Add plugin validate command

Author: SqlRush

cmd/claude/main.go

@@ -339,6 +339,8 @@ func runPluginCLI(ctx context.Context, state *bootstrap.State, args []string, st
 		return runPluginInstallCLI(state, args[1:], stdout, stderr)
 	case "update":
 		return runPluginUpdateCLI(state, args[1:], stdout, stderr)
+	case "validate":
+		return runPluginValidateCLI(state, args[1:], stdout, stderr)
 	case "enable":
 		return runPluginSetEnabledCLI(state, "enable", args[1:], stdout, stderr)
 	case "disable":
@@ -483,6 +485,31 @@ func runPluginUpdateCLI(state *bootstrap.State, args []string, stdout io.Writer,
 	return 0
 }
 
+func runPluginValidateCLI(state *bootstrap.State, args []string, stdout io.Writer, stderr io.Writer) int {
+	flags := flag.NewFlagSet("claude plugin validate", flag.ContinueOnError)
+	flags.SetOutput(stderr)
+	if err := flags.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if flags.NArg() != 1 {
+		fmt.Fprintln(stderr, "ccgo plugin validate: usage: claude plugin validate <path>")
+		return 2
+	}
+	result, err := pluginpkg.ValidateManifestPath(flags.Arg(0), state.CWD())
+	if err != nil {
+		fmt.Fprintf(stderr, "ccgo plugin validate: %v\n", err)
+		return 2
+	}
+	writePluginValidationResult(stdout, result)
+	if !result.Success {
+		return 1
+	}
+	return 0
+}
+
 func runPluginSetEnabledCLI(state *bootstrap.State, action string, args []string, stdout io.Writer, stderr io.Writer) int {
 	flags := flag.NewFlagSet("claude plugin "+action, flag.ContinueOnError)
 	flags.SetOutput(stderr)
@@ -807,6 +834,79 @@ func writePluginUpdateResult(stdout io.Writer, result pluginpkg.PluginUpdateResu
 	fmt.Fprintln(stdout, strings.Join(lines, "\n"))
 }
 
+func writePluginValidationResult(stdout io.Writer, result pluginpkg.ManifestValidationResult) {
+	lines := []string{
+		fmt.Sprintf("Validating %s manifest: %s", result.FileType, result.FilePath),
+		"",
+	}
+	if len(result.Errors) > 0 {
+		lines = append(lines, fmt.Sprintf("Found %d %s:", len(result.Errors), pluralWord(len(result.Errors), "error", "errors")))
+		lines = append(lines, "")
+		for _, item := range result.Errors {
+			lines = append(lines, fmt.Sprintf("- %s: %s", pluginCLIValidationMessagePath(item.Path), item.Message))
+		}
+		lines = append(lines, "")
+	}
+	if len(result.Warnings) > 0 {
+		lines = append(lines, fmt.Sprintf("Found %d %s:", len(result.Warnings), pluralWord(len(result.Warnings), "warning", "warnings")))
+		lines = append(lines, "")
+		for _, item := range result.Warnings {
+			lines = append(lines, fmt.Sprintf("- %s: %s", pluginCLIValidationMessagePath(item.Path), item.Message))
+		}
+		lines = append(lines, "")
+	}
+	if result.Success && result.FileType == "plugin" {
+		lines = append(lines, "Plugin: "+result.Plugin.Name)
+		if result.Plugin.Version != "" {
+			lines = append(lines, "Version: "+result.Plugin.Version)
+		}
+		lines = append(lines,
+			fmt.Sprintf("Commands: %d", len(result.Plugin.Commands)+len(result.Plugin.PromptTemplates)),
+			fmt.Sprintf("Skills: %d", len(result.Plugin.SkillCommands)),
+			fmt.Sprintf("Agents: %d", len(result.Plugin.Agents)),
+			fmt.Sprintf("MCP servers: %d", len(result.Plugin.MCPServers)),
+			fmt.Sprintf("Output styles: %d", len(result.Plugin.OutputStyles)),
+			fmt.Sprintf("Hooks: %d", len(result.Plugin.HookEvents)),
+			"",
+		)
+	}
+	if result.Success && result.FileType == "marketplace" {
+		lines = append(lines, fmt.Sprintf("Marketplace plugins: %d", result.PluginCount))
+		for _, name := range firstPluginCLIStrings(result.MarketplaceIDs, 10) {
+			lines = append(lines, "- "+name)
+		}
+		if len(result.MarketplaceIDs) > 10 {
+			lines = append(lines, fmt.Sprintf("Showing 10 of %d marketplace plugins.", len(result.MarketplaceIDs)))
+		}
+		lines = append(lines, "")
+	}
+	if result.Success {
+		if len(result.Warnings) > 0 {
+			lines = append(lines, "Validation passed with warnings")
+		} else {
+			lines = append(lines, "Validation passed")
+		}
+	} else {
+		lines = append(lines, "Validation failed")
+	}
+	fmt.Fprintln(stdout, strings.TrimRight(strings.Join(lines, "\n"), "\n"))
+}
+
+func firstPluginCLIStrings(values []string, limit int) []string {
+	if len(values) <= limit {
+		return values
+	}
+	return values[:limit]
+}
+
+func pluginCLIValidationMessagePath(path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "root"
+	}
+	return path
+}
+
 func pluginCLISettingsFromFiles(cwd string) (contracts.Settings, error) {
 	userSettings, err := pluginCLILoadOptionalSettings(config.UserSettingsPath())
 	if err != nil {

cmd/claude/main_test.go

@@ -2145,6 +2145,65 @@ func TestRunPluginListJSONAvailable(t *testing.T) {
 	}
 }
 
+func TestRunPluginValidateCLI(t *testing.T) {
+	configHome := t.TempDir()
+	t.Setenv("CLAUDE_CONFIG_DIR", configHome)
+	project := t.TempDir()
+	pluginDir := filepath.Join(project, "demo-plugin")
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.json"), []byte(`{
+		"name": "demo-plugin",
+		"version": "1.0.0",
+		"description": "Demo plugin",
+		"author": {"name": "Team"}
+	}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	expectedPluginDir, err := filepath.EvalSymlinks(pluginDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"--cwd", project, "plugin", "validate", "demo-plugin"}, strings.NewReader(""), &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	for _, want := range []string{
+		"Validating plugin manifest: " + filepath.Join(expectedPluginDir, "plugin.json"),
+		"Plugin: demo-plugin",
+		"Validation passed",
+	} {
+		if !strings.Contains(stdout.String(), want) {
+			t.Fatalf("stdout missing %q: %q", want, stdout.String())
+		}
+	}
+
+	badDir := filepath.Join(project, "bad-plugin")
+	if err := os.MkdirAll(badDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "plugin.json"), []byte(`{"name":`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stdout.Reset()
+	stderr.Reset()
+	code = run([]string{"--cwd", project, "plugin", "validate", "bad-plugin"}, strings.NewReader(""), &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("exit=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	for _, want := range []string{
+		"Found 1 error:",
+		"json: Invalid JSON syntax",
+		"Validation failed",
+	} {
+		if !strings.Contains(stdout.String(), want) {
+			t.Fatalf("stdout missing %q: %q", want, stdout.String())
+		}
+	}
+}
+
 func TestRunPluginInstallCLI(t *testing.T) {
 	configHome := t.TempDir()
 	t.Setenv("CLAUDE_CONFIG_DIR", configHome)

docs/cc-100-roadmap.md

@@ -43,6 +43,8 @@ M8 补充：`/plugin help|--help|-h` 已输出官方插件命令用法，`/plugi
 
 M8 补充：`/plugin uninstall|remove|rm [--scope project|user|local] <plugin>` 已接入 no-query 安全卸载路径，只允许删除 installed plugin directory 枚举出的插件 root，输出 removed path/scope/status，并刷新 plugin MCP server app-state。
 
+M8 补充：`/plugin validate <path>` 与 CLI `plugin validate <path>` 已接入共享 manifest 验证 API，支持官方 `.claude-plugin/marketplace.json` 优先目录检测、`.claude-plugin/plugin.json`、当前 Go root `marketplace.json`/`plugin.json` 兼容、未知文件内容推断、JSON/类型/unknown-key/path-traversal 诊断、plugin author/version/description/kebab-case warning 和 marketplace plugin count/duplicate/source 诊断；slash 路径不请求模型。
+
 M10 补充：plugin command/agent 的 allowed tool frontmatter 解析现在只在顶层逗号或空白处分隔，保留括号、方括号和引号内的逗号/空白，避免 `Bash(git commit -m "x,y")` 这类 tool pattern 被误拆。
 
 M8 补充：CLI `plugin marketplace list` 现在可列出 settings 中已配置的 marketplace；`--json` 输出按名称排序的 source/repo/url/path/package/installLocation 结构，普通文本输出与无配置提示也已覆盖。CLI `plugin marketplace add [--scope user|project|local] [--type ...] <name> <source>` 和 `plugin marketplace remove [--scope user|project|local] <name>` 现在复用 `internal/config` settings 文件写入 helper，可按目标 scope 写入/删除 `extraKnownMarketplaces`，并在写入前复用 marketplace source validation，且 `installLocation` 会校验为 `user|project|local`。CLI `plugin marketplace update [name]` 现在可按全部或指定 marketplace 触发现有 URL/git/github/npm/settings cache 加载刷新路径，命名 update 会用轻量 settings 读取避免启动时提前刷新全部 marketplace。运行时插件发现现在会合并项目链 `.claude/plugins` 和用户级 `${CLAUDE_CONFIG_DIR}/plugins`，项目同名插件优先。CLI `plugin install --scope project|user|local <plugin>` 与 headless `/plugin install [--scope project|user|local] <plugin>` 现在复用 `internal/plugins` 共享安装 API，把 marketplace 插件复制到目标 scope 的 `plugins/<safe-name>`，未显式传 scope 时会尊重 marketplace `installLocation` 默认值，并保留冲突检测、重复安装识别和 symlink/non-regular file 拒绝。CLI `plugin update --scope project|user|local|all <plugin>` 与 headless `/plugin update [--scope project|user|local|all] [plugin]` 现在复用 `internal/plugins` 共享更新 API，把目标 scope 已安装同名插件替换为最新 marketplace 副本，未显式传 scope 的命名更新同样会尊重 marketplace `installLocation`。CLI `plugin enable|disable [--scope user|project|local] <plugin>` 与 `plugin disable --all --scope ...` 现在复用 `internal/config` settings 文件写入 helper，按目标 scope 更新 `enabledPlugins` 并覆盖基本参数冲突。

docs/claude-code-go-rewrite-plan.md

@@ -899,6 +899,7 @@ test/parity/                 # golden tests against TS/official behavior
 
 - 本轮补充：`/plugin help|--help|-h` 现在输出官方 Plugin Command Usage 文案，`/plugin manage` 复用已安装 plugin summary，`/plugin i` 作为 install alias 接入同一安装路径，builtin command registry 同步声明官方 `/plugins` 与 `/marketplace` 顶层别名。
 - 本轮补充：`/plugin uninstall|remove|rm [--scope project|user|local] <plugin>` 现在有 no-query 安全卸载路径，只删除 installed plugin directory 枚举出的插件 root，输出 removed path/scope/status，并刷新 plugin MCP server app-state。
+- 本轮补充：`/plugin validate <path>` 现在走 no-query 本地 manifest 验证路径，并与 CLI `plugin validate <path>` 共享 `internal/plugins` 验证 API；目录输入会按官方优先级检测 `.claude-plugin/marketplace.json` 再 `.claude-plugin/plugin.json`，同时兼容当前 Go root `marketplace.json`/`plugin.json` 布局，输出 JSON/类型/unknown-key/path-traversal 诊断、plugin warning 和 marketplace plugin summary。
 
 - 本轮补充：bridge-safe 内置本地命令 `/summary`、`/release-notes`、`/files` 现在已注册并接入 no-query runner 路径；`/summary` 输出确定性的会话/历史消息计数、工具使用计数、估算 token 和最近用户/助手预览，`/files` 只读列出当前工作目录第一层条目而不读取文件内容，`/release-notes` 明确报告当前 Go runtime 未打包 release notes。完整 local-jsx UI surface 和其它本地命令 parity 仍需继续补。
 

docs/first-second-parity-audit.md

@@ -89,6 +89,7 @@ Anthropic API 和 conversation：
 - `/mcp <server-name>` now takes the no-query local server-detail path used by `/mcp show <server-name>` when the name matches a configured settings or plugin MCP server, while unknown one-word subcommands still report unsupported.
 - `/plugin help|--help|-h` now returns the official plugin command usage text without querying the model, `/plugin manage` reuses the installed-plugin summary path, `/plugin i` aliases install, and the built-in command registry now exposes the official `/plugins` and `/marketplace` aliases.
 - `/plugin uninstall|remove|rm [--scope project|user|local] <plugin>` now takes a no-query safe uninstall path that only removes plugin roots discovered from installed plugin directories, reports removed path/scope, and refreshes plugin MCP server app-state.
+- `/plugin validate <path>` now takes a no-query local validation path backed by a shared plugin manifest validator also used by CLI `plugin validate <path>`, covering official `.claude-plugin` marketplace/plugin directory detection, current Go root manifest layouts, JSON/type/unknown-key/path-traversal diagnostics, common plugin warnings, and marketplace entry summaries.
 - `/plugin <plugin-name>` now takes the no-query local plugin-detail path used by `/plugin show <plugin-name>` when the name matches a local plugin manifest, while unknown one-word subcommands still report unsupported.
 - `/model show`, `/model info`, and `/model current` now take the no-query current-model path instead of treating those words as custom model names and mutating the runner model.
 - A basic `Skill` tool wrapper is now registered with the default built-in tool set. It can invoke local project and plugin-directory prompt skills through the command registry, returns the official-style `Launching skill: ...` result plus structured command metadata, preserves command source/display/root/frontmatter metadata for plugin skills, and passes expanded meta user messages through `ToolResult.NewMessages`; the conversation runner now appends those new messages to transcripts and subsequent model requests.

internal/conversation/run.go

@@ -3390,6 +3390,8 @@ func (r Runner) formatPluginSummary(raw string) string {
 			return r.formatPluginConfig(args)
 		case "install", "i":
 			return r.installPluginSummary(subcommandRemainder(raw, args[0]))
+		case "validate":
+			return r.validatePluginSummary(subcommandRemainder(raw, args[0]))
 		case "uninstall", "remove", "rm":
 			return r.uninstallPluginSummary(subcommandRemainder(raw, args[0]))
 		case "update":
@@ -3546,6 +3548,109 @@ func pluginCommandHelp() string {
 	}, "\n")
 }
 
+func pluginValidateUsage() string {
+	return strings.Join([]string{
+		"Usage: /plugin validate <path>",
+		"",
+		"Validate a plugin or marketplace manifest file or directory.",
+		"",
+		"Examples:",
+		"  /plugin validate .claude-plugin/plugin.json",
+		"  /plugin validate /path/to/plugin-directory",
+		"  /plugin validate .",
+		"",
+		"When given a directory, automatically validates .claude-plugin/marketplace.json",
+		"or .claude-plugin/plugin.json (prefers marketplace if both exist).",
+		"",
+		"Or from the command line:",
+		"  claude plugin validate <path>",
+	}, "\n")
+}
+
+func (r Runner) validatePluginSummary(path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return pluginValidateUsage()
+	}
+	result, err := pluginpkg.ValidateManifestPath(path, r.WorkingDirectory)
+	if err != nil {
+		return "Unexpected error during validation: " + err.Error()
+	}
+	return formatPluginValidationResult(result)
+}
+
+func formatPluginValidationResult(result pluginpkg.ManifestValidationResult) string {
+	lines := []string{
+		fmt.Sprintf("Validating %s manifest: %s", result.FileType, result.FilePath),
+		"",
+	}
+	if len(result.Errors) > 0 {
+		lines = append(lines, fmt.Sprintf("Found %d %s:", len(result.Errors), pluginValidationPlural(len(result.Errors), "error")))
+		lines = append(lines, "")
+		for _, item := range result.Errors {
+			lines = append(lines, fmt.Sprintf("- %s: %s", pluginValidationMessagePath(item.Path), item.Message))
+		}
+		lines = append(lines, "")
+	}
+	if len(result.Warnings) > 0 {
+		lines = append(lines, fmt.Sprintf("Found %d %s:", len(result.Warnings), pluginValidationPlural(len(result.Warnings), "warning")))
+		lines = append(lines, "")
+		for _, item := range result.Warnings {
+			lines = append(lines, fmt.Sprintf("- %s: %s", pluginValidationMessagePath(item.Path), item.Message))
+		}
+		lines = append(lines, "")
+	}
+	if result.Success && result.FileType == "plugin" {
+		if result.Plugin.Name != "" {
+			lines = append(lines, "Plugin: "+result.Plugin.Name)
+		}
+		lines = append(lines,
+			fmt.Sprintf("Commands: %d", len(loadedPluginCommandNames(result.Plugin))),
+			fmt.Sprintf("Skills: %d", len(result.Plugin.SkillCommands)),
+			fmt.Sprintf("Agents: %d", len(result.Plugin.Agents)),
+			fmt.Sprintf("MCP servers: %d", len(result.Plugin.MCPServers)),
+			fmt.Sprintf("Output styles: %d", len(result.Plugin.OutputStyles)),
+			fmt.Sprintf("Hooks: %d", pluginHookCount([]pluginpkg.LoadedPlugin{result.Plugin})),
+			"",
+		)
+	}
+	if result.Success && result.FileType == "marketplace" {
+		lines = append(lines, fmt.Sprintf("Marketplace plugins: %d", result.PluginCount))
+		for _, name := range firstStrings(result.MarketplaceIDs, 10) {
+			lines = append(lines, "- "+name)
+		}
+		if len(result.MarketplaceIDs) > 10 {
+			lines = append(lines, fmt.Sprintf("Showing 10 of %d marketplace plugins.", len(result.MarketplaceIDs)))
+		}
+		lines = append(lines, "")
+	}
+	if result.Success {
+		if len(result.Warnings) > 0 {
+			lines = append(lines, "Validation passed with warnings")
+		} else {
+			lines = append(lines, "Validation passed")
+		}
+	} else {
+		lines = append(lines, "Validation failed")
+	}
+	return strings.TrimRight(strings.Join(lines, "\n"), "\n")
+}
+
+func pluginValidationPlural(count int, singular string) string {
+	if count == 1 {
+		return singular
+	}
+	return singular + "s"
+}
+
+func pluginValidationMessagePath(path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "root"
+	}
+	return path
+}
+
 func (r Runner) formatPluginShow(args []string) string {
 	if len(args) < 2 || strings.TrimSpace(args[1]) == "" {
 		return "Usage: /plugin " + args[0] + " <plugin-name>"