@fased/fased 0.1.55 → 0.1.57

package/dist/plugin-sdk/{config-CYDETqcF.js → config-Dbxj_jUP.js}

@@ -2,9 +2,9 @@ import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { c as CHANNEL_IDS, f as normalizeChatChannelId, t as createSubsystemLogger, u as CORE_RUNTIME_CHANNEL_IDS } from "./subsystem-DBPNbQDQ.js";
 import { c as expandHomePrefix, n as resolveConfigPath, o as resolveOAuthPath, r as resolveDefaultConfigCandidates, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
 import { C as isPlainObject$2, c as isRecord$3, h as resolveUserPath, p as resolveConfigDir, t as CONFIG_DIR } from "./utils-CYk9EKoq.js";
-import { A as openBoundaryFileSync, B as MAX_AGENT_MODEL_FALLBACKS, D as resolveFasedAgentPackageRootSync, F as isNotFoundPathError, H as resolveAgentModelPrimaryValue, I as isPathInside$2, L as isSymlinkOpenError, O as canUseBoundaryFileOpen, U as toAgentModelListLike, V as resolveAgentModelFallbackValues, i as resolveAgentConfig, l as resolveAgentWorkspaceDir, o as resolveAgentEffectiveModelPrimary, u as resolveDefaultAgentId } from "./agent-scope-BbgPlhtw.js";
+import { H as resolveAgentModelFallbackValues, I as isNotFoundPathError, L as isPathInside$2, O as resolveFasedAgentPackageRootSync, R as isSymlinkOpenError, U as resolveAgentModelPrimaryValue, V as MAX_AGENT_MODEL_FALLBACKS, W as toAgentModelListLike, i as resolveAgentConfig, j as openBoundaryFileSync, k as canUseBoundaryFileOpen, l as resolveAgentWorkspaceDir, o as resolveAgentEffectiveModelPrimary, u as resolveDefaultAgentId } from "./agent-scope-CCjfjKoO.js";
 import { h as isBlockedObjectKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID } from "./session-key-HSJ2KQTc.js";
-import { n as runExec } from "./exec-DQ8j4Fm3.js";
+import { n as runExec, t as runCommandWithTimeout } from "./exec-DQ8j4Fm3.js";
 import { n as redactSensitiveText } from "./redact-Bm8vu_ju.js";
 import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-CUK__1s1.js";
 import { t as runTasksWithConcurrency } from "./run-with-concurrency-BsDJWzgM.js";
@@ -31,10 +31,64 @@ import AjvPkg from "ajv";
 import { z } from "zod";
 
 //#region src/plugins/slots.ts
+const SLOT_BY_KIND = { memory: "memory" };
 const DEFAULT_SLOT_BY_KEY = { memory: "memory-core" };
+function slotKeyForPluginKind(kind) {
+	if (!kind) return null;
+	return SLOT_BY_KIND[kind] ?? null;
+}
 function defaultSlotIdForKey(slotKey) {
 	return DEFAULT_SLOT_BY_KEY[slotKey];
 }
+function applyExclusiveSlotSelection(params) {
+	const slotKey = slotKeyForPluginKind(params.selectedKind);
+	if (!slotKey) return {
+		config: params.config,
+		warnings: [],
+		changed: false
+	};
+	const warnings = [];
+	const pluginsConfig = params.config.plugins ?? {};
+	const prevSlot = pluginsConfig.slots?.[slotKey];
+	const slots = {
+		...pluginsConfig.slots,
+		[slotKey]: params.selectedId
+	};
+	const inferredPrevSlot = prevSlot ?? defaultSlotIdForKey(slotKey);
+	if (inferredPrevSlot && inferredPrevSlot !== params.selectedId) warnings.push(`Exclusive slot "${slotKey}" switched from "${inferredPrevSlot}" to "${params.selectedId}".`);
+	const entries = { ...pluginsConfig.entries };
+	const disabledIds = [];
+	if (params.registry) for (const plugin of params.registry.plugins) {
+		if (plugin.id === params.selectedId) continue;
+		if (plugin.kind !== params.selectedKind) continue;
+		const entry = entries[plugin.id];
+		if (!entry || entry.enabled !== false) {
+			entries[plugin.id] = {
+				...entry,
+				enabled: false
+			};
+			disabledIds.push(plugin.id);
+		}
+	}
+	if (disabledIds.length > 0) warnings.push(`Disabled other "${slotKey}" slot plugins: ${disabledIds.toSorted().join(", ")}.`);
+	if (!(prevSlot !== params.selectedId || disabledIds.length > 0)) return {
+		config: params.config,
+		warnings: [],
+		changed: false
+	};
+	return {
+		config: {
+			...params.config,
+			plugins: {
+				...pluginsConfig,
+				slots,
+				entries
+			}
+		},
+		warnings,
+		changed: true
+	};
+}
 
 //#endregion
 //#region src/plugins/config-state.ts
@@ -1216,6 +1270,17 @@ function resolveArchiveKind(filePath) {
 	if (TAR_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return "tar";
 	return null;
 }
+async function resolvePackedRootDir(extractDir) {
+	const direct = path.join(extractDir, "package");
+	try {
+		if ((await fs$1.stat(direct)).isDirectory()) return direct;
+	} catch {}
+	const dirs = (await fs$1.readdir(extractDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	if (dirs.length !== 1) throw new Error(`unexpected archive layout (dirs: ${dirs.join(", ")})`);
+	const onlyDir = dirs[0];
+	if (!onlyDir) throw new Error("unexpected archive layout (no package dir found)");
+	return path.join(extractDir, onlyDir);
+}
 async function withTimeout(promise, timeoutMs, label) {
 	let timeoutId;
 	try {
@@ -1473,9 +1538,351 @@ async function extractArchive(params) {
 		limits: params.limits
 	}), params.timeoutMs, label);
 }
+async function fileExists(filePath) {
+	try {
+		await fs$1.stat(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readJsonFile(filePath) {
+	const raw = await fs$1.readFile(filePath, "utf-8");
+	return JSON.parse(raw);
+}
+
+//#endregion
+//#region src/infra/install-source-utils.ts
+async function withTempDir(prefix, fn) {
+	const tmpDir = await fs$1.mkdtemp(path.join(os.tmpdir(), prefix));
+	try {
+		return await fn(tmpDir);
+	} finally {
+		await fs$1.rm(tmpDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+async function resolveArchiveSourcePath(archivePath) {
+	const resolved = resolveUserPath(archivePath);
+	if (!await fileExists(resolved)) return {
+		ok: false,
+		error: `archive not found: ${resolved}`
+	};
+	if (!resolveArchiveKind(resolved)) return {
+		ok: false,
+		error: `unsupported archive: ${resolved}`
+	};
+	return {
+		ok: true,
+		path: resolved
+	};
+}
+function toOptionalString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function parseResolvedSpecFromId(id) {
+	const at = id.lastIndexOf("@");
+	if (at <= 0 || at >= id.length - 1) return;
+	const name = id.slice(0, at).trim();
+	const version = id.slice(at + 1).trim();
+	if (!name || !version) return;
+	return `${name}@${version}`;
+}
+function normalizeNpmPackEntry(entry) {
+	if (!entry || typeof entry !== "object") return null;
+	const rec = entry;
+	const name = toOptionalString(rec.name);
+	const version = toOptionalString(rec.version);
+	const id = toOptionalString(rec.id);
+	const resolvedSpec = (name && version ? `${name}@${version}` : void 0) ?? (id ? parseResolvedSpecFromId(id) : void 0);
+	return {
+		filename: toOptionalString(rec.filename),
+		metadata: {
+			name,
+			version,
+			resolvedSpec,
+			integrity: toOptionalString(rec.integrity),
+			shasum: toOptionalString(rec.shasum)
+		}
+	};
+}
+function parseNpmPackJsonOutput(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const candidates = [trimmed];
+	const arrayStart = trimmed.indexOf("[");
+	if (arrayStart > 0) candidates.push(trimmed.slice(arrayStart));
+	for (const candidate of candidates) {
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch {
+			continue;
+		}
+		const entries = Array.isArray(parsed) ? parsed : [parsed];
+		let fallback = null;
+		for (let i = entries.length - 1; i >= 0; i -= 1) {
+			const normalized = normalizeNpmPackEntry(entries[i]);
+			if (!normalized) continue;
+			if (!fallback) fallback = normalized;
+			if (normalized.filename) return normalized;
+		}
+		if (fallback) return fallback;
+	}
+	return null;
+}
+function parsePackedArchiveFromStdout(stdout) {
+	const lines = stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const match = lines[index]?.match(/([^\s"']+\.tgz)/);
+		if (match?.[1]) return match[1];
+	}
+}
+async function findPackedArchiveInDir(cwd) {
+	const archives = (await fs$1.readdir(cwd, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".tgz"));
+	if (archives.length === 0) return;
+	if (archives.length === 1) return archives[0]?.name;
+	const sortedByMtime = await Promise.all(archives.map(async (entry) => ({
+		name: entry.name,
+		mtimeMs: (await fs$1.stat(path.join(cwd, entry.name))).mtimeMs
+	})));
+	sortedByMtime.sort((a, b) => b.mtimeMs - a.mtimeMs);
+	return sortedByMtime[0]?.name;
+}
+async function packNpmSpecToArchive(params) {
+	const res = await runCommandWithTimeout([
+		"npm",
+		"pack",
+		params.spec,
+		"--ignore-scripts",
+		"--json"
+	], {
+		timeoutMs: Math.max(params.timeoutMs, 3e5),
+		cwd: params.cwd,
+		env: {
+			COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+			NPM_CONFIG_IGNORE_SCRIPTS: "true"
+		}
+	});
+	if (res.code !== 0) {
+		const raw = res.stderr.trim() || res.stdout.trim();
+		if (/E404|is not in this registry/i.test(raw)) return {
+			ok: false,
+			error: `Package not found on npm: ${params.spec}. See https://docs.fased.ai/tools/plugin for installable plugins.`
+		};
+		return {
+			ok: false,
+			error: `npm pack failed: ${raw}`
+		};
+	}
+	const parsedJson = parseNpmPackJsonOutput(res.stdout || "");
+	let packed = parsedJson?.filename ?? parsePackedArchiveFromStdout(res.stdout || "");
+	if (!packed) packed = await findPackedArchiveInDir(params.cwd);
+	if (!packed) return {
+		ok: false,
+		error: "npm pack produced no archive"
+	};
+	let archivePath = path.isAbsolute(packed) ? packed : path.join(params.cwd, packed);
+	if (!await fileExists(archivePath)) {
+		const fallbackPacked = await findPackedArchiveInDir(params.cwd);
+		if (!fallbackPacked) return {
+			ok: false,
+			error: "npm pack produced no archive"
+		};
+		archivePath = path.join(params.cwd, fallbackPacked);
+	}
+	return {
+		ok: true,
+		archivePath,
+		metadata: parsedJson?.metadata ?? {}
+	};
+}
+
+//#endregion
+//#region src/infra/install-flow.ts
+async function withExtractedArchiveRoot(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const extractDir = path.join(tmpDir, "extract");
+		await fs$1.mkdir(extractDir, { recursive: true });
+		params.logger?.info?.(`Extracting ${params.archivePath}…`);
+		try {
+			await extractArchive({
+				archivePath: params.archivePath,
+				destDir: extractDir,
+				timeoutMs: params.timeoutMs,
+				logger: params.logger
+			});
+		} catch (err) {
+			return {
+				ok: false,
+				error: `failed to extract archive: ${String(err)}`
+			};
+		}
+		let rootDir = "";
+		try {
+			rootDir = await resolveInstallRootDir(extractDir, params.rootMarkers);
+		} catch (err) {
+			return {
+				ok: false,
+				error: String(err)
+			};
+		}
+		return await params.onExtracted(rootDir);
+	});
+}
+async function hasAnyRootMarker(rootDir, rootMarkers) {
+	for (const marker of rootMarkers) {
+		if (!marker || path.isAbsolute(marker) || marker.includes("..")) continue;
+		if (await fileExists(path.join(rootDir, marker))) return true;
+	}
+	return false;
+}
+async function resolveInstallRootDir(extractDir, rootMarkers) {
+	const markers = rootMarkers?.filter(Boolean) ?? [];
+	if (markers.length === 0) return await resolvePackedRootDir(extractDir);
+	if (await hasAnyRootMarker(extractDir, markers)) return extractDir;
+	const entries = await fs$1.readdir(extractDir, { withFileTypes: true });
+	const markerDirs = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		if (await hasAnyRootMarker(path.join(extractDir, entry.name), markers)) markerDirs.push(entry.name);
+	}
+	if (markerDirs.length === 1) return path.join(extractDir, markerDirs[0]);
+	if (markerDirs.length > 1) throw new Error(`unexpected archive layout (marker dirs: ${markerDirs.join(", ")})`);
+	return await resolvePackedRootDir(extractDir);
+}
+
+//#endregion
+//#region src/infra/install-mode-options.ts
+function resolveInstallModeOptions(params, defaultLogger) {
+	return {
+		logger: params.logger ?? defaultLogger,
+		mode: params.mode ?? "install",
+		dryRun: params.dryRun ?? false
+	};
+}
+function resolveTimedInstallModeOptions(params, defaultLogger, defaultTimeoutMs = 12e4) {
+	return {
+		...resolveInstallModeOptions(params, defaultLogger),
+		timeoutMs: params.timeoutMs ?? defaultTimeoutMs
+	};
+}
+
+//#endregion
+//#region src/infra/install-package-dir.ts
+function isObjectRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function sanitizeManifestForNpmInstall(targetDir) {
+	const manifestPath = path.join(targetDir, "package.json");
+	let manifestRaw = "";
+	try {
+		manifestRaw = await fs$1.readFile(manifestPath, "utf-8");
+	} catch {
+		return;
+	}
+	let manifest;
+	try {
+		const parsed = JSON.parse(manifestRaw);
+		if (!isObjectRecord(parsed)) return;
+		manifest = parsed;
+	} catch {
+		return;
+	}
+	const devDependencies = manifest.devDependencies;
+	if (!isObjectRecord(devDependencies)) return;
+	const filteredEntries = Object.entries(devDependencies).filter(([, rawSpec]) => {
+		return !(typeof rawSpec === "string" ? rawSpec.trim() : "").startsWith("workspace:");
+	});
+	if (filteredEntries.length === Object.keys(devDependencies).length) return;
+	if (filteredEntries.length === 0) delete manifest.devDependencies;
+	else manifest.devDependencies = Object.fromEntries(filteredEntries);
+	await fs$1.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
+}
+async function installPackageDir(params) {
+	params.logger?.info?.(`Installing to ${params.targetDir}…`);
+	let backupDir = null;
+	if (params.mode === "update" && await fileExists(params.targetDir)) {
+		const backupRoot = path.join(path.dirname(params.targetDir), ".fased-install-backups");
+		backupDir = path.join(backupRoot, `${path.basename(params.targetDir)}-${Date.now()}`);
+		await fs$1.mkdir(backupRoot, { recursive: true });
+		await fs$1.rename(params.targetDir, backupDir);
+	}
+	const rollback = async () => {
+		if (!backupDir) return;
+		await fs$1.rm(params.targetDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		await fs$1.rename(backupDir, params.targetDir).catch(() => void 0);
+	};
+	try {
+		await fs$1.cp(params.sourceDir, params.targetDir, { recursive: true });
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `${params.copyErrorPrefix}: ${String(err)}`
+		};
+	}
+	try {
+		await params.afterCopy?.();
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `post-copy validation failed: ${String(err)}`
+		};
+	}
+	if (params.hasDeps) {
+		await sanitizeManifestForNpmInstall(params.targetDir);
+		params.logger?.info?.(params.depsLogMessage);
+		const npmRes = await runCommandWithTimeout([
+			"npm",
+			"install",
+			"--omit=dev",
+			"--loglevel=error",
+			"--ignore-scripts",
+			"--legacy-peer-deps"
+		], {
+			timeoutMs: Math.max(params.timeoutMs, 3e5),
+			cwd: params.targetDir
+		});
+		if (npmRes.code !== 0) {
+			await rollback();
+			return {
+				ok: false,
+				error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`
+			};
+		}
+	}
+	try {
+		await params.afterInstall?.();
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `post-install validation failed: ${String(err)}`
+		};
+	}
+	if (backupDir) await fs$1.rm(backupDir, {
+		recursive: true,
+		force: true
+	}).catch(() => void 0);
+	return { ok: true };
+}
 
 //#endregion
 //#region src/infra/install-safe-path.ts
+function unscopedPackageName(name) {
+	const trimmed = name.trim();
+	if (!trimmed) return trimmed;
+	return trimmed.includes("/") ? trimmed.split("/").pop() ?? trimmed : trimmed;
+}
 function safeDirName(input) {
 	const trimmed = input.trim();
 	if (!trimmed) return trimmed;
@@ -1496,6 +1903,150 @@ function resolveSafeInstallDir(params) {
 	};
 }
 
+//#endregion
+//#region src/infra/npm-integrity.ts
+async function resolveNpmIntegrityDrift(params) {
+	if (!params.expectedIntegrity || !params.resolution.integrity) return { proceed: true };
+	if (params.expectedIntegrity === params.resolution.integrity) return { proceed: true };
+	const integrityDrift = {
+		expectedIntegrity: params.expectedIntegrity,
+		actualIntegrity: params.resolution.integrity
+	};
+	const payload = params.createPayload({
+		spec: params.spec,
+		expectedIntegrity: integrityDrift.expectedIntegrity,
+		actualIntegrity: integrityDrift.actualIntegrity,
+		resolution: params.resolution
+	});
+	let proceed = true;
+	if (params.onIntegrityDrift) proceed = await params.onIntegrityDrift(payload);
+	else params.warn?.(payload);
+	return {
+		integrityDrift,
+		proceed,
+		payload
+	};
+}
+async function resolveNpmIntegrityDriftWithDefaultMessage(params) {
+	const driftResult = await resolveNpmIntegrityDrift({
+		spec: params.spec,
+		expectedIntegrity: params.expectedIntegrity,
+		resolution: params.resolution,
+		createPayload: (drift) => ({ ...drift }),
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: (driftPayload) => {
+			params.warn?.(`Integrity drift detected for ${driftPayload.resolution.resolvedSpec ?? driftPayload.spec}: expected ${driftPayload.expectedIntegrity}, got ${driftPayload.actualIntegrity}`);
+		}
+	});
+	if (!driftResult.proceed && driftResult.payload) return {
+		integrityDrift: driftResult.integrityDrift,
+		error: `aborted: npm package integrity drift detected for ${driftResult.payload.resolution.resolvedSpec ?? driftResult.payload.spec}`
+	};
+	return { integrityDrift: driftResult.integrityDrift };
+}
+
+//#endregion
+//#region src/infra/npm-pack-install.ts
+async function installFromNpmSpecArchiveWithInstaller(params) {
+	return await installFromNpmSpecArchive({
+		tempDirPrefix: params.tempDirPrefix,
+		spec: params.spec,
+		timeoutMs: params.timeoutMs,
+		expectedIntegrity: params.expectedIntegrity,
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: params.warn,
+		installFromArchive: async ({ archivePath }) => await params.installFromArchive({
+			archivePath,
+			...params.archiveInstallParams
+		})
+	});
+}
+function isSuccessfulInstallResult(result) {
+	return result.ok;
+}
+function describeMissingNpmPackMetadata(metadata) {
+	const missing = [];
+	if (!metadata.name) missing.push("name");
+	if (!metadata.version) missing.push("version");
+	if (!metadata.integrity && !metadata.shasum) missing.push("integrity or shasum");
+	return missing;
+}
+function validateNpmPackMetadata(params) {
+	const missing = describeMissingNpmPackMetadata(params.metadata);
+	if (missing.length === 0) return null;
+	return `npm pack did not report ${missing.join(", ")} for ${params.spec}; refusing unpinned npm plugin install`;
+}
+function finalizeNpmSpecArchiveInstall(flowResult) {
+	if (!flowResult.ok) return flowResult;
+	const installResult = flowResult.installResult;
+	if (!isSuccessfulInstallResult(installResult)) return installResult;
+	return {
+		...installResult,
+		npmResolution: flowResult.npmResolution,
+		...flowResult.integrityDrift ? { integrityDrift: flowResult.integrityDrift } : {}
+	};
+}
+async function installFromNpmSpecArchive(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const packedResult = await packNpmSpecToArchive({
+			spec: params.spec,
+			timeoutMs: params.timeoutMs,
+			cwd: tmpDir
+		});
+		if (!packedResult.ok) return packedResult;
+		const metadataError = validateNpmPackMetadata({
+			spec: params.spec,
+			metadata: packedResult.metadata
+		});
+		if (metadataError) return {
+			ok: false,
+			error: metadataError
+		};
+		const npmResolution = {
+			...packedResult.metadata,
+			resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const driftResult = await resolveNpmIntegrityDriftWithDefaultMessage({
+			spec: params.spec,
+			expectedIntegrity: params.expectedIntegrity,
+			resolution: npmResolution,
+			onIntegrityDrift: params.onIntegrityDrift,
+			warn: params.warn
+		});
+		if (driftResult.error) return {
+			ok: false,
+			error: driftResult.error
+		};
+		return {
+			ok: true,
+			installResult: await params.installFromArchive({ archivePath: packedResult.archivePath }),
+			npmResolution,
+			integrityDrift: driftResult.integrityDrift
+		};
+	});
+}
+
+//#endregion
+//#region src/infra/npm-registry-spec.ts
+function validateRegistryNpmSpec(rawSpec) {
+	const spec = rawSpec.trim();
+	if (!spec) return "missing npm spec";
+	if (/\s/.test(spec)) return "unsupported npm spec: whitespace is not allowed";
+	if (spec.includes("://")) return "unsupported npm spec: URLs are not allowed";
+	if (spec.includes("#")) return "unsupported npm spec: git refs are not allowed";
+	if (spec.includes(":")) return "unsupported npm spec: protocol specs are not allowed";
+	const at = spec.lastIndexOf("@");
+	const hasVersion = at > 0;
+	const name = hasVersion ? spec.slice(0, at) : spec;
+	const version = hasVersion ? spec.slice(at + 1) : "";
+	if (!(name.startsWith("@") ? /^@[a-z0-9][a-z0-9-._~]*\/[a-z0-9][a-z0-9-._~]*$/.test(name) : /^[a-z0-9][a-z0-9-._~]*$/.test(name))) return "unsupported npm spec: expected <name> or <name>@<version> from the npm registry";
+	if (hasVersion) {
+		if (!version) return "unsupported npm spec: missing version/tag after @";
+		if (/[\\/]/.test(version)) return "unsupported npm spec: invalid version/tag";
+	}
+	return null;
+}
+
 //#endregion
 //#region src/security/scan-paths.ts
 function isPathInside$1(basePath, candidatePath) {
@@ -1504,6 +2055,9 @@ function isPathInside$1(basePath, candidatePath) {
 	const rel = path.relative(base, candidate);
 	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
 }
+function extensionUsesSkippedScannerPath(entry) {
+	return entry.split(/[\\/]+/).filter(Boolean).some((segment) => segment === "node_modules" || segment.startsWith(".") && segment !== "." && segment !== "..");
+}
 
 //#endregion
 //#region src/infra/errors.ts
@@ -1519,6 +2073,12 @@ function extractErrorCode(err) {
 function isErrno(err) {
 	return Boolean(err && typeof err === "object" && "code" in err);
 }
+/**
+* Check if an error has a specific errno code.
+*/
+function hasErrnoCode(err, code) {
+	return isErrno(err) && err.code === code;
+}
 function formatErrorMessage(err) {
 	let formatted;
 	if (err instanceof Error) formatted = err.message || err.name || "Error";
@@ -1539,7 +2099,243 @@ function formatUncaughtError(err) {
 
 //#endregion
 //#region src/security/skill-scanner.ts
+const SCANNABLE_EXTENSIONS = new Set([
+	".js",
+	".ts",
+	".mjs",
+	".cjs",
+	".mts",
+	".cts",
+	".jsx",
+	".tsx"
+]);
+const DEFAULT_MAX_SCAN_FILES = 500;
 const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
+function isScannable(filePath) {
+	return SCANNABLE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+const LINE_RULES = [
+	{
+		ruleId: "dangerous-exec",
+		severity: "critical",
+		message: "Shell command execution detected (child_process)",
+		pattern: /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/,
+		requiresContext: /child_process/
+	},
+	{
+		ruleId: "dynamic-code-execution",
+		severity: "critical",
+		message: "Dynamic code execution detected",
+		pattern: /\beval\s*\(|new\s+Function\s*\(/
+	},
+	{
+		ruleId: "crypto-mining",
+		severity: "critical",
+		message: "Possible crypto-mining reference detected",
+		pattern: /stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i
+	},
+	{
+		ruleId: "suspicious-network",
+		severity: "warn",
+		message: "WebSocket connection to non-standard port",
+		pattern: /new\s+WebSocket\s*\(\s*["']wss?:\/\/[^"']*:(\d+)/
+	}
+];
+const STANDARD_PORTS = new Set([
+	80,
+	443,
+	8080,
+	8443,
+	3e3
+]);
+const SOURCE_RULES = [
+	{
+		ruleId: "potential-exfiltration",
+		severity: "warn",
+		message: "File read combined with network send — possible data exfiltration",
+		pattern: /readFileSync|readFile/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Hex-encoded string sequence detected (possible obfuscation)",
+		pattern: /(\\x[0-9a-fA-F]{2}){6,}/
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Large base64 payload with decode call detected (possible obfuscation)",
+		pattern: /(?:atob|Buffer\.from)\s*\(\s*["'][A-Za-z0-9+/=]{200,}["']/
+	},
+	{
+		ruleId: "env-harvesting",
+		severity: "critical",
+		message: "Environment variable access combined with network send — possible credential harvesting",
+		pattern: /process\.env/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	}
+];
+function truncateEvidence(evidence, maxLen = 120) {
+	if (evidence.length <= maxLen) return evidence;
+	return `${evidence.slice(0, maxLen)}…`;
+}
+function scanSource(source, filePath) {
+	const findings = [];
+	const lines = source.split("\n");
+	const matchedLineRules = /* @__PURE__ */ new Set();
+	for (const rule of LINE_RULES) {
+		if (matchedLineRules.has(rule.ruleId)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			const match = rule.pattern.exec(line);
+			if (!match) continue;
+			if (rule.ruleId === "suspicious-network") {
+				const port = parseInt(match[1], 10);
+				if (STANDARD_PORTS.has(port)) continue;
+			}
+			findings.push({
+				ruleId: rule.ruleId,
+				severity: rule.severity,
+				file: filePath,
+				line: i + 1,
+				message: rule.message,
+				evidence: truncateEvidence(line.trim())
+			});
+			matchedLineRules.add(rule.ruleId);
+			break;
+		}
+	}
+	const matchedSourceRules = /* @__PURE__ */ new Set();
+	for (const rule of SOURCE_RULES) {
+		const ruleKey = `${rule.ruleId}::${rule.message}`;
+		if (matchedSourceRules.has(ruleKey)) continue;
+		if (!rule.pattern.test(source)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		let matchLine = 0;
+		let matchEvidence = "";
+		for (let i = 0; i < lines.length; i++) if (rule.pattern.test(lines[i])) {
+			matchLine = i + 1;
+			matchEvidence = lines[i].trim();
+			break;
+		}
+		if (matchLine === 0) {
+			matchLine = 1;
+			matchEvidence = source.slice(0, 120);
+		}
+		findings.push({
+			ruleId: rule.ruleId,
+			severity: rule.severity,
+			file: filePath,
+			line: matchLine,
+			message: rule.message,
+			evidence: truncateEvidence(matchEvidence)
+		});
+		matchedSourceRules.add(ruleKey);
+	}
+	return findings;
+}
+function normalizeScanOptions(opts) {
+	return {
+		includeFiles: opts?.includeFiles ?? [],
+		maxFiles: Math.max(1, opts?.maxFiles ?? DEFAULT_MAX_SCAN_FILES),
+		maxFileBytes: Math.max(1, opts?.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES)
+	};
+}
+async function walkDirWithLimit(dirPath, maxFiles) {
+	const files = [];
+	const stack = [dirPath];
+	while (stack.length > 0 && files.length < maxFiles) {
+		const currentDir = stack.pop();
+		if (!currentDir) break;
+		const entries = await fs$1.readdir(currentDir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (files.length >= maxFiles) break;
+			if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+			const fullPath = path.join(currentDir, entry.name);
+			if (entry.isDirectory()) stack.push(fullPath);
+			else if (isScannable(entry.name)) files.push(fullPath);
+		}
+	}
+	return files;
+}
+async function resolveForcedFiles(params) {
+	if (params.includeFiles.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const rawIncludePath of params.includeFiles) {
+		const includePath = path.resolve(params.rootDir, rawIncludePath);
+		if (!isPathInside$1(params.rootDir, includePath)) continue;
+		if (!isScannable(includePath)) continue;
+		if (seen.has(includePath)) continue;
+		let st = null;
+		try {
+			st = await fs$1.stat(includePath);
+		} catch (err) {
+			if (hasErrnoCode(err, "ENOENT")) continue;
+			throw err;
+		}
+		if (!st?.isFile()) continue;
+		out.push(includePath);
+		seen.add(includePath);
+	}
+	return out;
+}
+async function collectScannableFiles(dirPath, opts) {
+	const forcedFiles = await resolveForcedFiles({
+		rootDir: dirPath,
+		includeFiles: opts.includeFiles
+	});
+	if (forcedFiles.length >= opts.maxFiles) return forcedFiles.slice(0, opts.maxFiles);
+	const walkedFiles = await walkDirWithLimit(dirPath, opts.maxFiles);
+	const seen = new Set(forcedFiles.map((f) => path.resolve(f)));
+	const out = [...forcedFiles];
+	for (const walkedFile of walkedFiles) {
+		if (out.length >= opts.maxFiles) break;
+		const resolved = path.resolve(walkedFile);
+		if (seen.has(resolved)) continue;
+		out.push(walkedFile);
+		seen.add(resolved);
+	}
+	return out;
+}
+async function readScannableSource(filePath, maxFileBytes) {
+	let st = null;
+	try {
+		st = await fs$1.stat(filePath);
+	} catch (err) {
+		if (hasErrnoCode(err, "ENOENT")) return null;
+		throw err;
+	}
+	if (!st?.isFile() || st.size > maxFileBytes) return null;
+	try {
+		return await fs$1.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (hasErrnoCode(err, "ENOENT")) return null;
+		throw err;
+	}
+}
+async function scanDirectoryWithSummary(dirPath, opts) {
+	const scanOptions = normalizeScanOptions(opts);
+	const files = await collectScannableFiles(dirPath, scanOptions);
+	const allFindings = [];
+	let scannedFiles = 0;
+	for (const file of files) {
+		const source = await readScannableSource(file, scanOptions.maxFileBytes);
+		if (source == null) continue;
+		scannedFiles += 1;
+		const findings = scanSource(source, file);
+		allFindings.push(...findings);
+	}
+	return {
+		scannedFiles,
+		critical: allFindings.filter((f) => f.severity === "critical").length,
+		warn: allFindings.filter((f) => f.severity === "warn").length,
+		info: allFindings.filter((f) => f.severity === "info").length,
+		findings: allFindings
+	};
+}
 
 //#endregion
 //#region src/project.ts
@@ -1736,6 +2532,7 @@ function loadPluginManifest(rootDir) {
 		manifestPath
 	};
 	const enabledByDefault = raw.enabledByDefault === true;
+	const runtimeOnly = raw.runtimeOnly === true;
 	const legacyPluginIds = normalizeStringList(raw.legacyPluginIds);
 	const autoEnableWhenConfiguredProviders = normalizeStringList(raw.autoEnableWhenConfiguredProviders);
 	const kind = typeof raw.kind === "string" ? raw.kind : void 0;
@@ -1758,6 +2555,7 @@ function loadPluginManifest(rootDir) {
 		manifest: {
 			id,
 			configSchema,
+			...runtimeOnly ? { runtimeOnly: true } : {},
 			...enabledByDefault ? { enabledByDefault } : {},
 			...legacyPluginIds.length > 0 ? { legacyPluginIds } : {},
 			...autoEnableWhenConfiguredProviders.length > 0 ? { autoEnableWhenConfiguredProviders } : {},
@@ -1790,14 +2588,120 @@ function getPackageManifestMetadata(manifest) {
 	return manifest[MANIFEST_KEY];
 }
 
+//#endregion
+//#region src/plugins/package-extensions.ts
+function normalizeEntry(entry) {
+	if (typeof entry !== "string") return null;
+	const trimmed = entry.trim();
+	if (!trimmed || path.isAbsolute(trimmed)) return null;
+	const normalized = trimmed.replace(/^\.\/+/, "");
+	if (!normalized || normalized === "." || normalized === "..") return null;
+	return normalized;
+}
+async function inferExtensionsFromLegacyPluginManifest(params) {
+	if (!params.pluginManifest) return [];
+	const packageDir = path.resolve(params.packageDir);
+	const candidates = [
+		params.manifest.main,
+		params.manifest.module,
+		...DEFAULT_PLUGIN_ENTRY_CANDIDATES
+	];
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	for (const candidate of candidates) {
+		const normalized = normalizeEntry(candidate);
+		if (!normalized || seen.has(normalized)) continue;
+		seen.add(normalized);
+		const resolved = path.resolve(packageDir, normalized);
+		if (!isPathInside$1(packageDir, resolved)) continue;
+		if (await fileExists(resolved)) entries.push(normalized);
+	}
+	return entries;
+}
+async function resolvePluginPackageExtensions(params) {
+	let manifestKey = null;
+	let extensions = params.manifest[MANIFEST_KEY]?.extensions;
+	if (Array.isArray(extensions)) manifestKey = MANIFEST_KEY;
+	if (Array.isArray(extensions)) {
+		const list = extensions.map((e) => typeof e === "string" ? e.trim() : "").filter(Boolean);
+		if (list.length === 0) throw new Error(`package.json ${manifestKey ?? MANIFEST_KEY}.extensions is empty`);
+		return {
+			extensions: list,
+			source: "fased"
+		};
+	}
+	const inferred = await inferExtensionsFromLegacyPluginManifest(params);
+	if (inferred.length > 0) return {
+		extensions: inferred,
+		source: "legacy-plugin-manifest"
+	};
+	throw new Error(`package.json missing ${MANIFEST_KEY}.extensions`);
+}
+
 //#endregion
 //#region src/plugins/install.ts
+function normalizeExpectedPluginIds(params) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of [params.expectedPluginId, ...params.expectedPluginIds ?? []]) {
+		const trimmed = typeof raw === "string" ? raw.trim() : "";
+		if (!trimmed) continue;
+		ids.add(unscopedPackageName(trimmed));
+	}
+	return [...ids].toSorted((left, right) => left.localeCompare(right));
+}
+const defaultLogger = {};
 function validatePluginId(pluginId) {
 	if (!pluginId) return "invalid plugin name: missing";
 	if (pluginId === "." || pluginId === "..") return "invalid plugin name: reserved path segment";
 	if (pluginId.includes("/") || pluginId.includes("\\")) return "invalid plugin name: path separators not allowed";
 	return null;
 }
+function countManifestEntries(value) {
+	return Object.keys(value ?? {}).length;
+}
+function listManifestKeys(value) {
+	return Object.keys(value ?? {}).map((entry) => entry.trim()).filter(Boolean).toSorted((left, right) => left.localeCompare(right));
+}
+function isTypeScriptExtensionEntry(entry) {
+	const ext = path.extname(entry.trim()).toLowerCase();
+	return ext === ".ts" || ext === ".tsx" || ext === ".mts" || ext === ".cts";
+}
+function buildRuntimeWarnings(extensions) {
+	const sourceEntries = extensions.map((entry) => entry.trim()).filter(Boolean).filter(isTypeScriptExtensionEntry).toSorted((left, right) => left.localeCompare(right));
+	if (sourceEntries.length === 0) return [];
+	return [`package exposes TypeScript extension ${sourceEntries.length === 1 ? "entry" : "entries"} (${sourceEntries.join(", ")}); publish compiled JavaScript runtime output before enabling this plugin`];
+}
+function buildInstallPackageReview(params) {
+	const dependencyKinds = [];
+	const dependencyCount = countManifestEntries(params.manifest.dependencies);
+	const optionalDependencyCount = countManifestEntries(params.manifest.optionalDependencies);
+	const peerDependencyCount = countManifestEntries(params.manifest.peerDependencies);
+	const totalDependencyCount = dependencyCount + optionalDependencyCount + peerDependencyCount;
+	if (dependencyCount > 0) dependencyKinds.push(`dependencies:${dependencyCount}`);
+	if (optionalDependencyCount > 0) dependencyKinds.push(`optionalDependencies:${optionalDependencyCount}`);
+	if (peerDependencyCount > 0) dependencyKinds.push(`peerDependencies:${peerDependencyCount}`);
+	const scriptNames = listManifestKeys(params.manifest.scripts);
+	const dependencyWarnings = totalDependencyCount > 0 ? [`package declares ${totalDependencyCount} dependenc${totalDependencyCount === 1 ? "y" : "ies"}; Fased installs runtime dependencies with npm --ignore-scripts`] : [];
+	const scriptWarnings = scriptNames.length > 0 ? [`package declares npm scripts (${scriptNames.join(", ")}); Fased pack/install paths use --ignore-scripts`] : [];
+	const runtimeWarnings = buildRuntimeWarnings(params.extensions);
+	return {
+		pluginId: params.pluginId,
+		packageName: params.manifest.name || void 0,
+		version: params.manifest.version || void 0,
+		extensions: params.extensions,
+		kind: params.pluginManifest?.kind,
+		channels: params.pluginManifest?.channels ?? [],
+		providers: params.pluginManifest?.providers ?? [],
+		skills: params.pluginManifest?.skills ?? [],
+		tools: params.pluginManifest?.contracts?.tools ?? [],
+		dependencyCount: totalDependencyCount,
+		dependencyKinds,
+		scriptNames,
+		dependencyWarnings,
+		scriptWarnings,
+		runtimeWarnings
+	};
+}
 function resolvePluginInstallDir(pluginId, extensionsDir) {
 	const extensionsBase = extensionsDir ? resolveUserPath(extensionsDir) : path.join(CONFIG_DIR, "extensions");
 	const pluginIdError = validatePluginId(pluginId);
@@ -1810,6 +2714,197 @@ function resolvePluginInstallDir(pluginId, extensionsDir) {
 	if (!targetDirResult.ok) throw new Error(targetDirResult.error);
 	return targetDirResult.path;
 }
+async function installPluginFromPackageDir(params) {
+	const { logger, timeoutMs, mode, dryRun } = resolveTimedInstallModeOptions(params, defaultLogger);
+	const manifestPath = path.join(params.packageDir, "package.json");
+	if (!await fileExists(manifestPath)) return {
+		ok: false,
+		error: "extracted package missing package.json"
+	};
+	let manifest;
+	try {
+		manifest = await readJsonFile(manifestPath);
+	} catch (err) {
+		return {
+			ok: false,
+			error: `invalid package.json: ${String(err)}`
+		};
+	}
+	const pkgName = typeof manifest.name === "string" ? manifest.name : "";
+	const npmPluginId = pkgName ? unscopedPackageName(pkgName) : "plugin";
+	const pluginManifestResult = loadPluginManifest(params.packageDir);
+	const manifestPlugin = pluginManifestResult.ok && pluginManifestResult.manifest.id ? pluginManifestResult.manifest : void 0;
+	const manifestPluginId = pluginManifestResult.ok && pluginManifestResult.manifest.id ? unscopedPackageName(pluginManifestResult.manifest.id) : void 0;
+	let extensions;
+	try {
+		const resolvedExtensions = await resolvePluginPackageExtensions({
+			manifest,
+			packageDir: params.packageDir,
+			pluginManifest: manifestPlugin
+		});
+		extensions = resolvedExtensions.extensions;
+		if (resolvedExtensions.source === "legacy-plugin-manifest") logger.info?.(`Plugin "${manifestPlugin?.id ?? npmPluginId}" uses legacy plugin manifest entry inference; prefer package.json fased.extensions for new packages.`);
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+	const pluginId = manifestPluginId ?? npmPluginId;
+	const pluginIdError = validatePluginId(pluginId);
+	if (pluginIdError) return {
+		ok: false,
+		error: pluginIdError
+	};
+	const expectedPluginIds = normalizeExpectedPluginIds(params);
+	if (expectedPluginIds.length > 0 && !expectedPluginIds.includes(pluginId)) return {
+		ok: false,
+		error: `plugin id mismatch: expected ${expectedPluginIds.join(" or ")}, got ${pluginId}`
+	};
+	if (manifestPluginId && manifestPluginId !== npmPluginId) logger.info?.(`Plugin manifest id "${manifestPluginId}" differs from npm package name "${npmPluginId}"; using manifest id as the config key.`);
+	const packageDir = path.resolve(params.packageDir);
+	const forcedScanEntries = [];
+	for (const entry of extensions) {
+		const resolvedEntry = path.resolve(packageDir, entry);
+		if (!isPathInside$1(packageDir, resolvedEntry)) {
+			logger.warn?.(`extension entry escapes plugin directory and will not be scanned: ${entry}`);
+			continue;
+		}
+		if (extensionUsesSkippedScannerPath(entry)) logger.warn?.(`extension entry is in a hidden/node_modules path and will receive targeted scan coverage: ${entry}`);
+		forcedScanEntries.push(resolvedEntry);
+	}
+	try {
+		const scanSummary = await scanDirectoryWithSummary(params.packageDir, { includeFiles: forcedScanEntries });
+		if (scanSummary.critical > 0) {
+			const criticalDetails = scanSummary.findings.filter((f) => f.severity === "critical").map((f) => `${f.message} (${f.file}:${f.line})`).join("; ");
+			logger.warn?.(`WARNING: Plugin "${pluginId}" contains dangerous code patterns: ${criticalDetails}`);
+		} else if (scanSummary.warn > 0) logger.warn?.(`Plugin "${pluginId}" has ${scanSummary.warn} suspicious code pattern(s). Run "fased security audit --deep" for details.`);
+	} catch (err) {
+		logger.warn?.(`Plugin "${pluginId}" code safety scan failed (${String(err)}). Installation continues; run "fased security audit --deep" after install.`);
+	}
+	const extensionsDir = params.extensionsDir ? resolveUserPath(params.extensionsDir) : path.join(CONFIG_DIR, "extensions");
+	await fs$1.mkdir(extensionsDir, { recursive: true });
+	const targetDirResult = resolveSafeInstallDir({
+		baseDir: extensionsDir,
+		id: pluginId,
+		invalidNameMessage: "invalid plugin name: path traversal detected"
+	});
+	if (!targetDirResult.ok) return {
+		ok: false,
+		error: targetDirResult.error
+	};
+	const targetDir = targetDirResult.path;
+	if (mode === "install" && await fileExists(targetDir)) return {
+		ok: false,
+		error: `plugin already exists: ${targetDir} (delete it first)`
+	};
+	if (dryRun) return {
+		ok: true,
+		pluginId,
+		targetDir,
+		manifestName: pkgName || void 0,
+		version: typeof manifest.version === "string" ? manifest.version : void 0,
+		extensions,
+		review: buildInstallPackageReview({
+			pluginId,
+			manifest,
+			extensions,
+			pluginManifest: manifestPlugin
+		})
+	};
+	const hasDeps = Boolean(manifest.dependencies && Object.keys(manifest.dependencies).length > 0 || manifest.optionalDependencies && Object.keys(manifest.optionalDependencies).length > 0);
+	const installRes = await installPackageDir({
+		sourceDir: params.packageDir,
+		targetDir,
+		mode,
+		timeoutMs,
+		logger,
+		copyErrorPrefix: "failed to copy plugin",
+		hasDeps,
+		depsLogMessage: "Installing plugin dependencies…",
+		afterCopy: async () => {
+			for (const entry of extensions) {
+				const resolvedEntry = path.resolve(targetDir, entry);
+				if (!isPathInside$1(targetDir, resolvedEntry)) {
+					logger.warn?.(`extension entry escapes plugin directory: ${entry}`);
+					continue;
+				}
+				if (!await fileExists(resolvedEntry)) logger.warn?.(`extension entry not found: ${entry}`);
+			}
+		}
+	});
+	if (!installRes.ok) return installRes;
+	return {
+		ok: true,
+		pluginId,
+		targetDir,
+		manifestName: pkgName || void 0,
+		version: typeof manifest.version === "string" ? manifest.version : void 0,
+		extensions,
+		review: buildInstallPackageReview({
+			pluginId,
+			manifest,
+			extensions,
+			pluginManifest: manifestPlugin
+		})
+	};
+}
+async function installPluginFromArchive(params) {
+	const logger = params.logger ?? defaultLogger;
+	const timeoutMs = params.timeoutMs ?? 12e4;
+	const mode = params.mode ?? "install";
+	const archivePathResult = await resolveArchiveSourcePath(params.archivePath);
+	if (!archivePathResult.ok) return archivePathResult;
+	const archivePath = archivePathResult.path;
+	return await withExtractedArchiveRoot({
+		archivePath,
+		tempDirPrefix: "fased-plugin-",
+		timeoutMs,
+		logger,
+		onExtracted: async (packageDir) => await installPluginFromPackageDir({
+			packageDir,
+			extensionsDir: params.extensionsDir,
+			timeoutMs,
+			logger,
+			mode,
+			dryRun: params.dryRun,
+			expectedPluginId: params.expectedPluginId,
+			expectedPluginIds: params.expectedPluginIds
+		})
+	});
+}
+async function installPluginFromNpmSpec(params) {
+	const { logger, timeoutMs, mode, dryRun } = resolveTimedInstallModeOptions(params, defaultLogger);
+	const expectedPluginId = params.expectedPluginId;
+	const expectedPluginIds = params.expectedPluginIds;
+	const spec = params.spec.trim();
+	const specError = validateRegistryNpmSpec(spec);
+	if (specError) return {
+		ok: false,
+		error: specError
+	};
+	logger.info?.(`Downloading ${spec}…`);
+	return finalizeNpmSpecArchiveInstall(await installFromNpmSpecArchiveWithInstaller({
+		tempDirPrefix: "fased-npm-pack-",
+		spec,
+		timeoutMs,
+		expectedIntegrity: params.expectedIntegrity,
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: (message) => {
+			logger.warn?.(message);
+		},
+		installFromArchive: installPluginFromArchive,
+		archiveInstallParams: {
+			extensionsDir: params.extensionsDir,
+			timeoutMs,
+			logger,
+			mode,
+			dryRun,
+			expectedPluginId,
+			expectedPluginIds
+		}
+	}));
+}
 
 //#endregion
 //#region src/plugins/uninstall.ts
@@ -2036,6 +3131,7 @@ const MAX_THINKING_LEVELS = [
 	"xhigh",
 	"max"
 ];
+const ULTRA_THINKING_LEVELS = [...MAX_THINKING_LEVELS, "ultra"];
 const XHIGH_MODEL_REFS = [
 	"openai/gpt-5.6",
 	"openai/gpt-5.6-terra",
@@ -2088,6 +3184,7 @@ function normalizeThinkLevel(raw) {
 	const collapsed = key.replace(/[\s_-]+/g, "");
 	if (collapsed === "xhigh" || collapsed === "extrahigh") return "xhigh";
 	if (key === "max") return "max";
+	if (key === "ultra") return "ultra";
 	if (key === "off") return "off";
 	if ([
 		"on",
@@ -2111,7 +3208,6 @@ function normalizeThinkLevel(raw) {
 	].includes(key)) return "medium";
 	if ([
 		"high",
-		"ultra",
 		"ultrathink",
 		"think-hard",
 		"thinkhardest",
@@ -2145,6 +3241,9 @@ function normalizeThinkingLevels(values) {
 	return levels;
 }
 function listGenericThinkingLevels(provider, model) {
+	const normalizedProvider = normalizeProviderId$2(provider);
+	const normalizedModel = model?.trim().toLowerCase();
+	if (normalizedProvider === "openai-codex" && (normalizedModel === "gpt-5.6-sol" || normalizedModel === "gpt-5.6-terra")) return [...ULTRA_THINKING_LEVELS];
 	if (supportsMaxThinking(provider, model)) return [...MAX_THINKING_LEVELS];
 	return supportsXHighThinking(provider, model) ? [...XHIGH_THINKING_LEVELS] : [...BASE_THINKING_LEVELS];
 }
@@ -2229,6 +3328,9 @@ function listThinkingLevels(provider, model) {
 function listThinkingLevelLabels(provider, model) {
 	return listThinkingLevels(provider, model);
 }
+function supportsThinkingLevel(provider, model, level) {
+	return listThinkingLevels(provider, model).includes(level);
+}
 function formatThinkingLevels(provider, model, separator = ", ") {
 	return listThinkingLevelLabels(provider, model).join(separator);
 }
@@ -4244,6 +5346,7 @@ function buildXiaomiModelCapabilityOverrides(routeId = "xiaomi") {
 
 //#endregion
 //#region src/providers/litellm-models.ts
+const LITELLM_BASE_URL = "http://localhost:4000/v1";
 const LITELLM_DEFAULT_MODEL_ID = "default";
 const LITELLM_DEFAULT_MODEL_REF = `litellm/${LITELLM_DEFAULT_MODEL_ID}`;
 const LITELLM_DEFAULT_COST = {
@@ -5009,7 +6112,7 @@ const OPENAI_PROVIDER_MANIFEST = {
 		id: "openai-codex",
 		route: OPENAI_CODEX_ROUTE_ID,
 		kind: "oauth",
-		label: "Sign in",
+		label: "ChatGPT sign-in",
 		hint: "Open the OpenAI sign-in URL, finish login in the browser, then Fased completes the OAuth flow."
 	}, {
 		id: "openai-api-key",
@@ -5780,9 +6883,6 @@ function getProviderBrandManifestForRoute(route) {
 function isOpenAISignInRuntimeModelSupported(id) {
 	return OPENAI_SIGN_IN_RUNTIME_MODEL_ID_SET.has(id.trim().toLowerCase());
 }
-function isOpenAISignInCatalogModel(id) {
-	return OPENAI_SIGN_IN_MODEL_ID_SET.has(id.trim().toLowerCase());
-}
 function lookupProviderManifestModelCapability(provider, model) {
 	const providerId = provider.trim().toLowerCase();
 	const modelId = model.trim().toLowerCase();
@@ -6563,6 +7663,13 @@ const PLUGIN_ORIGIN_RANK = {
 const registryCache = /* @__PURE__ */ new Map();
 const DEFAULT_MANIFEST_CACHE_MS = 200;
 const LEGACY_REMOVED_PLUGIN_IDS$2 = /* @__PURE__ */ new Set();
+function isRuntimeOnlyComponent(params) {
+	if (params.manifest.runtimeOnly === true) return true;
+	return params.manifest.id === "openai-runtime" && params.candidate.packageName === "@fased/openai-runtime";
+}
+function clearPluginManifestRegistryCache() {
+	registryCache.clear();
+}
 function resolveManifestCacheMs(env) {
 	const raw = env.FASED_PLUGIN_MANIFEST_CACHE_MS?.trim();
 	if (raw === "" || raw === "0") return 0;
@@ -6620,6 +7727,7 @@ function buildRecord(params) {
 	});
 	return {
 		id: params.manifest.id,
+		runtimeOnly: isRuntimeOnlyComponent(params) ? true : void 0,
 		name: normalizeManifestLabel(params.manifest.name) ?? params.candidate.packageName,
 		description: normalizeManifestLabel(params.manifest.description) ?? params.candidate.packageDescription,
 		version: normalizeManifestLabel(params.manifest.version) ?? params.candidate.packageVersion,
@@ -6734,6 +7842,25 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			if (isRuntimeOnlyComponent({
+				manifest,
+				candidate
+			}) && records[existing.recordIndex]?.runtimeOnly === true) {
+				if (PLUGIN_ORIGIN_RANK[candidate.origin] < PLUGIN_ORIGIN_RANK[existing.candidate.origin]) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,
@@ -11115,7 +12242,8 @@ const OPENAI_CODEX_MODELS = [
 		input: ["text", "image"],
 		contextWindow: 105e4,
 		maxTokens: 128e3,
-		api: "openai-codex-responses"
+		api: "openai-codex-responses",
+		compat: { responsesLite: true }
 	}),
 	model({
 		id: "gpt-5.6-terra",
@@ -11124,7 +12252,8 @@ const OPENAI_CODEX_MODELS = [
 		input: ["text", "image"],
 		contextWindow: 105e4,
 		maxTokens: 128e3,
-		api: "openai-codex-responses"
+		api: "openai-codex-responses",
+		compat: { responsesLite: true }
 	}),
 	model({
 		id: "gpt-5.6-luna",
@@ -11133,7 +12262,8 @@ const OPENAI_CODEX_MODELS = [
 		input: ["text", "image"],
 		contextWindow: 105e4,
 		maxTokens: 128e3,
-		api: "openai-codex-responses"
+		api: "openai-codex-responses",
+		compat: { responsesLite: true }
 	}),
 	model({
 		id: "gpt-5.5",
@@ -18095,7 +19225,8 @@ const ModelCapabilitySchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	])).optional(),
 	defaultThinkingLevel: z.union([
 		z.literal("off"),
@@ -18104,7 +19235,8 @@ const ModelCapabilitySchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	]).optional(),
 	thinkingMode: z.union([
 		z.literal("openai-reasoning-effort"),
@@ -19020,7 +20152,8 @@ const AgentEntrySchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	]).optional(),
 	reasoningDefault: z.union([
 		z.literal("off"),
@@ -19029,7 +20162,8 @@ const AgentEntrySchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	]).optional(),
 	fastModeDefault: z.boolean().optional(),
 	skills: z.array(z.string()).optional(),
@@ -19180,7 +20314,8 @@ const AgentDefaultsSchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	]).optional(),
 	reasoningDefault: z.union([
 		z.literal("off"),
@@ -19189,7 +20324,8 @@ const AgentDefaultsSchema = z.object({
 		z.literal("medium"),
 		z.literal("high"),
 		z.literal("xhigh"),
-		z.literal("max")
+		z.literal("max"),
+		z.literal("ultra")
 	]).optional(),
 	fastModeDefault: z.boolean().optional(),
 	verboseDefault: z.union([
@@ -23405,4 +24541,4 @@ async function writeConfigFile(cfg, options = {}) {
 }
 
 //#endregion
-export { resetConfigOverrides as $, isOpenAISignInRuntimeModelSupported as $n, resolveSubagentSpawnModelSelection as $t, GroupPolicySchema as A, markAuthProfileGood as An, resolveCliName as Ar, isSafeExecutableValue as At, MODEL_APIS as B, normalizeProviderId$1 as Bn, buildModelAliasIndex as Bt, resolveIMessageAttachmentRoots as C, markAuthProfileFailure as Cn, resolveShellEnvFallbackTimeoutMs as Cr, unwrapKnownDispatchWrapperInvocation as Ct, BlockStreamingCoalesceSchema as D, dedupeProfileIds as Dn, sanitizeHostExecEnv as Dr, normalizeSafeBinProfileFixtures as Dt, ToolPolicySchema as E, resolveApiKeyForProfile as En, isDangerousHostInheritedEnvVarName as Er, SAFE_BIN_PROFILES as Et, TtsConfigSchema as F, acquireFileLock as Fn, normalizePluginsConfig as Fr, resolveTelegramPreviewStreamMode as Ft, isAvatarDataUrl as G, resolveAuthProfileDisplayLabel as Gn, normalizeModelRef as Gt, parseDurationMs as H, discoverFasedAgentPlugins as Hn, inferUniqueProviderFromConfiguredModels as Ht, TtsModeSchema as I, withFileLock as In, resolveEffectiveEnableState as Ir, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as It, isSupportedLocalAvatarExtension as J, assertSecretInputResolved as Jn, resolveConfiguredModelRef as Jt, isAvatarHttpUrl as K, isPrivateNetworkBaseUrl as Kn, normalizeProviderId as Kt, TtsProviderSchema as L, resolveProcessScopedMap as Ln, resolveMemorySlotDecision as Lr, resolveAgentMaxConcurrent as Lt, MarkdownTableModeSchema as M, resolveAuthStorePathForDisplay as Mn, parseBooleanValue as Mr, resolveDiscordPreviewStreamMode as Mt, ReplyRuntimeConfigSchemaShape as N, resolveFasedAgentAgentDir as Nn, applyTestPluginDefaults as Nr, resolveSlackNativeStreaming as Nt, DmConfigSchema as O, listProfilesForProvider as On, resolveOwnerDisplaySetting as Or, resolveSafeBinProfiles as Ot, TtsAutoSchema as P, resolveFasedAgentDir as Pn, isPluginRuntimeSessionReadAllowed as Pr, resolveSlackStreamingMode as Pt, getConfigOverrides as Q, isOpenAISignInCatalogModel as Qn, resolveReasoningDefault as Qt, normalizeAllowFrom as R, isPidAlive as Rn, resolvePluginAdminRpcActionGrant as Rr, buildAllowedModelSet as Rt, mergeInboundPathRoots as S, isProfileInCooldown as Sn, getShellPathFromLoginShell as Sr, isShellWrapperExecutable as St, normalizeScpRemoteHost as T, resolveProfilesUnavailableReason as Tn, isDangerousHostEnvVarName as Tr, splitShellArgs as Tt, parseByteSize as U, isPathInside as Un, isCliProvider as Ut, getBlockedNetworkModeReason as V, loadPluginManifestRegistry as Vn, findNormalizedProviderValue as Vt, AVATAR_MAX_BYTES as W, safeStatSync as Wn, modelKey as Wt, resolveAvatarMime as X, splitTrailingAuthProfile as Xn, resolveExplicitConfiguredModelRef as Xt, isWorkspaceRelativeAvatarPath as Y, coerceSecretRef as Yn, resolveDefaultModelForAgent as Yt, validateJsonSchemaValue as Z, getProviderBrandManifestForRoute as Zn, resolveModelRefFromString as Zt, TELEGRAM_COMMAND_NAME_PATTERN as _, normalizeModelCatalogProviderId as _n, extractErrorCode as _r, matchAllowlist as _t, readConfigFileSnapshotForWrite as a, getApiKeyForModel as an, formatXHighModelHint as ar, unsetConfigValueAtPath as at, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS as b, resolveAuthProfileOrder as bn, isErrno as br, extractShellWrapperInlineCommand as bt, validateConfigObjectWithPlugins as c, resolveApiKeyForProvider as cn, resolveModelThinkingCapability as cr, isTrustedSafeBinPath as ct, GoogleChatConfigSchema as d, CURRENT_MODEL_PROVIDER_CATALOG as dn, DEFAULT_MODEL as dr, validateSafeBinArgv as dt, resolveThinkingDefault as en, isStandardProviderCatalogEntry as er, setConfigOverride as et, IMessageConfigSchema as f, cloneCurrentModelProvider as fn, DEFAULT_PROVIDER as fr, analyzeShellCommand as ft, TelegramConfigSchema as g, normalizeModelCatalogModelId as gn, MANIFEST_KEY as gr, DEFAULT_SAFE_BINS as gt, SlackConfigSchema as h, mergeModelCatalogRowsByAuthority as hn, getPackageManifestMetadata as hr, splitCommandChain as ht, readConfigFileSnapshot as i, resolveImplicitProviders as in, formatThinkingLevels as ir, setConfigValueAtPath as it, MarkdownConfigSchema as j, ensureAuthProfileStore as jn, isTruthyEnvValue as jr, mapStreamingModeToSlackLegacyDraftStreamMode as jt, DmPolicySchema as k, listProvidersWithStoredCredentials as kn, formatCliCommand as kr, applyMergePatch as kt, WhatsAppConfigSchema as l, resolveEnvApiKey as ln, supportsXHighThinking as lr, listWritableExplicitTrustedSafeBinDirs as lt, SignalConfigSchema as m, buildModelCatalogMergeKey as mn, resolvePluginInstallDir as mr, isWindowsPlatform as mt, loadConfig as n, normalizeProviders as nn, lookupProviderManifestModelCapability as nr, getConfigValueAtPath as nt, resolveConfigSnapshotHash as o, getCustomProviderApiKey as on, listThinkingLevels as or, ensurePluginAllowlisted as ot, MSTeamsConfigSchema as p, listCurrentModelCatalogRows as pn, VERSION as pr, buildEnforcedShellCommand as pt, isPathWithinRoot as q, normalizeSecretInput as qn, parseModelRef as qt, parseConfigJson5 as r, resolveImplicitCopilotProvider as rn, providerModelRecommendationRank as rr, parseConfigPath as rt, writeConfigFile as s, requireApiKey as sn, normalizeThinkLevel as sr, getTrustedSafeBinDirs as st, createConfigIO as t, normalizeGoogleModelId as tn, listProviderBrandManifests as tr, unsetConfigOverride as tt, DiscordConfigSchema as u, resolveModelAuthMode as un, DEFAULT_CONTEXT_TOKENS as ur, normalizeTrustedSafeBinDirs as ut, normalizeTelegramCommandName as v, normalizeProviderCatalogRows as vn, formatErrorMessage as vr, resolveAllowlistCandidatePath as vt, resolveIMessageRemoteAttachmentRoots as w, markAuthProfileUsed as wn, isDangerousHostEnvOverrideVarName as wr, unwrapKnownShellMultiplexerInvocation as wt, isInboundPathAllowed as x, getSoonestCooldownExpiry as xn, extractArchive as xr, isDispatchWrapperExecutable as xt, resolveTelegramCustomCommands as y, auth_profiles_exports as yn, formatUncaughtError as yr, resolveCommandResolutionFromArgv as yt, requireOpenAllowFrom as z, findNormalizedProviderValue$1 as zn, buildConfiguredAllowlistKeys as zt };
+export { resetConfigOverrides as $, DEFAULT_CONTEXT_TOKENS as $i, ANTHROPIC_PROVIDER_BRAND_ID as $n, QWEN_API_ROUTE_ID as $r, resolveSubagentSpawnModelSelection as $t, GroupPolicySchema as A, listProviderBrandManifests as Ai, markAuthProfileGood as An, MINIMAX_PORTAL_ROUTE_ID as Ar, isSafeExecutableValue as At, MODEL_APIS as B, OPENCODE_ZEN_MODEL_IDS as Bi, normalizeProviderId$1 as Bn, OPENAI_API_MODEL_IDS as Br, buildModelAliasIndex as Bt, resolveIMessageAttachmentRoots as C, applyTestPluginDefaults as Ca, XIAOMI_ROUTE_ID as Ci, markAuthProfileFailure as Cn, LITELLM_PROVIDER_BRAND_ID as Cr, unwrapKnownDispatchWrapperInvocation as Ct, BlockStreamingCoalesceSchema as D, resolveMemorySlotDecision as Da, getProviderBrandManifestForRoute as Di, dedupeProfileIds as Dn, MINIMAX_API_ROUTE_ID as Dr, normalizeSafeBinProfileFixtures as Dt, ToolPolicySchema as E, resolveEffectiveEnableState as Ea, ZAI_ROUTE_ID as Ei, resolveApiKeyForProfile as En, LMSTUDIO_ROUTE_ID as Er, SAFE_BIN_PROFILES as Et, TtsConfigSchema as F, XIAOMI_MODEL_IDS as Fi, acquireFileLock as Fn, MOONSHOT_MODEL_IDS as Fr, resolveTelegramPreviewStreamMode as Ft, isAvatarDataUrl as G, BASE_THINKING_LEVELS as Gi, safeStatSync as Gn, OPENCODE_ZEN_ROUTE_ID as Gr, normalizeModelRef as Gt, parseDurationMs as H, CLOUDFLARE_AI_GATEWAY_MODEL_IDS as Hi, loadPluginManifestRegistry as Hn, OPENAI_CODEX_ROUTE_ID as Hr, inferUniqueProviderFromConfiguredModels as Ht, TtsModeSchema as I, VERCEL_AI_GATEWAY_MODEL_IDS as Ii, withFileLock as In, MOONSHOT_PROVIDER_BRAND_ID as Ir, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as It, isSupportedLocalAvatarExtension as J, listThinkingLevels as Ji, normalizeSecretInput as Jn, OPENROUTER_ROUTE_ID as Jr, resolveConfiguredModelRef as Jt, isAvatarHttpUrl as K, formatThinkingLevels as Ki, resolveAuthProfileDisplayLabel as Kn, OPENROUTER_MODEL_IDS as Kr, normalizeProviderId as Kt, TtsProviderSchema as L, VENICE_MODEL_IDS as Li, resolveProcessScopedMap as Ln, MOONSHOT_ROUTE_ID as Lr, resolveAgentMaxConcurrent as Lt, MarkdownTableModeSchema as M, providerModelRecommendationRank as Mi, resolveAuthStorePathForDisplay as Mn, MISTRAL_MODEL_IDS as Mr, resolveDiscordPreviewStreamMode as Mt, ReplyRuntimeConfigSchemaShape as N, resolveProviderRouteModelCapability as Ni, resolveFasedAgentAgentDir as Nn, MISTRAL_PROVIDER_BRAND_ID as Nr, resolveSlackNativeStreaming as Nt, DmConfigSchema as O, resolvePluginAdminRpcActionGrant as Oa, isOpenAISignInRuntimeModelSupported as Oi, listProfilesForProvider as On, MINIMAX_CN_ROUTE_ID as Or, resolveSafeBinProfiles as Ot, TtsAutoSchema as P, LITELLM_BASE_URL as Pi, resolveFasedAgentDir as Pn, MISTRAL_ROUTE_ID as Pr, resolveSlackStreamingMode as Pt, getConfigOverrides as Q, supportsXHighThinking as Qi, ANTHROPIC_MODEL_IDS as Qn, QWEN_API_MODEL_IDS as Qr, resolveReasoningDefault as Qt, normalizeAllowFrom as R, TOGETHER_MODEL_IDS as Ri, isPidAlive as Rn, OLLAMA_PROVIDER_BRAND_ID as Rr, buildAllowedModelSet as Rt, mergeInboundPathRoots as S, parseBooleanValue as Sa, XIAOMI_PROVIDER_BRAND_ID as Si, isProfileInCooldown as Sn, KIMI_CODING_ROUTE_ID as Sr, isShellWrapperExecutable as St, normalizeScpRemoteHost as T, normalizePluginsConfig as Ta, ZAI_PROVIDER_BRAND_ID as Ti, resolveProfilesUnavailableReason as Tn, LMSTUDIO_PROVIDER_BRAND_ID as Tr, splitShellArgs as Tt, parseByteSize as U, CLOUDFLARE_AI_GATEWAY_PROVIDER_BRAND_ID as Ui, discoverFasedAgentPlugins as Un, OPENAI_PROVIDER_BRAND_ID as Ur, isCliProvider as Ut, getBlockedNetworkModeReason as V, HUGGINGFACE_MODEL_IDS as Vi, clearPluginManifestRegistryCache as Vn, OPENAI_API_ROUTE_ID as Vr, findNormalizedProviderValue as Vt, AVATAR_MAX_BYTES as W, CLOUDFLARE_AI_GATEWAY_ROUTE_ID as Wi, isPathInside as Wn, OPENCODE_ZEN_PROVIDER_BRAND_ID as Wr, modelKey as Wt, resolveAvatarMime as X, resolveModelThinkingCapability as Xi, coerceSecretRef as Xn, QIANFAN_PROVIDER_BRAND_ID as Xr, resolveExplicitConfiguredModelRef as Xt, isWorkspaceRelativeAvatarPath as Y, normalizeThinkLevel as Yi, assertSecretInputResolved as Yn, QIANFAN_MODEL_IDS as Yr, resolveDefaultModelForAgent as Yt, validateJsonSchemaValue as Z, supportsThinkingLevel as Zi, splitTrailingAuthProfile as Zn, QIANFAN_ROUTE_ID as Zr, resolveModelRefFromString as Zt, TELEGRAM_COMMAND_NAME_PATTERN as _, sanitizeHostExecEnv as _a, VOLCENGINE_PROVIDER_BRAND_ID as _i, normalizeModelCatalogProviderId as _n, GOOGLE_GEMINI_MODEL_IDS as _r, matchAllowlist as _t, readConfigFileSnapshotForWrite as a, getPackageManifestMetadata as aa, TOGETHER_PROVIDER_BRAND_ID as ai, getApiKeyForModel as an, BYTEPLUS_PROVIDER_BRAND_ID as ar, unsetConfigValueAtPath as at, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS as b, resolveCliName as ba, XAI_PROVIDER_BRAND_ID as bi, resolveAuthProfileOrder as bn, HUGGINGFACE_ROUTE_ID as br, extractShellWrapperInlineCommand as bt, validateConfigObjectWithPlugins as c, formatErrorMessage as ca, VENICE_ROUTE_ID as ci, resolveApiKeyForProvider as cn, CHUTES_PROVIDER_BRAND_ID as cr, isTrustedSafeBinPath as ct, GoogleChatConfigSchema as d, extractArchive as da, VLLM_PROVIDER_BRAND_ID as di, CURRENT_MODEL_PROVIDER_CATALOG as dn, COPILOT_PROXY_MODEL_IDS as dr, validateSafeBinArgv as dt, DEFAULT_MODEL as ea, QWEN_CODING_PLAN_MODEL_IDS as ei, resolveThinkingDefault as en, ANTHROPIC_ROUTE_ID as er, setConfigOverride as et, IMessageConfigSchema as f, getShellPathFromLoginShell as fa, VLLM_ROUTE_ID as fi, cloneCurrentModelProvider as fn, COPILOT_PROXY_ROUTE_ID as fr, analyzeShellCommand as ft, TelegramConfigSchema as g, isDangerousHostInheritedEnvVarName as ga, VOLCENGINE_PLAN_ROUTE_ID as gi, normalizeModelCatalogModelId as gn, GOOGLE_GEMINI_CLI_ROUTE_ID as gr, DEFAULT_SAFE_BINS as gt, SlackConfigSchema as h, isDangerousHostEnvVarName as ha, VOLCENGINE_MODEL_IDS as hi, mergeModelCatalogRowsByAuthority as hn, GOOGLE_API_ROUTE_ID as hr, splitCommandChain as ht, readConfigFileSnapshot as i, resolvePluginInstallDir as ia, SYNTHETIC_ROUTE_ID as ii, resolveImplicitProviders as in, BYTEPLUS_PLAN_ROUTE_ID as ir, setConfigValueAtPath as it, MarkdownConfigSchema as j, lookupProviderManifestModelCapability as ji, ensureAuthProfileStore as jn, MINIMAX_PROVIDER_BRAND_ID as jr, mapStreamingModeToSlackLegacyDraftStreamMode as jt, DmPolicySchema as k, applyExclusiveSlotSelection as ka, isStandardProviderCatalogEntry as ki, listProvidersWithStoredCredentials as kn, MINIMAX_MODEL_IDS as kr, applyMergePatch as kt, WhatsAppConfigSchema as l, formatUncaughtError as la, VERCEL_AI_GATEWAY_PROVIDER_BRAND_ID as li, resolveEnvApiKey as ln, CHUTES_ROUTE_ID as lr, listWritableExplicitTrustedSafeBinDirs as lt, SignalConfigSchema as m, isDangerousHostEnvOverrideVarName as ma, VOLCENGINE_CODING_ROUTE_ID as mi, buildModelCatalogMergeKey as mn, CUSTOM_PROVIDER_ROUTE_ID as mr, isWindowsPlatform as mt, loadConfig as n, VERSION as na, QWEN_PROVIDER_BRAND_ID as ni, normalizeProviders as nn, BYTEPLUS_CODING_ROUTE_ID as nr, getConfigValueAtPath as nt, resolveConfigSnapshotHash as o, MANIFEST_KEY as oa, TOGETHER_ROUTE_ID as oi, getCustomProviderApiKey as on, BYTEPLUS_ROUTE_ID as or, ensurePluginAllowlisted as ot, MSTeamsConfigSchema as p, resolveShellEnvFallbackTimeoutMs as pa, VOLCENGINE_CODING_MODEL_IDS as pi, listCurrentModelCatalogRows as pn, CUSTOM_PROVIDER_BRAND_ID as pr, buildEnforcedShellCommand as pt, isPathWithinRoot as q, formatXHighModelHint as qi, isPrivateNetworkBaseUrl as qn, OPENROUTER_PROVIDER_BRAND_ID as qr, parseModelRef as qt, parseConfigJson5 as r, installPluginFromNpmSpec as ra, SYNTHETIC_PROVIDER_BRAND_ID as ri, resolveImplicitCopilotProvider as rn, BYTEPLUS_MODEL_IDS as rr, parseConfigPath as rt, writeConfigFile as s, extractErrorCode as sa, VENICE_PROVIDER_BRAND_ID as si, requireApiKey as sn, CHUTES_MODEL_IDS as sr, getTrustedSafeBinDirs as st, createConfigIO as t, DEFAULT_PROVIDER as ta, QWEN_CODING_PLAN_ROUTE_ID as ti, normalizeGoogleModelId as tn, BYTEPLUS_CODING_MODEL_IDS as tr, unsetConfigOverride as tt, DiscordConfigSchema as u, isErrno as ua, VERCEL_AI_GATEWAY_ROUTE_ID as ui, resolveModelAuthMode as un, COPILOT_PROVIDER_BRAND_ID as ur, normalizeTrustedSafeBinDirs as ut, normalizeTelegramCommandName as v, resolveOwnerDisplaySetting as va, VOLCENGINE_ROUTE_ID as vi, normalizeProviderCatalogRows as vn, GOOGLE_PROVIDER_BRAND_ID as vr, resolveAllowlistCandidatePath as vt, resolveIMessageRemoteAttachmentRoots as w, isPluginRuntimeSessionReadAllowed as wa, ZAI_MODEL_IDS as wi, markAuthProfileUsed as wn, LITELLM_ROUTE_ID as wr, unwrapKnownShellMultiplexerInvocation as wt, isInboundPathAllowed as x, isTruthyEnvValue as xa, XAI_ROUTE_ID as xi, getSoonestCooldownExpiry as xn, KIMI_CODING_MODEL_IDS as xr, isDispatchWrapperExecutable as xt, resolveTelegramCustomCommands as y, formatCliCommand as ya, XAI_MODEL_IDS as yi, auth_profiles_exports as yn, HUGGINGFACE_PROVIDER_BRAND_ID as yr, resolveCommandResolutionFromArgv as yt, requireOpenAllowFrom as z, SYNTHETIC_MODEL_IDS as zi, findNormalizedProviderValue$1 as zn, OLLAMA_ROUTE_ID as zr, buildConfiguredAllowlistKeys as zt };