harness-alchemist 0.1.9 → 0.2.0-alpha.1

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "harness-alchemist",
   "displayName": "Harness Alchemist",
-  "version": "0.1.9",
+  "version": "0.2.0-alpha.1",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-alchemist",
-  "version": "0.1.9",
+  "version": "0.2.0-alpha.1",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang",

package/README.md

@@ -38,7 +38,11 @@ npm install -g harness-alchemist
 npx harness-alchemist@latest create my-plugin --help
 ```
 
-Requires Node.js 22.20+ (Bun 1.2+ also supported).
+The CLI implementation is a native Rust binary. npm and Bun installations use a
+small launcher to select a prebuilt macOS, Linux, or Windows binary for x64 or
+arm64. No Rust toolchain or install script is required by CLI users. Repository
+development requires the pinned Rust toolchain in `rust-toolchain.toml`. The npm
+launcher requires Node.js 22.20+; invoking it with Bun 1.2+ is also supported.
 
 ## Quick start
 
@@ -157,14 +161,46 @@ and the DeepSeek Cordis check require npm mode with built adapters
 
 ## Validation tiers
 
-`npm run validate` always enforces Agent Skills frontmatter compliance, SKILL.md reference resolution, runtime-manifest validation, fixed contained entrypoints, and npm-mode twin parity. With the optional `pyodide` devDependency installed, Python twins are additionally compiled and smoke-executed inside a WebAssembly CPython sandbox; Pyodide is validation-only, not a version 1 execution engine.
+`npm run validate` always enforces Agent Skills frontmatter compliance, SKILL.md
+reference resolution, validation of every present runtime manifest, fixed
+contained entrypoints, npm-mode twin parity, and Python syntax through the native
+Rust parser. Generated npm plugins require a runtime manifest for every product
+skill; adapted skills-only repositories may also contain additional prose-only
+skills while retaining a manifest for the primary MCP-targeted skill. The validator
+does not execute project Python during structural validation; JavaScript/Python
+behavioral parity is exercised by the runtime tests.
 
 ## Release automation
 
+The main package and six platform packages use GitHub Actions workflow
+`npm-publish.yml` in `lunarmoon26/harness-alchemist` as their Trusted Publisher.
+The workflow builds each native target on its matching hosted runner, publishes
+platform packages first, then publishes the main package. It uses OIDC instead
+of an `NPM_TOKEN`, requires the tag to match both `package.json` and
+`Cargo.toml`, and accepts only commits contained in `main`.
+
+Trusted Publisher configuration is package-scoped. Before the first native
+release, create each new platform package once using an interactive npm session
+with 2FA (a reserved `0.0.0` bootstrap version keeps real releases on OIDC), then
+configure its publisher with npm 11.5.1 or newer:
+
+```bash
+npm trust github @lunarmoon26/harness-alchemist-darwin-arm64 \
+  --repo lunarmoon26/harness-alchemist --file npm-publish.yml \
+  --allow-publish --yes
+```
+
+Repeat that command for all six platform package names, then set each package's
+publishing access to **Require two-factor authentication and disallow tokens**.
+The existing main package must retain the same workflow identity and policy.
+Prerelease versions publish under the `next` dist-tag; stable versions publish
+under `latest`.
+
 ```bash
 # bump package.json version, then:
 npm run sync && npm run verify && git commit -am "Release vX.Y.Z" && git push
-git tag vX.Y.Z && git push origin vX.Y.Z   # publishes automatically
+# after the release commit is merged to main:
+git tag vX.Y.Z && git push origin vX.Y.Z   # publishes through npm Trusted Publishing
 ```
 
 ## License

package/alchemy.json

@@ -3,6 +3,6 @@
   "runtime": "npm",
   "template": "v0.1.0",
   "generator": "harness-alchemist",
-  "generatorVersion": "0.1.9",
+  "generatorVersion": "0.2.0-alpha.1",
   "createdAt": "2026-08-24T00:00:00.000Z"
 }

package/alchemy.schema.json

@@ -13,7 +13,7 @@
     "runtime": {
       "enum": ["npm", "skills"],
       "default": "npm",
-      "description": "'npm' requires the full generated contract (npm package, portable runtime manifests, OpenCode and Cordis adapters, and Cordis patch). 'skills' requires skills, portable runtime manifests, and harness manifests only and allows single-language scripts."
+      "description": "'npm' requires the full generated contract (npm package, a portable runtime manifest for every product skill, OpenCode and Cordis adapters, and Cordis patch). 'skills' requires portable skills and harness manifests, validates runtime manifests when present, and allows additional prose-only skills and single-language scripts while retaining a manifest for the primary MCP-targeted skill."
     },
     "pluginRoot": {
       "type": "string",

package/bin/harness-alchemist.mjs

@@ -1,48 +1,74 @@
 #!/usr/bin/env node
 
-import { readFile } from "node:fs/promises"
+import { existsSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+import { createRequire } from "node:module"
+import { spawnSync } from "node:child_process"
 
-import { listTemplates, runCreate } from "../lib/create.mjs"
-import { runInstallCheck } from "../lib/install-check.mjs"
-import { runValidate } from "../lib/validate.mjs"
+const require = createRequire(import.meta.url)
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
+const extension = process.platform === "win32" ? ".exe" : ""
 
-const packageJson = JSON.parse(
-  await readFile(new URL("../package.json", import.meta.url), "utf8"),
-)
+const platformPackages = {
+  darwin: {
+    arm64: "@lunarmoon26/harness-alchemist-darwin-arm64",
+    x64: "@lunarmoon26/harness-alchemist-darwin-x64",
+  },
+  linux: {
+    arm64: "@lunarmoon26/harness-alchemist-linux-arm64",
+    x64: "@lunarmoon26/harness-alchemist-linux-x64",
+  },
+  win32: {
+    arm64: "@lunarmoon26/harness-alchemist-win32-arm64",
+    x64: "@lunarmoon26/harness-alchemist-win32-x64",
+  },
+}
 
-function usage() {
-  return `Harness Alchemist ${packageJson.version}
+function installedBinary() {
+  const packageName = platformPackages[process.platform]?.[process.arch]
+  if (!packageName) return undefined
+  try {
+    return join(dirname(require.resolve(`${packageName}/package.json`)), `harness-alchemist${extension}`)
+  } catch {
+    return undefined
+  }
+}
 
-Usage: harness-alchemist <command> [options]
+function localBinary() {
+  for (const profile of ["release", "debug"]) {
+    const candidate = join(packageRoot, "target", profile, `harness-alchemist${extension}`)
+    if (existsSync(candidate)) return candidate
+  }
+  return undefined
+}
 
-Commands:
-  create <directory>    Create a universal coding-agent plugin repository.
-  validate [directory] Validate a generated repository.
-  install-check        Install the plugin into local harness CLIs and verify
-                        discovery (claude, codex, agy, opencode, dsh).
-  templates            List bundled canonical templates.
-  version              Print the CLI version.
-  help                 Show this help.
+const binary = process.env.HARNESS_ALCHEMIST_BINARY || installedBinary() || localBinary()
 
-Aliases: init and new are aliases for create.`
+if (!binary) {
+  const supported = platformPackages[process.platform]?.[process.arch]
+  const reason = supported
+    ? `The optional package '${supported}' is not installed.`
+    : `The platform '${process.platform}-${process.arch}' is not supported.`
+  console.error(`Harness Alchemist could not locate its native binary. ${reason}`)
+  console.error("Reinstall without --no-optional, or install a supported binary from GitHub Releases.")
+  process.exit(1)
 }
 
-const [command, ...args] = process.argv.slice(2)
-
-if (!command || command === "help" || command === "--help" || command === "-h") {
-  console.log(usage())
-} else if (command === "version" || command === "--version" || command === "-v") {
-  console.log(packageJson.version)
-} else if (command === "templates") {
-  console.log(listTemplates())
-} else if (["create", "init", "new"].includes(command)) {
-  process.exitCode = await runCreate(args)
-} else if (command === "validate") {
-  process.exitCode = await runValidate(args)
-} else if (command === "install-check") {
-  process.exitCode = await runInstallCheck(args)
+const result = spawnSync(binary, process.argv.slice(2), {
+  stdio: "inherit",
+  env: {
+    ...process.env,
+    HARNESS_ALCHEMIST_PACKAGE_ROOT: packageRoot,
+  },
+})
+
+if (result.error) {
+  console.error(`Failed to start Harness Alchemist: ${result.error.message}`)
+  process.exit(1)
+}
+if (result.signal) {
+  process.kill(process.pid, result.signal)
 } else {
-  console.error(`Unknown command: ${command}\n`)
-  console.error(usage())
-  process.exitCode = 2
+  process.exit(result.status ?? 1)
 }

package/mcp.json

@@ -6,7 +6,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@lunarmoon26/agent-skill-runtime@0.1.0",
+        "@lunarmoon26/agent-skill-runtime@0.1.1",
         "mcp",
         "--root",
         "${PLUGIN_ROOT}",

package/package.json

@@ -1,28 +1,35 @@
 {
-  "name": "harness-alchemist",
-  "version": "0.1.9",
-  "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
-  "type": "module",
+  "author": "Haochuan Zhang",
   "bin": {
     "harness-alchemist": "bin/harness-alchemist.mjs"
   },
-  "main": "./dist/opencode.js",
-  "types": "./dist/opencode.d.ts",
+  "dependencies": {
+    "@lunarmoon26/agent-skill-runtime": "0.1.1"
+  },
+  "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "engines": {
+    "bun": ">=1.2.0",
+    "node": ">=22.20.0"
+  },
   "exports": {
     ".": {
-      "types": "./dist/opencode.d.ts",
-      "import": "./dist/opencode.js"
+      "import": "./dist/opencode.js",
+      "types": "./dist/opencode.d.ts"
     },
+    "./cordis.patch.yml": "./cordis.patch.yml",
     "./deepseek": {
-      "types": "./dist/deepseek.d.ts",
-      "import": "./dist/deepseek.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml"
+      "import": "./dist/deepseek.js",
+      "types": "./dist/deepseek.d.ts"
+    }
   },
   "files": [
     "dist",
     "bin",
-    "lib",
     "templates",
     "skills",
     "alchemy.json",
@@ -35,20 +42,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test tests/*.test.mjs",
-    "sync": "node .agents/skills/develop-harness-alchemist/scripts/sync-metadata.mjs",
-    "validate": "node .agents/skills/develop-harness-alchemist/scripts/validate.mjs",
-    "pack:check": "node .agents/skills/develop-harness-alchemist/scripts/check-package.mjs",
-    "verify": "npm run check && npm test && npm run validate && npm run pack:check",
-    "prepack": "npm run verify"
-  },
-  "engines": {
-    "node": ">=22.20.0",
-    "bun": ">=1.2.0"
-  },
   "keywords": [
     "agent-skill",
     "antigravity",
@@ -58,8 +51,16 @@
     "opencode",
     "scaffolding"
   ],
-  "dependencies": {
-    "@lunarmoon26/agent-skill-runtime": "0.1.0"
+  "license": "MIT",
+  "main": "./dist/opencode.js",
+  "name": "harness-alchemist",
+  "optionalDependencies": {
+    "@lunarmoon26/harness-alchemist-darwin-arm64": "0.2.0-alpha.1",
+    "@lunarmoon26/harness-alchemist-darwin-x64": "0.2.0-alpha.1",
+    "@lunarmoon26/harness-alchemist-linux-arm64": "0.2.0-alpha.1",
+    "@lunarmoon26/harness-alchemist-linux-x64": "0.2.0-alpha.1",
+    "@lunarmoon26/harness-alchemist-win32-arm64": "0.2.0-alpha.1",
+    "@lunarmoon26/harness-alchemist-win32-x64": "0.2.0-alpha.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -73,22 +74,15 @@
       "optional": true
     }
   },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@opencode-ai/plugin": "^1.18.21",
-    "@types/node": "^26.2.0",
-    "pyodide": "^314.0.5",
-    "typescript": "^5.9.3"
+  "preferUnplugged": true,
+  "publishConfig": {
+    "access": "public"
   },
-  "author": "Haochuan Zhang",
-  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lunarmoon26/harness-alchemist.git"
   },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  }
+  "type": "module",
+  "types": "./dist/opencode.d.ts",
+  "version": "0.2.0-alpha.1"
 }

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-alchemist",
-  "version": "0.1.9",
+  "version": "0.2.0-alpha.1",
   "description": "Scaffold, validate, and publish portable coding-agent plugins across Claude Code, Codex, OpenCode, Antigravity, and DeepSeek Harness.",
   "author": {
     "name": "Haochuan Zhang"

package/skills/harness-alchemist/references/publishing.md

@@ -57,13 +57,17 @@ The package root exports OpenCode. The `./deepseek` subpath exports Cordis. Keep
 ## GitHub Release Publishing
 
 `.github/workflows/npm-publish.yml` publishes when a `vX.Y.Z` tag is pushed
-(or a GitHub release with a semver tag such as `vX.Y.Z-rc.1` is published);
-the workflow applies that version to `package.json`, runs
-`npm run sync`, verifies the package, and publishes it with npm provenance.
-
-Configure the repository `NPM_TOKEN` secret with an npm publish token before
-pushing the tag. The workflow never publishes from pull requests or branch
-pushes.
+(including a prerelease tag such as `vX.Y.Z-rc.1`). The workflow requires the
+tag to match the committed `package.json` version, checks that the tagged
+commit is contained in `main`, verifies synchronized metadata and the package,
+then publishes through npm Trusted Publishing with provenance.
+Prerelease versions publish under npm's `next` dist-tag; stable versions publish
+under `latest`.
+
+Before the first release, configure the npm package's Trusted Publisher for
+GitHub Actions with the repository owner, repository name, workflow filename
+`npm-publish.yml`, and no environment. Do not create an `NPM_TOKEN` secret.
+The workflow never publishes from pull requests or branch pushes.
 
 ## Public Catalog Metadata
 

package/templates/README.md

@@ -4,6 +4,6 @@ Each published versioned directory is a complete, immutable scaffold contract.
 
 - `v0.1.0/universal-typescript/` is the unreleased canonical universal plugin layout and may be updated in place.
 - `v0.1.0/licenses/` contains license source text used during rendering.
-- `lib/create.mjs` maps template directory names, renders metadata tokens, injects the validator and license, validates in staging, and atomically installs the result.
+- The native Rust generator maps template directory names, renders metadata tokens, injects `generated/validate.mjs` and the selected license, validates in staging, and atomically installs the result.
 
 After a version is published, make incompatible changes in a new `v<version>/` directory and require callers to select that version explicitly. Do not silently redirect old template identifiers.

package/{lib → templates/v0.1.0/generated}/validate.mjs

@@ -11,7 +11,7 @@ import { discoverSkillTools } from "@lunarmoon26/agent-skill-runtime"
 const AGENT_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
 const AGENT_PLUGIN_MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json"
 const SKILL_RUNTIME_PACKAGE = "@lunarmoon26/agent-skill-runtime"
-const SKILL_RUNTIME_VERSION = "0.1.0"
+const SKILL_RUNTIME_VERSION = "0.1.1"
 
 const PROJECT_REQUIRED_FILES = [
   ".agents/plugins/marketplace.json",
@@ -46,9 +46,9 @@ Validates a universal Claude, Codex, OpenCode, Antigravity, and DeepSeek
 plugin scaffold. By default the project is resolved from the current working
 directory or from the script's containing generated project.
 
-Product skills are checked against the Agent Skills specification and the
-portable skill runtime manifest. When the optional 'pyodide' devDependency is
-installed, Python twin entrypoints are also syntax-checked and smoke-executed
+Product skills are checked against the Agent Skills specification, and every
+present runtime manifest is validated. When the optional 'pyodide' devDependency
+is installed, Python entrypoints are also syntax-checked and smoke-executed
 in a WebAssembly CPython sandbox.
 
 Options:
@@ -668,9 +668,9 @@ export async function validateProject(projectRoot, options = {}) {
       }
       if (productSkillFiles.includes(skillFile)) {
         const manifestPath = join(dirname(skillFile), "skill-runtime.json")
-        if (!existsSync(manifestPath)) {
+        if (!existsSync(manifestPath) && (runtime === "npm" || directoryName === pluginName)) {
           errors.push(`${skillFile}: missing skill-runtime.json`)
-        } else {
+        } else if (existsSync(manifestPath)) {
           runtimeManifestPaths.push(relative(pluginRoot, manifestPath))
         }
         await checkProductSkillRuntime(skillFile, content, frontmatter, errors, pythonScripts, runtime)
@@ -678,7 +678,7 @@ export async function validateProject(projectRoot, options = {}) {
     }
   }
 
-  if (runtimeManifestPaths.length === productSkillFiles.length && runtimeManifestPaths.length > 0) {
+  if (runtimeManifestPaths.length > 0) {
     try {
       const tools = await discoverSkillTools({ pluginRoot, manifestPaths: runtimeManifestPaths })
       for (const tool of tools) {

package/templates/v0.1.0/universal-typescript/.github/workflows/npm-publish.yml.tpl

@@ -7,43 +7,68 @@ on:
 
 permissions:
   contents: read
-  id-token: write
+
+concurrency:
+  group: npm-publish-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   publish:
+    name: Publish package
     if: github.event.created && !github.event.deleted
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # Required for npm Trusted Publishing OIDC.
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 22.20.0
+          node-version: "24.19.0"
           registry-url: https://registry.npmjs.org
-      - uses: oven-sh/setup-bun@v2
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.2.0
+          bun-version: 1.4.0
+          no-cache: true
 
-      - name: Resolve release version
-        id: version
+      - name: Verify release tag
         shell: bash
         run: |
-          TAG="${{ github.ref_name }}"
-          VERSION="${TAG#v}"
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
-            echo "::error::Tag '$TAG' is not a valid semver version"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          EXPECTED_TAG="v${PACKAGE_VERSION}"
+          if [[ "$GITHUB_REF_NAME" != "$EXPECTED_TAG" ]]; then
+            echo "::error::Tag '$GITHUB_REF_NAME' must match package version '$EXPECTED_TAG'"
+            exit 1
+          fi
+
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          TAG_COMMIT="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
+          if ! git merge-base --is-ancestor "$TAG_COMMIT" refs/remotes/origin/main; then
+            echo "::error::Release tag '$GITHUB_REF_NAME' must point to a commit contained in main"
             exit 1
           fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - run: npm ci
-      - name: Set package version from tag
-        run: npm version "${{ steps.version.outputs.version }}" --no-git-tag-version --allow-same-version
-      - run: npm run sync
+      - name: Verify synchronized metadata
+        run: |
+          npm run sync
+          git diff --exit-code
       - run: npm run verify
       - name: Verify npm package contents
         run: npm pack --dry-run
+      - name: Select npm dist-tag
+        shell: bash
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ "$VERSION" == *-* ]]; then
+            echo "NPM_DIST_TAG=next" >> "$GITHUB_ENV"
+          else
+            echo "NPM_DIST_TAG=latest" >> "$GITHUB_ENV"
+          fi
       - name: Publish npm package
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --tag "$NPM_DIST_TAG"

package/templates/v0.1.0/universal-typescript/README.md.tpl

@@ -57,12 +57,14 @@ npm pack --dry-run
 ## GitHub Release Publishing
 
 `.github/workflows/npm-publish.yml` publishes when a `vX.Y.Z` tag is pushed
-(or a GitHub release with a semver tag such as `vX.Y.Z-rc.1` is published);
-the workflow applies that version, synchronizes manifests,
-verifies the package, and publishes with npm provenance.
-
-Configure the repository `NPM_TOKEN` secret with an npm publish token before
-pushing the tag.
+(including a prerelease tag such as `vX.Y.Z-rc.1`). The workflow requires the
+tag to match the committed `package.json` version, checks that the tagged
+commit is contained in `main`, verifies synchronized metadata and the package,
+then publishes through npm Trusted Publishing with provenance.
+
+Before the first release, configure the npm package's Trusted Publisher for
+GitHub Actions with the repository owner, repository name, workflow filename
+`npm-publish.yml`, and no environment. Do not create an `NPM_TOKEN` secret.
 
 ## Claude Code
 

package/templates/v0.1.0/universal-typescript/mcp.json.tpl

@@ -6,7 +6,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@lunarmoon26/agent-skill-runtime@0.1.0",
+        "@lunarmoon26/agent-skill-runtime@0.1.1",
         "mcp",
         "--root",
         "${PLUGIN_ROOT}",

package/templates/v0.1.0/universal-typescript/package.json.tpl

@@ -42,7 +42,7 @@
     "node": ">=22.20.0"
   },
   "dependencies": {
-    "@lunarmoon26/agent-skill-runtime": "0.1.0"
+    "@lunarmoon26/agent-skill-runtime": "0.1.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",

package/lib/create.mjs

@@ -1,331 +0,0 @@
-#!/usr/bin/env node
-
-import { randomUUID } from "node:crypto"
-import { existsSync } from "node:fs"
-import { chmod, cp, mkdir, readdir, readFile, rename, rm, rmdir, stat, writeFile } from "node:fs/promises"
-import { basename, dirname, join, resolve } from "node:path"
-import { fileURLToPath } from "node:url"
-import { spawnSync } from "node:child_process"
-
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
-const PACKAGE_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9]+(?:-[a-z0-9]+)*$/
-const LICENSES = new Set(["MIT", "Apache-2.0", "UNLICENSED"])
-const CANONICAL_VERSION = "v0.1.0"
-
-export function listTemplates() {
-  return `${CANONICAL_VERSION} (canonical)`
-}
-
-function usage() {
-  return `Usage: harness-alchemist create <output-directory> [options]
-
-Create one TypeScript repository for Claude Code, Codex/ChatGPT, OpenCode,
-Google Antigravity, and DeepSeek Harness/Cordis.
-
-Required:
-  --description <text>       One-sentence plugin description.
-  --author <name>            Author or team name.
-  --repository <source>      GitHub owner/repo or a full Git URL.
-
-Options:
-  --name <name>              Plugin name; defaults to output directory name.
-  --package <name>           npm package; defaults to plugin name. Its basename
-                             must equal the plugin name.
-  --display-name <text>      Human-readable name; defaults from plugin name.
-  --marketplace <name>       Claude/Codex marketplace name; defaults to
-                              <plugin-name>-plugins.
-  --template <version>       Canonical template version (default: v0.1.0).
-  --license <id>             MIT (default), Apache-2.0, or UNLICENSED.
-  --dry-run                  Validate inputs and print the files without writing.
-  --help                     Show this help.
-
-The destination must be missing or empty. Existing content is never replaced.`
-}
-
-function parseArgs(argv) {
-  const options = { license: "MIT", templateVersion: CANONICAL_VERSION, dryRun: false }
-  const valueOptions = new Map([
-    ["--name", "name"],
-    ["--description", "description"],
-    ["--package", "packageName"],
-    ["--author", "author"],
-    ["--repository", "repository"],
-    ["--display-name", "displayName"],
-    ["--marketplace", "marketplace"],
-    ["--template", "templateVersion"],
-    ["--license", "license"],
-  ])
-
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index]
-    if (arg === "--help" || arg === "-h") return { help: true }
-    if (arg === "--dry-run") {
-      options.dryRun = true
-      continue
-    }
-    if (valueOptions.has(arg)) {
-      const value = argv[index + 1]
-      if (!value || value.startsWith("--")) throw new Error(`${arg} requires a value`)
-      options[valueOptions.get(arg)] = value
-      index += 1
-      continue
-    }
-    if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`)
-    if (options.output) throw new Error("Only one output directory may be supplied")
-    options.output = arg
-  }
-
-  return { ...options, help: false }
-}
-
-function titleCase(name) {
-  return name
-    .split("-")
-    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
-    .join(" ")
-}
-
-function normalizeRepository(source) {
-  if (/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source)) {
-    return { installSource: source, url: `https://github.com/${source}` }
-  }
-  try {
-    const url = new URL(source)
-    const githubMatch = url.hostname === "github.com" && url.pathname.match(/^\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/)
-    return {
-      installSource: githubMatch ? `${githubMatch[1]}/${githubMatch[2]}` : source,
-      url: source.replace(/\.git$/, ""),
-    }
-  } catch {
-    if (/^git@[^:]+:.+/.test(source)) return { installSource: source, url: source }
-    throw new Error("--repository must be GitHub owner/repo or a full Git URL")
-  }
-}
-
-function validateOptions(options) {
-  if (!options.output) throw new Error("An output directory is required")
-  const name = options.name ?? basename(resolve(options.output))
-  if (!NAME_PATTERN.test(name) || name.length > 56) {
-    throw new Error("Plugin name must be <=56 characters using lowercase letters, digits, and single hyphens")
-  }
-  const packageName = options.packageName ?? name
-  if (!PACKAGE_PATTERN.test(packageName) || packageName.split("/").at(-1) !== name) {
-    throw new Error("npm package must be unscoped or @scoped and have the plugin name as its basename")
-  }
-  if (!options.description?.trim()) throw new Error("--description is required")
-  if (options.description.includes("\n")) throw new Error("--description must be one line")
-  if (!options.author?.trim()) throw new Error("--author is required")
-  if (!options.repository?.trim()) throw new Error("--repository is required")
-  if (!LICENSES.has(options.license)) {
-    throw new Error("--license must be MIT, Apache-2.0, or UNLICENSED")
-  }
-  if (options.templateVersion !== CANONICAL_VERSION) {
-    throw new Error(`Unknown template version '${options.templateVersion}'. Available: ${CANONICAL_VERSION}`)
-  }
-  const marketplace = options.marketplace ?? `${name}-plugins`
-  if (!NAME_PATTERN.test(marketplace) || marketplace.length > 64) {
-    throw new Error("Marketplace name must be <=64 characters in lowercase kebab-case")
-  }
-
-  return {
-    ...options,
-    output: resolve(options.output),
-    name,
-    packageName,
-    marketplace,
-    displayName: options.displayName?.trim() || titleCase(name),
-    description: options.description.trim(),
-    author: options.author.trim(),
-    repository: normalizeRepository(options.repository.trim()),
-  }
-}
-
-async function destinationState(path) {
-  if (!existsSync(path)) return "missing"
-  const info = await stat(path)
-  if (!info.isDirectory()) return "not-directory"
-  return (await readdir(path)).length === 0 ? "empty" : "non-empty"
-}
-
-function replaceTokens(content, tokens) {
-  return content.replace(/\{\{([A-Z0-9_]+)\}\}/g, (match, key) => {
-    if (!(key in tokens)) throw new Error(`Unknown template token ${match}`)
-    return tokens[key]
-  })
-}
-
-function mapSegment(segment, metadata) {
-  if (segment === "shared-skill") return metadata.name
-  if (segment === "develop-template") return `develop-${metadata.name}`
-  return segment.endsWith(".tpl") ? segment.slice(0, -4) : segment
-}
-
-async function renderTemplates(source, destination, metadata, tokens, relative = []) {
-  for (const entry of await readdir(source, { withFileTypes: true })) {
-    const nextRelative = [...relative, mapSegment(entry.name, metadata)]
-    const target = join(destination, ...nextRelative)
-    const input = join(source, entry.name)
-    if (entry.isDirectory()) {
-      await mkdir(target, { recursive: true })
-      await renderTemplates(input, destination, metadata, tokens, nextRelative)
-    } else if (entry.isFile()) {
-      const content = replaceTokens(await readFile(input, "utf8"), tokens)
-      await mkdir(dirname(target), { recursive: true })
-      await writeFile(target, content)
-    }
-  }
-}
-
-async function licenseText(skillRoot, metadata) {
-  if (metadata.license === "UNLICENSED") {
-    return `Copyright (c) ${new Date().getFullYear()} ${metadata.author}\n\nAll rights reserved. This project is not licensed for redistribution.\n`
-  }
-  if (metadata.license === "Apache-2.0") {
-    return readFile(join(skillRoot, "licenses/Apache-2.0.txt"), "utf8")
-  }
-  return `MIT License
-
-Copyright (c) ${new Date().getFullYear()} ${metadata.author}
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-`
-}
-
-async function listTemplateFiles(root, metadata, relative = []) {
-  const files = []
-  for (const entry of await readdir(root, { withFileTypes: true })) {
-    const next = [...relative, mapSegment(entry.name, metadata)]
-    if (entry.isDirectory()) files.push(...(await listTemplateFiles(join(root, entry.name), metadata, next)))
-    else if (entry.isFile()) files.push(next.join("/"))
-  }
-  files.push(`.agents/skills/develop-${metadata.name}/scripts/validate.mjs`, "LICENSE")
-  return files.sort()
-}
-
-export async function runCreate(argv) {
-  let options
-  try {
-    const parsed = parseArgs(argv)
-    if (parsed.help) {
-      console.log(usage())
-      return 0
-    }
-    options = validateOptions(parsed)
-  } catch (error) {
-    console.error(error.message)
-    console.error(usage())
-    return 2
-  }
-
-  const scriptPath = fileURLToPath(import.meta.url)
-  const projectRoot = dirname(dirname(scriptPath))
-  const canonicalRoot = join(projectRoot, "templates", options.templateVersion)
-  const templateRoot = join(canonicalRoot, "universal-typescript")
-  const generatorVersion = JSON.parse(await readFile(join(projectRoot, "package.json"), "utf8")).version
-  const state = await destinationState(options.output)
-  if (state === "not-directory" || state === "non-empty") {
-    console.error(`Destination must be missing or empty: ${options.output}`)
-    return 1
-  }
-
-  const tokens = {
-    NAME: options.name,
-    NAME_JSON: JSON.stringify(options.name),
-    TOOL_NAME: `${options.name.replaceAll("-", "_")}_run`,
-    TOOL_NAME_JSON: JSON.stringify(`${options.name.replaceAll("-", "_")}_run`),
-    DISPLAY_NAME: options.displayName,
-    DISPLAY_NAME_JSON: JSON.stringify(options.displayName),
-    DESCRIPTION: options.description,
-    DESCRIPTION_JSON: JSON.stringify(options.description),
-    TEMPLATE_VERSION: options.templateVersion,
-    GENERATOR_VERSION: generatorVersion,
-    CREATED_AT: new Date().toISOString(),
-    SHARED_SKILL_DESCRIPTION_JSON: JSON.stringify(
-      `${options.description} Use when the user requests ${options.displayName} workflows or explicitly asks to use the ${options.name} plugin.`,
-    ),
-    DEVELOPMENT_SKILL_DESCRIPTION_JSON: JSON.stringify(
-      `Develop, validate, and publish the ${options.displayName} universal coding-agent plugin. Use when modifying its shared skills, Claude or Codex manifests, OpenCode npm entrypoint, Antigravity bundle, or DeepSeek Cordis integration.`,
-    ),
-    PACKAGE_NAME: options.packageName,
-    PACKAGE_NAME_JSON: JSON.stringify(options.packageName),
-    AUTHOR: options.author,
-    AUTHOR_JSON: JSON.stringify(options.author),
-    REPOSITORY_SOURCE: options.repository.installSource,
-    REPOSITORY_SOURCE_JSON: JSON.stringify(options.repository.installSource),
-    REPOSITORY_URL: options.repository.url,
-    REPOSITORY_URL_JSON: JSON.stringify(options.repository.url),
-    MARKETPLACE: options.marketplace,
-    MARKETPLACE_JSON: JSON.stringify(options.marketplace),
-    LICENSE: options.license,
-    LICENSE_JSON: JSON.stringify(options.license),
-    YEAR: String(new Date().getFullYear()),
-  }
-
-  if (options.dryRun) {
-    console.log(JSON.stringify({
-      output: options.output,
-      template: options.templateVersion,
-      plugin: options.name,
-      package: options.packageName,
-      files: await listTemplateFiles(templateRoot, options),
-    }, null, 2))
-    return 0
-  }
-
-  await mkdir(dirname(options.output), { recursive: true })
-  const staging = join(dirname(options.output), `.${basename(options.output)}.scaffold-${randomUUID()}`)
-
-  try {
-    await mkdir(staging)
-    await renderTemplates(templateRoot, staging, options, tokens)
-    const localScripts = join(staging, ".agents/skills", `develop-${options.name}`, "scripts")
-    await mkdir(localScripts, { recursive: true })
-    await cp(join(projectRoot, "lib/validate.mjs"), join(localScripts, "validate.mjs"))
-    const skillScripts = join(staging, "skills", options.name, "scripts")
-    if (existsSync(skillScripts)) {
-      for (const entry of await readdir(skillScripts)) {
-        await chmod(join(skillScripts, entry), 0o755)
-      }
-    }
-    await writeFile(join(staging, "LICENSE"), await licenseText(canonicalRoot, options))
-
-    const validation = spawnSync(process.execPath, [join(projectRoot, "lib/validate.mjs"), staging], {
-      encoding: "utf8",
-    })
-    if (validation.status !== 0) {
-      throw new Error(`Generated project failed validation:\n${validation.stderr || validation.stdout}`)
-    }
-
-    if (state === "empty") await rmdir(options.output)
-    await rename(staging, options.output)
-
-    console.log(`Created universal plugin scaffold at ${options.output}`)
-    console.log(`Next: cd ${JSON.stringify(options.output)} && npm install && npm run verify`)
-    console.log(`Bun:  cd ${JSON.stringify(options.output)} && bun install && bun run verify`)
-    return 0
-  } catch (error) {
-    await rm(staging, { recursive: true, force: true })
-    console.error(error.message)
-    return 1
-  }
-}
-
-if (resolve(process.argv[1] ?? "") === fileURLToPath(import.meta.url)) {
-  process.exitCode = await runCreate(process.argv.slice(2))
-}

package/lib/install-check.mjs

@@ -1,363 +0,0 @@
-#!/usr/bin/env node
-
-import { existsSync, readdirSync } from "node:fs"
-import { cp, mkdtemp, readFile, rm, writeFile } from "node:fs/promises"
-import { tmpdir } from "node:os"
-import { dirname, join, resolve } from "node:path"
-import { fileURLToPath } from "node:url"
-import { spawnSync } from "node:child_process"
-
-const TIMEOUT_MS = 300_000
-
-function findProjectRoot(start) {
-  let current = resolve(start)
-  let conventionalRoot
-  while (true) {
-    if (existsSync(join(current, "alchemy.json"))) return current
-    if (
-      !conventionalRoot &&
-      existsSync(join(current, "package.json")) &&
-      existsSync(join(current, ".claude-plugin")) &&
-      existsSync(join(current, ".codex-plugin"))
-    ) {
-      conventionalRoot = current
-    }
-    const parent = dirname(current)
-    if (parent === current) return conventionalRoot
-    current = parent
-  }
-}
-
-function run(command, args, options = {}) {
-  const result = spawnSync(command, args, {
-    encoding: "utf8",
-    timeout: TIMEOUT_MS,
-    ...options,
-  })
-  if (result.error?.code === "ENOENT") return { missing: true }
-  return {
-    ok: result.status === 0,
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-  }
-}
-
-function firstLine(text) {
-  return text.trim().split("\n")[0] ?? ""
-}
-
-function usage() {
-  return `Usage: harness-alchemist install-check [project-directory] [options]
-
-Install-level verification: drives the local harness CLIs (claude, codex,
-agy, opencode, dsh) against the project's plugin package and asserts each
-harness can discover it. Static validation is a prerequisite; run
-'harness-alchemist validate' first.
-
-Options:
-  --harness <id>  Limit to one harness (claude, codex, agy, opencode, dsh).
-                  Repeatable.
-  --keep          Keep installed plugins and marketplaces after the check.
-  --json          Print a machine-readable result.
-  --help          Show this help.`
-}
-
-function parseArgs(argv) {
-  const options = { harnesses: [], keep: false, json: false }
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index]
-    if (arg === "--help" || arg === "-h") return { help: true }
-    if (arg === "--keep") options.keep = true
-    else if (arg === "--json") options.json = true
-    else if (arg === "--harness") {
-      const value = argv[index + 1]
-      if (!value || value.startsWith("--")) throw new Error("--harness requires a value")
-      if (!["claude", "codex", "agy", "opencode", "dsh"].includes(value)) {
-        throw new Error(`Unknown harness '${value}'. Choose from claude, codex, agy, opencode, dsh`)
-      }
-      options.harnesses.push(value)
-      index += 1
-    } else if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`)
-    else if (options.project) throw new Error("Only one project directory may be supplied")
-    else options.project = arg
-  }
-  return options
-}
-
-async function readJson(path, problems) {
-  try {
-    return JSON.parse(await readFile(path, "utf8"))
-  } catch (error) {
-    problems.push(`${path}: invalid JSON (${error.message})`)
-    return undefined
-  }
-}
-
-function skillNames(skillsDirectory) {
-  if (!existsSync(skillsDirectory)) return []
-  return readdirSync(skillsDirectory)
-    .filter((entry) => existsSync(join(skillsDirectory, entry, "SKILL.md")))
-}
-
-export async function runInstallCheck(argv) {
-  let options
-  try {
-    options = parseArgs(argv)
-  } catch (error) {
-    console.error(error.message)
-    console.error(usage())
-    return 2
-  }
-  if (options.help) {
-    console.log(usage())
-    return 0
-  }
-
-  const scriptDirectory = dirname(fileURLToPath(import.meta.url))
-  const root = options.project
-    ? resolve(options.project)
-    : findProjectRoot(process.cwd()) ?? findProjectRoot(scriptDirectory)
-  if (!root) {
-    console.error("Could not find a universal plugin project. Pass its directory explicitly.")
-    return 2
-  }
-
-  const problems = []
-  const layoutPath = join(root, "alchemy.json")
-  const layout = existsSync(layoutPath) ? (await readJson(layoutPath, problems)) ?? {} : {}
-  const pluginRoot = resolve(root, layout.pluginRoot ?? ".")
-  const runtime = layout.runtime ?? "npm"
-
-  const claudePlugin = await readJson(join(pluginRoot, ".claude-plugin/plugin.json"), problems)
-  const claudeMarketplace = await readJson(join(root, ".claude-plugin/marketplace.json"), problems)
-  if (problems.length > 0) {
-    for (const problem of problems) console.error(problem)
-    return 1
-  }
-
-  const pluginName = claudePlugin.name
-  const marketplaceName = claudeMarketplace.name
-  const skills = skillNames(join(pluginRoot, "skills"))
-  const selected = options.harnesses.length > 0
-    ? options.harnesses
-    : ["claude", "codex", "agy", "opencode", "dsh"]
-
-  const results = []
-  const record = (harness, status, details) => {
-    results.push({ harness, status, details })
-    if (options.json) return
-    const marker = status === "pass" ? "✔" : status === "skip" ? "○" : "✖"
-    console.log(`${marker} ${harness}: ${status}`)
-    for (const detail of details) console.log(`    ${detail}`)
-  }
-
-  const adapterPath = join(pluginRoot, "dist/opencode.js")
-
-  for (const harness of selected) {
-    if (harness === "claude") {
-      const details = []
-      let status = "pass"
-      const steps = [
-        ["validate", pluginRoot, "--strict"],
-        ["marketplace", "add", root],
-        ["install", `${pluginName}@${marketplaceName}`],
-        ["details", pluginName],
-      ]
-      for (const args of steps) {
-        const result = run("claude", ["plugin", ...args])
-        if (result.missing) { status = "skip"; details.push("claude CLI not found"); break }
-        if (!result.ok) {
-          status = "fail"
-          details.push(`\`${command} ${args.join(" ")}\` failed: ${firstLine(result.stderr || result.stdout)}`)
-          break
-        }
-        if (args[0] === "details") {
-          for (const skill of skills) {
-            if (!result.stdout.includes(skill)) {
-              status = "fail"
-              details.push(`skill '${skill}' missing from plugin details`)
-            }
-          }
-          details.push(`${skills.length} skills registered`)
-        }
-      }
-      if (!options.keep) {
-        run("claude", ["plugin", "uninstall", `${pluginName}@${marketplaceName}`])
-        run("claude", ["plugin", "marketplace", "remove", marketplaceName])
-      }
-      record(harness, status, details)
-    } else if (harness === "codex") {
-      const details = []
-      let status = "pass"
-      const add = run("codex", ["plugin", "marketplace", "add", root])
-      if (add.missing) {
-        record(harness, "skip", ["codex CLI not found"])
-        continue
-      }
-      if (!add.ok) {
-        record(harness, "fail", [`marketplace add failed: ${firstLine(add.stderr || add.stdout)}`])
-        continue
-      }
-      const install = run("codex", ["plugin", "add", `${pluginName}@${marketplaceName}`])
-      if (!install.ok) {
-        status = "fail"
-        details.push(`plugin add failed: ${firstLine(install.stderr || install.stdout)}`)
-      } else {
-        const list = run("codex", ["plugin", "list"])
-        if (!list.ok || !list.stdout.includes(`${pluginName}@${marketplaceName}`)) {
-          status = "fail"
-          details.push("plugin not listed as installed")
-        } else if (!list.stdout.includes("installed, enabled")) {
-          status = "fail"
-          details.push("plugin installed but not enabled")
-        } else {
-          details.push("installed and enabled")
-        }
-      }
-      if (!options.keep) {
-        run("codex", ["plugin", "remove", `${pluginName}@${marketplaceName}`])
-        run("codex", ["plugin", "marketplace", "remove", marketplaceName])
-      }
-      record(harness, status, details)
-    } else if (harness === "agy") {
-      const details = []
-      const validate = run("agy", ["plugin", "validate", pluginRoot])
-      if (validate.missing) {
-        record(harness, "skip", ["agy CLI not found"])
-        continue
-      }
-      if (!validate.ok) {
-        record(harness, "fail", [`validate failed: ${firstLine(validate.stderr || validate.stdout)}`])
-        continue
-      }
-      const install = run("agy", ["plugin", "install", pluginRoot])
-      if (!install.ok) {
-        record(harness, "fail", [`install failed: ${firstLine(install.stderr || install.stdout)}`])
-        continue
-      }
-      const list = run("agy", ["plugin", "list"])
-      if (!list.ok || !list.stdout.includes(pluginName)) {
-        record(harness, "fail", ["plugin missing from agy plugin list"])
-        continue
-      }
-      details.push("validated, installed, and listed")
-      if (!options.keep) run("agy", ["plugin", "uninstall", pluginName])
-      record(harness, "pass", details)
-    } else if (harness === "opencode") {
-      if (runtime === "npm" && !existsSync(adapterPath)) {
-        record(harness, "fail", [
-          `npm runtime requires a built adapter; missing ${adapterPath}`,
-          "run `npm run build` in the plugin package first",
-        ])
-        continue
-      }
-      const isolation = await mkdtemp(join(tmpdir(), "ha-opencode-"))
-      const configDirectory = join(isolation, "opencode")
-      const skillsDirectory = join(configDirectory, "skills")
-      await cp(join(pluginRoot, "skills"), skillsDirectory, { recursive: true })
-      const config = { $schema: "https://opencode.ai/config.json" }
-      if (runtime === "npm") {
-        config.plugin = [`file://${adapterPath}`]
-      }
-      await writeFile(join(configDirectory, "opencode.json"), `${JSON.stringify(config, null, 2)}\n`)
-      const environment = {
-        ...process.env,
-        XDG_CONFIG_HOME: isolation,
-        HOME: isolation,
-      }
-      const skillCheck = run("opencode", ["debug", "skill"], { env: environment })
-      if (skillCheck.missing) {
-        await rm(isolation, { recursive: true, force: true })
-        record(harness, "skip", ["opencode CLI not found"])
-        continue
-      }
-      const details = []
-      let status = "pass"
-      const missing = skills.filter((skill) => !skillCheck.stdout.includes(`"name": "${skill}"`))
-      if (missing.length > 0) {
-        status = "fail"
-        details.push(`skills not discovered: ${missing.join(", ")}`)
-      } else {
-        details.push(`${skills.length} skills discovered`)
-      }
-      if (runtime === "npm" && status === "pass") {
-        const startup = run("opencode", ["debug", "startup"], { env: environment })
-        if (!startup.ok) {
-          status = "fail"
-          details.push(`startup failed: ${firstLine(startup.stderr || startup.stdout)}`)
-        } else {
-          details.push("plugin loaded at startup")
-        }
-      }
-      await rm(isolation, { recursive: true, force: true })
-      record(harness, status, details)
-    } else if (harness === "dsh") {
-      if (runtime !== "npm") {
-        record(harness, "skip", ["skills runtime has no Cordis bundle; install skills via filesystem roots instead"])
-        continue
-      }
-      if (!existsSync(adapterPath)) {
-        record(harness, "fail", [
-          `npm runtime requires built adapters; missing ${join(pluginRoot, "dist/deepseek.js")}`,
-          "run `npm run build` in the plugin package first",
-        ])
-        continue
-      }
-      const dshHome = await mkdtemp(join(tmpdir(), "ha-dsh-"))
-      const environment = { ...process.env, DSH_HOME: dshHome }
-      let dshCommand = "dsh"
-      let dshPrefix = []
-      if (spawnSync("dsh", ["--version"], { encoding: "utf8" }).error?.code === "ENOENT") {
-        dshCommand = "npx"
-        dshPrefix = ["-y", "@deepseek-ai/dsh"]
-      }
-      const add = run(dshCommand, [...dshPrefix, "plugin", "--profile", "install-check", "add", pluginRoot], { env: environment })
-      if (add.missing) {
-        await rm(dshHome, { recursive: true, force: true })
-        record(harness, "skip", ["dsh CLI not found and npx unavailable"])
-        continue
-      }
-      if (!add.ok) {
-        await rm(dshHome, { recursive: true, force: true })
-        record(harness, "fail", [`profile add failed: ${firstLine(add.stderr || add.stdout)}`])
-        continue
-      }
-      const dump = run(dshCommand, [...dshPrefix, "--profile", "install-check", "--dump-config"], { env: environment })
-      const details = []
-      let status = "pass"
-      if (!dump.ok || !dump.stdout.includes(`- id: ${pluginName}`)) {
-        status = "fail"
-        details.push("cordis insert entry missing from composed profile")
-      } else {
-        details.push("cordis bundle composed into isolated profile")
-      }
-      await rm(dshHome, { recursive: true, force: true })
-      record(harness, status, details)
-    }
-  }
-
-  const failed = results.filter((entry) => entry.status === "fail")
-  const skipped = results.filter((entry) => entry.status === "skip")
-  if (options.json) {
-    console.log(JSON.stringify({
-      project: root,
-      plugin: pluginName,
-      runtime,
-      results,
-      summary: {
-        pass: results.length - failed.length - skipped.length,
-        fail: failed.length,
-        skip: skipped.length,
-      },
-    }, null, 2))
-  } else {
-    console.log(
-      failed.length === 0
-        ? `Install check passed for ${pluginName} (${results.length - skipped.length} verified, ${skipped.length} skipped)`
-        : `Install check failed for ${pluginName}: ${failed.length} of ${results.length} harnesses failed`,
-    )
-  }
-
-  return failed.length > 0 ? 1 : 0
-}