@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/plugins/marketplaceManager.d.ts

@@ -5,9 +5,15 @@
  * at the MVP subset (github + git sources only, no auto-update,
  * no policy blocking, no GCS mirror).
  */
-import type { MarketplaceSource, PluginMarketplace } from "./types.js";
+import type { MarketplaceFormat, MarketplaceSource, PluginMarketplace } from "./types.js";
+export type { MarketplaceFormat } from "./types.js";
 export declare function marketplacesRoot(): string;
 export declare function marketplaceDir(name: string): string;
+/**
+ * Classify a cloned marketplace by which manifest files it ships:
+ * both → universal, only .agents/plugins → codex, otherwise claude-code.
+ */
+export declare function detectMarketplaceFormat(dir: string): MarketplaceFormat;
 export type AddMarketplaceResult = {
     ok: true;
     name: string;
@@ -23,6 +29,13 @@ export type AddMarketplaceResult = {
  * an entry into known_marketplaces.json.
  */
 export declare function addMarketplace(name: string, source: MarketplaceSource): Promise<AddMarketplaceResult>;
+/**
+ * Refreshes a known marketplace: re-pulls its source so the cached
+ * marketplace.json reflects upstream (new plugins, version bumps). Reuses
+ * addMarketplace's same-source path (git fetch + reset). Returns an error if
+ * the marketplace isn't known.
+ */
+export declare function refreshMarketplace(name: string): Promise<AddMarketplaceResult>;
 /**
  * Removes a marketplace: deletes the cached clone and the manifest entry.
  * Returns whether anything was actually removed.
@@ -40,6 +53,7 @@ export interface ListedMarketplace {
     installLocation: string;
     lastUpdated: string;
     pluginCount: number;
+    format: MarketplaceFormat;
 }
 /**
  * Lists all known marketplaces with a quick plugin count read from each

package/dist/plugins/marketplaceManager.js

@@ -11,6 +11,7 @@ import { homedir } from "node:os";
 import { gitClone, gitFetchAndReset, githubRepoToCloneUrl } from "./gitOps.js";
 import { readKnownMarketplaces, upsertKnownMarketplace, removeKnownMarketplace, } from "./knownMarketplaces.js";
 import { validateMarketplace } from "./schemas.js";
+import { assertSafePluginName } from "./installer/paths.js";
 function userHome() {
     return process.env.HOME ?? homedir();
 }
@@ -18,10 +19,46 @@ export function marketplacesRoot() {
     return join(userHome(), ".code-shell", "plugins", "marketplaces");
 }
 export function marketplaceDir(name) {
+    // Single choke point for add/remove/refresh (all derive `dir` from here and
+    // then gitClone / rmSync it). Validate `name` as one safe path segment so a
+    // `..` / separator / NUL can't escape marketplacesRoot. Normal derived names
+    // (lowercase repo tails) are unaffected; reuses the plugin segment guard.
+    assertSafePluginName(name);
     return join(marketplacesRoot(), name);
 }
+const CC_MANIFEST_REL = [".claude-plugin", "marketplace.json"];
+const CODEX_MANIFEST_REL = [".agents", "plugins", "marketplace.json"];
+/**
+ * Resolve the marketplace manifest inside a cloned repo. Claude Code's format
+ * lives at .claude-plugin/marketplace.json; the Codex / agents format lives at
+ * .agents/plugins/marketplace.json. Prefer the CC manifest when present (it is
+ * our canonical shape), else fall back to the Codex one. Returns null when
+ * neither exists.
+ */
+function resolveManifestPath(dir) {
+    const cc = join(dir, ...CC_MANIFEST_REL);
+    if (existsSync(cc))
+        return cc;
+    const codex = join(dir, ...CODEX_MANIFEST_REL);
+    if (existsSync(codex))
+        return codex;
+    return null;
+}
 function marketplaceJsonPath(name) {
-    return join(marketplaceDir(name), ".claude-plugin", "marketplace.json");
+    return resolveManifestPath(marketplaceDir(name));
+}
+/**
+ * Classify a cloned marketplace by which manifest files it ships:
+ * both → universal, only .agents/plugins → codex, otherwise claude-code.
+ */
+export function detectMarketplaceFormat(dir) {
+    const hasCc = existsSync(join(dir, ...CC_MANIFEST_REL));
+    const hasCodex = existsSync(join(dir, ...CODEX_MANIFEST_REL));
+    if (hasCc && hasCodex)
+        return "universal";
+    if (hasCodex)
+        return "codex";
+    return "claude-code";
 }
 function sourceToCloneUrl(source) {
     return source.source === "github" ? githubRepoToCloneUrl(source.repo) : source.url;
@@ -55,11 +92,11 @@ export async function addMarketplace(name, source) {
         }
     }
     const manifestPath = marketplaceJsonPath(name);
-    if (!existsSync(manifestPath)) {
+    if (!manifestPath) {
         rmSync(dir, { recursive: true, force: true });
         return {
             ok: false,
-            error: `Marketplace ${name}: .claude-plugin/marketplace.json not found in the cloned repository.`,
+            error: `Marketplace ${name}: no marketplace.json found (looked in .claude-plugin/ and .agents/plugins/).`,
         };
     }
     let raw;
@@ -82,10 +119,25 @@ export async function addMarketplace(name, source) {
         source,
         installLocation: dir,
         lastUpdated: new Date().toISOString(),
+        format: detectMarketplaceFormat(dir),
     };
     upsertKnownMarketplace(name, entry);
     return { ok: true, name, marketplace: v.value, replaced: Boolean(existing) };
 }
+/**
+ * Refreshes a known marketplace: re-pulls its source so the cached
+ * marketplace.json reflects upstream (new plugins, version bumps). Reuses
+ * addMarketplace's same-source path (git fetch + reset). Returns an error if
+ * the marketplace isn't known.
+ */
+export async function refreshMarketplace(name) {
+    const known = readKnownMarketplaces();
+    const entry = known[name];
+    if (!entry) {
+        return { ok: false, error: `Unknown marketplace: ${name}` };
+    }
+    return addMarketplace(name, entry.source);
+}
 /**
  * Removes a marketplace: deletes the cached clone and the manifest entry.
  * Returns whether anything was actually removed.
@@ -108,7 +160,7 @@ export function loadMarketplace(name) {
     if (!known[name])
         return null;
     const manifestPath = marketplaceJsonPath(name);
-    if (!existsSync(manifestPath))
+    if (!manifestPath)
         return null;
     let raw;
     try {
@@ -136,6 +188,8 @@ export function listMarketplaces() {
             installLocation: entry.installLocation,
             lastUpdated: entry.lastUpdated,
             pluginCount: mp ? mp.plugins.length : -1,
+            // Re-detect from disk when the stored entry predates the format field.
+            format: entry.format ?? detectMarketplaceFormat(entry.installLocation),
         });
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));

package/dist/plugins/pluginCommandHook.js

@@ -31,6 +31,8 @@
  * branch — not the CC one.
  */
 import { spawn } from "node:child_process";
+import { MAX_HOOK_OUTPUT_BYTES } from "../hooks/hook-output.js";
+import { killChildTree } from "../runtime/spawn-common.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
 /**
  * Extract the user-facing context string from a CC plugin's stdout JSON.
@@ -99,6 +101,13 @@ export async function runPluginCommandHook(spec, ctx) {
         let stdout = "";
         let stderr = "";
         let settled = false;
+        // Output byte caps mirror src/hooks/shell-runner.ts so a chatty plugin
+        // hook can't hold engine memory hostage. Past the cap we SIGTERM the
+        // child and treat the hook as failed; stderr cap truncates with a
+        // marker instead of failing the hook.
+        let stdoutBytes = 0;
+        let stdoutCapped = false;
+        let stderrCapped = false;
         const settle = (value) => {
             if (settled)
                 return;
@@ -108,26 +117,31 @@ export async function runPluginCommandHook(spec, ctx) {
         const timer = setTimeout(() => {
             // eslint-disable-next-line no-console
             console.warn(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} timed out after ${timeoutMs}ms`);
-            try {
-                child.kill("SIGTERM");
-                setTimeout(() => {
-                    try {
-                        child.kill("SIGKILL");
-                    }
-                    catch {
-                        /* already exited */
-                    }
-                }, 1000);
-            }
-            catch {
-                /* already exited */
-            }
+            // win32: taskkill /T reaps the tree; POSIX: SIGTERM → grace → SIGKILL.
+            killChildTree(child, 1000);
             settle({});
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
+            stdoutBytes += chunk.length;
+            if (stdoutBytes > MAX_HOOK_OUTPUT_BYTES) {
+                if (!stdoutCapped) {
+                    stdoutCapped = true;
+                    // eslint-disable-next-line no-console
+                    console.warn(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} stdout exceeded ${MAX_HOOK_OUTPUT_BYTES} bytes — killing`);
+                    killChildTree(child, 1000);
+                }
+                return;
+            }
             stdout += chunk.toString("utf8");
         });
         child.stderr?.on("data", (chunk) => {
+            if (stderr.length + chunk.length > MAX_HOOK_OUTPUT_BYTES) {
+                if (!stderrCapped) {
+                    stderrCapped = true;
+                    stderr += "\n…[stderr truncated]";
+                }
+                return;
+            }
             stderr += chunk.toString("utf8");
         });
         child.on("error", (err) => {
@@ -138,6 +152,12 @@ export async function runPluginCommandHook(spec, ctx) {
         });
         child.on("close", (code) => {
             clearTimeout(timer);
+            if (stdoutCapped) {
+                // eslint-disable-next-line no-console
+                console.error(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} killed due to oversized stdout (> ${MAX_HOOK_OUTPUT_BYTES} bytes)`);
+                settle({});
+                return;
+            }
             if (code !== 0) {
                 // eslint-disable-next-line no-console
                 console.warn(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} exited ${code}; stderr:`, stderr.slice(0, 500));

package/dist/plugins/pluginContent.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Plugin content inventory (插件详情页) — enumerate everything one installed
+ * plugin contributes: skills, commands, agents, hooks, MCP servers. The
+ * plugins list only showed "N skills", so users couldn't see what a plugin
+ * actually installs (feedback#15). Read-only; reuses the same parsers the
+ * loaders use so the inventory can't drift from what actually loads.
+ */
+import { type PluginHookEntry } from "./loadPluginHooks.js";
+export interface PluginContentInventory {
+    /** skills/<name>/SKILL.md — name + frontmatter description when present. */
+    skills: {
+        name: string;
+        description?: string;
+    }[];
+    /** commands/<name>.md */
+    commands: string[];
+    /** agents/<name>.md */
+    agents: string[];
+    /** hooks/hooks.json entries (event + command), owner-filtered. */
+    hooks: PluginHookEntry[];
+    /** MCP server names as merged (keyed `<plugin>:<server>` — bare name here). */
+    mcpServers: string[];
+}
+/**
+ * Inventory one plugin's contributions. `pluginName` is the bare name (no
+ * @marketplace); `installPath` its install dir. Hooks/MCP go through the same
+ * scanners the runtime loaders use (filtered to this plugin) so naming —
+ * e.g. MCP's `<plugin>:<server>` record keys — matches what users see live.
+ */
+export declare function describePluginContent(pluginName: string, installPath: string): PluginContentInventory;

package/dist/plugins/pluginContent.js

@@ -0,0 +1,83 @@
+/**
+ * Plugin content inventory (插件详情页) — enumerate everything one installed
+ * plugin contributes: skills, commands, agents, hooks, MCP servers. The
+ * plugins list only showed "N skills", so users couldn't see what a plugin
+ * actually installs (feedback#15). Read-only; reuses the same parsers the
+ * loaders use so the inventory can't drift from what actually loads.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { parseFrontmatter } from "../skills/frontmatter.js";
+import { listPluginHooks } from "./loadPluginHooks.js";
+import { mergePluginMcpServers } from "./installer/loadPluginMcp.js";
+function listMdNames(dir) {
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir)
+            .filter((f) => f.endsWith(".md"))
+            .map((f) => f.replace(/\.md$/, ""))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+function listSkills(installPath) {
+    const dir = join(installPath, "skills");
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    try {
+        for (const entry of readdirSync(dir).sort()) {
+            const skillMd = join(dir, entry, "SKILL.md");
+            try {
+                if (!statSync(join(dir, entry)).isDirectory() || !existsSync(skillMd))
+                    continue;
+                const { frontmatter } = parseFrontmatter(readFileSync(skillMd, "utf-8"));
+                const desc = typeof frontmatter.description === "string" ? frontmatter.description : undefined;
+                out.push({ name: entry, description: desc });
+            }
+            catch {
+                // unreadable skill dir — skip, same as the loader would
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    return out;
+}
+/**
+ * Inventory one plugin's contributions. `pluginName` is the bare name (no
+ * @marketplace); `installPath` its install dir. Hooks/MCP go through the same
+ * scanners the runtime loaders use (filtered to this plugin) so naming —
+ * e.g. MCP's `<plugin>:<server>` record keys — matches what users see live.
+ */
+export function describePluginContent(pluginName, installPath) {
+    const mcpPrefix = `${pluginName}:`;
+    let mcpServers = [];
+    try {
+        mcpServers = Object.keys(mergePluginMcpServers({}))
+            .filter((k) => k.startsWith(mcpPrefix))
+            .map((k) => k.slice(mcpPrefix.length))
+            .sort();
+    }
+    catch {
+        mcpServers = [];
+    }
+    let hooks = [];
+    try {
+        hooks = listPluginHooks().filter((h) => h.plugin === pluginName);
+    }
+    catch {
+        hooks = [];
+    }
+    return {
+        skills: listSkills(installPath),
+        commands: listMdNames(join(installPath, "commands")),
+        agents: listMdNames(join(installPath, "agents")),
+        hooks,
+        mcpServers,
+    };
+}

package/dist/plugins/pluginInstaller.d.ts

@@ -5,6 +5,30 @@
  * sparse-checkout, no npm/pip.
  */
 import type { PluginInstallEntry } from "./types.js";
+/**
+ * Compose the on-disk cache directory for a plugin version. Every path segment
+ * (marketplace / plugin / version) can originate from an attacker-controlled
+ * marketplace manifest, so each must be validated as a single safe path
+ * segment before it enters `join`. Without this a manifest entry named `..`
+ * (or containing a separator) would let the materialized plugin tree be
+ * written outside the plugin cache root — a supply-chain path traversal.
+ *
+ * Reuses `assertSafePluginName` (rejects empty / "." / ".." / separators /
+ * NUL). Exported so the segment-validation contract can be unit-tested
+ * directly.
+ */
+export declare function pluginCacheDir(marketplace: string, plugin: string, version: string): string;
+/**
+ * Resolve a candidate `installPath` to a realpath and verify it lives strictly
+ * underneath the plugin cache root. Returns the resolved path on success, or
+ * null when the path is missing, escapes the cache, equals the cache root
+ * itself, or is otherwise unsafe to remove.
+ *
+ * Exported so tests can exercise the safety predicate directly without
+ * arranging a full uninstall — the contract this defends (no rmSync outside
+ * the plugin cache) is the entire point of T2 / Workstream A2.
+ */
+export declare function resolveSafePluginPath(installPath: string, cacheRoot: string): string | null;
 export interface VarRewriteReport {
     filesScanned: number;
     filesRewritten: number;
@@ -18,6 +42,16 @@ export type InstallResult = {
     ok: false;
     error: string;
 };
+/**
+ * Compare a marketplace-declared SHA against the cloned HEAD. The
+ * declaration is allowed to be a short prefix (>= 7 chars, standard git
+ * abbreviation length); for stricter integrity guarantees marketplaces
+ * should pin the full 40-char hash. Case-insensitive.
+ *
+ * Exported so a unit test can pin the policy without spinning up a real
+ * clone.
+ */
+export declare function shaMatches(declared: string, actual: string): boolean;
 /**
  * Install a plugin from a previously-added marketplace into the user
  * cache. Idempotent within a process: re-installing replaces the