agy-plugin-porter 0.1.0 → 0.2.0

package/lib/rules-compiler.mjs

@@ -9,7 +9,7 @@
 // - .cursorrules and Roo/Cline/Kilo workspace rules -> always_on rules
 // A rule over agy's 24 KB per-file limit is reported unported instead of being
 // silently truncated.
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 
 import { readJson } from './detector.mjs';
@@ -20,10 +20,19 @@ export const RULE_BYTES = 24_000;
 export const RULES_BUDGET_TOKENS = 20_000;
 
 const read = (file) => readFileSync(file, 'utf8').replace(/^/, '').replace(/\r\n?/g, '\n');
-const isFile = (file) => existsSync(file) && statSync(file).isFile();
-const mdFiles = (dir) => (existsSync(dir) && statSync(dir).isDirectory()
-  ? readdirSync(dir).filter((f) => /\.(md|mdc|txt)$/i.test(f)).sort().map((f) => join(dir, f))
-  : []);
+const isFile = (file) => existsSync(file) && !lstatSync(file).isSymbolicLink() && statSync(file).isFile();
+const mdFiles = (dir) => {
+  if (!existsSync(dir) || lstatSync(dir).isSymbolicLink() || !statSync(dir).isDirectory()) return [];
+  const out = [];
+  for (const entry of readdirSync(dir).sort()) {
+    const full = join(dir, entry);
+    if (lstatSync(full).isSymbolicLink()) continue;
+    const st = statSync(full);
+    if (st.isDirectory()) out.push(...mdFiles(full));
+    else if (/\.(md|mdc|txt)$/i.test(entry)) out.push(full);
+  }
+  return out;
+};
 
 function geminiContextFiles(srcDir) {
   let names = ['GEMINI.md'];
@@ -44,15 +53,39 @@ export function cursorTrigger(data) {
   return { trigger: 'manual' };
 }
 
+const RULE_VAR_RE = /(?:\$\{(?:CLAUDE_PLUGIN_ROOT|PLUGIN_ROOT|extensionPath|GEMINI_PLUGIN_PATH)\}|\$(?:CLAUDE_PLUGIN_ROOT|PLUGIN_ROOT|extensionPath|GEMINI_PLUGIN_PATH)\b)((?:[\\/]|\$\{\/\})+)([^\s"'`<>|*?()[\]{}]*)/g;
+const RULE_VAR_BARE_RE = /\$\{(?:CLAUDE_PLUGIN_ROOT|PLUGIN_ROOT|extensionPath|GEMINI_PLUGIN_PATH)\}|\$(?:CLAUDE_PLUGIN_ROOT|PLUGIN_ROOT|extensionPath|GEMINI_PLUGIN_PATH)\b/g;
+
+export function rewriteRuleVars(text, label, report) {
+  if (typeof text !== 'string') return text;
+  let count = 0;
+  let out = text.replace(RULE_VAR_RE, (_, _sep, tail) => {
+    count++;
+    const normalizedTail = (tail ?? '').replace(/(?:\$\{\/\}|[\\/])+/g, '/');
+    return `./${normalizedTail}`;
+  });
+  out = out.replace(RULE_VAR_BARE_RE, () => {
+    count++;
+    return '.';
+  });
+  if (count > 0 && report) {
+    const msg = `${label}: rewrote plugin-root variable(s) to relative path(s)`;
+    if (!report.warnings.includes(msg)) report.warnings.push(msg);
+  }
+  return out;
+}
+
 // A glob-scoped or manual Cursor rule becomes a skill the agent can pull in.
 function mdcToSkill(pluginDir, base, trigger, body, item, report) {
   let name = slugifyName(base);
   for (let n = 2; existsSync(join(pluginDir, 'skills', name)); n++) name = `${slugifyName(base)}-${n}`;
-  const description = trigger.trigger === 'glob'
+  const rawDescription = trigger.trigger === 'glob'
     ? `Use when working on files matching ${trigger.globs}.${trigger.description ? ` ${trigger.description}` : ''}`
     : `Use only when the user asks for the "${base}" rule.`;
+  const description = rewriteRuleVars(rawDescription, item, report);
+  const cleanBody = rewriteRuleVars(body, item, report);
   mkdirSync(join(pluginDir, 'skills', name), { recursive: true });
-  writeFileSync(join(pluginDir, 'skills', name, 'SKILL.md'), formatFrontmatter({ name, description }, `\n${body.trim()}\n`));
+  writeFileSync(join(pluginDir, 'skills', name, 'SKILL.md'), formatFrontmatter({ name, description }, `\n${cleanBody.trim()}\n`));
   report.ported.push(`${item} → skills/${name}`);
 }
 
@@ -61,7 +94,8 @@ export function compileRules(pluginDir, { srcDir, ecosystems }) {
   const rulesDir = join(pluginDir, 'rules');
   const outputs = [];
   const used = new Set(existsSync(rulesDir) ? readdirSync(rulesDir).map((f) => f.toLowerCase()) : []);
-  const add = (file, content, item, alwaysOn) => {
+  const add = (file, rawContent, item, alwaysOn) => {
+    const content = rewriteRuleVars(rawContent, item, report);
     if (Buffer.byteLength(content) > RULE_BYTES) {
       report.unported.push({ item, reason: `over agy's 24 KB per-rule limit (${Buffer.byteLength(content)} bytes); agy would truncate it` });
       return;
@@ -73,6 +107,10 @@ export function compileRules(pluginDir, { srcDir, ecosystems }) {
     report.ported.push(`${item} → rules/${name}`);
   };
 
+  const preExisting = existsSync(rulesDir)
+    ? readdirSync(rulesDir).filter((f) => /\.md$/i.test(f) && isFile(join(rulesDir, f)))
+    : [];
+
   // Always-on context files become one rules/AGENTS.md.
   const context = [];
   if (ecosystems.includes('claude')) context.push('CLAUDE.md');
@@ -96,6 +134,27 @@ export function compileRules(pluginDir, { srcDir, ecosystems }) {
     add('AGENTS.md', `${sections.join('\n\n')}\n`, sources.join(' + '), true);
   }
 
+  for (const f of preExisting) {
+    if (sections.length && f.toLowerCase() === 'agents.md') continue;
+    const full = join(rulesDir, f);
+    const raw = read(full);
+    const item = `rules/${f}`;
+    const content = rewriteRuleVars(raw, item, report);
+    if (Buffer.byteLength(content) > RULE_BYTES) {
+      rmSync(full, { force: true });
+      used.delete(f.toLowerCase());
+      report.unported.push({ item, reason: `over agy's 24 KB per-rule limit (${Buffer.byteLength(content)} bytes); agy would truncate it` });
+      continue;
+    }
+    if (content !== raw) writeFileSync(full, content);
+    let alwaysOn = true;
+    try {
+      const fm = splitFrontmatter(content);
+      if (fm.hasFrontmatter && fm.data.trigger && fm.data.trigger !== 'always_on') alwaysOn = false;
+    } catch {}
+    outputs.push({ name: f, content, alwaysOn, existing: true });
+  }
+
   if (ecosystems.includes('cursor')) {
     for (const file of mdFiles(join(srcDir, '.cursor/rules')).filter((f) => f.endsWith('.mdc'))) {
       let parsed;
@@ -110,6 +169,7 @@ export function compileRules(pluginDir, { srcDir, ecosystems }) {
         mdcToSkill(pluginDir, basename(file, '.mdc'), trigger, parsed.body, item, report);
         continue;
       }
+      if (trigger.description) trigger.description = rewriteRuleVars(trigger.description, item, report);
       add(`${slugifyName(basename(file, '.mdc'))}.md`, formatFrontmatter(trigger, parsed.body.trim() + '\n'), item, trigger.trigger === 'always_on');
     }
     if (isFile(join(srcDir, '.cursorrules'))) {
@@ -133,8 +193,9 @@ export function compileRules(pluginDir, { srcDir, ecosystems }) {
   for (const name of ['CLAUDE.md', 'GEMINI.md', 'AGENTS.md', ...geminiContextFiles(srcDir)]) {
     rmSync(join(pluginDir, name), { force: true });
   }
-  if (outputs.length) mkdirSync(rulesDir, { recursive: true });
-  for (const { name, content } of outputs) writeFileSync(join(rulesDir, name), content);
+  const newOutputs = outputs.filter((o) => !o.existing);
+  if (newOutputs.length) mkdirSync(rulesDir, { recursive: true });
+  for (const { name, content } of newOutputs) writeFileSync(join(rulesDir, name), content);
 
   const alwaysOnTokens = Math.ceil(outputs.filter((o) => o.alwaysOn).reduce((n, o) => n + Buffer.byteLength(o.content), 0) / 4);
   if (alwaysOnTokens > RULES_BUDGET_TOKENS) {

package/lib/skill-compiler.mjs

@@ -6,6 +6,7 @@
 import { cpSync, existsSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { rewriteRuleVars } from './rules-compiler.mjs';
 import { formatFrontmatter, splitFrontmatter } from './yaml-lite.mjs';
 
 export const SKILL_NAME = /^[a-z0-9][a-z0-9-]*$/;
@@ -33,7 +34,7 @@ export function normalizeSkill(skillsDir, folder, report, { fromCommand = false
   let { data, body, hasFrontmatter } = (() => {
     try { return splitFrontmatter(text); } catch (err) {
       report.warnings.push(`skill:${folder}: frontmatter isn't parseable (${err.message}); rebuilt from the folder name`);
-      return { data: {}, body: text.replace(/^---\n[\s\S]*?\n---\n?/, ''), hasFrontmatter: false };
+      return { data: {}, body: text.replace(/\r\n?/g, '\n').replace(/^---\n[\s\S]*?\n---\n?/, ''), hasFrontmatter: false };
     }
   })();
   const notes = [];
@@ -73,6 +74,8 @@ export function normalizeSkill(skillsDir, folder, report, { fromCommand = false
   if (/^!`|!\{[^}]*\}/m.test(body)) {
     report.warnings.push(`skill:${name}: inline shell execution (!\`…\` / !{…}) isn't supported by agy and is left as text`);
   }
+  out.description = rewriteRuleVars(out.description, `skill:${name}`, report);
+  body = rewriteRuleVars(body, `skill:${name}`, report);
   const rewritten = formatFrontmatter(out, body);
   const changed = !hasFrontmatter || rewritten !== text.replace(/^/, '').replace(/\r\n?/g, '\n');
   if (changed) writeFileSync(join(skillsDir, finalFolder, 'SKILL.md'), rewritten);

package/lib/source.mjs

@@ -1,7 +1,7 @@
 // Resolves a --source: a local path, or `owner/repo[@ref]` fetched from GitHub
 // at that ref (tag, branch or commit SHA) into a temp dir.
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync, statSync } from 'node:fs';
+import { chmodSync, existsSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 
@@ -17,6 +17,27 @@ function git(args, cwd) {
   return run.stdout.trim();
 }
 
+function makeWritable(dir) {
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) makeWritable(p);
+    else if (e.isFile()) chmodSync(p, 0o666);
+  }
+}
+
+// rmSync -r -f, except that Node 24's rmSync (agy-node's) can't delete read-only
+// files on Windows, which a git clone's pack files are: on EPERM, make every file
+// writable and try once more.
+export function removeTree(dir) {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch (err) {
+    if (err.code !== 'EPERM' || !existsSync(dir)) throw err;
+    makeWritable(dir);
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 export function parseSourceSpec(spec) {
   if (existsSync(spec)) return { kind: 'path', path: resolve(spec) };
   const m = GITHUB.exec(spec);
@@ -34,11 +55,13 @@ export function resolveSource(spec, { subPath } = {}) {
     root = parsed.path;
   } else {
     root = mkdtempSync(join(tmpdir(), 'agy-porter-src-'));
-    cleanup = () => rmSync(root, { recursive: true, force: true });
+    cleanup = () => removeTree(root);
     try {
       const ref = parsed.ref ?? 'HEAD';
       if (ref.startsWith('-')) throw new Error(`invalid ref "${ref}"`);
       git(['init', '-q'], root);
+      // Keep the upstream's line endings: on Windows, autocrlf would rewrite every file.
+      git(['config', 'core.autocrlf', 'false'], root);
       // "--": git reads everything after it as a repository or refspec, never an option.
       git(['fetch', '-q', '--depth', '1', '--', `https://github.com/${parsed.owner}/${parsed.repo}.git`, ref], root);
       git(['checkout', '-q', 'FETCH_HEAD'], root);

package/lib/static-auditor.mjs

@@ -2,9 +2,10 @@
 // characters (U+E0000–E007F, invisible prompt-injection carriers), flags risky
 // patterns, checks agy's rule and skill size limits, and infers the capability
 // tier with the same names and meaning as Hangar's TIER_*.
-import { closeSync, existsSync, fstatSync, ftruncateSync, openSync, readdirSync, readFileSync, statSync, writeSync } from 'node:fs';
+import { closeSync, existsSync, fstatSync, ftruncateSync, lstatSync, openSync, readdirSync, readFileSync, writeSync } from 'node:fs';
 import { extname, join } from 'node:path';
 
+import { extractServerMap } from './manifest-sanitizer.mjs';
 import { RULE_BYTES, RULES_BUDGET_TOKENS } from './rules-compiler.mjs';
 import { splitFrontmatter } from './yaml-lite.mjs';
 
@@ -14,7 +15,7 @@ const BINARY_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.
 const SKIP_DIRS = new Set(['.git', 'node_modules']);
 
 const TAGS = /[\u{E0000}-\u{E007F}]/gu;
-const BIDI = /[‪-‮⁦-⁩]/;
+const BIDI = /[\u202A-\u202E\u2066-\u2069]/;
 const PATTERNS = [
   ['pipe-to-shell', 'high', /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba|z|da|k)?sh\b/i],
   ['pipe-to-shell', 'high', /\b(iwr|irm|Invoke-WebRequest|Invoke-RestMethod)\b[^\n|]*\|\s*(iex|Invoke-Expression)\b/i],
@@ -49,9 +50,12 @@ function* walk(dir, rel = '') {
   for (const entry of readdirSync(dir)) {
     if (SKIP_DIRS.has(entry)) continue;
     const full = join(dir, entry);
+    let lst;
+    try { lst = lstatSync(full); } catch { continue; }
+    if (lst.isSymbolicLink()) continue;
     const path = rel ? `${rel}/${entry}` : entry;
-    if (statSync(full).isDirectory()) yield* walk(full, path);
-    else yield { full, path };
+    if (lst.isDirectory()) yield* walk(full, path);
+    else if (lst.isFile()) yield { full, path };
   }
 }
 
@@ -80,16 +84,41 @@ function readJsonIf(file) {
   try { return existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : null; } catch { return null; }
 }
 
-// TIER_2: anything that runs a local command (hooks, stdio MCP servers).
+function collectHookEvents(obj, events) {
+  if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return;
+  for (const [k, v] of Object.entries(obj)) {
+    if (k === 'enabled' || k === 'description' || k === 'modules') continue;
+    if (Array.isArray(v)) events.add(k);
+    else if (v && typeof v === 'object') collectHookEvents(v, events);
+  }
+}
+
+// TIER_2: anything that runs a local command (hooks, stdio MCP servers, sidecars).
 // TIER_3: subagents, or hooks that steer the agent loop (Stop, PostInvocation).
 export function inferTier(pluginDir) {
   const reasons = [];
   let rank = 0;
-  const hooks = readJsonIf(join(pluginDir, 'hooks.json')) ?? {};
-  const events = new Set(Object.values(hooks).flatMap((h) => Object.keys(h ?? {})).filter((e) => e !== 'enabled'));
+  const events = new Set();
+  for (const rel of ['hooks.json', 'hooks/hooks.json', '.claude-plugin/hooks.json']) {
+    collectHookEvents(readJsonIf(join(pluginDir, rel)), events);
+  }
+  for (const rel of ['plugin.json', '.claude-plugin/plugin.json']) {
+    const manifest = readJsonIf(join(pluginDir, rel));
+    if (manifest?.hooks && typeof manifest.hooks === 'object') collectHookEvents(manifest.hooks, events);
+  }
   if (events.size) { rank = Math.max(rank, 1); reasons.push(`hooks: ${[...events].join(', ')}`); }
   if (events.has('Stop') || events.has('PostInvocation')) { rank = 2; reasons.push('a hook can keep the agent running'); }
-  const servers = Object.entries(readJsonIf(join(pluginDir, 'mcp_config.json'))?.mcpServers ?? {});
+  const mcpMap = {};
+  for (const rel of ['mcp_config.json', '.mcp.json', 'mcp.json']) {
+    Object.assign(mcpMap, extractServerMap(readJsonIf(join(pluginDir, rel))));
+  }
+  for (const rel of ['plugin.json', '.claude-plugin/plugin.json', 'gemini-extension.json']) {
+    const manifest = readJsonIf(join(pluginDir, rel));
+    if (manifest?.mcpServers && typeof manifest.mcpServers === 'object' && !Array.isArray(manifest.mcpServers)) {
+      Object.assign(mcpMap, extractServerMap({ mcpServers: manifest.mcpServers }));
+    }
+  }
+  const servers = Object.entries(mcpMap);
   if (servers.length) {
     rank = Math.max(rank, 1);
     reasons.push(`MCP servers: ${servers.map(([n]) => n).join(', ')}`);
@@ -97,6 +126,16 @@ export function inferTier(pluginDir) {
   const agentsDir = join(pluginDir, 'agents');
   const agents = existsSync(agentsDir) ? readdirSync(agentsDir).filter((f) => f.endsWith('.md')) : [];
   if (agents.length) { rank = 2; reasons.push(`agents: ${agents.map((f) => f.replace(/\.md$/, '')).join(', ')}`); }
+  // Sidecars, including ported UI mods, whose mod.json lists their scan's Tier 3 reasons.
+  const sidecarsDir = join(pluginDir, 'sidecars');
+  const sidecars = existsSync(sidecarsDir) ? readdirSync(sidecarsDir).filter((d) => existsSync(join(sidecarsDir, d, 'sidecar.json'))) : [];
+  if (sidecars.length) { rank = Math.max(rank, 1); reasons.push(`sidecars: ${sidecars.join(', ')} (a full Node process outside agy's permission prompts)`); }
+  for (const id of sidecars) {
+    const mod = readJsonIf(join(sidecarsDir, id, 'mod.json'));
+    if (mod?.tier !== TIERS[2]) continue;
+    rank = 2;
+    reasons.push(`UI mod ${id}: ${(mod.tierReasons ?? []).slice(1).join(', ')}`);
+  }
   return { tier: TIERS[rank], reasons };
 }
 

package/lib/tool-map.mjs

@@ -41,7 +41,6 @@ export const ROO_GROUPS = {
 };
 
 export function unmappedToolReason(name) {
-  if (name.startsWith('mcp__')) return 'MCP tool names are not mapped yet (agy MCP step names are unverified)';
   if (name === 'TodoWrite' || /^Task(Create|Get|List|Update|Output|Stop)$/.test(name)) return 'agy has no built-in tool that does the same job';
   return 'no agy tool with this name';
 }

package/lib/transpiler-engine.mjs

@@ -5,16 +5,18 @@
 // plugin dir. agy only ever runs with HOME/USERPROFILE pointed at a temp dir,
 // so the user's real profile is never read or written.
 import { spawnSync } from 'node:child_process';
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, join, posix, resolve } from 'node:path';
+import { basename, join, resolve, sep } from 'node:path';
 
 import { detect } from './detector.mjs';
 import { compileHooks, writeHookPort } from './hook-compiler.mjs';
 import { sanitizeManifest, sourceManifest } from './manifest-sanitizer.mjs';
+import { compileMods, userConfigDefaults } from './mod-compiler.mjs';
 import { compileModes } from './mode-compiler.mjs';
 import { compileRules } from './rules-compiler.mjs';
 import { compileSkills, slugifyName } from './skill-compiler.mjs';
+import { removeTree } from './source.mjs';
 import { auditPlugin } from './static-auditor.mjs';
 
 const AGY_STAGED = ['claude', 'gemini'];
@@ -23,8 +25,13 @@ export function throwawayEnv(home) {
   return { ...process.env, HOME: home, USERPROFILE: home, NO_COLOR: '1' };
 }
 
+// Spawns agy. An `agy` that names a .mjs/.js file runs under this Node (tests use a stand-in).
+export function spawnAgy(agy, args, options) {
+  return /\.m?js$/i.test(agy) ? spawnSync(process.execPath, [agy, ...args], options) : spawnSync(agy, args, options);
+}
+
 export function runAgy(args, { agy = 'agy', home }) {
-  const run = spawnSync(agy, args, { encoding: 'utf8', env: throwawayEnv(home), timeout: 120_000 });
+  const run = spawnAgy(agy, args, { encoding: 'utf8', env: throwawayEnv(home), timeout: 120_000 });
   if (run.error) throw new Error(`can't run ${agy}: ${run.error.message}`);
   return run;
 }
@@ -63,8 +70,27 @@ export function defaultSlug(srcDir, ecosystems) {
   return slugifyName(typeof name === 'string' && name ? name : basename(resolve(srcDir)));
 }
 
-// Ports srcDir into outDir. Returns the port report.
-export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, validate = false }) {
+function makeCopyFilter(rootDir, skipRe) {
+  let rootReal = '';
+  try { rootReal = realpathSync(rootDir); } catch { rootReal = resolve(rootDir); }
+  return (p) => {
+    if (skipRe.test(p)) return false;
+    try {
+      const lst = lstatSync(p);
+      if (lst.isSymbolicLink()) {
+        const targetReal = realpathSync(p);
+        if (targetReal !== rootReal && !targetReal.startsWith(rootReal + sep)) return false;
+      }
+    } catch {
+      return false;
+    }
+    return true;
+  };
+}
+
+// Ports srcDir into outDir. Returns the port report. `esbuild` overrides the optional
+// esbuild the mod compiler loads for TS/TSX mods (null: act as if it's missing).
+export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, validate = false, esbuild }) {
   srcDir = resolve(srcDir);
   const detection = detect(srcDir);
   const { ecosystems } = detection;
@@ -80,14 +106,14 @@ export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, va
     const pluginDir = join(workDir, 'plugin');
     const stagedPaths = [];
     if (ecosystems.includes('antigravity')) {
-      cpSync(srcDir, pluginDir, { recursive: true, filter: (p) => !/[\\/](\.git|node_modules)$/.test(p) });
+      cpSync(srcDir, pluginDir, { recursive: true, filter: makeCopyFilter(srcDir, /[\\/](\.git|node_modules)$/) });
       report.ported.push('native plugin (copied as is)');
     } else if (ecosystems.some((e) => AGY_STAGED.includes(e))) {
       let stageFrom = srcDir;
       if (detection.manifestless) {
         // agy only detects Claude plugins by their manifest, so stage a copy with one.
         stageFrom = join(workDir, 'src');
-        cpSync(srcDir, stageFrom, { recursive: true, filter: (p) => !/[\\/](\.git|node_modules)$/.test(p) });
+        cpSync(srcDir, stageFrom, { recursive: true, filter: makeCopyFilter(srcDir, /[\\/](\.git|node_modules)$/) });
         mkdirSync(join(stageFrom, '.claude-plugin'));
         writeFileSync(join(stageFrom, '.claude-plugin', 'plugin.json'), JSON.stringify({ name: slug }));
         report.warnings.push('no .claude-plugin/plugin.json: ported as a Claude Code plugin from its default folders');
@@ -95,7 +121,7 @@ export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, va
       const staged = stageWithAgy(stageFrom, { agy, workDir });
       // agy may write the resolved path (macOS /var -> /private/var, Windows 8.3 names).
       stagedPaths.push(...new Set([staged, realpathSync.native(staged)]));
-      cpSync(staged, pluginDir, { recursive: true, filter: (p) => !/[\\/]\.git$/.test(p) });
+      cpSync(staged, pluginDir, { recursive: true, filter: makeCopyFilter(staged, /[\\/]\.git$/) });
     } else {
       mkdirSync(pluginDir);
     }
@@ -105,12 +131,18 @@ export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, va
       const hooks = compileHooks(detection.hookSources, { slug });
       writeHookPort(pluginDir, hooks);
       merge(report, hooks.report);
-      // UI mods are reported, never copied: drop the module files agy staged.
-      for (const mod of detection.uiMods) {
-        const base = posix.dirname(mod.path.split('#')[0]);
-        for (const m of mod.modules) rmSync(join(pluginDir, posix.join(base, String(m))), { force: true });
-        const types = sourceManifest(srcDir, ecosystems).types;
-        if (typeof types === 'string') rmSync(join(pluginDir, types), { force: true });
+      // UI mods become sidecars (it merges its hooks into hooks.json, so it runs after
+      // writeHookPort). The raw module files agy staged are dropped either way.
+      if (detection.uiMods.length) {
+        const manifest = sourceManifest(srcDir, ecosystems);
+        merge(report, compileMods(detection.uiMods, {
+          srcDir, pluginDir, slug, esbuild,
+          sourceName: typeof manifest.name === 'string' ? manifest.name : slug,
+          title: typeof manifest.displayName === 'string' ? manifest.displayName : undefined,
+          version: typeof manifest.version === 'string' ? manifest.version : undefined,
+          options: userConfigDefaults(manifest.userConfig),
+        }));
+        if (typeof manifest.types === 'string') rmSync(join(pluginDir, manifest.types), { force: true });
       }
       merge(report, compileSkills(pluginDir, { srcDir, ecosystems }));
       merge(report, compileRules(pluginDir, { srcDir, ecosystems }));
@@ -124,13 +156,13 @@ export function transpile({ srcDir, outDir, slug, agy = 'agy', force = false, va
     report.tier = audit.tier;
     report.tierReasons = audit.reasons;
 
-    rmSync(outDir, { recursive: true, force: true });
+    removeTree(outDir);
     mkdirSync(outDir, { recursive: true });
     cpSync(pluginDir, outDir, { recursive: true });
     if (validate) report.validation = validateWithAgy(outDir, { agy, workDir });
     return report;
   } finally {
-    rmSync(workDir, { recursive: true, force: true });
+    removeTree(workDir);
   }
 }
 
@@ -150,9 +182,9 @@ export function validateWithAgy(pluginDir, { agy = 'agy', workDir } = {}) {
       ok: run.status === 0,
       components: result.components,
       errors: findings.filter((f) => f.severity === 'error'),
-      warnings: findings.filter((f) => f.severity !== 'error'),
+      warnings: findings.filter((f) => f.severity === 'warning'),
     };
   } finally {
-    if (ownDir) rmSync(dir, { recursive: true, force: true });
+    if (ownDir) removeTree(dir);
   }
 }

package/lib/yaml-lite.mjs

@@ -1,10 +1,11 @@
 // A YAML subset, enough for Markdown frontmatter and `.roomodes`: block maps and
-// sequences, flow `[a, b]` / `{k: v}`, quoted and plain scalars, `|` / `>` block
+// sequences, flow `[a, b]` / `{k: v}` (on one line or several), quoted and plain scalars, `|` / `>` block
 // scalars, multi-line plain scalars and comments. Anchors, tags and multiple
 // documents are not supported. Like agy's loader, it tolerates `: ` inside an
 // unquoted value (`description: Runs checks: lint`).
 
 const KEY = /^("(?:[^"\\]|\\.)*"|'(?:[^']|'')*'|[^\s"'#\-[{][^:#]*?|-[^\s:#][^:#]*?)\s*:(?=\s|$)/;
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
 function unquote(s) {
   if (s.startsWith('"')) {
@@ -46,6 +47,19 @@ function splitFlow(s) {
   return parts.map((p) => p.trim()).filter((p) => p !== '');
 }
 
+// True once every `[` and `{` outside quotes is closed.
+function flowClosed(s) {
+  let depth = 0;
+  let quote = null;
+  for (const c of s) {
+    if (quote) { if (c === quote) quote = null; continue; }
+    if (c === '"' || c === "'") quote = c;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') depth--;
+  }
+  return depth <= 0;
+}
+
 export function parseScalar(raw) {
   const s = stripComment(raw.trim());
   if (s === '') return null;
@@ -55,7 +69,10 @@ export function parseScalar(raw) {
     const obj = {};
     for (const part of splitFlow(s.slice(1, -1))) {
       const m = KEY.exec(part);
-      if (m) obj[unquote(m[1])] = parseScalar(part.slice(m[0].length));
+      if (m) {
+        const k = unquote(m[1]);
+        if (!UNSAFE_KEYS.has(k)) obj[k] = parseScalar(part.slice(m[0].length));
+      }
     }
     return obj;
   }
@@ -99,9 +116,19 @@ export function parseYaml(text) {
     return trimmed === '' ? '' : `${trimmed}\n`;
   }
 
+  // A flow `[...]` or `{...}` that spans lines (`allowed-tools:\n  [\n "Read",\n ]`):
+  // joins lines until its brackets close.
+  function flowValue(first) {
+    let text = stripComment(first);
+    while (!flowClosed(text) && i < lines.length) text += ` ${stripComment(lines[i++].text)}`;
+    if (!flowClosed(text)) throw new Error(`yaml: unclosed ${text[0]} at the end of the document`);
+    return parseScalar(text);
+  }
+
   // A value on the same line as its key or dash, with continuation lines for plain scalars.
   function inlineValue(rest, indent) {
     if (/^[|>][-+0-9]*$/.test(stripComment(rest))) return blockScalar(rest, indent);
+    if (/^[[{]/.test(rest) && !flowClosed(stripComment(rest))) return flowValue(rest);
     const value = parseScalar(rest);
     if (typeof value !== 'string' || /^["'[{]/.test(rest)) return value;
     let joined = value;
@@ -114,6 +141,7 @@ export function parseYaml(text) {
   function node(indent) {
     skip();
     if (i >= lines.length || lines[i].indent < indent) return null;
+    if (/^[[{]/.test(lines[i].text)) return flowValue(lines[i++].text);
     return isSeq(lines[i].text) ? seq(lines[i].indent) : map(lines[i].indent);
   }
 
@@ -147,8 +175,12 @@ export function parseYaml(text) {
       if (rest === '' || rest.startsWith('#')) {
         skip();
         const next = lines[i];
-        obj[key] = next && (next.indent > indent || (next.indent === indent && isSeq(next.text))) ? node(next.indent) : null;
-      } else obj[key] = inlineValue(rest, indent);
+        const val = next && (next.indent > indent || (next.indent === indent && isSeq(next.text))) ? node(next.indent) : null;
+        if (!UNSAFE_KEYS.has(key)) obj[key] = val;
+      } else {
+        const val = inlineValue(rest, indent);
+        if (!UNSAFE_KEYS.has(key)) obj[key] = val;
+      }
     }
     return obj;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agy-plugin-porter",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Ports Claude Code, Gemini CLI, Cursor, Roo/Kilo and Codex plugins to native Antigravity plugins.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,10 @@
   "bugs": {
     "url": "https://github.com/arthurcavallari/agy-plugin-porter/issues"
   },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/arthurcavallari"
+  },
   "keywords": [
     "antigravity",
     "google-antigravity",
@@ -38,18 +42,24 @@
   "bin": {
     "agy-porter": "bin/agy-porter.mjs"
   },
+  "optionalDependencies": {
+    "esbuild": "0.28.2"
+  },
   "files": [
     "bin",
     "lib",
     "scripts/hook-shim.mjs",
+    "scripts/mod-runtime",
     "README.md",
     "LICENSE"
   ],
   "exports": {
     ".": "./lib/index.mjs",
+    "./consent": "./lib/consent.mjs",
     "./detector": "./lib/detector.mjs",
     "./hook-compiler": "./lib/hook-compiler.mjs",
     "./manifest-sanitizer": "./lib/manifest-sanitizer.mjs",
+    "./mod-compiler": "./lib/mod-compiler.mjs",
     "./skill-compiler": "./lib/skill-compiler.mjs",
     "./rules-compiler": "./lib/rules-compiler.mjs",
     "./mode-compiler": "./lib/mode-compiler.mjs",
@@ -58,7 +68,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "test": "node --test test/yaml-lite.test.mjs test/detector.test.mjs test/hook-compiler.test.mjs test/hook-shim.test.mjs test/compilers.test.mjs test/transpiler.test.mjs",
-    "test:pack": "node scripts/pack-smoke.mjs"
+    "test": "node --test test/yaml-lite.test.mjs test/detector.test.mjs test/hook-compiler.test.mjs test/hook-shim.test.mjs test/compilers.test.mjs test/transpiler.test.mjs test/mod-scan.test.mjs test/mod-compiler.test.mjs test/mod-continuation.test.mjs test/mod-runtime.test.mjs test/mod-stage.test.mjs test/mod-e2e.test.mjs test/consent.test.mjs test/session-start.test.mjs test/plugin-build.test.mjs test/plugin-mcp.test.mjs test/cockpit.test.mjs",
+    "test:pack": "node scripts/pack-smoke.mjs",
+    "build:plugin": "node scripts/build-plugin.mjs"
   }
 }