@claude-flow/cli 3.64.0 → 3.65.1

package/dist/src/mods/headless-plugins.js

@@ -0,0 +1,92 @@
+/**
+ * ADR-510 §2.2 — give a headless `claude -p` worker its ruflo plugins.
+ *
+ * Every place ruflo builds a `claude -p` command line passes its argv and env
+ * through `withHeadlessPlugins`. It appends `--plugin-dir <path>` per plugin
+ * in the worker profile (default: ruflo-mods) and sets
+ * `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1` unless the caller set it (a caller's
+ * `0` stays `0`). A caller's own `--plugin-dir` for the same plugin is never
+ * duplicated.
+ *
+ * A plugin that cannot be resolved does not stop the worker: it is logged once
+ * per process ("plugin <name> not found; worker runs without it") and returned
+ * in `missing` for the worker's status.
+ *
+ * Profile override: `RUFLO_HEADLESS_PLUGINS` is a comma list of plugin names;
+ * `none` (or an empty value) turns plugin loading off.
+ */
+import { realpathSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { ENABLE_ENV } from './install.js';
+import { resolvePluginPaths } from './plugin-paths.js';
+export const DEFAULT_WORKER_PLUGINS = ['ruflo-mods'];
+export const PROFILE_ENV = 'RUFLO_HEADLESS_PLUGINS';
+const warned = new Set();
+/** For tests: forget which missing plugins were already logged. */
+export function resetHeadlessPluginWarnings() {
+    warned.clear();
+}
+/** The worker profile: explicit, else RUFLO_HEADLESS_PLUGINS, else ruflo-mods. */
+export function workerProfile(env = process.env, explicit) {
+    if (explicit)
+        return [...explicit];
+    const raw = env[PROFILE_ENV];
+    if (raw === undefined)
+        return [...DEFAULT_WORKER_PLUGINS];
+    const names = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    return names.length === 1 && names[0].toLowerCase() === 'none' ? [] : names;
+}
+function canonical(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/** Every `--plugin-dir` value already in argv (both `--plugin-dir x` and `--plugin-dir=x`). */
+export function existingPluginDirs(argv) {
+    const dirs = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--plugin-dir' && i + 1 < argv.length)
+            dirs.push(argv[++i]);
+        else if (a.startsWith('--plugin-dir='))
+            dirs.push(a.slice('--plugin-dir='.length));
+    }
+    return dirs;
+}
+export function withHeadlessPlugins(argv, env, opts = {}) {
+    const profile = workerProfile(opts.env ?? env, opts.profile);
+    const outArgv = [...argv];
+    const outEnv = { ...env };
+    if (profile.length === 0)
+        return { argv: outArgv, env: outEnv, added: [], missing: [] };
+    const resolver = opts.resolver ?? resolvePluginPaths;
+    const { resolved, missing } = resolver(profile, { ...opts, env: opts.env ?? env });
+    const own = existingPluginDirs(argv);
+    const ownPaths = new Set(own.map(canonical));
+    const ownNames = new Set(own.map((d) => basename(resolve(d))));
+    const added = [];
+    for (const plugin of resolved) {
+        // The caller already passes this plugin (same folder, or its own copy of it).
+        if (ownPaths.has(canonical(plugin.path)) || ownNames.has(plugin.name))
+            continue;
+        outArgv.push('--plugin-dir', plugin.path);
+        added.push(plugin.name);
+    }
+    // A caller-supplied copy of a "missing" plugin is not missing.
+    const stillMissing = missing.filter((m) => !ownNames.has(m.name)).map((m) => m.name);
+    if ((added.length > 0 || own.length > 0) && outEnv[ENABLE_ENV] === undefined) {
+        outEnv[ENABLE_ENV] = '1';
+    }
+    const warn = opts.warn ?? ((line) => process.stderr.write(`${line}\n`));
+    for (const name of stillMissing) {
+        if (warned.has(name))
+            continue;
+        warned.add(name);
+        warn(`plugin ${name} not found; worker runs without it`);
+    }
+    return { argv: outArgv, env: outEnv, added, missing: stillMissing };
+}
+//# sourceMappingURL=headless-plugins.js.map

package/dist/src/mods/install-trust.d.ts

@@ -0,0 +1,28 @@
+import { type PluginVerification } from '../plugins/marketplace-trust/signature.js';
+import { type ModPlugin } from './install.js';
+import { type ReadFs } from './plugin-resolve.js';
+/**
+ * Scan each plugin the clone carries. Returns the plugin ids whose install must
+ * not run, each with the reason; prints every finding; records --accept-risk.
+ */
+export declare function scanBeforeInstall(root: string, clone: string | null, plugins: readonly ModPlugin[], acceptRisk: ReadonlySet<string>, fs?: ReadFs, 
+/** Lines already printed / overrides already recorded by an earlier scan in the same run (scanned before enabling, then again after the clone refresh). */
+seen?: Set<string>): {
+    blocked: Map<string, string>;
+};
+/** Verify the clone's ruflo plugins and write the status file; prints one line per non-verified plugin. */
+export declare function verifyAndRecord(configDir: string, clone: string | null, names: readonly string[], home?: string): PluginVerification[];
+export interface SignatureFinding {
+    name: string;
+    status: 'pass' | 'warn';
+    message: string;
+    fix?: string;
+}
+/**
+ * `ruflo mods doctor` (§2.1): one finding per ruflo mod plugin from its clone
+ * and install-cache signatures; writes the status file the mod's trust gate
+ * reads. `modified` / `bad-signature` warn: they are enforced only under
+ * modTrust: refuse-risky, since a local checkout is always modified.
+ */
+export declare function signatureFindings(configDir: string, clone: string | null, names: readonly string[], home?: string): SignatureFinding[];
+//# sourceMappingURL=install-trust.d.ts.map

package/dist/src/mods/install-trust.js

@@ -0,0 +1,127 @@
+/**
+ * ADR-509 on the `ruflo mods install` / `ruflo init` (mods) path: scan each
+ * plugin in the refreshed marketplace clone before `claude plugin install`
+ * (§2.2), and after the install verify the clone against its signatures and
+ * write the status file the ruflo-mods trust gate reads (§2.1): per plugin the
+ * worst of its clone and install-cache copies, and each copy by its directory.
+ */
+import { homedir } from 'node:os';
+import { dirname } from 'node:path';
+import { output } from '../output.js';
+import { formatScanFinding, gateScan, scanPluginDir } from '../plugins/marketplace-trust/scan.js';
+import { describeVerification } from '../plugins/marketplace-trust/signature.js';
+import { verifyClone, verifyInstallCache, writeVerifyStatus } from '../plugins/marketplace-trust/verify-status.js';
+import { recordAcceptedRisk } from './install.js';
+import { pluginManifestIn, nodeReadFs } from './plugin-resolve.js';
+const nameOf = (id) => id.split('@')[0];
+/**
+ * Scan each plugin the clone carries. Returns the plugin ids whose install must
+ * not run, each with the reason; prints every finding; records --accept-risk.
+ */
+export function scanBeforeInstall(root, clone, plugins, acceptRisk, fs = nodeReadFs, 
+/** Lines already printed / overrides already recorded by an earlier scan in the same run (scanned before enabling, then again after the clone refresh). */
+seen = new Set()) {
+    const blocked = new Map();
+    if (!clone)
+        return { blocked };
+    const byName = new Map();
+    const findings = plugins.flatMap((p) => {
+        const manifest = pluginManifestIn(clone, p.id, fs);
+        if (!fs.exists(manifest))
+            return [];
+        byName.set(nameOf(p.id), p.id);
+        return scanPluginDir(nameOf(p.id), dirname(dirname(manifest)));
+    });
+    // --accept-risk takes the plugin name or its id (name@ruflo).
+    const accept = new Set([...acceptRisk].map(nameOf));
+    const gate = gateScan(findings, accept);
+    for (const f of findings) {
+        const line = formatScanFinding(f);
+        if (seen.has(line))
+            continue;
+        seen.add(line);
+        if (f.severity === 'high')
+            output.writeln(`${output.error('✗')} scan ${line}`);
+        else
+            output.writeln(output.dim(`  scan ${line}`));
+    }
+    for (const name of gate.blocked) {
+        const id = byName.get(name) ?? name;
+        const first = gate.findings.find((f) => f.plugin === name && f.severity === 'high');
+        blocked.set(id, `not installed: high scan finding in ${first.file} (${first.rule}); review it, then re-run with --accept-risk ${name}`);
+    }
+    const at = new Date().toISOString();
+    const accepted = gate.accepted.filter((plugin) => !seen.has(`accepted:${plugin}`));
+    for (const plugin of accepted)
+        seen.add(`accepted:${plugin}`);
+    recordAcceptedRisk(root, accepted.map((plugin) => ({
+        plugin,
+        at,
+        findings: gate.findings.filter((f) => f.plugin === plugin && f.severity === 'high').map(formatScanFinding),
+    })));
+    for (const plugin of accepted)
+        output.printWarning(`--accept-risk ${plugin}: installing past its high scan finding(s); recorded in .claude-flow/mods/install.json`);
+    return { blocked };
+}
+/** Verify the clone's ruflo plugins and write the status file; prints one line per non-verified plugin. */
+export function verifyAndRecord(configDir, clone, names, home = homedir()) {
+    if (!clone)
+        return [];
+    let results;
+    let cache;
+    try {
+        results = verifyClone(clone, names);
+        // The install cache is what Claude Code loads an installed plugin from: it is recorded too (worst of both).
+        cache = verifyInstallCache(configDir, 'ruflo', names);
+        writeVerifyStatus(configDir, clone, results, home, cache);
+    }
+    catch (error) {
+        output.printWarning(`plugin signature check skipped: ${error.message}`);
+        return [];
+    }
+    for (const r of cache)
+        if (r.result === 'modified' || r.result === 'bad-signature')
+            output.writeln(`${output.error('✗')} signature (install cache) ${describeVerification(r)}`);
+    for (const r of results) {
+        if (r.result === 'verified')
+            output.writeln(`${output.success('✓')} signature ${r.plugin}: verified`);
+        else if (r.result !== 'unsigned')
+            output.writeln(`${output.error('✗')} signature ${describeVerification(r)}`);
+    }
+    const unsigned = results.filter((r) => r.result === 'unsigned').map((r) => r.plugin);
+    if (unsigned.length)
+        output.writeln(output.dim(`  signature: unsigned (no .claude-plugin/signature.json): ${unsigned.join(', ')}`));
+    return results;
+}
+/**
+ * `ruflo mods doctor` (§2.1): one finding per ruflo mod plugin from its clone
+ * and install-cache signatures; writes the status file the mod's trust gate
+ * reads. `modified` / `bad-signature` warn: they are enforced only under
+ * modTrust: refuse-risky, since a local checkout is always modified.
+ */
+export function signatureFindings(configDir, clone, names, home = homedir()) {
+    if (!clone)
+        return [];
+    let results;
+    let cache;
+    try {
+        results = verifyClone(clone, names);
+        cache = verifyInstallCache(configDir, 'ruflo', names);
+        writeVerifyStatus(configDir, clone, results, home, cache);
+    }
+    catch (error) {
+        return [{ name: 'plugin signatures', status: 'warn', message: `could not check: ${error.message}` }];
+    }
+    const rows = [...results.map((r) => ({ r, where: 'clone' })), ...cache.map((r) => ({ r, where: 'install cache' }))];
+    return rows.map(({ r, where }) => ({
+        name: `signature ${r.plugin} (${where})`,
+        // `unsigned` is reported, not warned: a clone from before the first signed release has no signature.json,
+        // and a --strict doctor gate must not fail on that alone. modified / bad-signature warn.
+        status: r.result === 'verified' || r.result === 'unsigned' ? 'pass' : 'warn',
+        message: r.result === 'unsigned' ? `${r.plugin}: unsigned (no .claude-plugin/signature.json in this release)` : describeVerification(r),
+        ...(r.result === 'modified' || r.result === 'bad-signature'
+            ? { fix: 'claude plugin marketplace update ruflo (a local checkout is always modified; enforced only with modTrust: refuse-risky)' }
+            : {}),
+    }));
+}
+//# sourceMappingURL=install-trust.js.map

package/dist/src/mods/install.d.ts

@@ -57,11 +57,20 @@ export interface Added {
      */
     claudeInstalled?: string[];
 }
+/** ADR-509 §2.2: an install that went ahead past a high scan finding because of --accept-risk <plugin>. */
+export interface AcceptedRisk {
+    plugin: string;
+    at: string;
+    /** The high findings accepted, as printed (`[high] plugin: file (rule) detail`). */
+    findings: string[];
+}
 export interface InstallRecord {
     version: 2;
     installedAt: string;
     /** What install added, per settings file it wrote. */
     files: Record<string, Added>;
+    /** ADR-509 §2.2: every --accept-risk override, newest last. */
+    acceptedRisk?: AcceptedRisk[];
 }
 type Settings = Record<string, unknown> & {
     enabledPlugins?: Record<string, unknown>;
@@ -89,8 +98,18 @@ export interface InstallResult {
 export declare function installMod(projectRoot: string, scope: Scope, dryRun?: boolean, plugins?: readonly string[], marketplace?: MarketplaceEntry): InstallResult;
 /** The install record, v1 (3.50.0: one file, ruflo-mods only) read as v2. */
 export declare function readRecord(projectRoot: string): InstallRecord | null;
+/** ADR-509 §2.2: record an --accept-risk override in .claude-flow/mods/install.json. */
+export declare function recordAcceptedRisk(projectRoot: string, entries: readonly AcceptedRisk[]): void;
 /** Note plugins ruflo installed with `claude plugin install` for one settings file. */
 export declare function recordClaudeInstalled(projectRoot: string, settingsFile: string, ids: readonly string[]): void;
+/**
+ * ADR-509 §2.2: a plugin whose scan blocked it must not stay enabled — Claude
+ * Code loads an enabled plugin straight from the marketplace clone, with or
+ * without an install. Removes `enabledPlugins[id]` (only when it is `true`: a
+ * `false` someone set is already off) and drops the id from what the record
+ * says ruflo added. Returns the ids it turned off.
+ */
+export declare function disableBlockedPlugins(projectRoot: string, settingsFile: string, ids: readonly string[]): string[];
 /** The scope a recorded settings file was written at. */
 export declare function scopeOfSettingsFile(file: string): Scope;
 export declare function uninstallMod(projectRoot: string, dryRun?: boolean): {

package/dist/src/mods/install.js

@@ -156,7 +156,10 @@ export function readRecord(projectRoot) {
                 const strings = (v) => (Array.isArray(v) ? v.filter((p) => typeof p === 'string') : []);
                 files[file] = { plugins: strings(a.plugins), marketplace: a.marketplace === true, env: a.env === true, claudeInstalled: strings(a.claudeInstalled) };
             }
-            return { version: 2, installedAt: String(parsed.installedAt ?? ''), files };
+            const accepted = Array.isArray(parsed.acceptedRisk)
+                ? parsed.acceptedRisk.filter(isRecord).map((r) => ({ plugin: String(r.plugin ?? ''), at: String(r.at ?? ''), findings: Array.isArray(r.findings) ? r.findings.map(String) : [] }))
+                : undefined;
+            return { version: 2, installedAt: String(parsed.installedAt ?? ''), files, ...(accepted?.length ? { acceptedRisk: accepted } : {}) };
         }
         if (parsed.version === 1 && typeof parsed.settingsFile === 'string' && isRecord(parsed.added)) {
             const a = parsed.added;
@@ -168,6 +171,14 @@ export function readRecord(projectRoot) {
         return null;
     }
 }
+/** ADR-509 §2.2: record an --accept-risk override in .claude-flow/mods/install.json. */
+export function recordAcceptedRisk(projectRoot, entries) {
+    if (entries.length === 0)
+        return;
+    const record = readRecord(projectRoot) ?? { version: 2, installedAt: new Date().toISOString(), files: {} };
+    record.acceptedRisk = [...(record.acceptedRisk ?? []), ...entries];
+    writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+}
 /** Note plugins ruflo installed with `claude plugin install` for one settings file. */
 export function recordClaudeInstalled(projectRoot, settingsFile, ids) {
     const record = readRecord(projectRoot);
@@ -177,6 +188,32 @@ export function recordClaudeInstalled(projectRoot, settingsFile, ids) {
     entry.claudeInstalled = [...new Set([...(entry.claudeInstalled ?? []), ...ids])];
     writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
 }
+/**
+ * ADR-509 §2.2: a plugin whose scan blocked it must not stay enabled — Claude
+ * Code loads an enabled plugin straight from the marketplace clone, with or
+ * without an install. Removes `enabledPlugins[id]` (only when it is `true`: a
+ * `false` someone set is already off) and drops the id from what the record
+ * says ruflo added. Returns the ids it turned off.
+ */
+export function disableBlockedPlugins(projectRoot, settingsFile, ids) {
+    if (ids.length === 0 || !existsSync(settingsFile))
+        return [];
+    const settings = readSettingsFile(settingsFile);
+    const enabled = isRecord(settings.enabledPlugins) ? { ...settings.enabledPlugins } : {};
+    const off = ids.filter((id) => enabled[id] === true);
+    if (off.length) {
+        for (const id of off)
+            delete enabled[id];
+        writeJson(settingsFile, { ...settings, enabledPlugins: enabled });
+    }
+    const record = readRecord(projectRoot);
+    const entry = record?.files[settingsFile];
+    if (record && entry && entry.plugins.some((p) => ids.includes(p))) {
+        entry.plugins = entry.plugins.filter((p) => !ids.includes(p));
+        writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+    }
+    return off;
+}
 /** The scope a recorded settings file was written at. */
 export function scopeOfSettingsFile(file) {
     return file.endsWith('settings.local.json') ? 'local' : 'project';

package/dist/src/mods/plugin-paths.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ADR-510 — where a ruflo plugin lives on disk, for a headless `claude -p`
+ * worker (`--plugin-dir <path>`) or an Agent SDK session
+ * (`plugins: [{ type: "local", path }]`).
+ *
+ * `claude -p` on a fresh config loads no marketplace plugins: the marketplace
+ * is cloned only by an interactive, trusted start. So a worker has to be told
+ * where each plugin is. Sources, in order:
+ *
+ *   1. a `--source local` directory marketplace (a ruflo checkout) that Claude
+ *      Code itself records in the user-level `known_marketplaces.json`, i.e.
+ *      one the user added through an interactive, trusted start;
+ *   2. the marketplace clone (`<config>/plugins/marketplaces/ruflo/...`);
+ *   3. the install cache (`<config>/plugins/cache/ruflo/<name>/<version>`).
+ *
+ * A folder without `.claude-plugin/plugin.json` is never returned: the plugin
+ * is reported missing instead. Read-only; the filesystem is injectable.
+ *
+ * Trust: nothing inside the project decides the path. A repository's own
+ * `.claude/settings.json` / `settings.local.json` (`extraKnownMarketplaces`)
+ * is never read here: interactive Claude Code gates a project-declared
+ * marketplace behind workspace trust, but `--plugin-dir` loads with no prompt
+ * and replaces the user's installed copy of the same name. Letting a cloned
+ * repo point the headless worker at its own folder would run repo-supplied
+ * function hooks in every daemon worker, in place of the user's guard.
+ */
+import { type ReadFs } from './plugin-resolve.js';
+export type PluginSource = 'local' | 'clone' | 'cache';
+export interface ResolvedPlugin {
+    name: string;
+    /** Absolute plugin folder (the one holding `.claude-plugin/plugin.json`). */
+    path: string;
+    source: PluginSource;
+}
+export interface MissingPlugin {
+    name: string;
+    reason: string;
+}
+export interface PluginPaths {
+    resolved: ResolvedPlugin[];
+    missing: MissingPlugin[];
+}
+/** ReadFs plus a directory listing (for the install cache's version folders). */
+export interface PluginFs extends ReadFs {
+    list(path: string): string[];
+}
+export declare const nodePluginFs: PluginFs;
+export interface ResolveOptions {
+    /**
+     * Accepted for callers' convenience but deliberately not consulted: the
+     * project's own settings never choose a headless plugin folder (see "Trust").
+     */
+    projectRoot?: string;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    fs?: PluginFs;
+}
+/** Resolve each plugin name (e.g. `ruflo-mods`) to an absolute folder, or report it missing. */
+export declare function resolvePluginPaths(names: readonly string[], opts?: ResolveOptions): PluginPaths;
+//# sourceMappingURL=plugin-paths.d.ts.map

package/dist/src/mods/plugin-paths.js

@@ -0,0 +1,131 @@
+/**
+ * ADR-510 — where a ruflo plugin lives on disk, for a headless `claude -p`
+ * worker (`--plugin-dir <path>`) or an Agent SDK session
+ * (`plugins: [{ type: "local", path }]`).
+ *
+ * `claude -p` on a fresh config loads no marketplace plugins: the marketplace
+ * is cloned only by an interactive, trusted start. So a worker has to be told
+ * where each plugin is. Sources, in order:
+ *
+ *   1. a `--source local` directory marketplace (a ruflo checkout) that Claude
+ *      Code itself records in the user-level `known_marketplaces.json`, i.e.
+ *      one the user added through an interactive, trusted start;
+ *   2. the marketplace clone (`<config>/plugins/marketplaces/ruflo/...`);
+ *   3. the install cache (`<config>/plugins/cache/ruflo/<name>/<version>`).
+ *
+ * A folder without `.claude-plugin/plugin.json` is never returned: the plugin
+ * is reported missing instead. Read-only; the filesystem is injectable.
+ *
+ * Trust: nothing inside the project decides the path. A repository's own
+ * `.claude/settings.json` / `settings.local.json` (`extraKnownMarketplaces`)
+ * is never read here: interactive Claude Code gates a project-declared
+ * marketplace behind workspace trust, but `--plugin-dir` loads with no prompt
+ * and replaces the user's installed copy of the same name. Letting a cloned
+ * repo point the headless worker at its own folder would run repo-supplied
+ * function hooks in every daemon worker, in place of the user's guard.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { MARKETPLACE_NAME } from './install.js';
+import { claudeConfigDir, marketplaceState, nodeReadFs, pluginManifestIn } from './plugin-resolve.js';
+export const nodePluginFs = {
+    ...nodeReadFs,
+    list: (p) => {
+        try {
+            return existsSync(p) ? readdirSync(p) : [];
+        }
+        catch {
+            return [];
+        }
+    },
+};
+const MANIFEST = join('.claude-plugin', 'plugin.json');
+function readJson(fs, path) {
+    const text = fs.readText(path);
+    if (text === undefined)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+/**
+ * The directory marketplace Claude Code knows as `ruflo`, from the user-level
+ * `known_marketplaces.json` only (see "Trust" above). A relative path is
+ * rejected: Claude Code records absolute ones, and a relative path would
+ * resolve against whatever directory the worker happens to start in.
+ */
+function localMarketplaceDir(configDir, fs) {
+    const market = marketplaceState(configDir, fs);
+    if (market.source?.source !== 'directory')
+        return null;
+    const declared = typeof market.source.path === 'string' ? market.source.path : null;
+    const dir = market.location ?? declared;
+    return dir && isAbsolute(dir) && (!declared || isAbsolute(declared)) ? dir : null;
+}
+/** Numeric-aware version compare ("0.10.0" > "0.9.3"); non-numeric parts compare as text. */
+function compareVersions(a, b) {
+    const pa = a.split(/[.-]/);
+    const pb = b.split(/[.-]/);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = pa[i] ?? '';
+        const y = pb[i] ?? '';
+        const nx = /^\d+$/.test(x) ? Number(x) : NaN;
+        const ny = /^\d+$/.test(y) ? Number(y) : NaN;
+        const d = !Number.isNaN(nx) && !Number.isNaN(ny) ? nx - ny : x.localeCompare(y);
+        if (d !== 0)
+            return d;
+    }
+    return 0;
+}
+/** The cached install: installed_plugins.json's path first, else the highest version folder. */
+function cachedPluginDir(configDir, name, fs) {
+    const record = readJson(fs, join(configDir, 'plugins', 'installed_plugins.json'));
+    const plugins = isRecord(record) && isRecord(record.plugins) ? record.plugins : undefined;
+    const entries = plugins && Array.isArray(plugins[`${name}@${MARKETPLACE_NAME}`]) ? plugins[`${name}@${MARKETPLACE_NAME}`] : [];
+    for (const e of entries) {
+        if (isRecord(e) && typeof e.installPath === 'string' && fs.exists(join(e.installPath, MANIFEST)))
+            return e.installPath;
+    }
+    const base = join(configDir, 'plugins', 'cache', MARKETPLACE_NAME, name);
+    const versions = fs.list(base).filter((v) => fs.exists(join(base, v, MANIFEST))).sort(compareVersions);
+    return versions.length > 0 ? join(base, versions[versions.length - 1]) : null;
+}
+/** Plugin folder from a marketplace root (its marketplace.json `source`, else plugins/<name>). */
+function pluginDirIn(root, name, fs) {
+    const manifest = pluginManifestIn(root, `${name}@${MARKETPLACE_NAME}`, fs);
+    return fs.exists(manifest) ? dirname(dirname(manifest)) : null;
+}
+/** Resolve each plugin name (e.g. `ruflo-mods`) to an absolute folder, or report it missing. */
+export function resolvePluginPaths(names, opts = {}) {
+    const env = opts.env ?? process.env;
+    const fs = opts.fs ?? nodePluginFs;
+    const configDir = claudeConfigDir(env, opts.home ?? homedir());
+    const local = localMarketplaceDir(configDir, fs);
+    const market = marketplaceState(configDir, fs);
+    const clone = market.source?.source === 'directory' ? null : market.location;
+    const out = { resolved: [], missing: [] };
+    for (const raw of names) {
+        const name = raw.split('@')[0].trim();
+        if (!name)
+            continue;
+        const fromLocal = local ? pluginDirIn(local, name, fs) : null;
+        const fromClone = !fromLocal && clone ? pluginDirIn(clone, name, fs) : null;
+        const fromCache = !fromLocal && !fromClone ? cachedPluginDir(configDir, name, fs) : null;
+        const hit = [[fromLocal, 'local'], [fromClone, 'clone'], [fromCache, 'cache']];
+        const found = hit.find(([p]) => p !== null);
+        if (found) {
+            out.resolved.push({ name, path: resolve(found[0]), source: found[1] });
+        }
+        else {
+            const looked = [local && `local marketplace ${local}`, clone && `clone ${clone}`, `cache ${join(configDir, 'plugins', 'cache', MARKETPLACE_NAME, name)}`].filter(Boolean);
+            out.missing.push({ name, reason: `no ${MANIFEST} in ${looked.join(', ')}` });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=plugin-paths.js.map

package/dist/src/mods/plugin-repair.d.ts

@@ -47,6 +47,14 @@ export interface RepairOptions {
     exec?: Exec;
     env?: NodeJS.ProcessEnv;
     fs?: ReadFs;
+    /**
+     * ADR-509 §2.2: called once the marketplace step has refreshed the clone and
+     * before any `claude plugin install`; a plugin id it returns is not installed
+     * (its step is a failure naming the reason).
+     */
+    beforeInstall?: (clone: string | null) => {
+        blocked: ReadonlyMap<string, string>;
+    };
 }
 /**
  * `update` when Claude Code already knows ruflo by the wanted source; else

package/dist/src/mods/plugin-repair.js

@@ -88,9 +88,16 @@ export async function repairPluginInstall(opts) {
             steps.push({ argv: installArgv(p.id, opts.scope), state: 'failed', output: `${p.id} is not in ${wanted.source.path}` });
         return { ok: missing.length === 0, steps };
     }
+    const gate = opts.beforeInstall?.(market.location);
     let ok = true;
     for (const plugin of plugins) {
         const argv = installArgv(plugin.id, opts.scope);
+        const blocked = gate?.blocked.get(plugin.id);
+        if (blocked) {
+            steps.push({ argv, state: 'failed', output: blocked });
+            ok = false;
+            continue;
+        }
         if (!cloneHas(market, plugin.id, fs)) {
             steps.push({ argv, state: plugin.required ? 'failed' : 'pending', output: `${plugin.id} is not in the ruflo marketplace${plugin.required ? ' even after the update' : ' yet (pending)'}` });
             ok &&= !plugin.required;

package/dist/src/plugins/marketplace-trust/scan.d.ts

@@ -0,0 +1,23 @@
+export type ScanSeverity = 'high' | 'medium';
+export interface ScanFinding {
+    plugin: string;
+    severity: ScanSeverity;
+    file: string;
+    rule: string;
+    detail: string;
+}
+/** Every finding for one plugin directory; empty when the plugin runs nothing on install. */
+export declare function scanPluginDir(plugin: string, root: string): ScanFinding[];
+export declare const formatScanFinding: (f: ScanFinding) => string;
+export interface ScanGate {
+    /** Plugins with a high finding that were not accepted: their install must not run. */
+    blocked: string[];
+    /** Plugins with a high finding that --accept-risk let through. */
+    accepted: string[];
+    findings: ScanFinding[];
+}
+/** Applies §2.2: a high finding blocks, unless the plugin is named in acceptRisk. */
+export declare function gateScan(findings: readonly ScanFinding[], acceptRisk: ReadonlySet<string>): ScanGate;
+/** `--accept-risk a,b` or repeated: plugin names (or ids) to install past a high scan finding (ADR-509 §2.2). */
+export declare function acceptRiskFrom(flags: Record<string, unknown>): string[];
+//# sourceMappingURL=scan.d.ts.map