@deepseek-ai/dsh-plugin-manager 0.1.6-alpha.2

package/lib/types/install-failure.js

@@ -0,0 +1,33 @@
+/**
+ * What a failed pnpm run was, read off how it ended and what it printed:
+ * pnpm names its failures with stable `ERR_PNPM_*` codes and Node's errno
+ * names, which the run's captured tail carries whatever the locale.
+ * @module @deepseek-ai/dsh-plugin-manager/install-failure
+ */
+/** Patterns in the order they decide: a specific code before the generic network family. */
+const LOG_KINDS = [
+    ['build-blocked', /ERR_PNPM_IGNORED_BUILDS|Ignored build scripts/],
+    ['not-found', /ERR_PNPM_FETCH_404|\bE404\b|404 Not Found|Not Found - GET/],
+    ['no-matching-version', /ERR_PNPM_NO_MATCHING_VERSION|\bETARGET\b|No matching version/],
+    ['disk-full', /\bENOSPC\b|no space left on device/i],
+    ['permission', /\bEACCES\b|\bEPERM\b|permission denied/i],
+    ['integrity', /ERR_PNPM_TARBALL_INTEGRITY|ERR_PNPM_BAD_TARBALL_SIZE|\bEINTEGRITY\b/],
+    ['network', /\bENOTFOUND\b|\bECONNRESET\b|\bETIMEDOUT\b|\bECONNREFUSED\b|\bEAI_AGAIN\b|ERR_PNPM_META_FETCH_FAIL|ERR_PNPM_FETCH_5\d\d|ERR_PNPM_FETCH_TIMEOUT|socket hang up|Could not resolve host|unable to access/],
+];
+/**
+ * Classify a failed run.
+ * @param facts - how the run ended and what it printed.
+ * @returns the kind, `unknown` when nothing in the facts names one.
+ */
+export function classifyInstallFailure(facts) {
+    if (facts.timedOut === true)
+        return 'timeout';
+    if (facts.cause?.code === 'ENOENT')
+        return 'pnpm-missing';
+    for (const [kind, pattern] of LOG_KINDS) {
+        if (pattern.test(facts.log))
+            return kind;
+    }
+    return 'unknown';
+}
+//# sourceMappingURL=install-failure.js.map

package/lib/types/install-spec.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Reading an install spec before pnpm sees it: which of pnpm's spec forms it
+ * takes, and for a registry name whether it is one the registry can accept.
+ * @module @deepseek-ai/dsh-plugin-manager/install-spec
+ */
+/** One spec read into its form and the parts an inspection needs. */
+export type ParsedInstallSpec = {
+    readonly kind: 'registry';
+    readonly spec: string;
+    readonly name: string;
+    readonly range?: string;
+} | {
+    readonly kind: 'path';
+    readonly spec: string;
+    readonly path: string;
+} | {
+    readonly kind: 'tarball';
+    readonly spec: string;
+    readonly path?: string;
+} | {
+    readonly kind: 'git';
+    readonly spec: string;
+};
+/** A spec neither pnpm nor the registry would take; `reason` is what the person reads. */
+export declare class InvalidInstallSpecError extends Error {
+    readonly spec: string;
+    readonly reason: string;
+    /**
+     * @param spec - the spec as typed, trimmed.
+     * @param reason - why it is refused, as one sentence.
+     */
+    constructor(spec: string, reason: string);
+}
+/**
+ * Read a spec into its form. A path must be absolute: the Host's working
+ * directory means nothing to the person typing into a browser, and a
+ * relative path resolved against the profile would point inside it.
+ * @param raw - the spec as typed.
+ * @returns the parsed spec.
+ * @throws {InvalidInstallSpecError} for an empty spec, a relative path, a name the
+ * registry would refuse, or a URL that is neither a git host nor a tarball.
+ */
+export declare function parseInstallSpec(raw: string): ParsedInstallSpec;
+//# sourceMappingURL=install-spec.d.ts.map

package/lib/types/install-spec.js

@@ -0,0 +1,73 @@
+/**
+ * Reading an install spec before pnpm sees it: which of pnpm's spec forms it
+ * takes, and for a registry name whether it is one the registry can accept.
+ * @module @deepseek-ai/dsh-plugin-manager/install-spec
+ */
+import { isAbsolute } from 'node:path';
+/** The forms pnpm resolves through a git host: a host shorthand, a git URL, or a hosted repository URL. */
+const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i;
+const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i;
+const HOSTED_REPOSITORY_URL = /^https?:\/\/[^/]+\/[^/]+\/[^/#]+(?:\.git)?(?:#.*)?$/i;
+/** A tarball, on disk or over HTTP. */
+const TARBALL_SPEC = /\.(?:tgz|tar\.gz)(?:#.*)?$/i;
+/** An npm package name: lowercase URL-safe segments, an optional scope, no leading dot or underscore. */
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+const PACKAGE_NAME_MAX_LENGTH = 214;
+/** A spec neither pnpm nor the registry would take; `reason` is what the person reads. */
+export class InvalidInstallSpecError extends Error {
+    spec;
+    reason;
+    /**
+     * @param spec - the spec as typed, trimmed.
+     * @param reason - why it is refused, as one sentence.
+     */
+    constructor(spec, reason) {
+        super(`plugin-manager: ${reason}: ${spec}`);
+        this.spec = spec;
+        this.reason = reason;
+        this.name = 'InvalidInstallSpecError';
+    }
+}
+function invalid(spec, reason) {
+    return new InvalidInstallSpecError(spec, reason);
+}
+/**
+ * Read a spec into its form. A path must be absolute: the Host's working
+ * directory means nothing to the person typing into a browser, and a
+ * relative path resolved against the profile would point inside it.
+ * @param raw - the spec as typed.
+ * @returns the parsed spec.
+ * @throws {InvalidInstallSpecError} for an empty spec, a relative path, a name the
+ * registry would refuse, or a URL that is neither a git host nor a tarball.
+ */
+export function parseInstallSpec(raw) {
+    const spec = raw.trim();
+    if (spec === '')
+        throw invalid(spec, 'the package spec must not be empty');
+    const path = spec.replace(/^(?:file|link):/, '');
+    if (path !== spec || isAbsolute(path)) {
+        if (!isAbsolute(path))
+            throw invalid(spec, 'a local path must be absolute');
+        return TARBALL_SPEC.test(path) ? { kind: 'tarball', spec, path } : { kind: 'path', spec, path };
+    }
+    if (/^\.{1,2}(?:[\\/]|$)/.test(spec))
+        throw invalid(spec, 'a local path must be absolute');
+    const git = GIT_SHORTHAND.test(spec) || GIT_URL.test(spec) || HOSTED_REPOSITORY_URL.test(spec);
+    if (git && !TARBALL_SPEC.test(spec))
+        return { kind: 'git', spec };
+    if (/^https?:\/\//i.test(spec)) {
+        if (TARBALL_SPEC.test(spec))
+            return { kind: 'tarball', spec };
+        throw invalid(spec, 'a URL must point at a git repository or a tarball');
+    }
+    const at = spec.indexOf('@', 1);
+    const name = at === -1 ? spec : spec.slice(0, at);
+    const range = at === -1 ? undefined : spec.slice(at + 1);
+    if (name.length > PACKAGE_NAME_MAX_LENGTH || !PACKAGE_NAME.test(name)) {
+        throw invalid(spec, 'not a package name the registry accepts');
+    }
+    if (range === '')
+        throw invalid(spec, 'a version after @ must not be empty');
+    return range === undefined ? { kind: 'registry', spec, name } : { kind: 'registry', spec, name, range };
+}
+//# sourceMappingURL=install-spec.js.map

package/lib/types/operations.d.ts

@@ -0,0 +1,93 @@
+import { type ProfileManifest } from '@deepseek-ai/dsh-app-boot';
+import type { PackageResult } from './types.ts';
+/** Profile and invocation locations supplied by the launcher. */
+export interface PackageOperationContext {
+    profile: string;
+    /** Explicit directory for an application-owned profile; named CLI profiles resolve under home. */
+    dir?: string;
+    installAnchor: string;
+    cwd: string;
+    home?: string;
+}
+/** Output and cancellation policy for one pnpm operation. */
+export interface PackageOperationOptions {
+    /** The pnpm executable name or path; resolved through `PATH` like the `dsh plugin` command. Defaults to `pnpm`. */
+    command?: string;
+    /** Prefix arguments for an application-owned executable. */
+    args?: readonly string[];
+    /** Application runtime environment, applied only to this package operation. */
+    env?: Readonly<Record<string, string>>;
+    /** CLI inherits authentication and terminal descriptors; service scrubs secrets and captures output. */
+    execution: 'cli' | 'service';
+    signal?: AbortSignal;
+    outputBytes: number;
+    onOutput?: (text: string, stream: 'stdout' | 'stderr') => void;
+    activateNewBundles?: boolean;
+    lockWaitMs?: number;
+}
+/** Resolve relative package specs against the caller's directory.
+ * @param argument One pnpm argument.
+ * @param cwd Invocation directory, never the profile directory.
+ * @returns Anchored argument.
+ */
+export declare function anchorPathSpec(argument: string, cwd: string): string;
+/** Read bundle metadata without loading its JavaScript.
+ * @param name Installed dependency or installation-owned package name.
+ * @param dir Profile directory.
+ * @param anchor Installation manifest.
+ * @returns Resolved metadata, or undefined for packages without bundle metadata.
+ */
+export declare function bundleManifest(name: string, dir: string, anchor: string): ProfileManifest | undefined;
+/** Atomically save a profile manifest while retaining unrelated fields.
+ * @param dir Profile directory.
+ * @param manifest Updated document.
+ */
+export declare function saveManifest(dir: string, manifest: ProfileManifest): Promise<void>;
+/** Execute pnpm inside a profile whose caller already holds the profile write lock.
+ * @param context Launcher-owned profile and resolution locations.
+ * @param args Pnpm arguments, before relative path anchoring.
+ * @param options Output, activation and cancellation policy.
+ * @returns Exit status and diagnostic path; service output is bounded, CLI output uses inherited descriptors.
+ */
+export declare function runProfilePnpm(context: PackageOperationContext, args: readonly string[], options: PackageOperationOptions): Promise<PackageResult>;
+/** Initialize and run the dsh plugin command with the same write lock as the service.
+ * @param context Launcher-owned locations.
+ * @param args Pnpm arguments.
+ * @param options Output and cancellation policy.
+ * @returns Completed package-manager result.
+ */
+export declare function runPluginCommand(context: PackageOperationContext, args: readonly string[], options: PackageOperationOptions): Promise<PackageResult>;
+/** What one registry lookup answered. */
+export interface PackageViewResult {
+    /** pnpm's exit code, null when it ended without one or never started. */
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    /** The lookup ran past its bound and was killed. */
+    timedOut: boolean;
+    /** The failure of starting pnpm at all, when that is what happened. */
+    cause?: unknown;
+}
+/** Bounds of one registry lookup. */
+export interface PackageViewOptions {
+    /** The pnpm executable name or path. Defaults to `pnpm`. */
+    command?: string;
+    /** Prefix arguments for an application-owned executable. */
+    args?: readonly string[];
+    /** Application runtime environment, applied only to this package operation. */
+    env?: Readonly<Record<string, string>>;
+    /** Ends the lookup early; the caller's signal, when it has one. */
+    signal?: AbortSignal;
+    /** Bound on the lookup, in milliseconds. */
+    timeoutMs: number;
+}
+/**
+ * Ask the registry what a spec names through `pnpm view`, run in the profile
+ * directory so the registry, proxy, and authentication settings of an install apply.
+ * @param dir Profile directory.
+ * @param spec One registry spec: a package name with an optional range.
+ * @param options Cancellation and the time bound.
+ * @returns pnpm's exit, output, and how the lookup ended.
+ */
+export declare function viewProfilePackage(dir: string, spec: string, options: PackageViewOptions): Promise<PackageViewResult>;
+//# sourceMappingURL=operations.d.ts.map

package/lib/types/operations.js

@@ -0,0 +1,177 @@
+/** Shared profile package operations used by dsh plugin and the running manager. */
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, open } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { execa } from 'execa';
+import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+import { DEFAULT_PROFILE_BUNDLES, initProfile, PROFILE_TEMPLATES, readProfileManifest, resolveBundleDir, resolveProfileDir, loadOverlayPatches, } from '@deepseek-ai/dsh-app-boot';
+import { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess';
+/** Resolve relative package specs against the caller's directory.
+ * @param argument One pnpm argument.
+ * @param cwd Invocation directory, never the profile directory.
+ * @returns Anchored argument.
+ */
+export function anchorPathSpec(argument, cwd) {
+    const match = /^(?<prefix>(?:file|link):)?(?<path>\.{1,2}(?:[/\\].*)?)$/.exec(argument);
+    if (match?.groups?.path === undefined)
+        return argument;
+    return `${match.groups.prefix ?? ''}${resolve(cwd, match.groups.path)}`;
+}
+/** Read bundle metadata without loading its JavaScript.
+ * @param name Installed dependency or installation-owned package name.
+ * @param dir Profile directory.
+ * @param anchor Installation manifest.
+ * @returns Resolved metadata, or undefined for packages without bundle metadata.
+ */
+export function bundleManifest(name, dir, anchor) {
+    const packageDir = resolveBundleDir('dsh', name, anchor, dir);
+    const manifest = readProfileManifest('dsh', packageDir);
+    return manifest.dsh?.bundle?.patch === undefined ? undefined : manifest;
+}
+/** Atomically save a profile manifest while retaining unrelated fields.
+ * @param dir Profile directory.
+ * @param manifest Updated document.
+ */
+export async function saveManifest(dir, manifest) {
+    await writeFileAtomic(join(dir, 'package.json'), JSON.stringify(manifest, undefined, 2) + '\n', { mode: 0o600 });
+}
+/** Reconcile package removals and newly installed bundles without re-enabling retained dependencies. */
+async function reconcile(before, dir, anchor, options) {
+    const after = readProfileManifest('dsh', dir);
+    const dependencies = Object.keys(after.dependencies ?? {});
+    const beforeDeps = new Set(Object.keys(before.dependencies ?? {}));
+    const previous = after.dsh?.profile?.bundles ?? [];
+    const bundles = previous.filter((name) => {
+        if (!beforeDeps.has(name) && !dependencies.includes(name))
+            return true;
+        return dependencies.includes(name) && bundleManifest(name, dir, anchor) !== undefined;
+    });
+    for (const name of dependencies) {
+        if (beforeDeps.has(name))
+            continue;
+        const metadata = bundleManifest(name, dir, anchor);
+        if (metadata?.dsh?.bundle === undefined) {
+            options.onOutput?.(`dsh: warning: ${name} declares no dsh.bundle — installed as a plain dependency, not a profile layer\n`, 'stderr');
+            continue;
+        }
+        loadOverlayPatches('dsh', join(resolveBundleDir('dsh', name, anchor, dir), metadata.dsh.bundle.patch));
+        if (!bundles.includes(name)) {
+            bundles.push(name);
+        }
+    }
+    if (JSON.stringify(previous) === JSON.stringify(bundles))
+        return;
+    after.dsh = { ...after.dsh, profile: { ...after.dsh?.profile, bundles } };
+    await saveManifest(dir, after);
+}
+/** Execute pnpm inside a profile whose caller already holds the profile write lock.
+ * @param context Launcher-owned profile and resolution locations.
+ * @param args Pnpm arguments, before relative path anchoring.
+ * @param options Output, activation and cancellation policy.
+ * @returns Exit status and diagnostic path; service output is bounded, CLI output uses inherited descriptors.
+ */
+export async function runProfilePnpm(context, args, options) {
+    const dir = context.dir ?? resolveProfileDir(context.profile, context.home);
+    const before = readProfileManifest('dsh', dir);
+    const logRoot = join(dir, '.plugin-manager', 'logs');
+    await mkdir(logRoot, { recursive: true, mode: 0o700 });
+    const logDir = await mkdtemp(join(logRoot, 'operation-'));
+    const logPath = join(logDir, 'pnpm.log');
+    const log = await open(logPath, 'wx', 0o600);
+    let output = Buffer.alloc(0);
+    let truncated = false;
+    const cancellation = new AbortController();
+    const child = execa(options.command ?? 'pnpm', [...options.args ?? [], ...args.map(arg => anchorPathSpec(arg, context.cwd))], {
+        cwd: dir, env: { ...(options.execution === 'cli' ? process.env : scrubbedParentEnv()), ...options.env }, extendEnv: false, reject: false,
+        stdout: options.execution === 'cli' ? 'inherit' : 'pipe',
+        stderr: options.execution === 'cli' ? 'inherit' : 'pipe',
+        buffer: false, stdin: options.execution === 'cli' ? 'inherit' : 'ignore', cancelSignal: options.signal === undefined
+            ? cancellation.signal : AbortSignal.any([cancellation.signal, options.signal]),
+    });
+    let writes = Promise.resolve();
+    const collect = async (stream, kind) => {
+        try {
+            for await (const chunk of stream) {
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                writes = writes.then(async () => { await log.write(bytes); });
+                await writes;
+                options.onOutput?.(bytes.toString('utf8'), kind);
+                output = Buffer.concat([output, bytes]);
+                if (output.length > options.outputBytes) {
+                    truncated = true;
+                    output = output.subarray(output.length - options.outputBytes);
+                }
+            }
+        }
+        catch (error) {
+            cancellation.abort();
+            throw error;
+        }
+    };
+    let exitCode;
+    try {
+        const [completion, ...streams] = await Promise.allSettled([child,
+            ...child.stdout === null ? [] : [collect(child.stdout, 'stdout')],
+            ...child.stderr === null ? [] : [collect(child.stderr, 'stderr')],
+        ]);
+        for (const stream of streams)
+            if (stream.status === 'rejected')
+                throw stream.reason;
+        if (completion.status === 'rejected')
+            throw completion.reason;
+        const result = completion.value;
+        exitCode = result.exitCode ?? (result.code === 'ENOENT' ? 127 : 1);
+        if (result.failed && output.length === 0) {
+            const diagnostic = result.shortMessage ?? 'pnpm failed';
+            await log.write(diagnostic);
+            truncated = Buffer.byteLength(diagnostic) > options.outputBytes;
+            output = Buffer.from(diagnostic).subarray(0, options.outputBytes);
+        }
+        if (exitCode === 0 && options.activateNewBundles !== false)
+            await reconcile(before, dir, context.installAnchor, options);
+    }
+    finally {
+        await log.close();
+    }
+    return { exitCode, output: output.toString('utf8'), truncated, logPath };
+}
+/** Initialize and run the dsh plugin command with the same write lock as the service.
+ * @param context Launcher-owned locations.
+ * @param args Pnpm arguments.
+ * @param options Output and cancellation policy.
+ * @returns Completed package-manager result.
+ */
+export async function runPluginCommand(context, args, options) {
+    const dir = context.dir ?? resolveProfileDir(context.profile, context.home);
+    await mkdir(dir, { recursive: true });
+    return withFileLock(join(dir, 'package.json'), async () => {
+        if (!existsSync(join(dir, 'package.json'))) {
+            const template = PROFILE_TEMPLATES[context.profile];
+            initProfile(dir, template?.bundles ?? DEFAULT_PROFILE_BUNDLES);
+            options.onOutput?.(`dsh: initialized profile ${context.profile} at ${dir}\n`, 'stderr');
+        }
+        return runProfilePnpm(context, args, options);
+    }, options.lockWaitMs === undefined ? undefined : { waitMs: options.lockWaitMs });
+}
+/**
+ * Ask the registry what a spec names through `pnpm view`, run in the profile
+ * directory so the registry, proxy, and authentication settings of an install apply.
+ * @param dir Profile directory.
+ * @param spec One registry spec: a package name with an optional range.
+ * @param options Cancellation and the time bound.
+ * @returns pnpm's exit, output, and how the lookup ended.
+ */
+export async function viewProfilePackage(dir, spec, options) {
+    const result = await execa(options.command ?? 'pnpm', [...options.args ?? [], 'view', spec, 'name', 'version', 'description', 'dsh', '--json'], {
+        cwd: dir, env: { ...scrubbedParentEnv(), ...options.env }, extendEnv: false, reject: false, stdin: 'ignore',
+        timeout: options.timeoutMs, ...options.signal === undefined ? {} : { cancelSignal: options.signal },
+    });
+    const cause = result.exitCode === undefined && !result.timedOut && !result.isCanceled
+        ? Object.assign(new Error(result.shortMessage), { code: result.code })
+        : undefined;
+    return {
+        exitCode: result.exitCode ?? null, stdout: result.stdout, stderr: result.stderr, timedOut: result.timedOut,
+        ...cause === undefined ? {} : { cause },
+    };
+}
+//# sourceMappingURL=operations.js.map

package/lib/types/patch.d.ts

@@ -0,0 +1,9 @@
+/** Replace the last matching override or append one after existing insertions.
+ * @param filename Current profile patch file.
+ * @param id Unique composition entry id.
+ * @param name Module name used to match name-qualified overrides.
+ * @param enabled Desired entry enablement.
+ * @returns Whether the file changed.
+ */
+export declare function writePluginEnabled(filename: string, id: string, name: string, enabled: boolean): Promise<boolean>;
+//# sourceMappingURL=patch.d.ts.map

package/lib/types/patch.js

@@ -0,0 +1,50 @@
+/** Comment-preserving profile plugin enablement edits. */
+import { readFile } from 'node:fs/promises';
+import { isMap, isSeq, parseDocument } from 'yaml';
+import { loadOptionalPatches } from '@deepseek-ai/dsh-app-boot';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+/** Replace the last matching override or append one after existing insertions.
+ * @param filename Current profile patch file.
+ * @param id Unique composition entry id.
+ * @param name Module name used to match name-qualified overrides.
+ * @param enabled Desired entry enablement.
+ * @returns Whether the file changed.
+ */
+export async function writePluginEnabled(filename, id, name, enabled) {
+    let text;
+    try {
+        text = await readFile(filename, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        text = '[]\n';
+    }
+    const document = parseDocument(text, {
+        customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value) => value }],
+    });
+    const error = document.errors[0];
+    if (error !== undefined)
+        throw error;
+    if (!isSeq(document.contents))
+        throw new Error('Profile patch must be a YAML sequence');
+    loadOptionalPatches('dsh', filename);
+    const items = document.contents.items;
+    const target = items.findLast((item, index) => {
+        if (!isMap(item) || document.getIn([index, 'id']) !== id || item.has('insert'))
+            return false;
+        const expectedName = document.getIn([index, 'name']);
+        return !expectedName || expectedName === name;
+    });
+    if (isMap(target)) {
+        if (document.getIn([items.indexOf(target), 'disabled']) === !enabled)
+            return false;
+        document.setIn([items.indexOf(target), 'disabled'], !enabled);
+    }
+    else {
+        document.add({ id, disabled: !enabled });
+    }
+    await writeFileAtomic(filename, String(document), { mode: 0o600 });
+    return true;
+}
+//# sourceMappingURL=patch.js.map

package/lib/types/tools.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Required services for the management tool. */
+export declare const inject: string[];
+/** Register one management tool for discovery and the four persistent actions.
+ * @param ctx Agent-scoped tool registration context.
+ */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=tools.d.ts.map

package/lib/types/tools.js

@@ -0,0 +1,74 @@
+/** Agent-facing current-profile management using the same service as Web controls. */
+import { assertNever } from '@deepseek-ai/dsh-util-values';
+import { approveEscalation } from '@deepseek-ai/dsh-sandbox';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+/** Required services for the management tool. */
+export const inject = ['tools', 'pluginManager', 'sandboxPolicy'];
+/** Register one management tool for discovery and the four persistent actions.
+ * @param ctx Agent-scoped tool registration context.
+ */
+export function apply(ctx) {
+    ctx.tools.register(defineTool({
+        name: 'plugin_manager',
+        description: 'List plugins or bundles in the current profile, enable or disable them, install a bundle, or remove an installed bundle. Every action requires danger-full-access permission or approval for this call. Approval does not change the session permission mode. Changes affect every session in this profile. List first to obtain exact identifiers. Package installation can execute allowed build scripts. Live profiles apply changes immediately; startup profiles require restart.',
+        parameters: {
+            action: { type: 'string', required: true, enum: ['list_plugins', 'list_bundles', 'set_plugin', 'set_bundle', 'install_bundle', 'remove_bundle'], description: 'Management operation.' },
+            target: { type: 'string', description: 'Plugin entry id, bundle package name, or installation spec, according to action.' },
+            enabled: { type: 'boolean', description: 'Required for set operations; defaults to true for installation.' },
+            approvedBuilds: { type: 'array', items: { type: 'string' }, description: 'For install_bundle: pass names from pendingBuilds only after the user explicitly approves running their install scripts in the conversation. This grants persistent permission for this profile.' },
+            offset: { type: 'number', description: 'Zero-based list offset; defaults to 0.' },
+            limit: { type: 'number', description: 'List page size, from 1 to 100; defaults to 25.' },
+        },
+        output: {
+            schema: { type: 'string' },
+            render: (_args, value) => [{ type: 'text', text: value }],
+        },
+        async execute(args, exec) {
+            const policy = ctx.sandboxPolicy.resolve(exec.agent === undefined ? {} : { session: exec.agent.session });
+            await approveEscalation({
+                requestedMode: 'danger-full-access', effectiveMode: policy.mode, subject: 'plugin management operation',
+                justification: `plugin_manager ${JSON.stringify(args)}. Profile changes persist across sessions; installed Host code runs outside the workspace sandbox.`,
+            }, { approver: ctx.get('approval'), agent: exec.agent, callId: exec.callId,
+                toolName: 'plugin_manager', signal: exec.signal });
+            exec.signal.throwIfAborted();
+            const manager = ctx.pluginManager;
+            switch (args.action) {
+                case 'list_plugins':
+                case 'list_bundles': {
+                    const offset = args.offset ?? 0;
+                    const limit = args.limit ?? 25;
+                    if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(limit) || limit < 1 || limit > 100) {
+                        throw new Error('offset must be a non-negative integer and limit must be an integer from 1 to 100');
+                    }
+                    const rows = args.action === 'list_plugins' ? await manager.listPlugins() : await manager.listBundles();
+                    const entries = rows.slice(offset, offset + limit);
+                    return JSON.stringify({ entries, total: rows.length,
+                        nextOffset: offset + entries.length < rows.length ? offset + entries.length : null });
+                }
+                case 'set_plugin':
+                case 'set_bundle': {
+                    if (args.target === undefined || args.enabled === undefined)
+                        throw new Error('target and enabled are required');
+                    return JSON.stringify(await (args.action === 'set_plugin'
+                        ? manager.setPluginEnabled(args.target, args.enabled)
+                        : manager.setBundleEnabled(args.target, args.enabled)));
+                }
+                case 'install_bundle':
+                    if (args.target === undefined)
+                        throw new Error('target package spec is required');
+                    return JSON.stringify(await manager.installBundle(args.target, {
+                        ...args.enabled === undefined ? {} : { enabled: args.enabled },
+                        ...args.approvedBuilds === undefined ? {} : { approvedBuilds: args.approvedBuilds },
+                    }));
+                case 'remove_bundle':
+                    if (args.target === undefined)
+                        throw new Error('target bundle name is required');
+                    return JSON.stringify(await manager.removeBundle(args.target));
+                /* v8 ignore next -- tool JSON validation rejects actions outside the declared enum */
+                default: return assertNever(args.action);
+            }
+        },
+        presentCall: args => ({ card: 'generic', title: 'Manage profile plugins', kind: args.action.startsWith('list_') ? 'read' : 'other', rawInput: args }),
+    }));
+}
+//# sourceMappingURL=tools.js.map