create-rigline-plugin 1.0.0-alpha.6 → 1.0.0-alpha.8

package/README.md

@@ -5,6 +5,10 @@ Claude Code VS Code extension.
 
     npm create rigline-plugin my-plugins
 
+A plugin runs inside a modification of Anthropic's extension, so the
+[plugin policy](https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md) applies to it —
+whether or not you ever publish it. One page, and the scaffolded README points at it too.
+
 ## What you get
 
 A pnpm workspace with `plugins/*` and one plugin in it, rather than a single-plugin repository. The

package/dist/index.js

@@ -30,10 +30,12 @@ export function scaffold(options) {
     if (!existsSync(templateDir)) {
         throw new ScaffoldError(`the template is missing from this package: ${templateDir}`);
     }
+    const range = options.riglineRange ?? riglineRange();
     const substitutions = {
         NAME: name,
         DESCRIPTION: options.description ?? `A Rigline plugin called ${name}.`,
-        RIGLINE_RANGE: options.riglineRange ?? riglineRange(),
+        RIGLINE_RANGE: range,
+        RIGLINE_VERSION: range.replace(/^\^/, ""),
     };
     const files = [];
     for (const source of walk(templateDir)) {
@@ -81,6 +83,10 @@ export function nextSteps(result) {
         "Then reload the webview: Developer: Reload Webviews.",
         "",
         `${join(here, "README.md")} has the rest, including the four rules worth reading first.`,
+        "",
+        "Read the plugin policy once — what Rigline promises Anthropic, and the part your plugin has",
+        "to hold up. It applies whether or not you ever publish this:",
+        "  https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md",
     ].join("\n");
 }
 export function main(argv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rigline-plugin",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.8",
   "description": "Scaffold a workspace for Claude Code VS Code extension plugins",
   "keywords": [
     "rigline",
@@ -32,7 +32,7 @@
     "create-rigline-plugin": "./dist/index.js"
   },
   "devDependencies": {
-    "@rigline/plugin-api": "1.0.0-alpha.6"
+    "@rigline/plugin-api": "1.0.0-alpha.8"
   },
   "scripts": {
     "build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.build.json",

package/template/README.md

@@ -37,6 +37,23 @@ which is the whole reason to declare rather than to reach.
 Put a dependency you can do without under `uses.optional`: it is checked the same way and costs the
 plugin that one decoration rather than the whole plugin.
 
+## The plugin policy
+
+**This applies whether or not you ever publish.** A plugin you wrote for yourself and will never
+share still runs inside a modification of Anthropic's extension, and Anthropic's terms still apply
+to what it does on your machine. Read it once, at
+[docs/plugin-policy.md](https://github.com/Rigline/Rigline/blob/main/docs/plugin-policy.md); it
+takes a minute.
+
+Rigline modifies Anthropic's extension and publishes a compliance position saying what it does and
+does not do. Your plugin runs inside that modification, so the position has to hold for it too.
+
+Most of it is not left to you — the webview has no network egress, no filesystem, and no way into
+the extension host, so the usual ways to do harm are absent rather than forbidden. What the policy
+asks is the part the architecture cannot cover: do not deceive the person using it, do not reach for
+credentials, do not carry conversation content off the machine by a path the closed network does not
+cover, and keep any host patch to switching on a capability the extension already has.
+
 ## Testing
 
 `pnpm test` runs the pure half — the functions that do not touch the DOM. Whether a decoration

package/template/pnpm-workspace.yaml

@@ -3,14 +3,24 @@ packages:
 
 # Supply-chain settings, written down rather than inherited.
 #
-# Three of these are pnpm's own defaults today. They are stated anyway, because a default is not a
-# position: a fresh clone on a different pnpm, or a default that moves, would quietly change what
-# this repository is willing to install without anyone deciding to.
+# Two of these restate a pnpm default. They are stated anyway, because a default is not a position:
+# a fresh clone on a different pnpm, or a default that moves, would quietly change what this
+# repository is willing to install without anyone deciding to.
 #
-# minimumReleaseAge is the rule rigline applies to plugins, applied here to your own dependencies:
-# a day is where a compromised publish is usually caught, and a day of latency costs nothing.
+# minimumReleaseAge is the third and is not a restatement. pnpm applies the same cutoff by default
+# but merely records anything younger; writing it down is what makes it refuse. That is the rule
+# rigline applies to plugins, applied here to your own dependencies: a day is where a compromised
+# publish is usually caught.
 minimumReleaseAge: 1440
 
+# The exception, and the reason for it: pnpm resolves to the newest version in range that is old
+# enough, and these two ranges have no older version in them to fall back on. Scaffolding you ran
+# minutes ago is this same release, so waiting a day for the rest of it protects nothing. Drop these
+# once the versions are a day old; a later Rigline release is gated like anything else.
+minimumReleaseAgeExclude:
+  - "@rigline/core@__RIGLINE_VERSION__"
+  - "@rigline/plugin-api@__RIGLINE_VERSION__"
+
 # Only a direct dependency may come from a git repository or a tarball URL. A transitive dependency
 # that resolves outside the registry is the shape of a supply-chain problem rather than of an
 # ordinary package.