@kaitranntt/ccs 7.77.1-dev.9 → 7.78.0

package/dist/web-server/shared-routes-markdown.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Shared Routes — Markdown file reading and description extraction
+ *
+ * Handles YAML frontmatter parsing, body-line extraction, and safe
+ * bounded reads for both description snippets and full content.
+ *
+ * Directory walking is in shared-routes-markdown-walker.ts.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveReadableMarkdownPath = exports.readMarkdownContent = exports.readFirstMarkdownDescription = exports.readMarkdownDescription = exports.extractDescription = exports.collectMarkdownFiles = exports.MAX_CONTENT_FILE_BYTES = void 0;
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const MAX_DESCRIPTION_LENGTH = 140;
+const MAX_MARKDOWN_FILE_BYTES = 1024 * 1024; // 1 MiB
+/** Exported for content module which uses a larger limit. */
+exports.MAX_CONTENT_FILE_BYTES = 2 * 1024 * 1024; // 2 MiB
+var shared_routes_markdown_walker_1 = require("./shared-routes-markdown-walker");
+Object.defineProperty(exports, "collectMarkdownFiles", { enumerable: true, get: function () { return shared_routes_markdown_walker_1.collectMarkdownFiles; } });
+// ---------------------------------------------------------------------------
+// Description extraction helpers
+// ---------------------------------------------------------------------------
+function isDescriptionBodyLine(line) {
+    if (!line) {
+        return false;
+    }
+    if (line === '---' || line === '...') {
+        return false;
+    }
+    return !line.startsWith('#') && !line.startsWith('<!--');
+}
+function extractFrontmatterDescription(content) {
+    const frontmatterMatch = content.match(/^---\s*\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);
+    if (!frontmatterMatch) {
+        return null;
+    }
+    try {
+        const parsed = yaml.load(frontmatterMatch[1]);
+        const description = parsed?.description;
+        if (typeof description !== 'string') {
+            return null;
+        }
+        const trimmed = description.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function stripFrontmatter(content) {
+    return content.replace(/^---\s*\r?\n[\s\S]*?\r?\n---\s*\r?\n?/, '');
+}
+function trimDescription(description) {
+    if (description.length <= MAX_DESCRIPTION_LENGTH) {
+        return description;
+    }
+    return `${description.slice(0, MAX_DESCRIPTION_LENGTH - 3).trimEnd()}...`;
+}
+function extractDescription(content) {
+    const frontmatterDescription = extractFrontmatterDescription(content);
+    if (frontmatterDescription) {
+        return trimDescription(frontmatterDescription);
+    }
+    // Fall back to first non-empty, non-heading body line.
+    const lines = stripFrontmatter(content).split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (isDescriptionBodyLine(trimmed)) {
+            return trimDescription(trimmed);
+        }
+    }
+    return 'No description';
+}
+exports.extractDescription = extractDescription;
+// ---------------------------------------------------------------------------
+// File readers
+// ---------------------------------------------------------------------------
+function readMarkdownDescription(markdownPath, allowedRoots) {
+    try {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            return null;
+        }
+        const stats = fs.statSync(resolvedMarkdownPath);
+        if (!stats.isFile() || stats.size > MAX_MARKDOWN_FILE_BYTES) {
+            return null;
+        }
+        const content = fs.readFileSync(resolvedMarkdownPath, 'utf8');
+        return extractDescription(content);
+    }
+    catch {
+        return null;
+    }
+}
+exports.readMarkdownDescription = readMarkdownDescription;
+function readFirstMarkdownDescription(markdownPaths, allowedRoots) {
+    for (const markdownPath of markdownPaths) {
+        const description = readMarkdownDescription(markdownPath, allowedRoots);
+        if (description) {
+            return description;
+        }
+    }
+    return null;
+}
+exports.readFirstMarkdownDescription = readFirstMarkdownDescription;
+function readMarkdownContent(markdownPath, allowedRoots) {
+    try {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            return null;
+        }
+        const stats = fs.statSync(resolvedMarkdownPath);
+        if (!stats.isFile() || stats.size > exports.MAX_CONTENT_FILE_BYTES) {
+            return null;
+        }
+        return fs.readFileSync(resolvedMarkdownPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+exports.readMarkdownContent = readMarkdownContent;
+function resolveReadableMarkdownPath(markdownPaths, allowedRoots) {
+    for (const markdownPath of markdownPaths) {
+        const resolvedMarkdownPath = (0, shared_routes_path_guards_1.safeRealPath)(markdownPath);
+        if (!resolvedMarkdownPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedMarkdownPath, allowedRoots)) {
+            continue;
+        }
+        try {
+            const stats = fs.statSync(resolvedMarkdownPath);
+            if (!stats.isFile() || stats.size > exports.MAX_CONTENT_FILE_BYTES) {
+                continue;
+            }
+            return resolvedMarkdownPath;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+exports.resolveReadableMarkdownPath = resolveReadableMarkdownPath;
+//# sourceMappingURL=shared-routes-markdown.js.map

package/dist/web-server/shared-routes-markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-markdown.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-markdown.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,8CAAgC;AAEhC,2EAA4E;AAE5E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAErD,6DAA6D;AAChD,QAAA,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAI/D,iFAAuE;AAA9D,qIAAA,oBAAoB,OAAA;AAE7B,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAe;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAmC,CAAC;QAChF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;QACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAe;IAChD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACjD,CAAC;IAED,uDAAuD;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAhBD,gDAgBC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAgB,uBAAuB,CACrC,YAAoB,EACpB,YAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAlBD,0DAkBC;AAED,SAAgB,4BAA4B,CAC1C,aAAuB,EACvB,YAAyB;IAEzB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAXD,oEAWC;AAED,SAAgB,mBAAmB,CACjC,YAAoB,EACpB,YAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,8BAAsB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAjBD,kDAiBC;AAED,SAAgB,2BAA2B,CACzC,aAAuB,EACvB,YAAyB;IAEzB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;YAClF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,8BAAsB,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AApBD,kEAoBC"}

package/dist/web-server/shared-routes-path-guards.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared Routes — Path safety helpers
+ *
+ * Prevents directory traversal by resolving real paths and checking
+ * containment within allowed roots before any file I/O.
+ */
+import { getCcsDir } from '../config/config-loader-facade';
+import type { SharedCollectionType } from './shared-routes-types';
+export declare function safeRealPath(targetPath: string): string | null;
+export declare function normalizeForPathComparison(targetPath: string): string;
+export declare function isPathWithin(candidatePath: string, basePath: string): boolean;
+export declare function isPathWithinAny(candidatePath: string, basePaths: Set<string>): boolean;
+export declare function resolveAllowedRoots(type: SharedCollectionType, ccsDir: string, sharedDirRoot: string): Set<string>;
+export declare function resolveSettingsAllowedRoots(ccsDir: string, sharedDirRoot: string): Set<string>;
+export { getCcsDir };
+//# sourceMappingURL=shared-routes-path-guards.d.ts.map

package/dist/web-server/shared-routes-path-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-path-guards.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-path-guards.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAOtF;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC,MAAM,CAAC,CAeb;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAS9F;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/web-server/shared-routes-path-guards.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Shared Routes — Path safety helpers
+ *
+ * Prevents directory traversal by resolving real paths and checking
+ * containment within allowed roots before any file I/O.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCcsDir = exports.resolveSettingsAllowedRoots = exports.resolveAllowedRoots = exports.isPathWithinAny = exports.isPathWithin = exports.normalizeForPathComparison = exports.safeRealPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const claude_config_path_1 = require("../utils/claude-config-path");
+const config_loader_facade_1 = require("../config/config-loader-facade");
+Object.defineProperty(exports, "getCcsDir", { enumerable: true, get: function () { return config_loader_facade_1.getCcsDir; } });
+function safeRealPath(targetPath) {
+    try {
+        return fs.realpathSync(targetPath);
+    }
+    catch {
+        return null;
+    }
+}
+exports.safeRealPath = safeRealPath;
+function normalizeForPathComparison(targetPath) {
+    const normalized = path.resolve(targetPath);
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+exports.normalizeForPathComparison = normalizeForPathComparison;
+function isPathWithin(candidatePath, basePath) {
+    const normalizedCandidate = normalizeForPathComparison(candidatePath);
+    const normalizedBase = normalizeForPathComparison(basePath);
+    const relative = path.relative(normalizedBase, normalizedCandidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+exports.isPathWithin = isPathWithin;
+function isPathWithinAny(candidatePath, basePaths) {
+    for (const basePath of basePaths) {
+        if (isPathWithin(candidatePath, basePath)) {
+            return true;
+        }
+    }
+    return false;
+}
+exports.isPathWithinAny = isPathWithinAny;
+function resolveAllowedRoots(type, ccsDir, sharedDirRoot) {
+    if (type === 'commands' || type === 'plugins') {
+        return new Set([sharedDirRoot]);
+    }
+    return new Set([
+        sharedDirRoot,
+        ...[
+            path.join((0, claude_config_path_1.getClaudeConfigDir)(), type),
+            path.join(ccsDir, '.claude', type),
+            path.join(ccsDir, 'shared', type),
+        ]
+            .map((dirPath) => safeRealPath(dirPath))
+            .filter((dirPath) => typeof dirPath === 'string'),
+    ]);
+}
+exports.resolveAllowedRoots = resolveAllowedRoots;
+function resolveSettingsAllowedRoots(ccsDir, sharedDirRoot) {
+    const claudeConfigDir = (0, claude_config_path_1.getClaudeConfigDir)();
+    return new Set([
+        sharedDirRoot,
+        safeRealPath(path.join(claudeConfigDir, 'settings.json')),
+        safeRealPath(path.join(ccsDir, '.claude', 'settings.json')),
+    ].filter((dirPath) => typeof dirPath === 'string'));
+}
+exports.resolveSettingsAllowedRoots = resolveSettingsAllowedRoots;
+//# sourceMappingURL=shared-routes-path-guards.js.map

package/dist/web-server/shared-routes-path-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-path-guards.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-path-guards.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,oEAAiE;AACjE,yEAA2D;AAiElD,0FAjEA,gCAAS,OAiEA;AA9DlB,SAAgB,YAAY,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAND,oCAMC;AAED,SAAgB,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAHD,gEAGC;AAED,SAAgB,YAAY,CAAC,aAAqB,EAAE,QAAgB;IAClE,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IACpE,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AALD,oCAKC;AAED,SAAgB,eAAe,CAAC,aAAqB,EAAE,SAAsB;IAC3E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAPD,0CAOC;AAED,SAAgB,mBAAmB,CACjC,IAA0B,EAC1B,MAAc,EACd,aAAqB;IAErB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,GAAG,CAAS;QACrB,aAAa;QACb,GAAG;YACD,IAAI,CAAC,IAAI,CAAC,IAAA,uCAAkB,GAAE,EAAE,IAAI,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;aACE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAnBD,kDAmBC;AAED,SAAgB,2BAA2B,CAAC,MAAc,EAAE,aAAqB;IAC/E,MAAM,eAAe,GAAG,IAAA,uCAAkB,GAAE,CAAC;IAC7C,OAAO,IAAI,GAAG,CACZ;QACE,aAAa;QACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;KAC5D,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CACtE,CAAC;AACJ,CAAC;AATD,kEASC"}

package/dist/web-server/shared-routes-plugin-registry-content.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared Routes — Plugin registry content renderer
+ *
+ * Renders the markdown content for an installed plugin entry,
+ * pulling from installed_plugins.json, known_marketplaces.json,
+ * and blocklist.json within the allowed roots.
+ */
+export declare function getPluginRegistryContent(itemPath: string, sharedDir: string, allowedRoots: Set<string>): {
+    content: string;
+    contentPath: string;
+} | null;
+//# sourceMappingURL=shared-routes-plugin-registry-content.d.ts.map

package/dist/web-server/shared-routes-plugin-registry-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-plugin-registry-content.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-plugin-registry-content.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkCH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0DjD"}

package/dist/web-server/shared-routes-plugin-registry-content.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Shared Routes — Plugin registry content renderer
+ *
+ * Renders the markdown content for an installed plugin entry,
+ * pulling from installed_plugins.json, known_marketplaces.json,
+ * and blocklist.json within the allowed roots.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPluginRegistryContent = void 0;
+const path = __importStar(require("path"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const shared_routes_plugins_1 = require("./shared-routes-plugins");
+function findPluginBlocklistEntry(sharedDir, allowedRoots, pluginName) {
+    const blocklist = (0, shared_routes_plugins_1.readJsonObject)(path.join(sharedDir, 'blocklist.json'), allowedRoots);
+    const plugins = blocklist?.plugins;
+    if (!Array.isArray(plugins)) {
+        return null;
+    }
+    return (plugins.find((entry) => entry &&
+        typeof entry === 'object' &&
+        'plugin' in entry &&
+        entry.plugin === pluginName) ?? null);
+}
+function getPluginRegistryContent(itemPath, sharedDir, allowedRoots) {
+    const pluginName = (0, shared_routes_plugins_1.decodePluginRegistryPath)(itemPath);
+    if (!pluginName) {
+        return null;
+    }
+    const registryPath = path.join(sharedDir, 'installed_plugins.json');
+    const resolvedRegistryPath = (0, shared_routes_path_guards_1.safeRealPath)(registryPath);
+    if (!resolvedRegistryPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedRegistryPath, allowedRoots)) {
+        return null;
+    }
+    const registry = (0, shared_routes_plugins_1.readPluginInstalledRegistry)(sharedDir, allowedRoots);
+    if (!registry || !Object.prototype.hasOwnProperty.call(registry.plugins, pluginName)) {
+        return null;
+    }
+    const metadata = registry.plugins[pluginName];
+    const marketplace = (0, shared_routes_plugins_1.extractMarketplaceFromPluginName)(pluginName);
+    const marketplaceEntry = marketplace
+        ? (0, shared_routes_plugins_1.readJsonObject)(path.join(sharedDir, 'known_marketplaces.json'), allowedRoots)?.[marketplace]
+        : null;
+    const blocklistEntry = findPluginBlocklistEntry(sharedDir, allowedRoots, pluginName);
+    const lines = [
+        `# ${pluginName}`,
+        '',
+        `Registry: \`${resolvedRegistryPath}\``,
+        '',
+        '## Installed Plugin',
+        '',
+        `- Source: shared \`installed_plugins.json\` registry`,
+        `- Registry version: ${registry.version ?? 'unknown'}`,
+        `- Marketplace: ${marketplace ?? 'not recorded in plugin name'}`,
+        `- Install records: ${Array.isArray(metadata) ? metadata.length : 1}`,
+    ];
+    if (marketplaceEntry) {
+        lines.push('', '## Marketplace Registry Entry', '', '```json', (0, shared_routes_plugins_1.stringifyJson)(marketplaceEntry), '```');
+    }
+    if (blocklistEntry) {
+        lines.push('', '## Blocklist Notice', '', '```json', (0, shared_routes_plugins_1.stringifyJson)(blocklistEntry), '```');
+    }
+    lines.push('', '## Plugin Registry Entry', '', '```json', (0, shared_routes_plugins_1.stringifyJson)(metadata), '```');
+    return {
+        content: lines.join('\n'),
+        contentPath: resolvedRegistryPath,
+    };
+}
+exports.getPluginRegistryContent = getPluginRegistryContent;
+//# sourceMappingURL=shared-routes-plugin-registry-content.js.map

package/dist/web-server/shared-routes-plugin-registry-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-plugin-registry-content.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-plugin-registry-content.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,2CAA6B;AAE7B,2EAA4E;AAC5E,mEAMiC;AAEjC,SAAS,wBAAwB,CAC/B,SAAiB,EACjB,YAAyB,EACzB,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAA,sCAAc,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,YAAY,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,SAAS,EAAE,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,QAAQ,IAAI,KAAK;QAChB,KAA8B,CAAC,MAAM,KAAK,UAAU,CACxD,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,QAAgB,EAChB,SAAiB,EACjB,YAAyB;IAEzB,MAAM,UAAU,GAAG,IAAA,gDAAwB,EAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACpE,MAAM,oBAAoB,GAAG,IAAA,wCAAY,EAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAA,2CAAe,EAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,mDAA2B,EAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAA,wDAAgC,EAAC,UAAU,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW;QAClC,CAAC,CAAC,IAAA,sCAAc,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC;QAC9F,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,cAAc,GAAG,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG;QACZ,KAAK,UAAU,EAAE;QACjB,EAAE;QACF,eAAe,oBAAoB,IAAI;QACvC,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,sDAAsD;QACtD,uBAAuB,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE;QACtD,kBAAkB,WAAW,IAAI,6BAA6B,EAAE;QAChE,sBAAsB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;KACtE,CAAC;IAEF,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+BAA+B,EAC/B,EAAE,EACF,SAAS,EACT,IAAA,qCAAa,EAAC,gBAAgB,CAAC,EAC/B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAA,qCAAa,EAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,SAAS,EAAE,IAAA,qCAAa,EAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAE1F,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,WAAW,EAAE,oBAAoB;KAClC,CAAC;AACJ,CAAC;AA9DD,4DA8DC"}

package/dist/web-server/shared-routes-plugins.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Shared Routes — Plugin collection and registry helpers
+ *
+ * Handles installed_plugins.json registry reads, legacy plugin directory
+ * scanning, and plugin path encode/decode.
+ *
+ * Registry content rendering is in shared-routes-plugin-registry-content.ts.
+ */
+import type { SharedItem, InstalledPluginRegistry } from './shared-routes-types';
+export declare function encodePluginRegistryPath(pluginName: string): string;
+export declare function decodePluginRegistryPath(itemPath: string): string | null;
+export declare function readJsonObject(filePath: string, allowedRoots: Set<string>): Record<string, unknown> | null;
+export declare function readPluginInstalledRegistry(sharedDir: string, allowedRoots: Set<string>): InstalledPluginRegistry | null;
+export declare function extractMarketplaceFromPluginName(pluginName: string): string | null;
+export declare function describeInstalledPlugin(pluginName: string, metadata: unknown): string;
+export declare function isPluginInfrastructurePath(candidatePath: string, sharedDir: string): boolean;
+export declare function stringifyJson(value: unknown): string;
+export declare function getPluginRegistryItems(sharedDir: string, allowedRoots: Set<string>): SharedItem[];
+export declare function getLegacyPluginDirectoryItems(sharedDir: string, allowedRoots: Set<string>): SharedItem[];
+export declare function getPluginItems(sharedDir: string, allowedRoots: Set<string>): SharedItem[];
+//# sourceMappingURL=shared-routes-plugins.d.ts.map

package/dist/web-server/shared-routes-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-plugins.d.ts","sourceRoot":"","sources":["../../src/web-server/shared-routes-plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AASjF,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWxE;AAMD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAkBhC;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,uBAAuB,GAAG,IAAI,CAchC;AAMD,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMlF;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAOrF;AAMD,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAMD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAMD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,EAAE,CAWjG;AAED,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,UAAU,EAAE,CAqCd;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,EAAE,CAUzF"}

package/dist/web-server/shared-routes-plugins.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Shared Routes — Plugin collection and registry helpers
+ *
+ * Handles installed_plugins.json registry reads, legacy plugin directory
+ * scanning, and plugin path encode/decode.
+ *
+ * Registry content rendering is in shared-routes-plugin-registry-content.ts.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPluginItems = exports.getLegacyPluginDirectoryItems = exports.getPluginRegistryItems = exports.stringifyJson = exports.isPluginInfrastructurePath = exports.describeInstalledPlugin = exports.extractMarketplaceFromPluginName = exports.readPluginInstalledRegistry = exports.readJsonObject = exports.decodePluginRegistryPath = exports.encodePluginRegistryPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const shared_routes_path_guards_1 = require("./shared-routes-path-guards");
+const shared_routes_markdown_1 = require("./shared-routes-markdown");
+const PLUGIN_REGISTRY_PATH_PREFIX = 'plugin-registry:';
+const PLUGIN_INFRASTRUCTURE_DIRECTORIES = new Set(['cache', 'data', 'marketplaces']);
+// ---------------------------------------------------------------------------
+// Path encode / decode
+// ---------------------------------------------------------------------------
+function encodePluginRegistryPath(pluginName) {
+    return `${PLUGIN_REGISTRY_PATH_PREFIX}${encodeURIComponent(pluginName)}`;
+}
+exports.encodePluginRegistryPath = encodePluginRegistryPath;
+function decodePluginRegistryPath(itemPath) {
+    if (!itemPath.startsWith(PLUGIN_REGISTRY_PATH_PREFIX)) {
+        return null;
+    }
+    try {
+        const encodedName = itemPath.slice(PLUGIN_REGISTRY_PATH_PREFIX.length);
+        const pluginName = decodeURIComponent(encodedName);
+        return pluginName.length > 0 ? pluginName : null;
+    }
+    catch {
+        return null;
+    }
+}
+exports.decodePluginRegistryPath = decodePluginRegistryPath;
+// ---------------------------------------------------------------------------
+// JSON helpers
+// ---------------------------------------------------------------------------
+function readJsonObject(filePath, allowedRoots) {
+    const resolvedPath = (0, shared_routes_path_guards_1.safeRealPath)(filePath);
+    if (!resolvedPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedPath, allowedRoots)) {
+        return null;
+    }
+    try {
+        const stats = fs.statSync(resolvedPath);
+        if (!stats.isFile() || stats.size > shared_routes_markdown_1.MAX_CONTENT_FILE_BYTES) {
+            return null;
+        }
+        const parsed = JSON.parse(fs.readFileSync(resolvedPath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+exports.readJsonObject = readJsonObject;
+function readPluginInstalledRegistry(sharedDir, allowedRoots) {
+    const parsed = readJsonObject(path.join(sharedDir, 'installed_plugins.json'), allowedRoots);
+    if (!parsed ||
+        !parsed.plugins ||
+        typeof parsed.plugins !== 'object' ||
+        Array.isArray(parsed.plugins)) {
+        return null;
+    }
+    return {
+        version: typeof parsed.version === 'number' ? parsed.version : undefined,
+        plugins: parsed.plugins,
+    };
+}
+exports.readPluginInstalledRegistry = readPluginInstalledRegistry;
+// ---------------------------------------------------------------------------
+// Description helpers
+// ---------------------------------------------------------------------------
+function extractMarketplaceFromPluginName(pluginName) {
+    const atIndex = pluginName.lastIndexOf('@');
+    if (atIndex <= 0 || atIndex === pluginName.length - 1) {
+        return null;
+    }
+    return pluginName.slice(atIndex + 1);
+}
+exports.extractMarketplaceFromPluginName = extractMarketplaceFromPluginName;
+function describeInstalledPlugin(pluginName, metadata) {
+    const recordCount = Array.isArray(metadata) ? metadata.length : 1;
+    const marketplace = extractMarketplaceFromPluginName(pluginName);
+    const recordLabel = `${recordCount} ${recordCount === 1 ? 'record' : 'records'}`;
+    return marketplace
+        ? `Installed from ${marketplace}; ${recordLabel} in shared registry`
+        : `Installed plugin; ${recordLabel} in shared registry`;
+}
+exports.describeInstalledPlugin = describeInstalledPlugin;
+// ---------------------------------------------------------------------------
+// Infrastructure path guard
+// ---------------------------------------------------------------------------
+function isPluginInfrastructurePath(candidatePath, sharedDir) {
+    for (const directoryName of PLUGIN_INFRASTRUCTURE_DIRECTORIES) {
+        const resolvedInfrastructurePath = (0, shared_routes_path_guards_1.safeRealPath)(path.join(sharedDir, directoryName));
+        if (resolvedInfrastructurePath && (0, shared_routes_path_guards_1.isPathWithin)(candidatePath, resolvedInfrastructurePath)) {
+            return true;
+        }
+    }
+    return false;
+}
+exports.isPluginInfrastructurePath = isPluginInfrastructurePath;
+// ---------------------------------------------------------------------------
+// JSON serialization
+// ---------------------------------------------------------------------------
+function stringifyJson(value) {
+    return JSON.stringify(value, null, 2) ?? 'null';
+}
+exports.stringifyJson = stringifyJson;
+// ---------------------------------------------------------------------------
+// Item list builders
+// ---------------------------------------------------------------------------
+function getPluginRegistryItems(sharedDir, allowedRoots) {
+    const registry = readPluginInstalledRegistry(sharedDir, allowedRoots);
+    if (!registry) {
+        return [];
+    }
+    return Object.entries(registry.plugins).map(([pluginName, metadata]) => ({
+        name: pluginName,
+        description: describeInstalledPlugin(pluginName, metadata),
+        path: encodePluginRegistryPath(pluginName),
+        type: 'plugin',
+    }));
+}
+exports.getPluginRegistryItems = getPluginRegistryItems;
+function getLegacyPluginDirectoryItems(sharedDir, allowedRoots) {
+    let entries = [];
+    try {
+        entries = fs.readdirSync(sharedDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const items = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || PLUGIN_INFRASTRUCTURE_DIRECTORIES.has(entry.name)) {
+            continue;
+        }
+        const entryPath = path.join(sharedDir, entry.name);
+        const resolvedEntryPath = (0, shared_routes_path_guards_1.safeRealPath)(entryPath);
+        if (!resolvedEntryPath || !(0, shared_routes_path_guards_1.isPathWithinAny)(resolvedEntryPath, allowedRoots)) {
+            continue;
+        }
+        const description = (0, shared_routes_markdown_1.readFirstMarkdownDescription)([
+            path.join(resolvedEntryPath, 'README.md'),
+            path.join(resolvedEntryPath, 'readme.md'),
+            path.join(resolvedEntryPath, 'PLUGIN.md'),
+        ], allowedRoots);
+        if (!description) {
+            continue;
+        }
+        items.push({ name: entry.name, description, path: entryPath, type: 'plugin' });
+    }
+    return items;
+}
+exports.getLegacyPluginDirectoryItems = getLegacyPluginDirectoryItems;
+function getPluginItems(sharedDir, allowedRoots) {
+    const registryItems = getPluginRegistryItems(sharedDir, allowedRoots);
+    const legacyDirectoryItems = getLegacyPluginDirectoryItems(sharedDir, allowedRoots);
+    const itemsByPath = new Map();
+    for (const item of [...registryItems, ...legacyDirectoryItems]) {
+        itemsByPath.set(item.path, item);
+    }
+    return [...itemsByPath.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+exports.getPluginItems = getPluginItems;
+//# sourceMappingURL=shared-routes-plugins.js.map

package/dist/web-server/shared-routes-plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-routes-plugins.js","sourceRoot":"","sources":["../../src/web-server/shared-routes-plugins.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,2EAA0F;AAC1F,qEAAgG;AAGhG,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AACvD,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAErF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAgB,wBAAwB,CAAC,UAAkB;IACzD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC3E,CAAC;AAFD,4DAEC;AAED,SAAgB,wBAAwB,CAAC,QAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAXD,4DAWC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAgB,cAAc,CAC5B,QAAgB,EAChB,YAAyB;IAEzB,MAAM,YAAY,GAAG,IAAA,wCAAY,EAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY,IAAI,CAAC,IAAA,2CAAe,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,+CAAsB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAY,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AArBD,wCAqBC;AAED,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,YAAyB;IAEzB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5F,IACE,CAAC,MAAM;QACP,CAAC,MAAM,CAAC,OAAO;QACf,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACxE,OAAO,EAAE,MAAM,CAAC,OAAkC;KACnD,CAAC;AACJ,CAAC;AAjBD,kEAiBC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAgB,gCAAgC,CAAC,UAAkB;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAND,4EAMC;AAED,SAAgB,uBAAuB,CAAC,UAAkB,EAAE,QAAiB;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,GAAG,WAAW,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACjF,OAAO,WAAW;QAChB,CAAC,CAAC,kBAAkB,WAAW,KAAK,WAAW,qBAAqB;QACpE,CAAC,CAAC,qBAAqB,WAAW,qBAAqB,CAAC;AAC5D,CAAC;AAPD,0DAOC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,SAAgB,0BAA0B,CAAC,aAAqB,EAAE,SAAiB;IACjF,KAAK,MAAM,aAAa,IAAI,iCAAiC,EAAE,CAAC;QAC9D,MAAM,0BAA0B,GAAG,IAAA,wCAAY,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QACrF,IAAI,0BAA0B,IAAI,IAAA,wCAAY,EAAC,aAAa,EAAE,0BAA0B,CAAC,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AARD,gEAQC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC;AAClD,CAAC;AAFD,sCAEC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,YAAyB;IACjF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC1D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC;QAC1C,IAAI,EAAE,QAAiB;KACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAXD,wDAWC;AAED,SAAgB,6BAA6B,CAC3C,SAAiB,EACjB,YAAyB;IAEzB,IAAI,OAAO,GAAgB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,iCAAiC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,iBAAiB,GAAG,IAAA,wCAAY,EAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAA,2CAAe,EAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,qDAA4B,EAC9C;YACE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;SAC1C,EACD,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAxCD,sEAwCC;AAED,SAAgB,cAAc,CAAC,SAAiB,EAAE,YAAyB;IACzE,MAAM,aAAa,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAVD,wCAUC"}