acrylblends 1.3.2 → 1.4.0

package/legacy/README.md

@@ -1,7 +1,7 @@
 # The scaffolds published acrylblends releases shipped
 
 Generated by `scripts/build-legacy-layouts.mjs`; do not edit by hand. Each folder is a template, each hash under it one distinct scaffold (deduplicated by
-content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.3.1, 43 releases)
+content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.3.2, 44 releases)
 to the layouts it shipped.
 
 `acrylblends upgrade` compares an app's scaffold files with these bytes: a file the app has not edited is brought up to date, an edited one is refused (or

package/legacy/layouts.json

@@ -419,6 +419,17 @@
         "notes": "fb43a1c5f3b4",
         "todo": "164274ffcf7f"
       }
+    },
+    {
+      "version": "1.3.2",
+      "layouts": {
+        "agent": "ecbc84f1c1e5",
+        "blank": "a7e8f539ffee",
+        "chat": "d4464dfb3b04",
+        "nodejs": "a6a340b4d3a6",
+        "notes": "fb43a1c5f3b4",
+        "todo": "164274ffcf7f"
+      }
     }
   ],
   "templates": {

package/lib/cordis/door.d.ts

@@ -102,12 +102,9 @@ interface PluginSharePort {
   list(): readonly unknown[];
   /** Take a plugin out and forget its record; a pulled folder still holding the release as pulled goes too. */
   remove(name: string): Promise<unknown>;
-  pull(source: string): Promise<{
-    readonly ok: boolean;
-    readonly action?: string;
-    readonly reason?: string;
-    readonly next?: string;
-  }>;
+  pull(source: string): Promise<PullView>;
+  /** Pull each source of a group's list on its own: one that is refused does not stop the others. */
+  pullList(from: string): Promise<PullListView>;
   planPublish(name: string, options?: PublishOptionsView): Promise<PublishPlanView | {
     readonly ok: false;
     readonly reason: string;
@@ -118,6 +115,28 @@ interface PluginSharePort {
     readonly reason?: string;
   }>;
 }
+/** What one pull did, or why it was refused. */
+interface PullView {
+  readonly ok: boolean;
+  readonly action?: string;
+  readonly name?: string;
+  readonly reason?: string;
+  readonly next?: string;
+}
+/** What a list pull did for each source, or why the list itself was refused (then nothing was pulled). */
+type PullListView = {
+  readonly ok: true;
+  readonly from: string;
+  readonly entries: readonly {
+    readonly line: number;
+    readonly source: string;
+    readonly result: PullView;
+  }[];
+} | {
+  readonly ok: false;
+  readonly reason: string;
+  readonly next: string;
+};
 /** Who a plan publishes as, and under which license; the service's defaults when absent. */
 interface PublishOptionsView {
   readonly owner?: string;
@@ -223,6 +242,8 @@ declare class Door {
   /** The person's yes, from their own terminal. Not a verb: MCP and the chat do not have it. */
   publishConfirmed(name: string, confirmed: PublishPlanView, options: PublishOptionsView): Promise<unknown>;
   private pull;
+  /** A group's list: every source is pulled on its own, so one refused plugin is named with its reason and the others still install and run. */
+  private pullList;
   /** A folder named by an agent, resolved from the app folder; it must be inside the app. */
   private insideApp;
   private offeredTools;

package/lib/cordis/door.js

@@ -464,15 +464,20 @@ const VERB_SPECS = {
 		}
 	},
 	"plugin-pull": {
-		usage: "plugin pull <source>: fetch a plugin someone released (github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz), check it and start it, live",
-		description: "Fetch a plugin someone released, without running anything; check its digest, that it works on every OS and that this app has the services it needs; then install and start it without a restart. A refusal says why and changes nothing.",
+		usage: "plugin pull <source> | --from <list>: fetch a plugin someone released (github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz), or every plugin of a group's list, check each and start it, live",
+		description: "Fetch a plugin someone released, without running anything; check its digest, that it works on every OS and that this app has the services it needs; then install and start it without a restart. A refusal says why and changes nothing. With from instead of source, pull every source of a group's list (one per line, # comments); each is pulled on its own, so a refused one is named with its reason and the others still come in.",
 		arguments: {
 			type: "object",
-			properties: { source: {
-				type: "string",
-				description: "github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz path or https address"
-			} },
-			required: ["source"],
+			properties: {
+				source: {
+					type: "string",
+					description: "github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz path or https address"
+				},
+				from: {
+					type: "string",
+					description: "instead of source: a list of sources, a file in the app (e.g. group.txt) or an https address"
+				}
+			},
 			additionalProperties: false
 		}
 	},
@@ -708,7 +713,7 @@ var Door = class {
 			}
 			case "plugin-list": return this.plugin((plugins) => plugins.list(), false, this.installed());
 			case "plugin-add": return this.plugin((extensions) => extensions.install(this.insideApp(input.folder)));
-			case "plugin-pull": return this.pull(input.source);
+			case "plugin-pull": return input.from === void 0 ? this.pull(input.source) : this.pullList(input.from, input.source);
 			case "plugin-publish": return this.planPublish(input);
 			case "plugin-remove": {
 				const name = input.name;
@@ -997,13 +1002,29 @@ var Door = class {
 	async pull(source) {
 		if (typeof source !== "string" || source === "") throw new DoorError("invalid", "plugin pull needs a source, e.g. plugin pull github:someone/pomodoro@0.1.0");
 		const value = await this.share().pull(source);
-		if (!value.ok) throw new DoorError("refused", `${value.reason ?? "the pull was refused"}. ${value.next ?? "nothing changed"}.`);
+		if (!value.ok) throw new DoorError("refused", `${sentence(value.reason ?? "the pull was refused")} ${sentence(value.next ?? "nothing changed")}`);
 		if (value.action !== "unchanged" && this.deps.reloadOnChange !== false) await this.deps.channel.reloadAll();
 		return {
 			value,
 			text: JSON.stringify(value, null, 2)
 		};
 	}
+	/** A group's list: every source is pulled on its own, so one refused plugin is named with its reason and the others still install and run. */
+	async pullList(from, source) {
+		if (source !== void 0) throw new DoorError("invalid", "plugin pull takes a source or --from <list>, not both");
+		if (typeof from !== "string" || from === "") throw new DoorError("invalid", "plugin pull --from needs a list, e.g. plugin pull --from group.txt");
+		const value = await this.share().pullList(from);
+		if (!value.ok) throw new DoorError("refused", `${sentence(value.reason)} ${sentence(value.next)}`);
+		if (value.entries.some((entry) => entry.result.ok && entry.result.action !== "unchanged") && this.deps.reloadOnChange !== false) await this.deps.channel.reloadAll();
+		const lines = value.entries.map((entry) => `${entry.source}: ${pullLine(entry.result)}`);
+		const refused = value.entries.filter((entry) => !entry.result.ok);
+		const summary = `${String(value.entries.length - refused.length)} of ${String(value.entries.length)} from ${value.from} pulled`;
+		if (refused.length > 0) throw new DoorError("refused", [`${summary}; ${String(refused.length)} refused, the others are in and running.`, ...lines].join("\n"));
+		return {
+			value,
+			text: [`${summary}.`, ...lines].join("\n")
+		};
+	}
 	/** A folder named by an agent, resolved from the app folder; it must be inside the app. */
 	insideApp(folder) {
 		if (typeof folder !== "string" || folder === "") throw new DoorError("invalid", "plugin add needs a folder, e.g. plugins/pomodoro");
@@ -1040,6 +1061,16 @@ var Door = class {
 		};
 	}
 };
+/** One source's outcome in a list pull, as a person reads it. */
+function pullLine(result) {
+	if (!result.ok) return `refused: ${sentence(result.reason ?? "the pull was refused")} ${sentence(result.next ?? "nothing changed")}`;
+	return `${result.action ?? "pulled"}${result.name === void 0 ? "" : ` ${result.name}`}`;
+}
+/** A text as one sentence: the full stop added only when it has no closing punctuation of its own (a reason may end with one, a next step often does). */
+function sentence(text) {
+	const trimmed = text.trim();
+	return /[.!?]$/u.test(trimmed) ? trimmed : `${trimmed}.`;
+}
 //#endregion
 //#region ../../plugins/acryl-door/src/host/chat-tools.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acrylblends",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "The Acryl web framework (import { Acryl } from \"acrylblends\") and the acrylblends command that scaffolds Cordis apps.",
   "license": "MIT",
   "type": "module",

package/plugins/acryl-door/src/cli/acryl.ts

@@ -17,7 +17,7 @@ import { fileURLToPath } from 'node:url'
 import { readDoorFile, STATE_DIR, DOOR_FILE } from '../host/door-file.ts'
 
 const ACT_OPS = new Set(['click', 'type', 'select', 'press', 'scroll', 'wait', 'reload', 'navigate'])
-const VALUED = new Set(['--dir', '--owner', '--license', '--ref', '--text', '--option', '--key', '--direction', '--amount', '--cursor', '--max-nodes', '--role', '--name', '--timeout-ms', '--id', '--width', '--height', '--window', '--tool', '--args', '--path'])
+const VALUED = new Set(['--dir', '--owner', '--license', '--ref', '--text', '--option', '--key', '--direction', '--amount', '--cursor', '--max-nodes', '--role', '--name', '--timeout-ms', '--id', '--width', '--height', '--window', '--tool', '--args', '--path', '--from'])
 const FLAGS = new Set(['--json', '--submit', '--no-clear', '--gone', '--force', '--help'])
 
 export class UsageError extends Error {}
@@ -139,7 +139,12 @@ export function parseInvocation(argv: readonly string[], env: NodeJS.ProcessEnv
     case 'plugin': {
       if (second === 'list' || second === 'reload') return make(`plugin-${second}`)
       if (second === 'add') { if (third === undefined) throw new UsageError('plugin add needs a folder, e.g. plugin add plugins/pomodoro'); return make('plugin-add', { folder: third }) }
-      if (second === 'pull') { if (third === undefined) throw new UsageError('plugin pull needs a source, e.g. plugin pull github:someone/pomodoro@0.1.0'); return make('plugin-pull', { source: third }) }
+      if (second === 'pull') {
+        const from = values.get('--from')
+        if (from !== undefined) { if (third !== undefined) throw new UsageError('plugin pull takes a source or --from <list>, not both'); return make('plugin-pull', { from }) }
+        if (third === undefined) throw new UsageError('plugin pull needs a source, e.g. plugin pull github:someone/pomodoro@0.1.0, or --from <list>')
+        return make('plugin-pull', { source: third })
+      }
       if (second === 'publish') {
         if (third === undefined) throw new UsageError('plugin publish needs a plugin name, e.g. plugin publish pomodoro')
         const owner = values.get('--owner')

package/plugins/acryl-door/src/host/door.ts

@@ -41,11 +41,21 @@ export interface PluginSharePort {
   list(): readonly unknown[]
   /** Take a plugin out and forget its record; a pulled folder still holding the release as pulled goes too. */
   remove(name: string): Promise<unknown>
-  pull(source: string): Promise<{ readonly ok: boolean; readonly action?: string; readonly reason?: string; readonly next?: string }>
+  pull(source: string): Promise<PullView>
+  /** Pull each source of a group's list on its own: one that is refused does not stop the others. */
+  pullList(from: string): Promise<PullListView>
   planPublish(name: string, options?: PublishOptionsView): Promise<PublishPlanView | { readonly ok: false; readonly reason: string; readonly next: string }>
   publish(name: string, confirmed: PublishPlanView, options?: PublishOptionsView): Promise<{ readonly ok: boolean; readonly reason?: string }>
 }
 
+/** What one pull did, or why it was refused. */
+export interface PullView { readonly ok: boolean; readonly action?: string; readonly name?: string; readonly reason?: string; readonly next?: string }
+
+/** What a list pull did for each source, or why the list itself was refused (then nothing was pulled). */
+export type PullListView =
+  | { readonly ok: true; readonly from: string; readonly entries: readonly { readonly line: number; readonly source: string; readonly result: PullView }[] }
+  | { readonly ok: false; readonly reason: string; readonly next: string }
+
 /** Who a plan publishes as, and under which license; the service's defaults when absent. */
 export interface PublishOptionsView {
   readonly owner?: string
@@ -159,7 +169,7 @@ export class Door {
       }
       case 'plugin-list': return this.plugin(plugins => plugins.list(), false, this.installed())
       case 'plugin-add': return this.plugin(extensions => extensions.install(this.insideApp(input.folder)))
-      case 'plugin-pull': return this.pull(input.source)
+      case 'plugin-pull': return input.from === undefined ? this.pull(input.source) : this.pullList(input.from, input.source)
       case 'plugin-publish': return this.planPublish(input)
       case 'plugin-remove': {
         const name = input.name
@@ -388,12 +398,28 @@ export class Door {
     if (typeof source !== 'string' || source === '') throw new DoorError('invalid', 'plugin pull needs a source, e.g. plugin pull github:someone/pomodoro@0.1.0')
     const value = await this.share().pull(source)
     // A refusal is a failed command, so a script does not read it as done; it changed nothing, and the open pages stay.
-    if (!value.ok) throw new DoorError('refused', `${value.reason ?? 'the pull was refused'}. ${value.next ?? 'nothing changed'}.`)
+    if (!value.ok) throw new DoorError('refused', `${sentence(value.reason ?? 'the pull was refused')} ${sentence(value.next ?? 'nothing changed')}`)
     // Neither did pulling what is already there change anything.
     if (value.action !== 'unchanged' && this.deps.reloadOnChange !== false) await this.deps.channel.reloadAll()
     return { value, text: JSON.stringify(value, null, 2) }
   }
 
+  /** A group's list: every source is pulled on its own, so one refused plugin is named with its reason and the others still install and run. */
+  private async pullList(from: unknown, source: unknown): Promise<VerbAnswer> {
+    if (source !== undefined) throw new DoorError('invalid', 'plugin pull takes a source or --from <list>, not both')
+    if (typeof from !== 'string' || from === '') throw new DoorError('invalid', 'plugin pull --from needs a list, e.g. plugin pull --from group.txt')
+    const value = await this.share().pullList(from)
+    if (!value.ok) throw new DoorError('refused', `${sentence(value.reason)} ${sentence(value.next)}`)
+    const changed = value.entries.some(entry => entry.result.ok && entry.result.action !== 'unchanged')
+    if (changed && this.deps.reloadOnChange !== false) await this.deps.channel.reloadAll()
+    const lines = value.entries.map(entry => `${entry.source}: ${pullLine(entry.result)}`)
+    const refused = value.entries.filter(entry => !entry.result.ok)
+    const summary = `${String(value.entries.length - refused.length)} of ${String(value.entries.length)} from ${value.from} pulled`
+    // Some refused: the command failed, so a script sees it, but the ones that came in stay in and keep running.
+    if (refused.length > 0) throw new DoorError('refused', [`${summary}; ${String(refused.length)} refused, the others are in and running.`, ...lines].join('\n'))
+    return { value, text: [`${summary}.`, ...lines].join('\n') }
+  }
+
   /** A folder named by an agent, resolved from the app folder; it must be inside the app. */
   private insideApp(folder: unknown): string {
     if (typeof folder !== 'string' || folder === '') throw new DoorError('invalid', 'plugin add needs a folder, e.g. plugins/pomodoro')
@@ -426,3 +452,15 @@ export class Door {
     return { value, text: typeof value === 'string' ? value : JSON.stringify(value, null, 2) }
   }
 }
+
+/** One source's outcome in a list pull, as a person reads it. */
+function pullLine(result: PullView): string {
+  if (!result.ok) return `refused: ${sentence(result.reason ?? 'the pull was refused')} ${sentence(result.next ?? 'nothing changed')}`
+  return `${result.action ?? 'pulled'}${result.name === undefined ? '' : ` ${result.name}`}`
+}
+
+/** A text as one sentence: the full stop added only when it has no closing punctuation of its own (a reason may end with one, a next step often does). */
+function sentence(text: string): string {
+  const trimmed = text.trim()
+  return /[.!?]$/u.test(trimmed) ? trimmed : `${trimmed}.`
+}

package/plugins/acryl-door/src/host/verbs.ts

@@ -87,9 +87,9 @@ export const VERB_SPECS: Readonly<Record<Verb, VerbSpec>> = {
     arguments: { type: 'object', properties: { folder: { type: 'string', description: 'a folder inside the app, e.g. plugins/pomodoro' } }, required: ['folder'], additionalProperties: false },
   },
   'plugin-pull': {
-    usage: 'plugin pull <source>: fetch a plugin someone released (github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz), check it and start it, live',
-    description: 'Fetch a plugin someone released, without running anything; check its digest, that it works on every OS and that this app has the services it needs; then install and start it without a restart. A refusal says why and changes nothing.',
-    arguments: { type: 'object', properties: { source: { type: 'string', description: 'github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz path or https address' } }, required: ['source'], additionalProperties: false },
+    usage: 'plugin pull <source> | --from <list>: fetch a plugin someone released (github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz), or every plugin of a group\'s list, check each and start it, live',
+    description: 'Fetch a plugin someone released, without running anything; check its digest, that it works on every OS and that this app has the services it needs; then install and start it without a restart. A refusal says why and changes nothing. With from instead of source, pull every source of a group\'s list (one per line, # comments); each is pulled on its own, so a refused one is named with its reason and the others still come in.',
+    arguments: { type: 'object', properties: { source: { type: 'string', description: 'github:<owner>/<repo>[@<version>][@sha256:<digest>], or a .tgz path or https address' }, from: { type: 'string', description: 'instead of source: a list of sources, a file in the app (e.g. group.txt) or an https address' } }, additionalProperties: false },
   },
   'plugin-publish': {
     usage: 'plugin publish <name> [--owner <account>] [--license <id>]: show what publishing this plugin would send; in a person\'s own terminal, ask them',

package/plugins/extensions/index.ts

@@ -116,6 +116,8 @@ export interface ExtensionInfo {
   readonly missing: readonly string[]
   /** The source folder no longer exists; the last installed version still runs. */
   readonly stale: boolean
+  /** The routes its mount added, as the plugin wrote them (without the frame's prefix), so a surface can link to its pages. */
+  readonly routes: readonly { readonly method: string; readonly path: string }[]
 }
 
 export type InstallResult =
@@ -353,6 +355,7 @@ export class Extensions extends Service {
           state,
           missing: state === 'pending' ? this.missing(entry.module) : [],
           stale: this.stale.has(entry.name),
+          routes: entry.routes.map(({ method, path }) => ({ method, path: this.written(path) })),
         }
       })
       .sort((a, b) => a.name.localeCompare(b.name))
@@ -609,6 +612,13 @@ export class Extensions extends Service {
     return servedRoutes(fibers)
   }
 
+  /** A served path as the plugin wrote it: without the frame's canvas prefix. */
+  private written(path: string): string {
+    return this.routePrefix !== '' && path.startsWith(`${this.routePrefix}/`)
+      ? path.slice(this.routePrefix.length)
+      : path
+  }
+
   /**
    * A route the new plugin added that another plugin already serves: the router would answer with the other one, so the new route would never be
    * reached. Refused before the plugin's own check, which the other plugin's answer would pass.
@@ -624,15 +634,11 @@ export class Extensions extends Service {
       [...this.installed.values()].find((entry) =>
         entry.routes.some((own) => own.method === taken.method && own.path === taken.path),
       )?.name ?? (taken.owner === '' ? 'the app' : taken.owner)
-    const shown = (path: string): string =>
-      this.routePrefix !== '' && path.startsWith(`${this.routePrefix}/`)
-        ? path.slice(this.routePrefix.length)
-        : path
     const same =
-      taken.path === route.path ? '' : ` (it serves ${taken.method} ${shown(taken.path)})`
+      taken.path === route.path ? '' : ` (it serves ${taken.method} ${this.written(taken.path)})`
     return {
       stage: 'conflict',
-      error: `${route.method} ${shown(route.path)} is already served by ${owner}${same}; rename this plugin's route, or remove ${owner} first`,
+      error: `${route.method} ${this.written(route.path)} is already served by ${owner}${same}; rename this plugin's route, or remove ${owner} first`,
     }
   }
 

package/plugins/plugin-share/index.ts

@@ -10,6 +10,7 @@ import {
   readFileSync,
   renameSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
@@ -54,6 +55,7 @@ import {
   refuse,
   splitDigest,
 } from './pull-check.ts'
+import { LIST_MAX_BYTES, parsePullList, pullListLocation } from './pull-list.ts'
 import { type PulledRecord, pulledRecords, withPulledRecord } from './pulled-records.ts'
 
 export type {
@@ -76,6 +78,8 @@ export interface PluginShareConfig {
   releases?: ReleasePort
   /** Where a publish goes. Defaults to the person's own `gh` and `git`. */
   publish?: PublishPorts
+  /** How an https address is read: a release `.tgz` and a list of sources. Defaults to HTTPS with the hub's size and time limits. */
+  download?: (url: string) => Promise<Uint8Array>
 }
 
 export type PullResult =
@@ -94,6 +98,19 @@ export type PullResult =
     }
   | PullRefused
 
+/** One source of a list and what pulling it did. */
+export interface PullListEntry {
+  /** Its line in the list. */
+  readonly line: number
+  readonly source: string
+  readonly result: PullResult
+}
+
+/** A list pulled: every source with its own result (some may be refused while the others install), or the list itself refused. */
+export type PullListResult =
+  | { readonly ok: true; readonly from: string; readonly entries: readonly PullListEntry[] }
+  | PullRefused
+
 /** One plugin installed while the app runs, as a person reads the list: what it is and, for one pulled, where it came from and who released it. */
 /** What extensions says about an installed plugin (its state, the services a pending one waits for, ...), and where a pulled one came from. */
 export interface SharedPluginInfo extends ExtensionInfo {
@@ -101,6 +118,8 @@ export interface SharedPluginInfo extends ExtensionInfo {
   readonly pulledFrom?: string
   /** Who released it: the account of a `github:` source or of a release address on github.com. */
   readonly author?: string
+  /** The version its `package.json` names (`version` is the installed content's short digest); absent without one. */
+  readonly release?: string
 }
 
 /** What removing a plugin did with its folder in `plugins/`. */
@@ -130,6 +149,20 @@ declare module '@deepseek-ai/cordis' {
 const authorOf = (source: string): string | undefined =>
   (/^github:([^/]+)\//u.exec(source) ?? /^https:\/\/github\.com\/([^/]+)\//u.exec(source))?.[1]
 
+/** The version a plugin folder's `package.json` names, when it names a plain one. */
+function releaseOf(folder: string): string | undefined {
+  try {
+    const version = (
+      JSON.parse(readFileSync(join(folder, 'package.json'), 'utf8')) as { version?: unknown }
+    ).version
+    return typeof version === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$/u.test(version)
+      ? version
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /** The license a new public plugin is offered under; the plan shows it before the person says yes. */
 const DEFAULT_LICENSE = 'MIT'
 const LICENSE_ID = /^[A-Za-z0-9][A-Za-z0-9.+-]*$/u
@@ -176,6 +209,7 @@ export class PluginShare extends Service {
   readonly restored: Promise<readonly RestoreOutcome[]>
   private readonly dir: string
   private readonly releases: ReleasePort
+  private readonly download: (url: string) => Promise<Uint8Array>
   private readonly ports: PublishPorts
   /** One at a time: two pulls of one name must not race for its folder, nor two publishes for its package. */
   private queue: Promise<unknown> = Promise.resolve()
@@ -193,6 +227,7 @@ export class PluginShare extends Service {
     this.own = ctx
     this.dir = resolve(config.dir ?? join(ctx.appInstance.root, 'plugins'))
     this.releases = config.releases ?? githubReleasesOverHttps()
+    this.download = config.download ?? httpsDownload()
     this.ports = config.publish ?? { host: githubCli(), git: gitCli() }
     // Removing a plugin removes its record. Listened to here, not asked of each caller: every way of removing it goes through extensions.
     ctx.on('extensions/changed', (name, change) => {
@@ -209,6 +244,67 @@ export class PluginShare extends Service {
     return this.inTurn(() => this.pullNow(source))
   }
 
+  /**
+   * Pull every source of a list, a file in the app or an https address (a gist, a file in the group's repository): one after the other and each on
+   * its own, so a source that is refused, or clashes with a plugin already here, is reported with its reason while the others install and keep running.
+   * A list that cannot be read, or has a line that is not one source, pulls nothing.
+   */
+  async pullList(from: string): Promise<PullListResult> {
+    const text = await this.readList(from)
+    if (typeof text !== 'string') return text
+    const { sources, problems } = parsePullList(text)
+    if (problems.length > 0)
+      return refuse('list', `${from}: ${problems.join('; ')}`, 'fix the list; nothing was pulled')
+    if (sources.length === 0)
+      return refuse(
+        'list',
+        `${from} names no plugin`,
+        'write one source per line, e.g. github:someone/pomodoro@0.1.0',
+      )
+    const entries: PullListEntry[] = []
+    for (const { line, source } of sources)
+      entries.push({ line, source, result: await this.pull(source) })
+    return { ok: true, from, entries }
+  }
+
+  /** The text of a list, or why it cannot be read. */
+  private async readList(from: string): Promise<string | PullRefused> {
+    const where = pullListLocation(from)
+    if (where === undefined)
+      return refuse(
+        'list',
+        `"${from}" is not a list`,
+        'name a file in the app (e.g. group.txt) or an https address of one',
+      )
+    try {
+      let bytes: Uint8Array
+      if (where.kind === 'address') bytes = await this.download(where.url)
+      else {
+        const path = resolve(this.own.appInstance.root, where.path)
+        if (!existsSync(path) || !statSync(path).isFile())
+          return refuse(
+            'list',
+            `there is no file ${where.path}`,
+            'name a file in the app, or an https address',
+          )
+        bytes = readFileSync(path)
+      }
+      if (bytes.length > LIST_MAX_BYTES)
+        return refuse(
+          'list',
+          `${from} is larger than ${String(LIST_MAX_BYTES)} bytes, so it is not a list of plugins`,
+          'name the list itself',
+        )
+      return new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+    } catch (cause) {
+      return refuse(
+        'list',
+        `${from} could not be read: ${reasonOf(cause)}`,
+        'check the address; nothing was pulled',
+      )
+    }
+  }
+
   /**
    * The content digest of a pulled plugin as it was installed: set before its folder appears, so whoever sees the folder change can tell the release as
    * pulled from an edit (the frame then does not load the app again for it). A pull from a local file has no record in `blend.yaml`; this knows it too.
@@ -224,10 +320,12 @@ export class PluginShare extends Service {
     return this.own.extensions.list().map((info) => {
       const record = records[info.name]
       const author = record === undefined ? undefined : authorOf(record.source)
+      const release = releaseOf(join(this.dir, info.name))
       return {
         ...info,
         ...(record === undefined ? {} : { pulledFrom: record.source }),
         ...(author === undefined ? {} : { author }),
+        ...(release === undefined ? {} : { release }),
       }
     })
   }
@@ -457,7 +555,7 @@ export class PluginShare extends Service {
           {
             store: new PluginStore(scratch),
             releases: this.releases,
-            download: httpsDownload(),
+            download: this.download,
           },
           expectIntegrity === undefined ? {} : { expectIntegrity },
         )

package/plugins/plugin-share/publish.ts

@@ -58,8 +58,22 @@ export interface PublishPorts {
 export const pullLineOf = (owner: string, repo: string, version: string, digest: string): string =>
   `npm run acryl -- plugin pull github:${owner}/${repo}@${version}@sha256:${digest}`
 
-/** The same plan: what the person confirmed is what would be published now. `released` only explains the version, and is gone once the next one is packaged. */
+/**
+ * The same plan: what the person confirmed is what would be published now. `released` only explains the version, and is gone once the next one is packaged.
+ * Field by field, so a plan that came back through JSON from another surface (the frame's confirm) is the same plan whatever order its fields arrived in.
+ */
 export function samePlan(a: PublishPlan, b: PublishPlan): boolean {
-  const compared = ({ released: _released, ...rest }: PublishPlan) => JSON.stringify(rest)
-  return compared(a) === compared(b)
+  return (
+    a.owner === b.owner &&
+    a.repo === b.repo &&
+    a.version === b.version &&
+    a.visibility === b.visibility &&
+    a.license === b.license &&
+    a.createsRepository === b.createsRepository &&
+    a.integrity === b.integrity &&
+    a.digest === b.digest &&
+    a.pullLine === b.pullLine &&
+    a.files.length === b.files.length &&
+    a.files.every((file, index) => file === b.files[index])
+  )
 }

package/plugins/plugin-share/pull-check.ts

@@ -17,6 +17,8 @@ export type Refusal =
   | 'missing-service'
   | 'folder-exists'
   | 'install'
+  /** A list of sources that cannot be read, or holds a line that is not one source. */
+  | 'list'
 
 export interface PullRefused {
   readonly ok: false

package/plugins/plugin-share/pull-list.ts

@@ -0,0 +1,71 @@
+/**
+ * A group's list of plugins: one source per line, as each person sends it (`github:<owner>/<repo>@<version>@sha256:<digest>`, or the whole line
+ * `plugin publish` prints). The list is text a person or a group keeps (a file in the app, a gist, a file in a repository), so reading it is
+ * forgiving about comments, blank lines and the pasted command, and strict about anything else: a line that is not one source is named, not guessed.
+ */
+
+/** A list is a few lines of text: anything larger is not a list of plugins. */
+export const LIST_MAX_BYTES = 64 * 1024
+
+/** More sources than a group has people is a mistake, not a workshop. */
+export const LIST_MAX_SOURCES = 100
+
+/** The command a person pastes from `plugin publish`: only its source is kept. */
+const PULL_COMMAND = /^(?:npm run acryl --\s+)?plugin pull\s+/u
+
+/** A `#` at the start of a line or after a space begins a comment; a source never holds one there. */
+const COMMENT = /(?:^|\s)#.*$/u
+
+export interface PullListLine {
+  /** Its line in the list, from 1, so a problem is easy to find. */
+  readonly line: number
+  readonly source: string
+}
+
+export interface ParsedPullList {
+  /** The sources in their order, each once. */
+  readonly sources: readonly PullListLine[]
+  /** Lines that are not one source, each with what is wrong. */
+  readonly problems: readonly string[]
+}
+
+/** The sources of a list, in order and without repeats, and the lines that are not a source. */
+export function parsePullList(text: string): ParsedPullList {
+  const sources: PullListLine[] = []
+  const problems: string[] = []
+  const seen = new Set<string>()
+  text.split(/\r?\n/u).forEach((raw, index) => {
+    const line = index + 1
+    const value = raw.replace(COMMENT, '').trim().replace(PULL_COMMAND, '').trim()
+    if (value === '') return
+    if (/\s/u.test(value)) {
+      problems.push(
+        `line ${String(line)} holds more than one word ("${value}"); write one source per line`,
+      )
+      return
+    }
+    if (seen.has(value)) return
+    seen.add(value)
+    sources.push({ line, source: value })
+  })
+  if (sources.length > LIST_MAX_SOURCES)
+    problems.push(
+      `the list has ${String(sources.length)} sources; a list holds at most ${String(LIST_MAX_SOURCES)}`,
+    )
+  return { sources, problems }
+}
+
+/** Where a list is read from: an https address, or a file (relative to the app folder). */
+export type PullListLocation =
+  | { readonly kind: 'address'; readonly url: string }
+  | { readonly kind: 'file'; readonly path: string }
+
+/** @returns undefined for something that is neither (an http: address, a github: source): the caller names what a list may be. */
+export function pullListLocation(from: string): PullListLocation | undefined {
+  const value = from.trim()
+  if (value === '') return undefined
+  if (/^https:\/\//iu.test(value)) return { kind: 'address', url: value }
+  // A drive letter (C:\...) is a path; any other scheme is not a place a list is read from.
+  if (/^[a-z][a-z0-9+.-]+:/iu.test(value) && !/^[a-z]:[\\/]/iu.test(value)) return undefined
+  return { kind: 'file', path: value }
+}