@xopcai/xopc 0.0.396 → 0.0.398

package/dist/src/extensions/agent-plugins/cli-authorization.d.ts

@@ -0,0 +1,33 @@
+import { type PluginAuthorization } from './setup-contract.js';
+import type { AgentPluginStore, InstalledAgentPlugin } from './store.js';
+type CliMethod = Extract<PluginAuthorization['methods'][number], {
+    type: 'cli';
+}>;
+export type PluginCliAuthorization = {
+    id: string;
+    state: 'preparing' | 'awaiting_user' | 'connected' | 'error' | 'cancelled';
+    expiresAt: number;
+    challenge?: {
+        type: 'url' | 'qr';
+        url: string;
+        message?: string;
+    };
+    error?: string;
+};
+export declare function inspectPluginCliAuthorization(store: AgentPluginStore, plugin: InstalledAgentPlugin, authorization: string, method: CliMethod, signal: AbortSignal): Promise<{
+    authenticated: boolean;
+    issues: {
+        id: string;
+        title: string;
+        scopes: string[];
+        instructions: string[];
+        method?: string;
+        helpUrl?: string;
+    }[];
+}>;
+export declare function checkPluginCliAuthorization(store: AgentPluginStore, plugin: InstalledAgentPlugin, authorization: string, method: CliMethod, signal: AbortSignal): Promise<boolean>;
+export declare function startPluginCliAuthorization(store: AgentPluginStore, plugin: InstalledAgentPlugin, authorization: string, method: CliMethod, owner: string): PluginCliAuthorization;
+export declare function getPluginCliAuthorization(id: string, owner: string, revision: string): PluginCliAuthorization | undefined;
+export declare function cancelPluginCliAuthorizations(pluginId: string, owner?: string): void;
+export declare function cancelAllPluginCliAuthorizations(): void;
+export {};

package/dist/src/extensions/agent-plugins/cli-authorization.js

@@ -0,0 +1,203 @@
+import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
+import { spawnProcess } from "../../process/run-process.js";
+import { parsePluginAuthorizationCheck, pluginAuthorizations, safeAuthorizationUrl } from "./setup-contract.js";
+import { containedPath, expandPluginVariables, resolvePluginCwd, validatePluginServer } from "./validation.js";
+import { expandUserConfig, readPluginUserConfig } from "./user-config.js";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { mkdirSync, readFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+//#region src/extensions/agent-plugins/cli-authorization.ts
+init_credentials();
+const attempts = /* @__PURE__ */ new Map();
+async function execute(store, plugin, authorization, command, signal, timeoutMs, onLine) {
+	validatePluginServer({
+		type: "stdio",
+		...command
+	}, plugin.rootDir, store.dataDir(plugin.id));
+	const data = store.dataDir(plugin.id), home = join(data, "accounts", plugin.receipt.revision, authorization);
+	mkdirSync(home, {
+		recursive: true,
+		mode: 448
+	});
+	const values = {
+		...Object.fromEntries(Object.entries(plugin.layout?.userConfig ?? {}).filter(([, field]) => field.default !== void 0).map(([key, field]) => [key, field.default])),
+		...readPluginUserConfig(store, plugin.id, plugin.receipt.revision)
+	};
+	const expand = (value) => expandUserConfig(expandPluginVariables(value.replace(/\$\{PLUGIN_RESOURCES\}/g, join(data, "resources", plugin.receipt.revision)), plugin.rootDir, data), values);
+	const environment = Object.fromEntries([
+		"PATH",
+		"SystemRoot",
+		"WINDIR",
+		"TMPDIR",
+		"TEMP",
+		"TMP",
+		"LANG"
+	].flatMap((key) => process.env[key] === void 0 ? [] : [[key, process.env[key]]]));
+	Object.assign(environment, {
+		HOME: home,
+		USERPROFILE: home,
+		XDG_CONFIG_HOME: join(home, "config"),
+		PLUGIN_HOST_HOME: homedir(),
+		PLUGIN_ACCOUNT_HOME: home,
+		PLUGIN_ROOT: plugin.rootDir,
+		PLUGIN_DATA: data,
+		PLUGIN_RESOURCES: join(data, "resources", plugin.receipt.revision)
+	});
+	const resolver = new CredentialResolver({ stateDir: store.stateDir });
+	for (const [key, value] of Object.entries(command.env)) {
+		const expanded = expand(value);
+		if (typeof expanded === "string") environment[key] = expanded;
+		else {
+			const reference = expanded;
+			if (!reference.xopcSecretRef) throw new Error("Invalid login credential reference");
+			const secret = await resolver.resolveApiKey(reference.xopcSecretRef.provider);
+			if (!secret) throw new Error("Login credential is unavailable");
+			environment[key] = reference.xopcSecretRef.prefix + secret;
+		}
+	}
+	const program = command.command.startsWith("./") ? containedPath(plugin.rootDir, resolve(plugin.rootDir, command.command)) : command.command.startsWith("${PLUGIN_RESOURCES}/") ? containedPath(data, join(data, "resources", plugin.receipt.revision, command.command.slice(20))) : command.command;
+	let pending = "";
+	const result = await spawnProcess({
+		program,
+		args: command.args.map((arg) => {
+			const value = expand(arg);
+			if (typeof value !== "string") throw new Error("Use environment variables for login secrets");
+			return value;
+		}),
+		cwd: resolvePluginCwd(command.cwd, plugin.rootDir, data),
+		env: environment,
+		signal,
+		timeoutMs,
+		maxOutputBytes: 65536,
+		terminationPolicy: "tree",
+		shell: false,
+		onOutput(stream, chunk) {
+			if (stream !== "stdout" || !onLine) return;
+			pending = (pending + chunk.toString("utf8")).slice(-65536);
+			let boundary;
+			while ((boundary = pending.indexOf("\n")) >= 0) {
+				const line = pending.slice(0, boundary);
+				pending = pending.slice(boundary + 1);
+				onLine(line);
+			}
+		}
+	}).completion;
+	if (result.exitCode !== 0 || result.timedOut || result.aborted || result.outputTruncated) throw new Error("CLI login or account check failed. Retry authorization.");
+	return result.stdout;
+}
+async function inspectPluginCliAuthorization(store, plugin, authorization, method, signal) {
+	try {
+		return parsePluginAuthorizationCheck(await execute(store, plugin, authorization, method.check, signal, 15e3), pluginAuthorizations(plugin.manifest).find((value) => value.id === authorization)?.methods.map((value) => value.id) ?? []);
+	} catch {
+		signal.throwIfAborted();
+		return {
+			authenticated: false,
+			issues: []
+		};
+	}
+}
+async function checkPluginCliAuthorization(store, plugin, authorization, method, signal) {
+	return (await inspectPluginCliAuthorization(store, plugin, authorization, method, signal)).authenticated;
+}
+function startPluginCliAuthorization(store, plugin, authorization, method, owner) {
+	for (const [key, attempt] of attempts) if (attempt.view.expiresAt < Date.now()) {
+		attempt.controller.abort();
+		attempts.delete(key);
+	} else if (attempt.pluginId === plugin.id && attempt.authorization === authorization) {
+		if (attempt.owner !== owner) throw new Error("Authorization belongs to another principal");
+		attempt.controller.abort();
+		attempt.view.state = "cancelled";
+	}
+	const controller = new AbortController();
+	const view = {
+		id: randomUUID(),
+		state: "preparing",
+		expiresAt: Date.now() + method.timeoutSeconds * 1e3
+	};
+	const attempt = {
+		owner,
+		pluginId: plugin.id,
+		revision: plugin.receipt.revision,
+		authorization,
+		view,
+		controller
+	};
+	attempts.set(view.id, attempt);
+	const watcher = setInterval(() => {
+		try {
+			const current = store.pendingReceipt(plugin.id) ?? store.receipt(plugin.id);
+			const job = JSON.parse(readFileSync(join(store.stateDir, "plugin-setup", `${plugin.id}.json`), "utf8"));
+			const target = job.authorizations?.find((value) => value.id === authorization);
+			if (current?.revision !== plugin.receipt.revision || job.packageRevision !== plugin.receipt.revision || target?.attemptId !== view.id || ["cancelled", "completed"].includes(job.state)) controller.abort();
+		} catch {
+			controller.abort();
+		}
+	}, 500);
+	watcher.unref();
+	(async () => {
+		try {
+			await execute(store, plugin, authorization, method.login, controller.signal, method.timeoutSeconds * 1e3, (line) => {
+				try {
+					const value = JSON.parse(line);
+					if (value.type === "challenge" && ["qr", "url"].includes(value.kind) && typeof value.url === "string" && value.url.length <= 8192) {
+						view.challenge = {
+							type: value.kind,
+							url: safeAuthorizationUrl(value.url),
+							...typeof value.message === "string" && value.message.length <= 300 ? { message: value.message } : {}
+						};
+						view.state = "awaiting_user";
+					}
+				} catch {}
+			});
+			controller.signal.throwIfAborted();
+			if ((store.pending(plugin.id) ?? store.get(plugin.id))?.receipt.revision !== plugin.receipt.revision) throw new Error("Plugin revision changed");
+			if (!await checkPluginCliAuthorization(store, plugin, authorization, method, controller.signal)) throw new Error("Account verification failed");
+			view.state = "connected";
+			delete view.challenge;
+		} catch {
+			view.state = controller.signal.aborted ? "cancelled" : "error";
+			view.error = controller.signal.aborted ? "Sign-in cancelled." : "Sign-in or account verification failed. Retry authorization.";
+			delete view.challenge;
+		} finally {
+			clearInterval(watcher);
+		}
+	})();
+	return view;
+}
+function getPluginCliAuthorization(id, owner, revision) {
+	const attempt = attempts.get(id);
+	if (!attempt) return;
+	if (attempt.owner !== owner || attempt.revision !== revision) throw new Error("Authorization does not match this installation");
+	if (attempt.view.expiresAt <= Date.now() && ![
+		"connected",
+		"error",
+		"cancelled"
+	].includes(attempt.view.state)) {
+		attempt.controller.abort();
+		attempt.view.state = "error";
+		attempt.view.error = "Sign-in expired. Try again.";
+		delete attempt.view.challenge;
+	}
+	return attempt.view;
+}
+function cancelPluginCliAuthorizations(pluginId, owner) {
+	for (const attempt of attempts.values()) if (attempt.pluginId === pluginId && (owner === void 0 || attempt.owner === owner)) {
+		attempt.controller.abort();
+		attempt.view.state = "cancelled";
+		delete attempt.view.challenge;
+	}
+}
+function cancelAllPluginCliAuthorizations() {
+	for (const attempt of attempts.values()) {
+		attempt.controller.abort();
+		if (![
+			"connected",
+			"error",
+			"cancelled"
+		].includes(attempt.view.state)) attempt.view.state = "cancelled";
+		delete attempt.view.challenge;
+	}
+}
+//#endregion
+export { cancelAllPluginCliAuthorizations, cancelPluginCliAuthorizations, checkPluginCliAuthorization, getPluginCliAuthorization, inspectPluginCliAuthorization, startPluginCliAuthorization };

package/dist/src/extensions/agent-plugins/connection-reuse.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from '../../config/schema.js';
+import type { PluginServer } from './validation.js';
+export interface PluginOAuthReference {
+    sourceServerId: string;
+    credentialId: string;
+    fingerprint: string;
+}
+export declare function connectionFingerprint(server: Record<string, unknown>): string;
+export declare function matchingReusableConnection(target: PluginServer, source: Record<string, unknown>): boolean;
+export declare function validPluginOAuthReference(reference: PluginOAuthReference, config: Config, target?: PluginServer): boolean;

package/dist/src/extensions/agent-plugins/connection-reuse.js

@@ -0,0 +1,23 @@
+import { createHash } from "node:crypto";
+//#region src/extensions/agent-plugins/connection-reuse.ts
+function connectionFingerprint(server) {
+	return createHash("sha256").update(JSON.stringify([
+		server.url,
+		server.oauth ?? null,
+		server.auth ?? null,
+		server.headers ?? null,
+		server.xopcOAuthCredentialId
+	])).digest("hex");
+}
+function settings(value) {
+	return JSON.stringify(Object.fromEntries(Object.entries(value && typeof value === "object" ? value : {}).sort(([a], [b]) => a.localeCompare(b))));
+}
+function matchingReusableConnection(target, source) {
+	return target.type !== "stdio" && target.connectionAuth?.mode !== "api-key" && source.enabled !== false && source.url === target.url && typeof source.xopcOAuthCredentialId === "string" && /^mcp_draft_[a-f0-9]{32}$/.test(source.xopcOAuthCredentialId) && !source.auth && !Object.keys(source.headers ?? {}).some((key) => key.toLowerCase() === "authorization") && !Object.keys(target.headers ?? {}).some((key) => key.toLowerCase() === "authorization") && settings(source.oauth) === settings(target.oauth);
+}
+function validPluginOAuthReference(reference, config, target) {
+	const source = config.mcp?.servers?.[reference.sourceServerId];
+	return !!source && (!target || matchingReusableConnection(target, source)) && source.enabled !== false && source.xopcOAuthCredentialId === reference.credentialId && connectionFingerprint(source) === reference.fingerprint;
+}
+//#endregion
+export { connectionFingerprint, matchingReusableConnection, validPluginOAuthReference };

package/dist/src/extensions/agent-plugins/credentials.js

@@ -1,7 +1,10 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { pluginName } from "./validation.js";
+import { pluginName, pluginServerId } from "./validation.js";
+import { createNativeMcpCredentials } from "../../agent/mcp/credential-store.js";
 import { pluginCredentialProviderPrefix } from "./auth.js";
+import { pluginOAuthCredentialId } from "./mcp-adapter.js";
+import { getNativePiAgentDir } from "../../agent/mcp/native-mcp.js";
 import { join } from "node:path";
 import { existsSync, rmSync } from "node:fs";
 //#region src/extensions/agent-plugins/credentials.ts
@@ -9,6 +12,19 @@ init_credentials();
 init_paths_state();
 async function removePluginCredentials(store, id) {
 	pluginName.parse(id);
+	const history = store.history(id);
+	if (store.stateDir === resolveStateDir()) {
+		getNativePiAgentDir();
+		const native = await createNativeMcpCredentials();
+		for (const plugin of history) {
+			const servers = plugin.receipt.oauthServers ?? Object.fromEntries(Object.entries(plugin.servers).filter(([, server]) => server.type !== "stdio").map(([name, server]) => [name, server.type !== "stdio" ? server.url : ""]));
+			for (const [name, url] of Object.entries(servers)) {
+				const alias = plugin.receipt.credentialScope === "revision" ? pluginOAuthCredentialId(id, plugin.receipt.revision, name) : pluginServerId(id, name);
+				await native.forServer(alias, url).save({ serverUrl: url });
+				native.remove(alias, url);
+			}
+		}
+	}
 	const dir = join(store.stateDir, "plugin-auth", id);
 	const resolver = new CredentialResolver(store.stateDir === resolveStateDir() ? {} : { stateDir: store.stateDir });
 	for (const profile of await resolver.listProfiles()) if (profile.provider.startsWith(pluginCredentialProviderPrefix(id))) await resolver.deleteProviderCredential(profile.provider);
@@ -16,6 +32,13 @@ async function removePluginCredentials(store, id) {
 		recursive: true,
 		force: true
 	});
+	for (const plugin of history) {
+		rmSync(join(store.stateDir, "plugin-config", `${id}-${plugin.receipt.revision}.json`), { force: true });
+		rmSync(join(store.dataDir(id), "accounts", plugin.receipt.revision), {
+			recursive: true,
+			force: true
+		});
+	}
 }
 //#endregion
 export { removePluginCredentials };

package/dist/src/extensions/agent-plugins/formats.d.ts

@@ -0,0 +1,27 @@
+export declare const PLUGIN_MANIFEST_PATHS: readonly ["plugin.json", ".codex-plugin/plugin.json", ".claude-plugin/plugin.json"];
+export type PluginDialect = 'portable' | 'codex' | 'claude';
+export interface CompatibilityItem {
+    component: string;
+    support: 'supported' | 'needs_adapter' | 'unsupported' | 'invalid';
+    message: string;
+}
+export interface PluginLayout {
+    descriptorVersion: 1;
+    adapterVersion: 'xopc-plugin-v1';
+    dialect: PluginDialect;
+    manifest: Record<string, unknown>;
+    skillRoots: string[];
+    mcpConfigs: unknown[];
+    compatibility: CompatibilityItem[];
+    userConfig: Record<string, {
+        type: 'string' | 'number' | 'boolean';
+        title: string;
+        required: boolean;
+        sensitive: boolean;
+        default?: string | number | boolean;
+    }>;
+    tasks: string[];
+}
+/** Interpret each dialect before applying the common package and execution checks. */
+export declare function readPluginLayout(root: string, read: (path: string) => string, safe: (path: string) => string, importManifest?: Record<string, unknown>): PluginLayout;
+export declare function collectPluginSkillFiles(root: string, safe: (path: string) => string): string[];

package/dist/src/extensions/agent-plugins/formats.js

@@ -0,0 +1,208 @@
+import { basename, join } from "node:path";
+import { existsSync, readdirSync, statSync } from "node:fs";
+//#region src/extensions/agent-plugins/formats.ts
+const PLUGIN_MANIFEST_PATHS = [
+	"plugin.json",
+	".codex-plugin/plugin.json",
+	".claude-plugin/plugin.json"
+];
+/** Interpret each dialect before applying the common package and execution checks. */
+function readPluginLayout(root, read, safe, importManifest) {
+	const has = (path) => existsSync(join(root, path));
+	const json = (path) => {
+		const value = JSON.parse(read(join(root, path)));
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Expected an object: ${path}`);
+		return value;
+	};
+	const path = PLUGIN_MANIFEST_PATHS.find(has);
+	if (!path && !importManifest) throw new Error("No supported plugin manifest found");
+	const dialect = path === "plugin.json" ? "portable" : path?.startsWith(".codex") ? "codex" : "claude";
+	const raw = path ? json(path) : importManifest;
+	const compatibility = [];
+	if (dialect !== "portable" && has(".codex-plugin/plugin.json") && has(".claude-plugin/plugin.json")) compatibility.push({
+		component: "manifest:claude",
+		support: "unsupported",
+		message: "Codex dialect selected; the separate Claude manifest is not applied."
+	});
+	const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+	const overlay = dialect === "portable" ? object(object(raw.extensions)["com.openai"] ?? (has(".codex-plugin/plugin.json") ? json(".codex-plugin/plugin.json") : {})) : raw;
+	const manifest = dialect === "portable" ? raw : {
+		$schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+		...Object.fromEntries([
+			"name",
+			"version",
+			"description",
+			"homepage",
+			"repository",
+			"license",
+			"keywords",
+			"extensions"
+		].filter((key) => raw[key] !== void 0).map((key) => [key, raw[key]])),
+		...raw.author ? { author: typeof raw.author === "string" ? { name: raw.author } : raw.author } : {}
+	};
+	const paths = (value, component) => {
+		if (value === void 0) return [];
+		const values = typeof value === "string" ? [value] : Array.isArray(value) ? value : [];
+		if (!values.length || values.some((v) => typeof v !== "string" || !v.startsWith("./"))) {
+			compatibility.push({
+				component,
+				support: "invalid",
+				message: "Expected package-relative paths beginning with ./"
+			});
+			return [];
+		}
+		return values.map((v) => safe(join(root, v)));
+	};
+	const guarded = (component, fn, fallback) => {
+		try {
+			return fn();
+		} catch (error) {
+			compatibility.push({
+				component,
+				support: "invalid",
+				message: error instanceof Error ? error.message : String(error)
+			});
+			return fallback;
+		}
+	};
+	const defaults = has("skills") ? guarded("skills", () => [safe(join(root, "skills"))], []) : [];
+	const declared = paths(overlay.skills, "skills");
+	const skillRoots = [...new Set(dialect === "portable" ? defaults : dialect === "claude" ? [...defaults, ...declared] : overlay.skills === void 0 ? defaults : declared)];
+	const mcpConfigs = [];
+	if (dialect === "portable" && has("mcp.json")) {
+		const config = guarded("mcp", () => json("mcp.json"), void 0);
+		if (config) mcpConfigs.push(config);
+	}
+	const legacyDefault = has(".mcp.json");
+	if (dialect !== "portable" && legacyDefault && (dialect === "claude" || overlay.mcpServers === void 0)) {
+		const config = guarded("mcp", () => json(".mcp.json"), void 0);
+		if (config) mcpConfigs.push(config);
+	}
+	if (dialect !== "portable" || !has("mcp.json")) {
+		if (overlay.mcpServers !== void 0) for (const item of Array.isArray(overlay.mcpServers) ? overlay.mcpServers : [overlay.mcpServers]) if (typeof item === "string") for (const file of paths(item, "mcp")) {
+			const config = guarded("mcp", () => JSON.parse(read(file)), void 0);
+			if (config) mcpConfigs.push(config);
+		}
+		else if (item && typeof item === "object") mcpConfigs.push({ mcpServers: item });
+		else compatibility.push({
+			component: "mcp",
+			support: "invalid",
+			message: "Expected an MCP configuration object or package path."
+		});
+	}
+	for (const [key, conventional] of Object.entries({
+		apps: ".app.json",
+		hooks: "hooks/hooks.json",
+		agents: "agents",
+		commands: "commands",
+		lspServers: ".lsp.json",
+		outputStyles: "output-styles",
+		settings: "settings.json",
+		workflows: "workflows",
+		monitors: "monitors",
+		channels: "channels",
+		themes: "themes"
+	})) if (overlay[key] !== void 0 || has(conventional)) compatibility.push({
+		component: key,
+		support: key === "apps" ? "needs_adapter" : "unsupported",
+		message: key === "apps" ? "Platform application tools require a host capability adapter; accounts are not inherited." : `${key} is not executed by this compatibility version.`
+	});
+	const userConfig = Object.create(null);
+	for (const [key, value] of Object.entries(object(overlay.userConfig))) {
+		const field = object(value);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || ![
+			"string",
+			"number",
+			"boolean"
+		].includes(String(field.type))) {
+			compatibility.push({
+				component: `config:${key}`,
+				support: "unsupported",
+				message: "Unsupported configuration field."
+			});
+			continue;
+		}
+		userConfig[key] = {
+			type: field.type,
+			title: String(field.title ?? key),
+			required: field.required === true,
+			sensitive: field.sensitive === true,
+			...[
+				"string",
+				"number",
+				"boolean"
+			].includes(typeof field.default) ? { default: field.default } : {}
+		};
+	}
+	const tasks = [object(overlay.interface).defaultPrompt].flat().filter((v) => typeof v === "string");
+	if (overlay.onboardingSkill !== void 0) compatibility.push({
+		component: "onboardingSkill",
+		support: "unsupported",
+		message: "Automatic onboarding skill execution is not supported; use the host setup flow."
+	});
+	const known = new Set([
+		"$schema",
+		"name",
+		"version",
+		"description",
+		"author",
+		"homepage",
+		"repository",
+		"license",
+		"keywords",
+		"extensions",
+		"displayName",
+		"skills",
+		"mcpServers",
+		"interface",
+		"userConfig",
+		"onboardingSkill",
+		"apps",
+		"hooks",
+		"agents",
+		"commands",
+		"lspServers",
+		"outputStyles",
+		"settings",
+		"workflows",
+		"monitors",
+		"channels",
+		"themes"
+	]);
+	for (const key of Object.keys(overlay)) if (!known.has(key)) compatibility.push({
+		component: key,
+		support: "unsupported",
+		message: "Unrecognized platform declaration."
+	});
+	return {
+		descriptorVersion: 1,
+		adapterVersion: "xopc-plugin-v1",
+		dialect,
+		manifest,
+		skillRoots,
+		mcpConfigs,
+		compatibility,
+		userConfig,
+		tasks
+	};
+}
+function collectPluginSkillFiles(root, safe) {
+	const result = [];
+	const visit = (path, depth) => {
+		const target = safe(path);
+		if (depth > 16) throw new Error("Skill directory nesting exceeds limits");
+		if (statSync(target).isFile()) {
+			if (basename(target) === "SKILL.md") result.push(target);
+			return;
+		}
+		if (existsSync(join(target, "SKILL.md"))) {
+			result.push(safe(join(target, "SKILL.md")));
+			return;
+		}
+		for (const name of readdirSync(target).sort()) visit(join(target, name), depth + 1);
+	};
+	visit(root, 0);
+	return result;
+}
+//#endregion
+export { PLUGIN_MANIFEST_PATHS, collectPluginSkillFiles, readPluginLayout };