buddy-agent-harness 0.7.0 → 0.8.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "buddy-agent-harness",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/README.md

@@ -18,7 +18,7 @@ In Claude Code, add the [cyberplace](https://github.com/cyberuni/cyberplace) mar
 
 ## CLI
 
-`init` runs behind the `init` skill, which sorts the configuration you already wrote before the command links anything. Install the package alongside `repobuddy` to mount both commands on `buddy`, as `buddy agent-harness doctor` and `buddy agent-harness init`.
+`init` runs behind the `init` skill, which sorts the configuration you already wrote before the command links anything. Install the package alongside `repobuddy` to mount every command on `buddy`, as `buddy agent-harness doctor`, `buddy agent-harness init`, and `buddy agent-harness dep-plugins`.
 
 The repository root's `AGENTS.md` and `.agents/` tree are canonical: `.agents/AGENTS.md` holds shared behavior, `.agents/skills/**/SKILL.md` holds capabilities, and separately named files hold tool settings. The active harness is enabled by default; explicit user preferences add others. The command preserves user-authored configuration and projects only supported mappings; it records nothing on disk.
 
@@ -30,4 +30,12 @@ The repository root's `AGENTS.md` and `.agents/` tree are canonical: `.agents/AG
 npx -y buddy-agent-harness doctor
 ```
 
+`dep-plugins` derives a marketplace catalog for plugins shipped by this repository's own dependencies, so a harness can install them — reaching a whole plugin (agents, commands, hooks, MCP servers) rather than only its skills:
+
+```sh
+npx -y buddy-agent-harness dep-plugins
+```
+
+It writes the catalog, then reports what each detected harness needs to match it and the command that does it. It never touches harness state itself. Claude Code and Codex install from this catalog; Copilot CLI rejects an npm marketplace source, and Cursor exposes no plugin subcommand from a terminal.
+
 It never repairs anything and always exits `0`; each finding names the `init` command that fixes it.

package/dist/{cli-Bvnq8zOL.mjs → cli-4ekejn5W.mjs}

@@ -1,4 +1,5 @@
-import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync } from "node:fs";
+import { createRequire } from "node:module";
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { cli, command, exitCodes, z } from "clibuilder";
 import { homedir, platform } from "node:os";
 import { dirname, join, posix, relative, resolve, sep } from "node:path";
@@ -71,6 +72,618 @@ function binPath(home, executable) {
 	return home && executable.startsWith(home + sep) ? `~${executable.slice(home.length)}` : executable;
 }
 //#endregion
+//#region src/dep-plugins/dep-plugins.ts
+/**
+* Marketplace names generic enough that two repositories are likely to pick the same one. The
+* collision is silent and costly: registering a second marketplace under a name already in use
+* replaces the first, and the install that follows reports "already installed" and does nothing —
+* so the repository silently runs the other one's plugin versions.
+*/
+const GENERIC_NAMES = /* @__PURE__ */ new Set([
+	"deps",
+	"dependencies",
+	"local",
+	"plugins",
+	"marketplace",
+	"plugin",
+	"default"
+]);
+function isGenericName(name) {
+	return GENERIC_NAMES.has(name.toLowerCase());
+}
+/**
+* A marketplace name derived from the consuming package's own name, so two repositories do not
+* collide by default. A scope is folded into the name rather than dropped (`@acme/web` → `acme-web`)
+* because the unscoped half is the part most likely to repeat across organizations.
+*/
+function marketplaceName(packageName) {
+	return packageName.replace(/^@/, "").replace(/\//g, "-").replace(/[^a-zA-Z0-9-_.]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "agent-plugins";
+}
+/**
+* Dependency names a repository declares, both runtime and development.
+*
+* Development dependencies are included on purpose: a plugin that supplies a project's testing or
+* release workflow is a development dependency, and excluding them would drop most of the cases this
+* exists for. Transitive dependencies are never included — see `resolve.ts`.
+*/
+function declaredDependencies(manifest) {
+	if (!manifest || typeof manifest !== "object") return [];
+	const record = manifest;
+	const names = /* @__PURE__ */ new Set();
+	for (const field of ["dependencies", "devDependencies"]) {
+		const group = record[field];
+		if (!group || typeof group !== "object") continue;
+		for (const name of Object.keys(group)) names.add(name);
+	}
+	return [...names].sort();
+}
+/**
+* The catalog is derived in full on every run and never merged into what is already on disk. That is
+* what makes the three cases a consumer cares about — a plugin added, a plugin removed, a version
+* moved — fall out of regeneration instead of needing reconciliation logic of their own.
+*
+* Entries are sorted by name so that a regeneration whose inputs did not change produces a
+* byte-identical file, which is what lets a check mode compare rather than interpret.
+*/
+function buildCatalog({ name, owner, plugins }) {
+	const entries = [...plugins].sort((a, b) => a.plugin.localeCompare(b.plugin)).map(({ plugin, package: pkg, version, description }) => {
+		const source = {
+			source: "npm",
+			package: pkg,
+			version
+		};
+		return description ? {
+			name: plugin,
+			source,
+			description
+		} : {
+			name: plugin,
+			source
+		};
+	});
+	return {
+		name,
+		owner: { name: owner },
+		description: "Plugins provided by this repository’s dependencies. Generated — do not edit.",
+		plugins: entries
+	};
+}
+/** Serialized the way the repository formats JSON, with the trailing newline a text file needs. */
+function serializeCatalog(catalog) {
+	return `${JSON.stringify(catalog, null, "	")}\n`;
+}
+//#endregion
+//#region src/dep-plugins/resolve.ts
+/**
+* Locating a declared dependency on disk, and reading the plugin manifest it may ship.
+*
+* Resolution rather than scanning. Walking `node_modules` finds transitive dependencies nobody
+* vetted, and a skill or plugin is instruction text that steers an agent — an unvetted transitive
+* dependency is a supply-chain surface, not a convenience. Asking the module resolver where a
+* *declared* dependency lives answers the question that was actually asked, and it is correct under
+* npm, pnpm, yarn with the node-modules linker, and bun alike, because all four put a real directory
+* on disk. Only Yarn PnP does not, and it is reported rather than guessed at.
+*/
+function readJson$1(path) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
+* Every ancestor `node_modules/<pkg>` from `startDir` upward. The fallback path only — see
+* {@link packageDir}.
+*/
+function ancestorCandidates(startDir, pkg) {
+	const segments = pkg.split("/");
+	const candidates = [];
+	let dir = startDir;
+	for (;;) {
+		candidates.push(join(dir, "node_modules", ...segments));
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return candidates;
+}
+/**
+* The directory a declared dependency was installed into, or `undefined`.
+*
+* Two mechanisms, in order, because neither alone is sufficient:
+*
+* 1. **`require.resolve('<pkg>/package.json')`, anchored at the declaring manifest.** The anchor
+*    matters: under pnpm's isolated store only the package that declares a dependency can resolve it,
+*    so resolving from a workspace root would miss what a workspace member declared.
+* 2. **A walk up `node_modules`.** Roughly one package in seven declares an `exports` map without a
+*    `./package.json` entry, and those refuse the first mechanism with `ERR_PACKAGE_PATH_NOT_EXPORTED`
+*    however plainly they are installed. Resolving a deeper file instead is not an escape — the same
+*    map blocks that too.
+*/
+function packageDir(pkg, fromManifest) {
+	try {
+		const require = createRequire(fromManifest);
+		return dirname(require.resolve(`${pkg}/package.json`));
+	} catch {}
+	for (const candidate of ancestorCandidates(dirname(fromManifest), pkg)) if (existsSync(join(candidate, "package.json"))) return candidate;
+}
+/**
+* Reads the plugin a dependency ships, if it ships one.
+*
+* The version comes from the dependency's own `package.json` rather than from a lockfile. It is the
+* same number — the version actually installed — and reading it needs no knowledge of which of the
+* four lockfile formats this repository uses.
+*
+* A manifest at the package root is what the Agent Plugins Specification pins, and it is the form a
+* harness accepts as a marketplace source without any vendor-specific manifest alongside it.
+*/
+function readDepPlugin(pkg, fromManifest) {
+	const dir = packageDir(pkg, fromManifest);
+	if (!dir) return {
+		ok: false,
+		package: pkg,
+		reason: "unresolved"
+	};
+	const manifest = readJson$1(join(dir, "plugin.json"));
+	if (!manifest || typeof manifest !== "object") return {
+		ok: false,
+		package: pkg,
+		reason: "no-manifest"
+	};
+	const record = manifest;
+	const name = typeof record["name"] === "string" ? record["name"] : void 0;
+	if (!name) return {
+		ok: false,
+		package: pkg,
+		reason: "unnamed"
+	};
+	const installed = readJson$1(join(dir, "package.json"));
+	const version = typeof installed?.version === "string" ? installed.version : void 0;
+	if (!version) return {
+		ok: false,
+		package: pkg,
+		reason: "no-manifest"
+	};
+	const description = typeof record["description"] === "string" ? record["description"] : void 0;
+	return {
+		ok: true,
+		plugin: description ? {
+			package: pkg,
+			plugin: name,
+			version,
+			description
+		} : {
+			package: pkg,
+			plugin: name,
+			version
+		}
+	};
+}
+/**
+* True when the process is running under Yarn's Plug'n'Play resolver, where packages live inside zip
+* archives rather than as directories. A marketplace source must be a real directory and an npm
+* source must be installable, so a PnP project needs `nodeLinker: node-modules` or the affected
+* dependencies unplugged. Detected rather than worked around, so the report can say so.
+*/
+function isPnp() {
+	return Boolean(process.versions["pnp"]);
+}
+//#endregion
+//#region src/dep-plugins/generate.ts
+/**
+* Deriving a repository's dependency-plugin catalog, and deciding whether what is on disk matches.
+*/
+/**
+* The catalog's home, relative to the repository root.
+*
+* Under this tool's own directory, beside the other files it owns there — the same place as
+* `mcp.toml` and `mcp.projected.json`, and the same shape as `.agents/repobuddy/` and
+* `.agents/cyberlegion/`. A directory named for what it holds rather than for who writes it would be
+* a second convention in a tree that already has one.
+*
+* Not the repository root's `.claude-plugin/`, which is where a repository publishes its *own*
+* plugins for its *own* consumers. Merging the two would leak every dependency-provided plugin into
+* what a consumer sees on adding the published marketplace, and no harness has a notion of a private
+* catalog entry to prevent that. Being a separate directory also makes this one a marketplace root
+* in its own right, which is what lets its entries be resolved without reaching outside it.
+*/
+const CATALOG_DIR = join(".agents", "buddy-agent-harness");
+const CATALOG_PATH = join(CATALOG_DIR, ".claude-plugin", "marketplace.json");
+function readManifest(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+/**
+* Derives the catalog from the repository's declared dependencies.
+*
+* Derived in full every time. A plugin newly added to `package.json` appears, one removed disappears,
+* and a version that moved follows — all three without a line of reconciliation logic, because there
+* is nothing to reconcile against. That is the same rule the vendor manifests already follow: the
+* artifact is derived, never authored.
+*/
+function deriveCatalog(root) {
+	const manifestPath = join(root, "package.json");
+	const manifest = readManifest(manifestPath);
+	const plugins = [];
+	const unresolved = [];
+	for (const pkg of declaredDependencies(manifest)) {
+		const outcome = readDepPlugin(pkg, manifestPath);
+		if (outcome.ok) plugins.push(outcome.plugin);
+		else if (outcome.reason === "unresolved") unresolved.push({
+			package: pkg,
+			reason: outcome.reason
+		});
+	}
+	const owner = typeof manifest["name"] === "string" ? manifest["name"] : "unknown";
+	const name = marketplaceName(owner);
+	return {
+		catalog: buildCatalog({
+			name,
+			owner,
+			plugins
+		}),
+		plugins,
+		unresolved,
+		genericName: isGenericName(name),
+		pnp: isPnp()
+	};
+}
+/**
+* What writing the catalog would do, without touching the disk.
+*
+* Comparing the serialized form rather than the parsed one is deliberate: a byte comparison is what
+* lets a check mode be a comparison instead of an interpretation, and `buildCatalog` sorts its
+* entries so that unchanged inputs serialize identically.
+*/
+function catalogStatus(root, catalog) {
+	let current;
+	try {
+		current = readFileSync(join(root, CATALOG_PATH), "utf8");
+	} catch {
+		current = void 0;
+	}
+	if (current === serializeCatalog(catalog)) return "unchanged";
+	return current === void 0 ? "created" : "updated";
+}
+/** Writes the catalog, reporting whether it moved. A write that would change nothing writes nothing. */
+function writeCatalog(root, catalog) {
+	const outcome = catalogStatus(root, catalog);
+	if (outcome === "unchanged") return outcome;
+	const path = join(root, CATALOG_PATH);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, serializeCatalog(catalog));
+	return outcome;
+}
+//#endregion
+//#region src/dep-plugins/harness-plugins.ts
+/**
+* What each harness does with a marketplace catalog, and how to read what it currently has.
+*
+* The runtimes diverge more than they look, and every difference below was established by running
+* the shipped CLI rather than by reading a document:
+*
+* - **Claude Code** refreshes with `plugin update`; re-running `plugin install` is a no-op that
+*   reports "already installed" and leaves the stale copy in place. Every verb defaults to user
+*   scope, so each one has to name `--scope project` explicitly.
+* - **Codex** has no update verb and no scope. Re-running `plugin add` re-reads the catalog and
+*   replaces the cached copy, so the same command installs and refreshes. It records no version in
+*   its config — the installed version is only in the cache directory's name.
+* - **Copilot CLI** accepts a path source but **rejects an `npm` source**, so it cannot consume this
+*   catalog at all. See {@link COPILOT_LIMITATION}.
+* - **Cursor** exposes no plugin subcommand from a terminal.
+*
+* A consumer should not have to know any of that, which is why it is here rather than in a document.
+*/
+/**
+* Why Copilot CLI is absent from the table. Recorded rather than dropped, so the reason travels with
+* the code: `copilot plugin marketplace add` rejects this catalog with
+* `Invalid marketplace.json: plugins.0.source: Invalid input`, while the same catalog with a
+* `./path` source is accepted. Supporting it needs a second, path-sourced catalog — and a path source
+* cannot escape its marketplace root, which is the constraint the `npm` source was chosen to avoid.
+*/
+const COPILOT_LIMITATION = "Copilot CLI rejects an npm marketplace source, so it cannot install from this catalog. It needs a path-sourced catalog, which cannot reach node_modules from a subdirectory.";
+function readJson(path) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+function directories(path) {
+	try {
+		return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	} catch {
+		return [];
+	}
+}
+/**
+* `CLAUDE_CONFIG_DIR` wins where set, which is also what keeps a test off a developer's real
+* configuration.
+*/
+function claudeConfigDir(home, env = process.env) {
+	return env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+}
+/**
+* Reads what Claude Code has installed.
+*
+* The file keys each plugin by `<plugin>@<marketplace>` and holds an *array* per key, because the
+* same plugin can be installed at more than one scope and, at project scope, once per project.
+*/
+function readClaudeState(configDir) {
+	const installedFile = readJson(join(configDir, "plugins", "installed_plugins.json"));
+	const installed = [];
+	for (const [id, entries] of Object.entries(installedFile?.plugins ?? {})) {
+		if (!Array.isArray(entries)) continue;
+		for (const entry of entries) {
+			if (!entry || typeof entry !== "object") continue;
+			const record = entry;
+			const version = typeof record["version"] === "string" ? record["version"] : void 0;
+			const scope = typeof record["scope"] === "string" ? record["scope"] : void 0;
+			if (!version || !scope) continue;
+			const projectPath = typeof record["projectPath"] === "string" ? record["projectPath"] : void 0;
+			installed.push(projectPath ? {
+				id,
+				version,
+				scope,
+				projectPath
+			} : {
+				id,
+				version,
+				scope
+			});
+		}
+	}
+	const knownFile = readJson(join(configDir, "plugins", "known_marketplaces.json"));
+	const marketplaces = [];
+	for (const [name, value] of Object.entries(knownFile ?? {})) marketplaces.push({
+		name,
+		path: typeof value?.source?.path === "string" ? value.source.path : ""
+	});
+	return {
+		installed,
+		marketplaces
+	};
+}
+const claudeCode = {
+	name: "claude-code",
+	scoped: true,
+	present: (home, env = process.env) => existsSync(claudeConfigDir(home, env)),
+	state: (home, env = process.env) => readClaudeState(claudeConfigDir(home, env)),
+	register: (catalogDir) => `claude plugin marketplace add ./${catalogDir} --scope project`,
+	install: (id) => `claude plugin install ${id} --scope project`,
+	/**
+	* Not `install`: re-running that on an already-installed plugin changes nothing and says so, which
+	* reads as success. `--scope project` is required rather than cosmetic — every verb defaults to
+	* user scope, so an update omitting it fails with "not installed at scope user" against a plugin
+	* that is plainly installed.
+	*/
+	update: (id) => `claude plugin update ${id} --scope project`,
+	uninstall: (id) => `claude plugin uninstall ${id} --scope project`,
+	refreshMarketplace: (marketplace) => `claude plugin marketplace update ${marketplace}`
+};
+function codexHome(home, env = process.env) {
+	return env["CODEX_HOME"] || join(home, ".codex");
+}
+/**
+* Reads what Codex has installed.
+*
+* The installed version comes from the cache layout, `plugins/cache/<marketplace>/<plugin>/<version>`,
+* because Codex's `config.toml` records only that a plugin is enabled — never which version.
+*
+* Registered marketplaces are read from `config.toml` by scanning for its `[marketplaces.<name>]`
+* tables. A deliberately narrow read rather than a TOML parser: only two keys are needed, and the
+* cost of being wrong is a report that suggests re-registering, which is harmless to re-run.
+*/
+function readCodexState(home) {
+	const cacheRoot = join(home, "plugins", "cache");
+	const installed = [];
+	for (const marketplace of directories(cacheRoot)) for (const plugin of directories(join(cacheRoot, marketplace))) for (const version of directories(join(cacheRoot, marketplace, plugin))) installed.push({
+		id: `${plugin}@${marketplace}`,
+		version,
+		scope: "user"
+	});
+	const marketplaces = [];
+	let config = "";
+	try {
+		config = readFileSync(join(home, "config.toml"), "utf8");
+	} catch {
+		config = "";
+	}
+	let current;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[marketplaces\.(?:"([^"]+)"|([^\]]+))\]\s*$/.exec(line);
+		if (header) {
+			current = {
+				name: header[1] ?? header[2],
+				path: ""
+			};
+			marketplaces.push(current);
+			continue;
+		}
+		if (/^\s*\[/.test(line)) {
+			current = void 0;
+			continue;
+		}
+		const source = current ? /^\s*source\s*=\s*"([^"]*)"\s*$/.exec(line) : void 0;
+		if (source?.[1] && current) current.path = source[1];
+	}
+	return {
+		installed,
+		marketplaces
+	};
+}
+const runtimes = [claudeCode, {
+	name: "codex",
+	/**
+	* Codex installs into `CODEX_HOME` with no notion of scope, so one install is shared by every
+	* repository on the machine. Two repositories whose catalogs share a marketplace name cannot be
+	* told apart here, which is what makes the marketplace name derived from the package name matter.
+	*/
+	scoped: false,
+	present: (home, env = process.env) => existsSync(codexHome(home, env)),
+	state: (home, env = process.env) => readCodexState(codexHome(home, env)),
+	register: (catalogDir) => `codex plugin marketplace add ./${catalogDir}`,
+	install: (id) => `codex plugin add ${id}`,
+	/** No update verb: re-running `add` re-reads the catalog and replaces the cached copy. */
+	update: (id) => `codex plugin add ${id}`,
+	uninstall: (id) => `codex plugin remove ${id}`,
+	/** `marketplace upgrade` refreshes git snapshots only; `add` already re-reads a local catalog. */
+	refreshMarketplace: () => ""
+}];
+//#endregion
+//#region src/dep-plugins/reconcile.ts
+/**
+* Installs belonging to this repository and this catalog.
+*
+* On a scoped runtime a user-scoped install is deliberately excluded rather than counted: it is
+* shared with every other repository on the machine, so treating it as satisfying this repository's
+* catalog would let one project's pin silently stand in for another's.
+*/
+function ours(installed, marketplace, root, scoped) {
+	const suffix = `@${marketplace}`;
+	return installed.filter((entry) => entry.id.endsWith(suffix) && (!scoped || entry.projectPath === root));
+}
+function reconcile({ catalog, catalogDir, root, installed, marketplaces, scoped = true }) {
+	const registration = marketplaces.find((entry) => entry.name === catalog.name);
+	const actions = [];
+	const expected = catalogDir.split(/[\\/]/).filter(Boolean);
+	const pointsHere = registration ? expected.every((segment) => registration.path.includes(segment)) : false;
+	const collision = registration && !pointsHere ? registration.path : void 0;
+	if (!registration) actions.push({
+		kind: "register",
+		subject: catalog.name,
+		detail: "marketplace is not registered with this harness"
+	});
+	const mine = ours(installed, catalog.name, root, scoped);
+	const byId = new Map(mine.map((entry) => [entry.id, entry]));
+	for (const entry of catalog.plugins) {
+		const id = `${entry.name}@${catalog.name}`;
+		const current = byId.get(id);
+		if (!current) {
+			actions.push({
+				kind: "install",
+				subject: id,
+				detail: `not installed; catalog pins ${entry.source.version}`
+			});
+			continue;
+		}
+		if (current.version !== entry.source.version) actions.push({
+			kind: "update",
+			subject: id,
+			detail: `installed ${current.version}, catalog pins ${entry.source.version}`
+		});
+	}
+	const wanted = new Set(catalog.plugins.map((entry) => `${entry.name}@${catalog.name}`));
+	for (const entry of mine) if (!wanted.has(entry.id)) actions.push({
+		kind: "uninstall",
+		subject: entry.id,
+		detail: "installed but no longer in the catalog; it will report a load failure until removed"
+	});
+	return {
+		actions,
+		...collision ? { collision } : {},
+		unregistered: !registration
+	};
+}
+//#endregion
+//#region src/dep-plugins/dep-plugins.command.ts
+/** The command that performs one action, so a reader is not left to look the verb up per runtime. */
+function commandFor(runtime, action, marketplace) {
+	switch (action.kind) {
+		case "register": return runtime.register(CATALOG_DIR);
+		case "install": return runtime.install(action.subject);
+		case "update": {
+			const refresh = runtime.refreshMarketplace(marketplace);
+			const update = runtime.update(action.subject);
+			return refresh ? `${refresh} && ${update}` : update;
+		}
+		case "uninstall": return runtime.uninstall(action.subject);
+	}
+}
+/**
+* Notes name the conditions a caller cannot see from the entry list and would otherwise discover as a
+* failure later — a dependency that is declared but absent, a marketplace name two repositories are
+* likely to share, a resolver under which no dependency has a directory at all.
+*/
+function notesFor(derived) {
+	const notes = [];
+	if (derived.pnp) notes.push("Yarn Plug’n’Play is active: dependencies live inside zip archives, so no harness can install from them. Set nodeLinker: node-modules, or unplug the plugin dependencies.");
+	if (derived.genericName) notes.push(`Marketplace name "${derived.catalog.name}" is generic. Registering a second marketplace under a name already in use replaces the first silently, and the install that follows reports "already installed" — the repository then runs the other one's versions.`);
+	for (const { package: pkg } of derived.unresolved) notes.push(`Declared dependency "${pkg}" is not installed; install dependencies before generating.`);
+	return notes;
+}
+const depPluginsCommand = command({
+	name: "dep-plugins",
+	description: "Derive the marketplace catalog for plugins shipped by this repository’s dependencies, so a harness can install them. Writes the catalog; installing is the harness’s own job.",
+	options: {
+		root: {
+			description: "Repository directory. Defaults to the current directory.",
+			type: z.optional(z.string())
+		},
+		check: {
+			description: "Report whether the catalog is current without writing it. For CI and postinstall.",
+			type: z.optional(z.boolean())
+		},
+		format: {
+			description: "Output format: toon (default), json, or text for a human-readable report.",
+			type: z.optional(z.string()),
+			default: "toon"
+		}
+	},
+	run(args) {
+		try {
+			const format = parseFormat(args.format);
+			const root = args.root ?? process.cwd();
+			const derived = deriveCatalog(root);
+			const outcome = args.check ? catalogStatus(root, derived.catalog) === "unchanged" ? "current" : "would-change" : writeCatalog(root, derived.catalog);
+			const home = homedir();
+			const notes = notesFor(derived);
+			const detected = runtimes.filter((candidate) => candidate.present(home));
+			const harness = [];
+			const actions = [];
+			for (const runtime of detected) {
+				const state = runtime.state(home);
+				const delta = reconcile({
+					catalog: derived.catalog,
+					catalogDir: CATALOG_DIR,
+					root: resolve(root),
+					installed: state.installed,
+					marketplaces: state.marketplaces,
+					scoped: runtime.scoped
+				});
+				if (delta.collision) notes.push(`${runtime.name}: marketplace "${derived.catalog.name}" is already registered against ${delta.collision}. Registering over it replaces the other repository's silently, and the install that follows reports "already installed" — rename this repository's marketplace instead.`);
+				harness.push({
+					runtime: runtime.name,
+					status: delta.actions.length ? `${delta.actions.length} to apply` : "in sync"
+				});
+				for (const action of delta.actions) actions.push({
+					runtime: runtime.name,
+					do: commandFor(runtime, action, derived.catalog.name),
+					subject: action.subject,
+					why: action.detail
+				});
+			}
+			if (derived.plugins.length) notes.push(COPILOT_LIMITATION);
+			writeResult({
+				catalog: CATALOG_PATH,
+				marketplace: derived.catalog.name,
+				outcome,
+				plugins: derived.plugins.length ? derived.plugins.map(({ plugin, package: pkg, version }) => ({
+					name: plugin,
+					package: pkg,
+					version
+				})) : "0 dependencies ship a plugin — nothing to install",
+				harness: harness.length ? harness : "no supported harness detected on this machine",
+				actions: actions.length ? actions : "0 actions — every detected harness matches the catalog",
+				...notes.length ? { notes } : {}
+			}, format);
+			return outcome === "would-change" ? exitCodes.error : exitCodes.success;
+		} catch (error) {
+			process.stderr.write(`error: ${error instanceof Error ? error.message : "Catalog generation failed."}\n`);
+			return exitCodes.error;
+		}
+	}
+});
+//#endregion
 //#region src/diagnose-bridges/directory-files.ts
 /**
 * Every file below `directory`, as paths relative to it, POSIX-separated and sorted. A directory
@@ -2094,7 +2707,7 @@ function app() {
 		name: "buddy-agent-harness",
 		version,
 		description: "Initialize agent harness skill compatibility in consumer repositories."
-	}).command(initCommand).command(doctorCommand);
+	}).command(initCommand).command(doctorCommand).command(depPluginsCommand);
 }
 /**
 * The application boundary: argv in, exit code out, nothing read from or written to the process.
@@ -2119,4 +2732,4 @@ async function run(argv) {
 //#endregion
 export { harnessRegistry as _, initializeHarnesses as a, diagnoseBridges as c, goldenSetPath as d, bridgeRepairs as f, renderDoctorSkill as g, instructionRepairs as h, initCommand as i, diagnoseInstructions as l, doctorSkill as m, activate as n, buildDoctorReport as o, doctorRepairs as p, harnessCommand as r, doctorCommand as s, run as t, diagnoseMcp as u };
 
-//# sourceMappingURL=cli-Bvnq8zOL.mjs.map
+//# sourceMappingURL=cli-4ekejn5W.mjs.map