@shipit-ai/cli 1.169.0 → 1.170.0-pr13.d3605b0

package/dist/packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.js

@@ -8,6 +8,7 @@
  * Uses constructor dependency injection for the spawn function
  * to enable testability without mocking node:child_process directly.
  */
+import { LiteLLMProxyRoutingMode } from '../../../../../domain/generated/output.js';
 import { ExecutorBase } from './executor-base.js';
 /** Features supported by Claude Code CLI */
 const SUPPORTED_FEATURES = new Set([
@@ -23,9 +24,52 @@ const SUPPORTED_FEATURES = new Set([
  */
 export class ClaudeCodeExecutorService extends ExecutorBase {
     agentType = 'claude-code';
+    proxyConfig;
     constructor(spawn) {
         super(spawn);
     }
+    updateProxyConfig(config) {
+        this.proxyConfig = config;
+    }
+    buildSpawnEnv() {
+        const env = super.buildSpawnEnv();
+        const cc = this.proxyConfig?.claudeCode;
+        if (!cc || !this.proxyConfig?.baseUrl)
+            return env;
+        const mode = cc.routingMode ?? LiteLLMProxyRoutingMode.direct;
+        if (mode === LiteLLMProxyRoutingMode.direct)
+            return env;
+        // Both proxy and passthrough set BASE_URL
+        env.ANTHROPIC_BASE_URL = this.proxyConfig.baseUrl;
+        if (mode === LiteLLMProxyRoutingMode.proxy) {
+            if (this.proxyConfig.apiKey) {
+                env.ANTHROPIC_AUTH_TOKEN = this.proxyConfig.apiKey;
+            }
+            if (cc.customHeaders) {
+                env.ANTHROPIC_CUSTOM_HEADERS = cc.customHeaders;
+            }
+        }
+        else if (mode === LiteLLMProxyRoutingMode.passthrough) {
+            const headers = [];
+            if (this.proxyConfig.apiKey) {
+                headers.push(`x-litellm-api-key: Bearer ${this.proxyConfig.apiKey}`);
+            }
+            if (cc.customHeaders) {
+                headers.push(cc.customHeaders);
+            }
+            if (headers.length) {
+                env.ANTHROPIC_CUSTOM_HEADERS = headers.join('\n');
+            }
+        }
+        // Model overrides (both proxy and passthrough)
+        if (cc.sonnetModel)
+            env.ANTHROPIC_DEFAULT_SONNET_MODEL = cc.sonnetModel;
+        if (cc.haikuModel)
+            env.ANTHROPIC_DEFAULT_HAIKU_MODEL = cc.haikuModel;
+        if (cc.opusModel)
+            env.ANTHROPIC_DEFAULT_OPUS_MODEL = cc.opusModel;
+        return env;
+    }
     async execute(prompt, options) {
         this.silent = options?.silent ?? false;
         // Use stream-json so we get real-time events in the worker log

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-agent-worker.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,kBAAkB,CAAC;AAgB1B,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAW7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyF1D;AAgCD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0S/D"}
+{"version":3,"file":"feature-agent-worker.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,kBAAkB,CAAC;AAiB1B,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAW7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyF1D;AAgCD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA8S/D"}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.js

@@ -16,6 +16,7 @@ import { initializeContainer, container } from '../../../di/container.js';
 import { createFeatureAgentGraph } from './feature-agent-graph.js';
 import { createFastFeatureAgentGraph } from './fast-feature-agent-graph.js';
 import { createCheckpointer } from '../common/checkpointer.js';
+import { ClaudeCodeExecutorService } from '../../../services/agents/common/executors/claude-code-executor.service.js';
 import { AgentRunStatus, SdlcLifecycle } from '../../../../domain/generated/output.js';
 import { initializeSettings } from '../../../services/settings.service.js';
 import { InitializeSettingsUseCase } from '../../../../application/use-cases/settings/initialize-settings.use-case.js';
@@ -183,6 +184,10 @@ export async function runWorker(args) {
         log(`Creating executor from pinned agent type: ${args.agentType}`);
         const factory = container.resolve('IAgentExecutorFactory');
         executor = factory.createExecutor(args.agentType, settings.agent);
+        // Update proxy config for direct factory calls (provider does this automatically)
+        if (executor instanceof ClaudeCodeExecutorService) {
+            executor.updateProxyConfig(settings.litellmProxy);
+        }
     }
     else {
         log('Creating executor from configured agent settings...');

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/index.d.ts

@@ -0,0 +1,4 @@
+export { PluginMarketplaceService } from './plugin-marketplace.service.js';
+export { MarketplaceCatalogSchema, InstalledPluginSchema, InstalledPluginsListSchema, } from './plugin-marketplace.schema.js';
+export { validatePluginId, validateMarketplaceName, validateMarketplaceUrl, validateScope, } from './plugin-marketplace.validators.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/plugin-marketplace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,oCAAoC,CAAC"}

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/index.js

@@ -0,0 +1,3 @@
+export { PluginMarketplaceService } from './plugin-marketplace.service.js';
+export { MarketplaceCatalogSchema, InstalledPluginSchema, InstalledPluginsListSchema, } from './plugin-marketplace.schema.js';
+export { validatePluginId, validateMarketplaceName, validateMarketplaceUrl, validateScope, } from './plugin-marketplace.validators.js';

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.schema.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Zod Schemas for Plugin Marketplace Data Validation
+ *
+ * Validates all external data boundaries:
+ * 1. LiteLLM proxy marketplace.json response
+ * 2. `claude plugin list --json` CLI output
+ *
+ * All data from external sources is untrusted. Strings are capped
+ * to prevent excessive memory use in UI rendering.
+ */
+import { z } from 'zod';
+declare const PluginEntrySchema: z.ZodObject<{
+    name: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    description: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string, string>>;
+    version: z.ZodOptional<z.ZodString>;
+    source: z.ZodObject<{
+        source: z.ZodEnum<{
+            url: "url";
+            github: "github";
+            "git-subdir": "git-subdir";
+        }>;
+        repo: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        path: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    category: z.ZodOptional<z.ZodString>;
+    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const MarketplaceCatalogSchema: z.ZodObject<{
+    name: z.ZodString;
+    owner: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodString;
+    }, z.core.$strip>>;
+    plugins: z.ZodArray<z.ZodObject<{
+        name: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        description: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string, string>>;
+        version: z.ZodOptional<z.ZodString>;
+        source: z.ZodObject<{
+            source: z.ZodEnum<{
+                url: "url";
+                github: "github";
+                "git-subdir": "git-subdir";
+            }>;
+            repo: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        category: z.ZodOptional<z.ZodString>;
+        keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const InstalledPluginSchema: z.ZodObject<{
+    id: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        project: "project";
+        local: "local";
+    }>;
+    version: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodBoolean;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const InstalledPluginsListSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        project: "project";
+        local: "local";
+    }>;
+    version: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodBoolean;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type MarketplaceCatalog = z.infer<typeof MarketplaceCatalogSchema>;
+export type ValidatedPluginEntry = z.infer<typeof PluginEntrySchema>;
+export {};
+//# sourceMappingURL=plugin-marketplace.schema.d.ts.map

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-marketplace.schema.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;iBASnC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAMhC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAAiC,CAAC;AAEzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.schema.js

@@ -0,0 +1,46 @@
+/**
+ * Zod Schemas for Plugin Marketplace Data Validation
+ *
+ * Validates all external data boundaries:
+ * 1. LiteLLM proxy marketplace.json response
+ * 2. `claude plugin list --json` CLI output
+ *
+ * All data from external sources is untrusted. Strings are capped
+ * to prevent excessive memory use in UI rendering.
+ */
+import { z } from 'zod';
+const PluginSourceSchema = z.object({
+    source: z.enum(['github', 'url', 'git-subdir']),
+    repo: z.string().optional(),
+    url: z.string().optional(),
+    path: z.string().optional(),
+});
+const PluginEntrySchema = z.object({
+    name: z.string().transform((s) => s.slice(0, 100)),
+    description: z
+        .string()
+        .default('')
+        .transform((s) => s.slice(0, 2000)),
+    version: z.string().optional(),
+    source: PluginSourceSchema,
+    category: z.string().optional(),
+    keywords: z.array(z.string()).optional(),
+});
+export const MarketplaceCatalogSchema = z.object({
+    name: z.string(),
+    owner: z
+        .object({
+        name: z.string(),
+        email: z.string(),
+    })
+        .optional(),
+    plugins: z.array(PluginEntrySchema),
+});
+export const InstalledPluginSchema = z.object({
+    id: z.string(),
+    scope: z.enum(['user', 'project', 'local']),
+    version: z.string().optional(),
+    enabled: z.boolean(),
+    installedAt: z.string().optional(),
+});
+export const InstalledPluginsListSchema = z.array(InstalledPluginSchema);

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.service.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Plugin Marketplace Service
+ *
+ * Implements IPluginMarketplaceService using:
+ * - Node 22+ native fetch for HTTP catalog retrieval from LiteLLM proxy
+ * - execFile-style subprocess calls to the `claude` CLI for plugin lifecycle
+ *
+ * This is the first HTTP client in the infrastructure layer.
+ * Pattern: AbortController timeout, redirect rejection, size limit, Zod validation.
+ *
+ * All subprocess arguments are validated via allowlist validators before passing
+ * to execFile. Arguments are always separate array elements (never concatenated).
+ */
+import type { IPluginMarketplaceService, PluginMarketplaceEntry, InstalledPlugin, PluginOperationResult } from '../../../application/ports/output/services/plugin-marketplace.interface.js';
+type SpawnCallback = (error: Error | null, stdout: string, stderr: string) => void;
+type SpawnFunction = (cmd: string, args: string[], callback: SpawnCallback) => void;
+export declare class PluginMarketplaceService implements IPluginMarketplaceService {
+    private readonly spawn;
+    constructor(spawn: SpawnFunction);
+    fetchCatalog(proxyBaseUrl: string, apiKey?: string): Promise<PluginMarketplaceEntry[]>;
+    listInstalled(): Promise<InstalledPlugin[]>;
+    installPlugin(pluginId: string, marketplace: string, scope?: string): Promise<PluginOperationResult>;
+    uninstallPlugin(pluginId: string, marketplace: string): Promise<PluginOperationResult>;
+    togglePlugin(pluginId: string, marketplace: string, enabled: boolean): Promise<PluginOperationResult>;
+    addMarketplace(url: string): Promise<PluginOperationResult>;
+    private execClaude;
+}
+export {};
+//# sourceMappingURL=plugin-marketplace.service.d.ts.map

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-marketplace.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACtB,MAAM,4EAA4E,CAAC;AAYpF,KAAK,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;AACnF,KAAK,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;AAMpF,qBAAa,wBAAyB,YAAW,yBAAyB;IACxE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;gBAE1B,KAAK,EAAE,aAAa;IAI1B,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAgDtF,aAAa,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB3C,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC;IAY3B,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAWtF,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC;IAY3B,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUjE,OAAO,CAAC,UAAU;CAanB"}

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.service.js

@@ -0,0 +1,147 @@
+/**
+ * Plugin Marketplace Service
+ *
+ * Implements IPluginMarketplaceService using:
+ * - Node 22+ native fetch for HTTP catalog retrieval from LiteLLM proxy
+ * - execFile-style subprocess calls to the `claude` CLI for plugin lifecycle
+ *
+ * This is the first HTTP client in the infrastructure layer.
+ * Pattern: AbortController timeout, redirect rejection, size limit, Zod validation.
+ *
+ * All subprocess arguments are validated via allowlist validators before passing
+ * to execFile. Arguments are always separate array elements (never concatenated).
+ */
+import { MarketplaceCatalogSchema, InstalledPluginsListSchema, } from './plugin-marketplace.schema.js';
+import { validatePluginId, validateMarketplaceName, validateMarketplaceUrl, validateScope, } from './plugin-marketplace.validators.js';
+const FETCH_TIMEOUT_MS = 10_000;
+const MAX_RESPONSE_SIZE = 5_000_000;
+const CLAUDE_BINARY = process.platform === 'win32' ? 'claude.cmd' : 'claude';
+export class PluginMarketplaceService {
+    spawn;
+    constructor(spawn) {
+        this.spawn = spawn;
+    }
+    async fetchCatalog(proxyBaseUrl, apiKey) {
+        try {
+            const url = validateMarketplaceUrl(proxyBaseUrl);
+            if (apiKey && url.protocol === 'http:') {
+                return [];
+            }
+            const catalogUrl = `${url.toString().replace(/\/$/, '')}/claude-code/marketplace.json`;
+            const headers = {};
+            if (apiKey) {
+                headers['Authorization'] = `Bearer ${apiKey}`;
+            }
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+            try {
+                const res = await fetch(catalogUrl, {
+                    signal: controller.signal,
+                    redirect: 'error',
+                    headers,
+                });
+                if (!res.ok) {
+                    return [];
+                }
+                const text = await res.text();
+                if (text.length > MAX_RESPONSE_SIZE) {
+                    return [];
+                }
+                const json = JSON.parse(text);
+                const parsed = MarketplaceCatalogSchema.safeParse(json);
+                if (!parsed.success) {
+                    return [];
+                }
+                return parsed.data.plugins;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        }
+        catch {
+            return [];
+        }
+    }
+    async listInstalled() {
+        return new Promise((resolve) => {
+            this.spawn(CLAUDE_BINARY, ['plugin', 'list', '--json'], (error, stdout) => {
+                if (error) {
+                    resolve([]);
+                    return;
+                }
+                try {
+                    const json = JSON.parse(stdout);
+                    const parsed = InstalledPluginsListSchema.safeParse(json);
+                    if (parsed.success) {
+                        resolve(parsed.data);
+                    }
+                    else {
+                        resolve([]);
+                    }
+                }
+                catch {
+                    resolve([]);
+                }
+            });
+        });
+    }
+    async installPlugin(pluginId, marketplace, scope) {
+        try {
+            const validId = validatePluginId(pluginId);
+            const validMp = validateMarketplaceName(marketplace);
+            const validScope = scope ? validateScope(scope) : 'user';
+            const args = ['plugin', 'install', `${validId}@${validMp}`, '--scope', validScope];
+            return await this.execClaude(args);
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : 'Validation failed' };
+        }
+    }
+    async uninstallPlugin(pluginId, marketplace) {
+        try {
+            const validId = validatePluginId(pluginId);
+            const validMp = validateMarketplaceName(marketplace);
+            const args = ['plugin', 'uninstall', `${validId}@${validMp}`];
+            return await this.execClaude(args);
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : 'Validation failed' };
+        }
+    }
+    async togglePlugin(pluginId, marketplace, enabled) {
+        try {
+            const validId = validatePluginId(pluginId);
+            const validMp = validateMarketplaceName(marketplace);
+            const action = enabled ? 'enable' : 'disable';
+            const args = ['plugin', action, `${validId}@${validMp}`];
+            return await this.execClaude(args);
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : 'Validation failed' };
+        }
+    }
+    async addMarketplace(url) {
+        try {
+            const validUrl = validateMarketplaceUrl(url);
+            const args = ['plugin', 'marketplace', 'add', validUrl.toString()];
+            return await this.execClaude(args);
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : 'Validation failed' };
+        }
+    }
+    execClaude(args) {
+        return new Promise((resolve) => {
+            this.spawn(CLAUDE_BINARY, args, (error) => {
+                if (error) {
+                    // Never expose raw subprocess stderr/error to the client.
+                    // Generic message only — details are logged server-side.
+                    resolve({ success: false, error: 'Plugin operation failed' });
+                }
+                else {
+                    resolve({ success: true });
+                }
+            });
+        });
+    }
+}

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.validators.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Input Validators for Plugin Marketplace Operations
+ *
+ * Strict allowlist-based validation for all values that become subprocess
+ * arguments or HTTP request parameters. Defense-in-depth against injection.
+ */
+export declare function validatePluginId(name: string): string;
+export declare function validateMarketplaceUrl(urlString: string): URL;
+export declare function validateMarketplaceName(name: string): string;
+export declare function validateScope(scope: string): 'user' | 'project' | 'local';
+//# sourceMappingURL=plugin-marketplace.validators.d.ts.map

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-marketplace.validators.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.validators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,CAkB7D;AAKD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAKzE"}

package/dist/packages/core/src/infrastructure/services/plugin-marketplace/plugin-marketplace.validators.js

@@ -0,0 +1,47 @@
+/**
+ * Input Validators for Plugin Marketplace Operations
+ *
+ * Strict allowlist-based validation for all values that become subprocess
+ * arguments or HTTP request parameters. Defense-in-depth against injection.
+ */
+const PLUGIN_NAME_REGEX = /^[a-zA-Z0-9_-]+$/;
+const MAX_PLUGIN_NAME_LENGTH = 100;
+const VALID_SCOPES = ['user', 'project', 'local'];
+const LOCALHOST_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+export function validatePluginId(name) {
+    if (!name || name.length > MAX_PLUGIN_NAME_LENGTH || !PLUGIN_NAME_REGEX.test(name)) {
+        throw new Error(`Invalid plugin ID: must be 1-${MAX_PLUGIN_NAME_LENGTH} characters matching [a-zA-Z0-9_-]`);
+    }
+    return name;
+}
+export function validateMarketplaceUrl(urlString) {
+    let url;
+    try {
+        url = new URL(urlString);
+    }
+    catch {
+        throw new Error(`Invalid marketplace URL: ${urlString}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`Invalid URL scheme: ${url.protocol} (only http: and https: allowed)`);
+    }
+    const isLocalhost = LOCALHOST_HOSTNAMES.has(url.hostname);
+    if (url.protocol === 'http:' && !isLocalhost) {
+        throw new Error('HTTP is only allowed for localhost URLs. Use HTTPS for remote hosts.');
+    }
+    return url;
+}
+const MARKETPLACE_NAME_REGEX = /^[a-zA-Z0-9_\-.:/@]+$/;
+const MAX_MARKETPLACE_NAME_LENGTH = 200;
+export function validateMarketplaceName(name) {
+    if (!name || name.length > MAX_MARKETPLACE_NAME_LENGTH || !MARKETPLACE_NAME_REGEX.test(name)) {
+        throw new Error(`Invalid marketplace name: must be 1-${MAX_MARKETPLACE_NAME_LENGTH} characters matching [a-zA-Z0-9_-./:@]`);
+    }
+    return name;
+}
+export function validateScope(scope) {
+    if (!VALID_SCOPES.includes(scope)) {
+        throw new Error(`Invalid scope: ${scope} (must be one of: ${VALID_SCOPES.join(', ')})`);
+    }
+    return scope;
+}

package/dist/src/presentation/web/app/actions/add-marketplace.d.ts

@@ -0,0 +1,5 @@
+export declare function addMarketplaceAction(url: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=add-marketplace.d.ts.map

package/dist/src/presentation/web/app/actions/add-marketplace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-marketplace.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/add-marketplace.ts"],"names":[],"mappings":"AAKA,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C"}

package/dist/src/presentation/web/app/actions/add-marketplace.js

@@ -0,0 +1,11 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+export async function addMarketplaceAction(url) {
+    try {
+        const useCase = resolve('AddMarketplaceUseCase');
+        return await useCase.execute({ url });
+    }
+    catch {
+        return { success: false, error: 'Failed to add marketplace' };
+    }
+}

package/dist/src/presentation/web/app/actions/fetch-plugin-catalog.d.ts

@@ -0,0 +1,5 @@
+import type { FetchPluginCatalogResult } from '../../../../../packages/core/src/application/use-cases/plugins/fetch-plugin-catalog.use-case.js';
+export declare function fetchPluginCatalogAction(): Promise<FetchPluginCatalogResult & {
+    error?: string;
+}>;
+//# sourceMappingURL=fetch-plugin-catalog.d.ts.map

package/dist/src/presentation/web/app/actions/fetch-plugin-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-plugin-catalog.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/fetch-plugin-catalog.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6EAA6E,CAAC;AAE5H,wBAAsB,wBAAwB,IAAI,OAAO,CACvD,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAC9C,CAOA"}

package/dist/src/presentation/web/app/actions/fetch-plugin-catalog.js

@@ -0,0 +1,11 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+export async function fetchPluginCatalogAction() {
+    try {
+        const useCase = resolve('FetchPluginCatalogUseCase');
+        return await useCase.execute();
+    }
+    catch {
+        return { plugins: [], installedPlugins: [], error: 'Failed to fetch plugin catalog' };
+    }
+}

package/dist/src/presentation/web/app/actions/install-plugin.d.ts

@@ -0,0 +1,5 @@
+export declare function installPluginAction(pluginId: string, marketplace: string, scope?: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=install-plugin.d.ts.map

package/dist/src/presentation/web/app/actions/install-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/install-plugin.ts"],"names":[],"mappings":"AAKA,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C"}

package/dist/src/presentation/web/app/actions/install-plugin.js

@@ -0,0 +1,11 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+export async function installPluginAction(pluginId, marketplace, scope) {
+    try {
+        const useCase = resolve('InstallPluginUseCase');
+        return await useCase.execute({ pluginId, marketplace, scope });
+    }
+    catch {
+        return { success: false, error: 'Failed to install plugin' };
+    }
+}

package/dist/src/presentation/web/app/actions/toggle-plugin.d.ts

@@ -0,0 +1,5 @@
+export declare function togglePluginAction(pluginId: string, marketplace: string, enabled: boolean): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=toggle-plugin.d.ts.map

package/dist/src/presentation/web/app/actions/toggle-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toggle-plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/toggle-plugin.ts"],"names":[],"mappings":"AAKA,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C"}

package/dist/src/presentation/web/app/actions/toggle-plugin.js

@@ -0,0 +1,11 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+export async function togglePluginAction(pluginId, marketplace, enabled) {
+    try {
+        const useCase = resolve('TogglePluginUseCase');
+        return await useCase.execute({ pluginId, marketplace, enabled });
+    }
+    catch {
+        return { success: false, error: 'Failed to toggle plugin' };
+    }
+}

package/dist/src/presentation/web/app/actions/uninstall-plugin.d.ts

@@ -0,0 +1,5 @@
+export declare function uninstallPluginAction(pluginId: string, marketplace: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=uninstall-plugin.d.ts.map

package/dist/src/presentation/web/app/actions/uninstall-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall-plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/uninstall-plugin.ts"],"names":[],"mappings":"AAKA,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C"}

package/dist/src/presentation/web/app/actions/uninstall-plugin.js

@@ -0,0 +1,11 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+export async function uninstallPluginAction(pluginId, marketplace) {
+    try {
+        const useCase = resolve('UninstallPluginUseCase');
+        return await useCase.execute({ pluginId, marketplace });
+    }
+    catch {
+        return { success: false, error: 'Failed to uninstall plugin' };
+    }
+}

package/dist/src/presentation/web/app/plugins/page.d.ts

@@ -0,0 +1,2 @@
+export default function PluginsPage(): Promise<import("react/jsx-runtime").JSX.Element>;
+//# sourceMappingURL=page.d.ts.map

package/dist/src/presentation/web/app/plugins/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/plugins/page.tsx"],"names":[],"mappings":"AAOA,wBAA8B,WAAW,qDAkBxC"}

package/dist/src/presentation/web/app/plugins/page.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { notFound } from 'next/navigation';
+import { getFeatureFlags } from '../../lib/feature-flags.js';
+import { PluginsPageClient } from '../../components/features/plugins/plugins-page-client.js';
+import { resolve } from '../../lib/server-container.js';
+import { AgentType } from '../../../../../packages/core/src/domain/generated/output.js';
+export default async function PluginsPage() {
+    const flags = await getFeatureFlags();
+    if (!flags.plugins)
+        notFound();
+    let proxyConfigured = false;
+    let isClaudeCode = false;
+    try {
+        const useCase = resolve('LoadSettingsUseCase');
+        const settings = await useCase.execute();
+        proxyConfigured = !!(settings.litellmProxy?.baseUrl && settings.litellmProxy?.marketplaceEnabled);
+        isClaudeCode = settings.agent?.type === AgentType.ClaudeCode;
+    }
+    catch {
+        // Settings not available
+    }
+    return _jsx(PluginsPageClient, { proxyConfigured: proxyConfigured, isClaudeCode: isClaudeCode });
+}

package/dist/src/presentation/web/components/common/repository-node/repository-drawer.stories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-drawer.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/repository-node/repository-drawer.stories.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,gBAAgB,CAOvC,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAqB/C,eAAO,MAAM,OAAO,EAAE,KAErB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAUtB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAIzB,CAAC;AAuBF,2EAA2E;AAC3E,eAAO,MAAM,QAAQ,EAAE,KAEtB,CAAC;AAkCF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,EAAE,KAE/B,CAAC"}
+{"version":3,"file":"repository-drawer.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/repository-node/repository-drawer.stories.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,gBAAgB,CAOvC,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAqB/C,eAAO,MAAM,OAAO,EAAE,KAErB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAUtB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAIzB,CAAC;AAuBF,2EAA2E;AAC3E,eAAO,MAAM,QAAQ,EAAE,KAEtB,CAAC;AAmCF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,EAAE,KAE/B,CAAC"}