feat(workspace): add lifecycle hooks for runtime prerequisites

[christso]

Summary

• Add lifecycleHooks.preSync to workspace config, allowing declarative shell scripts to run before plugin sync
• Scripts run in workspace root with ALLAGENTS_WORKSPACE and ALLAGENTS_CONFIG_DIR env vars
• Required script failure aborts sync before filesystem mutation; optional scripts log warnings and continue
• Dry-run shows what would run without executing

Motivation

Closes all-9qx. Plugins like the Codex plugin stack require runtime prerequisites (agent-tui, bd) that AllAgents cannot sync as agent artifacts. This escape hatch lets workspaces declare idempotent install/update scripts.

Changes

• Schema: LifecycleScriptSchema and LifecycleHooksSchema in workspace-config.ts
• Runner: src/core/lifecycle-scripts.ts - execute scripts in order, capture output, handle failures
• Integration: syncWorkspace runs preSync hooks before plugin validation
• CLI: lifecycle results shown in sync output, JSON mode support
• Tests: 29 unit/integration tests (parsing, execution, dry-run, failure, ordering, env vars, full sync flow)
• Docs: configuration reference section + examples/workspaces/lifecycle-hooks/

E2E Steps

# Build
bun run build
# Create temp workspace with lifecycle hooks
E2E_DIR=$(mktemp -d)
mkdir -p "$E2E_DIR/.allagents"
cat >"$E2E_DIR/.allagents/workspace.yaml"<< 'YAML'version: 2repositories: []plugins: []clients: [claude]lifecycleHooks: preSync: - name: first-hook script: 'echo "first-ran" > .allagents/e2e-first.txt' - name: second-hook script: 'echo "second-ran" > .allagents/e2e-second.txt'YAML# Dry-run: shows scripts, does NOT executecd"$E2E_DIR"&& node /path/to/dist/index.js workspace sync --dry-run
# Expect: [dry-run] would run: first-hook / second-hook# Verify: no e2e-first.txt or e2e-second.txt created# Real sync: scripts run in ordercd"$E2E_DIR"&& node /path/to/dist/index.js workspace sync
# Expect: first-hook (✓), second-hook (✓)# Verify: cat .allagents/e2e-first.txt → "first-ran"# Verify: cat .allagents/e2e-second.txt → "second-ran"# Required failure: aborts sync
cat >"$E2E_DIR/.allagents/workspace.yaml"<< 'YAML'version: 2repositories: []plugins: []clients: [claude]lifecycleHooks: preSync: - name: failing-hook script: 'exit 42' - name: should-not-run script: 'echo "nope" > .allagents/e2e-not.txt'YAMLcd"$E2E_DIR"&& node /path/to/dist/index.js workspace sync
# Expect: failing-hook ✗ (exit 42), should-not-run NOT executed# Optional failure: continues
cat >"$E2E_DIR/.allagents/workspace.yaml"<< 'YAML'version: 2repositories: []plugins: []clients: [claude]lifecycleHooks: preSync: - name: optional-fail script: 'exit 1' optional: true - name: continues-after script: 'echo "continued" > .allagents/e2e-continued.txt'YAMLcd"$E2E_DIR"&& node /path/to/dist/index.js workspace sync
# Expect: optional-fail ✗ (warning), continues-after ✓# Verify: cat .allagents/e2e-continued.txt → "continued"
rm -rf "$E2E_DIR"

Notes

• bun run test:integration is unavailable (no tests/integration/ directory on this branch)
• Security model: scripts are arbitrary local commands; only the workspace owner can opt in; docs include a caution box
• Idempotent pattern: example workspace shows storing version markers under .allagents/

[cloudflare-workers-and-pages]

Deploying allagents with Cloudflare Pages

Latest commit:	98a83bb
Status:	✅ Deploy successful!
Preview URL:	https://cdd3d4ce.allagents.pages.dev
Branch Preview URL:	https://feat-workspace-lifecycle-scr.allagents.pages.dev

View logs

[christso]

Rebased onto current main and checked in the hardened implementation plan at .claude/plans/workspace-runtime-prerequisites.md. The plan preserves the general preSync escape hatch but adds content-addressed user-local trust, fail-closed non-TTY behavior, bounded/minimal execution, plugin source SHA verification, and a pinned checksum-verified Workmux installation path. Production implementation and independent security review remain in progress.