@iaforged/context-code 1.0.72 → 1.0.74

package/dist/src/utils/plugins/pluginDirectories.js

@@ -0,0 +1,172 @@
+/**
+ * Centralized plugin directory configuration.
+ *
+ * This module provides the single source of truth for the plugins directory path.
+ * It supports switching between 'plugins' and 'cowork_plugins' directories via:
+ * - CLI flag: --cowork
+ * - Environment variable: CONTEXT_CODE_USE_COWORK_PLUGINS (legacy alias: CLAUDE_CODE_USE_COWORK_PLUGINS)
+ *
+ * The base directory can be overridden via CONTEXT_CODE_PLUGIN_CACHE_DIR
+ * (legacy alias: CLAUDE_CODE_PLUGIN_CACHE_DIR).
+ */
+import { mkdirSync } from 'fs';
+import { readdir, rm, stat } from 'fs/promises';
+import { delimiter, join } from 'path';
+import { getUseCoworkPlugins } from '../../bootstrap/state.js';
+import { logForDebugging } from '../debug.js';
+import { getClaudeConfigHomeDir, isEnvTruthy } from '../envUtils.js';
+import { errorMessage, isFsInaccessible } from '../errors.js';
+import { formatFileSize } from '../format.js';
+import { expandTilde } from '../permissions/pathValidation.js';
+const PLUGINS_DIR = 'plugins';
+const COWORK_PLUGINS_DIR = 'cowork_plugins';
+/**
+ * Get the plugins directory name based on current mode.
+ * Uses session state (from --cowork flag) or env var.
+ *
+ * Priority:
+ * 1. Session state (set by CLI flag --cowork)
+ * 2. Environment variable CLAUDE_CODE_USE_COWORK_PLUGINS
+ * 3. Default: 'plugins'
+ */
+function getPluginsDirectoryName() {
+    // Session state takes precedence (set by CLI flag)
+    if (getUseCoworkPlugins()) {
+        return COWORK_PLUGINS_DIR;
+    }
+    // Fall back to env var (CONTEXT_* preferred, CLAUDE_* legacy)
+    if (isEnvTruthy(process.env.CONTEXT_CODE_USE_COWORK_PLUGINS) ||
+        isEnvTruthy(process.env.CLAUDE_CODE_USE_COWORK_PLUGINS)) {
+        return COWORK_PLUGINS_DIR;
+    }
+    return PLUGINS_DIR;
+}
+/**
+ * Get the full path to the plugins directory.
+ *
+ * Priority:
+ * 1. CLAUDE_CODE_PLUGIN_CACHE_DIR env var (explicit override)
+ * 2. Default: ~/.context/plugins or ~/.context/cowork_plugins
+ */
+export function getPluginsDirectory() {
+    // expandTilde: when CLAUDE_CODE_PLUGIN_CACHE_DIR is set via settings.json
+    // `env` (not shell), ~ is not expanded by the shell. Without this, a value
+    // like "~/.context/plugins" becomes a literal `~` directory created in the
+    // cwd of every project (gh-30794 / CC-212).
+    const envOverride = process.env.CLAUDE_CODE_PLUGIN_CACHE_DIR;
+    if (envOverride) {
+        return expandTilde(envOverride);
+    }
+    return join(getClaudeConfigHomeDir(), getPluginsDirectoryName());
+}
+/**
+ * Get the read-only plugin seed directories, if configured.
+ *
+ * Customers can pre-bake a populated plugins directory into their container
+ * image and point CLAUDE_CODE_PLUGIN_SEED_DIR at it. CC will use it as a
+ * read-only fallback layer under the primary plugins directory — marketplaces
+ * and plugin caches found in the seed are used in place without re-cloning.
+ *
+ * Multiple seed directories can be layered using the platform path delimiter
+ * (':' on Unix, ';' on Windows), in PATH-like precedence order — the first
+ * seed that contains a given marketplace or plugin cache wins.
+ *
+ * Seed structure mirrors the primary plugins directory:
+ *   $CLAUDE_CODE_PLUGIN_SEED_DIR/
+ *     known_marketplaces.json
+ *     marketplaces/<name>/...
+ *     cache/<marketplace>/<plugin>/<version>/...
+ *
+ * @returns Absolute paths to seed dirs in precedence order (empty if unset)
+ */
+export function getPluginSeedDirs() {
+    // Same tilde-expansion rationale as getPluginsDirectory (gh-30794).
+    const raw = process.env.CLAUDE_CODE_PLUGIN_SEED_DIR;
+    if (!raw)
+        return [];
+    return raw.split(delimiter).filter(Boolean).map(expandTilde);
+}
+function sanitizePluginId(pluginId) {
+    // Same character class as the install-cache sanitizer (pluginLoader.ts)
+    return pluginId.replace(/[^a-zA-Z0-9\-_]/g, '-');
+}
+/** Pure path — no mkdir. For display (e.g. uninstall dialog). */
+export function pluginDataDirPath(pluginId) {
+    return join(getPluginsDirectory(), 'data', sanitizePluginId(pluginId));
+}
+/**
+ * Persistent per-plugin data directory, exposed to plugins as
+ * ${CLAUDE_PLUGIN_DATA}. Unlike the version-scoped install cache
+ * (${CLAUDE_PLUGIN_ROOT}, which is orphaned and GC'd on every update),
+ * this survives plugin updates — only removed on last-scope uninstall.
+ *
+ * Creates the directory on call (mkdir). The *lazy* behavior is at the
+ * substitutePluginVariables call site — the DATA pattern uses function-form
+ * .replace() so this isn't invoked unless ${CLAUDE_PLUGIN_DATA} is present
+ * (ROOT also uses function-form, but for $-pattern safety, not laziness).
+ * Env-var export sites (MCP/LSP server env, hook env) call this eagerly
+ * since subprocesses may expect the dir to exist before writing to it.
+ *
+ * Sync because it's called from substitutePluginVariables (sync, inside
+ * String.replace) — making this async would cascade through 6 call sites
+ * and their sync iteration loops. One mkdir in plugin-load path is cheap.
+ */
+export function getPluginDataDir(pluginId) {
+    const dir = pluginDataDirPath(pluginId);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/**
+ * Size of the data dir for the uninstall confirmation prompt. Returns null
+ * when the dir is absent or empty so callers can skip the prompt entirely.
+ * Recursive walk — not hot-path (only on uninstall).
+ */
+export async function getPluginDataDirSize(pluginId) {
+    const dir = pluginDataDirPath(pluginId);
+    let bytes = 0;
+    const walk = async (p) => {
+        for (const entry of await readdir(p, { withFileTypes: true })) {
+            const full = join(p, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full);
+            }
+            else {
+                // Per-entry catch: a broken symlink makes stat() throw ENOENT.
+                // Without this, one broken link bubbles to the outer catch →
+                // returns null → dialog skipped → data silently deleted.
+                try {
+                    bytes += (await stat(full)).size;
+                }
+                catch {
+                    // Broken symlink / raced delete — skip this entry, keep walking
+                }
+            }
+        }
+    };
+    try {
+        await walk(dir);
+    }
+    catch (e) {
+        if (isFsInaccessible(e))
+            return null;
+        throw e;
+    }
+    if (bytes === 0)
+        return null;
+    return { bytes, human: formatFileSize(bytes) };
+}
+/**
+ * Best-effort cleanup on last-scope uninstall. Failure is logged but does
+ * not throw — the uninstall itself already succeeded; we don't want a
+ * cleanup side-effect surfacing as "uninstall failed". Same rationale as
+ * deletePluginOptions (pluginOptionsStorage.ts).
+ */
+export async function deletePluginDataDir(pluginId) {
+    const dir = pluginDataDirPath(pluginId);
+    try {
+        await rm(dir, { recursive: true, force: true });
+    }
+    catch (e) {
+        logForDebugging(`Failed to delete plugin data dir ${dir}: ${errorMessage(e)}`, { level: 'warn' });
+    }
+}

package/dist/src/utils/plugins/pluginFlagging.js

@@ -0,0 +1,173 @@
+/**
+ * Flagged plugin tracking utilities
+ *
+ * Tracks plugins that were auto-removed because they were delisted from
+ * their marketplace. Data is stored in ~/.context/plugins/flagged-plugins.json.
+ * Flagged plugins appear in a "Flagged" section in /plugins until the user
+ * dismisses them.
+ *
+ * Uses a module-level cache so that getFlaggedPlugins() can be called
+ * synchronously during React render. The cache is populated on the first
+ * async call (loadFlaggedPlugins or addFlaggedPlugin) and kept in sync
+ * with writes.
+ */
+import { randomBytes } from 'crypto';
+import { readFile, rename, unlink, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { logForDebugging } from '../debug.js';
+import { getFsImplementation } from '../fsOperations.js';
+import { logError } from '../log.js';
+import { jsonParse, jsonStringify } from '../slowOperations.js';
+import { getPluginsDirectory } from './pluginDirectories.js';
+const FLAGGED_PLUGINS_FILENAME = 'flagged-plugins.json';
+const SEEN_EXPIRY_MS = 48 * 60 * 60 * 1000; // 48 hours
+// Module-level cache — populated by loadFlaggedPlugins(), updated by writes.
+let cache = null;
+function getFlaggedPluginsPath() {
+    return join(getPluginsDirectory(), FLAGGED_PLUGINS_FILENAME);
+}
+function parsePluginsData(content) {
+    const parsed = jsonParse(content);
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        !('plugins' in parsed) ||
+        typeof parsed.plugins !== 'object' ||
+        parsed.plugins === null) {
+        return {};
+    }
+    const plugins = parsed.plugins;
+    const result = {};
+    for (const [id, entry] of Object.entries(plugins)) {
+        if (entry &&
+            typeof entry === 'object' &&
+            'flaggedAt' in entry &&
+            typeof entry.flaggedAt === 'string') {
+            const parsed = {
+                flaggedAt: entry.flaggedAt,
+            };
+            if ('seenAt' in entry &&
+                typeof entry.seenAt === 'string') {
+                parsed.seenAt = entry.seenAt;
+            }
+            result[id] = parsed;
+        }
+    }
+    return result;
+}
+async function readFromDisk() {
+    try {
+        const content = await readFile(getFlaggedPluginsPath(), {
+            encoding: 'utf-8',
+        });
+        return parsePluginsData(content);
+    }
+    catch {
+        return {};
+    }
+}
+async function writeToDisk(plugins) {
+    const filePath = getFlaggedPluginsPath();
+    const tempPath = `${filePath}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+        await getFsImplementation().mkdir(getPluginsDirectory());
+        const content = jsonStringify({ plugins }, null, 2);
+        await writeFile(tempPath, content, {
+            encoding: 'utf-8',
+            mode: 0o600,
+        });
+        await rename(tempPath, filePath);
+        cache = plugins;
+    }
+    catch (error) {
+        logError(error);
+        try {
+            await unlink(tempPath);
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    }
+}
+/**
+ * Load flagged plugins from disk into the module cache.
+ * Must be called (and awaited) before getFlaggedPlugins() returns
+ * meaningful data. Called by useManagePlugins during plugin refresh.
+ */
+export async function loadFlaggedPlugins() {
+    const all = await readFromDisk();
+    const now = Date.now();
+    let changed = false;
+    for (const [id, entry] of Object.entries(all)) {
+        if (entry.seenAt &&
+            now - new Date(entry.seenAt).getTime() >= SEEN_EXPIRY_MS) {
+            delete all[id];
+            changed = true;
+        }
+    }
+    cache = all;
+    if (changed) {
+        await writeToDisk(all);
+    }
+}
+/**
+ * Get all flagged plugins from the in-memory cache.
+ * Returns an empty object if loadFlaggedPlugins() has not been called yet.
+ */
+export function getFlaggedPlugins() {
+    return cache ?? {};
+}
+/**
+ * Add a plugin to the flagged list.
+ *
+ * @param pluginId "name@marketplace" format
+ */
+export async function addFlaggedPlugin(pluginId) {
+    if (cache === null) {
+        cache = await readFromDisk();
+    }
+    const updated = {
+        ...cache,
+        [pluginId]: {
+            flaggedAt: new Date().toISOString(),
+        },
+    };
+    await writeToDisk(updated);
+    logForDebugging(`Flagged plugin: ${pluginId}`);
+}
+/**
+ * Mark flagged plugins as seen. Called when the Installed view renders
+ * flagged plugins. Sets seenAt on entries that don't already have it.
+ * After 48 hours from seenAt, entries are auto-cleared on next load.
+ */
+export async function markFlaggedPluginsSeen(pluginIds) {
+    if (cache === null) {
+        cache = await readFromDisk();
+    }
+    const now = new Date().toISOString();
+    let changed = false;
+    const updated = { ...cache };
+    for (const id of pluginIds) {
+        const entry = updated[id];
+        if (entry && !entry.seenAt) {
+            updated[id] = { ...entry, seenAt: now };
+            changed = true;
+        }
+    }
+    if (changed) {
+        await writeToDisk(updated);
+    }
+}
+/**
+ * Remove a plugin from the flagged list. Called when the user dismisses
+ * a flagged plugin notification in /plugins.
+ */
+export async function removeFlaggedPlugin(pluginId) {
+    if (cache === null) {
+        cache = await readFromDisk();
+    }
+    if (!(pluginId in cache))
+        return;
+    const { [pluginId]: _, ...rest } = cache;
+    cache = rest;
+    await writeToDisk(rest);
+}

package/dist/src/utils/plugins/pluginIdentifier.js

@@ -0,0 +1,78 @@
+import { ALLOWED_OFFICIAL_MARKETPLACE_NAMES, } from './schemas.js';
+/**
+ * Map from SettingSource to plugin scope.
+ * Note: flagSettings maps to 'flag' which is session-only and not persisted.
+ */
+export const SETTING_SOURCE_TO_SCOPE = {
+    policySettings: 'managed',
+    userSettings: 'user',
+    projectSettings: 'project',
+    localSettings: 'local',
+    flagSettings: 'flag',
+};
+/**
+ * Parse a plugin identifier string into name and marketplace components
+ * @param plugin The plugin identifier (name or name@marketplace)
+ * @returns Parsed plugin name and optional marketplace
+ *
+ * Note: Only the first '@' is used as separator. If the input contains multiple '@' symbols
+ * (e.g., "plugin@market@place"), everything after the second '@' is ignored.
+ * This is intentional as marketplace names should not contain '@'.
+ */
+export function parsePluginIdentifier(plugin) {
+    if (plugin.includes('@')) {
+        const parts = plugin.split('@');
+        return { name: parts[0] || '', marketplace: parts[1] };
+    }
+    return { name: plugin };
+}
+/**
+ * Build a plugin ID from name and marketplace
+ * @param name The plugin name
+ * @param marketplace Optional marketplace name
+ * @returns Plugin ID in format "name" or "name@marketplace"
+ */
+export function buildPluginId(name, marketplace) {
+    return marketplace ? `${name}@${marketplace}` : name;
+}
+/**
+ * Check if a marketplace name is an official (ContextCompany-controlled) marketplace.
+ * Used for telemetry redaction — official plugin identifiers are safe to log to
+ * general-access additional_metadata; third-party identifiers go only to the
+ * PII-tagged _PROTO_* BQ columns.
+ */
+export function isOfficialMarketplaceName(marketplace) {
+    return (marketplace !== undefined &&
+        ALLOWED_OFFICIAL_MARKETPLACE_NAMES.has(marketplace.toLowerCase()));
+}
+/**
+ * Map from installable plugin scope to editable setting source.
+ * This is the inverse of SETTING_SOURCE_TO_SCOPE for editable scopes only.
+ * Note: 'managed' scope cannot be installed to, so it's not included here.
+ */
+const SCOPE_TO_EDITABLE_SOURCE = {
+    user: 'userSettings',
+    project: 'projectSettings',
+    local: 'localSettings',
+};
+/**
+ * Convert a plugin scope to its corresponding editable setting source
+ * @param scope The plugin installation scope
+ * @returns The corresponding setting source for reading/writing settings
+ * @throws Error if scope is 'managed' (cannot install plugins to managed scope)
+ */
+export function scopeToSettingSource(scope) {
+    if (scope === 'managed') {
+        throw new Error('Cannot install plugins to managed scope');
+    }
+    return SCOPE_TO_EDITABLE_SOURCE[scope];
+}
+/**
+ * Convert an editable setting source to its corresponding plugin scope.
+ * Derived from SETTING_SOURCE_TO_SCOPE to maintain a single source of truth.
+ * @param source The setting source
+ * @returns The corresponding plugin scope
+ */
+export function settingSourceToScope(source) {
+    return SETTING_SOURCE_TO_SCOPE[source];
+}