harness-everything 0.4.4 → 0.5.0

package/.claude-plugin/marketplace.json

@@ -1,5 +1,6 @@
 {
   "name": "harness-everything",
+  "description": "Harness Everything plugin marketplace for Claude Code.",
   "owner": {
     "name": "dyphn1",
     "url": "https://github.com/dyphn1"
@@ -9,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.4.4",
+      "version": "0.5.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.5.0](https://github.com/dyphn1/Harness-everything/compare/v0.4.4...v0.5.0) (2026-09-16)
+
+### Features
+
+* **claude:** add plugin-only staging helper ([64e619b](https://github.com/dyphn1/Harness-everything/commit/64e619ba1add2678fac26152fe9e95a82517c03b))
+* **claude:** add strict host validation helper ([8d4ba18](https://github.com/dyphn1/Harness-everything/commit/8d4ba18396bd9ed305f26849f937f3e4e0d4d1ad))
+
+### Bug Fixes
+
+* **claude:** add strict marketplace description ([61129e5](https://github.com/dyphn1/Harness-everything/commit/61129e5078352ad8e0af343cba10255e9d31a0f5))
+* **claude:** correct hook validation diagnostic ([dd6681b](https://github.com/dyphn1/Harness-everything/commit/dd6681b5a073dcef19c17c9eda7ffbeb1cc5687f))
+* **claude:** keep staging output outside checkout ([10ac0da](https://github.com/dyphn1/Harness-everything/commit/10ac0da0c0e62537490d4051bb20c9095c601831))
+
 ## [0.4.4](https://github.com/dyphn1/Harness-everything/compare/v0.4.3...v0.4.4) (2026-09-16)
 
 ### Bug Fixes

package/ci/mechanism-2z-claude-plugin-manifest.test.js

@@ -2,28 +2,132 @@
 
 const assert = require('assert');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
 const projectRoot = path.resolve(__dirname, '..');
 const manifestPath = path.join(projectRoot, '.claude-plugin', 'plugin.json');
+const marketplacePath = path.join(projectRoot, '.claude-plugin', 'marketplace.json');
 const conventionalHooksPath = path.join(projectRoot, 'hooks', 'hooks.json');
 
+function insideProject(target) {
+  const relative = path.relative(projectRoot, target);
+  return relative !== '' && !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative);
+}
+
+function resolvePluginPath(reference, label) {
+  assert.strictEqual(typeof reference, 'string', `${label} must be a string path`);
+  assert.ok(reference.startsWith('./'), `${label} must be explicitly plugin-root relative: ${reference}`);
+  const resolved = path.resolve(projectRoot, reference);
+  assert.ok(insideProject(resolved), `${label} must stay inside the plugin root: ${reference}`);
+  return resolved;
+}
+
+function validateCommandTarget(command, label) {
+  assert.strictEqual(typeof command, 'string', `${label} command must be a string`);
+
+  // Harness deliberately uses direct Node hook commands. This avoids the known
+  // Windows shell-wrapper/path failure class while keeping plugin-root paths portable.
+  assert.match(
+    command,
+    /^node\s+["']?\$\{CLAUDE_PLUGIN_ROOT\}\//,
+    `${label} must invoke Node directly from \${CLAUDE_PLUGIN_ROOT}: ${command}`
+  );
+
+  const targetPattern = /\$\{CLAUDE_PLUGIN_ROOT\}\/([^"'\s]+)/g;
+  const targets = [...command.matchAll(targetPattern)].map(match => match[1]);
+  assert.ok(targets.length > 0, `${label} must reference at least one plugin-root target`);
+
+  for (const relativeTarget of targets) {
+    const resolved = path.resolve(projectRoot, relativeTarget);
+    assert.ok(insideProject(resolved), `${label} target escapes plugin root: ${relativeTarget}`);
+    assert.ok(fs.existsSync(resolved), `${label} references missing file: ${relativeTarget}`);
+  }
+}
+
 assert.ok(fs.existsSync(manifestPath), '.claude-plugin/plugin.json must exist');
+assert.ok(fs.existsSync(marketplacePath), '.claude-plugin/marketplace.json must exist');
 assert.ok(fs.existsSync(conventionalHooksPath), 'hooks/hooks.json must remain available for convention-based discovery');
 
 const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-const hooks = manifest.hooks;
+const marketplace = JSON.parse(fs.readFileSync(marketplacePath, 'utf8'));
+const hookConfig = JSON.parse(fs.readFileSync(conventionalHooksPath, 'utf8'));
+
+assert.ok(
+  typeof marketplace.description === 'string' && marketplace.description.trim().length > 0,
+  'Claude marketplace must have a top-level description so strict host validation does not regress'
+);
 
-if (hooks !== undefined) {
-  const refs = Array.isArray(hooks) ? hooks : [hooks];
+const marketplaceEntry = marketplace.plugins.find(entry => entry && entry.name === manifest.name);
+assert.ok(marketplaceEntry, `marketplace must contain plugin entry ${manifest.name}`);
+assert.strictEqual(marketplaceEntry.source, './', 'Claude marketplace entry must continue to point at the repository plugin root');
+assert.strictEqual(marketplaceEntry.version, manifest.version, 'Claude marketplace and plugin manifest versions must stay synchronized');
+assert.ok(
+  !Object.prototype.hasOwnProperty.call(marketplaceEntry, 'hooks'),
+  'Do not duplicate hook component registration in the marketplace entry; use hooks/hooks.json convention discovery'
+);
+
+const manifestHooks = manifest.hooks;
+if (manifestHooks !== undefined) {
+  const refs = Array.isArray(manifestHooks) ? manifestHooks : [manifestHooks];
   const normalized = refs
     .filter(ref => typeof ref === 'string')
     .map(ref => ref.replace(/\\/g, '/').replace(/^\.\//, ''));
 
   assert.ok(
     !normalized.includes('hooks/hooks.json'),
-    'Do not explicitly register hooks/hooks.json in .claude-plugin/plugin.json; Claude Code auto-discovers the conventional hook file and duplicate registration prevents the plugin from loading.'
+    'Do not explicitly register hooks/hooks.json in .claude-plugin/plugin.json; Claude Code auto-discovers the conventional hook file and duplicate registration has caused plugin-load regressions.'
   );
 }
 
-console.log('PASS: Claude plugin manifest does not duplicate the conventional hooks/hooks.json registration.');
+assert.ok(Array.isArray(manifest.skills) && manifest.skills.length > 0, 'Claude plugin must declare packaged skills');
+for (const skillRef of manifest.skills) {
+  const skillDir = resolvePluginPath(skillRef, `skill ${skillRef}`);
+  assert.ok(fs.statSync(skillDir).isDirectory(), `skill path must be a directory: ${skillRef}`);
+  assert.ok(fs.existsSync(path.join(skillDir, 'SKILL.md')), `skill path must contain SKILL.md: ${skillRef}`);
+}
+
+assert.ok(Array.isArray(manifest.agents) && manifest.agents.length > 0, 'Claude plugin must declare packaged agents');
+for (const agentRef of manifest.agents) {
+  const agentPath = resolvePluginPath(agentRef, `agent ${agentRef}`);
+  assert.ok(fs.statSync(agentPath).isFile(), `agent path must exist as a file: ${agentRef}`);
+}
+
+assert.ok(hookConfig && typeof hookConfig.hooks === 'object', 'hooks/hooks.json must contain a hooks object');
+let commandHookCount = 0;
+for (const [eventName, registrations] of Object.entries(hookConfig.hooks)) {
+  assert.ok(Array.isArray(registrations), `${eventName} registrations must be an array`);
+  for (const registration of registrations) {
+    assert.ok(Array.isArray(registration.hooks), `${eventName} registration must contain a hooks array`);
+    for (const hook of registration.hooks) {
+      if (hook.type !== 'command') continue;
+      commandHookCount += 1;
+      validateCommandTarget(hook.command, `${eventName}/${registration.id || 'unnamed'}`);
+    }
+  }
+}
+assert.ok(commandHookCount > 0, 'Claude plugin should contain command hooks to validate');
+
+// Negative control for anthropics/claude-code#77912: the host validator has
+// historically accepted dangling hook command targets, so the repository gate must not.
+assert.throws(
+  () => validateCommandTarget('node "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/DOES-NOT-EXIST.js"', 'negative-control'),
+  /references missing file/,
+  'missing hook command targets must fail repository validation'
+);
+
+// Ensure the optional staging helper can produce a plugin-only tree for host validation
+// without a marketplace file masking per-plugin manifest problems.
+const { stageClaudePlugin } = require('../scripts/stage-claude-plugin');
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-claude-plugin-'));
+const stagedRoot = path.join(tempRoot, 'plugin');
+try {
+  stageClaudePlugin(stagedRoot, { quiet: true });
+  assert.ok(fs.existsSync(path.join(stagedRoot, '.claude-plugin', 'plugin.json')), 'staged plugin must contain plugin.json');
+  assert.ok(fs.existsSync(path.join(stagedRoot, 'hooks', 'hooks.json')), 'staged plugin must contain hooks/hooks.json');
+  assert.ok(!fs.existsSync(path.join(stagedRoot, '.claude-plugin', 'marketplace.json')), 'plugin-only stage must exclude marketplace.json');
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}
+
+console.log(`PASS: Claude plugin manifest, marketplace, ${manifest.skills.length} skills, ${manifest.agents.length} agents, and ${commandHookCount} hook commands are internally consistent.`);

package/docs/claude-plugin-certification.md

@@ -0,0 +1,178 @@
+# Claude Code plugin certification
+
+This document separates **repository/mechanism validation** from **live Claude Code evidence** for the Harness Everything plugin.
+
+## Current design boundary
+
+Harness uses Claude Code's conventional plugin hook location:
+
+```text
+hooks/hooks.json
+```
+
+Do not add `"hooks": "./hooks/hooks.json"` to `.claude-plugin/plugin.json` or to the marketplace entry. Current Claude Code documentation explicitly supports convention-based discovery from `hooks/hooks.json`, and Harness already had a duplicate-registration load failure when the conventional file was also registered explicitly.
+
+Harness command hooks intentionally invoke Node directly through `${CLAUDE_PLUGIN_ROOT}` rather than routing through `.sh`, PowerShell, or another shell wrapper. This reduces Windows-specific hook-dispatch/path problems reported upstream.
+
+## What repository validation proves
+
+Run:
+
+```bash
+npm run test:plugin:claude
+```
+
+The repository gate verifies:
+
+- the marketplace has current strict-validation metadata;
+- marketplace and plugin versions agree;
+- the plugin does not duplicate-register the conventional hook file;
+- every declared skill path exists and contains `SKILL.md`;
+- every declared agent file exists;
+- every command hook uses a direct Node + `${CLAUDE_PLUGIN_ROOT}` form;
+- every plugin-root file referenced by a command hook exists;
+- a negative control proves a missing hook target fails the repository gate.
+
+This last check is intentional because Claude Code issue `anthropics/claude-code#77912` reports that `claude plugin validate` can accept a hook command whose target file does not exist.
+
+## Strict host validation
+
+When Claude Code is installed, run:
+
+```bash
+npm run plugin:claude:validate
+```
+
+The helper runs the repository gate, then performs two separate strict host validations:
+
+1. the repository marketplace;
+2. a temporary **plugin-only** staged tree with `.claude-plugin/marketplace.json` removed.
+
+The second validation prevents a marketplace-level success from being mistaken for validation of the plugin manifest itself. This is also a regression boundary for the historical `anthropics/claude-code#60725` validator behavior.
+
+`--json` validation output requires Claude Code 2.1.259 or later. `claude plugin list --json` diagnostics are richer on 2.1.268 or later.
+
+To inspect the staged plugin manually:
+
+```bash
+npm run plugin:claude:stage
+```
+
+By default this writes a temporary staged tree under the operating-system temp directory and excludes only the marketplace manifest.
+
+## Known upstream constraints that affect live testing
+
+### Directory-source marketplace hooks
+
+`anthropics/claude-code#86809` reports a reproducible case where a plugin installed from a **directory-source marketplace** is enabled and cached but its bundled hooks never run, while the same plugin installed from a GitHub-source marketplace works.
+
+Therefore:
+
+- use `--plugin-dir <plugin-only-stage>` only as a direct development/load probe;
+- use a **GitHub-source marketplace install** as the distribution/live-hook certification path;
+- do not treat a directory-source marketplace failure as a Harness runtime defect without reproducing it through the GitHub-source path.
+
+### Validator does not prove hook targets execute
+
+A green `claude plugin validate` result is schema/mechanism evidence only. It is not proof that hooks were registered or fired. Preserve observable runtime evidence from a fresh session.
+
+### Windows shell-wrapper issues
+
+Several upstream reports describe `.sh`, Bash/PowerShell wrapper, path-format, or shell-spawn problems for plugin hooks on Windows. Harness command hooks use direct Node invocations, so certification should retain that shape unless a future change has explicit Windows evidence.
+
+## Narrow live-certification checklist
+
+Do this after the implementation PR is merged and released.
+
+### A. Record environment
+
+```bash
+claude --version
+node --version
+npm --version
+git rev-parse HEAD
+```
+
+Record Windows version as well.
+
+### B. Mechanism/schema checks
+
+```bash
+npm run test:plugin:claude
+npm run plugin:claude:validate
+```
+
+Both must pass. These checks still do **not** make the platform `Live verified`.
+
+### C. Direct plugin-only development probe
+
+Create the stage:
+
+```bash
+npm run plugin:claude:stage
+```
+
+Start a fresh Claude Code session using the printed directory:
+
+```bash
+claude --plugin-dir <staged-plugin-directory>
+```
+
+In another terminal, this form can inspect a session-only plugin:
+
+```bash
+claude --plugin-dir <staged-plugin-directory> plugin list --json
+```
+
+Verify the plugin has no `errors` and no unexpected `notes`, and confirm the component inventory includes representative skills, agents, and hooks.
+
+### D. GitHub-source marketplace certification
+
+Use the repository's normal GitHub marketplace install/update path, not a directory-source marketplace.
+
+After installation or update:
+
+```bash
+claude plugin list --json
+```
+
+Then start a **fresh session**. Preserve evidence for:
+
+1. the installed plugin version/source;
+2. a representative bundled skill being discoverable without a separate standalone skill install;
+3. `SessionStart` / `UserPromptSubmit` Harness behavior being observable;
+4. a harmless tool call such as `git status` running normally;
+5. a safe destructive **no-op** probe producing the expected Harness audit/gate behavior without changing real data;
+6. restart/update/reload retaining plugin discovery.
+
+Use `claude --debug` if component or hook registration is unclear; current official documentation says debug output includes plugin loading and skill/agent/hook registration.
+
+## Permission-mode scope
+
+Harness's Claude action gate now defers matched actions to Claude Code's native permission flow by default rather than forcing its own `ask` decision. Claude Code itself owns the semantics of `default`, `acceptEdits`, `plan`, `auto`, `dontAsk`, and `bypassPermissions`.
+
+Because of that boundary, Claude certification does **not** need to re-prove every host permission mode before Harness can establish that its hook loaded and deferred correctly. The live minimum is:
+
+- one normal/manual-style session;
+- one `auto` session where available;
+- observable Harness audit evidence showing the hook ran without silently authorizing the command.
+
+Additional permission-mode testing is useful as a host-regression matrix, but it is not a prerequisite for validating Harness plugin discovery.
+
+## Evidence levels
+
+- **Repository verified**: Harness static/mechanism checks pass.
+- **Host schema verified**: current `claude plugin validate --strict --json` passes for marketplace and plugin-only stage.
+- **Live verified**: a fresh real Claude Code session proves bundled components loaded and the relevant hooks actually fired.
+
+Never promote repository or schema evidence to `Live verified` without the live-session artifacts above.
+
+## References
+
+- Claude Code plugins reference: https://code.claude.com/docs/en/plugins-reference
+- Claude Code plugin marketplaces: https://code.claude.com/docs/en/plugin-marketplaces
+- Claude Code permissions: https://code.claude.com/docs/en/permissions
+- Directory-source marketplace hook issue: https://github.com/anthropics/claude-code/issues/86809
+- Missing hook target validator issue: https://github.com/anthropics/claude-code/issues/77912
+- Historical per-plugin validation gap: https://github.com/anthropics/claude-code/issues/60725
+- Windows hook wrapper issue: https://github.com/anthropics/claude-code/issues/54772

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -26,6 +26,9 @@
     "test:routing": "node ci/routing-check.js",
     "test:routing:invariants": "node ci/invariant-routing.test.js && node ci/router-workflow-plan.test.js",
     "plugin:sync": "node scripts/sync-openai-plugin.js",
+    "test:plugin:claude": "node ci/mechanism-2z-claude-plugin-manifest.test.js",
+    "plugin:claude:stage": "node scripts/stage-claude-plugin.js",
+    "plugin:claude:validate": "node scripts/validate-claude-plugin.js",
     "test:plugin:openai": "node ci/openai-plugin-package.test.js && node ci/openai-plugin-runtime.test.js",
     "plugin:submission:build": "node scripts/build-openai-submission.js",
     "test:plugin:submission": "node ci/openai-plugin-submission.test.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/scripts/stage-claude-plugin.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const projectRoot = path.resolve(__dirname, '..');
+const MARKETPLACE_PATH = '.claude-plugin/marketplace.json';
+
+function containsPath(parent, target) {
+  const relative = path.relative(parent, target);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function trackedFiles() {
+  const output = execFileSync('git', ['ls-files', '-z'], {
+    cwd: projectRoot,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  return output.split('\0').filter(Boolean);
+}
+
+function stageClaudePlugin(outputDir, options = {}) {
+  const outputRoot = path.resolve(outputDir);
+
+  // The staging operation replaces its destination recursively. Keep it entirely
+  // outside the checkout so an accidental argument can never delete repo content.
+  if (containsPath(projectRoot, outputRoot) || containsPath(outputRoot, projectRoot)) {
+    throw new Error(`Refusing to stage inside the repository or one of its parent directories: ${outputRoot}`);
+  }
+
+  fs.rmSync(outputRoot, { recursive: true, force: true });
+  fs.mkdirSync(outputRoot, { recursive: true });
+
+  let copied = 0;
+  for (const relativePath of trackedFiles()) {
+    const normalized = relativePath.replace(/\\/g, '/');
+    if (normalized === MARKETPLACE_PATH) continue;
+
+    const source = path.join(projectRoot, relativePath);
+    if (!fs.existsSync(source) || !fs.statSync(source).isFile()) continue;
+
+    const destination = path.join(outputRoot, relativePath);
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.copyFileSync(source, destination);
+    copied += 1;
+  }
+
+  const pluginManifest = path.join(outputRoot, '.claude-plugin', 'plugin.json');
+  const hookManifest = path.join(outputRoot, 'hooks', 'hooks.json');
+  if (!fs.existsSync(pluginManifest) || !fs.existsSync(hookManifest)) {
+    fs.rmSync(outputRoot, { recursive: true, force: true });
+    throw new Error('Staged Claude plugin is incomplete: plugin.json or hooks/hooks.json is missing');
+  }
+
+  if (!options.quiet) {
+    console.log(`Staged ${copied} tracked files for Claude plugin validation at: ${outputRoot}`);
+    console.log('Excluded .claude-plugin/marketplace.json so host validation targets the plugin itself.');
+  }
+
+  return outputRoot;
+}
+
+if (require.main === module) {
+  const outputDir = process.argv[2] || path.join(os.tmpdir(), 'harness-everything-claude-plugin');
+  try {
+    stageClaudePlugin(outputDir);
+  } catch (error) {
+    console.error(error.message || error);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  stageClaudePlugin,
+};

package/scripts/validate-claude-plugin.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { stageClaudePlugin } = require('./stage-claude-plugin');
+
+const projectRoot = path.resolve(__dirname, '..');
+const staticTest = path.join(projectRoot, 'ci', 'mechanism-2z-claude-plugin-manifest.test.js');
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd || projectRoot,
+    encoding: 'utf8',
+    shell: process.platform === 'win32' && command === 'claude',
+  });
+
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  return result;
+}
+
+function requireSuccess(result, label) {
+  if (result.error) {
+    throw new Error(`${label} failed to start: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`${label} exited with status ${result.status}`);
+  }
+}
+
+function main() {
+  requireSuccess(run(process.execPath, [staticTest]), 'repository Claude plugin validation');
+
+  const version = run('claude', ['--version']);
+  if (version.error || version.status !== 0) {
+    console.error('INCONCLUSIVE: Claude Code CLI is unavailable or failed to start. Static repository validation passed, but host validation did not run.');
+    process.exit(2);
+  }
+
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-claude-cert-'));
+  const stagedPlugin = path.join(tempRoot, 'plugin');
+
+  try {
+    stageClaudePlugin(stagedPlugin, { quiet: true });
+
+    console.log('\n[1/2] Strict marketplace validation');
+    requireSuccess(
+      run('claude', ['plugin', 'validate', projectRoot, '--strict', '--json']),
+      'Claude marketplace validation'
+    );
+
+    console.log('\n[2/2] Strict plugin-only validation');
+    requireSuccess(
+      run('claude', ['plugin', 'validate', stagedPlugin, '--strict', '--json']),
+      'Claude plugin-only validation'
+    );
+
+    console.log('\nPASS: repository, marketplace, and plugin-only Claude validation completed successfully.');
+    console.log('This is mechanism/schema evidence only; it does not prove plugin hooks fired in a live Claude Code session.');
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`FAIL: ${error.message || error}`);
+  process.exit(1);
+}