forgecell plugin usage line omits plugin new and plugin pin #369

Fix the forgecell plugin usage line and --help so they list every plugin command (#369)

Component: every file belongs to the lab Go module (manifest lab/go.mod).

The released v0.4.0 binary prints this line for forgecell plugin with no subcommand, an unknown subcommand, and every usage error of plugin test, plugin list and plugin doctor. The line is pluginUsage in lab/internal/cli/plugin.go:

usage: forgecell plugin test <manifest> [--json] | forgecell plugin list [--lab DIR] [--lab-name NAME] [--json] | forgecell plugin doctor [NAME] [--lab DIR] [--lab-name NAME] [--json]

It leaves out plugin new and plugin pin, and plugin test doesn't show its live flags. forgecell --help (lab/internal/cli/cli.go, the help text) lists only plugin test <manifest> [--json].

Build:

1. pluginUsage becomes one line covering all five commands, in this order: new, pin, test, list, doctor. Build it from the existing per-command strings, with their usage: prefix removed, so it can't drift from them:

   • pluginNewUsage;
   • pluginPinUsage;
   • the plugin test form with live flags, from pluginTestLiveUsage;
   • the list and doctor forms exactly as they are today.

   The result is usage: forgecell plugin new … | forgecell plugin pin … | forgecell plugin test <manifest> [--json] [--live …] | forgecell plugin list … | forgecell plugin doctor ….

   pluginNewUsage, pluginPinUsage and pluginTestLiveUsage stay byte-identical, and every place that prints pluginUsage today still prints it.

2. In forgecell --help, the plugin test <manifest> [--json] line becomes lines for every plugin command: plugin new, plugin pin, plugin test with its live flags, plugin list and plugin doctor. Use the same forms as pluginUsage, without usage: forgecell , and keep the help's existing one-command-per-line style. No other help line changes.

Scope (files):

• Edited:
  • lab/internal/cli/plugin.go
  • lab/internal/cli/cli.go (help text only)
  • lab/internal/cli/plugin_new_test.go: TestPluginUsageKeepsTestListAndDoctor pins the old line by design (slice 6a kept it unchanged). Update it to assert the new line, and keep its loop over usage errors so each prints the new pluginUsage byte for byte. This is an intended protected delta.
• New: lab/internal/cli/plugin_usage_test.go
• Must stay untouched: every other existing _test.go, and everything outside lab/internal/cli.

Tests (new file):

• forgecell plugin with no subcommand, and with an unknown one, prints the new line and exits 1. It names new, pin, test with --live, list and doctor.
• pluginUsage contains each of pluginNewUsage, pluginPinUsage and pluginTestLiveUsage with the usage: prefix removed.
• --help has a line for each of the five plugin commands, and TestHelpListsPluginTest still passes.
• The usage errors of plugin new and plugin pin still print their own usage, unchanged.

Done when

• go test -timeout 20m ./internal/cli/... passes from lab/. The only base-test delta is TestPluginUsageKeepsTestListAndDoctor.

Plan checks for this slice

Use one combined targeted go test -timeout 20m ./internal/cli/... check. Its definitions must not include lab/internal/cli/plugin_new_test.go, because the change edits that file. Every plan check leaves reviewedAcceptance and independentProvenance empty.

Review checklist (read before coding)

The adversarial review checks these every time. Recent slices failed review on all of them, so build them in from the start:

• Bounds: sizes, counts, time and total work are bounded, and hitting a bound fails safe (incomplete or truncated, never silently accepted).
• Filesystem safety: paths cannot traverse. Use Lstat and O_NOFOLLOW, and check symlinks and ownership. Watch for TOCTOU races on shared dirs (/tmp). Only ever delete Forgecell-owned, marked paths.
• Untrusted input: issue text, repository files, model and tool output, and ledgers can be malformed, huge or hostile. Validate them, never interpolate them into HTML or a shell, and never let them trigger retries or approvals.
• No local leaks: no absolute local paths, environment variables or credentials in output, logs, the UI or ledgers.
• Contract changes: a changed adapter invocation bumps the protocol, and approved digests still bind exactly what was shown.
• Tests: deterministic. Use no wall-clock budgets (use readiness markers or seams), write nothing into the user's real temp or home, and cover the failure path as well as the happy path.

Plan checks (for intake)

Check category must be one of regression, candidate or setup. Use targeted package tests only as plain go test -timeout 20m commands (for example go test -timeout 20m ./internal/<pkg>/...; without -timeout, go test stops a package after 10 minutes, and cli and molecule exceed that on a loaded machine); the protected view adds -json itself when protected deltas are declared. The Formula baseline already runs the full suite once, so don't add another full go test ./... check, and don't repeat its go vet or gofmt checks. A plan may hold at most 16 checks in total, counting the 5 Formula baseline checks, so prefer one combined targeted command over one check per package.

• Keep base tests compiling: the protected view runs the base _test.go files against your code. Never change the signature of an existing function, method or type that a base test file calls. Add a new function or field instead. A protected build failure can't be declared as an expected delta.
• Keep base tests runnable: changed defaults or behaviour must not make a base test hang or panic. A package that aborts in the protected view hides every test after it, and nothing can be declared. Keep the old default when unconfigured and opt in to the new one.
• Plan checks: the operator's visual or browser check is a manual step after delivery, never a plan check. Every check leaves reviewedAcceptance and independentProvenance empty.
• Plan structure: new files need a parent component (in this repo, under lab/; a new root-level file blocks intake). A check's definitions must never include a file the change edits. A file the check only reads as data under test is not a definition.
• Scope lists files, not directories: list every new file path, including each golden fixture under testdata/. A directory entry doesn't cover the files inside it, and the scope audit blocks them.