@claude-flow/cli 3.63.9 → 3.65.0

package/dist/src/mods/plugin-paths.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ADR-510 — where a ruflo plugin lives on disk, for a headless `claude -p`
+ * worker (`--plugin-dir <path>`) or an Agent SDK session
+ * (`plugins: [{ type: "local", path }]`).
+ *
+ * `claude -p` on a fresh config loads no marketplace plugins: the marketplace
+ * is cloned only by an interactive, trusted start. So a worker has to be told
+ * where each plugin is. Sources, in order:
+ *
+ *   1. a `--source local` directory marketplace (a ruflo checkout) that Claude
+ *      Code itself records in the user-level `known_marketplaces.json`, i.e.
+ *      one the user added through an interactive, trusted start;
+ *   2. the marketplace clone (`<config>/plugins/marketplaces/ruflo/...`);
+ *   3. the install cache (`<config>/plugins/cache/ruflo/<name>/<version>`).
+ *
+ * A folder without `.claude-plugin/plugin.json` is never returned: the plugin
+ * is reported missing instead. Read-only; the filesystem is injectable.
+ *
+ * Trust: nothing inside the project decides the path. A repository's own
+ * `.claude/settings.json` / `settings.local.json` (`extraKnownMarketplaces`)
+ * is never read here: interactive Claude Code gates a project-declared
+ * marketplace behind workspace trust, but `--plugin-dir` loads with no prompt
+ * and replaces the user's installed copy of the same name. Letting a cloned
+ * repo point the headless worker at its own folder would run repo-supplied
+ * function hooks in every daemon worker, in place of the user's guard.
+ */
+import { type ReadFs } from './plugin-resolve.js';
+export type PluginSource = 'local' | 'clone' | 'cache';
+export interface ResolvedPlugin {
+    name: string;
+    /** Absolute plugin folder (the one holding `.claude-plugin/plugin.json`). */
+    path: string;
+    source: PluginSource;
+}
+export interface MissingPlugin {
+    name: string;
+    reason: string;
+}
+export interface PluginPaths {
+    resolved: ResolvedPlugin[];
+    missing: MissingPlugin[];
+}
+/** ReadFs plus a directory listing (for the install cache's version folders). */
+export interface PluginFs extends ReadFs {
+    list(path: string): string[];
+}
+export declare const nodePluginFs: PluginFs;
+export interface ResolveOptions {
+    /**
+     * Accepted for callers' convenience but deliberately not consulted: the
+     * project's own settings never choose a headless plugin folder (see "Trust").
+     */
+    projectRoot?: string;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    fs?: PluginFs;
+}
+/** Resolve each plugin name (e.g. `ruflo-mods`) to an absolute folder, or report it missing. */
+export declare function resolvePluginPaths(names: readonly string[], opts?: ResolveOptions): PluginPaths;
+//# sourceMappingURL=plugin-paths.d.ts.map

package/dist/src/mods/plugin-paths.js

@@ -0,0 +1,131 @@
+/**
+ * ADR-510 — where a ruflo plugin lives on disk, for a headless `claude -p`
+ * worker (`--plugin-dir <path>`) or an Agent SDK session
+ * (`plugins: [{ type: "local", path }]`).
+ *
+ * `claude -p` on a fresh config loads no marketplace plugins: the marketplace
+ * is cloned only by an interactive, trusted start. So a worker has to be told
+ * where each plugin is. Sources, in order:
+ *
+ *   1. a `--source local` directory marketplace (a ruflo checkout) that Claude
+ *      Code itself records in the user-level `known_marketplaces.json`, i.e.
+ *      one the user added through an interactive, trusted start;
+ *   2. the marketplace clone (`<config>/plugins/marketplaces/ruflo/...`);
+ *   3. the install cache (`<config>/plugins/cache/ruflo/<name>/<version>`).
+ *
+ * A folder without `.claude-plugin/plugin.json` is never returned: the plugin
+ * is reported missing instead. Read-only; the filesystem is injectable.
+ *
+ * Trust: nothing inside the project decides the path. A repository's own
+ * `.claude/settings.json` / `settings.local.json` (`extraKnownMarketplaces`)
+ * is never read here: interactive Claude Code gates a project-declared
+ * marketplace behind workspace trust, but `--plugin-dir` loads with no prompt
+ * and replaces the user's installed copy of the same name. Letting a cloned
+ * repo point the headless worker at its own folder would run repo-supplied
+ * function hooks in every daemon worker, in place of the user's guard.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { MARKETPLACE_NAME } from './install.js';
+import { claudeConfigDir, marketplaceState, nodeReadFs, pluginManifestIn } from './plugin-resolve.js';
+export const nodePluginFs = {
+    ...nodeReadFs,
+    list: (p) => {
+        try {
+            return existsSync(p) ? readdirSync(p) : [];
+        }
+        catch {
+            return [];
+        }
+    },
+};
+const MANIFEST = join('.claude-plugin', 'plugin.json');
+function readJson(fs, path) {
+    const text = fs.readText(path);
+    if (text === undefined)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+/**
+ * The directory marketplace Claude Code knows as `ruflo`, from the user-level
+ * `known_marketplaces.json` only (see "Trust" above). A relative path is
+ * rejected: Claude Code records absolute ones, and a relative path would
+ * resolve against whatever directory the worker happens to start in.
+ */
+function localMarketplaceDir(configDir, fs) {
+    const market = marketplaceState(configDir, fs);
+    if (market.source?.source !== 'directory')
+        return null;
+    const declared = typeof market.source.path === 'string' ? market.source.path : null;
+    const dir = market.location ?? declared;
+    return dir && isAbsolute(dir) && (!declared || isAbsolute(declared)) ? dir : null;
+}
+/** Numeric-aware version compare ("0.10.0" > "0.9.3"); non-numeric parts compare as text. */
+function compareVersions(a, b) {
+    const pa = a.split(/[.-]/);
+    const pb = b.split(/[.-]/);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = pa[i] ?? '';
+        const y = pb[i] ?? '';
+        const nx = /^\d+$/.test(x) ? Number(x) : NaN;
+        const ny = /^\d+$/.test(y) ? Number(y) : NaN;
+        const d = !Number.isNaN(nx) && !Number.isNaN(ny) ? nx - ny : x.localeCompare(y);
+        if (d !== 0)
+            return d;
+    }
+    return 0;
+}
+/** The cached install: installed_plugins.json's path first, else the highest version folder. */
+function cachedPluginDir(configDir, name, fs) {
+    const record = readJson(fs, join(configDir, 'plugins', 'installed_plugins.json'));
+    const plugins = isRecord(record) && isRecord(record.plugins) ? record.plugins : undefined;
+    const entries = plugins && Array.isArray(plugins[`${name}@${MARKETPLACE_NAME}`]) ? plugins[`${name}@${MARKETPLACE_NAME}`] : [];
+    for (const e of entries) {
+        if (isRecord(e) && typeof e.installPath === 'string' && fs.exists(join(e.installPath, MANIFEST)))
+            return e.installPath;
+    }
+    const base = join(configDir, 'plugins', 'cache', MARKETPLACE_NAME, name);
+    const versions = fs.list(base).filter((v) => fs.exists(join(base, v, MANIFEST))).sort(compareVersions);
+    return versions.length > 0 ? join(base, versions[versions.length - 1]) : null;
+}
+/** Plugin folder from a marketplace root (its marketplace.json `source`, else plugins/<name>). */
+function pluginDirIn(root, name, fs) {
+    const manifest = pluginManifestIn(root, `${name}@${MARKETPLACE_NAME}`, fs);
+    return fs.exists(manifest) ? dirname(dirname(manifest)) : null;
+}
+/** Resolve each plugin name (e.g. `ruflo-mods`) to an absolute folder, or report it missing. */
+export function resolvePluginPaths(names, opts = {}) {
+    const env = opts.env ?? process.env;
+    const fs = opts.fs ?? nodePluginFs;
+    const configDir = claudeConfigDir(env, opts.home ?? homedir());
+    const local = localMarketplaceDir(configDir, fs);
+    const market = marketplaceState(configDir, fs);
+    const clone = market.source?.source === 'directory' ? null : market.location;
+    const out = { resolved: [], missing: [] };
+    for (const raw of names) {
+        const name = raw.split('@')[0].trim();
+        if (!name)
+            continue;
+        const fromLocal = local ? pluginDirIn(local, name, fs) : null;
+        const fromClone = !fromLocal && clone ? pluginDirIn(clone, name, fs) : null;
+        const fromCache = !fromLocal && !fromClone ? cachedPluginDir(configDir, name, fs) : null;
+        const hit = [[fromLocal, 'local'], [fromClone, 'clone'], [fromCache, 'cache']];
+        const found = hit.find(([p]) => p !== null);
+        if (found) {
+            out.resolved.push({ name, path: resolve(found[0]), source: found[1] });
+        }
+        else {
+            const looked = [local && `local marketplace ${local}`, clone && `clone ${clone}`, `cache ${join(configDir, 'plugins', 'cache', MARKETPLACE_NAME, name)}`].filter(Boolean);
+            out.missing.push({ name, reason: `no ${MANIFEST} in ${looked.join(', ')}` });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=plugin-paths.js.map

package/dist/src/mods/plugin-repair.d.ts

@@ -47,6 +47,14 @@ export interface RepairOptions {
     exec?: Exec;
     env?: NodeJS.ProcessEnv;
     fs?: ReadFs;
+    /**
+     * ADR-509 §2.2: called once the marketplace step has refreshed the clone and
+     * before any `claude plugin install`; a plugin id it returns is not installed
+     * (its step is a failure naming the reason).
+     */
+    beforeInstall?: (clone: string | null) => {
+        blocked: ReadonlyMap<string, string>;
+    };
 }
 /**
  * `update` when Claude Code already knows ruflo by the wanted source; else

package/dist/src/mods/plugin-repair.js

@@ -88,9 +88,16 @@ export async function repairPluginInstall(opts) {
             steps.push({ argv: installArgv(p.id, opts.scope), state: 'failed', output: `${p.id} is not in ${wanted.source.path}` });
         return { ok: missing.length === 0, steps };
     }
+    const gate = opts.beforeInstall?.(market.location);
     let ok = true;
     for (const plugin of plugins) {
         const argv = installArgv(plugin.id, opts.scope);
+        const blocked = gate?.blocked.get(plugin.id);
+        if (blocked) {
+            steps.push({ argv, state: 'failed', output: blocked });
+            ok = false;
+            continue;
+        }
         if (!cloneHas(market, plugin.id, fs)) {
             steps.push({ argv, state: plugin.required ? 'failed' : 'pending', output: `${plugin.id} is not in the ruflo marketplace${plugin.required ? ' even after the update' : ' yet (pending)'}` });
             ok &&= !plugin.required;

package/dist/src/plugins/marketplace-trust/scan.d.ts

@@ -0,0 +1,23 @@
+export type ScanSeverity = 'high' | 'medium';
+export interface ScanFinding {
+    plugin: string;
+    severity: ScanSeverity;
+    file: string;
+    rule: string;
+    detail: string;
+}
+/** Every finding for one plugin directory; empty when the plugin runs nothing on install. */
+export declare function scanPluginDir(plugin: string, root: string): ScanFinding[];
+export declare const formatScanFinding: (f: ScanFinding) => string;
+export interface ScanGate {
+    /** Plugins with a high finding that were not accepted: their install must not run. */
+    blocked: string[];
+    /** Plugins with a high finding that --accept-risk let through. */
+    accepted: string[];
+    findings: ScanFinding[];
+}
+/** Applies §2.2: a high finding blocks, unless the plugin is named in acceptRisk. */
+export declare function gateScan(findings: readonly ScanFinding[], acceptRisk: ReadonlySet<string>): ScanGate;
+/** `--accept-risk a,b` or repeated: plugin names (or ids) to install past a high scan finding (ADR-509 §2.2). */
+export declare function acceptRiskFrom(flags: Record<string, unknown>): string[];
+//# sourceMappingURL=scan.d.ts.map

package/dist/src/plugins/marketplace-trust/scan.js

@@ -0,0 +1,255 @@
+/**
+ * Static scan of a Claude Code plugin before it is installed (ADR-509 §2.2).
+ *
+ * Reads what the plugin will make Claude Code run: `.mcp.json` servers,
+ * `hooks/hooks.json` command hooks, and its hook modules (function hooks).
+ * Rules: the settings-risk-scanner command rules for anything that becomes a
+ * shell command, and the ruflo-mods trust classifier's capability names for
+ * hook modules (`$.process.*`, `$.http.*`, `$.mcp.*`, `$.tool.call`, ...).
+ *
+ * `high` stops an install (override per plugin with --accept-risk); `medium`
+ * is printed and the install continues. Static by design: a hook that fetches
+ * code at run time is caught only by the network/process rules (ADR-509 §3).
+ */
+import { existsSync, lstatSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { scanCommandStringForRisk } from '../../init/settings-risk-scanner.js';
+/** Hook-module capabilities, named as the ruflo-mods trust classifier (hooks/trust.ts RISKY_CALLS) names them. */
+const MODULE_CAPABILITIES = [
+    { re: /\$\s*\.\s*process\s*\.\s*(run|spawn)\b/, rule: 'module-process', detail: 'runs host commands ($.process)' },
+    { re: /\$\s*\.\s*http\s*\.\s*fetch\b/, rule: 'module-network', detail: 'makes network requests ($.http.fetch)' },
+    { re: /\$\s*\.\s*mcp\s*\.\s*(call|connect)\b/, rule: 'module-mcp', detail: 'calls or connects MCP servers ($.mcp)' },
+    { re: /\$\s*\.\s*tool\s*\.\s*call\b/, rule: 'module-tool-call', detail: 'runs any tool, Bash included ($.tool.call)' },
+    { re: /\$\s*\.\s*config\s*\.\s*set\b/, rule: 'module-config', detail: 'changes Claude Code settings ($.config.set)' },
+];
+/** Node escape hatches a hook module should never need: they bypass the host's `$` entirely. */
+const MODULE_ESCAPES = [
+    { re: /(?:\brequire\s*\(\s*|\bimport\s*\(\s*|\bfrom\s+|\bimport\s+)['"](?:node:)?child_process['"]/, rule: 'module-child-process', detail: 'imports child_process (runs commands outside the host)' },
+    { re: /\beval\s*\(|\bnew\s+Function\s*\(/, rule: 'module-dynamic-code', detail: 'evaluates code built at run time (eval / new Function)' },
+];
+const MODULE_EXT = /\.(ts|mts|cts|tsx|js|mjs|cjs|jsx)$/;
+const MAX_FILE_BYTES = 1024 * 1024;
+const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function scanMcp(plugin, root, out) {
+    const file = '.mcp.json';
+    if (!existsSync(join(root, file)))
+        return;
+    const parsed = readJson(join(root, file));
+    const servers = record(parsed) && record(parsed.mcpServers) ? parsed.mcpServers : record(parsed) ? parsed : {};
+    for (const [name, raw] of Object.entries(servers)) {
+        if (!record(raw))
+            continue;
+        const command = typeof raw.command === 'string' ? raw.command : '';
+        const args = Array.isArray(raw.args) ? raw.args.filter((a) => typeof a === 'string') : [];
+        const line = [command, ...args].join(' ').trim();
+        if (line) {
+            for (const reason of scanCommandStringForRisk(line))
+                out.push({ plugin, severity: 'high', file, rule: 'mcp-command', detail: `server "${name}" ${reason}` });
+            // `npx -y pkg` / `npx pkg@latest` runs whatever the registry serves at start time.
+            if (/(^|\s)(npx|bunx|pnpx)(\s|$)/.test(line) && (/(^|\s)-y(\s|$)|--yes\b/.test(line) || /@latest\b/.test(line))) {
+                out.push({ plugin, severity: 'medium', file, rule: 'mcp-unpinned-package', detail: `server "${name}" runs an unpinned package at start (${line.slice(0, 80)})` });
+            }
+        }
+        if (typeof raw.url === 'string' && /^http:\/\//i.test(raw.url) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/i.test(raw.url)) {
+            out.push({ plugin, severity: 'medium', file, rule: 'mcp-plain-http', detail: `server "${name}" connects over plain http to a remote host` });
+        }
+    }
+}
+function scanHooksJson(plugin, root, out) {
+    const file = 'hooks/hooks.json';
+    if (!existsSync(join(root, file)))
+        return;
+    const parsed = readJson(join(root, file));
+    const hooks = record(parsed) && record(parsed.hooks) ? parsed.hooks : {};
+    for (const [event, groups] of Object.entries(hooks)) {
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            const list = record(group) && Array.isArray(group.hooks) ? group.hooks : [];
+            for (const h of list) {
+                if (!record(h) || typeof h.command !== 'string')
+                    continue;
+                for (const reason of scanCommandStringForRisk(h.command))
+                    out.push({ plugin, severity: 'high', file, rule: 'hook-command', detail: `${event}: ${reason}` });
+            }
+        }
+    }
+}
+/** Hook-module files under hooks/, for coverage beyond what hooks.json lists (tests, oversize files skipped). */
+function moduleFiles(root) {
+    const out = [];
+    const walk = (rel, depth) => {
+        if (depth > 6)
+            return;
+        let names;
+        try {
+            names = readdirSync(join(root, rel));
+        }
+        catch {
+            return;
+        }
+        for (const name of names.sort()) {
+            if (name === 'node_modules' || name === '.git' || name === 'tests' || name === '__tests__')
+                continue;
+            const childRel = `${rel}/${name}`;
+            const st = lstatSync(join(root, childRel));
+            if (st.isDirectory())
+                walk(childRel, depth + 1);
+            else if (st.isFile() && MODULE_EXT.test(name) && !/\.(test|spec)\.[a-z]+$/.test(name) && st.size <= MAX_FILE_BYTES)
+                out.push(childRel);
+        }
+    };
+    if (existsSync(join(root, 'hooks')))
+        walk('hooks', 0);
+    return out;
+}
+// Static module specifiers: import/export ... from, side-effect import, import(), require().
+const SPECIFIERS = [
+    /\bfrom\s*['"`]([^'"`\n]+)['"`]/g,
+    /\bimport\s*['"`]([^'"`\n]+)['"`]/g,
+    /\bimport\s*\(\s*['"`]([^'"`\n]+)['"`]\s*[,)]/g,
+    /\brequire\s*\(\s*['"`]([^'"`\n]+)['"`]\s*\)/g,
+];
+// import(x) / require(x) with a computed argument: what it loads cannot be read statically.
+const COMPUTED_LOAD = /\b(?:import|require)\s*\(\s*(?![\s'"]|`[^`$]*`)/;
+const MAX_MODULES = 2000;
+// `import type … from` / `export type … from` are erased by the TypeScript loader: nothing loads.
+const TYPE_ONLY = /\b(?:import|export)\s+type\s+[^;'"`]{0,2000}?\bfrom\s*['"][^'"\n]+['"]/g;
+function relativeSpecifiers(text) {
+    const out = new Set();
+    const loaded = text.replace(TYPE_ONLY, '');
+    for (const re of SPECIFIERS)
+        for (const m of loaded.matchAll(re))
+            if (m[1].startsWith('./') || m[1].startsWith('../'))
+                out.add(m[1]);
+    return [...out];
+}
+/** Node / TypeScript-style resolution of a relative specifier: exact, + extension, .js→.ts, index.*. */
+function resolveSpecifier(fromDir, spec) {
+    const base = resolve(fromDir, spec);
+    const exts = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+    const swapped = /\.(c|m)?js$/.test(base) ? [base.replace(/\.js$/, '.ts').replace(/\.mjs$/, '.mts').replace(/\.cjs$/, '.cts')] : [];
+    const candidates = [base, ...swapped, ...exts.map((e) => base + e), ...exts.map((e) => join(base, `index${e}`))];
+    for (const c of candidates) {
+        try {
+            if (statSync(c).isFile())
+                return c;
+        }
+        catch {
+            // try the next
+        }
+    }
+    return null;
+}
+const relTo = (root, abs) => relative(root, abs).split(sep).join('/');
+/**
+ * What the engine actually loads: the hooks.json \`modules\` (resolved against
+ * hooks.json's directory) and every relative import they reach. None of the
+ * walk's skips apply here: a listed or imported file is scanned whatever its
+ * name or size, and one that cannot be read or is too large is itself a high
+ * finding (\`unscannable\`), never silently passed.
+ */
+function scanLoadedModules(plugin, root, out, scanned) {
+    const hooksJson = join(root, 'hooks', 'hooks.json');
+    if (!existsSync(hooksJson))
+        return;
+    const parsed = readJson(hooksJson);
+    const listed = record(parsed) && Array.isArray(parsed.modules) ? parsed.modules : [];
+    const queue = [];
+    for (const m of listed) {
+        if (typeof m !== 'string')
+            continue;
+        const abs = resolveSpecifier(dirname(hooksJson), m) ?? resolve(dirname(hooksJson), m);
+        queue.push({ abs, from: 'hooks/hooks.json' });
+    }
+    const rootAbs = resolve(root);
+    while (queue.length) {
+        const { abs, from } = queue.shift();
+        if (scanned.has(abs))
+            continue;
+        scanned.add(abs);
+        const file = relTo(rootAbs, abs);
+        if (scanned.size > MAX_MODULES) {
+            out.push({ plugin, severity: 'high', file, rule: 'unscannable', detail: `more than ${MAX_MODULES} modules reachable from hooks.json` });
+            return;
+        }
+        if (file.startsWith('../') || isAbsolute(file)) {
+            out.push({ plugin, severity: 'high', file, rule: 'module-outside-plugin', detail: `loaded by ${from} but outside the plugin directory` });
+        }
+        let text;
+        try {
+            const st = lstatSync(abs);
+            if (!st.isFile())
+                throw new Error(st.isSymbolicLink() ? 'a symbolic link' : 'not a regular file');
+            if (st.size > MAX_FILE_BYTES)
+                throw new Error(`${st.size} bytes, over the ${MAX_FILE_BYTES}-byte scan limit`);
+            text = readFileSync(abs, 'utf-8');
+        }
+        catch (error) {
+            const code = error.code;
+            out.push({ plugin, severity: 'high', file, rule: 'unscannable', detail: `loaded by ${from} but cannot be scanned (${code === 'ENOENT' ? 'missing' : error.message})` });
+            continue;
+        }
+        scanText(plugin, file, text, out);
+        if (COMPUTED_LOAD.test(text))
+            out.push({ plugin, severity: 'high', file, rule: 'module-computed-import', detail: 'loads a module whose name is computed at run time (import()/require() of a non-literal)' });
+        for (const spec of relativeSpecifiers(text)) {
+            const next = resolveSpecifier(dirname(abs), spec);
+            if (next)
+                queue.push({ abs: next, from: file });
+            else
+                out.push({ plugin, severity: 'medium', file, rule: 'module-unresolved-import', detail: `imports ${spec}, which does not resolve to a file` });
+        }
+    }
+}
+function scanText(plugin, file, text, out) {
+    for (const r of MODULE_ESCAPES)
+        if (r.re.test(text))
+            out.push({ plugin, severity: 'high', file, rule: r.rule, detail: r.detail });
+    for (const r of MODULE_CAPABILITIES)
+        if (r.re.test(text))
+            out.push({ plugin, severity: 'medium', file, rule: r.rule, detail: r.detail });
+}
+function scanModules(plugin, root, out) {
+    const scanned = new Set();
+    scanLoadedModules(plugin, root, out, scanned);
+    for (const file of moduleFiles(root)) {
+        const abs = resolve(root, file);
+        if (scanned.has(abs))
+            continue;
+        scanned.add(abs);
+        scanText(plugin, file, readFileSync(abs, 'utf-8'), out);
+    }
+}
+/** Every finding for one plugin directory; empty when the plugin runs nothing on install. */
+export function scanPluginDir(plugin, root) {
+    const out = [];
+    if (!existsSync(root))
+        return out;
+    scanMcp(plugin, root, out);
+    scanHooksJson(plugin, root, out);
+    scanModules(plugin, root, out);
+    return out;
+}
+export const formatScanFinding = (f) => `[${f.severity}] ${f.plugin}: ${f.file} (${f.rule}) ${f.detail}`;
+/** Applies §2.2: a high finding blocks, unless the plugin is named in acceptRisk. */
+export function gateScan(findings, acceptRisk) {
+    const high = new Set(findings.filter((f) => f.severity === 'high').map((f) => f.plugin));
+    const accepted = [...high].filter((p) => acceptRisk.has(p));
+    return { blocked: [...high].filter((p) => !acceptRisk.has(p)), accepted, findings: [...findings] };
+}
+/** `--accept-risk a,b` or repeated: plugin names (or ids) to install past a high scan finding (ADR-509 §2.2). */
+export function acceptRiskFrom(flags) {
+    const raw = flags.acceptRisk ?? flags['accept-risk'];
+    const list = Array.isArray(raw) ? raw : typeof raw === 'string' ? [raw] : [];
+    return list.flatMap((v) => String(v).split(',')).map((v) => v.trim()).filter((v) => /^[A-Za-z0-9._-]{1,100}(@[A-Za-z0-9._-]{1,100})?$/.test(v));
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/plugins/marketplace-trust/signature.d.ts

@@ -0,0 +1,53 @@
+export declare const SIGNATURE_RELATIVE = ".claude-plugin/signature.json";
+export interface PluginFileEntry {
+    path: string;
+    sha256: string;
+}
+export interface PluginManifest {
+    plugin: string;
+    version: string;
+    files: PluginFileEntry[];
+}
+export interface SignedPluginManifest {
+    manifest: PluginManifest;
+    signature: string;
+    algorithm: 'ed25519';
+}
+export type VerifyResult = 'verified' | 'modified' | 'unsigned' | 'bad-signature';
+export interface PluginVerification {
+    plugin: string;
+    dir: string;
+    result: VerifyResult;
+    /** Files whose digest differs from the signed one. */
+    changed: string[];
+    /** Signed files that are gone. */
+    missing: string[];
+    /** Files present on disk that the signature does not list. */
+    extra: string[];
+    version?: string;
+}
+/** Canonical bytes: fixed key order, files sorted by path. MUST match scripts/sign-plugins.mjs. */
+export declare function canonicalPluginManifestBytes(m: PluginManifest): Buffer;
+/**
+ * Every file under a plugin root, as posix paths, excluding the signature
+ * itself. A symlink is an entry of its own (digest of `link:<target>`), never
+ * followed: following it would let a link swap in content the digest never saw.
+ */
+export declare function digestPluginDir(root: string): PluginFileEntry[];
+/** Signature check only: true when `signed.signature` verifies over its manifest. */
+export declare function signatureValid(signed: SignedPluginManifest, pubkeyPem?: string): boolean;
+/**
+ * Check a plugin directory against its signature.json. `expectName` (the
+ * marketplace name) must match the signed plugin name: a valid signature
+ * copied from another plugin is a bad signature here, not a pass.
+ */
+export declare function verifyPluginDir(dir: string, expectName: string, pubkeyPem?: string): PluginVerification;
+export interface MarketplacePlugin {
+    name: string;
+    dir: string;
+}
+/** The plugins a marketplace clone lists, each with its directory (its `source`, else plugins/<name>). */
+export declare function listMarketplacePlugins(clone: string): MarketplacePlugin[];
+/** One line per verification, with the differing files named (capped). */
+export declare function describeVerification(v: PluginVerification, cap?: number): string;
+//# sourceMappingURL=signature.d.ts.map