javi-forge 1.39.0 → 1.39.2

package/assets/claude-hooks/javi-forge-skillguard-pre-tool-use.mjs

@@ -792,12 +792,63 @@ function bashSubstitutions(command) {
 	}
 	return bodies;
 }
+// This deliberately recognizes only a direct, quoted Python stdin heredoc on
+// the first command line. It removes the opaque body before shell inspection;
+// it does not parse Python or permit its execution.
+function pythonQuotedHeredoc(command) {
+	const newline = command.indexOf("\n");
+	const header = newline < 0 ? command : command.slice(0, newline);
+	const starts = [0];
+	let quote = "", escaped = false, heredocs = 0;
+	for (let index = 0; index < header.length; index++) {
+		const char = header[index];
+		if (escaped) { escaped = false; continue; }
+		if (char === "\\" && quote !== "'") { escaped = true; continue; }
+		if (quote) { if (char === quote) quote = ""; continue; }
+		if (char === "'" || char === '"' || char === "`") { quote = char; continue; }
+		if (char === "<" && header[index + 1] === "<") { heredocs++; index++; }
+		if (char === ";" || char === "|" || char === "&") starts.push(index + 1);
+	}
+	const literalPath = String.raw`(?:[A-Za-z0-9_./~-]+|'[A-Za-z0-9_./~ -]+'|"[A-Za-z0-9_./~ -]+")`;
+	const redirection = String.raw`(?:[0-9]*>>?|[0-9]*<)[ \t]*${literalPath}[ \t]*`;
+	const python = String.raw`[ \t]*(?:python3?|/(?:[A-Za-z0-9_.-]+/)*python3?)(?:[ \t]+-)?[ \t]*`;
+	const pattern = new RegExp(String.raw`^(${python}(?:${redirection})*)<<(-?)[ \t]*(['"])([A-Za-z_][A-Za-z0-9_]*)\3([ \t]*(?:${redirection})*)([;|&].*)?$`);
+	for (const start of starts) {
+		const match = pattern.exec(header.slice(start));
+		if (!match) continue;
+		// Multiple documents and tab-stripping need a shell grammar this guard
+		// intentionally does not implement, so retain fail-closed behavior.
+		if (newline < 0 || heredocs !== 1 || match[2]) fail("unlexable-command");
+		if (match[6]?.trimStart().startsWith("|")) fail("unlexable-command");
+		let offset = newline + 1;
+		while (offset <= command.length) {
+			const end = command.indexOf("\n", offset);
+			const lineEnd = end < 0 ? command.length : end;
+			if (command.slice(offset, lineEnd) === match[4]) {
+				const outerHeader = header.slice(0, start) + match[1] + match[5] + (match[6] ?? "");
+				return { command: `${outerHeader}\n${command.slice(lineEnd + 1)}`, unsupported: true };
+			}
+			if (end < 0) break;
+			offset = end + 1;
+		}
+		fail("unlexable-command");
+	}
+	return { command, unsupported: false };
+}
 function evaluateBash(command, cwd, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT, depth = 0) {
 	if (depth > 4) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
+	let unsupported = false;
+	try { ({ command, unsupported } = pythonQuotedHeredoc(command)); } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
 	const headerOnlyCommand = opaqueInertCatHereDoc(command, cwd, config, projectRoot);
 	if (headerOnlyCommand === null) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
 	command = headerOnlyCommand;
-	try { for (const body of bashSubstitutions(command)) { const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1); if (!nested.allowed) return nested; } } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
+	try {
+		for (const body of bashSubstitutions(command)) {
+			const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1);
+			if (nested.ruleId === "shell.unsupported-interpreter") unsupported = true;
+			else if (!nested.allowed) return nested;
+		}
+	} catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
 	if (/^\s*:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:\s*$/.test(command)) return { allowed: false, ruleId: "shell.destructive-root" };
 	let parsed;
 	try { parsed = lex(command); } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
@@ -834,10 +885,16 @@ function evaluateBash(command, cwd, config = AGENT_CONFIGS.claude, projectRoot =
 		if (/^(?:powershell|pwsh)(?:\.exe)?$/i.test(executable) && tokens.some((token) => /^-(?:enc|encodedcommand)$/i.test(token))) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
 		if (/^(?:bash|sh|zsh|dash|ksh)$/.test(executable)) {
 			const flag = tokens.findIndex((token) => /^-[^-]*c[^-]*$/.test(token));
-			if (flag >= 0) { const body = tokens[flag + 1]; if (!body || /\$(?!\()/.test(body)) return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1); if (!nested.allowed) return nested; }
+			if (flag >= 0) {
+				const body = tokens[flag + 1];
+				if (!body || /\$(?!\()/.test(body)) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
+				const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1);
+				if (nested.ruleId === "shell.unsupported-interpreter") unsupported = true;
+				else if (!nested.allowed) return nested;
+			}
 		}
 	}
-	return { allowed: true };
+	return unsupported ? { allowed: false, ruleId: "shell.unsupported-interpreter" } : { allowed: true };
 }
 function evaluatePowerShell(command, cwd, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT) {
 	const parsed = lex(command, true);
@@ -939,6 +996,7 @@ function diagnostic(error) {
 }
 function denialDiagnostic(toolName, decision) {
 	const tool = SUPPORTED_TOOLS.includes(toolName) ? toolName : "supported tool";
+	if (decision.ruleId === "shell.unsupported-interpreter") return "javi-forge PreToolUse denied Bash [shell.unsupported-interpreter]: quoted Python heredoc execution is unsupported";
 	if (decision.ambiguity) return `javi-forge PreToolUse denied ${tool} [${decision.ruleId}]: ${decision.ambiguity.utility} ${decision.ambiguity.profile} ${decision.ambiguity.sink} semantics denied as ambiguous`;
 	return `javi-forge PreToolUse denied ${tool} [${decision.ruleId}]: global guard policy denied the invocation`;
 }

package/assets/claude-hooks/manifest.json

@@ -4,7 +4,7 @@
 		"name": "javi-forge-skillguard-pre-tool-use.mjs",
 		"version": 1,
 		"policyVersion": 2,
-		"sha256": "6edfbb31ce0551b27e38ae1ffd1daf9cc4bea54f2c86687c5124132af5b8c0af",
+		"sha256": "507a57a15f1b967103bb1eefe701a74813d5a9603fa7bcc15579a215b03621e3",
 		"historical": [
 			"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc",
 			"5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425",
@@ -12,7 +12,8 @@
 			"3581862f0567cce75a58b693c9ade80d39ee7d58add11537a34a8461c47c1ed4",
 			"54a270f28b068450b79547a88ec6f2d4854514392fd5f38ed1d6174ea093d7aa",
 			"9a565cec31d9e091e3fb9420b86685f824733bc1ebe479f086b2b955aba6ef3e",
-			"59fc4224975ad64cfc85bab50ec60d9bd4948070e9d41f42ab43e6d8231c19a1"
+			"59fc4224975ad64cfc85bab50ec60d9bd4948070e9d41f42ab43e6d8231c19a1",
+			"6edfbb31ce0551b27e38ae1ffd1daf9cc4bea54f2c86687c5124132af5b8c0af"
 		]
 	},
 	"settingsEntries": {

package/dist/cli/dispatch/plugin.d.ts

@@ -0,0 +1,9 @@
+import { type ReactElement } from "react";
+import { type PluginCommandRequest, type PluginCommandResult } from "../../commands/plugin.js";
+/** Preserve an earlier CLI failure, even when this request succeeds. */
+export declare function pluginCommandExitCode(result: PluginCommandResult, previous?: typeof process.exitCode): typeof process.exitCode;
+/** One mounted controller is one CLI invocation, never a retry or retarget. */
+export default function PluginController({ request, }: {
+    request: PluginCommandRequest;
+}): ReactElement;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/cli/dispatch/plugin.js

@@ -0,0 +1,68 @@
+import { createElement, useEffect, useRef, useState, } from "react";
+import { PLUGIN_COMMAND_STATUS, runPluginCommand, } from "../../commands/plugin.js";
+import Plugin from "../../ui/Plugin.js";
+/** Preserve an earlier CLI failure, even when this request succeeds. */
+export function pluginCommandExitCode(result, previous = undefined) {
+    if (previous !== undefined && previous !== 0 && previous !== "0")
+        return previous;
+    return result.status === PLUGIN_COMMAND_STATUS.SUCCESS ? 0 : 1;
+}
+function abortSearch(signal, controller) {
+    if (controller.signal.aborted)
+        return;
+    controller.abort();
+    if (signal === "SIGINT")
+        process.exitCode = 130;
+    if (signal === "SIGTERM")
+        process.exitCode = 143;
+}
+/** One mounted controller is one CLI invocation, never a retry or retarget. */
+export default function PluginController({ request, }) {
+    const initialRequest = useRef({ ...request }).current;
+    const started = useRef(false);
+    const [steps, setSteps] = useState([]);
+    const [result, setResult] = useState(null);
+    useEffect(() => {
+        if (started.current)
+            return;
+        started.current = true;
+        const controller = initialRequest.action === "search" ? new AbortController() : undefined;
+        const sigintHandler = controller === undefined
+            ? undefined
+            : () => abortSearch("SIGINT", controller);
+        const sigtermHandler = controller === undefined
+            ? undefined
+            : () => abortSearch("SIGTERM", controller);
+        if (sigintHandler)
+            process.on("SIGINT", sigintHandler);
+        if (sigtermHandler)
+            process.on("SIGTERM", sigtermHandler);
+        const onStep = (step) => {
+            setSteps((previous) => {
+                const index = previous.findIndex((item) => item.id === step.id);
+                if (index < 0)
+                    return [...previous, step];
+                const next = [...previous];
+                next[index] = step;
+                return next;
+            });
+        };
+        void runPluginCommand({ ...initialRequest, signal: controller?.signal }, onStep).then((outcome) => {
+            process.exitCode = pluginCommandExitCode(outcome, process.exitCode);
+            setResult(outcome);
+        });
+        return () => {
+            if (sigintHandler)
+                process.removeListener("SIGINT", sigintHandler);
+            if (sigtermHandler)
+                process.removeListener("SIGTERM", sigtermHandler);
+        };
+    }, [initialRequest]);
+    return createElement(Plugin, {
+        action: initialRequest.action ?? "list",
+        dryRun: initialRequest.dryRun,
+        steps,
+        result,
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/dist/cli/dispatch/simple-renderers.js

@@ -14,9 +14,9 @@ import AnalyzeUI from "../../ui/AnalyzeUI.js";
 import App from "../../ui/App.js";
 import { CIProvider as CIContextProvider } from "../../ui/CIContext.js";
 import LlmsTxt from "../../ui/LlmsTxt.js";
-import Plugin from "../../ui/Plugin.js";
 import { VALID_CI, VALID_MEMORY, VALID_STACKS } from "../validators.js";
 import DoctorController from "./doctor.js";
+import PluginController from "./plugin.js";
 export function handleDoctor(cli, ctx, deps = {}) {
     const platformSupport = resolvePlatformSupport(deps.platform ?? process.platform);
     if (platformSupport) {
@@ -39,24 +39,15 @@ export function handleLlmsTxt(cli, ctx) {
         React.createElement(LlmsTxt, { projectDir: process.cwd(), dryRun: cli.flags.dryRun })), { stdin: ctx.inkStdin });
 }
 export function handlePlugin(cli, ctx) {
-    const pluginAction = cli.input[1];
-    const VALID_PLUGIN_ACTIONS = [
-        "add",
-        "remove",
-        "list",
-        "search",
-        "validate",
-        "sync",
-        "export",
-        "import",
-        "export-skills",
-    ];
-    const action = pluginAction && VALID_PLUGIN_ACTIONS.includes(pluginAction)
-        ? pluginAction
-        : "list";
-    const target = cli.input[2];
     render(React.createElement(CIContextProvider, { isCI: ctx.isCI },
-        React.createElement(Plugin, { action: action, target: target, dryRun: cli.flags.dryRun, codex: cli.flags.codex, force: cli.flags.force })), { stdin: ctx.inkStdin });
+        React.createElement(PluginController, { request: {
+                action: cli.input[1],
+                target: cli.input[2],
+                projectDir: process.cwd(),
+                dryRun: cli.flags.dryRun,
+                codex: cli.flags.codex,
+                force: cli.flags.force,
+            } })), { stdin: ctx.inkStdin });
 }
 export function handleInitDefault(cli, ctx) {
     const platformSupport = resolvePlatformSupport(process.platform);

package/dist/commands/plugin.d.ts

@@ -1,55 +1,87 @@
 import type { InitStep } from "../types/index.js";
 type StepCallback = (step: InitStep) => void;
+export declare const PLUGIN_COMMAND_STATUS: {
+    readonly SUCCESS: "success";
+    readonly FAILURE: "failure";
+    readonly REFUSED: "refused";
+};
+export type PluginCommandStatus = (typeof PLUGIN_COMMAND_STATUS)[keyof typeof PLUGIN_COMMAND_STATUS];
+export declare const PLUGIN_COMMAND_ACTION: {
+    readonly ADD: "add";
+    readonly REMOVE: "remove";
+    readonly LIST: "list";
+    readonly SEARCH: "search";
+    readonly VALIDATE: "validate";
+    readonly SYNC: "sync";
+    readonly EXPORT: "export";
+    readonly IMPORT: "import";
+    readonly EXPORT_SKILLS: "export-skills";
+};
+export interface PluginCommandResult {
+    status: PluginCommandStatus;
+}
+export interface PluginCommandRequest {
+    action?: string;
+    target?: string;
+    projectDir: string;
+    dryRun: boolean;
+    codex?: boolean;
+    /** Force only unscannable sources; never override a guard block. */
+    force?: boolean;
+    signal?: AbortSignal;
+}
 /**
  * Add (install) a plugin from a GitHub source.
  */
 export declare function runPluginAdd(source: string, dryRun: boolean, onStep: StepCallback, options?: {
     force?: boolean;
-}): Promise<void>;
+}): Promise<PluginCommandResult>;
 /**
  * Remove an installed plugin by name.
  */
-export declare function runPluginRemove(name: string, dryRun: boolean, onStep: StepCallback): Promise<void>;
+export declare function runPluginRemove(name: string, dryRun: boolean, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * List all installed plugins.
  */
-export declare function runPluginList(onStep: StepCallback): Promise<void>;
+export declare function runPluginList(onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Search the remote plugin registry.
  */
 export declare function runPluginSearch(query: string | undefined, onStep: StepCallback, options?: {
     signal?: AbortSignal;
-}): Promise<void>;
+}): Promise<PluginCommandResult>;
 /**
  * Validate a local plugin directory.
  */
-export declare function runPluginValidate(pluginDir: string, onStep: StepCallback): Promise<void>;
+export declare function runPluginValidate(pluginDir: string, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Sync detected plugins into the project manifest.
  */
-export declare function runPluginSync(projectDir: string, dryRun: boolean, onStep: StepCallback): Promise<void>;
+export declare function runPluginSync(projectDir: string, dryRun: boolean, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Export an installed plugin to Agent Skills spec format.
  */
-export declare function runPluginExport(name: string, onStep: StepCallback): Promise<void>;
+export declare function runPluginExport(name: string, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Export an installed plugin to Codex-compatible TOML subagent files.
  */
-export declare function runPluginExportCodex(name: string, onStep: StepCallback): Promise<void>;
+export declare function runPluginExportCodex(name: string, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Import an Agent Skills spec package and convert to javi-forge plugin format.
  */
 export declare function runPluginImport(sourceDir: string, dryRun: boolean, onStep: StepCallback, options?: {
     force?: boolean;
-}): Promise<void>;
+}): Promise<PluginCommandResult>;
 /**
  * Generate a project-level skills.json from all installed plugins.
  * Makes the project discoverable by `npx skills add` and 40+ AI agents.
  */
-export declare function runPluginExportSkillsJson(projectDir: string, dryRun: boolean, onStep: StepCallback): Promise<void>;
+export declare function runPluginExportSkillsJson(projectDir: string, dryRun: boolean, onStep: StepCallback): Promise<PluginCommandResult>;
 /**
  * Generate a global skills.json from all globally installed plugins.
  */
-export declare function runPluginExportGlobalSkillsJson(dryRun: boolean, onStep: StepCallback): Promise<void>;
+export declare function runPluginExportGlobalSkillsJson(dryRun: boolean, onStep: StepCallback): Promise<PluginCommandResult>;
+/** Execute one plugin request; the CLI dispatcher owns process exit status. */
+export declare function runPluginCommand(request: PluginCommandRequest, onStep: StepCallback): Promise<PluginCommandResult>;
 export {};
 //# sourceMappingURL=plugin.d.ts.map

package/dist/commands/plugin.js

@@ -1,6 +1,22 @@
 import { exportPluginAsAgentSkills, generateGlobalSkillsJson, generateProjectSkillsJson, importAgentSkillsPackage, } from "../lib/agent-skills.js";
 import { exportPluginAsCodexToml } from "../lib/codex-export.js";
 import { installPlugin, listInstalledPlugins, removePlugin, searchRegistry, syncPlugins, validatePlugin, } from "../lib/plugin.js";
+export const PLUGIN_COMMAND_STATUS = {
+    SUCCESS: "success",
+    FAILURE: "failure",
+    REFUSED: "refused",
+};
+export const PLUGIN_COMMAND_ACTION = {
+    ADD: "add",
+    REMOVE: "remove",
+    LIST: "list",
+    SEARCH: "search",
+    VALIDATE: "validate",
+    SYNC: "sync",
+    EXPORT: "export",
+    IMPORT: "import",
+    EXPORT_SKILLS: "export-skills",
+};
 function report(onStep, id, label, status, detail) {
     onStep({ id, label, status, detail });
 }
@@ -32,13 +48,14 @@ export async function runPluginAdd(source, dryRun, onStep, options = {}) {
     }
     else {
         report(onStep, stepId, `Install plugin: ${source}`, "error", result.error);
-        // FU-1 (R4-002): a skillguard refusal must be distinguishable from
-        // success by scripted consumers — exit non-zero. `process.exitCode`
-        // (not `process.exit`) so the Ink tree keeps rendering/unmounting
-        // normally. Non-gate failures (validation, clone errors) keep exit 0.
-        if (result.refused)
-            process.exitCode = 1;
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : result.refused
+                ? PLUGIN_COMMAND_STATUS.REFUSED
+                : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Remove an installed plugin by name.
@@ -53,6 +70,11 @@ export async function runPluginRemove(name, dryRun, onStep) {
     else {
         report(onStep, stepId, `Remove plugin: ${name}`, "error", result.error);
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * List all installed plugins.
@@ -68,6 +90,7 @@ export async function runPluginList(onStep) {
         const summary = plugins.map((p) => `${p.name}@${p.version}`).join(", ");
         report(onStep, stepId, "List installed plugins", "done", `${plugins.length} plugins: ${summary}`);
     }
+    return { status: PLUGIN_COMMAND_STATUS.SUCCESS };
 }
 /**
  * Search the remote plugin registry.
@@ -78,9 +101,11 @@ export async function runPluginSearch(query, onStep, options = {}) {
     const results = await searchRegistry(query, options);
     if (results.status === "cancelled") {
         report(onStep, stepId, `Search plugins${query ? `: ${query}` : ""}`, "error", "registry search cancelled");
+        return { status: PLUGIN_COMMAND_STATUS.FAILURE };
     }
     else if (results.status === "unavailable") {
         report(onStep, stepId, `Search plugins${query ? `: ${query}` : ""}`, "error", "registry unavailable");
+        return { status: PLUGIN_COMMAND_STATUS.FAILURE };
     }
     else if (results.entries.length === 0) {
         report(onStep, stepId, `Search plugins${query ? `: ${query}` : ""}`, "done", query ? `no plugins matching "${query}"` : "registry empty");
@@ -91,6 +116,7 @@ export async function runPluginSearch(query, onStep, options = {}) {
             .join("\n  ");
         report(onStep, stepId, `Search plugins${query ? `: ${query}` : ""}`, "done", `${results.entries.length} results:\n  ${summary}`);
     }
+    return { status: PLUGIN_COMMAND_STATUS.SUCCESS };
 }
 /**
  * Validate a local plugin directory.
@@ -108,6 +134,11 @@ export async function runPluginValidate(pluginDir, onStep) {
             .join("\n");
         report(onStep, stepId, `Validate plugin: ${pluginDir}`, "error", `${result.errors.length} errors:\n${msgs}`);
     }
+    return {
+        status: result.valid
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Sync detected plugins into the project manifest.
@@ -132,10 +163,12 @@ export async function runPluginSync(projectDir, dryRun, onStep) {
             parts.push("no plugins detected");
         const prefix = dryRun ? "dry-run: " : "";
         report(onStep, stepId, "Sync plugins", "done", `${prefix}${parts.join(" | ")}`);
+        return { status: PLUGIN_COMMAND_STATUS.SUCCESS };
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         report(onStep, stepId, "Sync plugins", "error", msg);
+        return { status: PLUGIN_COMMAND_STATUS.FAILURE };
     }
 }
 /**
@@ -151,6 +184,11 @@ export async function runPluginExport(name, onStep) {
     else {
         report(onStep, stepId, `Export plugin: ${name}`, "error", result.error);
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Export an installed plugin to Codex-compatible TOML subagent files.
@@ -165,6 +203,11 @@ export async function runPluginExportCodex(name, onStep) {
     else {
         report(onStep, stepId, `Export plugin as Codex TOML: ${name}`, "error", result.error);
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Import an Agent Skills spec package and convert to javi-forge plugin format.
@@ -181,12 +224,14 @@ export async function runPluginImport(sourceDir, dryRun, onStep, options = {}) {
     }
     else {
         report(onStep, stepId, `Import agent-skills package: ${sourceDir}`, "error", result.error);
-        // FU-1 (R4-002): same exit-code contract as runPluginAdd — a skillguard
-        // refusal (manifest-integrity or verdict) exits non-zero; plain input
-        // errors (skills.json missing/invalid) keep exit 0.
-        if (result.refused)
-            process.exitCode = 1;
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : result.refused
+                ? PLUGIN_COMMAND_STATUS.REFUSED
+                : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Generate a project-level skills.json from all installed plugins.
@@ -203,6 +248,11 @@ export async function runPluginExportSkillsJson(projectDir, dryRun, onStep) {
     else {
         report(onStep, stepId, "Generate project skills.json", "error", result.error);
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
 }
 /**
  * Generate a global skills.json from all globally installed plugins.
@@ -218,5 +268,66 @@ export async function runPluginExportGlobalSkillsJson(dryRun, onStep) {
     else {
         report(onStep, stepId, "Generate global skills.json", "error", result.error);
     }
+    return {
+        status: result.success
+            ? PLUGIN_COMMAND_STATUS.SUCCESS
+            : PLUGIN_COMMAND_STATUS.FAILURE,
+    };
+}
+function requiredTargetLabel(action) {
+    if (action === PLUGIN_COMMAND_ACTION.ADD)
+        return "source";
+    if (action === PLUGIN_COMMAND_ACTION.REMOVE ||
+        action === PLUGIN_COMMAND_ACTION.EXPORT)
+        return "name";
+    if (action === PLUGIN_COMMAND_ACTION.VALIDATE ||
+        action === PLUGIN_COMMAND_ACTION.IMPORT)
+        return "path";
+    return undefined;
+}
+/** Execute one plugin request; the CLI dispatcher owns process exit status. */
+export async function runPluginCommand(request, onStep) {
+    const { action = PLUGIN_COMMAND_ACTION.LIST, dryRun, projectDir, codex = false, force = false, } = request;
+    const target = request.target ?? "";
+    const requiredLabel = requiredTargetLabel(action);
+    if (requiredLabel && !target) {
+        report(onStep, "err", "Error", "error", `${requiredLabel} required: javi-forge plugin ${action} <${requiredLabel}>`);
+        return { status: PLUGIN_COMMAND_STATUS.FAILURE };
+    }
+    try {
+        switch (action) {
+            case PLUGIN_COMMAND_ACTION.ADD:
+                return await runPluginAdd(target, dryRun, onStep, { force });
+            case PLUGIN_COMMAND_ACTION.REMOVE:
+                return await runPluginRemove(target, dryRun, onStep);
+            case PLUGIN_COMMAND_ACTION.LIST:
+                return await runPluginList(onStep);
+            case PLUGIN_COMMAND_ACTION.SEARCH:
+                return await runPluginSearch(request.target, onStep, {
+                    signal: request.signal,
+                });
+            case PLUGIN_COMMAND_ACTION.VALIDATE:
+                return await runPluginValidate(target, onStep);
+            case PLUGIN_COMMAND_ACTION.SYNC:
+                return await runPluginSync(projectDir, dryRun, onStep);
+            case PLUGIN_COMMAND_ACTION.EXPORT:
+                return codex
+                    ? await runPluginExportCodex(target, onStep)
+                    : await runPluginExport(target, onStep);
+            case PLUGIN_COMMAND_ACTION.IMPORT:
+                return await runPluginImport(target, dryRun, onStep, { force });
+            case PLUGIN_COMMAND_ACTION.EXPORT_SKILLS:
+                return target === "global"
+                    ? await runPluginExportGlobalSkillsJson(dryRun, onStep)
+                    : await runPluginExportSkillsJson(request.target ?? projectDir, dryRun, onStep);
+            default:
+                report(onStep, "err", "Error", "error", `unknown plugin action: ${action}`);
+                return { status: PLUGIN_COMMAND_STATUS.FAILURE };
+        }
+    }
+    catch (error) {
+        report(onStep, "fatal", "Fatal error", "error", String(error));
+        return { status: PLUGIN_COMMAND_STATUS.FAILURE };
+    }
 }
 //# sourceMappingURL=plugin.js.map

package/dist/ui/Plugin.d.ts

@@ -1,12 +1,12 @@
 import React from "react";
+import type { PluginCommandResult } from "../commands/plugin.js";
+import type { InitStep } from "../types/index.js";
 interface PluginProps {
-    action: "add" | "remove" | "list" | "search" | "validate" | "sync" | "export" | "import" | "export-skills";
-    target?: string;
+    action: string;
     dryRun: boolean;
-    codex?: boolean;
-    /** Bypass the skillguard gate for unscannable sources ONLY — block always refuses (D5) */
-    force?: boolean;
+    steps: readonly InitStep[];
+    result: PluginCommandResult | null;
 }
-export default function Plugin({ action, target, dryRun, codex, force, }: PluginProps): React.JSX.Element;
+export default function Plugin({ action, dryRun, steps, result }: PluginProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=Plugin.d.ts.map

package/dist/ui/Plugin.js

@@ -1,7 +1,6 @@
 import { Box, Text } from "ink";
 import Spinner from "ink-spinner";
-import React, { useEffect, useState } from "react";
-import { runPluginAdd, runPluginExport, runPluginExportCodex, runPluginExportGlobalSkillsJson, runPluginExportSkillsJson, runPluginImport, runPluginList, runPluginRemove, runPluginSearch, runPluginSync, runPluginValidate, } from "../commands/plugin.js";
+import React from "react";
 import { theme } from "./theme.js";
 const STATUS_ICON = {
     pending: "\u25cb",
@@ -16,150 +15,7 @@ const STATUS_COLOR = {
     error: theme.error,
     skipped: theme.muted,
 };
-export default function Plugin({ action, target, dryRun, codex = false, force = false, }) {
-    const [steps, setSteps] = useState([]);
-    const [done, setDone] = useState(false);
-    const handleTerminalSignal = (signal, signalController) => {
-        if (signalController.signal.aborted)
-            return;
-        signalController.abort();
-        if (signal === "SIGINT")
-            process.exitCode = 130;
-        if (signal === "SIGTERM")
-            process.exitCode = 143;
-    };
-    const onStep = (step) => {
-        setSteps((prev) => {
-            const idx = prev.findIndex((s) => s.id === step.id);
-            if (idx >= 0) {
-                const next = [...prev];
-                next[idx] = step;
-                return next;
-            }
-            return [...prev, step];
-        });
-    };
-    useEffect(() => {
-        const controller = action === "search" ? new AbortController() : undefined;
-        const sigintHandler = controller === undefined
-            ? undefined
-            : () => handleTerminalSignal("SIGINT", controller);
-        const sigtermHandler = controller === undefined
-            ? undefined
-            : () => handleTerminalSignal("SIGTERM", controller);
-        if (action === "search" && sigintHandler && sigtermHandler) {
-            process.on("SIGINT", sigintHandler);
-            process.on("SIGTERM", sigtermHandler);
-        }
-        const run = async () => {
-            try {
-                switch (action) {
-                    case "add":
-                        if (!target) {
-                            onStep({
-                                id: "err",
-                                label: "Error",
-                                status: "error",
-                                detail: "source required: javi-forge plugin add <org/repo>",
-                            });
-                            break;
-                        }
-                        await runPluginAdd(target, dryRun, onStep, { force });
-                        break;
-                    case "remove":
-                        if (!target) {
-                            onStep({
-                                id: "err",
-                                label: "Error",
-                                status: "error",
-                                detail: "name required: javi-forge plugin remove <name>",
-                            });
-                            break;
-                        }
-                        await runPluginRemove(target, dryRun, onStep);
-                        break;
-                    case "list":
-                        await runPluginList(onStep);
-                        break;
-                    case "search":
-                        await runPluginSearch(target, onStep, {
-                            signal: controller?.signal,
-                        });
-                        break;
-                    case "validate":
-                        if (!target) {
-                            onStep({
-                                id: "err",
-                                label: "Error",
-                                status: "error",
-                                detail: "path required: javi-forge plugin validate <dir>",
-                            });
-                            break;
-                        }
-                        await runPluginValidate(target, onStep);
-                        break;
-                    case "sync":
-                        await runPluginSync(process.cwd(), dryRun, onStep);
-                        break;
-                    case "export":
-                        if (!target) {
-                            onStep({
-                                id: "err",
-                                label: "Error",
-                                status: "error",
-                                detail: "name required: javi-forge plugin export <name>",
-                            });
-                            break;
-                        }
-                        if (codex) {
-                            await runPluginExportCodex(target, onStep);
-                        }
-                        else {
-                            await runPluginExport(target, onStep);
-                        }
-                        break;
-                    case "import":
-                        if (!target) {
-                            onStep({
-                                id: "err",
-                                label: "Error",
-                                status: "error",
-                                detail: "path required: javi-forge plugin import <dir>",
-                            });
-                            break;
-                        }
-                        await runPluginImport(target, dryRun, onStep, { force });
-                        break;
-                    case "export-skills":
-                        if (target === "global") {
-                            await runPluginExportGlobalSkillsJson(dryRun, onStep);
-                        }
-                        else {
-                            await runPluginExportSkillsJson(target ?? process.cwd(), dryRun, onStep);
-                        }
-                        break;
-                }
-            }
-            catch (e) {
-                onStep({
-                    id: "fatal",
-                    label: "Fatal error",
-                    status: "error",
-                    detail: String(e),
-                });
-            }
-            setDone(true);
-        };
-        run();
-        return () => {
-            if (sigintHandler) {
-                process.removeListener("SIGINT", sigintHandler);
-            }
-            if (sigtermHandler) {
-                process.removeListener("SIGTERM", sigtermHandler);
-            }
-        };
-    }, [action, target, dryRun, force]);
+export default function Plugin({ action, dryRun, steps, result }) {
     return (React.createElement(Box, { flexDirection: "column", padding: 1 },
         React.createElement(Box, { marginBottom: 1 },
             React.createElement(Text, { bold: true, color: theme.primary }, "javi-forge"),
@@ -180,7 +36,11 @@ export default function Plugin({ action, target, dryRun, codex = false, force =
             step.detail ? (React.createElement(Text, { color: theme.muted, dimColor: true },
                 " ",
                 step.detail)) : null))))),
-        done && (React.createElement(Box, { marginTop: 1 },
-            React.createElement(Text, { color: theme.muted }, "Done.")))));
+        result && (React.createElement(Box, { marginTop: 1 },
+            React.createElement(Text, { color: result.status === "success" ? theme.success : theme.error }, result.status === "success"
+                ? "Done."
+                : result.status === "refused"
+                    ? "Refused."
+                    : "Failed.")))));
 }
 //# sourceMappingURL=Plugin.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.39.0",
+	"version": "1.39.2",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {