@claude-flow/cli 3.64.0 → 3.65.1

package/dist/src/plugins/marketplace-trust/scan.js

@@ -0,0 +1,255 @@
+/**
+ * Static scan of a Claude Code plugin before it is installed (ADR-509 §2.2).
+ *
+ * Reads what the plugin will make Claude Code run: `.mcp.json` servers,
+ * `hooks/hooks.json` command hooks, and its hook modules (function hooks).
+ * Rules: the settings-risk-scanner command rules for anything that becomes a
+ * shell command, and the ruflo-mods trust classifier's capability names for
+ * hook modules (`$.process.*`, `$.http.*`, `$.mcp.*`, `$.tool.call`, ...).
+ *
+ * `high` stops an install (override per plugin with --accept-risk); `medium`
+ * is printed and the install continues. Static by design: a hook that fetches
+ * code at run time is caught only by the network/process rules (ADR-509 §3).
+ */
+import { existsSync, lstatSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { scanCommandStringForRisk } from '../../init/settings-risk-scanner.js';
+/** Hook-module capabilities, named as the ruflo-mods trust classifier (hooks/trust.ts RISKY_CALLS) names them. */
+const MODULE_CAPABILITIES = [
+    { re: /\$\s*\.\s*process\s*\.\s*(run|spawn)\b/, rule: 'module-process', detail: 'runs host commands ($.process)' },
+    { re: /\$\s*\.\s*http\s*\.\s*fetch\b/, rule: 'module-network', detail: 'makes network requests ($.http.fetch)' },
+    { re: /\$\s*\.\s*mcp\s*\.\s*(call|connect)\b/, rule: 'module-mcp', detail: 'calls or connects MCP servers ($.mcp)' },
+    { re: /\$\s*\.\s*tool\s*\.\s*call\b/, rule: 'module-tool-call', detail: 'runs any tool, Bash included ($.tool.call)' },
+    { re: /\$\s*\.\s*config\s*\.\s*set\b/, rule: 'module-config', detail: 'changes Claude Code settings ($.config.set)' },
+];
+/** Node escape hatches a hook module should never need: they bypass the host's `$` entirely. */
+const MODULE_ESCAPES = [
+    { re: /(?:\brequire\s*\(\s*|\bimport\s*\(\s*|\bfrom\s+|\bimport\s+)['"](?:node:)?child_process['"]/, rule: 'module-child-process', detail: 'imports child_process (runs commands outside the host)' },
+    { re: /\beval\s*\(|\bnew\s+Function\s*\(/, rule: 'module-dynamic-code', detail: 'evaluates code built at run time (eval / new Function)' },
+];
+const MODULE_EXT = /\.(ts|mts|cts|tsx|js|mjs|cjs|jsx)$/;
+const MAX_FILE_BYTES = 1024 * 1024;
+const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function scanMcp(plugin, root, out) {
+    const file = '.mcp.json';
+    if (!existsSync(join(root, file)))
+        return;
+    const parsed = readJson(join(root, file));
+    const servers = record(parsed) && record(parsed.mcpServers) ? parsed.mcpServers : record(parsed) ? parsed : {};
+    for (const [name, raw] of Object.entries(servers)) {
+        if (!record(raw))
+            continue;
+        const command = typeof raw.command === 'string' ? raw.command : '';
+        const args = Array.isArray(raw.args) ? raw.args.filter((a) => typeof a === 'string') : [];
+        const line = [command, ...args].join(' ').trim();
+        if (line) {
+            for (const reason of scanCommandStringForRisk(line))
+                out.push({ plugin, severity: 'high', file, rule: 'mcp-command', detail: `server "${name}" ${reason}` });
+            // `npx -y pkg` / `npx pkg@latest` runs whatever the registry serves at start time.
+            if (/(^|\s)(npx|bunx|pnpx)(\s|$)/.test(line) && (/(^|\s)-y(\s|$)|--yes\b/.test(line) || /@latest\b/.test(line))) {
+                out.push({ plugin, severity: 'medium', file, rule: 'mcp-unpinned-package', detail: `server "${name}" runs an unpinned package at start (${line.slice(0, 80)})` });
+            }
+        }
+        if (typeof raw.url === 'string' && /^http:\/\//i.test(raw.url) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/i.test(raw.url)) {
+            out.push({ plugin, severity: 'medium', file, rule: 'mcp-plain-http', detail: `server "${name}" connects over plain http to a remote host` });
+        }
+    }
+}
+function scanHooksJson(plugin, root, out) {
+    const file = 'hooks/hooks.json';
+    if (!existsSync(join(root, file)))
+        return;
+    const parsed = readJson(join(root, file));
+    const hooks = record(parsed) && record(parsed.hooks) ? parsed.hooks : {};
+    for (const [event, groups] of Object.entries(hooks)) {
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            const list = record(group) && Array.isArray(group.hooks) ? group.hooks : [];
+            for (const h of list) {
+                if (!record(h) || typeof h.command !== 'string')
+                    continue;
+                for (const reason of scanCommandStringForRisk(h.command))
+                    out.push({ plugin, severity: 'high', file, rule: 'hook-command', detail: `${event}: ${reason}` });
+            }
+        }
+    }
+}
+/** Hook-module files under hooks/, for coverage beyond what hooks.json lists (tests, oversize files skipped). */
+function moduleFiles(root) {
+    const out = [];
+    const walk = (rel, depth) => {
+        if (depth > 6)
+            return;
+        let names;
+        try {
+            names = readdirSync(join(root, rel));
+        }
+        catch {
+            return;
+        }
+        for (const name of names.sort()) {
+            if (name === 'node_modules' || name === '.git' || name === 'tests' || name === '__tests__')
+                continue;
+            const childRel = `${rel}/${name}`;
+            const st = lstatSync(join(root, childRel));
+            if (st.isDirectory())
+                walk(childRel, depth + 1);
+            else if (st.isFile() && MODULE_EXT.test(name) && !/\.(test|spec)\.[a-z]+$/.test(name) && st.size <= MAX_FILE_BYTES)
+                out.push(childRel);
+        }
+    };
+    if (existsSync(join(root, 'hooks')))
+        walk('hooks', 0);
+    return out;
+}
+// Static module specifiers: import/export ... from, side-effect import, import(), require().
+const SPECIFIERS = [
+    /\bfrom\s*['"`]([^'"`\n]+)['"`]/g,
+    /\bimport\s*['"`]([^'"`\n]+)['"`]/g,
+    /\bimport\s*\(\s*['"`]([^'"`\n]+)['"`]\s*[,)]/g,
+    /\brequire\s*\(\s*['"`]([^'"`\n]+)['"`]\s*\)/g,
+];
+// import(x) / require(x) with a computed argument: what it loads cannot be read statically.
+const COMPUTED_LOAD = /\b(?:import|require)\s*\(\s*(?![\s'"]|`[^`$]*`)/;
+const MAX_MODULES = 2000;
+// `import type … from` / `export type … from` are erased by the TypeScript loader: nothing loads.
+const TYPE_ONLY = /\b(?:import|export)\s+type\s+[^;'"`]{0,2000}?\bfrom\s*['"][^'"\n]+['"]/g;
+function relativeSpecifiers(text) {
+    const out = new Set();
+    const loaded = text.replace(TYPE_ONLY, '');
+    for (const re of SPECIFIERS)
+        for (const m of loaded.matchAll(re))
+            if (m[1].startsWith('./') || m[1].startsWith('../'))
+                out.add(m[1]);
+    return [...out];
+}
+/** Node / TypeScript-style resolution of a relative specifier: exact, + extension, .js→.ts, index.*. */
+function resolveSpecifier(fromDir, spec) {
+    const base = resolve(fromDir, spec);
+    const exts = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+    const swapped = /\.(c|m)?js$/.test(base) ? [base.replace(/\.js$/, '.ts').replace(/\.mjs$/, '.mts').replace(/\.cjs$/, '.cts')] : [];
+    const candidates = [base, ...swapped, ...exts.map((e) => base + e), ...exts.map((e) => join(base, `index${e}`))];
+    for (const c of candidates) {
+        try {
+            if (statSync(c).isFile())
+                return c;
+        }
+        catch {
+            // try the next
+        }
+    }
+    return null;
+}
+const relTo = (root, abs) => relative(root, abs).split(sep).join('/');
+/**
+ * What the engine actually loads: the hooks.json \`modules\` (resolved against
+ * hooks.json's directory) and every relative import they reach. None of the
+ * walk's skips apply here: a listed or imported file is scanned whatever its
+ * name or size, and one that cannot be read or is too large is itself a high
+ * finding (\`unscannable\`), never silently passed.
+ */
+function scanLoadedModules(plugin, root, out, scanned) {
+    const hooksJson = join(root, 'hooks', 'hooks.json');
+    if (!existsSync(hooksJson))
+        return;
+    const parsed = readJson(hooksJson);
+    const listed = record(parsed) && Array.isArray(parsed.modules) ? parsed.modules : [];
+    const queue = [];
+    for (const m of listed) {
+        if (typeof m !== 'string')
+            continue;
+        const abs = resolveSpecifier(dirname(hooksJson), m) ?? resolve(dirname(hooksJson), m);
+        queue.push({ abs, from: 'hooks/hooks.json' });
+    }
+    const rootAbs = resolve(root);
+    while (queue.length) {
+        const { abs, from } = queue.shift();
+        if (scanned.has(abs))
+            continue;
+        scanned.add(abs);
+        const file = relTo(rootAbs, abs);
+        if (scanned.size > MAX_MODULES) {
+            out.push({ plugin, severity: 'high', file, rule: 'unscannable', detail: `more than ${MAX_MODULES} modules reachable from hooks.json` });
+            return;
+        }
+        if (file.startsWith('../') || isAbsolute(file)) {
+            out.push({ plugin, severity: 'high', file, rule: 'module-outside-plugin', detail: `loaded by ${from} but outside the plugin directory` });
+        }
+        let text;
+        try {
+            const st = lstatSync(abs);
+            if (!st.isFile())
+                throw new Error(st.isSymbolicLink() ? 'a symbolic link' : 'not a regular file');
+            if (st.size > MAX_FILE_BYTES)
+                throw new Error(`${st.size} bytes, over the ${MAX_FILE_BYTES}-byte scan limit`);
+            text = readFileSync(abs, 'utf-8');
+        }
+        catch (error) {
+            const code = error.code;
+            out.push({ plugin, severity: 'high', file, rule: 'unscannable', detail: `loaded by ${from} but cannot be scanned (${code === 'ENOENT' ? 'missing' : error.message})` });
+            continue;
+        }
+        scanText(plugin, file, text, out);
+        if (COMPUTED_LOAD.test(text))
+            out.push({ plugin, severity: 'high', file, rule: 'module-computed-import', detail: 'loads a module whose name is computed at run time (import()/require() of a non-literal)' });
+        for (const spec of relativeSpecifiers(text)) {
+            const next = resolveSpecifier(dirname(abs), spec);
+            if (next)
+                queue.push({ abs: next, from: file });
+            else
+                out.push({ plugin, severity: 'medium', file, rule: 'module-unresolved-import', detail: `imports ${spec}, which does not resolve to a file` });
+        }
+    }
+}
+function scanText(plugin, file, text, out) {
+    for (const r of MODULE_ESCAPES)
+        if (r.re.test(text))
+            out.push({ plugin, severity: 'high', file, rule: r.rule, detail: r.detail });
+    for (const r of MODULE_CAPABILITIES)
+        if (r.re.test(text))
+            out.push({ plugin, severity: 'medium', file, rule: r.rule, detail: r.detail });
+}
+function scanModules(plugin, root, out) {
+    const scanned = new Set();
+    scanLoadedModules(plugin, root, out, scanned);
+    for (const file of moduleFiles(root)) {
+        const abs = resolve(root, file);
+        if (scanned.has(abs))
+            continue;
+        scanned.add(abs);
+        scanText(plugin, file, readFileSync(abs, 'utf-8'), out);
+    }
+}
+/** Every finding for one plugin directory; empty when the plugin runs nothing on install. */
+export function scanPluginDir(plugin, root) {
+    const out = [];
+    if (!existsSync(root))
+        return out;
+    scanMcp(plugin, root, out);
+    scanHooksJson(plugin, root, out);
+    scanModules(plugin, root, out);
+    return out;
+}
+export const formatScanFinding = (f) => `[${f.severity}] ${f.plugin}: ${f.file} (${f.rule}) ${f.detail}`;
+/** Applies §2.2: a high finding blocks, unless the plugin is named in acceptRisk. */
+export function gateScan(findings, acceptRisk) {
+    const high = new Set(findings.filter((f) => f.severity === 'high').map((f) => f.plugin));
+    const accepted = [...high].filter((p) => acceptRisk.has(p));
+    return { blocked: [...high].filter((p) => !acceptRisk.has(p)), accepted, findings: [...findings] };
+}
+/** `--accept-risk a,b` or repeated: plugin names (or ids) to install past a high scan finding (ADR-509 §2.2). */
+export function acceptRiskFrom(flags) {
+    const raw = flags.acceptRisk ?? flags['accept-risk'];
+    const list = Array.isArray(raw) ? raw : typeof raw === 'string' ? [raw] : [];
+    return list.flatMap((v) => String(v).split(',')).map((v) => v.trim()).filter((v) => /^[A-Za-z0-9._-]{1,100}(@[A-Za-z0-9._-]{1,100})?$/.test(v));
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/plugins/marketplace-trust/signature.d.ts

@@ -0,0 +1,53 @@
+export declare const SIGNATURE_RELATIVE = ".claude-plugin/signature.json";
+export interface PluginFileEntry {
+    path: string;
+    sha256: string;
+}
+export interface PluginManifest {
+    plugin: string;
+    version: string;
+    files: PluginFileEntry[];
+}
+export interface SignedPluginManifest {
+    manifest: PluginManifest;
+    signature: string;
+    algorithm: 'ed25519';
+}
+export type VerifyResult = 'verified' | 'modified' | 'unsigned' | 'bad-signature';
+export interface PluginVerification {
+    plugin: string;
+    dir: string;
+    result: VerifyResult;
+    /** Files whose digest differs from the signed one. */
+    changed: string[];
+    /** Signed files that are gone. */
+    missing: string[];
+    /** Files present on disk that the signature does not list. */
+    extra: string[];
+    version?: string;
+}
+/** Canonical bytes: fixed key order, files sorted by path. MUST match scripts/sign-plugins.mjs. */
+export declare function canonicalPluginManifestBytes(m: PluginManifest): Buffer;
+/**
+ * Every file under a plugin root, as posix paths, excluding the signature
+ * itself. A symlink is an entry of its own (digest of `link:<target>`), never
+ * followed: following it would let a link swap in content the digest never saw.
+ */
+export declare function digestPluginDir(root: string): PluginFileEntry[];
+/** Signature check only: true when `signed.signature` verifies over its manifest. */
+export declare function signatureValid(signed: SignedPluginManifest, pubkeyPem?: string): boolean;
+/**
+ * Check a plugin directory against its signature.json. `expectName` (the
+ * marketplace name) must match the signed plugin name: a valid signature
+ * copied from another plugin is a bad signature here, not a pass.
+ */
+export declare function verifyPluginDir(dir: string, expectName: string, pubkeyPem?: string): PluginVerification;
+export interface MarketplacePlugin {
+    name: string;
+    dir: string;
+}
+/** The plugins a marketplace clone lists, each with its directory (its `source`, else plugins/<name>). */
+export declare function listMarketplacePlugins(clone: string): MarketplacePlugin[];
+/** One line per verification, with the differing files named (capped). */
+export declare function describeVerification(v: PluginVerification, cap?: number): string;
+//# sourceMappingURL=signature.d.ts.map

package/dist/src/plugins/marketplace-trust/signature.js

@@ -0,0 +1,140 @@
+/**
+ * Signed plugin manifests for the ruflo marketplace (ADR-509 §2.1).
+ *
+ * At release, scripts/sign-plugins.mjs writes `<plugin>/.claude-plugin/signature.json`
+ * for every plugin listed in `.claude-plugin/marketplace.json`: a sorted list of
+ * every file's path and SHA-256, the plugin's version, and an Ed25519 signature
+ * over the canonical JSON of both. The key pair is the existing helpers signing
+ * key (ADR-174): the public half is RUFLO_HELPERS_PUBKEY, already pinned here.
+ *
+ * This module is the verifier. The canonical bytes MUST match the signer
+ * byte-for-byte; a round-trip test (signer script → this verifier) pins that.
+ */
+import { createHash, verify as edVerify } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { RUFLO_HELPERS_PUBKEY } from '../../init/helper-signing.js';
+export const SIGNATURE_RELATIVE = '.claude-plugin/signature.json';
+/** Never part of a plugin's signed content: VCS metadata and installed dependencies. */
+const SKIP_DIRS = new Set(['.git', 'node_modules']);
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+/** Canonical bytes: fixed key order, files sorted by path. MUST match scripts/sign-plugins.mjs. */
+export function canonicalPluginManifestBytes(m) {
+    const files = [...m.files]
+        .map((f) => ({ path: f.path, sha256: f.sha256 }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return Buffer.from(JSON.stringify({ plugin: m.plugin, version: m.version, files }), 'utf-8');
+}
+/**
+ * Every file under a plugin root, as posix paths, excluding the signature
+ * itself. A symlink is an entry of its own (digest of `link:<target>`), never
+ * followed: following it would let a link swap in content the digest never saw.
+ */
+export function digestPluginDir(root) {
+    const out = [];
+    const walk = (rel) => {
+        const abs = rel ? join(root, rel) : root;
+        for (const name of readdirSync(abs).sort()) {
+            const childRel = rel ? `${rel}/${name}` : name;
+            if (childRel === SIGNATURE_RELATIVE)
+                continue;
+            const st = lstatSync(join(abs, name));
+            if (st.isSymbolicLink())
+                out.push({ path: childRel, sha256: sha256(`link:${readlinkSync(join(abs, name))}`) });
+            else if (st.isDirectory()) {
+                if (!SKIP_DIRS.has(name))
+                    walk(childRel);
+            }
+            else if (st.isFile())
+                out.push({ path: childRel, sha256: sha256(readFileSync(join(abs, name))) });
+        }
+    };
+    walk('');
+    return out;
+}
+function parseSigned(text) {
+    try {
+        const s = JSON.parse(text);
+        if (!s || s.algorithm !== 'ed25519' || typeof s.signature !== 'string' || !s.manifest)
+            return null;
+        const m = s.manifest;
+        if (typeof m.plugin !== 'string' || typeof m.version !== 'string' || !Array.isArray(m.files))
+            return null;
+        if (!m.files.every((f) => f && typeof f.path === 'string' && typeof f.sha256 === 'string'))
+            return null;
+        return s;
+    }
+    catch {
+        return null;
+    }
+}
+/** Signature check only: true when `signed.signature` verifies over its manifest. */
+export function signatureValid(signed, pubkeyPem = RUFLO_HELPERS_PUBKEY) {
+    try {
+        return edVerify(null, canonicalPluginManifestBytes(signed.manifest), pubkeyPem, Buffer.from(signed.signature, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check a plugin directory against its signature.json. `expectName` (the
+ * marketplace name) must match the signed plugin name: a valid signature
+ * copied from another plugin is a bad signature here, not a pass.
+ */
+export function verifyPluginDir(dir, expectName, pubkeyPem = RUFLO_HELPERS_PUBKEY) {
+    const base = { plugin: expectName, dir, result: 'unsigned', changed: [], missing: [], extra: [] };
+    const sigPath = join(dir, SIGNATURE_RELATIVE);
+    if (!existsSync(sigPath))
+        return base;
+    const signed = parseSigned(readFileSync(sigPath, 'utf-8'));
+    if (!signed || signed.manifest.plugin !== expectName || !signatureValid(signed, pubkeyPem)) {
+        return { ...base, result: 'bad-signature', version: signed?.manifest.version };
+    }
+    const signedFiles = new Map(signed.manifest.files.map((f) => [f.path, f.sha256]));
+    const onDisk = new Map(digestPluginDir(dir).map((f) => [f.path, f.sha256]));
+    const changed = [];
+    const missing = [];
+    const extra = [];
+    for (const [path, digest] of signedFiles) {
+        const now = onDisk.get(path);
+        if (now === undefined)
+            missing.push(path);
+        else if (now !== digest)
+            changed.push(path);
+    }
+    for (const path of onDisk.keys())
+        if (!signedFiles.has(path))
+            extra.push(path);
+    const clean = changed.length === 0 && missing.length === 0 && extra.length === 0;
+    return { ...base, result: clean ? 'verified' : 'modified', changed, missing, extra, version: signed.manifest.version };
+}
+/** The plugins a marketplace clone lists, each with its directory (its `source`, else plugins/<name>). */
+export function listMarketplacePlugins(clone) {
+    const catalog = JSON.parse(readFileSync(join(clone, '.claude-plugin', 'marketplace.json'), 'utf-8'));
+    const listed = Array.isArray(catalog.plugins) ? catalog.plugins : [];
+    const out = [];
+    for (const p of listed) {
+        if (!p || typeof p.name !== 'string' || !/^[A-Za-z0-9._-]{1,100}$/.test(p.name))
+            continue;
+        const source = typeof p.source === 'string' ? p.source : `./plugins/${p.name}`;
+        // A source outside the clone (absolute, `..`, or a remote object) is not this clone's to verify.
+        if (source.startsWith('/') || source.split(/[\\/]/).includes('..'))
+            continue;
+        out.push({ name: p.name, dir: join(clone, source) });
+    }
+    return out;
+}
+/** One line per verification, with the differing files named (capped). */
+export function describeVerification(v, cap = 5) {
+    if (v.result !== 'modified')
+        return `${v.plugin}: ${v.result}`;
+    const parts = [
+        ...v.changed.map((p) => `changed ${p}`),
+        ...v.missing.map((p) => `missing ${p}`),
+        ...v.extra.map((p) => `extra ${p}`),
+    ];
+    const shown = parts.slice(0, cap).join(', ');
+    return `${v.plugin}: modified (${shown}${parts.length > cap ? `, … ${parts.length - cap} more` : ''})`;
+}
+//# sourceMappingURL=signature.js.map

package/dist/src/plugins/marketplace-trust/verify-status.d.ts

@@ -0,0 +1,42 @@
+import { type PluginVerification, type VerifyResult } from './signature.js';
+export declare const VERIFY_STATUS_RELATIVE: string;
+export interface VerifyStatusEntry {
+    writtenAt: string;
+    clone: string;
+    /**
+     * Plugin name → the WORST result across its clone copy and every install-cache
+     * copy: Claude Code loads an installed plugin from the cache, so a clean clone
+     * next to a tampered cache must not read as verified.
+     */
+    plugins: Record<string, VerifyResult>;
+    /** Plugin directory (normalized, see normalizeTrustPath) → that copy's own result: the mod looks up the dir it is loading. */
+    paths?: Record<string, VerifyResult>;
+}
+export interface VerifyStatusFile {
+    version: 1;
+    byConfigDir: Record<string, VerifyStatusEntry>;
+}
+/**
+ * The one spelling of a path both sides key on (the CLI writing, the mod
+ * reading): forward slashes, no repeated or trailing slash, and a Windows
+ * drive path lower-cased (Windows paths are case-insensitive, and HOME /
+ * USERPROFILE / os.homedir() disagree on separators). Kept byte-identical to
+ * plugins/ruflo-mods/hooks/trust.ts normalizeTrustPath.
+ */
+export declare function normalizeTrustPath(p: string): string;
+/** The worse of two results (bad-signature > modified > unsigned > verified). */
+export declare const worseResult: (a: VerifyResult | undefined, b: VerifyResult) => VerifyResult;
+export declare const verifyStatusPath: (home?: string) => string;
+export declare function readVerifyStatus(home?: string): VerifyStatusFile;
+/**
+ * Record the clone's results and the install-cache copies' (`cache`): per plugin
+ * the worst of all its copies, and per copy its own result keyed by directory.
+ */
+export declare function writeVerifyStatus(configDir: string, clone: string, results: readonly PluginVerification[], home?: string, cache?: readonly PluginVerification[]): string;
+/** Verify every plugin a clone lists (or only `names`). A plugin not in the clone is skipped. */
+export declare function verifyClone(clone: string, names?: readonly string[]): PluginVerification[];
+/** Install-cache copies of ruflo plugins (installed_plugins.json), each verified as its own row. */
+export declare function verifyInstallCache(configDir: string, marketplace: string, names?: readonly string[]): PluginVerification[];
+/** The results that §2.1 makes enforceable under refuse-risky. */
+export declare const isUntrusted: (r: VerifyResult) => r is "modified" | "bad-signature";
+//# sourceMappingURL=verify-status.d.ts.map

package/dist/src/plugins/marketplace-trust/verify-status.js

@@ -0,0 +1,110 @@
+/**
+ * Where the ruflo marketplace verification lands (ADR-509 §2.1): `ruflo mods
+ * install`, `ruflo mods doctor` and `ruflo plugins verify` check the clone
+ * Claude Code loads from (and the install cache) and write the result to a
+ * status file that the ruflo-mods `plugin.register` gate reads under
+ * `modTrust: refuse-risky`.
+ *
+ * The file lives under the user's home (~/.claude-flow/mods/plugin-verify.json),
+ * not in a project: the clone is per Claude Code config dir, and a repository
+ * must not be able to ship a file that says its own tampered clone verified.
+ * It is keyed by config dir, so two config dirs never overwrite each other.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { listMarketplacePlugins, verifyPluginDir } from './signature.js';
+export const VERIFY_STATUS_RELATIVE = join('.claude-flow', 'mods', 'plugin-verify.json');
+/**
+ * The one spelling of a path both sides key on (the CLI writing, the mod
+ * reading): forward slashes, no repeated or trailing slash, and a Windows
+ * drive path lower-cased (Windows paths are case-insensitive, and HOME /
+ * USERPROFILE / os.homedir() disagree on separators). Kept byte-identical to
+ * plugins/ruflo-mods/hooks/trust.ts normalizeTrustPath.
+ */
+export function normalizeTrustPath(p) {
+    let out = p.replace(/\\/g, '/').replace(/\/{2,}/g, '/');
+    if (out.length > 1)
+        out = out.replace(/\/+$/, '');
+    return /^[A-Za-z]:(\/|$)/.test(out) ? out.toLowerCase() : out;
+}
+const RANK = { verified: 0, unsigned: 1, modified: 2, 'bad-signature': 3 };
+/** The worse of two results (bad-signature > modified > unsigned > verified). */
+export const worseResult = (a, b) => (a === undefined || RANK[b] > RANK[a] ? b : a);
+export const verifyStatusPath = (home = homedir()) => join(home, VERIFY_STATUS_RELATIVE);
+export function readVerifyStatus(home = homedir()) {
+    try {
+        const parsed = JSON.parse(readFileSync(verifyStatusPath(home), 'utf-8'));
+        if (parsed && parsed.version === 1 && parsed.byConfigDir && typeof parsed.byConfigDir === 'object')
+            return parsed;
+    }
+    catch {
+        // absent or unreadable: nothing verified yet
+    }
+    return { version: 1, byConfigDir: {} };
+}
+/**
+ * Record the clone's results and the install-cache copies' (`cache`): per plugin
+ * the worst of all its copies, and per copy its own result keyed by directory.
+ */
+export function writeVerifyStatus(configDir, clone, results, home = homedir(), cache = []) {
+    const file = readVerifyStatus(home);
+    const plugins = {};
+    const paths = {};
+    for (const r of [...results, ...cache]) {
+        plugins[r.plugin] = worseResult(plugins[r.plugin], r.result);
+        const key = normalizeTrustPath(r.dir);
+        paths[key] = worseResult(paths[key], r.result);
+    }
+    const key = normalizeTrustPath(configDir);
+    // An entry an older writer keyed with another spelling of the same dir is replaced, not left beside it.
+    for (const k of Object.keys(file.byConfigDir))
+        if (k !== key && normalizeTrustPath(k) === key)
+            delete file.byConfigDir[k];
+    file.byConfigDir[key] = { writtenAt: new Date().toISOString(), clone, plugins, paths };
+    const path = verifyStatusPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n', 'utf-8');
+    renameSync(tmp, path);
+    return path;
+}
+/** Verify every plugin a clone lists (or only `names`). A plugin not in the clone is skipped. */
+export function verifyClone(clone, names) {
+    const want = names && names.length ? new Set(names) : null;
+    return listMarketplacePlugins(clone)
+        .filter((p) => !want || want.has(p.name))
+        .filter((p) => existsSync(join(p.dir, '.claude-plugin', 'plugin.json')))
+        .map((p) => verifyPluginDir(p.dir, p.name));
+}
+/** Install-cache copies of ruflo plugins (installed_plugins.json), each verified as its own row. */
+export function verifyInstallCache(configDir, marketplace, names) {
+    let installed;
+    try {
+        installed = JSON.parse(readFileSync(join(configDir, 'plugins', 'installed_plugins.json'), 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const plugins = installed?.plugins;
+    if (!plugins || typeof plugins !== 'object')
+        return [];
+    const out = [];
+    for (const [id, entries] of Object.entries(plugins)) {
+        const at = id.lastIndexOf('@');
+        if (at <= 0 || id.slice(at + 1) !== marketplace)
+            continue;
+        const name = id.slice(0, at);
+        if (names && names.length && !names.includes(name))
+            continue;
+        for (const e of Array.isArray(entries) ? entries : []) {
+            const path = e?.installPath;
+            if (typeof path === 'string' && existsSync(join(path, '.claude-plugin', 'plugin.json')))
+                out.push(verifyPluginDir(path, name));
+        }
+    }
+    return out;
+}
+/** The results that §2.1 makes enforceable under refuse-risky. */
+export const isUntrusted = (r) => r === 'modified' || r === 'bad-signature';
+//# sourceMappingURL=verify-status.js.map

package/dist/src/services/headless-worker-executor.d.ts

@@ -135,6 +135,8 @@ export interface HeadlessExecutionResult {
     error?: string;
     /** Execution ID for tracking */
     executionId: string;
+    /** ADR-510 — plugins in the worker profile that could not be found; the worker ran without them. */
+    missingPlugins?: string[];
     /**
      * #2661 — true when the launch was skipped because the same job
      * (repositoryId + HEAD + worker + config) succeeded within the freshness

package/dist/src/services/headless-worker-executor.js

@@ -25,6 +25,7 @@ import { join } from 'path';
 import { getGlobalAiBudget, isQuotaErrorText } from './global-ai-budget.js';
 import { resolveGitWorkspaceIdentity } from './git-workspace-identity.js';
 import { getAiJobDedupRegistry, computeAiJobKey, hashWorkerConfig } from './ai-job-dedup.js';
+import { withHeadlessPlugins } from '../mods/headless-plugins.js';
 // ============================================
 // Constants
 // ============================================
@@ -777,6 +778,7 @@ export class HeadlessWorkerExecutor extends EventEmitter {
                 timestamp: new Date(),
                 executionId,
                 error: result.error,
+                ...(result.missingPlugins ? { missingPlugins: result.missingPlugins } : {}),
             };
             // Log result
             this.logExecution(executionId, 'result', JSON.stringify(executionResult, null, 2));
@@ -1011,7 +1013,10 @@ Analyze the above codebase context and provide your response following the forma
      * Execute Claude Code in headless mode
      */
     executeClaudeCode(prompt, options) {
-        return new Promise((resolve) => {
+        return new Promise((resolveRaw) => {
+            // ADR-510: a plugin the worker profile wants but cannot find is recorded on the result.
+            let missingPlugins = [];
+            const resolve = (r) => resolveRaw(missingPlugins.length > 0 ? { ...r, missingPlugins } : r);
             const env = {
                 ...process.env,
                 CLAUDE_CODE_HEADLESS: 'true',
@@ -1057,9 +1062,14 @@ Analyze the above codebase context and provide your response following the forma
             // and ALWAYS falls back to the raw text on any mismatch — a schema
             // surprise from an older/newer `claude` CLI must degrade to exactly
             // today's behavior (no usage captured), never break analysis output.
-            const child = spawn('claude', ['--print', '--output-format', 'json'], {
+            // ADR-510: `claude -p` on a fresh config loads no marketplace plugins, so
+            // pass the worker profile (default ruflo-mods) as --plugin-dir and turn
+            // function hooks on unless the caller set CLAUDE_CODE_ENABLE_FUNCTION_HOOKS.
+            const staged = withHeadlessPlugins(['--print', '--output-format', 'json'], env, { projectRoot: this.projectRoot });
+            missingPlugins = staged.missing;
+            const child = spawn('claude', staged.argv, {
                 cwd: this.projectRoot,
-                env,
+                env: staged.env,
                 stdio: ['pipe', 'pipe', 'pipe'],
                 windowsHide: true, // Prevent phantom console windows on Windows
                 detached: process.platform !== 'win32',