@explyt/ai-agent 0.3.0 → 0.3.1-dogfood.2

package/README.md

@@ -17,8 +17,8 @@ explyt update                # install the newer latest, then restart open sessi
 For a one-off pinned run:
 
 ```bash
-npx -y "@explyt/ai-agent@0.3.0"          # start the terminal UI
-npx -y "@explyt/ai-agent@0.3.0" login    # store a provider credential, once
+npx -y "@explyt/ai-agent@0.3.1"          # start the terminal UI
+npx -y "@explyt/ai-agent@0.3.1" login    # store a provider credential, once
 ```
 
 The agent runs with exactly the extensions this build ships with and ignores any
@@ -28,4 +28,4 @@ you get.
 IDE (ACP) integration is not part of this package: it is provided by the Explyt
 managed backend, which the Neo plugin downloads and manages.
 
-Run `npx -y @explyt/ai-agent@0.3.0 --help` for the available options.
+Run `npx -y @explyt/ai-agent@0.3.1 --help` for the available options.

package/THIRD-PARTY-NOTICES.md

@@ -88,7 +88,17 @@ License or other written license agreements with the Company.
 - The public npm package contains `dist/mcp-adapter.js`, an unobfuscated compilation of
   the unmodified `pi-mcp-adapter` entrypoint (`index.ts`) together with the package's
   small runtime helper files, so that Node can load it outside the engine's TypeScript
-  loader.
+  loader. The compilation also inlines the package's own runtime dependencies except
+  `recheck`, `@napi-rs/keyring`, `open` and `@modelcontextprotocol/ext-apps`, which npm
+  installs beside it; each inlined package is listed with its copyright notice in the
+  generated "Packages compiled into this package's own files" section at the end of this file.
+- The public npm package contains `dist/vendor/pi-tui.js` and `dist/vendor/pi-mcp-adapter-types.js`:
+  unobfuscated compilations of the unmodified `@earendil-works/pi-tui` (with its dependencies)
+  and of `pi-mcp-adapter`'s `types` entry, each carrying the package's name, version, licence
+  and copyright in a banner. `@earendil-works/pi-tui` ships no licence file; its notice is
+  the one in the pi repository's `LICENSE` at the tag of the compiled version
+  (`https://github.com/earendil-works/pi/blob/v<version>/LICENSE`, Copyright (c) 2025 Mario
+  Zechner, MIT).
 - The public npm package contains `dist/vendor/pi-web-access.js`, an unobfuscated
   compilation of the unmodified `pi-web-access` entrypoint (`dist/index.js`) carrying the
   package's name, version and licence in a banner, so that its imports of the engine and
@@ -142,7 +152,7 @@ License or other written license agreements with the Company.
 - local Explyt extension with current `@earendil-works` imports
 - shell API-key execution removed; credential files use locked atomic writes and private permissions
 
-### 5. model-probe, @opencode-ai/models, yaml, minimatch, semver and typebox
+### 5. model-probe, @opencode-ai/models, yaml, minimatch, semver, typebox and yauzl
 
 - `model-probe` 0.6.0, MIT, https://www.npmjs.com/package/model-probe
   - Copyright (c) 2025 ratatulieoi
@@ -158,14 +168,21 @@ License or other written license agreements with the Company.
 - `typebox` (the version pinned in the development manifest, which the build compiles; the
   build-time metadata below and each compiled file's banner name it), MIT, https://www.npmjs.com/package/typebox
   - Copyright (c) 2017-2026 Haydn Paterson
-
-`model-probe` and `typebox` are also redistributed compiled, unobfuscated and unmodified:
-the public npm package contains `dist/vendor/model-probe/` (the installed `model-probe`
-compiled from its TypeScript, with its `rules.json`) and `dist/vendor/typebox/` (the pinned
-`typebox` in one ESM build), each file carrying the package's name, version and
-licence in a banner that names the exact version compiled.
-
-The MIT text below applies to the derivative, `model-probe`, `@opencode-ai/models` and
+- `yauzl` 3.4.0, MIT, https://www.npmjs.com/package/yauzl
+  - Copyright (c) 2014 Josh Wolfe
+- `pend` 1.2.0 (dependency of `yauzl`), MIT, https://www.npmjs.com/package/pend
+  - Copyright (c) 2014 Andrew Kelley
+
+`model-probe`, `typebox`, `yaml`, `minimatch`, `semver` and `yauzl` are also redistributed
+compiled, unobfuscated and unmodified: the public npm package contains `dist/vendor/model-probe/`
+(the installed `model-probe` compiled from its TypeScript, with its `rules.json`),
+`dist/vendor/typebox/` (the pinned `typebox` in one ESM build) and `dist/vendor/yaml.js`,
+`minimatch.js`, `semver.js` and `yauzl.js` (each installed package with its own dependencies in
+one file), each file carrying the package's name, version and licence in a banner that names
+the exact version compiled. `zod` is compiled the same way into `dist/vendor/zod.js`. The
+packages inlined with them are listed in the generated section at the end of this file.
+
+The MIT text below applies to the derivative, `model-probe`, `@opencode-ai/models`, `yauzl`, `pend`, and
 `typebox` with the copyright notices above. The ISC text immediately below applies to `yaml` and
 `semver`, each with its own copyright holder listed above (the ISC terms are identical);
 `minimatch` is covered by the separate Blue Oak Model License text further down, and its
@@ -209,6 +226,35 @@ THIS SOFTWARE.
 
 The MIT License text below applies to this package with the copyright notice above.
 
+### 7. Dangerous-action confirmation: unbash, Codex, cc-safety-net and Dippy (spec 020)
+
+- `unbash` 5.0.0, ISC, https://www.npmjs.com/package/unbash — a runtime dependency, installed beside
+  the package by npm, not bundled.
+  - Copyright (c) Lars Kappert
+- OpenAI Codex, Apache License 2.0, https://github.com/openai/codex — ported logic, not code:
+  the wrapper unwrapping, nested `-c` and `trap` re-parsing, the nesting limit and the
+  split-then-classify pipeline (`codex-rs/shell-command/src/command_safety/is_dangerous_command.rs`
+  and `codex-rs/core/src/exec_policy.rs` at `a5cce88`), and the flag conditions for `find`, `rg`,
+  `base64` and `sed` with `git` as never read-only (`is_safe_command.rs` at `9ca99b5`).
+  - NOTICE: "OpenAI Codex / Copyright 2025 OpenAI"
+- cc-safety-net, MIT, https://github.com/kenryu42/cc-safety-net — the destructive-command rules
+  and their descriptions and the secret-path catalogue (`src/core/rules/destructive.ts`,
+  `src/core/rules/secret.ts` at `f9bfeca`), ported as data into
+  `packages/shared/src/command-analysis/`.
+  - Copyright (c) 2026 J Liew
+- Dippy, MIT, https://github.com/ldayton/Dippy — the `SIMPLE_SAFE` read-only command names
+  (`src/dippy/core/allowlists.py` at `2edad4a`), ported as data.
+  - Copyright (c) 2025 Lily Dayton
+
+**Modifications Made:**
+- the logic is reimplemented in TypeScript on `unbash` rather than copied, and the data is
+  reduced: Dippy's names less the commands that run a program, reach the network, escape to a
+  shell or print secrets; cc-safety-net's rules extended with the rows of spec 020
+
+The MIT License text below applies to cc-safety-net and Dippy with the copyright notices above;
+the Apache License 2.0 text applies to the Codex logic with the NOTICE above; the ISC terms of
+`unbash` are those of the ISC text in section 5, with its own copyright holder listed above.
+
 ## Full License Texts
 
 ### MIT License
@@ -448,6 +494,56 @@ verbatim below.
    limitations under the License.
 ```
 
+### ISC License
+
+Applies to: `yaml`, `semver`, and the compiled packages listed as ISC in the generated
+"Packages compiled into this package's own files" section, each with its own copyright line.
+
+```
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+```
+
+### BSD 3-Clause License
+
+Applies to: the compiled packages listed as BSD-3-Clause in the generated "Packages compiled
+into this package's own files" section (`smol-toml`, `fast-uri`), each with the copyright
+lines listed for it there, which take the place of "the above copyright notice".
+
+```
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
 ### Blue Oak Model License 1.0.0
 
 Applies to: `minimatch`.
@@ -455,7 +551,9 @@ Applies to: `minimatch`.
 `minimatch` is an unmodified runtime dependency: the public npm package declares it and
 npm installs it beside the package, and the managed backend archive carries it in its
 installed tree. Either way its own `LICENSE.md` is present inside its package directory on
-the user's machine. The Blue Oak
+the user's machine. It is also compiled, unmodified, into `dist/vendor/minimatch.js`, whose
+banner names it and this text; its licence text names no copyright holder, so the holder is
+the one listed for it in section 5. The Blue Oak
 "Notices" clause requires everyone who receives a copy to also get the license text or a
 link to <https://blueoakcouncil.org/license/1.0.0>; the text is reproduced verbatim below
 so this notice satisfies that clause on its own.
@@ -526,14 +624,9 @@ Generated at build time. It records the license metadata declared by the npm pac
 this package depends on at runtime; none is bundled into the tarball, npm installs them beside it.
 Consult each package for its complete license text.
 
-- @modelcontextprotocol/client@2.0.0: license metadata = MIT (installed by npm beside this package)
-- @modelcontextprotocol/core@2.0.0: license metadata = MIT (installed by npm beside this package)
 - @modelcontextprotocol/ext-apps@1.7.5: license metadata = MIT (installed by npm beside this package)
 - @mozilla/readability@0.6.0: license metadata = Apache-2.0 (installed by npm beside this package)
 - @napi-rs/keyring@1.3.0: license metadata = MIT (installed by npm beside this package)
-- ajv@8.20.0: license metadata = MIT (installed by npm beside this package)
-- ajv-formats@3.0.1: license metadata = MIT (installed by npm beside this package)
-- cross-spawn@7.0.6: license metadata = MIT (installed by npm beside this package)
 - defuddle@0.19.3: license metadata = MIT (installed by npm beside this package)
 - linkedom@0.16.11: license metadata = ISC (installed by npm beside this package)
 - minimatch@10.2.6: license metadata = BlueOak-1.0.0 (installed by npm beside this package)
@@ -545,12 +638,88 @@ Consult each package for its complete license text.
 - promise.try@2.0.2: license metadata = MIT (installed by npm beside this package)
 - recheck@4.5.0: license metadata = MIT (installed by npm beside this package)
 - semver@7.8.5: license metadata = ISC (installed by npm beside this package)
-- smol-toml@1.9.0: license metadata = BSD-3-Clause (installed by npm beside this package)
-- strip-json-comments@5.0.3: license metadata = MIT (installed by npm beside this package)
 - turndown@7.2.4: license metadata = MIT (installed by npm beside this package)
+- unbash@5.0.0: license metadata = ISC (installed by npm beside this package)
 - undici@8.11.2: license metadata = MIT (installed by npm beside this package)
 - unpdf@1.8.1: license metadata = MIT (installed by npm beside this package)
 - yaml@2.9.0: license metadata = ISC (installed by npm beside this package)
+- yauzl@3.4.0: license metadata = MIT (installed by npm beside this package)
 - typebox@1.3.24: license metadata = MIT (compiled into dist/vendor/typebox)
 - model-probe@0.6.0: license metadata = MIT (compiled into dist/vendor/model-probe)
 - pi-web-access@0.31.0: license metadata = MIT (compiled into dist/vendor/pi-web-access.js)
+
+## Packages compiled into this package's own files
+
+Generated at build time from the packages each compiled, unobfuscated file inlines. Their
+directories do not ship, so their copyright notices are reproduced here; the full text of
+each licence named is under "Full License Texts" above.
+
+- @earendil-works/pi-tui@0.84.4, MIT, compiled into dist/vendor/pi-tui.js
+  - Copyright (c) 2025 Mario Zechner
+  - notice recorded from https://github.com/earendil-works/pi/blob/v0.84.4/LICENSE (the package ships none)
+- @modelcontextprotocol/client@2.0.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+- @modelcontextprotocol/core@2.0.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+- ajv-formats@3.0.1, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2020 Evgeny Poberezkin
+- ajv@8.20.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2015-2021 Evgeny Poberezkin
+- balanced-match@4.0.4, MIT, compiled into dist/vendor/minimatch.js
+  - Original code Copyright Julian Gruber <julian@juliangruber.com>
+  - Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
+- brace-expansion@5.0.12, MIT, compiled into dist/vendor/minimatch.js
+  - Copyright Julian Gruber <julian@juliangruber.com>
+  - TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
+- cross-spawn@7.0.6, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2018 Made With MOXY Lda <hello@moxy.studio>
+- eventsource-parser@3.1.1, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+- eventsource@3.0.7, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) EventSource GitHub organisation
+- fast-deep-equal@3.1.3, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2017 Evgeny Poberezkin
+- fast-uri@3.1.8, BSD-3-Clause, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
+  - Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
+- get-east-asian-width@1.6.0, MIT, compiled into dist/vendor/pi-tui.js
+  - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+- isexe@2.0.0, ISC, compiled into dist/mcp-adapter.js
+  - Copyright (c) Isaac Z. Schlueter and Contributors
+- jose@6.2.12, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2018 Filip Skokan
+- json-schema-traverse@1.0.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2017 Evgeny Poberezkin
+- marked@18.0.5, MIT, compiled into dist/vendor/pi-tui.js
+  - Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+  - Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+  - Copyright © 2004, John Gruber
+- minimatch@10.2.6, BlueOak-1.0.0, compiled into dist/vendor/minimatch.js
+  - Copyright Isaac Z. Schlueter <i@izs.me> and minimatch contributors
+  - notice recorded from https://www.npmjs.com/package/minimatch/v/10.2.6 (author field) (the package ships none)
+- path-key@3.1.1, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+- pend@1.2.0, MIT, compiled into dist/vendor/yauzl.js
+  - Copyright (c) 2014 Andrew Kelley
+- pi-mcp-adapter@2.31.0, MIT, compiled into dist/mcp-adapter.js, dist/vendor/pi-mcp-adapter-types.js
+  - Copyright (c) 2026 Nico Bailon
+- pkce-challenge@5.0.1, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) 2019
+- semver@7.8.5, ISC, compiled into dist/vendor/semver.js
+  - Copyright (c) Isaac Z. Schlueter and Contributors
+- shebang-command@2.0.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) Kevin Mårtensson <kevinmartensson@gmail.com> (github.com/kevva)
+- shebang-regex@3.0.0, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+- smol-toml@1.9.0, BSD-3-Clause, compiled into dist/mcp-adapter.js
+  - Copyright (c) Squirrel Chat et al., All rights reserved.
+- strip-json-comments@5.0.3, MIT, compiled into dist/mcp-adapter.js
+  - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+- which@2.0.2, ISC, compiled into dist/mcp-adapter.js
+  - Copyright (c) Isaac Z. Schlueter and Contributors
+- yaml@2.9.0, ISC, compiled into dist/vendor/yaml.js
+  - Copyright Eemeli Aro <eemeli@gmail.com>
+- yauzl@3.4.0, MIT, compiled into dist/vendor/yauzl.js
+  - Copyright (c) 2014 Josh Wolfe
+- zod@4.6.5, MIT, compiled into dist/vendor/zod.js
+  - Copyright (c) 2025 Colin McDonnell

package/agent-docs/README.md

@@ -15,6 +15,7 @@ it. Read the whole file before editing anything it describes.
 | `agents.md` | helper agents and model profiles: where the files live, every field, which model a helper runs on, disabling one |
 | `mcp.md` | MCP servers: the two `mcp.json` files, the entry shape, disabling a server or a tool |
 | `web-search.md` | web search and page fetch: `web-search.json`, where requests go, keys, switching search off, failures |
+| `plugins.md` | Marketplace plugins: the project manifest, the `explyt plugin` command, plugin values |
 
 ## User configuration lives under `.explyt/`
 
@@ -35,8 +36,12 @@ all projects, and in the project directory for one project:
 <project>/.explyt/mcp.json           MCP servers for this project
 <project>/.explyt/agents/*.md        helper agents for this project
 <project>/.explyt/models/*.md        model profiles for this project
+<project>/.explyt/plugins.json       Marketplace plugins enabled for this project
 ```
 
+Installed plugin payloads and plugin values are not user configuration files: they live in the
+product data directory and change only through `explyt plugin` (see `plugins.md`).
+
 Create these files and directories when they do not exist; nothing has to be registered anywhere
 for them to take effect.
 

package/agent-docs/mcp.md

@@ -9,12 +9,16 @@ An MCP server gives the agent extra tools, resources and prompts. Servers are de
 | global | `~/.explyt/mcp.json` | the user |
 | project | `<project>/.explyt/mcp.json` | the user |
 | session | the `mcpServers` field of the IDE's session request | the IDE |
+| plugin | the Marketplace plugins `<project>/.explyt/plugins.json` enables | the plugin author |
 
-These three and nothing else. Other tools' MCP files are **not** read — not `~/.config/mcp/mcp.json`,
+These four and nothing else. Other tools' MCP files are **not** read — not `~/.config/mcp/mcp.json`,
 not `~/.agents/mcp.json`, not `<project>/.mcp.json`, and not the legacy
 `~/.explyt/mcp_servers.json`. A server the user declared for another product will not appear here;
 it has to be copied into one of the two files above.
 
+A plugin server is defined by the plugin, not in `mcp.json`: its run mode and values are chosen
+with `explyt plugin` (see `plugins.md`).
+
 Either file may be absent. With none of the sources present the session simply starts with no MCP
 server.
 
@@ -72,6 +76,11 @@ A name that collides between the merged files and the servers the IDE supplied i
 matter — that makes the configuration invalid, and it is reported rather than resolved by
 preferring a source or renaming a server. Rename one of them.
 
+A plugin server never replaces another server. When its name is already taken by a global,
+project or session server, or by a server of another enabled plugin, it is left out of the session
+and reported in the plugins warning; the other server stays. Names are compared with case:
+`GitHub` and `github` do not collide.
+
 ## Turning a server off
 
 Set `disabled` on its entry:
@@ -109,3 +118,7 @@ which is not an error.
 In the terminal UI, `/mcp` lists the servers, their status and their tools, and can toggle a server
 or an individual tool — writing the same `disabled` and `excludeTools` fields described above. That
 command does not exist in an IDE session; there, edit the files.
+
+A plugin server is listed with the source `plugin` and cannot be toggled there: it is switched by
+enabling or disabling its plugin. A plugin server that could not be resolved is not listed at all;
+it is named in the plugins warning instead.

package/agent-docs/plugins.md

@@ -2,7 +2,7 @@
 
 ## Project activation
 
-Plugins are enabled per project in `.explyt/plugins.json`. Commit the exact plugin version and each MCP server's zero-based `runModes` index; do not put credentials or filesystem paths in this file.
+Plugins are enabled per project in `.explyt/plugins.json`. Commit the exact plugin version and each MCP server's zero-based `runModes` index; do not put credentials or filesystem paths in this file. An entry without a `version` is reported and ignored, and `enable`, `disable` and `config set-run-mode` drop it when they rewrite the file.
 
 Example:
 
@@ -20,21 +20,43 @@ Example:
 
 ## Plugin commands
 
-Use `/plugin install`, `/plugin uninstall`, `/plugin update`, `/plugin enable`, `/plugin disable`, `/plugin list`, `/plugin details`, `/plugin verify`, `/plugin config set`, and `/plugin config set-run-mode` in the terminal. Plugin activation requires an installed exact version. When enabling a plugin is not a no-op, provide an explicit run-mode choice for every declared MCP server; an existing selection for the same exact version in the current project may be reused.
+Plugins are managed from a shell in the project directory with `explyt plugin <operation>`. Without a global install, run `npx -y @explyt/ai-agent@<version> plugin <operation>` with the same version as the running agent (`explyt --version`, or the version it was started with). The current directory is the project. The command prints results on stdout and errors on stderr, and exits `0` on success, `1` when an operation fails, and `2` on an argument or usage error: an unknown operation or flag, a missing or extra argument, or an invalid plugin ID, version or run-mode index. Each error names its typed kind, such as `PluginVersionNotInstalled`.
+
+The operations are `install`, `uninstall`, `update`, `enable`, `disable`, `list`, `details`, `verify`, `config set`, and `config set-run-mode`; `explyt plugin help` lists their arguments, shows both values-file shapes and an `enable` example. Plugin activation requires an installed exact version. When enabling a plugin is not a no-op, provide an explicit run-mode choice for every declared MCP server, one `--run-mode <server-name> <index>` each, for example `explyt plugin enable security-pack@1.3.1 --run-mode "Github MCP" 1 --run-mode Local 0`; an existing selection for the same exact version in the current project may be reused. `verify` takes no argument and reports every issue of the plugins the current project enables: a missing or damaged version, an incompatible `minPluginVersion`, and a required value that is not set. The issues are its result: it prints them on stdout and exits `0`, and fails only when the project manifest cannot be read or is invalid.
+
+Before writing a values file or choosing run modes, run `explyt plugin details <plugin-id>@<version> --project` for the installed version. It lists each declared variable with its type, whether it is required, its default and choices, and whether a global or project value is stored (never the value itself), and each MCP server with its run-mode variants by index and the index this project selects. Without a version, or for a version that is not installed, `details` lists no declarations.
+
+No command changes a running session. Changes take effect in a new session, or in a running terminal session after `/reload`. A command run through a tool cannot reload the session it was run from.
 
 ## Values and credentials
 
-Credentials and other plugin values stay in the local plugin store, not in the project manifest. Configure them with:
+Credentials and other plugin values stay in the local plugin store, not in the project manifest. Values are first supplied at install time with a JSON object mapping each declared variable ID to a string; a required value that is neither supplied, already stored, nor defaulted fails the install:
+
+```text
+explyt plugin install <plugin-id>[@<version>] --values-file <values-file>
+```
+
+```json
+{ "github_pat": "ghp_...", "mode": "http" }
+```
+
+Later changes go through `config set`:
 
 ```text
-/plugin config set <plugin-id>@<version> <values-file>
-/plugin config set <plugin-id>@<version> --project <values-file>
+explyt plugin config set <plugin-id>@<version> <values-file>
+explyt plugin config set <plugin-id>@<version> --project <values-file>
+```
+
+The first command patches global values; the second patches values for the current project. A project value overrides the global value for that project. The values file for `config set` contains a `values` object and may contain an `unset` array; omitted keys are preserved, and an ID may not be in both:
+
+```json
+{ "values": { "mode": "mcp" }, "unset": ["api_key"] }
 ```
 
-The first command patches global values; the second patches values for the current project. A project value overrides the global value for that project. The values file for `config set` contains a `values` object and may contain an `unset` array; omitted keys are preserved.
+A `secret`, `path` or free-form `string` value may be an `${env:NAME}` or `${env:NAME:-fallback}` reference instead of the value itself, which keeps a secret out of the store; it is read from the agent's environment when a session starts.
 
-To remove an installed version, use `/plugin uninstall <plugin-id>[@<version>]`. Removing the last installed version also removes that plugin's stored values and per-version `${PLUGIN_DATA}` directories. To change one MCP server's selection for an enabled version, use:
+To remove an installed version, use `explyt plugin uninstall <plugin-id>[@<version>]`. Removing the last installed version also removes that plugin's stored values and per-version `${PLUGIN_DATA}` directories. To change one MCP server's selection for an enabled version, use:
 
 ```text
-/plugin config set-run-mode <plugin-id>@<version> <server-name> <index>
+explyt plugin config set-run-mode <plugin-id>@<version> <server-name> <index>
 ```

package/agent-docs/rules.md

@@ -15,8 +15,14 @@ does not repeat them in every conversation.
 | `<project>/.claude/CLAUDE.md` | `project:.claude/CLAUDE.md` | plain Markdown |
 | `<project>/CLAUDE.local.md` | `project:CLAUDE.local.md` | plain Markdown |
 
-Only these locations. A `CLAUDE.md` or `AGENTS.md` in a subdirectory is not picked up, and there is
-no search up the directory tree — the project is the session's working directory.
+Only these locations, plus the rules of the Marketplace plugins the project enables. A `CLAUDE.md`
+or `AGENTS.md` in a subdirectory is not picked up, and there is no search up the directory tree —
+the project is the session's working directory.
+
+A plugin rule is a top-level `rules/*.md` file of the enabled plugin version, with the ID
+`plugin:<plugin-id>/rules/<filename>`, for example `plugin:security-pack/rules/guard.md`. It uses
+the Explyt rule format below and applies after the Explyt project rules. It is part of the plugin:
+do not edit or copy it; `plugins.md` describes how a plugin is enabled.
 
 A new rule belongs in `.explyt/rules/`: project-wide in `<project>/.explyt/rules/`, or for every
 project in `~/.explyt/rules/`. The file may sit in subdirectories; every `.md` below the directory
@@ -27,12 +33,14 @@ session.
 
 ## Frontmatter of an Explyt rule
 
-YAML frontmatter, then the Markdown body. Both fields are optional.
+An optional YAML frontmatter block, then the Markdown body. A file with no frontmatter is a
+`system` rule whose whole text is the body; an empty frontmatter block (`---` followed by `---`)
+means the same. Both fields are optional.
 
 | Field | Values | Meaning |
 |---|---|---|
 | `strictness` | `system`, `user-message`, `tool-call` | when the body reaches the model; defaults to `system` |
-| `filePattern` | a glob such as `**/*.kt` | the body reaches the model after a matching file is read |
+| `filePattern` | a glob such as `**/*.kt`, or a non-empty list of globs | the body reaches the model after a file matching any of the globs is read |
 
 - `system` — part of the system prompt for the whole session.
 - `user-message` — delivered once with every message the user sends.
@@ -61,10 +69,26 @@ filePattern: "**/*.kt"
 This project targets Kotlin 2.0. Prefer data classes over records.
 ```
 
-A rule is **invalid** — and silently does not apply — when its frontmatter is missing, when its
-YAML does not parse or is not a mapping of fields, when `strictness` has an unknown value or the
-wrong type **and no `filePattern` is present**, or when `filePattern` is not a string. Only the body is sent to the model; the
-frontmatter is not. An empty body is valid and sends nothing.
+A file-pattern rule with several globs, applied when a read matches any of them:
+
+```markdown
+---
+filePattern: ["**/*.kt", "**/*.gradle.kts"]
+---
+Use the version catalog for dependency versions.
+```
+
+A rule with no frontmatter, applied to the whole session:
+
+```markdown
+Prefer small, focused commits.
+```
+
+A rule is **invalid** — and silently does not apply — when its YAML does not parse or is not a
+mapping of fields, when `strictness` has an unknown value or the wrong type **and no `filePattern`
+is present**, or when `filePattern` is neither a non-empty string nor a non-empty list of non-empty
+strings. Only the body is sent to the model; the frontmatter is not. An empty body is valid and
+sends nothing.
 
 Changes take effect on the next message the user sends; the current turn keeps the rules it
 started with.
@@ -88,5 +112,10 @@ case-insensitive matching. An entry matching no rule is kept and ignored.
 A rule owned by the project — any ID starting with `project:` — can be disabled only through the
 **project** layer. Such an entry written into the global layer is kept but has no effect.
 
+A plugin rule — any ID starting with `plugin:` — cannot be disabled through `rules.disabledRules`
+on either layer: such an entry is kept and ignored. It applies while its plugin is enabled in the
+project; disabling the plugin removes all of its rules.
+
 In the terminal UI the user can see the current list of rules and their state with the `/rules`
-command. That command does not exist in an IDE session — there, answer from the files above.
+command; a plugin rule is listed there read-only. That command does not exist in an IDE session —
+there, answer from the files above.

package/agent-docs/settings.md

@@ -28,8 +28,7 @@ One object per section, with the setting's keys inside it:
     "disabledSkills": ["pdf-tools"]
   },
   "subagents": {
-    "maxConcurrency": 20,
-    "permission": "inherit"
+    "maxConcurrency": 20
   }
 }
 ```
@@ -45,7 +44,6 @@ rest of the file as it is.
 | `skills.disabledSkills` | array of strings | `[]` | Skill names that are unavailable; see `skills.md` |
 | `sessionTitle.enabled` | boolean | `true` | whether a new chat gets a short title generated by the model after its first turn succeeds |
 | `subagents.maxConcurrency` | positive integer | `20` | Maximum simultaneously running or waiting children |
-| `subagents.permission` | `inherit` \| `yolo` \| `ask-permissions` | `inherit` | Permission mode resolved for child tools |
 | `subagents.disabledAgents` | array of strings | `[]` | helper agent names that are unavailable; see `agents.md` |
 | `subagents.disabledProfiles` | array of strings | `[]` | model profile names that are unavailable; see `agents.md` |
 | `tui.mascot` | string | `"cat"` | the animated mascot in the terminal's working row: `cat`, `snake`, `pacman`, `tetris`, `fishing`, `robot`, `pong`, `crab`, or `custom` for the user's own |
@@ -58,11 +56,15 @@ globs or prefixes: `"pdf-*"` matches nothing. An entry matching nothing is kept,
 A `disabledAgents` or `disabledProfiles` value that is not an array of strings, such as
 `"disabledProfiles": "strong"`, is ignored for that layer with a warning.
 
-For `subagents.maxConcurrency` and `subagents.permission`, a valid project value overrides the
-global value. Invalid values are ignored for that layer with a warning, so the other layer or the default still applies. `permission: "inherit"`
-resolves once when the child launches from the parent session's effective permission mode. The
-parent always asks before a dangerous command (or blocks it when nobody can answer), so today
-`inherit` behaves as `ask-permissions`; only an explicit `yolo` lets a child skip the question.
+For `subagents.maxConcurrency`, a valid project value overrides the global value. An invalid
+value is ignored for that layer with a warning, so the other layer or the default still applies.
+
+No setting chooses a subagent's permission mode. A subagent starts in the permission mode its
+parent session has when the subagent starts (`default`, `paranoid` or `bypassPermissions`), with a
+copy of the parent's "Allow for this session" approvals. A `permission` key left in the
+`subagents` section is ignored. The mode itself is not a setting either: the user switches it in
+the chat (the IDE's mode control, or `Shift+Tab`, `/mode` and `--permission-mode` in the terminal),
+and each chat keeps its own.
 
 The list settings are read per layer rather than merged, so a value written in the project layer does not
 replace the global one — each layer's list is applied on its own. Which layer to write is a

package/agent-docs/skills.md

@@ -27,6 +27,10 @@ project. No root outranks another, and the tool a Skill was written for is never
 
 The project root is the session's working directory; there is no search up the directory tree.
 
+The Marketplace plugins the project enables add their own Skills: each `skills/<name>/SKILL.md` of
+the enabled plugin version. A plugin Skill is part of the plugin — do not edit or copy it;
+`plugins.md` describes how a plugin is enabled.
+
 ## `SKILL.md`
 
 YAML frontmatter, then the Markdown body that carries the instructions.
@@ -55,7 +59,12 @@ when_to_use: Use when the user asks for a changelog or release notes
 
 The `name` in the frontmatter is the Skill's identity; it does not have to match the directory
 name, but making them equal keeps things findable. Two `SKILL.md` files claiming one name make
-**both** unavailable — neither wins.
+**both** unavailable — neither wins. This includes plugin Skills: an ordinary Skill named like a
+Skill of an enabled plugin makes both unavailable.
+
+A plugin Skill's frontmatter follows the plugin format: `name` and `description` follow the rules
+above, and instead of the two boolean fields it has `invocation` — `any` (the default: the user
+and the model), `user` (only the user) or `model` (only the model).
 
 A Skill is **invalid** — and unavailable — when the frontmatter is missing, unparseable or not a
 YAML mapping, when `name` or `description` breaks a rule above, when an optional field has the
@@ -86,5 +95,10 @@ kept and ignored.
 Disabling never edits a `SKILL.md`: to hide a Skill from the model but keep it available to the
 user, set `disable-model-invocation: true` in its frontmatter instead.
 
-In the terminal UI the user can see every Skill and its state with the `/skills` command. That
-command does not exist in an IDE session — there, answer from the files above.
+A plugin Skill cannot be disabled through `skills.disabledSkills` on either layer: an entry naming
+it is kept and ignored. It is available while its plugin is enabled in the project; disabling the
+plugin removes all of its Skills.
+
+In the terminal UI the user can see every Skill and its state with the `/skills` command; a plugin
+Skill is listed there read-only, with the source `plugin`. That command does not exist in an IDE
+session — there, answer from the files above.

package/dist/cli/engine.js

@@ -924,9 +924,10 @@ export function withIsolation(rest, packageRoot) {
  * interactive UI, started directly against our directory; `logout` removes what it
  * stored. `acp` is parsed everywhere but only FUNCTIONS in the managed-backend and
  * debug artifacts, where the adapter ships next to the wrapper; the public terminal
- * package answers it with a migration error.
+ * package answers it with a migration error. `plugin` manages Marketplace plugins from a shell
+ * and takes every argument after it as its own (spec 012 RQ-1).
  */
-export const COMMANDS = new Set(["acp", "config", "install", "login", "logout", "tui", "update"]);
+export const COMMANDS = new Set(["acp", "config", "install", "login", "logout", "plugin", "tui", "update"]);
 
 /**
  * Engine flags that confine a terminal run to a single package: ours.
@@ -1069,6 +1070,13 @@ export function withoutLaunchPath(rest, { argv1, launchFile, cwd = process.cwd()
   return rest.filter((arg) => arg.startsWith("-") || !(same(arg, argv1) || same(arg, launchFile)));
 }
 
+/**
+ * The terminal product's start mode (spec 020, RQ-22). The policy extension registers it with the
+ * engine and validates the value (RQ-26); here it only has to travel with its value, so that
+ * `--permission-mode login` is never read as the `login` subcommand.
+ */
+export const PERMISSION_MODE_FLAG = "--permission-mode";
+
 /**
  * Flags belonging to other programs that consume the NEXT argument as their value.
  *
@@ -1077,7 +1085,7 @@ export function withoutLaunchPath(rest, { argv1, launchFile, cwd = process.cwd()
  * which it rejects. Only pass-through flags need listing; our own flags are handled
  * explicitly below.
  */
-export const VALUE_FLAGS = new Set([ISOLATION_FLAG, "--extension", "--model", "--cwd"]);
+export const VALUE_FLAGS = new Set([ISOLATION_FLAG, "--extension", "--model", "--cwd", PERMISSION_MODE_FLAG]);
 
 /**
  * Argument shape of the user-facing CLI.
@@ -1128,6 +1136,12 @@ export function parseArgs(argv) {
     // Bare word. Only the first one can name a subcommand.
     if (!seenPositional) {
       seenPositional = true;
+      // `plugin` owns everything after it, flags and `--` included.
+      if (arg === "plugin") {
+        command = arg;
+        rest.push(...argv.slice(i + 1));
+        break;
+      }
       if (COMMANDS.has(arg)) { command = arg; continue; }
       if (arg === "help") { help = true; continue; }
     }
@@ -1149,9 +1163,11 @@ export function helpText() {
     "  npx -y @explyt/ai-agent@<version> login       store a provider credential",
     "  npx -y @explyt/ai-agent@<version> logout      remove stored credentials",
     "",
-    "Commands: explyt tui | login | logout | install | update | config",
+    "Commands: explyt tui | login | logout | plugin | install | update | config",
     "  explyt update      update the managed installation now (same as install)",
     "  explyt config set updateChannel stable|dogfood | autoUpdate true|false",
+    "  explyt plugin      manage Marketplace plugins (explyt plugin help)",
+    "  --permission-mode default|paranoid|bypassPermissions   start the terminal UI in that mode",
     "  -h, --help         show this message",
     "  -v, --version      print the version",
     "",