@duckmind/dm-windows-x64 0.63.6 → 0.63.9

package/extensions/.dm-extensions.json

@@ -1,6 +1,6 @@
 {
   "status": "ok",
-  "prepared_at": "2026-08-31T17:37:37.181676+00:00",
+  "prepared_at": "2026-09-04T12:16:40.370686+00:00",
   "managed_entries": [
     {
       "id": "dm-context",
@@ -46,6 +46,11 @@
       "id": "dm-skills-manager",
       "target_dir": "extensions/dm-skills-manager",
       "bundle_mode": "source-package-with-runtime-deps"
+    },
+    {
+      "id": "dm-mcp-adapter",
+      "target_dir": "extensions/dm-mcp-adapter",
+      "bundle_mode": "source-package-with-runtime-deps"
     }
   ],
   "local_entries": [
@@ -588,18 +593,15 @@
         "tool": "bun build --no-bundle",
         "mode": "module-preserving-transpile",
         "files": [
-          "detect.test.js",
           "detect.js",
-          "index.test.js",
           "index.js",
-          "keychain.test.js",
           "keychain.js"
         ],
-        "file_count": 6,
-        "before_bytes": 131212,
-        "after_bytes": 82230,
-        "runtime_specifier_rewrites": 4,
-        "runtime_filename_rewrites": 6,
+        "file_count": 3,
+        "before_bytes": 73770,
+        "after_bytes": 33235,
+        "runtime_specifier_rewrites": 1,
+        "runtime_filename_rewrites": 3,
         "declaration_files_removed": 0
       }
     },
@@ -773,6 +775,143 @@
         "declaration_files_removed": 0
       }
     },
+    {
+      "id": "dm-mcp-adapter",
+      "staged_dir": "extensions/dm-mcp-adapter",
+      "bundle_mode": "source-package-with-runtime-deps",
+      "dependencies_installed": false,
+      "dependency_mode": "platform-package-dependency",
+      "dependencies_declared": [
+        "@duckmind/dm-ai",
+        "@duckmind/dm-coding-agent",
+        "@duckmind/dm-tui",
+        "@modelcontextprotocol/client",
+        "@modelcontextprotocol/core",
+        "@modelcontextprotocol/ext-apps",
+        "@napi-rs/keyring",
+        "ajv",
+        "ajv-formats",
+        "cross-spawn",
+        "open",
+        "recheck",
+        "smol-toml",
+        "strip-json-comments",
+        "typebox",
+        "zod"
+      ],
+      "dependency_patches": [
+        "dm.extensions ts->js",
+        "exports ts->js",
+        "drop-dependencies",
+        "drop-devDependencies",
+        "drop-peerDependencies",
+        "drop-repository",
+        "drop-bugs",
+        "drop-homepage",
+        "drop-scripts",
+        "drop-files",
+        "drop-types"
+      ],
+      "stripped_documentation": [
+        "CHANGELOG.md",
+        "LICENSE",
+        "README.md",
+        "banner.png"
+      ],
+      "javascript_compile": {
+        "tool": "bun build --no-bundle",
+        "mode": "module-preserving-transpile",
+        "files": [
+          "abort.js",
+          "agent-dir.js",
+          "agent-plugin-loader.js",
+          "app-bridge.bundle.js",
+          "cli.js",
+          "commands.js",
+          "config.js",
+          "consent-manager.js",
+          "direct-tools.js",
+          "dist/agent-dir.js",
+          "dist/agent-plugin-loader.js",
+          "dist/config.js",
+          "dist/mcp-bearer-store.js",
+          "dist/metadata-cache.js",
+          "dist/package-mcp-loader.js",
+          "dist/resource-tools.js",
+          "dist/types.js",
+          "dist/ui-app-bridge-helpers.js",
+          "dist/ui-stream-types.js",
+          "dist/ui-tool-visibility.js",
+          "dist/utils.js",
+          "elicitation-handler.js",
+          "error-signal.js",
+          "errors.js",
+          "failure-backoff.js",
+          "glimpse-ui.js",
+          "host-html-template.js",
+          "index.js",
+          "init.js",
+          "json-schema-validator.js",
+          "lifecycle.js",
+          "logger.js",
+          "mcp-auth-flow.js",
+          "mcp-auth.js",
+          "mcp-bearer-store.js",
+          "mcp-callback-server.js",
+          "mcp-code.js",
+          "mcp-keyring-helper.cjs",
+          "mcp-oauth-provider.js",
+          "mcp-output-guard.js",
+          "mcp-panel.js",
+          "mcp-probe.js",
+          "mcp-references.js",
+          "mcp-script-worker.mjs",
+          "mcp-setup-panel.js",
+          "mcp-status.js",
+          "mcp-trace.js",
+          "metadata-cache.js",
+          "namespace-tools.js",
+          "npx-resolver.js",
+          "oauth-handler.js",
+          "oauth.js",
+          "onboarding-state.js",
+          "package-mcp-loader.js",
+          "panel-keys.js",
+          "prompts.js",
+          "proxy-modes.js",
+          "request-headers-command.js",
+          "resource-tools.js",
+          "runtime-owner.js",
+          "sampling-handler.js",
+          "sandbox-proxy-template.js",
+          "search-ranking.js",
+          "server-manager.js",
+          "session-recovery.js",
+          "state.js",
+          "test-runner.mjs",
+          "tool-approval.js",
+          "tool-metadata.js",
+          "tool-registrar.js",
+          "tool-result-renderer.js",
+          "ts-shape.js",
+          "types.js",
+          "ui-app-bridge-helpers.js",
+          "ui-resource-handler.js",
+          "ui-server.js",
+          "ui-session.js",
+          "ui-stream-types.js",
+          "ui-tool-visibility.js",
+          "unix-socket-transport.js",
+          "utils.js"
+        ],
+        "file_count": 81,
+        "before_bytes": 1437785,
+        "after_bytes": 1265238,
+        "runtime_specifier_rewrites": 39,
+        "runtime_filename_rewrites": 64,
+        "declaration_files_removed": 12
+      }
+    },
     {
       "id": "dm-cua",
       "staged_dir": "extensions/dm-cua",
@@ -862,26 +1001,50 @@
     "turndown": "^7.2.0",
     "undici": "^8.9.0",
     "unpdf": "^1.6.2",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/core": "2.0.0",
+    "@modelcontextprotocol/ext-apps": "^1.2.2",
+    "@napi-rs/keyring": "^1.3.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "cross-spawn": "^7.0.6",
+    "open": "^10.2.0",
+    "recheck": "^4.5.0",
+    "smol-toml": "^1.6.1",
+    "strip-json-comments": "^5.0.3",
+    "zod": "^3.25.0 || ^4.0.0",
     "@sinclair/typebox": "^0.34.48"
   },
   "runtime_loader": {
     "status": "verified",
-    "entries": 12,
+    "entries": 13,
     "loader": "dm-coding-agent",
     "platform_dependencies": [
+      "@modelcontextprotocol/client",
+      "@modelcontextprotocol/core",
+      "@modelcontextprotocol/ext-apps",
       "@mozilla/readability",
+      "@napi-rs/keyring",
       "@sinclair/typebox",
       "acorn",
+      "ajv",
+      "ajv-formats",
+      "cross-spawn",
       "defuddle",
       "jiti",
       "linkedom",
+      "open",
       "p-limit",
       "promise.try",
+      "recheck",
+      "smol-toml",
+      "strip-json-comments",
       "turndown",
       "typebox",
       "undici",
       "unpdf",
-      "yaml"
+      "yaml",
+      "zod"
     ]
   }
 }

package/extensions/dm-mcp-adapter/OAUTH.md

@@ -0,0 +1,3 @@
+# DM MCP Adapter OAuth
+
+Complete the provider authorization flow shown by DM, then return to the active DM session.

package/extensions/dm-mcp-adapter/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,4 @@
+# Third-party notice
+
+This managed extension is adapted from `nicobailon/pi-mcp-adapter` at `10a45367e033a32026987a75d6f401e37340c86f` (upstream tag `v2.32.1`) under MIT.
+The upstream package name and repository are retained solely as technical provenance.

package/extensions/dm-mcp-adapter/abort.js

@@ -0,0 +1,35 @@
+export function throwIfAborted(signal) {
+  if (!signal?.aborted)
+    return;
+  throw signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason ?? "MCP request aborted"));
+}
+export async function abortable(promise, signal) {
+  if (!signal)
+    return promise;
+  throwIfAborted(signal);
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason ?? "MCP request aborted")));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then((value) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      resolve(value);
+    }, (error) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      reject(error);
+    });
+  });
+}

package/extensions/dm-mcp-adapter/agent-dir.js

@@ -0,0 +1,45 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+export function getConfigDirName() {
+  const configDir = readPiConfig()?.configDir;
+  return typeof configDir === "string" && configDir.trim() ? configDir.trim() : ".dm";
+}
+export function getAgentDir() {
+  const piConfig = readPiConfig();
+  const name = piConfig?.name;
+  const appName = typeof name === "string" && name.trim() ? name.trim() : "pi";
+  const configured = process.env[`${appName.toUpperCase()}_CODING_AGENT_DIR`]?.trim();
+  if (!configured) {
+    return join(homedir(), getConfigDirName(), "agent");
+  }
+  if (configured === "~") {
+    return homedir();
+  }
+  if (configured.startsWith("~/")) {
+    return resolve(homedir(), configured.slice(2));
+  }
+  return resolve(configured);
+}
+export function getAgentPath(...segments) {
+  return join(getAgentDir(), ...segments);
+}
+function readPiConfig() {
+  const dir = process.env.PI_PACKAGE_DIR?.trim();
+  if (!dir)
+    return;
+  try {
+    const manifest = JSON.parse(readFileSync(join(resolve(dir), "package.json"), "utf8"));
+    return manifest.piConfig;
+  } catch {
+    return;
+  }
+}
+export function getAppName() {
+  const name = readPiConfig()?.name;
+  return typeof name === "string" && name.trim() ? name.trim() : "pi";
+}
+export function getAppClientUri() {
+  const uri = readPiConfig()?.clientUri;
+  return typeof uri === "string" && uri.trim() ? uri.trim() : undefined;
+}

package/extensions/dm-mcp-adapter/agent-plugin-loader.js

@@ -0,0 +1,349 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { getAgentPath } from "./agent-dir.js";
+const PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+const MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+const PLUGIN_NAME_PATTERN = /^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
+const PLUGIN_MANIFEST_FIELDS = new Set([
+  "$schema",
+  "name",
+  "version",
+  "description",
+  "author",
+  "homepage",
+  "repository",
+  "license",
+  "keywords",
+  "extensions"
+]);
+const MCP_CONFIG_FIELDS = new Set(["$schema", "mcpServers"]);
+const STDIO_FIELDS = new Set(["type", "command", "args", "env", "cwd"]);
+const HTTP_FIELDS = new Set(["type", "url", "headers"]);
+export function loadAgentPluginConfigs(paths, cwd = process.cwd()) {
+  const mcpServers = {};
+  for (const pluginPath of getPluginPaths(paths)) {
+    const loaded = loadAgentPluginMcpConfig(pluginPath, cwd);
+    if (!loaded)
+      continue;
+    for (const [serverName, server] of Object.entries(loaded.mcpServers)) {
+      if (mcpServers[serverName]) {
+        console.warn(`Agent Plugin at ${resolvePluginPath(pluginPath, cwd)} skips duplicate normalized MCP server ${serverName}`);
+        continue;
+      }
+      mcpServers[serverName] = server;
+    }
+  }
+  return { mcpServers };
+}
+export function getAgentPluginSummaries(paths, cwd = process.cwd()) {
+  return getPluginPaths(paths).map((path) => {
+    const pluginRoot = resolvePluginPath(path, cwd);
+    const loaded = loadAgentPluginMcpConfig(path, cwd);
+    const manifest = loaded ? readPluginManifest(pluginRoot, false) : null;
+    return {
+      path: pluginRoot,
+      ...manifest?.name ? { name: manifest.name } : {},
+      serverCount: loaded ? Object.keys(loaded.mcpServers).length : 0
+    };
+  });
+}
+function getPluginPaths(paths) {
+  return Array.isArray(paths) ? paths.filter((path) => typeof path === "string") : [];
+}
+function loadAgentPluginMcpConfig(path, cwd) {
+  const pluginRoot = resolvePluginPath(path, cwd);
+  const manifest = readPluginManifest(pluginRoot, true);
+  if (!manifest)
+    return null;
+  const mcpPath = resolve(pluginRoot, "mcp.json");
+  if (!existsSync(mcpPath))
+    return { mcpServers: {} };
+  if (!statSync(mcpPath).isFile()) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcp.json is not a regular file`);
+    return { mcpServers: {} };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(mcpPath, "utf8"));
+  } catch (error) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: failed to parse mcp.json`, error);
+    return { mcpServers: {} };
+  }
+  return translateAgentPluginMcpConfig(raw, manifest, pluginRoot);
+}
+function readPluginManifest(pluginRoot, report) {
+  const manifestPath = resolve(pluginRoot, "plugin.json");
+  if (!existsSync(manifestPath)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: missing plugin.json`);
+    return null;
+  }
+  if (!statSync(manifestPath).isFile()) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json is not a regular file`);
+    return null;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (error) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: failed to parse plugin.json`, error);
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json must be an object`);
+    return null;
+  }
+  const manifest = raw;
+  for (const key of Object.keys(manifest)) {
+    if (!PLUGIN_MANIFEST_FIELDS.has(key) && report) {
+      console.warn(`Agent Plugin at ${pluginRoot} ignores unknown plugin.json field: ${key}`);
+    }
+  }
+  if (manifest.$schema !== PLUGIN_SCHEMA) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: unsupported plugin.json $schema`);
+    return null;
+  }
+  if (typeof manifest.name !== "string" || manifest.name.length < 1 || manifest.name.length > 64 || !PLUGIN_NAME_PATTERN.test(manifest.name)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json name is invalid`);
+    return null;
+  }
+  if (manifest.extensions !== undefined && (!manifest.extensions || typeof manifest.extensions !== "object" || Array.isArray(manifest.extensions))) {
+    if (report)
+      console.warn(`Agent Plugin ${manifest.name} ignores non-object plugin.json extensions`);
+  }
+  return { name: manifest.name };
+}
+function translateAgentPluginMcpConfig(raw, manifest, pluginRoot) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcp.json must be an object`);
+    return { mcpServers: {} };
+  }
+  const mcpConfig = raw;
+  for (const key of Object.keys(mcpConfig)) {
+    if (!MCP_CONFIG_FIELDS.has(key)) {
+      console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: unknown top-level field ${key}`);
+      return { mcpServers: {} };
+    }
+  }
+  if (mcpConfig.$schema !== MCP_SCHEMA) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: unsupported mcp.json $schema`);
+    return { mcpServers: {} };
+  }
+  if (!mcpConfig.mcpServers || typeof mcpConfig.mcpServers !== "object" || Array.isArray(mcpConfig.mcpServers)) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcpServers must be an object`);
+    return { mcpServers: {} };
+  }
+  const mcpServers = {};
+  for (const [serverName, entry] of Object.entries(mcpConfig.mcpServers)) {
+    const translated = translateAgentPluginServer(manifest, pluginRoot, serverName, entry);
+    if (!translated)
+      continue;
+    const normalizedName = formatAgentPluginServerName(manifest.name, serverName);
+    if (mcpServers[normalizedName]) {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: normalized server name ${normalizedName} already exists`);
+      continue;
+    }
+    mcpServers[normalizedName] = translated;
+  }
+  return { mcpServers };
+}
+function translateAgentPluginServer(manifest, pluginRoot, serverName, entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: entry must be an object`);
+    return null;
+  }
+  const raw = entry;
+  if (raw.type === "stdio")
+    return translateStdioServer(manifest, pluginRoot, serverName, raw);
+  if (raw.type === "streamable-http" || raw.type === "sse")
+    return translateHttpServer(manifest, serverName, raw, raw.type);
+  console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: unsupported type`);
+  return null;
+}
+function translateStdioServer(manifest, pluginRoot, serverName, raw) {
+  for (const key of Object.keys(raw)) {
+    if (!STDIO_FIELDS.has(key))
+      return skipServer(manifest, serverName, `unknown field ${key}`);
+  }
+  if (typeof raw.command !== "string" || raw.command.length === 0)
+    return skipServer(manifest, serverName, "command must be a non-empty string");
+  if (!isBareCommand(raw.command) && !raw.command.startsWith("./"))
+    return skipServer(manifest, serverName, "command must be bare or plugin-relative");
+  const args = translateStringArray(raw.args, manifest, serverName, "args");
+  if (args === null)
+    return null;
+  const env = translateEnv(raw.env, manifest, serverName);
+  if (env === null)
+    return null;
+  const command = raw.command.startsWith("./") ? resolveContainedPath(pluginRoot, raw.command, pluginRoot) : raw.command;
+  if (command === null)
+    return skipServer(manifest, serverName, "command must stay inside the plugin directory");
+  const pluginDataDir = getAgentPath("agent-plugin-data", manifest.name);
+  const cwd = resolvePluginCwd(raw.cwd, pluginRoot, pluginDataDir);
+  if (cwd === null)
+    return skipServer(manifest, serverName, "cwd must be plugin-relative, PLUGIN_ROOT-rooted, or PLUGIN_DATA-rooted");
+  return {
+    command,
+    args: args.map((value) => expandPluginPlaceholders(value, pluginRoot, pluginDataDir)),
+    env: {
+      ...Object.fromEntries(Object.entries(env).map(([key, value]) => [key, expandPluginPlaceholders(value, pluginRoot, pluginDataDir)])),
+      PLUGIN_ROOT: pluginRoot,
+      PLUGIN_DATA: pluginDataDir
+    },
+    cwd,
+    pluginDataDir,
+    literalEnv: true
+  };
+}
+function translateHttpServer(manifest, serverName, raw, type) {
+  for (const key of Object.keys(raw)) {
+    if (!HTTP_FIELDS.has(key))
+      return skipServer(manifest, serverName, `unknown field ${key}`);
+  }
+  if (typeof raw.url !== "string" || raw.url.length === 0)
+    return skipServer(manifest, serverName, "url must be a non-empty string");
+  if (!isValidAgentPluginUrl(raw.url))
+    return skipServer(manifest, serverName, "url must be an allowed absolute HTTP(S) URL");
+  const headers = translateHeaders(raw.headers, manifest, serverName);
+  if (headers === null)
+    return null;
+  return {
+    url: raw.url,
+    httpTransport: type,
+    ...headers ? { headers } : {}
+  };
+}
+function formatAgentPluginServerName(pluginName, serverName) {
+  const pluginPart = pluginName.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "plugin";
+  const serverPart = serverName.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "server";
+  return `${pluginPart}__${serverPart}`;
+}
+function skipServer(manifest, serverName, reason) {
+  console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: ${reason}`);
+  return null;
+}
+function translateStringArray(value, manifest, serverName, field) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: ${field} must be an array of strings`);
+    return null;
+  }
+  return value;
+}
+function translateEnv(value, manifest, serverName) {
+  if (value === undefined)
+    return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env must be an object of strings`);
+    return null;
+  }
+  const env = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "PLUGIN_ROOT" || key === "PLUGIN_DATA") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env must not define ${key}`);
+      return null;
+    }
+    if (typeof entry !== "string") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env values must be strings`);
+      return null;
+    }
+    env[key] = entry;
+  }
+  return env;
+}
+function translateHeaders(value, manifest, serverName) {
+  if (value === undefined)
+    return;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: headers must be an object of strings`);
+    return null;
+  }
+  const headers = {};
+  const seen = new Set;
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: header values must be strings`);
+      return null;
+    }
+    const normalized = key.toLowerCase();
+    if (seen.has(normalized)) {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: duplicate header ${key}`);
+      return null;
+    }
+    seen.add(normalized);
+    headers[key] = entry;
+  }
+  try {
+    new Headers(headers);
+  } catch {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: headers are not valid HTTP fields`);
+    return null;
+  }
+  return Object.keys(headers).length > 0 ? headers : undefined;
+}
+function resolvePluginPath(path, cwd) {
+  if (path === "~")
+    return resolve(process.env.HOME ?? "", ".");
+  if (path.startsWith("~/"))
+    return resolve(process.env.HOME ?? "", path.slice(2));
+  return isAbsolute(path) ? resolve(path) : resolve(cwd, path);
+}
+function isBareCommand(command) {
+  return !command.includes("/") && !command.includes("\\") && !command.includes("${PLUGIN_ROOT}") && !command.includes("${PLUGIN_DATA}");
+}
+function resolvePluginCwd(value, pluginRoot, pluginDataDir) {
+  if (value === undefined)
+    return pluginRoot;
+  if (typeof value !== "string")
+    return null;
+  if (value.startsWith("./"))
+    return resolveContainedPath(pluginRoot, value, pluginRoot);
+  if (value === "${PLUGIN_ROOT}" || value.startsWith("${PLUGIN_ROOT}/")) {
+    return resolveContainedPath(pluginRoot, value.replace("${PLUGIN_ROOT}", "."), pluginRoot);
+  }
+  if (value === "${PLUGIN_DATA}" || value.startsWith("${PLUGIN_DATA}/")) {
+    return resolveContainedPath(pluginDataDir, value.replace("${PLUGIN_DATA}", "."), pluginDataDir);
+  }
+  return null;
+}
+function resolveContainedPath(root, value, containmentRoot) {
+  const resolved = resolve(root, value);
+  const rel = relative(containmentRoot, resolved);
+  if (rel === "" || !rel.startsWith("..") && !rel.startsWith(sep) && !isAbsolute(rel))
+    return resolved;
+  return null;
+}
+function expandPluginPlaceholders(value, pluginRoot, pluginDataDir) {
+  return value.replaceAll("${PLUGIN_ROOT}", pluginRoot).replaceAll("${PLUGIN_DATA}", pluginDataDir);
+}
+function isValidAgentPluginUrl(value) {
+  if (value.includes("${") || value.includes("$env:") || value.includes("{env:"))
+    return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    return false;
+  if (url.username || url.password || url.hash)
+    return false;
+  if (url.protocol === "https:")
+    return true;
+  return isLoopbackHost(url.hostname);
+}
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+    return true;
+  if (/^127(?:\.\d{1,3}){3}$/.test(host))
+    return true;
+  return false;
+}