@kolisachint/hoocode-agent 0.4.131 → 0.4.133

package/dist/core/tools/propose-plugin.js

@@ -1,14 +1,21 @@
 /**
- * Capability authoring tools (spec §3). The two escalating-risk build paths are
- * kept as *separate tools* by design — not collapsed into one:
+ * Capability authoring tools (spec §3), refactored to a single risk-gated path.
  *
- *   ProposePlugin            scaffold passive/low-risk capabilities — skills,
- *                            commands, and read-only subagents. Autonomous +
- *                            transparent (near-zero risk, reversible).
- *   ProposeExecutablePlugin  the risk-bearing path — hooks, MCP servers, and
- *                            mutating/high-privilege subagents. Draft → display
- *                            the code and the tool grant → human confirms →
- *                            activate. Bar >= install.
+ *   ProposePlugin  author a NEW plugin from any capability mix — skills,
+ *                  commands, subagents, hooks, MCP servers. The risk gate is
+ *                  *computed from content*, not pre-declared by tool choice:
+ *                  passive content (skills, commands, read-only subagents) is
+ *                  authored autonomously; executable content (hooks, MCP servers,
+ *                  mutating/high-privilege subagents) auto-triggers a "show the
+ *                  code + tool grant → human confirms → activate" gate in the
+ *                  same call. A mixed plugin (skill + hook) is authored in one
+ *                  call, and a hook can never be mis-routed through a "passive"
+ *                  tool because the gate keys off what the draft contains.
+ *   UpdatePlugin   merge inline-authored capabilities into an EXISTING local
+ *                  plugin. Nothing is fetched from a remote, so the supply-chain
+ *                  "benign v1 → hostile v2" risk that keeps a marketplace
+ *                  UpdatePlugin out of the model's hands does not apply here;
+ *                  executable additions still pass through the same confirm gate.
  *
  * Both author into `.agents/plugins/<id>/` in the requested vendor layouts
  * (Claude Code + GitHub Copilot by default) via the format registry, so results
@@ -19,10 +26,10 @@
  * both tools — so a low-trust authored agent cannot bootstrap privilege.
  */
 import { Type } from "typebox";
-import { classifyAllowlist, pluginExists, resolveAuthoringPlatforms, writePluginDraft, } from "../extensions/plugins/authoring.js";
+import { classifyAllowlist, getPlugin, isAuthoredPlugin, mergePluginDraft, pluginExists, removeFromPlugin, resolveAuthoringPlatforms, writePluginDraft, } from "../extensions/plugins/authoring.js";
 import { defineTool } from "../extensions/types.js";
-import { PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME, PROPOSE_PLUGIN_TOOL_NAME } from "./plugin-tool-names.js";
-export { PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME, PROPOSE_PLUGIN_TOOL_NAME } from "./plugin-tool-names.js";
+import { PROPOSE_PLUGIN_TOOL_NAME, REMOVE_PLUGIN_CAPABILITY_TOOL_NAME, UPDATE_PLUGIN_TOOL_NAME, } from "./plugin-tool-names.js";
+export { PROPOSE_PLUGIN_TOOL_NAME, REMOVE_PLUGIN_CAPABILITY_TOOL_NAME, UPDATE_PLUGIN_TOOL_NAME, } from "./plugin-tool-names.js";
 const platformSchema = Type.Union([Type.Literal("claude"), Type.Literal("github"), Type.Literal("agents")], {
     description: "Target format: claude (Claude Code), github (GitHub Copilot), or agents (native).",
 });
@@ -39,7 +46,10 @@ const commandSchema = Type.Object({
 const subagentSchema = Type.Object({
     name: Type.String({ description: "Subagent name." }),
     description: Type.Optional(Type.String({ description: "When to dispatch this subagent." })),
-    tools: Type.Optional(Type.String({ description: "Comma-separated allowed-tools, e.g. 'read, grep, glob'. Omit for none." })),
+    tools: Type.Optional(Type.String({
+        description: "Comma-separated allowed-tools, e.g. 'read, grep, glob'. Read-only grants are autonomous; " +
+            "mutating/exec/network grants (Bash, Write, Edit, MCP) or '*' require human confirmation. Omit for none.",
+    })),
     model: Type.Optional(Type.String({ description: "Model override, or 'inherit'." })),
     body: Type.String({ description: "System-prompt / instruction body (markdown)." }),
 }, { additionalProperties: false });
@@ -55,177 +65,300 @@ const mcpServerSchema = Type.Object({
     args: Type.Optional(Type.Array(Type.String(), { description: "Command arguments." })),
     env: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Environment variables." })),
 }, { additionalProperties: false });
+/** The capability params shared by ProposePlugin (create) and UpdatePlugin (merge). */
+const capabilityProps = {
+    description: Type.Optional(Type.String({ description: "Plugin description." })),
+    version: Type.Optional(Type.String({ description: "Plugin version, e.g. '0.1.0'." })),
+    platforms: Type.Optional(Type.Array(platformSchema, {
+        description: "Formats to scaffold into. Default: the session's --support-platform targets, else claude + github " +
+            "(UpdatePlugin defaults to the plugin's existing platforms).",
+    })),
+    skills: Type.Optional(Type.Array(skillSchema)),
+    commands: Type.Optional(Type.Array(commandSchema)),
+    subagents: Type.Optional(Type.Array(subagentSchema, {
+        description: "Subagents. Read-only allowlists are autonomous; mutating ones trigger human confirmation.",
+    })),
+    hooks: Type.Optional(Type.Array(hookSchema, { description: "Shell hooks (executable — trigger confirmation)." })),
+    mcpServers: Type.Optional(Type.Array(mcpServerSchema, { description: "MCP servers (executable — trigger confirmation)." })),
+};
 function resolvePlatforms(input) {
     // Explicit tool param → session --support-platform targets → claude + github.
     return resolveAuthoringPlatforms(input);
 }
-function summarizeWrite(id, platforms, files, dest) {
-    return (`Authored plugin "${id}" (${platforms.join(", ")}) with ${files.length} file(s) at ${dest}:\n` +
+function draftFrom(id, params, platforms) {
+    return {
+        id,
+        version: params.version,
+        description: params.description,
+        supportPlatform: platforms,
+        skills: params.skills,
+        commands: params.commands,
+        agents: params.subagents,
+        hooks: params.hooks,
+        mcpServers: params.mcpServers,
+    };
+}
+/** Total capabilities carried by the draft (empty arrays count as nothing). */
+function capabilityCount(params) {
+    return ((params.skills?.length ?? 0) +
+        (params.commands?.length ?? 0) +
+        (params.subagents?.length ?? 0) +
+        (params.hooks?.length ?? 0) +
+        (params.mcpServers?.length ?? 0));
+}
+/** The subagents whose allowlist makes them mutating/high-privilege (need the confirm gate). */
+function mutatingSubagents(params) {
+    return (params.subagents ?? []).filter((sa) => classifyAllowlist(sa.tools).risk === "mutating");
+}
+/** True when the draft carries anything executable — hooks, MCP servers, or a mutating subagent. */
+function hasExecutable(params) {
+    return ((params.hooks?.length ?? 0) > 0 || (params.mcpServers?.length ?? 0) > 0 || mutatingSubagents(params).length > 0);
+}
+/** Reject if any subagent carries a plugin-system tool (privilege-amplification guardrail). Returns the message, or null. */
+function guardrailViolation(params) {
+    for (const sa of params.subagents ?? []) {
+        const cls = classifyAllowlist(sa.tools);
+        if (cls.pluginTools.length > 0) {
+            return (`Subagent "${sa.name}" requests plugin-system tools (${cls.pluginTools.join(", ")}). ` +
+                "Authored subagents may never carry capability-acquisition tools.");
+        }
+    }
+    return null;
+}
+/** Build the human-facing review text: the executable code and every mutating tool grant. */
+function buildReview(id, params) {
+    const lines = [`Plugin "${id}" wants to install executable capabilities:`];
+    for (const h of params.hooks ?? []) {
+        lines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : ""}]: ${h.command}`);
+    }
+    for (const s of params.mcpServers ?? []) {
+        lines.push(`  mcp server "${s.name}": ${s.command}${s.args?.length ? ` ${s.args.join(" ")}` : ""}`);
+    }
+    for (const sa of mutatingSubagents(params)) {
+        lines.push(`  subagent "${sa.name}" tools: ${sa.tools ?? "(none)"} (${classifyAllowlist(sa.tools).reason})`);
+    }
+    return lines.join("\n");
+}
+function summarizeWrite(id, platforms, files, dest, verb) {
+    return (`${verb} plugin "${id}" (${platforms.join(", ")}) with ${files.length} file(s) at ${dest}:\n` +
         files.map((f) => `  ${f}`).join("\n") +
         `\nRemove it with UninstallPlugin.`);
 }
-// ── ProposePlugin (scaffold path) ─────────────────────────────────────────────
-const proposeParams = Type.Object({
-    id: Type.String({ description: "Plugin id (directory + manifest name)." }),
-    description: Type.Optional(Type.String({ description: "Plugin description." })),
-    version: Type.Optional(Type.String({ description: "Plugin version, e.g. '0.1.0'." })),
-    platforms: Type.Optional(Type.Array(platformSchema, {
-        description: "Formats to scaffold into. Default: the session's --support-platform targets, else claude + github.",
-    })),
-    skills: Type.Optional(Type.Array(skillSchema)),
-    commands: Type.Optional(Type.Array(commandSchema)),
-    subagents: Type.Optional(Type.Array(subagentSchema, { description: "Read-only subagents only (mutating grants are rejected here)." })),
-}, { additionalProperties: false });
+function reject(id, message) {
+    return { content: [{ type: "text", text: message }], details: { id, authored: false } };
+}
+/**
+ * Run the shared "executable capabilities → show → confirm" gate. Returns:
+ *  - `{ ok: true }` when there is nothing executable, or the human confirmed;
+ *  - a tool result (authored:false) when there is no UI to confirm on, or the
+ *    human declined.
+ */
+async function passExecutableGate(id, params, ctx) {
+    if (!hasExecutable(params))
+        return { ok: true, gated: false };
+    const review = buildReview(id, params);
+    ctx.ui.notify(review, "warning");
+    if (!ctx.hasUI) {
+        return {
+            ok: false,
+            result: reject(id, "Authoring executable capabilities requires human confirmation, which is unavailable in this mode. " +
+                `Not activated.\n${review}`),
+        };
+    }
+    const confirmed = await ctx.ui.confirm(`Author executable plugin "${id}"?`, `${review}\n\nThis installs and can run the code above. Activate it?`);
+    if (!confirmed) {
+        return {
+            ok: false,
+            result: {
+                content: [{ type: "text", text: `Declined — plugin "${id}" was not authored.` }],
+                details: { id, authored: false, confirmed: false },
+            },
+        };
+    }
+    return { ok: true, gated: true };
+}
+// ── ProposePlugin (create) ────────────────────────────────────────────────────
+const proposeParams = Type.Object({ id: Type.String({ description: "Plugin id (directory + manifest name)." }), ...capabilityProps }, { additionalProperties: false });
 export function createProposePluginToolDefinition() {
     return defineTool({
         name: PROPOSE_PLUGIN_TOOL_NAME,
         label: PROPOSE_PLUGIN_TOOL_NAME,
-        description: "Author a new plugin from passive, low-risk capabilities — skills, slash commands, and READ-ONLY subagents — when no marketplace plugin fits a gap. Scaffolds a proper plugin (Claude Code + GitHub Copilot layouts by default). Autonomous and reversible. For hooks, MCP servers, or mutating/high-privilege subagents, use ProposeExecutablePlugin instead.",
-        promptSnippet: "Author a skill/command/read-only-subagent plugin to fill a capability gap (scaffold; reversible).",
+        description: "Author a NEW plugin to fill a capability gap when no marketplace plugin fits. Accepts any capability mix — " +
+            "skills, slash commands, subagents, hooks, MCP servers. Passive content (skills, commands, read-only " +
+            "subagents) is authored autonomously; executable content (hooks, MCP servers, mutating subagents) is shown " +
+            "and requires human confirmation before it activates. To change an existing plugin, use UpdatePlugin.",
+        promptSnippet: "Author a new plugin to fill a capability gap (passive is autonomous; executable asks to confirm).",
         promptGuidelines: [
-            "Sense reusability proactively: when you complete a multi-step recipe you would plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it as a skill/command with ProposePlugin autonomously — announce what you created and why. It activates immediately and is reversible with UninstallPlugin.",
-            "Use ProposePlugin only for passive capabilities: skills, commands, and subagents whose tools are read-only (read, grep, glob, webfetch).",
-            "A subagent that needs Bash/Write/Edit/MCP or tools:* is mutating — author it with ProposeExecutablePlugin (human confirmation), not here.",
+            "Sense reusability proactively: when you complete a multi-step recipe you'd plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it with ProposePlugin. Passive skills/commands activate immediately and are reversible with UninstallPlugin — announce what you created and why.",
+            "One tool for the whole plugin: put skills + a hook in a single call. The risk gate is computed from content — you don't pre-classify. Read-only subagents and skills/commands go straight through; hooks, MCP servers, or a subagent needing Bash/Write/Edit/MCP or tools:* pause for human confirmation.",
             "Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.",
+            "Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.",
         ],
         parameters: proposeParams,
         async execute(_id, params, _signal, _onUpdate, ctx) {
-            const platforms = resolvePlatforms(params.platforms);
-            // Guardrail + risk gate on each subagent before writing anything.
-            for (const sa of params.subagents ?? []) {
-                const cls = classifyAllowlist(sa.tools);
-                if (cls.pluginTools.length > 0) {
-                    return reject(`Subagent "${sa.name}" requests plugin-system tools (${cls.pluginTools.join(", ")}). ` +
-                        "Authored subagents may never carry capability-acquisition tools.", params.id);
-                }
-                if (cls.risk === "mutating") {
-                    return reject(`Subagent "${sa.name}" has a mutating allowlist (${cls.reason}). ` +
-                        "Use ProposeExecutablePlugin so the human can review and confirm the tool grant.", params.id);
-                }
+            const violation = guardrailViolation(params);
+            if (violation)
+                return reject(params.id, violation);
+            if (capabilityCount(params) === 0) {
+                return reject(params.id, "Nothing to author. Provide skills, commands, subagents, hooks, or mcpServers.");
             }
             if (pluginExists(ctx.cwd, params.id)) {
-                return reject(`A plugin named "${params.id}" already exists. Uninstall it first or pick another id.`, params.id);
+                return reject(params.id, `A plugin named "${params.id}" already exists. Use UpdatePlugin to change it, or pick another id.`);
             }
-            const draft = {
-                id: params.id,
-                version: params.version,
-                description: params.description,
-                supportPlatform: platforms,
-                skills: params.skills,
-                commands: params.commands,
-                agents: params.subagents,
-            };
-            const result = writePluginDraft(ctx.cwd, draft, platforms);
-            // Passive capabilities activate live — the authored skill/command/subagent
-            // is usable on the very next model request, in this same turn.
+            const gate = await passExecutableGate(params.id, params, ctx);
+            if (!gate.ok)
+                return gate.result;
+            const platforms = resolvePlatforms(params.platforms);
+            const result = writePluginDraft(ctx.cwd, draftFrom(params.id, params, platforms), platforms);
+            // Passive capabilities activate live — usable on the very next model request,
+            // this same turn; hooks/MCP servers activate via the reload once the turn ends.
             const activation = ctx.activatePlugin(result.dest);
-            const text = `${summarizeWrite(params.id, platforms, result.files, result.dest)}\n${activation.message}`;
+            const text = `${summarizeWrite(params.id, platforms, result.files, result.dest, "Authored")}\n${activation.message}`;
             ctx.ui.notify(`Authored plugin "${params.id}" (${platforms.join(", ")}).`, "info");
-            return { content: [{ type: "text", text }], details: { id: params.id, authored: true } };
+            return {
+                content: [{ type: "text", text }],
+                details: { id: params.id, authored: true, confirmed: gate.gated },
+            };
         },
     });
 }
-// ── ProposeExecutablePlugin (risk-bearing path) ───────────────────────────────
-const proposeExecParams = Type.Object({
-    id: Type.String({ description: "Plugin id (directory + manifest name)." }),
-    description: Type.Optional(Type.String({ description: "Plugin description." })),
-    version: Type.Optional(Type.String({ description: "Plugin version, e.g. '0.1.0'." })),
-    platforms: Type.Optional(Type.Array(platformSchema, {
-        description: "Formats to scaffold into. Default: the session's --support-platform targets, else claude + github.",
-    })),
-    hooks: Type.Optional(Type.Array(hookSchema)),
-    mcpServers: Type.Optional(Type.Array(mcpServerSchema)),
-    subagents: Type.Optional(Type.Array(subagentSchema, { description: "Subagents with mutating/exec/network or tools:* allowlists." })),
-}, { additionalProperties: false });
-/** Build the human-facing review text: the executable code and every tool grant. */
-function buildReview(params) {
-    const lines = [`Plugin "${params.id}" wants to install executable capabilities:`];
-    for (const h of params.hooks ?? []) {
-        lines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : ""}]: ${h.command}`);
-    }
-    for (const s of params.mcpServers ?? []) {
-        lines.push(`  mcp server "${s.name}": ${s.command}${s.args?.length ? ` ${s.args.join(" ")}` : ""}`);
-    }
-    for (const sa of params.subagents ?? []) {
-        lines.push(`  subagent "${sa.name}" tools: ${sa.tools ?? "(none)"}`);
-    }
-    return lines.join("\n");
-}
-export function createProposeExecutablePluginToolDefinition() {
+// ── UpdatePlugin (merge into an existing local plugin) ─────────────────────────
+const updateParams = Type.Object({ id: Type.String({ description: "Id of the existing local plugin to update." }), ...capabilityProps }, { additionalProperties: false });
+export function createUpdatePluginToolDefinition() {
     return defineTool({
-        name: PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME,
-        label: PROPOSE_EXECUTABLE_PLUGIN_TOOL_NAME,
-        description: "Author a plugin that includes EXECUTABLE or high-privilege capabilities — hooks (run on tool events), MCP servers, or subagents with mutating/exec/network tool grants. The code and the exact tool grant are shown to the human, who must confirm before anything is activated. Use ProposePlugin for passive skills/commands/read-only subagents.",
-        promptSnippet: "Author a hook/MCP/high-privilege-subagent plugin (shows the code; requires human confirmation).",
+        name: UPDATE_PLUGIN_TOOL_NAME,
+        label: UPDATE_PLUGIN_TOOL_NAME,
+        description: "Merge inline-authored capabilities into an EXISTING locally AUTHORED plugin (marketplace-installed plugins " +
+            "are refused). Skills/commands/subagents are added or replaced by name; hooks and MCP servers are unioned " +
+            "with what's already there; metadata is overwritten only where you supply it. Additive only — remove a " +
+            "capability with RemovePluginCapability. Nothing is fetched from a remote. Passive " +
+            "additions apply autonomously; executable additions (hooks, MCP servers, mutating subagents) require human " +
+            "confirmation. Use ProposePlugin to create.",
+        promptSnippet: "Add/replace capabilities in a plugin you authored (additive; executable additions ask to confirm).",
         promptGuidelines: [
-            "ProposeExecutablePlugin always shows the code and tool grant and requires explicit human confirmation before activating.",
+            "Use UpdatePlugin to grow a plugin you already authored — e.g. add a skill to it, or attach a hook. Supply only the delta; existing capabilities are preserved (a matching name replaces just that one). It cannot remove a capability — use RemovePluginCapability for that.",
+            "Hooks cannot be modified in place: they have no name, so supplying a changed command ADDS a second hook alongside the old one (both fire). To change a hook, RemovePluginCapability the old one first, then add the new one here.",
+            "Only executable *additions* trigger confirmation — adding a passive skill to an already-executable plugin does not re-prompt.",
             "Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.",
-            "Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.",
         ],
-        parameters: proposeExecParams,
+        parameters: updateParams,
         async execute(_id, params, _signal, _onUpdate, ctx) {
-            const platforms = resolvePlatforms(params.platforms);
-            // Guardrail: authored subagents may never carry plugin-system tools.
-            for (const sa of params.subagents ?? []) {
-                const cls = classifyAllowlist(sa.tools);
-                if (cls.pluginTools.length > 0) {
-                    return rejectExec(`Subagent "${sa.name}" requests plugin-system tools (${cls.pluginTools.join(", ")}). ` +
-                        "Authored subagents may never carry capability-acquisition tools.", params.id);
-                }
+            const violation = guardrailViolation(params);
+            if (violation)
+                return reject(params.id, violation);
+            const existing = getPlugin(ctx.cwd, params.id);
+            if (!existing) {
+                return reject(params.id, `No plugin named "${params.id}" is installed. Use ProposePlugin to create it first.`);
             }
-            const hasExecutable = (params.hooks?.length ?? 0) > 0 ||
-                (params.mcpServers?.length ?? 0) > 0 ||
-                (params.subagents?.length ?? 0) > 0;
-            if (!hasExecutable) {
-                return rejectExec("Nothing to author. Provide hooks, mcpServers, or subagents.", params.id);
+            // Authored-only: marketplace installs land in the same directory but don't
+            // round-trip losslessly through our emitters (see mergePluginDraft).
+            if (!isAuthoredPlugin(ctx.cwd, params.id)) {
+                return reject(params.id, `Plugin "${params.id}" was not authored in this workspace (likely installed from a marketplace). ` +
+                    "UpdatePlugin only modifies locally authored plugins — updating a marketplace plugin is a human " +
+                    "action (uninstall it and install a newer version instead).");
             }
-            if (pluginExists(ctx.cwd, params.id)) {
-                return rejectExec(`A plugin named "${params.id}" already exists. Uninstall it first or pick another id.`, params.id);
+            if (capabilityCount(params) === 0 && !params.version && !params.description && !params.platforms) {
+                return reject(params.id, "Nothing to update. Provide skills, commands, subagents, hooks, mcpServers, platforms, or metadata.");
             }
-            // Draft → display → confirm → activate. Fail closed without a UI to confirm on.
-            const review = buildReview(params);
-            ctx.ui.notify(review, "warning");
-            if (!ctx.hasUI) {
-                return rejectExec("Authoring executable capabilities requires human confirmation, which is unavailable in this mode. " +
-                    `Not activated.\n${review}`, params.id);
+            // Gate on the DELTA only — existing executables aren't re-confirmed.
+            const gate = await passExecutableGate(params.id, params, ctx);
+            if (!gate.ok)
+                return gate.result;
+            const result = mergePluginDraft(ctx.cwd, params.id, draftFrom(params.id, params, existing.supportPlatform), params.platforms);
+            const platforms = result.plugin?.supportPlatform ?? existing.supportPlatform;
+            const activation = ctx.activatePlugin(result.dest);
+            const text = `${summarizeWrite(params.id, platforms, result.files, result.dest, "Updated")}\n${activation.message}`;
+            ctx.ui.notify(`Updated plugin "${params.id}" (${platforms.join(", ")}).`, "info");
+            return {
+                content: [{ type: "text", text }],
+                details: { id: params.id, authored: true, confirmed: gate.gated },
+            };
+        },
+    });
+}
+// ── RemovePluginCapability (subtract from an authored plugin) ─────────────────
+const hookRemovalSchema = Type.Object({
+    event: Type.String({ description: "Event of the hook(s) to remove, e.g. PreToolUse." }),
+    matcher: Type.Optional(Type.String({ description: "Narrow to hooks with exactly this matcher." })),
+    command: Type.Optional(Type.String({ description: "Narrow to hooks with exactly this command." })),
+}, { additionalProperties: false });
+const removeParams = Type.Object({
+    id: Type.String({ description: "Id of the authored plugin to remove capabilities from." }),
+    skills: Type.Optional(Type.Array(Type.String(), { description: "Skill names to remove." })),
+    commands: Type.Optional(Type.Array(Type.String(), { description: "Command names to remove." })),
+    subagents: Type.Optional(Type.Array(Type.String(), { description: "Subagent names to remove." })),
+    mcpServers: Type.Optional(Type.Array(Type.String(), { description: "MCP server names to remove." })),
+    hooks: Type.Optional(Type.Array(hookRemovalSchema, {
+        description: "Hooks to remove, matched by event and narrowed by matcher/command when provided.",
+    })),
+}, { additionalProperties: false });
+export function createRemovePluginCapabilityToolDefinition() {
+    return defineTool({
+        name: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,
+        label: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,
+        description: "Remove named capabilities from a locally AUTHORED plugin — skills, commands, subagents, and MCP servers by " +
+            "name; hooks by event (narrowed by matcher/command). The subtractive half of UpdatePlugin. Removal is " +
+            "low-risk and autonomous (deleting capabilities cannot execute code). To remove the whole plugin, use " +
+            "UninstallPlugin; marketplace-installed plugins are refused here.",
+        promptSnippet: "Remove capabilities from a plugin you authored (low risk; autonomous).",
+        promptGuidelines: [
+            "Removal runs autonomously (the low-risk direction) — announce what you removed and why.",
+            "To CHANGE a hook (hooks have no name to replace by): RemovePluginCapability the old hook, then UpdatePlugin the new one (which asks for confirmation).",
+        ],
+        parameters: removeParams,
+        async execute(_id, params, _signal, _onUpdate, ctx) {
+            const noDetails = (msg) => ({
+                content: [{ type: "text", text: msg }],
+                details: { id: params.id, removed: [], missing: [] },
+            });
+            const existing = getPlugin(ctx.cwd, params.id);
+            if (!existing) {
+                return noDetails(`No plugin named "${params.id}" is installed.`);
             }
-            const confirmed = await ctx.ui.confirm(`Author executable plugin "${params.id}"?`, `${review}\n\nThis installs and can run the code above. Activate it?`);
-            if (!confirmed) {
-                return {
-                    content: [{ type: "text", text: `Declined — plugin "${params.id}" was not authored.` }],
-                    details: { id: params.id, authored: false, confirmed: false },
-                };
+            if (!isAuthoredPlugin(ctx.cwd, params.id)) {
+                return noDetails(`Plugin "${params.id}" was not authored in this workspace (likely installed from a marketplace). ` +
+                    "RemovePluginCapability only edits locally authored plugins — use UninstallPlugin to remove it entirely.");
             }
-            const draft = {
-                id: params.id,
-                version: params.version,
-                description: params.description,
-                supportPlatform: platforms,
-                hooks: params.hooks,
+            const requested = (params.skills?.length ?? 0) +
+                (params.commands?.length ?? 0) +
+                (params.subagents?.length ?? 0) +
+                (params.mcpServers?.length ?? 0) +
+                (params.hooks?.length ?? 0);
+            if (requested === 0) {
+                return noDetails("Nothing to remove. Name skills, commands, subagents, mcpServers, or hooks.");
+            }
+            const result = removeFromPlugin(ctx.cwd, params.id, {
+                skills: params.skills,
+                commands: params.commands,
+                subagents: params.subagents,
                 mcpServers: params.mcpServers,
-                agents: params.subagents,
-            };
-            const result = writePluginDraft(ctx.cwd, draft, platforms);
-            // Human confirmed above: activate now. Subagents go live immediately;
-            // hooks/MCP servers activate via the automatic reload once the turn ends.
-            const activation = ctx.activatePlugin(result.dest);
-            const text = `${summarizeWrite(params.id, platforms, result.files, result.dest)}\n${activation.message}`;
-            ctx.ui.notify(`Authored executable plugin "${params.id}" (${platforms.join(", ")}).`, "info");
+                hooks: params.hooks,
+            });
+            const lines = [];
+            if (result.removed.length > 0) {
+                lines.push(`Removed from plugin "${params.id}":`, ...result.removed.map((r) => `  ${r}`));
+            }
+            if (result.missing.length > 0) {
+                lines.push(`Not found (nothing removed):`, ...result.missing.map((m) => `  ${m}`));
+            }
+            const text = lines.join("\n");
+            // Removal takes effect through the reload path, same as UninstallPlugin.
+            if (result.removed.length > 0)
+                ctx.requestReloadWhenIdle();
+            ctx.ui.notify(text, result.removed.length > 0 ? "info" : "warning");
             return {
                 content: [{ type: "text", text }],
-                details: { id: params.id, authored: true, confirmed: true },
+                details: { id: params.id, removed: result.removed, missing: result.missing },
             };
         },
     });
 }
-function reject(message, id) {
-    return { content: [{ type: "text", text: message }], details: { id, authored: false } };
-}
-function rejectExec(message, id) {
-    return { content: [{ type: "text", text: message }], details: { id, authored: false, confirmed: false } };
-}
-/** Both authoring tool definitions, for registration on the top-level agent. */
+/** All three authoring tool definitions, for registration on the top-level agent. */
 export function createProposePluginToolDefinitions() {
-    return [createProposePluginToolDefinition(), createProposeExecutablePluginToolDefinition()];
+    return [
+        createProposePluginToolDefinition(),
+        createUpdatePluginToolDefinition(),
+        createRemovePluginCapabilityToolDefinition(),
+    ];
 }
 //# sourceMappingURL=propose-plugin.js.map