rigline 1.0.0-alpha.4 → 1.0.0-alpha.6

package/README.md

@@ -1,7 +1,7 @@
 # rigline
 
-The command-line surface for [Rigline](https://github.com/Rigline/Rigline), a plugin layer for the
-Claude Code VS Code extension.
+The command for [Rigline](https://github.com/Rigline/Rigline), a plugin layer for the Claude Code
+VS Code extension.
 
 Rigline injects a small loader into the installed extension's webview, gives plugins a
 capability-scoped context to write against, and harvests the identifiers those plugins depend on
@@ -13,6 +13,11 @@ rather than a breakage to chase.
     npm install -g rigline
     rigline install
 
+The first command you run fetches the engine, [`@rigline/core`](https://www.npmjs.com/package/@rigline/core),
+into `~/.rigline/engine` and runs it from there. It takes a few seconds and needs the registry;
+after that nothing reaches the network unless you ask it to. If that directory is ever in a bad
+state, delete it and run any command again.
+
 `install` finds every installed version of the extension, harvests it, bakes the discovered plugins
 into a payload and injects the loader. It keeps a byte-faithful backup of each bundle it touches,
 and `rigline restore` puts everything back using nothing but Node and the backup.
@@ -30,8 +35,10 @@ directory until *Developer: Reload Window*.
 
     rigline add SPEC   install a plugin from a directory or npm, and re-inject
     rigline remove N   delete a plugin rigline installed, and re-inject
-    rigline update     move each npm plugin to what its tag resolves to
-    rigline list       every plugin, in load order: origin, source, switch, what it can do
+    rigline disable N  switch a plugin off, and re-inject
+    rigline enable N   switch it back on, and re-inject
+    rigline update     move the engine and every npm plugin to what its tag resolves to
+    rigline list       every plugin, in load order: version, origin, source, switch, what it can do
 
     rigline build      build a plugin to one browser ES module
     rigline dev        rebuild and re-inject as you edit
@@ -39,9 +46,25 @@ directory until *Developer: Reload Window*.
     rigline diff A B   identifier drift between two extension directories
     rigline doctor     install state per version, as a pasteable report
 
-`add` never runs a package manager: a published plugin is one bundled ES module and a manifest, so
-there is nothing to resolve. A version must reach a minimum age (a day, by default) before `add` or
-`update` will take it, and a withheld version is named rather than skipped in silence.
+    rigline --version  this command's version and the installed engine's
+    rigline --help     the whole surface, from the engine
+
+`add` never runs a package manager for a plugin: a published plugin is one bundled ES module and a
+manifest, so there is nothing to resolve. A version must reach a minimum age (a day, by default)
+before `add` or `update` will take it, and a withheld version is named rather than skipped in
+silence. `update` applies the same rule to the engine, and says which version it moved from so
+going back is one command.
+
+## How it is put together
+
+`rigline` is a small retrieval layer. It fetches bytes — a plugin tarball, the engine — checks them,
+and hands them over; `@rigline/core` does everything else and answers every verb above. The split is
+not decoration: a process cannot replace the package it is running out of, so whatever performs an
+update has to sit above the thing being updated.
+
+**It belongs in no project's dependencies.** If you are writing plugins, your workspace declares
+`@rigline/core` and runs `rigline-engine`; `npm create rigline-plugin` scaffolds it that way. A
+project that can declare dependencies does not need a delivery mechanism.
 
 ## Writing a plugin
 

package/dist/engine.js

@@ -0,0 +1,238 @@
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { UserError } from "./errors.js";
+import { releaseAgeProblem, resolveVersion } from "./registry.js";
+export const ENGINE_PACKAGE = "@rigline/core";
+export const ENGINE_BIN = "rigline-engine";
+export function riglineHome(env = process.env) {
+    const override = env.RIGLINE_HOME;
+    return override && override.length > 0 ? override : join(homedir(), ".rigline");
+}
+export function engineDir(home = riglineHome()) {
+    return join(home, "engine");
+}
+export function wrapperVersion() {
+    const manifest = fileURLToPath(new URL("../package.json", import.meta.url));
+    const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+    const version = parsed.version;
+    if (typeof version !== "string")
+        throw new Error(`${manifest} has no version`);
+    return version;
+}
+export function majorOf(version) {
+    const match = /^(\d+)\./.exec(version);
+    return match === null ? null : Number(match[1]);
+}
+export function readEngineState(prefix) {
+    const dir = join(prefix, "node_modules", ENGINE_PACKAGE);
+    const manifest = join(dir, "package.json");
+    if (!existsSync(manifest))
+        return { kind: "none" };
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(manifest, "utf8"));
+    }
+    catch {
+        return { kind: "unusable", version: "unreadable", why: `${manifest} is not readable JSON` };
+    }
+    const version = typeof parsed.version === "string" ? parsed.version : "unreadable";
+    const bin = parsed.bin;
+    const named = typeof bin === "object" && bin !== null
+        ? bin[ENGINE_BIN]
+        : undefined;
+    if (typeof named !== "string") {
+        return { kind: "unusable", version, why: `it has no ${ENGINE_BIN} command` };
+    }
+    const entry = resolve(dir, named);
+    if (!existsSync(entry)) {
+        return { kind: "unusable", version, why: `its ${ENGINE_BIN} entry ${entry} is missing` };
+    }
+    return { kind: "ready", version, entry };
+}
+export function majorProblem(wrapper, engine) {
+    const ours = majorOf(wrapper);
+    const theirs = majorOf(engine);
+    if (ours === null || theirs === null || ours === theirs)
+        return null;
+    return (`rigline ${ours}.x cannot run engine ${theirs}.x (${ENGINE_PACKAGE} ${engine}). ` +
+        "Run npm i -g rigline@latest.");
+}
+export function findNpmCli(execPath = process.execPath, exists = existsSync) {
+    const here = dirname(execPath);
+    const candidates = [
+        join(here, "node_modules", "npm", "bin", "npm-cli.js"),
+        join(here, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    ];
+    const found = candidates.find(exists);
+    if (found === undefined) {
+        throw new UserError(`no npm was found beside ${execPath}, so the engine cannot be installed. ` +
+            `Run: npm install --prefix ${engineDir()} --save-exact --ignore-scripts ${ENGINE_PACKAGE}@latest`);
+    }
+    return found;
+}
+export function engineInstallArgv(options) {
+    return [
+        options.npmCli,
+        "install",
+        "--prefix",
+        options.prefix,
+        "--save-exact",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--loglevel=error",
+        ...options.specs,
+    ];
+}
+const nodeSpawn = (command, args, options) => spawn(command, [...args], { stdio: [...options.stdio] });
+export async function ensureEngine(options = {}) {
+    const prefix = engineDir(options.home ?? riglineHome());
+    const version = options.version ?? wrapperVersion();
+    const state = readEngineState(prefix);
+    if (state.kind === "ready") {
+        const problem = majorProblem(version, state.version);
+        if (problem !== null)
+            throw new UserError(problem);
+        return engineAt(state, options);
+    }
+    const resolved = await resolveEngine(options);
+    if (state.kind === "unusable" && resolved.version === state.version) {
+        throw new UserError(`the engine in ${prefix} is ${ENGINE_PACKAGE} ${state.version} and ${state.why}, ` +
+            `and that is what ${ENGINE_PACKAGE}@${options.tag ?? "latest"} resolves to. ` +
+            `Delete ${prefix} and try again, or install a version that has one.`);
+    }
+    const problem = majorProblem(version, resolved.version);
+    if (problem !== null)
+        throw new UserError(problem);
+    console.log(`rigline: installing the engine, ${ENGINE_PACKAGE} ${resolved.version}`);
+    await installEngine(prefix, `${ENGINE_PACKAGE}@${resolved.version}`, options);
+    const installed = readEngineState(prefix);
+    if (installed.kind !== "ready") {
+        throw new UserError(`${ENGINE_PACKAGE} ${resolved.version} was installed into ${prefix}, but ` +
+            (installed.kind === "unusable" ? installed.why : "nothing is there"));
+    }
+    return engineAt(installed, options);
+}
+async function resolveEngine(options) {
+    return await resolveVersion({ name: ENGINE_PACKAGE, version: null, tag: options.tag ?? "latest" }, options.registry);
+}
+async function installEngine(prefix, spec, options) {
+    mkdirSync(prefix, { recursive: true });
+    const argv = engineInstallArgv({ npmCli: findNpmCli(), prefix, specs: [spec] });
+    const run = await capture(process.execPath, argv, options.spawnImpl);
+    if (run.code !== 0) {
+        throw new UserError(`installing ${spec} into ${prefix} failed (npm exited ${run.code}).\n${run.output.trim()}`);
+    }
+}
+function engineAt(state, options) {
+    const spawnImpl = options.spawnImpl ?? nodeSpawn;
+    return {
+        version: state.version,
+        entry: state.entry,
+        run: (argv) => new Promise((done, fail) => {
+            const child = spawnImpl(process.execPath, [state.entry, ...argv], {
+                stdio: ["inherit", "inherit", "inherit"],
+            });
+            child.on("error", fail);
+            child.on("close", (code) => done(code ?? 1));
+        }),
+        json: async (argv) => {
+            const run = await capture(process.execPath, [state.entry, ...argv], spawnImpl, "inherit");
+            if (run.code !== 0) {
+                throw new UserError(`the engine exited ${run.code} for \`${argv.join(" ")}\``);
+            }
+            try {
+                return JSON.parse(run.output);
+            }
+            catch {
+                throw new UserError(`the engine answered \`${argv.join(" ")}\` with something that is not JSON`);
+            }
+        },
+    };
+}
+async function capture(command, argv, spawnImpl = nodeSpawn, stderr = "pipe") {
+    return await new Promise((done, fail) => {
+        const child = spawnImpl(command, argv, { stdio: ["ignore", "pipe", stderr] });
+        let output = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            output += chunk;
+        });
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", (chunk) => {
+            output += chunk;
+        });
+        child.on("error", fail);
+        child.on("close", (code) => done({ code: code ?? 1, output }));
+    });
+}
+export async function updateEngine(options = {}) {
+    const prefix = engineDir(options.home ?? riglineHome());
+    const state = readEngineState(prefix);
+    const installed = state.kind === "none" ? null : state.version;
+    let resolved;
+    try {
+        resolved = await resolveEngine(options);
+    }
+    catch (error) {
+        return {
+            outcome: "failed",
+            ...(installed === null ? {} : { from: installed }),
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (state.kind === "ready" && resolved.version === state.version) {
+        return { outcome: "current", from: state.version };
+    }
+    const problem = majorProblem(options.version ?? wrapperVersion(), resolved.version);
+    if (problem !== null) {
+        return {
+            outcome: "failed",
+            ...(installed === null ? {} : { from: installed }),
+            reason: problem,
+        };
+    }
+    const withheld = releaseAgeProblem(resolved, options.registry);
+    if (withheld !== null) {
+        return {
+            outcome: "withheld",
+            ...(installed === null ? {} : { from: installed }),
+            to: resolved.version,
+            reason: withheld,
+        };
+    }
+    try {
+        await installEngine(prefix, `${ENGINE_PACKAGE}@${resolved.version}`, options);
+    }
+    catch (error) {
+        return {
+            outcome: "failed",
+            ...(installed === null ? {} : { from: installed }),
+            to: resolved.version,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+    return installed === null
+        ? { outcome: "installed", to: resolved.version }
+        : { outcome: "moved", from: installed, to: resolved.version };
+}
+export function formatEngineUpdate(update, home = riglineHome()) {
+    switch (update.outcome) {
+        case "installed":
+            return `engine: installed ${update.to}`;
+        case "moved":
+            return (`engine: ${update.from} -> ${update.to}\n` +
+                `  to go back: npm install --prefix ${engineDir(home)} --save-exact ` +
+                `${ENGINE_PACKAGE}@${update.from}`);
+        case "current":
+            return `engine: ${update.from}, which is what its tag resolves to`;
+        case "withheld":
+            return `engine: staying on ${update.from} — ${update.reason}`;
+        default:
+            return `engine: FAILED — ${update.reason}`;
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/errors.js

@@ -0,0 +1,4 @@
+export class UserError extends Error {
+    name = "UserError";
+}
+//# sourceMappingURL=errors.js.map

package/dist/index.js

@@ -1,110 +1,12 @@
 #!/usr/bin/env node
-import { existsSync, watch as fsWatch, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { addFromNpm, addPlugin, CORE_VERSION, check, collect, diffScans, EXTENSIONS_DIR, extensionVersion, findExtension, formatDiff, formatDoctor, formatFlow, formatPlugins, formatUpdates, generate, harvestAll, hostVerdict, inspect, install, installedExtensions, listPlugins, readAnchorOverrides, readBundles, removePlugin, restoreAll, riglinePaths, scanOf, UserError, update, updatePlugins, verdict, watch, } from "@rigline/core";
-import { buildPlugin } from "./build.js";
-const USAGE = `rigline ${CORE_VERSION}
-
-  rigline codegen [DIR] [--check] [--out FILE]
-      Harvest the installed extension (or DIR) and write ./generated.ts: the identifier
-      augmentation your plugins compile against, and the baseline install diffs. Commit it.
-      --check compares instead of writing and exits 1 when the file is out of date. Either
-      way it exits 1 if a curated anchor claims to name one element and this version
-      applies its class in more than one place. It reads the shipped anchor table, never
-      ~/.rigline/anchors.json: its verdict is about this repository's table.
-
-  rigline diff DIR_A DIR_B
-      Compare the identifier layers of two extension directories.
-
-  rigline build [DIR] [--source FILE]
-      Bundle a plugin's src/index.ts (or --source) into the entry its rigline.json names.
-
-  rigline install [--ext DIR] [--payload DIR]
-      Inject the loader into every installed extension version (or DIR), baking the enabled
-      plugins, and report what moved since the baseline and which plugins each version
-      refuses. Any entry in ~/.rigline/anchors.json is applied and named, with what this
-      version makes of it. Rewrites ./generated.ts when the directory has one and records
-      the new baseline; never commits either. Run it after an extension update, and reload
-      webviews afterwards. Exits 1 when a person is needed.
-
-  rigline check [--ext DIR]
-      Read-only. Per installed version (or DIR): what moved since the baseline, which
-      plugins this version would refuse and by which identifier, which curated anchors it
-      lacks, and what it makes of each entry in ~/.rigline/anchors.json. Exits 1 when a
-      person is needed.
-
-  rigline watch [--interval SECONDS]
-      install, and again whenever the set of installed extension directories changes,
-      which is what an extension update looks like from outside VS Code.
-
-  rigline dev [DIR...]
-      Build the named plugin directories (or every first-party one), re-inject, and rebuild
-      on every source change. Reload webviews after each one.
-
-  rigline add PATH|SPEC [--now]
-      Install a plugin into ~/.rigline/plugins, say what it can do, and re-inject. PATH is a
-      directory; SPEC is an npm package, optionally @version or @tag. A published version
-      must be a day old before it is installed; --now takes it anyway. No package manager
-      runs, nothing is resolved, and none of the plugin's own code is evaluated.
-
-  rigline update [NAME...] [--now]
-      Move each plugin installed from npm to whatever its tag resolves to now, and
-      re-inject. A plugin pinned to a version, added from a directory, or placed by hand is
-      reported and left alone, as is a newer version too young to install.
-
-  rigline remove NAME
-      Delete a plugin rigline installed, and re-inject. A plugin you did not install this
-      way is switched off in ~/.rigline/config.json instead; this will not delete it.
-
-  rigline list
-      Every plugin found, in the order they load: where it came from, whether it is
-      switched off, and what its manifest says it can do.
-
-  rigline status
-      Per installed version: is each bundle vanilla or patched, judged against its backup.
-
-  rigline restore
-      Every installed version back to the extension's own bytes. Needs neither VS Code nor
-      the extension to be working.
-
-  rigline doctor [--out FILE] [--ext DIR]
-      A markdown diagnostic to paste into a bug report: per installed version, whether it is
-      patched, what the payload holds, which plugins are baked in and what any host patch
-      did. For what the panel itself was doing, copy the probe's report from the RIG badge.
-`;
-function defaultPayloadDir() {
-    const here = dirname(fileURLToPath(import.meta.url));
-    return resolve(here, "..", "..", "host", "dist");
-}
-function repoPluginsDir() {
-    const here = dirname(fileURLToPath(import.meta.url));
-    return resolve(here, "..", "..", "..", "plugins");
-}
-function pluginOptions() {
-    const paths = riglinePaths();
-    return { roots: [repoPluginsDir(), paths.plugins], last: ["probe"], configPath: paths.config };
-}
-function reinject(options = {}) {
-    const targets = options.exts ?? installedExtensions();
-    if (targets.length === 0) {
-        if (options.required)
-            throw new UserError("no Claude Code extension is installed");
-        console.log("No Claude Code extension is installed, so nothing was injected.");
-        return 0;
-    }
-    const report = update({
-        exts: targets,
-        payloadDir: options.payloadDir ?? defaultPayloadDir(),
-        plugins: pluginOptions(),
-        codegen: true,
-    });
-    console.log(formatFlow(report));
-    console.log(report.versions.some((v) => v.hostChanged)
-        ? `\nA host patch changed: run Developer: Reload Window (this ends the window's sessions).`
-        : `\nReload with Developer: Reload Webviews (current window only).`);
-    return report.attention.length > 0 ? 1 : 0;
+import { ENGINE_PACKAGE, engineDir, ensureEngine, formatEngineUpdate, readEngineState, updateEngine, wrapperVersion, } from "./engine.js";
+import { UserError } from "./errors.js";
+import { addFromNpm, formatUpdates, updatePlugins } from "./remote.js";
+function isPathSpec(spec) {
+    if (spec.startsWith("@"))
+        return false;
+    return spec.startsWith(".") || spec.includes("/") || spec.includes("\\");
 }
 async function addCommand(args) {
     const { values, positionals } = parseArgs({
@@ -115,383 +17,70 @@ async function addCommand(args) {
     if (positionals.length !== 1) {
         throw new UserError("add needs exactly one plugin directory or npm package");
     }
-    const paths = riglinePaths();
     const spec = positionals[0];
-    const common = {
-        pluginsDir: paths.plugins,
-        configPath: paths.config,
-        otherRoots: [repoPluginsDir()],
-    };
-    const result = isPathSpec(spec)
-        ? addPlugin({ from: spec, ...common })
-        : await addFromNpm({ spec, ...common, registry: { ignoreReleaseAge: values.now } });
-    console.log(`${result.replaced ? "replaced" : "added"} ${result.name} — ${result.dir}`);
-    console.log(`  from ${result.from}`);
-    if (result.manifest.description)
-        console.log(`  ${result.manifest.description}`);
-    for (const sentence of result.can)
-        console.log(`  - ${sentence}`);
-    for (const patch of result.manifest.patches) {
-        console.log(`  - patches extension.js${patch.required ? " (required)" : ""}: ${patch.why}`);
-    }
-    if (result.disabled) {
-        console.log(`  "${result.name}" is switched off in ${paths.config}, so it will not load until you remove it from "disabled"`);
-    }
-    console.log("");
-    return reinject();
+    const engine = await ensureEngine();
+    if (isPathSpec(spec))
+        return await engine.run(["add", spec]);
+    return await addFromNpm({
+        spec,
+        engine: engine.run,
+        registry: { ignoreReleaseAge: values.now },
+    });
 }
-function isPathSpec(spec) {
-    if (spec.startsWith("@"))
-        return false;
-    if (spec.startsWith(".") || spec.includes("/") || spec.includes("\\"))
-        return true;
-    return existsSync(join(resolve(spec), "rigline.json"));
+async function listed(engine) {
+    const answer = await engine.json(["list", "--json"]);
+    if (!Array.isArray(answer))
+        throw new UserError("the engine's plugin list was not a list");
+    return answer;
 }
 async function updateCommand(args) {
     const { values, positionals } = parseArgs({
         args,
-        options: { now: { type: "boolean", default: false } },
+        options: { now: { type: "boolean", default: false }, tag: { type: "string" } },
         allowPositionals: true,
     });
-    const paths = riglinePaths();
+    const registry = { ignoreReleaseAge: values.now };
+    const engineUpdate = await updateEngine({ registry, ...(values.tag ? { tag: values.tag } : {}) });
+    console.log(formatEngineUpdate(engineUpdate));
+    const engine = await ensureEngine({ registry });
     const updates = await updatePlugins({
-        pluginsDir: paths.plugins,
-        configPath: paths.config,
-        otherRoots: [repoPluginsDir()],
-        names: positionals.length > 0 ? positionals : undefined,
-        registry: { ignoreReleaseAge: values.now },
-    });
-    console.log(formatUpdates(updates));
-    const moved = updates.some((u) => u.outcome === "updated");
-    if (!moved) {
-        return updates.some((u) => u.outcome === "failed") ? 1 : 0;
-    }
-    console.log("");
-    const code = reinject();
-    return updates.some((u) => u.outcome === "failed") ? 1 : code;
-}
-function removeCommand(args) {
-    const { positionals } = parseArgs({ args, options: {}, allowPositionals: true });
-    if (positionals.length !== 1)
-        throw new UserError("remove needs exactly one plugin name");
-    const paths = riglinePaths();
-    const result = removePlugin({
-        name: positionals[0],
-        pluginsDir: paths.plugins,
-        configPath: paths.config,
-        otherRoots: [repoPluginsDir()],
-    });
-    console.log(`removed ${result.name} — ${result.dir}`);
-    if (!result.hadSource)
-        console.log("  it had no source record, so it was placed here by hand");
-    if (result.wasDisabled)
-        console.log(`  and dropped from "disabled" in ${paths.config}`);
-    console.log("");
-    return reinject();
-}
-function installCommand(args) {
-    const { values } = parseArgs({
-        args,
-        options: { ext: { type: "string" }, payload: { type: "string" } },
-        allowPositionals: false,
+        listed: await listed(engine),
+        engine: engine.run,
+        ...(positionals.length > 0 ? { names: positionals } : {}),
+        registry,
     });
-    return reinject({
-        exts: values.ext ? [values.ext] : undefined,
-        payloadDir: values.payload,
-        required: true,
-    });
-}
-function listCommand() {
-    const paths = riglinePaths();
-    console.log(formatPlugins(listPlugins({
-        roots: [
-            { label: "this checkout", path: repoPluginsDir() },
-            { label: paths.plugins, path: paths.plugins, managed: true },
-        ],
-        last: ["probe"],
-        configPath: paths.config,
-    })));
-    return 0;
-}
-function statusCommand() {
-    const targets = installedExtensions();
-    if (targets.length === 0)
-        throw new UserError("no Claude Code extension is installed");
-    for (const ext of targets) {
-        const state = inspect(ext);
-        console.log(`${extensionVersion(ext)}: webview ${verdict(state)}${state.markerPresent ? " (marker present)" : ""}` +
-            `${state.backupExists ? "" : ", no backup"}; host ${hostVerdict(state)}` +
-            `${state.hostBackupExists ? " (backup present)" : ""}`);
-        console.log(`  ${ext}`);
-    }
-    return 0;
-}
-function doctorCommand(args) {
-    const { values } = parseArgs({
-        args,
-        options: { out: { type: "string" }, ext: { type: "string" } },
-        allowPositionals: false,
-    });
-    const report = collect({ exts: values.ext ? [resolve(values.ext)] : undefined });
-    const markdown = formatDoctor(report);
-    if (values.out === undefined) {
-        process.stdout.write(markdown);
-        return 0;
-    }
-    const out = resolve(values.out);
-    writeFileSync(out, markdown);
-    const versions = report.installs.length;
-    console.log(`wrote ${out}: ${versions} extension ${versions === 1 ? "version" : "versions"}`);
-    return 0;
-}
-function restoreCommand() {
-    const results = restoreAll(installedExtensions());
-    let noBackup = 0;
-    let hostFailed = 0;
-    for (const result of results) {
-        if (result.restored)
-            console.log(`restored: ${result.ext}`);
-        else {
-            noBackup++;
-            console.log(`NOT restored: ${result.ext} (${result.reason})`);
-        }
-        if (result.hostReason) {
-            hostFailed++;
-            console.log(`  extension.js NOT restored: ${result.hostReason}`);
-        }
+    let injected = 0;
+    if (engineUpdate.outcome === "moved" || engineUpdate.outcome === "installed") {
+        injected = await engine.run(["install"]);
     }
-    if (noBackup > 0) {
-        console.log("\nA version without a backup is recovered by uninstalling and reinstalling Claude Code from the Extensions view.");
-    }
-    if (hostFailed > 0) {
-        console.log("\nAn extension.js left patched still runs the substitution a plugin declared. Reinstalling Claude Code from the Extensions view replaces it.");
-    }
-    console.log("Reload the window afterwards.");
-    return noBackup + hostFailed > 0 ? 1 : 0;
-}
-function defaultGeneratedPath() {
-    return resolve(process.cwd(), "generated.ts");
-}
-function codegen(args) {
-    const { values, positionals } = parseArgs({
-        args,
-        options: { check: { type: "boolean", default: false }, out: { type: "string" } },
-        allowPositionals: true,
-    });
-    if (positionals.length > 1)
-        throw new UserError(`expected at most one directory: ${positionals}`);
-    const ext = positionals[0] ?? findExtension();
-    const out = values.out ?? defaultGeneratedPath();
-    const generated = generate(harvestAll(readBundles(ext)));
-    const label = relative(process.cwd(), out) || out;
-    const ambiguous = reportAmbiguousAnchors(generated);
-    if (values.check) {
-        const current = existsSync(out) ? readFileSync(out, "utf8") : "";
-        if (current !== generated.source) {
-            console.log(`${label} is out of date for ${generated.tables.version}. Run: rigline codegen`);
-            return 1;
-        }
-        console.log(`${label} is up to date for ${generated.tables.version}: ${generated.counts}`);
-        return ambiguous ? 1 : 0;
-    }
-    writeFileSync(out, generated.source);
-    console.log(`source: ${ext}`);
-    console.log(`${generated.tables.version}: ${generated.counts}`);
-    for (const module of generated.unreachableModules) {
-        console.log(`  unreachable stylesheet module: ${module}`);
-    }
-    for (const name of generated.anchors.unverified) {
-        console.log(`  unverified anchor: ${name} (its module's class map was never counted)`);
-    }
-    console.log(`wrote: ${label}`);
-    return ambiguous ? 1 : 0;
-}
-function reportAmbiguousAnchors(generated) {
-    if (generated.anchors.ambiguous.length === 0)
-        return false;
-    for (const { name, sites } of generated.anchors.ambiguous) {
-        console.error(`  ambiguous anchor: ${name} names one element, and ${generated.tables.version} applies its class at ${sites} places`);
-    }
-    console.error("Refine each in packages/plugin-api/src/anchors.ts, or change its kind to collection if it was never one element.");
-    return true;
-}
-function diff(args) {
-    if (args.length !== 2)
-        throw new UserError("diff needs exactly two extension directories");
-    const [a, b] = args;
-    const from = scanOf(harvestAll(readBundles(a)));
-    const to = scanOf(harvestAll(readBundles(b)));
-    console.log(formatDiff(from, to, diffScans(from, to)));
-    return 0;
-}
-async function build(args) {
-    const { values, positionals } = parseArgs({
-        args,
-        options: { source: { type: "string" } },
-        allowPositionals: true,
-    });
-    if (positionals.length > 1)
-        throw new UserError(`expected at most one directory: ${positionals}`);
-    const built = await buildPlugin({ dir: positionals[0], source: values.source });
-    console.log(`built ${built.input} -> ${built.output}`);
+    console.log(formatUpdates(updates));
+    const failed = updates.some((u) => u.outcome === "failed") || engineUpdate.outcome === "failed";
+    return failed || injected !== 0 ? 1 : 0;
+}
+function versionCommand() {
+    const prefix = engineDir();
+    const state = readEngineState(prefix);
+    console.log(`rigline ${wrapperVersion()}`);
+    console.log(state.kind === "none"
+        ? `engine: none in ${prefix} — the next command installs one`
+        : `engine: ${ENGINE_PACKAGE} ${state.version} in ${prefix}` +
+            (state.kind === "unusable" ? ` (unusable: ${state.why})` : ""));
     return 0;
 }
-function extOption(args) {
-    const { values } = parseArgs({ args, options: { ext: { type: "string" } } });
-    return values.ext ? [resolve(values.ext)] : undefined;
-}
-function checkCommand(args) {
-    const report = check({ exts: extOption(args), plugins: pluginOptions() });
-    console.log(formatFlow(report));
-    return report.attention.length > 0 ? 1 : 0;
-}
-function watchCommand(args) {
-    const { values } = parseArgs({
-        args,
-        options: { interval: { type: "string" } },
-        allowPositionals: false,
-    });
-    const seconds = values.interval === undefined ? 30 : Number(values.interval);
-    if (!Number.isFinite(seconds) || seconds < 1) {
-        throw new UserError(`--interval needs a number of seconds, got ${values.interval}`);
-    }
-    return new Promise((resolveWith) => {
-        let code = 0;
-        const watcher = watch({
-            payloadDir: defaultPayloadDir(),
-            plugins: pluginOptions(),
-            codegen: true,
-            intervalMs: seconds * 1000,
-            onReport(report) {
-                console.log(`
-[${new Date().toISOString()}]`);
-                console.log(formatFlow(report));
-                code = report.attention.length > 0 ? 1 : 0;
-            },
-            onError(error) {
-                console.error(`rigline watch: ${error instanceof Error ? error.message : String(error)}`);
-                code = 1;
-            },
-        });
-        console.log(`watching ${EXTENSIONS_DIR} every ${seconds}s; Ctrl-C to stop`);
-        const stop = () => {
-            watcher.stop();
-            resolveWith(code);
-        };
-        process.once("SIGINT", stop);
-        process.once("SIGTERM", stop);
-    });
-}
-async function dev(args) {
-    const { positionals } = parseArgs({ args, options: {}, allowPositionals: true });
-    const dirs = positionals.length > 0
-        ? positionals.map((d) => resolve(d))
-        : readdirSync(repoPluginsDir(), { withFileTypes: true })
-            .filter((e) => e.isDirectory() && existsSync(join(repoPluginsDir(), e.name, "rigline.json")))
-            .map((e) => join(repoPluginsDir(), e.name));
-    if (dirs.length === 0)
-        throw new UserError("no plugin directories to develop");
-    const exts = installedExtensions();
-    if (exts.length === 0)
-        throw new UserError("no Claude Code extension is installed");
-    const overrides = readAnchorOverrides();
-    for (const problem of overrides.problems)
-        console.error(`rigline dev: ${problem}`);
-    async function once() {
-        for (const dir of dirs) {
-            const built = await buildPlugin({ dir });
-            console.log(`built ${basename(dir)}: ${built.input} -> ${built.output}`);
-        }
-        let hostChanged = false;
-        for (const ext of exts) {
-            const report = install(ext, {
-                payloadDir: defaultPayloadDir(),
-                plugins: pluginOptions(),
-                anchors: overrides,
-            });
-            hostChanged ||= report.hostChanged;
-            for (const override of report.anchorOverrides) {
-                console.log(`  anchor override ${override.name}: ${overrides.path}`);
-            }
-            for (const verdict of report.verdicts) {
-                if (verdict.refusal)
-                    console.log(`  REFUSED ${verdict.plugin}: ${verdict.refusal}`);
-            }
-        }
-        console.log(hostChanged
-            ? "Developer: Reload Window (a host patch changed; this ends the window's sessions)"
-            : "Developer: Reload Webviews");
-    }
-    await once();
-    let pending = null;
-    let building = false;
-    const schedule = () => {
-        if (pending)
-            clearTimeout(pending);
-        pending = setTimeout(() => {
-            pending = null;
-            if (building)
-                return;
-            building = true;
-            once()
-                .catch((error) => {
-                console.error(`rigline dev: ${error instanceof Error ? error.message : String(error)}`);
-            })
-                .finally(() => {
-                building = false;
-            });
-        }, 150);
-    };
-    for (const dir of dirs) {
-        const src = join(dir, "src");
-        if (!existsSync(src))
-            continue;
-        fsWatch(src, { recursive: true }, schedule);
-    }
-    console.log(`watching ${dirs.length} plugin source director${dirs.length === 1 ? "y" : "ies"}; Ctrl-C to stop`);
-    return new Promise((resolveWith) => {
-        process.once("SIGINT", () => resolveWith(0));
-        process.once("SIGTERM", () => resolveWith(0));
-    });
-}
 async function main(argv) {
     const [command, ...rest] = argv;
     switch (command) {
-        case "codegen":
-            return codegen(rest);
-        case "diff":
-            return diff(rest);
-        case "build":
-            return build(rest);
-        case "install":
-            return installCommand(rest);
-        case "check":
-            return checkCommand(rest);
-        case "watch":
-            return watchCommand(rest);
-        case "dev":
-            return dev(rest);
+        case "--version":
+        case "-v":
+            return versionCommand();
         case "add":
-            return addCommand(rest);
+            return await addCommand(rest);
         case "update":
-            return updateCommand(rest);
-        case "remove":
-            return removeCommand(rest);
-        case "list":
-            return listCommand();
-        case "status":
-            return statusCommand();
-        case "restore":
-            return restoreCommand();
-        case "doctor":
-            return doctorCommand(rest);
-        case undefined:
-        case "--help":
-        case "-h":
-            console.log(USAGE);
-            return 0;
-        default:
-            throw new UserError(`unknown command "${command}"\n\n${USAGE}`);
+            return await updateCommand(rest);
+        default: {
+            const engine = await ensureEngine();
+            return await engine.run(argv);
+        }
     }
 }
 main(process.argv.slice(2)).then((code) => {

package/dist/registry.js

@@ -0,0 +1,134 @@
+import { createHash } from "node:crypto";
+import { UserError } from "./errors.js";
+export const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+export const MINIMUM_RELEASE_AGE_MINUTES = 1440;
+export function parsePluginSpec(spec) {
+    const at = spec.lastIndexOf("@");
+    const scoped = spec.startsWith("@");
+    if (at <= 0 || (scoped && at === 0)) {
+        return { name: spec, version: null, tag: null };
+    }
+    const name = spec.slice(0, at);
+    const rest = spec.slice(at + 1);
+    if (rest.length === 0)
+        return { name, version: null, tag: null };
+    return /^\d+\.\d+\.\d+(?:[-+].*)?$/.test(rest)
+        ? { name, version: rest, tag: null }
+        : { name, version: null, tag: rest };
+}
+export async function resolveVersion(spec, options = {}) {
+    const packument = await fetchPackument(spec.name, options);
+    const tag = spec.version === null ? (spec.tag ?? "latest") : null;
+    const version = spec.version ?? distTag(packument, spec.name, tag);
+    const release = packument.versions?.[version];
+    if (release === undefined) {
+        throw new UserError(`${spec.name} has no version ${version} on ${registryOf(options)}`);
+    }
+    const published = packument.time?.[version];
+    const ageMinutes = typeof published === "string" && !Number.isNaN(Date.parse(published))
+        ? Math.floor(((options.clock?.() ?? Date.now()) - Date.parse(published)) / 60_000)
+        : null;
+    const tarball = release.dist?.tarball;
+    if (typeof tarball !== "string" || tarball.length === 0) {
+        throw new UserError(`${spec.name}@${version} has no tarball on ${registryOf(options)}`);
+    }
+    return {
+        name: spec.name,
+        version,
+        tag,
+        tarball,
+        integrity: integrityOf(release, `${spec.name}@${version}`),
+        ageMinutes,
+    };
+}
+export async function fetchTarball(resolved, options = {}) {
+    const response = await request(resolved.tarball, options);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const problem = integrityProblem(bytes, resolved.integrity);
+    if (problem !== null) {
+        throw new UserError(`${resolved.name}@${resolved.version} from ${resolved.tarball} ${problem}. ` +
+            "Nothing was written.");
+    }
+    return bytes;
+}
+export function integrityProblem(bytes, integrity) {
+    const dash = integrity.indexOf("-");
+    if (dash <= 0)
+        return `has an integrity string this cannot read ("${integrity}")`;
+    const algorithm = integrity.slice(0, dash);
+    const expected = integrity.slice(dash + 1);
+    let actual;
+    try {
+        actual = createHash(algorithm).update(bytes).digest("base64");
+    }
+    catch {
+        return `names a digest this cannot compute ("${algorithm}")`;
+    }
+    return actual === expected
+        ? null
+        : `does not match its recorded integrity (${algorithm}-${actual} against ${integrity})`;
+}
+export function releaseAgeProblem(resolved, options = {}) {
+    if (options.ignoreReleaseAge)
+        return null;
+    const minimum = options.minimumReleaseAge ?? MINIMUM_RELEASE_AGE_MINUTES;
+    if (resolved.ageMinutes === null || resolved.ageMinutes >= minimum)
+        return null;
+    return (`${resolved.name}@${resolved.version} was published ${describeAge(resolved.ageMinutes)} ago, ` +
+        `and rigline waits ${describeAge(minimum)} before installing a version. That window is where ` +
+        "a compromised publish is usually caught, and it costs little here because the urgent repair " +
+        "— an anchor an extension update retired — is a local edit rather than a release (D44). " +
+        "Wait, or pass --now.");
+}
+export function describeAge(minutes) {
+    if (minutes < 60)
+        return `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 48)
+        return `${hours} ${hours === 1 ? "hour" : "hours"}`;
+    return `${Math.floor(hours / 24)} days`;
+}
+function distTag(packument, name, tag) {
+    const version = packument["dist-tags"]?.[tag];
+    if (typeof version === "string" && version.length > 0)
+        return version;
+    const tags = Object.keys(packument["dist-tags"] ?? {});
+    throw new UserError(`${name} has no "${tag}" tag${tags.length > 0 ? `; it has ${tags.join(", ")}` : ""}`);
+}
+function integrityOf(release, label) {
+    const { integrity, shasum } = release.dist ?? {};
+    if (typeof integrity === "string" && integrity.length > 0)
+        return integrity;
+    if (typeof shasum === "string" && /^[0-9a-f]{40}$/.test(shasum)) {
+        return `sha1-${Buffer.from(shasum, "hex").toString("base64")}`;
+    }
+    throw new UserError(`${label} carries no integrity hash, so its bytes cannot be checked`);
+}
+function registryOf(options) {
+    return (options.registry ?? process.env.npm_config_registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
+}
+async function fetchPackument(name, options) {
+    const url = `${registryOf(options)}/${name.replace("/", "%2F")}`;
+    const response = await request(url, options, { Accept: "application/json" });
+    return (await response.json());
+}
+async function request(url, options, headers) {
+    const impl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof impl !== "function") {
+        throw new UserError("this Node has no fetch, so nothing can be installed from a registry");
+    }
+    let response;
+    try {
+        response = await impl(url, headers ? { headers } : undefined);
+    }
+    catch (error) {
+        throw new UserError(`could not reach ${url}: ${error.message}`);
+    }
+    if (!response.ok) {
+        throw new UserError(response.status === 404
+            ? `${url} is not there (404). Check the name, and that it is published.`
+            : `${url} answered ${response.status}`);
+    }
+    return response;
+}
+//# sourceMappingURL=registry.js.map

package/dist/remote.js

@@ -0,0 +1,132 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { UserError } from "./errors.js";
+import { fetchTarball, parsePluginSpec, releaseAgeProblem, resolveVersion, } from "./registry.js";
+import { readPackageTarball } from "./tarball.js";
+export async function addFromNpm(options) {
+    const resolved = await resolveVersion(parsePluginSpec(options.spec), options.registry);
+    const withheld = releaseAgeProblem(resolved, options.registry);
+    if (withheld !== null)
+        throw new UserError(withheld);
+    return await stageAndAdd(resolved, options);
+}
+async function stageAndAdd(resolved, options) {
+    const label = `${resolved.name}@${resolved.version}`;
+    const files = readPackageTarball(await fetchTarball(resolved, options.registry), label);
+    const staged = mkdtempSync(join(tmpdir(), "rigline-add-"));
+    try {
+        for (const file of files) {
+            const target = join(staged, file.path);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, file.bytes);
+        }
+        const source = {
+            kind: "npm",
+            name: resolved.name,
+            version: resolved.version,
+            tag: resolved.tag,
+            integrity: resolved.integrity,
+            addedAt: (options.now?.() ?? new Date()).toISOString(),
+        };
+        return await options.engine(["add", staged, "--source", JSON.stringify(source)]);
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
+    }
+}
+export async function updatePlugins(options) {
+    const managed = options.listed.filter((plugin) => plugin.managed);
+    const byName = new Map(managed.map((plugin) => [plugin.name, plugin]));
+    const names = options.names ?? managed.map((plugin) => plugin.name);
+    const updates = [];
+    for (const name of names) {
+        const plugin = byName.get(name);
+        if (plugin === undefined) {
+            updates.push({ name, outcome: "failed", reason: "not installed by rigline" });
+            continue;
+        }
+        const source = plugin.source;
+        if (source === null) {
+            updates.push({ name, outcome: "unmanaged" });
+            continue;
+        }
+        if (source.kind === "path") {
+            updates.push({
+                name,
+                outcome: "local",
+                reason: typeof source.from === "string" ? source.from : "a directory",
+            });
+            continue;
+        }
+        if (source.kind !== "npm") {
+            updates.push({ name, outcome: "unmanaged", reason: `source kind "${source.kind}"` });
+            continue;
+        }
+        if (source.name === undefined || source.version === undefined) {
+            updates.push({ name, outcome: "failed", reason: "its npm source is incomplete" });
+            continue;
+        }
+        if (source.tag === null || source.tag === undefined) {
+            updates.push({ name, outcome: "pinned", from: source.version });
+            continue;
+        }
+        updates.push(await updateOne(name, { name: source.name, version: source.version, tag: source.tag }, options));
+    }
+    return updates;
+}
+async function updateOne(name, source, options) {
+    try {
+        const resolved = await resolveVersion({ name: source.name, version: null, tag: source.tag }, options.registry);
+        if (resolved.version === source.version) {
+            return { name, outcome: "current", from: source.version };
+        }
+        const withheld = releaseAgeProblem(resolved, options.registry);
+        if (withheld !== null) {
+            return {
+                name,
+                outcome: "withheld",
+                from: source.version,
+                to: resolved.version,
+                reason: withheld,
+            };
+        }
+        const code = await stageAndAdd(resolved, options);
+        if (code !== 0) {
+            return { name, outcome: "failed", from: source.version, reason: `the engine exited ${code}` };
+        }
+        return { name, outcome: "updated", from: source.version, to: resolved.version };
+    }
+    catch (error) {
+        return {
+            name,
+            outcome: "failed",
+            from: source.version,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function formatUpdates(updates) {
+    if (updates.length === 0)
+        return "no plugins are installed";
+    return updates.map(updateLine).join("\n");
+}
+function updateLine(update) {
+    switch (update.outcome) {
+        case "updated":
+            return `${update.name}: ${update.from} -> ${update.to}`;
+        case "current":
+            return `${update.name}: ${update.from}, which is what its tag resolves to`;
+        case "pinned":
+            return `${update.name}: pinned to ${update.from}; add it again to move it`;
+        case "local":
+            return `${update.name}: added from ${update.reason}; run rigline add again to refresh it`;
+        case "unmanaged":
+            return `${update.name}: placed by hand, so there is nowhere to fetch a newer one from`;
+        case "withheld":
+            return `${update.name}: staying on ${update.from} — ${update.reason}`;
+        default:
+            return `${update.name}: FAILED — ${update.reason}`;
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/tarball.js

@@ -0,0 +1,125 @@
+import { gunzipSync } from "node:zlib";
+import { UserError } from "./errors.js";
+const BLOCK = 512;
+const TYPE_FILE = 0x30;
+const TYPE_FILE_LEGACY = 0x00;
+const TYPE_DIRECTORY = 0x35;
+const TYPE_PAX_ENTRY = 0x78;
+const TYPE_PAX_GLOBAL = 0x67;
+const MAX_ENTRIES = 2000;
+const MAX_FILE_BYTES = 16 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+export function readPackageTarball(gzipped, label) {
+    let tar;
+    try {
+        tar = gunzipSync(gzipped);
+    }
+    catch (error) {
+        throw new UserError(`${label} is not a gzipped tarball: ${error.message}`);
+    }
+    const members = [];
+    let total = 0;
+    let offset = 0;
+    while (offset + BLOCK <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        if (isEndOfArchive(header))
+            break;
+        offset += BLOCK;
+        const name = readHeaderName(header, label);
+        const size = readOctal(header, 124, 12, `${label}: entry "${name}" has an unreadable size`);
+        const type = header[156] ?? 0;
+        const body = tar.subarray(offset, offset + size);
+        offset += Math.ceil(size / BLOCK) * BLOCK;
+        if (type === TYPE_PAX_ENTRY || type === TYPE_PAX_GLOBAL)
+            continue;
+        if (type === TYPE_DIRECTORY)
+            continue;
+        if (type !== TYPE_FILE && type !== TYPE_FILE_LEGACY) {
+            throw new UserError(`${label} carries "${name}", which is not a regular file (tar type ` +
+                `"${String.fromCharCode(type)}"). A plugin is files; nothing here unpacks a link, a ` +
+                "device or an archive member of any other kind.");
+        }
+        if (size > MAX_FILE_BYTES) {
+            throw new UserError(`${label}: "${name}" is ${size} bytes, over the ${MAX_FILE_BYTES} cap`);
+        }
+        total += size;
+        if (total > MAX_TOTAL_BYTES || members.length >= MAX_ENTRIES) {
+            throw new UserError(`${label} unpacks to more than ${MAX_ENTRIES} files or ${MAX_TOTAL_BYTES} bytes`);
+        }
+        if (body.length < size) {
+            throw new UserError(`${label} ends inside "${name}", so it is truncated`);
+        }
+        const path = safePath(name, label);
+        if (path === null)
+            continue;
+        members.push({ path, bytes: Buffer.from(body) });
+    }
+    return strip(members, label);
+}
+function strip(members, label) {
+    const first = members[0];
+    if (first === undefined) {
+        throw new UserError(`${label} has no files in it`);
+    }
+    const root = first.path.split("/")[0];
+    const files = [];
+    const seen = new Set();
+    for (const member of members) {
+        const segments = member.path.split("/");
+        if (segments[0] !== root) {
+            throw new UserError(`${label} carries "${member.path}", which is outside "${root}/"; every member of a ` +
+                "published tarball sits under one directory, and this one has two");
+        }
+        const path = segments.slice(1).join("/");
+        if (path.length === 0)
+            continue;
+        if (seen.has(path)) {
+            throw new UserError(`${label} carries "${path}" twice`);
+        }
+        seen.add(path);
+        files.push({ path, bytes: member.bytes });
+    }
+    if (files.length === 0) {
+        throw new UserError(`${label} has nothing under "${root}/"`);
+    }
+    return files;
+}
+function isEndOfArchive(header) {
+    for (const byte of header) {
+        if (byte !== 0)
+            return false;
+    }
+    return true;
+}
+function readHeaderName(header, label) {
+    const name = readString(header, 0, 100);
+    const prefix = readString(header, 345, 155);
+    if (name.length === 0) {
+        throw new UserError(`${label} carries an entry with no name`);
+    }
+    return prefix.length > 0 ? `${prefix}/${name}` : name;
+}
+function readString(header, at, length) {
+    const field = header.subarray(at, at + length);
+    const end = field.indexOf(0);
+    return field.subarray(0, end === -1 ? field.length : end).toString("utf8");
+}
+function readOctal(header, at, length, problem) {
+    const text = readString(header, at, length).trim();
+    const value = text.length === 0 ? 0 : Number.parseInt(text, 8);
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new UserError(problem);
+    return value;
+}
+function safePath(name, label) {
+    const path = name.replace(/\\/g, "/").replace(/\/+$/, "");
+    if (path.length === 0)
+        return null;
+    const segments = path.split("/");
+    if (name.startsWith("/") ||
+        segments.some((segment) => segment === "" || segment === "." || segment === ".." || /^[a-zA-Z]:/.test(segment))) {
+        throw new UserError(`${label} carries "${name}", which does not stay inside the directory it unpacks into`);
+    }
+    return path;
+}
+//# sourceMappingURL=tarball.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rigline",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.6",
   "description": "Install, update and develop plugins for the Claude Code VS Code extension",
   "keywords": [
     "rigline",
@@ -29,12 +29,8 @@
   "bin": {
     "rigline": "./dist/index.js"
   },
-  "dependencies": {
-    "@rigline/core": "1.0.0-alpha.4",
-    "rolldown": "^1.2.8"
-  },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json"
   }
 }

package/dist/build.js

@@ -1,25 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join, relative, resolve } from "node:path";
-import { UserError } from "@rigline/core";
-import { build as bundle } from "rolldown";
-export async function buildPlugin(options = {}) {
-    const dir = resolve(options.dir ?? process.cwd());
-    const manifestPath = join(dir, "rigline.json");
-    if (!existsSync(manifestPath))
-        throw new UserError(`${dir} has no rigline.json`);
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    if (typeof manifest.entry !== "string" || manifest.entry.length === 0) {
-        throw new UserError(`${manifestPath} has no "entry"`);
-    }
-    const input = resolve(dir, options.source ?? "src/index.ts");
-    if (!existsSync(input))
-        throw new UserError(`no plugin source at ${input}`);
-    const output = resolve(dir, manifest.entry);
-    await bundle({
-        input,
-        platform: "browser",
-        output: { file: output, format: "esm", sourcemap: "inline", codeSplitting: false },
-    });
-    return { input: relative(dir, input), output: relative(dir, output) };
-}
-//# sourceMappingURL=build.js.map