stella plugin — Scanner Plugin Manifests CLI Reference

Audience: operators and plugin authors who need to inspect or verify Scanner language-analyzer plug-in manifests before deployment, including in air-gapped environments.

The root plugin command group provides offline, deterministic inspection of Scanner language-analyzer manifests. It drives the Scanner ScannerPluginLoader directly to list and verify manifests; it never fetches external resources and never activates (executes) plug-in assemblies, so it is safe to run against untrusted directories.

Source: src/Cli/StellaOps.Cli/Commands/CommandHandlers.ScannerPlugins.cs.

Commands

stella plugin list <dir>

Lists manifests that the loader accepts from <dir>.

stella plugin list plugins/scanner/analyzers \
  --trust-store src/__Tests/__Datasets/trust-store/scanner-plugins/dev

Text output is sorted by plug-in id and includes:

id | version | capabilities | payloadSha256
stellaops.scanner.plugin.elixir | 0.1.0 | elixir,erlang,hex,language-analyzer,otp | <sha256>

The capabilities column lists the manifest’s full capabilities array sorted in ordinal order (the language-analyzer marker capability is included).

Options:

• --trust-store <dir>: directory of trusted Scanner plug-in public keys. When omitted, no keys are trusted: signed manifests are rejected and only --allow-unsigned fixtures can load.
• --allow-unsigned: allow unsigned manifests for local development fixtures. Defaults to false (fail-secure).
• --pattern <glob>: manifest file glob in the supplied directory or each immediate subdirectory. Defaults to manifest.json.
• --format text|json: output format. Defaults to text.

The command exits 0 only when at least one manifest loads and no manifest is rejected.

With --format json the command emits a deterministic object:

{
  "success": true,
  "count": 1,
  "rejectedCount": 0,
  "plugins": [
    { "id": "stellaops.scanner.plugin.elixir", "version": "0.1.0",
      "capabilities": ["elixir", "erlang", "hex", "language-analyzer", "otp"],
      "payloadSha256": "<sha256>" }
  ],
  "rejected": []
}

Each rejected entry carries id, reasonCode, and reason.

stella plugin verify <dir>

Dry-runs manifest verification for every discovered manifest and prints the signature status for each manifest.

stella plugin verify plugins/scanner/analyzers \
  --trust-store src/__Tests/__Datasets/trust-store/scanner-plugins/dev \
  --strict

Text output is sorted by plug-in id and includes:

id | version | signatureStatus | payloadSha256 | reason
stellaops.scanner.plugin.elixir | 0.1.0 | verified | <sha256> | -

Options:

• --trust-store <dir>: directory of trusted Scanner plug-in public keys (same semantics as list; omitting it trusts no keys).
• --strict: treat unsigned manifests as verification failures. Defaults to false for stella plugin verify (an unsigned manifest reports unsigned, not failed).
• --pattern <glob>: manifest file glob. Defaults to manifest.json.
• --format text|json: output format. Defaults to text.

Signature status values:

• verified: the manifest signature verified against a trusted key.
• unsigned: the manifest has no signature block.
• failed: the manifest was rejected for a non-unsigned verification or schema reason.

verify exits non-zero when any manifest is rejected (or when no manifest loads). With --strict, unsigned manifests are rejected and the reason column carries the stable loader reason code prefixed to the message, for example signature.missing: .... Other stable loader codes surface the same way (for example signature.payload_mismatch, signature.verify.failed, schema.validation.failed).

With --format json the command emits { success, count, plugins: [ { id, version, signatureStatus, payloadSha256, reason } ] }.

Directory Shape

The command accepts either:

• A directory containing one or more matching manifest files directly.
• A parent directory whose immediate child directories each contain a matching manifest file, such as plugins/scanner/analyzers/<language>/manifest.json.

Discovery and output ordering use ordinal string ordering. The command does not fetch external resources and does not run plug-in code.

Related commands

The root plugin group is the read-only directory-scanning subset. The stella scanner plugins command tree covers the same loader plus operator curation:

• stella scanner plugins list <plugin-dir> — directory listing (here --strict is replaced by --allow-unsigned, defaulting to fail-secure).
• stella scanner plugins verify --manifest <path> — verifies a single manifest file (note --manifest/-m, not a directory argument); --strict defaults to true here.
• stella scanner plugins derive-keyid --public-key <path> — prints the conventional key id for an Ed25519 public-key file (default prefix stella-scanner-plugin-dev-).