@vibe-agent-toolkit/cli 0.1.41-rc.6 → 0.1.41-rc.8

package/dist/commands/claude/plugin/build.d.ts

@@ -6,16 +6,27 @@
  * (commands, hooks, agents, .mcp.json, skills/, .claude-plugin/plugin.json) and
  * imports pool skills (from dist/skills/) via the `skills:` selector.
  */
+import { type SeverityCounts } from '@vibe-agent-toolkit/agent-schema';
+import { type DeclaredEvalSuite, type PackageSkillResult } from '@vibe-agent-toolkit/agent-skills';
+import type { ResourceRegistry, SkillsConfig } from '@vibe-agent-toolkit/resources';
 import { Command } from 'commander';
 import { createLogger } from '../../../utils/logger.js';
 export interface PluginBuildCommandOptions {
     marketplace?: string;
     debug?: boolean;
+    verbose?: boolean;
 }
 interface PluginBuildResult {
     pluginName: string;
     pluginDir: string;
     pluginVersion: string | undefined;
+    /**
+     * The plugin's merged `author` (config-owned name/email plus the subfields
+     * config cannot express, passed through from the author's plugin.json). Carried
+     * up so marketplace.json republishes THIS object rather than rebuilding one
+     * from the config `owner` and silently dropping the passthrough subfields.
+     */
+    pluginAuthor: Record<string, unknown>;
     skillsCopied: string[];
     commandsCopied: number;
     hooksCopied: number;
@@ -24,6 +35,15 @@ interface PluginBuildResult {
     treeFilesCopied: number;
     explicitFilesCopied: number;
     localSkillsPackaged: number;
+    /**
+     * Per-severity post-build findings across this plugin's plugin-local skills.
+     *
+     * Published rather than folded into the plugin's success/failure: the build
+     * gate is two-valued (a warning does not fail it), so a bare `status` cannot
+     * say whether a "built" plugin shipped warnings or info findings — and the
+     * reading a consumer takes from silence is the reassuring one.
+     */
+    localSkillIssueCounts: SeverityCounts;
 }
 export interface MarketplaceBuildResult {
     name: string;
@@ -45,10 +65,106 @@ export declare function createPluginBuildCommand(): Command;
  * vibe-agent-toolkit.config.yaml), so callers that already know the root build
  * against it rather than re-discovering from cwd. `options.marketplace` restricts
  * the build to a single marketplace by name.
+ *
+ * `options.verbose` affects the stderr findings report ONLY (see
+ * `summarizePackagedSkillIssues`); it changes nothing this function returns, so a
+ * programmatic caller — `vat skill test`, which builds a marketplace purely to
+ * stage a skill — can leave it off and still get the same result objects.
  */
 export declare function runClaudePluginBuild(configDir: string, options?: {
     marketplace?: string;
     logger?: ReturnType<typeof createLogger>;
+    verbose?: boolean;
 }): Promise<MarketplaceBuildResult[]>;
+/** One plugin-local skill, discovered once and carried through every later phase. */
+interface PluginLocalSkill {
+    /** Forward-slash dir path relative to the plugin's `skills/` dir (`a`, `group/b`). */
+    skillDirPath: string;
+    /** Absolute path to its `SKILL.md`. */
+    skillPath: string;
+    /** Its DECLARED name (frontmatter → H1 → filename), the key per-skill config uses. */
+    skillName: string;
+}
+/**
+ * PACKAGE each plugin-local skill (a skill living in the plugin's own `skills/`
+ * source tree) with the SAME packager that produces pool skills.
+ *
+ * This is the "one production path" rule. A plugin-local skill used to be
+ * tree-copied VERBATIM — every byte in its source directory shipped, links were
+ * never rewritten, and `files:` had to be re-applied separately because the
+ * packager never ran. That produced a materially different artifact from the
+ * pool path for the same kind of thing, and the difference was invisible: it
+ * shipped eval suites (answer keys included), scratch files, and un-rewritten
+ * links. The collision referee already conceded the point by preferring the
+ * pool copy whenever both existed.
+ *
+ * Now both paths run `packageSkill`, so "what ships in a skill" has exactly one
+ * answer: link-reachable resources plus declared `files:`, links rewritten,
+ * declared test input excluded, post-build checks applied.
+ *
+ * `input.skills` is the already-refereed set: pool-sourced collisions have been
+ * filtered out by {@link resolveCollidingSkills} and are copied in by Phase 3
+ * instead. Returns each packaged skill's result for error reporting.
+ *
+ * The returned list is also the ONLY definition of "which dirs under `skills/` did
+ * the packager produce": the tree-copy exclusion list is derived from it (see
+ * Phase 2b in {@link buildPlugin}), so a directory absent from it is a directory
+ * the tree-copy still ships.
+ */
+export declare function packagePluginLocalSkills(input: {
+    skills: readonly PluginLocalSkill[];
+    pluginDir: string;
+    skillsConfig: SkillsConfig | undefined;
+    /**
+     * THE project registry for this build, built once by {@link runClaudePluginBuild}.
+     *
+     * Not optional, and not defaulted: `packageSkill` silently falls back to
+     * crawling and parsing every markdown file in the project when it gets no
+     * registry, so an omission here costs one whole-project scan PER SKILL rather
+     * than failing. That is exactly what this lane used to do.
+     */
+    registry: ResourceRegistry;
+    /**
+     * THE project's declared eval suites, assembled once by {@link runClaudePluginBuild}.
+     *
+     * Not optional, and not defaulted, for the same reason as `registry` above: an
+     * omission would not fail, it would silently package one skill's bundle carrying
+     * ANOTHER skill's eval answer key — the failure mode a default value hid the first
+     * time this rule shipped.
+     */
+    projectSkills: readonly DeclaredEvalSuite[];
+    logger: ReturnType<typeof createLogger>;
+}): Promise<Array<{
+    skillDirPath: string;
+    result: PackageSkillResult;
+}>>;
+/**
+ * Summarize post-build issues for the plugin-local skills: the lines to print,
+ * the dirs that emitted errors, and the per-severity distribution.
+ *
+ * Mirrors `vat skills build`: a skill whose packaged output fails validation
+ * fails the build, so the two lanes hold the same bar, and they now render
+ * findings through the same helper — this lane used to label every non-error
+ * severity `[WARNING]`, so `info` findings were reported as warnings, and it
+ * read only `postBuildIssues`, so a skill failing purely on the built-output
+ * validation aborted the plugin build with no issue text at all.
+ *
+ * `verbose` governs the RENDERED lines and nothing else: `withErrors` (what the
+ * caller fails the plugin on) and `issueCounts` (what stdout publishes) are
+ * computed from the whole set at every verbosity, so quieting the report cannot
+ * quiet the gate. Per the shared policy in `issuesToRenderAtVerbosity`, errors
+ * always get a full block; warnings and info collapse into the per-skill heading
+ * above them, which still names the complete severity breakdown.
+ *
+ * Pure so the whole rendered set is assertable.
+ */
+export declare function summarizePackagedSkillIssues(packaged: Array<{
+    skillDirPath: string;
+    result: PackageSkillResult;
+}>, verbose: boolean): {
+    lines: string[];
+    withErrors: string[];
+    issueCounts: SeverityCounts;
+};
 export {};
 //# sourceMappingURL=build.d.ts.map

package/dist/commands/claude/plugin/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/build.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAexD,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAID,UAAU,iBAAiB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAgDlD;AAkBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA;CAAO,GAC/E,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAyEnC"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../../src/commands/claude/plugin/build.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAA4L,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC7R,OAAO,KAAK,EAAyD,gBAAgB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE3I,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBxD,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,UAAU,iBAAiB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,qBAAqB,EAAE,cAAc,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAuDlD;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;CACd,GACL,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA+FnC;AA4VD,qFAAqF;AACrF,UAAU,gBAAgB;IACxB,sFAAsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;CACnB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;;;OAOG;IACH,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5C,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAAC,CAoFvE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,KAAK,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,EACrE,OAAO,EAAE,OAAO,GACf;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,cAAc,CAAA;CAAE,CAkBxE"}

package/dist/commands/claude/plugin/build.js

@@ -9,16 +9,20 @@
 import { cpSync, existsSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
 import { basename } from 'node:path';
-import { getPluginOutputDir, getPluginSourceDir, listPluginSourceSkillDirs, listUntrackedPluginSkillDirs, packageSkill, packagingConfigToPackageOptions, skillNameToFsPath } from '@vibe-agent-toolkit/agent-skills';
+import { countBySeverity } from '@vibe-agent-toolkit/agent-schema';
+import { createProjectRegistry, getPluginOutputDir, getPluginSourceDir, listPluginSourceSkillDirs, listUntrackedPluginSkillDirs, packageSkill, packagingConfigToPackageOptions, skillNameToFsPath } from '@vibe-agent-toolkit/agent-skills';
 import { safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { Command } from 'commander';
 import { readSkillName } from '../../../commands/skills/skill-discovery.js';
 import { handleCommandError } from '../../../utils/command-error.js';
 import { loadConfig } from '../../../utils/config-loader.js';
+import { collectPostBuildIssues, formatIssueLines, formatIssueSetHeading, issuesToRenderAtVerbosity, sumSeverityCounts, } from '../../../utils/issue-rendering.js';
 import { createLogger } from '../../../utils/logger.js';
 import { writeYamlOutput } from '../../../utils/output.js';
-import { mergeSkillPackagingConfig } from '../../../utils/skill-packaging-config.js';
+import { collectDeclaredEvalSuites, mergeSkillPackagingConfig } from '../../../utils/skill-packaging-config.js';
+import { discoverSkillsFromConfig } from '../../skills/skill-discovery.js';
 import { loadClaudeProjectConfig } from '../claude-config.js';
+import { buildMarketplaceJson } from './marketplace-json.js';
 import { resolvePluginChangelogPath } from './plugin-changelog.js';
 import { applyPluginFiles } from './plugin-files.js';
 import { mergePluginJson, resolveVersion } from './plugin-json-merge.js';
@@ -30,6 +34,7 @@ export function createPluginBuildCommand() {
     command
         .description('Generate Claude plugin artifacts from plugin directories and pre-built skills')
         .option('--marketplace <name>', 'Build specific marketplace only')
+        .option('-v, --verbose', 'Show every individual finding, not just the errors')
         .option('--debug', 'Enable debug logging')
         .action(pluginBuildCommand)
         .addHelpText('after', `
@@ -59,6 +64,12 @@ Output:
   YAML summary -> stdout
   Build progress -> stderr
 
+  On stderr, each packaged skill's findings heading names the whole set and
+  its severity breakdown, and errors are always printed in full beneath it.
+  Warnings and info findings stay collapsed into that heading unless
+  --verbose. The stdout YAML is NOT affected by --verbose: its issueCounts
+  cover every finding at every verbosity.
+
 Exit Codes:
   0 - Build successful
   1 - Build error (empty plugin, invalid config)
@@ -95,9 +106,15 @@ async function discoverBuiltSkills(configDir) {
  * vibe-agent-toolkit.config.yaml), so callers that already know the root build
  * against it rather than re-discovering from cwd. `options.marketplace` restricts
  * the build to a single marketplace by name.
+ *
+ * `options.verbose` affects the stderr findings report ONLY (see
+ * `summarizePackagedSkillIssues`); it changes nothing this function returns, so a
+ * programmatic caller — `vat skill test`, which builds a marketplace purely to
+ * stage a skill — can leave it off and still get the same result objects.
  */
 export async function runClaudePluginBuild(configDir, options = {}) {
     const logger = options.logger ?? createLogger({});
+    const verbose = options.verbose === true;
     const projectConfig = loadConfig(configDir);
     const marketplaces = projectConfig?.claude?.marketplaces;
     if (!marketplaces || Object.keys(marketplaces).length === 0) {
@@ -128,6 +145,22 @@ export async function runClaudePluginBuild(configDir, options = {}) {
     logger.info(`Building Claude plugin artifacts`);
     logger.info(`   Config: ${safePath.join(configDir, 'vibe-agent-toolkit.config.yaml')}`);
     logger.info(`   Skills available: ${availableSkills.length}`);
+    // THE registry for this build: one crawl+parse of the project's markdown,
+    // shared by every plugin-local skill in every marketplace. `packageSkill`
+    // builds this itself when it is not given one, so omitting it does not fail —
+    // it just re-reads the whole project once per skill, which is how a 46-skill
+    // build came to take longer than a 30-minute CI budget.
+    const sharedRegistry = await createProjectRegistry(configDir);
+    logger.debug(`Project registry: ${sharedRegistry.getAllResources().length} markdown resources (built once)`);
+    // THE project's declared eval suites for this build, assembled ONCE and threaded
+    // to every plugin-local skill. Test input never ships, and the rule is
+    // project-wide: a file ANY skill declares as its eval suite is an answer key, so
+    // a plugin-local skill's bundle must exclude the OTHER skills' suites too — not
+    // just its own. Discovery is not free, hence once per run rather than per skill.
+    const projectSkills = skillsConfig === undefined
+        ? []
+        : collectDeclaredEvalSuites(skillsConfig, await discoverSkillsFromConfig(skillsConfig, configDir));
+    logger.debug(`Project declared eval suites: ${projectSkills.length}`);
     const results = [];
     const allPluginNames = [];
     for (const mp of Object.values(marketplaces)) {
@@ -142,7 +175,18 @@ export async function runClaudePluginBuild(configDir, options = {}) {
         }
         const mpConfig = marketplaces[name];
         logger.info(`\n   Building marketplace: ${name}`);
-        const result = await buildMarketplace(name, mpConfig, availableSkills, configDir, skillsConfig, rootVersion, logger);
+        const result = await buildMarketplace({
+            name,
+            config: mpConfig,
+            availableSkills,
+            configDir,
+            skillsConfig,
+            rootVersion,
+            registry: sharedRegistry,
+            projectSkills,
+            logger,
+            verbose,
+        });
         results.push(result);
         if (result.status === 'error') {
             throw new Error(`Claude plugin build failed for marketplace '${name}': ${result.reason ?? 'unknown error'}`);
@@ -166,12 +210,17 @@ async function pluginBuildCommand(options) {
         const results = await runClaudePluginBuild(configDir, {
             ...(options.marketplace ? { marketplace: options.marketplace } : {}),
             logger,
+            verbose: options.verbose === true,
         });
         const duration = Date.now() - startTime;
         const totalPlugins = results.flatMap((r) => r.plugins).length;
         const totalSkills = results.flatMap((r) => r.plugins).flatMap((p) => p.skillsCopied).length;
+        const allPlugins = results.flatMap((r) => r.plugins);
         writeYamlOutput({
             status: 'success',
+            // The build gate is two-valued and a warning does not fail it, so the
+            // distribution has to travel next to the status rather than inside it.
+            issueCounts: sumSeverityCounts(allPlugins.map((p) => p.localSkillIssueCounts)),
             marketplacesBuilt: results.filter((r) => r.status === 'built').length,
             pluginsBuilt: totalPlugins,
             skillsPackaged: totalSkills,
@@ -190,6 +239,7 @@ async function pluginBuildCommand(options) {
                     treeFilesCopied: p.treeFilesCopied,
                     explicitFilesCopied: p.explicitFilesCopied,
                     localSkillsPackaged: p.localSkillsPackaged,
+                    issueCounts: p.localSkillIssueCounts,
                 })),
             })),
             duration: `${duration}ms`,
@@ -224,7 +274,8 @@ async function copyDistributionFiles(marketplaceDir, configDir, config, logger)
         }
     }
 }
-async function buildMarketplace(name, config, availableSkills, configDir, skillsConfig, rootVersion, logger) {
+async function buildMarketplace(input) {
+    const { name, config, availableSkills, configDir, skillsConfig, rootVersion, registry, projectSkills, logger, verbose } = input;
     const plugins = [];
     // Clean stale marketplace directory before rebuilding — removes orphaned plugins
     const marketplaceBaseDir = safePath.join(configDir, 'dist', '.claude', 'plugins', 'marketplaces', name);
@@ -243,7 +294,10 @@ async function buildMarketplace(name, config, availableSkills, configDir, skills
             skillsConfig,
             owner: config.owner,
             rootVersion,
+            registry,
+            projectSkills,
             logger,
+            verbose,
         });
         plugins.push(pluginResult);
     }
@@ -252,27 +306,18 @@ async function buildMarketplace(name, config, availableSkills, configDir, skills
     const claudePluginDir = safePath.join(marketplaceDir, CLAUDE_PLUGIN_DIRNAME);
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await mkdir(claudePluginDir, { recursive: true });
-    const marketplaceJson = {
-        $schema: 'https://anthropic.com/claude-code/marketplace.schema.json',
+    // Each entry's author is the plugin's own MERGED author (see marketplace-json.ts),
+    // so marketplace.json and that plugin's plugin.json cannot disagree.
+    const marketplaceJson = buildMarketplaceJson({
         name,
-        owner: {
-            name: config.owner.name,
-            ...(config.owner.email ? { email: config.owner.email } : {}),
-        },
-        plugins: plugins.map((p) => {
-            const pluginDesc = config.plugins.find((pd) => pd.name === p.pluginName)?.description;
-            return {
-                name: p.pluginName,
-                ...(pluginDesc ? { description: pluginDesc } : {}),
-                source: `./plugins/${p.pluginName}`,
-                ...(p.pluginVersion ? { version: p.pluginVersion } : {}),
-                author: {
-                    name: config.owner.name,
-                    ...(config.owner.email ? { email: config.owner.email } : {}),
-                },
-            };
-        }),
-    };
+        owner: config.owner,
+        plugins: plugins.map((p) => ({
+            name: p.pluginName,
+            description: config.plugins.find((pd) => pd.name === p.pluginName)?.description,
+            version: p.pluginVersion,
+            author: p.pluginAuthor,
+        })),
+    });
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await writeFile(safePath.join(claudePluginDir, 'marketplace.json'), JSON.stringify(marketplaceJson, null, 2));
     logger.info(`   .claude-plugin/marketplace.json`);
@@ -355,7 +400,7 @@ async function writeMergedPluginJson(pluginDef, authorJson, pluginVersion, plugi
     const pluginJsonDir = safePath.join(pluginDir, CLAUDE_PLUGIN_DIRNAME);
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await mkdir(pluginJsonDir, { recursive: true });
-    const { merged, warnings } = mergePluginJson({
+    const { merged, author, warnings } = mergePluginJson({
         vat: {
             name: pluginDef.name,
             version: pluginVersion,
@@ -369,6 +414,7 @@ async function writeMergedPluginJson(pluginDef, authorJson, pluginVersion, plugi
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await writeFile(safePath.join(pluginJsonDir, 'plugin.json'), JSON.stringify(merged, null, 2));
     logger.info(`         .claude-plugin/plugin.json`);
+    return author;
 }
 /**
  * Copy pool skills (from dist/skills/) selected by the plugin's skills: selector
@@ -470,8 +516,31 @@ function lastPathSegment(dirPath) {
  * Phase 2b in {@link buildPlugin}), so a directory absent from it is a directory
  * the tree-copy still ships.
  */
-async function packagePluginLocalSkills(input) {
+export async function packagePluginLocalSkills(input) {
     const packaged = [];
+    // KNOWN GAP — NO PER-SKILL CONTAINMENT. `packageSkill` reports most problems by
+    // RETURNING a result whose `hasErrors` is set, but it THROWS on structural packaging
+    // failures (filename collisions, unreadable sources). This loop awaits it bare, so one
+    // throw escapes the whole plugin build and discards every skill packaged before it —
+    // while the partial `skills/<dir>/` trees already written stay on disk, described by
+    // nothing.
+    //
+    // This is the SAME defect, in the same shape, that `packageSkills` had until commit
+    // ba140fae ("fix(skills): one unbuildable skill no longer discards the whole build").
+    // Copy that fix: it wraps each iteration in try/catch and returns a
+    // `SkillPackageOutcome` discriminated union (`built` | `failed`) carrying the error,
+    // deliberately NOT a synthetic `PackageSkillResult` (which would have to invent
+    // `outputPath`/`skill`/`files`, so consumers would report a file count for a bundle
+    // that is not on disk).
+    //
+    // Why it matters concretely: a `vat build` on a 90-skill adopter (2026-07-30) hit 3
+    // filename collisions across three separate skills and, thanks to `packageSkills`'
+    // containment, still built the other 87. This lane would have thrown all 90 away.
+    //
+    // Note the containment this lane lacks is for a skill that THROWS, and a filename
+    // collision no longer throws — it is a returned finding. The remaining throw paths
+    // are an absent or unreadable `files:` source; do not use a collision as the fixture
+    // when adding that guard, or the test will pass without the guard existing.
     for (const { skillDirPath, skillPath, skillName } of input.skills) {
         // Per-skill config is keyed by the skill's declared NAME; the directory path and
         // its trailing segment are fallbacks for the common cases where they coincide.
@@ -483,30 +552,90 @@ async function packagePluginLocalSkills(input) {
             input.skillsConfig?.config?.[skillDirPath] ??
             input.skillsConfig?.config?.[lastPathSegment(skillDirPath)]);
         const skillOutputDir = safePath.join(input.pluginDir, 'skills', skillDirPath);
-        const result = await packageSkill(skillPath, packagingConfigToPackageOptions(packagingConfig, { skillPath, outputPath: skillOutputDir }));
+        // KNOWN GAP — false ALLOW_UNUSED for plugin-local skills. If you are here, please
+        // consider fixing it while the hood is open.
+        //
+        // This loop omits `allowLedger`, and omitting it is a positive claim that THIS
+        // call is the whole run (see PackageSkillOptions.allowLedger). That claim is FALSE
+        // here: we are looping. `validation.allow` is declared once per package but matched
+        // once per skill, so an entry matched while packaging skill A is reported unused
+        // while packaging skill B. `vat skills build` had exactly this bug and fixed it by
+        // creating one ledger for the invocation, threading it through, and draining it
+        // once after the last skill — see `runSkillBuild` in ../../skills/build.ts, which
+        // is the model to copy.
+        //
+        // Why it is not fixed here: this lane has no channel for RUN-level issues in its
+        // YAML output (every issue it reports is attributed to a skill dir), and inventing
+        // a second reporting shape was worse than leaving one honest comment. Fixing this
+        // properly means adding that channel first.
+        //
+        // Why it measures zero today: VAT's own plugins are assembled from the shared skill
+        // pool by copy-in, so this loop packages nothing. A project with plugin-local
+        // `skills/` directories AND package-scoped `validation.allow` entries still sees the
+        // false warnings. This is also the last thing blocking a promotion of ALLOW_UNUSED
+        // from `warning` to `error`, which would turn those false positives into hard build
+        // failures.
+        //
+        // That promotion is now MEASURABLE rather than open-ended. On the 90-skill adopter
+        // (2026-07-30) this lane's ledger drains to 17 unused allow entries, against 14 in
+        // the `vat skills build` (`skills`) lane — so the work this comment gates is a
+        // bounded 17-entry reconciliation, not an unbounded one. UNVERIFIED how much of the
+        // 17 - 14 delta is the false-positive class described above versus genuinely dead
+        // entries; nobody has classified them entry by entry.
+        const result = await packageSkill(skillPath, {
+            ...packagingConfigToPackageOptions(packagingConfig, { skillPath, outputPath: skillOutputDir }, input.projectSkills),
+            registry: input.registry,
+        });
         input.logger.info(`         ${skillName} -> skills/${skillDirPath} (${result.files.dependencies.length + 1} files)`);
         packaged.push({ skillDirPath, result });
     }
     return packaged;
 }
 /**
- * Report post-build issues for the plugin-local skills and return the names that
- * emitted errors. Mirrors `vat skills build`: a skill whose packaged output fails
- * validation fails the build, so the two lanes hold the same bar. This is new
- * enforcement for plugin-local skills — the verbatim tree-copy never validated
- * anything it shipped.
+ * Summarize post-build issues for the plugin-local skills: the lines to print,
+ * the dirs that emitted errors, and the per-severity distribution.
+ *
+ * Mirrors `vat skills build`: a skill whose packaged output fails validation
+ * fails the build, so the two lanes hold the same bar, and they now render
+ * findings through the same helper — this lane used to label every non-error
+ * severity `[WARNING]`, so `info` findings were reported as warnings, and it
+ * read only `postBuildIssues`, so a skill failing purely on the built-output
+ * validation aborted the plugin build with no issue text at all.
+ *
+ * `verbose` governs the RENDERED lines and nothing else: `withErrors` (what the
+ * caller fails the plugin on) and `issueCounts` (what stdout publishes) are
+ * computed from the whole set at every verbosity, so quieting the report cannot
+ * quiet the gate. Per the shared policy in `issuesToRenderAtVerbosity`, errors
+ * always get a full block; warnings and info collapse into the per-skill heading
+ * above them, which still names the complete severity breakdown.
+ *
+ * Pure so the whole rendered set is assertable.
  */
-function reportPackagedSkillIssues(packaged, logger) {
+export function summarizePackagedSkillIssues(packaged, verbose) {
+    const lines = [];
     const withErrors = [];
+    const perSkillCounts = [];
     for (const { skillDirPath, result } of packaged) {
-        for (const issue of result.postBuildIssues ?? []) {
-            const prefix = issue.severity === 'error' ? 'ERROR' : 'WARNING';
-            logger.info(`         [${prefix}] [${String(issue.code)}] ${String(issue.message)}`);
+        const issues = collectPostBuildIssues(result);
+        perSkillCounts.push(countBySeverity(issues));
+        if (issues.length > 0) {
+            lines.push(`         ${skillDirPath}: ${formatIssueSetHeading(issues, 'post-build')}`);
+            for (const issue of issuesToRenderAtVerbosity(issues, verbose)) {
+                lines.push(...formatIssueLines(issue, '         '));
+            }
         }
         if (result.hasErrors)
             withErrors.push(skillDirPath);
     }
-    return withErrors;
+    return { lines, withErrors, issueCounts: sumSeverityCounts(perSkillCounts) };
+}
+/** Print the summary to stderr and return what the caller gates on. */
+function reportPackagedSkillIssues(packaged, logger, verbose) {
+    const { lines, withErrors, issueCounts } = summarizePackagedSkillIssues(packaged, verbose);
+    for (const line of lines) {
+        logger.info(line);
+    }
+    return { withErrors, issueCounts };
 }
 /**
  * Split the plugin's own skills into those that COLLIDE with its resolved pool
@@ -554,7 +683,7 @@ function resolveCollidingSkills(skills, selectedSkillNames) {
     return { colliding, packageable, conflicts };
 }
 async function buildPlugin(input) {
-    const { marketplaceName, pluginDef, marketplaceAvailable, configDir, skillsConfig, owner, rootVersion, logger } = input;
+    const { marketplaceName, pluginDef, marketplaceAvailable, configDir, skillsConfig, owner, rootVersion, registry, projectSkills, logger, verbose } = input;
     const pluginDir = getPluginOutputDir(configDir, marketplaceName, pluginDef.name);
     const pluginSourceDir = getPluginSourceDir(configDir, pluginDef);
     logger.info(`      Building plugin: ${pluginDef.name}`);
@@ -621,9 +750,11 @@ async function buildPlugin(input) {
         skills: packageable,
         pluginDir,
         skillsConfig,
+        registry,
+        projectSkills,
         logger,
     });
-    const skillsWithErrors = reportPackagedSkillIssues(packagedLocalSkills, logger);
+    const { withErrors: skillsWithErrors, issueCounts: localSkillIssueCounts } = reportPackagedSkillIssues(packagedLocalSkills, logger, verbose);
     if (skillsWithErrors.length > 0) {
         throw new Error(`Plugin '${pluginDef.name}': ${skillsWithErrors.length} plugin-local skill(s) emitted ` +
             `post-build validation errors: ${skillsWithErrors.join(', ')}`);
@@ -677,7 +808,7 @@ async function buildPlugin(input) {
     // truth that flows into both the merged plugin.json and marketplace.json.
     const authorJson = readAuthorPluginJson(pluginSourceDir);
     const pluginVersion = resolveVersion(pluginDef, authorJson, rootVersion, { warn: (message) => logger.info(`warning: ${message}`) });
-    await writeMergedPluginJson(pluginDef, authorJson, pluginVersion, pluginDir, owner, logger);
+    const pluginAuthor = await writeMergedPluginJson(pluginDef, authorJson, pluginVersion, pluginDir, owner, logger);
     // Phase 6: per-plugin CHANGELOG copy. Resolves to <pluginSourceDir>/CHANGELOG.md
     // by default, or `entry.changelog` (relative to plugin source) when configured.
     // No-op when neither resolves — marketplace-level CHANGELOG (handled in
@@ -691,6 +822,7 @@ async function buildPlugin(input) {
         pluginName: pluginDef.name,
         pluginDir,
         pluginVersion,
+        pluginAuthor,
         skillsCopied,
         commandsCopied: treeResult.commandsCopied,
         hooksCopied: treeResult.hooksCopied,
@@ -699,6 +831,7 @@ async function buildPlugin(input) {
         treeFilesCopied: treeResult.filesCopied,
         explicitFilesCopied,
         localSkillsPackaged,
+        localSkillIssueCounts,
     };
 }
 //# sourceMappingURL=build.js.map