create-rigline-plugin 1.0.0-alpha.5 → 1.0.0-alpha.8

package/README.md

@@ -5,6 +5,10 @@ Claude Code VS Code extension.
 
     npm create rigline-plugin my-plugins
 
+A plugin runs inside a modification of Anthropic's extension, so the
+[plugin policy](https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md) applies to it —
+whether or not you ever publish it. One page, and the scaffolded README points at it too.
+
 ## What you get
 
 A pnpm workspace with `plugins/*` and one plugin in it, rather than a single-plugin repository. The
@@ -29,6 +33,11 @@ Then:
 
 and *Developer: Reload Webviews*.
 
+The workspace declares `@rigline/core` — the engine, which carries the `rigline-engine` command its
+`build` and `codegen` scripts run — and never `rigline`, which is the layer a *user* installs to
+fetch that engine. `pnpm rigline <verb>` here is a script forwarding to the engine in your own
+`node_modules`, so the loop above needs nothing installed globally.
+
 `generated.ts` ships as a placeholder so a fresh scaffold typechecks before `codegen` has ever run.
 Once you run `codegen` it holds the identifiers *your* extension version actually has; commit it,
 and the diff when you run against a newer extension is how you find out what moved.

package/dist/index.js

@@ -30,10 +30,12 @@ export function scaffold(options) {
     if (!existsSync(templateDir)) {
         throw new ScaffoldError(`the template is missing from this package: ${templateDir}`);
     }
+    const range = options.riglineRange ?? riglineRange();
     const substitutions = {
         NAME: name,
         DESCRIPTION: options.description ?? `A Rigline plugin called ${name}.`,
-        RIGLINE_RANGE: options.riglineRange ?? riglineRange(),
+        RIGLINE_RANGE: range,
+        RIGLINE_VERSION: range.replace(/^\^/, ""),
     };
     const files = [];
     for (const source of walk(templateDir)) {
@@ -81,6 +83,10 @@ export function nextSteps(result) {
         "Then reload the webview: Developer: Reload Webviews.",
         "",
         `${join(here, "README.md")} has the rest, including the four rules worth reading first.`,
+        "",
+        "Read the plugin policy once — what Rigline promises Anthropic, and the part your plugin has",
+        "to hold up. It applies whether or not you ever publish this:",
+        "  https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md",
     ].join("\n");
 }
 export function main(argv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rigline-plugin",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.8",
   "description": "Scaffold a workspace for Claude Code VS Code extension plugins",
   "keywords": [
     "rigline",
@@ -32,10 +32,10 @@
     "create-rigline-plugin": "./dist/index.js"
   },
   "devDependencies": {
-    "@rigline/plugin-api": "1.0.0-alpha.5"
+    "@rigline/plugin-api": "1.0.0-alpha.8"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json"
   }
 }

package/template/README.md

@@ -37,6 +37,23 @@ which is the whole reason to declare rather than to reach.
 Put a dependency you can do without under `uses.optional`: it is checked the same way and costs the
 plugin that one decoration rather than the whole plugin.
 
+## The plugin policy
+
+**This applies whether or not you ever publish.** A plugin you wrote for yourself and will never
+share still runs inside a modification of Anthropic's extension, and Anthropic's terms still apply
+to what it does on your machine. Read it once, at
+[docs/plugin-policy.md](https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md); it
+takes a minute.
+
+Rigline modifies Anthropic's extension and publishes a compliance position saying what it does and
+does not do. Your plugin runs inside that modification, so the position has to hold for it too.
+
+Most of it is not left to you — the webview has no network egress, no filesystem, and no way into
+the extension host, so the usual ways to do harm are absent rather than forbidden. What the policy
+asks is the part the architecture cannot cover: do not deceive the person using it, do not reach for
+credentials, do not carry conversation content off the machine by a path the closed network does not
+cover, and keep any host patch to switching on a capability the extension already has.
+
 ## Testing
 
 `pnpm test` runs the pure half — the functions that do not touch the DOM. Whether a decoration
@@ -51,9 +68,9 @@ says rather than resolving its own.
 ## Publishing
 
 A plugin is published as an ordinary npm package carrying `rigline.json` and its built entry, and
-installed with `rigline add <name>`. Nothing about publishing is special: `rigline build` bundles
-everything the entry imports, so a published plugin has no runtime dependency to install, and
-`@rigline/plugin-api` stays a *devDependency*.
+installed with `rigline add <name>`. Nothing about publishing is special: `rigline-engine build`
+bundles everything the entry imports, so a published plugin has no runtime dependency to install,
+and both `@rigline/core` and `@rigline/plugin-api` stay *devDependencies*.
 
 `.github/workflows/release.yml` does it from CI, with no npm token stored anywhere: GitHub
 authenticates to npm over OIDC, and what the workflow does is *stage* — a version nobody can

package/template/package.json

@@ -5,14 +5,15 @@
   "packageManager": "pnpm@12.3.4",
   "engines": { "node": ">=22.12.0" },
   "scripts": {
-    "codegen": "rigline codegen",
+    "rigline": "rigline-engine",
+    "codegen": "rigline-engine codegen",
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
     "test": "vitest run"
   },
   "devDependencies": {
+    "@rigline/core": "__RIGLINE_RANGE__",
     "@rigline/plugin-api": "__RIGLINE_RANGE__",
-    "rigline": "__RIGLINE_RANGE__",
     "rolldown": "^1.2.8",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0"

package/template/plugins/__NAME__/package.json

@@ -8,11 +8,11 @@
   "publishConfig": { "access": "public" },
   "files": ["dist", "rigline.json"],
   "scripts": {
-    "build": "rigline build",
+    "build": "rigline-engine build",
     "typecheck": "tsc -p tsconfig.json"
   },
   "devDependencies": {
-    "@rigline/plugin-api": "__RIGLINE_RANGE__",
-    "rigline": "__RIGLINE_RANGE__"
+    "@rigline/core": "__RIGLINE_RANGE__",
+    "@rigline/plugin-api": "__RIGLINE_RANGE__"
   }
 }

package/template/plugins/__NAME__/src/index.test.ts

@@ -4,7 +4,7 @@
  * Verification splits three ways, and knowing which tier a question belongs to is most of writing
  * a test that is worth having. A pure function is this tier. Whether a decoration lands in the
  * right place, survives a re-render, or costs the row a line of height is a question about the app,
- * and only the app can answer it: build, `rigline add`, reload the webview, look.
+ * and only the app can answer it: `pnpm build`, `pnpm rigline add`, reload the webview, look.
  */
 import { describe, expect, it } from "vitest";
 import { badgeText } from "./index.ts";

package/template/pnpm-workspace.yaml

@@ -3,14 +3,24 @@ packages:
 
 # Supply-chain settings, written down rather than inherited.
 #
-# Three of these are pnpm's own defaults today. They are stated anyway, because a default is not a
-# position: a fresh clone on a different pnpm, or a default that moves, would quietly change what
-# this repository is willing to install without anyone deciding to.
+# Two of these restate a pnpm default. They are stated anyway, because a default is not a position:
+# a fresh clone on a different pnpm, or a default that moves, would quietly change what this
+# repository is willing to install without anyone deciding to.
 #
-# minimumReleaseAge is the rule rigline applies to plugins, applied here to your own dependencies:
-# a day is where a compromised publish is usually caught, and a day of latency costs nothing.
+# minimumReleaseAge is the third and is not a restatement. pnpm applies the same cutoff by default
+# but merely records anything younger; writing it down is what makes it refuse. That is the rule
+# rigline applies to plugins, applied here to your own dependencies: a day is where a compromised
+# publish is usually caught.
 minimumReleaseAge: 1440
 
+# The exception, and the reason for it: pnpm resolves to the newest version in range that is old
+# enough, and these two ranges have no older version in them to fall back on. Scaffolding you ran
+# minutes ago is this same release, so waiting a day for the rest of it protects nothing. Drop these
+# once the versions are a day old; a later Rigline release is gated like anything else.
+minimumReleaseAgeExclude:
+  - "@rigline/core@__RIGLINE_VERSION__"
+  - "@rigline/plugin-api@__RIGLINE_VERSION__"
+
 # Only a direct dependency may come from a git repository or a tarball URL. A transitive dependency
 # that resolves outside the registry is the shape of a supply-chain problem rather than of an
 # ordinary package.