kojee-mcp 0.5.13 → 0.5.14

package/dist/{wizard-L4MYRLJI.js → wizard-5ILBK6YD.js}

@@ -29,16 +29,303 @@ import {
 } from "./chunk-X672ZN7V.js";
 
 // src/wizard/wizard.ts
+import crypto2 from "crypto";
+import fs4 from "fs";
+import path5 from "path";
+import { fileURLToPath } from "url";
+
+// src/wizard/registry.ts
+var installers = /* @__PURE__ */ new Map();
+function register(installer) {
+  installers.set(installer.id, installer);
+}
+function getInstaller(id) {
+  return installers.get(id);
+}
+function runtimeUsesWebhook(id) {
+  return getInstaller(id)?.capabilities.includes("webhook") ?? false;
+}
+
+// src/wizard/capabilities/webhook-secret.ts
 import crypto from "crypto";
 import fs from "fs";
 import path from "path";
+function generateSecret() {
+  return crypto.randomBytes(32).toString("hex");
+}
+function readSecretFromEnv(envPath) {
+  let body;
+  try {
+    body = fs.readFileSync(envPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const m = body.match(/^(?:export\s+)?KOJEE_WEBHOOK_SECRET=(.*)$/m);
+  if (!m) return void 0;
+  const raw = m[1].trim().replace(/^['"]|['"]$/g, "");
+  return raw.length > 0 ? raw : void 0;
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function upsertEnvFile(filePath, vars, opts = {}) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  let lines = [];
+  try {
+    lines = fs.readFileSync(filePath, "utf8").split("\n");
+  } catch {
+  }
+  if (opts.header && !lines.some((l) => l === opts.header)) lines.unshift(opts.header);
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const pre = opts.exportPrefix ? "export " : "";
+  for (const [k, v] of vars) {
+    const line = `${pre}${k}=${shellSingleQuote(v)}`;
+    const idx = lines.findIndex((l) => l.startsWith(`${k}=`) || l.startsWith(`export ${k}=`));
+    if (idx >= 0) lines[idx] = line;
+    else lines.push(line);
+  }
+  fs.writeFileSync(filePath, lines.join("\n") + "\n", { mode: 384 });
+}
+function writeWebhookSecretBothSides(opts) {
+  const existing = opts.existingSecret ?? readSecretFromEnv(opts.daemonEnvPath) ?? readSecretFromEnv(opts.adapterEnvPath);
+  const secret = existing ?? generateSecret();
+  const reused = existing !== void 0;
+  const daemonVars = [
+    ["KOJEE_RUNTIME", opts.runtime],
+    ["KOJEE_WEBHOOK_URL", opts.webhookUrl],
+    ["KOJEE_WEBHOOK_SECRET", secret],
+    ...opts.signatureEnv ?? []
+  ];
+  upsertEnvFile(opts.daemonEnvPath, daemonVars, {
+    exportPrefix: true,
+    header: `# kojee daemon env for runtime=${opts.runtime} (source this before starting the daemon)`
+  });
+  secureFile(opts.daemonEnvPath);
+  const adapterVars = [
+    ["KOJEE_WEBHOOK_SECRET", secret],
+    ...opts.mcpDir ? [["KOJEE_MCP_DIR", opts.mcpDir]] : [],
+    ...opts.allowAllUsers ? [["KOJEE_TANDEM_ALLOW_ALL_USERS", "true"]] : []
+  ];
+  upsertEnvFile(opts.adapterEnvPath, adapterVars);
+  secureFile(opts.adapterEnvPath);
+  return { secret, reused, daemonEnvPath: opts.daemonEnvPath, adapterEnvPath: opts.adapterEnvPath };
+}
+
+// src/wizard/installers/hermes.ts
+import path4 from "path";
+
+// src/wizard/plugin-payload.ts
+import fs2 from "fs";
+import path2 from "path";
+var HERMES_PAYLOAD_FILES = [
+  "__init__.py",
+  "adapter.py",
+  "kojee_tandem_core.py",
+  "plugin.yaml"
+];
+function stagePluginPayload(opts) {
+  fs2.mkdirSync(opts.destDir, { recursive: true });
+  const written = [];
+  for (const file of opts.files) {
+    const src = path2.join(opts.srcDir, file);
+    if (!fs2.existsSync(src)) {
+      throw new Error(
+        `stagePluginPayload: missing payload file '${file}' in ${opts.srcDir}`
+      );
+    }
+    const dest = path2.join(opts.destDir, file);
+    fs2.copyFileSync(src, dest);
+    written.push(dest);
+  }
+  return written;
+}
+function resolveBundledPayloadDir(runtime, baseDir) {
+  const dir = path2.join(baseDir, "plugins", runtime);
+  if (!fs2.existsSync(dir) || !fs2.statSync(dir).isDirectory()) {
+    throw new Error(
+      `resolveBundledPayloadDir: no bundled payload for '${runtime}' at ${dir} \u2014 run the build (npm run build) so dist/plugins is staged.`
+    );
+  }
+  return dir;
+}
+function missingPayloadFiles(runtime, baseDir, files) {
+  const dir = path2.join(baseDir, "plugins", runtime);
+  const dirOk = fs2.existsSync(dir) && fs2.statSync(dir).isDirectory();
+  if (!dirOk) return [...files];
+  return files.filter((f) => !fs2.existsSync(path2.join(dir, f)));
+}
+function installBundledPayload(opts) {
+  const srcDir = resolveBundledPayloadDir(opts.runtime, opts.baseDir);
+  return stagePluginPayload({ srcDir, destDir: opts.destDir, files: opts.files });
+}
+
+// src/wizard/service.ts
+import fs3 from "fs";
+import path3 from "path";
+function systemdUnit(spec) {
+  return [
+    "[Unit]",
+    `Description=kojee-mcp daemon (${spec.runtime} runtime) \u2014 Tandem wake sidecar`,
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `EnvironmentFile=${spec.envFile}`,
+    `Environment=KOJEE_RUNTIME=${spec.runtime}`,
+    `ExecStart=${spec.binPath}`,
+    "Restart=always",
+    "RestartSec=5",
+    "StandardOutput=journal",
+    "StandardError=journal",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+function darwinLabel(serviceName) {
+  return `net.kojee.${serviceName}`;
+}
+function launchdPlist(spec, label) {
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "  <key>Label</key>",
+    `  <string>${label}</string>`,
+    "  <key>ProgramArguments</key>",
+    `  <array><string>${spec.binPath}</string></array>`,
+    "  <key>EnvironmentVariables</key>",
+    `  <dict><key>KOJEE_RUNTIME</key><string>${spec.runtime}</string></dict>`,
+    "  <key>RunAtLoad</key><true/>",
+    "  <key>KeepAlive</key><true/>",
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function planService(platform, spec) {
+  if (platform === "linux") {
+    const unitPath = path3.join(
+      spec.homeDir,
+      ".config",
+      "systemd",
+      "user",
+      `${spec.serviceName}.service`
+    );
+    return {
+      supported: true,
+      unitPath,
+      unitContent: systemdUnit(spec),
+      activateCmd: `systemctl --user daemon-reload && systemctl --user enable --now ${spec.serviceName}`,
+      deactivateCmd: `systemctl --user disable --now ${spec.serviceName}`
+    };
+  }
+  if (platform === "darwin") {
+    const label = darwinLabel(spec.serviceName);
+    const unitPath = path3.join(spec.homeDir, "Library", "LaunchAgents", `${label}.plist`);
+    return {
+      supported: true,
+      unitPath,
+      unitContent: launchdPlist(spec, label),
+      activateCmd: `launchctl load -w ${unitPath}`,
+      deactivateCmd: `launchctl unload -w ${unitPath}`
+    };
+  }
+  const manual = `schtasks /create /tn ${spec.serviceName} /sc onlogon /tr "${spec.binPath}" /f (wrap it to set KOJEE_RUNTIME=${spec.runtime} and load ${spec.envFile}), or run directly: KOJEE_RUNTIME=${spec.runtime} ${spec.binPath}`;
+  return {
+    supported: false,
+    activateCmd: manual,
+    deactivateCmd: `schtasks /delete /tn ${spec.serviceName} /f`,
+    note: "Auto-service install isn't supported on this platform yet; run the command above to keep the daemon up."
+  };
+}
+function writeService(platform, spec) {
+  const plan = planService(platform, spec);
+  if (plan.supported && plan.unitPath && plan.unitContent !== void 0) {
+    fs3.mkdirSync(path3.dirname(plan.unitPath), { recursive: true });
+    fs3.writeFileSync(plan.unitPath, plan.unitContent, { mode: 420 });
+  }
+  return plan;
+}
+
+// src/wizard/installers/hermes.ts
+function installHermes(inp) {
+  const daemonEnv = path4.join(inp.homeDir, ".kojee", "hermes.env");
+  const adapterEnv = path4.join(inp.homeDir, ".hermes", ".env");
+  const pluginDir = path4.join(inp.homeDir, ".hermes", "plugins", "kojee-tandem");
+  if (!inp.skipPayload) {
+    const missing = missingPayloadFiles("hermes", inp.payloadBaseDir, HERMES_PAYLOAD_FILES);
+    if (missing.length > 0) {
+      return {
+        runtime: "hermes",
+        output: `hermes install ERROR: the bundled plugin payload is incomplete \u2014 missing ${missing.join(", ")} under ${path4.join(inp.payloadBaseDir, "plugins", "hermes")}. No changes were written. Run \`npm run build\` to stage dist/plugins/hermes, then retry.`,
+        exitCode: 2,
+        secret: "",
+        secretReused: false
+      };
+    }
+  }
+  const sec = writeWebhookSecretBothSides({
+    daemonEnvPath: daemonEnv,
+    adapterEnvPath: adapterEnv,
+    webhookUrl: inp.webhookUrl,
+    runtime: "hermes",
+    ...inp.mcpDir ? { mcpDir: inp.mcpDir } : {},
+    ...inp.allowAllUsers ? { allowAllUsers: true } : {},
+    ...inp.signatureEnv && inp.signatureEnv.length > 0 ? { signatureEnv: inp.signatureEnv } : {},
+    ...inp.webhookSecret ? { existingSecret: inp.webhookSecret } : {}
+  });
+  const staged = inp.skipPayload ? [] : installBundledPayload({
+    runtime: "hermes",
+    baseDir: inp.payloadBaseDir,
+    destDir: pluginDir,
+    files: [...HERMES_PAYLOAD_FILES]
+  });
+  const svc = writeService(inp.platform, {
+    serviceName: "kojee-hermes",
+    binPath: inp.binPath,
+    envFile: daemonEnv,
+    runtime: "hermes",
+    homeDir: inp.homeDir
+  });
+  const lines = [
+    "Configured runtime: hermes (complete install)",
+    `  secret:      ${sec.reused ? "reused existing" : "generated"} (matched on daemon + adapter env)`,
+    `  daemon env:  ${daemonEnv}`,
+    `  adapter env: ${adapterEnv}`,
+    inp.skipPayload ? `  plugin:      SKIPPED \u2014 no bundled payload (run \`npm run build\` to stage dist/plugins/hermes)` : `  plugin:      ${pluginDir} (${staged.length} files)`,
+    svc.supported ? `  service:     ${svc.unitPath}` : `  service:     manual \u2014 ${svc.note ?? "unsupported platform"}`,
+    // NB: the "Receiver contract" section is intentionally NOT printed here.
+    // configureHermes prints buildDaemonEnvBlock (the single contract owner for
+    // every daemon runtime) on the same URL-present path before this output, so
+    // emitting it here too would print the contract twice.
+    "",
+    "Next:",
+    `  - start the daemon service:  ${svc.activateCmd}`,
+    "  - reload the Hermes gateway to load the plugin:  systemctl --user restart hermes-gateway (or: hermes gateway restart)",
+    "  - join a tandem once:  tandem_join <tandem_id>",
+    "  - verify:  kojee-mcp doctor"
+  ];
+  return {
+    runtime: "hermes",
+    output: lines.join("\n"),
+    exitCode: 0,
+    secret: sec.secret,
+    secretReused: sec.reused
+  };
+}
+
+// src/wizard/wizard.ts
 var DEFAULT_BROKER_URL = "https://rosie-staging.kojee.net";
 function generateWebhookSecret() {
-  return crypto.randomBytes(32).toString("hex");
+  return crypto2.randomBytes(32).toString("hex");
 }
 async function resolveRuntime(opts) {
   if (opts.runtime !== void 0) {
-    if (!isWizardRuntime(opts.runtime)) {
+    if (!isWizardRuntime(opts.runtime) && getInstaller(opts.runtime) === void 0) {
       return {
         error: `Unknown --runtime "${opts.runtime}". Expected one of: ${WIZARD_RUNTIMES.join(", ")}.`
       };
@@ -47,7 +334,7 @@ async function resolveRuntime(opts) {
   }
   if (opts.interactive && opts.promptRuntime) {
     const picked = await opts.promptRuntime();
-    if (!isWizardRuntime(picked)) {
+    if (!isWizardRuntime(picked) && getInstaller(picked) === void 0) {
       return { error: `Unknown runtime "${picked}". Expected one of: ${WIZARD_RUNTIMES.join(", ")}.` };
     }
     return { runtime: picked };
@@ -96,11 +383,8 @@ function resolveWizardWebhook(opts) {
     ...warning !== void 0 ? { warning } : {}
   };
 }
-function shellSingleQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function writeRuntimeEnvFile(runtime, url, secret, signatureEnv = []) {
-  const envPath = path.join(kojeeHomeDir(), ".kojee", `${runtime}.env`);
+  const envPath = path5.join(kojeeHomeDir(), ".kojee", `${runtime}.env`);
   const body = [
     `# kojee daemon env for runtime=${runtime} (source this before starting the daemon)`,
     `export KOJEE_RUNTIME=${shellSingleQuote(runtime)}`,
@@ -110,15 +394,12 @@ function writeRuntimeEnvFile(runtime, url, secret, signatureEnv = []) {
     ...signatureEnv.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`),
     ""
   ].join("\n");
-  fs.mkdirSync(path.dirname(envPath), { recursive: true, mode: 448 });
-  fs.writeFileSync(envPath, body, { mode: 384 });
+  fs4.mkdirSync(path5.dirname(envPath), { recursive: true, mode: 448 });
+  fs4.writeFileSync(envPath, body, { mode: 384 });
   secureFile(envPath);
   return envPath;
 }
 var CODEX_UNVERIFIED_NOTE = "NOTE: live Codex verification (hook fires, MCP server connects, bounded listen works) has not been run on this build \u2014 confirm in a real Codex session. This is the owner morning step.";
-function runtimeUsesWebhook(runtime) {
-  return runtime === "codex" || runtime === "hermes" || runtime === "openclaw";
-}
 async function gatherGuidedInputs(runtime, opts) {
   const preamble = [];
   const next = { ...opts };
@@ -178,14 +459,16 @@ async function runWizard(opts) {
     effective = gathered.opts;
     preamble = gathered.preamble;
   }
-  const result = runtime === "claude-code" ? await configureClaudeCode(effective) : runtime === "codex" ? configureCodex(effective) : configureWebhookDaemon(runtime, effective);
+  const installer = getInstaller(runtime);
+  const result = installer ? await installer.install({ opts: effective }) : { runtime, output: `No installer registered for runtime '${runtime}'`, exitCode: 2 };
   if (preamble.length > 0 && result.exitCode === 0) {
     return {
-      ...result,
-      output: [...preamble, "", result.output, "", whatHappensNext(runtime, effective)].join("\n")
+      runtime,
+      output: [...preamble, "", result.output, "", whatHappensNext(runtime, effective)].join("\n"),
+      exitCode: result.exitCode
     };
   }
-  return result;
+  return { runtime, output: result.output, exitCode: result.exitCode };
 }
 function whatHappensNext(runtime, opts) {
   const lines = ["What happens next:"];
@@ -294,19 +577,9 @@ function configureCodex(opts) {
   lines.push(CODEX_UNVERIFIED_NOTE);
   return { runtime: "codex", output: lines.join("\n"), exitCode: 0 };
 }
-function configureWebhookDaemon(runtime, opts) {
-  const wh = resolveWizardWebhook(opts);
-  if (wh.error) {
-    return { runtime, output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
-  }
-  recordRuntime(runtime);
+function buildDaemonEnvBlock(runtime, wh, envFile) {
   const lines = [];
-  lines.push(`Configured runtime: ${runtime}`);
-  lines.push("Wake mode: webhook sink (daemon-consumed). NO MCP-config file, NO hooks written.");
-  lines.push("");
-  if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
-  if (wh.url) {
-    const envFile = writeRuntimeEnvFile(runtime, wh.url, wh.secret, wh.signatureEnv);
+  if (wh.url && envFile) {
     lines.push("Export these before starting the daemon (also written to a source-able file):");
     lines.push(`  export KOJEE_RUNTIME=${shellSingleQuote(runtime)}`);
     lines.push(`  export KOJEE_WEBHOOK_URL=${shellSingleQuote(wh.url)}`);
@@ -324,11 +597,87 @@ function configureWebhookDaemon(runtime, opts) {
   lines.push("");
   lines.push("Receiver contract:");
   lines.push(indent(buildWebhookReceiverNote({ header: wh.signatureHeader, prefix: wh.signaturePrefix })));
+  return lines;
+}
+function configureWebhookDaemon(runtime, opts) {
+  const wh = resolveWizardWebhook(opts);
+  if (wh.error) {
+    return { runtime, output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
+  }
+  recordRuntime(runtime);
+  const lines = [];
+  lines.push(`Configured runtime: ${runtime}`);
+  lines.push("Wake mode: webhook sink (daemon-consumed). NO MCP-config file, NO hooks written.");
+  lines.push("");
+  if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
+  const envFile = wh.url ? writeRuntimeEnvFile(runtime, wh.url, wh.secret, wh.signatureEnv) : void 0;
+  lines.push(...buildDaemonEnvBlock(runtime, wh, envFile));
   lines.push("");
   lines.push(`Next steps (${runtime}):`);
   lines.push("  Start the daemon with the env above. Verify: kojee-mcp doctor (after the daemon is up).");
   return { runtime, output: lines.join("\n"), exitCode: 0 };
 }
+function distDir() {
+  return path5.dirname(fileURLToPath(import.meta.url));
+}
+function resolveBinPath() {
+  const entry = process.argv[1];
+  return entry && entry.length > 0 ? entry : "kojee-mcp";
+}
+function configureHermes(opts) {
+  const runtime = "hermes";
+  const wh = resolveWizardWebhook(opts);
+  if (wh.error) {
+    return { runtime, output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
+  }
+  const lines = [];
+  lines.push(`Configured runtime: ${runtime}`);
+  lines.push("Wake mode: webhook sink (daemon-consumed). NO MCP-config file, NO hooks written.");
+  lines.push("");
+  if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
+  if (wh.url) {
+    const home = kojeeHomeDir();
+    let skipPayload = false;
+    const base = distDir();
+    try {
+      resolveBundledPayloadDir("hermes", base);
+    } catch {
+      skipPayload = true;
+    }
+    const env = opts.env ?? process.env;
+    const suppliedSecret = (opts.webhookSecret ?? env["KOJEE_WEBHOOK_SECRET"] ?? "").trim();
+    const install = installHermes({
+      homeDir: home,
+      payloadBaseDir: base,
+      platform: process.platform,
+      binPath: resolveBinPath(),
+      webhookUrl: wh.url,
+      ...suppliedSecret ? { webhookSecret: suppliedSecret } : {},
+      ...wh.signatureEnv.length > 0 ? { signatureEnv: wh.signatureEnv } : {},
+      signatureHeader: wh.signatureHeader,
+      signaturePrefix: wh.signaturePrefix,
+      skipPayload
+    });
+    if (install.exitCode !== 0) {
+      lines.push(install.output);
+      return { runtime, output: lines.join("\n"), exitCode: install.exitCode };
+    }
+    recordRuntime(runtime);
+    const envFile = path5.join(home, ".kojee", "hermes.env");
+    lines.push(...buildDaemonEnvBlock(runtime, wh, envFile));
+    lines.push("");
+    lines.push(install.output);
+    return { runtime, output: lines.join("\n"), exitCode: install.exitCode };
+  }
+  recordRuntime(runtime);
+  lines.push(...buildDaemonEnvBlock(runtime, wh, void 0));
+  lines.push("");
+  lines.push(`Next steps (${runtime}):`);
+  lines.push("  Re-run with --webhook-url once your receiver is up to complete the install");
+  lines.push("  (writes both env files, copies the plugin, installs the daemon service).");
+  lines.push("  Verify: kojee-mcp doctor (after the daemon is up).");
+  return { runtime, output: lines.join("\n"), exitCode: 0 };
+}
 async function runWizardUninstall(runtime, opts) {
   const effective = opts.runtime !== void 0 ? runtime : readRecordedRuntime() ?? runtime;
   const lines = [`Uninstalling runtime: ${effective}`];
@@ -359,9 +708,9 @@ async function runWizardUninstall(runtime, opts) {
   } else {
     lines.push("  (hermes/openclaw write no MCP-config or hooks \u2014 nothing to tear down.");
     lines.push("   Stop the daemon and unset KOJEE_WEBHOOK_URL/SECRET to disable the sink.)");
-    const envPath = path.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
+    const envPath = path5.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
     try {
-      fs.unlinkSync(envPath);
+      fs4.unlinkSync(envPath);
       lines.push(`  removed ${envPath}`);
     } catch {
     }
@@ -372,6 +721,46 @@ async function runWizardUninstall(runtime, opts) {
 function indent(s) {
   return s.split("\n").map((l) => "    " + l).join("\n");
 }
+function registerBuiltinInstaller(id, menuLabel, capabilities, doInstall) {
+  register({
+    id,
+    menuLabel,
+    capabilities,
+    install: async (ctx) => doInstall(ctx.opts),
+    uninstall: async (ctx) => runWizardUninstall(id, ctx.opts),
+    verify: async () => ({ runtime: id, ok: true, checks: [] })
+  });
+}
+registerBuiltinInstaller(
+  "claude-code",
+  "Claude Code",
+  ["pair-credential", "mcp-config-write", "hooks-write"],
+  (o) => configureClaudeCode(o)
+);
+registerBuiltinInstaller(
+  "codex",
+  "Codex",
+  ["pair-credential", "mcp-config-write", "hooks-write", "webhook"],
+  (o) => configureCodex(o)
+);
+registerBuiltinInstaller(
+  "hermes",
+  "Hermes",
+  [
+    "pair-credential",
+    "webhook",
+    "webhook-secret-both-sides",
+    "plugin-payload-copy",
+    "service-install"
+  ],
+  (o) => configureHermes(o)
+);
+registerBuiltinInstaller(
+  "openclaw",
+  "OpenClaw",
+  ["pair-credential", "webhook"],
+  (o) => configureWebhookDaemon("openclaw", o)
+);
 export {
   CODEX_UNVERIFIED_NOTE,
   DEFAULT_BROKER_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kojee-mcp",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -16,7 +16,7 @@
   },
   "_buildNote": "src/version.ts resolves package.json via '../package.json' from import.meta.url; this assumes dist output stays flat one level under the package root (tsup default outDir=dist, no nesting). If the build adds outDir nesting or a deeper entry, update version.ts's relative path.",
   "scripts": {
-    "build": "tsup src/cli.ts src/index.ts src/lib.ts --format esm --dts --clean",
+    "build": "tsup src/cli.ts src/index.ts src/lib.ts --format esm --dts --clean && tsx scripts/bundle-plugins.ts",
     "prepublishOnly": "npm run build && node scripts/verify-tarball.mjs",
     "dev": "tsup src/cli.ts --format esm --watch",
     "typecheck": "tsc --noEmit",