specrails-desktop 2.0.0

package/server/dist/plugins/claude-approval.js

@@ -0,0 +1,179 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClaudeApprovalState = getClaudeApprovalState;
+exports.findEnabledMarketplaceKeys = findEnabledMarketplaceKeys;
+exports.findInstalledMarketplaceKeys = findInstalledMarketplaceKeys;
+exports.findInstalledButNotEnabledMarketplaceKeys = findInstalledButNotEnabledMarketplaceKeys;
+exports.disableMarketplacePlugin = disableMarketplacePlugin;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Returns the approval state for `<projectPath>` × `<serverName>`. The state
+ * is sourced from EITHER:
+ *
+ *   1. `~/.claude.json` → projects[<path>].{enabled,disabled}McpjsonServers —
+ *      the per-project approval set when the user accepts (or denies) the
+ *      `.mcp.json` prompt the first time Claude opens the repo.
+ *
+ *   2. `~/.claude/settings.json` → enabledPlugins["<serverName>@*"] — Claude
+ *      Code's plugin-marketplace mechanism. When a user installs an MCP via
+ *      the marketplace, Serena (or similar) is available in EVERY project
+ *      regardless of `.mcp.json`. The card should reflect that the tool is
+ *      loaded, not that our app-managed `.mcp.json` entry is dormant.
+ *
+ * Resolution order:
+ *   - explicit disable in (1)            → `disabled`
+ *   - explicit enable in (1) OR (2)      → `enabled`
+ *   - otherwise                          → `pending`
+ *
+ * Defensive: any I/O / parse error falls back to 'pending'. Never throws.
+ */
+function getClaudeApprovalState(projectPath, serverName) {
+    // (1) Per-project mcpjson approval.
+    // Order:
+    //   - explicit disabled list   → disabled
+    //   - explicit enabled list    → enabled
+    //   - trusted project          → enabled (Claude auto-loads .mcp.json
+    //                                without prompting once trust is granted)
+    //   - none of the above        → pending (first prompt not yet shown)
+    let mcpjsonState = 'pending';
+    try {
+        const configPath = path_1.default.join(os_1.default.homedir(), '.claude.json');
+        if (fs_1.default.existsSync(configPath)) {
+            const parsed = JSON.parse(fs_1.default.readFileSync(configPath, 'utf8'));
+            const entry = parsed.projects?.[path_1.default.resolve(projectPath)];
+            if (entry) {
+                if (entry.disabledMcpjsonServers?.includes(serverName))
+                    mcpjsonState = 'disabled';
+                else if (entry.enabledMcpjsonServers?.includes(serverName))
+                    mcpjsonState = 'enabled';
+                else if (entry.hasTrustDialogAccepted === true)
+                    mcpjsonState = 'enabled';
+            }
+        }
+    }
+    catch {
+        // ignore — falls through to marketplace check
+    }
+    // Explicit disabled wins over marketplace enable.
+    if (mcpjsonState === 'disabled')
+        return 'disabled';
+    // (2) Claude marketplace plugin (per-user, project-agnostic).
+    let marketplaceEnabled = false;
+    try {
+        const settingsPath = path_1.default.join(os_1.default.homedir(), '.claude', 'settings.json');
+        if (fs_1.default.existsSync(settingsPath)) {
+            const settings = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf8'));
+            const enabled = settings.enabledPlugins ?? {};
+            const prefix = `${serverName}@`;
+            for (const [key, value] of Object.entries(enabled)) {
+                if (value === true && key.startsWith(prefix)) {
+                    marketplaceEnabled = true;
+                    break;
+                }
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    if (mcpjsonState === 'enabled' || marketplaceEnabled)
+        return 'enabled';
+    return 'pending';
+}
+/**
+ * Returns the keys (e.g., `serena@claude-plugins-official`) under
+ * `~/.claude/settings.json#enabledPlugins` that match `<serverName>@*` and
+ * are set to `true`. Empty array if none.
+ */
+function findEnabledMarketplaceKeys(serverName) {
+    try {
+        const settingsPath = path_1.default.join(os_1.default.homedir(), '.claude', 'settings.json');
+        if (!fs_1.default.existsSync(settingsPath))
+            return [];
+        const settings = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf8'));
+        const enabled = settings.enabledPlugins ?? {};
+        const prefix = `${serverName}@`;
+        return Object.entries(enabled)
+            .filter(([k, v]) => v === true && k.startsWith(prefix))
+            .map(([k]) => k);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Returns the keys present in `~/.claude/plugins/installed_plugins.json`
+ * that match `<serverName>@*`, regardless of the `enabledPlugins` toggle.
+ * Used to detect plugins that are physically in Claude's cache and may be
+ * loaded by Claude even when `enabledPlugins[key]=false` (observed: Claude
+ * keeps them resolvable from the cache `.mcp.json`).
+ */
+function findInstalledMarketplaceKeys(serverName) {
+    try {
+        const filePath = path_1.default.join(os_1.default.homedir(), '.claude', 'plugins', 'installed_plugins.json');
+        if (!fs_1.default.existsSync(filePath))
+            return [];
+        const parsed = JSON.parse(fs_1.default.readFileSync(filePath, 'utf8'));
+        const map = parsed.plugins ?? {};
+        const prefix = `${serverName}@`;
+        return Object.keys(map).filter((k) => k.startsWith(prefix));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Returns marketplace keys that are physically installed in Claude's plugin
+ * cache but NOT enabled (i.e., `enabledPlugins[key] !== true`). These are
+ * the ones likely to confuse users — the app disabled them but the binary +
+ * shipped `.mcp.json` are still on disk; Claude may still resolve the server.
+ */
+function findInstalledButNotEnabledMarketplaceKeys(serverName) {
+    const installed = findInstalledMarketplaceKeys(serverName);
+    if (installed.length === 0)
+        return [];
+    let enabledMap = {};
+    try {
+        const settingsPath = path_1.default.join(os_1.default.homedir(), '.claude', 'settings.json');
+        if (fs_1.default.existsSync(settingsPath)) {
+            const settings = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf8'));
+            enabledMap = settings.enabledPlugins ?? {};
+        }
+    }
+    catch { /* fall through */ }
+    return installed.filter((k) => enabledMap[k] !== true);
+}
+/**
+ * Mutates `~/.claude/settings.json` so the named marketplace plugin is set
+ * to `false` (disabling it). Atomic temp+rename. Returns true on success.
+ *
+ * NOTE: this is the only place the app touches Claude's per-user config.
+ * Surface to the user via an explicit action (button/CLI), never silently.
+ */
+function disableMarketplacePlugin(marketplaceKey) {
+    try {
+        const settingsPath = path_1.default.join(os_1.default.homedir(), '.claude', 'settings.json');
+        if (!fs_1.default.existsSync(settingsPath)) {
+            return { ok: false, reason: 'settings-not-found' };
+        }
+        const raw = fs_1.default.readFileSync(settingsPath, 'utf8');
+        const settings = JSON.parse(raw);
+        settings.enabledPlugins ??= {};
+        if (settings.enabledPlugins[marketplaceKey] === false) {
+            return { ok: true, reason: 'already-disabled' };
+        }
+        settings.enabledPlugins[marketplaceKey] = false;
+        const tmp = `${settingsPath}.${process.pid}.${Date.now()}.tmp`;
+        fs_1.default.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+        fs_1.default.renameSync(tmp, settingsPath);
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, reason: err.message };
+    }
+}

package/server/dist/plugins/claude-md-mutation.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBlockContent = getBlockContent;
+exports.upsertBlock = upsertBlock;
+exports.removeBlock = removeBlock;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const json_mutation_1 = require("./json-mutation");
+/**
+ * Plugins contribute named sections to the project's top-level instructions
+ * file (`CLAUDE.md` for claude projects, `AGENTS.md` for codex projects, and
+ * the adapter-declared filename for future providers) so the agent's global
+ * context includes per-plugin usage hints (e.g. "prefer Serena tools over
+ * raw Read/Grep when locating symbols"). Each plugin owns one named block
+ * delimited by HTML-comment markers; multiple plugins coexist without
+ * stomping each other.
+ *
+ *   <!-- specrails-desktop-managed:<plugin>:start -->
+ *   ...content...
+ *   <!-- specrails-desktop-managed:<plugin>:end -->
+ *
+ * Operations are surgical, atomic (temp+rename), and serialized via the
+ * shared in-process file mutex.
+ *
+ * The `filename` parameter on every function defaults to `'CLAUDE.md'` so
+ * existing callsites compile unchanged during the multi-provider migration.
+ * Callers that know the resolved provider pass `adapter.instructionsFilename`
+ * explicitly.
+ */
+function startMarker(pluginName) {
+    return `<!-- specrails-desktop-managed:${pluginName}:start -->`;
+}
+function endMarker(pluginName) {
+    return `<!-- specrails-desktop-managed:${pluginName}:end -->`;
+}
+// Legacy marker compat — blocks written by pre-rebrand "Specrails Hub"
+// installs used the `specrails-hub-managed` namespace. We still locate (and
+// therefore replace/remove) those blocks so existing user files never end up
+// with orphaned managed sections. New writes always use the new markers.
+function legacyStartMarker(pluginName) {
+    return `<!-- specrails-hub-managed:${pluginName}:start -->`;
+}
+function legacyEndMarker(pluginName) {
+    return `<!-- specrails-hub-managed:${pluginName}:end -->`;
+}
+function instructionsMdPath(projectPath, filename) {
+    return path_1.default.join(projectPath, filename);
+}
+/** Backwards-compat alias for callers that haven't been threaded the
+ *  adapter-driven filename yet. */
+function claudeMdPath(projectPath) {
+    return instructionsMdPath(projectPath, 'CLAUDE.md');
+}
+function locateBlockWithMarkers(text, start, end) {
+    const sIdx = text.indexOf(start);
+    if (sIdx < 0)
+        return null;
+    const eIdx = text.indexOf(end, sIdx + start.length);
+    if (eIdx < 0)
+        return null;
+    const innerStart = sIdx + start.length;
+    const innerEnd = eIdx;
+    return {
+        start: sIdx,
+        end: eIdx + end.length,
+        content: text.slice(innerStart, innerEnd).replace(/^\n+|\n+$/g, ''),
+    };
+}
+function locateBlock(text, pluginName) {
+    return (locateBlockWithMarkers(text, startMarker(pluginName), endMarker(pluginName)) ??
+        // Fall back to the legacy pre-rebrand markers (see legacyStartMarker).
+        locateBlockWithMarkers(text, legacyStartMarker(pluginName), legacyEndMarker(pluginName)));
+}
+/** Returns the current managed-block content for `pluginName`, or null if absent. */
+function getBlockContent(projectPath, pluginName, filename = 'CLAUDE.md') {
+    const file = instructionsMdPath(projectPath, filename);
+    if (!fs_1.default.existsSync(file))
+        return null;
+    const text = fs_1.default.readFileSync(file, 'utf8');
+    const match = locateBlock(text, pluginName);
+    return match ? match.content : null;
+}
+/**
+ * Insert or replace the managed block for `pluginName`. If the instructions
+ * file does not exist, it is created with just the block. If it exists
+ * without our block, the block is appended at the end (separated by a blank
+ * line). The filename defaults to `CLAUDE.md` for backwards compatibility;
+ * codex projects pass `AGENTS.md`.
+ */
+async function upsertBlock(projectPath, pluginName, content, filename = 'CLAUDE.md') {
+    const file = instructionsMdPath(projectPath, filename);
+    const block = `${startMarker(pluginName)}\n${content.trim()}\n${endMarker(pluginName)}`;
+    await (0, json_mutation_1.withFileLock)(file, async () => {
+        let next;
+        if (!fs_1.default.existsSync(file)) {
+            next = block + '\n';
+        }
+        else {
+            const cur = fs_1.default.readFileSync(file, 'utf8');
+            const match = locateBlock(cur, pluginName);
+            if (match) {
+                next = cur.slice(0, match.start) + block + cur.slice(match.end);
+            }
+            else {
+                const sep = cur.endsWith('\n\n') ? '' : cur.endsWith('\n') ? '\n' : '\n\n';
+                next = cur + sep + block + '\n';
+            }
+        }
+        (0, json_mutation_1.atomicWriteFileSync)(file, next);
+    });
+}
+/**
+ * Remove the managed block for `pluginName`. No-op when the instructions
+ * file is missing or the block is absent. Surrounding user content is
+ * preserved byte-identical.
+ *
+ * If removing the block leaves the file empty (the managed block was the
+ * only content), the file is deleted — this restores the pre-install state
+ * for projects that didn't have an instructions file before any plugin
+ * install. The filename defaults to `CLAUDE.md`.
+ */
+async function removeBlock(projectPath, pluginName, filename = 'CLAUDE.md') {
+    const file = instructionsMdPath(projectPath, filename);
+    if (!fs_1.default.existsSync(file))
+        return;
+    await (0, json_mutation_1.withFileLock)(file, async () => {
+        const cur = fs_1.default.readFileSync(file, 'utf8');
+        const match = locateBlock(cur, pluginName);
+        if (!match)
+            return;
+        // Strip the block plus a single trailing newline if present, so we don't
+        // leave a stray blank line behind.
+        let next = cur.slice(0, match.start) + cur.slice(match.end);
+        next = next.replace(/\n{3,}$/, '\n').replace(/^\n+/, '');
+        if (next.trim() === '') {
+            fs_1.default.unlinkSync(file);
+            return;
+        }
+        (0, json_mutation_1.atomicWriteFileSync)(file, next);
+    });
+}
+// Suppress unused-warning for the legacy alias — kept for API ergonomics.
+void claudeMdPath;

package/server/dist/plugins/codex-mcp.js

@@ -0,0 +1,108 @@
+"use strict";
+// Codex MCP registration helpers. Plugins on codex projects don't write
+// `<project>/.mcp.json`; instead, the app invokes `codex mcp add` against
+// a per-project `CODEX_HOME` so the resulting MCP registration is scoped
+// to that project alone, never leaking into the user's terminal codex
+// state or another managed project.
+//
+// Spec: openspec/changes/add-multi-provider-support/specs/plugin-system/spec.md
+//   - "Plugin install path is provider-aware" / "Per-provider home directory
+//      isolates plugin state"
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexHomeFor = codexHomeFor;
+exports.ensureCodexHome = ensureCodexHome;
+exports.codexMcpAdd = codexMcpAdd;
+exports.codexMcpRemove = codexMcpRemove;
+exports.codexMcpList = codexMcpList;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+/** Per-project CODEX_HOME root, sibling of the existing
+ *  `~/.specrails/projects/<slug>/{telemetry,jobs,explore-cwd,...}` tree. */
+function codexHomeFor(slug) {
+    return path_1.default.join(os_1.default.homedir(), '.specrails', 'projects', slug, 'codex-home');
+}
+/** Lazy-create the per-project codex home so `codex mcp add` writes its
+ *  config there without touching the user's `~/.codex/`. */
+function ensureCodexHome(slug) {
+    const dir = codexHomeFor(slug);
+    fs_1.default.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** Run `codex mcp add <name> -- <command> <args...>` with the project's
+ *  CODEX_HOME exported. Idempotent at the caller level — invokers should
+ *  probe `codexMcpList` first when re-registration matters. */
+function codexMcpAdd(slug, name, entry) {
+    const home = ensureCodexHome(slug);
+    const argv = ['mcp', 'add', name, '--', entry.command, ...entry.args];
+    const result = (0, child_process_1.spawnSync)('codex', argv, {
+        env: {
+            ...process.env,
+            ...(entry.env ?? {}),
+            CODEX_HOME: home,
+        },
+        encoding: 'utf-8',
+        timeout: 10_000,
+    });
+    if (result.error) {
+        return { ok: false, stdout: '', stderr: `${result.error.message}` };
+    }
+    return {
+        ok: (result.status ?? 1) === 0,
+        stdout: `${result.stdout ?? ''}`,
+        stderr: `${result.stderr ?? ''}`,
+    };
+}
+/** Run `codex mcp remove <name>` against the per-project CODEX_HOME. */
+function codexMcpRemove(slug, name) {
+    const home = ensureCodexHome(slug);
+    const result = (0, child_process_1.spawnSync)('codex', ['mcp', 'remove', name], {
+        env: { ...process.env, CODEX_HOME: home },
+        encoding: 'utf-8',
+        timeout: 10_000,
+    });
+    if (result.error) {
+        return { ok: false, stdout: '', stderr: `${result.error.message}` };
+    }
+    return {
+        ok: (result.status ?? 1) === 0,
+        stdout: `${result.stdout ?? ''}`,
+        stderr: `${result.stderr ?? ''}`,
+    };
+}
+/** Run `codex mcp list` against the per-project CODEX_HOME and return the
+ *  list of registered server names. Output format is `codex mcp list`'s
+ *  plain text — best-effort line scan, since codex doesn't expose --json
+ *  for this subcommand. */
+function codexMcpList(slug) {
+    const home = ensureCodexHome(slug);
+    const result = (0, child_process_1.spawnSync)('codex', ['mcp', 'list'], {
+        env: { ...process.env, CODEX_HOME: home },
+        encoding: 'utf-8',
+        timeout: 10_000,
+    });
+    if (result.error || (result.status ?? 1) !== 0) {
+        return { ok: false, servers: [], raw: `${result.stderr ?? result.stdout ?? ''}` };
+    }
+    const raw = `${result.stdout ?? ''}`;
+    // Heuristic line scan: a server name appears at the start of a line, then
+    // whitespace, then the command. Lines starting with `#` or empty are
+    // ignored. Empty list also returns ok with []. We intentionally don't
+    // hard-fail when the format drifts — manifest-level checks downstream
+    // catch real misalignments.
+    const servers = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const firstToken = trimmed.split(/\s+/)[0];
+        if (firstToken && /^[A-Za-z][A-Za-z0-9_-]*$/.test(firstToken)) {
+            servers.push(firstToken);
+        }
+    }
+    return { ok: true, servers, raw };
+}

package/server/dist/plugins/contributors.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_FILE_CONTRIBUTORS = void 0;
+exports.applyContributors = applyContributors;
+exports.revertContributors = revertContributors;
+exports.contributorPaths = contributorPaths;
+const claude_md_mutation_1 = require("./claude-md-mutation");
+const providers_1 = require("../providers");
+/** Resolve the instructions filename for a provider id, defaulting to
+ *  `CLAUDE.md` when the id is unknown or absent. */
+function instructionsFilenameFor(providerId) {
+    if (!providerId)
+        return 'CLAUDE.md';
+    try {
+        return (0, providers_1.getAdapter)(providerId).instructionsFilename;
+    }
+    catch {
+        return 'CLAUDE.md';
+    }
+}
+/** Provider-aware instructions-file contributor. Same block format
+ *  (`<!-- specrails-desktop-managed:<plugin>:start/end -->`); destination
+ *  filename is the adapter's `instructionsFilename`. */
+const instructionsMdContributor = {
+    id: 'instructions-md',
+    appliesTo: (p) => typeof p.manifest.claudeMdInstructions === 'string' && p.manifest.claudeMdInstructions.trim().length > 0,
+    relativePaths: (_p, providerId) => [instructionsFilenameFor(providerId)],
+    apply: async (p, projectPath, providerId) => {
+        await (0, claude_md_mutation_1.upsertBlock)(projectPath, p.manifest.name, p.manifest.claudeMdInstructions, instructionsFilenameFor(providerId));
+    },
+    revert: async (p, projectPath, providerId) => {
+        await (0, claude_md_mutation_1.removeBlock)(projectPath, p.manifest.name, instructionsFilenameFor(providerId));
+    },
+};
+exports.SHARED_FILE_CONTRIBUTORS = [
+    instructionsMdContributor,
+];
+/** Run `apply` for every contributor that applies to this plugin. */
+async function applyContributors(plugin, projectPath, providerId) {
+    const touchedPaths = [];
+    for (const c of exports.SHARED_FILE_CONTRIBUTORS) {
+        if (!c.appliesTo(plugin))
+            continue;
+        await c.apply(plugin, projectPath, providerId);
+        for (const rel of c.relativePaths(plugin, providerId)) {
+            if (!touchedPaths.includes(rel))
+                touchedPaths.push(rel);
+        }
+    }
+    return touchedPaths;
+}
+/** Run `revert` for every contributor that applies to this plugin. */
+async function revertContributors(plugin, projectPath, providerId) {
+    for (const c of exports.SHARED_FILE_CONTRIBUTORS) {
+        if (!c.appliesTo(plugin))
+            continue;
+        await c.revert(plugin, projectPath, providerId);
+    }
+}
+/** Project-relative paths every applicable contributor will touch. */
+function contributorPaths(plugin, providerId) {
+    const out = [];
+    for (const c of exports.SHARED_FILE_CONTRIBUTORS) {
+        if (!c.appliesTo(plugin))
+            continue;
+        for (const rel of c.relativePaths(plugin, providerId)) {
+            if (!out.includes(rel))
+                out.push(rel);
+        }
+    }
+    return out;
+}

package/server/dist/plugins/drift.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectMcpDrift = detectMcpDrift;
+const fs_1 = __importDefault(require("fs"));
+const paths_1 = require("./paths");
+const claude_md_mutation_1 = require("./claude-md-mutation");
+/**
+ * Returns true when the project's `.mcp.json` entry for any of the plugin's
+ * owned mcpServers no longer matches the bundled manifest. Used to surface
+ * an "Update available" affordance when upstream changes args (e.g.,
+ * Serena's `serena-mcp-server` → `serena start-mcp-server`).
+ *
+ * Only inspects entries the plugin owns; user-authored entries are ignored.
+ */
+function detectMcpDrift(projectPath, plugin) {
+    const ownedKeys = plugin.manifest.owns.mcpServers ?? [];
+    if (ownedKeys.length === 0)
+        return false;
+    // The plugin tells us what its current canonical entry should look like
+    // via `previewInstall` is too heavy; we instead introspect via a marker:
+    // plugins that ship their canonical entry expose it via `expectedMcpEntry`.
+    // We accept Plugins without it (drift detection silently disabled).
+    const expected = plugin
+        .expectedMcpEntry?.();
+    if (!expected)
+        return false;
+    const file = (0, paths_1.mcpJsonPath)(projectPath);
+    if (!fs_1.default.existsSync(file))
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(fs_1.default.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    const servers = parsed.mcpServers ?? {};
+    for (const key of ownedKeys) {
+        const current = servers[key];
+        if (current === undefined)
+            continue;
+        if (JSON.stringify(current) !== JSON.stringify(expected))
+            return true;
+    }
+    // Shared-file contributor drift. Today only CLAUDE.md is contributed to;
+    // we hardcode the comparison here. If/when more shared-file contributors
+    // land we move this to a `compareDrift` hook on the contributor type.
+    if (plugin.manifest.claudeMdInstructions) {
+        const expectedMd = plugin.manifest.claudeMdInstructions.trim();
+        const actualMd = ((0, claude_md_mutation_1.getBlockContent)(projectPath, plugin.manifest.name) ?? '').trim();
+        if (actualMd !== expectedMd)
+            return true;
+    }
+    return false;
+}

package/server/dist/plugins/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUNDLED_PLUGINS = void 0;
+const serena_1 = require("./serena");
+/**
+ * Bundled plugins available to every project on this app build. Adding a new
+ * plugin requires only:
+ *   1. Implementing the `Plugin` interface under `server/plugins/<name>/`.
+ *   2. Importing and appending it to this array.
+ *
+ * No other code in the app needs to change. PluginManager iterates this list
+ * dynamically; conflicts (overlapping ownership) fail fast at startup.
+ */
+exports.BUNDLED_PLUGINS = [serena_1.serenaPlugin];