toolfactory 0.1.1 → 0.2.0

package/dist/project/gate.js

@@ -9,6 +9,8 @@
  * A step here is a command and nothing else. GitHub Actions `uses:` steps are runner provisioning
  * (checkout, toolchains, caches) and stay in `src/surfaces/workflows.ts`, which wraps this list.
  */
+import { nativePackageSteps, nativeRegistryRows, nativeToolchainSteps, } from "../distribution/native.js";
+import { systemPackageSteps, systemRegistryRows, } from "../distribution/system.js";
 import { githubSlug } from "../hosts/github.js";
 import { githubOwner, projectName } from "../identity/name.js";
 import { isInstructionOnly } from "../model.js";
@@ -17,6 +19,7 @@ import { HOST_DIR as DSH_HOST_DIR } from "../surfaces/dsh.js";
 import { MANIFEST_PATH as MCPB_MANIFEST_PATH, MCPB_PIN } from "../surfaces/mcpb.js";
 import { HOST_DIR as OPENCLAW_HOST_DIR } from "../surfaces/openclaw-native.js";
 import { configProperties, envName, has, isSensitive, npmName, pypiName, } from "../surfaces/shared.js";
+import { extensionName, OVSX_VERSION, publisher, VSCE_VERSION, HOST_DIR as VSCODE_HOST_DIR, vsixName, } from "../surfaces/vscode-extension.js";
 /** Where `toolfactory package` and the release `package` job leave every asset. */
 export const RELEASE_DIR = "dist/release";
 /** The web app's build, shared by the release tarball and the Pages job (which sets `PAGES_BASE`). */
@@ -88,11 +91,18 @@ export function gateSteps(project) {
     const pm = commands(project);
     const cli = toolfactoryCli(project);
     const openclaw = has(project, "openclaw-native");
-    const steps = [
-        ...bootstrapSteps(project),
-        { name: "toolfactory check", run: `${cli} check` },
-        outputsStep(project),
-    ];
+    const steps = [...bootstrapSteps(project)];
+    if (!typescript && has(project, "hermes-native")) {
+        // Hermes' launcher clears PYTHONPATH and runs its own venv. Its plugin dependency
+        // declaration is advisory, so Doctor can import a native Python core only after the
+        // project is installed into that interpreter. Run after bootstrap's `uv sync` on CI.
+        steps.push({
+            name: "Install core into Hermes",
+            run: 'uv pip install --python "$HOME/.hermes/hermes-agent/venv/bin/python" --editable .',
+            when: "ci",
+        });
+    }
+    steps.push({ name: "toolfactory check", run: `${cli} check` }, outputsStep(project));
     if (has(project, "claude")) {
         steps.push({
             name: "Install Claude Code CLI",
@@ -100,7 +110,9 @@ export function gateSteps(project) {
             when: "ci",
         });
     }
-    if (has(project, "web") || has(project, "browser-extension")) {
+    if (has(project, "web") ||
+        has(project, "browser-extension") ||
+        has(project, "vscode-extension")) {
         // The web smoke and the browser extension's own Playwright smoke both drive Chromium;
         // their own npm installs fetch the browser, the runner needs its system libraries.
         steps.push({
@@ -109,6 +121,7 @@ export function gateSteps(project) {
             when: "ci",
         });
     }
+    steps.push(...nativeToolchainSteps(project));
     steps.push({
         name: "toolfactory validate",
         run: `${cli} validate`,
@@ -121,6 +134,8 @@ export function gateSteps(project) {
         name: "author tests",
         run: typescript ? pm.test : "uv run --with pytest pytest -q",
     });
+    if (typescript)
+        steps.push({ name: "author integration tests", run: pm.run("test:integration") });
     if (openclaw) {
         // T3, credential-free: one real OpenClaw agent turn against a scripted model. The suite only
         // exists when `tool.json` `tests.examples` names an operation the plugin carries, which is
@@ -183,13 +198,16 @@ const LEGAL_BUNDLE_PATHS = [
  * the release workflow's `package` job, which uploads the directory as one artifact. Publishing
  * to a registry stays a CI concern; producing the artifacts never is.
  */
-export function packageSteps(project) {
+export function packageSteps(project, options = {}) {
     const cli = toolfactoryCli(project);
     const name = project.identity.name;
     const steps = [
         { name: "release directory", run: `rm -rf ${RELEASE_DIR} && mkdir -p ${RELEASE_DIR}` },
         ...bootstrapSteps(project),
         outputsStep(project),
+        ...nativeToolchainSteps(project),
+        ...nativePackageSteps(project),
+        ...systemPackageSteps(project, { include: options.system !== false }),
     ];
     if (has(project, "web")) {
         steps.push({
@@ -202,27 +220,34 @@ export function packageSteps(project) {
     if (has(project, "npm")) {
         steps.push({ name: "npm tarball", run: `npm pack --pack-destination ${RELEASE_DIR}` });
     }
+    if (has(project, "pypi")) {
+        // Keep the wheel and sdist apart from the release's npm tarballs, plugin bundles and web
+        // archive: PyPA's publisher accepts only Python distribution files. The MCPB stage below
+        // unpacks this same canonical sdist rather than reproducing its source-file selection.
+        steps.push({ name: "python distributions", run: `uv build --out-dir ${RELEASE_DIR}/pypi` });
+    }
     if (has(project, "mcpb")) {
-        // A bundle root is the published package with its production dependencies installed into
-        // it, so it is built from the tarball `npm pack` just wrote rather than from the checkout:
-        // whatever ships to npm is exactly what ships to Claude Desktop. `--ignore-scripts` because
-        // nothing in a bundle root may run a build; the tarball already carries `dist/`.
         const stage = "dist/mcpb";
-        const tarball = npmTarball(project);
         steps.push({
             name: "MCPB bundle",
-            run: [
-                `rm -rf ${stage} && mkdir -p ${stage}`,
-                `tar -xzf ${RELEASE_DIR}/${tarball} -C ${stage} --strip-components=1`,
-                `npm --prefix ${stage} install --omit=dev --ignore-scripts`,
-                `cp ${MCPB_MANIFEST_PATH} ${stage}/manifest.json`,
-                `npx -y @anthropic-ai/mcpb@${MCPB_PIN} pack ${stage} ${RELEASE_DIR}/${name}.mcpb`,
-            ].join(" && "),
+            run: project.tool.binding === "python"
+                ? [
+                    `rm -rf ${stage} && mkdir -p ${stage}`,
+                    `tar -xzf ${RELEASE_DIR}/pypi/*.tar.gz -C ${stage} --strip-components=1`,
+                    `cp ${MCPB_MANIFEST_PATH} ${stage}/manifest.json`,
+                    `npx -y @anthropic-ai/mcpb@${MCPB_PIN} pack ${stage} ${RELEASE_DIR}/${name}.mcpb`,
+                ].join(" && ")
+                : [
+                    // The Node bundle root is the published package with production dependencies
+                    // installed, so whatever ships to npm is exactly what ships to Claude Desktop.
+                    `rm -rf ${stage} && mkdir -p ${stage}`,
+                    `tar -xzf ${RELEASE_DIR}/${npmTarball(project)} -C ${stage} --strip-components=1`,
+                    `npm --prefix ${stage} install --omit=dev --ignore-scripts`,
+                    `cp ${MCPB_MANIFEST_PATH} ${stage}/manifest.json`,
+                    `npx -y @anthropic-ai/mcpb@${MCPB_PIN} pack ${stage} ${RELEASE_DIR}/${name}.mcpb`,
+                ].join(" && "),
         });
     }
-    if (has(project, "pypi")) {
-        steps.push({ name: "python distributions", run: `uv build --out-dir ${RELEASE_DIR}` });
-    }
     if (has(project, "openclaw-native")) {
         // ClawHub's reusable workflow has no build step of its own, so the tarball it publishes has
         // to arrive already built (`package_artifact_name`).
@@ -281,6 +306,12 @@ export function packageSteps(project) {
         });
     }
     // COVERAGE.md is tracked; coverage.json is a build output that need not be, so recompute it.
+    if (has(project, "vscode-extension")) {
+        steps.push({
+            name: "VS Code extension VSIX",
+            run: `npm --prefix ${VSCODE_HOST_DIR} install && npm --prefix ${VSCODE_HOST_DIR} run vsix && cp ${VSCODE_HOST_DIR}/extension.vsix ${RELEASE_DIR}/${vsixName(project)}`,
+        });
+    }
     steps.push({
         name: "coverage report",
         run: `cp COVERAGE.md ${RELEASE_DIR}/ && ${cli} coverage > ${RELEASE_DIR}/coverage.json`,
@@ -341,6 +372,22 @@ const ASC_SECRETS = ["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_PRIVATE_KEY"];
 export const RELEASE_SECRET_NAMES = [
     "NPM_TOKEN",
     "CLAWHUB_TOKEN",
+    "VSCE_PAT",
+    "OVSX_PAT",
+    "CARGO_REGISTRY_TOKEN",
+    "NUGET_API_KEY",
+    "MAVEN_CENTRAL_USERNAME",
+    "MAVEN_CENTRAL_PASSWORD",
+    "MAVEN_GPG_PRIVATE_KEY",
+    "MAVEN_GPG_PASSPHRASE",
+    "RUBYGEMS_API_KEY",
+    "HOMEBREW_TAP_TOKEN",
+    "SCOOP_BUCKET_TOKEN",
+    "CHOCOLATEY_API_KEY",
+    "APT_GPG_PRIVATE_KEY",
+    "APT_GPG_KEY_ID",
+    "COPR_LOGIN",
+    "COPR_TOKEN",
     ...CHROME_SECRETS,
     ...FIREFOX_SECRETS,
     ...EDGE_SECRETS,
@@ -365,6 +412,29 @@ export function registries(project) {
     const browserZip = (browser) => `${BROWSER_HOST_DIR}/.output/${zipName(project, browser)}`;
     const wxtSubmit = `npm --prefix ${BROWSER_HOST_DIR} exec --no -- wxt submit --dry-run`;
     const rows = [
+        ...nativeRegistryRows(project),
+        ...systemRegistryRows(project),
+        {
+            id: "vscode-marketplace",
+            surfaces: ["vscode-extension"],
+            secrets: ["VSCE_PAT"],
+            url: "https://marketplace.visualstudio.com/manage",
+            probe: `npx --yes @vscode/vsce@${VSCE_VERSION} verify-pat ${publisher(project)}`,
+            exists: `npx --yes @vscode/vsce@${VSCE_VERSION} show ${publisher(project)}.${extensionName(project)} --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.exit(JSON.parse(s).versions.some(v=>v.version==="${version}")?0:1))'`,
+            gate: allSet(["VSCE_PAT"]),
+            retractUrl: "https://marketplace.visualstudio.com/manage",
+            retractHard: `npx --yes @vscode/vsce@${VSCE_VERSION} unpublish ${publisher(project)}.${extensionName(project)} --force`,
+        },
+        {
+            id: "open-vsx",
+            surfaces: ["vscode-extension"],
+            secrets: ["OVSX_PAT"],
+            url: "https://open-vsx.org/user-settings/tokens",
+            probe: `npx --yes ovsx@${OVSX_VERSION} verify-pat ${publisher(project)}`,
+            exists: `curl -fsS -o /dev/null https://open-vsx.org/api/${publisher(project)}/${extensionName(project)}/${version}`,
+            gate: allSet(["OVSX_PAT"]),
+            retractUrl: "https://open-vsx.org/user-settings/extensions",
+        },
         {
             id: "npm",
             surfaces: ["npm"],
@@ -513,7 +583,9 @@ export function registries(project) {
         },
     ];
     const selected = rows.filter((row) => row.surfaces.every((surface) => has(project, surface)) &&
-        (row.id !== "safari" || project.tool.browserExtension?.safari === true));
+        (row.id !== "safari" || project.tool.browserExtension?.safari === true) &&
+        (row.id !== "vscode-marketplace" || project.tool.vscode?.marketplace !== false) &&
+        (row.id !== "open-vsx" || project.tool.vscode?.openvsx !== false));
     const mcpRegistry = selected.find((row) => row.id === "mcp-registry");
     if (mcpRegistry) {
         const packages = selected.filter((row) => row.id === "npm" || row.id === "pypi" || row.id === "oci");
@@ -521,6 +593,11 @@ export function registries(project) {
             ? packages.map((row) => `[ "$${gateVariable(row)}" = true ]`).join(" && ")
             : "true";
     }
+    const runtime = selected.find((row) => row.id === (project.tool.binding === "python" ? "pypi" : "npm"));
+    for (const row of selected.filter((row) => row.id === "vscode-marketplace" || row.id === "open-vsx")) {
+        if (runtime)
+            row.gate = `(${row.gate}) && { ${runtime.exists} || { ${runtime.gate}; }; }`;
+    }
     return selected;
 }
 /** The shell variable the release gate holds a row's presence in; the job output takes the same name. */
@@ -544,6 +621,8 @@ export function manualSteps(project) {
     const has_ = (id) => rows.some((row) => row.id === id);
     const slug = githubSlug(project.identity.repository);
     const steps = [];
+    if (has_("vscode-marketplace") || has_("open-vsx"))
+        steps.push("VS Code: register the publisher in Visual Studio Marketplace; create the Open VSX namespace and accept its publisher agreement before setting VSCE_PAT / OVSX_PAT. tool.vscode.publisher selects that identity.");
     if (has_("oci")) {
         steps.push(`ghcr.io: the first push publishes a private image whatever the repository's visibility, and GitHub has no visibility API — flip it once at ${rows.find((row) => row.id === "oci")?.url}.`);
     }

package/dist/project/history.d.ts

@@ -10,7 +10,7 @@ export declare function toolAtRef(root: string, ref: string): {
     schemaVersion: 1;
     identity: string;
     binding: "typescript" | "python";
-    surfaces: ("skill" | "agent-plugins" | "claude" | "codex" | "cursor" | "mcp" | "mcp-registry" | "cli" | "npm" | "pypi" | "openclaw-native" | "hermes-native" | "clawhub" | "web" | "dsh" | "workflows" | "agents" | "readme" | "gemini" | "mcpb" | "browser-extension")[];
+    surfaces: ("homebrew" | "winget" | "scoop" | "chocolatey" | "apt" | "rpm" | "skill" | "agent-plugins" | "claude" | "codex" | "cursor" | "mcp" | "mcp-registry" | "cli" | "npm" | "pypi" | "openclaw-native" | "hermes-native" | "clawhub" | "web" | "dsh" | "workflows" | "agents" | "readme" | "gemini" | "mcpb" | "browser-extension" | "vscode-extension" | "cargo" | "nuget" | "maven-central" | "rubygems" | "packagist" | "go-module")[];
     bundle: {
         runtime: "package" | "bundled";
     };
@@ -28,6 +28,7 @@ export declare function toolAtRef(root: string, ref: string): {
         scope?: string | undefined;
     } | undefined;
     codex?: {
+        mcp: boolean;
         interface?: Record<string, unknown> | undefined;
     } | undefined;
     browserExtension?: {
@@ -45,6 +46,34 @@ export declare function toolAtRef(root: string, ref: string): {
     hermes?: {
         toolset?: string | undefined;
     } | undefined;
+    vscode?: {
+        marketplace: boolean;
+        openvsx: boolean;
+        publisher?: string | undefined;
+    } | undefined;
+    nativePackages?: {
+        id: "cargo" | "nuget" | "maven-central" | "rubygems" | "packagist" | "go-module";
+        path: string;
+        identity: string;
+        name: string;
+        versionCommand?: string | undefined;
+    }[] | undefined;
+    systemPackages?: {
+        id: "homebrew" | "winget" | "scoop" | "chocolatey" | "apt" | "rpm";
+        path: string;
+        identity: string;
+        name: string;
+        versionCommand: string;
+        buildDependencies: string[];
+        buildCommand?: string | undefined;
+        asset?: string | undefined;
+        tap?: string | undefined;
+        bucket?: string | undefined;
+        bucketName?: string | undefined;
+        catalogPath?: string | undefined;
+        ppa?: string | undefined;
+        coprProject?: string | undefined;
+    }[] | undefined;
     openclaw?: {
         registers?: {
             api: string;

package/dist/project/lock.d.ts

@@ -16,6 +16,11 @@ export declare const LockSchema: z.ZodObject<{
             manual: "manual";
         }>;
         keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyedArrays: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            id: z.ZodString;
+            values: z.ZodArray<z.ZodString>;
+            entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        }, z.core.$strip>>>;
         regions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             begin: z.ZodString;
             end: z.ZodString;

package/dist/project/lock.js

@@ -17,6 +17,15 @@ export const LockSchema = z.object({
          * patch — or deselecting the surface that added it — uninstalls it instead of stranding it.
          */
         keys: z.array(z.string()).optional(),
+        /** A keyed array's inverse: the entries Toolfactory owns at each dotted path. */
+        keyedArrays: z
+            .record(z.string(), z.object({
+            id: z.string(),
+            values: z.array(z.string()),
+            /** The last projected entry shape lets a later plan remove only stale generated leaves. */
+            entries: z.record(z.string(), z.record(z.string(), z.unknown())).optional(),
+        }))
+            .optional(),
         /**
          * A region file's inverse, exactly as `keys` is a merge file's: the marker pairs its
          * projector wrote. Regions the current plan no longer writes are emptied before the current

package/dist/surfaces/agent-plugins.js

@@ -1,4 +1,4 @@
-import { json, kernelLaunch, mcpVerdict } from "./shared.js";
+import { kernelLaunch, mcpVerdict } from "./shared.js";
 export const MCP_SCHEMA_ID = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
 export const PLUGIN_SCHEMA_ID = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
 export function assertBundleIdentity(project) {
@@ -13,12 +13,13 @@ export const surface = {
         const launch = kernelLaunch(project, "${PLUGIN_ROOT}");
         return [
             {
-                kind: "file",
+                kind: "merge",
                 path: "mcp.json",
-                content: json({
+                format: "json",
+                patch: {
                     $schema: MCP_SCHEMA_ID,
                     mcpServers: { [project.identity.name]: { type: "stdio", ...launch } },
-                }),
+                },
             },
         ];
     },

package/dist/surfaces/agents.js

@@ -58,6 +58,12 @@ export const RELOAD = [
         instructions: "`hermes skills trust` once in this repo, then a new conversation: the resolved skill directories are stable for a conversation.",
         line: "Run `hermes skills trust` once in this repo, then start a new Hermes conversation — every invocation re-scans plugins, skills and AGENTS.md. `/reload-mcp` only affects an already-open session; `hermes gateway restart` is only for the messaging gateway.",
     },
+    {
+        harness: "GSD",
+        env: [],
+        mcp: "`python3 .agents/sync.py --all` renders the shared `.mcp.json` even on a GSD-only machine. Refresh with `mcp_servers(refresh=true)`; start a new session after changing a connected server. Approve `mcp_discover` interactively once before unattended stdio use.",
+        instructions: "Reads `AGENTS.md` and `.agents/skills/` natively; `/reload` refreshes resources. `--bare` omits them.",
+    },
     {
         harness: "Gemini CLI",
         env: [],
@@ -154,7 +160,8 @@ function layoutSection(project) {
     if (has(project, "openclaw-native") ||
         has(project, "hermes-native") ||
         has(project, "dsh") ||
-        has(project, "browser-extension")) {
+        has(project, "browser-extension") ||
+        has(project, "vscode-extension")) {
         lines.push("- `hosts/<id>/` — the host-native escape hatch for a selected host; nothing else creates it.");
     }
     if (has(project, "web"))
@@ -210,6 +217,9 @@ function installSection(project) {
     if (has(project, "dsh")) {
         lines.push(`- **DSH** (experimental): \`dsh plugin --profile ${DSH_PROFILE} add ./${DSH_HOST_DIR}\` installs the`, "  bundle (`dsh plugin` forwards to pnpm, so pnpm must be on `PATH`); the operations reach the", `  model as \`${dshToolName(project, "<operation>")}\`, and \`dsh --profile ${DSH_PROFILE} --dump-config\` shows`, `  the composed \`id: ${dshRowId(project)}\` row. Bundle patches are read once per boot and never watched,`, `  so restart DSH after editing \`${DSH_HOST_DIR}/${PATCH_FILE}\` or reinstalling. Boot with`, `  \`--patch ${DSH_HOST_DIR}/${LOCAL_PATCH_FILE}\` and no bundle installed to drive this checkout`, "  instead. Every config variable is restated in the row's `env:` because DSH scrubs", "  KEY/PASSWORD/SECRET/TOKEN names before spawning an MCP server.");
     }
+    if (has(project, "vscode-extension")) {
+        lines.push("- **VS Code extension**: `npm --prefix hosts/vscode install`, then open `hosts/vscode` in VS Code", "  and press F5. Development and `npm --prefix hosts/vscode test` use the checkout's kernel.", "  `npm --prefix hosts/vscode run vsix` packages it; install with `code --install-extension hosts/vscode/extension.vsix`.", "  Use Developer: Reload Window after rebuilding an installed extension. Native activation, contributions", "  and every VS Code API are available in your own files; include your license in the extension directory.");
+    }
     if (has(project, "browser-extension")) {
         const { command, args } = getBinding(project.tool.binding).cliCommand(project);
         lines.push(`- **Browser extension**: \`npm --prefix ${BROWSER_HOST_DIR} install && npm --prefix ${BROWSER_HOST_DIR} exec --no -- wxt build\`,`, `  then \`chrome://extensions\` → developer mode → Load unpacked → \`${BROWSER_HOST_DIR}/.output/chrome-mv3\`;`, `  \`npm --prefix ${BROWSER_HOST_DIR} exec --no -- web-ext run\` does the same for Firefox. Pair it with this`, `  checkout's kernel: \`${[command, ...args].join(" ")} mcp --http --pair\` mints a token under the data`, `  directory and prints the \`<url>#<token>\` the extension's options page accepts (with no token minted`, `  and no \`${envName(project.identity.name)}_MCP_TOKEN\` in the environment the endpoint stays open on loopback). The content`, "  script's selectors are yours to maintain: it is authored escape-hatch code against a page that", "  changes on its own schedule, and nothing here can version-proof it.");
@@ -218,7 +228,8 @@ function installSection(project) {
         !openclaw &&
         !hermes &&
         !has(project, "dsh") &&
-        !has(project, "browser-extension")) {
+        !has(project, "browser-extension") &&
+        !has(project, "vscode-extension")) {
         lines.push("_No host-native surface (`openclaw-native`, `hermes-native`, `dsh`, `browser-extension`) or", "`gemini` extension is selected; nothing installs into a running host._");
     }
     lines.push("", "Codex and Cursor read this file as is; Claude Code and Gemini read `CLAUDE.md` / `GEMINI.md`,", "each of which `.agents/sync.py` renders as the one line `@AGENTS.md`.", "");
@@ -564,6 +575,19 @@ function devcontainer(project) {
         : document.features;
     return `${JSON.stringify({ ...document, features }, null, 2)}\n`;
 }
+/** The vendor-owned workflow gains the Python prerequisite it cannot know. */
+function agentConfigWorkflow(project) {
+    const path = ".github/workflows/agent-config.yml";
+    const workflow = TEMPLATE_FILES[path] ?? "";
+    if (isInstructionOnly(project.tool) || project.tool.binding !== "python")
+        return workflow;
+    const setup = "      - name: Run the shared setup entry point\n";
+    if (!workflow.includes(setup))
+        throw new Error(`${path} no longer has the setup step; re-vendor before adding uv.`);
+    return workflow.replace(setup, "      - name: Install uv\n" +
+        "        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0\n\n" +
+        setup);
+}
 /** Whole-file carriers: no per-project content, `adopt` is the escape hatch. */
 function vendored(project) {
     const skip = new Set([SETUP_PATH, IGNORE_PATH, ".devcontainer/devcontainer.json"]);
@@ -573,7 +597,7 @@ function vendored(project) {
             .map(([path, content]) => ({
             kind: "file",
             path,
-            content,
+            content: path === ".github/workflows/agent-config.yml" ? agentConfigWorkflow(project) : content,
             ...(path.endsWith("sync.py") ? { mode: 0o755 } : {}),
         })),
         { kind: "file", path: ".devcontainer/devcontainer.json", content: devcontainer(project) },

package/dist/surfaces/agents.test.js

@@ -108,6 +108,18 @@ describe("agents", () => {
         expect(setup).toContain("npx toolfactory check >/dev/null");
         expect(setup).toContain("npm install --no-audit --no-fund");
     });
+    it("installs uv before Python projects run the vendored setup workflow", () => {
+        const workflow = planned(project(["cli"], { binding: "python" }), ".github/workflows/agent-config.yml");
+        if (workflow.kind !== "file")
+            throw new Error("expected an agent-config workflow file");
+        const install = "uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0";
+        expect(workflow.content).toContain(install);
+        expect(workflow.content.indexOf(install)).toBeLessThan(workflow.content.indexOf("run: bash .agents/setup --all"));
+        const typescript = planned(project(["cli"]), ".github/workflows/agent-config.yml");
+        if (typescript.kind !== "file")
+            throw new Error("expected an agent-config workflow file");
+        expect(typescript.content).toBe(TEMPLATE_FILES[".github/workflows/agent-config.yml"]);
+    });
     it("owns the agent adapters, the binding's ignores and the build outputs in .gitignore", () => {
         const bare = region(project(["cli"]), IGNORE_PATH);
         const agentBlocks = (TEMPLATE_FILES[IGNORE_PATH] ?? "").split("# ─── Secrets")[0] ?? "";

package/dist/surfaces/claude.js

@@ -5,7 +5,7 @@
  * `claude plugin marketplace add <owner>/<repo>` (and Copilot CLI's identical command) installs.
  */
 import { githubSlug } from "../hosts/github.js";
-import { compact, configProperties, envName, has, isSensitive, json, kernelLaunch, mcpVerdict, requiredConfig, } from "./shared.js";
+import { compact, configProperties, envName, has, isSensitive, kernelLaunch, mcpVerdict, requiredConfig, } from "./shared.js";
 export const surface = {
     id: "claude",
     plan(project) {
@@ -61,8 +61,13 @@ export const surface = {
             plugins: [compact({ name: identity.name, source: "./", description: identity.description })],
         });
         return [
-            { kind: "file", path: ".claude-plugin/plugin.json", content: json(manifest) },
-            { kind: "file", path: ".claude-plugin/marketplace.json", content: json(marketplace) },
+            { kind: "merge", path: ".claude-plugin/plugin.json", format: "json", patch: manifest },
+            {
+                kind: "merge",
+                path: ".claude-plugin/marketplace.json",
+                format: "json",
+                patch: marketplace,
+            },
         ];
     },
     validate(project) {

package/dist/surfaces/codex.js

@@ -8,7 +8,7 @@
  * this surface does not reach.
  */
 import { projectName } from "../identity/name.js";
-import { compact, has, json, kernelLaunch, mcpVerdict } from "./shared.js";
+import { compact, has, kernelLaunch, mcpVerdict } from "./shared.js";
 /** The Codex CLI (`@openai/codex`) `validate()` is proven against — pin for a deterministic gate. */
 export const CODEX_PIN = "0.152.1";
 export const surface = {
@@ -39,7 +39,7 @@ export const surface = {
             license: identity.license,
             keywords: identity.keywords,
             skills: has(project, "skill") ? "./skills/" : undefined,
-            mcpServers: has(project, "mcp")
+            mcpServers: has(project, "mcp") && project.tool.codex?.mcp !== false
                 ? { [identity.name]: kernelLaunch(project, "${PLUGIN_ROOT}") }
                 : undefined,
             interface: codexInterface,
@@ -60,8 +60,13 @@ export const surface = {
             ],
         });
         return [
-            { kind: "file", path: ".codex-plugin/plugin.json", content: json(manifest) },
-            { kind: "file", path: ".agents/plugins/marketplace.json", content: json(marketplace) },
+            { kind: "merge", path: ".codex-plugin/plugin.json", format: "json", patch: manifest },
+            {
+                kind: "merge",
+                path: ".agents/plugins/marketplace.json",
+                format: "json",
+                patch: marketplace,
+            },
         ];
     },
     validate(project) {

package/dist/surfaces/codex.test.js

@@ -29,9 +29,9 @@ describe("codex", () => {
     it("makes the repository its own single-plugin marketplace, and validates with the real codex CLI", () => {
         const files = codex.plan(project(["codex", "mcp"]));
         const marketplace = files.find((entry) => entry.path === ".agents/plugins/marketplace.json");
-        if (marketplace?.kind !== "file")
-            throw new Error("expected a whole file");
-        expect(JSON.parse(marketplace.content)).toMatchObject({
+        if (marketplace?.kind !== "merge")
+            throw new Error("expected a merge manifest");
+        expect(marketplace.patch).toMatchObject({
             name: "hello",
             interface: { displayName: "Hello" },
             plugins: [
@@ -59,9 +59,19 @@ describe("codex", () => {
         const target = project(["skill", "codex"]);
         target.tool.runtime = "none";
         const manifest = codex.plan(target).find((entry) => entry.path === ".codex-plugin/plugin.json");
-        if (manifest?.kind !== "file")
+        if (manifest?.kind !== "merge")
             throw new Error("expected a manifest");
-        expect(JSON.parse(manifest.content)).toMatchObject({ skills: "./skills/" });
-        expect(JSON.parse(manifest.content)).not.toHaveProperty("mcpServers");
+        expect(manifest.patch).toMatchObject({ skills: "./skills/" });
+        expect(manifest.patch).not.toHaveProperty("mcpServers");
+    });
+    it("can omit the eager MCP server while retaining the plugin skill", () => {
+        const target = project(["skill", "codex", "mcp"]);
+        target.tool.codex = { mcp: false };
+        const manifest = codex.plan(target).find((entry) => entry.path === ".codex-plugin/plugin.json");
+        if (manifest?.kind !== "merge")
+            throw new Error("expected a manifest");
+        const parsed = manifest.patch;
+        expect(parsed.skills).toBe("./skills/");
+        expect(parsed).not.toHaveProperty("mcpServers");
     });
 });

package/dist/surfaces/cursor.js

@@ -3,7 +3,7 @@
  * and the bundle's `mcp.json` is shared. Loader unverified, like Codex.
  */
 import { projectName } from "../identity/name.js";
-import { compact, configProperties, envName, has, json, mcpVerdict, requiredConfig, } from "./shared.js";
+import { compact, configProperties, envName, has, mcpVerdict, requiredConfig } from "./shared.js";
 export const surface = {
     id: "cursor",
     plan(project) {
@@ -39,7 +39,7 @@ export const surface = {
             mcpServers: has(project, "agent-plugins") ? "./mcp.json" : undefined,
             variables,
         });
-        return [{ kind: "file", path: ".cursor-plugin/plugin.json", content: json(manifest) }];
+        return [{ kind: "merge", path: ".cursor-plugin/plugin.json", format: "json", patch: manifest }];
     },
     verdict: (operation) => {
         const verdict = mcpVerdict(operation);