@epoch-agent/core 0.21.0 → 0.22.0

package/dist/index.js

@@ -6296,6 +6296,7 @@ var ManifestSchema = z.object({
   epochVersion: z.string().min(1).optional(),
   homepage: z.string().min(1).optional(),
   keywords: z.array(z.string().min(1)).optional(),
+  dependencies: z.array(z.string().min(1)).optional().catch(void 0),
   displayName: z.string().min(1).optional(),
   category: z.string().min(1).optional(),
   icon: z.string().min(1).optional(),
@@ -6338,6 +6339,23 @@ function readPluginManifest(dir) {
       })
     });
   }
+  const rawDependencies = parsed?.dependencies;
+  if (rawDependencies !== void 0 && !Array.isArray(rawDependencies)) {
+    issues.push({
+      path: `${path}.dependencies`,
+      message: t("plugin_manifest.bad_dependencies", { raw: JSON.stringify(rawDependencies) })
+    });
+  }
+  if (Array.isArray(rawDependencies)) {
+    for (const item of rawDependencies) {
+      if (typeof item !== "string" || !isValidPluginName(item)) {
+        issues.push({
+          path: `${path}.dependencies`,
+          message: t("plugin_manifest.bad_dependency_name", { name: String(item) })
+        });
+      }
+    }
+  }
   const checked = parseLenient(ManifestSchema.optional(), parsed, void 0);
   if (!checked.value) {
     issues.push(
@@ -6639,6 +6657,7 @@ function loadPlugins(opts) {
   const state = readPluginRecords(statePath);
   const out = noPlugins();
   out.issues.push(...state.issues);
+  const declared = /* @__PURE__ */ new Map();
   const epochVersion = opts.epochVersion ?? currentEpochVersion();
   for (const record of state.records) {
     const outcome = admit(record, epochVersion);
@@ -6657,6 +6676,21 @@ function loadPlugins(opts) {
       continue;
     }
     collect(record, out);
+    if (outcome.manifest?.dependencies?.length) {
+      declared.set(record.name, outcome.manifest.dependencies);
+    }
+  }
+  const present = new Set(out.loaded.map((plugin) => plugin.name));
+  for (const [name, dependencies] of declared) {
+    if (!present.has(name)) continue;
+    for (const dependency of dependencies) {
+      if (present.has(dependency)) continue;
+      diags?.warn(
+        MODULE,
+        t("plugin_load.dependency_missing", { name, dependency }),
+        "plugin-dependency-missing"
+      );
+    }
   }
   for (const detail of issueDetails(out.issues)) {
     diags?.warn(MODULE, detail, "plugin-invalid");
@@ -6683,7 +6717,7 @@ function admit(record, epochVersion) {
   if (!version.ok) {
     return { reason: version.reason, code: "plugin-version-mismatch" };
   }
-  return {};
+  return { manifest: manifest.manifest };
 }
 function collect(record, out) {
   const { name, path: dir } = record;
@@ -7029,708 +7063,874 @@ function firstLine3(err) {
   const message = err instanceof Error ? err.message : String(err);
   return message.split("\n")[0] ?? message;
 }
-var NPM_SPEC = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:@[a-zA-Z0-9.^~*+-]+)?$/;
-var REMOTE_URL = /^https?:\/\/[^\s'"\\^|<>]+$/;
-function resolveSource(raw) {
-  const input = raw.trim();
-  if (!input) return void 0;
-  if (input.startsWith("github:")) {
-    const [slug = "", fragment] = input.slice("github:".length).split("#", 2);
-    if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) return void 0;
-    const sub = subdirOf(fragment);
-    if (!sub.ok) return void 0;
-    return {
-      type: "git",
-      raw: input,
-      target: `https://github.com/${slug}.git`,
-      ...sub.subdir ? { subdir: sub.subdir } : {}
-    };
-  }
-  if (input.startsWith("git+")) {
-    const [url = "", fragment] = input.slice("git+".length).split("#", 2);
-    if (!REMOTE_URL.test(url)) return void 0;
-    const sub = subdirOf(fragment);
-    if (!sub.ok) return void 0;
-    return { type: "git", raw: input, target: url, ...sub.subdir ? { subdir: sub.subdir } : {} };
-  }
-  if (input.startsWith("npm:")) {
-    const pkg = input.slice("npm:".length);
-    if (!NPM_SPEC.test(pkg)) return void 0;
-    return { type: "npm", raw: input, target: pkg };
-  }
-  if (input.startsWith("host:")) {
-    const opaque = input.slice("host:".length).trim();
-    if (!opaque) return void 0;
-    return { type: "host", raw: input, target: opaque };
-  }
-  if (input.startsWith("https://") || input.startsWith("http://")) {
-    const [url = "", fragment] = input.split("#", 2);
-    if (!REMOTE_URL.test(url)) return void 0;
-    const sha = fragment?.startsWith("sha256=") ? fragment.slice("sha256=".length) : void 0;
-    if (isArchiveUrl(url)) {
-      if (sha !== void 0 && !/^[a-f0-9]{64}$/i.test(sha)) return void 0;
-      return {
-        type: "archive",
-        raw: input,
-        target: url,
-        ...sha ? { sha256: sha.toLowerCase() } : {}
-      };
-    }
-    return { type: "git", raw: input, target: url };
-  }
-  const abs = isAbsolute(input) ? input : resolve(input);
-  if (isArchiveUrl(abs)) {
-    return { type: "archive", raw: input, target: abs, localFile: true };
-  }
-  return { type: "local", raw: input, target: abs };
-}
-function isArchiveUrl(url) {
-  return isWirePluginArchiveName(url);
+var MARKETPLACE_FILE = "epoch-marketplace.json";
+var NAME_PATTERN = PLUGIN_NAME_PATTERN;
+var EntryCategoryInput = z.union([z.string().min(1), z.array(z.string().min(1))]).optional().catch(void 0);
+var EntryShape = z.object({
+  name: z.string().regex(NAME_PATTERN),
+  description: z.string().min(1).optional(),
+  source: z.string().min(1),
+  category: EntryCategoryInput,
+  keywords: z.array(z.string().min(1)).optional(),
+  author: PluginAuthorSchema.optional(),
+  downloads: z.number().int().nonnegative().optional(),
+  likes: z.number().int().nonnegative().optional(),
+  displayName: z.string().min(1).optional(),
+  icon: z.string().min(1).optional(),
+  version: z.string().min(1).optional(),
+  changelog: z.string().min(1).optional(),
+  size: z.number().int().positive().optional(),
+  homepage: z.string().min(1).optional(),
+  visibility: z.enum(PLUGIN_VISIBILITY).optional().catch(void 0),
+  status: z.enum(["listed", "reviewing", "rejected", "offline"]).optional().catch(void 0)
+});
+var EntrySchema = EntryShape.transform(({ category, ...rest }) => {
+  const picked = category === void 0 ? [] : typeof category === "string" ? [category] : category;
+  return { ...rest, ...picked.length === 0 ? {} : { category: [...picked] } };
+});
+var MARKETPLACE_DISPLAY_FIELDS = [
+  "status",
+  "downloads",
+  "likes",
+  "author",
+  "category",
+  "visibility",
+  "icon",
+  "homepage",
+  "size"
+];
+var DisplaySchema = z.object({
+  fields: z.array(z.string().min(1)).optional()
+});
+var CategoryNodeSchema = z.lazy(
+  () => z.object({
+    id: z.string().min(1),
+    label: z.string().min(1).optional(),
+    children: z.array(CategoryNodeSchema).optional()
+  })
+);
+var CategoriesSchema = z.array(CategoryNodeSchema).refine(hasUniqueCategoryIds, { message: "category ids must be unique across the whole tree" }).optional().catch(void 0);
+function hasUniqueCategoryIds(nodes) {
+  const seen = /* @__PURE__ */ new Set();
+  const walk3 = (list) => list.every((node) => {
+    if (seen.has(node.id)) return false;
+    seen.add(node.id);
+    return node.children === void 0 || walk3(node.children);
+  });
+  return walk3(nodes);
 }
-function subdirOf(fragment) {
-  if (fragment === void 0 || fragment === "") return { ok: true };
-  if (!fragment.startsWith("subdir=")) return { ok: false };
-  const rel = fragment.slice("subdir=".length).replace(/\/+$/, "");
-  if (!/^[\w.-]+(?:\/[\w.-]+)*$/.test(rel)) return { ok: false };
-  if (rel.split("/").includes("..")) return { ok: false };
-  return { ok: true, subdir: rel };
+var CatalogSchema = z.object({
+  name: z.string().regex(NAME_PATTERN),
+  description: z.string().min(1).optional(),
+  owner: z.object({ name: z.string().min(1), url: z.string().min(1).optional() }).optional(),
+  display: DisplaySchema.optional(),
+  categories: CategoriesSchema,
+  plugins: z.array(EntrySchema)
+});
+var RecordSchema2 = z.object({
+  name: z.string().regex(NAME_PATTERN),
+  source: z.string().min(1),
+  addedAt: z.number(),
+  catalog: CatalogSchema
+});
+var StateSchema2 = z.object({
+  version: z.literal(1).optional(),
+  marketplaces: z.array(RecordSchema2)
+});
+function projectEntryForDisplay(entry, display) {
+  const allowed = display?.fields;
+  if (allowed === void 0) return entry;
+  const out = { ...entry };
+  for (const field of MARKETPLACE_DISPLAY_FIELDS) {
+    if (!displayAllows(display, field)) delete out[field];
+  }
+  return out;
 }
-function pluginRoot(source, staging) {
-  return source.subdir ? join(staging, source.subdir) : staging;
+function displayAllows(display, field) {
+  const allowed = display?.fields;
+  if (allowed === void 0) return true;
+  return allowed.includes(field);
 }
-// src/plugin/install.ts
-async function installPlugin(source, opts) {
-  const resolved = resolveSource(source);
-  if (!resolved) {
+function readMarketplaces(statePath) {
+  if (!existsSync(statePath)) return { records: [], issues: [] };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(statePath, "utf-8"));
+  } catch (err) {
     return {
-      ok: false,
-      reason: t("plugin_install.bad_source", { source })
+      records: [],
+      issues: [
+        { path: statePath, message: t("plugin_marketplace.bad_json", { reason: first(err) }) }
+      ]
     };
   }
-  mkdirSync(opts.pluginsDir, { recursive: true });
-  const staging = join(opts.pluginsDir, `.staging-${randomUUID().slice(0, 8)}`);
+  const checked = parseLenient(StateSchema2.optional(), raw, void 0);
+  if (!checked.value) {
+    return {
+      records: [],
+      issues: checked.issues.map((i) => ({
+        path: statePath,
+        message: t("plugin_marketplace.issue", { path: i.path, message: i.message })
+      }))
+    };
+  }
+  return { records: checked.value.marketplaces, issues: [] };
+}
+async function mutate(statePath, fn) {
+  const release = await acquireStateLock(statePath);
   try {
-    return await runInstall(resolved, staging, opts);
+    const next = fn(readMarketplaces(statePath).records);
+    if (!next) return false;
+    writeStateFile(statePath, JSON.stringify({ version: 1, marketplaces: next }, null, 2));
+    return true;
   } finally {
-    rmSync(staging, { recursive: true, force: true });
+    release();
   }
 }
-async function runInstall(resolved, staging, opts) {
-  const fetched = await fetchInto(resolved, staging, opts);
-  if (!fetched.ok) return { ok: false, reason: fetched.reason };
-  const readDir = resolved.type === "local" ? resolved.target : pluginRoot(resolved, staging);
-  const read = readPluginManifest(readDir);
-  const manifest = read.manifest;
-  if (!manifest) {
-    const detail = read.issues.map((i) => t("plugin_install.issue_line", { path: i.path, message: i.message })).join("\n");
-    return { ok: false, reason: t("plugin_install.manifest_unusable", { detail: `
-${detail}` }) };
-  }
-  const taken = new PluginStore(opts.statePath).read().records.find((r) => r.name === manifest.name);
-  const conflict = taken && taken.name !== opts.replace ? taken : void 0;
-  const current = opts.epochVersion ?? currentEpochVersion();
-  const version = checkEpochVersion(manifest.epochVersion, current);
-  const versionUnmet = !version.ok && manifest.epochVersion ? { required: manifest.epochVersion, current, reason: version.reason } : void 0;
-  const preview3 = {
-    manifest,
-    source: resolved,
-    inventory: scanPluginDir(readDir, manifest.name),
-    ...conflict ? { conflict } : {},
-    ...versionUnmet ? { versionUnmet } : {}
+async function addMarketplace(source, opts) {
+  const fetched = await fetchCatalog(source);
+  if (!fetched.ok) return fetched;
+  const record = {
+    name: fetched.catalog.name,
+    source: source.trim(),
+    addedAt: Date.now(),
+    catalog: fetched.catalog
   };
-  if (opts.replace !== void 0 && manifest.name !== opts.replace) {
+  const written = await mutate(
+    opts.statePath,
+    (records) => records.some((r) => r.name === record.name) ? void 0 : [...records, record].sort((a, b) => a.name.localeCompare(b.name))
+  );
+  return written ? { ok: true, record } : {
+    ok: false,
+    reason: t("plugin_marketplace.already_added", { name: record.name })
+  };
+}
+async function removeMarketplace(name, opts) {
+  const written = await mutate(
+    opts.statePath,
+    (records) => records.some((r) => r.name === name) ? records.filter((r) => r.name !== name) : void 0
+  );
+  return written ? { ok: true } : { ok: false, reason: t("plugin_marketplace.not_added", { name }) };
+}
+async function updateMarketplace(name, opts) {
+  const existing = readMarketplaces(opts.statePath).records.find((r) => r.name === name);
+  if (!existing) return { ok: false, reason: t("plugin_marketplace.not_added", { name }) };
+  const fetched = await fetchCatalog(existing.source);
+  if (!fetched.ok) return fetched;
+  if (fetched.catalog.name !== name) {
     return {
       ok: false,
-      preview: preview3,
-      reason: t("plugin_install.renamed", { found: manifest.name, expected: opts.replace })
+      reason: t("plugin_marketplace.renamed", {
+        source: existing.source,
+        name: fetched.catalog.name
+      })
     };
   }
-  if (conflict) {
+  const record = { ...existing, catalog: fetched.catalog };
+  await mutate(opts.statePath, (records) => records.map((r) => r.name === name ? record : r));
+  return { ok: true, record };
+}
+function searchMarketplaces(keyword, statePath) {
+  const needle = keyword.trim().toLowerCase();
+  const hits = [];
+  for (const record of readMarketplaces(statePath).records) {
+    for (const entry of record.catalog.plugins) {
+      const haystack = [
+        entry.name,
+        entry.description ?? "",
+        ...entry.category ?? [],
+        entry.author?.name ?? "",
+        ...entry.keywords ?? []
+      ].join(" ").toLowerCase();
+      if (needle && !haystack.includes(needle)) continue;
+      hits.push({
+        marketplace: record.name,
+        entry: projectEntryForDisplay(entry, record.catalog.display),
+        ref: `${record.name}/${entry.name}`
+      });
+    }
+  }
+  return hits;
+}
+function resolveMarketplaceRef(input, statePath) {
+  const parts = input.trim().split("/");
+  if (parts.length !== 2) return void 0;
+  const [market = "", plugin = ""] = parts;
+  if (!NAME_PATTERN.test(market) || !NAME_PATTERN.test(plugin)) return void 0;
+  const record = readMarketplaces(statePath).records.find((r) => r.name === market);
+  if (!record) {
     return {
       ok: false,
-      preview: preview3,
-      reason: t("plugin_install.already_installed", {
-        name: conflict.name,
-        version: conflict.version,
-        source: conflict.source
-      })
+      reason: t("plugin_marketplace.market_not_added", { market, input })
     };
   }
-  if (opts.confirm && !await opts.confirm(preview3)) {
-    return { ok: false, reason: t("plugin.install_cancelled"), cancelled: true, preview: preview3 };
-  }
-  const record = await commit(resolved, staging, preview3, opts);
-  return record ? { ok: true, record, preview: preview3 } : {
-    ok: false,
-    preview: preview3,
-    reason: t("plugin_install.raced", { name: manifest.name })
-  };
-}
-async function commit(source, staging, preview3, opts) {
-  const name = preview3.manifest.name;
-  const dest = join(opts.pluginsDir, name);
-  removeInstallDest(dest);
-  const linked = source.type === "local";
-  if (linked) {
-    try {
-      symlinkSync(source.target, dest, "junction");
-    } catch {
-      opts.onProgress?.(t("plugin_install.symlink_failed"));
-      cpSync(source.target, dest, { recursive: true });
-      return write(false);
-    }
-  } else {
-    renameSync(pluginRoot(source, staging), dest);
+  const entry = record.catalog.plugins.find((p) => p.name === plugin);
+  if (!entry) {
+    return {
+      ok: false,
+      reason: t("plugin_marketplace.plugin_not_in_market", { market, plugin })
+    };
   }
-  return write(linked);
-  function write(isLink) {
-    const record = {
-      name,
-      version: preview3.manifest.version,
-      source: source.raw,
-      sourceType: source.type,
-      path: dest,
-      linked: isLink,
-      enabled: true,
-      installedAt: Date.now(),
-      ...opts.marketplace ? { marketplace: opts.marketplace } : {},
-      ...source.sha256 ? { checksum: `sha256:${source.sha256}` } : {}
+  const source = resolveEntrySource(entry.source, record.source);
+  if (!source) {
+    return {
+      ok: false,
+      reason: t("plugin_marketplace.entry_unresolvable", {
+        market,
+        plugin,
+        source: entry.source
+      })
     };
-    return new PluginStore(opts.statePath).mutate((records) => {
-      const taken = records.some((r) => r.name === name);
-      if (taken && opts.replace !== name) return void 0;
-      return {
-        records: taken ? records.map((r) => r.name === name ? record : r) : [...records, record],
-        result: record
-      };
-    });
   }
+  return { ok: true, ref: { marketplace: market, source } };
 }
-function removeInstallDest(dest) {
-  let link = false;
-  try {
-    link = lstatSync(dest).isSymbolicLink();
-  } catch {
-  }
-  if (!link) {
-    rmSync(dest, { recursive: true, force: true });
-    return;
+function resolveEntrySource(entry, marketSource) {
+  const spec = entry.trim();
+  if (!spec.startsWith(".") && !spec.startsWith("/")) return spec;
+  const rel = spec.replace(/^\.\//, "").replace(/^\//, "");
+  if (rel === "" || rel.split("/").includes("..")) return void 0;
+  const market = marketSource.trim();
+  if (market.startsWith("github:") || market.startsWith("git+")) {
+    const [base = "", fragment] = market.split("#", 2);
+    const prefix = fragment?.startsWith("subdir=") ? `${fragment.slice("subdir=".length)}/` : "";
+    return `${base}#subdir=${prefix}${rel}`;
   }
-  try {
-    unlinkSync(dest);
-  } catch {
-    rmdirSync(dest);
+  if (market.startsWith("https://") || market.startsWith("http://")) {
+    return `${market.replace(/\/[^/]*$/, "")}/${rel}`;
   }
+  return join(marketDir(market), rel);
 }
-async function fetchInto(source, staging, opts) {
-  if (source.type === "local") return fetchLocal(source);
-  if (source.type === "git") return fetchGit(source, staging, opts);
-  if (source.type === "npm") return fetchNpm(source, staging, opts);
-  if (source.type === "host") return fetchFromHost(source, staging, opts);
-  if (source.localFile) return fetchLocalArchive(source, staging);
-  return fetchArchive(source, staging, opts);
-}
-async function fetchLocalArchive(source, staging) {
-  if (!existsSync(source.target)) {
-    return { ok: false, reason: t("plugin_install.archive_missing", { path: source.target }) };
+function findMarketplaceEntryByName(name, statePath) {
+  for (const record of readMarketplaces(statePath).records) {
+    const entry = record.catalog.plugins.find((plugin) => plugin.name === name);
+    if (!entry) continue;
+    const source = resolveEntrySource(entry.source, record.source);
+    if (!source) continue;
+    return { marketplace: record.name, source };
   }
-  mkdirSync(staging, { recursive: true });
-  return extractArchive(source.target, staging);
+  return void 0;
 }
-async function fetchFromHost(source, staging, opts) {
-  const ask = opts.fetchFromHost;
-  if (!ask) {
-    return { ok: false, reason: t("plugin_install.host_fetch_unavailable") };
-  }
-  opts.onProgress?.(t("plugin_install.host_fetching", { target: source.target }));
-  mkdirSync(staging, { recursive: true });
-  return withDownloadDir(async (dl) => {
-    let answer;
+async function fetchCatalog(source) {
+  const input = source.trim();
+  if (!input) return { ok: false, reason: t("plugin_marketplace.source_empty") };
+  const local = localCatalogPath(input);
+  if (local) {
+    if (!existsSync(local)) {
+      return { ok: false, reason: t("plugin_marketplace.local_missing", { path: local }) };
+    }
     try {
-      answer = await ask({ target: source.target, destDir: dl });
+      return parseCatalog(readFileSync(local, "utf-8"), local);
     } catch (err) {
-      return {
-        ok: false,
-        reason: t("plugin_install.host_fetch_threw", {
-          reason: (err instanceof Error ? err.message : String(err)).split("\n")[0] ?? ""
-        })
-      };
-    }
-    if (!answer.ok) {
-      return {
-        ok: false,
-        reason: answer.reason ?? t("plugin_install.host_fetch_failed", { target: source.target })
-      };
+      return { ok: false, reason: t("plugin_marketplace.read_failed", { reason: first(err) }) };
     }
-    if (!existsSync(answer.archivePath)) {
+  }
+  const url = catalogUrl(input);
+  if (!url) {
+    return {
+      ok: false,
+      reason: t("plugin_marketplace.bad_url", { input, file: MARKETPLACE_FILE })
+    };
+  }
+  try {
+    const response = await fetch(url, { redirect: "follow" });
+    if (!response.ok) {
+      const vars = { url, status: response.status };
       return {
         ok: false,
-        reason: t("plugin_install.host_fetch_no_file", { path: answer.archivePath })
+        reason: looksPrivate(response.status) ? t("marketplace.fetch_failed_private", vars) : t("marketplace.fetch_failed", vars)
       };
     }
-    return extractArchive(answer.archivePath, staging);
-  });
-}
-function fetchLocal(source) {
-  if (!existsSync(source.target)) {
-    return { ok: false, reason: t("plugin_install.local_missing", { path: source.target }) };
+    return parseCatalog(await response.text(), url);
+  } catch (err) {
+    return { ok: false, reason: t("marketplace.fetch_error", { url, reason: first(err) }) };
   }
-  return { ok: true };
 }
-async function fetchGit(source, staging, opts) {
-  opts.onProgress?.(t("plugin_install.cloning", { target: source.target }));
-  const result = await runCommand("git", ["clone", "--depth", "1", source.target, staging]);
-  if (!result.ok) {
-    return { ok: false, reason: t("plugin_install.clone_failed", { detail: result.detail }) };
+function looksPrivate(status) {
+  return status === 401 || status === 403 || status === 404;
+}
+function catalogUrl(input) {
+  if (input.startsWith("github:")) {
+    const slug = input.slice("github:".length);
+    if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) return void 0;
+    return `https://raw.githubusercontent.com/${slug}/HEAD/${MARKETPLACE_FILE}`;
   }
-  rmSync(join(staging, ".git"), { recursive: true, force: true });
-  return { ok: true };
+  if (!input.startsWith("https://") && !input.startsWith("http://")) return void 0;
+  return input.endsWith(".json") ? input : `${input.replace(/\/+$/, "")}/${MARKETPLACE_FILE}`;
 }
-async function fetchNpm(source, staging, opts) {
-  opts.onProgress?.(t("plugin_install.npm_fetching", { target: source.target }));
-  mkdirSync(staging, { recursive: true });
-  return withDownloadDir(async (dl) => {
-    const packed = await runCommand(
-      "npm",
-      ["pack", source.target, "--pack-destination", dl, "--silent"],
-      { cwd: dl, windowsShell: true }
-    );
-    if (!packed.ok) {
-      return { ok: false, reason: t("plugin_install.npm_pack_failed", { detail: packed.detail }) };
-    }
-    const tarball = packed.stdout.trim().split("\n").pop()?.trim();
-    if (!tarball) return { ok: false, reason: t("plugin_install.npm_no_tarball") };
-    return extractArchive(isAbsolute(tarball) ? tarball : join(dl, tarball), staging);
-  });
+function localCatalogPath(input) {
+  if (/^[a-z][a-z0-9+.-]+:/i.test(input) || input.startsWith("//")) return void 0;
+  const abs = isAbsolute(input) ? input : resolve(input);
+  if (existsSync(abs) && statSync(abs).isDirectory()) return join(abs, MARKETPLACE_FILE);
+  return abs;
 }
-async function fetchArchive(source, staging, opts) {
-  opts.onProgress?.(t("plugin_install.downloading", { target: source.target }));
-  mkdirSync(staging, { recursive: true });
-  let bytes;
+function marketDir(market) {
+  const abs = isAbsolute(market) ? market : resolve(market);
+  if (existsSync(abs) && statSync(abs).isDirectory()) return abs;
+  return abs.replace(/[/\\][^/\\]*$/, "");
+}
+function parseCatalog(body2, where) {
+  let raw;
   try {
-    const response = await fetch(source.target, { redirect: "follow" });
-    if (!response.ok) {
-      return {
-        ok: false,
-        reason: t("plugin_install.download_http", {
-          status: response.status,
-          statusText: response.statusText
-        })
-      };
-    }
-    bytes = Buffer.from(await response.arrayBuffer());
+    raw = JSON.parse(body2);
   } catch (err) {
     return {
       ok: false,
-      reason: t("plugin_install.download_failed", {
-        message: err instanceof Error ? err.message : String(err)
-      })
+      reason: t("plugin_marketplace.catalog_bad_json", { where, reason: first(err) })
     };
   }
-  if (source.sha256) {
-    const actual = createHash("sha256").update(bytes).digest("hex");
-    if (actual !== source.sha256) {
-      return {
-        ok: false,
-        reason: [
-          t("plugin_install.sha_mismatch"),
-          t("plugin_install.sha_expected", { expected: source.sha256 }),
-          t("plugin_install.sha_actual", { actual })
-        ].join("\n")
-      };
-    }
+  const checked = parseLenient(CatalogSchema.optional(), raw, void 0);
+  if (!checked.value) {
+    const detail = checked.issues.map((i) => t("plugin_marketplace.issue", { path: i.path, message: i.message })).join(t("plugin_marketplace.catalog_issue_sep"));
+    return { ok: false, reason: t("plugin_marketplace.catalog_invalid", { where, detail }) };
   }
-  return withDownloadDir(async (dl) => {
-    const archive = join(dl, `download${archiveExt(source.target)}`);
-    writeFileSync(archive, bytes);
-    return extractArchive(archive, staging);
-  });
+  return { ok: true, catalog: checked.value };
 }
-function archiveExt(url) {
-  const path = (url.split("?")[0] ?? "").toLowerCase();
-  if (path.endsWith(".tgz")) return ".tgz";
-  if (path.endsWith(".tar.gz")) return ".tar.gz";
-  return ".zip";
+function first(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message.split("\n")[0] ?? t("plugin_marketplace.unknown_error");
 }
-async function withDownloadDir(fn) {
-  const dir = mkdtempSync(join(tmpdir(), "epoch-plugin-dl-"));
-  try {
-    return await fn(dir);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
+var NPM_SPEC = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:@[a-zA-Z0-9.^~*+-]+)?$/;
+var REMOTE_URL = /^https?:\/\/[^\s'"\\^|<>]+$/;
+function resolveSource(raw) {
+  const input = raw.trim();
+  if (!input) return void 0;
+  if (input.startsWith("github:")) {
+    const [slug = "", fragment] = input.slice("github:".length).split("#", 2);
+    if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) return void 0;
+    const sub = subdirOf(fragment);
+    if (!sub.ok) return void 0;
+    return {
+      type: "git",
+      raw: input,
+      target: `https://github.com/${slug}.git`,
+      ...sub.subdir ? { subdir: sub.subdir } : {}
+    };
+  }
+  if (input.startsWith("git+")) {
+    const [url = "", fragment] = input.slice("git+".length).split("#", 2);
+    if (!REMOTE_URL.test(url)) return void 0;
+    const sub = subdirOf(fragment);
+    if (!sub.ok) return void 0;
+    return { type: "git", raw: input, target: url, ...sub.subdir ? { subdir: sub.subdir } : {} };
+  }
+  if (input.startsWith("npm:")) {
+    const pkg = input.slice("npm:".length);
+    if (!NPM_SPEC.test(pkg)) return void 0;
+    return { type: "npm", raw: input, target: pkg };
+  }
+  if (input.startsWith("host:")) {
+    const opaque = input.slice("host:".length).trim();
+    if (!opaque) return void 0;
+    return { type: "host", raw: input, target: opaque };
+  }
+  if (input.startsWith("https://") || input.startsWith("http://")) {
+    const [url = "", fragment] = input.split("#", 2);
+    if (!REMOTE_URL.test(url)) return void 0;
+    const sha = fragment?.startsWith("sha256=") ? fragment.slice("sha256=".length) : void 0;
+    if (isArchiveUrl(url)) {
+      if (sha !== void 0 && !/^[a-f0-9]{64}$/i.test(sha)) return void 0;
+      return {
+        type: "archive",
+        raw: input,
+        target: url,
+        ...sha ? { sha256: sha.toLowerCase() } : {}
+      };
+    }
+    return { type: "git", raw: input, target: url };
+  }
+  const abs = isAbsolute(input) ? input : resolve(input);
+  if (isArchiveUrl(abs)) {
+    return { type: "archive", raw: input, target: abs, localFile: true };
   }
+  return { type: "local", raw: input, target: abs };
 }
-// src/plugin/root-token.ts
-var PLUGIN_ROOT_TOKEN = "${EPOCH_PLUGIN_ROOT}";
-var PLUGIN_ROOT_ENV = "EPOCH_PLUGIN_ROOT";
-function mentionsPluginRoot(text) {
-  return text.includes(PLUGIN_ROOT_TOKEN);
+function isArchiveUrl(url) {
+  return isWirePluginArchiveName(url);
 }
-function substitutePluginRoot(text, root) {
-  return text.split(PLUGIN_ROOT_TOKEN).join(root);
+function subdirOf(fragment) {
+  if (fragment === void 0 || fragment === "") return { ok: true };
+  if (!fragment.startsWith("subdir=")) return { ok: false };
+  const rel = fragment.slice("subdir=".length).replace(/\/+$/, "");
+  if (!/^[\w.-]+(?:\/[\w.-]+)*$/.test(rel)) return { ok: false };
+  if (rel.split("/").includes("..")) return { ok: false };
+  return { ok: true, subdir: rel };
 }
-async function uninstallPlugin(name, opts) {
-  const removed = await new PluginStore(opts.statePath).mutate((records) => {
-    const hit = records.find((r) => r.name === name);
-    if (!hit) return void 0;
-    return { records: records.filter((r) => r.name !== name), result: hit };
-  });
-  if (!removed) return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
-  if (removed.linked) {
-    rmSync(removed.path, { force: true });
-    return { ok: true, message: t("plugin_lifecycle.uninstalled_link", { name }) };
-  }
-  rmSync(removed.path, { recursive: true, force: true });
-  return { ok: true, message: t("plugin_lifecycle.uninstalled", { name }) };
+function pluginRoot(source, staging) {
+  return source.subdir ? join(staging, source.subdir) : staging;
 }
-async function setPluginEnabled(name, enabled, opts) {
-  const changed = await new PluginStore(opts.statePath).mutate((records) => {
-    const hit = records.find((r) => r.name === name);
-    if (!hit) return void 0;
+// src/plugin/install.ts
+async function installPlugin(source, opts) {
+  const resolved = resolveSource(source);
+  if (!resolved) {
     return {
-      records: records.map((r) => r.name === name ? { ...r, enabled } : r),
-      result: hit.enabled !== enabled
+      ok: false,
+      reason: t("plugin_install.bad_source", { source })
     };
-  });
-  if (changed === void 0) {
-    return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
   }
-  const verb = enabled ? t("plugin_lifecycle.verb_enable") : t("plugin_lifecycle.verb_disable");
-  return {
-    ok: true,
-    message: changed ? t("plugin_lifecycle.toggled", { verb, name }) : t("plugin_lifecycle.already", { name, verb })
-  };
-}
-async function updatePlugin(name, opts) {
-  const existing = new PluginStore(opts.statePath).read().records.find((r) => r.name === name);
-  if (!existing) return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
-  if (existing.linked) {
-    return {
-      ok: true,
-      message: t("plugin_lifecycle.linked_no_update", { name, source: existing.source })
-    };
+  mkdirSync(opts.pluginsDir, { recursive: true });
+  const staging = join(opts.pluginsDir, `.staging-${randomUUID().slice(0, 8)}`);
+  try {
+    return await runInstall(resolved, staging, opts);
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
   }
-  return installPlugin(existing.source, {
-    ...opts,
-    replace: name,
-    ...existing.marketplace ? { marketplace: existing.marketplace } : {}
-  });
-}
-var MARKETPLACE_FILE = "epoch-marketplace.json";
-var NAME_PATTERN = PLUGIN_NAME_PATTERN;
-var EntryCategoryInput = z.union([z.string().min(1), z.array(z.string().min(1))]).optional().catch(void 0);
-var EntryShape = z.object({
-  name: z.string().regex(NAME_PATTERN),
-  description: z.string().min(1).optional(),
-  source: z.string().min(1),
-  category: EntryCategoryInput,
-  keywords: z.array(z.string().min(1)).optional(),
-  author: PluginAuthorSchema.optional(),
-  downloads: z.number().int().nonnegative().optional(),
-  likes: z.number().int().nonnegative().optional(),
-  displayName: z.string().min(1).optional(),
-  icon: z.string().min(1).optional(),
-  version: z.string().min(1).optional(),
-  changelog: z.string().min(1).optional(),
-  size: z.number().int().positive().optional(),
-  homepage: z.string().min(1).optional(),
-  visibility: z.enum(PLUGIN_VISIBILITY).optional().catch(void 0),
-  status: z.enum(["listed", "reviewing", "rejected", "offline"]).optional().catch(void 0)
-});
-var EntrySchema = EntryShape.transform(({ category, ...rest }) => {
-  const picked = category === void 0 ? [] : typeof category === "string" ? [category] : category;
-  return { ...rest, ...picked.length === 0 ? {} : { category: [...picked] } };
-});
-var MARKETPLACE_DISPLAY_FIELDS = [
-  "status",
-  "downloads",
-  "likes",
-  "author",
-  "category",
-  "visibility",
-  "icon",
-  "homepage",
-  "size"
-];
-var DisplaySchema = z.object({
-  fields: z.array(z.string().min(1)).optional()
-});
-var CategoryNodeSchema = z.lazy(
-  () => z.object({
-    id: z.string().min(1),
-    label: z.string().min(1).optional(),
-    children: z.array(CategoryNodeSchema).optional()
-  })
-);
-var CategoriesSchema = z.array(CategoryNodeSchema).refine(hasUniqueCategoryIds, { message: "category ids must be unique across the whole tree" }).optional().catch(void 0);
-function hasUniqueCategoryIds(nodes) {
-  const seen = /* @__PURE__ */ new Set();
-  const walk3 = (list) => list.every((node) => {
-    if (seen.has(node.id)) return false;
-    seen.add(node.id);
-    return node.children === void 0 || walk3(node.children);
-  });
-  return walk3(nodes);
 }
-var CatalogSchema = z.object({
-  name: z.string().regex(NAME_PATTERN),
-  description: z.string().min(1).optional(),
-  owner: z.object({ name: z.string().min(1), url: z.string().min(1).optional() }).optional(),
-  display: DisplaySchema.optional(),
-  categories: CategoriesSchema,
-  plugins: z.array(EntrySchema)
-});
-var RecordSchema2 = z.object({
-  name: z.string().regex(NAME_PATTERN),
-  source: z.string().min(1),
-  addedAt: z.number(),
-  catalog: CatalogSchema
-});
-var StateSchema2 = z.object({
-  version: z.literal(1).optional(),
-  marketplaces: z.array(RecordSchema2)
-});
-function projectEntryForDisplay(entry, display) {
-  const allowed = display?.fields;
-  if (allowed === void 0) return entry;
-  const out = { ...entry };
-  for (const field of MARKETPLACE_DISPLAY_FIELDS) {
-    if (!displayAllows(display, field)) delete out[field];
+async function runInstall(resolved, staging, opts) {
+  const rootStaging = join(staging, "root");
+  const fetched = await fetchInto(resolved, rootStaging, opts);
+  if (!fetched.ok) return { ok: false, reason: fetched.reason };
+  const readDir = resolved.type === "local" ? resolved.target : pluginRoot(resolved, rootStaging);
+  const read = readPluginManifest(readDir);
+  const manifest = read.manifest;
+  if (!manifest) {
+    const detail = read.issues.map((i) => t("plugin_install.issue_line", { path: i.path, message: i.message })).join("\n");
+    return { ok: false, reason: t("plugin_install.manifest_unusable", { detail: `
+${detail}` }) };
   }
-  return out;
-}
-function displayAllows(display, field) {
-  const allowed = display?.fields;
-  if (allowed === void 0) return true;
-  return allowed.includes(field);
-}
-function readMarketplaces(statePath) {
-  if (!existsSync(statePath)) return { records: [], issues: [] };
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync(statePath, "utf-8"));
-  } catch (err) {
+  const taken = new PluginStore(opts.statePath).read().records.find((r) => r.name === manifest.name);
+  const conflict = taken && taken.name !== opts.replace ? taken : void 0;
+  const current = opts.epochVersion ?? currentEpochVersion();
+  const version = checkEpochVersion(manifest.epochVersion, current);
+  const versionUnmet = !version.ok && manifest.epochVersion ? { required: manifest.epochVersion, current, reason: version.reason } : void 0;
+  const closure = await resolveClosure({
+    root: manifest.name,
+    declared: manifest.dependencies ?? [],
+    installed: new Set(new PluginStore(opts.statePath).read().records.map((r) => r.name)),
+    staging,
+    opts
+  });
+  const preview3 = {
+    manifest,
+    source: resolved,
+    inventory: scanPluginDir(readDir, manifest.name),
+    ...conflict ? { conflict } : {},
+    ...versionUnmet ? { versionUnmet } : {},
+    ...closure.report.length > 0 ? { dependencies: closure.report } : {}
+  };
+  if (opts.replace !== void 0 && manifest.name !== opts.replace) {
     return {
-      records: [],
-      issues: [
-        { path: statePath, message: t("plugin_marketplace.bad_json", { reason: first(err) }) }
-      ]
+      ok: false,
+      preview: preview3,
+      reason: t("plugin_install.renamed", { found: manifest.name, expected: opts.replace })
     };
   }
-  const checked = parseLenient(StateSchema2.optional(), raw, void 0);
-  if (!checked.value) {
+  if (conflict) {
     return {
-      records: [],
-      issues: checked.issues.map((i) => ({
-        path: statePath,
-        message: t("plugin_marketplace.issue", { path: i.path, message: i.message })
-      }))
+      ok: false,
+      preview: preview3,
+      reason: t("plugin_install.already_installed", {
+        name: conflict.name,
+        version: conflict.version,
+        source: conflict.source
+      })
     };
   }
-  return { records: checked.value.marketplaces, issues: [] };
-}
-async function mutate(statePath, fn) {
-  const release = await acquireStateLock(statePath);
-  try {
-    const next = fn(readMarketplaces(statePath).records);
-    if (!next) return false;
-    writeStateFile(statePath, JSON.stringify({ version: 1, marketplaces: next }, null, 2));
-    return true;
-  } finally {
-    release();
+  if (opts.confirm && !await opts.confirm(preview3)) {
+    return { ok: false, reason: t("plugin.install_cancelled"), cancelled: true, preview: preview3 };
   }
-}
-async function addMarketplace(source, opts) {
-  const fetched = await fetchCatalog(source);
-  if (!fetched.ok) return fetched;
-  const record = {
-    name: fetched.catalog.name,
-    source: source.trim(),
-    addedAt: Date.now(),
-    catalog: fetched.catalog
-  };
-  const written = await mutate(
-    opts.statePath,
-    (records) => records.some((r) => r.name === record.name) ? void 0 : [...records, record].sort((a, b) => a.name.localeCompare(b.name))
+  const records = await commitAll(
+    [
+      {
+        name: manifest.name,
+        version: manifest.version,
+        source: resolved,
+        stagingDir: rootStaging,
+        ...opts.marketplace ? { marketplace: opts.marketplace } : {}
+      },
+      ...closure.plans.map((plan) => ({
+        name: plan.name,
+        version: plan.manifest.version,
+        source: plan.source,
+        stagingDir: plan.stagingDir,
+        ...plan.marketplace ? { marketplace: plan.marketplace } : {}
+      }))
+    ],
+    opts
   );
-  return written ? { ok: true, record } : {
+  const record = records?.find((r) => r.name === manifest.name);
+  return record ? { ok: true, record, preview: preview3 } : {
     ok: false,
-    reason: t("plugin_marketplace.already_added", { name: record.name })
+    preview: preview3,
+    reason: t("plugin_install.raced", { name: manifest.name })
   };
 }
-async function removeMarketplace(name, opts) {
-  const written = await mutate(
-    opts.statePath,
-    (records) => records.some((r) => r.name === name) ? records.filter((r) => r.name !== name) : void 0
-  );
-  return written ? { ok: true } : { ok: false, reason: t("plugin_marketplace.not_added", { name }) };
-}
-async function updateMarketplace(name, opts) {
-  const existing = readMarketplaces(opts.statePath).records.find((r) => r.name === name);
-  if (!existing) return { ok: false, reason: t("plugin_marketplace.not_added", { name }) };
-  const fetched = await fetchCatalog(existing.source);
-  if (!fetched.ok) return fetched;
-  if (fetched.catalog.name !== name) {
-    return {
-      ok: false,
-      reason: t("plugin_marketplace.renamed", {
-        source: existing.source,
-        name: fetched.catalog.name
-      })
-    };
+var DEPENDENCY_LIMIT = 32;
+async function commitAll(entries2, opts) {
+  const records = [];
+  for (const entry of entries2) {
+    const dest = join(opts.pluginsDir, entry.name);
+    removeInstallDest(dest);
+    let linked = entry.source.type === "local";
+    if (linked) {
+      try {
+        symlinkSync(entry.source.target, dest, "junction");
+      } catch {
+        opts.onProgress?.(t("plugin_install.symlink_failed"));
+        cpSync(entry.source.target, dest, { recursive: true });
+        linked = false;
+      }
+    } else {
+      renameSync(pluginRoot(entry.source, entry.stagingDir), dest);
+    }
+    records.push({
+      name: entry.name,
+      version: entry.version,
+      source: entry.source.raw,
+      sourceType: entry.source.type,
+      path: dest,
+      linked,
+      enabled: true,
+      installedAt: Date.now(),
+      ...entry.marketplace ? { marketplace: entry.marketplace } : {},
+      ...entry.source.sha256 ? { checksum: `sha256:${entry.source.sha256}` } : {}
+    });
   }
-  const record = { ...existing, catalog: fetched.catalog };
-  await mutate(opts.statePath, (records) => records.map((r) => r.name === name ? record : r));
-  return { ok: true, record };
+  return new PluginStore(opts.statePath).mutate((existing) => {
+    for (const record of records) {
+      const taken = existing.some((r) => r.name === record.name);
+      if (taken && opts.replace !== record.name) return void 0;
+    }
+    let next = existing;
+    for (const record of records) {
+      const taken = next.some((r) => r.name === record.name);
+      next = taken ? next.map((r) => r.name === record.name ? record : r) : [...next, record];
+    }
+    return { records: next, result: records };
+  });
 }
-function searchMarketplaces(keyword, statePath) {
-  const needle = keyword.trim().toLowerCase();
-  const hits = [];
-  for (const record of readMarketplaces(statePath).records) {
-    for (const entry of record.catalog.plugins) {
-      const haystack = [
-        entry.name,
-        entry.description ?? "",
-        ...entry.category ?? [],
-        entry.author?.name ?? "",
-        ...entry.keywords ?? []
-      ].join(" ").toLowerCase();
-      if (needle && !haystack.includes(needle)) continue;
-      hits.push({
-        marketplace: record.name,
-        entry: projectEntryForDisplay(entry, record.catalog.display),
-        ref: `${record.name}/${entry.name}`
+async function resolveClosure(input) {
+  const { opts, staging } = input;
+  const seen = /* @__PURE__ */ new Set([input.root]);
+  const queue = input.declared.map((name) => ({
+    name,
+    requiredBy: input.root
+  }));
+  const report3 = [];
+  const plans = [];
+  while (queue.length > 0) {
+    const next = queue.shift();
+    if (!next) break;
+    const { name, requiredBy } = next;
+    if (seen.has(name)) continue;
+    seen.add(name);
+    if (input.installed.has(name)) {
+      report3.push({ name, status: "installed", requiredBy });
+      continue;
+    }
+    if (plans.length >= DEPENDENCY_LIMIT) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        reason: t("plugin_install.dep_too_many", { limit: DEPENDENCY_LIMIT, root: input.root })
+      });
+      continue;
+    }
+    const located = await locateDependency(name, opts);
+    if (!located) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        reason: t("plugin_install.dep_no_source", { name })
+      });
+      continue;
+    }
+    const source = resolveSource(located.source);
+    if (!source) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        source: located.source,
+        reason: t("plugin_install.dep_bad_source", { name, source: located.source })
+      });
+      continue;
+    }
+    opts.onProgress?.(t("plugin_install.dep_fetching", { name, source: located.source }));
+    const stagingDir = join(staging, `dep-${plans.length}`);
+    const fetched = await fetchInto(source, stagingDir, opts);
+    if (!fetched.ok) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        source: located.source,
+        reason: fetched.reason
       });
+      continue;
+    }
+    const readDir = source.type === "local" ? source.target : pluginRoot(source, stagingDir);
+    const read = readPluginManifest(readDir);
+    const manifest = read.manifest;
+    if (!manifest) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        source: located.source,
+        reason: t("plugin_install.dep_bad_manifest", {
+          name,
+          detail: read.issues.map((issue) => issue.message).join("; ")
+        })
+      });
+      continue;
+    }
+    if (manifest.name !== name) {
+      report3.push({
+        name,
+        status: "unresolved",
+        requiredBy,
+        source: located.source,
+        reason: t("plugin_install.dep_name_mismatch", { name, found: manifest.name })
+      });
+      continue;
+    }
+    const current = opts.epochVersion ?? currentEpochVersion();
+    const version = checkEpochVersion(manifest.epochVersion, current);
+    const versionUnmet = !version.ok && manifest.epochVersion ? { required: manifest.epochVersion, current, reason: version.reason } : void 0;
+    report3.push({
+      name,
+      status: "plan",
+      requiredBy,
+      source: located.source,
+      manifest,
+      inventory: scanPluginDir(readDir, manifest.name),
+      ...versionUnmet ? { versionUnmet } : {}
+    });
+    plans.push({
+      name: manifest.name,
+      source,
+      stagingDir,
+      manifest,
+      ...located.marketplace ? { marketplace: located.marketplace } : {}
+    });
+    for (const nested of manifest.dependencies ?? []) {
+      queue.push({ name: nested, requiredBy: manifest.name });
     }
   }
-  return hits;
+  return { report: report3, plans };
 }
-function resolveMarketplaceRef(input, statePath) {
-  const parts = input.trim().split("/");
-  if (parts.length !== 2) return void 0;
-  const [market = "", plugin = ""] = parts;
-  if (!NAME_PATTERN.test(market) || !NAME_PATTERN.test(plugin)) return void 0;
-  const record = readMarketplaces(statePath).records.find((r) => r.name === market);
-  if (!record) {
-    return {
-      ok: false,
-      reason: t("plugin_marketplace.market_not_added", { market, input })
-    };
+async function locateDependency(name, opts) {
+  const local = opts.marketplacesStatePath ? findMarketplaceEntryByName(name, opts.marketplacesStatePath) : void 0;
+  if (local) return { source: local.source, marketplace: local.marketplace };
+  if (!opts.resolveDependency) return void 0;
+  try {
+    const answer = await opts.resolveDependency(name);
+    return answer ? { source: answer } : void 0;
+  } catch {
+    return void 0;
   }
-  const entry = record.catalog.plugins.find((p) => p.name === plugin);
-  if (!entry) {
-    return {
-      ok: false,
-      reason: t("plugin_marketplace.plugin_not_in_market", { market, plugin })
-    };
+}
+function removeInstallDest(dest) {
+  let link = false;
+  try {
+    link = lstatSync(dest).isSymbolicLink();
+  } catch {
   }
-  const source = resolveEntrySource(entry.source, record.source);
-  if (!source) {
-    return {
-      ok: false,
-      reason: t("plugin_marketplace.entry_unresolvable", {
-        market,
-        plugin,
-        source: entry.source
-      })
-    };
+  if (!link) {
+    rmSync(dest, { recursive: true, force: true });
+    return;
+  }
+  try {
+    unlinkSync(dest);
+  } catch {
+    rmdirSync(dest);
   }
-  return { ok: true, ref: { marketplace: market, source } };
 }
-function resolveEntrySource(entry, marketSource) {
-  const spec = entry.trim();
-  if (!spec.startsWith(".") && !spec.startsWith("/")) return spec;
-  const rel = spec.replace(/^\.\//, "").replace(/^\//, "");
-  if (rel === "" || rel.split("/").includes("..")) return void 0;
-  const market = marketSource.trim();
-  if (market.startsWith("github:") || market.startsWith("git+")) {
-    const [base = "", fragment] = market.split("#", 2);
-    const prefix = fragment?.startsWith("subdir=") ? `${fragment.slice("subdir=".length)}/` : "";
-    return `${base}#subdir=${prefix}${rel}`;
-  }
-  if (market.startsWith("https://") || market.startsWith("http://")) {
-    return `${market.replace(/\/[^/]*$/, "")}/${rel}`;
+async function fetchInto(source, staging, opts) {
+  if (source.type === "local") return fetchLocal(source);
+  if (source.type === "git") return fetchGit(source, staging, opts);
+  if (source.type === "npm") return fetchNpm(source, staging, opts);
+  if (source.type === "host") return fetchFromHost(source, staging, opts);
+  if (source.localFile) return fetchLocalArchive(source, staging);
+  return fetchArchive(source, staging, opts);
+}
+async function fetchLocalArchive(source, staging) {
+  if (!existsSync(source.target)) {
+    return { ok: false, reason: t("plugin_install.archive_missing", { path: source.target }) };
   }
-  return join(marketDir(market), rel);
+  mkdirSync(staging, { recursive: true });
+  return extractArchive(source.target, staging);
 }
-async function fetchCatalog(source) {
-  const input = source.trim();
-  if (!input) return { ok: false, reason: t("plugin_marketplace.source_empty") };
-  const local = localCatalogPath(input);
-  if (local) {
-    if (!existsSync(local)) {
-      return { ok: false, reason: t("plugin_marketplace.local_missing", { path: local }) };
-    }
+async function fetchFromHost(source, staging, opts) {
+  const ask = opts.fetchFromHost;
+  if (!ask) {
+    return { ok: false, reason: t("plugin_install.host_fetch_unavailable") };
+  }
+  opts.onProgress?.(t("plugin_install.host_fetching", { target: source.target }));
+  mkdirSync(staging, { recursive: true });
+  return withDownloadDir(async (dl) => {
+    let answer;
     try {
-      return parseCatalog(readFileSync(local, "utf-8"), local);
+      answer = await ask({ target: source.target, destDir: dl });
     } catch (err) {
-      return { ok: false, reason: t("plugin_marketplace.read_failed", { reason: first(err) }) };
+      return {
+        ok: false,
+        reason: t("plugin_install.host_fetch_threw", {
+          reason: (err instanceof Error ? err.message : String(err)).split("\n")[0] ?? ""
+        })
+      };
+    }
+    if (!answer.ok) {
+      return {
+        ok: false,
+        reason: answer.reason ?? t("plugin_install.host_fetch_failed", { target: source.target })
+      };
+    }
+    if (!existsSync(answer.archivePath)) {
+      return {
+        ok: false,
+        reason: t("plugin_install.host_fetch_no_file", { path: answer.archivePath })
+      };
     }
+    return extractArchive(answer.archivePath, staging);
+  });
+}
+function fetchLocal(source) {
+  if (!existsSync(source.target)) {
+    return { ok: false, reason: t("plugin_install.local_missing", { path: source.target }) };
   }
-  const url = catalogUrl(input);
-  if (!url) {
-    return {
-      ok: false,
-      reason: t("plugin_marketplace.bad_url", { input, file: MARKETPLACE_FILE })
-    };
+  return { ok: true };
+}
+async function fetchGit(source, staging, opts) {
+  opts.onProgress?.(t("plugin_install.cloning", { target: source.target }));
+  const result = await runCommand("git", ["clone", "--depth", "1", source.target, staging]);
+  if (!result.ok) {
+    return { ok: false, reason: t("plugin_install.clone_failed", { detail: result.detail }) };
   }
+  rmSync(join(staging, ".git"), { recursive: true, force: true });
+  return { ok: true };
+}
+async function fetchNpm(source, staging, opts) {
+  opts.onProgress?.(t("plugin_install.npm_fetching", { target: source.target }));
+  mkdirSync(staging, { recursive: true });
+  return withDownloadDir(async (dl) => {
+    const packed = await runCommand(
+      "npm",
+      ["pack", source.target, "--pack-destination", dl, "--silent"],
+      { cwd: dl, windowsShell: true }
+    );
+    if (!packed.ok) {
+      return { ok: false, reason: t("plugin_install.npm_pack_failed", { detail: packed.detail }) };
+    }
+    const tarball = packed.stdout.trim().split("\n").pop()?.trim();
+    if (!tarball) return { ok: false, reason: t("plugin_install.npm_no_tarball") };
+    return extractArchive(isAbsolute(tarball) ? tarball : join(dl, tarball), staging);
+  });
+}
+async function fetchArchive(source, staging, opts) {
+  opts.onProgress?.(t("plugin_install.downloading", { target: source.target }));
+  mkdirSync(staging, { recursive: true });
+  let bytes;
   try {
-    const response = await fetch(url, { redirect: "follow" });
+    const response = await fetch(source.target, { redirect: "follow" });
     if (!response.ok) {
-      const vars = { url, status: response.status };
       return {
         ok: false,
-        reason: looksPrivate(response.status) ? t("marketplace.fetch_failed_private", vars) : t("marketplace.fetch_failed", vars)
+        reason: t("plugin_install.download_http", {
+          status: response.status,
+          statusText: response.statusText
+        })
       };
     }
-    return parseCatalog(await response.text(), url);
+    bytes = Buffer.from(await response.arrayBuffer());
   } catch (err) {
-    return { ok: false, reason: t("marketplace.fetch_error", { url, reason: first(err) }) };
+    return {
+      ok: false,
+      reason: t("plugin_install.download_failed", {
+        message: err instanceof Error ? err.message : String(err)
+      })
+    };
+  }
+  if (source.sha256) {
+    const actual = createHash("sha256").update(bytes).digest("hex");
+    if (actual !== source.sha256) {
+      return {
+        ok: false,
+        reason: [
+          t("plugin_install.sha_mismatch"),
+          t("plugin_install.sha_expected", { expected: source.sha256 }),
+          t("plugin_install.sha_actual", { actual })
+        ].join("\n")
+      };
+    }
   }
+  return withDownloadDir(async (dl) => {
+    const archive = join(dl, `download${archiveExt(source.target)}`);
+    writeFileSync(archive, bytes);
+    return extractArchive(archive, staging);
+  });
 }
-function looksPrivate(status) {
-  return status === 401 || status === 403 || status === 404;
+function archiveExt(url) {
+  const path = (url.split("?")[0] ?? "").toLowerCase();
+  if (path.endsWith(".tgz")) return ".tgz";
+  if (path.endsWith(".tar.gz")) return ".tar.gz";
+  return ".zip";
 }
-function catalogUrl(input) {
-  if (input.startsWith("github:")) {
-    const slug = input.slice("github:".length);
-    if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) return void 0;
-    return `https://raw.githubusercontent.com/${slug}/HEAD/${MARKETPLACE_FILE}`;
+async function withDownloadDir(fn) {
+  const dir = mkdtempSync(join(tmpdir(), "epoch-plugin-dl-"));
+  try {
+    return await fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
   }
-  if (!input.startsWith("https://") && !input.startsWith("http://")) return void 0;
-  return input.endsWith(".json") ? input : `${input.replace(/\/+$/, "")}/${MARKETPLACE_FILE}`;
 }
-function localCatalogPath(input) {
-  if (/^[a-z][a-z0-9+.-]+:/i.test(input) || input.startsWith("//")) return void 0;
-  const abs = isAbsolute(input) ? input : resolve(input);
-  if (existsSync(abs) && statSync(abs).isDirectory()) return join(abs, MARKETPLACE_FILE);
-  return abs;
+// src/plugin/root-token.ts
+var PLUGIN_ROOT_TOKEN = "${EPOCH_PLUGIN_ROOT}";
+var PLUGIN_ROOT_ENV = "EPOCH_PLUGIN_ROOT";
+function mentionsPluginRoot(text) {
+  return text.includes(PLUGIN_ROOT_TOKEN);
 }
-function marketDir(market) {
-  const abs = isAbsolute(market) ? market : resolve(market);
-  if (existsSync(abs) && statSync(abs).isDirectory()) return abs;
-  return abs.replace(/[/\\][^/\\]*$/, "");
+function substitutePluginRoot(text, root) {
+  return text.split(PLUGIN_ROOT_TOKEN).join(root);
 }
-function parseCatalog(body2, where) {
-  let raw;
-  try {
-    raw = JSON.parse(body2);
-  } catch (err) {
+async function uninstallPlugin(name, opts) {
+  const removed = await new PluginStore(opts.statePath).mutate((records) => {
+    const hit = records.find((r) => r.name === name);
+    if (!hit) return void 0;
+    return { records: records.filter((r) => r.name !== name), result: hit };
+  });
+  if (!removed) return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
+  if (removed.linked) {
+    rmSync(removed.path, { force: true });
+    return { ok: true, message: t("plugin_lifecycle.uninstalled_link", { name }) };
+  }
+  rmSync(removed.path, { recursive: true, force: true });
+  return { ok: true, message: t("plugin_lifecycle.uninstalled", { name }) };
+}
+async function setPluginEnabled(name, enabled, opts) {
+  const changed = await new PluginStore(opts.statePath).mutate((records) => {
+    const hit = records.find((r) => r.name === name);
+    if (!hit) return void 0;
     return {
-      ok: false,
-      reason: t("plugin_marketplace.catalog_bad_json", { where, reason: first(err) })
+      records: records.map((r) => r.name === name ? { ...r, enabled } : r),
+      result: hit.enabled !== enabled
     };
+  });
+  if (changed === void 0) {
+    return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
   }
-  const checked = parseLenient(CatalogSchema.optional(), raw, void 0);
-  if (!checked.value) {
-    const detail = checked.issues.map((i) => t("plugin_marketplace.issue", { path: i.path, message: i.message })).join(t("plugin_marketplace.catalog_issue_sep"));
-    return { ok: false, reason: t("plugin_marketplace.catalog_invalid", { where, detail }) };
-  }
-  return { ok: true, catalog: checked.value };
+  const verb = enabled ? t("plugin_lifecycle.verb_enable") : t("plugin_lifecycle.verb_disable");
+  return {
+    ok: true,
+    message: changed ? t("plugin_lifecycle.toggled", { verb, name }) : t("plugin_lifecycle.already", { name, verb })
+  };
 }
-function first(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return message.split("\n")[0] ?? t("plugin_marketplace.unknown_error");
+async function updatePlugin(name, opts) {
+  const existing = new PluginStore(opts.statePath).read().records.find((r) => r.name === name);
+  if (!existing) return { ok: false, reason: t("plugin_lifecycle.not_installed", { name }) };
+  if (existing.linked) {
+    return {
+      ok: true,
+      message: t("plugin_lifecycle.linked_no_update", { name, source: existing.source })
+    };
+  }
+  return installPlugin(existing.source, {
+    ...opts,
+    replace: name,
+    ...existing.marketplace ? { marketplace: existing.marketplace } : {}
+  });
 }
 var TMP_SUFFIX = ".epoch-rewind";
 function planFor(entry, current) {
@@ -7778,7 +7978,7 @@ async function applyRewind(store, sessionId, manifest, apply, skippedConflicts)
   } catch (err) {
     return { ...empty, failed: t("rewind.stage_failed", { message: messageOf(err) }) };
   }
-  return commitAll(staged, skippedConflicts);
+  return commitAll2(staged, skippedConflicts);
 }
 async function stageAll(store, sessionId, manifest, todo, byPath) {
   const staged = [];
@@ -7806,7 +8006,7 @@ async function stageAll(store, sessionId, manifest, todo, byPath) {
   }
   return staged;
 }
-async function commitAll(staged, skippedConflicts) {
+async function commitAll2(staged, skippedConflicts) {
   const outcome = {
     restored: [],
     deleted: [],
@@ -13371,6 +13571,10 @@ var DEFAULT_MODELS = {
   groq: "llama-3.3-70b-versatile",
   mistral: "ministral-8b-latest",
   moonshotai: "kimi-latest",
+  zhipu: "glm-4.5-flash",
+  dashscope: "qwen-flash",
+  bytedance: "doubao-seed-2.0-mini",
+  qianfan: "ernie-speed-128k",
   cohere: "command-r7b-12-2024",
   xai: "grok-vision-beta",
   perplexity: "sonar",
@@ -13783,6 +13987,10 @@ var PACKAGES = {
   groq: "@ai-sdk/groq",
   mistral: "@ai-sdk/mistral",
   moonshotai: "@ai-sdk/moonshotai",
+  zhipu: "@ai-sdk/openai-compatible",
+  dashscope: "@ai-sdk/alibaba",
+  bytedance: "@ai-sdk/openai-compatible",
+  qianfan: "@ai-sdk/openai-compatible",
   cohere: "@ai-sdk/cohere",
   xai: "@ai-sdk/xai",
   perplexity: "@ai-sdk/perplexity",
@@ -13792,6 +14000,17 @@ var PACKAGES = {
   ollama: "ollama-ai-provider-v2",
   "openai-compatible": "@ai-sdk/openai-compatible"
 };
+function openaiCompatibleFactory(name, defaultBaseUrl) {
+  return async ({ apiKey, baseUrl }) => {
+    const { createOpenAICompatible } = await import('@ai-sdk/openai-compatible');
+    return createOpenAICompatible({
+      apiKey,
+      baseURL: baseUrl || defaultBaseUrl,
+      name,
+      includeUsage: true
+    });
+  };
+}
 var LOADERS = {
   openai: async ({ apiKey, baseUrl }) => {
     const { createOpenAI } = await import('@ai-sdk/openai');
@@ -13823,6 +14042,17 @@ var LOADERS = {
     const { createMoonshotAI } = await import('@ai-sdk/moonshotai');
     return createMoonshotAI({ apiKey });
   },
+  zhipu: openaiCompatibleFactory("zhipu", "https://open.bigmodel.cn/api/paas/v4"),
+  dashscope: async ({ apiKey, baseUrl }) => {
+    const { createAlibaba } = await import('@ai-sdk/alibaba');
+    const provider = createAlibaba({
+      apiKey,
+      baseURL: baseUrl || "https://dashscope.aliyuncs.com/compatible-mode/v1"
+    });
+    return (model) => provider.languageModel(model);
+  },
+  bytedance: openaiCompatibleFactory("bytedance", "https://ark.cn-beijing.volces.com/api/v3"),
+  qianfan: openaiCompatibleFactory("qianfan", "https://qianfan.baidubce.com/v2"),
   cohere: async ({ apiKey }) => {
     const { createCohere } = await import('@ai-sdk/cohere');
     return createCohere({ apiKey });
@@ -13851,15 +14081,7 @@ var LOADERS = {
     const { createOllama } = await import('ollama-ai-provider-v2');
     return createOllama();
   },
-  "openai-compatible": async ({ apiKey, baseUrl }) => {
-    const { createOpenAICompatible } = await import('@ai-sdk/openai-compatible');
-    return createOpenAICompatible({
-      apiKey,
-      baseURL: baseUrl || "http://localhost:8080/v1",
-      name: "custom",
-      includeUsage: true
-    });
-  }
+  "openai-compatible": openaiCompatibleFactory("custom", "http://localhost:8080/v1")
 };
 var ProviderSdkMissingError = class extends Error {
   constructor(providerType, packageName, cause) {
@@ -14491,6 +14713,10 @@ var STATIC_MODEL_CATALOG = {
   ],
   mistral: ["mistral-large-latest", "mistral-small-latest", "codestral-latest"],
   moonshotai: ["kimi-latest"],
+  zhipu: ["glm-4.6", "glm-4.5-flash", "glm-4.5-air", "glm-4.5"],
+  dashscope: ["qwen3-max", "qwen-plus", "qwen-flash", "qwen-turbo", "qwen-max-latest"],
+  bytedance: ["doubao-seed-2.1-pro", "doubao-seed-2.0-mini", "doubao-seed-1.6-flash"],
+  qianfan: ["ernie-5.0", "ernie-speed-128k", "ernie-4.0-turbo-8k"],
   cohere: ["command-r-plus-04-2024", "command-r7b-12-2024", "command-a-03-2025"],
   xai: ["grok-vision-beta"],
   perplexity: ["sonar", "sonar-pro", "sonar-reasoning"],
@@ -14506,6 +14732,10 @@ var PROVIDER_DISCOVERY = {
   groq: { baseUrl: "https://api.groq.com/openai/v1", auth: "bearer" },
   mistral: { baseUrl: "https://api.mistral.ai/v1", auth: "bearer" },
   moonshotai: { baseUrl: "https://api.moonshot.ai/v1", auth: "bearer" },
+  zhipu: { baseUrl: "https://open.bigmodel.cn/api/paas/v4", auth: "bearer" },
+  dashscope: { baseUrl: "https://dashscope.aliyuncs.com/compatible-mode/v1", auth: "bearer" },
+  bytedance: { baseUrl: "https://ark.cn-beijing.volces.com/api/v3", auth: "bearer" },
+  qianfan: { baseUrl: "https://qianfan.baidubce.com/v2", auth: "bearer" },
   xai: { baseUrl: "https://api.x.ai/v1", auth: "bearer" },
   perplexity: { baseUrl: "https://api.perplexity.ai", auth: "bearer" },
   togetherai: { baseUrl: "https://api.together.xyz/v1", auth: "bearer" }
@@ -14756,7 +14986,7 @@ function writeUserYaml(path, key, value) {
   const after = asMapping(parseYaml(next));
   const intact = after !== null && (dot < 0 ? onlyChanged(before, after, key, value) : onlyChangedNested(before, after, key.slice(0, dot), key.slice(dot + 1), value));
   if (!intact) return { ok: false, reason: "unwritable-file" };
-  return commit2(path, next, 384, value);
+  return commit(path, next, 384, value);
 }
 function writeSettingsJson(path, key, value) {
   let before = {};
@@ -14776,7 +15006,7 @@ function writeSettingsJson(path, key, value) {
   }
   const body2 = `${JSON.stringify({ ...before, [key]: value }, null, 2)}
 `;
-  return commit2(path, body2, 420, value);
+  return commit(path, body2, 420, value);
 }
 function scalarText(value) {
   return dump(value, { lineWidth: -1 }).trimEnd();
@@ -14833,7 +15063,7 @@ function sameKeysAndValues(before, after, except) {
 function sameData(a, b) {
   return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
 }
-function commit2(path, body2, createMode, value) {
+function commit(path, body2, createMode, value) {
   const tmp = `${path}.${process.pid}.tmp`;
   try {
     mkdirSync(dirname(path), { recursive: true });
@@ -19965,7 +20195,7 @@ function parseSimpleToml(content, file) {
     const at = `${file}:${i + 1}`;
     if (!trimmed || trimmed.startsWith("#")) continue;
     if (trimmed === "[[rule]]") {
-      if (current) commit3(current, file, rules, issues);
+      if (current) commit2(current, file, rules, issues);
       current = { raw: {}, line: i + 1 };
       continue;
     }
@@ -19988,7 +20218,7 @@ function parseSimpleToml(content, file) {
       current.raw[kv.key] = kv.value;
     }
   }
-  if (current) commit3(current, file, rules, issues);
+  if (current) commit2(current, file, rules, issues);
   return { rules, issues };
 }
 function readKeyValue(line) {
@@ -20002,7 +20232,7 @@ function readKeyValue(line) {
   const sq = rawVal.match(/^'(.*)'$/);
   return { key, value: sq && sq[1] ? sq[1] : rawVal };
 }
-function commit3(draft, file, rules, issues) {
+function commit2(draft, file, rules, issues) {
   const at = `${file}:${draft.line}`;
   issues.push(...unknownKeyIssues(POLICY_RULE_KEYS, draft.raw, at));
   const raw = { ...draft.raw };
@@ -22490,7 +22720,7 @@ async function importSkills(source, opts) {
         detail: t("skill.import_stale", void 0, opts.lang)
       };
     }
-    return { ok: true, ...commit4(preview3, staged, opts.skillsDir, opts.lang) };
+    return { ok: true, ...commit3(preview3, staged, opts.skillsDir, opts.lang) };
   });
 }
 async function withStaged(source, opts, fn) {
@@ -22609,7 +22839,7 @@ function digest(entries2, staged) {
   }
   return hash.digest("hex").slice(0, 32);
 }
-function commit4(preview3, staged, skillsDir, lang) {
+function commit3(preview3, staged, skillsDir, lang) {
   const byName = new Map(staged.map((s) => [s.name, s.dir]));
   const imported = [];
   const skipped = [];