fix(cli): gate maintainer plugin source copy by rickylabs · Pull Request #133 · rickylabs/netscript

rickylabs · 2026-06-26T08:13:12Z

Summary

Gate maintainer/local official plugin source copying behind an explicit opt-out flag while preserving the public prod/JSR no-copy path. The local default remains the existing vendored-source behavior after drift showed the runtime e2e suite depends on that shape.

Scope

Archetype / area: CLI/tooling, packages/cli
Run dir: .llm/tmp/run/fix-cli-plugin-copy-flag-gate--copy-gate/

Slices

S1 local --no-copy-source plumbing and gate — 983b299a
S2 public prod no-copy regression lock — ae08da94
S3 e2e confirmation and debt close — a2f68d9c
Harness commit ledger update — 1174f3c0
Runtime Aspire evidence clarification — 863bd591
Final evidence ledger update — d894c77d

Validation

S1: run-deno-check.ts --root packages/cli --ext ts,tsx --pretty — pass, 0 findings
S1/S2: focused plugin-add units — pass, 2 suites / 8 steps
S1/S2: focused lint/fmt on changed files — pass; root lint/fmt wrappers exclude packages/cli and returned nonzero with 0 findings
S2: deno task publish:dry-run from packages/cli — pass; existing dynamic-import warnings, dry run complete
S3: native worktree confirmed at /home/codex/repos/netscript-cli-plugin-copy on ext4
S3: rtk proxy deno task e2e:cli run scaffold.plugins --cleanup --format pretty — pass; passed=11 failed=0
S3: first scaffold.runtime attempt — failed behavior.workers-executions after AppHost instability / connection refused; cleanup passed and evidence recorded
S3: Aspire/CLI parallel-mode check — e2e already uses aspire start --isolated; a concurrent scaffold runtime run can still contend on Aspire control-plane port 18891
S3: raw clean rerun deno task e2e:cli run scaffold.runtime --name plugin-copy-flag-runtime-20260626103409-raw --cleanup --format pretty --report .llm/tmp/run/fix-cli-plugin-copy-flag-gate--copy-gate/scaffold-runtime-raw-report.json --log-file .llm/tmp/run/fix-cli-plugin-copy-flag-gate--copy-gate/scaffold-runtime-raw.ndjson — pass; passed=47 failed=0

Harness

Phase: impl complete
PLAN-EVAL: waived by user self-review per run plan
Drift: D1 flipped to default-on with --no-copy-source after downstream runtime-gate coupling was found and recorded in drift.md.
Context pack: .llm/tmp/run/fix-cli-plugin-copy-flag-gate--copy-gate/context-pack.md

Drift / Debt

Drift resolved: default-off would require a larger runtime-reader/scaffold rework.
Validation drift recorded: parallel runtime suites can still collide on Aspire control-plane port 18891 even though --isolated is used.
Debt closed: PLUGIN-USERLAND-SOURCE-COPY in .llm/harness/debt/arch-debt.md.

Do not merge until the final evaluator/user review path clears.

…g-gate plugin source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

rickylabs · 2026-06-26T08:13:25Z

[PHASE: IMPL] [SLICE: S1]

Landed local maintainer copy gating with default vendored behavior preserved.

Scope

Added local-only --no-copy-source after --no-samples.
Threaded the flag into plugin-add request plumbing as noCopySource.
Gated maybeCopyOfficialPlugin() before canCopyPlugin() / copyPlugin() so opt-out falls through to PluginScaffolder.scaffold() with importMode: 'local'.
Updated local tests: default canonical plugin copy remains vendored; noCopySource produces a thin local-import stub and does not call copy helpers.
Recorded D1 flip and resolution in run artifacts after drift showed default-off would hollow out runtime e2e.

Commit

983b299a — fix(cli): gate local plugin source copy opt-out

Validation

deno test --allow-all packages/cli/src/local/features/plugins/add/add-local-plugin_test.ts — pass; 1 suite, 4 steps.
deno run --allow-read --allow-run .llm/tools/run-deno-check.ts --root packages/cli --ext ts,tsx --pretty — pass; 518 files, 5 batches, 0 findings.
deno test --allow-all packages/cli/src/local/features/plugins/add/add-local-plugin_test.ts packages/cli/src/public/features/plugins/add/add-plugin_test.ts — pass; 2 suites, 6 steps.
Focused changed-file lint/fmt — pass. Root scoped lint/fmt wrappers currently exclude packages/cli/ and returned nonzero with 0 findings; recorded in worklog.md.

Scope

Added a public canonical worker / workers plugin-add test.
Asserted generated public output stays on the JSR stub path and does not copy official source-only files under plugins/workers/.
Asserted no root workers workspace is created by the public path.
Added a static import-boundary assertion that public plugin-add files do not reference maintainer source-copy helpers.

Commit

ae08da94 — test(cli): lock public plugin add no-copy path

Validation

deno test --allow-all packages/cli/src/public/features/plugins/add/add-plugin_test.ts packages/cli/src/local/features/plugins/add/add-local-plugin_test.ts — pass; 2 suites, 8 steps.
deno task publish:dry-run from packages/cli — pass; dry run complete with existing dynamic-import warnings in plugin-registry.ts and UI registry.
Focused lint/fmt for add-plugin_test.ts — pass.

Scope

Added and closed PLUGIN-USERLAND-SOURCE-COPY in .llm/harness/debt/arch-debt.md.
Recorded S3 evidence in worklog.md and created context-pack.md for the run.
Preserved default maintainer e2e shape: official local plugin add still copies first-party source unless --no-copy-source is passed.

Commits

a2f68d9c — chore(harness): record plugin copy e2e closure
1174f3c0 — chore(harness): update plugin copy commit ledger

Validation

Native worktree: /home/codex/repos/netscript-cli-plugin-copy on ext4.
rtk proxy deno task e2e:cli run scaffold.plugins --cleanup --format pretty — pass; passed=11 failed=0.
First scaffold.runtime attempt — failed one gate, behavior.workers-executions, after AppHost instability/connection refused; cleanup passed. Recorded as transient evidence.
Clean rerun after confirming no 8091/8092/8093/8094/18891 listeners or plugin-smoke runtimes: rtk proxy deno task e2e:cli run scaffold.runtime --cleanup --format pretty — pass; passed=47 failed=0.

Update

Confirmed the e2e runtime path already launches Aspire with --isolated.
Recorded a validation drift note: another active scaffold runtime suite can still contend on Aspire's control-plane port 18891.
Added the raw successful runtime report/log artifacts to the harness run dir.
Final raw rerun from the WSL ext4 worktree passed: scaffold.runtime passed=47 failed=0.

Commits

863bd591 — clarify runtime Aspire evidence and add raw runtime report/log artifacts.
d894c77d — update harness commit ledger.

…lag-gate # Conflicts: # packages/cli/src/public/features/plugins/add/add-plugin_test.ts

…vioral guard test

Bump all 32 workspace members + cross-member jsr: import ranges from 0.0.1-alpha.4 to 0.0.1-alpha.5 via deno bump-version, plus the two wrapper-skipped manual edits (workspace-root deno.json version and the deno.lock @netscript/* range mirror). Unreleased substance since alpha.4: prod CLI usability (#136), JSR-safe asset embedding (#135), plugin-copy opt-out gate (#133), codex-watch (#134). Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

… (#164) * docs(release): one-shot deterministic release automation — research + plan (#147) Folds #122 (workspace-coordinated version bump: root+members+lock), #146 (drop --frozen rejected by Deno 2.9 deno ci), #123 (gate e2e-cli-prod behind publish via workflow_run, no JSR race), #133 (text-import preflight gate). Plan-only; no tooling code. Awaiting PLAN-EVAL before any implementation slice. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(openhands): apply agent changes * chore(openhands): record run trace 28304587059-1 * docs(release): PLAN-EVAL cycle-2 revision — narrow D3 + two-pass cross-line scan (#147) Addresses PLAN-EVAL cycle-1 FAIL_PLAN (sole blocker D3). D3 now scans only Deno.readTextFile/readFile (drops constructor false-positives) with a two-pass cross-line resolver for the openapi.ts:29->155 break class + positive/negative fixtures. Folds the 3 non-blocking clarifications: D4 artifact version handoff, D5 agentic:sync-claude regen, D2 exact edit sites. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(openhands): apply agent changes * chore(openhands): record run trace 28305083715-1 * chore(release): fix prod install args * chore(release): add text import preflight * chore(release): add release cut orchestrator * chore(release): order prod e2e after publish * docs(release): add release workflow skill * chore(harness): finalize release automation run artifacts * chore(openhands): apply agent changes * chore(openhands): record run trace 28305978962-1 * chore(lock): drop spurious @std/yaml entry from IMPL-EVAL ad-hoc parse The IMPL-EVAL evaluator ran an ad-hoc `@std/yaml parse` for workflow YAML sanity, which leaked jsr:@std/yaml@1 into the root deno.lock. No committed source imports @std/yaml, so the entry is unused churn. Restore deno.lock to the IMPL HEAD (58ab73c) state. Release-automation tooling is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: OpenHands Bot <openhands@all-hands.dev>

rickylabs added 2 commits June 26, 2026 10:02

docs(cli-plugin-copy): harness research + plan + implement brief (fla…

e0ecf9b

…g-gate plugin source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

fix(cli): gate local plugin source copy opt-out

983b299

rickylabs added area:cli status:impl type:fix labels Jun 26, 2026 — with ChatGPT Codex Connector

test(cli): lock public plugin add no-copy path

ae08da9

rickylabs added 2 commits June 26, 2026 10:30

chore(harness): record plugin copy e2e closure

a2f68d9

chore(harness): update plugin copy commit ledger

1174f3c

rickylabs added 2 commits June 26, 2026 10:39

chore(harness): clarify runtime aspire evidence

863bd59

chore(harness): update plugin copy evidence ledger

d894c77

rickylabs added 2 commits June 26, 2026 16:14

Merge remote-tracking branch 'origin/main' into fix/cli-plugin-copy-f…

49901e2

…lag-gate # Conflicts: # packages/cli/src/public/features/plugins/add/add-plugin_test.ts

fix(cli): gate public official-plugin copy on --no-copy-source + beha…

a2749f3

…vioral guard test

rickylabs marked this pull request as ready for review June 26, 2026 14:38

rickylabs merged commit b080185 into main Jun 26, 2026
6 checks passed

rickylabs deleted the fix/cli-plugin-copy-flag-gate branch June 26, 2026 14:38

rickylabs mentioned this pull request Jun 26, 2026

chore(release): bump workspace to 0.0.1-alpha.5 #137

Merged

rickylabs mentioned this pull request Jun 27, 2026

chore(release): one-shot deterministic release automation (plan) — #147 #164

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cli): gate maintainer plugin source copy#133

fix(cli): gate maintainer plugin source copy#133
rickylabs merged 9 commits into
mainfrom
fix/cli-plugin-copy-flag-gate

rickylabs commented Jun 26, 2026 •

edited

Loading

Uh oh!

rickylabs commented Jun 26, 2026

Uh oh!

rickylabs commented Jun 26, 2026

Uh oh!

rickylabs commented Jun 26, 2026

Uh oh!

rickylabs commented Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

rickylabs commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Slices

Validation

Harness

Drift / Debt

Uh oh!

rickylabs commented Jun 26, 2026

Scope

Commit

Validation

Next

Uh oh!

rickylabs commented Jun 26, 2026

Scope

Commit

Validation

Next

Uh oh!

rickylabs commented Jun 26, 2026

Scope

Commits

Validation

Next

Uh oh!

rickylabs commented Jun 26, 2026

Update

Commits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rickylabs commented Jun 26, 2026 •

edited

Loading