDirectory() && e.name.toLowerCase() === pluginName.toLowerCase());
+    if (matchInsensitive && matchInsensitive.name !== pluginName) {
+        throw new Error(`Plugin "${pluginName}" declared in config, but on-disk directory is "plugins/${matchInsensitive.name}/". ` +
+            `Names must match exactly (case-sensitive). This check catches macOS/Windows case-insensitive FS drift ` +
+            `that would break on Linux CI. Rename the directory or the config entry to match.`);
+    }
+}
+export function verifyNoCaseCollidingPluginNames(names) {
+    const seen = new Map();
+    for (const name of names) {
+        const key = name.toLowerCase();
+        const prior = seen.get(key);
+        if (prior === name) {
+            throw new Error(`Plugin name "${name}" is declared more than once across marketplaces. ` +
+                `Plugin names must be globally unique within a repo; rename one.`);
+        }
+        if (prior && prior !== name) {
+            throw new Error(`Plugin names "${prior}" and "${name}" differ only in case. ` +
+                `They would collide on case-insensitive filesystems; rename one.`);
+        }
+        seen.set(key, name);
+    }
+}
+async function parseJsonFileIfPresent(path, label) {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved path
+    if (!existsSync(path))
+        return;
+    try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved path
+        JSON.parse(await readFile(path, 'utf-8'));
+    }
+    catch (e) {
+        throw new Error(`${label} is not valid JSON: ${e.message}`);
+    }
+}
+export async function parsePluginJsonFiles(pluginSourceDir) {
+    await parseJsonFileIfPresent(safePath.join(pluginSourceDir, 'hooks', 'hooks.json'), 'hooks/hooks.json');
+    await parseJsonFileIfPresent(safePath.join(pluginSourceDir, '.mcp.json'), '.mcp.json');
+}
+//# sourceMappingURL=plugin-validators.js.map

package/dist/commands/claude/plugin/plugin-validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-validators.js","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/plugin-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAmB,EACnB,UAAkB;IAElB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1D,sFAAsF;IACtF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAErC,sFAAsF;IACtF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAC5E,CAAC;IACF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,2DAA2D,gBAAgB,CAAC,IAAI,MAAM;YACzG,wGAAwG;YACxG,kFAAkF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAwB;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,oDAAoD;gBACtE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,UAAU,IAAI,yBAAyB;gBAC3D,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAa;IAC/D,oFAAoF;IACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,oFAAoF;QACpF,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,eAAuB;IAChE,MAAM,sBAAsB,CAC1B,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,CAAC,EACrD,kBAAkB,CACnB,CAAC;IACF,MAAM,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;AACzF,CAAC"}

package/dist/commands/claude/plugin/tree-copy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Tree-copy stream for plugin build.
+ *
+ * Copies everything under <sourceDir> to <destDir>, except:
+ *   - .claude-plugin/ (owned by plugin.json merge-write)
+ *
+ * Respects .gitignore via crawlDirectory (respectGitignore: true, the default).
+ * Returns counts keyed to the spec's YAML summary extension.
+ */
+export interface TreeCopyOptions {
+    sourceDir: string;
+    destDir: string;
+    warn?: (message: string) => void;
+}
+export interface TreeCopyResult {
+    commandsCopied: number;
+    hooksCopied: number;
+    agentsCopied: number;
+    mcpCopied: number;
+    filesCopied: number;
+}
+export declare function treeCopyPlugin(options: TreeCopyOptions): Promise<TreeCopyResult>;
+//# sourceMappingURL=tree-copy.d.ts.map

package/dist/commands/claude/plugin/tree-copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-copy.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/tree-copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAYD,wBAAsB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAiDtF"}

package/dist/commands/claude/plugin/tree-copy.js

@@ -0,0 +1,68 @@
+/**
+ * Tree-copy stream for plugin build.
+ *
+ * Copies everything under <sourceDir> to <destDir>, except:
+ *   - .claude-plugin/ (owned by plugin.json merge-write)
+ *
+ * Respects .gitignore via crawlDirectory (respectGitignore: true, the default).
+ * Returns counts keyed to the spec's YAML summary extension.
+ */
+import { existsSync } from 'node:fs';
+import { copyFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { crawlDirectory, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
+const EXCLUDE_PATTERNS = ['.claude-plugin/**'];
+function classifyRelative(rel) {
+    if (rel.startsWith('commands/'))
+        return 'commandsCopied';
+    if (rel.startsWith('hooks/'))
+        return 'hooksCopied';
+    if (rel.startsWith('agents/'))
+        return 'agentsCopied';
+    if (rel === '.mcp.json')
+        return 'mcpCopied';
+    return undefined;
+}
+export async function treeCopyPlugin(options) {
+    const { sourceDir, destDir, warn } = options;
+    const result = {
+        commandsCopied: 0,
+        hooksCopied: 0,
+        agentsCopied: 0,
+        mcpCopied: 0,
+        filesCopied: 0,
+    };
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- sourceDir resolved from config
+    if (!existsSync(sourceDir)) {
+        return result;
+    }
+    const authorMarketplaceJson = safePath.join(sourceDir, '.claude-plugin', 'marketplace.json');
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- controlled path
+    if (existsSync(authorMarketplaceJson) && warn) {
+        warn(`Ignoring ${toForwardSlash(authorMarketplaceJson)}: marketplace.json is VAT-generated ` +
+            `at the marketplace level and cannot be supplied per-plugin.`);
+    }
+    const files = await crawlDirectory({
+        baseDir: sourceDir,
+        include: ['**/*'],
+        exclude: EXCLUDE_PATTERNS,
+        absolute: true,
+        filesOnly: true,
+        respectGitignore: true,
+        dot: true,
+    });
+    for (const absPath of files) {
+        const rel = toForwardSlash(safePath.relative(sourceDir, absPath));
+        const target = safePath.join(destDir, rel);
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- dest resolved from sourceDir+relative
+        await mkdir(dirname(target), { recursive: true });
+        await copyFile(absPath, target);
+        result.filesCopied += 1;
+        const bucket = classifyRelative(rel);
+        if (bucket) {
+            result[bucket] += 1;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=tree-copy.js.map

package/dist/commands/claude/plugin/tree-copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-copy.js","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/tree-copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAgBrF,MAAM,gBAAgB,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAE/C,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACzD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC;IACnD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,cAAc,CAAC;IACrD,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAwB;IAC3D,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAmB;QAC7B,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,qGAAqG;IACrG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC7F,sFAAsF;IACtF,IAAI,UAAU,CAAC,qBAAqB,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9C,IAAI,CACF,YAAY,cAAc,CAAC,qBAAqB,CAAC,sCAAsC;YACrF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;QACjC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,IAAI;QACtB,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IAEH,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,4GAA4G;QAC5G,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAExB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/docs/audit.md

@@ -61,6 +61,11 @@ Plugin directories contain a `.claude-plugin/plugin.json` manifest:
 my-plugin/
 ├── .claude-plugin/
 │   └── plugin.json      # Plugin manifest
+├── commands/            # slash commands (optional)
+├── agents/              # subagents (optional)
+├── hooks/
+│   └── hooks.json       # hook registry (optional)
+├── .mcp.json            # MCP server config (optional)
 └── skills/
     └── skill1.md
 ```
@@ -69,6 +74,7 @@ my-plugin/
 - `plugin.json` exists and is valid JSON
 - Schema validation against plugin manifest schema
 - Referenced skills exist
+- `hooks/hooks.json` and `.mcp.json` parse as valid JSON when present (emits `PLUGIN_INVALID_JSON`)
 
 ### 2. Marketplace Directories
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/cli",
-  "version": "0.1.33",
+  "version": "0.1.34-rc.2",
   "description": "Command-line interface for vibe-agent-toolkit",
   "type": "module",
   "bin": {
@@ -41,16 +41,16 @@
   "//dependencies-note": "DO NOT add example agent packages or adopter packages here. Adopter packages (like vat-development-agents) depend on the CLI binary at build time — declaring them as deps creates a circular build dependency. They are built in a second turbo pass via package#task overrides in turbo.json.",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.71.2",
-    "@vibe-agent-toolkit/agent-config": "0.1.33",
-    "@vibe-agent-toolkit/agent-schema": "0.1.33",
-    "@vibe-agent-toolkit/agent-skills": "0.1.33",
-    "@vibe-agent-toolkit/claude-marketplace": "0.1.33",
-    "@vibe-agent-toolkit/discovery": "0.1.33",
-    "@vibe-agent-toolkit/gateway-mcp": "0.1.33",
-    "@vibe-agent-toolkit/rag": "0.1.33",
-    "@vibe-agent-toolkit/rag-lancedb": "0.1.33",
-    "@vibe-agent-toolkit/resources": "0.1.33",
-    "@vibe-agent-toolkit/utils": "0.1.33",
+    "@vibe-agent-toolkit/agent-config": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/agent-schema": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/agent-skills": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/claude-marketplace": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/discovery": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/gateway-mcp": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/rag": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/rag-lancedb": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/resources": "0.1.34-rc.2",
+    "@vibe-agent-toolkit/utils": "0.1.34-rc.2",
     "adm-zip": "^0.5.16",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",