Stallion Developer Toolkit

Stallion is a developer resource plugin for engineering Speedwave extensions. It automates boilerplate scaffolding, schema validation, semantic versioning, changelog generation, and GitLab CI/CD release signing pipelines.

Architectural model

Stallion is a resource-only extension (capabilities: ["skills", "commands", "hooks"]). It does not run a containerized worker or allocate network ports, providing development assets and automation scripts directly to active Claude sessions:

• Shared engineering instructions: Bundles core developer guidelines via claude-resources/CLAUDE.md.
• CLI scaffolding commands: Terminal commands to bootstrap and version plugin repositories.
• CI/CD template repository: Shared GitLab CI configuration (.build-plugin.yml) compiling, cryptographically signing (Ed25519), and publishing release packages.

Skills and commands reference

Command / Skill	Scope	Description
create-plugin (Skill)	Interactive scaffolding	Guides plugin architecture, selecting between MCP worker containers or resource-only bundles.
add-oauth (Skill)	OAuth2 wiring	Implements host-mediated OAuth2 token refresh workflows and manifest definitions.
/stallion:new-plugin	Scaffolding	Bootstraps a new plugin workspace matching project conventions.
/stallion:bump	Versioning	Synchronizes semantic versions across manifest.json, package.json, and lockfiles.
/stallion:changelog	Release automation	Formulates categorized changelogs split into user-facing and internal changes.

Plugin scaffolding mechanics

Executing /stallion:new-plugin <slug> "<Name>" generates an extension directory adhering to Speedwave manifest specifications:

• Enforces slug regex ^[a-z][a-z0-9-]{0,63}$.
• Blocks reserved core identifiers (slack, sharepoint, redmine, gitlab, github, atlassian, office, playwright, context7, os, oauth, ide, host_exec).
• Sets default network ports (4010+) and standard container memory quotas (256 MiB).

Release signing pipeline

The automated CI/CD pipeline executes on the primary branch across three stages:

1. Build: Compiles TypeScript sources, bundles dependencies, and packages archive layers.
2. Sign: Computes the Speedwave deterministic SHA-256 package digest (paths sorted lexicographically with length framing) and applies Ed25519 cryptographic signatures using Speednet protected CI variables. Symlinks are strictly prohibited.
3. Publish: Deploys verified ZIP packages to the GitLab Package Registry.

Getting started

1. Export your GitLab deploy token to NPM_TOKEN to pull @speedwave/* development packages from the registry.
2. Install Stallion into your extension development workspace.
3. Scaffold a new extension with /stallion:new-plugin <slug> "<Display Name>".

Installed plugins $ install plugin my my-project

plugintypesignedon

figmamcp✓ ed25519

glpimcp✓ ed25519

Security boundaries

Stallion execution occurs locally within the developer environment. Signing keys reside strictly inside protected CI/CD pipeline runners and are never accessible to individual developers or runtime environments. Refer to Plugin mechanism internals for cryptographic verification specifications.