omakit 0.1.5 → 0.1.6

package/README.md

@@ -105,9 +105,9 @@ owner's behalf. Zero dependencies, plain ESM, one entry point, no build step.
 
 ```bash
 omakit setup                 # the environment, the pin, tab completion, and what to try first
-omakit submit <plugin-repo> --category <c> --tags <a,b>
+omakit submit <plugin-repo>  # every check, the issue title and body; asks for a category and tags at a terminal
 omakit watch <issue-url>     # the commit the marketplace validated, against the plugin's current HEAD
-omakit verify <plugin-repo>  # the official security baseline over the local transport, reported verbatim
+omakit verify <plugin-repo>  # the official security baseline over the local transport; --json for the document
 omakit parity                # the baseline over GitHub versus the local transport, on real listings; writes the evidence
 omakit doctor                # what is installed, what is pinned, and what has moved
 omakit pin                   # what setup does for the pin, on its own
@@ -126,6 +126,25 @@ that commit. The completion script knows the subcommands and their flags,
 completes a directory for `<target>`, and offers the categories and tags the
 pin's submission form actually has.
 
+`omakit verify` prints the official baseline result alone, with no Omakit
+check around it: the subject, the pin, the transport and what the local
+adapter assumes, then the marketplace's own outcome, each finding as a block
+with its rule id, whether it blocks publication under the pinned policy, the
+file and line, and the official text verbatim, then the marketplace's own
+statement. `--json` prints the document itself, unchanged from earlier
+releases, and `--out <file>` writes it; agents and the skills use those.
+
+`omakit submit` reads the marketplace's registry first. A plugin that is
+already listed is refused there and asked for nothing (measured on 0.1.5: it
+exited 2 asking for `--category` and `--tags`, then would have said there was
+nothing to submit). An unlisted plugin needs both, and they are an editorial
+choice nobody else can make: at a terminal it asks, once each, with the form's
+own lists numbered and the marketplace's own default for the manifest's kinds
+offered where it is on the list; in a pipe, from an agent, or with `--json` it
+is the usage error with the same lists, exit 2. Either way the report ends
+with the command line that repeats the run without asking, and `--json`
+carries it as `reproduce`.
+
 There is nothing to authenticate. If you have `gh auth login` done, omakit
 reads that credential for GET requests and stores nothing; a token in
 `GH_TOKEN` or `GITHUB_TOKEN` reaches it the same way, because `gh` honours

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "The safe place to find out: everything knowable about an Omarchy Quattro plugin submission before you post it, on your own machine. Agent-first, read-only, posts nothing, zero dependencies.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/skills/omarchy-plugin-submit/SKILL.md

@@ -12,6 +12,19 @@ the issue is a separate, explicit act that needs the plugin owner's approval
 first, which is what the marketplace's own agent instructions require. Show the
 owner the title, the body and the verdicts, ask, and only then post it.
 
+## If omakit is not installed
+
+```bash
+npm install --global omakit   # Omarchy ships Node and npm through mise
+omakit doctor                 # node, git, the pin, the credential source, and whether omakit is on PATH
+```
+
+If `omakit` is not found after the install, run
+`"$(npm prefix --global)/bin/omakit" setup`: it prints the one line that puts
+npm's bin on PATH for the shell in `$SHELL`. Keep it current with
+`omakit upgrade`, which updates the tool through npm at the exact version the
+registry names and never moves the marketplace pin.
+
 ## Run it
 
 ```bash
@@ -19,14 +32,32 @@ omakit pin     # once, and after any pin change: fetches the pinned marketplace
 omakit submit <path-to-the-plugin-repo> --category <category> --tags <a,b>
 ```
 
+The pin is a sparse read-only checkout of one marketplace commit under
+`$XDG_CACHE_HOME/omakit/marketplace` (or `~/.cache/omakit/marketplace`). Every
+rule is read from it; nothing about the format is written in the tool.
+
 The plugin's name and id come from the root `manifest.json`. The repository URL
 comes from `origin`. You supply the category and the tags, because nobody else
 can: they are an editorial choice about where the plugin belongs.
 
 If you do not know which category and tags are allowed, run the command without
-them: that is a usage error (exit 2) whose message lists the controlled values,
-read from the pinned form, before any check runs. With `--json` the same lists
-come back under `usage`.
+them: for you, in a pipe or with `--json`, that is a usage error (exit 2) whose
+message lists the controlled values, read from the pinned form; with `--json`
+the same lists come back under `usage`. A person at a terminal is asked
+instead, once each, with the marketplace's own default for the manifest's
+kinds. It is decided after the registry is read: a plugin that is already
+listed is refused at `identity.available` and asked for nothing. Every report
+ends with the command line that repeats the run without asking, and `--json`
+carries it as `reproduce`.
+
+To see the official baseline result alone, with no Omakit check around it:
+
+```bash
+omakit verify <path-to-the-plugin-repo> --json
+```
+
+`verify` without `--json` prints a report for a person; `--json` is the
+document, unchanged between releases.
 
 Useful flags: `--notes` for the Maintainer notes field, `--suggest-tag` for the
 optional suggestion, `--name` when the manifest has no name, `--json` for a

package/skills/omarchy-plugin-validation-watch/SKILL.md

@@ -29,6 +29,12 @@ push came after a review comment had also commented: engaged, and stuck.
 omakit watch https://github.com/omacom/omarchy-plugin-marketplace/issues/<number>
 ```
 
+If `omakit` is not installed: `npm install --global omakit` (Omarchy ships Node
+and npm through mise), then `omakit doctor`; if the command is not found after
+the install, `"$(npm prefix --global)/bin/omakit" setup` prints the one line
+that puts npm's bin on PATH. `omakit upgrade` keeps it current through npm.
+Add `--json` for a machine-readable result.
+
 Read-only. It does not comment, label, or edit anything, and it cannot. It reads
 the default branch through the REST API when a credential is available, taking
 it from the operator's `gh` login (which itself honours `GH_TOKEN` and

package/tools/marketplace/README.md

@@ -10,7 +10,7 @@ local commit through the transport seam the marketplace tests itself
 | `pin.mjs` | The pin identity (one home) and the reproducible setup: `omakit pin` fetches exactly that commit into `$XDG_CACHE_HOME/omakit/marketplace` and refuses a modified checkout. |
 | `local-transport.mjs` | Answers the four request shapes the official resolver makes, from a local clone at the exact commit. No network, no credentials, no writes. |
 | `run-baseline.mjs` | Runs the pinned official baseline over either transport and reports the pin identity beside the result. |
-| `verify.mjs` | Builds the `marketplaceBaseline` section: pin, transport, assumptions, the official result verbatim, the statement. |
+| `verify.mjs` | Builds the `marketplaceBaseline` section: pin, transport, assumptions, the official result verbatim, the statement. `omakit verify` renders it for a person (`renderVerify` in `report.mjs`) and prints the document itself behind `--json` and `--out`. |
 | `preflight.mjs` | Translates that result into what it will cause on submission, using the pinned policy, and renders the marketplace's own report text with its attestation marker stripped and asserted absent. |
 | `yaml.mjs` | A deliberately small YAML reader for the pinned issue form. Accepts that subset and throws on anything else. |
 | `form.mjs` | The submission contract, read from the form and cross-checked against the marketplace's own constants. |
@@ -19,11 +19,12 @@ local commit through the transport seam the marketplace tests itself
 | `plugin.mjs` | The root files the submission contract needs, and the declared plugin identity. |
 | `agent-control.mjs` | The recursive agent-control warning, and its remedy. |
 | `issue.mjs` | Renders the issue the way the form would, then has the marketplace's own parser judge it. |
-| `submit.mjs` | Assembles every check with its measured reason, and withholds the body when a blocking check fails. |
+| `submit.mjs` | Assembles every check with its measured reason, and withholds the body when a blocking check fails. Decides the category and tags after the registry: a listed plugin needs neither; an unlisted one without them is asked through `ask.mjs` at a terminal, and is a usage error otherwise. Ends with `reproduce`, the command line that repeats the run without asking. |
+| `ask.mjs` | The two questions `submit` asks a person at a terminal, and only there: category and tags, numbered from the pinned form, with the marketplace's own presentation for the manifest's kinds (read from the pinned catalog builder) as the default where it is on the list. Prompts on stderr, nothing persisted. |
 | `watch.mjs` | The validation watch: validated commit versus current default-branch HEAD, and the one action that refreshes it. |
 | `github.mjs` | Read-only GitHub access. GET only. The credential is your `gh` login, read through one frozen `gh auth token` call, and is never written anywhere. |
 | `style.mjs` | The visual system, defined once: the palette, the status vocabulary, the block ramp, the columns, the motion budgets, and the composition helpers every command draws with. `docs/TUI.md` explains it. |
-| `report.mjs` | Text rendering of submit, watch and doctor for the agent that runs this tool, and the person reading over its shoulder. |
+| `report.mjs` | Text rendering of submit, watch, doctor and verify for the agent that runs this tool, and the person reading over its shoulder. |
 | `path-hint.mjs` | Is `omakit` reachable as a bare command, and if not, the one line that makes it so for the install that is here: a symlink for a clone, the npm prefix's `bin` on PATH for a package, said for the shell in `$SHELL`. `setup` and `doctor` print it; nothing writes an rc file. |
 | `usage.mjs` | The help text, as data. |
 | `completion.mjs` | A completion script for bash, zsh or fish, derived from the help data and the pin's form: the subcommands and flags are read out of `COMMANDS`, the categories and tags out of the pinned submission form, and the script says which pin it came from. `setup` installs it for the shell in `$SHELL`, the one file this tool writes outside its own checkout. |
@@ -34,10 +35,11 @@ local commit through the transport seam the marketplace tests itself
 
 ```text
 omakit pin
+omakit submit /path/to/plugin-repo                       # asks for the category and tags at a terminal
 omakit submit /path/to/plugin-repo --category Widgets --tags bar,quickshell
 omakit submit https://github.com/owner/repo@<40-char sha> --category System --tags system
 omakit watch https://github.com/omacom/omarchy-plugin-marketplace/issues/4829
-omakit verify /path/to/plugin-repo
+omakit verify /path/to/plugin-repo                       # --json for the document
 omakit parity --count 30
 ```
 

package/tools/marketplace/ask.mjs

@@ -0,0 +1,140 @@
+// The two questions `omakit submit` asks a person at a terminal, and only
+// there: the category and the tags, which are an editorial choice nobody else
+// can make. Measured before this: `omakit submit <a listed plugin>` exited 2
+// asking for --category and --tags, and would then have refused at
+// identity.available with "nothing to submit"; and an unlisted plugin got the
+// same exit 2 from a person sitting at a terminal who could simply have been
+// asked. So the questions come after the registry, and only when stdin and
+// stdout are both terminals and --json is absent. An agent, a pipe or --json
+// gets the usage error, unchanged.
+//
+// The prompt goes to stderr, so stdout stays the report. The default offered
+// is the marketplace's own presentation for the manifest's kinds, read from
+// the pinned catalog builder (registry.mjs catalogPresentation), and offered
+// only when it is on the form's list. Nothing typed here is written anywhere:
+// the report ends with the command line that repeats the run without asking.
+
+import { createInterface } from "node:readline"
+import { colourEnabled, STEP, action, styler, wrap } from "./style.mjs"
+import { resolveCategory, resolveTags } from "./form.mjs"
+
+export class AskError extends Error {
+  constructor(message) {
+    super(message)
+    this.name = "AskError"
+    this.code = "usage"
+  }
+}
+
+/**
+ * Lines from stdin, one at a time, whether they arrive as they are typed or
+ * were all there before the first question (a scripted run). readline emits
+ * every buffered line at once, so they are queued rather than dropped; the
+ * end of stdin answers null.
+ */
+function reader(input) {
+  const rl = createInterface({ input, terminal: false })
+  const pending = []
+  const waiting = []
+  let closed = false
+  rl.on("line", (line) => (waiting.length ? waiting.shift()(line) : pending.push(line)))
+  rl.on("close", () => {
+    closed = true
+    while (waiting.length) waiting.shift()(null)
+  })
+  return {
+    next: () => (pending.length ? Promise.resolve(pending.shift()) : closed ? Promise.resolve(null) : new Promise((resolve) => waiting.push(resolve))),
+    close: () => rl.close(),
+  }
+}
+
+/** Ask one question until an answer resolves; `parse` returns { ok, value } or { ok: false, reason }. */
+async function question(lines, output, c, { name, heading, options, defaultIndexes, parse }) {
+  const step = " ".repeat(STEP)
+  output.write(`${wrap(heading, {}, c).join("\n")}\n`)
+  for (const [index, option] of options.entries()) {
+    output.write(`${step}${c("typeable", String(index + 1).padStart(2))}  ${option}\n`)
+  }
+  const fallback = defaultIndexes.length ? defaultIndexes.map((index) => index + 1).join(",") : null
+  const prompt = `${action(fallback ? `${name} [${fallback}]:` : `${name}:`, c, { indent: 0 })[0]} `
+  for (;;) {
+    output.write(prompt)
+    const raw = await lines.next()
+    if (raw === null) {
+      output.write("\n")
+      throw new AskError(`stdin ended before the ${name} was answered; pass --${name} on the command line`)
+    }
+    const text = raw.trim() || (fallback ?? "")
+    const parsed = parse(text)
+    if (parsed.ok) return parsed.value
+    output.write(`${wrap(parsed.reason, {}, c).join("\n")}\n`)
+  }
+}
+
+/** A comma-separated answer of numbers or names, resolved against a list. */
+function pick(text, options) {
+  const parts = String(text).split(",").map((part) => part.trim()).filter(Boolean)
+  const chosen = []
+  for (const part of parts) {
+    const number = /^\d+$/.test(part) ? Number(part) : null
+    const option = number !== null
+      ? options[number - 1]
+      : options.find((candidate) => candidate.toLowerCase() === part.toLowerCase())
+    if (!option) return { ok: false, reason: `"${part}" is not a number from 1 to ${options.length}, nor one of the names.` }
+    if (!chosen.includes(option)) chosen.push(option)
+  }
+  return { ok: true, value: chosen }
+}
+
+/**
+ * @param {{ contract: object, defaults: { category: string|null, tags: string[]|null }, missing: string[],
+ *           input?: NodeJS.ReadStream, output?: NodeJS.WriteStream, colour?: boolean }} options
+ *   `defaults` are the marketplace's own presentation for the manifest, offered
+ *   only where they are on the form's list. `missing` names which of
+ *   `--category` and `--tags` to ask for.
+ * @returns {Promise<{ category?: string, tags?: string[] }>}
+ */
+export async function askChoices({ contract, defaults, missing, input = process.stdin, output = process.stderr, colour = colourEnabled(output) }) {
+  const c = styler(colour)
+  const lines = reader(input)
+  const answers = {}
+  try {
+    if (missing.includes("--category")) {
+      const known = defaults.category ? resolveCategory(contract, defaults.category) : { ok: false }
+      const index = known.ok ? contract.categories.indexOf(known.value) : -1
+      answers.category = await question(lines, output, c, {
+        name: "category",
+        heading: `category: one of the form's ${contract.categories.length}${index >= 0 ? `; the marketplace's own choice for this manifest's kinds is ${known.value}` : ""}`,
+        options: contract.categories,
+        defaultIndexes: index >= 0 ? [index] : [],
+        parse: (text) => {
+          if (!text) return { ok: false, reason: `There is no default for this manifest; answer with a number from 1 to ${contract.categories.length}.` }
+          const picked = pick(text, contract.categories)
+          if (!picked.ok) return picked
+          if (picked.value.length !== 1) return { ok: false, reason: "Exactly one category." }
+          return { ok: true, value: picked.value[0] }
+        },
+      })
+    }
+    if (missing.includes("--tags")) {
+      const known = defaults.tags?.length ? resolveTags(contract, defaults.tags.filter((tag) => resolveTags(contract, [tag]).ok)) : { ok: false }
+      const indexes = known.ok ? known.value.map((label) => contract.tagLabels.indexOf(label)) : []
+      answers.tags = await question(lines, output, c, {
+        name: "tags",
+        heading: `tags: 1 to ${contract.maximumTags} of the form's ${contract.tagLabels.length}, comma-separated${indexes.length ? `; the marketplace's own choice for this manifest's kinds is ${known.value.join(", ")}` : ""}`,
+        options: contract.tagLabels,
+        defaultIndexes: indexes,
+        parse: (text) => {
+          if (!text) return { ok: false, reason: `There is no default for this manifest; answer with 1 to ${contract.maximumTags} numbers, comma-separated.` }
+          const picked = pick(text, contract.tagLabels)
+          if (!picked.ok) return picked
+          const resolved = resolveTags(contract, picked.value)
+          return resolved.ok ? { ok: true, value: resolved.value } : { ok: false, reason: `${resolved.reason}.` }
+        },
+      })
+    }
+  } finally {
+    lines.close()
+  }
+  return answers
+}

package/tools/marketplace/cli.mjs

@@ -14,13 +14,14 @@
 import { mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs"
 import { dirname, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
-import { ensurePin, MARKETPLACE_PIN } from "./pin.mjs"
+import { ensurePin, MARKETPLACE_PIN, requirePin } from "./pin.mjs"
 import { marketplaceBaselineSection } from "./verify.mjs"
 import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
-import { missingSubmitFlags, submitPreflight } from "./submit.mjs"
-import { submissionContract } from "./form.mjs"
+import { submitPreflight } from "./submit.mjs"
+import { askChoices } from "./ask.mjs"
 import { validationWatch } from "./watch.mjs"
-import { renderSubmit, renderWatch, renderDoctor } from "./report.mjs"
+import { renderSubmit, renderWatch, renderDoctor, renderVerify } from "./report.mjs"
+import { consequence } from "./preflight.mjs"
 import { doctor } from "./doctor.mjs"
 import { setup } from "./setup.mjs"
 import { upgrade } from "./upgrade.mjs"
@@ -98,29 +99,20 @@ function emit(args, text) {
 async function cmdSubmit(args) {
   const target = positionals(args)[0]
   if (!target) fail("usage", "submit needs a target: `omakit submit <target> --category <c> --tags <a,b>`", 2)
-  // A missing category or tag list is a usage error, decided before any check
-  // runs and before the spinner starts: nothing can be rendered without them,
-  // and the values the form accepts are the answer, read from the pin.
-  let usage = null
-  try {
-    usage = missingSubmitFlags(await submissionContract({ repoRoot: ROOT }), { category: option(args, "--category"), tags: option(args, "--tags") })
-  } catch (error) {
-    failFrom(error)
-  }
-  if (usage) {
-    if (args.includes("--json")) {
-      process.stdout.write(`${JSON.stringify({ usage }, null, 2)}\n`)
-      process.exit(2)
+  const json = args.includes("--json")
+  const spinner = json ? { phase: () => {}, done: () => {} } : progress()
+  // A missing --category or --tags on an unlisted plugin is asked for, once
+  // each, when a person is at a terminal on both ends and no machine is
+  // reading the result. Anything else, a pipe, an agent, --json, gets the
+  // usage error with the form's lists, exit 2. Decided after the registry:
+  // a listed plugin is never asked for a choice that does not matter.
+  const interactive = !json && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)
+  const chooser = interactive
+    ? async (asked) => {
+      spinner.done()
+      return askChoices({ ...asked, input: process.stdin, output: process.stderr })
     }
-    const flags = usage.missing.join(" and ")
-    fail("usage", `submit needs ${flags}: ${usage.missing.length === 1 ? "it is" : "they are"} an editorial choice nobody else can make, from the pinned form's own lists.`, 2,
-      `omakit submit ${target} --category <c> --tags <a,b>`,
-      (c) => [
-        ...labelled("categories", usage.categories.join(", "), c),
-        ...labelled(`tags, 1 to ${usage.maximumTags}`, usage.tags.join(", "), c),
-      ])
-  }
-  const spinner = args.includes("--json") ? { phase: () => {}, done: () => {} } : progress()
+    : undefined
   let result
   try {
     result = await submitPreflight({
@@ -134,9 +126,24 @@ async function cmdSubmit(args) {
       pluginName: option(args, "--name"),
       allowDirty: args.includes("--allow-dirty"),
       offline: args.includes("--offline"),
+      chooser,
     })
   } catch (error) {
     spinner.done()
+    if (error?.code === "usage" && error.usage) {
+      const usage = error.usage
+      if (json) {
+        process.stdout.write(`${JSON.stringify({ usage }, null, 2)}\n`)
+        process.exit(2)
+      }
+      const flags = usage.missing.join(" and ")
+      fail("usage", `submit needs ${flags}: ${usage.missing.length === 1 ? "it is" : "they are"} an editorial choice nobody else can make, from the pinned form's own lists.`, 2,
+        `omakit submit ${target} --category <c> --tags <a,b>`,
+        (c) => [
+          ...labelled("categories", usage.categories.join(", "), c),
+          ...labelled(`tags, 1 to ${usage.maximumTags}`, usage.tags.join(", "), c),
+        ])
+    }
     failFrom(error)
   }
   spinner.done()
@@ -207,7 +214,7 @@ async function cmdVerify(args) {
     fail(error?.code === "marketplace-unavailable" ? error.code : "baseline-unavailable", error.message)
   }
   spinner.done()
-  emit(args, `${JSON.stringify({
+  const document = {
     subject: {
       repository: subject.repository,
       commit: subject.commit,
@@ -215,7 +222,18 @@ async function cmdVerify(args) {
       mode: subject.mode,
     },
     marketplaceBaseline: section,
-  }, null, 2)}\n`)
+  }
+  // The JSON is the document itself, byte for byte what verify always
+  // printed, for --json and for --out; a person at the terminal gets the
+  // report, in the register submit uses for its checks.
+  if (args.includes("--json") || option(args, "--out")) {
+    emit(args, `${JSON.stringify(document, null, 2)}\n`)
+    return
+  }
+  const blockingRules = section.invoked && section.official && !section.official.error
+    ? (await consequence(requirePin(ROOT).dir, section.official)).selectivelyBlockingRules
+    : []
+  emit(args, renderVerify(document, { blockingRules }))
 }
 
 async function cmdParity(args) {

package/tools/marketplace/registry.mjs

@@ -71,6 +71,42 @@ export function reservedNamespace(pinDir) {
   return match[1].endsWith(".") ? match[1] : `${match[1]}.`
 }
 
+/**
+ * How the marketplace itself presents a plugin it lists, read out of the
+ * pinned `build-catalog.mjs` rather than copied: `categoryFor(kinds)` maps the
+ * manifest's kinds to a category in order of its `if` lines, with a fallback,
+ * and the tags are the first three kinds lowercased. `omakit submit` offers
+ * these as the default answer when it has to ask for a category and tags, so
+ * the default is the marketplace's own choice; a mapping that cannot be read
+ * offers no default. tests/unit/registry-figures.test.mjs pins what the
+ * mapping is at this commit, so a marketplace that changes it fails the suite
+ * until the docs follow.
+ *
+ * @returns {{ rules: Array<{ kinds: string[], category: string }>, fallback: string|null, tagsFromKinds: boolean }}
+ */
+export function catalogPresentation(pinDir) {
+  const source = readFileSync(join(pinDir, CATALOG_BUILDER_PATH), "utf8")
+  const body = source.match(/function categoryFor\([^)]*\)\s*\{([\s\S]*?)\n\}/)?.[1] || ""
+  const rules = [...body.matchAll(/if \(((?:kinds\.includes\("[^"]+"\)(?:\s*\|\|\s*)?)+)\) return "([^"]+)";/g)]
+    .map((match) => ({ kinds: [...match[1].matchAll(/"([^"]+)"/g)].map((kind) => kind[1]), category: match[2] }))
+  const fallback = body.match(/\n\s*return "([^"]+)";\s*$/)?.[1] || null
+  const tagsFromKinds = /tags:\s*kinds\.slice\(0,\s*3\)\.map\(\(kind\) => kind\.toLowerCase\(\)\)/.test(source)
+  return { rules, fallback, tagsFromKinds }
+}
+
+/**
+ * The marketplace's own presentation for a manifest's kinds: the category its
+ * rules pick and the tags it would derive. Null where the mapping was not
+ * readable, so nothing is offered rather than something guessed.
+ */
+export function defaultPresentation(presentation, kinds = []) {
+  const list = Array.isArray(kinds) ? kinds.filter((kind) => typeof kind === "string") : []
+  const rule = presentation.rules.find((candidate) => candidate.kinds.some((kind) => list.includes(kind)))
+  const category = presentation.rules.length && presentation.fallback ? (rule ? rule.category : presentation.fallback) : null
+  const tags = presentation.tagsFromKinds ? list.slice(0, 3).map((kind) => kind.toLowerCase()) : null
+  return { category, tags }
+}
+
 function repositorySlug(value) {
   try {
     return new URL(String(value)).pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").toLowerCase()

package/tools/marketplace/report.mjs

@@ -48,12 +48,7 @@ function checkBlock(check, c) {
   if (check.detail) out.push(...wrap(check.detail, { indent: GUTTER }, c))
   if (check.verdict === "fail") {
     // A path is the thing at fault, so it is yellow; its reason wraps under it.
-    for (const path of check.paths) {
-      out.push(...wrap(`- ${path}`, { indent: GUTTER + STEP, first: GUTTER })
-        .map((line, index) => (index === 0
-          ? `${body}${c("fail", "-")} ${c("placeholder", line.trimStart().slice(2))}`
-          : `${" ".repeat(GUTTER + STEP)}${c("placeholder", line.trimStart())}`)))
-    }
+    out.push(...pathLines(check.paths, c))
     for (const remedy of [].concat(check.remedy || [])) out.push(...action(remedy, c))
     // The measured reason is the point of the check, so it is not dimmed: only
     // its label is grey, and on a low-contrast theme the number still reads.
@@ -62,6 +57,42 @@ function checkBlock(check, c) {
   return out
 }
 
+/**
+ * A shell command as an arrow, broken before a flag when it would not fit:
+ * a command is not prose, and a line break inside it is only valid with a
+ * backslash, the way the issue-creating example at the end of the report
+ * is printed.
+ */
+function commandLines(command, c) {
+  // A flag and its value travel together; a quoted value is one word.
+  const words = String(command).match(/"(?:[^"\\]|\\.)*"|\S+/g) || []
+  const units = []
+  for (const word of words) {
+    if (units.length && units[units.length - 1].startsWith("--") && !units[units.length - 1].includes(" ") && !word.startsWith("--")) {
+      units[units.length - 1] += ` ${word}`
+    } else {
+      units.push(word)
+    }
+  }
+  const room = COLUMNS - STEP - " \\".length
+  const lines = []
+  let line = ""
+  for (const unit of units) {
+    const next = line ? `${line} ${unit}` : unit
+    if (line && next.length > room) {
+      lines.push(line)
+      line = unit
+    } else {
+      line = next
+    }
+  }
+  lines.push(line)
+  const step = " ".repeat(STEP)
+  return lines.flatMap((text, index) => (index === 0
+    ? action(`${text}${lines.length > 1 ? " \\" : ""}`, c, { indent: 0 })
+    : [`${step}${c("typeable", `${text}${index < lines.length - 1 ? " \\" : ""}`)}`]))
+}
+
 export function renderSubmit(result, { colour = colourEnabled() } = {}) {
   const c = styler(colour)
   const out = []
@@ -106,7 +137,12 @@ export function renderSubmit(result, { colour = colourEnabled() } = {}) {
       else out.push(...wrap(check.detail, { indent: GUTTER }, c))
       out.push("")
     }
-    out.push(failed.length === 1 ? "Fix it, then run submit again." : "Fix them, then run submit again.")
+    if (result.reproduce) {
+      out.push(failed.length === 1 ? "Fix it, then run submit again:" : "Fix them, then run submit again:")
+      out.push(...commandLines(result.reproduce, c))
+    } else {
+      out.push(failed.length === 1 ? "Fix it, then run submit again." : "Fix them, then run submit again.")
+    }
     return out.join("\n")
   }
 
@@ -131,6 +167,11 @@ export function renderSubmit(result, { colour = colourEnabled() } = {}) {
   out.push(`${step}${c("typeable", "--body-file <the body above>")}`)
   out.push("")
   out.push(...wrap(`After it is created: ${result.afterSubmitting}`, {}, c))
+  if (result.reproduce) {
+    out.push("")
+    out.push("The same run, without prompting:")
+    out.push(...commandLines(result.reproduce, c))
+  }
   return out.join("\n")
 }
 
@@ -176,6 +217,79 @@ export function renderWatch(result, { colour = colourEnabled() } = {}) {
   return out.join("\n")
 }
 
+/** A list of paths at fault, the way a failing check prints them: a tinted dash, the path in the placeholder tint. */
+function pathLines(paths, c, dash = "fail") {
+  return paths.flatMap((path) => wrap(`- ${path}`, { indent: GUTTER + STEP, first: GUTTER })
+    .map((line, index) => (index === 0
+      ? `${body}${c(dash, "-")} ${c("placeholder", line.trimStart().slice(2))}`
+      : `${" ".repeat(GUTTER + STEP)}${c("placeholder", line.trimStart())}`)))
+}
+
+/**
+ * `omakit verify` for a person: the subject, the pin, the transport and its
+ * assumptions, then the official result in the register submit uses for its
+ * checks, and the statement last. Nothing here is Omakit's judgement: the
+ * outcome, the disposition, each finding's title, reason and actions, and a
+ * refusal's message are the marketplace's own text verbatim; the one thing
+ * added is the tag on each finding, blocks publication or review-required,
+ * which is read from the pinned policy's selectively blocking rules
+ * (`blockingRules`). `--json` prints the document itself.
+ */
+export function renderVerify(document, { colour = colourEnabled(), blockingRules = [] } = {}) {
+  const c = styler(colour)
+  const out = []
+  const { subject, marketplaceBaseline: section } = document
+  const tree = subject.cleanTree?.clean
+    ? `clean tree, proof ${subject.cleanTree.proof}`
+    : c("advisory", "dirty worktree")
+  out.push(...field("subject", subject.repository?.url || "no declared GitHub repository URL", c, { wrapValue: false }))
+  out.push(...field("commit", subject.commit, c, { wrapValue: false }))
+  out.push(...continuation(`${tree}, ${subject.mode} mode`, c))
+  out.push(...field("marketplace", `${section.pin.commit}, baseline ${section.pin.baselineVersion}, ${section.pin.enforcementMode}`, c))
+  out.push(...field("transport", section.transport, c))
+  if (section.assumedByAdapter?.length) out.push(...field("assumed", section.assumedByAdapter.join(", "), c))
+  out.push("")
+
+  const official = section.official
+  if (!section.invoked) {
+    out.push(`${head("unknown", "not run", "marketplace-pin", c)}`)
+    out.push(...wrap(section.skipReason || "the official baseline was not invoked", { indent: GUTTER }, c))
+  } else if (official?.error) {
+    // The official code refused the snapshot: that refusal is the result.
+    out.push(`${head("fail", official.error.code, "marketplace-pin", c)}`)
+    out.push(...wrap(official.error.message, { indent: GUTTER }, c))
+    for (const [key, value] of Object.entries(official.error)) {
+      if (key === "code" || key === "message") continue
+      out.push(...wrap(`- ${key}: ${typeof value === "string" ? value : JSON.stringify(value)}`, { indent: GUTTER + STEP, first: GUTTER }, c))
+    }
+  } else {
+    const findings = official.findings || []
+    const capabilities = official.capabilities || []
+    const state = official.outcome === "passed" ? "pass" : official.blocksApproval ? "fail" : "advisory"
+    out.push(`${head(state, official.outcome, "marketplace-pin", c)}`)
+    out.push(...wrap(official.outcome === "passed"
+      ? "no findings and no capabilities"
+      : `disposition ${official.disposition}, enforcement ${official.enforcementMode}, blocksApproval ${official.blocksApproval}`, { indent: GUTTER }, c))
+    for (const finding of findings) {
+      const blocks = blockingRules.includes(finding.ruleId)
+      out.push("")
+      out.push(head(blocks ? "fail" : "advisory", finding.ruleId, blocks ? "blocks publication" : "review-required", c))
+      out.push(...wrap([finding.title, finding.why].filter(Boolean).join(". ").replace(/\.\.\s/g, ". "), { indent: GUTTER }, c))
+      out.push(...pathLines((finding.evidence || []).map((entry) => `${entry.path}:${entry.line}`), c, blocks ? "fail" : "advisory"))
+      for (const remedy of finding.actions || []) out.push(...action(remedy, c))
+    }
+    for (const capability of capabilities) {
+      out.push("")
+      out.push(head("info", capability.id, "capability", c))
+      out.push(...wrap([capability.title, capability.why].filter(Boolean).join(". ").replace(/\.\.\s/g, ". "), { indent: GUTTER }, c))
+      out.push(...pathLines((capability.evidence || []).map((entry) => `${entry.path}:${entry.line}`), c, "info"))
+    }
+  }
+  out.push("")
+  out.push(...wrap(section.statement, {}, c))
+  return out.join("\n")
+}
+
 const DOCTOR_STATE = { ok: "pass", advice: "advisory", problem: "fail", info: "info", unknown: "unknown" }
 
 export function renderDoctor(result, { colour = colourEnabled() } = {}) {

package/tools/marketplace/submit.mjs

@@ -13,8 +13,8 @@
 
 import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
 import { requirePin } from "./pin.mjs"
-import { submissionContract, resolveCategory, resolveTags } from "./form.mjs"
-import { idUniverse, checkIdentity, baselineFigures, figure, liveRegistry, registrySourceDetail } from "./registry.mjs"
+import { submissionContract, resolveCategory, resolveTags, tagSlug } from "./form.mjs"
+import { idUniverse, checkIdentity, baselineFigures, figure, liveRegistry, registrySourceDetail, catalogPresentation, defaultPresentation } from "./registry.mjs"
 import { readTree } from "./tree.mjs"
 import { inspectTree } from "./plugin.mjs"
 import { findAgentControl, REMEDY as AGENT_CONTROL_REMEDY } from "./agent-control.mjs"
@@ -108,13 +108,42 @@ export function missingSubmitFlags(contract, { category, tags } = {}) {
   return { missing, categories: [...contract.categories], tags: [...contract.tagLabels], maximumTags: contract.maximumTags }
 }
 
+/** A shell word: quoted when it holds anything a shell would read. */
+function shellWord(value) {
+  const text = String(value)
+  return /^[A-Za-z0-9_@%+=:,./~-]+$/.test(text) ? text : `"${text.replace(/(["\\$`])/g, "\\$1")}"`
+}
+
+/**
+ * The command line that repeats this run without asking anything: the target
+ * as given, the category and tags the run used wherever they came from, and
+ * every other flag that was given. Printed at the end of the report and
+ * carried in --json as `reproduce`, so the next run needs no prompt.
+ */
+export function reproduceCommand({ target, category, tags, pluginName, notes, suggestedTag, allowDirty, offline }) {
+  const parts = ["omakit", "submit", shellWord(target)]
+  if (category) parts.push("--category", shellWord(category))
+  if (tags?.length) parts.push("--tags", shellWord(tags.map(tagSlug).join(",")))
+  if (pluginName) parts.push("--name", shellWord(pluginName))
+  if (notes) parts.push("--notes", shellWord(notes))
+  if (suggestedTag) parts.push("--suggest-tag", shellWord(suggestedTag))
+  if (allowDirty) parts.push("--allow-dirty")
+  if (offline) parts.push("--offline")
+  return parts.join(" ")
+}
+
 /**
  * @param {{ repoRoot: string, target: string, category?: string, tags?: string|string[],
  *           notes?: string, suggestedTag?: string, pluginName?: string,
  *           allowDirty?: boolean, offline?: boolean,
- *           readRegistry?: typeof liveRegistry }} options
+ *           readRegistry?: typeof liveRegistry,
+ *           chooser?: (question: { contract: object, defaults: object, missing: string[] }) => Promise<{ category?: string, tags?: string[] }> }} options
  *   `readRegistry` is injectable for tests; the default reads the marketplace's
- *   current HEAD, or the pin with `offline`.
+ *   current HEAD, or the pin with `offline`. `chooser` answers for a missing
+ *   --category or --tags on an unlisted plugin; without one, that is a usage
+ *   error (SubmitError "usage", with the form's lists under `usage`), decided
+ *   after the registry so a listed plugin is never asked for a choice that
+ *   does not matter.
  */
 export async function submitPreflight(options) {
   const { repoRoot } = options
@@ -213,6 +242,30 @@ export async function submitPreflight(options) {
 
   const identity = checkIdentity(universe, { id: tree.pluginId, repositoryUrl: subject.repository.url })
   const identityRemedy = identity.ok ? null : identityRemedies(identity, universe, await newerCommitAction(pinDir))
+  const listed = identity.problems.some((problem) => problem.code === "plugin-id-listed" || problem.code === "submission-repository-listed")
+
+  // The category and the tags are decided here, after the registry. Measured
+  // before this: a listed plugin was asked for both and then told there was
+  // nothing to submit. A listed plugin needs neither; an unlisted plugin with
+  // either missing is asked through `chooser` when there is one, and is a
+  // usage error otherwise. The default offered is the marketplace's own
+  // presentation for the manifest's kinds, read from the pinned catalog
+  // builder.
+  let chosenCategory = options.category
+  let chosenTags = options.tags
+  const missing = missingSubmitFlags(contract, { category: chosenCategory, tags: chosenTags })
+  const moot = Boolean(missing) && listed
+  if (missing && !listed) {
+    if (!options.chooser) {
+      const error = new SubmitError("usage", `submit needs ${missing.missing.join(" and ")}`)
+      error.usage = missing
+      throw error
+    }
+    const defaults = defaultPresentation(catalogPresentation(pinDir), tree.manifest?.kinds)
+    const answers = await options.chooser({ contract, defaults, missing: missing.missing })
+    if (answers?.category) chosenCategory = answers.category
+    if (answers?.tags) chosenTags = answers.tags
+  }
   checks.push(check("identity.available", {
     source: "marketplace-pin",
     why: `The marketplace refuses \`plugin-id-listed\`, \`plugin-id-retired\`, \`reserved-plugin-id\` and \`submission-repository-listed\`. Checked here against ${figure(universe.counts.listedIds)} listed ids, ${figure(universe.counts.retiredIds)} retired ids and ${figure(universe.counts.listedRepositories)} listed repositories from the registry and catalog at the commit the detail names, and the reserved namespace from the pinned catalog builder. The registry is read from the marketplace's current HEAD when the network is there because the pin's copy is stale within hours: registry.json changed in 4,201 of the marketplace's 4,293 commits in the 30 days to 2026-09-13, about 140 a day (docs/MEASUREMENTS.md M7). Code and the form are only ever read from the pin.`,
@@ -226,8 +279,11 @@ export async function submitPreflight(options) {
   // --- the submission itself ------------------------------------------------
 
   const pluginName = String(options.pluginName || tree.pluginName || "").trim()
-  const category = resolveCategory(contract, options.category)
-  const tags = resolveTags(contract, options.tags)
+  const category = resolveCategory(contract, chosenCategory)
+  const tags = resolveTags(contract, chosenTags)
+  // For a listed plugin the editorial choice is moot: these wait on the
+  // identity check rather than failing for a flag nobody needed to give.
+  const mootWaitsOn = moot ? ["identity.available"] : []
 
   checks.push(check("submission.title", {
     source: "marketplace-pin",
@@ -245,6 +301,7 @@ export async function submitPreflight(options) {
     verdict: category.ok,
     detail: category.ok ? `category: ${category.value}` : `${category.reason}. Choose one of: ${contract.categories.join(", ")}`,
     remedy: category.ok ? null : "Pass --category with one of the listed values.",
+    waitedOn: mootWaitsOn,
   }))
 
   checks.push(check("submission.tags", {
@@ -253,11 +310,12 @@ export async function submitPreflight(options) {
     verdict: tags.ok,
     detail: tags.ok ? `tags: ${tags.value.join(", ")}` : `${tags.reason}. Choose from: ${contract.tagLabels.join(", ")}`,
     remedy: tags.ok ? null : "Pass --tags with 1 to 3 comma-separated values from the list.",
+    waitedOn: mootWaitsOn,
   }))
 
   // The body needs every field above and the repository URL below; the three
   // checks that read it wait on whichever of those failed.
-  const bodyWaitsOn = [
+  const bodyWaitsOn = moot ? mootWaitsOn : [
     !pluginName && "submission.title",
     !category.ok && "submission.category",
     !tags.ok && "submission.tags",
@@ -409,6 +467,16 @@ export async function submitPreflight(options) {
       note: "The marketplace validates the default-branch HEAD it resolves when the issue is opened or edited. After submitting, use `omakit watch <issue-url>` to see whether that validated commit has fallen behind.",
     },
     plugin: { id: tree.pluginId, name: pluginName },
+    reproduce: reproduceCommand({
+      target: options.target,
+      category: category.ok ? category.value : null,
+      tags: tags.ok ? tags.value : null,
+      pluginName: options.pluginName,
+      notes: options.notes,
+      suggestedTag: options.suggestedTag,
+      allowDirty: options.allowDirty === true,
+      offline: options.offline === true,
+    }),
     checks,
     ready,
     blocking: blocking.map((entry) => entry.id),

package/tools/marketplace/usage.mjs

@@ -45,6 +45,10 @@ export const COMMANDS = Object.freeze([
     lines: [
       "Every check that is knowable before submitting, the resolved commit, and",
       "the exact issue title and body. Prints them. Never posts anything.",
+      "A listed plugin is refused at identity and needs no category or tags.",
+      "An unlisted one without them is asked at a terminal, with the form's",
+      "lists numbered; in a pipe or with --json that is a usage error, exit 2.",
+      "The report ends with the command line that repeats the run unasked.",
     ],
   },
   {
@@ -56,10 +60,11 @@ export const COMMANDS = Object.freeze([
     ],
   },
   {
-    signature: "omakit verify <target> [--allow-dirty] [--out <file>]",
+    signature: "omakit verify <target> [--allow-dirty] [--json] [--out <file>]",
     lines: [
       "The official marketplace security baseline over the local Git transport,",
-      "reported verbatim beside the pin identity.",
+      "reported verbatim beside the pin identity. A report for a person; --json",
+      "prints the document itself, and --out writes it to a file.",
     ],
   },
   {