diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d48652..e41e39e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [2.1.5] - 2026-07-19 + +### Added + +- The `nddev-builder` `core` toolkit gains three workflow skills (and matching + slash commands) on top of the `add-*` set: `scaffold-plugin` composes a whole + plugin from an intent, `devtest-plugin` runs an isolated install-and-verify + loop in throwaway `HOME`/`ZCODE_HOME`, and `release-review` gates a whole + marketplace for release readiness. These stay within the ZCode 3.3.6 surface + (flatten-to-user-scope; no `plugin add`, cache, or dev-mode), so no publish, + managed-requirements, or remote-marketplace-source features were added. The + toolkit is now 19 skills / 19 slash commands. + ## [2.1.4] - 2026-07-16 ### Changed diff --git a/README.md b/README.md index 9b37920..b51adbd 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ changes. - **Author:** Danil Silantyev (github:rldyourmnd), CEO NDDev - **License:** AGPL-3.0-or-later -- **Build version:** 2.1.4 +- **Build version:** 2.1.5 - **Verified ZCode runtime:** app 3.3.6, CLI 0.15.2, model GLM-5.2 ## What this repository contains @@ -69,7 +69,7 @@ restore, remove, and custom-target usage. Each directory under `zcode_tools/marketplaces/` is a complete setup: -- `nddev-builder` enables its reusable 16-skill, 16-command `core` toolkit for +- `nddev-builder` enables its reusable 19-skill, 19-command `core` toolkit for creating and managing ZCode marketplaces, plugins, and components. - `nddev-designer` is a deliberately lean product-design profile focused on design-system consistency, accessibility, responsive states, and diff --git a/VERSION b/VERSION index 7d2ed7c..cd57a8b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.1.4 +2.1.5 diff --git a/build/manifest.json b/build/manifest.json index 0548080..5804750 100644 --- a/build/manifest.json +++ b/build/manifest.json @@ -1,6 +1,6 @@ { "name": "nddev-zcode-app", - "build_version": "2.1.4", + "build_version": "2.1.5", "source_root": "zcode_tools/marketplaces/", "installer": "cli-tools/scripts/install.sh install --setup ", "layout": { diff --git a/build/release-evidence.json b/build/release-evidence.json index 49eabda..feb74de 100644 --- a/build/release-evidence.json +++ b/build/release-evidence.json @@ -2,15 +2,15 @@ "schema_version": 2, "module": { "repository": "NDDev-it-com/nddev-zcode-app", - "setup_digest": "sha256:51f95a940c545ea1c590d8613a7bd018815dbef6864acdfc974f7e4dd0fb689a" + "setup_digest": "sha256:7da756e9cd3e22080d2ac0d44ae9a55bfbcef7f248877058eb1e13898ae2ed0a" }, "harness": { "repository": "NDDev-it-com/nddev-harnesses", - "commit": "f00fc21cc43b1510b33160e5026a743a6591d890" + "commit": "3fa150a3215943e32778f956282d75e4cbc0af32" }, "adapter": { "id": "zcode", - "version": "2.1.4" + "version": "2.1.5" }, "vendor": { "app_version": "3.3.6", @@ -30,8 +30,8 @@ } ], "lanes": [], - "generated_at_utc": "2026-07-19T02:11:35Z", - "expires_at_utc": "2027-01-15T02:11:35Z", + "generated_at_utc": "2026-07-19T08:34:26Z", + "expires_at_utc": "2027-01-15T08:34:26Z", "promotion": { "decision": "pending", "waivers": [] diff --git a/build/version.json b/build/version.json index 158eb2f..3c2484d 100644 --- a/build/version.json +++ b/build/version.json @@ -1,5 +1,5 @@ { - "build_version": "2.1.4", + "build_version": "2.1.5", "zcode_app_version": "3.3.6", "zcode_cli_version": "0.15.2", "zcode_runtime": "GLM-5.2", diff --git a/docs/architecture.md b/docs/architecture.md index 1e250ae..7929a21 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -52,7 +52,7 @@ prefix. ### Setup profiles - `nddev-builder` enables `core@nddev-builder`, a native component-authoring - toolkit with 16 skills, 16 matching commands, and one reviewer agent. + toolkit with 19 skills, 19 matching commands, and one reviewer agent. - `nddev-designer` is a production-ready minimal design profile. Its empty extension maps are intentional; project-specific design tools come from the active workspace. diff --git a/zcode_tools/marketplaces/nddev-builder/marketplace.json b/zcode_tools/marketplaces/nddev-builder/marketplace.json index f28737d..8f9d52f 100644 --- a/zcode_tools/marketplaces/nddev-builder/marketplace.json +++ b/zcode_tools/marketplaces/nddev-builder/marketplace.json @@ -10,7 +10,7 @@ "name": "core", "source": "./plugins/core", "description": "Reusable toolkit: skills, slash commands, and a reviewer subagent for building plugins, managing MCP servers and providers, authoring skills, and listing or removing components.", - "version": "2.1.4", + "version": "2.1.5", "author": { "name": "Danil Silantyev (github:rldyourmnd), CEO NDDev" }, diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/.zcode-plugin/plugin.json b/zcode_tools/marketplaces/nddev-builder/plugins/core/.zcode-plugin/plugin.json index 0acfba0..106c34c 100644 --- a/zcode_tools/marketplaces/nddev-builder/plugins/core/.zcode-plugin/plugin.json +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/.zcode-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "core", - "version": "2.1.4", + "version": "2.1.5", "description": "Reusable ZCode toolkit: skills, slash commands, and a reviewer subagent for building plugins, managing MCP servers and providers, authoring skills, and listing or removing components.", "author": { "name": "Danil Silantyev (github:rldyourmnd), CEO NDDev", diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md index 123277e..b10de21 100644 --- a/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md @@ -3,16 +3,18 @@ The `core` plugin is a reusable ZCode-native toolkit for creating and managing marketplaces, plugins, and convention-discovered components. -- **16 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`, +- **19 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`, `add-agent`, `add-hook`, `add-mcp-server`, `add-provider`, `add-reference`, `add-tool`, `add-instructions`, `list-components`, `remove-component`, - `enable-plugin`, `nddev-builder-orientation`, and `validate-components`. -- **16 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`, + `enable-plugin`, `nddev-builder-orientation`, `validate-components`, + `scaffold-plugin`, `devtest-plugin`, and `release-review`. +- **19 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`, `/nddev-add-skill`, `/nddev-add-command`, `/nddev-add-agent`, `/nddev-add-hook`, `/nddev-add-mcp`, `/nddev-add-provider`, `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-add-instructions`, - `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`, and - `/nddev-validate`. + `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`, + `/nddev-validate`, `/nddev-scaffold`, `/nddev-devtest`, and + `/nddev-release-review`. - **1 subagent**: `nddev-native-reviewer` (GLM-5.2). ## Capabilities @@ -32,6 +34,9 @@ marketplaces, plugins, and convention-discovered components. | `list-components` | Inventory marketplace components without mutation | | `remove-component` | Remove a component after reference checks | | `enable-plugin` | Enable or disable a plugin in the CLI configuration | +| `scaffold-plugin` | Compose a whole plugin from an intent | +| `devtest-plugin` | Isolated install-and-verify loop in throwaway state | +| `release-review` | Gate a whole marketplace for release readiness | | `nddev-native-reviewer` | Review ZCode-native format correctness | Development-only test, benchmark, release, and repository-doctor capabilities diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-devtest.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-devtest.md new file mode 100644 index 0000000..8edb19c --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-devtest.md @@ -0,0 +1,12 @@ +--- +description: Isolated install-and-verify loop for a marketplace using temporary HOME/ZCODE_HOME, proving components flatten and load without touching live ~/.zcode. +--- + +Behaviorally test a marketplace in throwaway state. + +Follow the `devtest-plugin` skill exactly: static-gate with +`validate-components`, isolate `HOME` and `ZCODE_HOME` in a temporary directory, +run `install.sh --plan` then `--apply`, assert each basename flattened once into +`~/.zcode/{skills,commands,agents}` (references and tools are not flattened), +restart to reload, then tear down. Never touch live `~/.zcode`. ZCode has no +`plugin add`, cache, or dev-mode reload. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-release-review.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-release-review.md new file mode 100644 index 0000000..1f0e9e2 --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-release-review.md @@ -0,0 +1,11 @@ +--- +description: Review a whole marketplace for release readiness — identity and version-lockstep presence, cross-plugin basename safety, inert-field and secret scans, and a clean install plan. +--- + +Review a whole marketplace for release readiness. + +Follow the `release-review` skill exactly: run `validate-components`, pass each +new or changed artifact through `nddev-native-reviewer`, then check bundle +coherence — plugin identity, version-lockstep presence, no inert fields, no +secrets, English only, and a clean `install.sh --plan`. Authoring-time gate only; +never set pins, tags, or evidence. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-scaffold.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-scaffold.md new file mode 100644 index 0000000..439ee21 --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/commands/nddev-scaffold.md @@ -0,0 +1,10 @@ +--- +description: Compose a complete ZCode plugin from an intent — a metadata-only manifest plus the needed skills, commands, agents, hooks, or MCP — and register it in the marketplace. +--- + +Compose a whole plugin from a described intent. + +Follow the `scaffold-plugin` skill exactly: fix the plugin boundary and the +minimal component set, scaffold with `add-plugin`, add each component with its +`add-*` skill (keeping every basename repo-unique), wire only real dependencies, +and finish with `validate-components` and a clean `install.sh --plan`. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/devtest-plugin/SKILL.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/devtest-plugin/SKILL.md new file mode 100644 index 0000000..133e63a --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/devtest-plugin/SKILL.md @@ -0,0 +1,43 @@ +--- +name: devtest-plugin +description: Runs an isolated install-and-verify loop for a marketplace using temporary HOME and ZCODE_HOME, proving components flatten and load without touching live ~/.zcode. Use to behaviorally test a plugin during development, after static validation. +--- + +# devtest-plugin + +Prove a marketplace actually installs and its components load — in throwaway +state, never against the owner's live `~/.zcode`. + +## What ZCode does and does NOT provide (read this first) + +ZCode 3.3.6 has **no** `zcode plugin add`, no plugin cache, no `/plugins` +command, and no developer-mode hot reload. Headless activation is the installer +**flattening** each plugin's `skills/`, `commands/`, and `agents/` into +`~/.zcode/{skills,commands,agents}`; UI activation (Discover → +) is a separate, +non-scriptable path. So this loop is install-and-inspect, not a CLI cache-buster. +See `nddev-builder-orientation`. + +## Procedure + +1. **Static gate.** `validate-components` must pass first. +2. **Isolate.** Create a temporary directory and point both `HOME` and + `ZCODE_HOME` into it. Never run against the real `~/.zcode`. +3. **Plan.** `install.sh install --setup --target --plan` — read-only + staged verification; it must report a clean plan. +4. **Apply.** `install.sh install --setup --target --apply` into the + isolated target. +5. **Assert the flatten.** Confirm each expected skill, command, and agent + basename now exists exactly once under the isolated + `~/.zcode/{skills,commands,agents}`, and that `references/` and `tools/` were + NOT flattened. +6. **Reload to observe.** Component discovery is read at startup; a running ZCode + must be restarted to pick up changes. Note this rather than expecting a live + reload. +7. **Tear down.** Remove the temporary state; the loop leaves no trace in live + user state. + +## Rules + +- Never touch live `HOME` or `~/.zcode`; always isolated temporary state. +- Static validation (`validate-components`) precedes every behavioral run. +- Report exactly what installed and loaded; a static pass is not a load proof. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/nddev-builder-orientation/SKILL.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/nddev-builder-orientation/SKILL.md index 420ea6c..2a6f802 100644 --- a/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/nddev-builder-orientation/SKILL.md +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/nddev-builder-orientation/SKILL.md @@ -95,3 +95,9 @@ Author with the dedicated skills; each now documents the flatten reality: `add-provider`, `add-plugin`, `add-marketplace`, `add-reference`, `add-tool`, `add-instructions`; inspect with `list-components`, remove with `remove-component`, pre-check with `validate-components`. + +For whole-plugin and whole-marketplace work, three workflow skills sit on top of +the `add-*` set: `scaffold-plugin` composes a complete bundle from an intent, +`devtest-plugin` runs an isolated install-and-verify loop in throwaway +`HOME`/`ZCODE_HOME`, and `release-review` gates the whole marketplace for release +readiness before shipping. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/release-review/SKILL.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/release-review/SKILL.md new file mode 100644 index 0000000..9a14195 --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/release-review/SKILL.md @@ -0,0 +1,42 @@ +--- +name: release-review +description: Reviews a whole ZCode marketplace for release readiness across all plugins — identity and version-lockstep presence, cross-plugin basename safety, inert-field and secret scans, English-only, and a clean install plan. Use before shipping a marketplace, after per-artifact review and static validation. +--- + +# release-review + +A whole-marketplace, cross-artifact readiness gate. `nddev-native-reviewer` +reviews one artifact and `validate-components` runs mechanical static checks; +this skill reviews the **bundle** for release coherence. It is an authoring-time +gate only — it never sets version pins, tags, or release evidence, which are +owned by the repository's private release process. + +## What to review (whole marketplace) + +1. **Static gate first.** `validate-components` must pass: frontmatter, name + patterns, JSON validity, cross-plugin basename uniqueness, and a clean + `install.sh install --setup --plan`. +2. **Per-artifact quality.** Each new or changed skill, command, and agent passes + `nddev-native-reviewer` (ZCode-native format plus an actionable trigger + description). +3. **Identity coherence.** Every plugin's `.zcode-plugin/plugin.json` `name` + equals its directory and its `marketplace.json` entry; each `source` is a + local `./plugins/` that exists; descriptions match between the manifest + and the catalog entry. +4. **Version-lockstep presence.** If the marketplace ships in this release, the + five version sources agree (see `add-plugin` step 8). Flag any drift; do not + set pins here. +5. **Execution-boundary hygiene.** No inert `lspServers`/`outputStyles`/ + `channels`/`settings` fields and no manifest component arrays (ZCode 3.3.6 + records but never executes them). +6. **Safety and language.** No secrets, credentials, or machine-local absolute + paths in any tracked file; English only across code, docs, and manifests. +7. **Install proof.** The `--plan` gate is clean; for a behavioral pass, run + `devtest-plugin` into isolated state. + +## Result + +Return PASS only when the static gate, every per-artifact review, and the +whole-bundle coherence checks all succeed. Otherwise return FAIL with the +plugin or component path, the coherence risk, and the correction. Never return a +green result while any check is unproven. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/scaffold-plugin/SKILL.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/scaffold-plugin/SKILL.md new file mode 100644 index 0000000..7f72698 --- /dev/null +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/skills/scaffold-plugin/SKILL.md @@ -0,0 +1,58 @@ +--- +name: scaffold-plugin +description: Composes a complete ZCode plugin from a described intent — a metadata-only manifest plus the right mix of skills, commands, agents, hooks, and MCP config — and registers it in the marketplace. Use when starting a plugin from a goal rather than adding one component at a time. +--- + +# scaffold-plugin + +Turn a described capability into a complete, install-ready ZCode plugin bundle in +one pass, then hand off to `validate-components`. This orchestrates the focused +`add-*` skills; it does not replace them. + +## When to use + +Use when the input is an intent ("a plugin that reviews Terraform and blocks +unsafe applies") rather than a single component. To add one skill or command to +an existing plugin, use the matching `add-*` skill directly. + +## ZCode facts this skill respects + +- A plugin is a metadata-only `.zcode-plugin/plugin.json` plus components under + convention directories. ZCode 3.3.6 executes only `commands`, `skills`, + `hooks`, `mcpServers`, and user-scope `agents`; never scaffold the inert + `lspServers`/`outputStyles`/`channels`/`settings` fields or manifest component + arrays. See `nddev-builder-orientation`. +- The headless install flattens every plugin's `skills/`, `commands/`, and + `agents/` into `~/.zcode/{skills,commands,agents}` and fails closed on a + duplicate basename, so every component this skill emits must have a + repo-unique name. + +## Procedure + +1. **Fix the boundary.** From the intent, decide the plugin's single + responsibility and the exact components it needs — which skills, which + commands, whether an agent, a hook, or an MCP server is genuinely required. + Prefer the smallest set that meets the intent. +2. **Pick or create the marketplace.** Use `add-marketplace` if none fits, then + scaffold the empty bundle with `add-plugin` (manifest + directories + README + + marketplace entry). +3. **Add each component** with its focused skill: `add-skill`, `add-command`, + `add-agent`, `add-hook`, `add-mcp-server`, `add-instructions`, + `add-reference`, `add-tool`, `add-provider`. Keep every basename unique across + the whole repository. +4. **Wire dependencies only if real** (for example, an MCP-consuming plugin + depends on the MCP transport plugin) — `name@marketplace` strings, with + cross-marketplace dependencies listed in `allowCrossMarketplaceDependenciesOn`. +5. **Validate** with `validate-components`, then the non-mutating + `install.sh install --setup --plan` gate. Run `devtest-plugin` for a + behavioral pass. +6. **Record the release** per `add-plugin` step 8 (one SemVer across the five + version sources plus `CHANGELOG.md`) if the bundle ships. + +## Rules + +- English only. Metadata-only manifests; never declare component arrays. +- Smallest component set that meets the intent; every emitted basename unique + across all plugins. +- Generated content is a starting point — complete each component and run + `validate-components` before shipping.