Install
$ agentstack add skill-archcore-ai-plugin-init Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Pipes remote content directly into a shell (remote code execution).
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
/archcore:init
First-time onboarding. Detects repo scale (small / medium / large) and shape, composes a scale-appropriate seed of .archcore/ documents, shows them in one preview, and creates them on a single confirm — so the code-alignment hook injection and per-command grounding have substance and the relation graph is live from day one. The same confirm also installs host wiring (project MCP config, SessionStart hook, usage hint — the same files archcore init writes), so the repo works for CLI-only teammates. Per magic-first-day-init.adr: extractive facts are composed in full; the top hotspot modules get real specs (synthesized only after confirm); the overview is an index, never a prose blob. Nothing is written before confirm. Exact per-mode output is in the Routing Table below.
Arguments
--depth=light|standard|deep— synthesis budget (defaultstandard), orthogonal to--mode. See the Depth axis section below. Also settable via thedepth:toggle in the preview.--mode=small|medium|large— force a mode, overriding auto-detection.--domain=— re-run focused on one domain (large repos): scopes data-model + hotspot specs to that domain's tree, tops up only its docs. Bypasses the "already seeded" early-exit.--refresh— re-run on an already-seeded repo to add facts that appeared since the first init (a new schema, config, or modules) — and to retrofit host wiring on repos seeded before wiring existed. Bypasses the early-exit; existing docs are skipped, missing ones composed.
When to use
- Empty
.archcore/— the SessionStart nudge points here. - First session on a fresh clone / fresh install.
- User says: "initialize archcore", "set up archcore", "seed archcore", "first-time setup", "what should I do first".
Not init (route elsewhere):
- Recording a specific decision →
/archcore:document. - Planning a feature →
/archcore:plan. - Documenting one module →
/archcore:document. - Codifying a team standard →
/archcore:document(offers rule + guide continuation). - Reading applicable context before coding → automatic; the code-alignment hook injects it on file edits.
- Docs health audit →
/archcore:review.
Routing table
Mode routing — Step 0.5 classifier, evaluated top-to-bottom, first match wins. The empty route is decided earlier in Step 0(b). Precise conditions in _shared/grounding/detect-scale.md.
| Signal | Route | Seeded (composed when detected) | |---|---|---| | No manifest AND no top-level source (Step 0b) | → empty | no content docs — host wiring only, behind its own mini-confirm | | --mode=X flag | → forced X (detected mode still reported) | per row below | | domain_count ≤ 1 AND module_count ≤ 15 | → small | stack rule, run guide, data-model, integrations, config, entry points, public surface, overview + hotspot specs (light 3 / standard 4 / deep 6 — see Depth axis) | | domain_count ≤ 2 AND module_count ≤ 40 | → medium | small set + cross-cutting rules (every depth — light ≤2 / standard ≤3 / deep ≤4) + hotspot specs (light 4 / standard 6 / deep 10 — see Depth axis) | | domain_count ≥ 3 OR module_count > 40 | → large | medium set + top-level map + domain dialog + data-model per schema-bearing domain (all, not only selected) + hotspot specs (per-domain floor + repo-wide rank — light 2/domain min6 cap12 / standard 3/domain min10 cap24 / deep 4/domain min14 cap40 — see Depth axis) |
Every non-empty mode also composes the architecture-overview capstone, plans relation wiring, and offers agent-file import — aggregate files (CLAUDE.md / AGENTS.md / .cursorrules) as link stubs and modular rule files (.cursor/rules/*.mdc, .github/instructions/*.md, .windsurf/rules/*.md) as rule docs by default, per lib/agent-files.md — inside the preview. Tier-1 facts (data-model, integrations, config, entry points, public surface) are seeded in any mode when detected — breadth scales with the repo, presence does not. The public-surface fact is what carries the seed for library / SPA / multi-command-CLI / agent-plugin repos, where there is no server to enumerate as entry points. The empty route exits after Step 0.
Follow-up routing — closing-message hand-offs. Init surfaces these as todos; MUST NOT auto-invoke.
| User wants to... | → Invoke | |---|---| | Capture another module | /archcore:document | | Record a decision | /archcore:document | | Codify a convention as a rule | /archcore:document | | Plan a feature | /archcore:plan | | Drill into another domain (large) | /archcore:init --domain= | | Add facts that appeared since first init | /archcore:init --refresh | | Scope queries to a domain (large) | mcp__archcore__search_documents with the domain tag | | See what's loaded | /archcore:review |
Depth axis (--depth=light|standard|deep)
Orthogonal to scale (--mode, which measures repo size). Depth sets the synthesis budget, not the artifact checklist. Extraction is always on in every depth — Tier-1 facts, imported authored rules, and the hotspot register are cheap and the highest-value / most-durable layer. Depth scales only the expensive, staleness-prone synthesis: spec bodies, cross-cutting rules, and big-file / aggregate extraction. Default: standard — a good first-day seed, not merely the cheapest one. Init is fully gated (nothing is written before confirm, and the preview shows all three depths' costs side by side before the user commits to any of them), so there is no reason to default to the thin tier just to be safe — light is the explicit opt-down for a cost-conscious user (still never empty — Universality invariant 3); deep is the explicit opt-up for a max plan.
| Depth | Hotspot specs | Cross-cutting synth (medium/large) | Big authored (>200) & CLAUDE.md/AGENTS.md | Authored decisions → ADR | Relations | |---|---|---|---|---|---| | light (opt-down) | small 3 / medium 4 / large 2-per-domain (min 6, cap 12) | ≤ 2 candidates — MAY narrow scan toward guard + shared-indirection primitives for cost, but MUST still surface any high-confidence hit | link | — | basic | | standard (default) | small 4 / medium 6 / large 3-per-domain (min 10, cap 24) | ≤ 3 candidates | link | — | basic | | deep (opt-up) | small 6 / medium 10 / large 4-per-domain (min 14, cap 40) | ≤ 4 candidates | extract + split | extract from files (Route 2), never invent from code | enriched (spec↔rule, spec↔spec) |
Large's per-domain numbers apply to the day-one dialog (Step A.0); a later --domain= re-run uses its own flat row (light 3 / standard 5 / deep 8 — detect-hotspots.md "Top-N by mode"). Cross-cutting synthesis is on at every depth — it is the highest value-per-token artifact init seeds; only its cap and (at light) its scan-cost priority change with depth, never whether it runs. A very large or hot hotspot (LOC > 3000 OR top-quartile churn) may compose as a flagship at any depth — raised body cap (≤ 120 vs. the default ≤ 80 lines) or decomposition into ≤ 3 sub-specs by separable sub-surface, never both (detect-hotspots.md "Flagship specs").
Cost scales with depth AND with the repo — the preview shows the computed total per depth, never a constant; on large mode it also scales with how many domains are selected in Step A.0. Treat any fixed multiplier as illustrative only.
Universality invariants — hold in EVERY depth and for ANY codebase
- Ceiling, not quota. A depth raises the budget cap; it NEVER fabricates to hit a number. If the ranked hotspot pool has 5 modules,
deepproduces 5 specs, not its 6/10/40 ceiling; on a sparse repodeep≈light. Same for cross-cutting: if only 1 candidate clears the "surface nothing over a false rule" bar, that is the output at any depth, not the depth's cap. "Prefer omission over a guess" holds in every depth. - "When detected", never "always." No depth has a fixed artifact checklist. data-model / integrations / config / entry-points / imports / cross-cutting appear only on positive evidence, identically across depths — a depth is defined by synthesis budget, not by mandatory docs.
lightis never empty. Its floor rests on the universal spine — stack rule + run guide + public-surface (a library's exports, a CLI's commands, a plugin's skills, a SPA's routes) + register + top-N specs via the test-independent fallback ranking. At least one fires for any base (library, SPA, ML, CLI, embedded, data/IaC, agent-plugin/markdown, polyglot, monorepo);lightnever degrades to nothing for lack of schema/tests/authored files.- Depth lives in Phase B (compose), not detection. No depth branch adds a stack-specific detection heuristic; detection stays high-level, evidence-first, non-exhaustive (guarded by the detect-catalog universality test).
deep's extra budget flows to whatever the repo affords. No authored files → nothing to extract, so the budget goes to specs/relations that DO have evidence.deepis "more of what this repo actually has," not a fixed feature list assuming a stack shape.
Selection: the --depth flag, or the depth: toggle in the preview (Phase C) — the user can flip depth after seeing the plan and its per-depth cost, then still edit individual items.
Execution
Content voice: default to architectural prose — decisions, rationale, intent. See skills/_shared/precision-rules.md Rule 6. Code blocks only where the document type requires it (rule, guide, cpat, and spec examples) or the user asks.
Pre-flight: CLI availability check
Before any init step, verify that the Archcore CLI is available on PATH. The canonical installer is documented at https://docs.archcore.ai/cli/install/ — use it as the single source of truth; do not suggest other channels (brew, go install, etc.) even if the user mentions them.
- Run:
archcore --version(via Bash tool) - If it succeeds → check the host-wiring version gate with the deterministic helper (never compare versions yourself — lexical comparison breaks on double-digit fields). Resolve
$din this same Bash call (each Bash invocation is a fresh shell — nothing persists from a later step), exactly as the Step -1 probe below does: rund="${CLAUDE_SKILL_DIR:-}"; "$d/../../bin/cli-gte" 0.7.0. It prints exactly one token:
yes→ proceed immediately to Step -1 (host wiring enabled).__NO_CLI__(unexpected here —--versionjust succeeded) → treat asno.no→ the seed still works, but the host-wiring step (see "Host wiring" below) needs a newer CLI. Ask the user once:
> Archcore CLI ` is older than v0.7.0 — host wiring (project MCP config, SessionStart hook, usage hint) will be skipped. Update now via archcore update`? (y/N)
- On
y→ runarchcore update(Bash), re-run thecli-gte 0.7.0check, and proceed to Step -1 (host wiring enabled onyes, disabled otherwise). - On
N/ silence → proceed to Step -1 with host wiring disabled: omit the Host wiring line from the preview, skip Phase E step 0 entirely (the cascade never runs — its manual-fallback leg is NOT a substitute for this note), and in the closing message note: *"Host wiring skipped (CLI --project ""in a terminal to make this repo self-contained for CLI-only teammates."* (/` come from the Step -1 probe, which runs regardless of the gate.)
- If it fails (command not found):
- Detect the platform via
uname -s(Bash).Darwin/Linux→ POSIX path. Anything else (Windows native) → instruct-only path. - POSIX path — ask the user once:
> Archcore CLI not found. The official installer runs: > > `` > curl -fsSL https://archcore.ai/install.sh | bash > `` > > Run it now? (y/N)
- On
y→ execute the command exactly as shown (Bash tool). After it returns, re-runarchcore --version. - Success → print: "Archcore CLI installed (``). Proceeding with init." → apply the same v0.7.0 comparison from item 2 (a fresh install is normally current, so host wiring is enabled) → go to Step -1.
- Still failing → print the install message below and stop.
- On
N/ silence / instruct-only path → print and stop:
> Archcore CLI required. Install it, then re-run /archcore:init: > > - macOS / Linux / WSL: curl -fsSL https://archcore.ai/install.sh | bash > - Windows (PowerShell 5.1+): irm https://archcore.ai/install.ps1 | iex > - Verify: archcore --version > - Full docs: https://docs.archcore.ai/cli/install/
Do not attempt brew install, go install, package-manager wrappers, or any other install command — they are not the supported path and will produce a CLI that is not version-compatible with the plugin.
Pre-flight: gating and lazy reading
Two disciplines bind the whole run:
- Gating (write boundary).
init_project()and the read-only MCP calls (list_documents,get_document) are infrastructure — they run before the preview. The gated operations arecreate_document,add_relation, and the host-wiring writes (install_host_config/archcore init --agent— they touch files outside.archcore/, like.mcp.jsonand.claude/settings.json): none fire before the user typesconfirm.canceltherefore leaves.archcore/content-empty and the repo's host configs untouched (the directory andsettings.jsonmay exist frominit_project, which is harmless and idempotent). - Lazy reading (two sub-phases). The detection/extraction catalogs at
_shared/grounding/*.mdand the composition files atlib/*.mdare heavy (≥ 1000 lines combined) — read them in two ordered batches, never all at once. The Detect sub-phase (Phase A) loads the detection catalogs and, for each detector it runs, captures into working memory both the signals AND the small## Outputcreate-fields + body template it will reuse later. The Compose sub-phase (Phase B) loads the composition contracts (_shared/precision-rules.md,_shared/spec-contract.md,_shared/rule-contract.md,lib/compose-overview.md,_shared/grounding/extract-routing.md) and reuses the Output fields/templates already captured during Detect — it does not re-read the bulky detection heuristics. "Release the detection catalogs" at the end of Phase A means dropping their heuristic prose from focus, not the captured Output specs.
Step -1: Initialize, detect host, and acknowledge (fast)
Call mcp__archcore__init_project() exactly once (pre-gate infrastructure — idempotent, safe on an already-initialized project). It creates .archcore/ and settings.json if missing.
Immediately after, give the user a one-line confirmation:
- Response includes
initialized: true(created now) — print: "Archcore initialized at.archcore/." already_initialized: true— print nothing here; the existing knowledge base speaks for itself in Step 0(a).
Host + project root for wiring — always run this probe, even when host wiring is disabled by the pre-flight version gate (it is one cheap Bash call, and the disabled-path closing message still needs `/`). One Bash call:
d="${CLAUDE_SKILL_DIR:-}"; host=$("$d/../../bin/detect-host"); root=$(git rev-parse --show-toplevel 2>/dev/null || pwd); printf '%s\n%s\n' "$host" "$root"
${CLAUDE_SKILL_DIR} is set by Claude Code only. On other hosts (Cursor, Codex CLI, GitHub Copilot CLI) substitute the absolute directory of this skill file — you know it from having read this file; bin/detect-host is two directories up from it (/bin/detect-host).
bin/detect-host resolves the current host from environment only (never cwd or stdin — Cursor guarantees neither) and prints exactly one token: claude-code | cursor | codex-cli | __UNKNOWN__. A GitHub Copilot CLI session always lands on __UNKNOWN__ — Copilot sets no environment marker in the shell command
…
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: archcore-ai
- Source: archcore-ai/plugin
- License: Apache-2.0
- Homepage: https://archcore.ai/plugin/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.