@kolisachint/hoocode-agent 0.4.131 → 0.4.133

package/dist/core/tools/propose-plugin.d.ts

@@ -1,14 +1,21 @@
 /**
- * Capability authoring tools (spec §3). The two escalating-risk build paths are
- * kept as *separate tools* by design — not collapsed into one:
+ * Capability authoring tools (spec §3), refactored to a single risk-gated path.
  *
- *   ProposePlugin            scaffold passive/low-risk capabilities — skills,
- *                            commands, and read-only subagents. Autonomous +
- *                            transparent (near-zero risk, reversible).
- *   ProposeExecutablePlugin  the risk-bearing path — hooks, MCP servers, and
- *                            mutating/high-privilege subagents. Draft → display
- *                            the code and the tool grant → human confirms →
- *                            activate. Bar >= install.
+ *   ProposePlugin  author a NEW plugin from any capability mix — skills,
+ *                  commands, subagents, hooks, MCP servers. The risk gate is
+ *                  *computed from content*, not pre-declared by tool choice:
+ *                  passive content (skills, commands, read-only subagents) is
+ *                  authored autonomously; executable content (hooks, MCP servers,
+ *                  mutating/high-privilege subagents) auto-triggers a "show the
+ *                  code + tool grant → human confirms → activate" gate in the
+ *                  same call. A mixed plugin (skill + hook) is authored in one
+ *                  call, and a hook can never be mis-routed through a "passive"
+ *                  tool because the gate keys off what the draft contains.
+ *   UpdatePlugin   merge inline-authored capabilities into an EXISTING local
+ *                  plugin. Nothing is fetched from a remote, so the supply-chain
+ *                  "benign v1 → hostile v2" risk that keeps a marketplace
+ *                  UpdatePlugin out of the model's hands does not apply here;
+ *                  executable additions still pass through the same confirm gate.
  *
  * Both author into `.agents/plugins/<id>/` in the requested vendor layouts
  * (Claude Code + GitHub Copilot by default) via the format registry, so results
@@ -19,18 +26,21 @@
  * both tools — so a low-trust authored agent cannot bootstrap privilege.
  */
 import { type ToolDefinition } from "../extensions/types.js";
-export { PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME, PROPOSE_PLUGIN_TOOL_NAME } from "./plugin-tool-names.js";
-export interface ProposePluginDetails {
+export { PROPOSE_PLUGIN_TOOL_NAME, REMOVE_PLUGIN_CAPABILITY_TOOL_NAME, UPDATE_PLUGIN_TOOL_NAME, } from "./plugin-tool-names.js";
+export interface AuthorPluginDetails {
     id: string;
     authored: boolean;
+    /** Whether an executable-capability confirmation gate ran (and was accepted). */
+    confirmed?: boolean;
 }
 export declare function createProposePluginToolDefinition(): ToolDefinition;
-export interface ProposeExecutablePluginDetails {
+export declare function createUpdatePluginToolDefinition(): ToolDefinition;
+export interface RemovePluginCapabilityDetails {
     id: string;
-    authored: boolean;
-    confirmed: boolean;
+    removed: string[];
+    missing: string[];
 }
-export declare function createProposeExecutablePluginToolDefinition(): ToolDefinition;
-/** Both authoring tool definitions, for registration on the top-level agent. */
+export declare function createRemovePluginCapabilityToolDefinition(): ToolDefinition;
+/** All three authoring tool definitions, for registration on the top-level agent. */
 export declare function createProposePluginToolDefinitions(): ToolDefinition[];
 //# sourceMappingURL=propose-plugin.d.ts.map

package/dist/core/tools/propose-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"propose-plugin.d.ts","sourceRoot":"","sources":["../../../src/core/tools/propose-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGzE,OAAO,EAAE,mCAAmC,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AA4FvG,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,iCAAiC,IAAI,cAAc,CA8DlE;AAwBD,MAAM,WAAW,8BAA8B;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACnB;AAiBD,wBAAgB,2CAA2C,IAAI,cAAc,CAqF5E;AAsBD,gFAAgF;AAChF,wBAAgB,kCAAkC,IAAI,cAAc,EAAE,CAErE","sourcesContent":["/**\n * Capability authoring tools (spec §3). The two escalating-risk build paths are\n * kept as *separate tools* by design — not collapsed into one:\n *\n *   ProposePlugin            scaffold passive/low-risk capabilities — skills,\n *                            commands, and read-only subagents. Autonomous +\n *                            transparent (near-zero risk, reversible).\n *   ProposeExecutablePlugin  the risk-bearing path — hooks, MCP servers, and\n *                            mutating/high-privilege subagents. Draft → display\n *                            the code and the tool grant → human confirms →\n *                            activate. Bar >= install.\n *\n * Both author into `.agents/plugins/<id>/` in the requested vendor layouts\n * (Claude Code + GitHub Copilot by default) via the format registry, so results\n * are proper, publishable plugins that round-trip through parsePluginDir.\n *\n * Privilege-amplification guardrail: an authored subagent may never carry a\n * plugin-system (capability-acquisition) tool in its allowlist — enforced in\n * both tools — so a low-trust authored agent cannot bootstrap privilege.\n */\n\nimport { type Static, Type } from \"typebox\";\nimport {\n\tclassifyAllowlist,\n\tpluginExists,\n\tresolveAuthoringPlatforms,\n\twritePluginDraft,\n} from \"../extensions/plugins/authoring.js\";\nimport type { MarketplacePlatform, PluginDraft } from \"../extensions/plugins/formats/types.js\";\nimport type { ExtensionContext } from \"../extensions/types.js\";\nimport { defineTool, type ToolDefinition } from \"../extensions/types.js\";\nimport { PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME, PROPOSE_PLUGIN_TOOL_NAME } from \"./plugin-tool-names.js\";\n\nexport { PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME, PROPOSE_PLUGIN_TOOL_NAME } from \"./plugin-tool-names.js\";\n\nconst platformSchema = Type.Union([Type.Literal(\"claude\"), Type.Literal(\"github\"), Type.Literal(\"agents\")], {\n\tdescription: \"Target format: claude (Claude Code), github (GitHub Copilot), or agents (native).\",\n});\n\nconst skillSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Skill name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line trigger description (kept lazy in context).\" })),\n\t\tbody: Type.String({ description: \"SKILL.md instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst commandSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Command name (invoked as /name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line description.\" })),\n\t\tbody: Type.String({ description: \"Prompt template body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst subagentSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Subagent name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"When to dispatch this subagent.\" })),\n\t\ttools: Type.Optional(\n\t\t\tType.String({ description: \"Comma-separated allowed-tools, e.g. 'read, grep, glob'. Omit for none.\" }),\n\t\t),\n\t\tmodel: Type.Optional(Type.String({ description: \"Model override, or 'inherit'.\" })),\n\t\tbody: Type.String({ description: \"System-prompt / instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst hookSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, Stop, ...\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Regex matched against the tool name. Empty/'*' = all.\" })),\n\t\tcommand: Type.String({ description: \"Shell command to run on the event.\" }),\n\t\ttimeout: Type.Optional(Type.Number({ description: \"Timeout in seconds.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst mcpServerSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"MCP server name.\" }),\n\t\tcommand: Type.String({ description: \"Executable to launch the server.\" }),\n\t\targs: Type.Optional(Type.Array(Type.String(), { description: \"Command arguments.\" })),\n\t\tenv: Type.Optional(Type.Record(Type.String(), Type.String(), { description: \"Environment variables.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nfunction resolvePlatforms(input: string[] | undefined): MarketplacePlatform[] {\n\t// Explicit tool param → session --support-platform targets → claude + github.\n\treturn resolveAuthoringPlatforms(input as MarketplacePlatform[] | undefined);\n}\n\nfunction summarizeWrite(id: string, platforms: MarketplacePlatform[], files: string[], dest: string): string {\n\treturn (\n\t\t`Authored plugin \"${id}\" (${platforms.join(\", \")}) with ${files.length} file(s) at ${dest}:\\n` +\n\t\tfiles.map((f) => `  ${f}`).join(\"\\n\") +\n\t\t`\\nRemove it with UninstallPlugin.`\n\t);\n}\n\n// ── ProposePlugin (scaffold path) ─────────────────────────────────────────────\n\nconst proposeParams = Type.Object(\n\t{\n\t\tid: Type.String({ description: \"Plugin id (directory + manifest name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"Plugin description.\" })),\n\t\tversion: Type.Optional(Type.String({ description: \"Plugin version, e.g. '0.1.0'.\" })),\n\t\tplatforms: Type.Optional(\n\t\t\tType.Array(platformSchema, {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Formats to scaffold into. Default: the session's --support-platform targets, else claude + github.\",\n\t\t\t}),\n\t\t),\n\t\tskills: Type.Optional(Type.Array(skillSchema)),\n\t\tcommands: Type.Optional(Type.Array(commandSchema)),\n\t\tsubagents: Type.Optional(\n\t\t\tType.Array(subagentSchema, { description: \"Read-only subagents only (mutating grants are rejected here).\" }),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport interface ProposePluginDetails {\n\tid: string;\n\tauthored: boolean;\n}\n\nexport function createProposePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof proposeParams, ProposePluginDetails>({\n\t\tname: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tlabel: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Author a new plugin from passive, low-risk capabilities — skills, slash commands, and READ-ONLY subagents — when no marketplace plugin fits a gap. Scaffolds a proper plugin (Claude Code + GitHub Copilot layouts by default). Autonomous and reversible. For hooks, MCP servers, or mutating/high-privilege subagents, use ProposeExecutablePlugin instead.\",\n\t\tpromptSnippet:\n\t\t\t\"Author a skill/command/read-only-subagent plugin to fill a capability gap (scaffold; reversible).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Sense reusability proactively: when you complete a multi-step recipe you would plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it as a skill/command with ProposePlugin autonomously — announce what you created and why. It activates immediately and is reversible with UninstallPlugin.\",\n\t\t\t\"Use ProposePlugin only for passive capabilities: skills, commands, and subagents whose tools are read-only (read, grep, glob, webfetch).\",\n\t\t\t\"A subagent that needs Bash/Write/Edit/MCP or tools:* is mutating — author it with ProposeExecutablePlugin (human confirmation), not here.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t],\n\t\tparameters: proposeParams,\n\t\tasync execute(_id, params: Static<typeof proposeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst platforms = resolvePlatforms(params.platforms);\n\n\t\t\t// Guardrail + risk gate on each subagent before writing anything.\n\t\t\tfor (const sa of params.subagents ?? []) {\n\t\t\t\tconst cls = classifyAllowlist(sa.tools);\n\t\t\t\tif (cls.pluginTools.length > 0) {\n\t\t\t\t\treturn reject(\n\t\t\t\t\t\t`Subagent \"${sa.name}\" requests plugin-system tools (${cls.pluginTools.join(\", \")}). ` +\n\t\t\t\t\t\t\t\"Authored subagents may never carry capability-acquisition tools.\",\n\t\t\t\t\t\tparams.id,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (cls.risk === \"mutating\") {\n\t\t\t\t\treturn reject(\n\t\t\t\t\t\t`Subagent \"${sa.name}\" has a mutating allowlist (${cls.reason}). ` +\n\t\t\t\t\t\t\t\"Use ProposeExecutablePlugin so the human can review and confirm the tool grant.\",\n\t\t\t\t\t\tparams.id,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (pluginExists(ctx.cwd, params.id)) {\n\t\t\t\treturn reject(\n\t\t\t\t\t`A plugin named \"${params.id}\" already exists. Uninstall it first or pick another id.`,\n\t\t\t\t\tparams.id,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst draft: PluginDraft = {\n\t\t\t\tid: params.id,\n\t\t\t\tversion: params.version,\n\t\t\t\tdescription: params.description,\n\t\t\t\tsupportPlatform: platforms,\n\t\t\t\tskills: params.skills,\n\t\t\t\tcommands: params.commands,\n\t\t\t\tagents: params.subagents,\n\t\t\t};\n\t\t\tconst result = writePluginDraft(ctx.cwd, draft, platforms);\n\t\t\t// Passive capabilities activate live — the authored skill/command/subagent\n\t\t\t// is usable on the very next model request, in this same turn.\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest)}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Authored plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn { content: [{ type: \"text\" as const, text }], details: { id: params.id, authored: true } };\n\t\t},\n\t});\n}\n\n// ── ProposeExecutablePlugin (risk-bearing path) ───────────────────────────────\n\nconst proposeExecParams = Type.Object(\n\t{\n\t\tid: Type.String({ description: \"Plugin id (directory + manifest name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"Plugin description.\" })),\n\t\tversion: Type.Optional(Type.String({ description: \"Plugin version, e.g. '0.1.0'.\" })),\n\t\tplatforms: Type.Optional(\n\t\t\tType.Array(platformSchema, {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Formats to scaffold into. Default: the session's --support-platform targets, else claude + github.\",\n\t\t\t}),\n\t\t),\n\t\thooks: Type.Optional(Type.Array(hookSchema)),\n\t\tmcpServers: Type.Optional(Type.Array(mcpServerSchema)),\n\t\tsubagents: Type.Optional(\n\t\t\tType.Array(subagentSchema, { description: \"Subagents with mutating/exec/network or tools:* allowlists.\" }),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport interface ProposeExecutablePluginDetails {\n\tid: string;\n\tauthored: boolean;\n\tconfirmed: boolean;\n}\n\n/** Build the human-facing review text: the executable code and every tool grant. */\nfunction buildReview(params: Static<typeof proposeExecParams>): string {\n\tconst lines: string[] = [`Plugin \"${params.id}\" wants to install executable capabilities:`];\n\tfor (const h of params.hooks ?? []) {\n\t\tlines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : \"\"}]: ${h.command}`);\n\t}\n\tfor (const s of params.mcpServers ?? []) {\n\t\tlines.push(`  mcp server \"${s.name}\": ${s.command}${s.args?.length ? ` ${s.args.join(\" \")}` : \"\"}`);\n\t}\n\tfor (const sa of params.subagents ?? []) {\n\t\tlines.push(`  subagent \"${sa.name}\" tools: ${sa.tools ?? \"(none)\"}`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nexport function createProposeExecutablePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof proposeExecParams, ProposeExecutablePluginDetails>({\n\t\tname: PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME,\n\t\tlabel: PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Author a plugin that includes EXECUTABLE or high-privilege capabilities — hooks (run on tool events), MCP servers, or subagents with mutating/exec/network tool grants. The code and the exact tool grant are shown to the human, who must confirm before anything is activated. Use ProposePlugin for passive skills/commands/read-only subagents.\",\n\t\tpromptSnippet: \"Author a hook/MCP/high-privilege-subagent plugin (shows the code; requires human confirmation).\",\n\t\tpromptGuidelines: [\n\t\t\t\"ProposeExecutablePlugin always shows the code and tool grant and requires explicit human confirmation before activating.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t\t\"Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.\",\n\t\t],\n\t\tparameters: proposeExecParams,\n\t\tasync execute(_id, params: Static<typeof proposeExecParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst platforms = resolvePlatforms(params.platforms);\n\n\t\t\t// Guardrail: authored subagents may never carry plugin-system tools.\n\t\t\tfor (const sa of params.subagents ?? []) {\n\t\t\t\tconst cls = classifyAllowlist(sa.tools);\n\t\t\t\tif (cls.pluginTools.length > 0) {\n\t\t\t\t\treturn rejectExec(\n\t\t\t\t\t\t`Subagent \"${sa.name}\" requests plugin-system tools (${cls.pluginTools.join(\", \")}). ` +\n\t\t\t\t\t\t\t\"Authored subagents may never carry capability-acquisition tools.\",\n\t\t\t\t\t\tparams.id,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst hasExecutable =\n\t\t\t\t(params.hooks?.length ?? 0) > 0 ||\n\t\t\t\t(params.mcpServers?.length ?? 0) > 0 ||\n\t\t\t\t(params.subagents?.length ?? 0) > 0;\n\t\t\tif (!hasExecutable) {\n\t\t\t\treturn rejectExec(\"Nothing to author. Provide hooks, mcpServers, or subagents.\", params.id);\n\t\t\t}\n\n\t\t\tif (pluginExists(ctx.cwd, params.id)) {\n\t\t\t\treturn rejectExec(\n\t\t\t\t\t`A plugin named \"${params.id}\" already exists. Uninstall it first or pick another id.`,\n\t\t\t\t\tparams.id,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Draft → display → confirm → activate. Fail closed without a UI to confirm on.\n\t\t\tconst review = buildReview(params);\n\t\t\tctx.ui.notify(review, \"warning\");\n\t\t\tif (!ctx.hasUI) {\n\t\t\t\treturn rejectExec(\n\t\t\t\t\t\"Authoring executable capabilities requires human confirmation, which is unavailable in this mode. \" +\n\t\t\t\t\t\t`Not activated.\\n${review}`,\n\t\t\t\t\tparams.id,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst confirmed = await ctx.ui.confirm(\n\t\t\t\t`Author executable plugin \"${params.id}\"?`,\n\t\t\t\t`${review}\\n\\nThis installs and can run the code above. Activate it?`,\n\t\t\t);\n\t\t\tif (!confirmed) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: `Declined — plugin \"${params.id}\" was not authored.` }],\n\t\t\t\t\tdetails: { id: params.id, authored: false, confirmed: false },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst draft: PluginDraft = {\n\t\t\t\tid: params.id,\n\t\t\t\tversion: params.version,\n\t\t\t\tdescription: params.description,\n\t\t\t\tsupportPlatform: platforms,\n\t\t\t\thooks: params.hooks,\n\t\t\t\tmcpServers: params.mcpServers,\n\t\t\t\tagents: params.subagents,\n\t\t\t};\n\t\t\tconst result = writePluginDraft(ctx.cwd, draft, platforms);\n\t\t\t// Human confirmed above: activate now. Subagents go live immediately;\n\t\t\t// hooks/MCP servers activate via the automatic reload once the turn ends.\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest)}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Authored executable plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: true },\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction reject(\n\tmessage: string,\n\tid: string,\n): {\n\tcontent: { type: \"text\"; text: string }[];\n\tdetails: ProposePluginDetails;\n} {\n\treturn { content: [{ type: \"text\" as const, text: message }], details: { id, authored: false } };\n}\n\nfunction rejectExec(\n\tmessage: string,\n\tid: string,\n): {\n\tcontent: { type: \"text\"; text: string }[];\n\tdetails: ProposeExecutablePluginDetails;\n} {\n\treturn { content: [{ type: \"text\" as const, text: message }], details: { id, authored: false, confirmed: false } };\n}\n\n/** Both authoring tool definitions, for registration on the top-level agent. */\nexport function createProposePluginToolDefinitions(): ToolDefinition[] {\n\treturn [createProposePluginToolDefinition(), createProposeExecutablePluginToolDefinition()];\n}\n"]}
+{"version":3,"file":"propose-plugin.d.ts","sourceRoot":"","sources":["../../../src/core/tools/propose-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAeH,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOzE,OAAO,EACN,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAsLhC,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AA4DD,wBAAgB,iCAAiC,IAAI,cAAc,CAiDlE;AASD,wBAAgB,gCAAgC,IAAI,cAAc,CAoEjE;AA6BD,MAAM,WAAW,6BAA6B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,0CAA0C,IAAI,cAAc,CAiE3E;AAED,qFAAqF;AACrF,wBAAgB,kCAAkC,IAAI,cAAc,EAAE,CAMrE","sourcesContent":["/**\n * Capability authoring tools (spec §3), refactored to a single risk-gated path.\n *\n *   ProposePlugin  author a NEW plugin from any capability mix — skills,\n *                  commands, subagents, hooks, MCP servers. The risk gate is\n *                  *computed from content*, not pre-declared by tool choice:\n *                  passive content (skills, commands, read-only subagents) is\n *                  authored autonomously; executable content (hooks, MCP servers,\n *                  mutating/high-privilege subagents) auto-triggers a \"show the\n *                  code + tool grant → human confirms → activate\" gate in the\n *                  same call. A mixed plugin (skill + hook) is authored in one\n *                  call, and a hook can never be mis-routed through a \"passive\"\n *                  tool because the gate keys off what the draft contains.\n *   UpdatePlugin   merge inline-authored capabilities into an EXISTING local\n *                  plugin. Nothing is fetched from a remote, so the supply-chain\n *                  \"benign v1 → hostile v2\" risk that keeps a marketplace\n *                  UpdatePlugin out of the model's hands does not apply here;\n *                  executable additions still pass through the same confirm gate.\n *\n * Both author into `.agents/plugins/<id>/` in the requested vendor layouts\n * (Claude Code + GitHub Copilot by default) via the format registry, so results\n * are proper, publishable plugins that round-trip through parsePluginDir.\n *\n * Privilege-amplification guardrail: an authored subagent may never carry a\n * plugin-system (capability-acquisition) tool in its allowlist — enforced in\n * both tools — so a low-trust authored agent cannot bootstrap privilege.\n */\n\nimport { type Static, Type } from \"typebox\";\nimport {\n\tclassifyAllowlist,\n\tgetPlugin,\n\tisAuthoredPlugin,\n\tmergePluginDraft,\n\tpluginExists,\n\tremoveFromPlugin,\n\tresolveAuthoringPlatforms,\n\twritePluginDraft,\n} from \"../extensions/plugins/authoring.js\";\nimport type { MarketplacePlatform, PluginDraft } from \"../extensions/plugins/formats/types.js\";\nimport type { ExtensionContext } from \"../extensions/types.js\";\nimport { defineTool, type ToolDefinition } from \"../extensions/types.js\";\nimport {\n\tPROPOSE_PLUGIN_TOOL_NAME,\n\tREMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\tUPDATE_PLUGIN_TOOL_NAME,\n} from \"./plugin-tool-names.js\";\n\nexport {\n\tPROPOSE_PLUGIN_TOOL_NAME,\n\tREMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\tUPDATE_PLUGIN_TOOL_NAME,\n} from \"./plugin-tool-names.js\";\n\nconst platformSchema = Type.Union([Type.Literal(\"claude\"), Type.Literal(\"github\"), Type.Literal(\"agents\")], {\n\tdescription: \"Target format: claude (Claude Code), github (GitHub Copilot), or agents (native).\",\n});\n\nconst skillSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Skill name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line trigger description (kept lazy in context).\" })),\n\t\tbody: Type.String({ description: \"SKILL.md instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst commandSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Command name (invoked as /name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line description.\" })),\n\t\tbody: Type.String({ description: \"Prompt template body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst subagentSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Subagent name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"When to dispatch this subagent.\" })),\n\t\ttools: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Comma-separated allowed-tools, e.g. 'read, grep, glob'. Read-only grants are autonomous; \" +\n\t\t\t\t\t\"mutating/exec/network grants (Bash, Write, Edit, MCP) or '*' require human confirmation. Omit for none.\",\n\t\t\t}),\n\t\t),\n\t\tmodel: Type.Optional(Type.String({ description: \"Model override, or 'inherit'.\" })),\n\t\tbody: Type.String({ description: \"System-prompt / instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst hookSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, Stop, ...\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Regex matched against the tool name. Empty/'*' = all.\" })),\n\t\tcommand: Type.String({ description: \"Shell command to run on the event.\" }),\n\t\ttimeout: Type.Optional(Type.Number({ description: \"Timeout in seconds.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst mcpServerSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"MCP server name.\" }),\n\t\tcommand: Type.String({ description: \"Executable to launch the server.\" }),\n\t\targs: Type.Optional(Type.Array(Type.String(), { description: \"Command arguments.\" })),\n\t\tenv: Type.Optional(Type.Record(Type.String(), Type.String(), { description: \"Environment variables.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\n/** The capability params shared by ProposePlugin (create) and UpdatePlugin (merge). */\nconst capabilityProps = {\n\tdescription: Type.Optional(Type.String({ description: \"Plugin description.\" })),\n\tversion: Type.Optional(Type.String({ description: \"Plugin version, e.g. '0.1.0'.\" })),\n\tplatforms: Type.Optional(\n\t\tType.Array(platformSchema, {\n\t\t\tdescription:\n\t\t\t\t\"Formats to scaffold into. Default: the session's --support-platform targets, else claude + github \" +\n\t\t\t\t\"(UpdatePlugin defaults to the plugin's existing platforms).\",\n\t\t}),\n\t),\n\tskills: Type.Optional(Type.Array(skillSchema)),\n\tcommands: Type.Optional(Type.Array(commandSchema)),\n\tsubagents: Type.Optional(\n\t\tType.Array(subagentSchema, {\n\t\t\tdescription: \"Subagents. Read-only allowlists are autonomous; mutating ones trigger human confirmation.\",\n\t\t}),\n\t),\n\thooks: Type.Optional(Type.Array(hookSchema, { description: \"Shell hooks (executable — trigger confirmation).\" })),\n\tmcpServers: Type.Optional(\n\t\tType.Array(mcpServerSchema, { description: \"MCP servers (executable — trigger confirmation).\" }),\n\t),\n} as const;\n\n/** Union of every capability a draft can carry (used to build a draft and to classify risk). */\ninterface CapabilityInput {\n\tdescription?: string;\n\tversion?: string;\n\tplatforms?: MarketplacePlatform[];\n\tskills?: Static<typeof skillSchema>[];\n\tcommands?: Static<typeof commandSchema>[];\n\tsubagents?: Static<typeof subagentSchema>[];\n\thooks?: Static<typeof hookSchema>[];\n\tmcpServers?: Static<typeof mcpServerSchema>[];\n}\n\nfunction resolvePlatforms(input: MarketplacePlatform[] | undefined): MarketplacePlatform[] {\n\t// Explicit tool param → session --support-platform targets → claude + github.\n\treturn resolveAuthoringPlatforms(input);\n}\n\nfunction draftFrom(id: string, params: CapabilityInput, platforms: MarketplacePlatform[]): PluginDraft {\n\treturn {\n\t\tid,\n\t\tversion: params.version,\n\t\tdescription: params.description,\n\t\tsupportPlatform: platforms,\n\t\tskills: params.skills,\n\t\tcommands: params.commands,\n\t\tagents: params.subagents,\n\t\thooks: params.hooks,\n\t\tmcpServers: params.mcpServers,\n\t};\n}\n\n/** Total capabilities carried by the draft (empty arrays count as nothing). */\nfunction capabilityCount(params: CapabilityInput): number {\n\treturn (\n\t\t(params.skills?.length ?? 0) +\n\t\t(params.commands?.length ?? 0) +\n\t\t(params.subagents?.length ?? 0) +\n\t\t(params.hooks?.length ?? 0) +\n\t\t(params.mcpServers?.length ?? 0)\n\t);\n}\n\n/** The subagents whose allowlist makes them mutating/high-privilege (need the confirm gate). */\nfunction mutatingSubagents(params: CapabilityInput): Static<typeof subagentSchema>[] {\n\treturn (params.subagents ?? []).filter((sa) => classifyAllowlist(sa.tools).risk === \"mutating\");\n}\n\n/** True when the draft carries anything executable — hooks, MCP servers, or a mutating subagent. */\nfunction hasExecutable(params: CapabilityInput): boolean {\n\treturn (\n\t\t(params.hooks?.length ?? 0) > 0 || (params.mcpServers?.length ?? 0) > 0 || mutatingSubagents(params).length > 0\n\t);\n}\n\n/** Reject if any subagent carries a plugin-system tool (privilege-amplification guardrail). Returns the message, or null. */\nfunction guardrailViolation(params: CapabilityInput): string | null {\n\tfor (const sa of params.subagents ?? []) {\n\t\tconst cls = classifyAllowlist(sa.tools);\n\t\tif (cls.pluginTools.length > 0) {\n\t\t\treturn (\n\t\t\t\t`Subagent \"${sa.name}\" requests plugin-system tools (${cls.pluginTools.join(\", \")}). ` +\n\t\t\t\t\"Authored subagents may never carry capability-acquisition tools.\"\n\t\t\t);\n\t\t}\n\t}\n\treturn null;\n}\n\n/** Build the human-facing review text: the executable code and every mutating tool grant. */\nfunction buildReview(id: string, params: CapabilityInput): string {\n\tconst lines: string[] = [`Plugin \"${id}\" wants to install executable capabilities:`];\n\tfor (const h of params.hooks ?? []) {\n\t\tlines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : \"\"}]: ${h.command}`);\n\t}\n\tfor (const s of params.mcpServers ?? []) {\n\t\tlines.push(`  mcp server \"${s.name}\": ${s.command}${s.args?.length ? ` ${s.args.join(\" \")}` : \"\"}`);\n\t}\n\tfor (const sa of mutatingSubagents(params)) {\n\t\tlines.push(`  subagent \"${sa.name}\" tools: ${sa.tools ?? \"(none)\"} (${classifyAllowlist(sa.tools).reason})`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction summarizeWrite(\n\tid: string,\n\tplatforms: MarketplacePlatform[],\n\tfiles: string[],\n\tdest: string,\n\tverb: string,\n): string {\n\treturn (\n\t\t`${verb} plugin \"${id}\" (${platforms.join(\", \")}) with ${files.length} file(s) at ${dest}:\\n` +\n\t\tfiles.map((f) => `  ${f}`).join(\"\\n\") +\n\t\t`\\nRemove it with UninstallPlugin.`\n\t);\n}\n\nexport interface AuthorPluginDetails {\n\tid: string;\n\tauthored: boolean;\n\t/** Whether an executable-capability confirmation gate ran (and was accepted). */\n\tconfirmed?: boolean;\n}\n\nfunction reject(\n\tid: string,\n\tmessage: string,\n): {\n\tcontent: { type: \"text\"; text: string }[];\n\tdetails: AuthorPluginDetails;\n} {\n\treturn { content: [{ type: \"text\" as const, text: message }], details: { id, authored: false } };\n}\n\n/**\n * Run the shared \"executable capabilities → show → confirm\" gate. Returns:\n *  - `{ ok: true }` when there is nothing executable, or the human confirmed;\n *  - a tool result (authored:false) when there is no UI to confirm on, or the\n *    human declined.\n */\nasync function passExecutableGate(\n\tid: string,\n\tparams: CapabilityInput,\n\tctx: ExtensionContext,\n): Promise<{ ok: true; gated: boolean } | { ok: false; result: ReturnType<typeof reject> }> {\n\tif (!hasExecutable(params)) return { ok: true, gated: false };\n\n\tconst review = buildReview(id, params);\n\tctx.ui.notify(review, \"warning\");\n\tif (!ctx.hasUI) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: reject(\n\t\t\t\tid,\n\t\t\t\t\"Authoring executable capabilities requires human confirmation, which is unavailable in this mode. \" +\n\t\t\t\t\t`Not activated.\\n${review}`,\n\t\t\t),\n\t\t};\n\t}\n\tconst confirmed = await ctx.ui.confirm(\n\t\t`Author executable plugin \"${id}\"?`,\n\t\t`${review}\\n\\nThis installs and can run the code above. Activate it?`,\n\t);\n\tif (!confirmed) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: {\n\t\t\t\tcontent: [{ type: \"text\" as const, text: `Declined — plugin \"${id}\" was not authored.` }],\n\t\t\t\tdetails: { id, authored: false, confirmed: false },\n\t\t\t},\n\t\t};\n\t}\n\treturn { ok: true, gated: true };\n}\n\n// ── ProposePlugin (create) ────────────────────────────────────────────────────\n\nconst proposeParams = Type.Object(\n\t{ id: Type.String({ description: \"Plugin id (directory + manifest name).\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createProposePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof proposeParams, AuthorPluginDetails>({\n\t\tname: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tlabel: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Author a NEW plugin to fill a capability gap when no marketplace plugin fits. Accepts any capability mix — \" +\n\t\t\t\"skills, slash commands, subagents, hooks, MCP servers. Passive content (skills, commands, read-only \" +\n\t\t\t\"subagents) is authored autonomously; executable content (hooks, MCP servers, mutating subagents) is shown \" +\n\t\t\t\"and requires human confirmation before it activates. To change an existing plugin, use UpdatePlugin.\",\n\t\tpromptSnippet:\n\t\t\t\"Author a new plugin to fill a capability gap (passive is autonomous; executable asks to confirm).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Sense reusability proactively: when you complete a multi-step recipe you'd plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it with ProposePlugin. Passive skills/commands activate immediately and are reversible with UninstallPlugin — announce what you created and why.\",\n\t\t\t\"One tool for the whole plugin: put skills + a hook in a single call. The risk gate is computed from content — you don't pre-classify. Read-only subagents and skills/commands go straight through; hooks, MCP servers, or a subagent needing Bash/Write/Edit/MCP or tools:* pause for human confirmation.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t\t\"Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.\",\n\t\t],\n\t\tparameters: proposeParams,\n\t\tasync execute(_id, params: Static<typeof proposeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tif (capabilityCount(params) === 0) {\n\t\t\t\treturn reject(params.id, \"Nothing to author. Provide skills, commands, subagents, hooks, or mcpServers.\");\n\t\t\t}\n\n\t\t\tif (pluginExists(ctx.cwd, params.id)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`A plugin named \"${params.id}\" already exists. Use UpdatePlugin to change it, or pick another id.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx);\n\t\t\tif (!gate.ok) return gate.result;\n\n\t\t\tconst platforms = resolvePlatforms(params.platforms);\n\t\t\tconst result = writePluginDraft(ctx.cwd, draftFrom(params.id, params, platforms), platforms);\n\t\t\t// Passive capabilities activate live — usable on the very next model request,\n\t\t\t// this same turn; hooks/MCP servers activate via the reload once the turn ends.\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest, \"Authored\")}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Authored plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── UpdatePlugin (merge into an existing local plugin) ─────────────────────────\n\nconst updateParams = Type.Object(\n\t{ id: Type.String({ description: \"Id of the existing local plugin to update.\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createUpdatePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof updateParams, AuthorPluginDetails>({\n\t\tname: UPDATE_PLUGIN_TOOL_NAME,\n\t\tlabel: UPDATE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Merge inline-authored capabilities into an EXISTING locally AUTHORED plugin (marketplace-installed plugins \" +\n\t\t\t\"are refused). Skills/commands/subagents are added or replaced by name; hooks and MCP servers are unioned \" +\n\t\t\t\"with what's already there; metadata is overwritten only where you supply it. Additive only — remove a \" +\n\t\t\t\"capability with RemovePluginCapability. Nothing is fetched from a remote. Passive \" +\n\t\t\t\"additions apply autonomously; executable additions (hooks, MCP servers, mutating subagents) require human \" +\n\t\t\t\"confirmation. Use ProposePlugin to create.\",\n\t\tpromptSnippet:\n\t\t\t\"Add/replace capabilities in a plugin you authored (additive; executable additions ask to confirm).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use UpdatePlugin to grow a plugin you already authored — e.g. add a skill to it, or attach a hook. Supply only the delta; existing capabilities are preserved (a matching name replaces just that one). It cannot remove a capability — use RemovePluginCapability for that.\",\n\t\t\t\"Hooks cannot be modified in place: they have no name, so supplying a changed command ADDS a second hook alongside the old one (both fire). To change a hook, RemovePluginCapability the old one first, then add the new one here.\",\n\t\t\t\"Only executable *additions* trigger confirmation — adding a passive skill to an already-executable plugin does not re-prompt.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t],\n\t\tparameters: updateParams,\n\t\tasync execute(_id, params: Static<typeof updateParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`No plugin named \"${params.id}\" is installed. Use ProposePlugin to create it first.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t// Authored-only: marketplace installs land in the same directory but don't\n\t\t\t// round-trip losslessly through our emitters (see mergePluginDraft).\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"UpdatePlugin only modifies locally authored plugins — updating a marketplace plugin is a human \" +\n\t\t\t\t\t\t\"action (uninstall it and install a newer version instead).\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (capabilityCount(params) === 0 && !params.version && !params.description && !params.platforms) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t\"Nothing to update. Provide skills, commands, subagents, hooks, mcpServers, platforms, or metadata.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Gate on the DELTA only — existing executables aren't re-confirmed.\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx);\n\t\t\tif (!gate.ok) return gate.result;\n\n\t\t\tconst result = mergePluginDraft(\n\t\t\t\tctx.cwd,\n\t\t\t\tparams.id,\n\t\t\t\tdraftFrom(params.id, params, existing.supportPlatform),\n\t\t\t\tparams.platforms,\n\t\t\t);\n\t\t\tconst platforms = result.plugin?.supportPlatform ?? existing.supportPlatform;\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest, \"Updated\")}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Updated plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── RemovePluginCapability (subtract from an authored plugin) ─────────────────\n\nconst hookRemovalSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event of the hook(s) to remove, e.g. PreToolUse.\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this matcher.\" })),\n\t\tcommand: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this command.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst removeParams = Type.Object(\n\t{\n\t\tid: Type.String({ description: \"Id of the authored plugin to remove capabilities from.\" }),\n\t\tskills: Type.Optional(Type.Array(Type.String(), { description: \"Skill names to remove.\" })),\n\t\tcommands: Type.Optional(Type.Array(Type.String(), { description: \"Command names to remove.\" })),\n\t\tsubagents: Type.Optional(Type.Array(Type.String(), { description: \"Subagent names to remove.\" })),\n\t\tmcpServers: Type.Optional(Type.Array(Type.String(), { description: \"MCP server names to remove.\" })),\n\t\thooks: Type.Optional(\n\t\t\tType.Array(hookRemovalSchema, {\n\t\t\t\tdescription: \"Hooks to remove, matched by event and narrowed by matcher/command when provided.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport interface RemovePluginCapabilityDetails {\n\tid: string;\n\tremoved: string[];\n\tmissing: string[];\n}\n\nexport function createRemovePluginCapabilityToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof removeParams, RemovePluginCapabilityDetails>({\n\t\tname: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tlabel: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Remove named capabilities from a locally AUTHORED plugin — skills, commands, subagents, and MCP servers by \" +\n\t\t\t\"name; hooks by event (narrowed by matcher/command). The subtractive half of UpdatePlugin. Removal is \" +\n\t\t\t\"low-risk and autonomous (deleting capabilities cannot execute code). To remove the whole plugin, use \" +\n\t\t\t\"UninstallPlugin; marketplace-installed plugins are refused here.\",\n\t\tpromptSnippet: \"Remove capabilities from a plugin you authored (low risk; autonomous).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Removal runs autonomously (the low-risk direction) — announce what you removed and why.\",\n\t\t\t\"To CHANGE a hook (hooks have no name to replace by): RemovePluginCapability the old hook, then UpdatePlugin the new one (which asks for confirmation).\",\n\t\t],\n\t\tparameters: removeParams,\n\t\tasync execute(_id, params: Static<typeof removeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst noDetails = (msg: string) => ({\n\t\t\t\tcontent: [{ type: \"text\" as const, text: msg }],\n\t\t\t\tdetails: { id: params.id, removed: [], missing: [] },\n\t\t\t});\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn noDetails(`No plugin named \"${params.id}\" is installed.`);\n\t\t\t}\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn noDetails(\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"RemovePluginCapability only edits locally authored plugins — use UninstallPlugin to remove it entirely.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst requested =\n\t\t\t\t(params.skills?.length ?? 0) +\n\t\t\t\t(params.commands?.length ?? 0) +\n\t\t\t\t(params.subagents?.length ?? 0) +\n\t\t\t\t(params.mcpServers?.length ?? 0) +\n\t\t\t\t(params.hooks?.length ?? 0);\n\t\t\tif (requested === 0) {\n\t\t\t\treturn noDetails(\"Nothing to remove. Name skills, commands, subagents, mcpServers, or hooks.\");\n\t\t\t}\n\n\t\t\tconst result = removeFromPlugin(ctx.cwd, params.id, {\n\t\t\t\tskills: params.skills,\n\t\t\t\tcommands: params.commands,\n\t\t\t\tsubagents: params.subagents,\n\t\t\t\tmcpServers: params.mcpServers,\n\t\t\t\thooks: params.hooks,\n\t\t\t});\n\t\t\tconst lines: string[] = [];\n\t\t\tif (result.removed.length > 0) {\n\t\t\t\tlines.push(`Removed from plugin \"${params.id}\":`, ...result.removed.map((r) => `  ${r}`));\n\t\t\t}\n\t\t\tif (result.missing.length > 0) {\n\t\t\t\tlines.push(`Not found (nothing removed):`, ...result.missing.map((m) => `  ${m}`));\n\t\t\t}\n\t\t\tconst text = lines.join(\"\\n\");\n\t\t\t// Removal takes effect through the reload path, same as UninstallPlugin.\n\t\t\tif (result.removed.length > 0) ctx.requestReloadWhenIdle();\n\t\t\tctx.ui.notify(text, result.removed.length > 0 ? \"info\" : \"warning\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, removed: result.removed, missing: result.missing },\n\t\t\t};\n\t\t},\n\t});\n}\n\n/** All three authoring tool definitions, for registration on the top-level agent. */\nexport function createProposePluginToolDefinitions(): ToolDefinition[] {\n\treturn [\n\t\tcreateProposePluginToolDefinition(),\n\t\tcreateUpdatePluginToolDefinition(),\n\t\tcreateRemovePluginCapabilityToolDefinition(),\n\t];\n}\n"]}