flower-trellis 0.6.2 → 0.6.3

package/src/plugin/formats/adapters.js

@@ -15,18 +15,36 @@ function detection(values) {
     kind: values.kind,
     entryPath: values.entryPath,
     pluginRoot: values.pluginRoot,
+    manifestPath: values.manifestPath,
     displayName: values.displayName,
     manifest: values.manifest || null,
   };
 }
 
+/**
+ * 判断 manifest 声明的内容路径是否在指定根目录下存在。
+ *
+ * @param {string} root 检测根
+ * @param {object} manifest Flower manifest
+ * @returns {boolean} 是否存在声明内容
+ */
+function hasDeclaredContent(root, manifest) {
+  const content = manifest?.content || {};
+  const skillPaths = (content.skills || []).map((entry) => entry?.path).filter(Boolean);
+  const passivePaths = ["specs", "assets", "scripts", "tests"]
+    .flatMap((kind) => content[kind] || []);
+  return [...skillPaths, ...passivePaths].some((entry) => (
+    fs.existsSync(path.join(root, ...String(entry).split("/")))
+  ));
+}
+
 /** Flower 原生格式 Adapter。 */
 export const flowerFormatAdapter = Object.freeze({
   format: "flower",
   /** @param {string} root 检测根 @returns {object[]} 检测结果 */
   detect(root) {
     const results = [];
-    const marketplace = path.join(root, ".flower-marketplace", "marketplace.json");
+    const marketplace = path.join(root, ".flower-plugin", "marketplace.json");
     if (fs.existsSync(marketplace)) {
       const manifest = readFormatJson(marketplace, "Flower Marketplace");
       results.push(detection({
@@ -42,11 +60,16 @@ export const flowerFormatAdapter = Object.freeze({
       const manifestFile = path.join(pluginRoot, "plugin.json");
       if (!fs.existsSync(manifestFile)) continue;
       const manifest = readFormatJson(manifestFile, "Flower Plugin");
+      const metadataRoot = path.join(root, ".flower-plugin");
+      const rootLevelMetadata = pluginRoot === metadataRoot &&
+        hasDeclaredContent(root, manifest) &&
+        !hasDeclaredContent(metadataRoot, manifest);
       results.push(detection({
         format: "flower",
         kind: "plugin",
         entryPath: relativeEntryPath(root, manifestFile),
-        pluginRoot,
+        pluginRoot: rootLevelMetadata ? root : pluginRoot,
+        manifestPath: rootLevelMetadata ? ".flower-plugin/plugin.json" : "plugin.json",
         displayName: manifest.name || manifest.id || path.basename(pluginRoot),
         manifest,
       }));
@@ -58,6 +81,7 @@ export const flowerFormatAdapter = Object.freeze({
     return normalizeFlowerPlugin({
       ...context,
       pluginRoot: selected.pluginRoot,
+      manifestPath: selected.manifestPath,
     });
   },
 });
@@ -159,7 +183,7 @@ export const skillOnlyFormatAdapter = Object.freeze({
   /** @param {string} root 检测根 @returns {object[]} 检测结果 */
   detect(root) {
     const knownEntries = [
-      ".flower-marketplace/marketplace.json",
+      ".flower-plugin/marketplace.json",
       ".flower-plugin/plugin.json",
       "plugin.json",
       ".agents/plugins/marketplace.json",

package/src/plugin/formats/normalized-package.js

@@ -26,6 +26,105 @@ const OMITTED_COMPONENTS = Object.freeze([
   ["apps", ".app.json"],
 ]);
 
+/**
+ * 列出原生 Flower manifest 声明的包内容路径。
+ *
+ * @param {import("../contracts.js").PluginManifest} manifest Flower manifest
+ * @returns {string[]} 需要进入规范化包的相对路径
+ */
+function declaredPackagePaths(manifest) {
+  const content = manifest.content || {};
+  const skills = (content.skills || []).map(({ path: skillPath }) => skillPath);
+  const passive = ["specs", "assets", "scripts", "tests"].flatMap((kind) => content[kind] || []);
+  const patches = [
+    manifest.patches?.catalog,
+    manifest.patches?.bundles,
+  ].filter(Boolean);
+  return [...new Set([...skills, ...passive, ...patches])].sort(compareUtf8);
+}
+
+/**
+ * 复制 manifest 显式声明的文件或目录。
+ *
+ * @param {string} sourceRoot 源仓库根
+ * @param {string} targetRoot 规范化包根
+ * @param {string} relative POSIX 相对路径
+ * @returns {void}
+ */
+function copyDeclaredPath(sourceRoot, targetRoot, relative) {
+  const safeRelative = assertSafePosixRelativePath(relative, "Flower Plugin content 路径");
+  const source = path.join(sourceRoot, ...safeRelative.split("/"));
+  const target = path.join(targetRoot, ...safeRelative.split("/"));
+  let stat;
+  try {
+    stat = fs.lstatSync(source);
+  } catch (error) {
+    throw new PluginRuntimeError(`Flower Plugin 声明内容不存在:${safeRelative}`, {
+      code: PLUGIN_RUNTIME_ERROR_CODES.FORMAT_UNSUPPORTED,
+      path: safeRelative,
+      cause: error,
+    });
+  }
+  if (stat.isSymbolicLink()) {
+    throw new PluginRuntimeError(`Flower Plugin 声明内容不能是软链:${safeRelative}`, {
+      code: PLUGIN_RUNTIME_ERROR_CODES.FORMAT_UNSUPPORTED,
+      path: safeRelative,
+    });
+  }
+  if (stat.isDirectory()) {
+    for (const file of listCanonicalTreeFiles(source)) {
+      const destination = path.join(target, ...file.path.split("/"));
+      fs.mkdirSync(path.dirname(destination), { recursive: true });
+      fs.copyFileSync(file.absolutePath, destination);
+    }
+    return;
+  }
+  if (!stat.isFile()) {
+    throw new PluginRuntimeError(`Flower Plugin 声明内容必须是普通文件或目录:${safeRelative}`, {
+      code: PLUGIN_RUNTIME_ERROR_CODES.FORMAT_UNSUPPORTED,
+      path: safeRelative,
+    });
+  }
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target);
+}
+
+/**
+ * 复制与声明内容匹配的平台覆盖。
+ *
+ * @param {string} sourceRoot 源仓库根
+ * @param {string} targetRoot 规范化包根
+ * @param {import("../contracts.js").PluginManifest} manifest Flower manifest
+ * @returns {void}
+ */
+function copyPlatformOverrides(sourceRoot, targetRoot, manifest) {
+  const platformsRoot = path.join(sourceRoot, "platforms");
+  if (!fs.existsSync(platformsRoot)) return;
+  for (const platform of fs.readdirSync(platformsRoot, { withFileTypes: true }).sort((left, right) => compareUtf8(left.name, right.name))) {
+    if (!platform.isDirectory()) continue;
+    for (const relative of declaredPackagePaths(manifest)) {
+      const override = `platforms/${platform.name}/${relative}`;
+      if (fs.existsSync(path.join(sourceRoot, ...override.split("/")))) {
+        copyDeclaredPath(sourceRoot, targetRoot, override);
+      }
+    }
+  }
+}
+
+/**
+ * 展开 Flower manifest 声明内容为兼容性报告条目。
+ *
+ * @param {import("../contracts.js").PluginManifest} manifest Flower manifest
+ * @returns {Array<{kind:string,path:string,name?:string}>} 内容条目
+ */
+function manifestContentItems(manifest) {
+  return Object.entries(manifest.content).flatMap(([kind, entries]) => (
+    kind === "skills"
+      ? entries.map((entry) => ({ kind, name: entry.name, path: entry.path }))
+      : entries.map((entry) => ({ kind, path: entry }))
+  )).sort((left, right) => compareUtf8(left.path, right.path));
+}
+
 /**
  * 生成外部 Plugin 缺省内部版本。
  *
@@ -92,11 +191,15 @@ function copySkill(source, target, name, description) {
 /**
  * 复制并复核原生 Flower Plugin 包。
  *
- * @param {{pluginRoot:string,outputRoot:string}} options 规范化参数
+ * @param {{pluginRoot:string,outputRoot:string,manifestPath?:string}} options 规范化参数
  * @returns {{root:string,manifest:import("../contracts.js").PluginManifest,integrity:string,compatibilityReport:object,externalVersion:string,description:string}} 标准包
  */
 export function normalizeFlowerPlugin(options) {
   const packageRoot = path.resolve(options.outputRoot);
+  const manifestPath = assertSafePosixRelativePath(
+    options.manifestPath || "plugin.json",
+    "Flower Plugin manifest 路径",
+  );
   if (fs.existsSync(packageRoot)) {
     throw new PluginRuntimeError(`规范化包目标已存在:${packageRoot}`, {
       code: PLUGIN_RUNTIME_ERROR_CODES.CONTENT_CONFLICT,
@@ -105,14 +208,23 @@ export function normalizeFlowerPlugin(options) {
   }
   fs.mkdirSync(packageRoot, { recursive: true });
   try {
-    for (const file of listCanonicalTreeFiles(options.pluginRoot)) {
-      const destination = path.join(packageRoot, ...file.path.split("/"));
-      fs.mkdirSync(path.dirname(destination), { recursive: true });
-      fs.copyFileSync(file.absolutePath, destination);
-    }
+    const raw = fs.readFileSync(path.join(options.pluginRoot, ...manifestPath.split("/")), "utf8");
     const manifest = validatePluginManifest(JSON.parse(
-      fs.readFileSync(path.join(packageRoot, "plugin.json"), "utf8"),
+      raw,
     ));
+    if (manifestPath === "plugin.json") {
+      for (const file of listCanonicalTreeFiles(options.pluginRoot)) {
+        const destination = path.join(packageRoot, ...file.path.split("/"));
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.copyFileSync(file.absolutePath, destination);
+      }
+    } else {
+      fs.writeFileSync(path.join(packageRoot, "plugin.json"), raw);
+      for (const relative of declaredPackagePaths(manifest)) {
+        copyDeclaredPath(options.pluginRoot, packageRoot, relative);
+      }
+      copyPlatformOverrides(options.pluginRoot, packageRoot, manifest);
+    }
     return {
       root: packageRoot,
       manifest,
@@ -120,9 +232,7 @@ export function normalizeFlowerPlugin(options) {
       compatibilityReport: {
         status: "compatible",
         format: "flower",
-        imported: Object.entries(manifest.content).flatMap(([kind, paths]) => (
-          paths.map((value) => ({ kind, path: value }))
-        )).sort((left, right) => compareUtf8(left.path, right.path)),
+        imported: manifestContentItems(manifest),
         omitted: [],
         diagnostics: [],
       },
@@ -206,12 +316,12 @@ export function normalizeExternalPlugin(options) {
         if (!fs.existsSync(path.join(source, "SKILL.md"))) continue;
         const name = registerName(directory, "Skill");
         copySkill(source, path.join(packageRoot, "skills", name), name, `${pluginName} 的 ${name} 工作流`);
-        imported.push({ kind: "skills", path: `skills/${name}` });
+        imported.push({ kind: "skills", name, path: `skills/${name}` });
       }
     } else if (fs.existsSync(path.join(root, "SKILL.md"))) {
       const name = registerName(path.basename(root), "Skill");
       copySkill(root, path.join(packageRoot, "skills", name), name, `${pluginName} 的 ${name} 工作流`);
-      imported.push({ kind: "skills", path: `skills/${name}` });
+      imported.push({ kind: "skills", name, path: `skills/${name}` });
     }
   }
 
@@ -226,7 +336,7 @@ export function normalizeExternalPlugin(options) {
         path.join(packageRoot, "skills", name, "SKILL.md"),
         normalizedSkillContent(content, name, `${pluginName} 的 ${name} 命令工作流`),
       );
-      imported.push({ kind: "commands", path: `skills/${name}` });
+      imported.push({ kind: "commands", name, path: `skills/${name}` });
       diagnostics.push({
         code: "external.command-converted",
         path: `commands/${file}`,
@@ -260,7 +370,9 @@ export function normalizeExternalPlugin(options) {
     dependencies: {},
     capabilities: { profile: "standard", required: ["content.skills"] },
     content: {
-      skills: imported.map(({ path: value }) => value).sort(compareUtf8),
+      skills: imported
+        .map(({ name, path: value }) => ({ name, path: value, version }))
+        .sort((left, right) => compareUtf8(left.name, right.name)),
     },
   });
   fs.writeFileSync(path.join(packageRoot, "plugin.json"), `${JSON.stringify(manifest, null, 2)}\n`);

package/src/plugin/gitlab/rest-client.js

@@ -216,6 +216,18 @@ export class GitLabRestClient {
             { status: response.status, endpoint: pathname, locationOrigin },
           );
         }
+        if (response.status === 401) {
+          throw this.#authError(`GitLab REST 认证失败，请重新登录:${this.source.id}`, PLUGIN_RUNTIME_ERROR_CODES.AUTH_REQUIRED, {
+            status: response.status,
+            endpoint: pathname,
+          });
+        }
+        if (response.status === 403) {
+          throw this.#authError(`GitLab REST scope 不足或访问被拒绝:${this.source.id}`, PLUGIN_RUNTIME_ERROR_CODES.AUTH_SCOPE_INVALID, {
+            status: response.status,
+            endpoint: pathname,
+          });
+        }
         throw this.#remoteError(`GitLab REST 请求失败:${response.status}`, this.source.id, undefined, {
           status: response.status,
           endpoint: pathname,
@@ -240,4 +252,13 @@ export class GitLabRestClient {
       details,
     });
   }
+
+  /** @param {string} message @param {string} code @param {object} details @returns {PluginRuntimeError} */
+  #authError(message, code, details) {
+    return new PluginRuntimeError(message, {
+      code,
+      path: this.source.id,
+      details,
+    });
+  }
 }

package/src/plugin/install/content-projector.js

@@ -9,6 +9,10 @@ import {
 import { assertSafePosixRelativePath } from "../schemas/shared.js";
 import { compareUtf8 } from "../stable-order.js";
 import { isRuntimeBuiltinProviderTrusted } from "../runtime-extensions.js";
+import {
+  normalizeContentSelection,
+  selectContentSkillEntries,
+} from "../content-selection.js";
 import { hashContent, hashFileIfExists } from "./content-hash.js";
 
 const CONTENT_KINDS = ["skills", "specs", "assets", "scripts", "tests"];
@@ -99,10 +103,11 @@ function resolvePlatformContent(packageRoot, platform, entry, relative, canonica
  * @param {string} kind 内容类型
  * @param {string} entry manifest 内容路径
  * @param {string|null} skillRoot 平台 Skill root
+ * @param {string} [entryName] 内容目标名称
  * @returns {string} 项目内目标前缀
  */
-function targetPrefix(owner, kind, entry, skillRoot) {
-  const name = path.posix.basename(entry);
+function targetPrefix(owner, kind, entry, skillRoot, entryName = path.posix.basename(entry)) {
+  const name = entryName;
   if (kind === "skills") return `${skillRoot}/${name}`;
   return `.flower/content/${owner}/${kind}/${name}`;
 }
@@ -146,6 +151,7 @@ export function projectPluginContent(options) {
     const candidate = selectedById.get(resolved.id);
     if (!candidate) throw new Error(`Resolved Plugin 缺少候选:${resolved.id}`);
     const pluginPackage = options.registry.readPackage(candidate);
+    const contentSelection = normalizeContentSelection(resolved.contentSelection);
     const provider = typeof options.registry.get === "function"
       ? options.registry.get(candidate.source.id)
       : null;
@@ -184,11 +190,16 @@ export function projectPluginContent(options) {
     }
     const paths = new Map();
     for (const kind of CONTENT_KINDS) {
-      for (const entry of [...(pluginPackage.manifest.content[kind] || [])].sort(compareUtf8)) {
-        const expanded = expandContentEntry(pluginPackage.root, entry);
+      const entries = kind === "skills"
+        ? selectContentSkillEntries(pluginPackage.manifest.content.skills || [], contentSelection, resolved.id)
+        : [...(pluginPackage.manifest.content[kind] || [])].sort(compareUtf8);
+      for (const entry of entries) {
+        const contentPath = kind === "skills" ? entry.path : entry;
+        const contentName = kind === "skills" ? entry.name : undefined;
+        const expanded = expandContentEntry(pluginPackage.root, contentPath);
         const targets = kind === "skills" ? options.platformSelection.targets : [{ root: null }];
         for (const platformTarget of targets) {
-          const prefix = targetPrefix(resolved.id, kind, entry, platformTarget.root);
+          const prefix = targetPrefix(resolved.id, kind, contentPath, platformTarget.root, contentName);
           if (kind !== "skills") {
             addDirectoryClaims(directoryClaims, resolved.id, `.flower/content/${resolved.id}`, "");
             addDirectoryClaims(directoryClaims, resolved.id, `.flower/content/${resolved.id}/${kind}`, "");
@@ -212,9 +223,9 @@ export function projectPluginContent(options) {
             const canonical = fs.readFileSync(file.absolutePath);
             const platformContents = kind === "skills"
               ? platformTarget.platforms.map((platform) => (
-                resolvePlatformContent(pluginPackage.root, platform, entry, file.relative, canonical)
+                resolvePlatformContent(pluginPackage.root, platform, contentPath, file.relative, canonical)
               ))
-              : [{ content: canonical, source: `${entry}${file.relative ? `/${file.relative}` : ""}` }];
+              : [{ content: canonical, source: `${contentPath}${file.relative ? `/${file.relative}` : ""}` }];
             const contentHashes = new Set(platformContents.map(({ content }) => hashContent(content)));
             if (contentHashes.size > 1) {
               throw new PluginRuntimeError(`共享 Skill root 的 platform override 内容不一致:${target}`, {
@@ -257,6 +268,7 @@ export function projectPluginContent(options) {
       id: resolved.id,
       version: resolved.version,
       platforms: [...options.platformSelection.platforms],
+      ...(contentSelection ? { contentSelection } : {}),
       paths: [...paths.values()].sort((left, right) => compareUtf8(left.path, right.path)),
       patches: [],
     });

package/src/plugin/resolver/dependency-resolver.js

@@ -4,6 +4,7 @@ import {
   PluginRuntimeError,
 } from "../runtime-errors.js";
 import { compareUtf8 } from "../stable-order.js";
+import { normalizeContentSelection } from "../content-selection.js";
 
 /**
  * 比较候选的稳定优先级。
@@ -173,6 +174,7 @@ export function resolvePluginGraph(declarations, registry, options = {}) {
     : new Set(options.update || []);
   const grantCapabilities = options.grantCapabilities || defaultCapabilityGrant;
   const initialConstraints = new Map();
+  const rootDeclarations = new Map(declarations.map((declaration) => [declaration.id, declaration]));
 
   for (const declaration of [...declarations].sort((left, right) => compareUtf8(left.id, right.id))) {
     const entries = initialConstraints.get(declaration.id) || [];
@@ -279,6 +281,9 @@ export function resolvePluginGraph(declarations, registry, options = {}) {
   const order = stableTopologicalOrder(roots, selected);
   const resolvedPlugins = order.map((id) => {
     const candidate = selected.get(id);
+    const contentSelection = rootDeclarations.has(id)
+      ? normalizeContentSelection(rootDeclarations.get(id).contentSelection)
+      : undefined;
     const dependencies = Object.fromEntries(
       Object.keys(candidate.manifest.dependencies || {}).sort(compareUtf8).map((dependency) => [
         dependency,
@@ -294,6 +299,7 @@ export function resolvePluginGraph(declarations, registry, options = {}) {
       dependencies,
       compatibility: candidate.manifest.compatibility,
       capabilities: grantCapabilities(candidate.manifest.capabilities, candidate),
+      ...(contentSelection ? { contentSelection } : {}),
     };
   });
   const graph = { roots, plugins: resolvedPlugins };

package/src/plugin/runtime-errors.js

@@ -20,6 +20,7 @@ export const PLUGIN_RUNTIME_ERROR_CODES = Object.freeze({
   DEPENDENCY_CYCLE: "PLUGIN_DEPENDENCY_CYCLE",
   PLATFORM_SELECTION_REQUIRED: "PLUGIN_PLATFORM_SELECTION_REQUIRED",
   PLATFORM_UNKNOWN: "PLUGIN_PLATFORM_UNKNOWN",
+  CONTENT_SELECTION_INVALID: "PLUGIN_CONTENT_SELECTION_INVALID",
   CONTENT_CONFLICT: "PLUGIN_CONTENT_CONFLICT",
   TARGET_DRIFT: "PLUGIN_TARGET_DRIFT",
   TRANSACTION_FAILED: "PLUGIN_TRANSACTION_FAILED",

package/src/plugin/schemas/marketplace-manifest.js

@@ -6,10 +6,11 @@ const sourceSchema = {
     {
       type: "object",
       additionalProperties: false,
-      required: ["type", "path"],
+      required: ["type"],
       properties: {
         type: { const: "path" },
         path: SAFE_PATH_SCHEMA,
+        manifestPath: SAFE_PATH_SCHEMA,
       },
     },
     {
@@ -20,6 +21,7 @@ const sourceSchema = {
         type: { const: "gitlab" },
         project: { type: "string", format: "gitlab-project" },
         subdir: SAFE_PATH_SCHEMA,
+        manifestPath: SAFE_PATH_SCHEMA,
       },
     },
     {
@@ -30,6 +32,7 @@ const sourceSchema = {
         type: { const: "github" },
         repository: { type: "string", format: "github-repository" },
         subdir: SAFE_PATH_SCHEMA,
+        manifestPath: SAFE_PATH_SCHEMA,
       },
     },
   ],

package/src/plugin/schemas/plugin-manifest.js

@@ -1,9 +1,10 @@
 import {
   CAPABILITY_NAME_SCHEMA,
+  CONTENT_SKILL_NAME_SCHEMA,
   PLUGIN_SCHEMA_VERSION,
   SAFE_PATH_SCHEMA,
 } from "./shared.js";
-import { createSchemaValidator } from "./validator.js";
+import { createSchemaValidator, schemaIssue } from "./validator.js";
 
 const stringList = {
   type: "array",
@@ -11,6 +12,21 @@ const stringList = {
   uniqueItems: true,
 };
 
+const skillEntryList = {
+  type: "array",
+  items: {
+    type: "object",
+    additionalProperties: false,
+    required: ["name", "path", "version"],
+    properties: {
+      name: CONTENT_SKILL_NAME_SCHEMA,
+      path: SAFE_PATH_SCHEMA,
+      version: { type: "string", format: "semver" },
+      description: { type: "string", minLength: 1 },
+    },
+  },
+};
+
 /** Flower Plugin Manifest v1 JSON Schema。 */
 export const PLUGIN_MANIFEST_SCHEMA = Object.freeze({
   $id: "https://flower-trellis.local/schema/plugin-manifest-v1.json",
@@ -59,7 +75,7 @@ export const PLUGIN_MANIFEST_SCHEMA = Object.freeze({
       additionalProperties: false,
       minProperties: 1,
       properties: {
-        skills: stringList,
+        skills: skillEntryList,
         specs: stringList,
         assets: stringList,
         scripts: stringList,
@@ -78,7 +94,43 @@ export const PLUGIN_MANIFEST_SCHEMA = Object.freeze({
   },
 });
 
-const validate = createSchemaValidator(PLUGIN_MANIFEST_SCHEMA, "Flower Plugin manifest");
+/**
+ * 校验 manifest 中 Skill 条目的唯一性。
+ *
+ * @param {unknown} value 已通过结构校验的 manifest
+ * @returns {Array<{code:string,path:string,message:string}>} 语义 issue
+ */
+function pluginManifestIssues(value) {
+  const manifest = /** @type {{content?:{skills?:Array<{name:string,path:string}>}}} */ (value);
+  const issues = [];
+  const names = new Set();
+  const paths = new Set();
+  for (const [index, skill] of (manifest.content?.skills || []).entries()) {
+    if (names.has(skill.name)) {
+      issues.push(schemaIssue(
+        "manifest.duplicate-skill-name",
+        `/content/skills/${index}/name`,
+        `Skill 名称重复:${skill.name}`,
+      ));
+    }
+    names.add(skill.name);
+    if (paths.has(skill.path)) {
+      issues.push(schemaIssue(
+        "manifest.duplicate-skill-path",
+        `/content/skills/${index}/path`,
+        `Skill 路径重复:${skill.path}`,
+      ));
+    }
+    paths.add(skill.path);
+  }
+  return issues;
+}
+
+const validate = createSchemaValidator(
+  PLUGIN_MANIFEST_SCHEMA,
+  "Flower Plugin manifest",
+  pluginManifestIssues,
+);
 
 /**
  * 校验 Flower Plugin Manifest v1。

package/src/plugin/schemas/project-files.js

@@ -1,5 +1,6 @@
 import {
   CAPABILITY_NAME_SCHEMA,
+  CONTENT_SKILL_NAME_SCHEMA,
   PLUGIN_SCHEMA_VERSION,
   SAFE_PATH_SCHEMA,
   parseCanonicalPluginId,
@@ -69,6 +70,20 @@ const capabilityGrantSchema = {
   },
 };
 
+const contentSelectionSchema = {
+  type: "object",
+  additionalProperties: false,
+  required: ["skills"],
+  properties: {
+    skills: {
+      type: "array",
+      minItems: 1,
+      items: CONTENT_SKILL_NAME_SCHEMA,
+      uniqueItems: true,
+    },
+  },
+};
+
 /** `.flower/plugins.json` v1 JSON Schema。 */
 export const PLUGINS_FILE_SCHEMA = Object.freeze({
   $id: "https://flower-trellis.local/schema/plugins-file-v1.json",
@@ -92,6 +107,7 @@ export const PLUGINS_FILE_SCHEMA = Object.freeze({
             items: { type: "string", format: "plugin-id" },
             uniqueItems: true,
           },
+          contentSelection: contentSelectionSchema,
         },
       },
     },
@@ -147,6 +163,7 @@ export const PLUGIN_LOCK_SCHEMA = Object.freeze({
             },
           },
           capabilities: capabilityGrantSchema,
+          contentSelection: contentSelectionSchema,
         },
       },
     },
@@ -176,6 +193,7 @@ export const PLUGIN_STATE_SCHEMA = Object.freeze({
             items: { type: "string", format: "plugin-id" },
             uniqueItems: true,
           },
+          contentSelection: contentSelectionSchema,
           paths: {
             type: "array",
             items: {

package/src/plugin/schemas/shared.js

@@ -12,6 +12,9 @@ export const PLUGIN_ID_PATTERN = "^[a-z0-9]+(?:-[a-z0-9]+)*$";
 export const CANONICAL_PLUGIN_ID_PATTERN =
   "^[a-z0-9]+(?:-[a-z0-9]+)*/[a-z0-9]+(?:-[a-z0-9]+)*$";
 
+/** contentSelection.skills 与 manifest Skill 条目名称的正则源。 */
+export const CONTENT_SKILL_NAME_PATTERN = "^(?!\\.{1,2}$)[^/\\\\]+$";
+
 /** SHA-256 摘要的正则源。 */
 export const SHA256_DIGEST_PATTERN = "^sha256:[a-f0-9]{64}$";
 
@@ -180,6 +183,13 @@ export function isGitHubRepository(value) {
 /** 可复用的安全相对路径 JSON Schema。 */
 export const SAFE_PATH_SCHEMA = Object.freeze({ type: "string", format: "posix-relative-path" });
 
+/** 可复用的内容 Skill 名称 JSON Schema。 */
+export const CONTENT_SKILL_NAME_SCHEMA = Object.freeze({
+  type: "string",
+  minLength: 1,
+  pattern: CONTENT_SKILL_NAME_PATTERN,
+});
+
 /** 可复用的 capability 名称 JSON Schema。 */
 export const CAPABILITY_NAME_SCHEMA = Object.freeze({
   type: "string",

package/src/plugin/sources/github-provider.js

@@ -433,7 +433,7 @@ export class GitHubSourceProvider {
         committedAt: resolved.committedAt,
         subdir,
         format: "flower",
-        entryPath: null,
+        entryPath: entry.source.manifestPath || null,
       });
       if (prepared.packages.length !== 1) {
         throw new PluginRuntimeError(`Flower Marketplace 条目不是单一 Plugin:${entry.id}`, {