@ordewell/core 0.4.7 → 0.4.9

package/dist/{ITerminalRunner-fynILAiR.d.mts → ITerminalRunner-1NAv8wCC.d.mts}

@@ -478,6 +478,8 @@ interface IPluginStore {
     getUserPluginsDir(): string;
     /** List subdirectory names inside the user plugins directory. */
     listUserPluginDirs(): string[];
+    /** List entry names directly inside a directory. Returns [] when unreadable. */
+    listDir(dir: string): string[];
     /** Read and parse a manifest.json from pluginDir. Returns null on failure. */
     loadManifest(pluginDir: string): RunnerPluginManifest | null;
     /** Recursively copy sourceDir to destDir. */
@@ -496,10 +498,15 @@ interface IPluginStore {
     exists(path: string): boolean;
 }
 
+/** True when a name belongs to a built-in runner and is therefore not installable. */
+declare function isReservedRunnerName(name: string): boolean;
+/** Clone seam: takes a validated URL and a destination, or throws. */
+type PluginCloneFn = (url: string, destDir: string) => void;
 declare class RunnerRegistry {
     private plugins;
     private store;
-    constructor(store?: IPluginStore);
+    private clone;
+    constructor(store?: IPluginStore, clone?: PluginCloneFn);
     private loadBuiltins;
     loadUserPlugins(): void;
     get(id: string): PluginEntry | undefined;
@@ -510,7 +517,12 @@ declare class RunnerRegistry {
     isBuiltIn(id: string): boolean;
     installFromPath(sourcePath: string): RunnerPluginManifest;
     installFromGit(url: string): RunnerPluginManifest;
-    private finishInstall;
+    /**
+     * The single destination-building step both install routes share: the name is
+     * constrained to a plain segment and the resolved destination is asserted to
+     * be inside the plugins directory before anything is copied.
+     */
+    private registerInstalled;
     remove(name: string): void;
     createSkeleton(name: string, outputDir: string): string;
 }
@@ -552,4 +564,4 @@ interface ITerminalRunner {
     activeCount: number;
 }
 
-export { type AiProvider as A, type ResolveContext as B, type CatalogModel as C, DENY_ALL as D, type RunnerInvocation as E, type FetchAllProviderModelsOptions as F, GREP_DEFAULT_HEAD_LIMIT as G, type RunnerPluginManifest as H, type IApproval as I, RunnerRegistry as J, collectProviderCredentials as K, enabledRunners as L, ModelCatalog as M, fetchAllProviderModels as N, ORCHESTRATOR_SHORTCUTS as O, type PluginEntry as P, knownModelId as Q, type ReadFileOpts as R, SEARCH_EXCLUSIONS as S, type ToolOutcome as T, resolveModelShortcut as U, resolveProvider as V, toOrchestratorOptions as W, type AllProviderModels as a, type ApprovalKind as b, type ApprovalMode as c, ApprovalPolicy as d, type ApprovalPolicyOptions as e, type ApprovalRequest as f, type ApprovalSource as g, type DiscoveryCommand as h, type FindSymbolOptions as i, type GlobOptions as j, type GrepOptions as k, type GrepOutputMode as l, type IConfig as m, type IFileSystem as n, type IPluginStore as o, type ITerminalRunner as p, type ITerminalSession as q, type ModelShortcut as r, type OrchestratorOption as s, type PluginFeatures as t, type PluginMode as u, type PluginModelDiscovery as v, type PluginRunnerDef as w, type ProviderCredentialSource as x, type ProviderModelLists as y, type ProviderModelsResult as z };
+export { type AiProvider as A, type ProviderModelsResult as B, type CatalogModel as C, DENY_ALL as D, type ResolveContext as E, type FetchAllProviderModelsOptions as F, GREP_DEFAULT_HEAD_LIMIT as G, type RunnerInvocation as H, type IApproval as I, type RunnerPluginManifest as J, RunnerRegistry as K, collectProviderCredentials as L, ModelCatalog as M, enabledRunners as N, ORCHESTRATOR_SHORTCUTS as O, type PluginCloneFn as P, fetchAllProviderModels as Q, type ReadFileOpts as R, SEARCH_EXCLUSIONS as S, type ToolOutcome as T, isReservedRunnerName as U, knownModelId as V, resolveModelShortcut as W, resolveProvider as X, toOrchestratorOptions as Y, type AllProviderModels as a, type ApprovalKind as b, type ApprovalMode as c, ApprovalPolicy as d, type ApprovalPolicyOptions as e, type ApprovalRequest as f, type ApprovalSource as g, type DiscoveryCommand as h, type FindSymbolOptions as i, type GlobOptions as j, type GrepOptions as k, type GrepOutputMode as l, type IConfig as m, type IFileSystem as n, type IPluginStore as o, type ITerminalRunner as p, type ITerminalSession as q, type ModelShortcut as r, type OrchestratorOption as s, type PluginEntry as t, type PluginFeatures as u, type PluginMode as v, type PluginModelDiscovery as w, type PluginRunnerDef as x, type ProviderCredentialSource as y, type ProviderModelLists as z };

package/dist/{ITerminalRunner-Cpyzyrnl.d.ts → ITerminalRunner-CbE6gKLI.d.ts}

@@ -478,6 +478,8 @@ interface IPluginStore {
     getUserPluginsDir(): string;
     /** List subdirectory names inside the user plugins directory. */
     listUserPluginDirs(): string[];
+    /** List entry names directly inside a directory. Returns [] when unreadable. */
+    listDir(dir: string): string[];
     /** Read and parse a manifest.json from pluginDir. Returns null on failure. */
     loadManifest(pluginDir: string): RunnerPluginManifest | null;
     /** Recursively copy sourceDir to destDir. */
@@ -496,10 +498,15 @@ interface IPluginStore {
     exists(path: string): boolean;
 }
 
+/** True when a name belongs to a built-in runner and is therefore not installable. */
+declare function isReservedRunnerName(name: string): boolean;
+/** Clone seam: takes a validated URL and a destination, or throws. */
+type PluginCloneFn = (url: string, destDir: string) => void;
 declare class RunnerRegistry {
     private plugins;
     private store;
-    constructor(store?: IPluginStore);
+    private clone;
+    constructor(store?: IPluginStore, clone?: PluginCloneFn);
     private loadBuiltins;
     loadUserPlugins(): void;
     get(id: string): PluginEntry | undefined;
@@ -510,7 +517,12 @@ declare class RunnerRegistry {
     isBuiltIn(id: string): boolean;
     installFromPath(sourcePath: string): RunnerPluginManifest;
     installFromGit(url: string): RunnerPluginManifest;
-    private finishInstall;
+    /**
+     * The single destination-building step both install routes share: the name is
+     * constrained to a plain segment and the resolved destination is asserted to
+     * be inside the plugins directory before anything is copied.
+     */
+    private registerInstalled;
     remove(name: string): void;
     createSkeleton(name: string, outputDir: string): string;
 }
@@ -552,4 +564,4 @@ interface ITerminalRunner {
     activeCount: number;
 }
 
-export { type AiProvider as A, type ResolveContext as B, type CatalogModel as C, DENY_ALL as D, type RunnerInvocation as E, type FetchAllProviderModelsOptions as F, GREP_DEFAULT_HEAD_LIMIT as G, type RunnerPluginManifest as H, type IApproval as I, RunnerRegistry as J, collectProviderCredentials as K, enabledRunners as L, ModelCatalog as M, fetchAllProviderModels as N, ORCHESTRATOR_SHORTCUTS as O, type PluginEntry as P, knownModelId as Q, type ReadFileOpts as R, SEARCH_EXCLUSIONS as S, type ToolOutcome as T, resolveModelShortcut as U, resolveProvider as V, toOrchestratorOptions as W, type AllProviderModels as a, type ApprovalKind as b, type ApprovalMode as c, ApprovalPolicy as d, type ApprovalPolicyOptions as e, type ApprovalRequest as f, type ApprovalSource as g, type DiscoveryCommand as h, type FindSymbolOptions as i, type GlobOptions as j, type GrepOptions as k, type GrepOutputMode as l, type IConfig as m, type IFileSystem as n, type IPluginStore as o, type ITerminalRunner as p, type ITerminalSession as q, type ModelShortcut as r, type OrchestratorOption as s, type PluginFeatures as t, type PluginMode as u, type PluginModelDiscovery as v, type PluginRunnerDef as w, type ProviderCredentialSource as x, type ProviderModelLists as y, type ProviderModelsResult as z };
+export { type AiProvider as A, type ProviderModelsResult as B, type CatalogModel as C, DENY_ALL as D, type ResolveContext as E, type FetchAllProviderModelsOptions as F, GREP_DEFAULT_HEAD_LIMIT as G, type RunnerInvocation as H, type IApproval as I, type RunnerPluginManifest as J, RunnerRegistry as K, collectProviderCredentials as L, ModelCatalog as M, enabledRunners as N, ORCHESTRATOR_SHORTCUTS as O, type PluginCloneFn as P, fetchAllProviderModels as Q, type ReadFileOpts as R, SEARCH_EXCLUSIONS as S, type ToolOutcome as T, isReservedRunnerName as U, knownModelId as V, resolveModelShortcut as W, resolveProvider as X, toOrchestratorOptions as Y, type AllProviderModels as a, type ApprovalKind as b, type ApprovalMode as c, ApprovalPolicy as d, type ApprovalPolicyOptions as e, type ApprovalRequest as f, type ApprovalSource as g, type DiscoveryCommand as h, type FindSymbolOptions as i, type GlobOptions as j, type GrepOptions as k, type GrepOutputMode as l, type IConfig as m, type IFileSystem as n, type IPluginStore as o, type ITerminalRunner as p, type ITerminalSession as q, type ModelShortcut as r, type OrchestratorOption as s, type PluginEntry as t, type PluginFeatures as u, type PluginMode as v, type PluginModelDiscovery as w, type PluginRunnerDef as x, type ProviderCredentialSource as y, type ProviderModelLists as z };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { h as RunnerId, c as PlanStatus, L as LegacyPlanState, d as ResearchProgress, a as DiscoveredModel, T as Task, R as ResearchLogEntry, C as ConversationMessage, n as TaskSnapshot, Q as QueuedMessage, A as ActiveTaskSession, g as ResearchToolType, u as Verdict, e as ResearchStep, b as PlanState } from './Task-1NwmUImI.mjs';
 export { D as DiscoveredMode, M as Message, P as PlanModificationWarnings, f as ResearchStepOutcome, S as StreamEvent, i as StreamStepEvent, j as StreamThinkingEvent, k as TaskMode, l as TaskModelAssignment, m as TaskOutputSummary, o as TaskStatus, p as TaskType, q as ThinkingBlock, U as UserPromptEntry, r as UserStep, V as ValidationCheck, s as ValidationContext, t as ValidationResult, v as VerificationCheck, w as addTaskToPlan, x as createEmptyPlan, y as createTask, z as emptyWarnings, B as flattenTasks, E as migrateLegacyPlan, F as migratePlanState, G as migrateTask, H as removeTaskFromPlan, I as renumberTasks, J as updateTaskInPlan, K as validateModifiedPlan, N as warningsText } from './Task-1NwmUImI.mjs';
-import { n as IFileSystem, I as IApproval, R as ReadFileOpts, T as ToolOutcome, k as GrepOptions, j as GlobOptions, i as FindSymbolOptions, f as ApprovalRequest, m as IConfig, A as AiProvider, y as ProviderModelLists, c as ApprovalMode, q as ITerminalSession, p as ITerminalRunner, J as RunnerRegistry, s as OrchestratorOption, b as ApprovalKind, g as ApprovalSource, E as RunnerInvocation, o as IPluginStore, H as RunnerPluginManifest, B as ResolveContext } from './ITerminalRunner-fynILAiR.mjs';
-export { a as AllProviderModels, d as ApprovalPolicy, e as ApprovalPolicyOptions, C as CatalogModel, D as DENY_ALL, h as DiscoveryCommand, F as FetchAllProviderModelsOptions, G as GREP_DEFAULT_HEAD_LIMIT, l as GrepOutputMode, M as ModelCatalog, r as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, P as PluginEntry, t as PluginFeatures, u as PluginMode, v as PluginModelDiscovery, w as PluginRunnerDef, x as ProviderCredentialSource, z as ProviderModelsResult, S as SEARCH_EXCLUSIONS, K as collectProviderCredentials, L as enabledRunners, N as fetchAllProviderModels, Q as knownModelId, U as resolveModelShortcut, V as resolveProvider, W as toOrchestratorOptions } from './ITerminalRunner-fynILAiR.mjs';
+import { n as IFileSystem, I as IApproval, R as ReadFileOpts, T as ToolOutcome, k as GrepOptions, j as GlobOptions, i as FindSymbolOptions, f as ApprovalRequest, m as IConfig, A as AiProvider, z as ProviderModelLists, c as ApprovalMode, q as ITerminalSession, p as ITerminalRunner, K as RunnerRegistry, s as OrchestratorOption, b as ApprovalKind, g as ApprovalSource, H as RunnerInvocation, o as IPluginStore, J as RunnerPluginManifest, E as ResolveContext } from './ITerminalRunner-1NAv8wCC.mjs';
+export { a as AllProviderModels, d as ApprovalPolicy, e as ApprovalPolicyOptions, C as CatalogModel, D as DENY_ALL, h as DiscoveryCommand, F as FetchAllProviderModelsOptions, G as GREP_DEFAULT_HEAD_LIMIT, l as GrepOutputMode, M as ModelCatalog, r as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, P as PluginCloneFn, t as PluginEntry, u as PluginFeatures, v as PluginMode, w as PluginModelDiscovery, x as PluginRunnerDef, y as ProviderCredentialSource, B as ProviderModelsResult, S as SEARCH_EXCLUSIONS, L as collectProviderCredentials, N as enabledRunners, Q as fetchAllProviderModels, U as isReservedRunnerName, V as knownModelId, W as resolveModelShortcut, X as resolveProvider, Y as toOrchestratorOptions } from './ITerminalRunner-1NAv8wCC.mjs';
 import { R as RunnerModeInfo, b as PlanParseError } from './parsing-xpozY5ac.mjs';
 export { M as ManifestLookup, P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as buildModeGuide, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as filteredBuildModes, n as looksLikePlanAttempt, p as parsePartialPlan, o as parsePlanJson, r as resolveDefaultMode, q as resolveTaskMode, s as runnerModesFrom, t as stripModelNoise, u as stripTrailingCommas, v as validatePlanModification } from './parsing-xpozY5ac.mjs';
 import { T as TaskOp } from './plan-utils-nfHKSbd3.mjs';
@@ -121,13 +121,44 @@ declare function researchShellWarning(shell: ResearchShell): string | null;
  * The old substring denylist both over-matched (`ls docs/removed` tripped `rm`)
  * and under-matched (`$(rm -rf /)` was invisible once chaining was allowed).
  *
+ * A segment is classified by the command that will actually execute, not by the
+ * name at the front of it: wrappers are unwrapped first, recursively, so
+ * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}.
+ *
+ * A permitted binary is permitted with the flags it is known to be read-only
+ * with, not with any flag at all: several of them will run a helper program or
+ * write a file when asked to, so `auto` is a per-binary flag allowlist and an
+ * unrecognised flag is refused. See {@link FLAG_POLICY}.
+ *
  * The lexer is dialect-aware, because the interpreter that will actually run
  * the command decides what the tokens are, and getting that wrong is not a
  * cosmetic error here — it is the difference between classifying what runs and
  * classifying something else. See {@link Dialect}.
  */
 
+/**
+ * `env` is deliberately absent. Given a command it is a wrapper, classified by
+ * what it actually runs (see {@link WRAPPER_FAMILY}); given none it prints the
+ * whole process environment — provider credentials included — into the research
+ * log, which is a disclosure the developer should get to see coming.
+ *
+ * Membership here is necessary but not sufficient: every name in this list also
+ * declares the flags it is read-only with in {@link FLAG_POLICY}.
+ */
 declare const AUTO_COMMANDS: string[];
+/**
+ * `ls-remote` is deliberately absent, and it is the one entry here that is
+ * read-only against the repository. It reaches the network: it contacts
+ * whatever host the named remote or URL resolves to, which routes around the
+ * web fetcher's per-origin approval and its request-forgery guard. So it
+ * prompts rather than running silently.
+ *
+ * Prompting only became the right answer once {@link scopeFor} widened. Under
+ * the old scope it would have been remembered as `git ls-remote`, so one
+ * approval of the workspace's own remote would have authorised a listing
+ * against any host at all — which is the same hole with an approval dialog in
+ * front of it. The scope now carries the destination.
+ */
 declare const GIT_READONLY_SUBCOMMANDS: string[];
 /**
  * Never runs, with or without approval.
@@ -1866,6 +1897,72 @@ declare function configuredProviders(config: {
     openaiCompatibleBaseUrl: string;
 }): AiProvider[];
 
+/**
+ * Which environment variables a settings update may write.
+ *
+ * The daemon's settings update sets `process.env` on the daemon itself, and
+ * every runner it spawns inherits that environment. The admission rule used to
+ * be "any upper-case key", which admitted the variables that make the runtime
+ * load arbitrary modules, preload libraries into every child, redirect the
+ * executable search path, move where settings are persisted, and turn approval
+ * prompting off — so a single settings write was arbitrary code execution.
+ *
+ * The rule is now an allowlist: the provider credential and base-URL families,
+ * derived from the provider registry so a new provider needs no second edit,
+ * plus a small set of Ordewell's own configuration variables. Everything else
+ * is refused and named back to the caller.
+ */
+/**
+ * Ordewell's own settable configuration. Deliberately short: a variable earns a
+ * place here only when a surface has a reason to change it on a live daemon.
+ *
+ * `ORDEWELL_AUTONOMOUS_MODE` is conspicuously absent and is in
+ * `SETTINGS_ENV_REFUSED` instead — see that list.
+ */
+declare const ORDEWELL_SETTABLE_ENV: readonly string[];
+/**
+ * Refused by name, not merely left out of the allowlist.
+ *
+ * Omission alone would already refuse these, so this list buys no admission
+ * behaviour — it buys a place where the reason is written down, and a failing
+ * test the moment someone widens the allowlist over one of them. Each entry is
+ * a known escalation from "can change a setting" to "can run code as the user":
+ *
+ * - The approval-mode and pre-approved-scope variables switch the consent gate
+ *   off, so every later command runs unprompted.
+ * - The settings-path override is honoured by the settings service, which
+ *   creates directories recursively when persisting — admitting it turns the
+ *   same write into an arbitrary-path file write.
+ * - The runtime-option and dynamic-loader variables load attacker-chosen
+ *   modules or shared objects into the daemon and into every process it spawns.
+ * - The executable-path variables redirect which binary a runner's command name
+ *   resolves to.
+ */
+declare const SETTINGS_ENV_REFUSED: readonly string[];
+/**
+ * The credential and endpoint keys alone. A write to one of these is what
+ * invalidates a model catalog — picking a planner, a model or an effort level
+ * changes nothing a catalog contains.
+ */
+declare const PROVIDER_CREDENTIAL_ENV: ReadonlySet<string>;
+/**
+ * Every key a settings update may write. Built once at module load; the refused
+ * names are subtracted last so a provider registration can never smuggle one in.
+ */
+declare const SETTINGS_ENV_ALLOWLIST: ReadonlySet<string>;
+interface EnvAdmission {
+    /** Keys that may be written, with their string values. */
+    accepted: Record<string, string>;
+    /** Keys the caller sent that were refused, in the order they arrived. */
+    rejected: string[];
+}
+/**
+ * Splits a settings update's `env` object into what may be written and what was
+ * refused. A non-string value for an allowlisted key is refused rather than
+ * dropped, so the caller never sees silence for a write that did not happen.
+ */
+declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
+
 interface SpawnSpec {
     command: string;
     args: string[];
@@ -3037,6 +3134,93 @@ interface WorkspaceCheckDeps {
 }
 /** Throws {@link WorkspaceNotFoundError} unless `workspace` names an existing directory. */
 declare function assertWorkspaceExists(workspace: string, deps?: WorkspaceCheckDeps): void;
+/**
+ * A workspace whose resolved path carries none of the markers below. Thrown
+ * instead of admitting the directory as-is: without this, a request pointed
+ * at the filesystem root or an arbitrary system directory becomes the
+ * confinement boundary for every read, search and permitted command the
+ * planner runs, by definition. A denylist of "dangerous" roots was rejected
+ * for the same reason as the other denylists in this project's remediation —
+ * it would still admit unlisted system directories.
+ */
+declare class WorkspaceNotAProjectError extends Error {
+    readonly workspace: string;
+    constructor(workspace: string);
+}
+interface WorkspaceProjectCheckDeps {
+    /** Resolves symlinks/`..` segments to a canonical absolute path. Defaults to `fs.realpathSync`. */
+    realpath?: (candidate: string) => string;
+    /** True when `candidate` names an existing filesystem entry. Defaults to `fs.existsSync`. */
+    exists?: (candidate: string) => boolean;
+}
+/**
+ * Throws {@link WorkspaceNotAProjectError} unless `workspace` resolves to a
+ * directory carrying at least one project marker. Resolves the path first —
+ * via `realpath`, not string inspection — so a request that traverses
+ * through symlinks or `..` segments is judged on where it actually lands,
+ * not on the path as written.
+ */
+declare function assertWorkspaceIsProject(workspace: string, deps?: WorkspaceProjectCheckDeps): void;
+
+/**
+ * The daemon's bearer token: minted at startup, written beside the per-port
+ * process-id file, read by the CLI.
+ *
+ * Header validation defends against browsers and nothing else. This is what
+ * stops another process running as the same user — an install script in the
+ * very repository the planner was pointed at, say — from driving the daemon
+ * just because it can see the port.
+ *
+ * Both ends of the wire live here so the carrier encodings cannot drift: the
+ * daemon extracts with the same functions the CLI attaches with.
+ */
+/**
+ * The subprotocol the token rides on during the WebSocket upgrade. A query
+ * parameter would land in access logs and in `ps`; a subprotocol travels in a
+ * request header like the HTTP `Authorization` it stands in for.
+ */
+declare const DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+/**
+ * Offered alongside the token subprotocol, and the one the server selects, so
+ * the 101 response never echoes the secret back.
+ */
+declare const DAEMON_SUBPROTOCOL = "ordewell.v1";
+/**
+ * One token file per port, with no default-port special case: unlike the
+ * process-id file there is no legacy name to preserve, and naming every file
+ * after its port is what stops a second daemon clobbering the first's token.
+ */
+declare function daemonTokenPath(port: number): string;
+/**
+ * Mint this daemon's token and hand it off through the filesystem.
+ *
+ * Unlink-then-create-exclusively rather than a plain write: `mode` is ignored
+ * when the file already exists, so writing over a pre-created file would leave
+ * the token at whatever permissions that file already had, and an existing
+ * symlink would carry the write somewhere else entirely.
+ */
+declare function mintDaemonToken(port: number): {
+    token: string;
+    file: string;
+};
+/** The token a client should present to the daemon on `port`, if one has been minted. */
+declare function readDaemonToken(port: number): string | undefined;
+/** Best-effort cleanup on shutdown, so a dead daemon leaves no usable-looking token behind. */
+declare function clearDaemonToken(port: number): void;
+/** The `Authorization` header value for HTTP requests. */
+declare function bearerHeaderValue(token: string): string;
+/** What a client offers on the upgrade: the real subprotocol first, the token second. */
+declare function tokenSubprotocols(token: string): string[];
+interface TokenCarriers {
+    /** `Authorization: Bearer <token>` — the HTTP carrier. */
+    authorization?: string | null;
+    /** `Sec-WebSocket-Protocol` — the upgrade carrier. */
+    secWebSocketProtocol?: string | null;
+}
+/** Pull the token out of whichever carrier it arrived on. */
+declare function extractPresentedToken(carriers: TokenCarriers): string | undefined;
+/** Constant-time comparison, so a wrong token leaks no information about the right one. */
+declare function tokensMatch(presented: string | undefined, expected: string): boolean;
 
 interface KillTreeDeps {
     platform?: NodeJS.Platform;
@@ -3137,6 +3321,7 @@ declare function clipboardCopyCommand(hasBin?: HasBinFn, platform?: NodeJS.Platf
 declare class FsPluginStore implements IPluginStore {
     getUserPluginsDir(): string;
     listUserPluginDirs(): string[];
+    listDir(dir: string): string[];
     loadManifest(pluginDir: string): RunnerPluginManifest | null;
     copyDir(sourceDir: string, destDir: string): void;
     removeDir(dir: string): void;
@@ -3147,6 +3332,56 @@ declare class FsPluginStore implements IPluginStore {
     exists(path: string): boolean;
 }
 
+/**
+ * Shape check for a manifest read off disk or out of a cloned repository. The
+ * name is constrained here rather than at each install route, so every store
+ * implementation gets the same guarantee that a manifest name is a plain
+ * segment and never a traversal sequence.
+ */
+declare function isValidManifest(obj: unknown): obj is RunnerPluginManifest;
+
+/**
+ * A plugin name is a single plain path segment: alphanumeric at both ends,
+ * dots/dashes/underscores in between. This is what keeps a manifest name from
+ * being a traversal sequence (`..`, `../../etc`), an absolute path, or a
+ * dash-prefixed string that a downstream tool reads as a flag.
+ */
+declare const PLUGIN_NAME_PATTERN: RegExp;
+declare function isPlainPluginName(name: unknown): name is string;
+declare function assertPlainPluginName(name: unknown): asserts name is string;
+/**
+ * Resolve where a plugin of this name installs, and assert the result is still
+ * a direct child of the plugins directory. Validation and use share this one
+ * call so they cannot disagree about the path being checked.
+ */
+declare function resolvePluginInstallDir(pluginsDir: string, name: unknown): string;
+
+/** Hosts a plugin may be cloned from. Exact hostname match, case-insensitive. */
+declare const ALLOWED_PLUGIN_HOSTS: readonly string[];
+type PluginSource = {
+    kind: 'git';
+    url: string;
+} | {
+    kind: 'path';
+    path: string;
+};
+/**
+ * Validate a plugin repository URL. Requires an ordinary HTTPS repository on an
+ * allowed host, which is also what rejects git's transport helpers (`ext::`,
+ * `git://`, `ssh://`, `file://`) — they never reach the clone because they are
+ * not the https scheme.
+ *
+ * Returns the parsed URL so callers clone the normalised form they validated.
+ */
+declare function assertInstallablePluginUrl(url: unknown): URL;
+/**
+ * Decide whether an install source names a remote repository or a local
+ * directory. Anything that carries a scheme or looks like an scp-style remote
+ * goes down the URL route so it is rejected as a bad URL rather than silently
+ * retried as a (nonexistent) directory.
+ */
+declare function classifyPluginSource(source: string): PluginSource;
+
 declare function resolveArgs(manifest: RunnerPluginManifest, ctx: ResolveContext): RunnerInvocation;
 
 declare const CLAUDE_CODE_MANIFEST: RunnerPluginManifest;
@@ -3156,6 +3391,17 @@ declare const OPENCODE_MANIFEST: RunnerPluginManifest;
 declare const STATE_DIR = ".ordewell";
 declare function ensureDir(dir: string): void;
 declare function getStateDir(baseDir?: string): string;
+/**
+ * A match-everything ignore rule, written *inside* the state directory. A
+ * `.gitignore` containing `*` inside a directory excludes that directory's
+ * whole contents, itself included, so plans and sessions stop being
+ * accidentally committable — without ever touching a file the developer wrote.
+ * Editing their root `.gitignore` would be the intrusive version of this.
+ *
+ * Idempotent, and never overwrites an existing file: a developer who has
+ * customised these rules (to commit their plans deliberately, say) keeps them.
+ */
+declare function ensureStateDirIgnored(baseDir?: string): void;
 
 declare function saveState(plan: LegacyPlanState, baseDir?: string): void;
 declare function loadState(baseDir?: string, logger?: ILogger): LegacyPlanState | null;
@@ -3178,6 +3424,8 @@ declare function getLatestSession(baseDir?: string, logger?: ILogger): {
 } | null;
 declare function deleteSession(sessionId: string, baseDir?: string, logger?: ILogger): boolean;
 
+declare function mintSessionId(): string;
+
 interface PrdBlock {
     slug: string;
     markdown: string;
@@ -3244,4 +3492,4 @@ declare class PlannerModelMemory {
     recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
 }
 
-export { ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AgentAdapter, type AgentAdapterFactory, type AgentEvent, type AgentProcessDeps, type AgentStartOptions, AiProvider, ApprovalKind, ApprovalMode, ApprovalRequest, ApprovalSource, BaseAiService, BaseConfig, BaseFileSystem, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, CommandLineTooLongError, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, ConversationMessage, type ConversationRequest, type ConversationTurn, DiscoveredModel, EmbeddedNewlineError, EnvConfig, type ExecFileFn, type ExecImpl, ExecutableNotFoundError, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HeadlessRunner, type HeadlessRunnerDeps, HeadlessSession, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LineBuffer, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PrdBlock, type PreparedLaunch, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, REFUSED_COMMANDS, ReadFileOpts, type RepairLoopOpts, type RepairVerdict, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchStep, ResearchToolType, type ResearchTurn, ResolveContext, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, type RunnerSpawnOptions, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SerializedPlan, type SerializedTask, type SerializedTaskStatus, Session, type SessionBroadcaster, type SessionData, type SessionDeps, type SessionMessage, type SessionMeta, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SpawnSpec, StdioAgentAdapter, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, TaskOp, TaskOrchestrator, TaskSnapshot, TmuxRunner, type TmuxRunnerDeps, type ToolCall, ToolOutcome, type ToolResult, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotFoundError, applyHeadLimit, assertWorkspaceExists, augmentPromptWithPriorOutputs, augmentedPath, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildShellInvocation, buildSplitPrompt, buildSubagentSystemPrompt, clampThinkingEffort, classifyCommand, classifyPlannerReply, clearAugmentedPathCache, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, configuredProviders, createAiService, defaultLogger, definitionPattern, deleteSession, discoverGeminiModels, effectiveAllowlist, ensureDir, executionLogBlock, executionSummary, extractPrdBlock, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, grantScopeFor, hasTmux, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, killTree, languageForId, listSessions, loadSession, loadSessionPlanState, loadState, mapAgentTool, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, pendingEditRulesBlock, planDirectLaunch, planShellLaunch, posixShellQuote, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, referencePattern, renderPlanMap, renderPriorOutputs, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolveProviderFromPrefix, resolveResearchShell, resolveWithin, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, serializePlan, serializeTask, serializeTaskStatus, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, taskOpsRejectedPrompt, tmuxSessionName, tmuxSocketName, tmuxWindowName, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, wrapWithPty };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AgentAdapter, type AgentAdapterFactory, type AgentEvent, type AgentProcessDeps, type AgentStartOptions, AiProvider, ApprovalKind, ApprovalMode, ApprovalRequest, ApprovalSource, BaseAiService, BaseConfig, BaseFileSystem, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, CommandLineTooLongError, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, ConversationMessage, type ConversationRequest, type ConversationTurn, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, ExecutableNotFoundError, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HeadlessRunner, type HeadlessRunnerDeps, HeadlessSession, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LineBuffer, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PluginSource, type PrdBlock, type PreparedLaunch, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, REFUSED_COMMANDS, ReadFileOpts, type RepairLoopOpts, type RepairVerdict, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchStep, ResearchToolType, type ResearchTurn, ResolveContext, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, type RunnerSpawnOptions, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SerializedPlan, type SerializedTask, type SerializedTaskStatus, Session, type SessionBroadcaster, type SessionData, type SessionDeps, type SessionMessage, type SessionMeta, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SpawnSpec, StdioAgentAdapter, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, TaskOp, TaskOrchestrator, TaskSnapshot, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildShellInvocation, buildSplitPrompt, buildSubagentSystemPrompt, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, configuredProviders, createAiService, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, discoverGeminiModels, effectiveAllowlist, ensureDir, ensureStateDirIgnored, executionLogBlock, executionSummary, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, grantScopeFor, hasTmux, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, loadSession, loadSessionPlanState, loadState, mapAgentTool, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, pendingEditRulesBlock, planDirectLaunch, planShellLaunch, posixShellQuote, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, readDaemonToken, referencePattern, renderPlanMap, renderPriorOutputs, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveWithin, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, serializePlan, serializeTask, serializeTaskStatus, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, taskOpsRejectedPrompt, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, wrapWithPty };