@orchid-labs/pluxx 0.1.20 → 0.1.22

package/dist/index.js

@@ -2203,7 +2203,7 @@ var require_jiti = __commonJS({
         }, pathe_M_eThtNZ_dirname = function(e3) {
           const t3 = pathe_M_eThtNZ_normalizeWindowsPath(e3).replace(/\/$/, "").split("/").slice(0, -1);
           return 1 === t3.length && ve.test(t3[0]) && (t3[0] += "/"), t3.join("/") || (isAbsolute(e3) ? "/" : ".");
-        }, basename2 = function(e3, t3) {
+        }, basename3 = function(e3, t3) {
           const i2 = pathe_M_eThtNZ_normalizeWindowsPath(e3).split("/");
           let s2 = "";
           for (let e4 = i2.length - 1; e4 >= 0; e4--) {
@@ -2911,7 +2911,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           if (!e3.opts.fsCache || !t3.filename) return i2();
           const s2 = ` /* v${zt}-${utils_hash(t3.source, 16)} */
 `;
-          let r2 = `${basename2(pathe_M_eThtNZ_dirname(t3.filename))}-${(function(e4) {
+          let r2 = `${basename3(pathe_M_eThtNZ_dirname(t3.filename))}-${(function(e4) {
             const t4 = e4.split(lt).pop();
             if (!t4) return;
             const i3 = t4.lastIndexOf(".");
@@ -2957,7 +2957,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           return i2.startsWith("#!") && (i2 = "// " + i2), i2;
         }
         function eval_evalModule(e3, t3, i2 = {}) {
-          const s2 = i2.id || (i2.filename ? basename2(i2.filename) : `_jitiEval.${i2.ext || (i2.async ? "mjs" : "js")}`), r2 = i2.filename || jitiResolve(e3, s2, { async: i2.async }), n2 = i2.ext || extname(r2), a2 = i2.cache || e3.parentCache || {}, o2 = /\.[cm]?tsx?$/.test(n2), h2 = ".mjs" === n2 || ".js" === n2 && "module" === (function(e4) {
+          const s2 = i2.id || (i2.filename ? basename3(i2.filename) : `_jitiEval.${i2.ext || (i2.async ? "mjs" : "js")}`), r2 = i2.filename || jitiResolve(e3, s2, { async: i2.async }), n2 = i2.ext || extname(r2), a2 = i2.cache || e3.parentCache || {}, o2 = /\.[cm]?tsx?$/.test(n2), h2 = ".mjs" === n2 || ".js" === n2 && "module" === (function(e4) {
             for (; e4 && "." !== e4 && "/" !== e4; ) {
               e4 = pathe_M_eThtNZ_join(e4, "..");
               try {
@@ -7841,6 +7841,20 @@ function definePlugin(config) {
   return PluginConfigSchema.parse(config);
 }
 
+// src/hook-events.ts
+var CODEX_SUPPORTED_HOOK_EVENTS = [
+  "SessionStart",
+  "SubagentStart",
+  "PreToolUse",
+  "PermissionRequest",
+  "PostToolUse",
+  "PreCompact",
+  "PostCompact",
+  "UserPromptSubmit",
+  "SubagentStop",
+  "Stop"
+];
+
 // src/runtime-readiness-registry.ts
 function getEnabledRuntimeReadinessBindings(capability, plan) {
   return capability.bindings.filter((binding) => {
@@ -7855,7 +7869,7 @@ function getEnabledRuntimeReadinessBindings(capability, plan) {
   });
 }
 var NAMED_PROMPT_TARGET_NOTE = "Named `skills` / `commands` readiness targets currently translate through prompt-entry gating with best-effort matching because the core four do not share one exact per-skill or per-command runtime interception surface.";
-var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, and Pluxx still emits `.codex/readiness.generated.json` plus `.codex/hooks.generated.json` as debugging companions because plugin-bundled hook activation still depends on `[features].plugin_hooks = true`. The general `hooks = true` flag covers non-plugin hook config and defaults on, while `codex_hooks` is deprecated and should not be treated as a plugin-bundled hook fallback.";
+var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, and Pluxx still emits `.codex/readiness.generated.json` plus `.codex/hooks.generated.json` as debugging companions because hook activation still depends on `[features].hooks = true`, enabled plugin state, review, trust, and runtime support. `codex_hooks` is deprecated and should not be treated as the current hook feature key.";
 function getRuntimeReadinessNamedPromptTargetNote() {
   return NAMED_PROMPT_TARGET_NOTE;
 }
@@ -7929,18 +7943,18 @@ function getRuntimeReadinessCapability(platform, pluginRootVar = "PLUGIN_ROOT")
           {
             gate: "session-start",
             event: "SessionStart",
-            command: "node ./.codex/pluxx-readiness.mjs session-start"
+            command: `node "\${${pluginRootVar}}/.codex/pluxx-readiness.mjs" session-start`
           },
           {
             gate: "mcp-gate",
             event: "PreToolUse",
             matcher: "MCP",
-            command: "node ./.codex/pluxx-readiness.mjs mcp-gate"
+            command: `node "\${${pluginRootVar}}/.codex/pluxx-readiness.mjs" mcp-gate`
           },
           {
             gate: "prompt-gate",
             event: "UserPromptSubmit",
-            command: "node ./.codex/pluxx-readiness.mjs prompt-gate"
+            command: `node "\${${pluginRootVar}}/.codex/pluxx-readiness.mjs" prompt-gate`
           }
         ],
         notes: CODEX_EXTERNAL_NOTE
@@ -8103,7 +8117,7 @@ var PLATFORM_LIMIT_POLICIES = {
     },
     hooksFeatureFlag: {
       kind: "hard",
-      notes: "Hook support depends on the Codex hooks feature flag/runtime support."
+      notes: "Codex hook support depends on the canonical hooks feature flag plus enabled-plugin, trust/review, and runtime support."
     }
   },
   "cursor": {
@@ -8303,8 +8317,8 @@ var PLATFORM_VALIDATION_RULES = {
     hooks: {
       supported: true,
       files: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
-      eventNames: ["SessionStart", "PreToolUse", "PermissionRequest", "PostToolUse", "UserPromptSubmit", "Stop"],
-      notes: "Codex documents both project or user hook config and plugin-bundled hooks. Plugin-bundled hooks live at `hooks/hooks.json` in the plugin and require `[features].plugin_hooks = true`; the general `[features].hooks = true` flag covers non-plugin hook config and defaults on. `codex_hooks` is deprecated and should not be treated as a plugin-bundled hook fallback."
+      eventNames: [...CODEX_SUPPORTED_HOOK_EVENTS],
+      notes: "Codex documents both project/user hook config and plugin-bundled hooks. Plugin-bundled hooks live at `hooks/hooks.json` in the plugin and require the canonical `[features].hooks = true` flag, enabled plugin state, user review, trust, and runtime support. `codex_hooks` is deprecated and should not be treated as the current hook feature key."
     },
     instructions: {
       files: ["AGENTS.md", "AGENTS.override.md"],
@@ -8743,7 +8757,7 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
       hooks: {
         mode: "translate",
         nativeSurfaces: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
-        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin with the documented `[features].plugin_hooks = true` plugin gate, and still tracks the broader project/user hook config paths where `[features].hooks` is the general flag and `codex_hooks` is deprecated."
+        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin with the documented `[features].hooks = true` feature key, and still tracks broader project/user hook config paths where `codex_hooks` is deprecated. Plugin-bundled execution still also depends on enabled plugin state, review, trust, and runtime support."
       },
       permissions: {
         mode: "translate",
@@ -9139,6 +9153,78 @@ function getPublishReloadInstruction(target) {
   return PUBLISH_RELOAD_INSTRUCTIONS[target];
 }
 
+// src/mcp-native-overrides.ts
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  return value;
+}
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return void 0;
+}
+function readStringRecord(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const stringRecord = Object.fromEntries(
+    Object.entries(record).filter(([, entryValue]) => typeof entryValue === "string")
+  );
+  return Object.keys(stringRecord).length > 0 ? stringRecord : void 0;
+}
+function extractEnvVar(value) {
+  const match = value.match(/\$\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/);
+  return match?.[1] ?? match?.[2];
+}
+function envVarToKey(envVar) {
+  return envVar.toLowerCase().replace(/_/g, "-");
+}
+function collectNativeMcpAuthUserConfigEntries(config, platforms, existingFields) {
+  const next = [];
+  const seenKeys = new Set(existingFields.map((field) => field.key));
+  const seenEnvVars = new Set(
+    existingFields.map((field) => field.envVar ?? defaultUserConfigEnvVar(field.key))
+  );
+  const pushDerived = (envVar, platform, serverName) => {
+    if (!envVar || seenEnvVars.has(envVar)) return;
+    const key = envVarToKey(envVar);
+    if (seenKeys.has(key)) return;
+    seenEnvVars.add(envVar);
+    seenKeys.add(key);
+    next.push({
+      key,
+      title: envVar,
+      description: `Derived from native ${platform} MCP auth for ${serverName}.`,
+      type: "secret",
+      required: true,
+      envVar,
+      targets: [platform]
+    });
+  };
+  for (const platform of platforms) {
+    const platformConfig = asRecord(config.platforms?.[platform]);
+    const mcpServers = asRecord(platformConfig?.mcpServers);
+    if (!mcpServers) continue;
+    for (const [serverName, rawOverride] of Object.entries(mcpServers)) {
+      const override = asRecord(rawOverride);
+      if (!override) continue;
+      const bearerTokenEnv = firstString(override.bearer_token_env_var, override.bearerTokenEnvVar);
+      if (bearerTokenEnv) pushDerived(bearerTokenEnv, platform, serverName);
+      for (const record of [
+        readStringRecord(override.env_http_headers ?? override.envHttpHeaders),
+        readStringRecord(override.headers),
+        readStringRecord(override.http_headers ?? override.httpHeaders)
+      ]) {
+        for (const value of Object.values(record ?? {})) {
+          const envVar = extractEnvVar(value) ?? value;
+          pushDerived(envVar, platform, serverName);
+        }
+      }
+    }
+  }
+  return next;
+}
+
 // src/cli/publish.ts
 var INSTALLER_TARGETS = ["claude-code", "cursor", "codex", "opencode"];
 function runCommandDefault(command, args, options) {
@@ -9438,8 +9524,15 @@ echo
 echo "Installed __DISPLAY_NAME__ across ${installerTargets.join(", ")}."
 `.replaceAll("__REPO__", "REPO_PLACEHOLDER").replaceAll("__DISPLAY_NAME__", "DISPLAY_PLACEHOLDER");
 }
+function collectInstallerUserConfigEntries(config, platforms) {
+  const baseEntries = collectUserConfigEntries(config, platforms);
+  return [
+    ...baseEntries,
+    ...collectNativeMcpAuthUserConfigEntries(config, platforms, baseEntries)
+  ];
+}
 function renderInstallerUserConfigSnippet(config, platform, installDirVariable) {
-  const entries = collectUserConfigEntries(config, [platform]).map((entry) => ({
+  const entries = collectInstallerUserConfigEntries(config, [platform]).map((entry) => ({
     key: entry.key,
     title: entry.title,
     type: entry.type ?? "string",
@@ -9447,6 +9540,7 @@ function renderInstallerUserConfigSnippet(config, platform, installDirVariable)
     envVar: entry.envVar ?? defaultUserConfigEnvVar(entry.key)
   }));
   if (entries.length === 0) return "";
+  const preserveSecretReferences = platform === "codex";
   const promptLines = entries.map((entry) => {
     const functionName = entry.type === "secret" ? "pluxx_prompt_secret_config" : "pluxx_prompt_text_config";
     return `${functionName} ${JSON.stringify(entry.key)} ${JSON.stringify(entry.envVar)} ${JSON.stringify(entry.title)} ${entry.required ? "1" : "0"}`;
@@ -9457,6 +9551,8 @@ ${JSON.stringify(entries)}
 PLUXX_USER_CONFIG_JSON
 )"
 PLUXX_REUSED_USER_CONFIG=0
+PLUXX_PRESERVE_SECRET_REFS="${preserveSecretReferences ? "1" : "0"}"
+export PLUXX_PRESERVE_SECRET_REFS
 
 pluxx_is_placeholder_secret() {
   case "$1" in
@@ -9483,12 +9579,14 @@ const fs = require('fs')
 const filepath = process.env.PLUXX_SAVED_USER_CONFIG_PATH
 const key = process.env.PLUXX_SAVED_CONFIG_KEY
 const envVar = process.env.PLUXX_SAVED_CONFIG_ENV_VAR
+const preserveSecretRefs = process.env.PLUXX_PRESERVE_SECRET_REFS === '1'
 
 try {
   const payload = JSON.parse(fs.readFileSync(filepath, 'utf8'))
   const candidates = [
     payload && payload.env && envVar ? payload.env[envVar] : undefined,
     payload && payload.values && key ? payload.values[key] : undefined,
+    preserveSecretRefs && payload && payload.envRefs && envVar && payload.envRefs[envVar] === envVar ? envVar : undefined,
   ]
 
   for (const candidate of candidates) {
@@ -9584,21 +9682,53 @@ const path = require('path')
 
 const installDir = process.env.PLUXX_INSTALL_DIR
 const spec = JSON.parse(process.env.PLUXX_USER_CONFIG_SPEC || '[]')
+const preserveSecretReferences = ${preserveSecretReferences ? "true" : "false"}
 
 if (installDir && spec.length > 0) {
   const env = {}
   const values = {}
+  const envRefs = {}
+  const secretKeys = []
+  const secretEnv = []
+  let hasSecret = false
+  const secretEnvVars = new Set(
+    spec
+      .filter((entry) => entry && entry.type === 'secret' && typeof entry.envVar === 'string' && entry.envVar !== '')
+      .map((entry) => entry.envVar),
+  )
 
   for (const entry of spec) {
+    if (entry.type === 'secret') {
+      hasSecret = true
+      if (preserveSecretReferences) {
+        if (entry.key) secretKeys.push(entry.key)
+        if (entry.envVar) secretEnv.push(entry.envVar)
+      }
+    }
     const value = process.env[entry.envVar]
     if (value === undefined || value === '') continue
+    if (preserveSecretReferences && entry.type === 'secret') {
+      envRefs[entry.envVar] = entry.envVar
+      continue
+    }
     values[entry.key] = value
     env[entry.envVar] = value
   }
 
   fs.writeFileSync(
     path.join(installDir, '.pluxx-user.json'),
-    JSON.stringify({ values, env }, null, 2) + '\\n',
+    JSON.stringify(
+      {
+        ...(Object.keys(values).length > 0 ? { values } : {}),
+        ...(Object.keys(env).length > 0 ? { env } : {}),
+        ...(Object.keys(envRefs).length > 0 ? { envRefs } : {}),
+        ...(hasSecret ? { secretStorage: preserveSecretReferences ? 'env-ref' : 'materialized' } : {}),
+        ...(preserveSecretReferences && secretKeys.length > 0 ? { secretKeys: [...new Set(secretKeys)].sort() } : {}),
+        ...(preserveSecretReferences && secretEnv.length > 0 ? { secretEnv: [...new Set(secretEnv)].sort() } : {}),
+      },
+      null,
+      2,
+    ) + '\\n',
   )
 
   const envScriptPath = path.join(installDir, 'scripts/check-env.sh')
@@ -9611,7 +9741,10 @@ if (installDir && spec.length > 0) {
 
   const materialize = (value) =>
     typeof value === 'string'
-      ? value.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_match, name) => env[name] || '${" + name + "}')
+      ? value.replace(
+        /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g,
+        (_match, name) => (preserveSecretReferences && secretEnvVars.has(name) ? '${" + name + "}' : (env[name] || '${" + name + "}')),
+      )
       : value
 
   const materializeRecord = (record) => {
@@ -9635,7 +9768,7 @@ if (installDir && spec.length > 0) {
         server.env = materializeRecord(server.env)
       }
 
-      if (server.bearer_token_env_var && env[server.bearer_token_env_var]) {
+      if (!preserveSecretReferences && server.bearer_token_env_var && env[server.bearer_token_env_var]) {
         server.http_headers = {
           ...(server.http_headers || {}),
           Authorization: 'Bearer ' + env[server.bearer_token_env_var],
@@ -9643,7 +9776,7 @@ if (installDir && spec.length > 0) {
         delete server.bearer_token_env_var
       }
 
-      if (server.env_http_headers && typeof server.env_http_headers === 'object') {
+      if (!preserveSecretReferences && server.env_http_headers && typeof server.env_http_headers === 'object') {
         server.http_headers = {
           ...(server.http_headers || {}),
         }
@@ -9668,7 +9801,7 @@ NODE
 `;
 }
 function hasInstallerUserConfig(config, platform) {
-  return collectUserConfigEntries(config, [platform]).length > 0;
+  return collectInstallerUserConfigEntries(config, [platform]).length > 0;
 }
 function renderInstallerSavedUserConfigCaptureSnippet(config, platform, installDirVariable) {
   if (!hasInstallerUserConfig(config, platform)) return "";
@@ -9834,13 +9967,13 @@ for (const line of lines) {
     continue
   }
   if (tableName === '') {
-    const dottedMatch = trimmed.match(/^features\\.plugin_hooks\\s*=\\s*(.+)$/)
+    const dottedMatch = trimmed.match(/^features\\.hooks\\s*=\\s*(.+)$/)
     if (dottedMatch && isTomlTrue(dottedMatch[1])) process.exit(0)
     const inlineMatch = trimmed.match(/^features\\s*=\\s*(.+)$/)
-    if (inlineMatch && /\\bplugin_hooks\\s*=\\s*true\\b/i.test(inlineMatch[1])) process.exit(0)
+    if (inlineMatch && /\\bhooks\\s*=\\s*true\\b/i.test(inlineMatch[1])) process.exit(0)
   }
   if (tableName !== 'features') continue
-  const match = trimmed.match(/^plugin_hooks\\s*=\\s*(.+)$/)
+  const match = trimmed.match(/^hooks\\s*=\\s*(.+)$/)
   if (match && isTomlTrue(match[1])) process.exit(0)
 }
 process.exit(1)
@@ -9859,7 +9992,7 @@ NODE
       *)
         if [[ -r /dev/tty ]]; then
           echo "This Codex plugin bundle includes startup hooks." >/dev/tty
-          echo "Codex requires [features].plugin_hooks = true before plugin-bundled hooks can run." >/dev/tty
+          echo "Codex requires [features].hooks = true before plugin-bundled hooks can run." >/dev/tty
           read -r -p "Enable Codex plugin-bundled hooks in $CODEX_CONFIG_PATH now? [Y/n] " PLUXX_CODEX_HOOKS_REPLY </dev/tty
           case "$PLUXX_CODEX_HOOKS_REPLY" in
             n|N|no|NO)
@@ -9931,7 +10064,7 @@ for (let index = 0; index < lines.length; index += 1) {
     if (/^features\\.[A-Za-z0-9_-]+\\s*=/.test(trimmed) && firstTopLevelFeaturesDotted < 0) {
       firstTopLevelFeaturesDotted = index
     }
-    if (/^features\\.plugin_hooks\\s*=/.test(trimmed)) {
+    if (/^features\\.hooks\\s*=/.test(trimmed)) {
       topLevelPluginHooksDotted = index
     }
     if (/^features\\s*=\\s*\\{/.test(trimmed)) {
@@ -9950,28 +10083,28 @@ if (start >= 0) {
 
   let updated = false
   for (let index = start + 1; index < end; index += 1) {
-    if (/^plugin_hooks\\s*=/.test(stripTomlComment(lines[index]).trim())) {
-      lines[index] = 'plugin_hooks = true'
+    if (/^hooks\\s*=/.test(stripTomlComment(lines[index]).trim())) {
+      lines[index] = 'hooks = true'
       updated = true
     }
   }
-  if (!updated) lines.splice(start + 1, 0, 'plugin_hooks = true')
+  if (!updated) lines.splice(start + 1, 0, 'hooks = true')
 } else if (topLevelPluginHooksDotted >= 0) {
-  lines[topLevelPluginHooksDotted] = 'features.plugin_hooks = true'
+  lines[topLevelPluginHooksDotted] = 'features.hooks = true'
 } else if (firstTopLevelFeaturesDotted >= 0) {
-  lines.splice(firstTopLevelFeaturesDotted + 1, 0, 'features.plugin_hooks = true')
+  lines.splice(firstTopLevelFeaturesDotted + 1, 0, 'features.hooks = true')
 } else if (topLevelInlineFeatures >= 0 && lines[topLevelInlineFeatures].includes('}')) {
-  if (/\\bplugin_hooks\\s*=/.test(lines[topLevelInlineFeatures])) {
+  if (/\\bhooks\\s*=/.test(lines[topLevelInlineFeatures])) {
     lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(
-      /\\bplugin_hooks\\s*=\\s*(true|false)\\b/i,
-      'plugin_hooks = true',
+      /\\bhooks\\s*=\\s*(true|false)\\b/i,
+      'hooks = true',
     )
   } else {
-    lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(/}/, ', plugin_hooks = true }')
+    lines[topLevelInlineFeatures] = lines[topLevelInlineFeatures].replace(/}/, ', hooks = true }')
   }
 } else {
   if (lines.length > 0 && lines[lines.length - 1] !== '') lines.push('')
-  lines.push('[features]', 'plugin_hooks = true')
+  lines.push('[features]', 'hooks = true')
 }
 
 fs.mkdirSync(path.dirname(filepath), { recursive: true })
@@ -9982,7 +10115,7 @@ NODE
     else
       echo "Codex plugin-bundled hooks are not enabled. Startup hooks from this plugin will not run until you add this to $CODEX_CONFIG_PATH:" >&2
       echo "[features]" >&2
-      echo "plugin_hooks = true" >&2
+      echo "hooks = true" >&2
       echo "Then restart or refresh Codex before relying on plugin startup hooks." >&2
       echo "Set PLUXX_CODEX_ENABLE_PLUGIN_HOOKS=1 before running this installer to enable it noninteractively." >&2
     fi
@@ -10621,7 +10754,7 @@ import { resolve as resolve5 } from "path";
 import { spawn, spawnSync as spawnSync2 } from "child_process";
 import { accessSync, constants, existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync } from "fs";
 import { homedir } from "os";
-import { basename, dirname as dirname2, resolve as resolve4 } from "path";
+import { basename as basename2, dirname as dirname2, relative as relative2, resolve as resolve4 } from "path";
 
 // node_modules/jiti/lib/jiti.mjs
 var import_jiti = __toESM(require_jiti(), 1);
@@ -10634,7 +10767,7 @@ var CONFIG_FILES = [
 ];
 
 // src/cli/install.ts
-import { resolve as resolve3, dirname } from "path";
+import { resolve as resolve3, dirname, basename, relative } from "path";
 import { existsSync as existsSync3, symlinkSync, mkdirSync as mkdirSync2, rmSync as rmSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, cpSync, readdirSync } from "fs";
 
 // src/mcp-stdio-paths.ts
@@ -10779,7 +10912,7 @@ function resolveBundleReference(rootDir, value) {
   if (isRelativeBundlePath(value)) {
     return resolve3(rootDir, value);
   }
-  const pluginRootMatch = value.match(/^\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|PLUGIN_ROOT)\}[\\/](.+)$/);
+  const pluginRootMatch = value.match(/^\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|CODEX_PLUGIN_ROOT|OPENCODE_PLUGIN_ROOT|PLUGIN_ROOT|PLUXX_PLUGIN_ROOT)\}[\\/](.+)$/);
   if (pluginRootMatch) {
     return resolve3(rootDir, pluginRootMatch[1]);
   }
@@ -10822,9 +10955,43 @@ function collectHookCommandStrings(value, commands) {
   }
 }
 function extractBundleCommandTargets(command) {
-  const matches = command.match(/\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|PLUGIN_ROOT)\}[\\/][^\s"'`;$|&<>]+|\.\.?[\\/][^\s"'`;$|&<>]+/g);
+  const matches = command.match(/\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|CODEX_PLUGIN_ROOT|OPENCODE_PLUGIN_ROOT|PLUGIN_ROOT|PLUXX_PLUGIN_ROOT)\}[\\/][^\s"'`;$|&<>]+|\.\.?[\\/][^\s"'`;$|&<>]+/g);
   return matches ?? [];
 }
+function extractRelativeBundleCommandTargets(command) {
+  return extractBundleCommandTargets(command).filter(isRelativeBundlePath);
+}
+function commandChangesToKnownPluginRoot(command) {
+  return /\bcd\s+["']?\$\{?(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|CODEX_PLUGIN_ROOT|OPENCODE_PLUGIN_ROOT|PLUGIN_ROOT|PLUXX_PLUGIN_ROOT)\}?/.test(command);
+}
+function formatBundleRelativePath(rootDir, filePath) {
+  const relativePath = relative(rootDir, filePath);
+  return relativePath && !relativePath.startsWith("..") ? relativePath : filePath;
+}
+function findHookWrapperPaths(rootDir, command) {
+  return extractBundleCommandTargets(command).map((target) => resolveBundleReference(rootDir, target)).filter((target) => {
+    if (!target) return false;
+    return existsSync3(target) && basename(target).startsWith("pluxx-hook-command-") && target.endsWith(".sh");
+  });
+}
+function findCodexCwdUnsafeHookCommands(rootDir, commands) {
+  const issues = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    const relativeTargets = extractRelativeBundleCommandTargets(command);
+    if (relativeTargets.length > 0 && !commandChangesToKnownPluginRoot(command)) {
+      issues.add(`${command} uses cwd-relative bundle target(s): ${relativeTargets.join(", ")}`);
+    }
+    for (const wrapperPath of findHookWrapperPaths(rootDir, command)) {
+      const wrapper = readFileSync3(wrapperPath, "utf-8");
+      const hookCommand = wrapper.match(/^PLUXX_HOOK_COMMAND=(.*)$/m)?.[1] ?? "";
+      const wrapperRelativeTargets = extractRelativeBundleCommandTargets(hookCommand);
+      if (wrapperRelativeTargets.length > 0 && !commandChangesToKnownPluginRoot(wrapper)) {
+        issues.add(`${formatBundleRelativePath(rootDir, wrapperPath)} evaluates cwd-relative bundle target(s): ${wrapperRelativeTargets.join(", ")}`);
+      }
+    }
+  }
+  return [...issues].sort();
+}
 function resolveInstalledHooksReference(rootDir, platform, manifest) {
   const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
   if (manifestReference) {
@@ -10862,6 +11029,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
     return {
       missingManifestPaths: [],
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: []
     };
   }
@@ -10871,6 +11039,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       manifestIssue: `missing plugin manifest at ${manifestPath}`,
       missingManifestPaths: [],
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: []
     };
   }
@@ -10882,6 +11051,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       manifestIssue: `plugin manifest at ${manifestPath} is not parseable: ${error instanceof Error ? error.message : String(error)}`,
       missingManifestPaths: [],
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: []
     };
   }
@@ -10896,6 +11066,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   }
@@ -10904,6 +11075,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   }
@@ -10917,10 +11089,12 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
         return resolved !== void 0 && !existsSync3(resolved);
       })
     )].sort();
+    const cwdUnsafeHookCommands = platform === "codex" ? findCodexCwdUnsafeHookCommands(rootDir, commands) : [];
     return {
       ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets,
+      cwdUnsafeHookCommands,
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   } catch (error) {
@@ -10929,6 +11103,7 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       hookConfigIssue: `hooks config at ${hooksReference} is not parseable: ${error instanceof Error ? error.message : String(error)}`,
       missingManifestPaths,
       missingHookTargets: [],
+      cwdUnsafeHookCommands: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   }
@@ -11114,7 +11289,7 @@ var MUTATING_PREFIX_PATTERN = new RegExp(`^(${MUTATING_PREFIXES.join("|")})\\b`,
 // src/codex-hooks-feature.ts
 var RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG = "hooks";
 var ALTERNATE_CODEX_HOOKS_FEATURE_FLAG = "codex_hooks";
-var PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG = "plugin_hooks";
+var PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG = "hooks";
 function getCodexHooksFeatureState(features) {
   if (!features) {
     return {
@@ -11292,12 +11467,119 @@ function splitTomlDottedPath(value) {
 var MATERIALIZED_ENV_MARKER = "materialized required config";
 var MIN_NODE_MAJOR = 18;
 var STDIO_LAUNCH_SMOKE_TIMEOUT_MS = 1200;
+var MAX_SECRET_SCAN_FILE_BYTES = 512 * 1024;
+var LEGACY_SECRET_IDENTIFIER_PATTERN = /(^|[-_])(api[-_]?key|secret|token|password|credential)([-_]|$)/i;
+var TEST_SECRET_SENTINELS = [
+  { pattern: /\bshh-secret\b/i, label: "test secret sentinel" },
+  { pattern: /\bsecret-key\b/i, label: "test secret sentinel" },
+  { pattern: /\bliteral-secret-value-that-should-not-copy\b/i, label: "test secret sentinel" }
+];
 function renderInstalledPluginRoot(value, rootDir) {
   return value.replaceAll("${PLUGIN_ROOT}", rootDir).replaceAll("${CLAUDE_PLUGIN_ROOT}", rootDir).replaceAll("${CURSOR_PLUGIN_ROOT}", rootDir).replaceAll("${CODEX_PLUGIN_ROOT}", rootDir).replaceAll("${OPENCODE_PLUGIN_ROOT}", rootDir);
 }
 function addCheck(checks, check) {
   checks.push(check);
 }
+function looksLegacySecretIdentifier(value) {
+  return LEGACY_SECRET_IDENTIFIER_PATTERN.test(
+    value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[._/\s]+/g, "-")
+  );
+}
+function walkInstalledBundleFiles(rootDir, currentDir = rootDir) {
+  const files = [];
+  for (const entry of readdirSync2(currentDir, { withFileTypes: true })) {
+    const absolutePath = resolve4(currentDir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walkInstalledBundleFiles(rootDir, absolutePath));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    files.push(relative2(rootDir, absolutePath).replace(/\\/g, "/"));
+  }
+  return files.sort();
+}
+function readInstalledTextFile(rootDir, relativePath) {
+  const absolutePath = resolve4(rootDir, relativePath);
+  const content = readFileSync4(absolutePath);
+  if (content.length > MAX_SECRET_SCAN_FILE_BYTES) return null;
+  if (content.includes(0)) return null;
+  return content.toString("utf-8");
+}
+function collectInstalledPlaintextSecretCandidates(rootDir) {
+  const userConfigPath = resolve4(rootDir, ".pluxx-user.json");
+  if (!existsSync4(userConfigPath)) return [];
+  try {
+    const payload = JSON.parse(readFileSync4(userConfigPath, "utf-8"));
+    if (payload.secretStorage === "materialized") return [];
+    const secretKeys = new Set(Array.isArray(payload.secretKeys) ? payload.secretKeys.filter((value) => typeof value === "string") : []);
+    const secretEnv = new Set(Array.isArray(payload.secretEnv) ? payload.secretEnv.filter((value) => typeof value === "string") : []);
+    const hasSecretMetadata = secretKeys.size > 0 || secretEnv.size > 0;
+    const candidateLabels = /* @__PURE__ */ new Map();
+    const recordCandidate = (rawValue, label) => {
+      if (typeof rawValue !== "string") return;
+      const value = rawValue.trim();
+      if (!value) return;
+      if (extractEnvReference(value)) return;
+      if (isPlaceholderSecretValue(value)) return;
+      const labels = candidateLabels.get(value) ?? /* @__PURE__ */ new Set();
+      labels.add(label);
+      candidateLabels.set(value, labels);
+    };
+    for (const [key, value] of Object.entries(payload.values ?? {})) {
+      if (hasSecretMetadata ? !secretKeys.has(key) : !looksLegacySecretIdentifier(key)) continue;
+      recordCandidate(value, `userConfig "${key}"`);
+    }
+    for (const [key, value] of Object.entries(payload.env ?? {})) {
+      if (hasSecretMetadata ? !secretEnv.has(key) : !looksLegacySecretIdentifier(key)) continue;
+      recordCandidate(value, `env "${key}"`);
+    }
+    return [...candidateLabels.entries()].map(([value, labels]) => ({
+      value,
+      labels: [...labels].sort()
+    }));
+  } catch {
+    return [];
+  }
+}
+function checkInstalledPlaintextSecrets(checks, rootDir) {
+  const literalCandidates = collectInstalledPlaintextSecretCandidates(rootDir);
+  const findings = /* @__PURE__ */ new Map();
+  for (const relativePath of walkInstalledBundleFiles(rootDir)) {
+    const content = readInstalledTextFile(rootDir, relativePath);
+    if (!content) continue;
+    const labels = /* @__PURE__ */ new Set();
+    for (const candidate of literalCandidates) {
+      if (!content.includes(candidate.value)) continue;
+      for (const label of candidate.labels) labels.add(label);
+    }
+    for (const sentinel of TEST_SECRET_SENTINELS) {
+      if (sentinel.pattern.test(content)) {
+        labels.add(sentinel.label);
+      }
+    }
+    if (labels.size > 0) {
+      findings.set(relativePath, labels);
+    }
+  }
+  if (findings.size === 0) {
+    addCheck(checks, {
+      level: "success",
+      code: "consumer-plaintext-secret-absent",
+      title: "Installed bundle does not expose known plaintext secret material",
+      detail: "No known prompted secret values or maintained test-secret sentinels were detected in scanned installed text files.",
+      fix: "No action needed."
+    });
+    return;
+  }
+  const detail = [...findings.entries()].map(([path, labels]) => `${path} (${[...labels].sort().join(", ")})`).join("; ");
+  addCheck(checks, {
+    level: "error",
+    code: "consumer-plaintext-secret-leak",
+    title: "Installed bundle contains plaintext secret material",
+    detail: `Detected plaintext secret material in installed files: ${detail}.`,
+    fix: "Rotate the affected credential, remove the leaking install, reinstall after the Pluxx secret-reference fix, and rerun pluxx doctor --consumer."
+  });
+}
 function summarizeChecks(checks) {
   const visibleChecks = checks.filter((check) => !check.code.startsWith("primitive-"));
   const errors = visibleChecks.filter((check) => check.level === "error").length;
@@ -11432,7 +11714,7 @@ function readCodexHooksFeatureFlag(filePath) {
       inFeaturesTable = sectionMatch[1].trim() === "features";
       continue;
     }
-    const dottedFeatureMatch = line.match(/^features\.(plugin_hooks|hooks|codex_hooks)\s*=\s*(.+)$/);
+    const dottedFeatureMatch = line.match(/^features\.(hooks|codex_hooks)\s*=\s*(.+)$/);
     if (dottedFeatureMatch) {
       assignFeatureFlag(dottedFeatureMatch[1], dottedFeatureMatch[2]);
       continue;
@@ -11449,7 +11731,7 @@ function readCodexHooksFeatureFlag(filePath) {
       continue;
     }
     if (!inFeaturesTable) continue;
-    const featureMatch = line.match(/^(plugin_hooks|hooks|codex_hooks)\s*=\s*(.+)$/);
+    const featureMatch = line.match(/^(hooks|codex_hooks)\s*=\s*(.+)$/);
     if (!featureMatch) continue;
     assignFeatureFlag(featureMatch[1], featureMatch[2]);
   }
@@ -11638,7 +11920,7 @@ function listClaudeSettingsCandidates(projectRoot) {
   });
 }
 function readClaudeDisableAllHooks(filePath) {
-  const parsed = readJsonFile(dirname2(filePath), basename(filePath));
+  const parsed = readJsonFile(dirname2(filePath), basename2(filePath));
   return typeof parsed.disableAllHooks === "boolean" ? parsed.disableAllHooks : void 0;
 }
 function probeClaudeDisableAllHooks(projectRoot) {
@@ -11981,6 +12263,9 @@ function checkInstalledBundleIntegrity(checks, rootDir, layout) {
   if (issues.missingHookTargets.length > 0) {
     details.push(`hook commands reference missing bundle target${issues.missingHookTargets.length === 1 ? "" : "s"}: ${issues.missingHookTargets.join(", ")}`);
   }
+  if (issues.cwdUnsafeHookCommands.length > 0) {
+    details.push(`Codex hook command${issues.cwdUnsafeHookCommands.length === 1 ? " depends" : "s depend"} on plugin-root cwd: ${issues.cwdUnsafeHookCommands.join("; ")}`);
+  }
   if (issues.invalidRuntimeScripts.length > 0) {
     details.push(`runtime startup still depends on installer-owned validation: ${issues.invalidRuntimeScripts.join(", ")}`);
   }
@@ -12000,7 +12285,7 @@ function checkInstalledBundleIntegrity(checks, rootDir, layout) {
     code: "consumer-bundle-integrity-invalid",
     title: "Installed bundle integrity is broken",
     detail: details.join("; "),
-    fix: "Reinstall the plugin or rebuild the bundle so every manifest path, hook config, and hook target is valid inside the installed plugin.",
+    fix: "Reinstall the plugin or rebuild the bundle so every manifest path, hook config, and hook command resolves from the installed plugin root.",
     path: layout.manifestPath
   });
 }
@@ -12065,31 +12350,31 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
   const enabledProbes = probes.filter((probe) => probe.enabled);
   const checkedPaths = probes.map((probe) => `${probe.scope} ${probe.exists ? "config" : "path"}: ${probe.path}${probe.exists ? "" : " (missing)"}`).join("; ");
   const describeEnabledFlags = (probe) => {
-    const enabledFlags = [];
-    if (probe.pluginBundledEnabled) enabledFlags.push(PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG);
-    if (probe.recommendedEnabled) enabledFlags.push(RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG);
-    if (probe.alternateEnabled) enabledFlags.push(ALTERNATE_CODEX_HOOKS_FEATURE_FLAG);
-    return enabledFlags.join(" + ");
+    const enabledFlags = /* @__PURE__ */ new Set();
+    if (probe.pluginBundledEnabled) enabledFlags.add(PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG);
+    if (probe.recommendedEnabled) enabledFlags.add(RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG);
+    if (probe.alternateEnabled) enabledFlags.add(ALTERNATE_CODEX_HOOKS_FEATURE_FLAG);
+    return [...enabledFlags].join(" + ");
   };
   const generalOnlyProbes = probes.filter((probe) => !probe.pluginBundledEnabled && (probe.recommendedEnabled || probe.alternateEnabled));
   if (generalOnlyProbes.length > 0) {
     addCheck(checks, {
       level: "warning",
       code: "consumer-codex-plugin-hooks-feature-flag-general-only",
-      title: "Codex config enables only general hook flags, not the plugin-bundled hook gate",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but ${generalOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")} enables only general hook flags (${generalOnlyProbes.map((probe) => describeEnabledFlags(probe)).join(" and ")}). Those general flags do not activate plugin-bundled hooks by themselves.`,
-      fix: `Enable \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the active Codex config, reload Codex, and rerun pluxx verify-install.`,
+      title: "Codex config enables only deprecated hook flags",
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but ${generalOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")} enables only deprecated hook flags (${generalOnlyProbes.map((probe) => describeEnabledFlags(probe)).join(" and ")}). Current Codex docs use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` as the canonical feature key.`,
+      fix: `Enable \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the active Codex config, reload Codex, and rerun pluxx verify-install.`,
       path: generalOnlyProbes[0].path
     });
   }
-  const legacyOnlyProbes = probes.filter((probe) => probe.alternateEnabled && !probe.recommendedEnabled);
+  const legacyOnlyProbes = probes.filter((probe) => !probe.pluginBundledEnabled && probe.alternateEnabled && !probe.recommendedEnabled);
   if (legacyOnlyProbes.length > 0) {
     addCheck(checks, {
       level: "warning",
       code: "consumer-codex-hooks-feature-flag-legacy-only",
       title: "Codex config still uses the deprecated general hook compatibility flag",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the checked Codex config enables only the deprecated general hook flag \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` in ${legacyOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")}. That flag is not the plugin-bundled hook gate.`,
-      fix: `Prefer \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` only for non-plugin hook config if needed, and use \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` for plugin-bundled hooks. Reload Codex and rerun pluxx verify-install after updating the active config.`,
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the checked Codex config enables only the deprecated hook flag \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` in ${legacyOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")}. Current Codex docs use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` as the canonical feature key.`,
+      fix: `Use \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\`, reload Codex, and rerun pluxx verify-install after updating the active config.`,
       path: legacyOnlyProbes[0].path
     });
   }
@@ -12097,8 +12382,8 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
     addCheck(checks, {
       level: "success",
       code: "consumer-codex-hooks-feature-flag-enabled",
-      title: "Codex plugin-bundled hook feature flag found for this install",
-      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the plugin hook gate was found in ${enabledProbes.map((probe) => `${probe.scope} config ${probe.path} (${describeEnabledFlags(probe)})`).join(" and ")}. Treat that as a prerequisite, not proof of live hook execution.`,
+      title: "Codex hook feature flag found for this install",
+      detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, and the canonical hook feature key was found in ${enabledProbes.map((probe) => `${probe.scope} config ${probe.path} (${describeEnabledFlags(probe)})`).join(" and ")}. Treat that as a prerequisite, not proof of live hook execution.`,
       fix: "No action needed.",
       path: enabledProbes[0].path
     });
@@ -12109,8 +12394,8 @@ function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
     level: "warning",
     code: "consumer-codex-hooks-feature-flag-missing",
     title: "Codex plugin-bundled hook activation is missing its known feature-gate prerequisite",
-    detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` was not found in the checked Codex config layers. The general \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\` flag covers non-plugin hook config and defaults on, while \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` is deprecated and should not be treated as a plugin-bundled hook fallback. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""}`,
-    fix: `Enable \`${PLUGIN_BUNDLED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the relevant project or user Codex config, reload Codex, and rerun pluxx verify-install.`,
+    detail: `This installed Codex bundle declares plugin-bundled hooks at ${hooksReference}, but \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` was not found in the checked Codex config layers. \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` is deprecated and should not be treated as the current hook feature key. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""}`,
+    fix: `Enable \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the relevant project or user Codex config, reload Codex, and rerun pluxx verify-install.`,
     path: probes.find((probe) => probe.exists)?.path ?? hooksReference
   });
 }
@@ -12473,7 +12758,7 @@ function isLikelyLocalRuntimePath(value) {
 function isLikelyOpenCodeInstallPath(rootDir) {
   const parent = dirname2(rootDir);
   const grandparent = dirname2(parent);
-  return basename(parent) === "plugins" && basename(grandparent) === "opencode";
+  return basename2(parent) === "plugins" && basename2(grandparent) === "opencode";
 }
 function checkInstalledOpenCodeHostBridge(checks, rootDir) {
   if (!isLikelyOpenCodeInstallPath(rootDir)) {
@@ -12487,7 +12772,7 @@ function checkInstalledOpenCodeHostBridge(checks, rootDir) {
     });
     return;
   }
-  const pluginName = basename(rootDir);
+  const pluginName = basename2(rootDir);
   const entryPath = `${rootDir}.ts`;
   const entryRelativePath = `${pluginName}.ts`;
   if (!existsSync4(entryPath)) {
@@ -12528,7 +12813,7 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
   if (!isLikelyOpenCodeInstallPath(rootDir)) {
     return;
   }
-  const pluginName = basename(rootDir);
+  const pluginName = basename2(rootDir);
   const sourceSkillsDir = resolve4(rootDir, "skills");
   if (!existsSync4(sourceSkillsDir)) {
     addCheck(checks, {
@@ -12644,6 +12929,7 @@ async function doctorConsumer(rootDir = process.cwd(), options = {}) {
   checkInstalledCodexPermissionCompanion(checks, rootDir, layout, options);
   checkInstalledPermissionHook(checks, rootDir, layout);
   checkInstalledUserConfig(checks, rootDir);
+  checkInstalledPlaintextSecrets(checks, rootDir);
   checkInstalledEnvValidation(checks, rootDir);
   checkInstalledRuntimeScriptRoles(checks, rootDir);
   await checkInstalledMcpConfig(checks, rootDir, layout);