open-plan-annotator 1.0.1 → 1.0.2

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "open-plan-annotator",
       "source": "./",
       "description": "Interactive plan annotation UI: review, strikethrough, and comment on Claude's plans before approving. Fully local, no external services.",
-      "version": "1.0.1",
+      "version": "1.0.2",
       "author": {
         "name": "ndom91"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "open-plan-annotator",
   "description": "Interactive plan annotation UI: review, strikethrough, and comment on Claude's plans before approving. Fully local, no external services.",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "author": {
     "name": "ndom91"
   },

package/bin/open-plan-annotator.cjs

@@ -39,12 +39,22 @@ if (!fs.existsSync(binaryPath)) {
   }
 }
 
+// Detect package manager so the binary can suggest the right update command
+function detectPackageManager() {
+  const ua = process.env.npm_config_user_agent || "";
+  if (ua.startsWith("pnpm")) return "pnpm";
+  if (ua.startsWith("yarn")) return "yarn";
+  if (ua.startsWith("bun")) return "bun";
+  return "npm";
+}
+
 // Spawn the binary with detached so it can outlive this wrapper.
 // We pipe stdout to detect the JSON hook output, then forward it and exit
 // immediately — the binary keeps its server alive in the background.
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: ["pipe", "pipe", "inherit"],
   detached: true,
+  env: { ...process.env, OPEN_PLAN_PKG_MANAGER: detectPackageManager() },
 });
 
 child.stdin.write(stdinBuffer);

package/install.cjs

@@ -9,6 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const zlib = require("zlib");
 const https = require("https");
+const crypto = require("crypto");
 
 const VERSION = require("./package.json").version;
 const REPO = "ndom91/open-plan-annotator";
@@ -35,6 +36,10 @@ function getDownloadUrl() {
   return `https://github.com/${REPO}/releases/download/v${VERSION}/${asset}.tar.gz`;
 }
 
+function getReleaseApiUrl() {
+  return `https://api.github.com/repos/${REPO}/releases/tags/v${VERSION}`;
+}
+
 function fetch(url, redirects) {
   if (redirects === undefined) redirects = 5;
   return new Promise((resolve, reject) => {
@@ -55,6 +60,85 @@ function fetch(url, redirects) {
   });
 }
 
+async function fetchJson(url) {
+  const buffer = await fetch(url);
+  return JSON.parse(buffer.toString("utf8"));
+}
+
+function sha256Hex(buffer) {
+  return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+
+function parseChecksumManifest(manifestText) {
+  const checksums = new Map();
+
+  for (const rawLine of manifestText.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+
+    const bsdStyle = line.match(/^SHA256\s*\(([^)]+)\)\s*=\s*([a-fA-F0-9]{64})$/);
+    if (bsdStyle) {
+      checksums.set(bsdStyle[1].trim(), bsdStyle[2].toLowerCase());
+      continue;
+    }
+
+    const gnuStyle = line.match(/^([a-fA-F0-9]{64})\s+[* ]?(.+)$/);
+    if (gnuStyle) {
+      checksums.set(gnuStyle[2].trim(), gnuStyle[1].toLowerCase());
+    }
+  }
+
+  return checksums;
+}
+
+function selectChecksumAsset(assets) {
+  const checksumAssets = assets
+    .filter((asset) => {
+      const lower = asset.name.toLowerCase();
+      return (
+        (lower.includes("sha256") || lower.includes("checksum")) &&
+        (lower.endsWith(".txt") || lower.endsWith(".sha256") || lower.endsWith(".sha256sum") || lower.endsWith(".sha256sums"))
+      );
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  return checksumAssets[0] || null;
+}
+
+async function resolveReleaseAssetAndChecksum() {
+  const release = await fetchJson(getReleaseApiUrl());
+  const releaseAssets = Array.isArray(release.assets) ? release.assets : [];
+  const key = getPlatformKey();
+  const assetBaseName = PLATFORM_MAP[key];
+  if (!assetBaseName) {
+    throw new Error(`Unsupported platform ${key}`);
+  }
+
+  const assetName = `${assetBaseName}.tar.gz`;
+  const asset = releaseAssets.find((entry) => entry.name === assetName);
+  if (!asset) {
+    throw new Error(`Release v${VERSION} is missing asset ${assetName}`);
+  }
+
+  const checksumAsset = selectChecksumAsset(releaseAssets);
+  if (!checksumAsset) {
+    throw new Error(`Release v${VERSION} does not contain a checksum manifest asset`);
+  }
+
+  const checksumManifest = (await fetch(checksumAsset.browser_download_url)).toString("utf8");
+  const checksums = parseChecksumManifest(checksumManifest);
+  const expectedSha256 = checksums.get(assetName);
+  if (!expectedSha256) {
+    throw new Error(`Checksum manifest does not contain ${assetName}`);
+  }
+
+  return {
+    assetName,
+    assetUrl: asset.browser_download_url,
+    expectedSha256,
+  };
+}
+
 function extractBinaryFromTarGz(buffer) {
   const tarBuffer = zlib.gunzipSync(buffer);
   let offset = 0;
@@ -82,24 +166,49 @@ function extractBinaryFromTarGz(buffer) {
 async function main() {
   const destDir = path.join(__dirname, "bin");
   const destPath = path.join(destDir, "open-plan-annotator-binary");
+  const tempPath = `${destPath}.tmp-${process.pid}-${Date.now()}`;
 
   // Skip if binary already exists
   if (fs.existsSync(destPath)) {
     return;
   }
 
-  const url = getDownloadUrl();
+  const fallbackUrl = getDownloadUrl();
   console.error(`Downloading open-plan-annotator for ${getPlatformKey()}...`);
 
-  const buffer = await fetch(url);
-  const binaryBuffer = extractBinaryFromTarGz(buffer);
+  try {
+    const { assetName, assetUrl, expectedSha256 } = await resolveReleaseAssetAndChecksum();
+    const archiveBuffer = await fetch(assetUrl);
+    const actualSha256 = sha256Hex(archiveBuffer);
 
-  if (!fs.existsSync(destDir)) {
-    fs.mkdirSync(destDir, { recursive: true });
-  }
+    if (actualSha256 !== expectedSha256) {
+      throw new Error(
+        `Checksum verification failed for ${assetName} (expected ${expectedSha256}, got ${actualSha256})`,
+      );
+    }
 
-  fs.writeFileSync(destPath, binaryBuffer, { mode: 0o755 });
-  console.error(`Installed open-plan-annotator to ${destPath}`);
+    const binaryBuffer = extractBinaryFromTarGz(archiveBuffer);
+
+    if (!fs.existsSync(destDir)) {
+      fs.mkdirSync(destDir, { recursive: true });
+    }
+
+    fs.writeFileSync(tempPath, binaryBuffer, { mode: 0o755 });
+    fs.renameSync(tempPath, destPath);
+    fs.chmodSync(destPath, 0o755);
+    console.error(`Installed open-plan-annotator to ${destPath}`);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tempPath);
+    } catch {
+      // Temp file may not exist
+    }
+
+    const message = err && err.message ? err.message : String(err);
+    console.error(`open-plan-annotator: install failed: ${message}`);
+    console.error(`Fallback URL for diagnostics: ${fallbackUrl}`);
+    throw err;
+  }
 }
 
 main().catch((err) => {

package/opencode/bridge.js

@@ -123,6 +123,14 @@ function findWrapperOnPath() {
   }
 }
 
+function detectPackageManager() {
+  const ua = process.env.npm_config_user_agent || "";
+  if (ua.startsWith("pnpm")) return "pnpm";
+  if (ua.startsWith("yarn")) return "yarn";
+  if (ua.startsWith("bun")) return "bun";
+  return "npm";
+}
+
 /** Ensure the compiled binary exists, downloading if necessary. */
 function ensureBinary() {
   if (existsSync(LOCAL_BINARY_PATH)) {
@@ -192,7 +200,10 @@ export async function runPlanReview(options) {
     const child = spawn(BINARY_PATH, [], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
-      env: process.env,
+      env: {
+        ...process.env,
+        OPEN_PLAN_PKG_MANAGER: process.env.OPEN_PLAN_PKG_MANAGER || detectPackageManager(),
+      },
       detached: true,
     });
 
@@ -268,4 +279,4 @@ export async function runPlanReview(options) {
     approved: false,
     feedback: decision.message,
   };
-}
+}

package/opencode/index.js

@@ -5,14 +5,14 @@ import { resolveImplementationHandoff } from "./config.js";
 const PLAN_REVIEW_INSTRUCTIONS = `## Plan Review Workflow
 
 For non-trivial implementation work, create a plan first and call the \`submit_plan\` tool.
-The user will review the plan in a browser and either approve it or request changes.
+The user will review the plan in a browser UI and either approve it or request changes.
 
-- If approved, proceed with implementation.
-- If changes are requested, revise the plan and call \`submit_plan\` again.
+- If the tool returns that the plan was **approved**: immediately begin writing code. Do NOT call \`submit_plan\` again — the plan phase is complete.
+- If the tool returns **revision feedback**: revise the plan based on the feedback, then call \`submit_plan\` again with the updated plan.
 
-Do not begin implementation until the plan is approved.`;
+Only call \`submit_plan\` once per plan version. After approval, your sole job is to implement what was approved.`;
 
-const IMPLEMENTATION_PROMPT = "Proceed with implementation.";
+const IMPLEMENTATION_PROMPT = "The plan has been approved by the user. Begin implementing it now — write code, create files, and make changes as described in the plan. Do not re-submit or re-review the plan.";
 
 function getErrorMessage(error) {
   if (error instanceof Error && error.message) {
@@ -148,7 +148,10 @@ export const OpenPlanAnnotatorPlugin = async (ctx) => {
           });
 
           if (result.approved) {
-            const lines = ["Plan approved by the user."];
+            const lines = [
+              "Plan approved by the user.",
+              "Do NOT call `submit_plan` again. The planning phase is finished.",
+            ];
 
             if (args.summary) {
               lines.push(`Summary: ${args.summary}`);
@@ -163,7 +166,7 @@ export const OpenPlanAnnotatorPlugin = async (ctx) => {
               }
             }
 
-            lines.push("Proceed with implementation.");
+            lines.push("Begin implementing the approved plan now — write code and make changes.");
             return lines.join("\n\n");
           }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-plan-annotator",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "type": "module",
   "description": "Fully local plugin for interactive plan annotation from your Agentic assistants",
   "author": "ndom91",