@jackwener/opencli 1.5.0 → 1.5.1

package/src/plugin.ts

@@ -3,7 +3,8 @@
  *
  * Plugins live in ~/.opencli/plugins/<name>/.
  * Monorepo clones live in ~/.opencli/monorepos/<repo-name>/.
- * Install source format: "github:user/repo" or "github:user/repo/subplugin"
+ * Install source format: "github:user/repo", "github:user/repo/subplugin",
+ * "https://github.com/user/repo", "file:///local/plugin", or a local directory path.
  */
 
 import * as fs from 'node:fs';
@@ -23,6 +24,7 @@ import {
 } from './plugin-manifest.js';
 
 const isWindows = process.platform === 'win32';
+const LOCAL_PLUGIN_SOURCE_PREFIX = 'local:';
 
 /** Get home directory, respecting HOME environment variable for test isolation. */
 function getHomeDir(): string {
@@ -39,22 +41,16 @@ export function getMonoreposDir(): string {
   return path.join(getHomeDir(), '.opencli', 'monorepos');
 }
 
-// Legacy const for backward compatibility (computed at load time)
-export const LOCK_FILE = path.join(os.homedir(), '.opencli', 'plugins.lock.json');
-export const MONOREPOS_DIR = path.join(os.homedir(), '.opencli', 'monorepos');
+export type PluginSourceRecord =
+  | { kind: 'git'; url: string }
+  | { kind: 'local'; path: string }
+  | { kind: 'monorepo'; url: string; repoName: string; subPath: string };
 
 export interface LockEntry {
-  source: string;
+  source: PluginSourceRecord;
   commitHash: string;
   installedAt: string;
   updatedAt?: string;
-  /** Present when this plugin comes from a monorepo. */
-  monorepo?: {
-    /** Monorepo directory name under ~/.opencli/monorepos/ */
-    name: string;
-    /** Relative path of this sub-plugin within the monorepo. */
-    subPath: string;
-  };
 }
 
 export interface PluginInfo {
@@ -70,6 +66,382 @@ export interface PluginInfo {
   description?: string;
 }
 
+interface ParsedSource {
+  type: 'git' | 'local';
+  name: string;
+  subPlugin?: string;
+  cloneUrl?: string;
+  localPath?: string;
+}
+
+function parseStoredPluginSource(source?: string): PluginSourceRecord | undefined {
+  if (!source) return undefined;
+  if (source.startsWith(LOCAL_PLUGIN_SOURCE_PREFIX)) {
+    return {
+      kind: 'local',
+      path: path.resolve(source.slice(LOCAL_PLUGIN_SOURCE_PREFIX.length)),
+    };
+  }
+  return { kind: 'git', url: source };
+}
+
+function isLocalPluginSource(source?: string): boolean {
+  return parseStoredPluginSource(source)?.kind === 'local';
+}
+
+function toStoredPluginSource(source: PluginSourceRecord): string {
+  if (source.kind === 'local') {
+    return `${LOCAL_PLUGIN_SOURCE_PREFIX}${path.resolve(source.path)}`;
+  }
+  return source.url;
+}
+
+function toLocalPluginSource(pluginDir: string): string {
+  return toStoredPluginSource({ kind: 'local', path: pluginDir });
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function normalizeLegacyMonorepo(
+  value: unknown,
+): { name: string; subPath: string } | undefined {
+  if (!isRecord(value)) return undefined;
+  if (typeof value.name !== 'string' || typeof value.subPath !== 'string') return undefined;
+  return { name: value.name, subPath: value.subPath };
+}
+
+function normalizePluginSource(
+  source: unknown,
+  legacyMonorepo?: { name: string; subPath: string },
+): PluginSourceRecord | undefined {
+  if (typeof source === 'string') {
+    const parsed = parseStoredPluginSource(source);
+    if (!parsed) return undefined;
+    if (parsed.kind === 'git' && legacyMonorepo) {
+      return {
+        kind: 'monorepo',
+        url: parsed.url,
+        repoName: legacyMonorepo.name,
+        subPath: legacyMonorepo.subPath,
+      };
+    }
+    return parsed;
+  }
+
+  if (!isRecord(source) || typeof source.kind !== 'string') return undefined;
+  switch (source.kind) {
+    case 'git':
+      return typeof source.url === 'string'
+        ? { kind: 'git', url: source.url }
+        : undefined;
+    case 'local':
+      return typeof source.path === 'string'
+        ? { kind: 'local', path: path.resolve(source.path) }
+        : undefined;
+    case 'monorepo':
+      return typeof source.url === 'string'
+        && typeof source.repoName === 'string'
+        && typeof source.subPath === 'string'
+        ? {
+            kind: 'monorepo',
+            url: source.url,
+            repoName: source.repoName,
+            subPath: source.subPath,
+          }
+        : undefined;
+    default:
+      return undefined;
+  }
+}
+
+function normalizeLockEntry(value: unknown): LockEntry | undefined {
+  if (!isRecord(value)) return undefined;
+
+  const legacyMonorepo = normalizeLegacyMonorepo(value.monorepo);
+  const source = normalizePluginSource(value.source, legacyMonorepo);
+  if (!source) return undefined;
+  if (typeof value.commitHash !== 'string' || typeof value.installedAt !== 'string') {
+    return undefined;
+  }
+
+  const entry: LockEntry = {
+    source,
+    commitHash: value.commitHash,
+    installedAt: value.installedAt,
+  };
+
+  if (typeof value.updatedAt === 'string') {
+    entry.updatedAt = value.updatedAt;
+  }
+
+  return entry;
+}
+
+function resolvePluginSource(lockEntry: LockEntry | undefined, pluginDir: string): PluginSourceRecord | undefined {
+  if (lockEntry) {
+    return lockEntry.source;
+  }
+  return parseStoredPluginSource(getPluginSource(pluginDir));
+}
+
+function resolveStoredPluginSource(lockEntry: LockEntry | undefined, pluginDir: string): string | undefined {
+  const source = resolvePluginSource(lockEntry, pluginDir);
+  return source ? toStoredPluginSource(source) : undefined;
+}
+
+// ── Filesystem helpers ──────────────────────────────────────────────────────
+
+/**
+ * Move a directory, with EXDEV fallback.
+ * fs.renameSync fails when source and destination are on different
+ * filesystems (e.g. /tmp → ~/.opencli). In that case we copy then remove.
+ */
+type MoveDirFsOps = Pick<typeof fs, 'renameSync' | 'cpSync' | 'rmSync'>;
+
+function moveDir(src: string, dest: string, fsOps: MoveDirFsOps = fs): void {
+  try {
+    fsOps.renameSync(src, dest);
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code === 'EXDEV') {
+      try {
+        fsOps.cpSync(src, dest, { recursive: true });
+      } catch (copyErr) {
+        try { fsOps.rmSync(dest, { recursive: true, force: true }); } catch {}
+        throw copyErr;
+      }
+      fsOps.rmSync(src, { recursive: true, force: true });
+    } else {
+      throw err;
+    }
+  }
+}
+
+type PromoteDirFsOps = MoveDirFsOps & Pick<typeof fs, 'existsSync' | 'mkdirSync'>;
+
+function createSiblingTempPath(dest: string, kind: 'tmp' | 'bak'): string {
+  const suffix = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  return path.join(path.dirname(dest), `.${path.basename(dest)}.${kind}-${suffix}`);
+}
+
+/**
+ * Promote a prepared staging directory into its final location.
+ * The final path is only exposed after the directory has been fully prepared.
+ */
+function promoteDir(stagingDir: string, dest: string, fsOps: PromoteDirFsOps = fs): void {
+  if (fsOps.existsSync(dest)) {
+    throw new Error(`Destination already exists: ${dest}`);
+  }
+
+  fsOps.mkdirSync(path.dirname(dest), { recursive: true });
+  const tempDest = createSiblingTempPath(dest, 'tmp');
+
+  try {
+    moveDir(stagingDir, tempDest, fsOps);
+    fsOps.renameSync(tempDest, dest);
+  } catch (err) {
+    try { fsOps.rmSync(tempDest, { recursive: true, force: true }); } catch {}
+    throw err;
+  }
+}
+
+function replaceDir(stagingDir: string, dest: string, fsOps: PromoteDirFsOps = fs): void {
+  const replacement = beginReplaceDir(stagingDir, dest, fsOps);
+  replacement.finalize();
+}
+
+function cloneRepoToTemp(cloneUrl: string): string {
+  const tmpCloneDir = path.join(
+    os.tmpdir(),
+    `opencli-clone-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`,
+  );
+
+  try {
+    execFileSync('git', ['clone', '--depth', '1', cloneUrl, tmpCloneDir], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (err) {
+    throw new Error(`Failed to clone plugin: ${getErrorMessage(err)}`);
+  }
+
+  return tmpCloneDir;
+}
+
+function withTempClone<T>(cloneUrl: string, work: (cloneDir: string) => T): T {
+  const tmpCloneDir = cloneRepoToTemp(cloneUrl);
+  try {
+    return work(tmpCloneDir);
+  } finally {
+    try { fs.rmSync(tmpCloneDir, { recursive: true, force: true }); } catch {}
+  }
+}
+
+function resolveRemotePluginSource(lockEntry: LockEntry | undefined, dir: string): string {
+  const source = resolvePluginSource(lockEntry, dir);
+  if (!source || source.kind === 'local') {
+    throw new Error(`Unable to determine remote source for plugin at ${dir}`);
+  }
+  return source.url;
+}
+
+function pathExistsSync(p: string): boolean {
+  try {
+    fs.lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function removePathSync(p: string): void {
+  try {
+    const stat = fs.lstatSync(p);
+    if (stat.isSymbolicLink()) {
+      fs.unlinkSync(p);
+      return;
+    }
+    fs.rmSync(p, { recursive: true, force: true });
+  } catch {}
+}
+
+interface TransactionHandle {
+  finalize(): void;
+  rollback(): void;
+}
+
+class Transaction {
+  #handles: TransactionHandle[] = [];
+  #settled = false;
+
+  track<T extends TransactionHandle>(handle: T): T {
+    this.#handles.push(handle);
+    return handle;
+  }
+
+  commit(): void {
+    if (this.#settled) return;
+    this.#settled = true;
+    for (const handle of this.#handles) {
+      handle.finalize();
+    }
+  }
+
+  rollback(): void {
+    if (this.#settled) return;
+    this.#settled = true;
+    for (const handle of [...this.#handles].reverse()) {
+      handle.rollback();
+    }
+  }
+}
+
+function runTransaction<T>(work: (tx: Transaction) => T): T {
+  const tx = new Transaction();
+  try {
+    const result = work(tx);
+    tx.commit();
+    return result;
+  } catch (err) {
+    tx.rollback();
+    throw err;
+  }
+}
+
+function beginReplaceDir(
+  stagingDir: string,
+  dest: string,
+  fsOps: PromoteDirFsOps = fs,
+): TransactionHandle {
+  const destExisted = fsOps.existsSync(dest);
+  fsOps.mkdirSync(path.dirname(dest), { recursive: true });
+
+  const tempDest = createSiblingTempPath(dest, 'tmp');
+  const backupDest = destExisted ? createSiblingTempPath(dest, 'bak') : null;
+  let settled = false;
+
+  try {
+    moveDir(stagingDir, tempDest, fsOps);
+    if (backupDest) {
+      fsOps.renameSync(dest, backupDest);
+    }
+    fsOps.renameSync(tempDest, dest);
+  } catch (err) {
+    try { fsOps.rmSync(tempDest, { recursive: true, force: true }); } catch {}
+    if (backupDest && !fsOps.existsSync(dest)) {
+      try { fsOps.renameSync(backupDest, dest); } catch {}
+    }
+    throw err;
+  }
+
+  return {
+    finalize() {
+      if (settled) return;
+      settled = true;
+      if (backupDest) {
+        try { fsOps.rmSync(backupDest, { recursive: true, force: true }); } catch {}
+      }
+    },
+    rollback() {
+      if (settled) return;
+      settled = true;
+      try { fsOps.rmSync(dest, { recursive: true, force: true }); } catch {}
+      if (backupDest) {
+        try { fsOps.renameSync(backupDest, dest); } catch {}
+      }
+      try { fsOps.rmSync(tempDest, { recursive: true, force: true }); } catch {}
+    },
+  };
+}
+
+function beginReplaceSymlink(target: string, linkPath: string): TransactionHandle {
+  const linkExists = pathExistsSync(linkPath);
+  if (linkExists && !isSymlinkSync(linkPath)) {
+    throw new Error(`Expected monorepo plugin link at ${linkPath} to be a symlink`);
+  }
+
+  fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+
+  const tempLink = createSiblingTempPath(linkPath, 'tmp');
+  const backupLink = linkExists ? createSiblingTempPath(linkPath, 'bak') : null;
+  const linkType = isWindows ? 'junction' : 'dir';
+  let settled = false;
+
+  try {
+    fs.symlinkSync(target, tempLink, linkType);
+    if (backupLink) {
+      fs.renameSync(linkPath, backupLink);
+    }
+    fs.renameSync(tempLink, linkPath);
+  } catch (err) {
+    removePathSync(tempLink);
+    if (backupLink && !pathExistsSync(linkPath)) {
+      try { fs.renameSync(backupLink, linkPath); } catch {}
+    }
+    throw err;
+  }
+
+  return {
+    finalize() {
+      if (settled) return;
+      settled = true;
+      if (backupLink) {
+        removePathSync(backupLink);
+      }
+    },
+    rollback() {
+      if (settled) return;
+      settled = true;
+      removePathSync(linkPath);
+      if (backupLink && !pathExistsSync(linkPath)) {
+        try { fs.renameSync(backupLink, linkPath); } catch {}
+      }
+      removePathSync(tempLink);
+    },
+  };
+}
+
 // ── Validation helpers ──────────────────────────────────────────────────────
 
 export interface ValidationResult {
@@ -79,19 +451,67 @@ export interface ValidationResult {
 
 // ── Lock file helpers ───────────────────────────────────────────────────────
 
-export function readLockFile(): Record<string, LockEntry> {
+function readLockFileWithWriter(
+  writeLock: (lock: Record<string, LockEntry>) => void = writeLockFile,
+): Record<string, LockEntry> {
   try {
     const raw = fs.readFileSync(getLockFilePath(), 'utf-8');
-    return JSON.parse(raw) as Record<string, LockEntry>;
+    const parsed = JSON.parse(raw) as unknown;
+    if (!isRecord(parsed)) return {};
+
+    const lock: Record<string, LockEntry> = {};
+    let changed = false;
+
+    for (const [name, entry] of Object.entries(parsed)) {
+      const normalized = normalizeLockEntry(entry);
+      if (!normalized) {
+        changed = true;
+        continue;
+      }
+
+      lock[name] = normalized;
+      if (JSON.stringify(entry) !== JSON.stringify(normalized)) {
+        changed = true;
+      }
+    }
+
+    if (changed) {
+      try {
+        writeLock(lock);
+      } catch {}
+    }
+
+    return lock;
   } catch {
     return {};
   }
 }
 
-export function writeLockFile(lock: Record<string, LockEntry>): void {
+export function readLockFile(): Record<string, LockEntry> {
+  return readLockFileWithWriter(writeLockFile);
+}
+
+type WriteLockFileFsOps = Pick<typeof fs, 'mkdirSync' | 'writeFileSync' | 'renameSync' | 'rmSync'>;
+
+function writeLockFileWithFs(
+  lock: Record<string, LockEntry>,
+  fsOps: WriteLockFileFsOps = fs,
+): void {
   const lockPath = getLockFilePath();
-  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
-  fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+  fsOps.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const tempPath = createSiblingTempPath(lockPath, 'tmp');
+
+  try {
+    fsOps.writeFileSync(tempPath, JSON.stringify(lock, null, 2) + '\n');
+    fsOps.renameSync(tempPath, lockPath);
+  } catch (err) {
+    try { fsOps.rmSync(tempPath, { force: true }); } catch {}
+    throw err;
+  }
+}
+
+export function writeLockFile(lock: Record<string, LockEntry>): void {
+  writeLockFileWithFs(lock, fs);
 }
 
 /** Get the HEAD commit hash of a git repo directory. */
@@ -114,7 +534,7 @@ export function getCommitHash(dir: string): string | undefined {
  */
 export function validatePluginStructure(pluginDir: string): ValidationResult {
   const errors: string[] = [];
-  
+
   if (!fs.existsSync(pluginDir)) {
     return { valid: false, errors: ['Plugin directory does not exist'] };
   }
@@ -125,21 +545,21 @@ export function validatePluginStructure(pluginDir: string): ValidationResult {
   const hasJs = files.some(f => f.endsWith('.js') && !f.endsWith('.d.js'));
 
   if (!hasYaml && !hasTs && !hasJs) {
-    errors.push(`No command files found in plugin directory. A plugin must contain at least one .yaml, .ts, or .js command file.`);
+    errors.push('No command files found in plugin directory. A plugin must contain at least one .yaml, .ts, or .js command file.');
   }
 
   if (hasTs) {
     const pkgJsonPath = path.join(pluginDir, 'package.json');
     if (!fs.existsSync(pkgJsonPath)) {
-      errors.push(`Plugin contains .ts files but no package.json. A package.json with "type": "module" and "@jackwener/opencli" peer dependency is required for TS plugins.`);
+      errors.push('Plugin contains .ts files but no package.json. A package.json with "type": "module" and "@jackwener/opencli" peer dependency is required for TS plugins.');
     } else {
       try {
         const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
         if (pkg.type !== 'module') {
-          errors.push(`Plugin package.json must have "type": "module" for TypeScript plugins.`);
+          errors.push('Plugin package.json must have "type": "module" for TypeScript plugins.');
         }
       } catch {
-        errors.push(`Plugin package.json is malformed or invalid JSON.`);
+        errors.push('Plugin package.json is malformed or invalid JSON.');
       }
     }
   }
@@ -190,12 +610,76 @@ function postInstallMonorepoLifecycle(repoDir: string, pluginDirs: string[]): vo
   }
 }
 
+function ensureStandalonePluginReady(pluginDir: string): void {
+  const validation = validatePluginStructure(pluginDir);
+  if (!validation.valid) {
+    throw new Error(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
+  }
+
+  postInstallLifecycle(pluginDir);
+}
+
+type LockEntryInput = Omit<LockEntry, 'installedAt'> & Partial<Pick<LockEntry, 'installedAt'>>;
+
+function upsertLockEntry(
+  lock: Record<string, LockEntry>,
+  name: string,
+  entry: LockEntryInput,
+): void {
+  lock[name] = {
+    ...entry,
+    installedAt: entry.installedAt ?? new Date().toISOString(),
+  };
+}
+
+function publishStandalonePlugin(
+  stagingDir: string,
+  targetDir: string,
+  writeLock: (commitHash: string | undefined) => void,
+): void {
+  runTransaction((tx) => {
+    tx.track(beginReplaceDir(stagingDir, targetDir));
+    writeLock(getCommitHash(targetDir));
+  });
+}
+
+interface MonorepoPublishPlugin {
+  name: string;
+  subPath: string;
+}
+
+function publishMonorepoPlugins(
+  repoDir: string,
+  pluginsDir: string,
+  plugins: MonorepoPublishPlugin[],
+  publishRepo?: { stagingDir: string; parentDir: string },
+  writeLock?: (commitHash: string | undefined) => void,
+): void {
+  runTransaction((tx) => {
+    if (publishRepo) {
+      fs.mkdirSync(publishRepo.parentDir, { recursive: true });
+      tx.track(beginReplaceDir(publishRepo.stagingDir, repoDir));
+    }
+
+    const commitHash = getCommitHash(repoDir);
+    for (const plugin of plugins) {
+      const linkPath = path.join(pluginsDir, plugin.name);
+      const subDir = path.join(repoDir, plugin.subPath);
+      tx.track(beginReplaceSymlink(subDir, linkPath));
+    }
+
+    writeLock?.(commitHash);
+  });
+}
+
 /**
  * Install a plugin from a source.
  * Supports:
  *   "github:user/repo"            — single plugin or full monorepo
  *   "github:user/repo/subplugin"  — specific sub-plugin from a monorepo
  *   "https://github.com/user/repo"
+ *   "file:///absolute/path"       — local plugin directory (symlinked)
+ *   "/absolute/path"              — local plugin directory (symlinked)
  *
  * Returns the installed plugin name(s).
  */
@@ -207,24 +691,22 @@ export function installPlugin(source: string): string | string[] {
       `Supported formats:\n` +
       `  github:user/repo\n` +
       `  github:user/repo/subplugin\n` +
-      `  https://github.com/user/repo`
+      `  https://github.com/user/repo\n` +
+      `  https://<host>/<path>/repo.git\n` +
+      `  ssh://git@<host>/<path>/repo.git\n` +
+      `  git@<host>:user/repo.git\n` +
+      `  file:///absolute/path\n` +
+      `  /absolute/path`
     );
   }
 
-  const { cloneUrl, name: repoName, subPlugin } = parsed;
+  const { name: repoName, subPlugin } = parsed;
 
-  // Clone to a temporary location first so we can inspect the manifest
-  const tmpCloneDir = path.join(os.tmpdir(), `opencli-clone-${Date.now()}`);
-  try {
-    execFileSync('git', ['clone', '--depth', '1', cloneUrl, tmpCloneDir], {
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-  } catch (err) {
-    throw new Error(`Failed to clone plugin: ${getErrorMessage(err)}`);
+  if (parsed.type === 'local') {
+    return installLocalPlugin(parsed.localPath!, repoName);
   }
 
-  try {
+  return withTempClone(parsed.cloneUrl!, (tmpCloneDir) => {
     const manifest = readPluginManifest(tmpCloneDir);
 
     // Check top-level compatibility
@@ -235,15 +717,12 @@ export function installPlugin(source: string): string | string[] {
     }
 
     if (manifest && isMonorepo(manifest)) {
-      return installMonorepo(tmpCloneDir, cloneUrl, repoName, manifest, subPlugin);
+      return installMonorepo(tmpCloneDir, parsed.cloneUrl!, repoName, manifest, subPlugin);
     }
 
     // Single plugin mode
-    return installSinglePlugin(tmpCloneDir, cloneUrl, repoName, manifest);
-  } finally {
-    // Clean up temp clone (may already have been moved)
-    try { fs.rmSync(tmpCloneDir, { recursive: true, force: true }); } catch {}
-  }
+    return installSinglePlugin(tmpCloneDir, parsed.cloneUrl!, repoName, manifest);
+  });
 }
 
 /** Install a single (non-monorepo) plugin. */
@@ -260,30 +739,100 @@ function installSinglePlugin(
     throw new Error(`Plugin "${pluginName}" is already installed at ${targetDir}`);
   }
 
-  const validation = validatePluginStructure(cloneDir);
+  ensureStandalonePluginReady(cloneDir);
+  publishStandalonePlugin(cloneDir, targetDir, (commitHash) => {
+    const lock = readLockFile();
+    if (commitHash) {
+      upsertLockEntry(lock, pluginName, {
+        source: { kind: 'git', url: cloneUrl },
+        commitHash,
+      });
+      writeLockFile(lock);
+    }
+  });
+
+  return pluginName;
+}
+
+/**
+ * Install a local plugin by creating a symlink.
+ * Used for plugin development: the source directory is symlinked into
+ * the plugins dir so changes are reflected immediately.
+ */
+function installLocalPlugin(localPath: string, name: string): string {
+  if (!fs.existsSync(localPath)) {
+    throw new Error(`Local plugin path does not exist: ${localPath}`);
+  }
+
+  const stat = fs.statSync(localPath);
+  if (!stat.isDirectory()) {
+    throw new Error(`Local plugin path is not a directory: ${localPath}`);
+  }
+
+  const manifest = readPluginManifest(localPath);
+
+  if (manifest?.opencli && !checkCompatibility(manifest.opencli)) {
+    throw new Error(
+      `Plugin requires opencli ${manifest.opencli}, but current version is incompatible.`
+    );
+  }
+
+  const pluginName = manifest?.name ?? name;
+  const targetDir = path.join(PLUGINS_DIR, pluginName);
+
+  if (fs.existsSync(targetDir)) {
+    throw new Error(`Plugin "${pluginName}" is already installed at ${targetDir}`);
+  }
+
+  const validation = validatePluginStructure(localPath);
   if (!validation.valid) {
     throw new Error(`Invalid plugin structure:\n- ${validation.errors.join('\n- ')}`);
   }
 
   fs.mkdirSync(PLUGINS_DIR, { recursive: true });
-  fs.renameSync(cloneDir, targetDir);
 
-  postInstallLifecycle(targetDir);
+  const resolvedPath = path.resolve(localPath);
+  const linkType = isWindows ? 'junction' : 'dir';
+  fs.symlinkSync(resolvedPath, targetDir, linkType);
 
-  const commitHash = getCommitHash(targetDir);
-  if (commitHash) {
-    const lock = readLockFile();
-    lock[pluginName] = {
-      source: cloneUrl,
-      commitHash,
-      installedAt: new Date().toISOString(),
-    };
-    writeLockFile(lock);
-  }
+  installDependencies(localPath);
+  finalizePluginRuntime(localPath);
+
+  const lock = readLockFile();
+  const commitHash = getCommitHash(localPath);
+  upsertLockEntry(lock, pluginName, {
+    source: { kind: 'local', path: resolvedPath },
+    commitHash: commitHash ?? 'local',
+  });
+  writeLockFile(lock);
 
   return pluginName;
 }
 
+function updateLocalPlugin(
+  name: string,
+  targetDir: string,
+  lock: Record<string, LockEntry>,
+  lockEntry?: LockEntry,
+): void {
+  const pluginDir = fs.realpathSync(targetDir);
+
+  const validation = validatePluginStructure(pluginDir);
+  if (!validation.valid) {
+    log.warn(`Plugin "${name}" structure invalid:\n- ${validation.errors.join('\n- ')}`);
+  }
+
+  postInstallLifecycle(pluginDir);
+
+  upsertLockEntry(lock, name, {
+    source: lockEntry?.source ?? { kind: 'local', path: pluginDir },
+    commitHash: getCommitHash(pluginDir) ?? 'local',
+    installedAt: lockEntry?.installedAt ?? new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+  });
+  writeLockFile(lock);
+}
+
 /** Install sub-plugins from a monorepo. */
 function installMonorepo(
   cloneDir: string,
@@ -294,34 +843,34 @@ function installMonorepo(
 ): string[] {
   const monoreposDir = getMonoreposDir();
   const repoDir = path.join(monoreposDir, repoName);
+  const repoAlreadyInstalled = fs.existsSync(repoDir);
+  const repoRoot = repoAlreadyInstalled ? repoDir : cloneDir;
+  const effectiveManifest = repoAlreadyInstalled ? readPluginManifest(repoDir) : manifest;
 
-  // Move clone to permanent monorepos location (if not already there)
-  if (!fs.existsSync(repoDir)) {
-    fs.mkdirSync(monoreposDir, { recursive: true });
-    fs.renameSync(cloneDir, repoDir);
+  if (!effectiveManifest || !isMonorepo(effectiveManifest)) {
+    throw new Error(`Monorepo manifest missing or invalid at ${repoRoot}`);
   }
 
-  let pluginsToInstall = getEnabledPlugins(manifest);
+  let pluginsToInstall = getEnabledPlugins(effectiveManifest);
 
   // If a specific sub-plugin was requested, filter to just that one
   if (subPlugin) {
     pluginsToInstall = pluginsToInstall.filter((p) => p.name === subPlugin);
     if (pluginsToInstall.length === 0) {
       // Check if it exists but is disabled
-      const disabled = manifest.plugins?.[subPlugin];
+      const disabled = effectiveManifest.plugins?.[subPlugin];
       if (disabled) {
         throw new Error(`Sub-plugin "${subPlugin}" is disabled in the manifest.`);
       }
       throw new Error(
-        `Sub-plugin "${subPlugin}" not found in monorepo. Available: ${Object.keys(manifest.plugins ?? {}).join(', ')}`
+        `Sub-plugin "${subPlugin}" not found in monorepo. Available: ${Object.keys(effectiveManifest.plugins ?? {}).join(', ')}`
       );
     }
   }
 
   const installedNames: string[] = [];
   const lock = readLockFile();
-  const commitHash = getCommitHash(repoDir);
-  const eligiblePlugins: Array<{ name: string; entry: typeof pluginsToInstall[number]['entry']; subDir: string }> = [];
+  const eligiblePlugins: Array<{ name: string; entry: typeof pluginsToInstall[number]['entry'] }> = [];
 
   fs.mkdirSync(PLUGINS_DIR, { recursive: true });
 
@@ -332,7 +881,7 @@ function installMonorepo(
       continue;
     }
 
-    const subDir = path.join(repoDir, entry.path);
+    const subDir = path.join(repoRoot, entry.path);
     if (!fs.existsSync(subDir)) {
       log.warn(`Skipping "${name}": path "${entry.path}" not found in repo.`);
       continue;
@@ -350,34 +899,128 @@ function installMonorepo(
       continue;
     }
 
-    eligiblePlugins.push({ name, entry, subDir });
+    eligiblePlugins.push({ name, entry });
   }
 
-  if (eligiblePlugins.length > 0) {
-    postInstallMonorepoLifecycle(repoDir, eligiblePlugins.map((p) => p.subDir));
+  if (eligiblePlugins.length === 0) {
+    return installedNames;
   }
 
-  for (const { name, entry, subDir } of eligiblePlugins) {
-    const linkPath = path.join(PLUGINS_DIR, name);
+  const publishPlugins = eligiblePlugins.map(({ name, entry }) => ({ name, subPath: entry.path }));
 
-    // Create symlink (junction on Windows)
-    const linkType = isWindows ? 'junction' : 'dir';
-    fs.symlinkSync(subDir, linkPath, linkType);
+  if (repoAlreadyInstalled) {
+    postInstallMonorepoLifecycle(repoDir, eligiblePlugins.map((p) => path.join(repoDir, p.entry.path)));
+  } else {
+    postInstallMonorepoLifecycle(cloneDir, eligiblePlugins.map((p) => path.join(cloneDir, p.entry.path)));
+  }
 
-    if (commitHash) {
-      lock[name] = {
-        source: cloneUrl,
-        commitHash,
-        installedAt: new Date().toISOString(),
-        monorepo: { name: repoName, subPath: entry.path },
-      };
+  publishMonorepoPlugins(
+    repoDir,
+    PLUGINS_DIR,
+    publishPlugins,
+    repoAlreadyInstalled ? undefined : { stagingDir: cloneDir, parentDir: monoreposDir },
+    (commitHash) => {
+      for (const { name, entry } of eligiblePlugins) {
+        if (commitHash) {
+          upsertLockEntry(lock, name, {
+            source: {
+              kind: 'monorepo',
+              url: cloneUrl,
+              repoName,
+              subPath: entry.path,
+            },
+            commitHash,
+          });
+        }
+        installedNames.push(name);
+      }
+      writeLockFile(lock);
+    },
+  );
+
+  return installedNames;
+}
+
+function collectUpdatedMonorepoPlugins(
+  monoName: string,
+  lock: Record<string, LockEntry>,
+  manifest: PluginManifest,
+  cloneUrl: string,
+  tmpCloneDir: string,
+): Array<{
+  name: string;
+  lockEntry: LockEntry;
+  manifestEntry: NonNullable<PluginManifest['plugins']>[string];
+}> {
+  const updatedPlugins: Array<{
+    name: string;
+    lockEntry: LockEntry;
+    manifestEntry: NonNullable<PluginManifest['plugins']>[string];
+  }> = [];
+
+  for (const [pluginName, entry] of Object.entries(lock)) {
+    if (entry.source.kind !== 'monorepo' || entry.source.repoName !== monoName) continue;
+    const manifestEntry = manifest.plugins?.[pluginName];
+    if (!manifestEntry || manifestEntry.disabled) {
+      throw new Error(`Installed sub-plugin "${pluginName}" no longer exists in ${cloneUrl}`);
+    }
+    if (manifestEntry.opencli && !checkCompatibility(manifestEntry.opencli)) {
+      throw new Error(`Sub-plugin "${pluginName}" requires opencli ${manifestEntry.opencli}`);
     }
 
-    installedNames.push(name);
+    const subDir = path.join(tmpCloneDir, manifestEntry.path);
+    const validation = validatePluginStructure(subDir);
+    if (!validation.valid) {
+      throw new Error(`Updated sub-plugin "${pluginName}" is invalid:\n- ${validation.errors.join('\n- ')}`);
+    }
+    updatedPlugins.push({ name: pluginName, lockEntry: entry, manifestEntry });
   }
 
-  writeLockFile(lock);
-  return installedNames;
+  return updatedPlugins;
+}
+
+function updateMonorepoLockEntries(
+  lock: Record<string, LockEntry>,
+  plugins: Array<{
+    name: string;
+    lockEntry: LockEntry;
+    manifestEntry: NonNullable<PluginManifest['plugins']>[string];
+  }>,
+  cloneUrl: string,
+  monoName: string,
+  commitHash: string | undefined,
+): void {
+  for (const plugin of plugins) {
+    if (!commitHash) continue;
+    upsertLockEntry(lock, plugin.name, {
+      ...plugin.lockEntry,
+      source: {
+        kind: 'monorepo',
+        url: cloneUrl,
+        repoName: monoName,
+        subPath: plugin.manifestEntry.path,
+      },
+      commitHash,
+      updatedAt: new Date().toISOString(),
+    });
+  }
+}
+
+function updateStandaloneLockEntry(
+  lock: Record<string, LockEntry>,
+  name: string,
+  cloneUrl: string,
+  existing: LockEntry | undefined,
+  commitHash: string | undefined,
+): void {
+  if (!commitHash) return;
+
+  upsertLockEntry(lock, name, {
+    source: { kind: 'git', url: cloneUrl },
+    commitHash,
+    installedAt: existing?.installedAt ?? new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+  });
 }
 
 /**
@@ -405,11 +1048,11 @@ export function uninstallPlugin(name: string): void {
   }
 
   // Clean up monorepo directory if no more sub-plugins reference it
-  if (lockEntry?.monorepo) {
+  if (lockEntry?.source.kind === 'monorepo') {
     delete lock[name];
-    const monoName = lockEntry.monorepo.name;
+    const monoName = lockEntry.source.repoName;
     const stillReferenced = Object.values(lock).some(
-      (entry) => entry.monorepo?.name === monoName,
+      (entry) => entry.source.kind === 'monorepo' && entry.source.repoName === monoName,
     );
     if (!stillReferenced) {
       const monoDir = path.join(getMonoreposDir(), monoName);
@@ -444,79 +1087,76 @@ export function updatePlugin(name: string): void {
 
   const lock = readLockFile();
   const lockEntry = lock[name];
+  const source = resolvePluginSource(lockEntry, targetDir);
 
-  if (lockEntry?.monorepo) {
-    // Monorepo update: pull the repo root
-    const monoDir = path.join(getMonoreposDir(), lockEntry.monorepo.name);
-    try {
-      execFileSync('git', ['pull', '--ff-only'], {
-        cwd: monoDir,
-        encoding: 'utf-8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-    } catch (err) {
-      throw new Error(`Failed to update monorepo: ${getErrorMessage(err)}`);
-    }
-
-    // Re-run lifecycle for ALL sub-plugins from this monorepo
-    const monoName = lockEntry.monorepo.name;
-    const commitHash = getCommitHash(monoDir);
-    const pluginDirs: string[] = [];
-    for (const [pluginName, entry] of Object.entries(lock)) {
-      if (entry.monorepo?.name !== monoName) continue;
-      const subDir = path.join(monoDir, entry.monorepo.subPath);
-      const validation = validatePluginStructure(subDir);
-      if (!validation.valid) {
-        log.warn(`Plugin "${pluginName}" structure invalid after update:\n- ${validation.errors.join('\n- ')}`);
-      }
-      pluginDirs.push(subDir);
-    }
-    if (pluginDirs.length > 0) {
-      postInstallMonorepoLifecycle(monoDir, pluginDirs);
-    }
-    for (const [pluginName, entry] of Object.entries(lock)) {
-      if (entry.monorepo?.name !== monoName) continue;
-      if (commitHash) {
-        lock[pluginName] = {
-          ...entry,
-          commitHash,
-          updatedAt: new Date().toISOString(),
-        };
-      }
-    }
-    writeLockFile(lock);
+  if (source?.kind === 'local') {
+    updateLocalPlugin(name, targetDir, lock, lockEntry);
     return;
   }
 
-  // Standard single-plugin update
-  try {
-    execFileSync('git', ['pull', '--ff-only'], {
-      cwd: targetDir,
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
+  if (source?.kind === 'monorepo') {
+    const monoDir = path.join(getMonoreposDir(), source.repoName);
+    const monoName = source.repoName;
+    const cloneUrl = source.url;
+    withTempClone(cloneUrl, (tmpCloneDir) => {
+      const manifest = readPluginManifest(tmpCloneDir);
+      if (!manifest || !isMonorepo(manifest)) {
+        throw new Error(`Updated source is no longer a monorepo: ${cloneUrl}`);
+      }
+
+      if (manifest.opencli && !checkCompatibility(manifest.opencli)) {
+        throw new Error(
+          `Plugin requires opencli ${manifest.opencli}, but current version is incompatible.`
+        );
+      }
+
+      const updatedPlugins = collectUpdatedMonorepoPlugins(
+        monoName,
+        lock,
+        manifest,
+        cloneUrl,
+        tmpCloneDir,
+      );
+
+      if (updatedPlugins.length > 0) {
+        postInstallMonorepoLifecycle(tmpCloneDir, updatedPlugins.map((plugin) => path.join(tmpCloneDir, plugin.manifestEntry.path)));
+      }
+
+      publishMonorepoPlugins(
+        monoDir,
+        PLUGINS_DIR,
+        updatedPlugins.map((plugin) => ({ name: plugin.name, subPath: plugin.manifestEntry.path })),
+        { stagingDir: tmpCloneDir, parentDir: path.dirname(monoDir) },
+        (commitHash) => {
+          updateMonorepoLockEntries(lock, updatedPlugins, cloneUrl, monoName, commitHash);
+          writeLockFile(lock);
+        },
+      );
     });
-  } catch (err) {
-    throw new Error(`Failed to update plugin: ${getErrorMessage(err)}`);
+    return;
   }
 
-  const validation = validatePluginStructure(targetDir);
-  if (!validation.valid) {
-    log.warn(`Plugin "${name}" updated, but structure is now invalid:\n- ${validation.errors.join('\n- ')}`);
-  }
+  const cloneUrl = resolveRemotePluginSource(lockEntry, targetDir);
+  withTempClone(cloneUrl, (tmpCloneDir) => {
+    const manifest = readPluginManifest(tmpCloneDir);
+    if (manifest && isMonorepo(manifest)) {
+      throw new Error(`Updated source is now a monorepo: ${cloneUrl}`);
+    }
 
-  postInstallLifecycle(targetDir);
+    if (manifest?.opencli && !checkCompatibility(manifest.opencli)) {
+      throw new Error(
+        `Plugin requires opencli ${manifest.opencli}, but current version is incompatible.`
+      );
+    }
 
-  const commitHash = getCommitHash(targetDir);
-  if (commitHash) {
-    const existing = lock[name];
-    lock[name] = {
-      source: existing?.source ?? getPluginSource(targetDir) ?? '',
-      commitHash,
-      installedAt: existing?.installedAt ?? new Date().toISOString(),
-      updatedAt: new Date().toISOString(),
-    };
-    writeLockFile(lock);
-  }
+    ensureStandalonePluginReady(tmpCloneDir);
+    publishStandalonePlugin(tmpCloneDir, targetDir, (commitHash) => {
+      updateStandaloneLockEntry(lock, name, cloneUrl, lock[name], commitHash);
+      if (commitHash) {
+        writeLockFile(lock);
+      }
+    });
+  });
 }
 
 export interface UpdateResult {
@@ -569,8 +1209,8 @@ export function listPlugins(): PluginInfo[] {
     // For monorepo sub-plugins, also check the monorepo root manifest
     let description = manifest?.description;
     let version = manifest?.version;
-    if (lockEntry?.monorepo && !description) {
-      const monoDir = path.join(getMonoreposDir(), lockEntry.monorepo.name);
+    if (lockEntry?.source.kind === 'monorepo' && !description) {
+      const monoDir = path.join(getMonoreposDir(), lockEntry.source.repoName);
       const monoManifest = readPluginManifest(monoDir);
       const subEntry = monoManifest?.plugins?.[entry.name];
       if (subEntry) {
@@ -579,9 +1219,7 @@ export function listPlugins(): PluginInfo[] {
       }
     }
 
-    const source = lockEntry?.monorepo
-      ? lockEntry.source
-      : getPluginSource(pluginDir);
+    const source = resolveStoredPluginSource(lockEntry, pluginDir);
 
     plugins.push({
       name: entry.name,
@@ -590,7 +1228,7 @@ export function listPlugins(): PluginInfo[] {
       source,
       version: version ?? lockEntry?.commitHash?.slice(0, 7),
       installedAt: lockEntry?.installedAt,
-      monorepoName: lockEntry?.monorepo?.name,
+      monorepoName: lockEntry?.source.kind === 'monorepo' ? lockEntry.source.repoName : undefined,
       description,
     });
   }
@@ -633,7 +1271,29 @@ function getPluginSource(dir: string): string | undefined {
 /** Parse a plugin source string into clone URL, repo name, and optional sub-plugin. */
 function parseSource(
   source: string,
-): { cloneUrl: string; name: string; subPlugin?: string } | null {
+): ParsedSource | null {
+  if (source.startsWith('file://')) {
+    try {
+      const localPath = path.resolve(fileURLToPath(source));
+      return {
+        type: 'local',
+        localPath,
+        name: path.basename(localPath).replace(/^opencli-plugin-/, ''),
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  if (path.isAbsolute(source)) {
+    const localPath = path.resolve(source);
+    return {
+      type: 'local',
+      localPath,
+      name: path.basename(localPath).replace(/^opencli-plugin-/, ''),
+    };
+  }
+
   // github:user/repo/subplugin  (monorepo specific sub-plugin)
   const githubSubMatch = source.match(
     /^github:([\w.-]+)\/([\w.-]+)\/([\w.-]+)$/,
@@ -642,6 +1302,7 @@ function parseSource(
     const [, user, repo, sub] = githubSubMatch;
     const name = repo.replace(/^opencli-plugin-/, '');
     return {
+      type: 'git',
       cloneUrl: `https://github.com/${user}/${repo}.git`,
       name,
       subPlugin: sub,
@@ -654,6 +1315,7 @@ function parseSource(
     const [, user, repo] = githubMatch;
     const name = repo.replace(/^opencli-plugin-/, '');
     return {
+      type: 'git',
       cloneUrl: `https://github.com/${user}/${repo}.git`,
       name,
     };
@@ -667,11 +1329,48 @@ function parseSource(
     const [, user, repo] = urlMatch;
     const name = repo.replace(/^opencli-plugin-/, '');
     return {
+      type: 'git',
       cloneUrl: `https://github.com/${user}/${repo}.git`,
       name,
     };
   }
 
+  // ── Generic git URL support ─────────────────────────────────────────────
+
+  // ssh://git@host/path/to/repo.git
+  const sshUrlMatch = source.match(/^ssh:\/\/[^/]+\/(.*?)(?:\.git)?$/);
+  if (sshUrlMatch) {
+    const pathPart = sshUrlMatch[1];
+    const segments = pathPart.split('/');
+    const repoSegment = segments.pop()!;
+    const name = repoSegment.replace(/^opencli-plugin-/, '');
+    return { type: 'git', cloneUrl: source, name };
+  }
+
+  // git@host:user/repo.git (SCP-style)
+  const scpMatch = source.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
+  if (scpMatch) {
+    const pathPart = scpMatch[1];
+    const segments = pathPart.split('/');
+    const repoSegment = segments.pop()!;
+    const name = repoSegment.replace(/^opencli-plugin-/, '');
+    return { type: 'git', cloneUrl: source, name };
+  }
+
+  // Generic https/http git URL (non-GitHub hosts)
+  const genericHttpMatch = source.match(
+    /^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/,
+  );
+  if (genericHttpMatch) {
+    const pathPart = genericHttpMatch[1];
+    const segments = pathPart.split('/');
+    const repoSegment = segments.pop()!;
+    const name = repoSegment.replace(/^opencli-plugin-/, '');
+    // Ensure clone URL ends with .git
+    const cloneUrl = source.endsWith('.git') ? source : `${source}.git`;
+    return { type: 'git', cloneUrl, name };
+  }
+
   return null;
 }
 
@@ -776,7 +1475,10 @@ function transpilePluginTs(pluginDir: string): void {
     const esbuildBin = resolveEsbuildBin();
 
     if (!esbuildBin) {
-      log.debug('esbuild not found in host node_modules, via resolve, or in PATH, skipping TS transpilation');
+      log.warn(
+        'esbuild not found. TS plugin files will not be transpiled and may fail to load. ' +
+        'Install esbuild (`npm i -g esbuild`) or ensure it is available in the opencli host node_modules.'
+      );
       return;
     }
 
@@ -804,8 +1506,8 @@ function transpilePluginTs(pluginDir: string): void {
         log.warn(`Failed to transpile ${tsFile}: ${getErrorMessage(err)}`);
       }
     }
-  } catch {
-    // Non-fatal: skip transpilation if anything goes wrong
+  } catch (err) {
+    log.warn(`TS transpilation setup failed: ${getErrorMessage(err)}`);
   }
 }
 
@@ -816,9 +1518,20 @@ export {
   parseSource as _parseSource,
   postInstallMonorepoLifecycle as _postInstallMonorepoLifecycle,
   readLockFile as _readLockFile,
+  readLockFileWithWriter as _readLockFileWithWriter,
   updateAllPlugins as _updateAllPlugins,
   validatePluginStructure as _validatePluginStructure,
   writeLockFile as _writeLockFile,
+  writeLockFileWithFs as _writeLockFileWithFs,
   isSymlinkSync as _isSymlinkSync,
   getMonoreposDir as _getMonoreposDir,
+  installLocalPlugin as _installLocalPlugin,
+  isLocalPluginSource as _isLocalPluginSource,
+  moveDir as _moveDir,
+  promoteDir as _promoteDir,
+  replaceDir as _replaceDir,
+  resolvePluginSource as _resolvePluginSource,
+  resolveStoredPluginSource as _resolveStoredPluginSource,
+  toStoredPluginSource as _toStoredPluginSource,
+  toLocalPluginSource as _toLocalPluginSource,
 };