@milpa/comal 0.2.2 → 0.2.4

package/src/operations.mjs

@@ -17,6 +17,21 @@ export function toolEffects(name) {
   return { workspace: 'unknown', external: 'unknown', process: 'unknown', authority: 'none' };
 }
 
+// A model often sends an array/object field as a string holding JSON (sometimes broken JSON). Say so
+// precisely instead of only "must be array", so the next call can be a real correction.
+function stringValueHint(error, actual) {
+  const expected = [].concat(error.params?.type || []);
+  if (error.keyword !== 'type' || typeof actual !== 'string' || !expected.some(type => type === 'array' || type === 'object')) return {};
+  try {
+    const parsed = JSON.parse(actual), parsedType = Array.isArray(parsed) ? 'array' : parsed === null ? 'null' : typeof parsed;
+    return { string_value: { valid_json: true, parsed_type: parsedType, hint: expected.includes(parsedType) ? `This field arrived as a string that contains JSON. Send the ${parsedType} itself as the field value, not a string.` : `This field arrived as a string whose JSON is a ${parsedType}, not ${expected.join(' or ')}.` } };
+  } catch (parseError) {
+    const position = Number(/position (\d+)/.exec(parseError.message)?.[1]);
+    const near = Number.isSafeInteger(position) ? `${position > 60 ? '…' : ''}${actual.slice(Math.max(0, position - 60), position + 40)}${position + 40 < actual.length ? '…' : ''}` : actual.slice(0, 100);
+    return { string_value: { valid_json: false, error: String(parseError.message).slice(0, 200), near, hint: `This field arrived as a string, and that string is not valid JSON either. Send the ${expected.join(' or ')} itself as the field value, with balanced brackets and escaped quotes.` } };
+  }
+}
+
 export class Operation {
   #validate;
   #validateOutput;
@@ -47,9 +62,9 @@ export class Operation {
       const issues = this.#validate.errors.slice(0, 12).map(error => {
         const pointer = error.instancePath || '';
         let actual = input; for (const part of pointer.split('/').slice(1)) actual = actual?.[part.replace(/~1/g, '/').replace(/~0/g, '~')];
-        return { path: pointer || '/', rule: error.keyword, message: error.message, ...error.params, ...(['maxItems', 'minItems'].includes(error.keyword) && Array.isArray(actual) ? { actual_count: actual.length } : {}) };
+        return { path: pointer || '/', rule: error.keyword, message: error.message, ...error.params, ...(['maxItems', 'minItems'].includes(error.keyword) && Array.isArray(actual) ? { actual_count: actual.length } : {}), ...stringValueHint(error, actual) };
       });
-      throw Object.assign(new Error(`Input inválido para ${this.contract.name}: ${this.#validate.errors.map(error => `${error.instancePath || 'input'} ${error.message}`).join('; ')}.`), {
+      throw Object.assign(new Error(`Input inválido para ${this.contract.name}: ${this.#validate.errors.map(error => `${error.instancePath || 'input'} ${error.message}${error.params?.additionalProperty ? ` (${error.params.additionalProperty})` : ''}`).join('; ')}.`), {
         code: 'HOUSE_INPUT_SCHEMA', details: { operation: this.contract.name, executed: false, issues, next_action: 'Correct the named fields using the live tool schema; preserve all intended work. Do not repeat unchanged arguments, invent operation names, query the board, or infer that any effect ran.' },
       });
     }

package/src/package-identity.mjs

@@ -0,0 +1,68 @@
+import { readFile, readdir, lstat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Identidad del paquete INSTALADO de Comal: nombre, versión e integridad. La integridad es
+// el digest de {ruta → sha256} de todos los archivos que publica el paquete (los `files` de
+// su package.json: bin, src, contratos, docs), calculado por Comal sobre sus propios bytes
+// una vez por proceso. Sirve para que la confianza en los plugins INCLUIDOS se ate al
+// paquete (se pide una vez por versión) y no a cada archivo ni a la ruta donde se instaló.
+// Una copia de desarrollo (package.json con `private: true`, como el del repo) no tiene
+// identidad de paquete: ahí la confianza sigue atada a la huella del código, como siempre.
+const ROOT = fileURLToPath(new URL('../', import.meta.url));
+const MAX_FILES = 20000, MAX_BYTES = 256 << 20;
+const sha = value => createHash('sha256').update(value).digest('hex');
+const posix = file => file.split(path.sep).join('/');
+
+/** Digest canónico de {ruta → sha256}: lo que identifica el contenido del paquete. */
+export const manifestIntegrity = files => sha(JSON.stringify(Object.keys(files).sort().map(key => [key, files[key]])));
+
+async function hashTree(root, entries) {
+  const files = {}; let count = 0, bytes = 0;
+  const visit = async relative => {
+    const absolute = path.join(root, relative), info = await lstat(absolute).catch(() => null);
+    if (!info || info.isSymbolicLink()) return;
+    if (info.isDirectory()) { for (const name of (await readdir(absolute)).sort()) if (name !== 'node_modules' && !name.startsWith('.')) await visit(path.join(relative, name)); return; }
+    if (!info.isFile()) return;
+    if (++count > MAX_FILES || (bytes += info.size) > MAX_BYTES) throw new Error('package too large');
+    files[posix(relative)] = sha(await readFile(absolute));
+  };
+  for (const entry of new Set(['package.json', ...entries])) await visit(entry);
+  return files;
+}
+
+const cache = new Map();
+/**
+ * {root, name, version, integrity, files} del paquete instalado en `root` (por omisión, esta
+ * instalación) o null si es una copia de desarrollo o no se puede leer.
+ */
+export function packageIdentity(root = ROOT) {
+  const key = path.resolve(root);
+  if (!cache.has(key)) cache.set(key, (async () => {
+    try {
+      const pkg = JSON.parse(await readFile(path.join(key, 'package.json'), 'utf8'));
+      if (pkg.private === true || typeof pkg.name !== 'string' || typeof pkg.version !== 'string' || !Array.isArray(pkg.files) || !pkg.files.length) return null;
+      const entries = pkg.files.filter(item => typeof item === 'string' && !path.isAbsolute(item) && !item.split(/[\\/]/).includes('..'));
+      const files = await hashTree(key, entries);
+      return Object.freeze({ root: key, name: pkg.name, version: pkg.version, integrity: manifestIntegrity(files), files: Object.freeze(files) });
+    } catch { return null; }
+  })());
+  return cache.get(key);
+}
+
+/**
+ * Si TODOS los archivos dados ({file absoluto, sha256}) son del paquete y coinciden con los
+ * que se midieron para su integridad, devuelve {name, version, integrity}; si no (fuera del
+ * paquete o cambiados desde entonces), null: la confianza vuelve a la huella del código.
+ */
+export function packageCoverage(identity, files) {
+  if (!identity || !Array.isArray(files) || !files.length) return null;
+  for (const { file, sha256 } of files) {
+    const relative = posix(path.relative(identity.root, file));
+    if (!relative || relative.startsWith('../') || path.isAbsolute(relative) || identity.files[relative] !== sha256) return null;
+  }
+  return { name: identity.name, version: identity.version, integrity: identity.integrity };
+}
+
+export const samePackage = (a, b) => Boolean(a && b && a.name === b.name && a.version === b.version && a.integrity === b.integrity);

package/src/peer-probe.mjs

@@ -0,0 +1,16 @@
+// Sondeo de mensajes para el peer de la TUI (cada 300 ms). Avisos de plugins, mensajes entre sesiones y
+// resultados de subagentes viven en el libro de la sesión: si el libro no cambió desde el último «no hay
+// nada», la respuesta tampoco. Así una sesión grande no se relee entera en cada tick (gate «extensión de
+// bóveda»: ~760 ms por sondeo con 6 MB, peerProcessing siempre activo y ~120 % de CPU en reposo). Un
+// sondeo completo cada `maxAgeMs` cubre lo que no deja rastro en el libro (p. ej. un subagente que murió).
+export function memoizedPeerProbe({ stamp, probe, maxAgeMs = 5000, now = Date.now }) {
+  let last = null; // { stamp, at } del último sondeo completo que dijo «nada»
+  return async () => {
+    let current = null;
+    try { current = await stamp(); } catch { current = null; }
+    if (current !== null && last && last.stamp === current && now() - last.at < maxAgeMs) return false;
+    const answer = Boolean(await probe());
+    last = !answer && current !== null ? { stamp: current, at: now() } : null;
+    return answer;
+  };
+}

package/src/permissions.mjs

@@ -1,10 +1,79 @@
 // Work controls write only the session ledger; nested effects still use the house judge.
 const READ_TOOLS = new Set(['Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch', 'McpStatus', 'HouseContext', 'HouseSnapshot', 'OperationCatalog', 'ReadTable', 'PluginStatus', 'WorkSnapshot', 'AuditStatus', 'EvidenceRead', 'WorkPlanSet', 'WorkCheckRepair', 'WorkTaskUpdate', 'WorkStepRun', 'WorkDraft', 'WorkBoard']);
 const EDIT_TOOLS = new Set(['Write', 'Edit', 'McpConfigure','GitIntegrationPrepare','GitIntegrationApply']);
-import { inspectAutoAction, intentCoversAction } from './auto-guard.mjs';
+import { inspectAutoAction, intentCoversAction, isProtectedPath } from './auto-guard.mjs';
 import { randomUUID } from 'node:crypto';
 import { readOnlyBashCheck, chromeLabObservation, openRelayObservation, omarchyObservation } from './read-only-check.mjs';
 import { describeRule, suggestRule } from './permission-rules.mjs';
+import { measureHumanWait } from './turn-timing.mjs';
+import { realpath, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const within = (root, file) => { const relative = path.relative(root, file); return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)); };
+
+/** realpath of the nearest existing ancestor plus the rest: a location not created yet still compares canonically. */
+async function canonicalish(file) {
+  let ancestor = path.resolve(file), suffix = [];
+  while (true) {
+    try { return path.join(await realpath(ancestor), ...suffix); }
+    catch { const parent = path.dirname(ancestor); if (parent === ancestor) return path.resolve(file); suffix.unshift(path.basename(ancestor)); ancestor = parent; }
+  }
+}
+
+/**
+ * Comal's private configuration and state: saved permission rules, plugin trust, credentials, peer tokens,
+ * the visual-approval key, relay tokens, session books. A writable or readable copy of any of them would let
+ * the model grant itself authority or take secrets, so no /add-dir may contain or sit inside one.
+ */
+export function privateLocations({ env = process.env, home = env.HOME || os.homedir(), extra = [] } = {}) {
+  const list = [
+    env.XDG_CONFIG_HOME && path.join(env.XDG_CONFIG_HOME, 'comal'), path.join(home, '.config', 'comal'),
+    env.XDG_STATE_HOME && path.join(env.XDG_STATE_HOME, 'comal'), path.join(home, '.local', 'state', 'comal'),
+    path.join(home, '.comal'), path.join(home, '.relay-hub'),
+    ...['COMAL_AUTH_DIR', 'COMAL_CLOUD_CONFIG', 'COMAL_PEER_DIR', 'COMAL_VISUAL_KEY_DIR', 'COMAL_CONTEXT_STATS_DIR', 'COMAL_PLUGIN_CONFIG', 'COMAL_PROVIDERS_CONFIG', 'RELAY_HUB_ROOT'].map(name => env[name]),
+    ...extra,
+  ];
+  return [...new Set(list.filter(item => typeof item === 'string' && item).map(item => path.resolve(item)))];
+}
+const STATE_NAMES = ['.comal', '.harness'];
+export const holdsComalState = (root, file) => path.relative(root, file).split(path.sep).some(segment => STATE_NAMES.includes(segment));
+
+/**
+ * /add-dir: directories the human opens mid-session for reading AND writing. Canonical and existing; never
+ * the filesystem root, a world-writable directory, Comal state (.comal/.harness), nor anything that contains
+ * or sits inside a private Comal location (see privateLocations).
+ */
+export async function workRootsFrom(paths = [], { env = process.env, home, private: extra = [] } = {}) {
+  const locations = [];
+  for (const location of privateLocations({ env, home, extra })) locations.push([location, await canonicalish(location)]);
+  const out = [];
+  for (const raw of paths) {
+    let canonical;
+    try { canonical = await realpath(raw); } catch { throw new Error(`/add-dir ${raw}: does not exist.`); }
+    const info = await stat(canonical);
+    if (!info.isDirectory()) throw new Error(`/add-dir ${raw}: not a directory.`);
+    if (canonical === path.parse(canonical).root) throw new Error(`/add-dir ${raw}: the filesystem root cannot be opened for writing.`);
+    if (holdsComalState(path.parse(canonical).root, canonical)) throw new Error(`/add-dir ${raw}: it is Comal state (.comal/.harness).`);
+    if (info.mode & 0o002) throw new Error(`/add-dir ${raw}: it is world-writable; another user could swap files under Comal. Choose a private directory.`);
+    const hit = locations.find(([location, real]) => [location, real].some(item => within(canonical, item) || within(item, canonical)));
+    if (hit) throw new Error(`/add-dir ${raw}: it touches a private Comal location (${hit[0]}); Comal configuration, credentials and session state stay out of reach. Choose a narrower directory.`);
+    if (!out.includes(canonical)) out.push(canonical);
+  }
+  return out;
+}
+
+/** --add-dir: directorios de solo lectura elegidos por el humano al arrancar; canónicos y existentes. */
+export async function readRootsFrom(paths = []) {
+  const out = [];
+  for (const raw of paths) {
+    let canonical;
+    try { canonical = await realpath(raw); } catch { throw new Error(`--add-dir ${raw}: no existe.`); }
+    if (!(await stat(canonical)).isDirectory()) throw new Error(`--add-dir ${raw}: no es un directorio.`);
+    if (!out.includes(canonical)) out.push(canonical);
+  }
+  return out;
+}
 READ_TOOLS.add('ToolPack');
 for (const name of ['ArtifactAccount','ArtifactCapabilities','ArtifactList','ArtifactInspect']) READ_TOOLS.add(name);
 for (const name of ['ListDirectory', 'FileInfo', 'SourceRead', 'GitInspect','GitIntegrationStatus','GitIntegrationEvidence']) READ_TOOLS.add(name);
@@ -51,13 +120,36 @@ export class PermissionPolicy {
   // rules: almacén de reglas guardadas (permission-rules.mjs) con decide(name, input) → {list, rule, scope}.
   // contractOf(name): contrato vivo de la operación (house.registry.get(name)?.contract); de ahí sale
   // el techo duro confirm:'always', que sólo el host lee y el modelo no puede cambiar.
-  constructor({ mode = 'default', dangerouslySkipPermissions = false, allowed = [], denied = [], confirm, classifier, cwd, rules, contractOf, onDecision = () => {} } = {}) {
+  #workRoots = []; #private = []; #privateExtra;
+  constructor({ mode = 'default', dangerouslySkipPermissions = false, allowed = [], denied = [], confirm, classifier, cwd, rules, contractOf, onDecision = () => {}, readRoots = [], privateLocations: privateExtra = [] } = {}) {
+    this.#privateExtra = [...privateExtra];
     if (!PERMISSION_MODES.includes(mode) && !(dangerouslySkipPermissions === true && mode === BYPASS_PERMISSION_MODE)) throw new Error('Invalid permission mode. Use default, plan, acceptEdits or auto; bypass requires the startup flag.');
     Object.defineProperty(this, 'dangerouslySkipPermissions', { value: dangerouslySkipPermissions === true, enumerable: true });
     this.#mode = this.dangerouslySkipPermissions ? BYPASS_PERMISSION_MODE : mode;
     this.allowed = new Set(allowed); this.denied = new Set(denied); this.confirm = confirm;
     this.classifier = classifier; this.cwd = cwd; this.rules = rules; this.contractOf = contractOf; this.onDecision = onDecision; this.context = { intentions: [], actions: [] };
+    // --add-dir: solo lectura (Read, FileInfo, ListDirectory, Grep, Glob); la escritura sigue en el workspace.
+    Object.defineProperty(this, 'readRoots', { value: Object.freeze([...readRoots]), enumerable: true });
+  }
+  /** /add-dir: read+write directories the human opened this session (a frozen copy; only addWorkRoot changes it). */
+  get workRoots() { return Object.freeze([...this.#workRoots]); }
+  /** Host-only: the human's /add-dir. Writes there still go through this policy like workspace writes. */
+  async addWorkRoot(dir, options = {}) {
+    const extra = [...this.#privateExtra, ...(options.private || [])];
+    const [canonical] = await workRootsFrom([dir], { ...options, private: extra });
+    // exact: restoring a recorded path; if it now resolves elsewhere (a swapped symlink), nothing opens.
+    if (options.exact && canonical !== dir) throw new Error(`${dir} now resolves to ${canonical}.`);
+    this.#private = [];
+    for (const location of privateLocations({ env: options.env, home: options.home, extra })) this.#private.push(location, await canonicalish(location));
+    if (this.cwd) { let workspace = this.cwd; try { workspace = await realpath(this.cwd); } catch {} if (within(workspace, canonical)) return { added: false, path: canonical, reason: 'inside_workspace' }; }
+    if (this.#workRoots.includes(canonical)) return { added: false, path: canonical, reason: 'already_added' };
+    this.#workRoots.push(canonical);
+    return { added: true, path: canonical };
   }
+  /** Host-only: another session was resumed in this process; its own /add-dir rows are restored next. */
+  clearWorkRoots() { this.#workRoots = []; }
+  /** A private Comal location or a path an active plugin protects: closed even under an added directory. */
+  isPrivate(file) { return this.#private.some(location => within(location, file)) || isProtectedPath(file); }
   get mode() { return this.#mode; }
   set mode(mode) {
     if (this.dangerouslySkipPermissions) throw new Error(BYPASS_LOCKED_MESSAGE);
@@ -137,7 +229,8 @@ export class PermissionPolicy {
       if(this.confirm!==confirm || stamp!==permissionStamp(this))return this.confirm===confirm && visible===houseStamp(this) ? { allowed: false, stale: true } : { allowed: false };
       await onWaiting?.({type:'house_waiting',question_id:questionId});
       displayed=true;signal?.throwIfAborted();
-      const answer=normalizeAnswer(await waitWithAbort(confirm(name,input,{signal,questionId,...(offer?{remember:offer}:{})}),signal),offer);
+      // The visible card is human time: excluded from the turn's Comal time.
+      const answer=normalizeAnswer(await measureHumanWait(()=>waitWithAbort(confirm(name,input,{signal,questionId,...(offer?{remember:offer}:{})}),signal)),offer);
       signal?.throwIfAborted();
       allowed=answer.allowed && this.confirm===confirm && (stamp===permissionStamp(this) || visible===houseStamp(this) && this.rules?.decide(name,input)?.list!=='deny');
       if(!allowed || !answer.remember)return { allowed };
@@ -153,7 +246,7 @@ export class PermissionPolicy {
   }
   async authorizeAuto(name, input, signal, onWaiting, invocation, hostFacts, rule = this.rules?.decide(name, input)) {
     const inspection = inspectAutoAction(name, input, this.cwd || process.cwd());
-    const data = { workspace: this.cwd, human_requests: this.context.intentions, previous_tool_calls: this.context.actions, proposed_action: { name, input } };
+    const data = { workspace: this.cwd, ...(this.#workRoots.length ? { extra_work_directories: [...this.#workRoots] } : {}), human_requests: this.context.intentions, previous_tool_calls: this.context.actions, proposed_action: { name, input } };
     if(hostFacts)data.host_verified_facts=hostFacts;
     let verdict;
     if (inspection.hard) verdict = { decision: 'deny', risk: 'destructive', reason: inspection.hard, intent_quote: '', source: 'guard' };

package/src/plugin-config.mjs

@@ -3,6 +3,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createHash, randomUUID } from 'node:crypto';
 import { t, registerMessages } from './i18n/index.mjs';
+import { packageIdentity, packageCoverage } from './package-identity.mjs';
+import { access } from 'node:fs/promises';
 
 registerMessages({'Invalid plugin JSON: {detail}': 'Configuración de plugins JSON inválida: {detail}'});
 
@@ -108,7 +110,22 @@ export async function inspectPluginModule(requested) {
     }
   }
   const list = [...files].map(([file, sha256]) => ({ path: path.relative(root, file).split(path.sep).join('/'), sha256 })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  return { module: entry, code_fingerprint: hash(Buffer.from(JSON.stringify(list))), files: list, external: [...external].sort() };
+  // Plugins que viajan dentro de un paquete instalado (Comal): su identidad es la del paquete
+  // si todos sus archivos coinciden con los que se midieron para su integridad (package-identity.mjs).
+  const owner = await packageRootOf(entry), pkg = owner && packageCoverage(await packageIdentity(owner), [...files].filter(([, sha256]) => sha256).map(([file, sha256]) => ({ file, sha256 })));
+  return { module: entry, code_fingerprint: hash(Buffer.from(JSON.stringify(list))), files: list, external: [...external].sort(), ...(pkg ? { package: pkg } : {}) };
+}
+
+// El directorio más cercano (hasta 8 niveles arriba) con package.json. La identidad es de
+// contenido (digest de los sha256 de los archivos del paquete), así que otro paquete sólo
+// coincide con uno confiado si sus bytes son los mismos.
+async function packageRootOf(file) {
+  let dir = path.dirname(file);
+  for (let level = 0; level < 8; level++) {
+    try { await access(path.join(dir, 'package.json')); return dir; } catch {}
+    const parent = path.dirname(dir); if (parent === dir) return null; dir = parent;
+  }
+  return null;
 }
 
 /** Import executes trusted host code. Call only after explicit human plugin trust. */

package/src/plugin-controls.mjs

@@ -139,7 +139,14 @@ export class PluginControls {
   }
   get project() { return this.runtime.file; }
   /** Callback de arranque: decide si la confianza registrada sigue vigente para el código actual. */
-  trusted = async (entry, code) => trustVerdict(this.store.find(this.project, entry.id), { project: this.project, entry, code });
+  trusted = async (entry, code) => { const verdict = trustVerdict(this.store.find(this.project, entry.id), { project: this.project, entry, code }); await this.#follow(entry.id, verdict, code); return verdict; };
+  // Confianza de paquete (mismo Comal, otra ruta o huella): el registro sigue al código vivo
+  // para que las reglas allow (codeTrusted) apliquen. No amplía nada: es el mismo contenido.
+  async #follow(id, verdict, code) {
+    const saved = this.store.find(this.project, id);
+    if (verdict.status !== 'trusted' || !saved || (saved.module === code.module && saved.code_fingerprint === code.code_fingerprint)) return;
+    try { await this.store.update(this.project, id, () => ({ module: code.module, code_fingerprint: code.code_fingerprint, files: code.files })); } catch {}
+  }
   async initialize({ trust = false, signal } = {}) {
     await this.store.load(); await this.rules.load();
     for (const warning of [this.store.warning, this.rules.warning]) if (warning) this.notice(warning);
@@ -166,22 +173,23 @@ export class PluginControls {
     return name === 'PluginTrust' && this.trustByFlag;
   }
   #live(id) { return this.runtime.status().plugins.find(plugin => plugin.id === id); }
-  async #trustAndEnable(id, options = {}, { recommend = false } = {}) {
+  async #trustAndEnable(id, options = {}, { recommend = false, preapproved = false } = {}) {
     const { entry, code } = await this.runtime.inspect(id), saved = this.store.find(this.project, id);
     const verdict = trustVerdict(saved, { project: this.project, entry, code }), live = this.#live(id), active = live?.state === 'active';
     const expect = { module: code.module, code_fingerprint: code.code_fingerprint };
     if (verdict.status === 'trusted') {
+      await this.#follow(id, verdict, code);
       if (!active) await this.runtime.enable(id, { signal: options.signal, expect });
       else if (live.code_fingerprint !== code.code_fingerprint) await this.runtime.load(id, { signal: options.signal, expect });
       return t('{id}: trust current · active · {grants}', { id, grants: this.#grantSummary(id) });
     }
-    if (!this.confirm && !this.trustByFlag) {
+    if (!preapproved && !this.confirm && !this.trustByFlag) {
       // Sin TUI ni --trust-plugins: la orden humana carga sólo esta sesión, como siempre.
       // Conserva la salida JSON de estado que ya consumen scripts de -p.
       const status = active ? this.runtime.status() : await this.runtime.enable(id, { signal: options.signal });
       return JSON.stringify({ ...status, note: t('{id}: active only in this session (no remembered trust). In the TUI, /plugins enable {id} asks for confirmation and remembers it; in -p, add --trust-plugins.', { id }) });
     }
-    const accepted = await this.#ask('PluginTrust', {
+    const accepted = preapproved || await this.#ask('PluginTrust', {
       plugin: id, project: this.project, module: code.module, code_fingerprint: code.code_fingerprint, files: code.files.map(file => file.path), ...(code.external.length ? { uncovered_packages: code.external } : {}), config: entry.config,
       ...(verdict.status === 'stale' ? { changed: verdict.reasons } : {}),
       effect: t('Comal will import and run this local Node code with your user permissions, now and on later startups while module, fingerprint and configuration do not change.'),
@@ -193,7 +201,7 @@ export class PluginControls {
     const lines = [t('{id}: trust remembered ({count} files, fingerprint {fingerprint}) · active.', { id, count: code.files.length, fingerprint: code.code_fingerprint.slice(0, 12) })];
     const split = pluginOperations(id);
     if (recommend && split && !this.rules.list().some(this.#pluginAllow(id))) {
-      const allow = await this.#ask('PluginAllow', { plugin: id, allow: split.observations.map(short), still_ask: split.actions.map(short), note: t('Recommended: authorize only observations. Actions will keep asking; /plugins allow {id} all authorizes all of them. Explicit denials still win.', { id }) }, options);
+      const allow = preapproved || await this.#ask('PluginAllow', { plugin: id, allow: split.observations.map(short), still_ask: split.actions.map(short), note: t('Recommended: authorize only observations. Actions will keep asking; /plugins allow {id} all authorizes all of them. Explicit denials still win.', { id }) }, options);
       if (allow) await this.rules.update({ add: [{ list: 'allow', rule: `plugin:${id}:observe`, scope: this.rules.scope }] });
       else lines.push(t('No allow rule saved. Recommended: /plugins allow {id} observe.', { id }));
     }
@@ -224,10 +232,18 @@ export class PluginControls {
     }).join('\n\n');
   }
   #split(id, set) { const { workflow, ...config } = set || {}; if (workflow !== undefined && !bundledPlugin(id)?.host?.workflow?.includes(workflow)) throw new Error(t('workflow does not apply to {id} or is not auto|raw.', { id })); return { workflow, config }; }
-  async add({ id, set }, options) {
+  async add({ id, set }, options) { return this.#add({ id, set }, options); }
+  /**
+   * Alta, confianza y lecturas sin preguntar confirmadas por una tarjeta del HOST que ya las
+   * mostró (la de /relay: versión de Comal, proyecto, permisos de la delegación). No vuelve a
+   * preguntar PluginTrust ni PluginAllow. Sólo plugins incluidos. No es una operación: ni el
+   * modelo ni /plugins la invocan; la llama el host después de la tarjeta del humano.
+   */
+  async link({ id, set }, options = {}) { return this.#add({ id, set }, options, { preapproved: true, replace: true }); }
+  async #add({ id, set }, options, { preapproved = false, replace = false } = {}) {
     const item = bundledPlugin(id); if (!item) throw new Error(t('{id} is not a bundled plugin. Use /plugins available; for others, edit {file}.', { id, file: this.project }));
     const { workflow, config } = this.#split(id, set), raw = await readRaw(this.project), existing = raw.plugins.find(entry => entry.id === id);
-    const next = { id, module: item.module, enabled: true, config: validateBundledConfig(id, { ...item.defaults, ...(existing?.config || {}), ...config }) };
+    const next = { id, module: item.module, enabled: true, config: validateBundledConfig(id, { ...item.defaults, ...(replace ? {} : existing?.config || {}), ...config }) };
     if (this.#live(id)?.state === 'active' && existing && existing.module !== item.module) throw new Error(t('{id} is active with another module; disable it before replacing it.', { id }));
     raw.plugins = existing ? raw.plugins.map(entry => entry.id === id ? next : entry) : [...raw.plugins, next];
     if (workflow) raw.chrome_workflow = workflow;
@@ -235,9 +251,16 @@ export class PluginControls {
     if (workflow) await this.onWorkflow(workflow);
     const lines = [t(existing ? 'Updated {id} in {file}' : 'Added {id} in {file}', { id, file: this.project }), t('  module: {module}', { module: item.module }), t('  config: {config}', { config: Object.entries(next.config).map(([key, value]) => `${key}=${value}`).join(' ') })];
     if (this.#live(id)?.state === 'active' && existing && configDigest(existing.config) !== configDigest(next.config)) lines.push(await this.#reconfigure(id, options));
-    lines.push(await this.#trustAndEnable(id, options, { recommend: true }));
+    lines.push(await this.#trustAndEnable(id, options, { recommend: true, preapproved }));
     return lines.join('\n');
   }
+  /** Estado de un plugin incluido en este proyecto: config guardada, confianza vigente y estado vivo. */
+  async describe(id) {
+    const raw = await readRaw(this.project), entry = raw.plugins.find(item => item.id === id), live = this.#live(id);
+    let trust = { status: 'untrusted', reasons: ['no record'] }, code = null;
+    if (entry) { try { const inspected = await this.runtime.inspect(id); code = inspected.code; trust = trustVerdict(this.store.find(this.project, id), { project: this.project, entry: inspected.entry, code }); } catch (error) { trust = { status: 'error', reasons: [error.message] }; } }
+    return { configured: Boolean(entry), config: entry?.config || null, state: live?.state || null, error: live?.error || null, trust, package: code?.package || null, code_fingerprint: code?.code_fingerprint || null };
+  }
   async #reconfigure(id, options) {
     const saved = this.store.find(this.project, id), { entry } = await this.runtime.inspect(id);
     if (saved) await this.store.update(this.project, id, () => ({ config_sha256: configDigest(entry.config) }));

package/src/plugin-trust.mjs

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { readPrivateJson, writePrivateJson } from './permission-rules.mjs';
 import { t, registerMessages } from './i18n/index.mjs';
+import { samePackage } from './package-identity.mjs';
 
 registerMessages({
   'Invalid trust record.': 'Registro de confianza inválido.',
@@ -11,6 +12,7 @@ registerMessages({
   'Trust record: invalid id or fingerprints.': 'Registro de confianza: id o huellas inválidas.',
   'Trust record: invalid files.': 'Registro de confianza: archivos inválidos.',
   'Trust record: invalid date.': 'Registro de confianza: fecha inválida.',
+  'Trust record: invalid package.': 'Registro de confianza: paquete inválido.',
   'Unrecognized trust registry format.': 'Formato de registro de confianza no reconocido.',
   'Trust registry ignored: {reason}': 'Registro de confianza ignorado: {reason}',
   'No recorded trust for {id} in this project. Use /plugins enable {id}.': 'No hay confianza registrada para {id} en este proyecto. Usa /plugins enable {id}.',
@@ -32,25 +34,32 @@ export function pluginTrustFile(env = process.env) {
 
 function record(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw fail(t('Invalid trust record.'));
-  const keys = ['project', 'id', 'module', 'code_fingerprint', 'config_sha256', 'files', 'trusted_at'];
+  const keys = ['project', 'id', 'module', 'code_fingerprint', 'config_sha256', 'files', 'trusted_at', 'package'];
   for (const key of Object.keys(value)) if (!keys.includes(key)) throw fail(t('Trust record: unknown field {key}', { key }));
   if (typeof value.project !== 'string' || !path.isAbsolute(value.project) || typeof value.module !== 'string' || !path.isAbsolute(value.module)) throw fail(t('Trust record: absolute paths required.'));
   if (!ID.test(value.id || '') || !SHA.test(value.code_fingerprint || '') || !SHA.test(value.config_sha256 || '')) throw fail(t('Trust record: invalid id or fingerprints.'));
   if (!Array.isArray(value.files) || value.files.length > 256 || value.files.some(file => !file || typeof file.path !== 'string' || !(file.sha256 === null || SHA.test(file.sha256)))) throw fail(t('Trust record: invalid files.'));
   if (typeof value.trusted_at !== 'string') throw fail(t('Trust record: invalid date.'));
-  return { project: value.project, id: value.id, module: value.module, code_fingerprint: value.code_fingerprint, config_sha256: value.config_sha256, files: value.files.map(file => ({ path: file.path, sha256: file.sha256 })), trusted_at: value.trusted_at };
+  const pkg = value.package;
+  if (pkg !== undefined && (!pkg || typeof pkg.name !== 'string' || pkg.name.length > 214 || typeof pkg.version !== 'string' || pkg.version.length > 64 || !SHA.test(pkg.integrity || '') || Object.keys(pkg).some(key => !['name', 'version', 'integrity'].includes(key)))) throw fail(t('Trust record: invalid package.'));
+  return { project: value.project, id: value.id, module: value.module, code_fingerprint: value.code_fingerprint, config_sha256: value.config_sha256, files: value.files.map(file => ({ path: file.path, sha256: file.sha256 })), trusted_at: value.trusted_at, ...(pkg ? { package: { name: pkg.name, version: pkg.version, integrity: pkg.integrity } } : {}) };
 }
 
 /**
  * Juzga una entrada configurada contra el registro. Sólo hay confianza vigente
  * si coinciden proyecto, id, módulo real, huella del código y digest de config.
+ * Plugins incluidos en un paquete con manifiesto (Comal instalado): la confianza es del
+ * PAQUETE (nombre, versión e integridad), así que vuelve a preguntarse una vez por versión
+ * y no depende de la ruta donde se instaló; el contenido sigue siendo el mismo porque la
+ * integridad es el digest de los archivos. Sin manifiesto (copia de desarrollo) vale la huella.
  */
 // Los motivos van también en el estado que lee el modelo (PluginStatus): inglés fijo, sin t().
 export function trustVerdict(saved, { project, entry, code }) {
   if (!saved) return { status: 'untrusted', reasons: ['no record'] };
-  const reasons = [];
-  if (saved.module !== code.module) reasons.push('module path');
-  if (saved.code_fingerprint !== code.code_fingerprint) {
+  const reasons = [], pkg = samePackage(saved.package, code.package);
+  if (saved.module !== code.module && !pkg) reasons.push('module path');
+  if (saved.package && code.package && !pkg) reasons.push(`Comal package (${saved.package.version} → ${code.package.version})`);
+  else if (saved.code_fingerprint !== code.code_fingerprint && !pkg) {
     const before = new Map(saved.files.map(file => [file.path, file.sha256])), changed = code.files.filter(file => before.get(file.path) !== file.sha256).map(file => file.path);
     const removed = saved.files.filter(file => !code.files.some(next => next.path === file.path)).map(file => file.path);
     reasons.push(`code fingerprint (${[...changed, ...removed].slice(0, 6).join(', ') || 'files'})`);
@@ -85,7 +94,7 @@ export class PluginTrustStore {
   }
   async trust({ project, entry, code }) {
     await this.#ready();
-    const next = record({ project, id: entry.id, module: code.module, code_fingerprint: code.code_fingerprint, config_sha256: configDigest(entry.config), files: code.files, trusted_at: new Date().toISOString() });
+    const next = record({ project, id: entry.id, module: code.module, code_fingerprint: code.code_fingerprint, config_sha256: configDigest(entry.config), files: code.files, trusted_at: new Date().toISOString(), ...(code.package ? { package: code.package } : {}) });
     await this.#save([...this.#records.filter(item => !(item.project === project && item.id === entry.id)), next]);
     return structuredClone(next);
   }

package/src/plugins/chrome-lab/bridge.mjs

@@ -22,14 +22,14 @@ export async function remoteBridge(config, lines) {
     if (!valid) throw new Error('Invalid private attach diagnostic arguments.');
     return option;
   };
-  const cdp = (method, params = {}, sessionId, diagnostic) => new Promise((resolve, reject) => {
+  const cdp = (method, params = {}, sessionId, diagnostic, replyOwner) => new Promise((resolve, reject) => {
     const id = ++sequence, started = performance.now();
     const outcome = (state,reason,error) => ({diagnostic:{version:1,method,session_id:sessionId,state,reason,remote_dispatched:true,timeout_ms:diagnostic.timeout_ms,elapsed_ms:performance.now()-started,...(error?{error}: {})}});
     const timer = setTimeout(() => {
       pending.delete(id);
       diagnostic ? resolve(outcome('unknown','command_timeout')) : reject(new Error(`CDP timeout: ${method}; no se reintentó.`));
     }, diagnostic?.timeout_ms ?? config.timeoutMs);
-    pending.set(id, { resolve, reject, timer, method, params, diagnostic, outcome });
+    pending.set(id, { resolve, reject, timer, method, params, sessionId, diagnostic, outcome, replyOwner });
     try { socket.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) })); }
     catch(error) { pending.delete(id); clearTimeout(timer); reject(error); }
   });
@@ -60,6 +60,19 @@ export async function remoteBridge(config, lines) {
   await new Promise((resolve, reject) => { socket.addEventListener('open', resolve, { once: true }); socket.addEventListener('error', () => reject(new Error('No se pudo abrir WebSocket CDP.')), { once: true }); });
   socket.addEventListener('message', event => {
     const message = JSON.parse(event.data);
+    const matched = pending.get(message.id);
+    // Only the actual matched browser response can populate this lexical owner.
+    // Caller-shaped Errors, optional diagnostics and internal bridge commands
+    // never supply native reply provenance. Keep the untruncated raw response.
+    if (matched?.replyOwner && ['Page.bringToFront','DOM.focus'].includes(matched.method) &&
+        typeof event.data === 'string' && Buffer.byteLength(event.data) <= 8192) {
+      matched.replyOwner.nativeReply = {format:'comal-cdp-native-reply/1',
+        outer_request_id:matched.replyOwner.outerId, cdp_request_id:message.id,
+        method:matched.method, session_id:matched.sessionId,
+        params_sha256:digest(JSON.stringify(matched.params)),
+        browser_endpoint_id:/^\/devtools\/browser\/([^/]+)$/.exec(endpoint.pathname)?.[1] || null,
+        remote_dispatched:true, reply_json:event.data};
+    }
     if (message.id) { const entry = pending.get(message.id); if (!entry) return; pending.delete(message.id); clearTimeout(entry.timer); if (!message.error) { if (entry.method === 'Target.attachToTarget' && message.result?.sessionId) { attached.add(message.result.sessionId); if(entry.params.flatten === true) flattened.add(message.result.sessionId); } if (entry.method === 'Target.detachFromTarget') { attached.delete(entry.params.sessionId); flattened.delete(entry.params.sessionId); } } if(entry.diagnostic) { if(message.error && (!Number.isInteger(message.error.code) || typeof message.error.message !== 'string')) entry.reject(new Error('Malformed diagnostic CDP error.')); else entry.resolve(message.error ? entry.outcome('rejected','command_error',{code:message.error.code,message:message.error.message.slice(0,1000)}) : entry.outcome('enabled','command_reply')); } else message.error ? entry.reject(Object.assign(new Error(`${message.error.code}: ${message.error.message}`), { cdpError: { method: entry.method, code: message.error.code, message: String(message.error.message).slice(0, 1000) } })) : entry.resolve(message.result); }
     else if (['Runtime.consoleAPICalled', 'Runtime.exceptionThrown', 'Runtime.executionContextCreated', 'Runtime.executionContextDestroyed', 'Runtime.executionContextsCleared', 'Log.entryAdded', 'Network.loadingFailed', 'Inspector.detached', 'Target.detachedFromTarget'].includes(message.method)) {
       if(message.method === 'Target.detachedFromTarget') { attached.delete(message.params?.sessionId); flattened.delete(message.params?.sessionId); }
@@ -204,12 +217,12 @@ export async function remoteBridge(config, lines) {
     return { url: `http://127.0.0.1:${server.address().port}/${file.split('/').map(encodeURIComponent).join('/')}`, lifetime: 'plugin_connection' };
   };
   lines.on('line', async line => {
-    let request;
+    let request, replyOwner;
     try {
       if (line.length > config.maxDeployBytes * 1.5 + 1000000) throw new Error('Mensaje demasiado grande.');
       request = JSON.parse(line); let result;
       const diagnostic = Object.hasOwn(request,'attachDiagnostic') ? diagnosticPolicy(request) : undefined;
-      if (request.action === 'cdp') result = await cdp(request.method, request.params, request.sessionId, diagnostic);
+      if (request.action === 'cdp') { replyOwner={outerId:request.id};result = await cdp(request.method, request.params, request.sessionId, diagnostic, replyOwner); }
       else if (request.action === 'status') result = await ownExtensions();
       else if (request.action === 'checkTarget') result = await checkTarget(request.params.targetId);
       else if (request.action === 'open') result = await cdp('Target.createTarget', { url: await checkURL(request.params.url) });
@@ -223,10 +236,10 @@ export async function remoteBridge(config, lines) {
       else if (request.action === 'preview') result = await preview(request.params);
       else if (request.action === 'unload') { const extension = await extensionFor(request.params.project); await cdp('Extensions.uninstall', { id: extension.id }); result = { extension_id: extension.id, unloaded: true }; }
       else throw new Error('Acción del bridge desconocida.');
-      const output = JSON.stringify({ id: request.id, result });
+      const output = JSON.stringify({ id: request.id, result, ...(replyOwner?.nativeReply ? {native_reply:replyOwner.nativeReply} : {}) });
       if (output.length > 12000000) throw new Error('Respuesta excesiva; usa consultas acotadas.');
       process.stdout.write(output + '\n');
-    } catch (error) { send({ id: request?.id, error: error.message, ...(error.cdpError ? { cdp_error: error.cdpError } : {}) }); }
+    } catch (error) { send({ id: request?.id, error: error.message, ...(error.cdpError ? { cdp_error: error.cdpError } : {}), ...(replyOwner?.nativeReply ? {native_reply:replyOwner.nativeReply} : {}) }); }
   });
   send({ ready: { browser: version.Browser, browser_endpoint_id: /^\/devtools\/browser\/([^/]+)$/.exec(endpoint.pathname)?.[1] || null, protocol_version: version['Protocol-Version'], extensions: protocol.domains.find(domain => domain.domain === 'Extensions')?.commands.map(command => command.name) || [], remote_root: root, node: process.version } });
 }