francois 0.18.13 → 0.19.0

package/bin/francois.js

@@ -10,9 +10,11 @@
  */
 
 const { spawn, spawnSync } = require('node:child_process');
+const fs = require('node:fs');
 const path = require('node:path');
 
 const desktop = require('../lib/desktop.js');
+const extensions = require('../lib/extensions.js');
 const {
   assetKey,
   readInstallRecord,
@@ -30,11 +32,118 @@ Usage
   francois shortcut            re-register the Start Menu / Launchpad / menu entry
   francois shortcut --remove   unregister it
   francois uninstall           unregister the desktop entry, then npm-uninstall this package
+  francois ext install <name>  install a plugin by name, local path, or git URL
+  francois ext list            list installed plugins (works with the app closed)
+  francois ext remove <id>     delete an installed plugin
   francois --help              this message
 
 Anything else is forwarded to the app.
 `;
 
+const EXT_USAGE = `francois ext — manage plugins in ~/.francois/extensions (filesystem only,
+never the app's socket — this works with the app closed).
+
+Usage
+  francois ext install <name|path|git-url> [--force]
+  francois ext list
+  francois ext remove <id> [--yes]
+
+A bare <name> resolves by CONVENTION to the repository
+\`github.com/antoine-gmnz/francois-plugin-<name>\`; \`<owner>/<name>\` uses that
+owner instead. There is no index and nothing to search — the convention is a
+URL shorthand, so any plugin is still installable by its full URL. An existing
+local directory of that name always wins, so nothing reaches the network when
+a local answer exists.
+
+Installing never enables a plugin — review and enable it in Extensions (⌘K).
+`;
+
+/** A single blocking line read off stdin — no dependency, works in a real
+ * terminal and under a piped `echo y |` in CI alike. */
+function confirmSync(question) {
+  process.stdout.write(question);
+  const buf = Buffer.alloc(4096);
+  let bytesRead = 0;
+  try {
+    bytesRead = fs.readSync(0, buf, 0, buf.length, null);
+  } catch {
+    return false;
+  }
+  const answer = buf.toString('utf8', 0, bytesRead).trim().toLowerCase();
+  return answer === 'y' || answer === 'yes';
+}
+
+function runExt(args) {
+  const sub = args[0];
+  if (!sub || sub === '--help' || sub === '-h') {
+    process.stdout.write(EXT_USAGE);
+    return;
+  }
+
+  if (sub === 'install') {
+    const force = args.includes('--force');
+    const source = args.slice(1).find((a) => !a.startsWith('--'));
+    if (!source) die('francois ext install <name|path|git-url>');
+    let result;
+    try {
+      result = extensions.installExtension(source, { force });
+    } catch (error) {
+      die(error.message);
+    }
+    // The resolved source is printed because a bare name is ambiguous by
+    // design: the user must be able to see whether it copied a directory or
+    // cloned a repository, without re-deriving the convention in their head.
+    // `result.source`/`result.id`/`result.path` are all untrusted (attacker-
+    // controlled path/URL text) — sanitize before they ever reach stdout, the
+    // same as the `list` path.
+    process.stdout.write(
+      `francois: installed "${extensions.sanitizeForDisplay(result.id)}" from ${extensions.sanitizeForDisplay(result.source)}\n`
+    );
+    process.stdout.write(`francois:   at ${extensions.sanitizeForDisplay(result.path)}\n`);
+    // FR-15/FR-28: discovery is not authorization — it always arrives inert.
+    process.stdout.write('francois: disabled — enable it in Extensions (⌘K)\n');
+    return;
+  }
+
+  if (sub === 'list') {
+    const found = extensions.listExtensions();
+    if (found.length === 0) {
+      process.stdout.write(`francois: nothing installed yet — see ${extensions.extensionsDir()}\n`);
+      return;
+    }
+    for (const ext of found) {
+      const status = !ext.valid ? 'invalid manifest' : ext.enabled ? 'enabled' : 'disabled';
+      process.stdout.write(`${ext.id}\t${ext.label}\t${ext.path}\t${status}\n`);
+    }
+    return;
+  }
+
+  if (sub === 'remove') {
+    const id = args[1];
+    if (!id || id.startsWith('--')) die('francois ext remove <id>');
+    let target;
+    try {
+      target = extensions.resolveExtensionDir(id);
+    } catch (error) {
+      die(error.message);
+    }
+    process.stdout.write(`francois: about to delete ${target}\n`);
+    if (!args.includes('--yes') && !confirmSync('remove this extension? [y/N] ')) {
+      process.stdout.write('francois: cancelled.\n');
+      return;
+    }
+    try {
+      extensions.removeExtension(id);
+    } catch (error) {
+      die(error.message);
+    }
+    process.stdout.write(`francois: removed "${id}".\n`);
+    return;
+  }
+
+  die(`unknown "francois ext ${sub}" — see \`francois ext --help\`.`);
+}
+
 function die(message) {
   process.stderr.write(`\nfrancois: ${message}\n\n`);
   process.exit(1);
@@ -79,6 +188,13 @@ function main() {
     return;
   }
 
+  // extension-install FR-27: filesystem verbs, off the socket — work with the
+  // app closed, and never reach the app's dispatch below.
+  if (argv[0] === 'ext') {
+    runExt(argv.slice(1));
+    return;
+  }
+
   // Re-runnable on demand: a shortcut can be deleted, or the postinstall can have
   // run somewhere the desktop wasn't reachable (SSH, a container, a CI image).
   if (argv[0] === 'shortcut') {

package/manifest.json

@@ -1,12 +1,12 @@
 {
   "repo": "antoine-gmnz/francois",
-  "tag": "v0.18.13",
+  "tag": "v0.19.0",
   "channel": "stable",
-  "appVersion": "0.18.13",
+  "appVersion": "0.19.0",
   "productName": "Francois",
   "assets": {
-    "darwin-universal": { "name": "francois-darwin-universal.tar.gz", "sha256": "d7fe763c2ba6130611de9249af49d06f89e3d0e75170f515886af39245a3d1cf" },
-    "linux-x64": { "name": "francois-linux-x64.tar.gz", "sha256": "3275ac629e4427ad34470cadcb92ec140267ecabf20275c8922175dc577515e1" },
-    "win32-x64": { "name": "francois-win32-x64.zip", "sha256": "b6b2db077be05e9f343142c2763c933908f478b742faacbbe74b24d2a738d362" }
+    "darwin-universal": { "name": "francois-darwin-universal.tar.gz", "sha256": "ab291ffde31a9b86790d6d478be32081ef40cdafd1e74d8234f5431b36726cf3" },
+    "linux-x64": { "name": "francois-linux-x64.tar.gz", "sha256": "f991296c452aae7a3217be955845b15f6350ee3734b8d53cb8e2d2d2045b3c4c" },
+    "win32-x64": { "name": "francois-win32-x64.zip", "sha256": "45b6b69bcd720a284c167c4341546b31edc0cd22563e3110a16057a4e2ed3af0" }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "francois",
-  "version": "0.18.13",
+  "version": "0.19.0",
   "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",
   "license": "AGPL-3.0-only",
   "author": "Antoine Gimenez",