buddy-agent-harness 0.7.0 → 0.8.0

package/dist/index.d.mts

@@ -163,7 +163,7 @@ type Harness = {
  *
  * See `.research/agentic-configuration-standards/` for the per-harness sources.
  */
-declare const harnessRegistry: readonly Harness[];
+export declare const harnessRegistry: readonly Harness[];
 //#endregion
 //#region src/diagnose-bridges/diagnose-instructions.d.ts
 /** What is on disk where an instruction bridge belongs. */
@@ -189,7 +189,7 @@ type InstructionReport = {
  * checks are read-only, and no repair is a command — rewriting an instruction file is the `init`
  * skill's judgment.
  */
-declare function diagnoseInstructions(root: string, harnesses: readonly Harness[], cli: string): {
+export declare function diagnoseInstructions(root: string, harnesses: readonly Harness[], cli: string): {
   instructions: InstructionReport[];
   findings: BridgeFinding[];
 };
@@ -309,10 +309,10 @@ type Repair = {
    */
   skillRepair(at: Locator): string;
 };
-declare const bridgeRepairs: readonly Repair[];
-declare const instructionRepairs: readonly Repair[];
-declare const doctorRepairs: readonly Repair[];
-declare const doctorSkill: {
+export declare const bridgeRepairs: readonly Repair[];
+export declare const instructionRepairs: readonly Repair[];
+export declare const doctorRepairs: readonly Repair[];
+export declare const doctorSkill: {
   readonly name: "doctor";
   readonly description: "Use this skill when a repository loads no project skills, when skills are missing after a clone, when a harness appears to be ignoring AGENTS.md, or when checking whether the agent configuration bridges into .claude/skills, CLAUDE.md, and the other harness files still resolve.";
 };
@@ -324,7 +324,7 @@ declare const doctorSkill: {
  * The finding tables are NOT here. They live in the reference pages below, and this file carries
  * only what every reader needs: how to run it, how to read the report, and where to go next.
  */
-declare function renderDoctorSkill(version: string): string;
+export declare function renderDoctorSkill(version: string): string;
 //#endregion
 //#region src/diagnose-bridges/git-bridge-state.d.ts
 /** Which side of a diverged bridge moved since the last commit where the two agreed. */
@@ -425,7 +425,7 @@ type DiagnoseResult = {
  * `.agents/skills`, and the instruction bridges into `AGENTS.md`. Read-only: nothing is created,
  * moved, or repaired, so the caller decides what to run from the repair each finding carries.
  */
-declare function diagnoseBridges({ root, harnesses: preferred, cli }: DiagnoseOptions): DiagnoseResult;
+export declare function diagnoseBridges({ root, harnesses: preferred, cli }: DiagnoseOptions): DiagnoseResult;
 //#endregion
 //#region src/diagnose-configuration/diagnose-configuration.d.ts
 /**
@@ -480,8 +480,8 @@ type DoctorReport = {
  * AXI §5: the healthy answer states the zero with context, so an agent does not re-run with other
  * flags to confirm that an empty section really meant "nothing wrong".
  */
-declare function buildDoctorReport(bin: string, result: DiagnoseResult, configuration?: ConfigurationFinding[]): DoctorReport;
-declare const doctorCommand: cli$1.Command;
+export declare function buildDoctorReport(bin: string, result: DiagnoseResult, configuration?: ConfigurationFinding[]): DoctorReport;
+export declare const doctorCommand: cli$1.Command;
 //#endregion
 //#region src/diagnose-mcp/diagnose-mcp.d.ts
 /**
@@ -505,7 +505,7 @@ type DiagnoseMcpOptions = {
   /** How to name this tool in the repair commands. */
   cli: string;
 };
-declare function diagnoseMcp({ root, git, cli }: DiagnoseMcpOptions): ConfigurationFinding[];
+export declare function diagnoseMcp({ root, git, cli }: DiagnoseMcpOptions): ConfigurationFinding[];
 //#endregion
 //#region src/diagnose-mcp/mcp-model.d.ts
 /**
@@ -544,12 +544,12 @@ type McpDirection = "target" | "golden" | "both" | "unknown";
 //#endregion
 //#region src/diagnose-mcp/mcp-sources.d.ts
 /** Where the golden set lives, and why it is namespaced rather than sitting at `.agents/mcp.json`. */
-declare const goldenSetPath = ".agents/buddy-agent-harness/mcp.toml";
+export declare const goldenSetPath = ".agents/buddy-agent-harness/mcp.toml";
 //#endregion
 //#region src/initialize-harnesses/init.command.d.ts
-declare const initCommand: cli$1.Command;
-declare const harnessCommand: cli$1.Command;
-declare function activate({ addCommand }: {
+export declare const initCommand: cli$1.Command;
+export declare const harnessCommand: cli$1.Command;
+export declare function activate({ addCommand }: {
   addCommand(command: typeof harnessCommand): void;
 }): void;
 //#endregion
@@ -583,7 +583,7 @@ type InitializeResult = {
   skills: number;
   copied: boolean;
 };
-declare function initializeHarnesses({ root, harnesses: preferred, copy, force }: InitializeOptions): InitializeResult;
+export declare function initializeHarnesses({ root, harnesses: preferred, copy, force }: InitializeOptions): InitializeResult;
 //#endregion
-export { type BridgeFinding, type BridgeKind, type BridgeProblem, type BridgeReport, type BridgeStatus, type ConfigurationFault, type ConfigurationProblem, type DiagnoseMcpOptions, type DiagnoseOptions, type DiagnoseResult, type DivergenceDirection, type DivergenceReport, type DoctorProblem, type DoctorReport, type Harness, type HarnessName, type HarnessScope, type HarnessScopeName, type InitializeOptions, type InitializeResult, type InstructionBridge, type InstructionKind, type InstructionProblem, type InstructionReport, type InstructionStatus, type McpConfig, type McpDirection, type McpField, type McpProblem, type McpServer, type McpTransport, type Repair, activate, bridgeRepairs, buildDoctorReport, diagnoseBridges, diagnoseInstructions, diagnoseMcp, doctorCommand, doctorRepairs, doctorSkill, goldenSetPath, harnessCommand, harnessRegistry, initCommand, initializeHarnesses, instructionRepairs, renderDoctorSkill, run };
+export { type BridgeFinding, type BridgeKind, type BridgeProblem, type BridgeReport, type BridgeStatus, type ConfigurationFault, type ConfigurationProblem, type DiagnoseMcpOptions, type DiagnoseOptions, type DiagnoseResult, type DivergenceDirection, type DivergenceReport, type DoctorProblem, type DoctorReport, type Harness, type HarnessName, type HarnessScope, type HarnessScopeName, type InitializeOptions, type InitializeResult, type InstructionBridge, type InstructionKind, type InstructionProblem, type InstructionReport, type InstructionStatus, type McpConfig, type McpDirection, type McpField, type McpProblem, type McpServer, type McpTransport, type Repair, run };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts"],"mappings":";;;;;;;;;;;;;;;KAYY;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAUA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;cAuBD,0BAA0B;;;;KCzE3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;iBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCfA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;cAwKJ,wBAAwB;cA4CxB,6BAA6B;cAuM7B,wBAAwB;cAOxB;WACZ;WACA;;;;;;;;;;iBAmCe,kBAAkB;;;;KC5jBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;iBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;iBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;cAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;iBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;cCAC;;;cCAA,aAAa,MAAI;cAoDjB,gBAAgB,MAAI;iBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;iBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/harness-registry/instruction-bridge.ts","../src/harness-registry/mcp-config.ts","../src/harness-registry/nonstandard-artifact.ts","../src/harness-registry/harness-registry.ts","../src/diagnose-bridges/diagnose-instructions.ts","../src/diagnose-bridges/locator.ts","../src/diagnose-bridges/doctor-guidance.ts","../src/diagnose-bridges/git-bridge-state.ts","../src/diagnose-bridges/diagnose-bridges.ts","../src/diagnose-configuration/diagnose-configuration.ts","../src/diagnose-bridges/doctor.command.ts","../src/diagnose-mcp/diagnose-mcp.ts","../src/diagnose-mcp/mcp-model.ts","../src/diagnose-mcp/mcp-baseline.ts","../src/diagnose-mcp/mcp-sources.ts","../src/initialize-harnesses/init.command.ts","../src/skill-projection/skill-projection.ts","../src/initialize-harnesses/initialize-harnesses.ts"],"mappings":";;;;;;;;;;;;;;;KAYY;;;;;;EAOT;;EAEA;;;EAIA;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;KCbS;;EAEX;;;;;;EAMA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;;;;;;;;KCtBW;KAgBA;;;;;EAKX;;EAEA;EACA,MAAM;;;;KC/BK;;KAUA;;;;;;;;;;;;;;;;;;;;;;;;;KA0BA;EACX;EACA;EACA,oBAAoB;EACpB,YAAY;EACZ,uBAAuB;;KAGZ;EACX,MAAM;;EAEN,SAAS;;;;;EAKT,OAAO;;EAEP,aAAa;;;;;;;;;;;;;;;;;;;;;;qBAuBD,0BAA0B;;;;KCzE3B;;;;;;KAMA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;;;;;;;;;wBAkFO,qBACf,cACA,oBAAoB,WACpB;EACI,cAAc;EAAqB,UAAU;;;;;;;;;;;;;;;;;;;;KC5FtC;EAAa;EAAc;;KAE3B;;EAEX;;EAEA;;EAEA;;EAEA,WAAW;;;;;;;;;;KCfA;;;;;;;;;;;KAqBA;;;;;;;;;KAUA;;;;;;;;;KAoBA;KAOA;;KAOA,gBAAgB,gBAAgB,qBAAqB,qBAAqB,aAAa;;KAGvF,uBAAuB;;;;;;;;;;;;;;;;;;KAmBvB;;EAEX;;EAEA;;KAGW;EACX,SAAS;;EAET;;;;;;;EAOA,OAAO,IAAI,SAAS,cAAc;;;;;;EAMlC,YAAY,IAAI;;qBAwKJ,wBAAwB;qBA4CxB,6BAA6B;qBAuM7B,wBAAwB;qBAOxB;WACZ;WACA;;;;;;;;;;wBAmCe,kBAAkB;;;;KC5jBtB;;KAGA;;;;;;cAwBC;mBAIA;;mBAFK;EAEjB,YAAY;;;;;;EASZ,WAAW,eAAe;;;;;;;EAa1B,UAAU;;;;;;;;;EAaV,gBAAgB;;EAMhB,UAAU,gBAAgB;;;;;EAS1B,YAAY,gBAAgB,oBAAoB;;UAYxC;;;;;UAmBA;;;;KC5GG;KACA;KAEA;EACX,SAAS;;EAET;EACA,MAAM;EACN,QAAQ;;KAGG;EACX;;;;;EAKA,SAAS;EACT;;EAEA,QAAQ;;KAGG;EACX;EACA,WAAW;;KAGA;EACX;EACA,YAAY;;EAEZ;;KAGW;EACX,SAAS;;;;;EAKT,cAAc;EACd,YAAY;EACZ,UAAU;;;;;;;wBA2EK,kBAAkB,MAAM,WAAW,WAAgB,OAAO,kBAAkB;;;;;;;;;;;;;;;;;KC1GhF;;EAEX;EACA,SAAS;EACT;;EAEA,QAAQ;;;;KCfG;EACX;EACA,SAAS;EACT,cAAc;EACd,aAAa;;;;;EAKb;IAAY;IAAc,SAAS;IAAe;;;;;;;;;;EASlD,OAAO;;;;;;wBAOQ,kBACf,aACA,QAAQ,gBACR,gBAAe,yBACb;qBAgCU,eAAe,MAAI;;;;;;;;;;;;;;;;;;KC7CpB;EACX;EACA,KAAK;;EAEL;;wBAgCe,cAAc,MAAM,KAAK,OAAO,qBAAqB;;;;;;;;;;;;;;;;KClDzD;KAEA;EACX,YAAY;EACZ;EACA;EACA,MAAM,SAAS;EACf;EACA,UAAU,SAAS;EACnB;EACA;EACA;EACA;;;cAIY;KAaD,mBAAmB;;;;KCnCnB;;;;qBCAC;;;qBCAA,aAAa,MAAI;qBAoDjB,gBAAgB,MAAI;wBAMjB,WAAW;EAAgB,WAAW,gBAAgB;;;;;;;;;KCV1D;;;KCpDA;EACX;EACA,YAAY;EACZ;EACA,QAAQ;;KAEG;EACX;EACA,WAAW;EACX,QAAQ;EACR,QAAQ;;EAER,SAAS;;EAET;IAAc,MAAM;IAAa,YAAY;;EAC7C;EACA;;wBAGe,sBACf,MACA,WAAW,WACX,MACA,SACE,oBAAoB"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as harnessRegistry, a as initializeHarnesses, c as diagnoseBridges, d as goldenSetPath, f as bridgeRepairs, g as renderDoctorSkill, h as instructionRepairs, i as initCommand, l as diagnoseInstructions, m as doctorSkill, n as activate, o as buildDoctorReport, p as doctorRepairs, r as harnessCommand, s as doctorCommand, t as run, u as diagnoseMcp } from "./cli-Bvnq8zOL.mjs";
+import { _ as harnessRegistry, a as initializeHarnesses, c as diagnoseBridges, d as goldenSetPath, f as bridgeRepairs, g as renderDoctorSkill, h as instructionRepairs, i as initCommand, l as diagnoseInstructions, m as doctorSkill, n as activate, o as buildDoctorReport, p as doctorRepairs, r as harnessCommand, s as doctorCommand, t as run, u as diagnoseMcp } from "./cli-4ekejn5W.mjs";
 export { activate, bridgeRepairs, buildDoctorReport, diagnoseBridges, diagnoseInstructions, diagnoseMcp, doctorCommand, doctorRepairs, doctorSkill, goldenSetPath, harnessCommand, harnessRegistry, initCommand, initializeHarnesses, instructionRepairs, renderDoctorSkill, run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buddy-agent-harness",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Initialize standards-based agent configuration across agent harnesses",
   "keywords": [
     "repobuddy",
@@ -51,11 +51,11 @@
   },
   "devDependencies": {
     "@types/node": "^24.12.4",
-    "@vitest/coverage-v8": "^4.1.0",
-    "tsdown": "^0.22.0",
+    "@vitest/coverage-v8": "^5.0.0",
+    "tsdown": "^0.23.0",
     "tsx": "^4.22.3",
     "typescript": "^7.0.0",
-    "vitest": "^4.1.0"
+    "vitest": "^5.0.0"
   },
   "scripts": {
     "build": "tsdown",

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "buddy-agent-harness",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Initialize standards-based agent configuration across agent harnesses",
 	"author": {
 		"name": "repobuddy"

package/skills/doctor/SKILL.md

@@ -15,7 +15,7 @@ Diagnose it:
 node scripts/doctor.mjs
 ```
 
-That path is relative to this skill's own directory. The launcher runs the CLI that shipped beside it against the current working directory, so nothing is downloaded. Fall back to `npx -y buddy-agent-harness@^0.7.0 doctor` when the launcher cannot be resolved or run, which is the case when the plugin was installed from git rather than npm and its dependencies were never installed.
+That path is relative to this skill's own directory. The launcher runs the CLI that shipped beside it against the current working directory, so nothing is downloaded. Fall back to `npx -y buddy-agent-harness@^0.8.0 doctor` when the launcher cannot be resolved or run, which is the case when the plugin was installed from git rather than npm and its dependencies were never installed.
 
 The command is read-only. It never repairs anything, so it is safe to run at any point, including from a session-start hook.
 

package/skills/enhance/references/delegation.md

@@ -16,7 +16,9 @@ rule that appears only in a skill body — this addition is for the always-loade
 ```markdown
 ## Delegation
 
-If this harness can spawn subagents, delegate bulk-mechanical work and research whose answer is far smaller than the reading behind it. Do it yourself when the brief would cost more than the task — a one-line edit is not worth a subagent. Keep the judgment calls and final decisions; delegate the fact-gathering that feeds them. The cheaper the subagent, the less should break if it gets the answer wrong. Brief every one you spawn: it inherits no context, so give it the context, the why, and what done looks like.
+If this harness can spawn subagents, delegate the mechanical work and the research whose answer is far smaller than the reading behind it. Keep the judgment calls and the decisions; anything you would finish in less time than briefing it takes, do yourself.
+
+A subagent inherits your model if you do not pick one, and none of your context either way. Pick the cheapest, unless you cannot say what a right answer looks like or could not cheaply tell a wrong one. Give it the context, the why, and what done looks like.
 ```
 
 ## Do not edit it

package/skills/init/SKILL.md

@@ -75,7 +75,7 @@ One case does need asking even though it only creates a file: a nested `AGENTS.m
 2. Move approved skills and commands to `.agents/skills/<name>/SKILL.md`, preferring `git mv` so history follows. Fix frontmatter per `references/frontmatter.md` — this is where cross-harness portability is won or lost.
 3. Merge approved instruction content into `AGENTS.md`, preserving the author's wording. Append; do not restructure. Replace a harness file with a pointer only where approved. Content only some tasks need belongs in a skill, not in `AGENTS.md`.
 4. Apply the conversions that were approved, one at a time, and nothing else from the list. A rule approved as a skill moves to `.agents/skills/<name>/SKILL.md` with frontmatter per `references/frontmatter.md`; instruction content approved for consolidation is appended as in the step above and its harness file left as a generated copy. Everything declined, and everything with no candidate, stays exactly where it is.
-5. Run `node scripts/init.mjs` at the repository root, resolving that path against this skill's own directory. The launcher runs the CLI that shipped beside it, so nothing is downloaded; fall back to `npx -y buddy-agent-harness@^0.7.0 init` when the path cannot be resolved. It links `.agents/skills` into the harnesses that need it and skips those that read it natively. Add harnesses the user names with `--harness codex,gemini-cli`.
+5. Run `node scripts/init.mjs` at the repository root, resolving that path against this skill's own directory. The launcher runs the CLI that shipped beside it, so nothing is downloaded; fall back to `npx -y buddy-agent-harness@^0.8.0 init` when the path cannot be resolved. It links `.agents/skills` into the harnesses that need it and skips those that read it natively. Add harnesses the user names with `--harness codex,gemini-cli`.
 6. If the command reports a conflict, resolve the named target and retry. Pass the target to `--force` — `--force .claude/skills` replaces that projection and reports any other conflict untouched, where a bare `--force` replaces every conflicting target at once. Reach for the bare form only when replacing all of them is what you came for. Use `--copy` only where links are unavailable — a copy is a snapshot, not a live projection, so say so when you fall back.
 7. Apply the instruction bridges `init` does not write. Claude Code reads `CLAUDE.md`, not `AGENTS.md` — create a `CLAUDE.md` containing `@AGENTS.md`. Gemini CLI needs `AGENTS.md` added to `context.fileName` in `.gemini/settings.json`. Both are detailed in the matching `references/harnesses/<harness>.md`; apply only the ones you enabled. Where nested `AGENTS.md` files exist, write the same stub in each directory holding one — `references/agents-md.md` covers the one case that stops for approval first.
 8. If any bridge now exists, write or restore the non-material region in `AGENTS.md` per `references/agents-md.md`, unless the markers are present and empty. Without it, an agent asked to change a skill edits `.claude/skills/<name>/SKILL.md` — which a link resolves back to canonical, but a copy silently forks. Skip this when every enabled harness reads `.agents/skills/` natively; with no bridge there is nothing to warn about.

package/src/cli.ts

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs'
 import { cli, exitCodes } from 'clibuilder'
+import { depPluginsCommand } from './dep-plugins/dep-plugins.command.ts'
 import { doctorCommand } from './diagnose-bridges/doctor.command.ts'
 import { initCommand } from './initialize-harnesses/init.command.ts'
 
@@ -24,6 +25,7 @@ function app() {
 	})
 		.command(initCommand)
 		.command(doctorCommand)
+		.command(depPluginsCommand)
 }
 
 /**

package/src/dep-plugins/dep-plugins.command.ts

@@ -0,0 +1,168 @@
+import { homedir } from 'node:os'
+import { resolve } from 'node:path'
+import type { cli } from 'clibuilder'
+import { command, exitCodes, z } from 'clibuilder'
+import { parseFormat, writeResult } from '../command-output/command-output.ts'
+import { CATALOG_DIR, CATALOG_PATH, catalogStatus, deriveCatalog, type WriteOutcome, writeCatalog } from './generate.ts'
+import { COPILOT_LIMITATION, type PluginRuntime, runtimes } from './harness-plugins.ts'
+import { type Action, reconcile } from './reconcile.ts'
+
+export type DepPluginsReport = {
+	catalog: string
+	marketplace: string
+	outcome: WriteOutcome | 'would-change' | 'current'
+	/** Always emitted, so a healthy run states its zero rather than leaving a reader to infer it. */
+	plugins: { name: string; package: string; version: string }[] | string
+	/** Every runtime detected on this machine, and whether it matches the catalog. */
+	harness: { runtime: string; status: string }[] | string
+	/**
+	 * What each runtime needs in order to match the catalog, and the command that does it. Reported
+	 * rather than run: this writes outside the repository, and a generation step should not reach into
+	 * a developer's harness state without being asked.
+	 *
+	 * One flat row per action rather than actions nested under each runtime: a uniform record renders
+	 * as a table in both TOON and text, where a nested array collapses into a JSON blob.
+	 */
+	actions: { runtime: string; do: string; subject: string; why: string }[] | string
+	notes?: string[]
+	help?: string[]
+}
+
+/** The command that performs one action, so a reader is not left to look the verb up per runtime. */
+function commandFor(runtime: PluginRuntime, action: Action, marketplace: string): string {
+	switch (action.kind) {
+		case 'register':
+			return runtime.register(CATALOG_DIR)
+		case 'install':
+			return runtime.install(action.subject)
+		case 'update': {
+			// Where a runtime caches the catalog it has to be refreshed first, or the update reinstalls
+			// the version already cached rather than the one the catalog now pins. Codex re-reads a local
+			// catalog on every add and needs no such step, so it declares no refresh command.
+			const refresh = runtime.refreshMarketplace(marketplace)
+			const update = runtime.update(action.subject)
+			return refresh ? `${refresh} && ${update}` : update
+		}
+		case 'uninstall':
+			return runtime.uninstall(action.subject)
+	}
+}
+
+/**
+ * Notes name the conditions a caller cannot see from the entry list and would otherwise discover as a
+ * failure later — a dependency that is declared but absent, a marketplace name two repositories are
+ * likely to share, a resolver under which no dependency has a directory at all.
+ */
+function notesFor(derived: ReturnType<typeof deriveCatalog>): string[] {
+	const notes: string[] = []
+	if (derived.pnp) {
+		notes.push(
+			'Yarn Plug’n’Play is active: dependencies live inside zip archives, so no harness can install from them. Set nodeLinker: node-modules, or unplug the plugin dependencies.',
+		)
+	}
+	if (derived.genericName) {
+		notes.push(
+			`Marketplace name "${derived.catalog.name}" is generic. Registering a second marketplace under a name already in use replaces the first silently, and the install that follows reports "already installed" — the repository then runs the other one's versions.`,
+		)
+	}
+	for (const { package: pkg } of derived.unresolved) {
+		notes.push(`Declared dependency "${pkg}" is not installed; install dependencies before generating.`)
+	}
+	return notes
+}
+
+export const depPluginsCommand: cli.Command = command({
+	name: 'dep-plugins',
+	description:
+		'Derive the marketplace catalog for plugins shipped by this repository’s dependencies, so a harness can install them. Writes the catalog; installing is the harness’s own job.',
+	options: {
+		root: {
+			description: 'Repository directory. Defaults to the current directory.',
+			type: z.optional(z.string()),
+		},
+		check: {
+			description: 'Report whether the catalog is current without writing it. For CI and postinstall.',
+			type: z.optional(z.boolean()),
+		},
+		format: {
+			description: 'Output format: toon (default), json, or text for a human-readable report.',
+			type: z.optional(z.string()),
+			default: 'toon',
+		},
+	},
+	run(args) {
+		try {
+			const format = parseFormat(args.format)
+			const root = args.root ?? process.cwd()
+			const derived = deriveCatalog(root)
+
+			// `--check` compares without touching the disk, so it is safe from a postinstall hook and from
+			// CI, where the question is only whether the committed catalog still matches the declared
+			// dependencies.
+			const outcome = args.check
+				? catalogStatus(root, derived.catalog) === 'unchanged'
+					? ('current' as const)
+					: ('would-change' as const)
+				: writeCatalog(root, derived.catalog)
+
+			// Read-only, and against each harness's own state files rather than its CLI: asking a runtime
+			// what it has should not depend on that runtime being launchable from here. Only runtimes
+			// actually set up on this machine are reported, so a report names work a reader can do.
+			const home = homedir()
+			const notes = notesFor(derived)
+			const detected = runtimes.filter((candidate) => candidate.present(home))
+			const harness: { runtime: string; status: string }[] = []
+			const actions: { runtime: string; do: string; subject: string; why: string }[] = []
+
+			for (const runtime of detected) {
+				const state = runtime.state(home)
+				const delta = reconcile({
+					catalog: derived.catalog,
+					catalogDir: CATALOG_DIR,
+					root: resolve(root),
+					installed: state.installed,
+					marketplaces: state.marketplaces,
+					scoped: runtime.scoped,
+				})
+				if (delta.collision) {
+					notes.push(
+						`${runtime.name}: marketplace "${derived.catalog.name}" is already registered against ${delta.collision}. Registering over it replaces the other repository's silently, and the install that follows reports "already installed" — rename this repository's marketplace instead.`,
+					)
+				}
+				harness.push({
+					runtime: runtime.name,
+					status: delta.actions.length ? `${delta.actions.length} to apply` : 'in sync',
+				})
+				for (const action of delta.actions) {
+					actions.push({
+						runtime: runtime.name,
+						do: commandFor(runtime, action, derived.catalog.name),
+						subject: action.subject,
+						why: action.detail,
+					})
+				}
+			}
+			if (derived.plugins.length) notes.push(COPILOT_LIMITATION)
+
+			const report: DepPluginsReport = {
+				catalog: CATALOG_PATH,
+				marketplace: derived.catalog.name,
+				outcome,
+				plugins: derived.plugins.length
+					? derived.plugins.map(({ plugin, package: pkg, version }) => ({ name: plugin, package: pkg, version }))
+					: '0 dependencies ship a plugin — nothing to install',
+				harness: harness.length ? harness : 'no supported harness detected on this machine',
+				actions: actions.length ? actions : '0 actions — every detected harness matches the catalog',
+				...(notes.length ? { notes } : {}),
+			}
+			writeResult(report, format)
+
+			// A stale catalog under `--check` is the one failure this command reports through its exit
+			// code, because that is the whole question the flag asks. Everything else the report carries.
+			return outcome === 'would-change' ? exitCodes.error : exitCodes.success
+		} catch (error) {
+			process.stderr.write(`error: ${error instanceof Error ? error.message : 'Catalog generation failed.'}\n`)
+			return exitCodes.error
+		}
+	},
+})

package/src/dep-plugins/dep-plugins.ts

@@ -0,0 +1,131 @@
+/**
+ * Dependency-provided plugins: the catalog half.
+ *
+ * A dependency that ships an Agent Plugins manifest at its package root is a plugin the consuming
+ * repository can install through its harness. This module turns the set of such dependencies into a
+ * marketplace catalog; installing from that catalog is the runtime's own job, and the lifecycle half
+ * drives it.
+ *
+ * Everything here is pure. Resolution against `node_modules` lives in `resolve.ts`.
+ */
+
+/** One dependency that ships a plugin manifest. */
+export type DepPlugin = {
+	/** The npm package name — what a consumer declared, and what the catalog installs by. */
+	package: string
+	/** The plugin's own name from its manifest, which need not match the package name. */
+	plugin: string
+	/** The version actually installed, read from the dependency's own `package.json`. */
+	version: string
+	description?: string
+}
+
+/**
+ * A catalog entry's `npm` source. Deliberately not a path: a path source is resolved against the
+ * marketplace root and may not escape it, so a path-sourced catalog would have to sit at the
+ * repository root — the one place the repository's own public catalog already occupies. An `npm`
+ * source carries no path, so this catalog can live in its own directory and stay separate from
+ * whatever the repository publishes for its own consumers.
+ */
+export type NpmSource = {
+	source: 'npm'
+	package: string
+	version: string
+}
+
+export type CatalogEntry = {
+	name: string
+	source: NpmSource
+	description?: string
+}
+
+/**
+ * The Claude-shaped catalog, which Codex, Copilot CLI, and Cursor also read. `owner` is an object
+ * whose `name` is required — a string there is a schema error rather than a tolerated shorthand.
+ */
+export type Catalog = {
+	name: string
+	owner: { name: string }
+	description: string
+	plugins: CatalogEntry[]
+}
+
+/**
+ * Marketplace names generic enough that two repositories are likely to pick the same one. The
+ * collision is silent and costly: registering a second marketplace under a name already in use
+ * replaces the first, and the install that follows reports "already installed" and does nothing —
+ * so the repository silently runs the other one's plugin versions.
+ */
+const GENERIC_NAMES = new Set(['deps', 'dependencies', 'local', 'plugins', 'marketplace', 'plugin', 'default'])
+
+export function isGenericName(name: string): boolean {
+	return GENERIC_NAMES.has(name.toLowerCase())
+}
+
+/**
+ * A marketplace name derived from the consuming package's own name, so two repositories do not
+ * collide by default. A scope is folded into the name rather than dropped (`@acme/web` → `acme-web`)
+ * because the unscoped half is the part most likely to repeat across organizations.
+ */
+export function marketplaceName(packageName: string): string {
+	const folded = packageName.replace(/^@/, '').replace(/\//g, '-')
+	const cleaned = folded
+		.replace(/[^a-zA-Z0-9-_.]/g, '-')
+		.replace(/-+/g, '-')
+		.replace(/^-|-$/g, '')
+	return cleaned || 'agent-plugins'
+}
+
+/**
+ * Dependency names a repository declares, both runtime and development.
+ *
+ * Development dependencies are included on purpose: a plugin that supplies a project's testing or
+ * release workflow is a development dependency, and excluding them would drop most of the cases this
+ * exists for. Transitive dependencies are never included — see `resolve.ts`.
+ */
+export function declaredDependencies(manifest: unknown): string[] {
+	if (!manifest || typeof manifest !== 'object') return []
+	const record = manifest as Record<string, unknown>
+	const names = new Set<string>()
+	for (const field of ['dependencies', 'devDependencies']) {
+		const group = record[field]
+		if (!group || typeof group !== 'object') continue
+		for (const name of Object.keys(group as Record<string, unknown>)) names.add(name)
+	}
+	return [...names].sort()
+}
+
+export type BuildCatalogOptions = {
+	name: string
+	owner: string
+	plugins: readonly DepPlugin[]
+}
+
+/**
+ * The catalog is derived in full on every run and never merged into what is already on disk. That is
+ * what makes the three cases a consumer cares about — a plugin added, a plugin removed, a version
+ * moved — fall out of regeneration instead of needing reconciliation logic of their own.
+ *
+ * Entries are sorted by name so that a regeneration whose inputs did not change produces a
+ * byte-identical file, which is what lets a check mode compare rather than interpret.
+ */
+export function buildCatalog({ name, owner, plugins }: BuildCatalogOptions): Catalog {
+	const entries = [...plugins]
+		.sort((a, b) => a.plugin.localeCompare(b.plugin))
+		.map(({ plugin, package: pkg, version, description }): CatalogEntry => {
+			const source: NpmSource = { source: 'npm', package: pkg, version }
+			return description ? { name: plugin, source, description } : { name: plugin, source }
+		})
+
+	return {
+		name,
+		owner: { name: owner },
+		description: 'Plugins provided by this repository’s dependencies. Generated — do not edit.',
+		plugins: entries,
+	}
+}
+
+/** Serialized the way the repository formats JSON, with the trailing newline a text file needs. */
+export function serializeCatalog(catalog: Catalog): string {
+	return `${JSON.stringify(catalog, null, '\t')}\n`
+}

package/src/dep-plugins/generate.ts

@@ -0,0 +1,115 @@
+/**
+ * Deriving a repository's dependency-plugin catalog, and deciding whether what is on disk matches.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import {
+	buildCatalog,
+	type Catalog,
+	type DepPlugin,
+	declaredDependencies,
+	isGenericName,
+	marketplaceName,
+	serializeCatalog,
+} from './dep-plugins.ts'
+import { isPnp, readDepPlugin, type SkipReason } from './resolve.ts'
+
+/**
+ * The catalog's home, relative to the repository root.
+ *
+ * Under this tool's own directory, beside the other files it owns there — the same place as
+ * `mcp.toml` and `mcp.projected.json`, and the same shape as `.agents/repobuddy/` and
+ * `.agents/cyberlegion/`. A directory named for what it holds rather than for who writes it would be
+ * a second convention in a tree that already has one.
+ *
+ * Not the repository root's `.claude-plugin/`, which is where a repository publishes its *own*
+ * plugins for its *own* consumers. Merging the two would leak every dependency-provided plugin into
+ * what a consumer sees on adding the published marketplace, and no harness has a notion of a private
+ * catalog entry to prevent that. Being a separate directory also makes this one a marketplace root
+ * in its own right, which is what lets its entries be resolved without reaching outside it.
+ */
+export const CATALOG_DIR: string = join('.agents', 'buddy-agent-harness')
+export const CATALOG_PATH: string = join(CATALOG_DIR, '.claude-plugin', 'marketplace.json')
+
+/** A declared dependency that yielded no plugin, kept so a report can say why rather than go quiet. */
+export type Skipped = { package: string; reason: SkipReason }
+
+export type DerivedCatalog = {
+	catalog: Catalog
+	plugins: DepPlugin[]
+	/** Only the dependencies that failed to resolve at all; a dependency with no plugin is not news. */
+	unresolved: Skipped[]
+	/** Set when the marketplace name is one two repositories are likely to share. */
+	genericName: boolean
+	/** Set under Yarn PnP, where no dependency has a directory for a harness to install from. */
+	pnp: boolean
+}
+
+function readManifest(path: string): Record<string, unknown> {
+	return JSON.parse(readFileSync(path, 'utf8')) as Record<string, unknown>
+}
+
+/**
+ * Derives the catalog from the repository's declared dependencies.
+ *
+ * Derived in full every time. A plugin newly added to `package.json` appears, one removed disappears,
+ * and a version that moved follows — all three without a line of reconciliation logic, because there
+ * is nothing to reconcile against. That is the same rule the vendor manifests already follow: the
+ * artifact is derived, never authored.
+ */
+export function deriveCatalog(root: string): DerivedCatalog {
+	const manifestPath = join(root, 'package.json')
+	const manifest = readManifest(manifestPath)
+
+	const plugins: DepPlugin[] = []
+	const unresolved: Skipped[] = []
+	for (const pkg of declaredDependencies(manifest)) {
+		const outcome = readDepPlugin(pkg, manifestPath)
+		if (outcome.ok) plugins.push(outcome.plugin)
+		else if (outcome.reason === 'unresolved') unresolved.push({ package: pkg, reason: outcome.reason })
+	}
+
+	const owner = typeof manifest['name'] === 'string' ? manifest['name'] : 'unknown'
+	const name = marketplaceName(owner)
+
+	return {
+		catalog: buildCatalog({ name, owner, plugins }),
+		plugins,
+		unresolved,
+		genericName: isGenericName(name),
+		pnp: isPnp(),
+	}
+}
+
+/** What a write did, or would do, so a caller can report a no-op as a no-op rather than as a change. */
+export type WriteOutcome = 'created' | 'updated' | 'unchanged'
+
+/**
+ * What writing the catalog would do, without touching the disk.
+ *
+ * Comparing the serialized form rather than the parsed one is deliberate: a byte comparison is what
+ * lets a check mode be a comparison instead of an interpretation, and `buildCatalog` sorts its
+ * entries so that unchanged inputs serialize identically.
+ */
+export function catalogStatus(root: string, catalog: Catalog): WriteOutcome {
+	let current: string | undefined
+	try {
+		current = readFileSync(join(root, CATALOG_PATH), 'utf8')
+	} catch {
+		current = undefined
+	}
+	if (current === serializeCatalog(catalog)) return 'unchanged'
+	return current === undefined ? 'created' : 'updated'
+}
+
+/** Writes the catalog, reporting whether it moved. A write that would change nothing writes nothing. */
+export function writeCatalog(root: string, catalog: Catalog): WriteOutcome {
+	const outcome = catalogStatus(root, catalog)
+	if (outcome === 'unchanged') return outcome
+
+	const path = join(root, CATALOG_PATH)
+	mkdirSync(dirname(path), { recursive: true })
+	writeFileSync(path, serializeCatalog(catalog))
+	return outcome
+}