fix(kyberforge): catch plugin.json and hooks.json drift in sync-plugin-content.sh --check

--check's throwaway pack copy seeded .claude-plugin/plugin.json and
.github/plugin/plugin.json from the real plugin dir, then packed without
--force -- apm pack silently skips regenerating a plugin.json that already
exists, so the diff always compared the copy against itself and never caught
drift in the compiled name/version/description/mcpServers. --force is now
always passed; in check mode it forces regeneration inside the throwaway copy
only, which sync_plugin_manifest() then diffs against the real committed
manifest.

sync_hooks_json() returned early whenever .apm/hooks/ was missing, without
checking whether a stale hooks.json was still sitting at the plugin root from
a prior sync -- unlike sync_dir(), which already detects that kind of orphaned
mirrored output. It now mirrors sync_dir()'s shape: flagged as drift in
--check, removed on a real sync.

Running the corrected --check --all against this repo's own plugins surfaced
3 real orphans: plugins/{git,gitea,core}/hooks.json, empty stubs added in
4edaaac only to satisfy an old plugin.json pointer-field check that no longer
exists (their compiled plugin.json has never had a hooks field, and none of
the three ever had .apm/hooks/). Removed as part of this fix since they're
exactly the drift the corrected check now catches -- leaving them would break
the sync-plugin-content pre-push gate on this branch.

Also extracts two shared helpers into scripts/lib/, sourced by this script and
others so a future bug fix doesn't need hand-applying three times:
- marketplace-plugins.sh: walks marketplace.json for local plugin dirs (this
  script's --all branch and check-manifests.sh had near-identical copies)
- batch-run.sh: the bounded-batch concurrent job runner (this script,
  tests/run-tests.sh, and tests/run-bats.sh each hand-rolled the same
  core-count-capped wait loop independently)

Extended tests/test-sync-plugin-content.sh with coverage for both drift cases
(plugin.json version-bump drift, orphaned-hooks.json drift), including that a
re-sync clears each.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

tests/run-bats.sh

@@ -36,27 +36,24 @@ fi
 # of these suites) across files, which is where the wall-clock actually goes.
 # Output is buffered per file so concurrent TAP streams can't interleave, then
 # flushed in stable sorted order once every job has finished.
+#
+# Dispatch and throttling is scripts/lib/batch-run.sh's batch_run -- shared
+# with scripts/sync-plugin-content.sh and tests/run-tests.sh so a batching bug
+# fix only needs to land once; see that file for why this is batched rather
+# than a rolling `wait -n` pool.
 SCRATCH_ROOT="$(mktemp -d)"
 trap 'rm -rf "$SCRATCH_ROOT"' EXIT
+# shellcheck source=../scripts/lib/batch-run.sh
+source "$REPO_ROOT/scripts/lib/batch-run.sh"
 
-# Batches (not a rolling pool) because a bounded rolling pool needs `wait -n`,
-# which is bash 4.3+ and this script is explicitly bash-3.2-safe like
-# run-tests.sh; plain `wait` -- waiting for every job in the current batch --
-# is available since ancient bash. `getconf` over `nproc` for the same
-# reason: `nproc` doesn't exist on macOS.
-JOBS="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)"
-running=0
+declare -a batch_args=()
 i=0
 for f in "${TEST_FILES[@]}"; do
     i=$((i + 1))
-    ( "$BATS" "$f" >"$SCRATCH_ROOT/$i.log" 2>&1; echo $? >"$SCRATCH_ROOT/$i.status" ) &
-    running=$((running + 1))
-    if [[ "$running" -ge "$JOBS" ]]; then
-        wait
-        running=0
-    fi
+    cmd="$(printf '%q %q; echo $? >%q' "$BATS" "$f" "$SCRATCH_ROOT/$i.status")"
+    batch_args+=("$i" "$cmd")
 done
-wait
+batch_run "$SCRATCH_ROOT" ${batch_args[@]+"${batch_args[@]}"}
 
 FAIL=0
 TOTAL_OK=0

tests/run-tests.sh

@@ -51,32 +51,24 @@ done < <(
 
 # Each test-*.sh is independent (fixtures live under its own mktemp dir, none
 # write back into the live repo tree -- verified before adding this), so they
-# run concurrently in fixed-size batches instead of one at a time. Batches
-# (not a rolling pool) because a bounded rolling pool needs `wait -n`, which
-# is bash 4.3+ and this script is explicitly bash-3.2-safe (see the hazard
-# scan in test-vale-wrap.sh); plain `wait` -- waiting for every job in the
-# current batch -- is available since ancient bash. `getconf` over `nproc`
-# for the same reason: `nproc` doesn't exist on macOS.
+# run concurrently in fixed-size batches instead of one at a time. Dispatch and
+# throttling is scripts/lib/batch-run.sh's batch_run -- shared with
+# scripts/sync-plugin-content.sh and tests/run-bats.sh so a batching bug fix
+# only needs to land once; see that file for why this is batched rather than a
+# rolling `wait -n` pool.
 SCRATCH_ROOT="$(mktemp -d)"
 trap 'rm -rf "$SCRATCH_ROOT"' EXIT
-JOBS_LIMIT="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)"
+# shellcheck source=lib/batch-run.sh
+source "$REPO_ROOT/scripts/lib/batch-run.sh"
 
-running=0
+declare -a batch_args=()
 idx=0
 for script in ${SCRIPTS[@]+"${SCRIPTS[@]}"}; do
   idx=$((idx + 1))
-  (
-    rc=0
-    bash "$script" >"$SCRATCH_ROOT/$idx.log" 2>&1 || rc=$?
-    echo "$rc" >"$SCRATCH_ROOT/$idx.status"
-  ) &
-  running=$((running + 1))
-  if [[ $running -ge $JOBS_LIMIT ]]; then
-    wait
-    running=0
-  fi
+  cmd="$(printf 'rc=0; bash %q || rc=$?; echo "$rc" >%q' "$script" "$SCRATCH_ROOT/$idx.status")"
+  batch_args+=("$idx" "$cmd")
 done
-wait
+batch_run "$SCRATCH_ROOT" ${batch_args[@]+"${batch_args[@]}"}
 
 idx=0
 for script in ${SCRIPTS[@]+"${SCRIPTS[@]}"}; do

tests/test-sync-plugin-content.sh

@@ -236,6 +236,73 @@ else
   fail "an empty .mcp.json still added mcpServers -- should match apm's own omit-when-empty convention"
 fi
 
+# --- 12. --check detects drift in the compiled plugin.json (apm.yml content changed) ---
+echo ""
+echo "--- --check detects plugin.json content drift from apm.yml after a version bump ---"
+FIXTURE12="$(make_fixture)"; track "$FIXTURE12"
+bash "$SCRIPT" "$FIXTURE12" > /dev/null 2>&1
+if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
+  pass "check is clean right after the initial sync (baseline for this test)"
+else
+  fail "check reported drift right after the initial sync -- can't test the version-bump case"
+fi
+# Bump the version in apm.yml without re-syncing -- the compiled
+# .claude-plugin/plugin.json is now stale relative to what apm pack would
+# currently produce.
+cat > "$FIXTURE12/apm.yml" <<'YAML'
+name: fixture
+version: 0.0.2
+description: fixture
+license: MIT
+type: hybrid
+targets:
+  - claude
+dependencies:
+  apm: []
+  mcp: []
+includes: auto
+devDependencies:
+  apm: []
+scripts: {}
+YAML
+if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
+  fail "no drift reported after bumping apm.yml's version -- plugin.json should be stale"
+else
+  pass "plugin.json content drift (version bump) is detected"
+  bash "$SCRIPT" "$FIXTURE12" > /dev/null 2>&1
+  if bash "$SCRIPT" --check "$FIXTURE12" > /dev/null 2>&1; then
+    pass "re-sync clears the plugin.json drift"
+  else
+    fail "re-sync did not clear the plugin.json drift"
+  fi
+fi
+
+# --- 13. --check detects an orphaned hooks.json after .apm/hooks/ is removed ---
+echo ""
+echo "--- --check detects an orphaned hooks.json when .apm/hooks/ is removed ---"
+FIXTURE13="$(make_fixture)"; track "$FIXTURE13"
+bash "$SCRIPT" "$FIXTURE13" > /dev/null 2>&1
+if [[ ! -f "$FIXTURE13/hooks.json" ]]; then
+  fail "initial sync did not create hooks.json -- can't test the orphan case"
+fi
+rm -rf "$FIXTURE13/.apm/hooks"
+if bash "$SCRIPT" --check "$FIXTURE13" > /dev/null 2>&1; then
+  fail "no drift reported for an orphaned hooks.json after .apm/hooks/ removal"
+else
+  pass "orphaned hooks.json is detected as drift"
+  bash "$SCRIPT" "$FIXTURE13" > /dev/null 2>&1
+  if [[ ! -e "$FIXTURE13/hooks.json" ]]; then
+    pass "re-sync removes the orphaned hooks.json"
+  else
+    fail "re-sync left the orphaned hooks.json in place"
+  fi
+  if bash "$SCRIPT" --check "$FIXTURE13" > /dev/null 2>&1; then
+    pass "re-sync clears the orphaned-hooks.json drift"
+  else
+    fail "re-sync did not clear the orphaned-hooks.json drift"
+  fi
+fi
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 [[ $FAIL -eq 0 ]]