fix(config): keep a malformed plugin block the validator's AB4000 when discovery derives the skill identity

Review: discovery dereferenced config.plugin.name before validateSource ran,
turning {} or plugin: null into a generic AB7000. declaredPluginIdentity()
returns undefined for an unusable plugin.name; the rendered skill then gets
no identity (AB3003) and validation reports AB4000 as before.

Author: ScriptedAlchemy

packages/agent-bundle/src/config/discover.ts

@@ -12,7 +12,7 @@ import { compileRouteGraph, isEmptyRouteGraph } from '../routes/graph.ts';
 import type { CompiledRouteGraph } from '../routes/types.ts';
 import { parseCommand, type CommandDocument } from './command.ts';
 import { isProjectPathIgnored, readProjectIgnoreRules } from './ignore.ts';
-import { pluginIdentity } from './plugin-identity.ts';
+import { declaredPluginIdentity } from './plugin-identity.ts';
 import { isRenderedSkillSourceName } from './rendered-skill.ts';
 import { parseRule, type RuleDocument } from './rule.ts';
 import { parseSkill, type SkillDocument } from './skill.ts';
@@ -257,8 +257,11 @@ export const discoverProject = async (
   const rules = await readProjectIgnoreRules(projectRoot);
   // Rendered skills evaluate during discovery, before normalization stamps
   // the same identity into the model; `agent-bundle/meta` serves it to them
-  // here so a skill documents the version its plugin ships (#440).
-  const meta = projectMeta(pluginIdentity(projectRoot, config));
+  // here so a skill documents the version its plugin ships (#440). A config
+  // without a usable `plugin.name` is the validator's AB4000, not a crash
+  // here, and such a skill gets no identity rather than a fabricated one.
+  const identity = declaredPluginIdentity(projectRoot, config as Readonly<Record<string, unknown>>);
+  const meta = identity === undefined ? undefined : projectMeta(identity);
   const configuredSkills = config.skills;
   const conventionalSources = (await fastGlob('src/skills/*/SKILL.{md,ts,tsx}', {
     absolute: true,
@@ -352,7 +355,7 @@ export const discoverProject = async (
     ...(discoveredRules.length === 0 ? {} : { rules: discoveredRules }),
     ...(shadowedConventionalSkills.length === 0 ? {} : { shadowedConventionalSkills }),
     skills: await Promise.all(
-      skillDirs.map((skillDir) => parseSkill(skillDir, projectRoot, rules, { meta })),
+      skillDirs.map((skillDir) => parseSkill(skillDir, projectRoot, rules, meta === undefined ? {} : { meta })),
     ),
     ...(state === undefined ? {} : { state }),
   };

packages/agent-bundle/src/config/plugin-identity.ts

@@ -1,5 +1,6 @@
 import type { ProjectMetaSource } from '../build/meta.ts';
 import { developmentFallbackVersion, snapshotPackageIdentity } from '../core/project-context.ts';
+import { isRecord } from '../core/strict-json.ts';
 import type { AgentBundleConfig } from '../core/types.ts';
 
 /**
@@ -39,3 +40,22 @@ export const pluginIdentity = (
     version: resolvePluginVersion(config.plugin.version, packageIdentity.packageVersion),
   });
 };
+
+/**
+ * {@link pluginIdentity} for a configuration that has not been validated yet
+ * (discovery runs before `validateSource`): undefined when `plugin.name` is
+ * not a nonempty string, so a malformed `plugin` block stays the validator's
+ * `AB4000` to report rather than a crash here, and no fabricated identity is
+ * ever served in its place.
+ */
+export const declaredPluginIdentity = (
+  projectRoot: string,
+  config: Readonly<Record<string, unknown>>,
+): ProjectMetaSource | undefined => {
+  const plugin = config.plugin;
+  if (!isRecord(plugin) || typeof plugin.name !== 'string' || plugin.name.trim().length === 0) return undefined;
+  // `resolvePluginVersion` already treats a non-string `version` as absent.
+  return pluginIdentity(projectRoot, {
+    plugin: { name: plugin.name, ...(typeof plugin.version === 'string' ? { version: plugin.version } : {}) },
+  });
+};

packages/agent-bundle/tests/rendered-skills.test.ts

@@ -280,6 +280,16 @@ describe('rendered skill compilation', () => {
     // it resolves however the project resolves `agent-bundle` — here, not at all.
     const direct = await parseSkill(join(root, 'src', 'skills', 'identity'), root);
     expect(direct.diagnostics).toEqual([expect.objectContaining({ code: 'AB3003' })]);
+
+    // A config with no usable plugin.name is the validator's AB4000: discovery
+    // still completes, and the skill is served no fabricated identity.
+    for (const malformed of [{}, { plugin: null }, { plugin: { name: '' } }, { plugin: 'x' }]) {
+      const config = malformed as unknown as AgentBundleConfig;
+      const withoutIdentity = await discoverProject(root, config);
+      expect(withoutIdentity.skills[0]?.diagnostics).toEqual([expect.objectContaining({ code: 'AB3003' })]);
+      expect(validateSource(loadedProject(config, root), withoutIdentity, registry).map(({ code }) => code))
+        .toContain('AB4000');
+    }
   });
 
   it('compiles JSX against the loader element factory, not the consumer react/jsx-runtime (#441)', async () => {