Skip to content

Release 2.1.281 (2026-10-31)

Chores

  • uv lock --upgrade

Features

  • share and verify the marketplace refresh on host and VMs (#3872)
  • feat(plugins): share and verify the marketplace refresh on host and VMs

Move the plugin refresh out of vm_guest into lib/claude_marketplace so the host and every VM run one sequence: re-add each declared marketplace at its declared ref, update the marketplaces and installs, then verify each registration's repo and ref against settings.json. Add vrg-host plugins (human only, exit 2 on failure). vrg-vm update copies the host config before refreshing, the Lima update-all loop defers plugin failures, a missing or invalid guest settings.json is fatal, and copy_claude_config becomes the sole owner of the read-only guest CLAUDE.md. Ref vergil-project/vergil-tooling#3851

  • fix(plugins): validate settings shape and harden the host and update paths

Reject a misshapen settings.json with a named error, read an empty ref as no ref, run the host refresh from the home directory and echo a failed command's stderr once. vrg-vm update now requires the host settings.json, names unreadable host files, removes a guest CLAUDE.md the host lacks, and refuses an agent identity with the fail-closed check. Docs describe the CLAUDE.md mode as a guard against accidental writes. Ref vergil-project/vergil-tooling#3851

  • fix(plugins): check the host settings before updating any VM and share the settings parser

vrg-vm update now checks the host settings.json before touching any VM, so a missing file is one clear error instead of a half-updated box per VM. The host and the guest parse settings.json with one shared function, and the host also names a non-UTF-8 file. A missing host ~/.claude removes a stale guest CLAUDE.md. The docs say a missing registered ref fails only when the settings declare one. Ref vergil-project/vergil-tooling#3851

  • fix(plugins): parse the host settings before updating any VM and tighten the plugin-list and enabledPlugins checks

vrg-vm update now parses the host settings.json, not only checks it exists, before copying it into any VM, and runs that check after the --all usage check. A single-VM or off-platform update reports a config or plugin failure as an ERROR line and exit 1. claude plugin list --json entries must carry a string scope and projectPath and a boolean enabled when present, enabledPlugins values must be booleans, and a failed marketplace add is labelled by marketplace name, deduplicated against the verification.

  • docs(plugins): list vrg-host plugins in the vrg-host preconditions and failure modes

  • feat(vm): make every vrg-vm subcommand a human action

vrg-vm runs the VMs the agents work inside, so main() now refuses an agent identity (the same fail-closed check vrg-vm update used) before dispatching any subcommand; --help and the bare usage output still work. The per-command check in update is folded into it. Tests pin the refusal for every subcommand, the mixed-signal case and the human path; the vrg-vm reference says it is a human tool. Ref vergil-project/vergil-tooling#3851

  • fix(plugins): shape-check the host settings before any VM update and report a failed command cleanly

vrg-vm update's pre-flight now runs the refresh's own extraKnownMarketplaces and enabledPlugins checks (claude_marketplace.validate_settings), and copy_claude_config with require_settings parses and shape-checks the exact text it pipes, so a misshapen or since-changed host settings.json is never copied into a VM. Single-VM and off-platform updates report a failed command as an exit status, as the --all loop does. The official marketplace is again deduplicated by source, so declaring its repo under another name adds it once. Ref vergil-project/vergil-tooling#3851

  • docs(plugins): say the cloud memory projection no longer carries the global CLAUDE.md

copy_claude_config now copies and locks the guest CLAUDE.md on every transport, so the share-set guide limits the cloud read-only projection to the memory subtree. Ref vergil-project/vergil-tooling#3851

CI Evidence: All gates passed — full audit bundle available. Download →