feat: drop the kettle plugin; the binary writes its own skills

The plugin and the binary shipped on two release cadences and nothing on an
operator's machine ever checked that the one they installed described the other.
The generated flag block existed precisely so a renamed flag could not ship with
documentation recommending the old one — and then shipped one version behind the
registry it came from, which is the same bug one hop downstream.

So the prose moved into the binary. `internal/scaffold` embeds every document;
`kettle init` and `kettle gen scaffold` write them into a project's own
`.claude/`. The two cannot disagree because there is one artefact.

The namespace survived the move. A project's skills are flat, so the prefix is
spelled into the directory name (`kettle-issue`); a project's *commands* take
their namespace from a subdirectory, so `commands/kettle/init.md` is still
`/kettle:init`. Four of the six command files are thin pointers at a skill, and
that is what kept ~1,600 lines of `/kettle:…` cross-references true without a
rewrite. `init` and `auth` lost `disable-model-invocation: true` — being a
command is that property — and `auth` now restricts `allowed-tools` so a model
cannot reach `kettle auth add` at all.

`gen scaffold` writes files whole rather than splicing a region. The old
refusal protected somebody's hand-written prose around the block; that prose is
embedded now, so there is none to protect, and preserving local edits would
freeze a project's documentation at whatever version first initialized it.
`--check` warns before an upgrade discards one.

The plugin's `agents-sync.sh` — 141 lines of Python behind a filename that said
`.sh` — became `internal/mirror` and `kettle mirror`. Same seven branches, same
refusal to merge two real files that differ, now with a table test per branch
and a check that a repair converges in one pass. `--hook` is the PreToolUse
form and exits 0 on every path including a panic. It is opt-in per project,
which is strictly narrower than the plugin hook that was on for everybody who
installed it.

`kettle init --interactive` walks a person through the login, the token (read
with the echo off, so it lands in no history and no file), the repository, the
`.claude/` tree and the mirror hook. It refuses a stdin that is not a terminal
and names the flags instead: every question it asks has one, and it performs
nothing itself, so an interactive run and a flag run are one code path.

Two rules that used to be prose are now the binary's: init refuses a linked
worktree and names the main checkout, and writing into an existing
`.claude/settings.json` is refused with the snippet printed rather than
reformatting a file the operator commits.

The scaffold version stamp went to its own `.kettle/scaffold.yaml` rather than
into `config.yaml`, because unknown keys there are a hard error and that file
may be committed and read by whatever build each machine has.

golang.org/x/term becomes a direct dependency; it was already in the tree
indirectly, so no module was added.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
naudachu
2026-08-12 16:17:24 +05:00
parent f18a633185
commit 8b1b11001a
445 changed files with 231172 additions and 1339 deletions
+97
View File
@@ -0,0 +1,97 @@
# AGENTS.md — internal/mirror
**One filesystem invariant, in every directory of a tree:**
```
AGENTS.md is the real file; CLAUDE.md is a symlink pointing at it.
```
**Imports the standard library and nothing else** — no issue, no tracker, no
configuration, no login. That is not a stylistic preference: this walks whatever
directory it is pointed at, on any machine, and a package that reached for a
project's configuration could not be run outside a project. Two tests hold it,
see [`internal/AGENTS.md`](../AGENTS.md).
| file | what is in it |
|---|---|
| `mirror.go` | `Sync`, `Check`, `Result`, and `fixDir` — the seven branches |
| `mirror_test.go` | one case per branch, plus the walk, the skip list and idempotence |
| `layering_test.go` | the two tests that keep this package at the bottom |
## Why the invariant
Two agent harnesses read two different filenames for the same document. A
repository that keeps both as real files keeps **two documents**, and they drift —
silently, until somebody reads the stale one and believes it. One real file with a
link beside it is the only arrangement where that cannot happen.
`AGENTS.md` is the real file rather than `CLAUDE.md` because the convention is not
one vendor's: a repository that names its documents after a single tool has picked
a side it did not need to pick.
## The seven branches
Every one of them is either lossless or a refusal. **Nothing here deletes content.**
| starting state | what happens |
|---|---|
| `AGENTS.md` real, no `CLAUDE.md` | create the symlink |
| `CLAUDE.md` real, no `AGENTS.md` | rename to `AGENTS.md`, link back |
| `CLAUDE.md` symlink → `AGENTS.md` | canonical; nothing to do |
| `CLAUDE.md` symlink elsewhere | re-point it |
| `AGENTS.md` symlink → real `CLAUDE.md` | reversed layout; swap it round |
| both real, identical content | replace `CLAUDE.md` with the symlink |
| both real, **different** content | **refuse**, and name the directory |
The last row is the reason the other six can be automatic. One of those two files
is somebody's writing and no rule here knows which, so a merge is not attempted and
not offered — the conflict is reported and the directory is left exactly as it was.
Two smaller refusals sit beside it, both about a symlink with no target: a broken
`AGENTS.md` with no `CLAUDE.md` beside it, and a `CLAUDE.md` pointing at something
that is gone. Neither is repairable without inventing content.
**The link target is relative.** `CLAUDE.md -> AGENTS.md`, never an absolute path:
a tree that is moved, copied, cloned or mounted somewhere else keeps working, and
an absolute link would point at wherever the repair happened to run.
## Two properties the tests hold
**A repair that fails halfway reports nothing.** An unwritable directory, a race
with an editor — the fix is abandoned and no line is added. Claiming a repair that
did not happen is worse than silence: the next run finds the same state, and the
operator has now been told twice that it was handled.
**Sync converges in one pass.** Every case in the table runs `Sync` twice and fails
if the second run still has work. This matters more here than it looks: the command
that wraps this package runs on `PreToolUse(Bash)`, so a state that reported itself
fixed without converging would re-report on every Bash call, forever.
`Check` is the same walk with the writes turned off — one code path, not a second
implementation that might disagree — so a check that says nothing is a promise
about the run that follows it.
## What is skipped
`node_modules`, `__pycache__`, `venv`, `vendor`, and every dot-directory.
Somebody else's tree is somebody else's business: a vendored dependency's
`AGENTS.md` rewritten here is a diff nobody asked for. `.git` gets the same
treatment for a second reason — it is not a place to be creating symlinks.
## What does not belong here
The JSON a `PreToolUse` hook reads and writes, the decision to run at all, and the
exit status. Those are [`cmd`](../cmd/AGENTS.md)'s, in `mirror.go` there; this
package takes a directory and returns a `Result`. That split is what lets the
repair be tested against a temp directory without a hook payload anywhere near it.
## Keeping this file true
- **Scope:** `mirror.go` and its tests — the invariant, the seven branches, the
skip list, and the two properties above.
- **Update it when** a branch is added or its outcome changes (the table is the
contract), a directory is added to or dropped from the skip list, or the link
stops being relative.
- **Do not** document the command, the hook payload or the exit codes here.
[`internal/cmd`](../cmd/AGENTS.md) owns those.
+57
View File
@@ -0,0 +1,57 @@
package mirror
import (
"os/exec"
"strings"
"testing"
)
// This package repairs a filesystem layout and knows nothing else. It has no
// business with an issue, a tracker, a login or a configuration file, and the
// moment it imports one of them it stops being a thing that can be run over any
// directory on the machine.
//
// The dependency walk, so a helper pulled in three packages deep is caught as
// the same violation as one written at the top of a file.
func TestMirrorDependsOnNothing(t *testing.T) {
out, err := exec.Command("go", "list", "-deps", ".").Output()
if err != nil {
t.Fatalf("go list: %v", err)
}
for _, dep := range strings.Fields(string(out)) {
if dep == "git.noodles.cam/claude-skills/marketplace/cli/internal/mirror" {
continue
}
// A standard-library import path has no dot in its first element,
// because it has no domain name in front of it.
if first, _, _ := strings.Cut(dep, "/"); strings.Contains(first, ".") {
t.Errorf("mirror imports %s — this walks a directory, and nothing else belongs here", dep)
}
}
}
// The other half: os and net/http are standard library, so "no third-party
// imports" would not catch a request or a shell-out written by hand here. os
// itself is the point of this package, so it is the one that is allowed.
//
// DIRECT imports, not the dependency walk — fmt reaches os on its own, and the
// question this asks is what THIS package reaches for.
func TestMirrorNeitherDialsNorShellsOut(t *testing.T) {
forbidden := map[string]string{
"net/http": "a documentation convention is not fetched from anywhere",
"net": "a documentation convention is not fetched from anywhere",
"os/exec": "the repair is syscalls, not a shell — that is the whole reason it left bash",
"encoding/json": "the hook's JSON is the command layer's business, not this one's",
"time": "nothing here has a clock in it",
}
out, err := exec.Command("go", "list", "-f", `{{join .Imports "\n"}}`, ".").Output()
if err != nil {
t.Fatalf("go list: %v", err)
}
for _, dep := range strings.Fields(string(out)) {
if why, bad := forbidden[dep]; bad {
t.Errorf("mirror imports %s — %s", dep, why)
}
}
}
+232
View File
@@ -0,0 +1,232 @@
// Package mirror enforces one filesystem invariant, in every directory of a
// tree:
//
// AGENTS.md is the real file; CLAUDE.md is a symlink pointing at it.
//
// Two agent harnesses read two different filenames for the same document, and a
// repository that keeps both as real files keeps two documents — which drift,
// silently, until somebody reads the stale one and believes it. One real file
// with a link beside it is the only arrangement where that cannot happen.
//
// This package depends on nothing but the standard library. It performs no
// merge and DELETES NO CONTENT: every branch is either a lossless repair or a
// report, and the one case it refuses to resolve — two real files whose contents
// differ — is the one where a wrong guess would destroy somebody's writing.
package mirror
import (
"bytes"
"fmt"
"io/fs"
"os"
"path/filepath"
"strings"
)
// The two names, and the link's target. The target is written relative on
// purpose: a tree that is moved, copied or mounted somewhere else keeps working,
// and an absolute link would point at wherever the repair happened to run.
const (
Agents = "AGENTS.md"
Claude = "CLAUDE.md"
)
// skipDirs are never descended into. Each holds somebody else's tree — a
// vendored dependency's AGENTS.md is that dependency's business, and rewriting
// it would show up as a diff nobody asked for. Dot-directories are skipped by
// the same argument and by a second one: `.git` is not a place to be creating
// symlinks.
var skipDirs = map[string]bool{
"node_modules": true,
"__pycache__": true,
"venv": true,
"vendor": true,
}
// Result is what one walk found. Both halves are ordered by directory, because
// the walk is, so two runs over the same tree report in the same order.
type Result struct {
// Fixes are the repairs made — or, from Check, the repairs that would be.
Fixes []string
// Conflicts are the directories this package refuses to resolve. A conflict
// is reported identically by both entry points: nothing about it is a write.
Conflicts []string
}
// Clean reports whether the tree was already canonical.
func (r Result) Clean() bool { return len(r.Fixes) == 0 && len(r.Conflicts) == 0 }
// Sync walks root and repairs every directory under it.
func Sync(root string) Result { return walk(root, true) }
// Check walks root and reports what Sync would do, writing nothing.
//
// The two share one code path with the writes turned off, so a check that says
// nothing is a promise about the run that follows it rather than a second
// implementation that might disagree.
func Check(root string) Result { return walk(root, false) }
func walk(root string, apply bool) Result {
var res Result
abs, err := filepath.Abs(root)
if err != nil {
return res
}
_ = filepath.WalkDir(abs, func(path string, d fs.DirEntry, err error) error {
if err != nil {
// An unreadable directory is skipped, never fatal: this runs over
// somebody's whole working tree and one bad mode must not stop it.
if d != nil && d.IsDir() {
return fs.SkipDir
}
return nil
}
if !d.IsDir() {
return nil
}
if path != abs {
if name := d.Name(); skipDirs[name] || strings.HasPrefix(name, ".") {
return fs.SkipDir
}
}
fixDir(path, abs, apply, &res)
return nil
})
return res
}
// fixDir applies the invariant to one directory.
//
// The seven cases, and every one of them is either lossless or a refusal:
//
// AGENTS.md real, no CLAUDE.md ........ create the symlink
// CLAUDE.md real, no AGENTS.md ........ rename to AGENTS.md, link back
// CLAUDE.md symlink -> AGENTS.md ...... canonical, nothing to do
// CLAUDE.md symlink elsewhere ......... re-point it
// AGENTS.md symlink -> real CLAUDE.md . reversed layout, swap it round
// both real, identical content ........ replace CLAUDE.md with the symlink
// both real, different content ........ REFUSE, and say which directory
//
// A repair that fails halfway — an unwritable directory, a race with an editor —
// reports nothing rather than a fix it did not make. Claiming a repair that did
// not happen is worse than silence, because the next run would find the same
// state and the operator would have been told twice that it was handled.
func fixDir(dir, root string, apply bool, res *Result) {
agents := filepath.Join(dir, Agents)
claude := filepath.Join(dir, Claude)
aInfo, aErr := os.Lstat(agents)
cInfo, cErr := os.Lstat(claude)
a, c := aErr == nil, cErr == nil
if !a && !c {
return
}
aLink := a && aInfo.Mode()&os.ModeSymlink != 0
cLink := c && cInfo.Mode()&os.ModeSymlink != 0
rel := func(p string) string {
r, err := filepath.Rel(root, p)
if err != nil {
return p
}
if r == "." {
return "<root>"
}
return r
}
conflict := func(format string, v ...any) {
res.Conflicts = append(res.Conflicts, fmt.Sprintf(format, v...))
}
// fix runs the repair unless this is a check, and records it only if every
// step of it succeeded.
fix := func(msg string, steps ...func() error) {
if apply {
for _, step := range steps {
if err := step(); err != nil {
return
}
}
}
res.Fixes = append(res.Fixes, msg)
}
link := func() error { return os.Symlink(Agents, claude) }
switch {
case a && !c:
if aLink && !exists(agents) {
conflict("%s: broken symlink and no %s", rel(agents), Claude)
return
}
fix(fmt.Sprintf("%s: created symlink -> %s", rel(claude), Agents), link)
case c && !a:
if cLink {
target, _ := os.Readlink(claude)
conflict("%s: symlink to missing target (%s)", rel(claude), target)
return
}
fix(fmt.Sprintf("%s: renamed to %s, symlink left in place", rel(claude), Agents),
func() error { return os.Rename(claude, agents) }, link)
case cLink:
if sameFile(claude, agents) {
return // canonical
}
old, _ := os.Readlink(claude)
fix(fmt.Sprintf("%s: re-pointed symlink (%s -> %s)", rel(claude), old, Agents),
func() error { return os.Remove(claude) }, link)
case aLink:
// Reversed layout: AGENTS.md is the link and CLAUDE.md the real file.
if !sameFile(agents, claude) {
conflict("%s: symlink elsewhere while %s is a real file", rel(agents), Claude)
return
}
fix(fmt.Sprintf("%s: swapped — %s is now the real file", rel(agents), Agents),
func() error { return os.Remove(agents) },
func() error { return os.Rename(claude, agents) }, link)
default:
// Both are real files, and only their contents decide what happens.
if !identical(agents, claude) {
conflict("%s: %s and %s are different real files — merge manually",
rel(dir), Agents, Claude)
return
}
fix(fmt.Sprintf("%s: identical to %s, replaced with symlink", rel(claude), Agents),
func() error { return os.Remove(claude) }, link)
}
}
func exists(p string) bool {
_, err := os.Stat(p)
return err == nil
}
// sameFile reports whether two paths resolve to one file.
func sameFile(a, b string) bool {
ra, err := filepath.EvalSymlinks(a)
if err != nil {
return false
}
rb, err := filepath.EvalSymlinks(b)
if err != nil {
return false
}
return ra == rb
}
// identical compares two files by content, not by size or mtime. The whole
// point of the comparison is to decide whether one of them may be deleted.
func identical(a, b string) bool {
ba, err := os.ReadFile(a)
if err != nil {
return false
}
bb, err := os.ReadFile(b)
if err != nil {
return false
}
return bytes.Equal(ba, bb)
}
+268
View File
@@ -0,0 +1,268 @@
package mirror
import (
"os"
"path/filepath"
"strings"
"testing"
)
// state is what one directory looks like after a walk: what kind of thing each
// name is, and what the real file holds. It is the assertion for every case
// below, because every case is a statement about exactly this.
type state struct {
agentsIsFile bool
claudeIsLink bool
linkTarget string
body string
}
func read(t *testing.T, dir string) state {
t.Helper()
var s state
if fi, err := os.Lstat(filepath.Join(dir, Agents)); err == nil {
s.agentsIsFile = fi.Mode().IsRegular()
}
if fi, err := os.Lstat(filepath.Join(dir, Claude)); err == nil {
if fi.Mode()&os.ModeSymlink != 0 {
s.claudeIsLink = true
s.linkTarget, _ = os.Readlink(filepath.Join(dir, Claude))
}
}
if b, err := os.ReadFile(filepath.Join(dir, Agents)); err == nil {
s.body = string(b)
}
return s
}
// canonical is the one arrangement this package exists to produce.
func canonical(body string) state {
return state{agentsIsFile: true, claudeIsLink: true, linkTarget: Agents, body: body}
}
func writeFile(t *testing.T, path, body string) {
t.Helper()
if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
t.Fatal(err)
}
}
func symlink(t *testing.T, target, path string) {
t.Helper()
if err := os.Symlink(target, path); err != nil {
t.Fatal(err)
}
}
// The seven branches, each named by the state it starts in.
func TestEveryBranchIsLosslessOrARefusal(t *testing.T) {
cases := []struct {
name string
// setup builds one directory in the state under test.
setup func(t *testing.T, dir string)
// want is the state afterwards; a conflict case wants no change at all.
want state
// fixes and conflicts are how many of each the walk reports.
fixes, conflicts int
// says is a fragment the one report has to contain, so a message that
// stops naming what happened fails here rather than in somebody's
// terminal a year from now.
says string
}{
{
name: "AGENTS.md alone gets a link beside it",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Agents), "doc\n")
},
want: canonical("doc\n"),
fixes: 1,
says: "created symlink",
},
{
name: "CLAUDE.md alone is renamed and linked back",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Claude), "doc\n")
},
want: canonical("doc\n"),
fixes: 1,
says: "renamed to " + Agents,
},
{
name: "already canonical is left completely alone",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Agents), "doc\n")
symlink(t, Agents, filepath.Join(dir, Claude))
},
want: canonical("doc\n"),
},
{
name: "a link pointing elsewhere is re-pointed",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Agents), "doc\n")
writeFile(t, filepath.Join(dir, "OTHER.md"), "other\n")
symlink(t, "OTHER.md", filepath.Join(dir, Claude))
},
want: canonical("doc\n"),
fixes: 1,
says: "re-pointed symlink",
},
{
name: "the reversed layout is swapped round",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Claude), "doc\n")
symlink(t, Claude, filepath.Join(dir, Agents))
},
want: canonical("doc\n"),
fixes: 1,
says: "swapped",
},
{
name: "two real files with one content lose the copy",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Agents), "doc\n")
writeFile(t, filepath.Join(dir, Claude), "doc\n")
},
want: canonical("doc\n"),
fixes: 1,
says: "replaced with symlink",
},
{
// The one case that must never be resolved: one of the two is
// somebody's writing, and no rule here knows which.
name: "two real files with different content are refused",
setup: func(t *testing.T, dir string) {
writeFile(t, filepath.Join(dir, Agents), "mine\n")
writeFile(t, filepath.Join(dir, Claude), "theirs\n")
},
want: state{agentsIsFile: true, body: "mine\n"},
conflicts: 1,
says: "merge manually",
},
{
name: "a broken link with nothing beside it is reported, not replaced",
setup: func(t *testing.T, dir string) {
symlink(t, "GONE.md", filepath.Join(dir, Agents))
},
want: state{},
conflicts: 1,
says: "broken symlink",
},
{
name: "a CLAUDE.md link to nothing is reported",
setup: func(t *testing.T, dir string) {
symlink(t, "GONE.md", filepath.Join(dir, Claude))
},
want: state{claudeIsLink: true, linkTarget: "GONE.md"},
conflicts: 1,
says: "missing target",
},
{
name: "a directory holding neither is not touched",
setup: func(t *testing.T, dir string) {},
want: state{},
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
dir := t.TempDir()
tc.setup(t, dir)
res := Sync(dir)
if len(res.Fixes) != tc.fixes {
t.Errorf("fixes = %d (%v), want %d", len(res.Fixes), res.Fixes, tc.fixes)
}
if len(res.Conflicts) != tc.conflicts {
t.Errorf("conflicts = %d (%v), want %d", len(res.Conflicts), res.Conflicts, tc.conflicts)
}
if tc.says != "" {
all := strings.Join(append(res.Fixes, res.Conflicts...), "\n")
if !strings.Contains(all, tc.says) {
t.Errorf("no report mentions %q; got:\n%s", tc.says, all)
}
}
if got := read(t, dir); got != tc.want {
t.Errorf("after Sync:\n got %+v\nwant %+v", got, tc.want)
}
// A second run must find nothing left to do. A repair that reported
// itself fixed and did not converge would loop forever inside a
// PreToolUse hook, once per Bash call.
if again := Sync(dir); len(again.Fixes) != 0 {
t.Errorf("not idempotent — a second run still fixes %v", again.Fixes)
}
})
}
}
// Check is the same walk with the writes turned off, and the promise it makes is
// that the run after it does exactly what it said.
func TestCheckReportsWithoutWriting(t *testing.T) {
dir := t.TempDir()
writeFile(t, filepath.Join(dir, Agents), "doc\n")
before := read(t, dir)
res := Check(dir)
if len(res.Fixes) != 1 {
t.Fatalf("Check found %d fixes, want 1", len(res.Fixes))
}
if after := read(t, dir); after != before {
t.Errorf("Check wrote to the tree: %+v -> %+v", before, after)
}
sync := Sync(dir)
if len(sync.Fixes) != len(res.Fixes) || sync.Fixes[0] != res.Fixes[0] {
t.Errorf("Sync did not do what Check said:\n check %v\n sync %v", res.Fixes, sync.Fixes)
}
if !Check(dir).Clean() {
t.Error("the tree is still not canonical after Sync")
}
}
// Somebody else's tree is somebody else's business. A vendored dependency's
// AGENTS.md rewritten here is a diff nobody asked for, and `.git` is not a place
// to be creating symlinks.
func TestSkippedDirectoriesAreNotTouched(t *testing.T) {
dir := t.TempDir()
for _, skip := range []string{"vendor", "node_modules", ".git", ".claude"} {
sub := filepath.Join(dir, skip, "pkg")
if err := os.MkdirAll(sub, 0o755); err != nil {
t.Fatal(err)
}
writeFile(t, filepath.Join(sub, Agents), "theirs\n")
}
if res := Sync(dir); !res.Clean() {
t.Errorf("walked into a skipped directory: %+v", res)
}
for _, skip := range []string{"vendor", "node_modules", ".git", ".claude"} {
p := filepath.Join(dir, skip, "pkg", Claude)
if _, err := os.Lstat(p); err == nil {
t.Errorf("%s was created inside %s", Claude, skip)
}
}
}
// The walk is a walk: a document six directories down is as canonical as one at
// the top, and the report says where it was.
func TestTheWholeTreeIsWalked(t *testing.T) {
dir := t.TempDir()
deep := filepath.Join(dir, "cli", "internal", "issue")
if err := os.MkdirAll(deep, 0o755); err != nil {
t.Fatal(err)
}
writeFile(t, filepath.Join(dir, Agents), "root\n")
writeFile(t, filepath.Join(deep, Agents), "issue\n")
res := Sync(dir)
if len(res.Fixes) != 2 {
t.Fatalf("fixes = %v, want one per directory", res.Fixes)
}
joined := strings.Join(res.Fixes, "\n")
if !strings.Contains(joined, filepath.Join("cli", "internal", "issue", Claude)) {
t.Errorf("the report does not name the nested directory:\n%s", joined)
}
if got := read(t, deep); got != canonical("issue\n") {
t.Errorf("nested directory not canonical: %+v", got)
}
}