@nanhara/hara 0.126.0 → 0.126.1

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.126.1 — 2026-07-19 — verified plugin packages and ownership-safe lifecycle
+
+- **Plugin packages now fail closed at staging.** Hara validates a bounded manifest schema, portable IDs and
+  relative paths, declared Skills/roles/binaries/panels, and MCP entry points before activation. Complete
+  package scans reject symbolic links, hard-linked or special files, protected credential-shaped files,
+  filesystem-boundary crossings, and excessive file/byte counts.
+- **Install, update, and removal have an ownership transaction.** A same-filesystem private staging directory
+  is atomically activated; command collisions never overwrite foreign entries; and a private receipt binds the
+  installed root device/inode, manifest digest, and exact command links. Update rollback preserves the previous
+  package and commands, while uninstall refuses a changed root, a foreign command replacement, or an older
+  unreceipted install. A legacy plugin remains usable; reinstalling it from the same reviewed source performs
+  the one-time receipt migration, after which later updates and removal use the verified ownership path.
+- **Plugin MCP processes are rooted in their installed package.** Relative executables and conventional
+  Node/Bun/Deno/Python entry scripts are verified and converted to absolute installed paths, and each server
+  receives the immutable plugin root as its working directory instead of the user's project.
+- Install warnings no longer echo manifest-provided MCP arguments or hook command bodies, which could contain
+  credentials. They still identify each executable surface so the package source can be reviewed before use.
+- Upgrade with `npm i -g @nanhara/hara@0.126.1`.
+
 ## 0.126.0 — 2026-07-19 — provider control plane, bounded tools, and honest execution time
 
 - **Desktop can configure providers through an authenticated, redacted Serve control plane.** The shared

package/README.md

@@ -238,7 +238,10 @@ and a near-duplicate is flagged so it updates instead of piling up. `assetCaptur
 **Plugins** — bundle skills + roles + MCP servers in one installable unit (Claude-Code-compatible
 `plugin.json` / `.claude-plugin/`). `hara plugin add file:<path> | github:<owner/repo> | git:<url>` installs it;
 `hara plugin` lists; `enable`/`disable`/`remove`. A plugin's skills/roles/MCP auto-contribute (your project &
-global override them). `.claude/agents/*.md` subagents load as roles too.
+global override them). Installation validates the full package in a private stage, activates it atomically,
+and records an owner-only receipt for the exact root and command links. Plugins installed before `0.126.1`
+remain usable; reinstall the same reviewed source once to create the receipt before removing them.
+`.claude/agents/*.md` subagents load as roles too.
 
 **Recall** — `hara recall --init` creates a personal `~/.hara/code-assets` library (snippets as `*.md`);
 `hara recall "<query>"` searches it **plus your skills** (one corpus), and `/recall <query>` pulls the best

package/SECURITY.md

@@ -74,9 +74,13 @@ local user (who already has your shell).
   permission and starts one named server only when a task needs it. Their inherited environment is still
   scrubbed, but the extension may use its own credentials or access anything its host process permits.
 - **Plugins are code you trust.** Installing a plugin (`hara plugin add`) grants its author code execution:
-  its MCP servers may run on first relevant use and its hooks may run around matching tool calls. `hara plugin
-  add` **prints the exact commands** a plugin can run so you can review them; disable with
-  `hara plugin disable <name>`.
+  its MCP servers may run on first relevant use and its hooks may run around matching tool calls. Installation
+  validates the complete package in a private same-filesystem stage, binds executable contributions to portable
+  package-relative paths, and records an owner-only root/manifest/command receipt before removal is allowed.
+  `hara plugin add` identifies each executable surface without echoing manifest-provided arguments or hook
+  bodies, which may contain credentials; review the package source itself, and disable it with
+  `hara plugin disable <name>`. Plugins installed before `0.126.1` remain usable; reinstalling one from the same
+  reviewed source creates the receipt required for later ownership-safe updates and removal.
 - **Coding-plan keys.** Provider keys you configure are used only to call the model endpoint you set.
 
 ## What is *not* a security boundary

package/dist/index.js

@@ -2850,13 +2850,13 @@ pluginCmd
             if (!onPath)
                 out(c.yellow(`  add to PATH once:  echo 'export PATH="$HOME/.hara/bin:$PATH"' >> ~/.zshrc && source ~/.zshrc\n`));
         }
-        // Surface the code-execution surface: a plugin's MCP servers + hooks run shell commands on every
-        // hara launch with no prompt. Installing a plugin = trusting its author to run code; show what.
+        // Surface the code-execution surface without echoing manifest-provided arguments or hook bodies:
+        // those fields may contain credentials. Installing a plugin means trusting code from its author.
         const execs = [];
         for (const [name, s] of Object.entries(m.mcpServers ?? {}))
-            execs.push(`mcp ${name}: ${[s.command, ...(s.args ?? [])].join(" ")}`);
-        for (const h of [...(m.hooks?.PreToolUse ?? []), ...(m.hooks?.PostToolUse ?? [])])
-            execs.push(`hook: ${h.command}`);
+            execs.push(`mcp ${name}: ${s.command}`);
+        for (const _hook of [...(m.hooks?.PreToolUse ?? []), ...(m.hooks?.PostToolUse ?? [])])
+            execs.push("hook configured (command hidden)");
         if (execs.length) {
             out(c.yellow(`⚠ ${p.name} will run these commands on every hara launch (a plugin is code you run — review them):\n`) +
                 execs.map((e) => c.dim(`    ${e}`)).join("\n") +
@@ -2871,7 +2871,14 @@ pluginCmd
     .command("remove <name>")
     .alias("uninstall")
     .description("uninstall a plugin")
-    .action((name) => out(uninstallPlugin(name) ? c.green(`Removed ${name}\n`) : c.dim(`(no plugin '${name}')\n`)));
+    .action((name) => {
+    try {
+        out(uninstallPlugin(name) ? c.green(`Removed ${name}\n`) : c.dim(`(no plugin '${name}')\n`));
+    }
+    catch (error) {
+        out(c.red(`Remove failed: ${error?.message ?? String(error)}\n`));
+    }
+});
 pluginCmd
     .command("enable <name>")
     .description("enable an installed plugin")

package/dist/mcp/client.js

@@ -148,6 +148,7 @@ export async function connectMcpServers(servers, log, options = {}) {
             transport = new StdioClientTransport({
                 command: cfg.command,
                 args: cfg.args ?? [],
+                ...(cfg.cwd ? { cwd: cfg.cwd } : {}),
                 // The inherited agent environment is scrubbed; server-specific cfg.env is an explicit grant.
                 env: toolSubprocessEnv(process.env, cfg.env ?? {}),
                 // The SDK default is "inherit", which would let an external server print credentials or terminal

package/dist/plugins/manifest.js

@@ -0,0 +1,317 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { sensitiveFileReason } from "../security/sensitive-files.js";
+const MANIFEST_PATHS = [".claude-plugin/plugin.json", ".hara-plugin/plugin.json", "plugin.json"];
+const TOP_LEVEL_KEYS = new Set(["name", "version", "description", "skills", "agents", "mcpServers", "hooks", "bin", "panels"]);
+const MCP_KEYS = new Set(["command", "args", "env"]);
+const PANEL_KEYS = new Set(["id", "title", "command", "args", "port", "detect"]);
+const HOOK_KEYS = new Set(["matcher", "command"]);
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const MAX_PLUGIN_FILES = 20_000;
+const MAX_PLUGIN_BYTES = 512 * 1024 * 1024;
+const MAX_ARRAY_ENTRIES = 256;
+function record(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        throw new Error(`${label} must be a plain object`);
+    return value;
+}
+function knownKeys(value, allowed, label) {
+    const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+    if (unknown.length)
+        throw new Error(`${label} contains unsupported field '${unknown[0]}'`);
+}
+function text(value, label, max = 4096) {
+    if (typeof value !== "string")
+        throw new Error(`${label} must be a string`);
+    if (!value || value.length > max || /[\0-\x1f\x7f]/u.test(value)) {
+        throw new Error(`${label} is empty, too long, or contains control characters`);
+    }
+    return value;
+}
+export function safePluginId(value, label = "plugin name") {
+    const id = text(value, label, 64);
+    if (!ID.test(id))
+        throw new Error(`${label} must match ${ID.source}`);
+    return id;
+}
+export function safePluginRelativePath(value, label) {
+    const input = text(value, label, 512);
+    const path = input.startsWith("./") ? input.slice(2) : input;
+    if (isAbsolute(path)
+        || path.includes("\\")
+        || path.startsWith("~")
+        || /^[A-Za-z]:/u.test(path)
+        || path.startsWith("//"))
+        throw new Error(`${label} must be a portable relative path`);
+    const parts = path.split("/");
+    if (parts.some((part) => !part || part === "." || part === ".." || /[\0-\x1f\x7f]/u.test(part))) {
+        throw new Error(`${label} must not contain empty, current, parent, or control-character components`);
+    }
+    return parts.join("/");
+}
+function inside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+export function verifiedPluginPath(root, rel, kind, label) {
+    const safe = safePluginRelativePath(rel, label);
+    const canonicalRoot = realpathSync.native(resolve(root));
+    let current = canonicalRoot;
+    const parts = safe.split("/");
+    for (let index = 0; index < parts.length; index++) {
+        current = join(current, parts[index]);
+        const info = lstatSync(current);
+        if (info.isSymbolicLink())
+            throw new Error(`${label} contains a symbolic-link component`);
+        if (index < parts.length - 1 && !info.isDirectory())
+            throw new Error(`${label} crosses a non-directory component`);
+    }
+    const info = lstatSync(current);
+    if (kind === "file" && (!info.isFile() || info.nlink !== 1))
+        throw new Error(`${label} must be a single-link regular file`);
+    if (kind === "directory" && !info.isDirectory())
+        throw new Error(`${label} must be a directory`);
+    const canonical = realpathSync.native(current);
+    if (!inside(canonicalRoot, canonical))
+        throw new Error(`${label} escapes the immutable plugin root`);
+    return canonical;
+}
+function stringArray(value, label, pathValues = false) {
+    if (!Array.isArray(value) || value.length > MAX_ARRAY_ENTRIES)
+        throw new Error(`${label} must be a bounded array`);
+    return value.map((entry, index) => pathValues
+        ? safePluginRelativePath(entry, `${label}[${index}]`)
+        : text(entry, `${label}[${index}]`));
+}
+function validateHooks(value) {
+    const raw = record(value, "plugin hooks");
+    knownKeys(raw, new Set(["PreToolUse", "PostToolUse"]), "plugin hooks");
+    const out = {};
+    for (const event of ["PreToolUse", "PostToolUse"]) {
+        if (raw[event] === undefined)
+            continue;
+        if (!Array.isArray(raw[event]) || raw[event].length > 64)
+            throw new Error(`plugin hooks.${event} must be a bounded array`);
+        out[event] = raw[event].map((entry, index) => {
+            const item = record(entry, `plugin hooks.${event}[${index}]`);
+            knownKeys(item, HOOK_KEYS, `plugin hooks.${event}[${index}]`);
+            const hook = { command: text(item.command, `plugin hooks.${event}[${index}].command`, 16_384) };
+            if (item.matcher !== undefined)
+                hook.matcher = text(item.matcher, `plugin hooks.${event}[${index}].matcher`, 1024);
+            return hook;
+        });
+    }
+    return out;
+}
+function validateMcpServers(value) {
+    const raw = record(value, "plugin mcpServers");
+    if (Object.keys(raw).length > 64)
+        throw new Error("plugin mcpServers has too many entries");
+    const out = {};
+    for (const [rawName, rawConfig] of Object.entries(raw)) {
+        const name = safePluginId(rawName, "MCP server id");
+        const item = record(rawConfig, `MCP server '${name}'`);
+        knownKeys(item, MCP_KEYS, `MCP server '${name}'`);
+        const command = text(item.command, `MCP server '${name}' command`, 512);
+        if (/\s/u.test(command))
+            throw new Error(`MCP server '${name}' command must be one executable, not a shell command`);
+        const config = { command };
+        if (item.args !== undefined)
+            config.args = stringArray(item.args, `MCP server '${name}' args`);
+        if (item.env !== undefined) {
+            const env = record(item.env, `MCP server '${name}' env`);
+            if (Object.keys(env).length > 128)
+                throw new Error(`MCP server '${name}' env has too many entries`);
+            config.env = {};
+            for (const [key, rawValue] of Object.entries(env)) {
+                if (!ENV_KEY.test(key))
+                    throw new Error(`MCP server '${name}' env key '${key}' is invalid`);
+                config.env[key] = text(rawValue, `MCP server '${name}' env '${key}'`, 65_536);
+            }
+        }
+        out[name] = config;
+    }
+    return out;
+}
+function validateManifest(value, root) {
+    const raw = record(value, "plugin manifest");
+    knownKeys(raw, TOP_LEVEL_KEYS, "plugin manifest");
+    const manifest = { name: safePluginId(raw.name) };
+    if (raw.version !== undefined)
+        manifest.version = text(raw.version, "plugin version", 128);
+    if (raw.description !== undefined)
+        manifest.description = text(raw.description, "plugin description", 4096);
+    for (const field of ["skills", "agents"]) {
+        if (raw[field] === undefined)
+            continue;
+        const paths = stringArray(raw[field], `plugin ${field}`, true);
+        for (let index = 0; index < paths.length; index++) {
+            verifiedPluginPath(root, paths[index], "directory", `plugin ${field}[${index}]`);
+        }
+        manifest[field] = paths;
+    }
+    if (raw.bin !== undefined) {
+        const bins = record(raw.bin, "plugin bin");
+        if (Object.keys(bins).length > 128)
+            throw new Error("plugin bin has too many entries");
+        manifest.bin = {};
+        for (const [rawName, rawPath] of Object.entries(bins)) {
+            const name = safePluginId(rawName, "plugin command name");
+            const rel = safePluginRelativePath(rawPath, `plugin bin '${name}'`);
+            verifiedPluginPath(root, rel, "file", `plugin bin '${name}'`);
+            manifest.bin[name] = rel;
+        }
+    }
+    if (raw.mcpServers !== undefined)
+        manifest.mcpServers = validateMcpServers(raw.mcpServers);
+    if (raw.hooks !== undefined)
+        manifest.hooks = validateHooks(raw.hooks);
+    if (raw.panels !== undefined) {
+        if (!Array.isArray(raw.panels) || raw.panels.length > 64)
+            throw new Error("plugin panels must be a bounded array");
+        manifest.panels = raw.panels.map((entry, index) => {
+            const item = record(entry, `plugin panels[${index}]`);
+            knownKeys(item, PANEL_KEYS, `plugin panels[${index}]`);
+            const command = safePluginId(item.command, `plugin panels[${index}].command`);
+            if (!manifest.bin?.[command]) {
+                throw new Error(`plugin panels[${index}].command must reference a declared plugin bin`);
+            }
+            const panel = {
+                id: safePluginId(item.id, `plugin panels[${index}].id`),
+                title: text(item.title, `plugin panels[${index}].title`, 256),
+                command,
+            };
+            if (item.args !== undefined)
+                panel.args = stringArray(item.args, `plugin panels[${index}].args`);
+            if (item.detect !== undefined)
+                panel.detect = stringArray(item.detect, `plugin panels[${index}].detect`, true);
+            if (item.port !== undefined) {
+                if (!Number.isInteger(item.port) || Number(item.port) < 1 || Number(item.port) > 65_535) {
+                    throw new Error(`plugin panels[${index}].port must be an integer from 1 to 65535`);
+                }
+                panel.port = Number(item.port);
+            }
+            return panel;
+        });
+    }
+    // Validation must fail during staging, not only when a later session starts the server. This also catches
+    // `node server.mjs`-style relative entry scripts whose process cwd used to be the user's current project.
+    if (manifest.mcpServers)
+        bindPluginMcpServers(root, manifest);
+    return manifest;
+}
+export function verifyPluginTree(root) {
+    const canonicalRoot = realpathSync.native(resolve(root));
+    const rootInfo = lstatSync(canonicalRoot);
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink())
+        throw new Error("plugin root must be a real directory");
+    const rootDevice = String(rootInfo.dev);
+    let files = 0;
+    let bytes = 0;
+    const stack = [canonicalRoot];
+    while (stack.length) {
+        const directory = stack.pop();
+        for (const name of readdirSync(directory)) {
+            files++;
+            if (files > MAX_PLUGIN_FILES)
+                throw new Error(`plugin contains more than ${MAX_PLUGIN_FILES} filesystem entries`);
+            const path = join(directory, name);
+            const info = lstatSync(path);
+            if (info.isSymbolicLink())
+                throw new Error(`plugin packages must not contain symbolic links: '${relative(canonicalRoot, path)}'`);
+            if (String(info.dev) !== rootDevice) {
+                throw new Error(`plugin packages must not cross filesystem boundaries: '${relative(canonicalRoot, path)}'`);
+            }
+            if (info.isDirectory()) {
+                stack.push(path);
+                continue;
+            }
+            if (!info.isFile() || info.nlink !== 1) {
+                throw new Error(`plugin packages may contain only directories and single-link regular files: '${relative(canonicalRoot, path)}'`);
+            }
+            const protectedReason = sensitiveFileReason(path);
+            if (protectedReason)
+                throw new Error(`plugin package contains protected ${protectedReason}: '${relative(canonicalRoot, path)}'`);
+            bytes += info.size;
+            if (bytes > MAX_PLUGIN_BYTES)
+                throw new Error(`plugin exceeds the ${MAX_PLUGIN_BYTES}-byte unpacked limit`);
+        }
+    }
+}
+export function readVerifiedPluginManifest(root, options = {}) {
+    if (options.scanTree !== false)
+        verifyPluginTree(root);
+    else {
+        const info = lstatSync(realpathSync.native(resolve(root)));
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("plugin root must be a real directory");
+    }
+    const present = [];
+    for (const rel of MANIFEST_PATHS) {
+        try {
+            present.push(verifiedPluginPath(root, rel, "file", "plugin manifest"));
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                throw error;
+        }
+    }
+    if (!present.length)
+        throw new Error("no supported plugin.json at the source root");
+    if (present.length > 1)
+        throw new Error("plugin package contains multiple ambiguous manifests");
+    const path = present[0];
+    const info = lstatSync(path);
+    if (info.size > MAX_MANIFEST_BYTES)
+        throw new Error("plugin manifest is too large");
+    const raw = readFileSync(path, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("plugin manifest is not valid JSON");
+    }
+    return {
+        manifest: validateManifest(parsed, root),
+        path,
+        sha256: createHash("sha256").update(raw).digest("hex"),
+    };
+}
+function pathLikeCommand(command) {
+    return command.startsWith(".") || command.includes("/") || command.includes("\\") || isAbsolute(command) || /^[A-Za-z]:/u.test(command);
+}
+/** Bind every plugin-owned MCP process to the installed package root. Bare PATH executables remain
+ * allowed, but relative executables and conventional runtime entry scripts become verified absolute files. */
+export function bindPluginMcpServers(root, manifest) {
+    const out = {};
+    for (const [name, input] of Object.entries(manifest.mcpServers ?? {})) {
+        let command = input.command;
+        const args = [...(input.args ?? [])];
+        if (pathLikeCommand(command)) {
+            command = verifiedPluginPath(root, safePluginRelativePath(command, `MCP server '${name}' command`), "file", `MCP server '${name}' command`);
+        }
+        else {
+            const runtime = command.toLowerCase().replace(/\.exe$/u, "");
+            if (["node", "bun", "deno", "python", "python3", "pythonw"].includes(runtime)) {
+                const scriptIndex = args.findIndex((arg) => !arg.startsWith("-") && /\.(?:[cm]?js|ts|py)$/iu.test(arg));
+                if (scriptIndex >= 0) {
+                    args[scriptIndex] = verifiedPluginPath(root, safePluginRelativePath(args[scriptIndex], `MCP server '${name}' entry script`), "file", `MCP server '${name}' entry script`);
+                }
+            }
+        }
+        out[name] = {
+            command,
+            ...(args.length ? { args } : {}),
+            ...(input.env ? { env: { ...input.env } } : {}),
+            cwd: realpathSync.native(resolve(root)),
+        };
+    }
+    return out;
+}

package/dist/plugins/plugins.js

@@ -1,189 +1,526 @@
-// Plugins — a distribution unit that drops skills / roles / MCP servers onto disk; it owns nothing at
-// runtime. The existing loaders pick the contents up (skillsDirs/loadRoles append the resolvers below;
-// index.ts merges pluginMcpServers into the MCP set). Manifest is Claude-Code-compatible: we read
-// .claude-plugin/plugin.json, .hara-plugin/plugin.json, or a bare plugin.json at the plugin root.
-import { readFileSync, existsSync, mkdirSync, readdirSync, rmSync, cpSync, symlinkSync, chmodSync } from "node:fs";
-import { join, resolve, isAbsolute } from "node:path";
+// Plugins are untrusted distribution units. Installation validates every executable contribution,
+// activates a same-filesystem staging directory atomically, and records the exact directory/bin ownership
+// used by uninstall. Runtime loaders re-validate installed manifests instead of trusting installation time.
+import { chmodSync, cpSync, existsSync, lstatSync, readlinkSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { readRawConfig, updateRawConfig } from "../config.js";
+import { bindPrivateHaraStateFile, ensurePrivateStateSubdirectory, readPrivateStateFileSnapshotSync, removePrivateStateFile, writePrivateStateFileSync, } from "../security/private-state.js";
+import { bindPluginMcpServers, readVerifiedPluginManifest, safePluginId, safePluginRelativePath, } from "./manifest.js";
 export function pluginsDir() {
     return join(homedir(), ".hara", "plugins");
 }
-/** Where plugin-contributed CLI commands are symlinked. Add to PATH to use them (e.g. `export PATH="$HOME/.hara/bin:$PATH"`). */
 export function haraBinDir() {
     return join(homedir(), ".hara", "bin");
 }
-/** Symlink a plugin's `bin` entries into ~/.hara/bin (chmod +x the targets). Returns the command names linked. */
-function linkPluginBins(root, manifest) {
-    if (!manifest.bin)
-        return [];
-    const dir = haraBinDir();
-    mkdirSync(dir, { recursive: true });
-    const linked = [];
-    for (const [name, rel] of Object.entries(manifest.bin)) {
-        const target = join(root, rel);
-        if (!existsSync(target))
-            continue;
-        try {
-            chmodSync(target, 0o755);
-        }
-        catch {
-            /* best-effort */
-        }
-        const link = join(dir, name);
-        try {
-            rmSync(link, { force: true });
-            symlinkSync(target, link);
-            linked.push(name);
-        }
-        catch {
-            /* skip a bin we can't link */
-        }
+function pluginStorage() {
+    return ensurePrivateStateSubdirectory(homedir(), [".hara", "plugins"]).path;
+}
+function pluginBinStorage() {
+    return ensurePrivateStateSubdirectory(homedir(), [".hara", "bin"]).path;
+}
+function pluginRoot(name) {
+    const safe = safePluginId(name);
+    const root = join(pluginStorage(), safe);
+    if (resolve(root) !== join(pluginStorage(), safe))
+        throw new Error("plugin root escaped the Hara plugin directory");
+    return root;
+}
+function receiptBinding(name) {
+    return bindPrivateHaraStateFile(homedir(), ["plugin-receipts"], `${safePluginId(name)}.json`);
+}
+function rootIdentity(path) {
+    const info = lstatSync(path);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error(`plugin root '${path}' is not an owned real directory`);
+    return { rootDev: String(info.dev), rootIno: String(info.ino) };
+}
+function pluginBins(manifest) {
+    return { ...(manifest.bin ?? {}) };
+}
+function parseReceipt(raw, expectedName) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`plugin '${expectedName}' ownership receipt is invalid JSON`);
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`plugin '${expectedName}' ownership receipt is invalid`);
+    }
+    const input = value;
+    const allowed = new Set(["schemaVersion", "name", "root", "rootDev", "rootIno", "manifestSha256", "bins"]);
+    if (Object.keys(input).some((key) => !allowed.has(key)) || input.schemaVersion !== 1) {
+        throw new Error(`plugin '${expectedName}' ownership receipt has an unsupported schema`);
     }
-    return linked;
+    const name = safePluginId(input.name, "receipt plugin name");
+    if (name !== expectedName)
+        throw new Error(`plugin '${expectedName}' ownership receipt belongs to '${name}'`);
+    if (typeof input.root !== "string"
+        || typeof input.rootDev !== "string"
+        || typeof input.rootIno !== "string"
+        || typeof input.manifestSha256 !== "string"
+        || !/^[a-f0-9]{64}$/u.test(input.manifestSha256)
+        || !input.bins
+        || typeof input.bins !== "object"
+        || Array.isArray(input.bins))
+        throw new Error(`plugin '${expectedName}' ownership receipt is incomplete`);
+    const bins = {};
+    for (const [rawName, rawPath] of Object.entries(input.bins)) {
+        const binName = safePluginId(rawName, "receipt command name");
+        bins[binName] = safePluginRelativePath(rawPath, `receipt command '${binName}'`);
+    }
+    return {
+        schemaVersion: 1,
+        name,
+        root: resolve(input.root),
+        rootDev: input.rootDev,
+        rootIno: input.rootIno,
+        manifestSha256: input.manifestSha256,
+        bins,
+    };
+}
+function readReceipt(name) {
+    const binding = receiptBinding(name);
+    const snapshot = readPrivateStateFileSnapshotSync(binding.path, 256 * 1024);
+    if (!snapshot)
+        return null;
+    return { binding, snapshot, raw: snapshot.text, receipt: parseReceipt(snapshot.text, name) };
+}
+function writeReceipt(name, root, verified) {
+    const identity = rootIdentity(root);
+    const receipt = {
+        schemaVersion: 1,
+        name,
+        root: resolve(root),
+        ...identity,
+        manifestSha256: verified.sha256,
+        bins: pluginBins(verified.manifest),
+    };
+    writePrivateStateFileSync(receiptBinding(name), `${JSON.stringify(receipt, null, 2)}\n`);
+    return receipt;
 }
-/** Remove a plugin's linked bins (on uninstall). */
-function unlinkPluginBins(manifest) {
-    if (!manifest?.bin)
+function restoreReceipt(name, raw) {
+    const binding = receiptBinding(name);
+    if (raw !== null) {
+        writePrivateStateFileSync(binding, raw);
         return;
-    for (const name of Object.keys(manifest.bin)) {
-        try {
-            rmSync(join(haraBinDir(), name), { force: true });
-        }
-        catch {
-            /* ignore */
-        }
     }
+    const current = readPrivateStateFileSnapshotSync(binding.path, 256 * 1024);
+    if (current)
+        removePrivateStateFile(binding.path, current, binding.directory);
 }
-const MANIFEST_PATHS = [".claude-plugin/plugin.json", ".hara-plugin/plugin.json", "plugin.json"];
-function readManifest(root) {
-    for (const rel of MANIFEST_PATHS) {
-        const p = join(root, rel);
-        if (!existsSync(p))
-            continue;
-        try {
-            return JSON.parse(readFileSync(p, "utf8"));
-        }
-        catch {
-            return null;
-        }
+function verifyReceipt(receipt, root, verified) {
+    const canonicalRoot = resolve(root);
+    const identity = rootIdentity(canonicalRoot);
+    if (receipt.root !== canonicalRoot
+        || receipt.rootDev !== identity.rootDev
+        || receipt.rootIno !== identity.rootIno
+        || receipt.manifestSha256 !== verified.sha256)
+        throw new Error(`plugin '${receipt.name}' changed after installation; refusing an ownership-sensitive operation`);
+}
+function resolvedLinkTarget(link) {
+    const target = readlinkSync(link);
+    return resolve(dirname(link), target);
+}
+function entryExists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return false;
+        throw error;
     }
-    return null;
 }
-/** Every installed plugin under ~/.hara/plugins (regardless of enabled state). */
+function expectedBinTarget(root, rel) {
+    const target = resolve(root, safePluginRelativePath(rel, "plugin command target"));
+    const relToRoot = relative(resolve(root), target);
+    if (relToRoot.startsWith("..") || isAbsolute(relToRoot))
+        throw new Error("plugin command target escaped its package root");
+    return target;
+}
+function preflightBinLink(root, name, rel, allowMissing = true) {
+    const link = join(pluginBinStorage(), safePluginId(name, "plugin command name"));
+    if (!entryExists(link)) {
+        if (allowMissing)
+            return;
+        throw new Error(`plugin command link '${name}' is missing`);
+    }
+    const info = lstatSync(link);
+    if (!info.isSymbolicLink() || resolvedLinkTarget(link) !== expectedBinTarget(root, rel)) {
+        throw new Error(`refusing to replace or remove foreign command entry '${link}'`);
+    }
+}
+function unlinkBinLink(root, name, rel) {
+    const link = join(pluginBinStorage(), safePluginId(name, "plugin command name"));
+    if (!entryExists(link))
+        return;
+    preflightBinLink(root, name, rel, false);
+    rmSync(link);
+}
+function ensureBinLink(root, name, rel) {
+    const dir = pluginBinStorage();
+    const link = join(dir, safePluginId(name, "plugin command name"));
+    const target = expectedBinTarget(root, rel);
+    const targetInfo = lstatSync(target);
+    if (!targetInfo.isFile() || targetInfo.isSymbolicLink() || targetInfo.nlink !== 1) {
+        throw new Error(`plugin command '${name}' is not a verified regular file`);
+    }
+    if (entryExists(link)) {
+        preflightBinLink(root, name, rel, false);
+        return;
+    }
+    try {
+        chmodSync(target, 0o755);
+    }
+    catch (error) {
+        if (process.platform !== "win32")
+            throw error;
+    }
+    symlinkSync(target, link, "file");
+}
+function restoreBinLinks(root, bins) {
+    for (const [name, rel] of Object.entries(bins))
+        ensureBinLink(root, name, rel);
+}
+function safeTemporaryRemove(path) {
+    if (!existsSync(path))
+        return;
+    const info = lstatSync(path);
+    if (info.isSymbolicLink()) {
+        rmSync(path);
+        return;
+    }
+    if (!info.isDirectory())
+        throw new Error(`refusing to recursively remove unexpected plugin staging entry '${path}'`);
+    rmSync(path, { recursive: true, force: true });
+}
+function readInstalled(root, expectedName, options = {}) {
+    const info = lstatSync(root);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error(`installed plugin root '${root}' is not a real directory`);
+    const verified = readVerifiedPluginManifest(root, options);
+    const name = safePluginId(verified.manifest.name);
+    if (expectedName && name !== expectedName)
+        throw new Error(`installed plugin '${expectedName}' claims the different name '${name}'`);
+    return {
+        plugin: { name, version: verified.manifest.version || "0.0.0", root: realpathSync.native(root), manifest: verified.manifest },
+        verified,
+    };
+}
+/** Every installed plugin under ~/.hara/plugins (regardless of enabled state). Invalid roots never execute.
+ * A structurally valid legacy root remains usable so an explicit reinstall can replace it and create a receipt;
+ * ownership-sensitive removal still refuses it until that migration happens. */
 export function listInstalled() {
-    const dir = pluginsDir();
-    if (!existsSync(dir))
-        return [];
+    const dir = pluginStorage();
     const out = [];
     for (const entry of readdirSync(dir)) {
-        const root = join(dir, entry);
-        const manifest = readManifest(root);
-        if (!manifest)
+        if (entry.startsWith(".") || entry.startsWith("_"))
             continue;
-        out.push({ name: manifest.name || entry, version: manifest.version || "0.0.0", root, manifest });
+        try {
+            const name = safePluginId(entry, "installed plugin directory");
+            // Installation and ownership-sensitive operations scan the complete package. Hot-path discovery only
+            // revalidates the manifest and every declared skill/agent/bin/MCP entry; unrelated package files cannot
+            // become executable contributions and must not add O(package-size) latency to each prompt/turn.
+            const { plugin } = readInstalled(join(dir, name), name, { scanTree: false });
+            out.push(plugin);
+        }
+        catch {
+            // Fail closed: a malformed root contributes no code, paths, hooks, MCP servers, or panels.
+        }
     }
     return out;
 }
-/** A plugin is active unless explicitly disabled in config (`plugins.enabled[name] === false`). */
 export function enabledPlugins() {
     const enabled = (readRawConfig().plugins?.enabled ?? {});
-    return listInstalled().filter((p) => enabled[p.name] !== false);
+    return listInstalled().filter((plugin) => enabled[plugin.name] !== false);
 }
-function resolveDirs(p, entries) {
-    return (entries ?? [])
-        .map((e) => (isAbsolute(e) ? e : resolve(p.root, e)))
-        .filter((d) => existsSync(d));
+function resolveDirs(plugin, entries) {
+    return (entries ?? []).map((entry) => {
+        const root = realpathSync.native(resolve(plugin.root));
+        const requested = resolve(root, safePluginRelativePath(entry, `plugin '${plugin.name}' contribution`));
+        const target = realpathSync.native(requested);
+        const rel = relative(root, target);
+        if (rel.startsWith("..") || isAbsolute(rel))
+            throw new Error(`plugin '${plugin.name}' contribution escaped its root`);
+        return target;
+    });
 }
-// --- Contribution resolvers (consumed by the existing loaders; lowest precedence) ---
-/** Skill search dirs from enabled plugins (each holds <name>/SKILL.md subdirs). */
 export function pluginSkillDirs() {
-    return enabledPlugins().flatMap((p) => resolveDirs(p, p.manifest.skills));
+    return enabledPlugins().flatMap((plugin) => resolveDirs(plugin, plugin.manifest.skills));
 }
-/** Role/subagent dirs from enabled plugins. */
 export function pluginRoleDirs() {
-    return enabledPlugins().flatMap((p) => resolveDirs(p, p.manifest.agents));
+    return enabledPlugins().flatMap((plugin) => resolveDirs(plugin, plugin.manifest.agents));
 }
-/** MCP servers contributed by enabled plugins (merged under user config, which wins). */
 export function pluginMcpServers() {
     const out = {};
-    for (const p of enabledPlugins())
-        Object.assign(out, p.manifest.mcpServers ?? {});
+    for (const plugin of enabledPlugins())
+        Object.assign(out, bindPluginMcpServers(plugin.root, plugin.manifest));
     return out;
 }
-/** Lifecycle hooks contributed by enabled plugins (appended after user-config hooks). */
 export function pluginHooks() {
     const out = { PreToolUse: [], PostToolUse: [] };
-    for (const p of enabledPlugins()) {
-        const h = p.manifest.hooks;
-        if (!h || typeof h !== "object")
+    for (const plugin of enabledPlugins()) {
+        const hooks = plugin.manifest.hooks;
+        if (!hooks)
             continue;
-        if (Array.isArray(h.PreToolUse))
-            out.PreToolUse.push(...h.PreToolUse);
-        if (Array.isArray(h.PostToolUse))
-            out.PostToolUse.push(...h.PostToolUse);
+        if (hooks.PreToolUse)
+            out.PreToolUse.push(...hooks.PreToolUse);
+        if (hooks.PostToolUse)
+            out.PostToolUse.push(...hooks.PostToolUse);
     }
     return out;
 }
-/** Install a plugin from `file:<path>`, `github:<owner/repo>`, or `git:<url>` into ~/.hara/plugins/<name>. */
+function validGitSource(source) {
+    const url = source.slice("git:".length);
+    if (!/^(?:https:\/\/|ssh:\/\/|git@)[^\s\0]+$/u.test(url)) {
+        throw new Error("git source must use an https://, ssh://, or git@ URL");
+    }
+    return url;
+}
+function populateStaging(source, staging) {
+    if (source.startsWith("file:")) {
+        const requested = resolve(source.slice("file:".length));
+        const info = lstatSync(requested);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error(`plugin source '${requested}' must be a real directory`);
+        const src = realpathSync.native(requested);
+        const store = realpathSync.native(pluginStorage());
+        const rel = relative(store, src);
+        if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
+            throw new Error("plugin source must not be inside Hara's installed plugin directory");
+        }
+        cpSync(src, staging, { recursive: true, dereference: false, errorOnExist: true, force: false });
+    }
+    else if (source.startsWith("github:")) {
+        const repo = source.slice("github:".length);
+        if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(repo))
+            throw new Error("github source must be owner/repository");
+        execFileSync("git", ["clone", "--depth", "1", `https://github.com/${repo}.git`, staging], { stdio: "ignore" });
+    }
+    else if (source.startsWith("git:")) {
+        execFileSync("git", ["clone", "--depth", "1", validGitSource(source), staging], { stdio: "ignore" });
+    }
+    else {
+        throw new Error("source must be file:<path>, github:<owner/repo>, or git:<url>");
+    }
+    safeTemporaryRemove(join(staging, ".git"));
+    safeTemporaryRemove(join(staging, ".learnings"));
+}
+/** Install through a validated same-filesystem stage. Replacements preserve the previous directory and
+ * receipt until the new manifest, bin links, and ownership receipt have all committed successfully. */
 export function installPlugin(source) {
-    mkdirSync(pluginsDir(), { recursive: true });
-    const tmpName = `_install-${process.pid}-${Date.now()}`;
-    const tmp = join(pluginsDir(), tmpName);
-    rmSync(tmp, { recursive: true, force: true });
+    const store = pluginStorage();
+    const staging = join(store, `_install-${process.pid}-${randomUUID()}`);
+    const backup = join(store, `_backup-${process.pid}-${randomUUID()}`);
+    let destination = "";
+    let newActivated = false;
+    let oldMoved = false;
+    let oldManifest = null;
+    let oldReceipt = null;
+    let oldBins = {};
+    let oldIdentity = null;
+    let newManifest = null;
     try {
-        if (source.startsWith("file:")) {
-            const src = resolve(source.slice("file:".length));
-            if (!existsSync(src))
-                throw new Error(`no such path: ${src}`);
-            cpSync(src, tmp, { recursive: true });
-        }
-        else if (source.startsWith("github:")) {
-            execFileSync("git", ["clone", "--depth", "1", `https://github.com/${source.slice("github:".length)}.git`, tmp], { stdio: "ignore" });
-        }
-        else if (source.startsWith("git:")) {
-            execFileSync("git", ["clone", "--depth", "1", source.slice("git:".length), tmp], { stdio: "ignore" });
-        }
-        else {
-            throw new Error("source must be file:<path>, github:<owner/repo>, or git:<url>");
-        }
-        const manifest = readManifest(tmp);
-        if (!manifest || !manifest.name) {
-            rmSync(tmp, { recursive: true, force: true });
-            throw new Error("no valid plugin.json (need at least a name) at the source root");
-        }
-        const dest = join(pluginsDir(), manifest.name);
-        rmSync(dest, { recursive: true, force: true });
-        // move tmp → dest (rename within the same dir)
-        cpSync(tmp, dest, { recursive: true });
-        rmSync(tmp, { recursive: true, force: true });
-        linkPluginBins(dest, manifest); // expose any plugin CLI commands in ~/.hara/bin
-        return { name: manifest.name, version: manifest.version || "0.0.0", root: dest, manifest };
-    }
-    catch (e) {
-        rmSync(tmp, { recursive: true, force: true });
-        throw e;
-    }
-}
-export function uninstallPlugin(name) {
-    const dest = join(pluginsDir(), name);
-    if (!existsSync(dest))
+        populateStaging(source, staging);
+        newManifest = readVerifiedPluginManifest(staging);
+        const name = newManifest.manifest.name;
+        destination = pluginRoot(name);
+        if (existsSync(destination)) {
+            const installed = readInstalled(destination, name);
+            oldManifest = installed.verified;
+            oldBins = pluginBins(oldManifest.manifest);
+            oldReceipt = readReceipt(name);
+            if (oldReceipt)
+                verifyReceipt(oldReceipt.receipt, destination, oldManifest);
+            oldIdentity = rootIdentity(destination);
+        }
+        const newBins = pluginBins(newManifest.manifest);
+        for (const [name, rel] of Object.entries(oldBins))
+            preflightBinLink(destination, name, rel);
+        for (const [name, rel] of Object.entries(newBins)) {
+            const link = join(pluginBinStorage(), name);
+            if (!entryExists(link))
+                continue;
+            if (!oldBins[name])
+                throw new Error(`refusing to overwrite foreign command entry '${link}'`);
+            preflightBinLink(destination, name, oldBins[name], false);
+            // The new target itself was verified in staging; changed relative targets are replaced after activation.
+            void rel;
+        }
+        if (existsSync(destination)) {
+            renameSync(destination, backup);
+            oldMoved = true;
+            const moved = rootIdentity(backup);
+            if (!oldIdentity || moved.rootDev !== oldIdentity.rootDev || moved.rootIno !== oldIdentity.rootIno) {
+                throw new Error(`plugin '${name}' root identity changed during update`);
+            }
+        }
+        renameSync(staging, destination);
+        newActivated = true;
+        newManifest = readVerifiedPluginManifest(destination);
+        for (const [name, rel] of Object.entries(oldBins)) {
+            if (newBins[name] !== rel)
+                unlinkBinLink(destination, name, rel);
+        }
+        for (const [name, rel] of Object.entries(newBins))
+            ensureBinLink(destination, name, rel);
+        writeReceipt(name, destination, newManifest);
+        const result = {
+            name,
+            version: newManifest.manifest.version || "0.0.0",
+            root: realpathSync.native(destination),
+            manifest: newManifest.manifest,
+        };
+        // Activation and its receipt are committed. Cleanup is deliberately outside rollback: recursive backup
+        // removal can partially succeed, so a cleanup error must leave an inert `_backup-*` entry rather than
+        // restore a partially removed old package over the verified new one.
+        if (oldMoved) {
+            try {
+                safeTemporaryRemove(backup);
+            }
+            catch {
+                // A later bounded maintenance pass may remove the skipped, non-loadable backup after inspection.
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        const rollbackErrors = [];
+        const failedManifest = newManifest;
+        const name = failedManifest?.manifest.name;
+        if (failedManifest && name && destination) {
+            try {
+                if (newActivated) {
+                    for (const [binName, rel] of Object.entries(pluginBins(failedManifest.manifest))) {
+                        if (entryExists(join(pluginBinStorage(), binName)))
+                            unlinkBinLink(destination, binName, rel);
+                    }
+                }
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(`new command cleanup: ${rollbackError?.message ?? String(rollbackError)}`);
+            }
+            try {
+                if (newActivated && existsSync(destination))
+                    safeTemporaryRemove(destination);
+                if (oldMoved && existsSync(backup))
+                    renameSync(backup, destination);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(`directory restore: ${rollbackError?.message ?? String(rollbackError)}`);
+            }
+            try {
+                if (oldMoved && existsSync(destination))
+                    restoreBinLinks(destination, oldBins);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(`old command restore: ${rollbackError?.message ?? String(rollbackError)}`);
+            }
+            try {
+                restoreReceipt(name, oldReceipt?.raw ?? null);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(`receipt restore: ${rollbackError?.message ?? String(rollbackError)}`);
+            }
+        }
+        try {
+            safeTemporaryRemove(staging);
+            safeTemporaryRemove(backup);
+        }
+        catch (rollbackError) {
+            rollbackErrors.push(`staging cleanup: ${rollbackError?.message ?? String(rollbackError)}`);
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(rollbackErrors.length ? `${detail}; rollback warning: ${rollbackErrors.join("; ")}` : detail);
+    }
+}
+export function uninstallPlugin(rawName) {
+    const name = safePluginId(rawName);
+    const destination = pluginRoot(name);
+    if (!existsSync(destination))
         return false;
-    unlinkPluginBins(readManifest(dest)); // remove any linked CLI commands first
-    rmSync(dest, { recursive: true, force: true });
+    const installed = readInstalled(destination, name);
+    const stored = readReceipt(name);
+    if (!stored) {
+        throw new Error(`refusing to uninstall legacy plugin '${name}' without an ownership receipt; ` +
+            "reinstall the same source with this Hara version, then remove it");
+    }
+    verifyReceipt(stored.receipt, destination, installed.verified);
+    for (const [binName, rel] of Object.entries(stored.receipt.bins))
+        preflightBinLink(destination, binName, rel);
+    const quarantine = join(pluginStorage(), `_remove-${process.pid}-${randomUUID()}`);
+    renameSync(destination, quarantine);
+    const moved = rootIdentity(quarantine);
+    if (moved.rootDev !== stored.receipt.rootDev || moved.rootIno !== stored.receipt.rootIno) {
+        renameSync(quarantine, destination);
+        throw new Error(`plugin '${name}' root identity changed during uninstall`);
+    }
+    try {
+        for (const [binName, rel] of Object.entries(stored.receipt.bins))
+            unlinkBinLink(destination, binName, rel);
+        removePrivateStateFile(stored.binding.path, stored.snapshot, stored.binding.directory);
+    }
+    catch (error) {
+        const rollbackErrors = [];
+        try {
+            if (existsSync(quarantine) && !existsSync(destination))
+                renameSync(quarantine, destination);
+            restoreBinLinks(destination, stored.receipt.bins);
+        }
+        catch (rollbackError) {
+            rollbackErrors.push(rollbackError?.message ?? String(rollbackError));
+        }
+        try {
+            restoreReceipt(name, stored.raw);
+        }
+        catch (rollbackError) {
+            rollbackErrors.push(rollbackError?.message ?? String(rollbackError));
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(rollbackErrors.length ? `${detail}; rollback warning: ${rollbackErrors.join("; ")}` : detail);
+    }
+    // The namespace, executable links, and receipt are already removed. A cleanup failure leaves only an
+    // inert unpredictable quarantine directory and must not reactivate unreceipted code.
+    try {
+        safeTemporaryRemove(quarantine);
+    }
+    catch {
+        // A later bounded maintenance pass may remove it after inspecting ownership.
+    }
     return true;
 }
-/** Panels applicable to a project cwd — a panel matches when any of its `detect` markers exists under
- *  the cwd. Pure over the given plugin list (testable); `panelsForProject` binds it to enabled plugins. */
+function safeMarkerExists(cwd, marker) {
+    try {
+        const rel = safePluginRelativePath(marker, "plugin panel detect marker");
+        const canonicalRoot = realpathSync.native(resolve(cwd));
+        let current = canonicalRoot;
+        for (const part of rel.split("/")) {
+            current = join(current, part);
+            const info = lstatSync(current);
+            if (info.isSymbolicLink())
+                return false;
+        }
+        const relToRoot = relative(canonicalRoot, realpathSync.native(current));
+        return !relToRoot.startsWith("..") && !isAbsolute(relToRoot);
+    }
+    catch {
+        return false;
+    }
+}
 export function matchPanels(plugins, cwd) {
     const out = [];
-    for (const pl of plugins) {
-        for (const panel of pl.manifest.panels ?? []) {
+    for (const plugin of plugins) {
+        for (const panel of plugin.manifest.panels ?? []) {
             if (!panel.detect?.length)
-                continue; // global-only panels stay off project surfaces
-            if (panel.detect.some((m) => existsSync(join(cwd, m))))
-                out.push({ plugin: pl.name, panel });
+                continue;
+            if (panel.detect.some((marker) => safeMarkerExists(cwd, marker)))
+                out.push({ plugin: plugin.name, panel });
         }
     }
     return out;
@@ -191,8 +528,8 @@ export function matchPanels(plugins, cwd) {
 export function panelsForProject(cwd) {
     return matchPanels(enabledPlugins(), cwd);
 }
-/** Persist a plugin's enabled flag in ~/.hara/config.json (`plugins.enabled[name]`). */
-export function setPluginEnabled(name, on) {
+export function setPluginEnabled(rawName, on) {
+    const name = safePluginId(rawName);
     updateRawConfig((config) => {
         const plugins = (config.plugins && typeof config.plugins === "object" ? config.plugins : {});
         plugins.enabled = { ...(plugins.enabled ?? {}), [name]: on };

package/dist/security/private-state.js

@@ -8,7 +8,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { FileReadLimitError, MAX_EDIT_READ_BYTES, decodeUtf8Strict, openVerifiedRegularFileNoFollow, verifyOpenedRegularFileSync, } from "../fs-read.js";
 import { optionalPosixOpenFlag } from "../fs-open-flags.js";
 import { sameOpenedFileIdentity } from "../fs-identity.js";
-const PRIVATE_TREES = new Set(["sessions", "checkpoints", "index", "gateway", "cron", "weixin", "tool-results"]);
+const PRIVATE_TREES = new Set(["sessions", "checkpoints", "index", "gateway", "cron", "weixin", "tool-results", "plugin-receipts"]);
 const tightenedHomes = new Set();
 const DEFAULT_MIGRATION_CAP = 50_000;
 function isMissing(error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.126.0",
+  "version": "0.126.1",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"