@iaforged/context-code 1.0.62 → 1.0.65

package/dist/src/utils/plugins/pluginOptionsStorage.js

@@ -1,311 +0,0 @@
-/**
- * Plugin option storage and substitution.
- *
- * Plugins declare user-configurable options in `manifest.userConfig` — a record
- * of field schemas matching `McpbUserConfigurationOption`. At enable time the
- * user is prompted for values. Storage splits by `sensitive`:
- *   - `sensitive: true`  → secureStorage (keychain on macOS, .credentials.json elsewhere)
- *   - everything else    → settings.json `pluginConfigs[pluginId].options`
- *
- * `loadPluginOptions` reads and merges both. The substitution helpers are also
- * here (moved from mcpPluginIntegration.ts) so hooks/LSP/skills don't all
- * import from MCP-specific code.
- */
-import memoize from 'lodash-es/memoize.js';
-import { logForDebugging } from '../debug.js';
-import { logError } from '../log.js';
-import { getSecureStorage } from '../secureStorage/index.js';
-import { getSettings_DEPRECATED, updateSettingsForSource, } from '../settings/settings.js';
-import { validateUserConfig, } from './mcpbHandler.js';
-import { getPluginDataDir } from './pluginDirectories.js';
-/**
- * Canonical storage key for a plugin's options in both `settings.pluginConfigs`
- * and `secureStorage.pluginSecrets`. Today this is `plugin.source` — always
- * `"${name}@${marketplace}"` (pluginLoader.ts:1400). `plugin.repository` is
- * a backward-compat alias that's set to the same string (1401); don't use it
- * for storage. UI code that manually constructs `` `${name}@${marketplace}` ``
- * produces the same key by convention — see PluginOptionsFlow, ManagePlugins.
- *
- * Exists so there's exactly one place to change if the key format ever drifts.
- */
-export function getPluginStorageId(plugin) {
-    return plugin.source;
-}
-/**
- * Load saved option values for a plugin, merging non-sensitive (from settings)
- * with sensitive (from secureStorage). SecureStorage wins on key collision.
- *
- * Memoized per-pluginId because hooks can fire per-tool-call and each call
- * would otherwise do a settings read + keychain spawn. Cache cleared via
- * `clearPluginOptionsCache` when settings change or plugins reload.
- */
-export const loadPluginOptions = memoize((pluginId) => {
-    const settings = getSettings_DEPRECATED();
-    const nonSensitive = settings.pluginConfigs?.[pluginId]?.options ?? {};
-    // NOTE: storage.read() spawns `security find-generic-password` on macOS
-    // (~50-100ms, synchronous). Mitigated by the memoize above (per-pluginId,
-    // session-lifetime) + keychain's own 30s TTL cache — so one blocking spawn
-    // per session per plugin-with-options. /reload-plugins clears the memoize
-    // and the next hook/MCP-load after that eats a fresh spawn.
-    const storage = getSecureStorage();
-    const sensitive = storage.read()?.pluginSecrets?.[pluginId] ??
-        {};
-    // secureStorage wins on collision — schema determines destination so
-    // collision shouldn't happen, but if a user hand-edits settings.json we
-    // trust the more secure source.
-    return { ...nonSensitive, ...sensitive };
-});
-export function clearPluginOptionsCache() {
-    loadPluginOptions.cache?.clear?.();
-}
-/**
- * Save option values, splitting by `schema[key].sensitive`. Non-sensitive go
- * to userSettings; sensitive go to secureStorage. Writes are skipped if nothing
- * in that category is present.
- *
- * Clears the load cache on success so the next `loadPluginOptions` sees fresh.
- */
-export function savePluginOptions(pluginId, values, schema) {
-    const nonSensitive = {};
-    const sensitive = {};
-    for (const [key, value] of Object.entries(values)) {
-        if (schema[key]?.sensitive === true) {
-            sensitive[key] = String(value);
-        }
-        else {
-            nonSensitive[key] = value;
-        }
-    }
-    // Scrub sets — see saveMcpServerUserConfig (mcpbHandler.ts) for the
-    // rationale. Only keys in THIS save are scrubbed from the other store,
-    // so partial reconfigures don't lose data.
-    const sensitiveKeysInThisSave = new Set(Object.keys(sensitive));
-    const nonSensitiveKeysInThisSave = new Set(Object.keys(nonSensitive));
-    // secureStorage FIRST — if keychain fails, throw before touching
-    // settings.json so old plaintext (if any) stays as fallback.
-    const storage = getSecureStorage();
-    const existingInSecureStorage = storage.read()?.pluginSecrets?.[pluginId] ?? undefined;
-    const secureScrubbed = existingInSecureStorage
-        ? Object.fromEntries(Object.entries(existingInSecureStorage).filter(([k]) => !nonSensitiveKeysInThisSave.has(k)))
-        : undefined;
-    const needSecureScrub = secureScrubbed &&
-        existingInSecureStorage &&
-        Object.keys(secureScrubbed).length !==
-            Object.keys(existingInSecureStorage).length;
-    if (Object.keys(sensitive).length > 0 || needSecureScrub) {
-        const existing = storage.read() ?? {};
-        if (!existing.pluginSecrets) {
-            existing.pluginSecrets = {};
-        }
-        existing.pluginSecrets[pluginId] = {
-            ...secureScrubbed,
-            ...sensitive,
-        };
-        const result = storage.update(existing);
-        if (!result.success) {
-            const err = new Error(`Failed to save sensitive plugin options for ${pluginId} to secure storage`);
-            logError(err);
-            throw err;
-        }
-        if (result.warning) {
-            logForDebugging(`Plugin secrets save warning: ${result.warning}`, {
-                level: 'warn',
-            });
-        }
-    }
-    // settings.json AFTER secureStorage — scrub sensitive keys via explicit
-    // undefined (mergeWith deletion pattern).
-    //
-    // TODO: getSettings_DEPRECATED returns MERGED settings across all scopes.
-    // Mutating that and writing to userSettings can leak project-scope
-    // pluginConfigs into ~/.claude/settings.json. Same pattern exists in
-    // saveMcpServerUserConfig. Safe today since pluginConfigs is only ever
-    // written here (user-scope), but will bite if we add project-scoped
-    // plugin options.
-    const settings = getSettings_DEPRECATED();
-    const existingInSettings = settings.pluginConfigs?.[pluginId]?.options ?? {};
-    const keysToScrubFromSettings = Object.keys(existingInSettings).filter(k => sensitiveKeysInThisSave.has(k));
-    if (Object.keys(nonSensitive).length > 0 ||
-        keysToScrubFromSettings.length > 0) {
-        if (!settings.pluginConfigs) {
-            settings.pluginConfigs = {};
-        }
-        if (!settings.pluginConfigs[pluginId]) {
-            settings.pluginConfigs[pluginId] = {};
-        }
-        const scrubbed = Object.fromEntries(keysToScrubFromSettings.map(k => [k, undefined]));
-        settings.pluginConfigs[pluginId].options = {
-            ...nonSensitive,
-            ...scrubbed,
-        };
-        const result = updateSettingsForSource('userSettings', settings);
-        if (result.error) {
-            logError(result.error);
-            throw new Error(`Failed to save plugin options for ${pluginId}: ${result.error.message}`);
-        }
-    }
-    clearPluginOptionsCache();
-}
-/**
- * Delete all stored option values for a plugin — both the non-sensitive
- * `settings.pluginConfigs[pluginId]` entry and the sensitive
- * `secureStorage.pluginSecrets[pluginId]` entry.
- *
- * Call this when the LAST installation of a plugin is uninstalled (i.e.,
- * alongside `markPluginVersionOrphaned`). Don't call on every uninstall —
- * a plugin can be installed in multiple scopes and the user's config should
- * survive removing it from one scope while it remains in another.
- *
- * Best-effort: keychain write failure is logged but doesn't throw, since
- * the uninstall itself succeeded and we don't want to surface a confusing
- * "uninstall failed" message for a cleanup side-effect.
- */
-export function deletePluginOptions(pluginId) {
-    // Settings side — also wipes the legacy mcpServers sub-key (same story:
-    // orphaned on uninstall, never cleaned up before this PR).
-    //
-    // Use `undefined` (not `delete`) because `updateSettingsForSource` merges
-    // via `mergeWith` — absent keys are ignored, only `undefined` triggers
-    // removal. Cast is deliberate (CLAUDE.md's 10% case): adding z.undefined()
-    // to the schema instead (like enabledPlugins:466 does) leaks
-    // `| {[k: string]: unknown}` into the public SDK type, which subsumes the
-    // real object arm and kills excess-property checks for SDK consumers. The
-    // mergeWith-deletion contract is internal plumbing — it shouldn't shape
-    // the Zod schema. enabledPlugins gets away with it only because its other
-    // arms (string[] | boolean) are non-objects that stay distinct.
-    const settings = getSettings_DEPRECATED();
-    if (settings.pluginConfigs?.[pluginId]) {
-        // Partial<Record<K,V>> = Record<K, V | undefined> — gives us the widening
-        // for the undefined value, and Partial-of-X overlaps with X so the cast
-        // is a narrowing TS accepts (same approach as marketplaceManager.ts:1795).
-        const pluginConfigs = { [pluginId]: undefined };
-        const { error } = updateSettingsForSource('userSettings', {
-            pluginConfigs: pluginConfigs,
-        });
-        if (error) {
-            logForDebugging(`deletePluginOptions: failed to clear settings.pluginConfigs[${pluginId}]: ${error.message}`, { level: 'warn' });
-        }
-    }
-    // Secure storage side — delete both the top-level pluginSecrets[pluginId]
-    // and any per-server composite keys `${pluginId}/${server}` (from
-    // saveMcpServerUserConfig's sensitive split). `/` prefix match is safe:
-    // plugin IDs are `name@marketplace`, never contain `/`, so
-    // startsWith(`${id}/`) can't false-positive on a different plugin.
-    const storage = getSecureStorage();
-    const existing = storage.read();
-    if (existing?.pluginSecrets) {
-        const prefix = `${pluginId}/`;
-        const survivingEntries = Object.entries(existing.pluginSecrets).filter(([k]) => k !== pluginId && !k.startsWith(prefix));
-        if (survivingEntries.length !== Object.keys(existing.pluginSecrets).length) {
-            const result = storage.update({
-                ...existing,
-                pluginSecrets: survivingEntries.length > 0
-                    ? Object.fromEntries(survivingEntries)
-                    : undefined,
-            });
-            if (!result.success) {
-                logForDebugging(`deletePluginOptions: failed to clear pluginSecrets for ${pluginId} from keychain`, { level: 'warn' });
-            }
-        }
-    }
-    clearPluginOptionsCache();
-}
-/**
- * Find option keys whose saved values don't satisfy the schema — i.e., what to
- * prompt for. Returns the schema slice for those keys, or empty if everything
- * validates. Empty manifest.userConfig → empty result.
- *
- * Used by PluginOptionsFlow to decide whether to show the prompt after enable.
- */
-export function getUnconfiguredOptions(plugin) {
-    const manifestSchema = plugin.manifest.userConfig;
-    if (!manifestSchema || Object.keys(manifestSchema).length === 0) {
-        return {};
-    }
-    const saved = loadPluginOptions(getPluginStorageId(plugin));
-    const validation = validateUserConfig(saved, manifestSchema);
-    if (validation.valid) {
-        return {};
-    }
-    // Return only the fields that failed. validateUserConfig reports errors as
-    // strings keyed by title/key — simpler to just re-check each field here than
-    // parse error strings.
-    const unconfigured = {};
-    for (const [key, fieldSchema] of Object.entries(manifestSchema)) {
-        const single = validateUserConfig({ [key]: saved[key] }, { [key]: fieldSchema });
-        if (!single.valid) {
-            unconfigured[key] = fieldSchema;
-        }
-    }
-    return unconfigured;
-}
-/**
- * Substitute ${CLAUDE_PLUGIN_ROOT} and ${CLAUDE_PLUGIN_DATA} with their paths.
- * On Windows, normalizes backslashes to forward slashes so shell commands
- * don't interpret them as escape characters.
- *
- * ${CLAUDE_PLUGIN_ROOT} — version-scoped install dir (recreated on update)
- * ${CLAUDE_PLUGIN_DATA} — persistent state dir (survives updates)
- *
- * Both patterns use the function-replacement form of .replace(): ROOT so
- * `$`-patterns in NTFS paths ($$, $', $`, $&) aren't interpreted; DATA so
- * getPluginDataDir (which lazily mkdirs) only runs when actually present.
- *
- * Used in MCP/LSP server command/args/env, hook commands, skill/agent content.
- */
-export function substitutePluginVariables(value, plugin) {
-    const normalize = (p) => process.platform === 'win32' ? p.replace(/\\/g, '/') : p;
-    let out = value.replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, () => normalize(plugin.path));
-    // source can be absent (e.g. hooks where pluginRoot is a skill root without
-    // a plugin context). In that case ${CLAUDE_PLUGIN_DATA} is left literal.
-    if (plugin.source) {
-        const source = plugin.source;
-        out = out.replace(/\$\{CLAUDE_PLUGIN_DATA\}/g, () => normalize(getPluginDataDir(source)));
-    }
-    return out;
-}
-/**
- * Substitute ${user_config.KEY} with saved option values.
- *
- * Throws on missing keys — callers pass this only after `validateUserConfig`
- * succeeded, so a miss here means a plugin references a key it never declared
- * in its schema. That's a plugin authoring bug; failing loud surfaces it.
- *
- * Use `substituteUserConfigInContent` for skill/agent prose — it handles
- * missing keys and sensitive-filtering instead of throwing.
- */
-export function substituteUserConfigVariables(value, userConfig) {
-    return value.replace(/\$\{user_config\.([^}]+)\}/g, (_match, key) => {
-        const configValue = userConfig[key];
-        if (configValue === undefined) {
-            throw new Error(`Missing required user configuration value: ${key}. ` +
-                `This should have been validated before variable substitution.`);
-        }
-        return String(configValue);
-    });
-}
-/**
- * Content-safe variant for skill/agent prose. Differences from
- * `substituteUserConfigVariables`:
- *
- *   - Sensitive-marked keys substitute to a descriptive placeholder instead of
- *     the actual value — skill/agent content goes to the model prompt, and
- *     we don't put secrets in the model's context.
- *   - Unknown keys stay literal (no throw) — matches how `${VAR}` env refs
- *     behave today when the var is unset.
- *
- * A ref to a sensitive key produces obvious-looking output so plugin authors
- * notice and move the ref into a hook/MCP env instead.
- */
-export function substituteUserConfigInContent(content, options, schema) {
-    return content.replace(/\$\{user_config\.([^}]+)\}/g, (match, key) => {
-        if (schema[key]?.sensitive === true) {
-            return `[sensitive option '${key}' not available in skill content]`;
-        }
-        const value = options[key];
-        if (value === undefined) {
-            return match;
-        }
-        return String(value);
-    });
-}

package/dist/src/utils/plugins/pluginPolicy.js

@@ -1,18 +0,0 @@
-/**
- * Plugin policy checks backed by managed settings (policySettings).
- *
- * Kept as a leaf module (only imports settings) to avoid circular dependencies
- * — marketplaceHelpers.ts imports marketplaceManager.ts which transitively
- * reaches most of the plugin subsystem.
- */
-import { getSettingsForSource } from '../settings/settings.js';
-/**
- * Check if a plugin is force-disabled by org policy (managed-settings.json).
- * Policy-blocked plugins cannot be installed or enabled by the user at any
- * scope. Used as the single source of truth for policy blocking across the
- * install chokepoint, enable op, and UI filters.
- */
-export function isPluginBlockedByPolicy(pluginId) {
-    const policyEnabled = getSettingsForSource('policySettings')?.enabledPlugins;
-    return policyEnabled?.[pluginId] === false;
-}

package/dist/src/utils/plugins/pluginStartupCheck.js

@@ -1,261 +0,0 @@
-import { join } from 'path';
-import { getCwd } from '../cwd.js';
-import { logForDebugging } from '../debug.js';
-import { logError } from '../log.js';
-import { getInitialSettings, getSettingsForSource, updateSettingsForSource, } from '../settings/settings.js';
-import { getAddDirEnabledPlugins } from './addDirPluginSettings.js';
-import { getInMemoryInstalledPlugins, migrateFromEnabledPlugins, } from './installedPluginsManager.js';
-import { getPluginById } from './marketplaceManager.js';
-import { SETTING_SOURCE_TO_SCOPE, scopeToSettingSource, } from './pluginIdentifier.js';
-import { cacheAndRegisterPlugin, registerPluginInstallation, } from './pluginInstallationHelpers.js';
-import { isLocalPluginSource } from './schemas.js';
-/**
- * Checks for enabled plugins across all settings sources, including --add-dir.
- *
- * Uses getInitialSettings() which merges all sources with policy as
- * highest priority, then layers --add-dir plugins underneath. This is the
- * authoritative "is this plugin enabled?" check — don't delegate to
- * getPluginEditableScopes() which serves a different purpose (scope tracking).
- *
- * @returns Array of plugin IDs (plugin@marketplace format) that are enabled
- */
-export async function checkEnabledPlugins() {
-    const settings = getInitialSettings();
-    const enabledPlugins = [];
-    // Start with --add-dir plugins (lowest priority)
-    const addDirPlugins = getAddDirEnabledPlugins();
-    for (const [pluginId, value] of Object.entries(addDirPlugins)) {
-        if (pluginId.includes('@') && value) {
-            enabledPlugins.push(pluginId);
-        }
-    }
-    // Merged settings (policy > local > project > user) override --add-dir
-    if (settings.enabledPlugins) {
-        for (const [pluginId, value] of Object.entries(settings.enabledPlugins)) {
-            if (!pluginId.includes('@')) {
-                continue;
-            }
-            const idx = enabledPlugins.indexOf(pluginId);
-            if (value) {
-                if (idx === -1) {
-                    enabledPlugins.push(pluginId);
-                }
-            }
-            else {
-                // Explicitly disabled — remove even if --add-dir enabled it
-                if (idx !== -1) {
-                    enabledPlugins.splice(idx, 1);
-                }
-            }
-        }
-    }
-    return enabledPlugins;
-}
-/**
- * Gets the user-editable scope that "owns" each enabled plugin.
- *
- * Used for scope tracking: determining where to write back when a user
- * enables/disables a plugin. Managed (policy) settings are processed first
- * (lowest priority) because the user cannot edit them — the scope should
- * resolve to the highest user-controllable source.
- *
- * NOTE: This is NOT the authoritative "is this plugin enabled?" check.
- * Use checkEnabledPlugins() for that — it uses merged settings where
- * policy has highest priority and can block user-enabled plugins.
- *
- * Precedence (lowest to highest):
- * 0. addDir (--add-dir directories) - session-only, lowest priority
- * 1. managed (policySettings) - not user-editable
- * 2. user (userSettings)
- * 3. project (projectSettings)
- * 4. local (localSettings)
- * 5. flag (flagSettings) - session-only, not persisted
- *
- * @returns Map of plugin ID to the user-editable scope that owns it
- */
-export function getPluginEditableScopes() {
-    const result = new Map();
-    // Process --add-dir directories FIRST (lowest priority, overridden by all standard sources)
-    const addDirPlugins = getAddDirEnabledPlugins();
-    for (const [pluginId, value] of Object.entries(addDirPlugins)) {
-        if (!pluginId.includes('@')) {
-            continue;
-        }
-        if (value === true) {
-            result.set(pluginId, 'flag'); // 'flag' scope = session-only, no write-back
-        }
-        else if (value === false) {
-            result.delete(pluginId);
-        }
-    }
-    // Process standard sources in precedence order (later overrides earlier)
-    const scopeSources = [
-        { scope: 'managed', source: 'policySettings' },
-        { scope: 'user', source: 'userSettings' },
-        { scope: 'project', source: 'projectSettings' },
-        { scope: 'local', source: 'localSettings' },
-        { scope: 'flag', source: 'flagSettings' },
-    ];
-    for (const { scope, source } of scopeSources) {
-        const settings = getSettingsForSource(source);
-        if (!settings?.enabledPlugins) {
-            continue;
-        }
-        for (const [pluginId, value] of Object.entries(settings.enabledPlugins)) {
-            // Skip invalid format
-            if (!pluginId.includes('@')) {
-                continue;
-            }
-            // Log when a standard source overrides an --add-dir plugin
-            if (pluginId in addDirPlugins && addDirPlugins[pluginId] !== value) {
-                logForDebugging(`Plugin ${pluginId} from --add-dir (${addDirPlugins[pluginId]}) overridden by ${source} (${value})`);
-            }
-            if (value === true) {
-                // Plugin enabled at this scope
-                result.set(pluginId, scope);
-            }
-            else if (value === false) {
-                // Explicitly disabled - remove from result
-                result.delete(pluginId);
-            }
-            // Note: Other values (like version strings for future P2) are ignored for now
-        }
-    }
-    logForDebugging(`Found ${result.size} enabled plugins with scopes: ${Array.from(result.entries())
-        .map(([id, scope]) => `${id}(${scope})`)
-        .join(', ')}`);
-    return result;
-}
-/**
- * Check if a scope is persistable (not session-only).
- * @param scope The scope to check
- * @returns true if the scope should be persisted to installed_plugins.json
- */
-export function isPersistableScope(scope) {
-    return scope !== 'flag';
-}
-/**
- * Convert SettingSource to plugin scope.
- * @param source The settings source
- * @returns The corresponding plugin scope
- */
-export function settingSourceToScope(source) {
-    return SETTING_SOURCE_TO_SCOPE[source];
-}
-/**
- * Gets the list of currently installed plugins
- * Reads from installed_plugins.json which tracks global installation state.
- * Automatically runs migration on first call if needed.
- *
- * Always uses V2 format and initializes the in-memory session state
- * (which triggers V1→V2 migration if needed).
- *
- * @returns Array of installed plugin IDs
- */
-export async function getInstalledPlugins() {
-    // Trigger sync in background (don't await - don't block startup)
-    // This syncs enabledPlugins from settings.json to installed_plugins.json
-    void migrateFromEnabledPlugins().catch(error => {
-        logError(error);
-    });
-    // Always use V2 format - initializes in-memory session state and triggers V1→V2 migration
-    const v2Data = getInMemoryInstalledPlugins();
-    const installed = Object.keys(v2Data.plugins);
-    logForDebugging(`Found ${installed.length} installed plugins`);
-    return installed;
-}
-/**
- * Finds plugins that are enabled but not installed
- * @param enabledPlugins Array of enabled plugin IDs
- * @returns Array of missing plugin IDs
- */
-export async function findMissingPlugins(enabledPlugins) {
-    try {
-        const installedPlugins = await getInstalledPlugins();
-        // Filter to not-installed synchronously, then look up all in parallel.
-        // Results are collected in original enabledPlugins order.
-        const notInstalled = enabledPlugins.filter(id => !installedPlugins.includes(id));
-        const lookups = await Promise.all(notInstalled.map(async (pluginId) => {
-            try {
-                const plugin = await getPluginById(pluginId);
-                return { pluginId, found: plugin !== null && plugin !== undefined };
-            }
-            catch (error) {
-                logForDebugging(`Failed to check plugin ${pluginId} in marketplace: ${error}`);
-                // Plugin doesn't exist in any marketplace, will be handled as an error
-                return { pluginId, found: false };
-            }
-        }));
-        const missing = lookups
-            .filter(({ found }) => found)
-            .map(({ pluginId }) => pluginId);
-        return missing;
-    }
-    catch (error) {
-        logError(error);
-        return [];
-    }
-}
-/**
- * Installs the selected plugins
- * @param pluginsToInstall Array of plugin IDs to install
- * @param onProgress Optional callback for installation progress
- * @param scope Installation scope: user, project, or local (defaults to 'user')
- * @returns Installation results with succeeded and failed plugins
- */
-export async function installSelectedPlugins(pluginsToInstall, onProgress, scope = 'user') {
-    // Get projectPath for non-user scopes
-    const projectPath = scope !== 'user' ? getCwd() : undefined;
-    // Get the correct settings source for this scope
-    const settingSource = scopeToSettingSource(scope);
-    const settings = getSettingsForSource(settingSource);
-    const updatedEnabledPlugins = { ...settings?.enabledPlugins };
-    const installed = [];
-    const failed = [];
-    for (let i = 0; i < pluginsToInstall.length; i++) {
-        const pluginId = pluginsToInstall[i];
-        if (!pluginId)
-            continue;
-        if (onProgress) {
-            onProgress(pluginId, i + 1, pluginsToInstall.length);
-        }
-        try {
-            const pluginInfo = await getPluginById(pluginId);
-            if (!pluginInfo) {
-                failed.push({
-                    name: pluginId,
-                    error: 'Plugin not found in any marketplace',
-                });
-                continue;
-            }
-            // Cache the plugin if it's from an external source
-            const { entry, marketplaceInstallLocation } = pluginInfo;
-            if (!isLocalPluginSource(entry.source)) {
-                // External plugin - cache and register it with scope
-                await cacheAndRegisterPlugin(pluginId, entry, scope, projectPath);
-            }
-            else {
-                // Local plugin - just register it with the install path and scope
-                registerPluginInstallation({
-                    pluginId,
-                    installPath: join(marketplaceInstallLocation, entry.source),
-                    version: entry.version,
-                }, scope, projectPath);
-            }
-            // Mark as enabled in settings
-            updatedEnabledPlugins[pluginId] = true;
-            installed.push(pluginId);
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            failed.push({ name: pluginId, error: errorMessage });
-            logError(error);
-        }
-    }
-    // Update settings with newly enabled plugins using the correct settings source
-    updateSettingsForSource(settingSource, {
-        ...settings,
-        enabledPlugins: updatedEnabledPlugins,
-    });
-    return { installed, failed };
-}