fix(config): Fail fast on plugin build config

[dcramer]

Tighten plugin and build configuration loading so malformed, unresolved, or misspelled explicit config fails at startup/build instead of being silently ignored.

This keeps the build-time Nitro virtual config path as the primary source, but only falls back to JUNIOR_PLUGIN_PACKAGES when the virtual module is genuinely absent. Other import errors now propagate instead of being mistaken for missing config.

Configured plugins.packages entries now fail if the package list is malformed, the package name is malformed, the package cannot be resolved, or the package has no plugin content. A typo should break loudly, not produce a runtime that simply lacks the requested provider. App startup now forces catalog validation for explicit plugin package/config/defaults input and rolls both plugin config and install defaults back if validation fails, so a bad startup attempt cannot leak partial process-global state. Package discovery uses a shared package-root resolver that preserves visible and ancestor node_modules paths and can resolve content-only packages through package.json, so plugin packages do not need a JS entry point just to load plugin.yaml or skills. Resolver setup failures also return through the same explicit configured-package error path instead of leaking lower-level module setup errors.

The runtime now has one plugin configuration source. The old package-only plugin global is gone, so app startup, eval setup, diagnostics, and registry loading all read package configuration from the same PluginConfig state instead of keeping package names and manifest overrides in separate mutable slots.

Build copying uses the same resolver for includeFiles and rejects malformed package names before touching filesystem paths. includeFiles itself must be an array of package subpath patterns, and entries still fail if the package, source directory, file pattern, or matched source file cannot be resolved/copied. These entries are explicit build contracts for files the bundler cannot trace, so skipping them would produce a misleadingly successful build.

Install-wide config defaults now reject malformed shapes, deep-clone values on write and read, and only treat undefined as a clear operation. That keeps nested values from mutating process-global defaults outside the validation path.

This also removes the hidden JUNIOR_EXTRA_PLUGIN_ROOTS discovery path. Tests and evals now install fixture plugins through a temporary app/plugins root and exercise the same local plugin discovery path as production apps; the eval harness also cleans up partial plugin fixture setup if later setup validation fails, so cwd is restored for subsequent evals.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
junior-docs	Ready	Preview, Comment	May 23, 2026 5:39am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2a20894. Configure here.}