fix(build,validate,doctor): run the Claude host validator and --plugin-dir load check; doctor reads enabled (AB7327) (#475, #476)

[ScriptedAlchemy]

Fixes #475, Fixes #476

What changes

build runs the Claude host validator (#476). agent-bundle build now runs the same Claude Code checks as validate --artifact over every built claude and plugin target: --host-validation (default on), --no-host-validation, --strict. Findings keep AB6019–AB6022. Without claude on PATH the build spawns exactly once, reports one informational AB6019, and marks the remaining Claude targets unavailable without another spawn. Programmatic build() never runs it unless hostValidation: true is passed (dev/eval/temporary artifacts stay fast). The JSON document carries hostValidation[].

Load check in the shared runner (#479 follow-up). claude plugin validate --strict accepts manifests Claude then refuses to load (verified 2.1.250–2.1.260: invalid monitors/monitors.json, auto-loaded hooks pointer, …). validateClaudePlugin now follows the two validation runs with claude --plugin-dir <dir> plugin list --json and reads the bundle's <name>@inline row:

load.status	Code
loaded	—
refused (row carries errors[], quoted verbatim)	AB7325 error — a warning when every entry is Dependency "…" is not installed (that describes the validating machine, not the artifact; --strict promotes it)
unregistered (no row)	AB7311
failed (listing unreadable)	AB6022

This applies to both build and validate --artifact behind the existing --host-validation flag. Skipped when the bundle has no readable plugin.json name; loadCheck: false opts out (Doctor uses it — its registration proof and inventory errors[] from #479 already hold the verdict).

doctor --host claude (#476). Runs the validator over the --from bundle and every installed copy Claude lists (findings prefixed Bundle at … / Installed copy at … (scope …), one --version probe per host via the new version option), and reads each row's enabled: an installed-but-disabled copy is state: 'disabled', the comparison carries enabled: false next to its content verdict, and a new AB7327 warning names the exact claude plugin enable <name>@<marketplace> [--scope …] command (reinstalling does not enable). #482 took AB7326 while this was in flight, hence AB7327. Workbench discovery gained the disabled state (Zod schema + presentation).

Native proofs validate in plugin mode (#475). host-adapters.native.test.ts and packed-native-smoke.ts go through the shared runner (plugin.json → marketplace.json → load check) instead of claude plugin validate <dir> (marketplace mode). Re-recorded on Claude Code 2.1.250 (CI pin) and 2.1.260: the symlinked-skill case now asserts the documented plugin-mode warning (plugin-marketplaces-0.md → "Validate a plugin or a directory without a manifest" → "Check files behind symlinks": directory: 1 entry here is a symlink and was not read, --strict → exit 1) and proves the marketplace run never reports it; the monitors case records that validation passes but the load check refuses (AB7325); the dependencies case records the machine-bound AB7325 warning. native-claude-contract.ts had nothing left to change.

Docs

docs/diagnostics.md (host-validation section now covers build/doctor, the load check, AB7311/AB7325 there, new AB7327 section citing plugins-reference "plugin enable"/"plugin disable"/"Default enablement"); en+zh guide/distribution/validation.mdx, guide/distribution/installation.mdx, reference/cli.mdx. Also adds the detail table header website/plugins/generated-reference.ts (#490) references but never defined — main's Docs workflow is red on it; without this the docs gate cannot pass here.

Tests

• claude-plugin-validation.test.ts: load check call order/report shape, AB7325 refused, dependency warning + --strict, AB7311, AB6022 (nonzero / not JSON / not array), opt-out and nameless-manifest skip.
• api.test.ts: build runs validate+load only when asked, --strict, AB7325 from a refused load, single AB6019 + single spawn with claude absent.
• cli.test.ts: build flag policy and human output.
• doctor.test.ts: AB7327 disabled copy, validator over bundle + installed copy with one probe and no second listing; existing expectations updated for enabled and the validate calls.
• Ran: pnpm typecheck (clean after pnpm build), pnpm lint, pnpm test:unit (3113 passed), targeted integration suites (api, cli, cli-routes-build, artifact-validator, packed-consumer, claude-plugin-validate-acceptance, host-install-proof — 180 passed), test:host-install, test:host-install:packed, test:packed:native with the pinned Claude 2.1.250, native host-adapter proofs on 2.1.250 and 2.1.260 (the only failures are pre-existing and untouched: the 2.1.257 help pin and a 2.1.250 marketplace source-constraint wording), pnpm docs:site:build.

Review status

Codex review completed on e9ec043 with no findings (no review threads). Head fe1d855 differs only by the changeset's (#504) PR reference and is unreviewed; merging on green CI per the reviewer-fallback rule (no PR comments are posted from this worker).

[changeset-bot]

🦋 Changeset detected

Latest commit: fe1d855

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T01:35:32.955858Z	e9ec043	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@504

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@504

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@504

commit: fe1d855