@ordewell/core 0.4.6 → 0.4.8

package/dist/index.js

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ALLOWED_PLUGIN_HOSTS: () => ALLOWED_PLUGIN_HOSTS,
   ALL_PROVIDERS: () => ALL_PROVIDERS,
   AUTO_COMMANDS: () => AUTO_COMMANDS,
   AbstractRunner: () => AbstractRunner,
@@ -48,6 +49,8 @@ __export(index_exports, {
   CommandLineTooLongError: () => CommandLineTooLongError,
   ConsoleLogger: () => ConsoleLogger,
   ContextCollector: () => ContextCollector,
+  DAEMON_SUBPROTOCOL: () => DAEMON_SUBPROTOCOL,
+  DAEMON_TOKEN_SUBPROTOCOL_PREFIX: () => DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DENY_ALL: () => DENY_ALL,
   EmbeddedNewlineError: () => EmbeddedNewlineError,
   EnvConfig: () => EnvConfig,
@@ -64,9 +67,12 @@ __export(index_exports, {
   ModelResolver: () => ModelResolver,
   OPENCODE_MANIFEST: () => OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS: () => ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_SETTABLE_ENV: () => ORDEWELL_SETTABLE_ENV,
   OpenAiService: () => OpenAiService,
   OpenCodeAdapter: () => OpenCodeAdapter,
   PLAN_ENVELOPE_KEY: () => PLAN_ENVELOPE_KEY,
+  PLUGIN_NAME_PATTERN: () => PLUGIN_NAME_PATTERN,
+  PROVIDER_CREDENTIAL_ENV: () => PROVIDER_CREDENTIAL_ENV,
   PROVIDER_DETECT_PRIORITY: () => PROVIDER_DETECT_PRIORITY,
   PROVIDER_LABEL: () => PROVIDER_LABEL,
   PROVIDER_PRIORITY: () => PROVIDER_PRIORITY,
@@ -81,6 +87,8 @@ __export(index_exports, {
   RunnerInstallation: () => RunnerInstallation,
   RunnerRegistry: () => RunnerRegistry,
   SEARCH_EXCLUSIONS: () => SEARCH_EXCLUSIONS,
+  SETTINGS_ENV_ALLOWLIST: () => SETTINGS_ENV_ALLOWLIST,
+  SETTINGS_ENV_REFUSED: () => SETTINGS_ENV_REFUSED,
   STATE_DIR: () => STATE_DIR,
   STOPPED_TOOL_RESULT: () => STOPPED_TOOL_RESULT,
   SYMBOL_LANGUAGES: () => SYMBOL_LANGUAGES,
@@ -93,13 +101,19 @@ __export(index_exports, {
   TmuxRunner: () => TmuxRunner,
   VerdictEngine: () => VerdictEngine,
   WINDOWS_MAX_COMMAND_LINE: () => WINDOWS_MAX_COMMAND_LINE,
+  WorkspaceNotAProjectError: () => WorkspaceNotAProjectError,
   WorkspaceNotFoundError: () => WorkspaceNotFoundError,
   addTaskToPlan: () => addTaskToPlan,
+  admitSettingsEnv: () => admitSettingsEnv,
   applyHeadLimit: () => applyHeadLimit,
   applyTaskOps: () => applyTaskOps,
+  assertInstallablePluginUrl: () => assertInstallablePluginUrl,
+  assertPlainPluginName: () => assertPlainPluginName,
   assertWorkspaceExists: () => assertWorkspaceExists,
+  assertWorkspaceIsProject: () => assertWorkspaceIsProject,
   augmentPromptWithPriorOutputs: () => augmentPromptWithPriorOutputs,
   augmentedPath: () => augmentedPath,
+  bearerHeaderValue: () => bearerHeaderValue,
   buildConversationSystemPrompt: () => buildConversationSystemPrompt,
   buildFallbackGrepArgs: () => buildFallbackGrepArgs,
   buildGlobArgs: () => buildGlobArgs,
@@ -127,7 +141,9 @@ __export(index_exports, {
   classifyCommand: () => classifyCommand,
   classifyOutcome: () => classifyOutcome,
   classifyPlannerReply: () => classifyPlannerReply,
+  classifyPluginSource: () => classifyPluginSource,
   clearAugmentedPathCache: () => clearAugmentedPathCache,
+  clearDaemonToken: () => clearDaemonToken,
   clearResearchShellCache: () => clearResearchShellCache,
   clearState: () => clearState,
   clipboardCopyCommand: () => clipboardCopyCommand,
@@ -139,6 +155,7 @@ __export(index_exports, {
   createAiService: () => createAiService,
   createEmptyPlan: () => createEmptyPlan,
   createTask: () => createTask,
+  daemonTokenPath: () => daemonTokenPath,
   defaultLogger: () => defaultLogger,
   definitionPattern: () => definitionPattern,
   deleteSession: () => deleteSession,
@@ -156,6 +173,7 @@ __export(index_exports, {
   extractObjectWithBalance: () => extractObjectWithBalance,
   extractObjectsWithKey: () => extractObjectsWithKey,
   extractPrdBlock: () => extractPrdBlock,
+  extractPresentedToken: () => extractPresentedToken,
   fetchAllProviderModels: () => fetchAllProviderModels,
   filterFallbackByAnchoredInclude: () => filterFallbackByAnchoredInclude,
   filterModelsForPrompt: () => filterModelsForPrompt,
@@ -173,6 +191,9 @@ __export(index_exports, {
   isCliProvider: () => isCliProvider,
   isExecutableResolved: () => isExecutableResolved,
   isOpenAiProvider: () => isOpenAiProvider,
+  isPlainPluginName: () => isPlainPluginName,
+  isReservedRunnerName: () => isReservedRunnerName,
+  isValidManifest: () => isValidManifest,
   killTree: () => killTree,
   knownModelId: () => knownModelId,
   languageForId: () => languageForId,
@@ -185,6 +206,8 @@ __export(index_exports, {
   migrateLegacyPlan: () => migrateLegacyPlan,
   migratePlanState: () => migratePlanState,
   migrateTask: () => migrateTask,
+  mintDaemonToken: () => mintDaemonToken,
+  mintSessionId: () => mintSessionId,
   modelContextBlock: () => modelContextBlock,
   modifyValidationFeedback: () => modifyValidationFeedback,
   normalizeAgentArgs: () => normalizeAgentArgs,
@@ -200,6 +223,7 @@ __export(index_exports, {
   providerForRunner: () => providerForRunner,
   reEmitPlanPrompt: () => reEmitPlanPrompt,
   reEmitTaskOpsPrompt: () => reEmitTaskOpsPrompt,
+  readDaemonToken: () => readDaemonToken,
   referencePattern: () => referencePattern,
   removeTaskFromPlan: () => removeTaskFromPlan,
   renderPlanMap: () => renderPlanMap,
@@ -211,6 +235,7 @@ __export(index_exports, {
   resolveArgs: () => resolveArgs,
   resolveDefaultMode: () => resolveDefaultMode,
   resolveModelShortcut: () => resolveModelShortcut,
+  resolvePluginInstallDir: () => resolvePluginInstallDir,
   resolveProvider: () => resolveProvider,
   resolveProviderFromPrefix: () => resolveProviderFromPrefix,
   resolveResearchShell: () => resolveResearchShell,
@@ -241,6 +266,8 @@ __export(index_exports, {
   tmuxSocketName: () => tmuxSocketName,
   tmuxWindowName: () => tmuxWindowName,
   toOrchestratorOptions: () => toOrchestratorOptions,
+  tokenSubprotocols: () => tokenSubprotocols,
+  tokensMatch: () => tokensMatch,
   truncatedPlanReEmitPrompt: () => truncatedPlanReEmitPrompt,
   updateTaskInPlan: () => updateTaskInPlan,
   validateModifiedPlan: () => validateModifiedPlan,
@@ -605,7 +632,6 @@ var AUTO_COMMANDS = [
   "pwd",
   "which",
   "type",
-  "env",
   "uname",
   "whoami",
   "cut",
@@ -806,6 +832,52 @@ var MULTIPLEXERS = [
   "flutter",
   "dart"
 ];
+var HELP_FLAGS = ["--help", "--version"];
+var WRAPPER_FAMILY = {
+  env: {
+    valueFlags: ["-u", "--unset", "-C", "--chdir"],
+    booleanFlags: [
+      "-i",
+      "--ignore-environment",
+      "-0",
+      "--null",
+      "-v",
+      "--debug",
+      // Optional-value flags: see WrapperSpec.booleanFlags.
+      "--block-signal",
+      "--default-signal",
+      "--ignore-signal",
+      "--list-signal-handling",
+      ...HELP_FLAGS
+    ],
+    stringFlags: ["-S", "--split-string"],
+    acceptsAssignments: true
+  },
+  nice: {
+    valueFlags: ["-n", "--adjustment"],
+    booleanFlags: HELP_FLAGS,
+    booleanPattern: /^-\d+$/
+  },
+  timeout: {
+    valueFlags: ["-s", "--signal", "-k", "--kill-after"],
+    booleanFlags: ["--preserve-status", "--foreground", "-v", "--verbose", ...HELP_FLAGS],
+    positionals: 1
+  },
+  nohup: { booleanFlags: HELP_FLAGS },
+  setsid: { booleanFlags: ["-c", "--ctty", "-f", "--fork", "-w", "--wait", "-h", "-V", ...HELP_FLAGS] },
+  stdbuf: {
+    valueFlags: ["-i", "--input", "-o", "--output", "-e", "--error"],
+    booleanFlags: HELP_FLAGS
+  },
+  ionice: {
+    valueFlags: ["-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid", "-u", "--uid"],
+    booleanFlags: ["-t", "--ignore", "-h", "-V", ...HELP_FLAGS]
+  },
+  // The multi-call binary ships its own `rm`, `mv` and `sh`, so the refused
+  // name arrives as its first argument.
+  busybox: { booleanFlags: ["--list", "--install", ...HELP_FLAGS] },
+  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] }
+};
 var POSIX_DIALECT = {
   escape: "\\",
   escapeInQuotes: true,
@@ -1020,10 +1092,92 @@ function binaryName(token, dialect) {
   if (dot <= 0) return base;
   return dialect.strippedExtensions.includes(base.slice(dot).toLowerCase()) ? base.slice(0, dot) : base;
 }
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function toSegment(tokens, piped, dialect) {
   const rest = [...tokens];
-  while (rest.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest[0])) rest.shift();
-  return { binary: rest.length > 0 ? binaryName(rest[0], dialect) : "", args: rest.slice(1), piped, expandable: false };
+  const assignments = [];
+  while (rest.length > 0 && ASSIGNMENT.test(rest[0])) assignments.push(rest.shift());
+  return {
+    binary: rest.length > 0 ? binaryName(rest[0], dialect) : "",
+    args: rest.slice(1),
+    assignments,
+    piped,
+    expandable: false
+  };
+}
+function joinedShortFlag(list, token) {
+  if (token.length <= 2) return void 0;
+  return list.find((f) => f.length === 2 && token.startsWith(f));
+}
+function scanWrapperArgs(binary, spec, args) {
+  const valueFlags = spec.valueFlags ?? [];
+  const stringFlags = spec.stringFlags ?? [];
+  const assignments = [];
+  let positionals = spec.positionals ?? 0;
+  let i = 0;
+  while (i < args.length) {
+    const token = args[i];
+    if (token === "--") {
+      i++;
+      break;
+    }
+    if (/^-./.test(token)) {
+      const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+      const name = eq > 0 ? token.slice(0, eq) : token;
+      const selfContained = eq > 0;
+      if ((spec.noExecFlags ?? []).includes(name)) return { kind: "no-exec" };
+      if (stringFlags.includes(name) || joinedShortFlag(stringFlags, token)) {
+        return {
+          kind: "refuse",
+          reason: `"${binary} ${name}" splits a string into a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`
+        };
+      }
+      if ((spec.booleanFlags ?? []).includes(name) || spec.booleanPattern?.test(token)) {
+        i++;
+        continue;
+      }
+      if (valueFlags.includes(name)) {
+        i += selfContained ? 1 : 2;
+        continue;
+      }
+      if (joinedShortFlag(valueFlags, token)) {
+        i++;
+        continue;
+      }
+      return {
+        kind: "refuse",
+        reason: `"${token}" is not a flag this classifier knows on the wrapper "${binary}", so it cannot tell which command "${binary}" would actually run. Re-run without it.`
+      };
+    }
+    if (spec.acceptsAssignments && ASSIGNMENT.test(token)) {
+      assignments.push(token);
+      i++;
+      continue;
+    }
+    if (positionals > 0) {
+      positionals--;
+      i++;
+      continue;
+    }
+    break;
+  }
+  return { kind: "command", tokens: args.slice(i), assignments };
+}
+function unwrap(seg, dialect) {
+  const wrappers = [];
+  const assignments = [...seg.assignments];
+  let current = seg;
+  while (WRAPPER_FAMILY[current.binary]) {
+    const scan = scanWrapperArgs(current.binary, WRAPPER_FAMILY[current.binary], current.args);
+    if (scan.kind === "refuse") return { seg: { ...current, assignments }, wrappers, reason: scan.reason };
+    if (scan.kind === "no-exec" || scan.tokens.length === 0) break;
+    assignments.push(...scan.assignments);
+    wrappers.push(current.binary);
+    const inner = toSegment(scan.tokens, current.piped, dialect);
+    assignments.push(...inner.assignments);
+    current = { ...inner, assignments: [], expandable: current.expandable };
+  }
+  return { seg: { ...current, assignments }, wrappers };
 }
 function lexAll(command, dialect) {
   const queue = [];
@@ -1086,6 +1240,16 @@ function refusalFor(seg) {
         return `"git ${sub} ${flag}" mutates refs. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
     }
+    const execPathFlag = seg.args.find((a) => a === "--exec-path" || a.startsWith("--exec-path="));
+    if (execPathFlag) {
+      return `"git ${execPathFlag}" redirects where git looks for its helper programs, and can make it run an arbitrary one. Use the read-only research tools, or describe the change as a task.`;
+    }
+    if (sub === "grep") {
+      const pagerFlag = seg.args.find((a) => a === "-O" || a === "--open-files-in-pager" || a.startsWith("--open-files-in-pager="));
+      if (pagerFlag) {
+        return `"git grep ${pagerFlag}" opens the results in an arbitrary named program. Use the read-only research tools, or describe the change as a task.`;
+      }
+    }
   }
   if (seg.binary === "find") {
     const flag = seg.args.find((a) => ["-exec", "-execdir", "-ok", "-okdir", "-delete"].includes(a));
@@ -1108,8 +1272,17 @@ function refusalFor(seg) {
       return `Inline code via "${seg.binary} ${seg.args.find(isInlineCodeFlag)}" is not available to the planner. Use the read-only research tools, or describe it as a task.`;
     }
   }
+  if (seg.assignments.length > 0) {
+    return `The environment assignment "${seg.assignments[0]}" decides what "${seg.binary}" actually does, and this classifier cannot judge the value. Re-run the command without the assignment.`;
+  }
   return void 0;
 }
+function withWrapperNote(reason, wrappers) {
+  if (wrappers.length === 0) return reason;
+  const quoted = wrappers.map((w) => `"${w}"`);
+  const names = quoted.length > 1 ? `${quoted.slice(0, -1).join(", ")} and ${quoted[quoted.length - 1]}` : quoted[0];
+  return `${reason} Wrapping it in ${names} does not change what runs.`;
+}
 function classifyCommand(command, opts = {}) {
   const trimmed = command.trim();
   if (!trimmed) return { tier: "refuse", scope: "", reason: "Empty command." };
@@ -1138,11 +1311,13 @@ function classifyCommand(command, opts = {}) {
     };
   }
   if (segments.length === 0) return { tier: "refuse", scope: "", reason: "No command found." };
-  for (const seg of segments) {
+  const unwrapped = segments.map((seg) => unwrap(seg, dialect));
+  for (const { seg, wrappers, reason: wrapperReason } of unwrapped) {
+    if (wrapperReason) return { tier: "refuse", scope: "", reason: wrapperReason };
     const reason = refusalFor(seg);
-    if (reason) return { tier: "refuse", scope: "", reason };
+    if (reason) return { tier: "refuse", scope: "", reason: withWrapperNote(reason, wrappers) };
   }
-  const nonAuto = segments.filter((s) => !isAuto(s));
+  const nonAuto = unwrapped.map((u) => u.seg).filter((s) => !isAuto(s));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
   const scope = [...new Set(nonAuto.map(scopeFor))].sort().join(" + ");
   return { tier: "ask", scope };
@@ -1641,14 +1816,14 @@ var PendingApprovals = class {
   ask(request) {
     const id = `ap-${Date.now()}-${counter++}`;
     const pending = { id, request, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const settle = (granted) => {
         const entry = this.entries.get(id);
         if (!entry) return;
         clearTimeout(entry.timer);
         this.entries.delete(id);
         this.opts.onSettled?.(id, granted);
-        resolve3(granted);
+        resolve4(granted);
       };
       const timer = setTimeout(() => settle(false), this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
       timer.unref?.();
@@ -4558,9 +4733,9 @@ function summarizeToolCall(tool, argsJson, toolLabel) {
       const scope = args.include ? ` in ${args.include}` : "";
       return `grep ${ellipsize(String(args.pattern), 40)}${scope}${mode}`;
     }
-    const path15 = args.filePath || args.file_path || args.path;
-    if (path15) {
-      const basename = String(path15).split("/").pop() || String(path15);
+    const path17 = args.filePath || args.file_path || args.path;
+    if (path17) {
+      const basename = String(path17).split("/").pop() || String(path17);
       return `${display} ${basename}`;
     }
     if (args.pattern) {
@@ -7221,28 +7396,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join14 = (...parts) => path5.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join14(base, ...parts)] : [];
+  const join16 = (...parts) => path5.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join16(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join14(home, ".local", "bin"),
-    join14(home, ".opencode", "bin"),
-    join14(home, ".claude", "bin"),
-    join14(home, ".codex", "bin"),
+    join16(home, ".local", "bin"),
+    join16(home, ".opencode", "bin"),
+    join16(home, ".claude", "bin"),
+    join16(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join14(home, "AppData", "Roaming", "npm"),
+    join16(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join14(home, ".bun", "bin"),
+    join16(home, ".bun", "bin"),
     // Windows package managers.
-    join14(home, "scoop", "shims"),
+    join16(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -7252,7 +7427,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join14(home, ".volta", "bin")
+    join16(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -7553,7 +7728,7 @@ var defaultAppServerClient = async (command, args, options) => {
   const PATH = await augmentedPath();
   const launch = await planDirectLaunch(command, args).catch(() => null);
   if (!launch) return null;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let child;
     try {
       child = (0, import_child_process3.spawn)(launch.file, launch.args, {
@@ -7562,7 +7737,7 @@ var defaultAppServerClient = async (command, args, options) => {
         windowsVerbatimArguments: launch.verbatim
       });
     } catch {
-      resolve3(null);
+      resolve4(null);
       return;
     }
     let settled = false;
@@ -7571,7 +7746,7 @@ var defaultAppServerClient = async (command, args, options) => {
       settled = true;
       clearTimeout(timer);
       killTree(child);
-      resolve3(value);
+      resolve4(value);
     };
     const timer = setTimeout(() => finish(null), options?.timeout ?? 2e4);
     child.on("error", () => finish(null));
@@ -8611,11 +8786,71 @@ var RunnerInstallation = class {
   }
 };
 
+// src/services/settingsEnvAllowlist.ts
+var ORDEWELL_SETTABLE_ENV = [
+  "AI_PROVIDER",
+  "ORCHESTRATOR_MODEL",
+  "ORDEWELL_SUBAGENT_MODEL",
+  "ORDEWELL_PLANNER_EFFORT",
+  "ORDEWELL_RESEARCH_ENABLED",
+  "ORDEWELL_MAX_PARALLEL"
+];
+var SETTINGS_ENV_REFUSED = [
+  // Approval posture and pre-approved scope.
+  "ORDEWELL_AUTONOMOUS_MODE",
+  "ORDEWELL_APPROVAL_MODE",
+  "ORDEWELL_APPROVAL_ALLOW",
+  // Where settings are persisted.
+  "ORDEWELL_SETTINGS_PATH",
+  // Runtime options and dynamic loaders.
+  "NODE_OPTIONS",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "NODE_PATH",
+  "ELECTRON_RUN_AS_NODE",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FRAMEWORK_PATH",
+  // Executable resolution.
+  "PATH",
+  "PATHEXT",
+  "NODE"
+];
+var REFUSED = new Set(SETTINGS_ENV_REFUSED);
+function providerEnvKeys() {
+  const keys = [];
+  for (const meta of Object.values(ALL_PROVIDERS)) {
+    if (meta.apiKeyEnvVar) keys.push(meta.apiKeyEnvVar);
+    if (meta.baseUrlEnvVar) keys.push(meta.baseUrlEnvVar);
+    for (const detect of meta.detectEnvVars) keys.push(detect);
+  }
+  return keys;
+}
+var PROVIDER_CREDENTIAL_ENV = new Set(providerEnvKeys());
+var SETTINGS_ENV_ALLOWLIST = new Set(
+  [...providerEnvKeys(), ...ORDEWELL_SETTABLE_ENV].filter((key) => !REFUSED.has(key))
+);
+function admitSettingsEnv(env) {
+  const accepted = {};
+  const rejected = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (REFUSED.has(key) || !SETTINGS_ENV_ALLOWLIST.has(key) || typeof value !== "string") {
+      rejected.push(key);
+      continue;
+    }
+    accepted[key] = value;
+  }
+  return { accepted, rejected };
+}
+
 // src/services/harness/CliAgentAiService.ts
 var import_child_process5 = require("child_process");
 
 // src/utils/workspace.ts
 var fs3 = __toESM(require("fs"));
+var path9 = __toESM(require("path"));
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -8635,6 +8870,46 @@ function assertWorkspaceExists(workspace, deps = {}) {
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
   if (!isDirectory(workspace)) throw new WorkspaceNotFoundError(workspace);
 }
+var WorkspaceNotAProjectError = class extends Error {
+  constructor(workspace) {
+    super(`Workspace "${workspace}" is not a project directory (no .ordewell state, version control, or recognized manifest found).`);
+    this.workspace = workspace;
+    this.name = "WorkspaceNotAProjectError";
+  }
+  workspace;
+};
+var PROJECT_MARKER_DIRS = [".ordewell", ".git", ".hg", ".svn", ".bzr"];
+var PROJECT_MARKER_FILES = [
+  "package.json",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "setup.py",
+  "requirements.txt",
+  "Pipfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "Gemfile",
+  "composer.json",
+  "pubspec.yaml",
+  "mix.exs",
+  "CMakeLists.txt"
+];
+function assertWorkspaceIsProject(workspace, deps = {}) {
+  const realpath = deps.realpath ?? ((candidate) => fs3.realpathSync(candidate));
+  const exists = deps.exists ?? ((candidate) => fs3.existsSync(candidate));
+  let resolved;
+  try {
+    resolved = realpath(workspace);
+  } catch {
+    throw new WorkspaceNotAProjectError(workspace);
+  }
+  const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
+    (marker) => exists(path9.join(resolved, marker))
+  );
+  if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
+}
 
 // src/services/harness/AgentAdapter.ts
 var LineBuffer = class {
@@ -8690,8 +8965,8 @@ var StdioAgentAdapter = class {
   }
   async start(opts) {
     assertWorkspaceExists(opts.cwd, { isDirectory: this.deps.isDirectory });
-    this.processEnded = new Promise((resolve3) => {
-      this.markEnded = resolve3;
+    this.processEnded = new Promise((resolve4) => {
+      this.markEnded = resolve4;
     });
     const spec = this.spawnSpec(opts);
     const resolvePath = this.deps.resolvePath ?? augmentedPath;
@@ -8739,7 +9014,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
       onEvent({ type: "error", message: this.exitMessage() });
       return;
     }
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       let settled = false;
       const finish = () => {
         if (settled) return;
@@ -8748,7 +9023,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
         signal?.removeEventListener("abort", onAbort);
         this.process?.removeListener("exit", onExit);
         this.process?.removeListener("error", onExit);
-        resolve3();
+        resolve4();
       };
       const emit = (event) => {
         onEvent(event);
@@ -8949,14 +9224,14 @@ function codexSandboxUnavailableMessage() {
   ].join("\n");
 }
 function runProbe(deps, cwd, env, flags) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let output = "";
     let settled = false;
     const finish = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve3({ code, output });
+      resolve4({ code, output });
     };
     const timer = setTimeout(() => finish(null), PROBE_TIMEOUT_MS);
     timer.unref?.();
@@ -9039,8 +9314,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
   async handshake(opts) {
     this.sandbox = await probeCodexSandbox(this.deps, opts.cwd, this.spawnEnv);
     if (this.sandbox === "unavailable") throw new Error(codexSandboxUnavailableMessage());
-    const ready = new Promise((resolve3) => {
-      this.settleHandshake = resolve3;
+    const ready = new Promise((resolve4) => {
+      this.settleHandshake = resolve4;
     });
     this.writeLine({
       jsonrpc: "2.0",
@@ -9053,8 +9328,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
       // A binary that rejects `app-server` outright dies immediately; waiting
       // out the timeout would turn a one-line diagnostic into a 30s stall.
       this.processEnded.then(() => false),
-      new Promise((resolve3) => {
-        const t = setTimeout(() => resolve3(false), HANDSHAKE_TIMEOUT_MS);
+      new Promise((resolve4) => {
+        const t = setTimeout(() => resolve4(false), HANDSHAKE_TIMEOUT_MS);
         t.unref?.();
       })
     ]);
@@ -9342,12 +9617,12 @@ var OpenCodeAdapter = class {
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
     });
-    const banner = new Promise((resolve3) => {
+    const banner = new Promise((resolve4) => {
       let seen = "";
       const scan = (chunk) => {
         seen += chunk.toString();
         const match = seen.match(/https?:\/\/[^\s]+/);
-        if (match) resolve3(match[0].replace(/[.,)]$/, ""));
+        if (match) resolve4(match[0].replace(/[.,)]$/, ""));
       };
       this.process.stdout?.on("data", scan);
       this.process.stderr?.on("data", (chunk) => {
@@ -9356,15 +9631,15 @@ var OpenCodeAdapter = class {
       });
       this.process.on("exit", () => {
         this.exited = true;
-        resolve3(null);
+        resolve4(null);
       });
       this.process.on("error", (err) => {
         this.exited = true;
         this.stderrTail = (this.stderrTail + `
 ${err.message}`).slice(-STDERR_TAIL_CHARS2);
-        resolve3(null);
+        resolve4(null);
       });
-      const timer = setTimeout(() => resolve3(null), SERVER_READY_TIMEOUT_MS);
+      const timer = setTimeout(() => resolve4(null), SERVER_READY_TIMEOUT_MS);
       timer.unref?.();
     });
     this.baseUrl = await banner;
@@ -9394,8 +9669,8 @@ ${this.stderrTail.trim()}` : ""}`);
     const streamAbort = new AbortController();
     let connected = () => {
     };
-    const streamReady = new Promise((resolve3) => {
-      connected = resolve3;
+    const streamReady = new Promise((resolve4) => {
+      connected = resolve4;
     });
     const live = this.streamEvents(
       streamAbort.signal,
@@ -9547,14 +9822,14 @@ ${this.stderrTail.trim()}` : ""}`);
       }
     }
   }
-  async json(method, path15, body, signal) {
-    const response = await this.deps.fetch(`${this.baseUrl}${path15}`, {
+  async json(method, path17, body, signal) {
+    const response = await this.deps.fetch(`${this.baseUrl}${path17}`, {
       method,
       headers: { "content-type": "application/json" },
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
       ...signal ? { signal } : {}
     });
-    if (!response.ok) throw new Error(`${method} ${path15} failed: ${response.status} ${response.statusText}`);
+    if (!response.ok) throw new Error(`${method} ${path17} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   nativeSessionId() {
@@ -10368,11 +10643,11 @@ function executionSummary(tasks) {
 
 // src/utils/sessionStore.ts
 var fs5 = __toESM(require("fs"));
-var path10 = __toESM(require("path"));
+var path11 = __toESM(require("path"));
 
 // src/utils/fsHelpers.ts
 var fs4 = __toESM(require("fs"));
-var path9 = __toESM(require("path"));
+var path10 = __toESM(require("path"));
 var STATE_DIR = ".ordewell";
 function ensureDir(dir) {
   if (!fs4.existsSync(dir)) {
@@ -10380,13 +10655,19 @@ function ensureDir(dir) {
   }
 }
 function getStateDir(baseDir) {
-  return path9.join(baseDir ?? process.cwd(), STATE_DIR);
+  return path10.join(baseDir ?? process.cwd(), STATE_DIR);
+}
+
+// src/utils/sessionId.ts
+var import_crypto = require("crypto");
+function mintSessionId() {
+  return `session-${(0, import_crypto.randomBytes)(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path10.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path11.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function hasScalarRunner(parsed) {
@@ -10407,7 +10688,7 @@ function saveSession(plan, goal, baseDir, id) {
   ensureDir(sessionsDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const meta = {
-    id: id || `session-${Date.now()}`,
+    id: id || mintSessionId(),
     goal: goal || "(untitled)",
     runners: plan.runners,
     taskCount: plan.tasks.flatMap((t) => [t, ...t.subtasks || []]).length,
@@ -10420,7 +10701,7 @@ function saveSession(plan, goal, baseDir, id) {
     plan: JSON.parse(JSON.stringify(plan))
   };
   const filename = sessionFilename(meta);
-  const filePath = path10.join(sessionsDir, filename);
+  const filePath = path11.join(sessionsDir, filename);
   fs5.writeFileSync(filePath, JSON.stringify(session, null, 2));
   return meta;
 }
@@ -10430,7 +10711,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   return files.map((f) => {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${f}: ${REJECTION_MESSAGE}`);
@@ -10448,7 +10729,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -10463,7 +10744,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, file), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -10497,7 +10778,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs5.unlinkSync(path10.join(sessionsDir, file));
+      fs5.unlinkSync(path11.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -10516,11 +10797,6 @@ var PlanEditError = class extends Error {
 function sessionRuntimeSettings(settings) {
   return { ...plannerRuntimeToggles(settings), modelAllowlist: settings.modelAllowlist };
 }
-var lastMintedAt = 0;
-function mintSessionId() {
-  lastMintedAt = Math.max(Date.now(), lastMintedAt + 1);
-  return `session-${lastMintedAt}`;
-}
 var Session = class {
   /** Injected by a test; when present it is the service, forever. */
   pinnedAiService;
@@ -12318,26 +12594,128 @@ var TmuxRunner = class extends AbstractRunner {
   }
 };
 
+// src/utils/daemonToken.ts
+var import_crypto2 = require("crypto");
+var import_fs2 = require("fs");
+var import_os2 = require("os");
+var import_path2 = require("path");
+var BEARER_PREFIX = "bearer ";
+var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+var DAEMON_SUBPROTOCOL = "ordewell.v1";
+function configDir() {
+  return (0, import_path2.join)((0, import_os2.homedir)(), ".config", "ordewell");
+}
+function daemonTokenPath(port) {
+  return (0, import_path2.join)(configDir(), `server-${port}.token`);
+}
+function mintDaemonToken(port) {
+  const token = (0, import_crypto2.randomBytes)(32).toString("base64url");
+  const file = daemonTokenPath(port);
+  (0, import_fs2.mkdirSync)(configDir(), { recursive: true });
+  try {
+    (0, import_fs2.unlinkSync)(file);
+  } catch {
+  }
+  const fd = (0, import_fs2.openSync)(file, "wx", 384);
+  try {
+    (0, import_fs2.writeSync)(fd, token);
+  } finally {
+    (0, import_fs2.closeSync)(fd);
+  }
+  return { token, file };
+}
+function readDaemonToken(port) {
+  try {
+    const token = (0, import_fs2.readFileSync)(daemonTokenPath(port), "utf8").trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+function clearDaemonToken(port) {
+  try {
+    (0, import_fs2.unlinkSync)(daemonTokenPath(port));
+  } catch {
+  }
+}
+function bearerHeaderValue(token) {
+  return `Bearer ${token}`;
+}
+function tokenSubprotocols(token) {
+  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
+}
+function extractPresentedToken(carriers) {
+  const authorization = carriers.authorization;
+  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
+    const value = authorization.slice(BEARER_PREFIX.length).trim();
+    if (value !== "") return value;
+  }
+  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
+    const value = offered.trim();
+    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
+    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
+    if (token !== "") return token;
+  }
+  return void 0;
+}
+function tokensMatch(presented, expected) {
+  if (presented === void 0) return false;
+  const a = Buffer.from(presented, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return (0, import_crypto2.timingSafeEqual)(a, b);
+}
+
 // src/plugins/RunnerRegistry.ts
 var fs7 = __toESM(require("fs"));
-var path12 = __toESM(require("path"));
+var path14 = __toESM(require("path"));
 var os5 = __toESM(require("os"));
 var import_child_process9 = require("child_process");
+var import_crypto3 = require("crypto");
 
 // src/plugins/FsPluginStore.ts
 var fs6 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
+var path13 = __toESM(require("path"));
 var os4 = __toESM(require("os"));
-function userPluginsDir() {
-  return path11.join(os4.homedir(), ".config", "ordewell", "plugins");
+
+// src/plugins/pluginNames.ts
+var path12 = __toESM(require("path"));
+var PLUGIN_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var MAX_PLUGIN_NAME_LENGTH = 64;
+function isPlainPluginName(name) {
+  return typeof name === "string" && name.length <= MAX_PLUGIN_NAME_LENGTH && PLUGIN_NAME_PATTERN.test(name);
+}
+function assertPlainPluginName(name) {
+  if (!isPlainPluginName(name)) {
+    throw new Error(
+      `Invalid plugin name: ${JSON.stringify(name)}. Names must be a single plain segment of letters, digits, '.', '-' or '_' (max ${MAX_PLUGIN_NAME_LENGTH} characters).`
+    );
+  }
 }
+function resolvePluginInstallDir(pluginsDir, name) {
+  assertPlainPluginName(name);
+  const root = path12.resolve(pluginsDir);
+  const dest = path12.resolve(root, name);
+  const relative3 = path12.relative(root, dest);
+  if (relative3 !== name || relative3 === "" || path12.isAbsolute(relative3)) {
+    throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
+  }
+  return dest;
+}
+
+// src/plugins/manifestValidation.ts
 function isValidManifest(obj) {
   if (!obj || typeof obj !== "object") return false;
   const m = obj;
-  return typeof m.name === "string" && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+  return isPlainPluginName(m.name) && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+}
+
+// src/plugins/FsPluginStore.ts
+function userPluginsDir() {
+  return path13.join(os4.homedir(), ".config", "ordewell", "plugins");
 }
 function loadManifestFromDir(dir) {
-  const manifestPath = path11.join(dir, "manifest.json");
+  const manifestPath = path13.join(dir, "manifest.json");
   if (!fs6.existsSync(manifestPath)) return null;
   try {
     const raw = fs6.readFileSync(manifestPath, "utf8");
@@ -12352,8 +12730,8 @@ function copyDirSync(src, dest) {
   ensureDir(dest);
   const entries = fs6.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path11.join(src, entry.name);
-    const destPath = path11.join(dest, entry.name);
+    const srcPath = path13.join(src, entry.name);
+    const destPath = path13.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
@@ -12365,7 +12743,7 @@ function rmDirSync(dir) {
   if (!fs6.existsSync(dir)) return;
   const entries = fs6.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const p = path11.join(dir, entry.name);
+    const p = path13.join(dir, entry.name);
     if (entry.isDirectory()) {
       rmDirSync(p);
     } else {
@@ -12389,6 +12767,13 @@ var FsPluginStore = class {
     }
     return entries.filter((e) => e.isDirectory()).map((e) => e.name);
   }
+  listDir(dir) {
+    try {
+      return fs6.readdirSync(dir);
+    } catch {
+      return [];
+    }
+  }
   loadManifest(pluginDir) {
     return loadManifestFromDir(pluginDir);
   }
@@ -12411,11 +12796,11 @@ var FsPluginStore = class {
       return null;
     }
   }
-  dirExists(path15) {
-    return fs6.existsSync(path15) && fs6.statSync(path15).isDirectory();
+  dirExists(path17) {
+    return fs6.existsSync(path17) && fs6.statSync(path17).isDirectory();
   }
-  exists(path15) {
-    return fs6.existsSync(path15);
+  exists(path17) {
+    return fs6.existsSync(path17);
   }
 };
 
@@ -12703,17 +13088,98 @@ var OPENCODE_MANIFEST = {
   ]
 };
 
+// src/plugins/pluginSource.ts
+var ALLOWED_PLUGIN_HOSTS = [
+  "github.com",
+  "gitlab.com",
+  "bitbucket.org",
+  "codeberg.org"
+];
+var SAFE_REPO_PATH = /^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/;
+var HAS_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]+:/;
+var SCP_LIKE_REMOTE = /^[^/\\]+@[^/\\]+:/;
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function assertInstallablePluginUrl(url) {
+  if (typeof url !== "string" || url.trim() === "") {
+    throw new Error("A plugin repository URL is required.");
+  }
+  if (hasControlCharacter(url)) {
+    throw new Error("Plugin URL contains control characters.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    throw new Error(`Not a valid plugin repository URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `Plugin repositories must be cloned over https (got "${parsed.protocol}//"). git transport helpers and non-https schemes are not accepted.`
+    );
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("Plugin URL must not embed credentials.");
+  }
+  if (parsed.port) {
+    throw new Error("Plugin URL must not specify a port.");
+  }
+  if (parsed.search || parsed.hash) {
+    throw new Error("Plugin URL must not carry a query string or fragment.");
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_PLUGIN_HOSTS.includes(host)) {
+    throw new Error(
+      `Plugin host not allowed: ${host}. Allowed hosts: ${ALLOWED_PLUGIN_HOSTS.join(", ")}.`
+    );
+  }
+  if (!SAFE_REPO_PATH.test(parsed.pathname)) {
+    throw new Error(`Not a plain repository path: ${parsed.pathname}`);
+  }
+  return parsed;
+}
+function classifyPluginSource(source) {
+  const trimmed = source.trim();
+  if (trimmed.startsWith("github:")) {
+    const repo = trimmed.slice("github:".length).replace(/\.git$/, "");
+    return { kind: "git", url: `https://github.com/${repo}.git` };
+  }
+  if (HAS_SCHEME.test(trimmed) || SCP_LIKE_REMOTE.test(trimmed)) {
+    return { kind: "git", url: trimmed };
+  }
+  return { kind: "path", path: source };
+}
+
 // src/plugins/RunnerRegistry.ts
 var BUILTIN_MANIFESTS = [
   CLAUDE_CODE_MANIFEST,
   CODEX_MANIFEST,
   OPENCODE_MANIFEST
 ];
+var RESERVED_RUNNER_NAMES = new Set(BUILTIN_MANIFESTS.map((m) => m.name.toLowerCase()));
+function isReservedRunnerName(name) {
+  return RESERVED_RUNNER_NAMES.has(name.toLowerCase());
+}
+function gitClone(url, destDir) {
+  (0, import_child_process9.execFileSync)("git", ["clone", "--depth", "1", "--", url, destDir], {
+    stdio: "pipe",
+    timeout: 3e4,
+    // A repository that demands credentials should fail, not hang on a prompt.
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+}
 var RunnerRegistry = class {
   plugins = /* @__PURE__ */ new Map();
   store;
-  constructor(store) {
+  clone;
+  constructor(store, clone) {
     this.store = store ?? new FsPluginStore();
+    this.clone = clone ?? gitClone;
     this.loadBuiltins();
   }
   loadBuiltins() {
@@ -12724,9 +13190,15 @@ var RunnerRegistry = class {
   loadUserPlugins() {
     const names = this.store.listUserPluginDirs();
     for (const name of names) {
-      const pluginDir = path12.join(this.store.getUserPluginsDir(), name);
+      let pluginDir;
+      try {
+        pluginDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), name);
+      } catch {
+        continue;
+      }
       const manifest = this.store.loadManifest(pluginDir);
-      if (!manifest) continue;
+      if (!manifest || !isPlainPluginName(manifest.name)) continue;
+      if (isReservedRunnerName(manifest.name)) continue;
       this.plugins.set(manifest.name, {
         manifest,
         source: "user",
@@ -12755,7 +13227,7 @@ var RunnerRegistry = class {
     return entry?.source === "builtin";
   }
   installFromPath(sourcePath) {
-    const absPath = path12.resolve(sourcePath);
+    const absPath = path14.resolve(sourcePath);
     if (!this.store.dirExists(absPath)) {
       throw new Error(`Plugin source must be a directory: ${absPath}`);
     }
@@ -12763,48 +13235,50 @@ var RunnerRegistry = class {
     if (!manifest) {
       throw new Error(`No valid manifest.json found in: ${absPath}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
-    this.store.ensureDir(destDir);
-    this.store.copyDir(absPath, destDir);
-    this.plugins.set(manifest.name, {
-      manifest,
-      source: "user",
-      installPath: destDir
-    });
-    return manifest;
+    return this.registerInstalled(manifest, absPath);
   }
   installFromGit(url) {
-    const repoName = url.split("/").pop()?.replace(/\.git$/, "") || "plugin";
-    const tmpDir = path12.join(os5.tmpdir(), `ordewell-plugin-${Date.now()}`);
+    const validated = assertInstallablePluginUrl(url);
+    const tmpDir = path14.join(os5.tmpdir(), `ordewell-plugin-${(0, import_crypto3.randomBytes)(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
-      (0, import_child_process9.execSync)(`git clone --depth 1 "${url}" "${tmpDir}"`, { stdio: "pipe", timeout: 3e4 });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(`Failed to clone repository: ${message}`);
-    }
-    const contents = fsReaddirSync(tmpDir);
-    const hasManifest = contents.some((f) => f === "manifest.json");
-    if (!hasManifest && contents.length === 1 && this.store.dirExists(path12.join(tmpDir, contents[0]))) {
-      const subDir = path12.join(tmpDir, contents[0]);
-      return this.finishInstall(subDir, repoName, tmpDir);
-    }
-    if (!hasManifest) {
+      try {
+        this.clone(validated.toString(), tmpDir);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to clone repository: ${message}`);
+      }
+      const contents = this.store.listDir(tmpDir);
+      const hasManifest = contents.some((f) => f === "manifest.json");
+      let sourceDir = tmpDir;
+      if (!hasManifest) {
+        const onlyEntry = contents.length === 1 ? path14.join(tmpDir, contents[0]) : void 0;
+        if (!onlyEntry || !this.store.dirExists(onlyEntry)) {
+          throw new Error(`No manifest.json found in repository: ${validated.toString()}`);
+        }
+        sourceDir = onlyEntry;
+      }
+      const manifest = this.store.loadManifest(sourceDir);
+      if (!manifest) {
+        throw new Error("No valid manifest.json found in cloned repository");
+      }
+      return this.registerInstalled(manifest, sourceDir);
+    } finally {
       this.store.removeDir(tmpDir);
-      throw new Error(`No manifest.json found in repository: ${url}`);
     }
-    return this.finishInstall(tmpDir, repoName, tmpDir);
   }
-  finishInstall(sourceDir, repoName, tmpDir) {
-    const manifest = this.store.loadManifest(sourceDir);
-    if (!manifest) {
-      this.store.removeDir(tmpDir);
-      throw new Error(`No valid manifest.json found in cloned repository`);
+  /**
+   * The single destination-building step both install routes share: the name is
+   * constrained to a plain segment and the resolved destination is asserted to
+   * be inside the plugins directory before anything is copied.
+   */
+  registerInstalled(manifest, sourceDir) {
+    if (isReservedRunnerName(manifest.name)) {
+      throw new Error(`Cannot install a plugin named after a built-in runner: ${manifest.name}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
+    const destDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), manifest.name);
     this.store.ensureDir(destDir);
     this.store.copyDir(sourceDir, destDir);
-    this.store.removeDir(tmpDir);
     this.plugins.set(manifest.name, {
       manifest,
       source: "user",
@@ -12825,7 +13299,8 @@ var RunnerRegistry = class {
     this.plugins.delete(name);
   }
   createSkeleton(name, outputDir) {
-    const dir = path12.resolve(outputDir, name);
+    assertPlainPluginName(name);
+    const dir = path14.resolve(outputDir, name);
     this.store.ensureDir(dir);
     const manifest = {
       name,
@@ -12857,8 +13332,8 @@ var RunnerRegistry = class {
         ]
       }
     };
-    this.store.writeFile(path12.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
-    const runSh = path12.join(dir, "run.sh");
+    this.store.writeFile(path14.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+    const runSh = path14.join(dir, "run.sh");
     const scriptContent = `#!/usr/bin/env bash
 # Custom runner script for ${name}
 # Receives:
@@ -12882,13 +13357,6 @@ echo "Running ${name} with prompt: $prompt"
     return dir;
   }
 };
-function fsReaddirSync(dir) {
-  try {
-    return fs7.readdirSync(dir);
-  } catch {
-    return [];
-  }
-}
 function fsChmodSync(fpath, mode) {
   try {
     fs7.chmodSync(fpath, mode);
@@ -12898,14 +13366,14 @@ function fsChmodSync(fpath, mode) {
 
 // src/utils/stateStore.ts
 var fs8 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
+var path15 = __toESM(require("path"));
 var STATE_FILE = "state.json";
 function getStatePath(baseDir) {
-  return path13.join(getStateDir(baseDir), STATE_FILE);
+  return path15.join(getStateDir(baseDir), STATE_FILE);
 }
 function saveState(plan, baseDir) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path13.dirname(statePath));
+  ensureDir(path15.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   fs8.writeFileSync(statePath, JSON.stringify(plan, null, 2));
 }
@@ -12938,7 +13406,7 @@ function stateExists(baseDir) {
 
 // src/services/SettingsService.ts
 var fs9 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var path16 = __toESM(require("path"));
 var os6 = __toESM(require("os"));
 var DEFAULTS = {
   grillMe: { enabled: false },
@@ -12951,7 +13419,7 @@ var DEFAULTS = {
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path14.join(os6.homedir(), ".config", "ordewell", "settings.json");
+  return path16.join(os6.homedir(), ".config", "ordewell", "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -13116,7 +13584,7 @@ var SettingsService = class {
     return { ...DEFAULTS, grillMe: { ...DEFAULTS.grillMe }, tdd: { ...DEFAULTS.tdd }, prd: { ...DEFAULTS.prd }, review: { ...DEFAULTS.review }, verification: { ...DEFAULTS.verification }, researchSubagents: { ...DEFAULTS.researchSubagents } };
   }
   persist() {
-    const dir = path14.dirname(this.filePath);
+    const dir = path16.dirname(this.filePath);
     if (!fs9.existsSync(dir)) {
       fs9.mkdirSync(dir, { recursive: true });
     }
@@ -13161,6 +13629,7 @@ var PlannerModelMemory = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ALLOWED_PLUGIN_HOSTS,
   ALL_PROVIDERS,
   AUTO_COMMANDS,
   AbstractRunner,
@@ -13179,6 +13648,8 @@ var PlannerModelMemory = class {
   CommandLineTooLongError,
   ConsoleLogger,
   ContextCollector,
+  DAEMON_SUBPROTOCOL,
+  DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DENY_ALL,
   EmbeddedNewlineError,
   EnvConfig,
@@ -13195,9 +13666,12 @@ var PlannerModelMemory = class {
   ModelResolver,
   OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_SETTABLE_ENV,
   OpenAiService,
   OpenCodeAdapter,
   PLAN_ENVELOPE_KEY,
+  PLUGIN_NAME_PATTERN,
+  PROVIDER_CREDENTIAL_ENV,
   PROVIDER_DETECT_PRIORITY,
   PROVIDER_LABEL,
   PROVIDER_PRIORITY,
@@ -13212,6 +13686,8 @@ var PlannerModelMemory = class {
   RunnerInstallation,
   RunnerRegistry,
   SEARCH_EXCLUSIONS,
+  SETTINGS_ENV_ALLOWLIST,
+  SETTINGS_ENV_REFUSED,
   STATE_DIR,
   STOPPED_TOOL_RESULT,
   SYMBOL_LANGUAGES,
@@ -13224,13 +13700,19 @@ var PlannerModelMemory = class {
   TmuxRunner,
   VerdictEngine,
   WINDOWS_MAX_COMMAND_LINE,
+  WorkspaceNotAProjectError,
   WorkspaceNotFoundError,
   addTaskToPlan,
+  admitSettingsEnv,
   applyHeadLimit,
   applyTaskOps,
+  assertInstallablePluginUrl,
+  assertPlainPluginName,
   assertWorkspaceExists,
+  assertWorkspaceIsProject,
   augmentPromptWithPriorOutputs,
   augmentedPath,
+  bearerHeaderValue,
   buildConversationSystemPrompt,
   buildFallbackGrepArgs,
   buildGlobArgs,
@@ -13258,7 +13740,9 @@ var PlannerModelMemory = class {
   classifyCommand,
   classifyOutcome,
   classifyPlannerReply,
+  classifyPluginSource,
   clearAugmentedPathCache,
+  clearDaemonToken,
   clearResearchShellCache,
   clearState,
   clipboardCopyCommand,
@@ -13270,6 +13754,7 @@ var PlannerModelMemory = class {
   createAiService,
   createEmptyPlan,
   createTask,
+  daemonTokenPath,
   defaultLogger,
   definitionPattern,
   deleteSession,
@@ -13287,6 +13772,7 @@ var PlannerModelMemory = class {
   extractObjectWithBalance,
   extractObjectsWithKey,
   extractPrdBlock,
+  extractPresentedToken,
   fetchAllProviderModels,
   filterFallbackByAnchoredInclude,
   filterModelsForPrompt,
@@ -13304,6 +13790,9 @@ var PlannerModelMemory = class {
   isCliProvider,
   isExecutableResolved,
   isOpenAiProvider,
+  isPlainPluginName,
+  isReservedRunnerName,
+  isValidManifest,
   killTree,
   knownModelId,
   languageForId,
@@ -13316,6 +13805,8 @@ var PlannerModelMemory = class {
   migrateLegacyPlan,
   migratePlanState,
   migrateTask,
+  mintDaemonToken,
+  mintSessionId,
   modelContextBlock,
   modifyValidationFeedback,
   normalizeAgentArgs,
@@ -13331,6 +13822,7 @@ var PlannerModelMemory = class {
   providerForRunner,
   reEmitPlanPrompt,
   reEmitTaskOpsPrompt,
+  readDaemonToken,
   referencePattern,
   removeTaskFromPlan,
   renderPlanMap,
@@ -13342,6 +13834,7 @@ var PlannerModelMemory = class {
   resolveArgs,
   resolveDefaultMode,
   resolveModelShortcut,
+  resolvePluginInstallDir,
   resolveProvider,
   resolveProviderFromPrefix,
   resolveResearchShell,
@@ -13372,6 +13865,8 @@ var PlannerModelMemory = class {
   tmuxSocketName,
   tmuxWindowName,
   toOrchestratorOptions,
+  tokenSubprotocols,
+  tokensMatch,
   truncatedPlanReEmitPrompt,
   updateTaskInPlan,
   validateModifiedPlan,