@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.6.0-rc.8";
+export const VERSION = "0.7.0";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────
@@ -11,7 +11,7 @@ export { Engine, loadAgentDefinitionsForCwd } from "./engine/engine.js";
 export { resolveLLMConfigForTag } from "./engine/resolve-llm-config.js";
 export { resolveAuxKey } from "./engine/aux-key.js";
 export { parseAgentDefinition, serializeAgentDefinition, } from "./agent/agent-definition.js";
-export { AgentDefinitionRegistry, } from "./agent/agent-definition-registry.js";
+export { AgentDefinitionRegistry } from "./agent/agent-definition-registry.js";
 export { EngineRuntime } from "./engine/runtime.js";
 export { ChatSessionManager } from "./protocol/chat-session-manager.js";
 // ─── LLM ─────────────────────────────────────────────────────────
@@ -24,7 +24,7 @@ export { modelEntriesFromConnections } from "./engine/model-connections-pool.js"
 // ─── Tools ───────────────────────────────────────────────────────
 export { ToolRegistry } from "./tool-system/registry.js";
 export { ToolExecutor } from "./tool-system/executor.js";
-export { PermissionClassifier, HeadlessApprovalBackend, AutoApprovalBackend } from "./tool-system/permission.js";
+export { PermissionClassifier, HeadlessApprovalBackend, AutoApprovalBackend, } from "./tool-system/permission.js";
 export { BUILTIN_TOOLS } from "./tool-system/builtin/index.js";
 export { makeUpdateAutomationMemoryTool } from "./tool-system/builtin/update-automation-memory.js";
 export { MCPManager, buildHttpHeaders, buildStdioEnv } from "./tool-system/mcp-manager.js";
@@ -34,16 +34,17 @@ export { wrapHookMessages } from "./hooks/inject.js";
 // ─── Protocol (client/server + transports) ──────────────────────
 export { AgentServer } from "./protocol/server.js";
 export { AgentClient } from "./protocol/client.js";
-export { createInProcessTransport, StdioTransport, } from "./protocol/transport.js";
-export { SocketTransport, listenTcp, } from "./protocol/tcp-transport.js";
+export { createInProcessTransport, StdioTransport } from "./protocol/transport.js";
+export { SocketTransport, listenTcp } from "./protocol/tcp-transport.js";
 // Recommended public factories — see protocol/factories.ts for the
 // stable construction contract referenced by standard §7.
 export { createServer, createClient, } from "./protocol/factories.js";
-export { Methods, ErrorCodes, } from "./protocol/types.js";
+export { Methods, ErrorCodes } from "./protocol/types.js";
 // ─── Session ─────────────────────────────────────────────────────
 export { Transcript } from "./session/transcript.js";
 export { SessionManager } from "./session/session-manager.js";
 export { FileHistory } from "./session/file-history.js";
+export { createWorktree, currentBranch, DEFAULT_WORKTREE_BRANCH_PREFIX, getWorktreeDiff, isManagedWorktreeBranch, isValidWorktreeBranchPrefix, findMainWorktreeRoot, listWorktrees, listWorktreesFast, normalizeWorktreeBranchPrefix, removeWorktree, validateWorktreeSlug, worktreeHasUncommittedOrAheadChanges, worktreeHasUncommittedChanges, } from "./git/worktree.js";
 export { latestUndoTarget, earliestSnapshotsPerFile, latestTurnUndoTargets, latestRedoTargets, } from "./session/undo-target.js";
 export { diffLines, renderDiffPreview } from "./session/simple-diff.js";
 export { MemoryManager } from "./session/memory.js";
@@ -54,7 +55,7 @@ export { SectionCache } from "./prompt/section-cache.js";
 export { scanInstructions, combineInstructions } from "./prompt/instruction-scanner.js";
 // ─── Presets ─────────────────────────────────────────────────────
 export { BUILTIN_AGENT_PRESETS, DEFAULT_AGENT_PRESET, DEFAULT_CLI_PRESET, resolveAgentPreset, resolveBuiltinToolNames, buildPresetSystemPrompt, registerPreset, listPresetNames, } from "./preset/index.js";
-export { loadSection, loadSections, availableSections, registerSection } from "./prompt/section-loader.js";
+export { loadSection, loadSections, availableSections, registerSection, } from "./prompt/section-loader.js";
 // ─── Context ─────────────────────────────────────────────────────
 export { ContextManager } from "./context/manager.js";
 export { estimateTokens, microcompact, windowCompact, truncateToolResult, buildSummarizationPrompt, applySummaryCompaction, COMPACTABLE_TOOL_NAMES, } from "./context/compaction.js";
@@ -71,7 +72,7 @@ export { installPluginFromSource } from "./plugins/installer/installFromSource.j
 export { installLocalPlugin, installPluginFromArchive, } from "./plugins/installer/installFromArchive.js";
 export { parseSource } from "./plugins/installer/parseSource.js";
 export { detectPluginFormat } from "./plugins/installer/detectFormat.js";
-export { CodexPluginManifest, CSMeta, PluginInstallError, } from "./plugins/installer/types.js";
+export { CodexPluginManifest, CSMeta, PluginInstallError } from "./plugins/installer/types.js";
 export { mergePluginMcpServers } from "./plugins/installer/loadPluginMcp.js";
 export { listPluginHooks, pluginHookKey } from "./plugins/loadPluginHooks.js";
 export { describePluginContent } from "./plugins/pluginContent.js";
@@ -85,14 +86,14 @@ export { checkPluginUpdate } from "./plugins/installer/checkUpdate.js";
 export { Arena } from "./arena/arena.js";
 export { MODEL_PRESETS, getMaxOutputTokens } from "./arena/model-presets.js";
 export { detectArenaMode } from "./arena/detect-mode.js";
-export { getStrategy, getStrategyForPlan, ReviewStrategy, DiscussionStrategy, PlanningStrategy } from "./arena/strategies/index.js";
+export { getStrategy, getStrategyForPlan, ReviewStrategy, DiscussionStrategy, PlanningStrategy, } from "./arena/strategies/index.js";
 export { planArena } from "./arena/planner.js";
 export { collectEvidence } from "./arena/providers/index.js";
 export { selectTools, hasTools } from "./arena/tools/selector.js";
 export { ArenaLedger } from "./arena/ledger.js";
 export { registerClaims, selectClaimsForReview } from "./arena/phases/claim-registry.js";
 export { buildDigest, formatDigest } from "./arena/digest-builder.js";
-export { transitionClaim, resolveClaimStatus, markUnderReview, applyReviewResult, markUnresolved, isTerminal, validTransitions } from "./arena/transitions.js";
+export { transitionClaim, resolveClaimStatus, markUnderReview, applyReviewResult, markUnresolved, isTerminal, validTransitions, } from "./arena/transitions.js";
 // ─── Arena: Iterate mode ────────────────────────────────────────
 // Multi-model authoring loop (tournament v1 → critique-revise rounds).
 // Use IterativeArena to produce a draft from scratch (code, PRD, design doc);
@@ -121,12 +122,12 @@ export { defineProduct, } from "./product/index.js";
 // ─── Logging ─────────────────────────────────────────────────────
 export { logger } from "./logging/logger.js";
 // ─── Settings ────────────────────────────────────────────────────
-export { SettingsManager } from "./settings/manager.js";
+export { SettingsManager, userHome } from "./settings/manager.js";
 export { migrateConfig, configVersionOf, CURRENT_CONFIG_VERSION, } from "./settings/migrate-config.js";
 export { SettingsSchema, validateSettings } from "./settings/schema.js";
 export { settingsJsonSchema, writeSettingsSchemaFile } from "./settings/schema-export.js";
 export { personalizationFrom } from "./settings/personalization.js";
-export { CredentialStore, formatNetscapeCookies, parseCookieJar, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
+export { CredentialStore, buildOAuthRefreshRequest, isOAuthAccessTokenExpired, oauthCredentialStatus, parseOAuthCredentialSecret, summarizeOAuthCredentialSecret, formatNetscapeCookies, parseCookieJar, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
 // ─── State (runtime singletons shared with TUI) ──────────────────
 /** @internal Shared with the in-repo TUI/desktop hosts; not stable SDK surface. */
 export { getSessionId, switchSession, getOriginalCwd, setOriginalCwd, getProjectRoot, setProjectRoot, getCwdState, getIsInteractive, updateLastInteractionTime, flushInteractionTime, markScrollActivity, } from "./state.js";
@@ -149,7 +150,7 @@ export { startCapturingEarlyInput, stopCapturingEarlyInput, consumeEarlyInput, h
 export { formatBytes, formatToolArgs, singleLine, MAX_LINE_WIDTH, TOOL_DOT_COLORS, } from "./utils/toolDisplay.js";
 export { classifyBashLines, } from "./tool-system/builtin/bash-output-style.js";
 export { formatDuration, formatTokens } from "./utils/format.js";
-export { getTheme, } from "./utils/theme.js";
+export { getTheme } from "./utils/theme.js";
 export { resolveThemeSetting } from "./utils/systemTheme.js";
 // ─── Logging (extended) ──────────────────────────────────────────
 /** @internal Host-lifecycle logging hooks for the in-repo TUI/desktop hosts; not stable SDK surface. */
@@ -174,7 +175,7 @@ export { buildReviewPrompt, parseDimensions, ALL_DIMENSIONS, } from "./review/re
  * primary Engine/Protocol API above.
  */
 export { getInteractiveApprovalBackend } from "./tool-system/permission.js";
-export { defaultSandboxConfig, } from "./tool-system/sandbox/index.js";
+export { defaultSandboxConfig } from "./tool-system/sandbox/index.js";
 export { buildNotificationMessage, buildNotificationSummary, notificationQueue, agentNotificationBus, notificationItemToStreamEvent, } from "./tool-system/builtin/agent-notifications.js";
 // Automation — zero-env-dependency scheduling module (startAutomation facade
 // + scheduler/store/runner). Hosts (Electron main, future CLI server) load
@@ -185,8 +186,9 @@ export * from "./cc-orchestrator/index.js";
 // Quota — remaining CC/Codex subscription usage (self-contained, plugin-liftable).
 export { checkQuota, formatQuota } from "./quota/index.js";
 export { resolveQuotaCredentials } from "./quota/credentials.js";
-export { asyncAgentRegistry, } from "./tool-system/builtin/agent-registry.js";
+export { asyncAgentRegistry } from "./tool-system/builtin/agent-registry.js";
 export { backgroundShellManager, BackgroundShellManager, } from "./runtime/background-shell.js";
+export { ENV_DENY_REGEX, ENV_ALLOWLIST } from "./runtime/spawn-common.js";
 export { getImageProvider, DEFAULT_IMAGE_MODEL, } from "./tool-system/builtin/image-providers.js";
 // ─── Speech-to-text (voice input / 听写) ────────────────────────
 export { transcribe, } from "./stt/transcribe.js";
@@ -200,21 +202,21 @@ export { createInProcessClient } from "./protocol/helpers.js";
 export { formatArenaResult, printArenaResult, renderProgress, createProgressRenderer, } from "./arena/render/terminal.js";
 export { formatArenaResultForSession } from "./arena/render/session.js";
 // ─── Plugins ─────────────────────────────────────────────────────
-export { installPlugin, uninstallPlugin, listInstalled, } from "./plugins/pluginInstaller.js";
+export { installPlugin, uninstallPlugin, listInstalled } from "./plugins/pluginInstaller.js";
 export { addMarketplace, refreshMarketplace, removeMarketplace, listMarketplaces, loadMarketplace, } from "./plugins/marketplaceManager.js";
-export { parseMarketplaceInput, deriveMarketplaceName, } from "./plugins/parseMarketplaceInput.js";
-export { scanPluginCommands, } from "./plugins/pluginCommandsLoader.js";
+export { parseMarketplaceInput, deriveMarketplaceName } from "./plugins/parseMarketplaceInput.js";
+export { scanPluginCommands } from "./plugins/pluginCommandsLoader.js";
 // ─── LLM (extended for TUI) ─────────────────────────────────────
 /** @internal Extended LLM surface for the in-repo TUI/desktop hosts; not stable SDK surface. */
-export { defaultCacheDir, } from "./llm/model-cache.js";
-export { fetchModelList, } from "./llm/model-fetcher.js";
-export { sanitizeApiKey, hasNonAsciiPrintable, } from "./llm/api-key-sanitize.js";
-export { PROVIDER_KINDS, } from "./llm/provider-kinds.js";
-export { capabilitiesFor, } from "./llm/capabilities/index.js";
+export { defaultCacheDir } from "./llm/model-cache.js";
+export { fetchModelList } from "./llm/model-fetcher.js";
+export { sanitizeApiKey, hasNonAsciiPrintable } from "./llm/api-key-sanitize.js";
+export { PROVIDER_KINDS } from "./llm/provider-kinds.js";
+export { capabilitiesFor } from "./llm/capabilities/index.js";
 export { reasoningControlFor, } from "./llm/capabilities/reasoning-control.js";
-export { REASONING_EFFORTS, } from "./llm/reasoning-setting.js";
+export { REASONING_EFFORTS } from "./llm/reasoning-setting.js";
 // ─── Data ────────────────────────────────────────────────────────
-export { syncOpenRouterCatalog, getOpenRouterSnapshot, } from "./data/openrouter-sync.js";
+export { syncOpenRouterCatalog, getOpenRouterSnapshot } from "./data/openrouter-sync.js";
 // ─── External agent config (Mobile Web Remote Rooms) ─────────────
 // Resolves the externalAgents settings block (notably claudeCode.trustedWorkspaces),
 // the source of truth for a Room's permission mode. The former /cc & /codex

package/dist/logging/logger.js

@@ -121,12 +121,12 @@ function resolveCategoryFilter() {
 //
 // Two mechanisms, layered:
 //
-// 1. `runWithSid(sid, fn)` — preferred. Engine.run wraps its entire body
-//    in this AsyncLocalStorage scope, so every log line emitted inside the
-//    (possibly deeply async) call tree picks up the right sid. Concurrent
-//    parent + child Engines coexist because each `await` boundary preserves
-//    the ALS context — they don't trample each other like a single module
-//    global would.
+// 1. `runWithSid(sid, fn)` — preferred. Once Engine.run has resolved the
+//    authoritative sid, its session-bound execution body runs in this
+//    AsyncLocalStorage scope, so every log line emitted inside the (possibly
+//    deeply async) call tree picks up the right sid. Concurrent parent + child
+//    Engines coexist because each `await` boundary preserves the ALS context —
+//    they don't trample each other like a single module global would.
 //
 // 2. `_currentSidFallback` — module-level mutable, written by `setCurrentSid`.
 //    Used only as a fallback when a code path runs outside any ALS scope

package/dist/logging/sanitize-messages.d.ts

@@ -21,17 +21,25 @@
  * pure-text turns pay essentially nothing on the fast path.
  */
 import type { Message } from "../types.js";
+export interface SanitizeMessagesOptions {
+    /**
+     * Tool-result IDs whose model-facing plaintext must be replaced before the
+     * request is written to any recorder/log sink. The original messages still
+     * go to the provider; this option is only for diagnostic copies.
+     */
+    sensitiveToolResultRedactions?: ReadonlyMap<string, string>;
+}
 /**
  * Walk a single message's content and replace image-payload blocks with
  * metadata stubs. Returns a new value — the input is not mutated.
  */
-export declare function sanitizeContent(content: Message["content"]): Message["content"];
+export declare function sanitizeContent(content: Message["content"], options?: SanitizeMessagesOptions): Message["content"];
 /**
  * Walk a {@link Message}[] array and sanitize every entry's content.
  * Returns the *same* array reference when no message held an image (fast
  * path for the overwhelmingly common pure-text case).
  */
-export declare function sanitizeMessages(messages: readonly Message[]): Message[];
+export declare function sanitizeMessages(messages: readonly Message[], options?: SanitizeMessagesOptions): Message[];
 /**
  * Recursively walk a value and return a *new* value with secret-looking
  * fields replaced by "[redacted]". Used by the logger (so anything ending up

package/dist/logging/sanitize-messages.js

@@ -75,19 +75,28 @@ function sanitizeImageUrlPart(part) {
         image_url: {
             // Keep the data-URL header so reviewers can see the MIME, but strip
             // the payload. "data:image/png;base64,<omitted, 12345 bytes>"
-            url: comma === -1
-                ? url
-                : `${url.slice(0, comma + 1)}<omitted, ${payloadLen} bytes>`,
+            url: comma === -1 ? url : `${url.slice(0, comma + 1)}<omitted, ${payloadLen} bytes>`,
             omitted: true,
             bytes: payloadLen,
         },
     };
 }
+function getSensitiveToolResultReplacement(block, options) {
+    const redactions = options?.sensitiveToolResultRedactions;
+    if (!redactions || redactions.size === 0)
+        return undefined;
+    if (!block || typeof block !== "object")
+        return undefined;
+    const b = block;
+    if (b.type !== "tool_result" || typeof b.tool_use_id !== "string")
+        return undefined;
+    return redactions.get(b.tool_use_id);
+}
 /**
  * Walk a single message's content and replace image-payload blocks with
  * metadata stubs. Returns a new value — the input is not mutated.
  */
-export function sanitizeContent(content) {
+export function sanitizeContent(content, options) {
     if (typeof content === "string")
         return content;
     if (!Array.isArray(content))
@@ -95,6 +104,12 @@ export function sanitizeContent(content) {
     let touched = false;
     const out = [];
     for (const block of content) {
+        const sensitiveReplacement = getSensitiveToolResultReplacement(block, options);
+        if (sensitiveReplacement !== undefined) {
+            out.push({ ...block, content: sensitiveReplacement });
+            touched = true;
+            continue;
+        }
         if (isImageBlock(block)) {
             out.push(sanitizeImageBlock(block));
             touched = true;
@@ -114,11 +129,11 @@ export function sanitizeContent(content) {
  * Returns the *same* array reference when no message held an image (fast
  * path for the overwhelmingly common pure-text case).
  */
-export function sanitizeMessages(messages) {
+export function sanitizeMessages(messages, options) {
     let touched = false;
     const out = [];
     for (const m of messages) {
-        const sanitized = sanitizeContent(m.content);
+        const sanitized = sanitizeContent(m.content, options);
         if (sanitized !== m.content) {
             touched = true;
             out.push({ ...m, content: sanitized });

package/dist/plugins/installer/checkUpdate.d.ts

@@ -5,6 +5,9 @@ export interface UpdateCheck {
     latestCommit?: string;
     reason?: string;
 }
+export interface CheckPluginUpdateOptions {
+    allowUnsafeTransport?: boolean;
+}
 /**
  * Check whether a remote (git-sourced) plugin has a newer commit upstream,
  * WITHOUT cloning. Compares the recorded install commit (meta.commit) against
@@ -13,4 +16,4 @@ export interface UpdateCheck {
  * an explanatory `reason` rather than throwing — the only hard error is an
  * unknown plugin name.
  */
-export declare function checkPluginUpdate(name: string): Promise<UpdateCheck>;
+export declare function checkPluginUpdate(name: string, options?: CheckPluginUpdateOptions): Promise<UpdateCheck>;

package/dist/plugins/installer/checkUpdate.js

@@ -11,12 +11,14 @@ import { CSMeta, PluginInstallError } from "./types.js";
  * an explanatory `reason` rather than throwing — the only hard error is an
  * unknown plugin name.
  */
-export async function checkPluginUpdate(name) {
+export async function checkPluginUpdate(name, options = {}) {
     const metaPath = pluginMetaPath(name);
     if (!existsSync(metaPath))
         throw new PluginInstallError(`no plugin named '${name}'`);
     const meta = CSMeta.parse(JSON.parse(readFileSync(metaPath, "utf-8")));
-    const parsed = parseSource(meta.source);
+    const parsed = parseSource(meta.source, {
+        allowUnsafeTransport: options.allowUnsafeTransport === true,
+    });
     if (parsed.kind !== "remote") {
         return { name, updateAvailable: false, reason: "not a remote source" };
     }

package/dist/plugins/installer/install.js

@@ -9,6 +9,7 @@ import { resolveCodexMcpServers } from "./codex/convertMcp.js";
 import { copyCodexSkills } from "./codex/convertSkills.js";
 import { copyCodexCommands } from "./codex/convertCommands.js";
 import { appendInstallEntry, pluginInstallKey } from "../installedPlugins.js";
+import { rewritePluginVars } from "../varRewrite.js";
 /**
  * Install a local plugin directory into ~/.code-shell/plugins/<name>/.
  * Builds into a temp sibling dir, then renames into place — a conversion
@@ -63,6 +64,7 @@ export async function installPluginFromPath(sourceDir, name, installedAt) {
             }
             meta = { name, format: "codex", version: manifest.version, source: sourceDir, installedAt };
         }
+        rewritePluginVars(tmpDir);
         await writeFile(join(tmpDir, ".cs-meta.json"), JSON.stringify(meta, null, 2));
         await rename(tmpDir, finalDir);
         // Register so existing loaders (scanInstalledPlugins / loadPluginHooks)

package/dist/plugins/installer/installFromSource.js

@@ -5,6 +5,7 @@ import { gitClone, gitRevParseHead } from "../gitOps.js";
 import { installPluginFromPath } from "./install.js";
 import { pluginMetaPath } from "./paths.js";
 import { PluginInstallError } from "./types.js";
+import { resolveContainedPluginSubpath } from "./sourcePath.js";
 /**
  * Remote install orchestrator: a thin bridge over the existing pieces. Clone
  * the git source to a private temp dir, hand the (sub)directory to the local
@@ -26,7 +27,14 @@ export async function installPluginFromSource(parsed, name, installedAt) {
         if (!clone.ok) {
             throw new PluginInstallError(`clone failed: ${clone.error}`);
         }
-        const realSrc = parsed.subdir ? join(tmp, parsed.subdir) : tmp;
+        const realSrc = parsed.subdir
+            ? (() => {
+                const resolved = resolveContainedPluginSubpath(tmp, parsed.subdir, "subdir");
+                if (!resolved.ok)
+                    throw new PluginInstallError(resolved.error);
+                return resolved.path;
+            })()
+            : tmp;
         if (!existsSync(realSrc) || !statSync(realSrc).isDirectory()) {
             throw new PluginInstallError(`subdir not found in repo: ${parsed.subdir}`);
         }

package/dist/plugins/installer/parseSource.d.ts

@@ -17,4 +17,7 @@ export type ParsedSource = {
     raw: string;
     inferredName: string;
 };
-export declare function parseSource(input: string): ParsedSource;
+export interface ParseSourceOptions {
+    allowUnsafeTransport?: boolean;
+}
+export declare function parseSource(input: string, options?: ParseSourceOptions): ParsedSource;

package/dist/plugins/installer/parseSource.js

@@ -1,16 +1,30 @@
 import { resolve } from "node:path";
 import { githubRepoToCloneUrl } from "../gitOps.js";
+import { PluginInstallError } from "./types.js";
 /** SSH shorthand `git@host:org/repo.git` — has a `:` after the `git@host` part. */
 function isSshUrl(s) {
     return /^[^/]+@[^/]+:/.test(s) && !s.includes("://");
 }
 function isRemote(s) {
-    return (s.startsWith("github:") ||
-        s.startsWith("https://") ||
-        s.startsWith("http://") ||
-        s.startsWith("git://") ||
-        s.startsWith("file://") ||
-        isSshUrl(s));
+    const lower = s.toLowerCase();
+    return lower.startsWith("github:") || /^[a-z][a-z0-9+.-]*:\/\//i.test(s) || isSshUrl(s);
+}
+function unsafeTransport(input) {
+    const scheme = input.match(/^([a-z][a-z0-9+.-]*):\/\//i)?.[1]?.toLowerCase();
+    if (!scheme)
+        return null;
+    if (scheme === "https")
+        return null;
+    return `${scheme}://`;
+}
+function lowerUrlScheme(input) {
+    return input.replace(/^([a-z][a-z0-9+.-]*):/i, (scheme) => scheme.toLowerCase());
+}
+function hasGithubScheme(input) {
+    return input.slice(0, "github:".length).toLowerCase() === "github:";
+}
+function stripGithubScheme(input) {
+    return input.slice("github:".length);
 }
 /** Last path segment of a repo url/path, with a trailing `.git` stripped. */
 function repoNameFromUrl(url) {
@@ -22,10 +36,14 @@ function repoNameFromUrl(url) {
 function lastSegment(p) {
     return p.split("/").filter(Boolean).pop() ?? p;
 }
-export function parseSource(input) {
+export function parseSource(input, options = {}) {
     if (!isRemote(input)) {
         return { kind: "local", path: resolve(input) };
     }
+    const unsafe = unsafeTransport(input);
+    if (unsafe && !options.allowUnsafeTransport) {
+        throw new PluginInstallError(`unsafe plugin source transport '${unsafe}' is disabled by default; use https://, github:, SSH, or pass allowUnsafeTransport explicitly`);
+    }
     const raw = input;
     // 1. Split off `#subdir` (last `#`).
     let rest = input;
@@ -58,11 +76,11 @@ export function parseSource(input) {
     }
     // 3. Normalize url.
     let url;
-    if (base.startsWith("github:")) {
-        url = githubRepoToCloneUrl(base.slice("github:".length));
+    if (hasGithubScheme(base)) {
+        url = githubRepoToCloneUrl(stripGithubScheme(base));
     }
     else {
-        url = base;
+        url = lowerUrlScheme(base);
     }
     const inferredName = subdir ? lastSegment(subdir) : repoNameFromUrl(url);
     const result = { kind: "remote", url, raw, inferredName };

package/dist/plugins/installer/sourcePath.d.ts

@@ -0,0 +1,9 @@
+export type ContainedPluginSubpathResult = {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function validateRelativePluginSubpath(subpath: string, label: string): string | null;
+export declare function resolveContainedPluginSubpath(root: string, subpath: string, label: string): ContainedPluginSubpathResult;

package/dist/plugins/installer/sourcePath.js

@@ -0,0 +1,50 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
+function normPath(path) {
+    return process.platform === "win32" ? path.toLowerCase() : path;
+}
+function isContainedOrRoot(child, parent) {
+    const c = normPath(child);
+    const parentPath = normPath(parent);
+    const parentPrefix = normPath(parent.endsWith(sep) ? parent : parent + sep);
+    return c === parentPath || c.startsWith(parentPrefix);
+}
+export function validateRelativePluginSubpath(subpath, label) {
+    if (typeof subpath !== "string" || subpath.length === 0) {
+        return `${label} must be a non-empty relative path`;
+    }
+    if (subpath.includes("\0")) {
+        return `${label} must not contain NUL bytes: ${subpath}`;
+    }
+    if (isAbsolute(subpath)) {
+        return `${label} must be relative and inside the source tree: ${subpath}`;
+    }
+    if (subpath.split(/[\\/]+/).includes("..")) {
+        return `${label} must not contain parent-directory segments: ${subpath}`;
+    }
+    return null;
+}
+export function resolveContainedPluginSubpath(root, subpath, label) {
+    const invalid = validateRelativePluginSubpath(subpath, label);
+    if (invalid)
+        return { ok: false, error: invalid };
+    let realRoot;
+    try {
+        realRoot = realpathSync(root);
+    }
+    catch (err) {
+        return { ok: false, error: `${label} root could not be resolved: ${err.message}` };
+    }
+    const candidate = resolve(root, subpath);
+    let realCandidate;
+    try {
+        realCandidate = realpathSync(candidate);
+    }
+    catch {
+        return { ok: false, error: `${label} not found in source tree: ${subpath}` };
+    }
+    if (!isContainedOrRoot(realCandidate, realRoot)) {
+        return { ok: false, error: `${label} escapes the source tree: ${subpath}` };
+    }
+    return { ok: true, path: realCandidate };
+}

package/dist/plugins/installer/update.d.ts

@@ -2,6 +2,9 @@ export interface UpdateResult {
     updated: boolean;
     reason: string;
 }
+export interface UpdatePluginOptions {
+    allowUnsafeTransport?: boolean;
+}
 /**
  * Reinstall a plugin atomically: a failed update leaves the OLD plugin intact.
  *
@@ -25,4 +28,4 @@ export declare function reinstallAtomic(name: string, source: string, doInstall:
  *   no local version file to compare, so update is always a fresh pull
  *   (equivalent to `--force`; cheap and reliable). See spec §9.
  */
-export declare function updatePluginByName(name: string, installedAt: string, force: boolean): Promise<UpdateResult>;
+export declare function updatePluginByName(name: string, installedAt: string, force: boolean, options?: UpdatePluginOptions): Promise<UpdateResult>;

package/dist/plugins/installer/update.js

@@ -6,7 +6,7 @@ import { pluginInstallDir } from "./paths.js";
 import { installPluginFromPath } from "./install.js";
 import { installPluginFromSource } from "./installFromSource.js";
 import { parseSource } from "./parseSource.js";
-import { pluginInstallKey, readInstalledPlugins, removeInstallEntries, writeInstalledPlugins } from "../installedPlugins.js";
+import { pluginInstallKey, readInstalledPlugins, removeInstallEntries, writeInstalledPlugins, } from "../installedPlugins.js";
 import { CodexPluginManifest, CSMeta, PluginInstallError } from "./types.js";
 /**
  * Reinstall a plugin atomically: a failed update leaves the OLD plugin intact.
@@ -66,13 +66,15 @@ export async function reinstallAtomic(name, source, doInstall) {
  *   no local version file to compare, so update is always a fresh pull
  *   (equivalent to `--force`; cheap and reliable). See spec §9.
  */
-export async function updatePluginByName(name, installedAt, force) {
+export async function updatePluginByName(name, installedAt, force, options = {}) {
     const dir = pluginInstallDir(name);
     const metaPath = join(dir, ".cs-meta.json");
     if (!existsSync(metaPath))
         throw new PluginInstallError(`no plugin named '${name}'`);
     const meta = CSMeta.parse(JSON.parse(readFileSync(metaPath, "utf-8")));
-    const parsed = parseSource(meta.source);
+    const parsed = parseSource(meta.source, {
+        allowUnsafeTransport: options.allowUnsafeTransport === true,
+    });
     if (parsed.kind === "remote") {
         // No local version to diff against — always re-clone and reinstall.
         await reinstallAtomic(name, meta.source, () => installPluginFromSource(parsed, name, installedAt));

package/dist/plugins/parseMarketplaceInput.d.ts

@@ -4,11 +4,14 @@
  * local absolute paths, github shorthand, https git URLs, and ssh git URLs.
  */
 import type { MarketplaceSource } from "./types.js";
+export interface ParseMarketplaceInputOptions {
+    allowUnsafeTransport?: boolean;
+}
 /**
  * Returns the parsed source, or null when the input does not match any
  * supported pattern. Callers should show a usage hint on null.
  */
-export declare function parseMarketplaceInput(input: string): MarketplaceSource | null;
+export declare function parseMarketplaceInput(input: string, options?: ParseMarketplaceInputOptions): MarketplaceSource | null;
 /**
  * Derive a stable marketplace name from a source. Used as the filesystem
  * directory and the key in known_marketplaces.json.

package/dist/plugins/parseMarketplaceInput.js

@@ -7,15 +7,14 @@
  * Returns the parsed source, or null when the input does not match any
  * supported pattern. Callers should show a usage hint on null.
  */
-export function parseMarketplaceInput(input) {
+export function parseMarketplaceInput(input, options = {}) {
     const trimmed = input.trim();
     if (trimmed === "")
         return null;
     // Absolute local path to a git repository (bare or with .git suffix).
     // Useful for dev workflows where the marketplace lives on disk rather
     // than at a remote URL. git clone itself accepts the same form.
-    if ((trimmed.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(trimmed)) &&
-        trimmed.endsWith(".git")) {
+    if ((trimmed.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(trimmed)) && trimmed.endsWith(".git")) {
         return { source: "git", url: trimmed };
     }
     // SSH: user@host:path[.git]
@@ -26,6 +25,8 @@ export function parseMarketplaceInput(input) {
     }
     // HTTPS
     if (trimmed.startsWith("https://") || trimmed.startsWith("http://")) {
+        if (trimmed.startsWith("http://") && !options.allowUnsafeTransport)
+            return null;
         let parsed;
         try {
             parsed = new URL(trimmed);