@fased/fased 0.1.56 → 0.1.58

package/dist/plugin-sdk/{config-Bt5GhnA-.js → config-DrhYEiCM.js}

@@ -2,9 +2,9 @@ import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { c as CHANNEL_IDS, f as normalizeChatChannelId, t as createSubsystemLogger, u as CORE_RUNTIME_CHANNEL_IDS } from "./subsystem-DBPNbQDQ.js";
 import { c as expandHomePrefix, n as resolveConfigPath, o as resolveOAuthPath, r as resolveDefaultConfigCandidates, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
 import { C as isPlainObject$2, c as isRecord$3, h as resolveUserPath, p as resolveConfigDir, t as CONFIG_DIR } from "./utils-CYk9EKoq.js";
-import { A as openBoundaryFileSync, B as MAX_AGENT_MODEL_FALLBACKS, D as resolveFasedAgentPackageRootSync, F as isNotFoundPathError, H as resolveAgentModelPrimaryValue, I as isPathInside$2, L as isSymlinkOpenError, O as canUseBoundaryFileOpen, U as toAgentModelListLike, V as resolveAgentModelFallbackValues, i as resolveAgentConfig, l as resolveAgentWorkspaceDir, o as resolveAgentEffectiveModelPrimary, u as resolveDefaultAgentId } from "./agent-scope-BbgPlhtw.js";
+import { H as resolveAgentModelFallbackValues, I as isNotFoundPathError, L as isPathInside$2, O as resolveFasedAgentPackageRootSync, R as isSymlinkOpenError, U as resolveAgentModelPrimaryValue, V as MAX_AGENT_MODEL_FALLBACKS, W as toAgentModelListLike, i as resolveAgentConfig, j as openBoundaryFileSync, k as canUseBoundaryFileOpen, l as resolveAgentWorkspaceDir, o as resolveAgentEffectiveModelPrimary, u as resolveDefaultAgentId } from "./agent-scope-CCjfjKoO.js";
 import { h as isBlockedObjectKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID } from "./session-key-HSJ2KQTc.js";
-import { n as runExec } from "./exec-DQ8j4Fm3.js";
+import { n as runExec, t as runCommandWithTimeout } from "./exec-DQ8j4Fm3.js";
 import { n as redactSensitiveText } from "./redact-Bm8vu_ju.js";
 import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-CUK__1s1.js";
 import { t as runTasksWithConcurrency } from "./run-with-concurrency-BsDJWzgM.js";
@@ -31,10 +31,64 @@ import AjvPkg from "ajv";
 import { z } from "zod";
 
 //#region src/plugins/slots.ts
+const SLOT_BY_KIND = { memory: "memory" };
 const DEFAULT_SLOT_BY_KEY = { memory: "memory-core" };
+function slotKeyForPluginKind(kind) {
+	if (!kind) return null;
+	return SLOT_BY_KIND[kind] ?? null;
+}
 function defaultSlotIdForKey(slotKey) {
 	return DEFAULT_SLOT_BY_KEY[slotKey];
 }
+function applyExclusiveSlotSelection(params) {
+	const slotKey = slotKeyForPluginKind(params.selectedKind);
+	if (!slotKey) return {
+		config: params.config,
+		warnings: [],
+		changed: false
+	};
+	const warnings = [];
+	const pluginsConfig = params.config.plugins ?? {};
+	const prevSlot = pluginsConfig.slots?.[slotKey];
+	const slots = {
+		...pluginsConfig.slots,
+		[slotKey]: params.selectedId
+	};
+	const inferredPrevSlot = prevSlot ?? defaultSlotIdForKey(slotKey);
+	if (inferredPrevSlot && inferredPrevSlot !== params.selectedId) warnings.push(`Exclusive slot "${slotKey}" switched from "${inferredPrevSlot}" to "${params.selectedId}".`);
+	const entries = { ...pluginsConfig.entries };
+	const disabledIds = [];
+	if (params.registry) for (const plugin of params.registry.plugins) {
+		if (plugin.id === params.selectedId) continue;
+		if (plugin.kind !== params.selectedKind) continue;
+		const entry = entries[plugin.id];
+		if (!entry || entry.enabled !== false) {
+			entries[plugin.id] = {
+				...entry,
+				enabled: false
+			};
+			disabledIds.push(plugin.id);
+		}
+	}
+	if (disabledIds.length > 0) warnings.push(`Disabled other "${slotKey}" slot plugins: ${disabledIds.toSorted().join(", ")}.`);
+	if (!(prevSlot !== params.selectedId || disabledIds.length > 0)) return {
+		config: params.config,
+		warnings: [],
+		changed: false
+	};
+	return {
+		config: {
+			...params.config,
+			plugins: {
+				...pluginsConfig,
+				slots,
+				entries
+			}
+		},
+		warnings,
+		changed: true
+	};
+}
 
 //#endregion
 //#region src/plugins/config-state.ts
@@ -1216,6 +1270,17 @@ function resolveArchiveKind(filePath) {
 	if (TAR_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return "tar";
 	return null;
 }
+async function resolvePackedRootDir(extractDir) {
+	const direct = path.join(extractDir, "package");
+	try {
+		if ((await fs$1.stat(direct)).isDirectory()) return direct;
+	} catch {}
+	const dirs = (await fs$1.readdir(extractDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	if (dirs.length !== 1) throw new Error(`unexpected archive layout (dirs: ${dirs.join(", ")})`);
+	const onlyDir = dirs[0];
+	if (!onlyDir) throw new Error("unexpected archive layout (no package dir found)");
+	return path.join(extractDir, onlyDir);
+}
 async function withTimeout(promise, timeoutMs, label) {
 	let timeoutId;
 	try {
@@ -1473,9 +1538,351 @@ async function extractArchive(params) {
 		limits: params.limits
 	}), params.timeoutMs, label);
 }
+async function fileExists(filePath) {
+	try {
+		await fs$1.stat(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readJsonFile(filePath) {
+	const raw = await fs$1.readFile(filePath, "utf-8");
+	return JSON.parse(raw);
+}
+
+//#endregion
+//#region src/infra/install-source-utils.ts
+async function withTempDir(prefix, fn) {
+	const tmpDir = await fs$1.mkdtemp(path.join(os.tmpdir(), prefix));
+	try {
+		return await fn(tmpDir);
+	} finally {
+		await fs$1.rm(tmpDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+async function resolveArchiveSourcePath(archivePath) {
+	const resolved = resolveUserPath(archivePath);
+	if (!await fileExists(resolved)) return {
+		ok: false,
+		error: `archive not found: ${resolved}`
+	};
+	if (!resolveArchiveKind(resolved)) return {
+		ok: false,
+		error: `unsupported archive: ${resolved}`
+	};
+	return {
+		ok: true,
+		path: resolved
+	};
+}
+function toOptionalString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function parseResolvedSpecFromId(id) {
+	const at = id.lastIndexOf("@");
+	if (at <= 0 || at >= id.length - 1) return;
+	const name = id.slice(0, at).trim();
+	const version = id.slice(at + 1).trim();
+	if (!name || !version) return;
+	return `${name}@${version}`;
+}
+function normalizeNpmPackEntry(entry) {
+	if (!entry || typeof entry !== "object") return null;
+	const rec = entry;
+	const name = toOptionalString(rec.name);
+	const version = toOptionalString(rec.version);
+	const id = toOptionalString(rec.id);
+	const resolvedSpec = (name && version ? `${name}@${version}` : void 0) ?? (id ? parseResolvedSpecFromId(id) : void 0);
+	return {
+		filename: toOptionalString(rec.filename),
+		metadata: {
+			name,
+			version,
+			resolvedSpec,
+			integrity: toOptionalString(rec.integrity),
+			shasum: toOptionalString(rec.shasum)
+		}
+	};
+}
+function parseNpmPackJsonOutput(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const candidates = [trimmed];
+	const arrayStart = trimmed.indexOf("[");
+	if (arrayStart > 0) candidates.push(trimmed.slice(arrayStart));
+	for (const candidate of candidates) {
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch {
+			continue;
+		}
+		const entries = Array.isArray(parsed) ? parsed : [parsed];
+		let fallback = null;
+		for (let i = entries.length - 1; i >= 0; i -= 1) {
+			const normalized = normalizeNpmPackEntry(entries[i]);
+			if (!normalized) continue;
+			if (!fallback) fallback = normalized;
+			if (normalized.filename) return normalized;
+		}
+		if (fallback) return fallback;
+	}
+	return null;
+}
+function parsePackedArchiveFromStdout(stdout) {
+	const lines = stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const match = lines[index]?.match(/([^\s"']+\.tgz)/);
+		if (match?.[1]) return match[1];
+	}
+}
+async function findPackedArchiveInDir(cwd) {
+	const archives = (await fs$1.readdir(cwd, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".tgz"));
+	if (archives.length === 0) return;
+	if (archives.length === 1) return archives[0]?.name;
+	const sortedByMtime = await Promise.all(archives.map(async (entry) => ({
+		name: entry.name,
+		mtimeMs: (await fs$1.stat(path.join(cwd, entry.name))).mtimeMs
+	})));
+	sortedByMtime.sort((a, b) => b.mtimeMs - a.mtimeMs);
+	return sortedByMtime[0]?.name;
+}
+async function packNpmSpecToArchive(params) {
+	const res = await runCommandWithTimeout([
+		"npm",
+		"pack",
+		params.spec,
+		"--ignore-scripts",
+		"--json"
+	], {
+		timeoutMs: Math.max(params.timeoutMs, 3e5),
+		cwd: params.cwd,
+		env: {
+			COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+			NPM_CONFIG_IGNORE_SCRIPTS: "true"
+		}
+	});
+	if (res.code !== 0) {
+		const raw = res.stderr.trim() || res.stdout.trim();
+		if (/E404|is not in this registry/i.test(raw)) return {
+			ok: false,
+			error: `Package not found on npm: ${params.spec}. See https://docs.fased.ai/tools/plugin for installable plugins.`
+		};
+		return {
+			ok: false,
+			error: `npm pack failed: ${raw}`
+		};
+	}
+	const parsedJson = parseNpmPackJsonOutput(res.stdout || "");
+	let packed = parsedJson?.filename ?? parsePackedArchiveFromStdout(res.stdout || "");
+	if (!packed) packed = await findPackedArchiveInDir(params.cwd);
+	if (!packed) return {
+		ok: false,
+		error: "npm pack produced no archive"
+	};
+	let archivePath = path.isAbsolute(packed) ? packed : path.join(params.cwd, packed);
+	if (!await fileExists(archivePath)) {
+		const fallbackPacked = await findPackedArchiveInDir(params.cwd);
+		if (!fallbackPacked) return {
+			ok: false,
+			error: "npm pack produced no archive"
+		};
+		archivePath = path.join(params.cwd, fallbackPacked);
+	}
+	return {
+		ok: true,
+		archivePath,
+		metadata: parsedJson?.metadata ?? {}
+	};
+}
+
+//#endregion
+//#region src/infra/install-flow.ts
+async function withExtractedArchiveRoot(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const extractDir = path.join(tmpDir, "extract");
+		await fs$1.mkdir(extractDir, { recursive: true });
+		params.logger?.info?.(`Extracting ${params.archivePath}…`);
+		try {
+			await extractArchive({
+				archivePath: params.archivePath,
+				destDir: extractDir,
+				timeoutMs: params.timeoutMs,
+				logger: params.logger
+			});
+		} catch (err) {
+			return {
+				ok: false,
+				error: `failed to extract archive: ${String(err)}`
+			};
+		}
+		let rootDir = "";
+		try {
+			rootDir = await resolveInstallRootDir(extractDir, params.rootMarkers);
+		} catch (err) {
+			return {
+				ok: false,
+				error: String(err)
+			};
+		}
+		return await params.onExtracted(rootDir);
+	});
+}
+async function hasAnyRootMarker(rootDir, rootMarkers) {
+	for (const marker of rootMarkers) {
+		if (!marker || path.isAbsolute(marker) || marker.includes("..")) continue;
+		if (await fileExists(path.join(rootDir, marker))) return true;
+	}
+	return false;
+}
+async function resolveInstallRootDir(extractDir, rootMarkers) {
+	const markers = rootMarkers?.filter(Boolean) ?? [];
+	if (markers.length === 0) return await resolvePackedRootDir(extractDir);
+	if (await hasAnyRootMarker(extractDir, markers)) return extractDir;
+	const entries = await fs$1.readdir(extractDir, { withFileTypes: true });
+	const markerDirs = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		if (await hasAnyRootMarker(path.join(extractDir, entry.name), markers)) markerDirs.push(entry.name);
+	}
+	if (markerDirs.length === 1) return path.join(extractDir, markerDirs[0]);
+	if (markerDirs.length > 1) throw new Error(`unexpected archive layout (marker dirs: ${markerDirs.join(", ")})`);
+	return await resolvePackedRootDir(extractDir);
+}
+
+//#endregion
+//#region src/infra/install-mode-options.ts
+function resolveInstallModeOptions(params, defaultLogger) {
+	return {
+		logger: params.logger ?? defaultLogger,
+		mode: params.mode ?? "install",
+		dryRun: params.dryRun ?? false
+	};
+}
+function resolveTimedInstallModeOptions(params, defaultLogger, defaultTimeoutMs = 12e4) {
+	return {
+		...resolveInstallModeOptions(params, defaultLogger),
+		timeoutMs: params.timeoutMs ?? defaultTimeoutMs
+	};
+}
+
+//#endregion
+//#region src/infra/install-package-dir.ts
+function isObjectRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function sanitizeManifestForNpmInstall(targetDir) {
+	const manifestPath = path.join(targetDir, "package.json");
+	let manifestRaw = "";
+	try {
+		manifestRaw = await fs$1.readFile(manifestPath, "utf-8");
+	} catch {
+		return;
+	}
+	let manifest;
+	try {
+		const parsed = JSON.parse(manifestRaw);
+		if (!isObjectRecord(parsed)) return;
+		manifest = parsed;
+	} catch {
+		return;
+	}
+	const devDependencies = manifest.devDependencies;
+	if (!isObjectRecord(devDependencies)) return;
+	const filteredEntries = Object.entries(devDependencies).filter(([, rawSpec]) => {
+		return !(typeof rawSpec === "string" ? rawSpec.trim() : "").startsWith("workspace:");
+	});
+	if (filteredEntries.length === Object.keys(devDependencies).length) return;
+	if (filteredEntries.length === 0) delete manifest.devDependencies;
+	else manifest.devDependencies = Object.fromEntries(filteredEntries);
+	await fs$1.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
+}
+async function installPackageDir(params) {
+	params.logger?.info?.(`Installing to ${params.targetDir}…`);
+	let backupDir = null;
+	if (params.mode === "update" && await fileExists(params.targetDir)) {
+		const backupRoot = path.join(path.dirname(params.targetDir), ".fased-install-backups");
+		backupDir = path.join(backupRoot, `${path.basename(params.targetDir)}-${Date.now()}`);
+		await fs$1.mkdir(backupRoot, { recursive: true });
+		await fs$1.rename(params.targetDir, backupDir);
+	}
+	const rollback = async () => {
+		if (!backupDir) return;
+		await fs$1.rm(params.targetDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		await fs$1.rename(backupDir, params.targetDir).catch(() => void 0);
+	};
+	try {
+		await fs$1.cp(params.sourceDir, params.targetDir, { recursive: true });
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `${params.copyErrorPrefix}: ${String(err)}`
+		};
+	}
+	try {
+		await params.afterCopy?.();
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `post-copy validation failed: ${String(err)}`
+		};
+	}
+	if (params.hasDeps) {
+		await sanitizeManifestForNpmInstall(params.targetDir);
+		params.logger?.info?.(params.depsLogMessage);
+		const npmRes = await runCommandWithTimeout([
+			"npm",
+			"install",
+			"--omit=dev",
+			"--loglevel=error",
+			"--ignore-scripts",
+			"--legacy-peer-deps"
+		], {
+			timeoutMs: Math.max(params.timeoutMs, 3e5),
+			cwd: params.targetDir
+		});
+		if (npmRes.code !== 0) {
+			await rollback();
+			return {
+				ok: false,
+				error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`
+			};
+		}
+	}
+	try {
+		await params.afterInstall?.();
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `post-install validation failed: ${String(err)}`
+		};
+	}
+	if (backupDir) await fs$1.rm(backupDir, {
+		recursive: true,
+		force: true
+	}).catch(() => void 0);
+	return { ok: true };
+}
 
 //#endregion
 //#region src/infra/install-safe-path.ts
+function unscopedPackageName(name) {
+	const trimmed = name.trim();
+	if (!trimmed) return trimmed;
+	return trimmed.includes("/") ? trimmed.split("/").pop() ?? trimmed : trimmed;
+}
 function safeDirName(input) {
 	const trimmed = input.trim();
 	if (!trimmed) return trimmed;
@@ -1496,6 +1903,150 @@ function resolveSafeInstallDir(params) {
 	};
 }
 
+//#endregion
+//#region src/infra/npm-integrity.ts
+async function resolveNpmIntegrityDrift(params) {
+	if (!params.expectedIntegrity || !params.resolution.integrity) return { proceed: true };
+	if (params.expectedIntegrity === params.resolution.integrity) return { proceed: true };
+	const integrityDrift = {
+		expectedIntegrity: params.expectedIntegrity,
+		actualIntegrity: params.resolution.integrity
+	};
+	const payload = params.createPayload({
+		spec: params.spec,
+		expectedIntegrity: integrityDrift.expectedIntegrity,
+		actualIntegrity: integrityDrift.actualIntegrity,
+		resolution: params.resolution
+	});
+	let proceed = true;
+	if (params.onIntegrityDrift) proceed = await params.onIntegrityDrift(payload);
+	else params.warn?.(payload);
+	return {
+		integrityDrift,
+		proceed,
+		payload
+	};
+}
+async function resolveNpmIntegrityDriftWithDefaultMessage(params) {
+	const driftResult = await resolveNpmIntegrityDrift({
+		spec: params.spec,
+		expectedIntegrity: params.expectedIntegrity,
+		resolution: params.resolution,
+		createPayload: (drift) => ({ ...drift }),
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: (driftPayload) => {
+			params.warn?.(`Integrity drift detected for ${driftPayload.resolution.resolvedSpec ?? driftPayload.spec}: expected ${driftPayload.expectedIntegrity}, got ${driftPayload.actualIntegrity}`);
+		}
+	});
+	if (!driftResult.proceed && driftResult.payload) return {
+		integrityDrift: driftResult.integrityDrift,
+		error: `aborted: npm package integrity drift detected for ${driftResult.payload.resolution.resolvedSpec ?? driftResult.payload.spec}`
+	};
+	return { integrityDrift: driftResult.integrityDrift };
+}
+
+//#endregion
+//#region src/infra/npm-pack-install.ts
+async function installFromNpmSpecArchiveWithInstaller(params) {
+	return await installFromNpmSpecArchive({
+		tempDirPrefix: params.tempDirPrefix,
+		spec: params.spec,
+		timeoutMs: params.timeoutMs,
+		expectedIntegrity: params.expectedIntegrity,
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: params.warn,
+		installFromArchive: async ({ archivePath }) => await params.installFromArchive({
+			archivePath,
+			...params.archiveInstallParams
+		})
+	});
+}
+function isSuccessfulInstallResult(result) {
+	return result.ok;
+}
+function describeMissingNpmPackMetadata(metadata) {
+	const missing = [];
+	if (!metadata.name) missing.push("name");
+	if (!metadata.version) missing.push("version");
+	if (!metadata.integrity && !metadata.shasum) missing.push("integrity or shasum");
+	return missing;
+}
+function validateNpmPackMetadata(params) {
+	const missing = describeMissingNpmPackMetadata(params.metadata);
+	if (missing.length === 0) return null;
+	return `npm pack did not report ${missing.join(", ")} for ${params.spec}; refusing unpinned npm plugin install`;
+}
+function finalizeNpmSpecArchiveInstall(flowResult) {
+	if (!flowResult.ok) return flowResult;
+	const installResult = flowResult.installResult;
+	if (!isSuccessfulInstallResult(installResult)) return installResult;
+	return {
+		...installResult,
+		npmResolution: flowResult.npmResolution,
+		...flowResult.integrityDrift ? { integrityDrift: flowResult.integrityDrift } : {}
+	};
+}
+async function installFromNpmSpecArchive(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const packedResult = await packNpmSpecToArchive({
+			spec: params.spec,
+			timeoutMs: params.timeoutMs,
+			cwd: tmpDir
+		});
+		if (!packedResult.ok) return packedResult;
+		const metadataError = validateNpmPackMetadata({
+			spec: params.spec,
+			metadata: packedResult.metadata
+		});
+		if (metadataError) return {
+			ok: false,
+			error: metadataError
+		};
+		const npmResolution = {
+			...packedResult.metadata,
+			resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const driftResult = await resolveNpmIntegrityDriftWithDefaultMessage({
+			spec: params.spec,
+			expectedIntegrity: params.expectedIntegrity,
+			resolution: npmResolution,
+			onIntegrityDrift: params.onIntegrityDrift,
+			warn: params.warn
+		});
+		if (driftResult.error) return {
+			ok: false,
+			error: driftResult.error
+		};
+		return {
+			ok: true,
+			installResult: await params.installFromArchive({ archivePath: packedResult.archivePath }),
+			npmResolution,
+			integrityDrift: driftResult.integrityDrift
+		};
+	});
+}
+
+//#endregion
+//#region src/infra/npm-registry-spec.ts
+function validateRegistryNpmSpec(rawSpec) {
+	const spec = rawSpec.trim();
+	if (!spec) return "missing npm spec";
+	if (/\s/.test(spec)) return "unsupported npm spec: whitespace is not allowed";
+	if (spec.includes("://")) return "unsupported npm spec: URLs are not allowed";
+	if (spec.includes("#")) return "unsupported npm spec: git refs are not allowed";
+	if (spec.includes(":")) return "unsupported npm spec: protocol specs are not allowed";
+	const at = spec.lastIndexOf("@");
+	const hasVersion = at > 0;
+	const name = hasVersion ? spec.slice(0, at) : spec;
+	const version = hasVersion ? spec.slice(at + 1) : "";
+	if (!(name.startsWith("@") ? /^@[a-z0-9][a-z0-9-._~]*\/[a-z0-9][a-z0-9-._~]*$/.test(name) : /^[a-z0-9][a-z0-9-._~]*$/.test(name))) return "unsupported npm spec: expected <name> or <name>@<version> from the npm registry";
+	if (hasVersion) {
+		if (!version) return "unsupported npm spec: missing version/tag after @";
+		if (/[\\/]/.test(version)) return "unsupported npm spec: invalid version/tag";
+	}
+	return null;
+}
+
 //#endregion
 //#region src/security/scan-paths.ts
 function isPathInside$1(basePath, candidatePath) {
@@ -1504,6 +2055,9 @@ function isPathInside$1(basePath, candidatePath) {
 	const rel = path.relative(base, candidate);
 	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
 }
+function extensionUsesSkippedScannerPath(entry) {
+	return entry.split(/[\\/]+/).filter(Boolean).some((segment) => segment === "node_modules" || segment.startsWith(".") && segment !== "." && segment !== "..");
+}
 
 //#endregion
 //#region src/infra/errors.ts
@@ -1519,6 +2073,12 @@ function extractErrorCode(err) {
 function isErrno(err) {
 	return Boolean(err && typeof err === "object" && "code" in err);
 }
+/**
+* Check if an error has a specific errno code.
+*/
+function hasErrnoCode(err, code) {
+	return isErrno(err) && err.code === code;
+}
 function formatErrorMessage(err) {
 	let formatted;
 	if (err instanceof Error) formatted = err.message || err.name || "Error";
@@ -1539,7 +2099,243 @@ function formatUncaughtError(err) {
 
 //#endregion
 //#region src/security/skill-scanner.ts
+const SCANNABLE_EXTENSIONS = new Set([
+	".js",
+	".ts",
+	".mjs",
+	".cjs",
+	".mts",
+	".cts",
+	".jsx",
+	".tsx"
+]);
+const DEFAULT_MAX_SCAN_FILES = 500;
 const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
+function isScannable(filePath) {
+	return SCANNABLE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+const LINE_RULES = [
+	{
+		ruleId: "dangerous-exec",
+		severity: "critical",
+		message: "Shell command execution detected (child_process)",
+		pattern: /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/,
+		requiresContext: /child_process/
+	},
+	{
+		ruleId: "dynamic-code-execution",
+		severity: "critical",
+		message: "Dynamic code execution detected",
+		pattern: /\beval\s*\(|new\s+Function\s*\(/
+	},
+	{
+		ruleId: "crypto-mining",
+		severity: "critical",
+		message: "Possible crypto-mining reference detected",
+		pattern: /stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i
+	},
+	{
+		ruleId: "suspicious-network",
+		severity: "warn",
+		message: "WebSocket connection to non-standard port",
+		pattern: /new\s+WebSocket\s*\(\s*["']wss?:\/\/[^"']*:(\d+)/
+	}
+];
+const STANDARD_PORTS = new Set([
+	80,
+	443,
+	8080,
+	8443,
+	3e3
+]);
+const SOURCE_RULES = [
+	{
+		ruleId: "potential-exfiltration",
+		severity: "warn",
+		message: "File read combined with network send — possible data exfiltration",
+		pattern: /readFileSync|readFile/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Hex-encoded string sequence detected (possible obfuscation)",
+		pattern: /(\\x[0-9a-fA-F]{2}){6,}/
+	},
+	{
+		ruleId: "obfuscated-code",
+		severity: "warn",
+		message: "Large base64 payload with decode call detected (possible obfuscation)",
+		pattern: /(?:atob|Buffer\.from)\s*\(\s*["'][A-Za-z0-9+/=]{200,}["']/
+	},
+	{
+		ruleId: "env-harvesting",
+		severity: "critical",
+		message: "Environment variable access combined with network send — possible credential harvesting",
+		pattern: /process\.env/,
+		requiresContext: /\bfetch\b|\bpost\b|http\.request/i
+	}
+];
+function truncateEvidence(evidence, maxLen = 120) {
+	if (evidence.length <= maxLen) return evidence;
+	return `${evidence.slice(0, maxLen)}…`;
+}
+function scanSource(source, filePath) {
+	const findings = [];
+	const lines = source.split("\n");
+	const matchedLineRules = /* @__PURE__ */ new Set();
+	for (const rule of LINE_RULES) {
+		if (matchedLineRules.has(rule.ruleId)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			const match = rule.pattern.exec(line);
+			if (!match) continue;
+			if (rule.ruleId === "suspicious-network") {
+				const port = parseInt(match[1], 10);
+				if (STANDARD_PORTS.has(port)) continue;
+			}
+			findings.push({
+				ruleId: rule.ruleId,
+				severity: rule.severity,
+				file: filePath,
+				line: i + 1,
+				message: rule.message,
+				evidence: truncateEvidence(line.trim())
+			});
+			matchedLineRules.add(rule.ruleId);
+			break;
+		}
+	}
+	const matchedSourceRules = /* @__PURE__ */ new Set();
+	for (const rule of SOURCE_RULES) {
+		const ruleKey = `${rule.ruleId}::${rule.message}`;
+		if (matchedSourceRules.has(ruleKey)) continue;
+		if (!rule.pattern.test(source)) continue;
+		if (rule.requiresContext && !rule.requiresContext.test(source)) continue;
+		let matchLine = 0;
+		let matchEvidence = "";
+		for (let i = 0; i < lines.length; i++) if (rule.pattern.test(lines[i])) {
+			matchLine = i + 1;
+			matchEvidence = lines[i].trim();
+			break;
+		}
+		if (matchLine === 0) {
+			matchLine = 1;
+			matchEvidence = source.slice(0, 120);
+		}
+		findings.push({
+			ruleId: rule.ruleId,
+			severity: rule.severity,
+			file: filePath,
+			line: matchLine,
+			message: rule.message,
+			evidence: truncateEvidence(matchEvidence)
+		});
+		matchedSourceRules.add(ruleKey);
+	}
+	return findings;
+}
+function normalizeScanOptions(opts) {
+	return {
+		includeFiles: opts?.includeFiles ?? [],
+		maxFiles: Math.max(1, opts?.maxFiles ?? DEFAULT_MAX_SCAN_FILES),
+		maxFileBytes: Math.max(1, opts?.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES)
+	};
+}
+async function walkDirWithLimit(dirPath, maxFiles) {
+	const files = [];
+	const stack = [dirPath];
+	while (stack.length > 0 && files.length < maxFiles) {
+		const currentDir = stack.pop();
+		if (!currentDir) break;
+		const entries = await fs$1.readdir(currentDir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (files.length >= maxFiles) break;
+			if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+			const fullPath = path.join(currentDir, entry.name);
+			if (entry.isDirectory()) stack.push(fullPath);
+			else if (isScannable(entry.name)) files.push(fullPath);
+		}
+	}
+	return files;
+}
+async function resolveForcedFiles(params) {
+	if (params.includeFiles.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const rawIncludePath of params.includeFiles) {
+		const includePath = path.resolve(params.rootDir, rawIncludePath);
+		if (!isPathInside$1(params.rootDir, includePath)) continue;
+		if (!isScannable(includePath)) continue;
+		if (seen.has(includePath)) continue;
+		let st = null;
+		try {
+			st = await fs$1.stat(includePath);
+		} catch (err) {
+			if (hasErrnoCode(err, "ENOENT")) continue;
+			throw err;
+		}
+		if (!st?.isFile()) continue;
+		out.push(includePath);
+		seen.add(includePath);
+	}
+	return out;
+}
+async function collectScannableFiles(dirPath, opts) {
+	const forcedFiles = await resolveForcedFiles({
+		rootDir: dirPath,
+		includeFiles: opts.includeFiles
+	});
+	if (forcedFiles.length >= opts.maxFiles) return forcedFiles.slice(0, opts.maxFiles);
+	const walkedFiles = await walkDirWithLimit(dirPath, opts.maxFiles);
+	const seen = new Set(forcedFiles.map((f) => path.resolve(f)));
+	const out = [...forcedFiles];
+	for (const walkedFile of walkedFiles) {
+		if (out.length >= opts.maxFiles) break;
+		const resolved = path.resolve(walkedFile);
+		if (seen.has(resolved)) continue;
+		out.push(walkedFile);
+		seen.add(resolved);
+	}
+	return out;
+}
+async function readScannableSource(filePath, maxFileBytes) {
+	let st = null;
+	try {
+		st = await fs$1.stat(filePath);
+	} catch (err) {
+		if (hasErrnoCode(err, "ENOENT")) return null;
+		throw err;
+	}
+	if (!st?.isFile() || st.size > maxFileBytes) return null;
+	try {
+		return await fs$1.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (hasErrnoCode(err, "ENOENT")) return null;
+		throw err;
+	}
+}
+async function scanDirectoryWithSummary(dirPath, opts) {
+	const scanOptions = normalizeScanOptions(opts);
+	const files = await collectScannableFiles(dirPath, scanOptions);
+	const allFindings = [];
+	let scannedFiles = 0;
+	for (const file of files) {
+		const source = await readScannableSource(file, scanOptions.maxFileBytes);
+		if (source == null) continue;
+		scannedFiles += 1;
+		const findings = scanSource(source, file);
+		allFindings.push(...findings);
+	}
+	return {
+		scannedFiles,
+		critical: allFindings.filter((f) => f.severity === "critical").length,
+		warn: allFindings.filter((f) => f.severity === "warn").length,
+		info: allFindings.filter((f) => f.severity === "info").length,
+		findings: allFindings
+	};
+}
 
 //#endregion
 //#region src/project.ts
@@ -1736,6 +2532,7 @@ function loadPluginManifest(rootDir) {
 		manifestPath
 	};
 	const enabledByDefault = raw.enabledByDefault === true;
+	const runtimeOnly = raw.runtimeOnly === true;
 	const legacyPluginIds = normalizeStringList(raw.legacyPluginIds);
 	const autoEnableWhenConfiguredProviders = normalizeStringList(raw.autoEnableWhenConfiguredProviders);
 	const kind = typeof raw.kind === "string" ? raw.kind : void 0;
@@ -1758,6 +2555,7 @@ function loadPluginManifest(rootDir) {
 		manifest: {
 			id,
 			configSchema,
+			...runtimeOnly ? { runtimeOnly: true } : {},
 			...enabledByDefault ? { enabledByDefault } : {},
 			...legacyPluginIds.length > 0 ? { legacyPluginIds } : {},
 			...autoEnableWhenConfiguredProviders.length > 0 ? { autoEnableWhenConfiguredProviders } : {},
@@ -1790,14 +2588,120 @@ function getPackageManifestMetadata(manifest) {
 	return manifest[MANIFEST_KEY];
 }
 
+//#endregion
+//#region src/plugins/package-extensions.ts
+function normalizeEntry(entry) {
+	if (typeof entry !== "string") return null;
+	const trimmed = entry.trim();
+	if (!trimmed || path.isAbsolute(trimmed)) return null;
+	const normalized = trimmed.replace(/^\.\/+/, "");
+	if (!normalized || normalized === "." || normalized === "..") return null;
+	return normalized;
+}
+async function inferExtensionsFromLegacyPluginManifest(params) {
+	if (!params.pluginManifest) return [];
+	const packageDir = path.resolve(params.packageDir);
+	const candidates = [
+		params.manifest.main,
+		params.manifest.module,
+		...DEFAULT_PLUGIN_ENTRY_CANDIDATES
+	];
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	for (const candidate of candidates) {
+		const normalized = normalizeEntry(candidate);
+		if (!normalized || seen.has(normalized)) continue;
+		seen.add(normalized);
+		const resolved = path.resolve(packageDir, normalized);
+		if (!isPathInside$1(packageDir, resolved)) continue;
+		if (await fileExists(resolved)) entries.push(normalized);
+	}
+	return entries;
+}
+async function resolvePluginPackageExtensions(params) {
+	let manifestKey = null;
+	let extensions = params.manifest[MANIFEST_KEY]?.extensions;
+	if (Array.isArray(extensions)) manifestKey = MANIFEST_KEY;
+	if (Array.isArray(extensions)) {
+		const list = extensions.map((e) => typeof e === "string" ? e.trim() : "").filter(Boolean);
+		if (list.length === 0) throw new Error(`package.json ${manifestKey ?? MANIFEST_KEY}.extensions is empty`);
+		return {
+			extensions: list,
+			source: "fased"
+		};
+	}
+	const inferred = await inferExtensionsFromLegacyPluginManifest(params);
+	if (inferred.length > 0) return {
+		extensions: inferred,
+		source: "legacy-plugin-manifest"
+	};
+	throw new Error(`package.json missing ${MANIFEST_KEY}.extensions`);
+}
+
 //#endregion
 //#region src/plugins/install.ts
+function normalizeExpectedPluginIds(params) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of [params.expectedPluginId, ...params.expectedPluginIds ?? []]) {
+		const trimmed = typeof raw === "string" ? raw.trim() : "";
+		if (!trimmed) continue;
+		ids.add(unscopedPackageName(trimmed));
+	}
+	return [...ids].toSorted((left, right) => left.localeCompare(right));
+}
+const defaultLogger = {};
 function validatePluginId(pluginId) {
 	if (!pluginId) return "invalid plugin name: missing";
 	if (pluginId === "." || pluginId === "..") return "invalid plugin name: reserved path segment";
 	if (pluginId.includes("/") || pluginId.includes("\\")) return "invalid plugin name: path separators not allowed";
 	return null;
 }
+function countManifestEntries(value) {
+	return Object.keys(value ?? {}).length;
+}
+function listManifestKeys(value) {
+	return Object.keys(value ?? {}).map((entry) => entry.trim()).filter(Boolean).toSorted((left, right) => left.localeCompare(right));
+}
+function isTypeScriptExtensionEntry(entry) {
+	const ext = path.extname(entry.trim()).toLowerCase();
+	return ext === ".ts" || ext === ".tsx" || ext === ".mts" || ext === ".cts";
+}
+function buildRuntimeWarnings(extensions) {
+	const sourceEntries = extensions.map((entry) => entry.trim()).filter(Boolean).filter(isTypeScriptExtensionEntry).toSorted((left, right) => left.localeCompare(right));
+	if (sourceEntries.length === 0) return [];
+	return [`package exposes TypeScript extension ${sourceEntries.length === 1 ? "entry" : "entries"} (${sourceEntries.join(", ")}); publish compiled JavaScript runtime output before enabling this plugin`];
+}
+function buildInstallPackageReview(params) {
+	const dependencyKinds = [];
+	const dependencyCount = countManifestEntries(params.manifest.dependencies);
+	const optionalDependencyCount = countManifestEntries(params.manifest.optionalDependencies);
+	const peerDependencyCount = countManifestEntries(params.manifest.peerDependencies);
+	const totalDependencyCount = dependencyCount + optionalDependencyCount + peerDependencyCount;
+	if (dependencyCount > 0) dependencyKinds.push(`dependencies:${dependencyCount}`);
+	if (optionalDependencyCount > 0) dependencyKinds.push(`optionalDependencies:${optionalDependencyCount}`);
+	if (peerDependencyCount > 0) dependencyKinds.push(`peerDependencies:${peerDependencyCount}`);
+	const scriptNames = listManifestKeys(params.manifest.scripts);
+	const dependencyWarnings = totalDependencyCount > 0 ? [`package declares ${totalDependencyCount} dependenc${totalDependencyCount === 1 ? "y" : "ies"}; Fased installs runtime dependencies with npm --ignore-scripts`] : [];
+	const scriptWarnings = scriptNames.length > 0 ? [`package declares npm scripts (${scriptNames.join(", ")}); Fased pack/install paths use --ignore-scripts`] : [];
+	const runtimeWarnings = buildRuntimeWarnings(params.extensions);
+	return {
+		pluginId: params.pluginId,
+		packageName: params.manifest.name || void 0,
+		version: params.manifest.version || void 0,
+		extensions: params.extensions,
+		kind: params.pluginManifest?.kind,
+		channels: params.pluginManifest?.channels ?? [],
+		providers: params.pluginManifest?.providers ?? [],
+		skills: params.pluginManifest?.skills ?? [],
+		tools: params.pluginManifest?.contracts?.tools ?? [],
+		dependencyCount: totalDependencyCount,
+		dependencyKinds,
+		scriptNames,
+		dependencyWarnings,
+		scriptWarnings,
+		runtimeWarnings
+	};
+}
 function resolvePluginInstallDir(pluginId, extensionsDir) {
 	const extensionsBase = extensionsDir ? resolveUserPath(extensionsDir) : path.join(CONFIG_DIR, "extensions");
 	const pluginIdError = validatePluginId(pluginId);
@@ -1810,6 +2714,197 @@ function resolvePluginInstallDir(pluginId, extensionsDir) {
 	if (!targetDirResult.ok) throw new Error(targetDirResult.error);
 	return targetDirResult.path;
 }
+async function installPluginFromPackageDir(params) {
+	const { logger, timeoutMs, mode, dryRun } = resolveTimedInstallModeOptions(params, defaultLogger);
+	const manifestPath = path.join(params.packageDir, "package.json");
+	if (!await fileExists(manifestPath)) return {
+		ok: false,
+		error: "extracted package missing package.json"
+	};
+	let manifest;
+	try {
+		manifest = await readJsonFile(manifestPath);
+	} catch (err) {
+		return {
+			ok: false,
+			error: `invalid package.json: ${String(err)}`
+		};
+	}
+	const pkgName = typeof manifest.name === "string" ? manifest.name : "";
+	const npmPluginId = pkgName ? unscopedPackageName(pkgName) : "plugin";
+	const pluginManifestResult = loadPluginManifest(params.packageDir);
+	const manifestPlugin = pluginManifestResult.ok && pluginManifestResult.manifest.id ? pluginManifestResult.manifest : void 0;
+	const manifestPluginId = pluginManifestResult.ok && pluginManifestResult.manifest.id ? unscopedPackageName(pluginManifestResult.manifest.id) : void 0;
+	let extensions;
+	try {
+		const resolvedExtensions = await resolvePluginPackageExtensions({
+			manifest,
+			packageDir: params.packageDir,
+			pluginManifest: manifestPlugin
+		});
+		extensions = resolvedExtensions.extensions;
+		if (resolvedExtensions.source === "legacy-plugin-manifest") logger.info?.(`Plugin "${manifestPlugin?.id ?? npmPluginId}" uses legacy plugin manifest entry inference; prefer package.json fased.extensions for new packages.`);
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+	const pluginId = manifestPluginId ?? npmPluginId;
+	const pluginIdError = validatePluginId(pluginId);
+	if (pluginIdError) return {
+		ok: false,
+		error: pluginIdError
+	};
+	const expectedPluginIds = normalizeExpectedPluginIds(params);
+	if (expectedPluginIds.length > 0 && !expectedPluginIds.includes(pluginId)) return {
+		ok: false,
+		error: `plugin id mismatch: expected ${expectedPluginIds.join(" or ")}, got ${pluginId}`
+	};
+	if (manifestPluginId && manifestPluginId !== npmPluginId) logger.info?.(`Plugin manifest id "${manifestPluginId}" differs from npm package name "${npmPluginId}"; using manifest id as the config key.`);
+	const packageDir = path.resolve(params.packageDir);
+	const forcedScanEntries = [];
+	for (const entry of extensions) {
+		const resolvedEntry = path.resolve(packageDir, entry);
+		if (!isPathInside$1(packageDir, resolvedEntry)) {
+			logger.warn?.(`extension entry escapes plugin directory and will not be scanned: ${entry}`);
+			continue;
+		}
+		if (extensionUsesSkippedScannerPath(entry)) logger.warn?.(`extension entry is in a hidden/node_modules path and will receive targeted scan coverage: ${entry}`);
+		forcedScanEntries.push(resolvedEntry);
+	}
+	try {
+		const scanSummary = await scanDirectoryWithSummary(params.packageDir, { includeFiles: forcedScanEntries });
+		if (scanSummary.critical > 0) {
+			const criticalDetails = scanSummary.findings.filter((f) => f.severity === "critical").map((f) => `${f.message} (${f.file}:${f.line})`).join("; ");
+			logger.warn?.(`WARNING: Plugin "${pluginId}" contains dangerous code patterns: ${criticalDetails}`);
+		} else if (scanSummary.warn > 0) logger.warn?.(`Plugin "${pluginId}" has ${scanSummary.warn} suspicious code pattern(s). Run "fased security audit --deep" for details.`);
+	} catch (err) {
+		logger.warn?.(`Plugin "${pluginId}" code safety scan failed (${String(err)}). Installation continues; run "fased security audit --deep" after install.`);
+	}
+	const extensionsDir = params.extensionsDir ? resolveUserPath(params.extensionsDir) : path.join(CONFIG_DIR, "extensions");
+	await fs$1.mkdir(extensionsDir, { recursive: true });
+	const targetDirResult = resolveSafeInstallDir({
+		baseDir: extensionsDir,
+		id: pluginId,
+		invalidNameMessage: "invalid plugin name: path traversal detected"
+	});
+	if (!targetDirResult.ok) return {
+		ok: false,
+		error: targetDirResult.error
+	};
+	const targetDir = targetDirResult.path;
+	if (mode === "install" && await fileExists(targetDir)) return {
+		ok: false,
+		error: `plugin already exists: ${targetDir} (delete it first)`
+	};
+	if (dryRun) return {
+		ok: true,
+		pluginId,
+		targetDir,
+		manifestName: pkgName || void 0,
+		version: typeof manifest.version === "string" ? manifest.version : void 0,
+		extensions,
+		review: buildInstallPackageReview({
+			pluginId,
+			manifest,
+			extensions,
+			pluginManifest: manifestPlugin
+		})
+	};
+	const hasDeps = Boolean(manifest.dependencies && Object.keys(manifest.dependencies).length > 0 || manifest.optionalDependencies && Object.keys(manifest.optionalDependencies).length > 0);
+	const installRes = await installPackageDir({
+		sourceDir: params.packageDir,
+		targetDir,
+		mode,
+		timeoutMs,
+		logger,
+		copyErrorPrefix: "failed to copy plugin",
+		hasDeps,
+		depsLogMessage: "Installing plugin dependencies…",
+		afterCopy: async () => {
+			for (const entry of extensions) {
+				const resolvedEntry = path.resolve(targetDir, entry);
+				if (!isPathInside$1(targetDir, resolvedEntry)) {
+					logger.warn?.(`extension entry escapes plugin directory: ${entry}`);
+					continue;
+				}
+				if (!await fileExists(resolvedEntry)) logger.warn?.(`extension entry not found: ${entry}`);
+			}
+		}
+	});
+	if (!installRes.ok) return installRes;
+	return {
+		ok: true,
+		pluginId,
+		targetDir,
+		manifestName: pkgName || void 0,
+		version: typeof manifest.version === "string" ? manifest.version : void 0,
+		extensions,
+		review: buildInstallPackageReview({
+			pluginId,
+			manifest,
+			extensions,
+			pluginManifest: manifestPlugin
+		})
+	};
+}
+async function installPluginFromArchive(params) {
+	const logger = params.logger ?? defaultLogger;
+	const timeoutMs = params.timeoutMs ?? 12e4;
+	const mode = params.mode ?? "install";
+	const archivePathResult = await resolveArchiveSourcePath(params.archivePath);
+	if (!archivePathResult.ok) return archivePathResult;
+	const archivePath = archivePathResult.path;
+	return await withExtractedArchiveRoot({
+		archivePath,
+		tempDirPrefix: "fased-plugin-",
+		timeoutMs,
+		logger,
+		onExtracted: async (packageDir) => await installPluginFromPackageDir({
+			packageDir,
+			extensionsDir: params.extensionsDir,
+			timeoutMs,
+			logger,
+			mode,
+			dryRun: params.dryRun,
+			expectedPluginId: params.expectedPluginId,
+			expectedPluginIds: params.expectedPluginIds
+		})
+	});
+}
+async function installPluginFromNpmSpec(params) {
+	const { logger, timeoutMs, mode, dryRun } = resolveTimedInstallModeOptions(params, defaultLogger);
+	const expectedPluginId = params.expectedPluginId;
+	const expectedPluginIds = params.expectedPluginIds;
+	const spec = params.spec.trim();
+	const specError = validateRegistryNpmSpec(spec);
+	if (specError) return {
+		ok: false,
+		error: specError
+	};
+	logger.info?.(`Downloading ${spec}…`);
+	return finalizeNpmSpecArchiveInstall(await installFromNpmSpecArchiveWithInstaller({
+		tempDirPrefix: "fased-npm-pack-",
+		spec,
+		timeoutMs,
+		expectedIntegrity: params.expectedIntegrity,
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: (message) => {
+			logger.warn?.(message);
+		},
+		installFromArchive: installPluginFromArchive,
+		archiveInstallParams: {
+			extensionsDir: params.extensionsDir,
+			timeoutMs,
+			logger,
+			mode,
+			dryRun,
+			expectedPluginId,
+			expectedPluginIds
+		}
+	}));
+}
 
 //#endregion
 //#region src/plugins/uninstall.ts
@@ -6568,6 +7663,13 @@ const PLUGIN_ORIGIN_RANK = {
 const registryCache = /* @__PURE__ */ new Map();
 const DEFAULT_MANIFEST_CACHE_MS = 200;
 const LEGACY_REMOVED_PLUGIN_IDS$2 = /* @__PURE__ */ new Set();
+function isRuntimeOnlyComponent(params) {
+	if (params.manifest.runtimeOnly === true) return true;
+	return params.manifest.id === "openai-runtime" && params.candidate.packageName === "@fased/openai-runtime";
+}
+function clearPluginManifestRegistryCache() {
+	registryCache.clear();
+}
 function resolveManifestCacheMs(env) {
 	const raw = env.FASED_PLUGIN_MANIFEST_CACHE_MS?.trim();
 	if (raw === "" || raw === "0") return 0;
@@ -6625,6 +7727,7 @@ function buildRecord(params) {
 	});
 	return {
 		id: params.manifest.id,
+		runtimeOnly: isRuntimeOnlyComponent(params) ? true : void 0,
 		name: normalizeManifestLabel(params.manifest.name) ?? params.candidate.packageName,
 		description: normalizeManifestLabel(params.manifest.description) ?? params.candidate.packageDescription,
 		version: normalizeManifestLabel(params.manifest.version) ?? params.candidate.packageVersion,
@@ -6739,6 +7842,25 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			if (isRuntimeOnlyComponent({
+				manifest,
+				candidate
+			}) && records[existing.recordIndex]?.runtimeOnly === true) {
+				if (PLUGIN_ORIGIN_RANK[candidate.origin] < PLUGIN_ORIGIN_RANK[existing.candidate.origin]) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,
@@ -11910,6 +13032,9 @@ function cloneCurrentModelProvider(provider) {
 		}))
 	};
 }
+function listCurrentModelCatalogProviderIds() {
+	return Object.keys(CURRENT_MODEL_PROVIDER_CATALOG).map(normalizeModelCatalogProviderId).filter(Boolean).toSorted((left, right) => left.localeCompare(right));
+}
 function listCurrentModelCatalogRows() {
 	return Object.entries(CURRENT_MODEL_PROVIDER_CATALOG).flatMap(([provider, providerConfig]) => normalizeProviderCatalogRows({
 		provider,
@@ -23419,4 +24544,4 @@ async function writeConfigFile(cfg, options = {}) {
 }
 
 //#endregion
-export { resetConfigOverrides as $, DEFAULT_MODEL as $i, ANTHROPIC_ROUTE_ID as $n, QWEN_CODING_PLAN_MODEL_IDS as $r, resolveSubagentSpawnModelSelection as $t, GroupPolicySchema as A, lookupProviderManifestModelCapability as Ai, markAuthProfileGood as An, MINIMAX_PROVIDER_BRAND_ID as Ar, isSafeExecutableValue as At, MODEL_APIS as B, HUGGINGFACE_MODEL_IDS as Bi, normalizeProviderId$1 as Bn, OPENAI_API_ROUTE_ID as Br, buildModelAliasIndex as Bt, resolveIMessageAttachmentRoots as C, normalizePluginsConfig as Ca, ZAI_MODEL_IDS as Ci, markAuthProfileFailure as Cn, LITELLM_ROUTE_ID as Cr, unwrapKnownDispatchWrapperInvocation as Ct, BlockStreamingCoalesceSchema as D, isOpenAISignInRuntimeModelSupported as Di, dedupeProfileIds as Dn, MINIMAX_CN_ROUTE_ID as Dr, normalizeSafeBinProfileFixtures as Dt, ToolPolicySchema as E, resolvePluginAdminRpcActionGrant as Ea, getProviderBrandManifestForRoute as Ei, resolveApiKeyForProfile as En, MINIMAX_API_ROUTE_ID as Er, SAFE_BIN_PROFILES as Et, TtsConfigSchema as F, VERCEL_AI_GATEWAY_MODEL_IDS as Fi, acquireFileLock as Fn, MOONSHOT_PROVIDER_BRAND_ID as Fr, resolveTelegramPreviewStreamMode as Ft, isAvatarDataUrl as G, formatThinkingLevels as Gi, resolveAuthProfileDisplayLabel as Gn, OPENROUTER_MODEL_IDS as Gr, normalizeModelRef as Gt, parseDurationMs as H, CLOUDFLARE_AI_GATEWAY_PROVIDER_BRAND_ID as Hi, discoverFasedAgentPlugins as Hn, OPENAI_PROVIDER_BRAND_ID as Hr, inferUniqueProviderFromConfiguredModels as Ht, TtsModeSchema as I, VENICE_MODEL_IDS as Ii, withFileLock as In, MOONSHOT_ROUTE_ID as Ir, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as It, isSupportedLocalAvatarExtension as J, normalizeThinkLevel as Ji, assertSecretInputResolved as Jn, QIANFAN_MODEL_IDS as Jr, resolveConfiguredModelRef as Jt, isAvatarHttpUrl as K, formatXHighModelHint as Ki, isPrivateNetworkBaseUrl as Kn, OPENROUTER_PROVIDER_BRAND_ID as Kr, normalizeProviderId as Kt, TtsProviderSchema as L, TOGETHER_MODEL_IDS as Li, resolveProcessScopedMap as Ln, OLLAMA_PROVIDER_BRAND_ID as Lr, resolveAgentMaxConcurrent as Lt, MarkdownTableModeSchema as M, resolveProviderRouteModelCapability as Mi, resolveAuthStorePathForDisplay as Mn, MISTRAL_PROVIDER_BRAND_ID as Mr, resolveDiscordPreviewStreamMode as Mt, ReplyRuntimeConfigSchemaShape as N, LITELLM_BASE_URL as Ni, resolveFasedAgentAgentDir as Nn, MISTRAL_ROUTE_ID as Nr, resolveSlackNativeStreaming as Nt, DmConfigSchema as O, isStandardProviderCatalogEntry as Oi, listProfilesForProvider as On, MINIMAX_MODEL_IDS as Or, resolveSafeBinProfiles as Ot, TtsAutoSchema as P, XIAOMI_MODEL_IDS as Pi, resolveFasedAgentDir as Pn, MOONSHOT_MODEL_IDS as Pr, resolveSlackStreamingMode as Pt, getConfigOverrides as Q, DEFAULT_CONTEXT_TOKENS as Qi, ANTHROPIC_PROVIDER_BRAND_ID as Qn, QWEN_API_ROUTE_ID as Qr, resolveReasoningDefault as Qt, normalizeAllowFrom as R, SYNTHETIC_MODEL_IDS as Ri, isPidAlive as Rn, OLLAMA_ROUTE_ID as Rr, buildAllowedModelSet as Rt, mergeInboundPathRoots as S, isPluginRuntimeSessionReadAllowed as Sa, XIAOMI_ROUTE_ID as Si, isProfileInCooldown as Sn, LITELLM_PROVIDER_BRAND_ID as Sr, isShellWrapperExecutable as St, normalizeScpRemoteHost as T, resolveMemorySlotDecision as Ta, ZAI_ROUTE_ID as Ti, resolveProfilesUnavailableReason as Tn, LMSTUDIO_ROUTE_ID as Tr, splitShellArgs as Tt, parseByteSize as U, CLOUDFLARE_AI_GATEWAY_ROUTE_ID as Ui, isPathInside as Un, OPENCODE_ZEN_PROVIDER_BRAND_ID as Ur, isCliProvider as Ut, getBlockedNetworkModeReason as V, CLOUDFLARE_AI_GATEWAY_MODEL_IDS as Vi, loadPluginManifestRegistry as Vn, OPENAI_CODEX_ROUTE_ID as Vr, findNormalizedProviderValue as Vt, AVATAR_MAX_BYTES as W, BASE_THINKING_LEVELS as Wi, safeStatSync as Wn, OPENCODE_ZEN_ROUTE_ID as Wr, modelKey as Wt, resolveAvatarMime as X, supportsThinkingLevel as Xi, splitTrailingAuthProfile as Xn, QIANFAN_ROUTE_ID as Xr, resolveExplicitConfiguredModelRef as Xt, isWorkspaceRelativeAvatarPath as Y, resolveModelThinkingCapability as Yi, coerceSecretRef as Yn, QIANFAN_PROVIDER_BRAND_ID as Yr, resolveDefaultModelForAgent as Yt, validateJsonSchemaValue as Z, supportsXHighThinking as Zi, ANTHROPIC_MODEL_IDS as Zn, QWEN_API_MODEL_IDS as Zr, resolveModelRefFromString as Zt, TELEGRAM_COMMAND_NAME_PATTERN as _, formatCliCommand as _a, VOLCENGINE_ROUTE_ID as _i, normalizeModelCatalogProviderId as _n, GOOGLE_PROVIDER_BRAND_ID as _r, matchAllowlist as _t, readConfigFileSnapshotForWrite as a, extractErrorCode as aa, TOGETHER_ROUTE_ID as ai, getApiKeyForModel as an, BYTEPLUS_ROUTE_ID as ar, unsetConfigValueAtPath as at, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS as b, parseBooleanValue as ba, XAI_ROUTE_ID as bi, resolveAuthProfileOrder as bn, KIMI_CODING_MODEL_IDS as br, extractShellWrapperInlineCommand as bt, validateConfigObjectWithPlugins as c, isErrno as ca, VERCEL_AI_GATEWAY_PROVIDER_BRAND_ID as ci, resolveApiKeyForProvider as cn, CHUTES_ROUTE_ID as cr, isTrustedSafeBinPath as ct, GoogleChatConfigSchema as d, resolveShellEnvFallbackTimeoutMs as da, VLLM_ROUTE_ID as di, CURRENT_MODEL_PROVIDER_CATALOG as dn, COPILOT_PROXY_ROUTE_ID as dr, validateSafeBinArgv as dt, DEFAULT_PROVIDER as ea, QWEN_CODING_PLAN_ROUTE_ID as ei, resolveThinkingDefault as en, BYTEPLUS_CODING_MODEL_IDS as er, setConfigOverride as et, IMessageConfigSchema as f, isDangerousHostEnvOverrideVarName as fa, VOLCENGINE_CODING_MODEL_IDS as fi, cloneCurrentModelProvider as fn, CUSTOM_PROVIDER_BRAND_ID as fr, analyzeShellCommand as ft, TelegramConfigSchema as g, resolveOwnerDisplaySetting as ga, VOLCENGINE_PROVIDER_BRAND_ID as gi, normalizeModelCatalogModelId as gn, GOOGLE_GEMINI_MODEL_IDS as gr, DEFAULT_SAFE_BINS as gt, SlackConfigSchema as h, sanitizeHostExecEnv as ha, VOLCENGINE_PLAN_ROUTE_ID as hi, mergeModelCatalogRowsByAuthority as hn, GOOGLE_GEMINI_CLI_ROUTE_ID as hr, splitCommandChain as ht, readConfigFileSnapshot as i, MANIFEST_KEY as ia, TOGETHER_PROVIDER_BRAND_ID as ii, resolveImplicitProviders as in, BYTEPLUS_PROVIDER_BRAND_ID as ir, setConfigValueAtPath as it, MarkdownConfigSchema as j, providerModelRecommendationRank as ji, ensureAuthProfileStore as jn, MISTRAL_MODEL_IDS as jr, mapStreamingModeToSlackLegacyDraftStreamMode as jt, DmPolicySchema as k, listProviderBrandManifests as ki, listProvidersWithStoredCredentials as kn, MINIMAX_PORTAL_ROUTE_ID as kr, applyMergePatch as kt, WhatsAppConfigSchema as l, extractArchive as la, VERCEL_AI_GATEWAY_ROUTE_ID as li, resolveEnvApiKey as ln, COPILOT_PROVIDER_BRAND_ID as lr, listWritableExplicitTrustedSafeBinDirs as lt, SignalConfigSchema as m, isDangerousHostInheritedEnvVarName as ma, VOLCENGINE_MODEL_IDS as mi, buildModelCatalogMergeKey as mn, GOOGLE_API_ROUTE_ID as mr, isWindowsPlatform as mt, loadConfig as n, resolvePluginInstallDir as na, SYNTHETIC_PROVIDER_BRAND_ID as ni, normalizeProviders as nn, BYTEPLUS_MODEL_IDS as nr, getConfigValueAtPath as nt, resolveConfigSnapshotHash as o, formatErrorMessage as oa, VENICE_PROVIDER_BRAND_ID as oi, getCustomProviderApiKey as on, CHUTES_MODEL_IDS as or, ensurePluginAllowlisted as ot, MSTeamsConfigSchema as p, isDangerousHostEnvVarName as pa, VOLCENGINE_CODING_ROUTE_ID as pi, listCurrentModelCatalogRows as pn, CUSTOM_PROVIDER_ROUTE_ID as pr, buildEnforcedShellCommand as pt, isPathWithinRoot as q, listThinkingLevels as qi, normalizeSecretInput as qn, OPENROUTER_ROUTE_ID as qr, parseModelRef as qt, parseConfigJson5 as r, getPackageManifestMetadata as ra, SYNTHETIC_ROUTE_ID as ri, resolveImplicitCopilotProvider as rn, BYTEPLUS_PLAN_ROUTE_ID as rr, parseConfigPath as rt, writeConfigFile as s, formatUncaughtError as sa, VENICE_ROUTE_ID as si, requireApiKey as sn, CHUTES_PROVIDER_BRAND_ID as sr, getTrustedSafeBinDirs as st, createConfigIO as t, VERSION as ta, QWEN_PROVIDER_BRAND_ID as ti, normalizeGoogleModelId as tn, BYTEPLUS_CODING_ROUTE_ID as tr, unsetConfigOverride as tt, DiscordConfigSchema as u, getShellPathFromLoginShell as ua, VLLM_PROVIDER_BRAND_ID as ui, resolveModelAuthMode as un, COPILOT_PROXY_MODEL_IDS as ur, normalizeTrustedSafeBinDirs as ut, normalizeTelegramCommandName as v, resolveCliName as va, XAI_MODEL_IDS as vi, normalizeProviderCatalogRows as vn, HUGGINGFACE_PROVIDER_BRAND_ID as vr, resolveAllowlistCandidatePath as vt, resolveIMessageRemoteAttachmentRoots as w, resolveEffectiveEnableState as wa, ZAI_PROVIDER_BRAND_ID as wi, markAuthProfileUsed as wn, LMSTUDIO_PROVIDER_BRAND_ID as wr, unwrapKnownShellMultiplexerInvocation as wt, isInboundPathAllowed as x, applyTestPluginDefaults as xa, XIAOMI_PROVIDER_BRAND_ID as xi, getSoonestCooldownExpiry as xn, KIMI_CODING_ROUTE_ID as xr, isDispatchWrapperExecutable as xt, resolveTelegramCustomCommands as y, isTruthyEnvValue as ya, XAI_PROVIDER_BRAND_ID as yi, auth_profiles_exports as yn, HUGGINGFACE_ROUTE_ID as yr, resolveCommandResolutionFromArgv as yt, requireOpenAllowFrom as z, OPENCODE_ZEN_MODEL_IDS as zi, findNormalizedProviderValue$1 as zn, OPENAI_API_MODEL_IDS as zr, buildConfiguredAllowlistKeys as zt };
+export { resetConfigOverrides as $, supportsXHighThinking as $i, ANTHROPIC_MODEL_IDS as $n, QWEN_API_MODEL_IDS as $r, resolveSubagentSpawnModelSelection as $t, GroupPolicySchema as A, applyExclusiveSlotSelection as Aa, isStandardProviderCatalogEntry as Ai, listProvidersWithStoredCredentials as An, MINIMAX_MODEL_IDS as Ar, isSafeExecutableValue as At, MODEL_APIS as B, SYNTHETIC_MODEL_IDS as Bi, findNormalizedProviderValue$1 as Bn, OLLAMA_ROUTE_ID as Br, buildModelAliasIndex as Bt, resolveIMessageAttachmentRoots as C, parseBooleanValue as Ca, XIAOMI_PROVIDER_BRAND_ID as Ci, isProfileInCooldown as Cn, KIMI_CODING_ROUTE_ID as Cr, unwrapKnownDispatchWrapperInvocation as Ct, BlockStreamingCoalesceSchema as D, resolveEffectiveEnableState as Da, ZAI_ROUTE_ID as Di, resolveApiKeyForProfile as Dn, LMSTUDIO_ROUTE_ID as Dr, normalizeSafeBinProfileFixtures as Dt, ToolPolicySchema as E, normalizePluginsConfig as Ea, ZAI_PROVIDER_BRAND_ID as Ei, resolveProfilesUnavailableReason as En, LMSTUDIO_PROVIDER_BRAND_ID as Er, SAFE_BIN_PROFILES as Et, TtsConfigSchema as F, LITELLM_BASE_URL as Fi, resolveFasedAgentDir as Fn, MISTRAL_ROUTE_ID as Fr, resolveTelegramPreviewStreamMode as Ft, isAvatarDataUrl as G, CLOUDFLARE_AI_GATEWAY_ROUTE_ID as Gi, isPathInside as Gn, OPENCODE_ZEN_PROVIDER_BRAND_ID as Gr, normalizeModelRef as Gt, parseDurationMs as H, HUGGINGFACE_MODEL_IDS as Hi, clearPluginManifestRegistryCache as Hn, OPENAI_API_ROUTE_ID as Hr, inferUniqueProviderFromConfiguredModels as Ht, TtsModeSchema as I, XIAOMI_MODEL_IDS as Ii, acquireFileLock as In, MOONSHOT_MODEL_IDS as Ir, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as It, isSupportedLocalAvatarExtension as J, formatXHighModelHint as Ji, isPrivateNetworkBaseUrl as Jn, OPENROUTER_PROVIDER_BRAND_ID as Jr, resolveConfiguredModelRef as Jt, isAvatarHttpUrl as K, BASE_THINKING_LEVELS as Ki, safeStatSync as Kn, OPENCODE_ZEN_ROUTE_ID as Kr, normalizeProviderId as Kt, TtsProviderSchema as L, VERCEL_AI_GATEWAY_MODEL_IDS as Li, withFileLock as Ln, MOONSHOT_PROVIDER_BRAND_ID as Lr, resolveAgentMaxConcurrent as Lt, MarkdownTableModeSchema as M, lookupProviderManifestModelCapability as Mi, ensureAuthProfileStore as Mn, MINIMAX_PROVIDER_BRAND_ID as Mr, resolveDiscordPreviewStreamMode as Mt, ReplyRuntimeConfigSchemaShape as N, providerModelRecommendationRank as Ni, resolveAuthStorePathForDisplay as Nn, MISTRAL_MODEL_IDS as Nr, resolveSlackNativeStreaming as Nt, DmConfigSchema as O, resolveMemorySlotDecision as Oa, getProviderBrandManifestForRoute as Oi, dedupeProfileIds as On, MINIMAX_API_ROUTE_ID as Or, resolveSafeBinProfiles as Ot, TtsAutoSchema as P, resolveProviderRouteModelCapability as Pi, resolveFasedAgentAgentDir as Pn, MISTRAL_PROVIDER_BRAND_ID as Pr, resolveSlackStreamingMode as Pt, getConfigOverrides as Q, supportsThinkingLevel as Qi, splitTrailingAuthProfile as Qn, QIANFAN_ROUTE_ID as Qr, resolveReasoningDefault as Qt, normalizeAllowFrom as R, VENICE_MODEL_IDS as Ri, resolveProcessScopedMap as Rn, MOONSHOT_ROUTE_ID as Rr, buildAllowedModelSet as Rt, mergeInboundPathRoots as S, isTruthyEnvValue as Sa, XAI_ROUTE_ID as Si, getSoonestCooldownExpiry as Sn, KIMI_CODING_MODEL_IDS as Sr, isShellWrapperExecutable as St, normalizeScpRemoteHost as T, isPluginRuntimeSessionReadAllowed as Ta, ZAI_MODEL_IDS as Ti, markAuthProfileUsed as Tn, LITELLM_ROUTE_ID as Tr, splitShellArgs as Tt, parseByteSize as U, CLOUDFLARE_AI_GATEWAY_MODEL_IDS as Ui, loadPluginManifestRegistry as Un, OPENAI_CODEX_ROUTE_ID as Ur, isCliProvider as Ut, getBlockedNetworkModeReason as V, OPENCODE_ZEN_MODEL_IDS as Vi, normalizeProviderId$1 as Vn, OPENAI_API_MODEL_IDS as Vr, findNormalizedProviderValue as Vt, AVATAR_MAX_BYTES as W, CLOUDFLARE_AI_GATEWAY_PROVIDER_BRAND_ID as Wi, discoverFasedAgentPlugins as Wn, OPENAI_PROVIDER_BRAND_ID as Wr, modelKey as Wt, resolveAvatarMime as X, normalizeThinkLevel as Xi, assertSecretInputResolved as Xn, QIANFAN_MODEL_IDS as Xr, resolveExplicitConfiguredModelRef as Xt, isWorkspaceRelativeAvatarPath as Y, listThinkingLevels as Yi, normalizeSecretInput as Yn, OPENROUTER_ROUTE_ID as Yr, resolveDefaultModelForAgent as Yt, validateJsonSchemaValue as Z, resolveModelThinkingCapability as Zi, coerceSecretRef as Zn, QIANFAN_PROVIDER_BRAND_ID as Zr, resolveModelRefFromString as Zt, TELEGRAM_COMMAND_NAME_PATTERN as _, isDangerousHostInheritedEnvVarName as _a, VOLCENGINE_PLAN_ROUTE_ID as _i, normalizeModelCatalogModelId as _n, GOOGLE_GEMINI_CLI_ROUTE_ID as _r, matchAllowlist as _t, readConfigFileSnapshotForWrite as a, resolvePluginInstallDir as aa, SYNTHETIC_ROUTE_ID as ai, getApiKeyForModel as an, BYTEPLUS_PLAN_ROUTE_ID as ar, unsetConfigValueAtPath as at, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS as b, formatCliCommand as ba, XAI_MODEL_IDS as bi, auth_profiles_exports as bn, HUGGINGFACE_PROVIDER_BRAND_ID as br, extractShellWrapperInlineCommand as bt, validateConfigObjectWithPlugins as c, extractErrorCode as ca, VENICE_PROVIDER_BRAND_ID as ci, resolveApiKeyForProvider as cn, CHUTES_MODEL_IDS as cr, isTrustedSafeBinPath as ct, GoogleChatConfigSchema as d, isErrno as da, VERCEL_AI_GATEWAY_ROUTE_ID as di, CURRENT_MODEL_PROVIDER_CATALOG as dn, COPILOT_PROVIDER_BRAND_ID as dr, validateSafeBinArgv as dt, DEFAULT_CONTEXT_TOKENS as ea, QWEN_API_ROUTE_ID as ei, resolveThinkingDefault as en, ANTHROPIC_PROVIDER_BRAND_ID as er, setConfigOverride as et, IMessageConfigSchema as f, extractArchive as fa, VLLM_PROVIDER_BRAND_ID as fi, cloneCurrentModelProvider as fn, COPILOT_PROXY_MODEL_IDS as fr, analyzeShellCommand as ft, TelegramConfigSchema as g, isDangerousHostEnvVarName as ga, VOLCENGINE_MODEL_IDS as gi, mergeModelCatalogRowsByAuthority as gn, GOOGLE_API_ROUTE_ID as gr, DEFAULT_SAFE_BINS as gt, SlackConfigSchema as h, isDangerousHostEnvOverrideVarName as ha, VOLCENGINE_CODING_ROUTE_ID as hi, buildModelCatalogMergeKey as hn, CUSTOM_PROVIDER_ROUTE_ID as hr, splitCommandChain as ht, readConfigFileSnapshot as i, installPluginFromNpmSpec as ia, SYNTHETIC_PROVIDER_BRAND_ID as ii, resolveImplicitProviders as in, BYTEPLUS_MODEL_IDS as ir, setConfigValueAtPath as it, MarkdownConfigSchema as j, listProviderBrandManifests as ji, markAuthProfileGood as jn, MINIMAX_PORTAL_ROUTE_ID as jr, mapStreamingModeToSlackLegacyDraftStreamMode as jt, DmPolicySchema as k, resolvePluginAdminRpcActionGrant as ka, isOpenAISignInRuntimeModelSupported as ki, listProfilesForProvider as kn, MINIMAX_CN_ROUTE_ID as kr, applyMergePatch as kt, WhatsAppConfigSchema as l, formatErrorMessage as la, VENICE_ROUTE_ID as li, resolveEnvApiKey as ln, CHUTES_PROVIDER_BRAND_ID as lr, listWritableExplicitTrustedSafeBinDirs as lt, SignalConfigSchema as m, resolveShellEnvFallbackTimeoutMs as ma, VOLCENGINE_CODING_MODEL_IDS as mi, listCurrentModelCatalogRows as mn, CUSTOM_PROVIDER_BRAND_ID as mr, isWindowsPlatform as mt, loadConfig as n, DEFAULT_PROVIDER as na, QWEN_CODING_PLAN_ROUTE_ID as ni, normalizeProviders as nn, BYTEPLUS_CODING_MODEL_IDS as nr, getConfigValueAtPath as nt, resolveConfigSnapshotHash as o, getPackageManifestMetadata as oa, TOGETHER_PROVIDER_BRAND_ID as oi, getCustomProviderApiKey as on, BYTEPLUS_PROVIDER_BRAND_ID as or, ensurePluginAllowlisted as ot, MSTeamsConfigSchema as p, getShellPathFromLoginShell as pa, VLLM_ROUTE_ID as pi, listCurrentModelCatalogProviderIds as pn, COPILOT_PROXY_ROUTE_ID as pr, buildEnforcedShellCommand as pt, isPathWithinRoot as q, formatThinkingLevels as qi, resolveAuthProfileDisplayLabel as qn, OPENROUTER_MODEL_IDS as qr, parseModelRef as qt, parseConfigJson5 as r, VERSION as ra, QWEN_PROVIDER_BRAND_ID as ri, resolveImplicitCopilotProvider as rn, BYTEPLUS_CODING_ROUTE_ID as rr, parseConfigPath as rt, writeConfigFile as s, MANIFEST_KEY as sa, TOGETHER_ROUTE_ID as si, requireApiKey as sn, BYTEPLUS_ROUTE_ID as sr, getTrustedSafeBinDirs as st, createConfigIO as t, DEFAULT_MODEL as ta, QWEN_CODING_PLAN_MODEL_IDS as ti, normalizeGoogleModelId as tn, ANTHROPIC_ROUTE_ID as tr, unsetConfigOverride as tt, DiscordConfigSchema as u, formatUncaughtError as ua, VERCEL_AI_GATEWAY_PROVIDER_BRAND_ID as ui, resolveModelAuthMode as un, CHUTES_ROUTE_ID as ur, normalizeTrustedSafeBinDirs as ut, normalizeTelegramCommandName as v, sanitizeHostExecEnv as va, VOLCENGINE_PROVIDER_BRAND_ID as vi, normalizeModelCatalogProviderId as vn, GOOGLE_GEMINI_MODEL_IDS as vr, resolveAllowlistCandidatePath as vt, resolveIMessageRemoteAttachmentRoots as w, applyTestPluginDefaults as wa, XIAOMI_ROUTE_ID as wi, markAuthProfileFailure as wn, LITELLM_PROVIDER_BRAND_ID as wr, unwrapKnownShellMultiplexerInvocation as wt, isInboundPathAllowed as x, resolveCliName as xa, XAI_PROVIDER_BRAND_ID as xi, resolveAuthProfileOrder as xn, HUGGINGFACE_ROUTE_ID as xr, isDispatchWrapperExecutable as xt, resolveTelegramCustomCommands as y, resolveOwnerDisplaySetting as ya, VOLCENGINE_ROUTE_ID as yi, normalizeProviderCatalogRows as yn, GOOGLE_PROVIDER_BRAND_ID as yr, resolveCommandResolutionFromArgv as yt, requireOpenAllowFrom as z, TOGETHER_MODEL_IDS as zi, isPidAlive as zn, OLLAMA_PROVIDER_BRAND_ID as zr, buildConfiguredAllowlistKeys as zt };