grok-bot-cli 0.6.0 → 0.8.0

package/dist/install.mjs

@@ -7,7 +7,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { fileURLToPath } from 'node:url';
 
 const pluginName = "gbot";
-const pluginVersion = "0.6.0";
+const pluginVersion = "0.8.0";
 const receiptFile = ".agent-bundle-install.json";
 const receiptFormat = "agent-bundle-install-receipt/2";
 const legacyReceiptFormat = "agent-bundle-install-receipt/1";
@@ -118,7 +118,7 @@ const hashEntry = (hash, relative, metadata, bytes) => {
 // Deterministic tree walk: symlinks and special files refused, the root receipt skipped. `transform`
 // maps a file's bytes to what the Cursor copy will hold (the Agent Plugins mcp.json expansion below), so
 // the artifact hash describes the installed form and reruns compare like for like.
-const inventory = async (root, transform) => {
+const readTree = async (root, transform, selectedPaths) => {
   const rootMetadata = await lstat(root);
   if (rootMetadata.isSymbolicLink() || !rootMetadata.isDirectory()) throw unsupported('.');
   const hash = createHash('sha256');
@@ -139,10 +139,11 @@ const inventory = async (root, transform) => {
     const bytes = await readFile(absolute);
     hashEntry(hash, relative, metadata, transform === undefined ? bytes : transform(posixPath, bytes));
   };
-  if (artifactManifest !== undefined) {
-    const selected = new Set(['agent-bundle.manifest.json', ...artifactManifest.files.map((file) => file.path)]);
-    for (const file of ['.env', '.env.local']) if (await exists(join(root, file))) selected.add(file);
-    for (const file of [...selected].sort(compareTreePaths)) await visit(file);
+  if (selectedPaths !== undefined) {
+    for (const file of selectedPaths) {
+      if (!(await exists(join(root, file)))) throw new Error(`bundle does not match its manifest: ${file} is missing.`);
+      await visit(file);
+    }
     return { files, hash: hash.digest('hex') };
   }
   for (const entry of (await readdir(root)).sort((left, right) => left.localeCompare(right))) {
@@ -157,6 +158,13 @@ const inventory = async (root, transform) => {
   }
   return { files, hash: hash.digest('hex') };
 };
+const inventory = (root, transform) => readTree(root, transform, undefined);
+const artifactInventory = async (root, transform) => {
+  if (artifactManifest === undefined) return inventory(root, transform);
+  const selected = new Set(['agent-bundle.manifest.json', ...artifactManifest.files.map((file) => file.path)]);
+  for (const file of ['.env', '.env.local']) if (await exists(join(root, file))) selected.add(file);
+  return readTree(root, transform, [...selected].sort(compareTreePaths));
+};
 
 const treeHash = async (root) => (await inventory(root)).hash;
 
@@ -545,7 +553,7 @@ const stage = async (tree, receiptOptions = {}) => {
     };
     await cp(source, root, { errorOnExist: true, filter, force: false, recursive: true, verbatimSymlinks: true });
     if (expansion !== undefined) await writeFile(join(root, expansion.mcpDocument), expansion.expanded, 'utf8');
-    const staged = await inventory(root);
+    const staged = await artifactInventory(root);
     await writeFile(join(root, receiptFile), receiptFor(staged, receiptOptions), 'utf8');
     return { inventory: staged, parent, root };
   } catch (error) {
@@ -1018,7 +1026,7 @@ const marketplaceManifestPath = join(marketplaceRepo, '.cursor-plugin', 'marketp
 // commit lets --uninstall prove the repository is still the one staging wrote.
 const writeMarketplaceReceipt = async (commit) => {
   const previous = await readReceiptFile(marketplaceReceipt);
-  const tree = await inventory(source);
+  const tree = await artifactInventory(source);
   if (previous !== undefined && previous.contentHash === tree.hash && previous.registrations[0]?.commit === commit) return;
   await mkdir(receiptsRoot, { recursive: true });
   // The committed repository is removed wholesale after a HEAD check; the receipt owns no individual files.
@@ -1081,6 +1089,7 @@ if (mode === 'marketplace') {
   if (nestedGit !== undefined) {
     throw new Error(`--mode marketplace refuses bundle-internal Git metadata at ${JSON.stringify(nestedGit)}: git would record it as an empty gitlink and Cursor would import a plugin without files. Stage from a built bundle directory without .git, or use the default local mode.`);
   }
+  await artifactInventory(source);
   await mkdir(marketplaceRoot, { recursive: true });
   if (await exists(marketplaceRepo)) {
     let stagedVersion;
@@ -1089,6 +1098,7 @@ if (mode === 'marketplace') {
     if (stagedVersion !== undefined && stagedVersion !== pluginVersion) {
       throw new Error(`Refusing version collision at ${marketplaceRepo}: found ${stagedVersion}, requested ${pluginVersion}.`);
     }
+    // The staged plugin is an unfiltered copy of the bundle, so both sides hash the files present.
     if (await exists(marketplacePlugin) && await exists(join(marketplaceRepo, '.git')) && await treeHash(source) === await treeHash(marketplacePlugin)) {
       let stagedManifest;
       try { stagedManifest = await readFile(marketplaceManifestPath, 'utf8'); }
@@ -1143,7 +1153,7 @@ if (mode === 'marketplace') {
 }
 
 // The artifact is inventoried (and any unsupported entry refused) before anything is created in the home.
-const artifact = await inventory(source, cursorTransform);
+const artifact = await artifactInventory(source, cursorTransform);
 // The receipt records which host directories this run creates on the way to the plugin root (a fresh Cursor
 // home has no plugins/local), so --uninstall can prune exactly those and no more.
 const createdHostDirectories = [];