@vibe-agent-toolkit/vat-development-agents 0.1.32-rc.4 → 0.1.32

package/dist/.claude/plugins/marketplaces/vat-skills/plugins/vibe-agent-toolkit/skills/distribution/resources/vat-install-architecture.md

@@ -1,229 +0,0 @@
----
-name: install
-description: VAT skill/plugin install and uninstall architecture — what's supported, what isn't, and the full design vision across file-based, cloud, MDM, and enterprise-CI methods. Read before designing any install/uninstall feature.
----
-
-# VAT Skill Install & Uninstall: Architecture and Vision
-
-## The Problem Space
-
-Skills and plugins need to reach users' Claude installations through several distinct
-delivery channels. Each channel has different operators (developers, IT, Anthropic),
-different trust levels, and different UX requirements. VAT today only covers one of
-these channels.
-
-This document defines the full landscape, what VAT currently supports, what it does
-not, and the architectural direction for each gap.
-
----
-
-## Install Method Landscape
-
-| Method | Operator | Current State | Notes |
-|--------|----------|---------------|-------|
-| **File-based: Code CLI** | Developer / IT | ✅ Supported | `~/.claude/plugins/` — only supported method |
-| **File-based: Claude Desktop** | Developer / IT | ❌ Not supported | Different config path; same file structure expected |
-| **npm postinstall** | IT / end-user | ✅ Supported | Requires `vibe-agent-toolkit` as runtime dep |
-| **Managed settings file** | IT / Enterprise | ✅ Partial | `vat verify` validates; deployment is out of scope |
-| **MDM-driven npm install** | IT | ✅ Works (via postinstall) | Jamf/SCCM/Intune runs `npm install -g` |
-| **Anthropic Cloud / claude.ai org** | Org admin | ❌ Not supported | No API available; future Anthropic feature |
-| **GitHub CI enterprise push** | IT / DevOps | ❌ Not supported | VAT design vision — see below |
-| **Shared network registry** | IT | ❌ Not supported | Internal npm registry approach |
-
----
-
-## What VAT Currently Supports
-
-### File-based install: Claude Code CLI only
-
-`vat skills install` and `vat skills uninstall` operate exclusively on:
-```
-~/.claude/
-├── plugins/
-│   ├── marketplaces/<marketplace>/plugins/<plugin>/   ← plugin files
-│   ├── cache/<marketplace>/<plugin>/<version>/        ← version cache
-│   ├── known_marketplaces.json
-│   └── installed_plugins.json
-├── skills/                                            ← legacy skills (no plugin system)
-└── settings.json                                      ← enabledPlugins, permissions
-```
-
-This is the **Claude Code CLI** configuration directory. It is the only path VAT
-resolves. Claude Desktop uses a different path (see below) and is out of scope.
-
-### Install sources (all resolve to the file-based method above)
-
-```bash
-# npm package (downloads, extracts, copies plugin tree)
-vat skills install npm:@myorg/my-skills
-
-# Local directory (copies plugin tree from local path)
-vat skills install ./path/to/package
-
-# ZIP file
-vat skills install ./my-skills.zip
-
-# npm postinstall hook (triggered by npm install -g)
-# package.json: "postinstall": "node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall"
-```
-
-### Uninstall (current state)
-
-`vat skills uninstall` removes skills from `~/.claude/skills/` only. It does NOT
-remove plugin-system installs (the `~/.claude/plugins/` tree).
-
-**A full `vat plugins uninstall` command does not yet exist.** See design notes below.
-
----
-
-## What VAT Does NOT Support (and Why)
-
-### Claude Desktop file-based installs
-
-Claude Desktop on macOS uses `~/Library/Application Support/Claude/` rather than
-`~/.claude/`. On Windows it uses `%APPDATA%\Claude\`.
-
-**Why not supported today**: VAT's `getClaudeUserPaths()` is hardcoded to `~/.claude/`.
-Extending it requires detecting which applications are installed and resolving both
-paths. This is well-understood work with no architectural unknowns.
-
-**Architectural note**: When implemented, both paths should be handled by a single
-`getClaudeInstallTargets()` function returning multiple targets. CLI commands gain a
-`--target code-cli|desktop|all` flag. Default is `code-cli` until Desktop path
-handling is verified stable.
-
-### Anthropic Cloud / claude.ai organization-level skills
-
-Anthropic operates a cloud-based skill system for claude.ai. Organization admins can
-manage skills for all users through the admin console. VAT has no integration with
-this system today because Anthropic has not published a public API for programmatic
-management.
-
-**Architectural note**: When Anthropic publishes an org management API, VAT should
-add `vat skills publish --target claude-ai` as a first-class install method. The
-`dist/` artifacts from `vat build` are format-compatible with this target. The gap
-is authentication and the API itself.
-
-### GitHub CI enterprise push (vision)
-
-The goal: a GitHub Actions workflow in a skills repository automatically deploys
-skills to all users in an enterprise whenever a new version is merged to main.
-
-This is a multi-layer problem with several viable approaches:
-
-#### Approach A: MDM-integrated npm publish (recommended near-term)
-```
-GitHub Actions on release →
-  npm publish @myorg/my-skills →
-    MDM policy (Jamf/SCCM/Intune) detects new package version →
-      Runs: npm install -g @myorg/my-skills
-        → postinstall hook installs plugin to user's ~/.claude/
-```
-VAT already supports this end-to-end. The MDM layer is outside VAT's scope and is
-configured by IT using standard MDM software management policies. The VAT piece is
-complete; IT must configure the npm-to-MDM trigger.
-
-#### Approach B: Managed settings deployment (near-term, no MDM required)
-```
-GitHub Actions on release →
-  vat build &&
-  Generates managed-settings.json with plugin enablement →
-    Deploys managed-settings.json to shared network path or cloud storage →
-      Claude Code reads managed-settings.json at startup
-```
-`vat verify` validates `managed-settings.json` today. The deployment step is IT's
-responsibility. This approach requires no per-machine npm install; Claude Code reads
-the settings file directly if it is placed at the expected path or if the path is
-configured.
-
-**Gap**: VAT does not yet have a `vat claude deploy` command that handles the push
-step. Adding this would require IT to configure cloud storage credentials once.
-
-#### Approach C: Anthropic org API (long-term, requires Anthropic)
-```
-GitHub Actions on release →
-  vat skills publish --target claude-ai --org myorg →
-    Anthropic API activates skills for all org users in claude.ai
-```
-Blocked on Anthropic publishing an org management API. VAT's `dist/` output format
-is already designed for this target.
-
----
-
-## `vat plugins uninstall` — Design Intent
-
-A `vat plugins uninstall <plugin>@<marketplace>` command should exist but does not yet.
-
-### What it must reverse
-
-Uninstalling a plugin installed via the file-based method requires reversing 5 artifacts:
-
-1. Delete `~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin>/`
-2. Delete `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/`
-3. Remove `<plugin>@<marketplace>` from `installed_plugins.json`
-4. Remove `<marketplace>` from `known_marketplaces.json` if no plugins remain
-5. Remove `enabledPlugins[<plugin>@<marketplace>]` from `settings.json`
-
-### Design decisions
-
-- **Idempotent**: exit 0 if plugin not found — safe for IT automation scripts
-- **Not-VAT-installed case**: if plugin directory exists but no registry entries, delete
-  the directory and clean settings.json; emit a warning that the plugin was not
-  installed via VAT
-- **`--dry-run`**: show what would be deleted without deleting (follow `vat skills uninstall` pattern)
-- **`--target`**: code-cli | desktop | all (default: code-cli until Desktop is implemented)
-- **`vat plugins list`**: companion command to show installed plugins — needed for
-  discoverability before uninstalling
-
-### Implementation location
-
-Per the CLI "dumb orchestration" principle:
-- Logic: `packages/claude-marketplace/src/install/plugin-uninstall.ts` (new file alongside plugin-registry.ts)
-- CLI: `packages/cli/src/commands/plugins/uninstall.ts` (thin wrapper)
-- New command group: `vat plugins` with subcommands `list` and `uninstall`
-
----
-
-## Guidance for Adopters
-
-### For end-user / IT-managed deployments (recommended)
-
-Add `vibe-agent-toolkit` as a **runtime dependency** (not devDependencies) and use
-the local node_modules binary in postinstall. Never assume `vat` is globally installed.
-
-```json
-{
-  "dependencies": { "vibe-agent-toolkit": "latest" },
-  "scripts": {
-    "postinstall": "node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall || exit 0"
-  }
-}
-```
-
-IT runs: `npm install -g @myorg/my-skills` — no other tools required on the user's machine.
-
-For private GitHub Packages registries, IT pre-configures `.npmrc` with a read-only
-token for the `@myorg` scope. End users do not need to know about registries or tokens.
-
-### For developer self-install
-
-```bash
-npx vibe-agent-toolkit skills install npm:@myorg/my-skills
-```
-
-### For enterprise CI (near-term best option)
-
-Use Approach A (MDM-integrated npm publish) or Approach B (managed-settings deployment).
-Both work today with no additional VAT features.
-
----
-
-## What Is Out of Scope for VAT
-
-VAT is a **packaging and local install tool**. The following are permanently out of scope:
-
-- MDM software management configuration (Jamf, SCCM, Intune policies)
-- Internal npm registry setup and authentication management
-- Anthropic cloud API authentication or org provisioning
-- Per-user credential management for private registries
-- Claude Desktop configuration (until Desktop and Code CLI paths converge)

package/dist/.claude/plugins/marketplaces/vat-skills/plugins/vibe-agent-toolkit/skills/install/SKILL.md

@@ -1,229 +0,0 @@
----
-name: install
-description: VAT skill/plugin install and uninstall architecture — what's supported, what isn't, and the full design vision across file-based, cloud, MDM, and enterprise-CI methods. Read before designing any install/uninstall feature.
----
-
-# VAT Skill Install & Uninstall: Architecture and Vision
-
-## The Problem Space
-
-Skills and plugins need to reach users' Claude installations through several distinct
-delivery channels. Each channel has different operators (developers, IT, Anthropic),
-different trust levels, and different UX requirements. VAT today only covers one of
-these channels.
-
-This document defines the full landscape, what VAT currently supports, what it does
-not, and the architectural direction for each gap.
-
----
-
-## Install Method Landscape
-
-| Method | Operator | Current State | Notes |
-|--------|----------|---------------|-------|
-| **File-based: Code CLI** | Developer / IT | ✅ Supported | `~/.claude/plugins/` — only supported method |
-| **File-based: Claude Desktop** | Developer / IT | ❌ Not supported | Different config path; same file structure expected |
-| **npm postinstall** | IT / end-user | ✅ Supported | Requires `vibe-agent-toolkit` as runtime dep |
-| **Managed settings file** | IT / Enterprise | ✅ Partial | `vat verify` validates; deployment is out of scope |
-| **MDM-driven npm install** | IT | ✅ Works (via postinstall) | Jamf/SCCM/Intune runs `npm install -g` |
-| **Anthropic Cloud / claude.ai org** | Org admin | ❌ Not supported | No API available; future Anthropic feature |
-| **GitHub CI enterprise push** | IT / DevOps | ❌ Not supported | VAT design vision — see below |
-| **Shared network registry** | IT | ❌ Not supported | Internal npm registry approach |
-
----
-
-## What VAT Currently Supports
-
-### File-based install: Claude Code CLI only
-
-`vat skills install` and `vat skills uninstall` operate exclusively on:
-```
-~/.claude/
-├── plugins/
-│   ├── marketplaces/<marketplace>/plugins/<plugin>/   ← plugin files
-│   ├── cache/<marketplace>/<plugin>/<version>/        ← version cache
-│   ├── known_marketplaces.json
-│   └── installed_plugins.json
-├── skills/                                            ← legacy skills (no plugin system)
-└── settings.json                                      ← enabledPlugins, permissions
-```
-
-This is the **Claude Code CLI** configuration directory. It is the only path VAT
-resolves. Claude Desktop uses a different path (see below) and is out of scope.
-
-### Install sources (all resolve to the file-based method above)
-
-```bash
-# npm package (downloads, extracts, copies plugin tree)
-vat skills install npm:@myorg/my-skills
-
-# Local directory (copies plugin tree from local path)
-vat skills install ./path/to/package
-
-# ZIP file
-vat skills install ./my-skills.zip
-
-# npm postinstall hook (triggered by npm install -g)
-# package.json: "postinstall": "node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall"
-```
-
-### Uninstall (current state)
-
-`vat skills uninstall` removes skills from `~/.claude/skills/` only. It does NOT
-remove plugin-system installs (the `~/.claude/plugins/` tree).
-
-**A full `vat plugins uninstall` command does not yet exist.** See design notes below.
-
----
-
-## What VAT Does NOT Support (and Why)
-
-### Claude Desktop file-based installs
-
-Claude Desktop on macOS uses `~/Library/Application Support/Claude/` rather than
-`~/.claude/`. On Windows it uses `%APPDATA%\Claude\`.
-
-**Why not supported today**: VAT's `getClaudeUserPaths()` is hardcoded to `~/.claude/`.
-Extending it requires detecting which applications are installed and resolving both
-paths. This is well-understood work with no architectural unknowns.
-
-**Architectural note**: When implemented, both paths should be handled by a single
-`getClaudeInstallTargets()` function returning multiple targets. CLI commands gain a
-`--target code-cli|desktop|all` flag. Default is `code-cli` until Desktop path
-handling is verified stable.
-
-### Anthropic Cloud / claude.ai organization-level skills
-
-Anthropic operates a cloud-based skill system for claude.ai. Organization admins can
-manage skills for all users through the admin console. VAT has no integration with
-this system today because Anthropic has not published a public API for programmatic
-management.
-
-**Architectural note**: When Anthropic publishes an org management API, VAT should
-add `vat skills publish --target claude-ai` as a first-class install method. The
-`dist/` artifacts from `vat build` are format-compatible with this target. The gap
-is authentication and the API itself.
-
-### GitHub CI enterprise push (vision)
-
-The goal: a GitHub Actions workflow in a skills repository automatically deploys
-skills to all users in an enterprise whenever a new version is merged to main.
-
-This is a multi-layer problem with several viable approaches:
-
-#### Approach A: MDM-integrated npm publish (recommended near-term)
-```
-GitHub Actions on release →
-  npm publish @myorg/my-skills →
-    MDM policy (Jamf/SCCM/Intune) detects new package version →
-      Runs: npm install -g @myorg/my-skills
-        → postinstall hook installs plugin to user's ~/.claude/
-```
-VAT already supports this end-to-end. The MDM layer is outside VAT's scope and is
-configured by IT using standard MDM software management policies. The VAT piece is
-complete; IT must configure the npm-to-MDM trigger.
-
-#### Approach B: Managed settings deployment (near-term, no MDM required)
-```
-GitHub Actions on release →
-  vat build &&
-  Generates managed-settings.json with plugin enablement →
-    Deploys managed-settings.json to shared network path or cloud storage →
-      Claude Code reads managed-settings.json at startup
-```
-`vat verify` validates `managed-settings.json` today. The deployment step is IT's
-responsibility. This approach requires no per-machine npm install; Claude Code reads
-the settings file directly if it is placed at the expected path or if the path is
-configured.
-
-**Gap**: VAT does not yet have a `vat claude deploy` command that handles the push
-step. Adding this would require IT to configure cloud storage credentials once.
-
-#### Approach C: Anthropic org API (long-term, requires Anthropic)
-```
-GitHub Actions on release →
-  vat skills publish --target claude-ai --org myorg →
-    Anthropic API activates skills for all org users in claude.ai
-```
-Blocked on Anthropic publishing an org management API. VAT's `dist/` output format
-is already designed for this target.
-
----
-
-## `vat plugins uninstall` — Design Intent
-
-A `vat plugins uninstall <plugin>@<marketplace>` command should exist but does not yet.
-
-### What it must reverse
-
-Uninstalling a plugin installed via the file-based method requires reversing 5 artifacts:
-
-1. Delete `~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin>/`
-2. Delete `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/`
-3. Remove `<plugin>@<marketplace>` from `installed_plugins.json`
-4. Remove `<marketplace>` from `known_marketplaces.json` if no plugins remain
-5. Remove `enabledPlugins[<plugin>@<marketplace>]` from `settings.json`
-
-### Design decisions
-
-- **Idempotent**: exit 0 if plugin not found — safe for IT automation scripts
-- **Not-VAT-installed case**: if plugin directory exists but no registry entries, delete
-  the directory and clean settings.json; emit a warning that the plugin was not
-  installed via VAT
-- **`--dry-run`**: show what would be deleted without deleting (follow `vat skills uninstall` pattern)
-- **`--target`**: code-cli | desktop | all (default: code-cli until Desktop is implemented)
-- **`vat plugins list`**: companion command to show installed plugins — needed for
-  discoverability before uninstalling
-
-### Implementation location
-
-Per the CLI "dumb orchestration" principle:
-- Logic: `packages/claude-marketplace/src/install/plugin-uninstall.ts` (new file alongside plugin-registry.ts)
-- CLI: `packages/cli/src/commands/plugins/uninstall.ts` (thin wrapper)
-- New command group: `vat plugins` with subcommands `list` and `uninstall`
-
----
-
-## Guidance for Adopters
-
-### For end-user / IT-managed deployments (recommended)
-
-Add `vibe-agent-toolkit` as a **runtime dependency** (not devDependencies) and use
-the local node_modules binary in postinstall. Never assume `vat` is globally installed.
-
-```json
-{
-  "dependencies": { "vibe-agent-toolkit": "latest" },
-  "scripts": {
-    "postinstall": "node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall || exit 0"
-  }
-}
-```
-
-IT runs: `npm install -g @myorg/my-skills` — no other tools required on the user's machine.
-
-For private GitHub Packages registries, IT pre-configures `.npmrc` with a read-only
-token for the `@myorg` scope. End users do not need to know about registries or tokens.
-
-### For developer self-install
-
-```bash
-npx vibe-agent-toolkit skills install npm:@myorg/my-skills
-```
-
-### For enterprise CI (near-term best option)
-
-Use Approach A (MDM-integrated npm publish) or Approach B (managed-settings deployment).
-Both work today with no additional VAT features.
-
----
-
-## What Is Out of Scope for VAT
-
-VAT is a **packaging and local install tool**. The following are permanently out of scope:
-
-- MDM software management configuration (Jamf, SCCM, Intune policies)
-- Internal npm registry setup and authentication management
-- Anthropic cloud API authentication or org provisioning
-- Per-user credential management for private registries
-- Claude Desktop configuration (until Desktop and Code CLI paths converge)

package/dist/generated/resources/skills/vat-debugging.js

@@ -1,48 +0,0 @@
-/**
- * Generated from markdown file - DO NOT EDIT
- */
-
-export const meta = {
-  name: "debugging",
-  description: "Debug unexpected VAT behavior, reproduce bugs, test local vibe-agent-toolkit changes in adopter projects (VAT_ROOT_DIR), write failing tests before fixing, and validate fixes with the full build pipeline before publishing"
-};
-
-export const text = "\n# Debugging & Testing VAT Fixes\n\nUse this skill when VAT itself is behaving unexpectedly, you suspect a VAT bug,\nor you need to test a local code change to vibe-agent-toolkit in another project.\n\n## Step 1: Confirm the Version\n\nFirst, confirm which version of VAT is running:\n\n\`\`\`bash\n# In the adopter project\ncat node_modules/@vibe-agent-toolkit/cli/package.json | grep \'\"version\"\'\n\n# Or check the binary directly\nvat --version\n\`\`\`\n\nIf the installed version is behind the monorepo, you may need \`VAT_ROOT_DIR\` (see below)\nto test with the local build instead.\n\n## Step 2: Enable Debug Output\n\n\`\`\`bash\nVAT_DEBUG=1 vat <command>\n\`\`\`\n\n\`VAT_DEBUG=1\` prints context detection info, binary path resolution, and config loading\ndetails. Use it to confirm which config file and which binary are actually being used.\n\nOther useful env vars:\n- \`VAT_TEST_ROOT=/path\` — Override the project root VAT uses (skips \`.git\` detection)\n- \`VAT_TEST_CONFIG=/path/to/config.yaml\` — Override the config file path\n\n## Step 3: Reproduce With the Local Monorepo Build\n\nTo test a fix from your local vibe-agent-toolkit checkout in an adopter project\n(e.g. lfa-cc-marketplace) **without publishing to npm**:\n\n### Option A: VAT_ROOT_DIR (recommended)\n\n\`\`\`bash\n# In your shell (or .env.local in the adopter project)\nexport VAT_ROOT_DIR=/path/to/vibe-agent-toolkit\n\n# Build the monorepo first — always required\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Now any vat command in the adopter project uses your local build\ncd /path/to/adopter-project\nvat resources validate .\n\`\`\`\n\nThe globally-installed \`vat\` wrapper detects \`VAT_ROOT_DIR\` and re-dispatches\nto \`$VAT_ROOT_DIR/packages/cli/dist/bin.js\`.\n\n### Option B: Direct path (no global install needed)\n\n\`\`\`bash\n# Build first\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Then invoke directly\nnode /path/to/vibe-agent-toolkit/packages/cli/dist/bin/vat.js resources validate .\n\`\`\`\n\n## Step 4: Write a Failing Test Before Fixing\n\nBefore changing VAT source code, write a test that reproduces the bug:\n\n- **Unit bug** → add a test in \`packages/<package>/test/\`\n- **CLI behavior** → add an integration test in \`packages/cli/test/integration/\`\n- **End-to-end workflow** → add a system test in \`packages/cli/test/system/\`\n\nSee [docs/writing-tests.md](../../../../docs/writing-tests.md) for test patterns and\nthe unit/integration/system classification guide.\n\n## Step 5: Validate Before Committing\n\nAfter fixing, run the full pipeline from the monorepo root:\n\n\`\`\`bash\nbun run validate\n\`\`\`\n\nThis runs unit → integration → system tests with caching. If tests pass, the fix\nis safe to commit. Do not commit until \`bun run validate\` passes.\n\n## Quick Diagnosis Checklist\n\n| Symptom | First thing to check |\n|---|---|\n| \`vat\` command not found | \`npm install -g vibe-agent-toolkit\` |\n| Wrong results in adopter project | Confirm installed version matches expected RC |\n| Fix applied but adopter still wrong | Did you \`bun run build\` after the change? |\n| Validation slow every time | \`git rev-parse --git-dir\` — are you in a git repo? |\n| Config not loading | \`VAT_DEBUG=1 vat <command>\` to see which config is found |\n| Test passes locally, fails CI | Windows path separator? Use \`toForwardSlash()\` from \`@vibe-agent-toolkit/utils\` |\n\n## See Also\n\n- [docs/debug-and-test-vat-fixes.md](../../../../docs/debug-and-test-vat-fixes.md) — Full reference\n- [docs/writing-tests.md](../../../../docs/writing-tests.md) — Test patterns and classification\n- [packages/cli/CLAUDE.md](../../../cli/CLAUDE.md) — CLI development guidelines\n";
-
-export const fragments = {
-  step1ConfirmTheVersion: {
-    header: "## Step 1: Confirm the Version",
-    body: "First, confirm which version of VAT is running:\n\n\`\`\`bash\n# In the adopter project\ncat node_modules/@vibe-agent-toolkit/cli/package.json | grep \'\"version\"\'\n\n# Or check the binary directly\nvat --version\n\`\`\`\n\nIf the installed version is behind the monorepo, you may need \`VAT_ROOT_DIR\` (see below)\nto test with the local build instead.",
-    text: "## Step 1: Confirm the Version\n\nFirst, confirm which version of VAT is running:\n\n\`\`\`bash\n# In the adopter project\ncat node_modules/@vibe-agent-toolkit/cli/package.json | grep \'\"version\"\'\n\n# Or check the binary directly\nvat --version\n\`\`\`\n\nIf the installed version is behind the monorepo, you may need \`VAT_ROOT_DIR\` (see below)\nto test with the local build instead."
-  },
-  step2EnableDebugOutput: {
-    header: "## Step 2: Enable Debug Output",
-    body: "\`\`\`bash\nVAT_DEBUG=1 vat <command>\n\`\`\`\n\n\`VAT_DEBUG=1\` prints context detection info, binary path resolution, and config loading\ndetails. Use it to confirm which config file and which binary are actually being used.\n\nOther useful env vars:\n- \`VAT_TEST_ROOT=/path\` — Override the project root VAT uses (skips \`.git\` detection)\n- \`VAT_TEST_CONFIG=/path/to/config.yaml\` — Override the config file path",
-    text: "## Step 2: Enable Debug Output\n\n\`\`\`bash\nVAT_DEBUG=1 vat <command>\n\`\`\`\n\n\`VAT_DEBUG=1\` prints context detection info, binary path resolution, and config loading\ndetails. Use it to confirm which config file and which binary are actually being used.\n\nOther useful env vars:\n- \`VAT_TEST_ROOT=/path\` — Override the project root VAT uses (skips \`.git\` detection)\n- \`VAT_TEST_CONFIG=/path/to/config.yaml\` — Override the config file path"
-  },
-  step3ReproduceWithTheLocalMonorepoBuild: {
-    header: "## Step 3: Reproduce With the Local Monorepo Build",
-    body: "To test a fix from your local vibe-agent-toolkit checkout in an adopter project\n(e.g. lfa-cc-marketplace) **without publishing to npm**:\n\n### Option A: VAT_ROOT_DIR (recommended)\n\n\`\`\`bash\n# In your shell (or .env.local in the adopter project)\nexport VAT_ROOT_DIR=/path/to/vibe-agent-toolkit\n\n# Build the monorepo first — always required\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Now any vat command in the adopter project uses your local build\ncd /path/to/adopter-project\nvat resources validate .\n\`\`\`\n\nThe globally-installed \`vat\` wrapper detects \`VAT_ROOT_DIR\` and re-dispatches\nto \`$VAT_ROOT_DIR/packages/cli/dist/bin.js\`.\n\n### Option B: Direct path (no global install needed)\n\n\`\`\`bash\n# Build first\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Then invoke directly\nnode /path/to/vibe-agent-toolkit/packages/cli/dist/bin/vat.js resources validate .\n\`\`\`",
-    text: "## Step 3: Reproduce With the Local Monorepo Build\n\nTo test a fix from your local vibe-agent-toolkit checkout in an adopter project\n(e.g. lfa-cc-marketplace) **without publishing to npm**:\n\n### Option A: VAT_ROOT_DIR (recommended)\n\n\`\`\`bash\n# In your shell (or .env.local in the adopter project)\nexport VAT_ROOT_DIR=/path/to/vibe-agent-toolkit\n\n# Build the monorepo first — always required\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Now any vat command in the adopter project uses your local build\ncd /path/to/adopter-project\nvat resources validate .\n\`\`\`\n\nThe globally-installed \`vat\` wrapper detects \`VAT_ROOT_DIR\` and re-dispatches\nto \`$VAT_ROOT_DIR/packages/cli/dist/bin.js\`.\n\n### Option B: Direct path (no global install needed)\n\n\`\`\`bash\n# Build first\ncd /path/to/vibe-agent-toolkit && bun run build\n\n# Then invoke directly\nnode /path/to/vibe-agent-toolkit/packages/cli/dist/bin/vat.js resources validate .\n\`\`\`"
-  },
-  step4WriteAFailingTestBeforeFixing: {
-    header: "## Step 4: Write a Failing Test Before Fixing",
-    body: "Before changing VAT source code, write a test that reproduces the bug:\n\n- **Unit bug** → add a test in \`packages/<package>/test/\`\n- **CLI behavior** → add an integration test in \`packages/cli/test/integration/\`\n- **End-to-end workflow** → add a system test in \`packages/cli/test/system/\`\n\nSee [docs/writing-tests.md](../../../../docs/writing-tests.md) for test patterns and\nthe unit/integration/system classification guide.",
-    text: "## Step 4: Write a Failing Test Before Fixing\n\nBefore changing VAT source code, write a test that reproduces the bug:\n\n- **Unit bug** → add a test in \`packages/<package>/test/\`\n- **CLI behavior** → add an integration test in \`packages/cli/test/integration/\`\n- **End-to-end workflow** → add a system test in \`packages/cli/test/system/\`\n\nSee [docs/writing-tests.md](../../../../docs/writing-tests.md) for test patterns and\nthe unit/integration/system classification guide."
-  },
-  step5ValidateBeforeCommitting: {
-    header: "## Step 5: Validate Before Committing",
-    body: "After fixing, run the full pipeline from the monorepo root:\n\n\`\`\`bash\nbun run validate\n\`\`\`\n\nThis runs unit → integration → system tests with caching. If tests pass, the fix\nis safe to commit. Do not commit until \`bun run validate\` passes.",
-    text: "## Step 5: Validate Before Committing\n\nAfter fixing, run the full pipeline from the monorepo root:\n\n\`\`\`bash\nbun run validate\n\`\`\`\n\nThis runs unit → integration → system tests with caching. If tests pass, the fix\nis safe to commit. Do not commit until \`bun run validate\` passes."
-  },
-  quickDiagnosisChecklist: {
-    header: "## Quick Diagnosis Checklist",
-    body: "| Symptom | First thing to check |\n|---|---|\n| \`vat\` command not found | \`npm install -g vibe-agent-toolkit\` |\n| Wrong results in adopter project | Confirm installed version matches expected RC |\n| Fix applied but adopter still wrong | Did you \`bun run build\` after the change? |\n| Validation slow every time | \`git rev-parse --git-dir\` — are you in a git repo? |\n| Config not loading | \`VAT_DEBUG=1 vat <command>\` to see which config is found |\n| Test passes locally, fails CI | Windows path separator? Use \`toForwardSlash()\` from \`@vibe-agent-toolkit/utils\` |",
-    text: "## Quick Diagnosis Checklist\n\n| Symptom | First thing to check |\n|---|---|\n| \`vat\` command not found | \`npm install -g vibe-agent-toolkit\` |\n| Wrong results in adopter project | Confirm installed version matches expected RC |\n| Fix applied but adopter still wrong | Did you \`bun run build\` after the change? |\n| Validation slow every time | \`git rev-parse --git-dir\` — are you in a git repo? |\n| Config not loading | \`VAT_DEBUG=1 vat <command>\` to see which config is found |\n| Test passes locally, fails CI | Windows path separator? Use \`toForwardSlash()\` from \`@vibe-agent-toolkit/utils\` |"
-  },
-  seeAlso: {
-    header: "## See Also",
-    body: "- [docs/debug-and-test-vat-fixes.md](../../../../docs/debug-and-test-vat-fixes.md) — Full reference\n- [docs/writing-tests.md](../../../../docs/writing-tests.md) — Test patterns and classification\n- [packages/cli/CLAUDE.md](../../../cli/CLAUDE.md) — CLI development guidelines",
-    text: "## See Also\n\n- [docs/debug-and-test-vat-fixes.md](../../../../docs/debug-and-test-vat-fixes.md) — Full reference\n- [docs/writing-tests.md](../../../../docs/writing-tests.md) — Test patterns and classification\n- [packages/cli/CLAUDE.md](../../../cli/CLAUDE.md) — CLI development guidelines"
-  }
-};

package/dist/generated/resources/skills/vat-install-architecture.js

@@ -1,48 +0,0 @@
-/**
- * Generated from markdown file - DO NOT EDIT
- */
-
-export const meta = {
-  name: "install",
-  description: "VAT skill/plugin install and uninstall architecture — what\'s supported, what isn\'t, and the full design vision across file-based, cloud, MDM, and enterprise-CI methods. Read before designing any install/uninstall feature."
-};
-
-export const text = "\n# VAT Skill Install & Uninstall: Architecture and Vision\n\n## The Problem Space\n\nSkills and plugins need to reach users\' Claude installations through several distinct\ndelivery channels. Each channel has different operators (developers, IT, Anthropic),\ndifferent trust levels, and different UX requirements. VAT today only covers one of\nthese channels.\n\nThis document defines the full landscape, what VAT currently supports, what it does\nnot, and the architectural direction for each gap.\n\n---\n\n## Install Method Landscape\n\n| Method | Operator | Current State | Notes |\n|--------|----------|---------------|-------|\n| **File-based: Code CLI** | Developer / IT | ✅ Supported | \`~/.claude/plugins/\` — only supported method |\n| **File-based: Claude Desktop** | Developer / IT | ❌ Not supported | Different config path; same file structure expected |\n| **npm postinstall** | IT / end-user | ✅ Supported | Requires \`vibe-agent-toolkit\` as runtime dep |\n| **Managed settings file** | IT / Enterprise | ✅ Partial | \`vat verify\` validates; deployment is out of scope |\n| **MDM-driven npm install** | IT | ✅ Works (via postinstall) | Jamf/SCCM/Intune runs \`npm install -g\` |\n| **Anthropic Cloud / claude.ai org** | Org admin | ❌ Not supported | No API available; future Anthropic feature |\n| **GitHub CI enterprise push** | IT / DevOps | ❌ Not supported | VAT design vision — see below |\n| **Shared network registry** | IT | ❌ Not supported | Internal npm registry approach |\n\n---\n\n## What VAT Currently Supports\n\n### File-based install: Claude Code CLI only\n\n\`vat skills install\` and \`vat skills uninstall\` operate exclusively on:\n\`\`\`\n~/.claude/\n├── plugins/\n│   ├── marketplaces/<marketplace>/plugins/<plugin>/   ← plugin files\n│   ├── cache/<marketplace>/<plugin>/<version>/        ← version cache\n│   ├── known_marketplaces.json\n│   └── installed_plugins.json\n├── skills/                                            ← legacy skills (no plugin system)\n└── settings.json                                      ← enabledPlugins, permissions\n\`\`\`\n\nThis is the **Claude Code CLI** configuration directory. It is the only path VAT\nresolves. Claude Desktop uses a different path (see below) and is out of scope.\n\n### Install sources (all resolve to the file-based method above)\n\n\`\`\`bash\n# npm package (downloads, extracts, copies plugin tree)\nvat skills install npm:@myorg/my-skills\n\n# Local directory (copies plugin tree from local path)\nvat skills install ./path/to/package\n\n# ZIP file\nvat skills install ./my-skills.zip\n\n# npm postinstall hook (triggered by npm install -g)\n# package.json: \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall\"\n\`\`\`\n\n### Uninstall (current state)\n\n\`vat skills uninstall\` removes skills from \`~/.claude/skills/\` only. It does NOT\nremove plugin-system installs (the \`~/.claude/plugins/\` tree).\n\n**A full \`vat plugins uninstall\` command does not yet exist.** See design notes below.\n\n---\n\n## What VAT Does NOT Support (and Why)\n\n### Claude Desktop file-based installs\n\nClaude Desktop on macOS uses \`~/Library/Application Support/Claude/\` rather than\n\`~/.claude/\`. On Windows it uses \`%APPDATA%\\Claude\\\`.\n\n**Why not supported today**: VAT\'s \`getClaudeUserPaths()\` is hardcoded to \`~/.claude/\`.\nExtending it requires detecting which applications are installed and resolving both\npaths. This is well-understood work with no architectural unknowns.\n\n**Architectural note**: When implemented, both paths should be handled by a single\n\`getClaudeInstallTargets()\` function returning multiple targets. CLI commands gain a\n\`--target code-cli|desktop|all\` flag. Default is \`code-cli\` until Desktop path\nhandling is verified stable.\n\n### Anthropic Cloud / claude.ai organization-level skills\n\nAnthropic operates a cloud-based skill system for claude.ai. Organization admins can\nmanage skills for all users through the admin console. VAT has no integration with\nthis system today because Anthropic has not published a public API for programmatic\nmanagement.\n\n**Architectural note**: When Anthropic publishes an org management API, VAT should\nadd \`vat skills publish --target claude-ai\` as a first-class install method. The\n\`dist/\` artifacts from \`vat build\` are format-compatible with this target. The gap\nis authentication and the API itself.\n\n### GitHub CI enterprise push (vision)\n\nThe goal: a GitHub Actions workflow in a skills repository automatically deploys\nskills to all users in an enterprise whenever a new version is merged to main.\n\nThis is a multi-layer problem with several viable approaches:\n\n#### Approach A: MDM-integrated npm publish (recommended near-term)\n\`\`\`\nGitHub Actions on release →\n  npm publish @myorg/my-skills →\n    MDM policy (Jamf/SCCM/Intune) detects new package version →\n      Runs: npm install -g @myorg/my-skills\n        → postinstall hook installs plugin to user\'s ~/.claude/\n\`\`\`\nVAT already supports this end-to-end. The MDM layer is outside VAT\'s scope and is\nconfigured by IT using standard MDM software management policies. The VAT piece is\ncomplete; IT must configure the npm-to-MDM trigger.\n\n#### Approach B: Managed settings deployment (near-term, no MDM required)\n\`\`\`\nGitHub Actions on release →\n  vat build &&\n  Generates managed-settings.json with plugin enablement →\n    Deploys managed-settings.json to shared network path or cloud storage →\n      Claude Code reads managed-settings.json at startup\n\`\`\`\n\`vat verify\` validates \`managed-settings.json\` today. The deployment step is IT\'s\nresponsibility. This approach requires no per-machine npm install; Claude Code reads\nthe settings file directly if it is placed at the expected path or if the path is\nconfigured.\n\n**Gap**: VAT does not yet have a \`vat claude deploy\` command that handles the push\nstep. Adding this would require IT to configure cloud storage credentials once.\n\n#### Approach C: Anthropic org API (long-term, requires Anthropic)\n\`\`\`\nGitHub Actions on release →\n  vat skills publish --target claude-ai --org myorg →\n    Anthropic API activates skills for all org users in claude.ai\n\`\`\`\nBlocked on Anthropic publishing an org management API. VAT\'s \`dist/\` output format\nis already designed for this target.\n\n---\n\n## \`vat plugins uninstall\` — Design Intent\n\nA \`vat plugins uninstall <plugin>@<marketplace>\` command should exist but does not yet.\n\n### What it must reverse\n\nUninstalling a plugin installed via the file-based method requires reversing 5 artifacts:\n\n1. Delete \`~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin>/\`\n2. Delete \`~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/\`\n3. Remove \`<plugin>@<marketplace>\` from \`installed_plugins.json\`\n4. Remove \`<marketplace>\` from \`known_marketplaces.json\` if no plugins remain\n5. Remove \`enabledPlugins[<plugin>@<marketplace>]\` from \`settings.json\`\n\n### Design decisions\n\n- **Idempotent**: exit 0 if plugin not found — safe for IT automation scripts\n- **Not-VAT-installed case**: if plugin directory exists but no registry entries, delete\n  the directory and clean settings.json; emit a warning that the plugin was not\n  installed via VAT\n- **\`--dry-run\`**: show what would be deleted without deleting (follow \`vat skills uninstall\` pattern)\n- **\`--target\`**: code-cli | desktop | all (default: code-cli until Desktop is implemented)\n- **\`vat plugins list\`**: companion command to show installed plugins — needed for\n  discoverability before uninstalling\n\n### Implementation location\n\nPer the CLI \"dumb orchestration\" principle:\n- Logic: \`packages/claude-marketplace/src/install/plugin-uninstall.ts\` (new file alongside plugin-registry.ts)\n- CLI: \`packages/cli/src/commands/plugins/uninstall.ts\` (thin wrapper)\n- New command group: \`vat plugins\` with subcommands \`list\` and \`uninstall\`\n\n---\n\n## Guidance for Adopters\n\n### For end-user / IT-managed deployments (recommended)\n\nAdd \`vibe-agent-toolkit\` as a **runtime dependency** (not devDependencies) and use\nthe local node_modules binary in postinstall. Never assume \`vat\` is globally installed.\n\n\`\`\`json\n{\n  \"dependencies\": { \"vibe-agent-toolkit\": \"latest\" },\n  \"scripts\": {\n    \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall || exit 0\"\n  }\n}\n\`\`\`\n\nIT runs: \`npm install -g @myorg/my-skills\` — no other tools required on the user\'s machine.\n\nFor private GitHub Packages registries, IT pre-configures \`.npmrc\` with a read-only\ntoken for the \`@myorg\` scope. End users do not need to know about registries or tokens.\n\n### For developer self-install\n\n\`\`\`bash\nnpx vibe-agent-toolkit skills install npm:@myorg/my-skills\n\`\`\`\n\n### For enterprise CI (near-term best option)\n\nUse Approach A (MDM-integrated npm publish) or Approach B (managed-settings deployment).\nBoth work today with no additional VAT features.\n\n---\n\n## What Is Out of Scope for VAT\n\nVAT is a **packaging and local install tool**. The following are permanently out of scope:\n\n- MDM software management configuration (Jamf, SCCM, Intune policies)\n- Internal npm registry setup and authentication management\n- Anthropic cloud API authentication or org provisioning\n- Per-user credential management for private registries\n- Claude Desktop configuration (until Desktop and Code CLI paths converge)\n";
-
-export const fragments = {
-  theProblemSpace: {
-    header: "## The Problem Space",
-    body: "Skills and plugins need to reach users\' Claude installations through several distinct\ndelivery channels. Each channel has different operators (developers, IT, Anthropic),\ndifferent trust levels, and different UX requirements. VAT today only covers one of\nthese channels.\n\nThis document defines the full landscape, what VAT currently supports, what it does\nnot, and the architectural direction for each gap.\n\n---",
-    text: "## The Problem Space\n\nSkills and plugins need to reach users\' Claude installations through several distinct\ndelivery channels. Each channel has different operators (developers, IT, Anthropic),\ndifferent trust levels, and different UX requirements. VAT today only covers one of\nthese channels.\n\nThis document defines the full landscape, what VAT currently supports, what it does\nnot, and the architectural direction for each gap.\n\n---"
-  },
-  installMethodLandscape: {
-    header: "## Install Method Landscape",
-    body: "| Method | Operator | Current State | Notes |\n|--------|----------|---------------|-------|\n| **File-based: Code CLI** | Developer / IT | ✅ Supported | \`~/.claude/plugins/\` — only supported method |\n| **File-based: Claude Desktop** | Developer / IT | ❌ Not supported | Different config path; same file structure expected |\n| **npm postinstall** | IT / end-user | ✅ Supported | Requires \`vibe-agent-toolkit\` as runtime dep |\n| **Managed settings file** | IT / Enterprise | ✅ Partial | \`vat verify\` validates; deployment is out of scope |\n| **MDM-driven npm install** | IT | ✅ Works (via postinstall) | Jamf/SCCM/Intune runs \`npm install -g\` |\n| **Anthropic Cloud / claude.ai org** | Org admin | ❌ Not supported | No API available; future Anthropic feature |\n| **GitHub CI enterprise push** | IT / DevOps | ❌ Not supported | VAT design vision — see below |\n| **Shared network registry** | IT | ❌ Not supported | Internal npm registry approach |\n\n---",
-    text: "## Install Method Landscape\n\n| Method | Operator | Current State | Notes |\n|--------|----------|---------------|-------|\n| **File-based: Code CLI** | Developer / IT | ✅ Supported | \`~/.claude/plugins/\` — only supported method |\n| **File-based: Claude Desktop** | Developer / IT | ❌ Not supported | Different config path; same file structure expected |\n| **npm postinstall** | IT / end-user | ✅ Supported | Requires \`vibe-agent-toolkit\` as runtime dep |\n| **Managed settings file** | IT / Enterprise | ✅ Partial | \`vat verify\` validates; deployment is out of scope |\n| **MDM-driven npm install** | IT | ✅ Works (via postinstall) | Jamf/SCCM/Intune runs \`npm install -g\` |\n| **Anthropic Cloud / claude.ai org** | Org admin | ❌ Not supported | No API available; future Anthropic feature |\n| **GitHub CI enterprise push** | IT / DevOps | ❌ Not supported | VAT design vision — see below |\n| **Shared network registry** | IT | ❌ Not supported | Internal npm registry approach |\n\n---"
-  },
-  whatVatCurrentlySupports: {
-    header: "## What VAT Currently Supports",
-    body: "### File-based install: Claude Code CLI only\n\n\`vat skills install\` and \`vat skills uninstall\` operate exclusively on:\n\`\`\`\n~/.claude/\n├── plugins/\n│   ├── marketplaces/<marketplace>/plugins/<plugin>/   ← plugin files\n│   ├── cache/<marketplace>/<plugin>/<version>/        ← version cache\n│   ├── known_marketplaces.json\n│   └── installed_plugins.json\n├── skills/                                            ← legacy skills (no plugin system)\n└── settings.json                                      ← enabledPlugins, permissions\n\`\`\`\n\nThis is the **Claude Code CLI** configuration directory. It is the only path VAT\nresolves. Claude Desktop uses a different path (see below) and is out of scope.\n\n### Install sources (all resolve to the file-based method above)\n\n\`\`\`bash\n# npm package (downloads, extracts, copies plugin tree)\nvat skills install npm:@myorg/my-skills\n\n# Local directory (copies plugin tree from local path)\nvat skills install ./path/to/package\n\n# ZIP file\nvat skills install ./my-skills.zip\n\n# npm postinstall hook (triggered by npm install -g)\n# package.json: \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall\"\n\`\`\`\n\n### Uninstall (current state)\n\n\`vat skills uninstall\` removes skills from \`~/.claude/skills/\` only. It does NOT\nremove plugin-system installs (the \`~/.claude/plugins/\` tree).\n\n**A full \`vat plugins uninstall\` command does not yet exist.** See design notes below.\n\n---",
-    text: "## What VAT Currently Supports\n\n### File-based install: Claude Code CLI only\n\n\`vat skills install\` and \`vat skills uninstall\` operate exclusively on:\n\`\`\`\n~/.claude/\n├── plugins/\n│   ├── marketplaces/<marketplace>/plugins/<plugin>/   ← plugin files\n│   ├── cache/<marketplace>/<plugin>/<version>/        ← version cache\n│   ├── known_marketplaces.json\n│   └── installed_plugins.json\n├── skills/                                            ← legacy skills (no plugin system)\n└── settings.json                                      ← enabledPlugins, permissions\n\`\`\`\n\nThis is the **Claude Code CLI** configuration directory. It is the only path VAT\nresolves. Claude Desktop uses a different path (see below) and is out of scope.\n\n### Install sources (all resolve to the file-based method above)\n\n\`\`\`bash\n# npm package (downloads, extracts, copies plugin tree)\nvat skills install npm:@myorg/my-skills\n\n# Local directory (copies plugin tree from local path)\nvat skills install ./path/to/package\n\n# ZIP file\nvat skills install ./my-skills.zip\n\n# npm postinstall hook (triggered by npm install -g)\n# package.json: \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall\"\n\`\`\`\n\n### Uninstall (current state)\n\n\`vat skills uninstall\` removes skills from \`~/.claude/skills/\` only. It does NOT\nremove plugin-system installs (the \`~/.claude/plugins/\` tree).\n\n**A full \`vat plugins uninstall\` command does not yet exist.** See design notes below.\n\n---"
-  },
-  whatVatDoesNotSupportAndWhy: {
-    header: "## What VAT Does NOT Support (and Why)",
-    body: "### Claude Desktop file-based installs\n\nClaude Desktop on macOS uses \`~/Library/Application Support/Claude/\` rather than\n\`~/.claude/\`. On Windows it uses \`%APPDATA%\\Claude\\\`.\n\n**Why not supported today**: VAT\'s \`getClaudeUserPaths()\` is hardcoded to \`~/.claude/\`.\nExtending it requires detecting which applications are installed and resolving both\npaths. This is well-understood work with no architectural unknowns.\n\n**Architectural note**: When implemented, both paths should be handled by a single\n\`getClaudeInstallTargets()\` function returning multiple targets. CLI commands gain a\n\`--target code-cli|desktop|all\` flag. Default is \`code-cli\` until Desktop path\nhandling is verified stable.\n\n### Anthropic Cloud / claude.ai organization-level skills\n\nAnthropic operates a cloud-based skill system for claude.ai. Organization admins can\nmanage skills for all users through the admin console. VAT has no integration with\nthis system today because Anthropic has not published a public API for programmatic\nmanagement.\n\n**Architectural note**: When Anthropic publishes an org management API, VAT should\nadd \`vat skills publish --target claude-ai\` as a first-class install method. The\n\`dist/\` artifacts from \`vat build\` are format-compatible with this target. The gap\nis authentication and the API itself.\n\n### GitHub CI enterprise push (vision)\n\nThe goal: a GitHub Actions workflow in a skills repository automatically deploys\nskills to all users in an enterprise whenever a new version is merged to main.\n\nThis is a multi-layer problem with several viable approaches:\n\n#### Approach A: MDM-integrated npm publish (recommended near-term)\n\`\`\`\nGitHub Actions on release →\n  npm publish @myorg/my-skills →\n    MDM policy (Jamf/SCCM/Intune) detects new package version →\n      Runs: npm install -g @myorg/my-skills\n        → postinstall hook installs plugin to user\'s ~/.claude/\n\`\`\`\nVAT already supports this end-to-end. The MDM layer is outside VAT\'s scope and is\nconfigured by IT using standard MDM software management policies. The VAT piece is\ncomplete; IT must configure the npm-to-MDM trigger.\n\n#### Approach B: Managed settings deployment (near-term, no MDM required)\n\`\`\`\nGitHub Actions on release →\n  vat build &&\n  Generates managed-settings.json with plugin enablement →\n    Deploys managed-settings.json to shared network path or cloud storage →\n      Claude Code reads managed-settings.json at startup\n\`\`\`\n\`vat verify\` validates \`managed-settings.json\` today. The deployment step is IT\'s\nresponsibility. This approach requires no per-machine npm install; Claude Code reads\nthe settings file directly if it is placed at the expected path or if the path is\nconfigured.\n\n**Gap**: VAT does not yet have a \`vat claude deploy\` command that handles the push\nstep. Adding this would require IT to configure cloud storage credentials once.\n\n#### Approach C: Anthropic org API (long-term, requires Anthropic)\n\`\`\`\nGitHub Actions on release →\n  vat skills publish --target claude-ai --org myorg →\n    Anthropic API activates skills for all org users in claude.ai\n\`\`\`\nBlocked on Anthropic publishing an org management API. VAT\'s \`dist/\` output format\nis already designed for this target.\n\n---",
-    text: "## What VAT Does NOT Support (and Why)\n\n### Claude Desktop file-based installs\n\nClaude Desktop on macOS uses \`~/Library/Application Support/Claude/\` rather than\n\`~/.claude/\`. On Windows it uses \`%APPDATA%\\Claude\\\`.\n\n**Why not supported today**: VAT\'s \`getClaudeUserPaths()\` is hardcoded to \`~/.claude/\`.\nExtending it requires detecting which applications are installed and resolving both\npaths. This is well-understood work with no architectural unknowns.\n\n**Architectural note**: When implemented, both paths should be handled by a single\n\`getClaudeInstallTargets()\` function returning multiple targets. CLI commands gain a\n\`--target code-cli|desktop|all\` flag. Default is \`code-cli\` until Desktop path\nhandling is verified stable.\n\n### Anthropic Cloud / claude.ai organization-level skills\n\nAnthropic operates a cloud-based skill system for claude.ai. Organization admins can\nmanage skills for all users through the admin console. VAT has no integration with\nthis system today because Anthropic has not published a public API for programmatic\nmanagement.\n\n**Architectural note**: When Anthropic publishes an org management API, VAT should\nadd \`vat skills publish --target claude-ai\` as a first-class install method. The\n\`dist/\` artifacts from \`vat build\` are format-compatible with this target. The gap\nis authentication and the API itself.\n\n### GitHub CI enterprise push (vision)\n\nThe goal: a GitHub Actions workflow in a skills repository automatically deploys\nskills to all users in an enterprise whenever a new version is merged to main.\n\nThis is a multi-layer problem with several viable approaches:\n\n#### Approach A: MDM-integrated npm publish (recommended near-term)\n\`\`\`\nGitHub Actions on release →\n  npm publish @myorg/my-skills →\n    MDM policy (Jamf/SCCM/Intune) detects new package version →\n      Runs: npm install -g @myorg/my-skills\n        → postinstall hook installs plugin to user\'s ~/.claude/\n\`\`\`\nVAT already supports this end-to-end. The MDM layer is outside VAT\'s scope and is\nconfigured by IT using standard MDM software management policies. The VAT piece is\ncomplete; IT must configure the npm-to-MDM trigger.\n\n#### Approach B: Managed settings deployment (near-term, no MDM required)\n\`\`\`\nGitHub Actions on release →\n  vat build &&\n  Generates managed-settings.json with plugin enablement →\n    Deploys managed-settings.json to shared network path or cloud storage →\n      Claude Code reads managed-settings.json at startup\n\`\`\`\n\`vat verify\` validates \`managed-settings.json\` today. The deployment step is IT\'s\nresponsibility. This approach requires no per-machine npm install; Claude Code reads\nthe settings file directly if it is placed at the expected path or if the path is\nconfigured.\n\n**Gap**: VAT does not yet have a \`vat claude deploy\` command that handles the push\nstep. Adding this would require IT to configure cloud storage credentials once.\n\n#### Approach C: Anthropic org API (long-term, requires Anthropic)\n\`\`\`\nGitHub Actions on release →\n  vat skills publish --target claude-ai --org myorg →\n    Anthropic API activates skills for all org users in claude.ai\n\`\`\`\nBlocked on Anthropic publishing an org management API. VAT\'s \`dist/\` output format\nis already designed for this target.\n\n---"
-  },
-  vatPluginsUninstall-DesignIntent: {
-    header: "## \`vat plugins uninstall\` — Design Intent",
-    body: "A \`vat plugins uninstall <plugin>@<marketplace>\` command should exist but does not yet.\n\n### What it must reverse\n\nUninstalling a plugin installed via the file-based method requires reversing 5 artifacts:\n\n1. Delete \`~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin>/\`\n2. Delete \`~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/\`\n3. Remove \`<plugin>@<marketplace>\` from \`installed_plugins.json\`\n4. Remove \`<marketplace>\` from \`known_marketplaces.json\` if no plugins remain\n5. Remove \`enabledPlugins[<plugin>@<marketplace>]\` from \`settings.json\`\n\n### Design decisions\n\n- **Idempotent**: exit 0 if plugin not found — safe for IT automation scripts\n- **Not-VAT-installed case**: if plugin directory exists but no registry entries, delete\n  the directory and clean settings.json; emit a warning that the plugin was not\n  installed via VAT\n- **\`--dry-run\`**: show what would be deleted without deleting (follow \`vat skills uninstall\` pattern)\n- **\`--target\`**: code-cli | desktop | all (default: code-cli until Desktop is implemented)\n- **\`vat plugins list\`**: companion command to show installed plugins — needed for\n  discoverability before uninstalling\n\n### Implementation location\n\nPer the CLI \"dumb orchestration\" principle:\n- Logic: \`packages/claude-marketplace/src/install/plugin-uninstall.ts\` (new file alongside plugin-registry.ts)\n- CLI: \`packages/cli/src/commands/plugins/uninstall.ts\` (thin wrapper)\n- New command group: \`vat plugins\` with subcommands \`list\` and \`uninstall\`\n\n---",
-    text: "## \`vat plugins uninstall\` — Design Intent\n\nA \`vat plugins uninstall <plugin>@<marketplace>\` command should exist but does not yet.\n\n### What it must reverse\n\nUninstalling a plugin installed via the file-based method requires reversing 5 artifacts:\n\n1. Delete \`~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin>/\`\n2. Delete \`~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/\`\n3. Remove \`<plugin>@<marketplace>\` from \`installed_plugins.json\`\n4. Remove \`<marketplace>\` from \`known_marketplaces.json\` if no plugins remain\n5. Remove \`enabledPlugins[<plugin>@<marketplace>]\` from \`settings.json\`\n\n### Design decisions\n\n- **Idempotent**: exit 0 if plugin not found — safe for IT automation scripts\n- **Not-VAT-installed case**: if plugin directory exists but no registry entries, delete\n  the directory and clean settings.json; emit a warning that the plugin was not\n  installed via VAT\n- **\`--dry-run\`**: show what would be deleted without deleting (follow \`vat skills uninstall\` pattern)\n- **\`--target\`**: code-cli | desktop | all (default: code-cli until Desktop is implemented)\n- **\`vat plugins list\`**: companion command to show installed plugins — needed for\n  discoverability before uninstalling\n\n### Implementation location\n\nPer the CLI \"dumb orchestration\" principle:\n- Logic: \`packages/claude-marketplace/src/install/plugin-uninstall.ts\` (new file alongside plugin-registry.ts)\n- CLI: \`packages/cli/src/commands/plugins/uninstall.ts\` (thin wrapper)\n- New command group: \`vat plugins\` with subcommands \`list\` and \`uninstall\`\n\n---"
-  },
-  guidanceForAdopters: {
-    header: "## Guidance for Adopters",
-    body: "### For end-user / IT-managed deployments (recommended)\n\nAdd \`vibe-agent-toolkit\` as a **runtime dependency** (not devDependencies) and use\nthe local node_modules binary in postinstall. Never assume \`vat\` is globally installed.\n\n\`\`\`json\n{\n  \"dependencies\": { \"vibe-agent-toolkit\": \"latest\" },\n  \"scripts\": {\n    \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall || exit 0\"\n  }\n}\n\`\`\`\n\nIT runs: \`npm install -g @myorg/my-skills\` — no other tools required on the user\'s machine.\n\nFor private GitHub Packages registries, IT pre-configures \`.npmrc\` with a read-only\ntoken for the \`@myorg\` scope. End users do not need to know about registries or tokens.\n\n### For developer self-install\n\n\`\`\`bash\nnpx vibe-agent-toolkit skills install npm:@myorg/my-skills\n\`\`\`\n\n### For enterprise CI (near-term best option)\n\nUse Approach A (MDM-integrated npm publish) or Approach B (managed-settings deployment).\nBoth work today with no additional VAT features.\n\n---",
-    text: "## Guidance for Adopters\n\n### For end-user / IT-managed deployments (recommended)\n\nAdd \`vibe-agent-toolkit\` as a **runtime dependency** (not devDependencies) and use\nthe local node_modules binary in postinstall. Never assume \`vat\` is globally installed.\n\n\`\`\`json\n{\n  \"dependencies\": { \"vibe-agent-toolkit\": \"latest\" },\n  \"scripts\": {\n    \"postinstall\": \"node ./node_modules/vibe-agent-toolkit/bin/vat claude plugin install --npm-postinstall || exit 0\"\n  }\n}\n\`\`\`\n\nIT runs: \`npm install -g @myorg/my-skills\` — no other tools required on the user\'s machine.\n\nFor private GitHub Packages registries, IT pre-configures \`.npmrc\` with a read-only\ntoken for the \`@myorg\` scope. End users do not need to know about registries or tokens.\n\n### For developer self-install\n\n\`\`\`bash\nnpx vibe-agent-toolkit skills install npm:@myorg/my-skills\n\`\`\`\n\n### For enterprise CI (near-term best option)\n\nUse Approach A (MDM-integrated npm publish) or Approach B (managed-settings deployment).\nBoth work today with no additional VAT features.\n\n---"
-  },
-  whatIsOutOfScopeForVat: {
-    header: "## What Is Out of Scope for VAT",
-    body: "VAT is a **packaging and local install tool**. The following are permanently out of scope:\n\n- MDM software management configuration (Jamf, SCCM, Intune policies)\n- Internal npm registry setup and authentication management\n- Anthropic cloud API authentication or org provisioning\n- Per-user credential management for private registries\n- Claude Desktop configuration (until Desktop and Code CLI paths converge)",
-    text: "## What Is Out of Scope for VAT\n\nVAT is a **packaging and local install tool**. The following are permanently out of scope:\n\n- MDM software management configuration (Jamf, SCCM, Intune policies)\n- Internal npm registry setup and authentication management\n- Anthropic cloud API authentication or org provisioning\n- Per-user credential management for private registries\n- Claude Desktop configuration (until Desktop and Code CLI paths converge)"
-  }
-};