@phnx-labs/agents-cli 1.20.34 → 1.20.36

package/dist/lib/picker.js

@@ -174,6 +174,133 @@ export function itemPicker(config) {
         const help = previewOpen
             ? chalk.gray(`↑↓ navigate · space: close preview · ⏎ ${enter} · esc: cancel`)
             : chalk.gray(`↑↓ navigate${hasPreview ? ' · space: preview' : ''} · ⏎ ${enter} · esc: cancel`);
+        const parts = [header];
+        if (cfg.subtitle)
+            parts.push(cfg.subtitle);
+        parts.push(page);
+        if (results.length === 0) {
+            parts.push(chalk.gray(`  ${cfg.emptyMessage ?? 'No matches.'}`));
+        }
+        if (previewOpen && selected && cfg.buildPreview) {
+            const width = terminalWidth();
+            const separator = chalk.gray('─'.repeat(Math.min(width, 80)));
+            const fixedRows = renderedRows(header, width) +
+                renderedRows(parts.slice(1).join('\n'), width) +
+                renderedRows(separator, width) +
+                renderedRows(help, width);
+            const availablePreviewRows = terminalRows() - fixedRows;
+            const preview = limitPreviewHeight(cfg.buildPreview(selected.value), availablePreviewRows, width);
+            if (preview) {
+                parts.push(separator);
+                parts.push(preview);
+            }
+        }
+        parts.push(help);
+        return [header, parts.slice(1).join('\n')];
+    });
+    return prompt(config);
+}
+/**
+ * Multi-select variant of {@link itemPicker}. Same searchable, paginated list
+ * and preview pane, but `space` toggles a checkbox on the active row instead of
+ * the preview (preview moves to `tab`), and `enter` confirms every checked row.
+ *
+ * Returns the selected items (in the config's `items` order) or `null` on
+ * cancel. Pressing `enter` with nothing checked confirms just the highlighted
+ * row, so a quick single-pick still works.
+ */
+export function multiItemPicker(config) {
+    const prompt = createPrompt((cfg, done) => {
+        const theme = makeTheme({});
+        const [status, setStatus] = useState('idle');
+        const [searchTerm, setSearchTerm] = useState(cfg.initialSearch ?? '');
+        const [previewOpen, setPreviewOpen] = useState(false);
+        const [selectedKeys, setSelectedKeys] = useState(new Set());
+        const [active, setActive] = useState(0);
+        const prefix = usePrefix({ status, theme });
+        const results = useMemo(() => {
+            const filtered = cfg.filter(searchTerm).slice(0, 200);
+            return filtered.map((item) => ({
+                value: item,
+                label: cfg.labelFor(item, searchTerm),
+            }));
+        }, [searchTerm]);
+        useEffect(() => {
+            if (active >= results.length)
+                setActive(0);
+        }, [results]);
+        const selected = results[active];
+        // Selected items resolved in the original list order for deterministic fan-out.
+        const collectSelected = () => cfg.items.filter((it) => selectedKeys.has(cfg.keyFor(it)));
+        useKeypress((key, rl) => {
+            if (isEnterKey(key)) {
+                const chosen = selectedKeys.size > 0 ? collectSelected() : selected ? [selected.value] : [];
+                if (chosen.length === 0)
+                    return;
+                setStatus('done');
+                done(chosen);
+                return;
+            }
+            // space toggles the active row's checkbox; strip the space from the buffer
+            // so it never leaks into the filter.
+            if (isSpaceKey(key)) {
+                rl.clearLine(0);
+                if (selected) {
+                    const k = cfg.keyFor(selected.value);
+                    const next = new Set(selectedKeys);
+                    if (next.has(k))
+                        next.delete(k);
+                    else
+                        next.add(k);
+                    setSelectedKeys(next);
+                }
+                return;
+            }
+            if (key.name === 'tab' && cfg.buildPreview) {
+                rl.clearLine(0);
+                setPreviewOpen(!previewOpen);
+                return;
+            }
+            if (isUpKey(key)) {
+                rl.clearLine(0);
+                if (results.length > 0)
+                    setActive((active - 1 + results.length) % results.length);
+                return;
+            }
+            if (isDownKey(key)) {
+                rl.clearLine(0);
+                if (results.length > 0)
+                    setActive((active + 1) % results.length);
+                return;
+            }
+            setSearchTerm(rl.line);
+        });
+        const message = theme.style.message(cfg.message, status);
+        const count = selectedKeys.size;
+        if (status === 'done') {
+            return `${prefix} ${message} ${chalk.cyan(`${count || 1} session${(count || 1) === 1 ? '' : 's'}`)}`;
+        }
+        const placeholder = '(type to filter · space to toggle · enter to resume)';
+        const searchStr = searchTerm ? chalk.cyan(searchTerm) : chalk.gray(placeholder);
+        const header = [prefix, message, searchStr].filter(Boolean).join(' ');
+        const page = usePagination({
+            items: results,
+            active,
+            renderItem({ item, isActive }) {
+                if (Separator.isSeparator(item))
+                    return ` ${item.separator}`;
+                const checked = selectedKeys.has(cfg.keyFor(item.value));
+                const box = checked ? chalk.green('[x]') : chalk.gray('[ ]');
+                const cursor = isActive ? chalk.cyan('>') : ' ';
+                const row = isActive ? chalk.bold(item.label) : item.label;
+                return `${cursor} ${box} ${row}`;
+            },
+            pageSize: cfg.pageSize ?? 10,
+            loop: false,
+        });
+        const enter = cfg.enterHint ?? 'resume';
+        const countStr = count > 0 ? chalk.green(`${count} selected`) : chalk.gray('0 selected');
+        const help = chalk.gray(`${countStr}${chalk.gray(' · ↑↓ navigate · space toggle')}${cfg.buildPreview ? chalk.gray(' · tab preview') : ''}${chalk.gray(` · ⏎ ${enter} · esc cancel`)}`);
         const parts = [header, page];
         if (results.length === 0) {
             parts.push(chalk.gray(`  ${cfg.emptyMessage ?? 'No matches.'}`));

package/dist/lib/platform/exec.d.ts

@@ -17,3 +17,49 @@ export declare function needsWindowsShell(binary: string, platform?: NodeJS.Plat
  * shell would actually run, matching `which` semantics on POSIX.
  */
 export declare function findExecutable(name: string, platform?: NodeJS.Platform): string | null;
+/**
+ * Absolute path of the POSIX shell for `sh -c <command string>` composition.
+ * `/bin/sh` on POSIX; on Windows there is no /bin/sh, so resolve Git's
+ * `sh.exe`/`bash.exe` from PATH (present wherever Git for Windows is — dev
+ * boxes and the GitHub windows runners alike). Falls back to the bare name so
+ * a missing shell surfaces as a clear spawn ENOENT on `sh` rather than a
+ * misleading one on `/bin/sh`.
+ */
+export declare function posixShellPath(platform?: NodeJS.Platform): string;
+/**
+ * Quote one argument for a Windows `cmd.exe` command line, as built by Node's
+ * `spawn(..., { shell: true })` on win32 (the `.cmd` agent shims, `agents secrets
+ * exec`, ...). cmd.exe does NO quoting of its own, so an unquoted arg with a space
+ * is split into several args, and a cmd metacharacter (`&|<>()^`) would be
+ * interpreted by the shell. We wrap any arg with whitespace, a quote, or a
+ * metacharacter in double quotes and escape embedded quotes / trailing
+ * backslashes per the CommandLineToArgvW rules, so the *child's* argv parse
+ * reconstructs the original argument.
+ *
+ * CAVEAT: cmd.exe expands `%VAR%` (always) and `!VAR!` (under delayed expansion)
+ * BEFORE argv parsing, and double-quoting does NOT suppress `%`/`!` (the
+ * "BatBadBut" / CVE-2024-1874 class). We deliberately do not escape `%`/`!`:
+ * the callers here run a command whose `%`/`!`-bearing tokens are the caller's
+ * own (an agent prompt against the caller's shell, a bundle the caller owns), so
+ * caller-controlled `%`/`!` is not a privilege boundary. If that ever changes
+ * (composing an untrusted command line), route through a shell that disables
+ * expansion rather than relying on this quoter. An empty arg becomes `""`.
+ */
+export declare function quoteWin32ExecArg(arg: string): string;
+/**
+ * Compose a DEP0190-safe Windows shell command line from a command and its args.
+ *
+ * Node's `spawn(cmd, args, { shell: true })` on win32 concatenates `cmd` and
+ * every element of `args` into a single cmd.exe line WITHOUT escaping — that is
+ * both Node's DEP0190 deprecation (a future hard error) and a real injection
+ * surface, since user-controlled text (an agent prompt, a secrets-exec command)
+ * flows through `args`. Passing the fully-composed line as the SOLE `command`
+ * with an EMPTY args array sidesteps both: we quote every token with
+ * `quoteWin32ExecArg` so the child's CommandLineToArgvW parse reconstructs the
+ * exact original argv, and Node has no args array left to concatenate.
+ *
+ * Callers spawn the result as `spawn(line, [], { shell: true })`. A simple arg
+ * (no whitespace/quote/metachar) is passed through untouched, so the composed
+ * line is byte-identical to the old unquoted join for the common case.
+ */
+export declare function composeWin32CommandLine(command: string, args: string[]): string;

package/dist/lib/platform/exec.js

@@ -39,3 +39,77 @@ export function findExecutable(name, platform = process.platform) {
         return null;
     }
 }
+/**
+ * Absolute path of the POSIX shell for `sh -c <command string>` composition.
+ * `/bin/sh` on POSIX; on Windows there is no /bin/sh, so resolve Git's
+ * `sh.exe`/`bash.exe` from PATH (present wherever Git for Windows is — dev
+ * boxes and the GitHub windows runners alike). Falls back to the bare name so
+ * a missing shell surfaces as a clear spawn ENOENT on `sh` rather than a
+ * misleading one on `/bin/sh`.
+ */
+export function posixShellPath(platform = process.platform) {
+    if (platform !== 'win32')
+        return '/bin/sh';
+    return findExecutable('sh', platform) ?? findExecutable('bash', platform) ?? 'sh';
+}
+/**
+ * Quote one argument for a Windows `cmd.exe` command line, as built by Node's
+ * `spawn(..., { shell: true })` on win32 (the `.cmd` agent shims, `agents secrets
+ * exec`, ...). cmd.exe does NO quoting of its own, so an unquoted arg with a space
+ * is split into several args, and a cmd metacharacter (`&|<>()^`) would be
+ * interpreted by the shell. We wrap any arg with whitespace, a quote, or a
+ * metacharacter in double quotes and escape embedded quotes / trailing
+ * backslashes per the CommandLineToArgvW rules, so the *child's* argv parse
+ * reconstructs the original argument.
+ *
+ * CAVEAT: cmd.exe expands `%VAR%` (always) and `!VAR!` (under delayed expansion)
+ * BEFORE argv parsing, and double-quoting does NOT suppress `%`/`!` (the
+ * "BatBadBut" / CVE-2024-1874 class). We deliberately do not escape `%`/`!`:
+ * the callers here run a command whose `%`/`!`-bearing tokens are the caller's
+ * own (an agent prompt against the caller's shell, a bundle the caller owns), so
+ * caller-controlled `%`/`!` is not a privilege boundary. If that ever changes
+ * (composing an untrusted command line), route through a shell that disables
+ * expansion rather than relying on this quoter. An empty arg becomes `""`.
+ */
+export function quoteWin32ExecArg(arg) {
+    if (arg.length > 0 && !/[\s"&|<>()^]/.test(arg))
+        return arg;
+    let result = '"';
+    let backslashes = 0;
+    for (const ch of arg) {
+        if (ch === '\\') {
+            backslashes += 1;
+            continue;
+        }
+        if (ch === '"') {
+            // Double the run of backslashes, then escape this quote.
+            result += '\\'.repeat(backslashes * 2 + 1) + '"';
+            backslashes = 0;
+            continue;
+        }
+        result += '\\'.repeat(backslashes) + ch;
+        backslashes = 0;
+    }
+    // Trailing backslashes precede the closing quote → must be doubled.
+    result += '\\'.repeat(backslashes * 2) + '"';
+    return result;
+}
+/**
+ * Compose a DEP0190-safe Windows shell command line from a command and its args.
+ *
+ * Node's `spawn(cmd, args, { shell: true })` on win32 concatenates `cmd` and
+ * every element of `args` into a single cmd.exe line WITHOUT escaping — that is
+ * both Node's DEP0190 deprecation (a future hard error) and a real injection
+ * surface, since user-controlled text (an agent prompt, a secrets-exec command)
+ * flows through `args`. Passing the fully-composed line as the SOLE `command`
+ * with an EMPTY args array sidesteps both: we quote every token with
+ * `quoteWin32ExecArg` so the child's CommandLineToArgvW parse reconstructs the
+ * exact original argv, and Node has no args array left to concatenate.
+ *
+ * Callers spawn the result as `spawn(line, [], { shell: true })`. A simple arg
+ * (no whitespace/quote/metachar) is passed through untouched, so the composed
+ * line is byte-identical to the old unquoted join for the common case.
+ */
+export function composeWin32CommandLine(command, args) {
+    return [command, ...args].map(quoteWin32ExecArg).join(' ');
+}

package/dist/lib/platform/process.d.ts

@@ -9,6 +9,37 @@
  * process counts as success.
  */
 export declare function killTree(pid: number): void;
+/**
+ * Spawn options for a long-lived background child (daemon, detached worker,
+ * sidecar server, fire-and-forget job).
+ *
+ * POSIX: `detached: true` — the child leads its own process group, so it
+ * survives the parent and group kills (`kill(-pid)`) still reach it.
+ *
+ * Windows: the child must not share the launcher's console (a console-close
+ * event when the launcher exits would tear it down, #556) and must not flash
+ * a window. How to get there depends on the child's stdio:
+ *
+ * - All stdio non-inherited ('ignore'/'pipe'): `windowsHide: true`, NOT
+ *   detached. CREATE_NO_WINDOW gives the child its own hidden console that
+ *   every console-subsystem descendant (powershell, git, a .cmd shim's cmd.exe
+ *   wrapper) inherits — no window anywhere down the tree. `detached` would
+ *   defeat it: DETACHED_PROCESS makes CreateProcess ignore CREATE_NO_WINDOW.
+ *
+ * - Any stdio slot redirected to an fd (log files — `fdStdio: true`): libuv
+ *   skips CREATE_NO_WINDOW whenever a stdio fd is inherited, so windowsHide
+ *   cannot engage and a non-detached child would share the launcher's console
+ *   and die with it. Keep DETACHED_PROCESS: the child runs console-less and
+ *   windowless; its console-tool spawns stay invisible because the leaf call
+ *   sites pass their own `windowsHide` with piped stdio.
+ */
+export declare function backgroundSpawnOptions(opts?: {
+    fdStdio?: boolean;
+    platform?: NodeJS.Platform;
+}): {
+    detached: boolean;
+    windowsHide: boolean;
+};
 /**
  * Is a process with this PID currently alive?
  *

package/dist/lib/platform/process.js

@@ -17,7 +17,7 @@ export function killTree(pid) {
         return;
     if (process.platform === 'win32') {
         try {
-            execFileSync('taskkill', ['/F', '/T', '/PID', String(pid)], { stdio: 'ignore' });
+            execFileSync('taskkill', ['/F', '/T', '/PID', String(pid)], { stdio: 'ignore', windowsHide: true });
         }
         catch { /* already gone, or no such pid */ }
     }
@@ -28,6 +28,39 @@ export function killTree(pid) {
         catch { /* already gone */ }
     }
 }
+/**
+ * Spawn options for a long-lived background child (daemon, detached worker,
+ * sidecar server, fire-and-forget job).
+ *
+ * POSIX: `detached: true` — the child leads its own process group, so it
+ * survives the parent and group kills (`kill(-pid)`) still reach it.
+ *
+ * Windows: the child must not share the launcher's console (a console-close
+ * event when the launcher exits would tear it down, #556) and must not flash
+ * a window. How to get there depends on the child's stdio:
+ *
+ * - All stdio non-inherited ('ignore'/'pipe'): `windowsHide: true`, NOT
+ *   detached. CREATE_NO_WINDOW gives the child its own hidden console that
+ *   every console-subsystem descendant (powershell, git, a .cmd shim's cmd.exe
+ *   wrapper) inherits — no window anywhere down the tree. `detached` would
+ *   defeat it: DETACHED_PROCESS makes CreateProcess ignore CREATE_NO_WINDOW.
+ *
+ * - Any stdio slot redirected to an fd (log files — `fdStdio: true`): libuv
+ *   skips CREATE_NO_WINDOW whenever a stdio fd is inherited, so windowsHide
+ *   cannot engage and a non-detached child would share the launcher's console
+ *   and die with it. Keep DETACHED_PROCESS: the child runs console-less and
+ *   windowless; its console-tool spawns stay invisible because the leaf call
+ *   sites pass their own `windowsHide` with piped stdio.
+ */
+export function backgroundSpawnOptions(opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    if (platform === 'win32') {
+        return opts.fdStdio
+            ? { detached: true, windowsHide: true }
+            : { detached: false, windowsHide: true };
+    }
+    return { detached: true, windowsHide: false };
+}
 /**
  * Is a process with this PID currently alive?
  *

package/dist/lib/platform/winpath.js

@@ -107,6 +107,7 @@ function runPowerShell(script, extraEnv) {
         encoding: 'utf-8',
         env: extraEnv ? { ...process.env, ...extraEnv } : process.env,
         stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
     });
 }
 /** Parse the read script's stdout into the original value kind and RAW value. */
@@ -163,6 +164,7 @@ export function getEffectiveExecutionPolicy() {
         const out = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', 'Get-ExecutionPolicy'], {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
         }).trim();
         return out || null;
     }

package/dist/lib/plugin-marketplace.d.ts

@@ -144,6 +144,36 @@ export declare function syncMarketplaceManifest(spec: MarketplaceSpec, agent: Ag
  * marketplaces' entries are preserved untouched.
  */
 export declare function registerMarketplace(spec: MarketplaceSpec, agent: AgentId, versionHome: string): void;
+/**
+ * Record a plugin in Droid's installed_plugins.json (user scope), pointing
+ * installPath at the marketplace install dir so no second copy is needed. This
+ * is what makes `droid plugin list` show the plugin (Active once enabledPlugins
+ * is set). Idempotent: re-running refreshes lastUpdated and preserves the
+ * original installedAt plus any non-user scope entries.
+ */
+export declare function registerDroidInstalledPlugin(pluginName: string, marketplaceName: string, installDir: string, version: string, agent: AgentId, versionHome: string): void;
+/** True when Droid's installed_plugins.json carries a user-scope entry for the plugin. */
+export declare function isDroidPluginInstalled(pluginName: string, marketplaceName: string, agent: AgentId, versionHome: string): boolean;
+/**
+ * Remove a plugin's user-scope entry from Droid's installed_plugins.json.
+ * Inverse of registerDroidInstalledPlugin. Drops the key when no scopes remain
+ * and deletes the file when the registry is empty.
+ */
+export declare function unregisterDroidInstalledPlugin(pluginName: string, marketplaceName: string, agent: AgentId, versionHome: string): void;
+/**
+ * Record a plugin in Copilot's config.json#installedPlugins (the registry that
+ * makes `copilot plugin list` see it). `cache_path` points at the marketplace
+ * install dir — no separate copy. Idempotent: re-running refreshes the entry and
+ * preserves the original installed_at plus every other config key.
+ */
+export declare function registerCopilotInstalledPlugin(pluginName: string, marketplaceName: string, installDir: string, version: string, enabled: boolean, agent: AgentId, versionHome: string): void;
+/**
+ * Remove a plugin's entry from Copilot's config.json#installedPlugins. Inverse
+ * of registerCopilotInstalledPlugin. Leaves the file (with an empty
+ * installedPlugins) rather than deleting it, since config.json may hold other
+ * Copilot-managed keys.
+ */
+export declare function unregisterCopilotInstalledPlugin(pluginName: string, marketplaceName: string, agent: AgentId, versionHome: string): void;
 /**
  * Drop a marketplace entry from known_marketplaces.json. Called when the last
  * plugin under it is removed. Removes only its own entry; deletes the file only

package/dist/lib/plugin-marketplace.js

@@ -127,7 +127,14 @@ export function marketplaceRoot(specOrName, agent, versionHome) {
     return path.join(pluginsRootForVersion(agent, versionHome), 'marketplaces', nameOf(specOrName));
 }
 export function marketplaceManifestPath(specOrName, agent, versionHome) {
-    return path.join(marketplaceRoot(specOrName, agent, versionHome), '.claude-plugin', 'marketplace.json');
+    const root = marketplaceRoot(specOrName, agent, versionHome);
+    // Copilot resolves a marketplace's catalog from `marketplace.json` at the
+    // marketplace ROOT (also `.plugin/marketplace.json`, `.github/plugin/
+    // marketplace.json`) — NOT `.claude-plugin/marketplace.json`. Verified against
+    // GitHub Copilot CLI 1.0.56 (`plugin marketplace add`).
+    if (agent === 'copilot')
+        return path.join(root, 'marketplace.json');
+    return path.join(root, '.claude-plugin', 'marketplace.json');
 }
 export function pluginInstallDir(plugin, specOrName, agent, versionHome) {
     return path.join(marketplaceRoot(specOrName, agent, versionHome), 'plugins', plugin.name);
@@ -375,6 +382,14 @@ export function syncMarketplaceManifest(spec, agent, versionHome) {
 export function registerMarketplace(spec, agent, versionHome) {
     const name = marketplaceNameFor(spec);
     const root = marketplaceRoot(spec, agent, versionHome);
+    // Copilot diverges from Claude's known_marketplaces.json: it reads registered
+    // marketplaces from settings.json#extraKnownMarketplaces. Verified against
+    // GitHub Copilot CLI 1.0.56 (`plugin marketplace add <dir>` writes exactly
+    // this shape). A "directory"-source entry points at the on-disk catalog root.
+    if (agent === 'copilot') {
+        registerCopilotMarketplace(name, root, agent, versionHome);
+        return;
+    }
     const knownPath = knownMarketplacesPath(agent, versionHome);
     let known = {};
     if (fs.existsSync(knownPath)) {
@@ -385,14 +400,206 @@ export function registerMarketplace(spec, agent, versionHome) {
             known = {};
         }
     }
+    // Droid names the on-disk source type "local" (Claude/OpenClaw use
+    // "directory") and stamps autoUpdate — verified against `droid plugin
+    // marketplace add`. A "directory" entry is silently ignored by the Factory
+    // CLI, so the plugin never resolves.
+    const isDroid = agent === 'droid';
     known[name] = {
-        source: { source: 'directory', path: root },
+        source: { source: isDroid ? 'local' : 'directory', path: root },
         installLocation: root,
         lastUpdated: new Date().toISOString(),
+        ...(isDroid ? { autoUpdate: true } : {}),
     };
     fs.mkdirSync(path.dirname(knownPath), { recursive: true });
     fs.writeFileSync(knownPath, JSON.stringify(known, null, 2) + '\n', 'utf-8');
 }
+// ─── Droid installed-plugins registry ─────────────────────────────────────────
+function installedPluginsPath(agent, versionHome) {
+    return path.join(pluginsRootForVersion(agent, versionHome), 'installed_plugins.json');
+}
+function readInstalledPlugins(agent, versionHome) {
+    const p = installedPluginsPath(agent, versionHome);
+    if (fs.existsSync(p)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(p, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && parsed.plugins && typeof parsed.plugins === 'object') {
+                return { schemaVersion: parsed.schemaVersion ?? 1, plugins: parsed.plugins };
+            }
+        }
+        catch { /* fall through to fresh registry */ }
+    }
+    return { schemaVersion: 1, plugins: {} };
+}
+/**
+ * Record a plugin in Droid's installed_plugins.json (user scope), pointing
+ * installPath at the marketplace install dir so no second copy is needed. This
+ * is what makes `droid plugin list` show the plugin (Active once enabledPlugins
+ * is set). Idempotent: re-running refreshes lastUpdated and preserves the
+ * original installedAt plus any non-user scope entries.
+ */
+export function registerDroidInstalledPlugin(pluginName, marketplaceName, installDir, version, agent, versionHome) {
+    const registry = readInstalledPlugins(agent, versionHome);
+    const key = `${pluginName}@${marketplaceName}`;
+    const now = new Date().toISOString();
+    const existing = registry.plugins[key] ?? [];
+    const priorUser = existing.find(e => e.scope === 'user');
+    const others = existing.filter(e => e.scope !== 'user');
+    registry.plugins[key] = [
+        ...others,
+        {
+            scope: 'user',
+            installPath: installDir,
+            version,
+            installedAt: priorUser?.installedAt ?? now,
+            lastUpdated: now,
+            source: marketplaceName,
+        },
+    ];
+    const p = installedPluginsPath(agent, versionHome);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify(registry, null, 2) + '\n', 'utf-8');
+}
+/** True when Droid's installed_plugins.json carries a user-scope entry for the plugin. */
+export function isDroidPluginInstalled(pluginName, marketplaceName, agent, versionHome) {
+    const registry = readInstalledPlugins(agent, versionHome);
+    const entries = registry.plugins[`${pluginName}@${marketplaceName}`];
+    return Array.isArray(entries) && entries.some(e => e.scope === 'user');
+}
+/**
+ * Remove a plugin's user-scope entry from Droid's installed_plugins.json.
+ * Inverse of registerDroidInstalledPlugin. Drops the key when no scopes remain
+ * and deletes the file when the registry is empty.
+ */
+export function unregisterDroidInstalledPlugin(pluginName, marketplaceName, agent, versionHome) {
+    const p = installedPluginsPath(agent, versionHome);
+    if (!fs.existsSync(p))
+        return;
+    const registry = readInstalledPlugins(agent, versionHome);
+    const key = `${pluginName}@${marketplaceName}`;
+    const entries = registry.plugins[key];
+    if (!Array.isArray(entries))
+        return;
+    const kept = entries.filter(e => e.scope !== 'user');
+    if (kept.length > 0) {
+        registry.plugins[key] = kept;
+    }
+    else {
+        delete registry.plugins[key];
+    }
+    if (Object.keys(registry.plugins).length === 0) {
+        try {
+            fs.unlinkSync(p);
+        }
+        catch { /* ignore */ }
+        return;
+    }
+    fs.writeFileSync(p, JSON.stringify(registry, null, 2) + '\n', 'utf-8');
+}
+// ─── Copilot marketplace + installed-plugin registry ──────────────────────────
+function copilotConfigPath(agent, versionHome) {
+    return path.join(versionHome, agentConfigDirName(agent), 'config.json');
+}
+function readCopilotSettings(agent, versionHome) {
+    const p = settingsPath(agent, versionHome);
+    if (fs.existsSync(p)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(p, 'utf-8'));
+            if (parsed && typeof parsed === 'object')
+                return parsed;
+        }
+        catch { /* fall through */ }
+    }
+    return {};
+}
+function writeCopilotSettings(agent, versionHome, settings) {
+    const p = settingsPath(agent, versionHome);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+}
+/** Register a marketplace in Copilot's settings.json#extraKnownMarketplaces. */
+function registerCopilotMarketplace(name, root, agent, versionHome) {
+    const settings = readCopilotSettings(agent, versionHome);
+    const known = (settings.extraKnownMarketplaces && typeof settings.extraKnownMarketplaces === 'object'
+        ? settings.extraKnownMarketplaces
+        : {});
+    known[name] = { source: { source: 'directory', path: root } };
+    settings.extraKnownMarketplaces = known;
+    writeCopilotSettings(agent, versionHome, settings);
+}
+/** Inverse of registerCopilotMarketplace: drop the entry, prune the empty key. */
+function unregisterCopilotMarketplace(name, agent, versionHome) {
+    const p = settingsPath(agent, versionHome);
+    if (!fs.existsSync(p))
+        return;
+    const settings = readCopilotSettings(agent, versionHome);
+    const known = settings.extraKnownMarketplaces;
+    if (!known || !(name in known))
+        return;
+    delete known[name];
+    if (Object.keys(known).length === 0)
+        delete settings.extraKnownMarketplaces;
+    writeCopilotSettings(agent, versionHome, settings);
+}
+function readCopilotConfig(agent, versionHome) {
+    const p = copilotConfigPath(agent, versionHome);
+    if (fs.existsSync(p)) {
+        try {
+            // config.json may carry a leading `//` comment banner written by Copilot;
+            // strip line comments before parsing so we never clobber a real config.
+            const raw = fs.readFileSync(p, 'utf-8').replace(/^\s*\/\/.*$/gm, '');
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object') {
+                return { ...parsed, installedPlugins: Array.isArray(parsed.installedPlugins) ? parsed.installedPlugins : [] };
+            }
+        }
+        catch { /* fall through to fresh config */ }
+    }
+    return { installedPlugins: [] };
+}
+/**
+ * Record a plugin in Copilot's config.json#installedPlugins (the registry that
+ * makes `copilot plugin list` see it). `cache_path` points at the marketplace
+ * install dir — no separate copy. Idempotent: re-running refreshes the entry and
+ * preserves the original installed_at plus every other config key.
+ */
+export function registerCopilotInstalledPlugin(pluginName, marketplaceName, installDir, version, enabled, agent, versionHome) {
+    const config = readCopilotConfig(agent, versionHome);
+    const now = new Date().toISOString();
+    const prior = config.installedPlugins.find(e => e.name === pluginName && e.marketplace === marketplaceName);
+    const others = config.installedPlugins.filter(e => !(e.name === pluginName && e.marketplace === marketplaceName));
+    config.installedPlugins = [
+        ...others,
+        {
+            name: pluginName,
+            marketplace: marketplaceName,
+            version,
+            installed_at: prior?.installed_at ?? now,
+            enabled,
+            cache_path: installDir,
+        },
+    ];
+    const p = copilotConfigPath(agent, versionHome);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+}
+/**
+ * Remove a plugin's entry from Copilot's config.json#installedPlugins. Inverse
+ * of registerCopilotInstalledPlugin. Leaves the file (with an empty
+ * installedPlugins) rather than deleting it, since config.json may hold other
+ * Copilot-managed keys.
+ */
+export function unregisterCopilotInstalledPlugin(pluginName, marketplaceName, agent, versionHome) {
+    const p = copilotConfigPath(agent, versionHome);
+    if (!fs.existsSync(p))
+        return;
+    const config = readCopilotConfig(agent, versionHome);
+    const kept = config.installedPlugins.filter(e => !(e.name === pluginName && e.marketplace === marketplaceName));
+    if (kept.length === config.installedPlugins.length)
+        return;
+    config.installedPlugins = kept;
+    fs.writeFileSync(p, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+}
 /**
  * Drop a marketplace entry from known_marketplaces.json. Called when the last
  * plugin under it is removed. Removes only its own entry; deletes the file only
@@ -400,6 +607,12 @@ export function registerMarketplace(spec, agent, versionHome) {
  */
 export function unregisterMarketplace(specOrName, agent, versionHome) {
     const name = nameOf(specOrName);
+    // Copilot stores registrations in settings.json#extraKnownMarketplaces, not
+    // known_marketplaces.json. Mirror the branch in registerMarketplace.
+    if (agent === 'copilot') {
+        unregisterCopilotMarketplace(name, agent, versionHome);
+        return;
+    }
     const knownPath = knownMarketplacesPath(agent, versionHome);
     if (!fs.existsSync(knownPath))
         return;

package/dist/lib/plugins.d.ts

@@ -148,6 +148,11 @@ export declare function marketplaceSpecForName(name: string | undefined, cwd?: s
  * MCP servers, bin/, settings.json, and permissions once the plugin lives at the
  * native install path and is marked enabled — see
  * https://code.claude.com/docs/en/plugins.
+ *
+ * Droid (Factory CLI) reuses this same marketplace layout but additionally
+ * requires an installed_plugins.json registry entry and a "local"-source
+ * known_marketplaces.json entry before `droid plugin list` will see the plugin
+ * (steps handled by registerMarketplace's droid branch + step 5c below).
  */
 export declare function syncPluginToVersion(plugin: DiscoveredPlugin, agent: AgentId, versionHome: string, options?: {
     allowExecSurfaces?: boolean;