@nexrall/code-core 1.4.23 → 1.4.25

package/dist/plugins/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/plugins/installer.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAUD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ1F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CASpF;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGhD;AAID,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA+C5D;AAYD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiB9D;AAyDD,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACtF;AAQD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+EnG;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOpE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAYhH;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;CAAO,GACjG,OAAO,CAAC,aAAa,CAAC,CAexB"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/plugins/installer.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAUD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ1F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CASpF;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGhD;AAID,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA+C5D;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAoB9D;AAgFD,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC3G,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwGnG;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOpE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAYhH;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;CAAO,GACjG,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/plugins/installer.js

@@ -47,6 +47,8 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const client_1 = require("../api/client");
+const index_1 = require("./index");
+const sources_1 = require("./sources");
 const RECEIPT_FILE = '_install.json';
 /** Search the registry (empty query = list all, official first). */
 async function searchRegistry(query, limit = 50) {
@@ -134,23 +136,36 @@ function listMd(dir) {
         return [];
     }
 }
-/** What does this plugin contain? Callers must warn on hasHooks/hasMcp. */
+/**
+ * What does this plugin contain? Callers must warn on hasHooks/hasMcp.
+ *
+ * Resolves every single-file component through the SAME candidate table the
+ * loader uses (plugins/index.ts FILE_CANDIDATES). That shared lookup is a
+ * security requirement, not tidiness: this function produces the warning shown
+ * before install, so any path the loader would execute but the inspector does
+ * not check is a plugin that runs code the user was never told about. A Claude
+ * Code plugin shipping `.mcp.json` used to be exactly that — reported as
+ * containing no MCP servers.
+ */
 function inspectPluginDir(dir) {
     let meta = {};
-    try {
-        const j = JSON.parse(fs.readFileSync(path.join(dir, 'plugin.json'), 'utf-8'));
-        meta = {
-            name: typeof j.name === 'string' ? j.name : undefined,
-            version: typeof j.version === 'string' ? j.version : undefined,
-            description: typeof j.description === 'string' ? j.description : undefined,
-        };
+    const manifest = (0, index_1.resolvePluginFile)(dir, 'manifest');
+    if (manifest) {
+        try {
+            const j = JSON.parse(fs.readFileSync(manifest, 'utf-8'));
+            meta = {
+                name: typeof j.name === 'string' ? j.name : undefined,
+                version: typeof j.version === 'string' ? j.version : undefined,
+                description: typeof j.description === 'string' ? j.description : undefined,
+            };
+        }
+        catch { /* optional */ }
     }
-    catch { /* optional */ }
     return {
         commands: listMd(path.join(dir, 'commands')),
         agents: listMd(path.join(dir, 'agents')),
-        hasHooks: fs.existsSync(path.join(dir, 'hooks.json')),
-        hasMcp: fs.existsSync(path.join(dir, 'mcp.json')),
+        hasHooks: (0, index_1.resolvePluginFile)(dir, 'hooks') !== null,
+        hasMcp: (0, index_1.resolvePluginFile)(dir, 'mcp') !== null,
         meta,
     };
 }
@@ -160,6 +175,30 @@ function looksLikePlugin(dir) {
     return i.commands.length > 0 || i.agents.length > 0 || i.hasHooks || i.hasMcp || i.meta.name !== undefined;
 }
 // ─── Download & extract ───────────────────────────────────────────────────────
+/**
+ * Resolve a ref (branch/tag/HEAD/sha) to the commit SHA it points at right now.
+ *
+ * Deliberately best-effort: returns null on any failure instead of throwing.
+ * Pinning is an audit and reproducibility feature, and making it mandatory would
+ * mean a GitHub API hiccup or an exhausted unauthenticated rate limit could block
+ * an install that would otherwise succeed — trading a real capability for a
+ * bookkeeping nicety. An unknown SHA is recorded as absent and said out loud,
+ * rather than guessed.
+ */
+async function resolveCommitSha(repo, ref) {
+    try {
+        const res = await fetch(`https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref || 'HEAD')}`, {
+            headers: { Accept: 'application/vnd.github.sha', 'User-Agent': 'nexrall-code' },
+        });
+        if (!res.ok)
+            return null;
+        const sha = (await res.text()).trim();
+        return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
 async function downloadTarball(repo, ref, destFile) {
     const r = ref || 'HEAD';
     const url = `https://codeload.github.com/${repo}/tar.gz/${encodeURIComponent(r)}`;
@@ -219,6 +258,16 @@ function pluginsRoot(scope, workDir) {
 async function installPlugin(spec, opts = {}) {
     const source = parsePluginSource(spec);
     const scope = opts.scope ?? 'global';
+    // Enterprise policy, enforced HERE rather than in each command.
+    //
+    // Every install path in every client funnels through this function, so this is
+    // the one place a restriction cannot be routed around by a caller that forgot
+    // to check — the CLI, the VS Code UI and `update` all inherit it for free. A
+    // check in the CLI command alone would have been decorative.
+    const patterns = (0, sources_1.allowedSourcePatterns)();
+    if (patterns && source.kind === 'github' && !(0, sources_1.isSourceAllowed)(source.raw, patterns)) {
+        throw new Error(`Blocked by your organisation's policy: plugins may only be installed from ${patterns.join(', ')}.`);
+    }
     const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'nexrall-plugin-'));
     try {
         // 1. Materialise the source into tmp
@@ -234,6 +283,12 @@ async function installPlugin(spec, opts = {}) {
             await downloadTarball(source.repo, source.ref, tarFile);
             repoRoot = extractTarball(tarFile, path.join(tmpBase, 'x'));
         }
+        // Resolve the commit alongside the download. Note this is a SEPARATE request
+        // from the tarball, so in principle the branch could move between the two;
+        // the SHA is therefore an audit record of what we asked for, not a checksum
+        // of the bytes on disk. Saying that plainly is better than implying a
+        // guarantee we do not verify.
+        const sha = source.kind === 'github' ? await resolveCommitSha(source.repo, source.ref) : null;
         // 2. Locate the plugin root
         let pluginRoot = source.subdir ? path.join(repoRoot, source.subdir) : repoRoot;
         pluginRoot = path.resolve(pluginRoot);
@@ -264,7 +319,11 @@ async function installPlugin(spec, opts = {}) {
             throw new Error(`Invalid plugin name "${name}".`);
         // 4. Caller confirmation (safety gate — hooks/MCP warnings live here)
         if (opts.confirm) {
-            const ok = await opts.confirm(inspection, name);
+            const ok = await opts.confirm(inspection, name, {
+                sha: sha ?? undefined,
+                previousSha: opts._previousSha,
+                isUpdate: Boolean(opts._previousSha) || Boolean(opts.force),
+            });
             if (!ok)
                 throw new Error('Installation cancelled.');
         }
@@ -284,9 +343,10 @@ async function installPlugin(spec, opts = {}) {
             ref: source.ref,
             subdir: source.subdir,
             installedAt: new Date().toISOString(),
+            ...(sha ? { sha } : {}),
         };
         fs.writeFileSync(path.join(dest, RECEIPT_FILE), JSON.stringify(receipt, null, 2));
-        return { name, dir: dest, scope, inspection };
+        return { name, dir: dest, scope, inspection, sha: sha ?? undefined, previousSha: opts._previousSha };
     }
     finally {
         fs.rmSync(tmpBase, { recursive: true, force: true });
@@ -328,7 +388,18 @@ async function updatePlugin(name, opts = {}) {
         if (receipt.kind === 'local') {
             throw new Error(`Plugin "${name}" was installed from a local path — re-run 'nex plugin install ${receipt.source} --force'.`);
         }
-        return installPlugin(receipt.source, { scope: s, workDir: opts.workDir, name, force: true, confirm: opts.confirm });
+        // Re-installs from the ORIGINAL spec, so an unpinned source still tracks its
+        // branch — that is what "update" means. The recorded SHA is carried through so
+        // the confirmation can show what is actually changing rather than presenting a
+        // possibly wholesale content swap as a routine refresh.
+        return installPlugin(receipt.source, {
+            scope: s,
+            workDir: opts.workDir,
+            name,
+            force: true,
+            confirm: opts.confirm,
+            _previousSha: receipt.sha,
+        });
     }
     throw new Error(`Plugin "${name}" is not installed.`);
 }

package/dist/plugins/sources.d.ts

@@ -0,0 +1,49 @@
+/** Where a declared source came from, which decides how much it is trusted. */
+export type SourceTier = 'managed' | 'user' | 'project';
+export interface DeclaredSource {
+    /** Short alias used as `nex plugin install <alias>`. */
+    name: string;
+    /** A spec parsePluginSource understands: owner/repo, owner/repo#ref, owner/repo/subdir. */
+    spec: string;
+    tier: SourceTier;
+    /** Absolute path of the settings file that declared it (for display/debugging). */
+    file: string;
+}
+/**
+ * All declared sources, most-trusted tier first.
+ *
+ * `includeProject` is false by default. Project-tier entries come from the
+ * repository, so a caller must consciously opt in AFTER workspace trust has been
+ * established — making the safe path the default one and the risky path an
+ * explicit argument.
+ */
+export declare function loadDeclaredSources(workDir: string, opts?: {
+    includeProject?: boolean;
+}): DeclaredSource[];
+/**
+ * Enterprise restriction: which sources may be installed from at all.
+ *
+ * Read ONLY from the managed policy file — a repository or a user cannot widen
+ * their own allowlist, which is the entire point of a managed setting. Absent
+ * (the normal case) means unrestricted.
+ */
+export declare function allowedSourcePatterns(): string[] | null;
+/**
+ * Is this spec permitted by enterprise policy?
+ *
+ * Patterns match `owner/repo` with a trailing `*` wildcard, e.g. `acme/*`. The
+ * comparison strips any `#ref` and subdirectory so a policy cannot be defeated
+ * by appending to the spec.
+ */
+export declare function isSourceAllowed(spec: string, patterns?: string[] | null): boolean;
+/** Resolve an alias to its declared spec, or null when it is not a known alias. */
+export declare function resolveSourceAlias(alias: string, workDir: string, opts?: {
+    includeProject?: boolean;
+}): DeclaredSource | null;
+/** Add or update a source in a settings file, creating it when absent. */
+export declare function writeDeclaredSource(file: string, name: string, spec: string): void;
+/** Remove a source from a settings file. Returns false when it was not there. */
+export declare function removeDeclaredSource(file: string, name: string): boolean;
+/** The settings file a given scope writes to. */
+export declare function sourcesFileFor(scope: 'user' | 'project', workDir: string): string;
+//# sourceMappingURL=sources.d.ts.map

package/dist/plugins/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../../src/plugins/sources.ts"],"names":[],"mappings":"AA0CA,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AA0DD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,cAAc,EAAE,CASlB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAMvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,EAAE,GAAG,IAA8B,GAAG,OAAO,CAU1G;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,cAAc,GAAG,IAAI,CAGvB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,IAAI,CAWN;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQxE;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAIjF"}

package/dist/plugins/sources.js

@@ -0,0 +1,197 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDeclaredSources = loadDeclaredSources;
+exports.allowedSourcePatterns = allowedSourcePatterns;
+exports.isSourceAllowed = isSourceAllowed;
+exports.resolveSourceAlias = resolveSourceAlias;
+exports.writeDeclaredSource = writeDeclaredSource;
+exports.removeDeclaredSource = removeDeclaredSource;
+exports.sourcesFileFor = sourcesFileFor;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+function managedSettingsPath() {
+    if (process.platform === 'darwin')
+        return '/Library/Application Support/Nexrall/managed-settings.json';
+    if (process.platform === 'win32')
+        return path.join(process.env.PROGRAMDATA ?? 'C:\\ProgramData', 'Nexrall', 'managed-settings.json');
+    return '/etc/nexrall/managed-settings.json';
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Alias syntax. Kept strict so an alias can never be confused with a path or a ref. */
+const ALIAS_RE = /^[a-z0-9][\w.-]{0,63}$/i;
+/**
+ * A source entry may be a bare string or `{ source: "..." }`.
+ *
+ * The object form exists only to match what people already write in Claude Code
+ * settings, so a team migrating does not have to rewrite their config to find
+ * out whether we accept it.
+ */
+function readSpec(value) {
+    if (typeof value === 'string')
+        return value.trim() || null;
+    if (value && typeof value === 'object') {
+        const v = value;
+        const inner = v.source ?? v.repo ?? v.url;
+        if (typeof inner === 'string')
+            return inner.trim() || null;
+        // Claude Code nests one deeper: { source: { source: "github", repo: "o/r" } }
+        if (inner && typeof inner === 'object') {
+            const deep = inner.repo ?? inner.url;
+            if (typeof deep === 'string')
+                return deep.trim() || null;
+        }
+    }
+    return null;
+}
+function collect(file, tier, into) {
+    const obj = readJson(file);
+    const raw = obj?.pluginSources;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return;
+    for (const [name, value] of Object.entries(raw)) {
+        if (!ALIAS_RE.test(name))
+            continue;
+        const spec = readSpec(value);
+        if (!spec)
+            continue;
+        // First tier to declare a name wins, and tiers are visited most-trusted
+        // first. So a repository cannot redefine an alias the user or an
+        // administrator already bound — otherwise a project file could point a
+        // familiar, trusted-looking name at somewhere else entirely.
+        if (into.has(name))
+            continue;
+        into.set(name, { name, spec, tier, file });
+    }
+}
+/**
+ * All declared sources, most-trusted tier first.
+ *
+ * `includeProject` is false by default. Project-tier entries come from the
+ * repository, so a caller must consciously opt in AFTER workspace trust has been
+ * established — making the safe path the default one and the risky path an
+ * explicit argument.
+ */
+function loadDeclaredSources(workDir, opts = {}) {
+    const out = new Map();
+    collect(managedSettingsPath(), 'managed', out);
+    collect(path.join(os.homedir(), '.nexrall', 'settings.json'), 'user', out);
+    if (opts.includeProject) {
+        collect(path.join(workDir, '.nexrall', 'settings.json'), 'project', out);
+        collect(path.join(workDir, '.nexrall', 'settings.local.json'), 'project', out);
+    }
+    return [...out.values()];
+}
+/**
+ * Enterprise restriction: which sources may be installed from at all.
+ *
+ * Read ONLY from the managed policy file — a repository or a user cannot widen
+ * their own allowlist, which is the entire point of a managed setting. Absent
+ * (the normal case) means unrestricted.
+ */
+function allowedSourcePatterns() {
+    const obj = readJson(managedSettingsPath());
+    const v = obj?.allowedPluginSources;
+    if (!Array.isArray(v))
+        return null;
+    const pats = v.filter((x) => typeof x === 'string' && x.trim().length > 0);
+    return pats.length ? pats : null;
+}
+/**
+ * Is this spec permitted by enterprise policy?
+ *
+ * Patterns match `owner/repo` with a trailing `*` wildcard, e.g. `acme/*`. The
+ * comparison strips any `#ref` and subdirectory so a policy cannot be defeated
+ * by appending to the spec.
+ */
+function isSourceAllowed(spec, patterns = allowedSourcePatterns()) {
+    if (!patterns)
+        return true;
+    const cleaned = spec.trim().replace(/^https?:\/\/(?:www\.)?github\.com\//i, '').replace(/\.git$/, '');
+    const base = cleaned.split('#')[0].split('/').slice(0, 2).join('/').toLowerCase();
+    return patterns.some((p) => {
+        const pat = p.trim().toLowerCase().replace(/^https?:\/\/(?:www\.)?github\.com\//i, '');
+        if (pat === '*')
+            return true;
+        if (pat.endsWith('/*'))
+            return base.startsWith(pat.slice(0, -1));
+        return base === pat.split('#')[0].split('/').slice(0, 2).join('/');
+    });
+}
+/** Resolve an alias to its declared spec, or null when it is not a known alias. */
+function resolveSourceAlias(alias, workDir, opts = {}) {
+    const want = alias.trim().toLowerCase();
+    return loadDeclaredSources(workDir, opts).find((s) => s.name.toLowerCase() === want) ?? null;
+}
+/** Add or update a source in a settings file, creating it when absent. */
+function writeDeclaredSource(file, name, spec) {
+    if (!ALIAS_RE.test(name)) {
+        throw new Error(`Invalid source name "${name}". Use letters, numbers, dot, dash or underscore.`);
+    }
+    const obj = readJson(file) ?? {};
+    const existing = (obj.pluginSources && typeof obj.pluginSources === 'object' && !Array.isArray(obj.pluginSources))
+        ? obj.pluginSources
+        : {};
+    obj.pluginSources = { ...existing, [name]: spec };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+}
+/** Remove a source from a settings file. Returns false when it was not there. */
+function removeDeclaredSource(file, name) {
+    const obj = readJson(file);
+    if (!obj?.pluginSources || typeof obj.pluginSources !== 'object')
+        return false;
+    const sources = obj.pluginSources;
+    if (!(name in sources))
+        return false;
+    delete sources[name];
+    fs.writeFileSync(file, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+    return true;
+}
+/** The settings file a given scope writes to. */
+function sourcesFileFor(scope, workDir) {
+    return scope === 'user'
+        ? path.join(os.homedir(), '.nexrall', 'settings.json')
+        : path.join(workDir, '.nexrall', 'settings.json');
+}
+//# sourceMappingURL=sources.js.map

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA4sEtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAiuEtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/tools/executor.js

@@ -44,6 +44,7 @@ const child_process_1 = require("child_process");
 const sandbox_1 = require("./sandbox");
 const auth_1 = require("../auth");
 const editCompleteness_1 = require("../agent/editCompleteness");
+const securityLint_1 = require("../agent/securityLint");
 const memory_1 = require("../agent/memory");
 const skills_1 = require("../agent/skills");
 const testIntegrity_1 = require("../agent/testIntegrity");
@@ -413,8 +414,16 @@ async function writeFile(input, workDir) {
         atomicWrite(resolved, content, existingMode);
         const bytes = Buffer.byteLength(content, 'utf-8');
         const lines = content.split('\n').length;
+        // Inline security review of what was just written.
+        //
+        // Six gates already run automatically on every write (elision, cross-file
+        // breakage, test integrity, claim evidence, flaky tests, destructive commands)
+        // and none of them was about security — so an agent that writes production code
+        // could commit a hardcoded credential or an injection sink with nothing to say
+        // otherwise. This warns; it never blocks (see securityLint.ts for why).
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         // Reward-hacking guard: a write_file that OVERWRITES an existing test file can
@@ -426,7 +435,7 @@ async function writeFile(input, workDir) {
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
             tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${tiMarker}` };
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
     }
     catch (err) {
         return { error: err.message };
@@ -1408,7 +1417,12 @@ async function editFile(input, workDir) {
         const linesBefore = origNorm.split('\n').length;
         const linesAfter = updated.split('\n').length;
         const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
-        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}` };
+        // Security-lint only the NEWLY INSERTED text, not the whole file. Scanning the
+        // full file would re-report pre-existing findings on every unrelated edit —
+        // noise that has nothing to do with the change being made, and the fastest way
+        // to teach everyone to ignore the warning.
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
+        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}${xfile}${sec}` };
     }
     catch (err) {
         return { error: err.message };
@@ -1747,6 +1761,9 @@ async function multiEdit(input, workDir) {
         let content = normalizeLF(rawFile);
         const originalNorm = content; // captured before edits mutate `content`
         const diffs = [];
+        // Inserted text from every edit, collected for the security lint below so it
+        // scans only what this call ADDED rather than the whole file.
+        const insertedText = [];
         for (let i = 0; i < edits.length; i++) {
             const edit = edits[i];
             // Normalize incoming old/new strings too
@@ -1766,6 +1783,7 @@ async function multiEdit(input, workDir) {
             // Pass the pre-replace content so line numbers reflect the file state at
             // the point this edit was applied (not the final state after all edits).
             diffs.push(buildDiff(filePath, oldStr, newStr, content));
+            insertedText.push(newStr);
             content = literalReplace(content, oldStr, newStr);
         }
         // Restore original line endings before writing (atomic temp+rename),
@@ -1773,9 +1791,11 @@ async function multiEdit(input, workDir) {
         const finalContent = wasCRLF ? content.replace(/\n/g, '\r\n') : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
         const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        // Lint only the newly inserted text (see the same reasoning in editFile).
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join('\n')));
         return {
             output: `Applied ${edits.length} edit(s) to ${resolved}:\n` +
-                diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n') + xfile,
+                diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n') + xfile + sec,
         };
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexrall/code-core",
-  "version": "1.4.23",
+  "version": "1.4.25",
   "description": "Core agent loop, tools, and extension primitives for Nexrall Code — embed an AI coding agent in any Node.js application.",
   "license": "MIT",
   "author": "Nexrall <support@nexrall.com> (https://nexrall.com)",