@cjhyy/code-shell-core 0.7.1 → 0.8.0

package/dist/plugins/pluginHookIntegrity.d.ts

@@ -0,0 +1,69 @@
+import type { PluginInstallEntry, StoredPluginHookReview } from "./types.js";
+/** Hard limits for one canonical plugin hook definition. */
+export declare const MAX_PLUGIN_HOOK_FILE_BYTES = 1048576;
+export declare const MAX_PLUGIN_HOOK_EVENTS = 32;
+export declare const MAX_PLUGIN_HOOK_GROUPS = 128;
+export declare const MAX_PLUGIN_HOOK_COMMANDS = 256;
+export declare const MAX_PLUGIN_HOOK_EVENT_NAME_LENGTH = 128;
+export declare const MAX_PLUGIN_HOOK_COMMAND_LENGTH = 32768;
+export declare const MAX_PLUGIN_HOOK_MATCHER_LENGTH = 4096;
+export declare const MAX_PLUGIN_HOOK_TIMEOUT_MS = 600000;
+export declare const MAX_PLUGIN_HOOK_REVIEW_COMMAND_LENGTH = 4096;
+export declare const SUPPORTED_PLUGIN_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PreCompact", "Notification", "Stop", "SubagentStop"];
+export type SupportedPluginHookEvent = (typeof SUPPORTED_PLUGIN_HOOK_EVENTS)[number];
+export interface ParsedPluginCommandHook {
+    command: string;
+    async?: boolean;
+    timeoutMs?: number;
+}
+export interface ParsedPluginHookGroup {
+    matcher?: string;
+    hooks: ParsedPluginCommandHook[];
+}
+export interface ParsedPluginHooksDefinition {
+    hooks: Partial<Record<SupportedPluginHookEvent, ParsedPluginHookGroup[]>>;
+}
+export interface PluginHooksSnapshot {
+    state: "absent" | "valid" | "invalid";
+    digest: string;
+    definition: ParsedPluginHooksDefinition | null;
+    hasExecutableHooks: boolean;
+    error?: string;
+}
+export type PluginHookIntegrity = "verified" | "changed" | "legacy";
+export type PluginHookApprovalState = "approved" | "pending" | "changed" | "legacy" | "none";
+/**
+ * Securely read and parse the one canonical hook file. All digest, approval,
+ * listing, and runtime decisions consume this snapshot so malformed or
+ * replaced files cannot be interpreted differently by separate code paths.
+ */
+export declare function inspectPluginHooks(installPath: string): PluginHooksSnapshot;
+/**
+ * Digest the exact canonical hooks file after it passes the bounded parser.
+ * Valid and absent definitions preserve the existing v1 digest contract;
+ * every invalid definition shares a fail-closed sentinel digest.
+ */
+export declare function pluginHooksDigest(installPath: string): string;
+/** Whether the bounded canonical definition currently contains an executable command hook. */
+export declare function pluginHasExecutableHooks(installPath: string): boolean;
+/** Build bounded, non-executable review metadata from one validated snapshot. */
+export declare function pluginHookReviewSnapshot(snapshot: PluginHooksSnapshot): StoredPluginHookReview[];
+/**
+ * Older installed_plugins.json entries predate hook digests and remain
+ * compatible as `legacy`. New entries fail closed when their effective hook
+ * file no longer matches the bytes approved by install/update.
+ */
+export declare function verifyPluginHookIntegrity(entry: PluginInstallEntry, snapshot?: PluginHooksSnapshot): PluginHookIntegrity;
+/**
+ * Runtime trust state for one installed plugin. Legacy entries stay compatible;
+ * new entries with executable hooks remain pending until the approved digest
+ * matches the install-time digest. Invalid definitions always fail closed as
+ * hook-free regardless of legacy state.
+ */
+export declare function pluginHookApprovalState(entry: PluginInstallEntry, snapshot?: PluginHooksSnapshot): PluginHookApprovalState;
+/**
+ * Integrity fields written at install/update. Hook-free packages approve the
+ * absent-hooks digest automatically; executable hooks require explicit trust.
+ * A previously approved identical digest remains approved across an update.
+ */
+export declare function pluginHookInstallRecord(installPath: string, previousEntries?: PluginInstallEntry[]): Pick<PluginInstallEntry, "hookDigest" | "approvedHookDigest" | "approvedHookSnapshot">;

package/dist/plugins/pluginHookIntegrity.js

@@ -0,0 +1,361 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+const DIGEST_DOMAIN = "codeshell-plugin-hooks-v1";
+const ABSENT_HOOKS = "<absent>";
+const INVALID_HOOKS = "<invalid>";
+/** Hard limits for one canonical plugin hook definition. */
+export const MAX_PLUGIN_HOOK_FILE_BYTES = 1_048_576;
+export const MAX_PLUGIN_HOOK_EVENTS = 32;
+export const MAX_PLUGIN_HOOK_GROUPS = 128;
+export const MAX_PLUGIN_HOOK_COMMANDS = 256;
+export const MAX_PLUGIN_HOOK_EVENT_NAME_LENGTH = 128;
+export const MAX_PLUGIN_HOOK_COMMAND_LENGTH = 32_768;
+export const MAX_PLUGIN_HOOK_MATCHER_LENGTH = 4_096;
+export const MAX_PLUGIN_HOOK_TIMEOUT_MS = 600_000;
+export const MAX_PLUGIN_HOOK_REVIEW_COMMAND_LENGTH = 4_096;
+export const SUPPORTED_PLUGIN_HOOK_EVENTS = [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PostToolUse",
+    "PreCompact",
+    "Notification",
+    "Stop",
+    "SubagentStop",
+];
+const SUPPORTED_EVENT_SET = new Set(SUPPORTED_PLUGIN_HOOK_EVENTS);
+function digestHooks(payload) {
+    return createHash("sha256").update(DIGEST_DOMAIN).update("\0").update(payload).digest("hex");
+}
+function invalidSnapshot(error) {
+    return {
+        state: "invalid",
+        digest: digestHooks(INVALID_HOOKS),
+        definition: null,
+        hasExecutableHooks: false,
+        error,
+    };
+}
+function absentSnapshot() {
+    return {
+        state: "absent",
+        digest: digestHooks(ABSENT_HOOKS),
+        definition: null,
+        hasExecutableHooks: false,
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMissingFileError(error) {
+    return (error instanceof Error && "code" in error && error.code === "ENOENT");
+}
+function pathIsWithin(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+function readBoundedRegularFile(installPath) {
+    const hooksDir = join(installPath, "hooks");
+    const hooksPath = join(hooksDir, "hooks.json");
+    let rootReal;
+    try {
+        const rootStat = lstatSync(installPath);
+        if (!rootStat.isDirectory())
+            return new Error("plugin install path is not a directory");
+        rootReal = realpathSync(installPath);
+    }
+    catch (error) {
+        return isMissingFileError(error) ? null : error;
+    }
+    try {
+        const hooksDirStat = lstatSync(hooksDir);
+        if (hooksDirStat.isSymbolicLink() || !hooksDirStat.isDirectory()) {
+            return new Error("canonical hooks directory must be a regular directory");
+        }
+    }
+    catch (error) {
+        return isMissingFileError(error) ? null : error;
+    }
+    let pathStat;
+    try {
+        pathStat = lstatSync(hooksPath);
+    }
+    catch (error) {
+        return isMissingFileError(error) ? null : error;
+    }
+    if (pathStat.isSymbolicLink() || !pathStat.isFile()) {
+        return new Error("canonical hooks file must be a regular file");
+    }
+    if (pathStat.size > MAX_PLUGIN_HOOK_FILE_BYTES) {
+        return new Error(`canonical hooks file exceeds ${MAX_PLUGIN_HOOK_FILE_BYTES} bytes`);
+    }
+    let targetReal;
+    try {
+        targetReal = realpathSync(hooksPath);
+    }
+    catch (error) {
+        return error;
+    }
+    if (!pathIsWithin(rootReal, targetReal)) {
+        return new Error("canonical hooks file escapes the plugin install path");
+    }
+    let fd;
+    try {
+        fd = openSync(hooksPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const openedStat = fstatSync(fd);
+        if (!openedStat.isFile())
+            return new Error("canonical hooks file must be a regular file");
+        if (openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) {
+            return new Error("canonical hooks file changed while being opened");
+        }
+        if (openedStat.size > MAX_PLUGIN_HOOK_FILE_BYTES) {
+            return new Error(`canonical hooks file exceeds ${MAX_PLUGIN_HOOK_FILE_BYTES} bytes`);
+        }
+        const chunks = [];
+        let total = 0;
+        while (true) {
+            const remaining = MAX_PLUGIN_HOOK_FILE_BYTES + 1 - total;
+            if (remaining <= 0) {
+                return new Error(`canonical hooks file exceeds ${MAX_PLUGIN_HOOK_FILE_BYTES} bytes`);
+            }
+            const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
+            const bytesRead = readSync(fd, chunk, 0, chunk.length, null);
+            if (bytesRead === 0)
+                break;
+            total += bytesRead;
+            if (total > MAX_PLUGIN_HOOK_FILE_BYTES) {
+                return new Error(`canonical hooks file exceeds ${MAX_PLUGIN_HOOK_FILE_BYTES} bytes`);
+            }
+            chunks.push(chunk.subarray(0, bytesRead));
+        }
+        return Buffer.concat(chunks, total);
+    }
+    catch (error) {
+        return error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function parseHooksDefinition(bytes) {
+    let value;
+    try {
+        value = JSON.parse(bytes.toString("utf8"));
+    }
+    catch (error) {
+        throw new Error(`invalid hooks JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!isRecord(value))
+        throw new Error("hooks document must be an object");
+    const rawHooks = value.hooks;
+    if (rawHooks === undefined)
+        return { hooks: {} };
+    if (!isRecord(rawHooks))
+        throw new Error("hooks must be an object");
+    const events = Object.entries(rawHooks);
+    if (events.length > MAX_PLUGIN_HOOK_EVENTS) {
+        throw new Error(`hooks define more than ${MAX_PLUGIN_HOOK_EVENTS} events`);
+    }
+    const parsed = { hooks: {} };
+    let groupCount = 0;
+    let commandCount = 0;
+    for (const [eventName, rawGroups] of events) {
+        if (eventName.length === 0 || eventName.length > MAX_PLUGIN_HOOK_EVENT_NAME_LENGTH) {
+            throw new Error(`hook event names must contain 1-${MAX_PLUGIN_HOOK_EVENT_NAME_LENGTH} characters`);
+        }
+        if (!Array.isArray(rawGroups)) {
+            throw new Error(`hook event "${eventName}" must be an array`);
+        }
+        groupCount += rawGroups.length;
+        if (groupCount > MAX_PLUGIN_HOOK_GROUPS) {
+            throw new Error(`hooks define more than ${MAX_PLUGIN_HOOK_GROUPS} groups`);
+        }
+        const supported = SUPPORTED_EVENT_SET.has(eventName);
+        const parsedGroups = [];
+        for (const rawGroup of rawGroups) {
+            if (!isRecord(rawGroup))
+                throw new Error(`hook group for "${eventName}" must be an object`);
+            const matcher = rawGroup.matcher;
+            if (matcher !== undefined) {
+                if (typeof matcher !== "string") {
+                    throw new Error(`hook matcher for "${eventName}" must be a string`);
+                }
+                if (matcher.length > MAX_PLUGIN_HOOK_MATCHER_LENGTH) {
+                    throw new Error(`hook matcher for "${eventName}" exceeds ${MAX_PLUGIN_HOOK_MATCHER_LENGTH} characters`);
+                }
+                try {
+                    new RegExp(matcher);
+                }
+                catch {
+                    throw new Error(`hook matcher for "${eventName}" is not a valid regular expression`);
+                }
+            }
+            const rawCommands = rawGroup.hooks;
+            if (rawCommands !== undefined && !Array.isArray(rawCommands)) {
+                throw new Error(`hook commands for "${eventName}" must be an array`);
+            }
+            const commands = rawCommands ?? [];
+            commandCount += commands.length;
+            if (commandCount > MAX_PLUGIN_HOOK_COMMANDS) {
+                throw new Error(`hooks define more than ${MAX_PLUGIN_HOOK_COMMANDS} commands`);
+            }
+            const parsedCommands = [];
+            for (const rawCommand of commands) {
+                if (!isRecord(rawCommand)) {
+                    throw new Error(`hook command for "${eventName}" must be an object`);
+                }
+                if (rawCommand.type !== "command")
+                    continue;
+                const command = rawCommand.command;
+                if (typeof command !== "string") {
+                    throw new Error(`command hook for "${eventName}" must include a string command`);
+                }
+                if (command.length > MAX_PLUGIN_HOOK_COMMAND_LENGTH) {
+                    throw new Error(`command hook for "${eventName}" exceeds ${MAX_PLUGIN_HOOK_COMMAND_LENGTH} characters`);
+                }
+                if (rawCommand.async !== undefined && typeof rawCommand.async !== "boolean") {
+                    throw new Error(`command hook async flag for "${eventName}" must be boolean`);
+                }
+                const timeoutMs = rawCommand.timeout_ms;
+                if (timeoutMs !== undefined &&
+                    (typeof timeoutMs !== "number" ||
+                        !Number.isSafeInteger(timeoutMs) ||
+                        timeoutMs < 1 ||
+                        timeoutMs > MAX_PLUGIN_HOOK_TIMEOUT_MS)) {
+                    throw new Error(`command hook timeout for "${eventName}" must be an integer between 1 and ${MAX_PLUGIN_HOOK_TIMEOUT_MS}`);
+                }
+                if (supported && command.trim().length > 0) {
+                    parsedCommands.push({
+                        command,
+                        ...(rawCommand.async === undefined ? {} : { async: rawCommand.async }),
+                        ...(timeoutMs === undefined ? {} : { timeoutMs }),
+                    });
+                }
+            }
+            if (supported) {
+                parsedGroups.push({
+                    ...(matcher === undefined ? {} : { matcher: matcher }),
+                    hooks: parsedCommands,
+                });
+            }
+        }
+        if (supported) {
+            parsed.hooks[eventName] = parsedGroups;
+        }
+    }
+    return parsed;
+}
+/**
+ * Securely read and parse the one canonical hook file. All digest, approval,
+ * listing, and runtime decisions consume this snapshot so malformed or
+ * replaced files cannot be interpreted differently by separate code paths.
+ */
+export function inspectPluginHooks(installPath) {
+    const bytes = readBoundedRegularFile(installPath);
+    if (bytes === null)
+        return absentSnapshot();
+    if (bytes instanceof Error)
+        return invalidSnapshot(bytes.message);
+    try {
+        const definition = parseHooksDefinition(bytes);
+        return {
+            state: "valid",
+            digest: digestHooks(bytes),
+            definition,
+            hasExecutableHooks: Object.values(definition.hooks).some((groups) => groups?.some((group) => group.hooks.length > 0)),
+        };
+    }
+    catch (error) {
+        return invalidSnapshot(error instanceof Error ? error.message : String(error));
+    }
+}
+/**
+ * Digest the exact canonical hooks file after it passes the bounded parser.
+ * Valid and absent definitions preserve the existing v1 digest contract;
+ * every invalid definition shares a fail-closed sentinel digest.
+ */
+export function pluginHooksDigest(installPath) {
+    return inspectPluginHooks(installPath).digest;
+}
+/** Whether the bounded canonical definition currently contains an executable command hook. */
+export function pluginHasExecutableHooks(installPath) {
+    return inspectPluginHooks(installPath).hasExecutableHooks;
+}
+function reviewCommand(command) {
+    const truncated = command.length > MAX_PLUGIN_HOOK_REVIEW_COMMAND_LENGTH;
+    return {
+        command: truncated
+            ? `${command.slice(0, MAX_PLUGIN_HOOK_REVIEW_COMMAND_LENGTH - 1)}…`
+            : command,
+        commandDigest: createHash("sha256").update(command).digest("hex"),
+        ...(truncated ? { commandTruncated: true } : {}),
+    };
+}
+/** Build bounded, non-executable review metadata from one validated snapshot. */
+export function pluginHookReviewSnapshot(snapshot) {
+    if (!snapshot.definition)
+        return [];
+    const out = [];
+    for (const rawEvent of Object.keys(snapshot.definition.hooks)) {
+        for (const group of snapshot.definition.hooks[rawEvent] ?? []) {
+            for (const hook of group.hooks) {
+                out.push({
+                    rawEvent,
+                    ...(group.matcher === undefined ? {} : { matcher: group.matcher }),
+                    ...reviewCommand(hook.command),
+                    ...(hook.async === undefined ? {} : { async: hook.async }),
+                    ...(hook.timeoutMs === undefined ? {} : { timeoutMs: hook.timeoutMs }),
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Older installed_plugins.json entries predate hook digests and remain
+ * compatible as `legacy`. New entries fail closed when their effective hook
+ * file no longer matches the bytes approved by install/update.
+ */
+export function verifyPluginHookIntegrity(entry, snapshot = inspectPluginHooks(entry.installPath)) {
+    if (!entry.hookDigest)
+        return "legacy";
+    return snapshot.digest === entry.hookDigest ? "verified" : "changed";
+}
+/**
+ * Runtime trust state for one installed plugin. Legacy entries stay compatible;
+ * new entries with executable hooks remain pending until the approved digest
+ * matches the install-time digest. Invalid definitions always fail closed as
+ * hook-free regardless of legacy state.
+ */
+export function pluginHookApprovalState(entry, snapshot = inspectPluginHooks(entry.installPath)) {
+    if (!snapshot.hasExecutableHooks)
+        return "none";
+    const integrity = verifyPluginHookIntegrity(entry, snapshot);
+    if (integrity === "legacy")
+        return "legacy";
+    if (integrity === "changed")
+        return "changed";
+    return entry.approvedHookDigest === entry.hookDigest ? "approved" : "pending";
+}
+/**
+ * Integrity fields written at install/update. Hook-free packages approve the
+ * absent-hooks digest automatically; executable hooks require explicit trust.
+ * A previously approved identical digest remains approved across an update.
+ */
+export function pluginHookInstallRecord(installPath, previousEntries = []) {
+    const snapshot = inspectPluginHooks(installPath);
+    const previouslyApproved = previousEntries.find((entry) => entry.hookDigest === snapshot.digest && entry.approvedHookDigest === entry.hookDigest);
+    const previousReview = previousEntries.find((entry) => entry.approvedHookDigest === entry.hookDigest && entry.approvedHookSnapshot !== undefined)?.approvedHookSnapshot;
+    const approved = snapshot.state !== "invalid" && (!snapshot.hasExecutableHooks || previouslyApproved);
+    return {
+        hookDigest: snapshot.digest,
+        ...(approved ? { approvedHookDigest: snapshot.digest } : {}),
+        ...(approved
+            ? { approvedHookSnapshot: pluginHookReviewSnapshot(snapshot) }
+            : previousReview
+                ? { approvedHookSnapshot: previousReview }
+                : {}),
+    };
+}

package/dist/plugins/pluginInstaller.js

@@ -5,16 +5,26 @@
  * sparse-checkout, no npm/pip.
  */
 import { existsSync, realpathSync, rmSync, rmdirSync } from "node:fs";
-import { cp, mkdir, mkdtemp, rm } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, sep } from "node:path";
 import { homedir, tmpdir } from "node:os";
-import { gitClone, gitRevParseHead, gitSparseCheckoutAdd, githubRepoToCloneUrl, } from "./gitOps.js";
+import { gitClone, gitRevParseHead, gitSparseCheckoutAdd, githubRepoToCloneUrl } from "./gitOps.js";
 import { loadMarketplace } from "./marketplaceManager.js";
 import { readKnownMarketplaces } from "./knownMarketplaces.js";
 import { appendInstallEntry, pluginInstallKey, readInstalledPlugins, removeInstallEntries, } from "./installedPlugins.js";
 import { rewritePluginVars } from "./varRewrite.js";
+import { pluginHookInstallRecord } from "./pluginHookIntegrity.js";
+import { pluginMcpInstallRecord } from "./pluginMcpIntegrity.js";
 import { assertSafePluginName } from "./installer/paths.js";
 import { pruneDisabledSettingsForPlugin } from "./installer/pruneDisabled.js";
+import { detectPluginFormat } from "./installer/detectFormat.js";
+import { normalizePluginManifest } from "./installer/normalizeManifest.js";
+import { normalizePluginMcpMap, readPluginMcp } from "./installer/loadPluginMcp.js";
+import { convertCodexAgentsDirectory } from "./installer/codex/convertAgents.js";
+import { copyCodexCommands } from "./installer/codex/convertCommands.js";
+import { copyCodexHooks } from "./installer/codex/convertHooks.js";
+import { resolveCodexMcpServers } from "./installer/codex/convertMcp.js";
+import { CodexPluginManifest } from "./installer/types.js";
 import { resolveContainedPluginSubpath, validateRelativePluginSubpath, } from "./installer/sourcePath.js";
 function userHome() {
     return process.env.HOME ?? homedir();
@@ -81,6 +91,29 @@ export function resolveSafePluginPath(installPath, cacheRoot) {
         return null;
     return resolvedTarget;
 }
+async function projectMarketplacePluginRuntime(pluginDir, pluginName, format) {
+    if (format !== "codex")
+        return;
+    const manifest = CodexPluginManifest.parse(JSON.parse(await readFile(join(pluginDir, ".codex-plugin", "plugin.json"), "utf-8")));
+    // Marketplace installs already preserve the complete source package. Add
+    // only the CodeShell-native projections that runtime loaders consume.
+    await convertCodexAgentsDirectory(pluginDir, pluginDir, pluginName);
+    await copyCodexCommands(pluginDir, pluginDir);
+    await copyCodexHooks(pluginDir, pluginDir, manifest.hooks);
+    const servers = resolveCodexMcpServers(pluginDir, manifest.mcpServers);
+    const keyed = {};
+    for (const [serverName, config] of Object.entries(servers)) {
+        const key = `${pluginName}:${serverName}`;
+        keyed[key] = { ...config, name: key };
+    }
+    if (Object.keys(keyed).length > 0) {
+        const normalized = normalizePluginMcpMap(keyed, pluginName, true);
+        if (Object.keys(normalized).length !== Object.keys(keyed).length) {
+            throw new Error("invalid plugin MCP server declaration");
+        }
+        await writeFile(join(pluginDir, "mcp-servers.json"), JSON.stringify(normalized, null, 2), "utf-8");
+    }
+}
 async function materializePath(marketplaceInstallLocation, relativePath, cacheTarget) {
     const contained = resolveContainedPluginSubpath(marketplaceInstallLocation, relativePath, "plugin source path");
     if (!contained.ok) {
@@ -240,7 +273,10 @@ async function materialize(source, marketplaceInstallLocation, marketplace, plug
         await rm(placeholder, { recursive: true, force: true });
         return { ok: true, cacheDir: finalDir, version, sha: r.sha };
     }
-    return { ok: false, error: `unsupported source type "${source.source}"` };
+    return {
+        ok: false,
+        error: `unsupported source type "${source.source}"`,
+    };
 }
 /**
  * Install a plugin from a previously-added marketplace into the user
@@ -248,6 +284,8 @@ async function materialize(source, marketplaceInstallLocation, marketplace, plug
  * cached files and updates the manifest entry.
  */
 export async function installPlugin(pluginName, marketplaceName) {
+    const key = pluginInstallKey(pluginName, marketplaceName);
+    const previousEntries = readInstalledPlugins().plugins[key] ?? [];
     const known = readKnownMarketplaces();
     const km = known[marketplaceName];
     if (!km) {
@@ -265,7 +303,10 @@ export async function installPlugin(pluginName, marketplaceName) {
     }
     const entry = manifest.plugins.find((p) => p.name === pluginName);
     if (!entry) {
-        return { ok: false, error: `plugin "${pluginName}" not found in marketplace "${marketplaceName}".` };
+        return {
+            ok: false,
+            error: `plugin "${pluginName}" not found in marketplace "${marketplaceName}".`,
+        };
     }
     // materialize() validates every cache path segment (marketplace / plugin /
     // version) and throws a PluginInstallError on an unsafe one. Convert that to
@@ -281,17 +322,33 @@ export async function installPlugin(pluginName, marketplaceName) {
     }
     if (!mat.ok)
         return mat;
-    // Rewrite ${CLAUDE_PLUGIN_ROOT} → ${CODESHELL_PLUGIN_ROOT} across every
-    // text file in the materialized tree. Plugins authored against Claude
-    // Code's protocol bake CLAUDE_PLUGIN_ROOT into hooks.json and shell
-    // scripts; we normalize at install time so the runtime only ever sets
-    // CODESHELL_PLUGIN_ROOT and host-detection branches in plugin scripts
-    // pick the codeshell-native code path. The breadcrumb file dropped at
-    // the root documents the rewrite for users debugging upstream diffs.
+    // Project Codex package components into the same runtime-native layout used
+    // by local/direct installs, then validate and freeze the author manifest
+    // before the install becomes visible in installed_plugins.json.
+    try {
+        const format = detectPluginFormat(mat.cacheDir);
+        await projectMarketplacePluginRuntime(mat.cacheDir, pluginName, format);
+        await normalizePluginManifest(mat.cacheDir, {
+            name: pluginName,
+            version: entry.version ?? mat.version,
+            format,
+            destinationRoot: mat.cacheDir,
+        });
+    }
+    catch (error) {
+        await rm(mat.cacheDir, { recursive: true, force: true });
+        return {
+            ok: false,
+            error: `invalid plugin manifest: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    // Rewrite Claude-specific plugin root/data variables across every text file
+    // in the materialized tree. The runtime exposes CodeShell-native names plus
+    // Codex aliases, while keeping Claude host-detection variables unset. The
+    // breadcrumb documents the rewrite for users debugging upstream diffs.
     const rewriteSummary = rewritePluginVars(mat.cacheDir);
     // Remove old install entries for the same key so we don't pile up
     // historical versions (Phase A: single-scope only).
-    const key = pluginInstallKey(pluginName, marketplaceName);
     removeInstallEntries(key);
     const now = new Date().toISOString();
     const installEntry = {
@@ -301,6 +358,8 @@ export async function installPlugin(pluginName, marketplaceName) {
         installedAt: now,
         lastUpdated: now,
         ...(mat.sha ? { gitCommitSha: mat.sha } : {}),
+        ...pluginHookInstallRecord(mat.cacheDir, previousEntries),
+        ...pluginMcpInstallRecord(mat.cacheDir, Object.keys(readPluginMcp(mat.cacheDir, pluginName)).length > 0, previousEntries),
     };
     appendInstallEntry(key, installEntry);
     return {

package/dist/plugins/pluginMcpApproval.d.ts

@@ -0,0 +1,19 @@
+import { type PluginMcpApprovalState } from "./pluginMcpIntegrity.js";
+export interface PluginMcpTrustEntry {
+    installKey: string;
+    plugin: string;
+    serverNames: string[];
+    status: PluginMcpApprovalState;
+}
+export interface PluginMcpApprovalResult extends PluginMcpTrustEntry {
+    changed: boolean;
+}
+/** List every installed plugin's MCP trust without merging user MCP config. */
+export declare function listPluginMcpTrust(): PluginMcpTrustEntry[];
+/** Approve only the install-time MCP bytes; tampered bytes require update/reinstall. */
+export declare function approvePluginMcp(target: string): PluginMcpApprovalResult[];
+/**
+ * Revoke plugin MCP execution. Legacy entries first record their current
+ * digest, preventing revocation from falling back to legacy compatibility.
+ */
+export declare function revokePluginMcp(target: string): PluginMcpApprovalResult[];