@ordewell/core 0.4.7 → 0.4.8

package/dist/index.mjs

@@ -108,7 +108,6 @@ var AUTO_COMMANDS = [
   "pwd",
   "which",
   "type",
-  "env",
   "uname",
   "whoami",
   "cut",
@@ -309,6 +308,52 @@ var MULTIPLEXERS = [
   "flutter",
   "dart"
 ];
+var HELP_FLAGS = ["--help", "--version"];
+var WRAPPER_FAMILY = {
+  env: {
+    valueFlags: ["-u", "--unset", "-C", "--chdir"],
+    booleanFlags: [
+      "-i",
+      "--ignore-environment",
+      "-0",
+      "--null",
+      "-v",
+      "--debug",
+      // Optional-value flags: see WrapperSpec.booleanFlags.
+      "--block-signal",
+      "--default-signal",
+      "--ignore-signal",
+      "--list-signal-handling",
+      ...HELP_FLAGS
+    ],
+    stringFlags: ["-S", "--split-string"],
+    acceptsAssignments: true
+  },
+  nice: {
+    valueFlags: ["-n", "--adjustment"],
+    booleanFlags: HELP_FLAGS,
+    booleanPattern: /^-\d+$/
+  },
+  timeout: {
+    valueFlags: ["-s", "--signal", "-k", "--kill-after"],
+    booleanFlags: ["--preserve-status", "--foreground", "-v", "--verbose", ...HELP_FLAGS],
+    positionals: 1
+  },
+  nohup: { booleanFlags: HELP_FLAGS },
+  setsid: { booleanFlags: ["-c", "--ctty", "-f", "--fork", "-w", "--wait", "-h", "-V", ...HELP_FLAGS] },
+  stdbuf: {
+    valueFlags: ["-i", "--input", "-o", "--output", "-e", "--error"],
+    booleanFlags: HELP_FLAGS
+  },
+  ionice: {
+    valueFlags: ["-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid", "-u", "--uid"],
+    booleanFlags: ["-t", "--ignore", "-h", "-V", ...HELP_FLAGS]
+  },
+  // The multi-call binary ships its own `rm`, `mv` and `sh`, so the refused
+  // name arrives as its first argument.
+  busybox: { booleanFlags: ["--list", "--install", ...HELP_FLAGS] },
+  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] }
+};
 var POSIX_DIALECT = {
   escape: "\\",
   escapeInQuotes: true,
@@ -523,10 +568,92 @@ function binaryName(token, dialect) {
   if (dot <= 0) return base;
   return dialect.strippedExtensions.includes(base.slice(dot).toLowerCase()) ? base.slice(0, dot) : base;
 }
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function toSegment(tokens, piped, dialect) {
   const rest = [...tokens];
-  while (rest.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest[0])) rest.shift();
-  return { binary: rest.length > 0 ? binaryName(rest[0], dialect) : "", args: rest.slice(1), piped, expandable: false };
+  const assignments = [];
+  while (rest.length > 0 && ASSIGNMENT.test(rest[0])) assignments.push(rest.shift());
+  return {
+    binary: rest.length > 0 ? binaryName(rest[0], dialect) : "",
+    args: rest.slice(1),
+    assignments,
+    piped,
+    expandable: false
+  };
+}
+function joinedShortFlag(list, token) {
+  if (token.length <= 2) return void 0;
+  return list.find((f) => f.length === 2 && token.startsWith(f));
+}
+function scanWrapperArgs(binary, spec, args) {
+  const valueFlags = spec.valueFlags ?? [];
+  const stringFlags = spec.stringFlags ?? [];
+  const assignments = [];
+  let positionals = spec.positionals ?? 0;
+  let i = 0;
+  while (i < args.length) {
+    const token = args[i];
+    if (token === "--") {
+      i++;
+      break;
+    }
+    if (/^-./.test(token)) {
+      const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+      const name = eq > 0 ? token.slice(0, eq) : token;
+      const selfContained = eq > 0;
+      if ((spec.noExecFlags ?? []).includes(name)) return { kind: "no-exec" };
+      if (stringFlags.includes(name) || joinedShortFlag(stringFlags, token)) {
+        return {
+          kind: "refuse",
+          reason: `"${binary} ${name}" splits a string into a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`
+        };
+      }
+      if ((spec.booleanFlags ?? []).includes(name) || spec.booleanPattern?.test(token)) {
+        i++;
+        continue;
+      }
+      if (valueFlags.includes(name)) {
+        i += selfContained ? 1 : 2;
+        continue;
+      }
+      if (joinedShortFlag(valueFlags, token)) {
+        i++;
+        continue;
+      }
+      return {
+        kind: "refuse",
+        reason: `"${token}" is not a flag this classifier knows on the wrapper "${binary}", so it cannot tell which command "${binary}" would actually run. Re-run without it.`
+      };
+    }
+    if (spec.acceptsAssignments && ASSIGNMENT.test(token)) {
+      assignments.push(token);
+      i++;
+      continue;
+    }
+    if (positionals > 0) {
+      positionals--;
+      i++;
+      continue;
+    }
+    break;
+  }
+  return { kind: "command", tokens: args.slice(i), assignments };
+}
+function unwrap(seg, dialect) {
+  const wrappers = [];
+  const assignments = [...seg.assignments];
+  let current = seg;
+  while (WRAPPER_FAMILY[current.binary]) {
+    const scan = scanWrapperArgs(current.binary, WRAPPER_FAMILY[current.binary], current.args);
+    if (scan.kind === "refuse") return { seg: { ...current, assignments }, wrappers, reason: scan.reason };
+    if (scan.kind === "no-exec" || scan.tokens.length === 0) break;
+    assignments.push(...scan.assignments);
+    wrappers.push(current.binary);
+    const inner = toSegment(scan.tokens, current.piped, dialect);
+    assignments.push(...inner.assignments);
+    current = { ...inner, assignments: [], expandable: current.expandable };
+  }
+  return { seg: { ...current, assignments }, wrappers };
 }
 function lexAll(command, dialect) {
   const queue = [];
@@ -589,6 +716,16 @@ function refusalFor(seg) {
         return `"git ${sub} ${flag}" mutates refs. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
     }
+    const execPathFlag = seg.args.find((a) => a === "--exec-path" || a.startsWith("--exec-path="));
+    if (execPathFlag) {
+      return `"git ${execPathFlag}" redirects where git looks for its helper programs, and can make it run an arbitrary one. Use the read-only research tools, or describe the change as a task.`;
+    }
+    if (sub === "grep") {
+      const pagerFlag = seg.args.find((a) => a === "-O" || a === "--open-files-in-pager" || a.startsWith("--open-files-in-pager="));
+      if (pagerFlag) {
+        return `"git grep ${pagerFlag}" opens the results in an arbitrary named program. Use the read-only research tools, or describe the change as a task.`;
+      }
+    }
   }
   if (seg.binary === "find") {
     const flag = seg.args.find((a) => ["-exec", "-execdir", "-ok", "-okdir", "-delete"].includes(a));
@@ -611,8 +748,17 @@ function refusalFor(seg) {
       return `Inline code via "${seg.binary} ${seg.args.find(isInlineCodeFlag)}" is not available to the planner. Use the read-only research tools, or describe it as a task.`;
     }
   }
+  if (seg.assignments.length > 0) {
+    return `The environment assignment "${seg.assignments[0]}" decides what "${seg.binary}" actually does, and this classifier cannot judge the value. Re-run the command without the assignment.`;
+  }
   return void 0;
 }
+function withWrapperNote(reason, wrappers) {
+  if (wrappers.length === 0) return reason;
+  const quoted = wrappers.map((w) => `"${w}"`);
+  const names = quoted.length > 1 ? `${quoted.slice(0, -1).join(", ")} and ${quoted[quoted.length - 1]}` : quoted[0];
+  return `${reason} Wrapping it in ${names} does not change what runs.`;
+}
 function classifyCommand(command, opts = {}) {
   const trimmed = command.trim();
   if (!trimmed) return { tier: "refuse", scope: "", reason: "Empty command." };
@@ -641,11 +787,13 @@ function classifyCommand(command, opts = {}) {
     };
   }
   if (segments.length === 0) return { tier: "refuse", scope: "", reason: "No command found." };
-  for (const seg of segments) {
+  const unwrapped = segments.map((seg) => unwrap(seg, dialect));
+  for (const { seg, wrappers, reason: wrapperReason } of unwrapped) {
+    if (wrapperReason) return { tier: "refuse", scope: "", reason: wrapperReason };
     const reason = refusalFor(seg);
-    if (reason) return { tier: "refuse", scope: "", reason };
+    if (reason) return { tier: "refuse", scope: "", reason: withWrapperNote(reason, wrappers) };
   }
-  const nonAuto = segments.filter((s) => !isAuto(s));
+  const nonAuto = unwrapped.map((u) => u.seg).filter((s) => !isAuto(s));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
   const scope = [...new Set(nonAuto.map(scopeFor))].sort().join(" + ");
   return { tier: "ask", scope };
@@ -1144,14 +1292,14 @@ var PendingApprovals = class {
   ask(request) {
     const id = `ap-${Date.now()}-${counter++}`;
     const pending = { id, request, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const settle = (granted) => {
         const entry = this.entries.get(id);
         if (!entry) return;
         clearTimeout(entry.timer);
         this.entries.delete(id);
         this.opts.onSettled?.(id, granted);
-        resolve3(granted);
+        resolve4(granted);
       };
       const timer = setTimeout(() => settle(false), this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
       timer.unref?.();
@@ -5791,28 +5939,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join14 = (...parts) => path5.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join14(base, ...parts)] : [];
+  const join16 = (...parts) => path5.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join16(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join14(home, ".local", "bin"),
-    join14(home, ".opencode", "bin"),
-    join14(home, ".claude", "bin"),
-    join14(home, ".codex", "bin"),
+    join16(home, ".local", "bin"),
+    join16(home, ".opencode", "bin"),
+    join16(home, ".claude", "bin"),
+    join16(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join14(home, "AppData", "Roaming", "npm"),
+    join16(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join14(home, ".bun", "bin"),
+    join16(home, ".bun", "bin"),
     // Windows package managers.
-    join14(home, "scoop", "shims"),
+    join16(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -5822,7 +5970,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join14(home, ".volta", "bin")
+    join16(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -6123,7 +6271,7 @@ var defaultAppServerClient = async (command, args, options) => {
   const PATH = await augmentedPath();
   const launch = await planDirectLaunch(command, args).catch(() => null);
   if (!launch) return null;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let child;
     try {
       child = spawn(launch.file, launch.args, {
@@ -6132,7 +6280,7 @@ var defaultAppServerClient = async (command, args, options) => {
         windowsVerbatimArguments: launch.verbatim
       });
     } catch {
-      resolve3(null);
+      resolve4(null);
       return;
     }
     let settled = false;
@@ -6141,7 +6289,7 @@ var defaultAppServerClient = async (command, args, options) => {
       settled = true;
       clearTimeout(timer);
       killTree(child);
-      resolve3(value);
+      resolve4(value);
     };
     const timer = setTimeout(() => finish(null), options?.timeout ?? 2e4);
     child.on("error", () => finish(null));
@@ -7181,11 +7329,71 @@ var RunnerInstallation = class {
   }
 };
 
+// src/services/settingsEnvAllowlist.ts
+var ORDEWELL_SETTABLE_ENV = [
+  "AI_PROVIDER",
+  "ORCHESTRATOR_MODEL",
+  "ORDEWELL_SUBAGENT_MODEL",
+  "ORDEWELL_PLANNER_EFFORT",
+  "ORDEWELL_RESEARCH_ENABLED",
+  "ORDEWELL_MAX_PARALLEL"
+];
+var SETTINGS_ENV_REFUSED = [
+  // Approval posture and pre-approved scope.
+  "ORDEWELL_AUTONOMOUS_MODE",
+  "ORDEWELL_APPROVAL_MODE",
+  "ORDEWELL_APPROVAL_ALLOW",
+  // Where settings are persisted.
+  "ORDEWELL_SETTINGS_PATH",
+  // Runtime options and dynamic loaders.
+  "NODE_OPTIONS",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "NODE_PATH",
+  "ELECTRON_RUN_AS_NODE",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FRAMEWORK_PATH",
+  // Executable resolution.
+  "PATH",
+  "PATHEXT",
+  "NODE"
+];
+var REFUSED = new Set(SETTINGS_ENV_REFUSED);
+function providerEnvKeys() {
+  const keys = [];
+  for (const meta of Object.values(ALL_PROVIDERS)) {
+    if (meta.apiKeyEnvVar) keys.push(meta.apiKeyEnvVar);
+    if (meta.baseUrlEnvVar) keys.push(meta.baseUrlEnvVar);
+    for (const detect of meta.detectEnvVars) keys.push(detect);
+  }
+  return keys;
+}
+var PROVIDER_CREDENTIAL_ENV = new Set(providerEnvKeys());
+var SETTINGS_ENV_ALLOWLIST = new Set(
+  [...providerEnvKeys(), ...ORDEWELL_SETTABLE_ENV].filter((key) => !REFUSED.has(key))
+);
+function admitSettingsEnv(env) {
+  const accepted = {};
+  const rejected = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (REFUSED.has(key) || !SETTINGS_ENV_ALLOWLIST.has(key) || typeof value !== "string") {
+      rejected.push(key);
+      continue;
+    }
+    accepted[key] = value;
+  }
+  return { accepted, rejected };
+}
+
 // src/services/harness/CliAgentAiService.ts
 import { spawn as nodeSpawn } from "child_process";
 
 // src/utils/workspace.ts
 import * as fs3 from "fs";
+import * as path9 from "path";
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -7205,6 +7413,46 @@ function assertWorkspaceExists(workspace, deps = {}) {
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
   if (!isDirectory(workspace)) throw new WorkspaceNotFoundError(workspace);
 }
+var WorkspaceNotAProjectError = class extends Error {
+  constructor(workspace) {
+    super(`Workspace "${workspace}" is not a project directory (no .ordewell state, version control, or recognized manifest found).`);
+    this.workspace = workspace;
+    this.name = "WorkspaceNotAProjectError";
+  }
+  workspace;
+};
+var PROJECT_MARKER_DIRS = [".ordewell", ".git", ".hg", ".svn", ".bzr"];
+var PROJECT_MARKER_FILES = [
+  "package.json",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "setup.py",
+  "requirements.txt",
+  "Pipfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "Gemfile",
+  "composer.json",
+  "pubspec.yaml",
+  "mix.exs",
+  "CMakeLists.txt"
+];
+function assertWorkspaceIsProject(workspace, deps = {}) {
+  const realpath = deps.realpath ?? ((candidate) => fs3.realpathSync(candidate));
+  const exists = deps.exists ?? ((candidate) => fs3.existsSync(candidate));
+  let resolved;
+  try {
+    resolved = realpath(workspace);
+  } catch {
+    throw new WorkspaceNotAProjectError(workspace);
+  }
+  const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
+    (marker) => exists(path9.join(resolved, marker))
+  );
+  if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
+}
 
 // src/services/harness/AgentAdapter.ts
 var LineBuffer = class {
@@ -7260,8 +7508,8 @@ var StdioAgentAdapter = class {
   }
   async start(opts) {
     assertWorkspaceExists(opts.cwd, { isDirectory: this.deps.isDirectory });
-    this.processEnded = new Promise((resolve3) => {
-      this.markEnded = resolve3;
+    this.processEnded = new Promise((resolve4) => {
+      this.markEnded = resolve4;
     });
     const spec = this.spawnSpec(opts);
     const resolvePath = this.deps.resolvePath ?? augmentedPath;
@@ -7309,7 +7557,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
       onEvent({ type: "error", message: this.exitMessage() });
       return;
     }
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       let settled = false;
       const finish = () => {
         if (settled) return;
@@ -7318,7 +7566,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
         signal?.removeEventListener("abort", onAbort);
         this.process?.removeListener("exit", onExit);
         this.process?.removeListener("error", onExit);
-        resolve3();
+        resolve4();
       };
       const emit = (event) => {
         onEvent(event);
@@ -7519,14 +7767,14 @@ function codexSandboxUnavailableMessage() {
   ].join("\n");
 }
 function runProbe(deps, cwd, env, flags) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let output = "";
     let settled = false;
     const finish = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve3({ code, output });
+      resolve4({ code, output });
     };
     const timer = setTimeout(() => finish(null), PROBE_TIMEOUT_MS);
     timer.unref?.();
@@ -7609,8 +7857,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
   async handshake(opts) {
     this.sandbox = await probeCodexSandbox(this.deps, opts.cwd, this.spawnEnv);
     if (this.sandbox === "unavailable") throw new Error(codexSandboxUnavailableMessage());
-    const ready = new Promise((resolve3) => {
-      this.settleHandshake = resolve3;
+    const ready = new Promise((resolve4) => {
+      this.settleHandshake = resolve4;
     });
     this.writeLine({
       jsonrpc: "2.0",
@@ -7623,8 +7871,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
       // A binary that rejects `app-server` outright dies immediately; waiting
       // out the timeout would turn a one-line diagnostic into a 30s stall.
       this.processEnded.then(() => false),
-      new Promise((resolve3) => {
-        const t = setTimeout(() => resolve3(false), HANDSHAKE_TIMEOUT_MS);
+      new Promise((resolve4) => {
+        const t = setTimeout(() => resolve4(false), HANDSHAKE_TIMEOUT_MS);
         t.unref?.();
       })
     ]);
@@ -7912,12 +8160,12 @@ var OpenCodeAdapter = class {
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
     });
-    const banner = new Promise((resolve3) => {
+    const banner = new Promise((resolve4) => {
       let seen = "";
       const scan = (chunk) => {
         seen += chunk.toString();
         const match = seen.match(/https?:\/\/[^\s]+/);
-        if (match) resolve3(match[0].replace(/[.,)]$/, ""));
+        if (match) resolve4(match[0].replace(/[.,)]$/, ""));
       };
       this.process.stdout?.on("data", scan);
       this.process.stderr?.on("data", (chunk) => {
@@ -7926,15 +8174,15 @@ var OpenCodeAdapter = class {
       });
       this.process.on("exit", () => {
         this.exited = true;
-        resolve3(null);
+        resolve4(null);
       });
       this.process.on("error", (err) => {
         this.exited = true;
         this.stderrTail = (this.stderrTail + `
 ${err.message}`).slice(-STDERR_TAIL_CHARS2);
-        resolve3(null);
+        resolve4(null);
       });
-      const timer = setTimeout(() => resolve3(null), SERVER_READY_TIMEOUT_MS);
+      const timer = setTimeout(() => resolve4(null), SERVER_READY_TIMEOUT_MS);
       timer.unref?.();
     });
     this.baseUrl = await banner;
@@ -7964,8 +8212,8 @@ ${this.stderrTail.trim()}` : ""}`);
     const streamAbort = new AbortController();
     let connected = () => {
     };
-    const streamReady = new Promise((resolve3) => {
-      connected = resolve3;
+    const streamReady = new Promise((resolve4) => {
+      connected = resolve4;
     });
     const live = this.streamEvents(
       streamAbort.signal,
@@ -8117,14 +8365,14 @@ ${this.stderrTail.trim()}` : ""}`);
       }
     }
   }
-  async json(method, path15, body, signal) {
-    const response = await this.deps.fetch(`${this.baseUrl}${path15}`, {
+  async json(method, path17, body, signal) {
+    const response = await this.deps.fetch(`${this.baseUrl}${path17}`, {
       method,
       headers: { "content-type": "application/json" },
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
       ...signal ? { signal } : {}
     });
-    if (!response.ok) throw new Error(`${method} ${path15} failed: ${response.status} ${response.statusText}`);
+    if (!response.ok) throw new Error(`${method} ${path17} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   nativeSessionId() {
@@ -8938,11 +9186,11 @@ function executionSummary(tasks) {
 
 // src/utils/sessionStore.ts
 import * as fs5 from "fs";
-import * as path10 from "path";
+import * as path11 from "path";
 
 // src/utils/fsHelpers.ts
 import * as fs4 from "fs";
-import * as path9 from "path";
+import * as path10 from "path";
 var STATE_DIR = ".ordewell";
 function ensureDir(dir) {
   if (!fs4.existsSync(dir)) {
@@ -8950,13 +9198,19 @@ function ensureDir(dir) {
   }
 }
 function getStateDir(baseDir) {
-  return path9.join(baseDir ?? process.cwd(), STATE_DIR);
+  return path10.join(baseDir ?? process.cwd(), STATE_DIR);
+}
+
+// src/utils/sessionId.ts
+import { randomBytes } from "crypto";
+function mintSessionId() {
+  return `session-${randomBytes(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path10.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path11.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function hasScalarRunner(parsed) {
@@ -8977,7 +9231,7 @@ function saveSession(plan, goal, baseDir, id) {
   ensureDir(sessionsDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const meta = {
-    id: id || `session-${Date.now()}`,
+    id: id || mintSessionId(),
     goal: goal || "(untitled)",
     runners: plan.runners,
     taskCount: plan.tasks.flatMap((t) => [t, ...t.subtasks || []]).length,
@@ -8990,7 +9244,7 @@ function saveSession(plan, goal, baseDir, id) {
     plan: JSON.parse(JSON.stringify(plan))
   };
   const filename = sessionFilename(meta);
-  const filePath = path10.join(sessionsDir, filename);
+  const filePath = path11.join(sessionsDir, filename);
   fs5.writeFileSync(filePath, JSON.stringify(session, null, 2));
   return meta;
 }
@@ -9000,7 +9254,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   return files.map((f) => {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${f}: ${REJECTION_MESSAGE}`);
@@ -9018,7 +9272,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -9033,7 +9287,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, file), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -9067,7 +9321,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs5.unlinkSync(path10.join(sessionsDir, file));
+      fs5.unlinkSync(path11.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -9086,11 +9340,6 @@ var PlanEditError = class extends Error {
 function sessionRuntimeSettings(settings) {
   return { ...plannerRuntimeToggles(settings), modelAllowlist: settings.modelAllowlist };
 }
-var lastMintedAt = 0;
-function mintSessionId() {
-  lastMintedAt = Math.max(Date.now(), lastMintedAt + 1);
-  return `session-${lastMintedAt}`;
-}
 var Session = class {
   /** Injected by a test; when present it is the service, forever. */
   pinnedAiService;
@@ -10531,8 +10780,8 @@ var HeadlessRunner = class extends AbstractRunner {
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify4 } from "util";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
-import { existsSync as existsSync5, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
 
 // src/utils/tmux.ts
 import { execSync as execSync2 } from "child_process";
@@ -10637,7 +10886,7 @@ var TmuxSession = class extends AbstractTerminalSession {
     if (this.exited) return;
     let content;
     try {
-      content = existsSync5(this.logPath) ? readFileSync4(this.logPath, "utf8") : "";
+      content = existsSync6(this.logPath) ? readFileSync4(this.logPath, "utf8") : "";
     } catch {
       return;
     }
@@ -10816,7 +11065,7 @@ var TmuxRunner = class extends AbstractRunner {
       windowName,
       this.execFileImpl,
       this.pollIntervalMs,
-      join9(this.logDir, `${id}.log`),
+      join10(this.logDir, `${id}.log`),
       this.socket
     );
     invocation.env = { ...invocation.env, PATH: await this.resolvePath() };
@@ -10826,26 +11075,128 @@ var TmuxRunner = class extends AbstractRunner {
   }
 };
 
+// src/utils/daemonToken.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5, unlinkSync as unlinkSync3, writeSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join11 } from "path";
+var BEARER_PREFIX = "bearer ";
+var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+var DAEMON_SUBPROTOCOL = "ordewell.v1";
+function configDir() {
+  return join11(homedir5(), ".config", "ordewell");
+}
+function daemonTokenPath(port) {
+  return join11(configDir(), `server-${port}.token`);
+}
+function mintDaemonToken(port) {
+  const token = randomBytes2(32).toString("base64url");
+  const file = daemonTokenPath(port);
+  mkdirSync5(configDir(), { recursive: true });
+  try {
+    unlinkSync3(file);
+  } catch {
+  }
+  const fd = openSync(file, "wx", 384);
+  try {
+    writeSync(fd, token);
+  } finally {
+    closeSync(fd);
+  }
+  return { token, file };
+}
+function readDaemonToken(port) {
+  try {
+    const token = readFileSync5(daemonTokenPath(port), "utf8").trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+function clearDaemonToken(port) {
+  try {
+    unlinkSync3(daemonTokenPath(port));
+  } catch {
+  }
+}
+function bearerHeaderValue(token) {
+  return `Bearer ${token}`;
+}
+function tokenSubprotocols(token) {
+  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
+}
+function extractPresentedToken(carriers) {
+  const authorization = carriers.authorization;
+  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
+    const value = authorization.slice(BEARER_PREFIX.length).trim();
+    if (value !== "") return value;
+  }
+  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
+    const value = offered.trim();
+    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
+    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
+    if (token !== "") return token;
+  }
+  return void 0;
+}
+function tokensMatch(presented, expected) {
+  if (presented === void 0) return false;
+  const a = Buffer.from(presented, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 // src/plugins/RunnerRegistry.ts
 import * as fs7 from "fs";
-import * as path12 from "path";
+import * as path14 from "path";
 import * as os5 from "os";
-import { execSync as execSync3 } from "child_process";
+import { execFileSync } from "child_process";
+import { randomBytes as randomBytes3 } from "crypto";
 
 // src/plugins/FsPluginStore.ts
 import * as fs6 from "fs";
-import * as path11 from "path";
+import * as path13 from "path";
 import * as os4 from "os";
-function userPluginsDir() {
-  return path11.join(os4.homedir(), ".config", "ordewell", "plugins");
+
+// src/plugins/pluginNames.ts
+import * as path12 from "path";
+var PLUGIN_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var MAX_PLUGIN_NAME_LENGTH = 64;
+function isPlainPluginName(name) {
+  return typeof name === "string" && name.length <= MAX_PLUGIN_NAME_LENGTH && PLUGIN_NAME_PATTERN.test(name);
+}
+function assertPlainPluginName(name) {
+  if (!isPlainPluginName(name)) {
+    throw new Error(
+      `Invalid plugin name: ${JSON.stringify(name)}. Names must be a single plain segment of letters, digits, '.', '-' or '_' (max ${MAX_PLUGIN_NAME_LENGTH} characters).`
+    );
+  }
 }
+function resolvePluginInstallDir(pluginsDir, name) {
+  assertPlainPluginName(name);
+  const root = path12.resolve(pluginsDir);
+  const dest = path12.resolve(root, name);
+  const relative3 = path12.relative(root, dest);
+  if (relative3 !== name || relative3 === "" || path12.isAbsolute(relative3)) {
+    throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
+  }
+  return dest;
+}
+
+// src/plugins/manifestValidation.ts
 function isValidManifest(obj) {
   if (!obj || typeof obj !== "object") return false;
   const m = obj;
-  return typeof m.name === "string" && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+  return isPlainPluginName(m.name) && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+}
+
+// src/plugins/FsPluginStore.ts
+function userPluginsDir() {
+  return path13.join(os4.homedir(), ".config", "ordewell", "plugins");
 }
 function loadManifestFromDir(dir) {
-  const manifestPath = path11.join(dir, "manifest.json");
+  const manifestPath = path13.join(dir, "manifest.json");
   if (!fs6.existsSync(manifestPath)) return null;
   try {
     const raw = fs6.readFileSync(manifestPath, "utf8");
@@ -10860,8 +11211,8 @@ function copyDirSync(src, dest) {
   ensureDir(dest);
   const entries = fs6.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path11.join(src, entry.name);
-    const destPath = path11.join(dest, entry.name);
+    const srcPath = path13.join(src, entry.name);
+    const destPath = path13.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
@@ -10873,7 +11224,7 @@ function rmDirSync(dir) {
   if (!fs6.existsSync(dir)) return;
   const entries = fs6.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const p = path11.join(dir, entry.name);
+    const p = path13.join(dir, entry.name);
     if (entry.isDirectory()) {
       rmDirSync(p);
     } else {
@@ -10897,6 +11248,13 @@ var FsPluginStore = class {
     }
     return entries.filter((e) => e.isDirectory()).map((e) => e.name);
   }
+  listDir(dir) {
+    try {
+      return fs6.readdirSync(dir);
+    } catch {
+      return [];
+    }
+  }
   loadManifest(pluginDir) {
     return loadManifestFromDir(pluginDir);
   }
@@ -10919,11 +11277,11 @@ var FsPluginStore = class {
       return null;
     }
   }
-  dirExists(path15) {
-    return fs6.existsSync(path15) && fs6.statSync(path15).isDirectory();
+  dirExists(path17) {
+    return fs6.existsSync(path17) && fs6.statSync(path17).isDirectory();
   }
-  exists(path15) {
-    return fs6.existsSync(path15);
+  exists(path17) {
+    return fs6.existsSync(path17);
   }
 };
 
@@ -11211,17 +11569,98 @@ var OPENCODE_MANIFEST = {
   ]
 };
 
+// src/plugins/pluginSource.ts
+var ALLOWED_PLUGIN_HOSTS = [
+  "github.com",
+  "gitlab.com",
+  "bitbucket.org",
+  "codeberg.org"
+];
+var SAFE_REPO_PATH = /^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/;
+var HAS_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]+:/;
+var SCP_LIKE_REMOTE = /^[^/\\]+@[^/\\]+:/;
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function assertInstallablePluginUrl(url) {
+  if (typeof url !== "string" || url.trim() === "") {
+    throw new Error("A plugin repository URL is required.");
+  }
+  if (hasControlCharacter(url)) {
+    throw new Error("Plugin URL contains control characters.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    throw new Error(`Not a valid plugin repository URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `Plugin repositories must be cloned over https (got "${parsed.protocol}//"). git transport helpers and non-https schemes are not accepted.`
+    );
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("Plugin URL must not embed credentials.");
+  }
+  if (parsed.port) {
+    throw new Error("Plugin URL must not specify a port.");
+  }
+  if (parsed.search || parsed.hash) {
+    throw new Error("Plugin URL must not carry a query string or fragment.");
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_PLUGIN_HOSTS.includes(host)) {
+    throw new Error(
+      `Plugin host not allowed: ${host}. Allowed hosts: ${ALLOWED_PLUGIN_HOSTS.join(", ")}.`
+    );
+  }
+  if (!SAFE_REPO_PATH.test(parsed.pathname)) {
+    throw new Error(`Not a plain repository path: ${parsed.pathname}`);
+  }
+  return parsed;
+}
+function classifyPluginSource(source) {
+  const trimmed = source.trim();
+  if (trimmed.startsWith("github:")) {
+    const repo = trimmed.slice("github:".length).replace(/\.git$/, "");
+    return { kind: "git", url: `https://github.com/${repo}.git` };
+  }
+  if (HAS_SCHEME.test(trimmed) || SCP_LIKE_REMOTE.test(trimmed)) {
+    return { kind: "git", url: trimmed };
+  }
+  return { kind: "path", path: source };
+}
+
 // src/plugins/RunnerRegistry.ts
 var BUILTIN_MANIFESTS = [
   CLAUDE_CODE_MANIFEST,
   CODEX_MANIFEST,
   OPENCODE_MANIFEST
 ];
+var RESERVED_RUNNER_NAMES = new Set(BUILTIN_MANIFESTS.map((m) => m.name.toLowerCase()));
+function isReservedRunnerName(name) {
+  return RESERVED_RUNNER_NAMES.has(name.toLowerCase());
+}
+function gitClone(url, destDir) {
+  execFileSync("git", ["clone", "--depth", "1", "--", url, destDir], {
+    stdio: "pipe",
+    timeout: 3e4,
+    // A repository that demands credentials should fail, not hang on a prompt.
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+}
 var RunnerRegistry = class {
   plugins = /* @__PURE__ */ new Map();
   store;
-  constructor(store) {
+  clone;
+  constructor(store, clone) {
     this.store = store ?? new FsPluginStore();
+    this.clone = clone ?? gitClone;
     this.loadBuiltins();
   }
   loadBuiltins() {
@@ -11232,9 +11671,15 @@ var RunnerRegistry = class {
   loadUserPlugins() {
     const names = this.store.listUserPluginDirs();
     for (const name of names) {
-      const pluginDir = path12.join(this.store.getUserPluginsDir(), name);
+      let pluginDir;
+      try {
+        pluginDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), name);
+      } catch {
+        continue;
+      }
       const manifest = this.store.loadManifest(pluginDir);
-      if (!manifest) continue;
+      if (!manifest || !isPlainPluginName(manifest.name)) continue;
+      if (isReservedRunnerName(manifest.name)) continue;
       this.plugins.set(manifest.name, {
         manifest,
         source: "user",
@@ -11263,7 +11708,7 @@ var RunnerRegistry = class {
     return entry?.source === "builtin";
   }
   installFromPath(sourcePath) {
-    const absPath = path12.resolve(sourcePath);
+    const absPath = path14.resolve(sourcePath);
     if (!this.store.dirExists(absPath)) {
       throw new Error(`Plugin source must be a directory: ${absPath}`);
     }
@@ -11271,48 +11716,50 @@ var RunnerRegistry = class {
     if (!manifest) {
       throw new Error(`No valid manifest.json found in: ${absPath}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
-    this.store.ensureDir(destDir);
-    this.store.copyDir(absPath, destDir);
-    this.plugins.set(manifest.name, {
-      manifest,
-      source: "user",
-      installPath: destDir
-    });
-    return manifest;
+    return this.registerInstalled(manifest, absPath);
   }
   installFromGit(url) {
-    const repoName = url.split("/").pop()?.replace(/\.git$/, "") || "plugin";
-    const tmpDir = path12.join(os5.tmpdir(), `ordewell-plugin-${Date.now()}`);
+    const validated = assertInstallablePluginUrl(url);
+    const tmpDir = path14.join(os5.tmpdir(), `ordewell-plugin-${randomBytes3(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
-      execSync3(`git clone --depth 1 "${url}" "${tmpDir}"`, { stdio: "pipe", timeout: 3e4 });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(`Failed to clone repository: ${message}`);
-    }
-    const contents = fsReaddirSync(tmpDir);
-    const hasManifest = contents.some((f) => f === "manifest.json");
-    if (!hasManifest && contents.length === 1 && this.store.dirExists(path12.join(tmpDir, contents[0]))) {
-      const subDir = path12.join(tmpDir, contents[0]);
-      return this.finishInstall(subDir, repoName, tmpDir);
-    }
-    if (!hasManifest) {
+      try {
+        this.clone(validated.toString(), tmpDir);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to clone repository: ${message}`);
+      }
+      const contents = this.store.listDir(tmpDir);
+      const hasManifest = contents.some((f) => f === "manifest.json");
+      let sourceDir = tmpDir;
+      if (!hasManifest) {
+        const onlyEntry = contents.length === 1 ? path14.join(tmpDir, contents[0]) : void 0;
+        if (!onlyEntry || !this.store.dirExists(onlyEntry)) {
+          throw new Error(`No manifest.json found in repository: ${validated.toString()}`);
+        }
+        sourceDir = onlyEntry;
+      }
+      const manifest = this.store.loadManifest(sourceDir);
+      if (!manifest) {
+        throw new Error("No valid manifest.json found in cloned repository");
+      }
+      return this.registerInstalled(manifest, sourceDir);
+    } finally {
       this.store.removeDir(tmpDir);
-      throw new Error(`No manifest.json found in repository: ${url}`);
     }
-    return this.finishInstall(tmpDir, repoName, tmpDir);
   }
-  finishInstall(sourceDir, repoName, tmpDir) {
-    const manifest = this.store.loadManifest(sourceDir);
-    if (!manifest) {
-      this.store.removeDir(tmpDir);
-      throw new Error(`No valid manifest.json found in cloned repository`);
+  /**
+   * The single destination-building step both install routes share: the name is
+   * constrained to a plain segment and the resolved destination is asserted to
+   * be inside the plugins directory before anything is copied.
+   */
+  registerInstalled(manifest, sourceDir) {
+    if (isReservedRunnerName(manifest.name)) {
+      throw new Error(`Cannot install a plugin named after a built-in runner: ${manifest.name}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
+    const destDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), manifest.name);
     this.store.ensureDir(destDir);
     this.store.copyDir(sourceDir, destDir);
-    this.store.removeDir(tmpDir);
     this.plugins.set(manifest.name, {
       manifest,
       source: "user",
@@ -11333,7 +11780,8 @@ var RunnerRegistry = class {
     this.plugins.delete(name);
   }
   createSkeleton(name, outputDir) {
-    const dir = path12.resolve(outputDir, name);
+    assertPlainPluginName(name);
+    const dir = path14.resolve(outputDir, name);
     this.store.ensureDir(dir);
     const manifest = {
       name,
@@ -11365,8 +11813,8 @@ var RunnerRegistry = class {
         ]
       }
     };
-    this.store.writeFile(path12.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
-    const runSh = path12.join(dir, "run.sh");
+    this.store.writeFile(path14.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+    const runSh = path14.join(dir, "run.sh");
     const scriptContent = `#!/usr/bin/env bash
 # Custom runner script for ${name}
 # Receives:
@@ -11390,13 +11838,6 @@ echo "Running ${name} with prompt: $prompt"
     return dir;
   }
 };
-function fsReaddirSync(dir) {
-  try {
-    return fs7.readdirSync(dir);
-  } catch {
-    return [];
-  }
-}
 function fsChmodSync(fpath, mode) {
   try {
     fs7.chmodSync(fpath, mode);
@@ -11406,14 +11847,14 @@ function fsChmodSync(fpath, mode) {
 
 // src/utils/stateStore.ts
 import * as fs8 from "fs";
-import * as path13 from "path";
+import * as path15 from "path";
 var STATE_FILE = "state.json";
 function getStatePath(baseDir) {
-  return path13.join(getStateDir(baseDir), STATE_FILE);
+  return path15.join(getStateDir(baseDir), STATE_FILE);
 }
 function saveState(plan, baseDir) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path13.dirname(statePath));
+  ensureDir(path15.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   fs8.writeFileSync(statePath, JSON.stringify(plan, null, 2));
 }
@@ -11446,7 +11887,7 @@ function stateExists(baseDir) {
 
 // src/services/SettingsService.ts
 import * as fs9 from "fs";
-import * as path14 from "path";
+import * as path16 from "path";
 import * as os6 from "os";
 var DEFAULTS = {
   grillMe: { enabled: false },
@@ -11459,7 +11900,7 @@ var DEFAULTS = {
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path14.join(os6.homedir(), ".config", "ordewell", "settings.json");
+  return path16.join(os6.homedir(), ".config", "ordewell", "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -11624,7 +12065,7 @@ var SettingsService = class {
     return { ...DEFAULTS, grillMe: { ...DEFAULTS.grillMe }, tdd: { ...DEFAULTS.tdd }, prd: { ...DEFAULTS.prd }, review: { ...DEFAULTS.review }, verification: { ...DEFAULTS.verification }, researchSubagents: { ...DEFAULTS.researchSubagents } };
   }
   persist() {
-    const dir = path14.dirname(this.filePath);
+    const dir = path16.dirname(this.filePath);
     if (!fs9.existsSync(dir)) {
       fs9.mkdirSync(dir, { recursive: true });
     }
@@ -11668,6 +12109,7 @@ var PlannerModelMemory = class {
   }
 };
 export {
+  ALLOWED_PLUGIN_HOSTS,
   ALL_PROVIDERS,
   AUTO_COMMANDS,
   AbstractRunner,
@@ -11686,6 +12128,8 @@ export {
   CommandLineTooLongError,
   ConsoleLogger,
   ContextCollector,
+  DAEMON_SUBPROTOCOL,
+  DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DENY_ALL,
   EmbeddedNewlineError,
   EnvConfig,
@@ -11702,9 +12146,12 @@ export {
   ModelResolver,
   OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_SETTABLE_ENV,
   OpenAiService,
   OpenCodeAdapter,
   PLAN_ENVELOPE_KEY,
+  PLUGIN_NAME_PATTERN,
+  PROVIDER_CREDENTIAL_ENV,
   PROVIDER_DETECT_PRIORITY,
   PROVIDER_LABEL,
   PROVIDER_PRIORITY,
@@ -11719,6 +12166,8 @@ export {
   RunnerInstallation,
   RunnerRegistry,
   SEARCH_EXCLUSIONS,
+  SETTINGS_ENV_ALLOWLIST,
+  SETTINGS_ENV_REFUSED,
   STATE_DIR,
   STOPPED_TOOL_RESULT,
   SYMBOL_LANGUAGES,
@@ -11731,13 +12180,19 @@ export {
   TmuxRunner,
   VerdictEngine,
   WINDOWS_MAX_COMMAND_LINE,
+  WorkspaceNotAProjectError,
   WorkspaceNotFoundError,
   addTaskToPlan,
+  admitSettingsEnv,
   applyHeadLimit,
   applyTaskOps,
+  assertInstallablePluginUrl,
+  assertPlainPluginName,
   assertWorkspaceExists,
+  assertWorkspaceIsProject,
   augmentPromptWithPriorOutputs,
   augmentedPath,
+  bearerHeaderValue,
   buildConversationSystemPrompt,
   buildFallbackGrepArgs,
   buildGlobArgs,
@@ -11765,7 +12220,9 @@ export {
   classifyCommand,
   classifyOutcome,
   classifyPlannerReply,
+  classifyPluginSource,
   clearAugmentedPathCache,
+  clearDaemonToken,
   clearResearchShellCache,
   clearState,
   clipboardCopyCommand,
@@ -11777,6 +12234,7 @@ export {
   createAiService,
   createEmptyPlan,
   createTask,
+  daemonTokenPath,
   defaultLogger,
   definitionPattern,
   deleteSession,
@@ -11794,6 +12252,7 @@ export {
   extractObjectWithBalance,
   extractObjectsWithKey,
   extractPrdBlock,
+  extractPresentedToken,
   fetchAllProviderModels,
   filterFallbackByAnchoredInclude,
   filterModelsForPrompt,
@@ -11811,6 +12270,9 @@ export {
   isCliProvider,
   isExecutableResolved,
   isOpenAiProvider,
+  isPlainPluginName,
+  isReservedRunnerName,
+  isValidManifest,
   killTree,
   knownModelId,
   languageForId,
@@ -11823,6 +12285,8 @@ export {
   migrateLegacyPlan,
   migratePlanState,
   migrateTask,
+  mintDaemonToken,
+  mintSessionId,
   modelContextBlock,
   modifyValidationFeedback,
   normalizeAgentArgs,
@@ -11838,6 +12302,7 @@ export {
   providerForRunner,
   reEmitPlanPrompt,
   reEmitTaskOpsPrompt,
+  readDaemonToken,
   referencePattern,
   removeTaskFromPlan,
   renderPlanMap,
@@ -11849,6 +12314,7 @@ export {
   resolveArgs,
   resolveDefaultMode,
   resolveModelShortcut,
+  resolvePluginInstallDir,
   resolveProvider,
   resolveProviderFromPrefix,
   resolveResearchShell,
@@ -11879,6 +12345,8 @@ export {
   tmuxSocketName,
   tmuxWindowName,
   toOrchestratorOptions,
+  tokenSubprotocols,
+  tokensMatch,
   truncatedPlanReEmitPrompt,
   updateTaskInPlan,
   validateModifiedPlan,