mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
Claude
a21dfe1ef0
- New cli-tool/src/plugin-installer.js: installs bundles from the
aitmpl.com registry (CCT_PLUGIN_REGISTRY_URL override for testing).
Downloads file-by-file from files.json with sha256 verification,
3-retry exponential backoff, and a zip-slip path guard; unpacks the
pure spec layout into .agent-plugins/{name}/ and activates into the
familiar destinations: skills -> .claude/skills/, mcp.json merged into
.mcp.json, agents/commands/loops flat into .claude/ (same layout the
individual installers produce). Hooks/settings in a bundle are unpacked
but deliberately not auto-activated (their interactive multi-location
merge stays with --hook/--setting). Spec failure model: invalid
plugin.json rejects the plugin; an invalid skill is skipped with a
warning. Tracked as type 'plugin' with batchId/durationMs.
- bin/create-claude-config.js: new --plugin <names> (comma-separated) and
--plugin-raw (unpack-only) options; help text disambiguates from the
--plugins dashboard.
- src/index.js: --plugin wired into routing and installMultipleComponents;
installIndividualMCP's merge body extracted into the shared
mergeMcpServers() helper (same semantics: description stripped, existing
servers preserved, 2-space output) so bundle activation and --mcp share
one code path. merged_with_existing telemetry now reports the real value
instead of always-true.
- cli-tool/tests/plugin/installer.test.js: 11 tests over a stubbed fetch
serving a packer-built bundle — activation placement, existing-server
preservation, --plugin-raw, spec rejection, path traversal, sha256
mismatch cleanup, dry run, and mergeMcpServers regression.
Verified end-to-end: real CLI install of both pilot bundles from a local
HTTP registry produced the expected .agent-plugins/ + .claude/ + .mcp.json.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NPhPzxiW2q2wgQQLS8Bn9w