@nexrall/code-core 1.4.24 → 1.4.26

package/dist/plugins/index.d.ts

@@ -7,6 +7,26 @@ export interface PluginInfo {
     dir: string;
     scope: 'project' | 'global';
 }
+/**
+ * Where each single-file component may live, in priority order.
+ *
+ * Our own layout is checked first so a plugin shipping both is unambiguous, and
+ * so this stays additive: nothing that worked before changes behaviour.
+ *
+ * SECURITY: `hooks` and `mcp` here are code-execution surfaces. Every reader
+ * below and `inspectPluginDir` in installer.ts MUST resolve through this same
+ * table — if the loader reads a path the inspector does not check, a plugin can
+ * run commands that the install-time warning never mentioned. Adding a candidate
+ * without updating the inspector is exactly that bug, so the two are pinned
+ * together by a test.
+ */
+export declare const FILE_CANDIDATES: {
+    readonly manifest: readonly ["plugin.json", string];
+    readonly hooks: readonly ["hooks.json", string];
+    readonly mcp: readonly ["mcp.json", ".mcp.json"];
+};
+/** First existing candidate path for a component, or null. */
+export declare function resolvePluginFile(dir: string, kind: keyof typeof FILE_CANDIDATES): string | null;
 /** Discover installed plugins (project scope shadows global on name clash). */
 export declare function loadPlugins(workDir: string): PluginInfo[];
 /** Subdirectories of every installed plugin that hold `kind` assets (existing only). */

package/dist/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC7B;AAsCD,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAKzD;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,EAAE,CAMjG;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAetE;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,eAAe,GAAG,MAAM,GAAG,IAAI,CAQhG;AAwCD,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAKzD;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,EAAE,CAMjG;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAiBtE;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezE"}

package/dist/plugins/index.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.FILE_CANDIDATES = void 0;
+exports.resolvePluginFile = resolvePluginFile;
 exports.loadPlugins = loadPlugins;
 exports.pluginAssetDirs = pluginAssetDirs;
 exports.pluginHooks = pluginHooks;
@@ -40,9 +42,42 @@ exports.pluginMcpServers = pluginMcpServers;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/**
+ * Where each single-file component may live, in priority order.
+ *
+ * Our own layout is checked first so a plugin shipping both is unambiguous, and
+ * so this stays additive: nothing that worked before changes behaviour.
+ *
+ * SECURITY: `hooks` and `mcp` here are code-execution surfaces. Every reader
+ * below and `inspectPluginDir` in installer.ts MUST resolve through this same
+ * table — if the loader reads a path the inspector does not check, a plugin can
+ * run commands that the install-time warning never mentioned. Adding a candidate
+ * without updating the inspector is exactly that bug, so the two are pinned
+ * together by a test.
+ */
+exports.FILE_CANDIDATES = {
+    manifest: ['plugin.json', path.join('.claude-plugin', 'plugin.json')],
+    hooks: ['hooks.json', path.join('hooks', 'hooks.json')],
+    mcp: ['mcp.json', '.mcp.json'],
+};
+/** First existing candidate path for a component, or null. */
+function resolvePluginFile(dir, kind) {
+    for (const rel of exports.FILE_CANDIDATES[kind]) {
+        const full = path.join(dir, rel);
+        try {
+            if (fs.statSync(full).isFile())
+                return full;
+        }
+        catch { /* try the next candidate */ }
+    }
+    return null;
+}
 function readMeta(dir) {
+    const file = resolvePluginFile(dir, 'manifest');
+    if (!file)
+        return {};
     try {
-        const raw = fs.readFileSync(path.join(dir, 'plugin.json'), 'utf-8');
+        const raw = fs.readFileSync(file, 'utf-8');
         const j = JSON.parse(raw);
         return {
             name: typeof j.name === 'string' ? j.name : undefined,
@@ -104,8 +139,11 @@ function pluginAssetDirs(workDir, kind) {
 function pluginHooks(workDir) {
     const merged = {};
     for (const p of loadPlugins(workDir)) {
+        const file = resolvePluginFile(p.dir, 'hooks');
+        if (!file)
+            continue;
         try {
-            const raw = fs.readFileSync(path.join(p.dir, 'hooks.json'), 'utf-8');
+            const raw = fs.readFileSync(file, 'utf-8');
             const j = JSON.parse(raw);
             // Accept either { hooks: {...} } or the bare hooks object.
             const hooks = (j.hooks ?? j);
@@ -123,8 +161,11 @@ function pluginHooks(workDir) {
 function pluginMcpServers(workDir) {
     const merged = {};
     for (const p of loadPlugins(workDir)) {
+        const file = resolvePluginFile(p.dir, 'mcp');
+        if (!file)
+            continue;
         try {
-            const raw = fs.readFileSync(path.join(p.dir, 'mcp.json'), 'utf-8');
+            const raw = fs.readFileSync(file, 'utf-8');
             const j = JSON.parse(raw);
             const servers = (j.mcpServers ?? j);
             for (const [name, cfg] of Object.entries(servers)) {

package/dist/plugins/installer.d.ts

@@ -26,12 +26,29 @@ export interface InstallReceipt {
     ref?: string;
     subdir?: string;
     installedAt: string;
+    /**
+     * The exact commit these files came from.
+     *
+     * Without it an install was not reproducible and, worse, not auditable: the
+     * receipt recorded `"owner/repo"`, so nobody — including `nex plugin update` —
+     * could say WHICH code had been reviewed and approved. Recording the resolved
+     * SHA lets an update report `abc1234 → def5678` instead of silently swapping
+     * the contents of a plugin the user already trusted.
+     *
+     * Optional because resolution needs a network call that must never be the
+     * reason an install fails (see resolveCommitSha).
+     */
+    sha?: string;
 }
 export interface InstallResult {
     name: string;
     dir: string;
     scope: 'project' | 'global';
     inspection: PluginInspection;
+    /** Commit installed, when known. */
+    sha?: string;
+    /** For an update: the commit that was previously installed, when known. */
+    previousSha?: string;
 }
 export interface RegistryPlugin {
     name: string;
@@ -57,7 +74,17 @@ export declare function getRegistryPlugin(name: string): Promise<RegistryPlugin
 export declare function reportInstall(name: string): void;
 /** Parse a user-supplied plugin spec into a structured source. Throws on junk. */
 export declare function parsePluginSource(spec: string): PluginSource;
-/** What does this plugin contain? Callers must warn on hasHooks/hasMcp. */
+/**
+ * What does this plugin contain? Callers must warn on hasHooks/hasMcp.
+ *
+ * Resolves every single-file component through the SAME candidate table the
+ * loader uses (plugins/index.ts FILE_CANDIDATES). That shared lookup is a
+ * security requirement, not tidiness: this function produces the warning shown
+ * before install, so any path the loader would execute but the inspector does
+ * not check is a plugin that runs code the user was never told about. A Claude
+ * Code plugin shipping `.mcp.json` used to be exactly that — reported as
+ * containing no MCP servers.
+ */
 export declare function inspectPluginDir(dir: string): PluginInspection;
 export interface InstallOptions {
     /** 'global' (default) → ~/.nexrall/plugins; 'project' → <workDir>/.nexrall/plugins */
@@ -71,7 +98,18 @@ export interface InstallOptions {
      * Called after inspection, before finalising. Return false to abort.
      * Callers should surface hooks/MCP warnings here.
      */
-    confirm?: (inspection: PluginInspection, name: string) => Promise<boolean> | boolean;
+    confirm?: (inspection: PluginInspection, name: string, ctx?: InstallContext) => Promise<boolean> | boolean;
+    /** Internal: SHA previously installed, so an update can be described as a change. */
+    _previousSha?: string;
+}
+/** Extra facts about what is being installed, for the confirmation prompt. */
+export interface InstallContext {
+    /** Commit about to be installed, when it could be resolved. */
+    sha?: string;
+    /** Commit currently installed (updates only). */
+    previousSha?: string;
+    /** True when this replaces an existing install of the same name. */
+    isUpdate: boolean;
 }
 export declare function installPlugin(spec: string, opts?: InstallOptions): Promise<InstallResult>;
 export declare function readReceipt(pluginDir: string): InstallReceipt | null;

package/dist/plugins/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/plugins/installer.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAUD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ1F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CASpF;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGhD;AAID,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA+C5D;AAYD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiB9D;AAyDD,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACtF;AAQD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+EnG;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOpE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAYhH;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;CAAO,GACjG,OAAO,CAAC,aAAa,CAAC,CAexB"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/plugins/installer.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAUD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ1F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CASpF;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGhD;AAID,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA+C5D;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAoB9D;AAgFD,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC3G,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwGnG;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOpE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAYhH;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;CAAO,GACjG,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/plugins/installer.js

@@ -47,6 +47,8 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const client_1 = require("../api/client");
+const index_1 = require("./index");
+const sources_1 = require("./sources");
 const RECEIPT_FILE = '_install.json';
 /** Search the registry (empty query = list all, official first). */
 async function searchRegistry(query, limit = 50) {
@@ -134,23 +136,36 @@ function listMd(dir) {
         return [];
     }
 }
-/** What does this plugin contain? Callers must warn on hasHooks/hasMcp. */
+/**
+ * What does this plugin contain? Callers must warn on hasHooks/hasMcp.
+ *
+ * Resolves every single-file component through the SAME candidate table the
+ * loader uses (plugins/index.ts FILE_CANDIDATES). That shared lookup is a
+ * security requirement, not tidiness: this function produces the warning shown
+ * before install, so any path the loader would execute but the inspector does
+ * not check is a plugin that runs code the user was never told about. A Claude
+ * Code plugin shipping `.mcp.json` used to be exactly that — reported as
+ * containing no MCP servers.
+ */
 function inspectPluginDir(dir) {
     let meta = {};
-    try {
-        const j = JSON.parse(fs.readFileSync(path.join(dir, 'plugin.json'), 'utf-8'));
-        meta = {
-            name: typeof j.name === 'string' ? j.name : undefined,
-            version: typeof j.version === 'string' ? j.version : undefined,
-            description: typeof j.description === 'string' ? j.description : undefined,
-        };
+    const manifest = (0, index_1.resolvePluginFile)(dir, 'manifest');
+    if (manifest) {
+        try {
+            const j = JSON.parse(fs.readFileSync(manifest, 'utf-8'));
+            meta = {
+                name: typeof j.name === 'string' ? j.name : undefined,
+                version: typeof j.version === 'string' ? j.version : undefined,
+                description: typeof j.description === 'string' ? j.description : undefined,
+            };
+        }
+        catch { /* optional */ }
     }
-    catch { /* optional */ }
     return {
         commands: listMd(path.join(dir, 'commands')),
         agents: listMd(path.join(dir, 'agents')),
-        hasHooks: fs.existsSync(path.join(dir, 'hooks.json')),
-        hasMcp: fs.existsSync(path.join(dir, 'mcp.json')),
+        hasHooks: (0, index_1.resolvePluginFile)(dir, 'hooks') !== null,
+        hasMcp: (0, index_1.resolvePluginFile)(dir, 'mcp') !== null,
         meta,
     };
 }
@@ -160,6 +175,30 @@ function looksLikePlugin(dir) {
     return i.commands.length > 0 || i.agents.length > 0 || i.hasHooks || i.hasMcp || i.meta.name !== undefined;
 }
 // ─── Download & extract ───────────────────────────────────────────────────────
+/**
+ * Resolve a ref (branch/tag/HEAD/sha) to the commit SHA it points at right now.
+ *
+ * Deliberately best-effort: returns null on any failure instead of throwing.
+ * Pinning is an audit and reproducibility feature, and making it mandatory would
+ * mean a GitHub API hiccup or an exhausted unauthenticated rate limit could block
+ * an install that would otherwise succeed — trading a real capability for a
+ * bookkeeping nicety. An unknown SHA is recorded as absent and said out loud,
+ * rather than guessed.
+ */
+async function resolveCommitSha(repo, ref) {
+    try {
+        const res = await fetch(`https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref || 'HEAD')}`, {
+            headers: { Accept: 'application/vnd.github.sha', 'User-Agent': 'nexrall-code' },
+        });
+        if (!res.ok)
+            return null;
+        const sha = (await res.text()).trim();
+        return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
 async function downloadTarball(repo, ref, destFile) {
     const r = ref || 'HEAD';
     const url = `https://codeload.github.com/${repo}/tar.gz/${encodeURIComponent(r)}`;
@@ -219,6 +258,16 @@ function pluginsRoot(scope, workDir) {
 async function installPlugin(spec, opts = {}) {
     const source = parsePluginSource(spec);
     const scope = opts.scope ?? 'global';
+    // Enterprise policy, enforced HERE rather than in each command.
+    //
+    // Every install path in every client funnels through this function, so this is
+    // the one place a restriction cannot be routed around by a caller that forgot
+    // to check — the CLI, the VS Code UI and `update` all inherit it for free. A
+    // check in the CLI command alone would have been decorative.
+    const patterns = (0, sources_1.allowedSourcePatterns)();
+    if (patterns && source.kind === 'github' && !(0, sources_1.isSourceAllowed)(source.raw, patterns)) {
+        throw new Error(`Blocked by your organisation's policy: plugins may only be installed from ${patterns.join(', ')}.`);
+    }
     const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'nexrall-plugin-'));
     try {
         // 1. Materialise the source into tmp
@@ -234,6 +283,12 @@ async function installPlugin(spec, opts = {}) {
             await downloadTarball(source.repo, source.ref, tarFile);
             repoRoot = extractTarball(tarFile, path.join(tmpBase, 'x'));
         }
+        // Resolve the commit alongside the download. Note this is a SEPARATE request
+        // from the tarball, so in principle the branch could move between the two;
+        // the SHA is therefore an audit record of what we asked for, not a checksum
+        // of the bytes on disk. Saying that plainly is better than implying a
+        // guarantee we do not verify.
+        const sha = source.kind === 'github' ? await resolveCommitSha(source.repo, source.ref) : null;
         // 2. Locate the plugin root
         let pluginRoot = source.subdir ? path.join(repoRoot, source.subdir) : repoRoot;
         pluginRoot = path.resolve(pluginRoot);
@@ -264,7 +319,11 @@ async function installPlugin(spec, opts = {}) {
             throw new Error(`Invalid plugin name "${name}".`);
         // 4. Caller confirmation (safety gate — hooks/MCP warnings live here)
         if (opts.confirm) {
-            const ok = await opts.confirm(inspection, name);
+            const ok = await opts.confirm(inspection, name, {
+                sha: sha ?? undefined,
+                previousSha: opts._previousSha,
+                isUpdate: Boolean(opts._previousSha) || Boolean(opts.force),
+            });
             if (!ok)
                 throw new Error('Installation cancelled.');
         }
@@ -284,9 +343,10 @@ async function installPlugin(spec, opts = {}) {
             ref: source.ref,
             subdir: source.subdir,
             installedAt: new Date().toISOString(),
+            ...(sha ? { sha } : {}),
         };
         fs.writeFileSync(path.join(dest, RECEIPT_FILE), JSON.stringify(receipt, null, 2));
-        return { name, dir: dest, scope, inspection };
+        return { name, dir: dest, scope, inspection, sha: sha ?? undefined, previousSha: opts._previousSha };
     }
     finally {
         fs.rmSync(tmpBase, { recursive: true, force: true });
@@ -328,7 +388,18 @@ async function updatePlugin(name, opts = {}) {
         if (receipt.kind === 'local') {
             throw new Error(`Plugin "${name}" was installed from a local path — re-run 'nex plugin install ${receipt.source} --force'.`);
         }
-        return installPlugin(receipt.source, { scope: s, workDir: opts.workDir, name, force: true, confirm: opts.confirm });
+        // Re-installs from the ORIGINAL spec, so an unpinned source still tracks its
+        // branch — that is what "update" means. The recorded SHA is carried through so
+        // the confirmation can show what is actually changing rather than presenting a
+        // possibly wholesale content swap as a routine refresh.
+        return installPlugin(receipt.source, {
+            scope: s,
+            workDir: opts.workDir,
+            name,
+            force: true,
+            confirm: opts.confirm,
+            _previousSha: receipt.sha,
+        });
     }
     throw new Error(`Plugin "${name}" is not installed.`);
 }

package/dist/plugins/sources.d.ts

@@ -0,0 +1,49 @@
+/** Where a declared source came from, which decides how much it is trusted. */
+export type SourceTier = 'managed' | 'user' | 'project';
+export interface DeclaredSource {
+    /** Short alias used as `nex plugin install <alias>`. */
+    name: string;
+    /** A spec parsePluginSource understands: owner/repo, owner/repo#ref, owner/repo/subdir. */
+    spec: string;
+    tier: SourceTier;
+    /** Absolute path of the settings file that declared it (for display/debugging). */
+    file: string;
+}
+/**
+ * All declared sources, most-trusted tier first.
+ *
+ * `includeProject` is false by default. Project-tier entries come from the
+ * repository, so a caller must consciously opt in AFTER workspace trust has been
+ * established — making the safe path the default one and the risky path an
+ * explicit argument.
+ */
+export declare function loadDeclaredSources(workDir: string, opts?: {
+    includeProject?: boolean;
+}): DeclaredSource[];
+/**
+ * Enterprise restriction: which sources may be installed from at all.
+ *
+ * Read ONLY from the managed policy file — a repository or a user cannot widen
+ * their own allowlist, which is the entire point of a managed setting. Absent
+ * (the normal case) means unrestricted.
+ */
+export declare function allowedSourcePatterns(): string[] | null;
+/**
+ * Is this spec permitted by enterprise policy?
+ *
+ * Patterns match `owner/repo` with a trailing `*` wildcard, e.g. `acme/*`. The
+ * comparison strips any `#ref` and subdirectory so a policy cannot be defeated
+ * by appending to the spec.
+ */
+export declare function isSourceAllowed(spec: string, patterns?: string[] | null): boolean;
+/** Resolve an alias to its declared spec, or null when it is not a known alias. */
+export declare function resolveSourceAlias(alias: string, workDir: string, opts?: {
+    includeProject?: boolean;
+}): DeclaredSource | null;
+/** Add or update a source in a settings file, creating it when absent. */
+export declare function writeDeclaredSource(file: string, name: string, spec: string): void;
+/** Remove a source from a settings file. Returns false when it was not there. */
+export declare function removeDeclaredSource(file: string, name: string): boolean;
+/** The settings file a given scope writes to. */
+export declare function sourcesFileFor(scope: 'user' | 'project', workDir: string): string;
+//# sourceMappingURL=sources.d.ts.map

package/dist/plugins/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../../src/plugins/sources.ts"],"names":[],"mappings":"AA0CA,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AA0DD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,cAAc,EAAE,CASlB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAMvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,EAAE,GAAG,IAA8B,GAAG,OAAO,CAU1G;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,cAAc,GAAG,IAAI,CAGvB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,IAAI,CAWN;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQxE;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAIjF"}

package/dist/plugins/sources.js

@@ -0,0 +1,197 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDeclaredSources = loadDeclaredSources;
+exports.allowedSourcePatterns = allowedSourcePatterns;
+exports.isSourceAllowed = isSourceAllowed;
+exports.resolveSourceAlias = resolveSourceAlias;
+exports.writeDeclaredSource = writeDeclaredSource;
+exports.removeDeclaredSource = removeDeclaredSource;
+exports.sourcesFileFor = sourcesFileFor;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+function managedSettingsPath() {
+    if (process.platform === 'darwin')
+        return '/Library/Application Support/Nexrall/managed-settings.json';
+    if (process.platform === 'win32')
+        return path.join(process.env.PROGRAMDATA ?? 'C:\\ProgramData', 'Nexrall', 'managed-settings.json');
+    return '/etc/nexrall/managed-settings.json';
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Alias syntax. Kept strict so an alias can never be confused with a path or a ref. */
+const ALIAS_RE = /^[a-z0-9][\w.-]{0,63}$/i;
+/**
+ * A source entry may be a bare string or `{ source: "..." }`.
+ *
+ * The object form exists only to match what people already write in Claude Code
+ * settings, so a team migrating does not have to rewrite their config to find
+ * out whether we accept it.
+ */
+function readSpec(value) {
+    if (typeof value === 'string')
+        return value.trim() || null;
+    if (value && typeof value === 'object') {
+        const v = value;
+        const inner = v.source ?? v.repo ?? v.url;
+        if (typeof inner === 'string')
+            return inner.trim() || null;
+        // Claude Code nests one deeper: { source: { source: "github", repo: "o/r" } }
+        if (inner && typeof inner === 'object') {
+            const deep = inner.repo ?? inner.url;
+            if (typeof deep === 'string')
+                return deep.trim() || null;
+        }
+    }
+    return null;
+}
+function collect(file, tier, into) {
+    const obj = readJson(file);
+    const raw = obj?.pluginSources;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return;
+    for (const [name, value] of Object.entries(raw)) {
+        if (!ALIAS_RE.test(name))
+            continue;
+        const spec = readSpec(value);
+        if (!spec)
+            continue;
+        // First tier to declare a name wins, and tiers are visited most-trusted
+        // first. So a repository cannot redefine an alias the user or an
+        // administrator already bound — otherwise a project file could point a
+        // familiar, trusted-looking name at somewhere else entirely.
+        if (into.has(name))
+            continue;
+        into.set(name, { name, spec, tier, file });
+    }
+}
+/**
+ * All declared sources, most-trusted tier first.
+ *
+ * `includeProject` is false by default. Project-tier entries come from the
+ * repository, so a caller must consciously opt in AFTER workspace trust has been
+ * established — making the safe path the default one and the risky path an
+ * explicit argument.
+ */
+function loadDeclaredSources(workDir, opts = {}) {
+    const out = new Map();
+    collect(managedSettingsPath(), 'managed', out);
+    collect(path.join(os.homedir(), '.nexrall', 'settings.json'), 'user', out);
+    if (opts.includeProject) {
+        collect(path.join(workDir, '.nexrall', 'settings.json'), 'project', out);
+        collect(path.join(workDir, '.nexrall', 'settings.local.json'), 'project', out);
+    }
+    return [...out.values()];
+}
+/**
+ * Enterprise restriction: which sources may be installed from at all.
+ *
+ * Read ONLY from the managed policy file — a repository or a user cannot widen
+ * their own allowlist, which is the entire point of a managed setting. Absent
+ * (the normal case) means unrestricted.
+ */
+function allowedSourcePatterns() {
+    const obj = readJson(managedSettingsPath());
+    const v = obj?.allowedPluginSources;
+    if (!Array.isArray(v))
+        return null;
+    const pats = v.filter((x) => typeof x === 'string' && x.trim().length > 0);
+    return pats.length ? pats : null;
+}
+/**
+ * Is this spec permitted by enterprise policy?
+ *
+ * Patterns match `owner/repo` with a trailing `*` wildcard, e.g. `acme/*`. The
+ * comparison strips any `#ref` and subdirectory so a policy cannot be defeated
+ * by appending to the spec.
+ */
+function isSourceAllowed(spec, patterns = allowedSourcePatterns()) {
+    if (!patterns)
+        return true;
+    const cleaned = spec.trim().replace(/^https?:\/\/(?:www\.)?github\.com\//i, '').replace(/\.git$/, '');
+    const base = cleaned.split('#')[0].split('/').slice(0, 2).join('/').toLowerCase();
+    return patterns.some((p) => {
+        const pat = p.trim().toLowerCase().replace(/^https?:\/\/(?:www\.)?github\.com\//i, '');
+        if (pat === '*')
+            return true;
+        if (pat.endsWith('/*'))
+            return base.startsWith(pat.slice(0, -1));
+        return base === pat.split('#')[0].split('/').slice(0, 2).join('/');
+    });
+}
+/** Resolve an alias to its declared spec, or null when it is not a known alias. */
+function resolveSourceAlias(alias, workDir, opts = {}) {
+    const want = alias.trim().toLowerCase();
+    return loadDeclaredSources(workDir, opts).find((s) => s.name.toLowerCase() === want) ?? null;
+}
+/** Add or update a source in a settings file, creating it when absent. */
+function writeDeclaredSource(file, name, spec) {
+    if (!ALIAS_RE.test(name)) {
+        throw new Error(`Invalid source name "${name}". Use letters, numbers, dot, dash or underscore.`);
+    }
+    const obj = readJson(file) ?? {};
+    const existing = (obj.pluginSources && typeof obj.pluginSources === 'object' && !Array.isArray(obj.pluginSources))
+        ? obj.pluginSources
+        : {};
+    obj.pluginSources = { ...existing, [name]: spec };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+}
+/** Remove a source from a settings file. Returns false when it was not there. */
+function removeDeclaredSource(file, name) {
+    const obj = readJson(file);
+    if (!obj?.pluginSources || typeof obj.pluginSources !== 'object')
+        return false;
+    const sources = obj.pluginSources;
+    if (!(name in sources))
+        return false;
+    delete sources[name];
+    fs.writeFileSync(file, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+    return true;
+}
+/** The settings file a given scope writes to. */
+function sourcesFileFor(scope, workDir) {
+    return scope === 'user'
+        ? path.join(os.homedir(), '.nexrall', 'settings.json')
+        : path.join(workDir, '.nexrall', 'settings.json');
+}
+//# sourceMappingURL=sources.js.map

package/dist/types.d.ts

@@ -321,6 +321,15 @@ export interface AgentLoopOptions {
     env?: EnvContext;
     editorContext?: EditorContext | null;
     nexrallMd?: string;
+    /**
+     * Session-wide read-only lock ("plan mode"). When true the loop refuses every
+     * mutating tool BEFORE requestPermission is consulted, so no user answer at a
+     * permission prompt can unlock it — only leaving plan mode can.
+     *
+     * Inherited by every sub-agent: a lock the main agent can delegate its way
+     * out of is not a lock.
+     */
+    planMode?: boolean;
     /** Client type — controls which tools Claude is told about. */
     clientType?: string;
     /**