@cjhyy/code-shell-core 0.7.0 → 0.8.0

package/dist/plugins/installer/installFromNpm.js

@@ -0,0 +1,273 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { mkdtemp, mkdir, open, readFile, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { valid as validSemver } from "semver";
+import { findPluginRoot, normalizePluginName } from "./installFromArchive.js";
+import { installPluginFromPath } from "./install.js";
+import { gunzipNpmTarball, extractNpmTar, MAX_NPM_TARBALL_BYTES } from "./npmTar.js";
+import { PluginInstallError } from "./types.js";
+export const NPM_PUBLIC_REGISTRY = "https://registry.npmjs.org";
+export const MAX_NPM_METADATA_BYTES = 4 * 1024 * 1024;
+const NPM_FETCH_TIMEOUT_MS = 30_000;
+const MAX_NPM_PACKAGE_JSON_BYTES = 1024 * 1024;
+function assertRegistryUrl(raw, label) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new PluginInstallError(`${label} is not a valid URL`);
+    }
+    if (url.protocol !== "https:" ||
+        url.hostname !== "registry.npmjs.org" ||
+        url.port !== "" ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        throw new PluginInstallError(`${label} must use the fixed public registry.npmjs.org origin`);
+    }
+    return url;
+}
+function assertSelfContained(document) {
+    const dependencyFields = [
+        "dependencies",
+        "optionalDependencies",
+        "peerDependencies",
+        "bundledDependencies",
+        "bundleDependencies",
+    ];
+    for (const field of dependencyFields) {
+        const value = document[field];
+        const populated = value === undefined || value === null || value === false
+            ? false
+            : Array.isArray(value)
+                ? value.length > 0
+                : typeof value === "object"
+                    ? Object.keys(value).length > 0
+                    : true;
+        if (populated) {
+            throw new PluginInstallError(`npm plugin declares ${field}; Phase A accepts self-contained packages only and never installs dependencies`);
+        }
+    }
+}
+async function verifyExtractedPackage(packageDir, resolution) {
+    const manifestPath = join(packageDir, "package.json");
+    let manifestStat;
+    try {
+        manifestStat = await stat(manifestPath);
+    }
+    catch {
+        throw new PluginInstallError("npm tarball is missing package/package.json");
+    }
+    if (!manifestStat.isFile() || manifestStat.size > MAX_NPM_PACKAGE_JSON_BYTES) {
+        throw new PluginInstallError("npm package.json is not a bounded regular file");
+    }
+    let document;
+    try {
+        document = JSON.parse(await readFile(manifestPath, "utf8"));
+    }
+    catch (error) {
+        throw new PluginInstallError(`npm tarball has malformed package.json: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (document.name !== resolution.packageName || document.version !== resolution.resolvedVersion) {
+        throw new PluginInstallError("npm tarball package identity does not match the reviewed registry metadata");
+    }
+    assertSelfContained(document);
+}
+function sha512DigestFromIntegrity(integrity) {
+    const token = integrity.split(/\s+/).find((candidate) => candidate.startsWith("sha512-"));
+    if (!token)
+        throw new PluginInstallError("npm package has no sha512 integrity value");
+    const encoded = token.slice("sha512-".length);
+    if (!/^[A-Za-z0-9+/]{86}==$/.test(encoded)) {
+        throw new PluginInstallError("npm package sha512 integrity value is malformed");
+    }
+    const digest = Buffer.from(encoded, "base64");
+    if (digest.length !== 64 || digest.toString("base64") !== encoded) {
+        throw new PluginInstallError("npm package sha512 integrity value is malformed");
+    }
+    return digest;
+}
+async function checkedFetch(url, accept, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "GET",
+            redirect: "manual",
+            headers: {
+                Accept: accept,
+                "Accept-Encoding": "identity",
+                "User-Agent": "CodeShell-plugin-installer/1",
+            },
+            signal: AbortSignal.timeout(NPM_FETCH_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new PluginInstallError(`public npm registry request failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (response.status !== 200) {
+        throw new PluginInstallError(`public npm registry returned HTTP ${response.status}; redirects and non-success responses are refused`);
+    }
+    const lengthText = response.headers.get("content-length");
+    if (lengthText && (!/^[0-9]+$/.test(lengthText) || !Number.isSafeInteger(Number(lengthText)))) {
+        throw new PluginInstallError("public npm registry returned an invalid Content-Length");
+    }
+    return response;
+}
+async function readBoundedResponse(response, limit, label) {
+    const declared = response.headers.get("content-length");
+    if (declared && Number(declared) > limit) {
+        throw new PluginInstallError(`${label} exceeds ${limit} bytes`);
+    }
+    if (!response.body)
+        throw new PluginInstallError(`${label} response has no body`);
+    const chunks = [];
+    let total = 0;
+    for await (const value of response.body) {
+        const chunk = Buffer.from(value);
+        total += chunk.length;
+        if (total > limit)
+            throw new PluginInstallError(`${label} exceeds ${limit} bytes`);
+        chunks.push(chunk);
+    }
+    if (declared && total !== Number(declared)) {
+        throw new PluginInstallError(`${label} length does not match Content-Length`);
+    }
+    return Buffer.concat(chunks, total);
+}
+/** Resolve an exact version or dist-tag to an immutable public-registry snapshot. */
+export async function resolveNpmPlugin(parsed, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function")
+        throw new PluginInstallError("fetch is unavailable");
+    const metadataUrl = assertRegistryUrl(`${NPM_PUBLIC_REGISTRY}/${encodeURIComponent(parsed.packageName)}/${encodeURIComponent(parsed.selector)}`, "npm metadata URL");
+    const response = await checkedFetch(metadataUrl, "application/json", fetchImpl);
+    const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+    if (!contentType.includes("json")) {
+        throw new PluginInstallError("public npm registry metadata response is not JSON");
+    }
+    const body = await readBoundedResponse(response, MAX_NPM_METADATA_BYTES, "npm metadata");
+    let document;
+    try {
+        document = JSON.parse(body.toString("utf8"));
+    }
+    catch (error) {
+        throw new PluginInstallError(`public npm registry returned malformed metadata: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (document.name !== parsed.packageName) {
+        throw new PluginInstallError("npm metadata package name does not match the requested package");
+    }
+    if (typeof document.version !== "string" || !validSemver(document.version)) {
+        throw new PluginInstallError("npm metadata did not resolve to an exact semantic version");
+    }
+    const resolvedVersion = validSemver(document.version);
+    if (parsed.selectorKind === "exact" && resolvedVersion !== parsed.selector) {
+        throw new PluginInstallError("npm registry resolved a different version than requested");
+    }
+    assertSelfContained(document);
+    if (typeof document.dist?.tarball !== "string") {
+        throw new PluginInstallError("npm metadata has no tarball URL");
+    }
+    assertRegistryUrl(document.dist.tarball, "npm tarball URL");
+    if (typeof document.dist.integrity !== "string") {
+        throw new PluginInstallError("npm metadata has no integrity value");
+    }
+    sha512DigestFromIntegrity(document.dist.integrity);
+    return {
+        packageName: parsed.packageName,
+        requestedSelector: parsed.selector,
+        resolvedVersion,
+        tarballUrl: document.dist.tarball,
+        integrity: document.dist.integrity,
+    };
+}
+/** Download a tarball with a compressed-byte cap and verify SHA-512 before use. */
+export async function downloadVerifiedNpmTarball(resolution, targetPath, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function")
+        throw new PluginInstallError("fetch is unavailable");
+    const url = assertRegistryUrl(resolution.tarballUrl, "npm tarball URL");
+    const response = await checkedFetch(url, "application/octet-stream", fetchImpl);
+    const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+    if (contentType &&
+        !["application/octet-stream", "application/gzip", "application/x-gzip"].some((allowed) => contentType.includes(allowed))) {
+        throw new PluginInstallError("npm tarball response has an unexpected Content-Type");
+    }
+    const contentEncoding = response.headers.get("content-encoding")?.toLowerCase();
+    if (contentEncoding && contentEncoding !== "identity") {
+        throw new PluginInstallError("npm tarball HTTP content encoding must be identity");
+    }
+    const declared = response.headers.get("content-length");
+    if (declared && Number(declared) > MAX_NPM_TARBALL_BYTES) {
+        throw new PluginInstallError(`npm tarball exceeds ${MAX_NPM_TARBALL_BYTES} bytes`);
+    }
+    if (!response.body)
+        throw new PluginInstallError("npm tarball response has no body");
+    const hash = createHash("sha512");
+    const output = await open(targetPath, "wx", 0o600);
+    let total = 0;
+    try {
+        for await (const value of response.body) {
+            const chunk = Buffer.from(value);
+            total += chunk.length;
+            if (total > MAX_NPM_TARBALL_BYTES) {
+                throw new PluginInstallError(`npm tarball exceeds ${MAX_NPM_TARBALL_BYTES} bytes`);
+            }
+            hash.update(chunk);
+            await output.write(chunk);
+        }
+    }
+    catch (error) {
+        await output.close();
+        await rm(targetPath, { force: true });
+        if (error instanceof PluginInstallError)
+            throw error;
+        throw new PluginInstallError(`npm tarball download failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    await output.close();
+    if (declared && total !== Number(declared)) {
+        await rm(targetPath, { force: true });
+        throw new PluginInstallError("npm tarball length does not match Content-Length");
+    }
+    const expected = sha512DigestFromIntegrity(resolution.integrity);
+    const actual = hash.digest();
+    if (!timingSafeEqual(actual, expected)) {
+        await rm(targetPath, { force: true });
+        throw new PluginInstallError("npm tarball sha512 integrity check failed");
+    }
+}
+/**
+ * Install a self-contained plugin from the public npm registry. The resolved
+ * exact version is recorded as the source; Phase A deliberately has no npm
+ * dependency install, lifecycle execution, private registry, or auto-update.
+ */
+export async function installPluginFromNpm(parsed, name, installedAt, options = {}) {
+    if (parsed.kind !== "npm") {
+        throw new PluginInstallError("installPluginFromNpm expects an npm source");
+    }
+    const resolution = await resolveNpmPlugin(parsed, options);
+    const resolvedName = normalizePluginName(name ?? parsed.inferredName);
+    const temp = await mkdtemp(join(tmpdir(), "cs-tmp-npm-"));
+    const tgzPath = join(temp, "package.tgz");
+    const tarPath = join(temp, "package.tar");
+    const extractPath = join(temp, "extract");
+    try {
+        await mkdir(extractPath, { mode: 0o700 });
+        await downloadVerifiedNpmTarball(resolution, tgzPath, options);
+        await gunzipNpmTarball(tgzPath, tarPath);
+        await extractNpmTar(tarPath, extractPath);
+        const packageDir = join(extractPath, "package");
+        await verifyExtractedPackage(packageDir, resolution);
+        const root = await findPluginRoot(packageDir);
+        const dir = await installPluginFromPath(root, resolvedName, installedAt, {
+            source: `npm:${resolution.packageName}@${resolution.resolvedVersion}`,
+            version: resolution.resolvedVersion,
+        });
+        return { dir, name: resolvedName, resolution };
+    }
+    finally {
+        await rm(temp, { recursive: true, force: true });
+    }
+}

package/dist/plugins/installer/loadPluginAgents.js

@@ -1,5 +1,5 @@
-import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
 import { readInstalledPlugins } from "../installedPlugins.js";
 function pluginNameFromKey(key) {
     const at = key.lastIndexOf("@");
@@ -19,8 +19,21 @@ export function pluginAgentDirs(disabledPlugins = []) {
             // Carry pluginName so a plugin agent's bare skill allowlist
             // (`director-skill`) can be namespaced to `<pluginName>:director-skill`
             // at spawn time — see resolveAgentTypeOverrides.
-            if (existsSync(dir))
-                out.push({ dir, source: "plugin", pluginName });
+            if (!existsSync(dir))
+                continue;
+            try {
+                const installRoot = realpathSync(entry.installPath);
+                const resolvedDir = realpathSync(dir);
+                const rel = relative(installRoot, resolvedDir);
+                if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+                    continue;
+                if (statSync(resolvedDir).isDirectory()) {
+                    out.push({ dir, source: "plugin", pluginName });
+                }
+            }
+            catch {
+                // Missing, unreadable, or escaping plugin contribution — ignore it.
+            }
         }
     }
     return out;

package/dist/plugins/installer/loadPluginMcp.d.ts

@@ -1,4 +1,18 @@
 import type { MCPServerConfig, MCPServerOverride } from "../../types.js";
+export declare function normalizePluginMcpMap(raw: unknown, pluginName: string, alreadyKeyed: boolean): Record<string, MCPServerConfig>;
+/**
+ * Read a single plugin's MCP servers, already keyed `<plugin>:<server>`.
+ *
+ * Two on-disk shapes are supported:
+ *  - `mcp-servers.json` — the Codex-install product: already keyed + named.
+ *  - `.mcp.json` — what a CC plugin ships verbatim (Docker's mcp-toolkit etc.).
+ *    It uses a `{ mcpServers: {...} }` wrapper with bare server names; we unwrap
+ *    it and apply the `<plugin>:` prefix + `name` so it matches the keyed shape.
+ *
+ * `mcp-servers.json` wins if both exist. Malformed files yield {} (must not
+ * break startup).
+ */
+export declare function readPluginMcp(installPath: string, pluginName: string): Record<string, MCPServerConfig>;
 /**
  * Merge each registered plugin's MCP servers into a copy of `base`.
  * Plugin keys are `<plugin>:<server>`. A key already present in `base`

package/dist/plugins/installer/loadPluginMcp.js

@@ -1,24 +1,240 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
 import { readInstalledPlugins } from "../installedPlugins.js";
+import { pluginMcpApprovalState } from "../pluginMcpIntegrity.js";
 function pluginNameFromKey(key) {
     const at = key.lastIndexOf("@");
     return at > 0 ? key.slice(0, at) : key;
 }
+const MAX_PLUGIN_MCP_CONFIG_BYTES = 1024 * 1024;
+const MAX_PLUGIN_MCP_SERVERS = 64;
+const MAX_SERVER_NAME_LENGTH = 96;
+const MAX_COMMAND_LENGTH = 4096;
+const MAX_URL_LENGTH = 2048;
+const MAX_ARGS = 256;
+const MAX_RECORD_ENTRIES = 128;
+const MAX_VALUE_LENGTH = 8192;
+const SERVER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const HTTP_HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const PLUGIN_TRANSPORTS = new Set(["stdio", "sse", "streamable-http"]);
+function readContainedPluginJson(installPath, fileName) {
+    try {
+        const root = realpathSync(installPath);
+        const candidate = join(installPath, fileName);
+        const linkInfo = lstatSync(candidate);
+        if (linkInfo.isSymbolicLink() ||
+            !linkInfo.isFile() ||
+            linkInfo.size > MAX_PLUGIN_MCP_CONFIG_BYTES) {
+            return null;
+        }
+        const target = realpathSync(candidate);
+        const rel = relative(root, target);
+        if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            return null;
+        const info = statSync(target);
+        if (!info.isFile() || info.size > MAX_PLUGIN_MCP_CONFIG_BYTES)
+            return null;
+        return JSON.parse(readFileSync(target, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function boundedString(value, maxLength) {
+    return typeof value === "string" && value.length > 0 && value.length <= maxLength
+        ? value
+        : undefined;
+}
+function boundedStringArray(value, maxItems, maxLength, validate) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > maxItems)
+        return undefined;
+    const items = [];
+    for (const item of value) {
+        const stringValue = boundedString(item, maxLength);
+        if (!stringValue || (validate && !validate(stringValue)))
+            return undefined;
+        items.push(stringValue);
+    }
+    return items;
+}
+function boundedStringRecord(value, validateKey, validateValue) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value);
+    if (entries.length > MAX_RECORD_ENTRIES)
+        return undefined;
+    const result = {};
+    for (const [key, item] of entries) {
+        if (key.length === 0 ||
+            key.length > 256 ||
+            key.includes("\0") ||
+            (validateKey && !validateKey(key))) {
+            return undefined;
+        }
+        const stringValue = typeof item === "string" && item.length <= MAX_VALUE_LENGTH ? item : undefined;
+        if (stringValue === undefined ||
+            stringValue.includes("\0") ||
+            (validateValue && !validateValue(stringValue))) {
+            return undefined;
+        }
+        result[key] = stringValue;
+    }
+    return result;
+}
+function safeHttpUrl(value) {
+    const raw = boundedString(value, MAX_URL_LENGTH);
+    if (!raw)
+        return undefined;
+    try {
+        const url = new URL(raw);
+        if ((url.protocol !== "http:" && url.protocol !== "https:") ||
+            !url.hostname ||
+            url.username ||
+            url.password) {
+            return undefined;
+        }
+        return raw;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Turn one untrusted plugin MCP declaration into the narrow runtime shape.
+ * Unknown fields are dropped; malformed known fields reject the whole server
+ * instead of reaching MCPManager and failing during application startup.
+ */
+function normalizePluginMcpServer(raw, key) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const cfg = raw;
+    const transport = cfg.transport === undefined
+        ? undefined
+        : typeof cfg.transport === "string" && PLUGIN_TRANSPORTS.has(cfg.transport)
+            ? cfg.transport
+            : null;
+    if (transport === null)
+        return undefined;
+    const command = cfg.command === undefined ? undefined : boundedString(cfg.command, MAX_COMMAND_LENGTH);
+    if (cfg.command !== undefined && !command)
+        return undefined;
+    if (command?.includes("\0"))
+        return undefined;
+    const url = cfg.url === undefined ? undefined : safeHttpUrl(cfg.url);
+    if (cfg.url !== undefined && !url)
+        return undefined;
+    const args = boundedStringArray(cfg.args, MAX_ARGS, MAX_VALUE_LENGTH, (item) => {
+        return !item.includes("\0");
+    });
+    if (cfg.args !== undefined && !args)
+        return undefined;
+    const env = boundedStringRecord(cfg.env, (name) => ENV_NAME_RE.test(name));
+    if (cfg.env !== undefined && !env)
+        return undefined;
+    const headers = boundedStringRecord(cfg.headers, (name) => HTTP_HEADER_NAME_RE.test(name), (value) => !value.includes("\r") && !value.includes("\n"));
+    if (cfg.headers !== undefined && !headers)
+        return undefined;
+    const envHeaders = boundedStringRecord(cfg.envHeaders, (name) => HTTP_HEADER_NAME_RE.test(name), (envName) => ENV_NAME_RE.test(envName));
+    if (cfg.envHeaders !== undefined && !envHeaders)
+        return undefined;
+    const envVars = boundedStringArray(cfg.envVars, MAX_RECORD_ENTRIES, 256, (name) => ENV_NAME_RE.test(name));
+    if (cfg.envVars !== undefined && !envVars)
+        return undefined;
+    const bearerTokenEnvVar = cfg.bearerTokenEnvVar === undefined ? undefined : boundedString(cfg.bearerTokenEnvVar, 256);
+    if (cfg.bearerTokenEnvVar !== undefined &&
+        (!bearerTokenEnvVar || !ENV_NAME_RE.test(bearerTokenEnvVar))) {
+        return undefined;
+    }
+    const credentialRef = cfg.credentialRef === undefined ? undefined : boundedString(cfg.credentialRef, 256);
+    if (cfg.credentialRef !== undefined && !credentialRef)
+        return undefined;
+    if (cfg.enabled !== undefined && typeof cfg.enabled !== "boolean")
+        return undefined;
+    const allowedToolsRaw = cfg.allowedTools ?? cfg.allowed_tools;
+    const disabledToolsRaw = cfg.disabledTools ?? cfg.disabled_tools;
+    const allowedTools = boundedStringArray(allowedToolsRaw, 256, 256, (name) => {
+        return !name.includes("\0");
+    });
+    if (allowedToolsRaw !== undefined && !allowedTools)
+        return undefined;
+    const disabledTools = boundedStringArray(disabledToolsRaw, 256, 256, (name) => {
+        return !name.includes("\0");
+    });
+    if (disabledToolsRaw !== undefined && !disabledTools)
+        return undefined;
+    const effectiveTransport = transport ?? (url && !command ? "streamable-http" : "stdio");
+    if (effectiveTransport === "stdio" && !command)
+        return undefined;
+    if ((effectiveTransport === "sse" || effectiveTransport === "streamable-http") && !url) {
+        return undefined;
+    }
+    return {
+        name: key,
+        ...(command ? { command } : {}),
+        ...(args ? { args } : {}),
+        ...(env ? { env } : {}),
+        ...(url ? { url } : {}),
+        ...(transport ? { transport } : {}),
+        ...(headers ? { headers } : {}),
+        ...(envVars ? { envVars } : {}),
+        ...(bearerTokenEnvVar ? { bearerTokenEnvVar } : {}),
+        ...(envHeaders ? { envHeaders } : {}),
+        ...(credentialRef ? { credentialRef } : {}),
+        ...(typeof cfg.enabled === "boolean" ? { enabled: cfg.enabled } : {}),
+        ...(allowedTools ? { allowedTools } : {}),
+        ...(disabledTools ? { disabledTools } : {}),
+    };
+}
+export function normalizePluginMcpMap(raw, pluginName, alreadyKeyed) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return {};
+    const entries = Object.entries(raw);
+    if (entries.length > MAX_PLUGIN_MCP_SERVERS)
+        return {};
+    const keyed = {};
+    for (const [declaredName, config] of entries) {
+        const serverName = alreadyKeyed
+            ? declaredName.startsWith(`${pluginName}:`)
+                ? declaredName.slice(pluginName.length + 1)
+                : ""
+            : declaredName;
+        if (serverName.length === 0 ||
+            serverName.length > MAX_SERVER_NAME_LENGTH ||
+            !SERVER_NAME_RE.test(serverName)) {
+            continue;
+        }
+        const key = `${pluginName}:${serverName}`;
+        const normalized = normalizePluginMcpServer(config, key);
+        if (normalized)
+            keyed[key] = normalized;
+    }
+    return keyed;
+}
 /**
  * Layer a user override's supplement fields onto a plugin server config.
  *
- * Only env/credential fields are picked — command/args/url/transport are
- * deliberately NOT carried, because those are the plugin's identity and must
- * keep coming from the plugin manifest so a plugin update can change them
- * without the user being stuck on a stale shadow copy. This explicit pick is
- * defense-in-depth on top of the schema's `.strict()`, so a hand-edited
- * settings file can never smuggle those fields in.
+ * Only the user server/tool policy and env/credential fields are picked —
+ * command/args/url/transport are deliberately NOT carried, because those are
+ * the plugin's identity and must keep coming from the plugin manifest so an
+ * update can change them without the user being stuck on a stale shadow copy.
+ * This explicit pick is defense-in-depth on top of the schema's `.strict()`,
+ * so a hand-edited settings file can never smuggle identity fields in.
  */
 function applyOverride(pluginConfig, override) {
     if (!override)
         return pluginConfig;
     const supplement = {};
+    if (override.enabled !== undefined)
+        supplement.enabled = override.enabled;
+    if (override.allowedTools !== undefined)
+        supplement.allowedTools = override.allowedTools;
+    if (override.disabledTools !== undefined)
+        supplement.disabledTools = override.disabledTools;
     if (override.env !== undefined)
         supplement.env = override.env;
     if (override.envVars !== undefined)
@@ -43,34 +259,25 @@ function applyOverride(pluginConfig, override) {
  * `mcp-servers.json` wins if both exist. Malformed files yield {} (must not
  * break startup).
  */
-function readPluginMcp(installPath, pluginName) {
-    const keyedPath = join(installPath, "mcp-servers.json");
-    if (existsSync(keyedPath)) {
-        try {
-            return JSON.parse(readFileSync(keyedPath, "utf-8"));
-        }
-        catch {
-            return {};
-        }
+export function readPluginMcp(installPath, pluginName) {
+    let keyedPresent = false;
+    try {
+        lstatSync(join(installPath, "mcp-servers.json"));
+        keyedPresent = true;
     }
-    const rawPath = join(installPath, ".mcp.json");
-    if (existsSync(rawPath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(rawPath, "utf-8"));
-        }
-        catch {
-            return {};
-        }
-        const servers = parsed && typeof parsed === "object" && "mcpServers" in parsed
-            ? parsed.mcpServers ?? {}
-            : parsed ?? {};
-        const keyed = {};
-        for (const [serverName, cfg] of Object.entries(servers)) {
-            const key = `${pluginName}:${serverName}`;
-            keyed[key] = { ...cfg, name: key };
-        }
-        return keyed;
+    catch {
+        // Missing: the CC-compatible .mcp.json fallback may be used.
+    }
+    const keyed = readContainedPluginJson(installPath, "mcp-servers.json");
+    if (keyed && typeof keyed === "object" && !Array.isArray(keyed)) {
+        return normalizePluginMcpMap(keyed, pluginName, true);
+    }
+    if (keyedPresent)
+        return {};
+    const parsed = readContainedPluginJson(installPath, ".mcp.json");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const servers = "mcpServers" in parsed ? (parsed.mcpServers ?? {}) : parsed;
+        return normalizePluginMcpMap(servers, pluginName, false);
     }
     return {};
 }
@@ -96,6 +303,9 @@ export function mergePluginMcpServers(base, disabledPlugins = [], overrides = {}
             continue;
         for (const entry of entries) {
             const servers = readPluginMcp(entry.installPath, pluginName);
+            const approval = pluginMcpApprovalState(entry, Object.keys(servers).length > 0);
+            if (approval === "pending" || approval === "changed" || approval === "none")
+                continue;
             for (const [k, cfg] of Object.entries(servers)) {
                 if (k in merged)
                     continue; // user / earlier wins

package/dist/plugins/installer/normalizeManifest.d.ts

@@ -0,0 +1,13 @@
+import { type CanonicalPluginManifest as CanonicalPluginManifestData } from "./types.js";
+export interface NormalizePluginManifestOptions {
+    name: string;
+    version?: string;
+    format: "cc" | "codex";
+    destinationRoot: string;
+}
+/**
+ * Normalize an Agent Plugin into the runtime manifest. Desktop Panel Apps have
+ * their own package and installer, so a Plugin declaration cannot contain UI.
+ */
+export declare function normalizePluginManifest(sourceRoot: string, options: NormalizePluginManifestOptions): Promise<CanonicalPluginManifestData>;
+export declare function readCanonicalPluginManifest(installRoot: string): Promise<CanonicalPluginManifestData | null>;