@milpa/comal 0.1.7 → 0.2.1

package/src/permissions.mjs

@@ -1,16 +1,19 @@
 // Work controls write only the session ledger; nested effects still use the house judge.
 const READ_TOOLS = new Set(['Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch', 'McpStatus', 'HouseContext', 'HouseSnapshot', 'OperationCatalog', 'ReadTable', 'PluginStatus', 'WorkSnapshot', 'AuditStatus', 'EvidenceRead', 'WorkPlanSet', 'WorkCheckRepair', 'WorkTaskUpdate', 'WorkStepRun', 'WorkDraft', 'WorkBoard']);
-const EDIT_TOOLS = new Set(['Write', 'Edit', 'McpConfigure']);
+const EDIT_TOOLS = new Set(['Write', 'Edit', 'McpConfigure','GitIntegrationPrepare','GitIntegrationApply']);
 import { inspectAutoAction, intentCoversAction } from './auto-guard.mjs';
 import { randomUUID } from 'node:crypto';
-import { readOnlyBashCheck, chromeLabObservation } from './read-only-check.mjs';
+import { readOnlyBashCheck, chromeLabObservation, openRelayObservation } from './read-only-check.mjs';
+import { describeRule, suggestRule } from './permission-rules.mjs';
 READ_TOOLS.add('ToolPack');
 for (const name of ['ArtifactAccount','ArtifactCapabilities','ArtifactList','ArtifactInspect']) READ_TOOLS.add(name);
-for (const name of ['ListDirectory', 'FileInfo']) READ_TOOLS.add(name);
+for (const name of ['ListDirectory', 'FileInfo', 'SourceRead', 'GitInspect','GitIntegrationStatus','GitIntegrationEvidence']) READ_TOOLS.add(name);
 for (const name of ['ListAgents','SendMessage','ProviderCapabilities','ProviderSearch','AnalyzeMedia']) READ_TOOLS.add(name);
 
 export const PERMISSION_MODES = ['default', 'acceptEdits', 'plan', 'auto'];
-export function nextPermissionMode(mode) { return PERMISSION_MODES[(PERMISSION_MODES.indexOf(mode) + 1) % PERMISSION_MODES.length]; }
+export const BYPASS_PERMISSION_MODE = 'bypassPermissions';
+export const BYPASS_LOCKED_MESSAGE = 'Permission bypass is fixed for this process. Restart Comal without --dangerously-skip-permissions to change modes.';
+export function nextPermissionMode(mode) { return mode === BYPASS_PERMISSION_MODE ? mode : PERMISSION_MODES[(PERMISSION_MODES.indexOf(mode) + 1) % PERMISSION_MODES.length]; }
 
 // A UI callback may be shared by resident and subagent policies. One visible
 // question at a time prevents another invocation from replacing its authority.
@@ -28,31 +31,98 @@ function waitWithAbort(promise, signal) {
   });
 }
 function permissionStamp(policy) {
+  return JSON.stringify([policy.mode,[...policy.allowed].sort(),[...policy.denied].sort(),policy.context?.intentions,policy.rules?.revision ?? null]);
+}
+// Lo que House observa como autoridad; si sólo cambian las reglas guardadas, la propia
+// política vuelve a decidir (p. ej. otra pregunta acaba de guardar «sí, siempre»).
+function houseStamp(policy) {
   return JSON.stringify([policy.mode,[...policy.allowed].sort(),[...policy.denied].sort(),policy.context?.intentions]);
 }
+// La tarjeta puede responder true/false o { allowed, remember: 'project'|'user' }.
+function normalizeAnswer(value, offer) {
+  if (value && typeof value === 'object') return { allowed: Boolean(value.allowed), remember: offer && value.allowed && ['project', 'user'].includes(value.remember) ? value.remember : null };
+  if (offer && ['project', 'user'].includes(value)) return { allowed: true, remember: value };
+  return { allowed: Boolean(value), remember: null };
+}
+const CONFIRM_ALWAYS = 'confirm:"always"';
 
 export class PermissionPolicy {
-  constructor({ mode = 'default', allowed = [], denied = [], confirm, classifier, cwd, onDecision = () => {} } = {}) {
-    if (!PERMISSION_MODES.includes(mode)) throw new Error('Invalid permission mode. Use default, plan, acceptEdits or auto.');
-    this.mode = mode; this.allowed = new Set(allowed); this.denied = new Set(denied); this.confirm = confirm;
-    this.classifier = classifier; this.cwd = cwd; this.onDecision = onDecision; this.context = { intentions: [], actions: [] };
+  #mode;
+  // rules: almacén de reglas guardadas (permission-rules.mjs) con decide(name, input) → {list, rule, scope}.
+  // contractOf(name): contrato vivo de la operación (house.registry.get(name)?.contract); de ahí sale
+  // el techo duro confirm:'always', que sólo el host lee y el modelo no puede cambiar.
+  constructor({ mode = 'default', dangerouslySkipPermissions = false, allowed = [], denied = [], confirm, classifier, cwd, rules, contractOf, onDecision = () => {} } = {}) {
+    if (!PERMISSION_MODES.includes(mode) && !(dangerouslySkipPermissions === true && mode === BYPASS_PERMISSION_MODE)) throw new Error('Invalid permission mode. Use default, plan, acceptEdits or auto; bypass requires the startup flag.');
+    Object.defineProperty(this, 'dangerouslySkipPermissions', { value: dangerouslySkipPermissions === true, enumerable: true });
+    this.#mode = this.dangerouslySkipPermissions ? BYPASS_PERMISSION_MODE : mode;
+    this.allowed = new Set(allowed); this.denied = new Set(denied); this.confirm = confirm;
+    this.classifier = classifier; this.cwd = cwd; this.rules = rules; this.contractOf = contractOf; this.onDecision = onDecision; this.context = { intentions: [], actions: [] };
+  }
+  get mode() { return this.#mode; }
+  set mode(mode) {
+    if (this.dangerouslySkipPermissions) throw new Error(BYPASS_LOCKED_MESSAGE);
+    if (!PERMISSION_MODES.includes(mode)) throw new Error('Bypass requires --dangerously-skip-permissions at startup; it cannot be enabled by changing modes.');
+    this.#mode = mode;
   }
   setContext(context) { this.context = context; }
-  async authorize(name, input, { signal, onWaiting } = {}) {
+  /** ¿Declara el contrato vivo de la operación confirm:'always'? */
+  confirmAlways(name) { try { return this.contractOf?.(name)?.confirm === 'always'; } catch { return false; } }
+  /**
+   * Precedencia (la primera que decide gana):
+   *  1. --disallowed-tools y reglas deny;
+   *  2. bypass de arranque (--dangerously-skip-permissions);
+   *  3. techo confirm:'always' (plan → deniega; sin humano → deniega; si no, pregunta siempre);
+   *  4. reglas ask (preguntan incluso en auto);
+   *  5. plan (sólo lecturas), lecturas nativas, allow / --allowed-tools;
+   *  6. modos: auto (guardia + clasificador), acceptEdits, default (pregunta).
+   */
+  async authorize(name, input, options = {}) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const result = await this.#authorize(name, input, options);
+      if (!result.stale) return result;
+    }
+    return { allowed: false, reason: 'Las reglas de permiso cambiaron mientras la pregunta esperaba; propón la acción de nuevo.' };
+  }
+  async #authorize(name, input, { signal, onWaiting, invocation, hostFacts } = {}) {
     signal?.throwIfAborted();
     if (this.denied.has(name)) return { allowed: false, reason: 'Explicit denial rule' };
-    const knownRead = READ_TOOLS.has(name) || this.allowed.has(name) && chromeLabObservation(name);
+    // Saved human rules: deny > ask > allow. Ask forces a question even in auto; the startup bypass skips it (deny still applies).
+    const rule = this.rules?.decide(name, input), ruled = rule ? `Permission ${describeRule(rule)}` : null, cite = rule ? { rule: rule.rule } : {};
+    if (rule?.list === 'deny') return { allowed: false, reason: ruled, source: 'permission_rule', ...cite };
+    if (this.mode === BYPASS_PERMISSION_MODE) return { allowed: true, reason: 'Explicit startup --dangerously-skip-permissions; permission prompts and classifier skipped', source: 'startup_bypass' };
+    if (this.confirmAlways(name)) {
+      if (this.mode === 'plan') return { allowed: false, reason: `Plan mode: la operación declara ${CONFIRM_ALWAYS} y plan no la ejecuta`, source: 'confirm_always' };
+      if (!this.confirm) return { allowed: false, reason: `La operación declara ${CONFIRM_ALWAYS} y no hay un humano que confirme`, source: 'confirm_always' };
+      const answer = await this.#question(name, input, signal, onWaiting, null); if (answer.stale) return answer;
+      return { allowed: answer.allowed, reason: `Confirmación obligatoria (${CONFIRM_ALWAYS}): ${answer.allowed ? 'User confirmation' : 'No authorization for this tool'}`, source: 'confirm_always' };
+    }
+    if (rule?.list === 'ask') { const answer = await this.#question(name, input, signal, onWaiting, null); if (answer.stale) return answer; return { allowed: answer.allowed, reason: `${ruled}: ${answer.allowed ? 'User confirmation' : 'No authorization for this tool'}`, source: 'permission_rule', ...cite }; }
+    const granted = this.allowed.has(name) || rule?.list === 'allow';
+    const knownRead = READ_TOOLS.has(name) || granted && (chromeLabObservation(name) || openRelayObservation(name));
     if (name === 'Agent' || name === 'AgentBatch') return { allowed: true, reason: 'Delegation: every child action retains the session permissions' };
     if (this.mode === 'plan' && !knownRead) return { allowed: false, reason: 'Plan mode: read-only' };
     if (name === 'Bash' && readOnlyBashCheck(input.command)) return { allowed: true, reason: 'Native read-only check with fixed argv; no classifier required.' };
-    if (this.mode === 'auto' && !knownRead) return this.authorizeAuto(name, input, signal, onWaiting);
-    if (knownRead || this.allowed.has(name) || (this.mode === 'acceptEdits' && EDIT_TOOLS.has(name))) return { allowed: true, reason: 'Session policy' };
-    const allowed = await this.ask(name, input, signal, onWaiting);
-    return { allowed, reason: allowed ? 'User confirmation' : 'No authorization for this tool' };
+    if (this.mode === 'auto' && !knownRead) return this.authorizeAuto(name, input, signal, onWaiting, invocation, hostFacts, rule);
+    if (knownRead || granted || (this.mode === 'acceptEdits' && EDIT_TOOLS.has(name))) return { allowed: true, reason: !this.allowed.has(name) && rule?.list === 'allow' && !READ_TOOLS.has(name) ? ruled : 'Session policy', ...(ruled && rule.list === 'allow' && !this.allowed.has(name) ? { source: 'permission_rule', ...cite } : {}) };
+    return this.#askWithOffer(name, input, signal, onWaiting);
+  }
+  // Pregunta normal: ofrece «sí, siempre» con la regla más específica razonable.
+  async #askWithOffer(name, input, signal, onWaiting, reason) {
+    const offer = this.rememberOffer(name, input), answer = await this.#question(name, input, signal, onWaiting, offer);
+    if (answer.stale) return answer;
+    const base = reason ?? (answer.allowed ? 'User confirmation' : 'No authorization for this tool');
+    return { allowed: answer.allowed, reason: answer.saved ? `${base}; saved ${describeRule(answer.saved)}` : answer.saveError ? `${base}; the rule was not saved: ${answer.saveError}` : base, ...(answer.saved ? { source: 'permission_rule', rule: answer.saved.rule } : {}) };
+  }
+  /** Regla propuesta para «sí, siempre» o null (sin almacén, confirm:'always' o sin regla segura). */
+  rememberOffer(name, input) {
+    if (!this.rules?.add || this.confirmAlways(name)) return null;
+    const rule = suggestRule(name, input, { project: this.rules.project || this.cwd || process.cwd() });
+    return rule ? { rule, project: this.rules.scope ? this.rules.project : null } : null;
   }
-  async ask(name, input, signal, onWaiting) {
-    if (!this.confirm) return false;
-    const confirm=this.confirm, stamp=permissionStamp(this), previous=confirmationQueues.get(confirm) || Promise.resolve();
+  async ask(name, input, signal, onWaiting) { return (await this.#question(name, input, signal, onWaiting, null)).allowed; }
+  async #question(name, input, signal, onWaiting, offer) {
+    if (!this.confirm) return { allowed: false };
+    const confirm=this.confirm, stamp=permissionStamp(this), visible=houseStamp(this), previous=confirmationQueues.get(confirm) || Promise.resolve();
     let release;
     const slot=new Promise(resolve => {release=resolve;});
     const tail=previous.catch(() => {}).then(() => slot);
@@ -63,37 +133,50 @@ export class PermissionPolicy {
       signal?.throwIfAborted();
       // Do not show a stale question. House observes the changed authority and
       // calls authorize again, so newly denied/plan actions cannot reach a UI.
-      if(this.confirm!==confirm || stamp!==permissionStamp(this))return false;
+      // If only saved rules changed, this policy decides again by itself.
+      if(this.confirm!==confirm || stamp!==permissionStamp(this))return this.confirm===confirm && visible===houseStamp(this) ? { allowed: false, stale: true } : { allowed: false };
       await onWaiting?.({type:'house_waiting',question_id:questionId});
       displayed=true;signal?.throwIfAborted();
-      allowed=Boolean(await waitWithAbort(confirm(name,input,{signal,questionId}),signal));
+      const answer=normalizeAnswer(await waitWithAbort(confirm(name,input,{signal,questionId,...(offer?{remember:offer}:{})}),signal),offer);
       signal?.throwIfAborted();
-      return stamp===permissionStamp(this) && this.confirm===confirm ? allowed : false;
+      allowed=answer.allowed && this.confirm===confirm && (stamp===permissionStamp(this) || visible===houseStamp(this) && this.rules?.decide(name,input)?.list!=='deny');
+      if(!allowed || !answer.remember)return { allowed };
+      // Se guarda antes de liberar el turno, para que la siguiente pregunta ya la vea.
+      const scope=answer.remember==='user' ? 'user' : this.rules.scope;
+      if(!scope)return { allowed, saveError: 'this session has no project' };
+      try { return { allowed, saved: await this.rules.add({ list: 'allow', rule: offer.rule, scope }) }; }
+      catch(error) { return { allowed, saveError: error.message }; }
     } finally {
-      try { if(displayed)await onWaiting?.({type:'house_answered',question_id:questionId,allowed:allowed && !signal?.aborted && stamp===permissionStamp(this)}); }
+      try { if(displayed)await onWaiting?.({type:'house_answered',question_id:questionId,allowed:allowed && !signal?.aborted}); }
       finally {release();if(confirmationQueues.get(confirm)===tail)tail.then(()=>{if(confirmationQueues.get(confirm)===tail)confirmationQueues.delete(confirm);});}
     }
   }
-  async authorizeAuto(name, input, signal, onWaiting) {
+  async authorizeAuto(name, input, signal, onWaiting, invocation, hostFacts, rule = this.rules?.decide(name, input)) {
     const inspection = inspectAutoAction(name, input, this.cwd || process.cwd());
     const data = { workspace: this.cwd, human_requests: this.context.intentions, previous_tool_calls: this.context.actions, proposed_action: { name, input } };
+    if(hostFacts)data.host_verified_facts=hostFacts;
     let verdict;
     if (inspection.hard) verdict = { decision: 'deny', risk: 'destructive', reason: inspection.hard, intent_quote: '', source: 'guard' };
     else if (!this.classifier || !data.human_requests.length || Buffer.byteLength(JSON.stringify(data)) > 64000) verdict = { decision: 'ask', risk: 'unknown', reason: 'No classifier or insufficient intent context for automatic approval.', intent_quote: '', source: 'guard' };
     else try {
-      verdict = { ...await this.classifier.classify(data, signal), source: 'classifier' };
+      const classified = await this.classifier.classify(data, signal, invocation || {});
+      // Custom classifiers also supply data, not journal metadata. Do not spread it.
+      verdict = { decision: classified.decision, risk: classified.risk, reason: classified.reason, intent_quote: classified.intent_quote, ...(classified.target_quote !== undefined ? { target_quote: classified.target_quote } : {}), ...(classified.retry_attempts === 1 ? { retry_attempts: 1 } : {}), source: 'classifier' };
+      if (verdict.decision === 'allow' && (inspection.destructive || ['destructive','external'].includes(verdict.risk)) && verdict.target_quote && !data.human_requests.at(-1)?.includes(verdict.target_quote)) verdict = { ...verdict, decision: 'ask', reason: 'The target citation is not a literal span of the latest human request.' };
       if (verdict.decision === 'allow' && (inspection.opaque || verdict.risk === 'unknown')) verdict = { ...verdict, decision: 'ask', reason: 'The action contains expansion, opaque execution or unknown effects; review is required.' };
-      if (verdict.decision === 'allow' && (inspection.destructive || verdict.risk === 'destructive') && !intentCoversAction(verdict, data.proposed_action, inspection, data.human_requests)) verdict = { ...verdict, decision: 'deny', reason: 'The latest intent does not explicitly authorize the destructive action and its target.' };
-      if (verdict.decision === 'allow' && verdict.risk === 'external' && (!verdict.intent_quote || !data.human_requests.at(-1)?.includes(verdict.intent_quote))) verdict = { ...verdict, decision: 'ask', reason: 'Explicit authorization for the external effect is missing.' };
+      if (verdict.decision === 'allow' && (inspection.destructive || verdict.risk === 'destructive') && !intentCoversAction(verdict, data.proposed_action, inspection, data.human_requests, hostFacts)) verdict = { ...verdict, decision: 'deny', reason: 'The latest intent does not explicitly authorize the destructive action and its target.' };
+      if (verdict.decision === 'allow' && verdict.risk === 'external' && (!verdict.intent_quote || !data.human_requests.at(-1)?.includes(verdict.intent_quote) || verdict.target_quote && !data.human_requests.at(-1)?.includes(verdict.target_quote))) verdict = { ...verdict, decision: 'ask', reason: 'Explicit authorization for the external effect is missing.' };
     } catch (error) {
       if (signal?.aborted || error.code === 'GOAL_BUDGET') throw error;
       verdict = { decision: 'ask', risk: 'unknown', reason: `Auto verifier unavailable: ${error.message}`, intent_quote: '', source: 'classifier-error' };
     }
     signal?.throwIfAborted();
-    if (this.mode !== 'auto') return this.authorize(name, input, { signal, onWaiting });
-    await this.onDecision({ type: 'auto_decision', name, input, ...verdict });
-    let allowed = verdict.decision === 'allow';
-    if (verdict.decision === 'ask') allowed = await this.ask(name, input, signal, onWaiting);
-    return { allowed, reason: verdict.reason, decision: verdict.decision, risk: verdict.risk, source: verdict.source };
+    if (this.mode !== 'auto') return this.authorize(name, input, { signal, onWaiting, invocation, hostFacts });
+    await this.onDecision({ ...verdict, ...(invocation || {}), type: 'auto_decision', name, input });
+    // Una regla allow guardada responde por el humano cuando el veredicto sólo pide preguntar;
+    // nunca anula un deny del guardia o del clasificador.
+    if (verdict.decision === 'ask' && rule?.list === 'allow') return { allowed: true, reason: `Permission ${describeRule(rule)} (auto wanted to ask: ${verdict.reason})`, decision: verdict.decision, risk: verdict.risk, source: 'permission_rule', rule: rule.rule };
+    if (verdict.decision === 'ask') { const answer = await this.#askWithOffer(name, input, signal, onWaiting, verdict.reason); if (answer.stale) return answer; return { ...answer, reason: answer.reason, decision: verdict.decision, risk: verdict.risk, source: answer.source || verdict.source }; }
+    return { allowed: verdict.decision === 'allow', reason: verdict.reason, decision: verdict.decision, risk: verdict.risk, source: verdict.source };
   }
 }

package/src/plugin-catalog.mjs

@@ -0,0 +1,84 @@
+import { fileURLToPath } from 'node:url';
+import { t, registerMessages } from './i18n/index.mjs';
+import { Operation } from './operations.mjs';
+import { createChromeLabPlugin, CHROME_LAB_TOOLS } from './plugins/chrome-lab/index.mjs';
+import { chromeLabObservation, openRelayObservation } from './read-only-check.mjs';
+import { createOpenRelayPlugin, OPEN_RELAY_TOOLS } from './plugins/open-relay/index.mjs';
+
+// Plugins que viajan con Comal. La ruta es absoluta y se resuelve desde esta
+// instalación, de modo que una entrada agregada funciona en cualquier proyecto.
+const short = name => name.split('__').at(-1);
+// La misma lista que la política ya trata como observación conocida (read-only-check).
+const chromeObservations = CHROME_LAB_TOOLS.filter(chromeLabObservation).map(short);
+
+const CHROME_DESCRIPTION = 'MV3 extension lab in a real Chrome on Windows over SSH + CDP: deploy, open, read the DOM, verify and download.';
+const RELAY_DESCRIPTION = 'Operator of an open-relay swarm through the relayd admin socket: status, inbox, plans, jobs, notices, decision dossier and four actions (Reply, Ack, ApprovePlan, RejectPlan) with a confirmation card.';
+registerMessages({
+  [CHROME_DESCRIPTION]: 'Laboratorio de extensiones MV3 en un Chrome real de Windows por SSH + CDP: desplegar, abrir, leer DOM, verificar y descargar.',
+  [RELAY_DESCRIPTION]: 'Operador de un enjambre open-relay por el socket admin de relayd: estado, buzón, planes, jobs, avisos, expediente de decisión y cuatro acciones (Reply, Ack, ApprovePlan, RejectPlan) con tarjeta de confirmación.',
+  '{id} needs {keys}. Example: /plugins add {id} {example}': '{id} necesita {keys}. Ejemplo: /plugins add {id} {example}',
+  'Invalid setting «{token}». Use key=value.': 'Ajuste inválido «{token}». Usa clave=valor.',
+  '{key} must be an integer.': '{key} debe ser entero.',
+});
+
+const BUNDLED = Object.freeze({
+  'chrome-lab': Object.freeze({
+    id: 'chrome-lab',
+    description: CHROME_DESCRIPTION,
+    module: fileURLToPath(new URL('./plugins/chrome-lab/index.mjs', import.meta.url)),
+    // Sin host ni ruta por omisión: dependen de la máquina Windows de cada quien.
+    defaults: Object.freeze({ cdpURL: 'http://127.0.0.1:9222', timeoutMs: 20000, maxDeployBytes: 10000000 }),
+    required: Object.freeze({ sshHost: 'HOST', remoteRoot: 'C:\\Users\\YOU\\AppData\\Local\\Comal\\chrome-lab' }),
+    schema: createChromeLabPlugin({ clientFactory: () => { throw new Error('Sólo esquema.'); } }).config_schema,
+    operations: Object.freeze(CHROME_LAB_TOOLS.map(short)),
+    observations: Object.freeze(chromeObservations),
+    // Ajustes del host (no del plugin): se guardan aparte en plugins.json.
+    host: Object.freeze({ workflow: Object.freeze(['auto', 'raw']) }),
+  }),
+  'open-relay': Object.freeze({
+    id: 'open-relay',
+    description: RELAY_DESCRIPTION,
+    module: fileURLToPath(new URL('./plugins/open-relay/index.mjs', import.meta.url)),
+    defaults: Object.freeze({ notify: 'on' }),
+    required: Object.freeze({}),
+    schema: createOpenRelayPlugin().config_schema,
+    operations: Object.freeze(OPEN_RELAY_TOOLS.map(short)),
+    // Lecturas (incluido Dossier) son observaciones; Reply, Ack, ApprovePlan y RejectPlan, acciones.
+    observations: Object.freeze(OPEN_RELAY_TOOLS.filter(openRelayObservation).map(short)),
+  }),
+});
+
+export const bundledPlugins = () => Object.values(BUNDLED);
+export const bundledPlugin = id => BUNDLED[id];
+export const operationName = (id, name) => name.startsWith('plugin__') ? name : `plugin__${id}__${name}`;
+
+/** Observaciones conocidas vs. acciones. Sólo los plugins incluidos declaran esta separación. */
+export function pluginOperations(id) {
+  const item = BUNDLED[id]; if (!item) return null;
+  return { observations: item.observations.map(name => operationName(id, name)), actions: item.operations.filter(name => !item.observations.includes(name)).map(name => operationName(id, name)) };
+}
+
+/** key=value, separados por espacios. Enteros según el esquema; el resto como texto literal. */
+export function parseAssignments(text = '', schema = {}) {
+  const result = {}, tokens = text.match(/(?:[^\s"]+|"[^"]*")+/g) || [];
+  for (const token of tokens) {
+    const match = /^([A-Za-z][A-Za-z0-9_]{0,63})=(.*)$/s.exec(token);
+    if (!match) throw new Error(t('Invalid setting «{token}». Use key=value.', { token }));
+    let value = match[2].replace(/^"([\s\S]*)"$/, '$1');
+    if (schema.properties?.[match[1]]?.type === 'integer') { if (!/^-?\d+$/.test(value)) throw new Error(t('{key} must be an integer.', { key: match[1] })); value = Number(value); }
+    result[match[1]] = value;
+  }
+  return result;
+}
+
+/** Ajustes sin valor por omisión que el humano da al agregar el plugin (clave → ejemplo). */
+export const requiredSettings = id => BUNDLED[id]?.required || {};
+
+/** Valida con el mismo contrato que aplicará el runtime al activar el plugin. */
+export function validateBundledConfig(id, config) {
+  const item = BUNDLED[id];
+  const missing = Object.keys(item?.required || {}).filter(key => config?.[key] === undefined || config[key] === '');
+  if (missing.length) throw new Error(t('{id} needs {keys}. Example: /plugins add {id} {example}', { id, keys: missing.join(', '), example: missing.map(key => `${key}=${item.required[key]}`).join(' ') }));
+  if (item?.schema) new Operation({ name: `${id}_config`, description: 'Plugin configuration', input_schema: item.schema, run: () => '' }).validate(config);
+  return config;
+}

package/src/plugin-config.mjs

@@ -2,6 +2,9 @@ import { open, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createHash, randomUUID } from 'node:crypto';
+import { t, registerMessages } from './i18n/index.mjs';
+
+registerMessages({'Invalid plugin JSON: {detail}': 'Configuración de plugins JSON inválida: {detail}'});
 
 const MAX_BYTES = 1024 * 1024;
 const ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -55,8 +58,9 @@ export async function readPluginConfig(file, { missing = false } = {}) {
   }
   let config;
   try { config = JSON.parse(bytes.toString('utf8')); }
-  catch (error) { throw new Error(`Configuración de plugins JSON inválida: ${error.message}`); }
-  fields(config, ['plugins'], 'Configuración de plugins');
+  catch (error) { throw new Error(t('Invalid plugin JSON: {detail}', {detail: error.message})); }
+  fields(config, ['plugins', 'chrome_workflow'], 'Configuración de plugins');
+  if (config.chrome_workflow !== undefined && !['auto', 'raw'].includes(config.chrome_workflow)) throw new Error('chrome_workflow debe ser auto o raw');
   if (!Array.isArray(config.plugins) || config.plugins.length > 32) throw new Error('plugins debe ser un arreglo con máximo 32 entradas');
   const seen = new Set();
   const entries = config.plugins.map(entry => {
@@ -68,28 +72,66 @@ export async function readPluginConfig(file, { missing = false } = {}) {
     if (entry.config !== undefined && !object(entry.config)) throw new Error(`config debe ser un objeto: ${entry.id}`);
     return { id: entry.id, module: modulePath(entry.module, path.dirname(absolute)), enabled: entry.enabled ?? true, config: entry.config ?? {} };
   });
-  return { file: absolute, hash: hash(bytes), entries };
+  return { file: absolute, hash: hash(bytes), entries, ...(config.chrome_workflow ? { chrome_workflow: config.chrome_workflow } : {}) };
+}
+
+const MAX_CODE_FILES = 256;
+// Literal specifiers only. Computed imports and packages are reported, never followed.
+const SPECIFIERS = [/\bfrom\s*['"]([^'"\n]+)['"]/g, /\bimport\s*['"]([^'"\n]+)['"]/g, /\bimport\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g, /\bnew\s+URL\s*\(\s*['"]([^'"\n]+)['"]\s*,\s*import\.meta\.url\s*\)/g];
+
+/**
+ * Fingerprint the plugin code without importing it: the entry module plus every
+ * local file reachable through literal relative imports or new URL(..., import.meta.url).
+ * Packages (bare specifiers) are listed as external and are not covered.
+ */
+export async function inspectPluginModule(requested) {
+  const entry = await realpath(modulePath(requested, process.cwd()));
+  modulePath(entry, process.cwd());
+  const root = path.dirname(entry), files = new Map(), external = new Set(), pending = [entry];
+  while (pending.length) {
+    const file = pending.shift();
+    if (files.has(file)) continue;
+    if (files.size >= MAX_CODE_FILES) throw new Error(`El plugin alcanza más de ${MAX_CODE_FILES} archivos locales: ${entry}`);
+    let bytes;
+    try { bytes = await boundedRead(file); }
+    catch (error) { if (error.code !== 'ENOENT' || file === entry) throw error; files.set(file, null); continue; }
+    files.set(file, hash(bytes));
+    if (!/\.(?:mjs|js|cjs)$/.test(file)) continue;
+    const source = bytes.toString('utf8');
+    for (const pattern of SPECIFIERS) for (const match of source.matchAll(pattern)) {
+      const specifier = match[1];
+      if (specifier.startsWith('./') || specifier.startsWith('../')) {
+        const target = path.resolve(path.dirname(file), specifier.split(/[?#]/)[0]);
+        let real; try { real = await realpath(target); } catch (error) { if (error.code !== 'ENOENT') throw error; real = target; }
+        if (!files.has(real)) pending.push(real);
+      } else if (!specifier.startsWith('node:') && !/^[a-z][a-z0-9+.-]*:/i.test(specifier)) external.add(specifier);
+    }
+  }
+  const list = [...files].map(([file, sha256]) => ({ path: path.relative(root, file).split(path.sep).join('/'), sha256 })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return { module: entry, code_fingerprint: hash(Buffer.from(JSON.stringify(list))), files: list, external: [...external].sort() };
 }
 
 /** Import executes trusted host code. Call only after explicit human plugin trust. */
-export async function importPluginEntry(entry) {
+export async function importPluginEntry(entry, { expect } = {}) {
   pluginId(entry.id);
   if (entry.enabled === false) throw new Error(`Plugin deshabilitado: ${entry.id}`);
   const requested = modulePath(entry.module, process.cwd());
   const module = await realpath(requested);
   // A symlink must still resolve to a JavaScript entrypoint.
   modulePath(module, process.cwd());
+  const code = await inspectPluginModule(module);
+  if (expect && (expect.module !== code.module || expect.code_fingerprint !== code.code_fingerprint)) throw Object.assign(new Error(`El código del plugin ${entry.id} ya no coincide con la confianza registrada; no se importó.`), { code: 'PLUGIN_TRUST_STALE' });
   const before = await boundedRead(module);
   const fingerprint = hash(before);
   const url = pathToFileURL(module);
   url.searchParams.set('comal_revision', `${fingerprint}-${randomUUID()}`);
   const imported = await import(url.href);
   const after = await boundedRead(module);
-  if (hash(after) !== fingerprint || await realpath(requested) !== module) throw new Error(`El módulo cambió durante la importación: ${entry.id}`);
+  if (hash(after) !== fingerprint || await realpath(requested) !== module || (await inspectPluginModule(module)).code_fingerprint !== code.code_fingerprint) throw new Error(`El módulo cambió durante la importación: ${entry.id}`);
   const definition = imported.default;
   if (!object(definition) || definition.id !== entry.id || typeof definition.version !== 'string'
     || !definition.version.trim() || typeof definition.activate !== 'function') {
     throw new Error(`Plugin inválido ${entry.id}: export default requiere id coincidente, version y activate`);
   }
-  return { definition, fingerprint, module };
+  return { definition, fingerprint, module, code_fingerprint: code.code_fingerprint, code_files: code.files.length };
 }