pan-wizard 3.26.0 → 3.28.0

package/scripts/build-plugin.js

@@ -8,6 +8,9 @@
  *   agents/pan-*.md               agent definitions
  *   hooks/hooks.json              PAN hooks with ${CLAUDE_PLUGIN_ROOT} paths
  *   hooks/pan-*.js                hook scripts
+ *   .mcp.json                     MCP bridge declaration (${CLAUDE_PLUGIN_ROOT} path)
+ *   workflows/pan-*.js            native workflow scripts, agentType namespaced
+ *                                 `<plugin>:<agent>` (plugin agents load scoped)
  *   pan-wizard-core/              dispatcher + modules + workflows + templates
  *
  * Distribution status: built ALONGSIDE the loose-file installer. Marketplace
@@ -38,7 +41,28 @@ const fs = require('fs');
 const path = require('path');
 
 const ROOT = path.join(__dirname, '..');
-const OUT = path.join(ROOT, 'dist', 'pan-wizard-plugin');
+// Output directory. `PAN_PLUGIN_OUT` overrides the default so that callers which
+// may run CONCURRENTLY — test files under `node --test`, which runs files in
+// parallel — each build into their own directory instead of racing on one:
+// one process's `rmSync` below landed in the middle of another's copy
+// (ENOENT mid-tree, and an empty stdout for plugin-path.js) on 2026-09-10.
+const OUT = process.env.PAN_PLUGIN_OUT
+  ? path.resolve(process.env.PAN_PLUGIN_OUT)
+  : path.join(ROOT, 'dist', 'pan-wizard-plugin');
+
+/**
+ * Refuse to wipe a directory that is not a previous plugin build. The default
+ * path is ours by construction; an override is a user-supplied path, and
+ * `rmSync(recursive)` on the wrong one is unrecoverable. A directory that does
+ * not exist yet, is empty, or carries our own manifest is fair game.
+ */
+function assertSafeToReplace(dir) {
+  if (!fs.existsSync(dir)) return;
+  const entries = fs.readdirSync(dir);
+  if (entries.length === 0) return;
+  if (fs.existsSync(path.join(dir, '.claude-plugin', 'plugin.json'))) return;
+  throw new Error(`build-plugin: refusing to replace ${dir} — it is non-empty and does not look like a previous plugin build (no .claude-plugin/plugin.json)`);
+}
 const pkg = require(path.join(ROOT, 'package.json'));
 const lib = require(path.join(ROOT, 'bin', 'install-lib.cjs'));
 
@@ -73,13 +97,15 @@ function copyTree(srcDir, destDir, transformMd) {
 
 function main() {
   // Clean output
+  assertSafeToReplace(OUT);
   fs.rmSync(OUT, { recursive: true, force: true });
   fs.mkdirSync(path.join(OUT, '.claude-plugin'), { recursive: true });
 
   // 1. Manifest
+  const manifest = lib.buildPluginManifest(pkg);
   fs.writeFileSync(
     path.join(OUT, '.claude-plugin', 'plugin.json'),
-    JSON.stringify(lib.buildPluginManifest(pkg), null, 2) + '\n'
+    JSON.stringify(manifest, null, 2) + '\n'
   );
 
   // 2. Commands (Claude flavor, plugin-root-relative paths)
@@ -109,7 +135,7 @@ function main() {
   // deliberately bypasses rewriteContent().
   fs.writeFileSync(
     path.join(OUT, 'commands', 'pan-plugin-selftest.md'),
-    lib.buildPluginSelfTestCommand(CONTENT_PREFIX.replace(/\/$/, ''))
+    lib.buildPluginSelfTestCommand(CONTENT_PREFIX.replace(/\/$/, ''), manifest.name)
   );
 
   // 4b. MCP registration. The server itself rides along inside pan-wizard-core
@@ -125,12 +151,31 @@ function main() {
   fs.rmSync(path.join(OUT, 'pan-wizard-core', 'learnings', 'internal'), { recursive: true, force: true });
   fs.writeFileSync(path.join(OUT, 'pan-wizard-core', 'VERSION'), pkg.version);
 
+  // 6. Native workflows. A plugin loads `workflows/` at its root and exposes each
+  // script as `/<plugin>:<meta.name>`. Until 2026-09 the builder never wrote this
+  // directory, so the plugin shipped LESS than a loose-file install (which has
+  // written `.claude/workflows/` since 2026-06). One thing differs from that
+  // install: the scripts spawn PAN agents by name, and plugin agents load under a
+  // SCOPED name — `agents/pan-reviewer.md` here is `pan-wizard:pan-reviewer`
+  // (plugins-reference, read 2026-09-10) — so a bare `agentType: 'pan-…'` that
+  // resolves in a loose install would not resolve inside the plugin. The rewrite
+  // is applied to the plugin copy only; the installer keeps bare names.
+  fs.mkdirSync(path.join(OUT, 'workflows'), { recursive: true });
+  const workflowScripts = lib.buildNativeWorkflowScripts();
+  for (const { name, content } of workflowScripts) {
+    fs.writeFileSync(
+      path.join(OUT, 'workflows', name),
+      lib.namespaceWorkflowAgentTypes(content, manifest.name)
+    );
+  }
+
   // Sanity report
   const count = (p) => { try { return fs.readdirSync(p).length; } catch { return 0; } };
   console.log('PAN plugin built at', path.relative(ROOT, OUT));
   console.log('  commands/pan:', count(path.join(OUT, 'commands', 'pan')));
   console.log('  agents:', count(path.join(OUT, 'agents')));
   console.log('  hooks:', count(path.join(OUT, 'hooks')));
+  console.log('  workflows:', workflowScripts.length);
   console.log('  version:', pkg.version);
 }
 

package/scripts/generate-skills-docs.py

@@ -48,7 +48,7 @@ GROUP_ORDER = [
 # Dev skill categorization (filename -> category)
 DEV_CATEGORIES = {
     "Development Workflow": [
-        "pandev", "execplan", "superplan", "featureAI", "review",
+        "pandev", "execplan", "superplan", "featureAI", "review", "reality-check",
     ],
     "Testing & Verification": [
         "test", "quick", "pantest", "check", "check-platform", "auditai",

package/scripts/release-check.js

@@ -3,7 +3,7 @@
  * release-check.js — Pre-publish validation gate.
  *
  * Wired into `prepublishOnly` so `npm publish` fails BEFORE upload if any
- * gate is red. Runs seven checks in order; first failure aborts.
+ * gate is red. Runs eight checks in order; first failure aborts.
  *
  *   1. build:hooks      — hook scripts copy/build cleanly
  *   2. test:all         — full test suite (unit + scenario) passes
@@ -57,7 +57,7 @@ function run(cmd, args, opts = {}) {
 }
 
 // Gate 1: build:hooks
-process.stderr.write('\n[release-check] Gate 1/7: build:hooks\n');
+process.stderr.write('\n[release-check] Gate 1/8: build:hooks\n');
 {
   const r = run('npm', ['run', 'build:hooks']);
   logGate('build:hooks', r.status === 0, r.status !== 0 ? `exit ${r.status}` : '');
@@ -65,7 +65,7 @@ process.stderr.write('\n[release-check] Gate 1/7: build:hooks\n');
 }
 
 // Gate 2: test:all
-process.stderr.write('\n[release-check] Gate 2/7: test:all\n');
+process.stderr.write('\n[release-check] Gate 2/8: test:all\n');
 {
   const r = run('npm', ['run', 'test:all']);
   logGate('test:all', r.status === 0, r.status !== 0 ? `exit ${r.status}` : '');
@@ -74,9 +74,9 @@ process.stderr.write('\n[release-check] Gate 2/7: test:all\n');
 
 // Gate 3: npm audit (production deps only)
 if (SKIP_AUDIT) {
-  process.stderr.write('\n[release-check] Gate 3/7: npm audit (SKIPPED)\n');
+  process.stderr.write('\n[release-check] Gate 3/8: npm audit (SKIPPED)\n');
 } else {
-  process.stderr.write('\n[release-check] Gate 3/7: npm audit --omit=dev\n');
+  process.stderr.write('\n[release-check] Gate 3/8: npm audit --omit=dev\n');
   const r = run('npm', ['audit', '--omit=dev', '--audit-level=high'], { capture: true });
   // npm audit exits non-zero on findings. We tolerate moderate; fail on high+.
   const ok = r.status === 0;
@@ -88,7 +88,7 @@ if (SKIP_AUDIT) {
 }
 
 // Gate 4: doc-lint counts on user-facing docs (count-SSoT enforcement)
-process.stderr.write('\n[release-check] Gate 4/7: doc-lint counts docs/\n');
+process.stderr.write('\n[release-check] Gate 4/8: doc-lint counts docs/\n');
 {
   const tools = path.join(REPO_ROOT, 'pan-wizard-core', 'bin', 'pan-tools.cjs');
   const docsDir = path.join(REPO_ROOT, 'docs');
@@ -103,7 +103,7 @@ process.stderr.write('\n[release-check] Gate 4/7: doc-lint counts docs/\n');
 
 // Gate 5: doc↔code link graph resolves (anti-fake — a doc cannot reference a
 // code anchor that doesn't exist; deterministic, self-enforcing exit 1).
-process.stderr.write('\n[release-check] Gate 5/7: links validate\n');
+process.stderr.write('\n[release-check] Gate 5/8: links validate\n');
 {
   const tools = path.join(REPO_ROOT, 'pan-wizard-core', 'bin', 'pan-tools.cjs');
   const r = run('node', [tools, 'links', 'validate', '--raw'], { capture: true });
@@ -125,16 +125,21 @@ process.stderr.write('\n[release-check] Gate 5/7: links validate\n');
 
 // Gate 6: npm pack — produces a non-empty, sanely-sized tarball (read the file,
 // never parse stdout)
-process.stderr.write('\n[release-check] Gate 6/7: npm pack (size sanity)\n');
+process.stderr.write('\n[release-check] Gate 6/8: npm pack (size sanity)\n');
 {
   const tmp6 = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-pack-'));
   const r = run('npm', ['pack', '--pack-destination', tmp6], { capture: true });
   const tgz = r.status === 0 ? fs.readdirSync(tmp6).find(f => f.endsWith('.tgz')) : null;
   const size = tgz ? fs.statSync(path.join(tmp6, tgz)).size : 0;
   const sizeMB = (size / 1024 / 1024).toFixed(2);
+  // R8: "zero runtime dependencies" is a headline claim (README, COMPARISON.md); a
+  // dependency added by accident must turn the release red before it ships. The unit
+  // pin is tests/package-contract.test.cjs; this is the publish-time backstop.
+  const deps = Object.keys(require(path.join(REPO_ROOT, 'package.json')).dependencies || {});
+  const zeroDeps = deps.length === 0;
   // Sane = a non-empty tarball under 50MB (large for a zero-runtime-dep tool)
-  const ok = r.status === 0 && !!tgz && size > 0 && size < 50 * 1024 * 1024;
-  logGate('npm pack', ok, tgz ? `${sizeMB}MB tarball` : `no tarball (exit ${r.status})`);
+  const ok = r.status === 0 && !!tgz && size > 0 && size < 50 * 1024 * 1024 && zeroDeps;
+  logGate('npm pack', ok, (tgz ? `${sizeMB}MB tarball` : `no tarball (exit ${r.status})`) + (zeroDeps ? '' : `; runtime dependencies present: ${deps.join(', ')}`));
   fs.rmSync(tmp6, { recursive: true, force: true });
   if (!ok) {
     process.stderr.write((r.stderr || '') + '\n');
@@ -144,9 +149,9 @@ process.stderr.write('\n[release-check] Gate 6/7: npm pack (size sanity)\n');
 
 // Gate 7: smoke install — pack and install into temp dir, run pan-tools
 if (SKIP_SMOKE) {
-  process.stderr.write('\n[release-check] Gate 7/7: smoke install (SKIPPED)\n');
+  process.stderr.write('\n[release-check] Gate 7/8: smoke install (SKIPPED)\n');
 } else {
-  process.stderr.write('\n[release-check] Gate 7/7: smoke install (npm pack + install + sanity)\n');
+  process.stderr.write('\n[release-check] Gate 7/8: smoke install (npm pack + install + sanity)\n');
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-smoke-'));
   try {
     // Pack — read the .tgz npm writes to tmpDir; never parse its stdout (see note).
@@ -192,6 +197,47 @@ if (SKIP_SMOKE) {
   }
 }
 
+// Gate 8: distribution bundles — both plugin builders produce a manifest. Built into
+// temp dirs (never dist/) so the gate cannot race a concurrently running test and
+// leaves the checkout untouched. A bundle that fails to build is a release that
+// ships a broken marketplace entry.
+process.stderr.write('\n[release-check] Gate 8/8: distribution bundles (build:plugin + build:agent-plugin)\n');
+{
+  const tmp8 = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-bundles-'));
+  try {
+    const claudeOut = path.join(tmp8, 'claude');
+    const agentOut = path.join(tmp8, 'agent');
+    const a = run('node', [path.join(REPO_ROOT, 'scripts', 'build-plugin.js')], { capture: true, env: { ...process.env, PAN_PLUGIN_OUT: claudeOut } });
+    const b = run('node', [path.join(REPO_ROOT, 'scripts', 'build-agent-plugin.js')], { capture: true, env: { ...process.env, PAN_AGENT_PLUGIN_OUT: agentOut } });
+    const okA = a.status === 0 && fs.existsSync(path.join(claudeOut, '.claude-plugin', 'plugin.json'));
+    const okB = b.status === 0 && fs.existsSync(path.join(agentOut, 'plugin.json')) && fs.existsSync(path.join(agentOut, 'mcp.json'));
+    // R10: .agents/plugins/marketplace.json (Codex) and .github/plugin/marketplace.json
+    // (Copilot) resolve to ./dist/pan-agent-plugin with no rebuild-on-resolve — unlike
+    // the Claude `command` source. A stale dist/ shipped silently on 2026-09-10 (built
+    // before the vendor-directory commit). Compare it with the fresh build when it
+    // exists; the gate stays read-only and never writes dist/.
+    let staleDetail = '';
+    const distAgent = path.join(REPO_ROOT, 'dist', 'pan-agent-plugin');
+    if (okB && fs.existsSync(distAgent)) {
+      const { dirDigest } = require(path.join(REPO_ROOT, 'bin', 'install-lib.cjs'));
+      if (dirDigest(distAgent) !== dirDigest(agentOut)) {
+        staleDetail = 'dist/pan-agent-plugin is STALE — run `npm run build:agent-plugin` (the Codex and Copilot marketplaces install from it)';
+      }
+    }
+    const ok8 = okA && okB && !staleDetail;
+    const detail = ok8
+      ? 'Claude plugin + Agent Plugins bundle built' + (fs.existsSync(distAgent) ? '; dist/pan-agent-plugin matches the fresh build' : '')
+      : staleDetail || `claude:${okA ? 'ok' : 'FAIL exit ' + a.status} agent-plugins:${okB ? 'ok' : 'FAIL exit ' + b.status}`;
+    logGate('distribution bundles', ok8, detail);
+    if (!ok8) {
+      process.stderr.write((a.stderr || '') + (b.stderr || '') + '\n');
+      process.exit(1);
+    }
+  } finally {
+    try { fs.rmSync(tmp8, { recursive: true, force: true }); } catch { /* best-effort */ }
+  }
+}
+
 // Summary
 process.stderr.write('\n[release-check] Summary:\n');
 for (const c of checks) {