feat(plugin): install the pipelines' skill plugins on SessionStart

The ship-feature pipelines drive `/superpowers:*` commands as their per-node
drivers, so a fresh install had a dependency it was only told about — the
`/ccam-doctor` WARN row and a line in the README.

`server/lib/skill-plugins.js` now carries the whole thing, shared by the
doctor (reports) and the bootstrap (installs) so the two cannot disagree
about what is missing. The bootstrap installs at the very end of its DETACHED
worker — the install clones from the network and nothing in the 10 s
SessionStart hook may wait on it — retrying once behind a `marketplace add`,
logging a failure with the manual command, and never throwing: the dashboard,
hooks, CLI and MCP all work without these plugins. The outcome is recorded as
`state.skillPluginsSettled`, which `fastPathOk()` now also requires, so the
check runs exactly once per install and `/ccam-update` is the retry.
`CCAM_AUTO_INSTALL_PLUGINS=0|false|off` opts out.

Reporting is derived, installing is allowlisted. Requirements come from the
loaded templates, which is right for a report; installing from that same
source would not be, because a template is a file anyone can drop into
`DASHBOARD_PIPELINES_DIR` — it would turn "edit a JSON file" into "run this
vendor's install command on the next session". Auto-install consults
`AUTO_INSTALLABLE`, a constant in code (`superpowers` today), and reports
every other requirement as skipped.

Tests inject a `run` seam so no case reaches a real `claude plugin install`,
and cover the refusal explicitly.
This commit is contained in:
2026-09-04 14:03:12 +07:00
parent 413b3f40b2
commit 6cb7f4f843
11 changed files with 640 additions and 71 deletions
+54
View File
@@ -103,6 +103,10 @@ function fastPathOk(rt = runtimeDir()) {
if (state.pluginRoot !== PLUGIN_ROOT) return false;
if (state.depsHash !== depsHash()) return false;
if (!fs.existsSync(path.join(rt, "node_modules"))) return false;
// A machine can be fully set up and still be missing the plugins the
// pipelines drive. Reading one recorded flag keeps this hot path cheap — the
// actual check (manifest + every user SKILL.md) runs once, in the worker.
if (!state.skillPluginsSettled) return false;
return serverIsLive();
}
@@ -397,6 +401,46 @@ function log(rt, line) {
}
}
/**
* Install the plugins CCAM's pipelines drive but this machine cannot resolve —
* today `superpowers`, which `/ccam:ship-feature(-lane)` calls step by step. A
* fresh `ccam` install otherwise runs those skills partway and fails at the
* first call with no warning beforehand.
*
* Off by setting `CCAM_AUTO_INSTALL_PLUGINS` to `0`, `false` or `off`; that
* leaves `/ccam-doctor`'s WARN row as the only notice, which is the right
* behaviour for anyone who wants to choose their own plugins.
*
* One-shot: the outcome is recorded in the runtime state and the fast path
* takes it into account, so a machine with no network does not re-attempt a
* clone on every session. `/ccam-update` (`--force`) retries.
*
* Best-effort throughout. Nothing here may throw or block: the dashboard,
* hooks, CLI and MCP all work without these plugins.
*
* @returns {"off"|"nothing-missing"|"installed"|"failed"|"error"} or the previously
* recorded outcome when this run had nothing to settle.
*/
function autoInstallSkillPlugins(rt, { force = false } = {}) {
const flag = process.env.CCAM_AUTO_INSTALL_PLUGINS;
if (flag === "0" || flag === "false" || flag === "off") return "off";
// Return the PREVIOUS outcome, not a marker: writeState records whatever this
// returns, and overwriting "installed" with "already-settled" would lose the
// only record of what actually happened.
const settled = readState(rt)?.skillPluginsSettled;
if (!force && settled) return settled;
try {
const { autoInstallSkillPlugins: install } = require("../server/lib/skill-plugins");
const summary = install((line) => log(rt, line));
if (!summary.attempted.length) return "nothing-missing";
return summary.failed.length ? "failed" : "installed";
} catch (err) {
log(rt, `skill-plugin auto-install skipped: ${err.message}`);
return "error";
}
}
/**
* The real work. Runs detached from the SessionStart hook, so its only channel
* is the log file; `/ccam-update` runs it in the foreground with `force`, which
@@ -506,12 +550,21 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
}
}
// Last, and deliberately so: it clones from the network, and nothing above
// may wait on it. Runs here rather than in the foreground pass because this
// whole function is already detached from the 10 s SessionStart hook.
const skillPlugins = autoInstallSkillPlugins(rt, { force });
writeState(
{
pluginVersion: pluginVersion(),
depsHash: wantDeps,
pluginRoot: PLUGIN_ROOT,
claudeHome: getClaudeHome(),
// Settles the fast path: whatever the outcome, the next SessionStart
// must not spawn a worker just to retry a network clone. Cleared by
// `/ccam-update` (force), which is the retry.
skillPluginsSettled: skillPlugins,
updatedAt: new Date().toISOString(),
},
rt
@@ -578,5 +631,6 @@ module.exports = {
livePids,
stopDashboard,
startDashboard,
autoInstallSkillPlugins,
bootstrap,
};
+19 -66
View File
@@ -103,81 +103,34 @@ function diagnose() {
}
/**
* Slash commands the loaded pipeline templates name — as the pipeline's own
* driver (`skill`) or as one node's driver (`command`) — grouped by the plugin
* that has to provide them. Derived from the templates rather than hardcoded so
* a custom template dropped in `DASHBOARD_PIPELINES_DIR` is checked too, and so
* editing a built-in one cannot leave this check behind.
* WARN (never FAIL) when a plugin the pipelines depend on cannot be resolved:
* the dashboard, hooks, CLI and MCP all work without it — only the pipeline
* skills that drive it stop partway, so this must not fail a doctor run.
*
* `ccam` itself is dropped: it is the plugin running the diagnosis.
*
* @returns {Map<string, Set<string>>} plugin name → skill names it must ship.
*/
function pipelineSkillRequirements() {
const requirements = new Map();
let pipelines = [];
try {
pipelines = require("../server/lib/pipelines").listPipelines();
} catch {
return requirements; // templates unreadable — a separate failure, not this row's
}
for (const pipeline of pipelines) {
for (const cmd of [pipeline.skill, ...pipeline.nodes.map((n) => n.command)]) {
const match = /^\/([A-Za-z0-9_-]+):([A-Za-z0-9_-]+)/.exec(cmd || "");
if (!match) continue; // a shell command, or a bare /command with no plugin
const [, plugin, skill] = match;
if (plugin === "ccam") continue;
if (!requirements.has(plugin)) requirements.set(plugin, new Set());
requirements.get(plugin).add(skill);
}
}
return requirements;
}
/**
* WARN (never FAIL) when a plugin the pipelines depend on is absent: the
* dashboard, hooks, CLI and MCP all work without it — only the pipeline skills
* that drive it stop partway, so this must not fail a doctor run.
*
* A plugin listed but explicitly disabled counts as missing (Claude Code will
* not resolve its skills), and a plugin whose skills are all present as plain
* user skills counts as satisfied — copying them into `~/.claude/skills/`
* instead of installing the plugin is a legitimate setup, and reporting it as
* missing would train the reader to ignore this row.
* The requirement derivation and the missing/satisfied rules live in
* `server/lib/skill-plugins.js`, shared with the bootstrap that installs them.
*/
function skillPluginStatus() {
const requirements = pipelineSkillRequirements();
if (!requirements.size) return ["ok", "Skill plugins", "no pipeline names an external plugin"];
const skillPlugins = require("../server/lib/skill-plugins");
const required = skillPlugins.requiredSkillPlugins();
if (!required.size) return ["ok", "Skill plugins", "no pipeline names an external plugin"];
let plugins = [];
let userSkills = new Set();
let missing;
try {
const discovery = require("../server/lib/cc-discovery");
plugins = discovery.readPlugins().plugins;
userSkills = new Set(discovery.readSkills({ scope: "user" }).map((s) => s.name));
missing = skillPlugins.missingSkillPlugins();
} catch {
return ["warn", "Skill plugins", "could not read the installed-plugin manifest"];
}
const missing = [];
for (const [name, skills] of requirements) {
const installed = plugins.find(
(p) => p.name === name && p.installPathExists && p.enabled !== false
);
if (installed) continue;
if ([...skills].every((s) => userSkills.has(s))) continue;
const absent = [...skills].filter((s) => !userSkills.has(s)).sort();
missing.push(`${name} (needed for ${absent.join(", ")})`);
if (!missing.length) {
return ["ok", "Skill plugins", `${[...required.keys()].sort().join(", ")} available`];
}
return missing.length
? [
"warn",
"Skill plugins",
`${missing.join("; ")} — the pipelines name these commands; install with ` +
`claude plugin install ${missing.map((m) => m.split(" ")[0]).join(" ")}`,
]
: ["ok", "Skill plugins", `${[...requirements.keys()].sort().join(", ")} available`];
return [
"warn",
"Skill plugins",
`${missing.map((m) => `${m.name} (needed for ${m.skills.join(", ")})`).join("; ")} — ` +
`the pipelines name these commands; install with ` +
`claude plugin install ${missing.map((m) => m.autoInstall?.spec || m.name).join(" ")}`,
];
}
function countLegacyHookEntries() {