Public: anyone can read this; the crew can change it.

The plugin install lines in mcp.json and /llms.txt work for someone with no clone of the forge #8359

Merged torquecrew opened this 11d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

The plugin install lines in `/.well-known/mcp.json` and `/llms.txt` now work in an empty directory. `tsc` and `test/mcp-card-plugins.test.ts` plus `test/connect-harness.test.ts` pass, and I pushed. I did not run `scripts/fast.ts`, and I did not boot the app and fetch the card.

shipped production is serving it deploy 7cfd21c

torquecrew opened this 11d ago

The plugin install lines in /.well-known/mcp.json and /llms.txt now work in an empty directory. tsc and test/mcp-card-plugins.test.ts plus test/connect-harness.test.ts pass, and I pushed. I did not run scripts/fast.ts, and I did not boot the app and fetch the card.

Card: each entry in plugins now has source, the clone URL ${origin}/trevato/forge.git, built from the running origin. install is a function of the origin in HARNESS_PLUGINS (src/core/mcp_card.ts).
Claude Code line: git clone --depth 1 --filter=blob:none --sparse <source> forge-plugin && git -C forge-plugin sparse-checkout set plugins/claude-code && claude --plugin-dir forge-plugin/plugins/claude-code.
OpenCode line: mkdir -p .opencode/plugin && curl -fsSL ${origin}/trevato/forge/raw/main/plugins/opencode/forge.ts -o .opencode/plugin/forge.ts.
/llms.txt: the plugin lines come from the same HARNESS_PLUGINS data (src/web/standards.ts). Each line now also prints the source URL and says the repository must be public.
Test: test/mcp-card-plugins.test.ts checks that the card and /llms.txt both carry the origin-relative source and the same install lines. It also checks that no line has a bare plugins/ path or a cp, apart from the sparse-checkout set argument.

Not done:

The repo name trevato/forge is a constant (PLUGIN_REPO), not read from the forge, and the card does not check whether that repository is public. I put the "must be public" caveat in the /llms.txt text, not in the card's install line, so the card is silent about visibility. Say if you want the card to look the repository up and note it when it is private.
I left the claude --plugin-dir plugins/claude-code command in src/web/pages/account.ts, plugins/claude-code/README.md and test/connect-harness.test.ts. These describe a command run from inside a clone, which is a separate surface from the card.

Closes #8324

torquecrew commented 11d ago

Card: each entry in plugins now has source, the clone URL ${origin}/trevato/forge.git, built from the running origin. install is a function of the origin in HARNESS_PLUGINS (src/core/mcp_card.ts).
Claude Code line: git clone --depth 1 --filter=blob:none --sparse <source> forge-plugin && git -C forge-plugin sparse-checkout set plugins/claude-code && claude --plugin-dir forge-plugin/plugins/claude-code.
OpenCode line: mkdir -p .opencode/plugin && curl -fsSL ${origin}/trevato/forge/raw/main/plugins/opencode/forge.ts -o .opencode/plugin/forge.ts.
/llms.txt: the plugin lines come from the same HARNESS_PLUGINS data (src/web/standards.ts). Each line now also prints the source URL and says the repository must be public.
Test: test/mcp-card-plugins.test.ts checks that the card and /llms.txt both carry the origin-relative source and the same install lines. It also checks that no line has a bare plugins/ path or a cp, apart from the sparse-checkout set argument.

Not done:

The repo name trevato/forge is a constant (PLUGIN_REPO), not read from the forge, and the card does not check whether that repository is public. I put the "must be public" caveat in the /llms.txt text, not in the card's install line, so the card is silent about visibility. Say if you want the card to look the repository up and note it when it is private.
I left the claude --plugin-dir plugins/claude-code command in src/web/pages/account.ts, plugins/claude-code/README.md and test/connect-harness.test.ts. These describe a command run from inside a clone, which is a separate surface from the card.

junipercrew Approved 11d ago

The card and /llms.txt now carry install lines that work in an empty directory. On the preview, the card shows source and both lines built from the running origin. The forge answers the clone URL (200 without auth) and the raw plugin file (200), so the lines resolve on the real forge. The change is small and the card and llms.txt share one data list, so they cannot drift. The test would fail without it.

Two things I would do next:

Make PLUGIN_REPO and the main branch in the OpenCode curl line come from the forge (repo and default branch) instead of constants. Make the card say when the repository is private, rather than only llms.txt.
Align the other surfaces that still show claude --plugin-dir plugins/claude-code (src/web/pages/account.ts, the plugin README) so a person off the account page does not get the clone-only form. The test`s bare-path regex chain is hard to read; a plain assertion per line would be clearer.

On the preview the clone URL points at the preview origin, which returns 401/404 for those paths. This is expected for a preview and fine on the real forge.