@subshell-ai/plugin-claude-code 1.0.1 → 3.0.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-//#region ../../plugin-api/dist/types-CSNepTNr.d.ts
+//#region ../../plugin-api/dist/types-D6R-hjGN.d.ts
 //#region src/types.d.ts
 /**
  * The contract a Subshell plugin implements.
@@ -20,16 +20,28 @@
  * For humans: it groups and labels in the UI and filters the catalog. Code
  * branches on {@link PluginCapability} instead, so adding a type here touches
  * labels while adding a capability touches the launch pipeline.
+ *
+ * ONE exception, and it is structural rather than a branch on a label: a
+ * `network` plugin implements {@link NetworkPlugin} instead of
+ * {@link SubshellPlugin}, so the loader picks WHICH members to require by
+ * type. A harness drives a thing in a pane; a network plugin connects this
+ * host to one network. They share the store, the manifest and the capability
+ * vocabulary, and nothing else.
  */
-type PluginType = "agent-harness" | "terminal";
+type PluginType = "agent-harness" | "terminal" | "network";
 /**
  * What a plugin can DO. The launch pipeline and the UI read this; neither
  * branches on {@link PluginType}.
+ *
+ * The union is shared across types and the applicable SUBSET is not, so
+ * {@link capabilityMismatches} takes the type: a harness claiming `publish`
+ * and a network plugin claiming `resume` are both refused at load, for the
+ * same reason a claimed-but-unimplemented capability is.
  */
-type PluginCapability = "mcp" | "resume" | "attention" | "settings";
-/** A harness profile as defined by the user (decoded JSON blobs). */
-interface ProfileDefinition {
-  /** Human-friendly profile name */
+type PluginCapability = "mcp" | "resume" | "attention" | "publish" | "supervise" | "guard" | "settings";
+/** A harness preset as defined by the user (decoded JSON blobs). */
+interface PresetDefinition {
+  /** Human-friendly preset name */
   name: string;
   /** Optional longer description */
   description?: string | null;
@@ -39,21 +51,21 @@ interface ProfileDefinition {
   flags: string[];
   /** Settings blob passed to the harness (e.g. claude --settings JSON) */
   settings: Record<string, unknown> | null;
-  /** If true, only this profile's config sources apply (isolation) */
+  /** If true, only this preset's config sources apply (isolation) */
   configIsolation: boolean;
-  /** If true, new subshells from this profile auto-restart on exit */
+  /** If true, new subshells from this preset auto-restart on exit */
   restartOnExit?: boolean;
 }
-/** Snapshot of a single field-level validation error on a profile. */
-interface ProfileValidationIssue {
+/** Snapshot of a single field-level validation error on a preset. */
+interface PresetValidationIssue {
   /** Field name (e.g. "name", "env", "settings") */
   field: string;
   /** Human-readable problem description */
   message: string;
 }
-interface ProfileValidationResult {
+interface PresetValidationResult {
   valid: boolean;
-  issues: ProfileValidationIssue[];
+  issues: PresetValidationIssue[];
 }
 /** Everything a plugin needs to build a launch command. */
 interface BuildCommandInput {
@@ -61,8 +73,8 @@ interface BuildCommandInput {
   binary: string;
   /** Working directory the harness runs in */
   cwd: string;
-  /** The validated profile being used */
-  profile: ProfileDefinition;
+  /** The validated preset being used */
+  preset: PresetDefinition;
   /** Subshell display name ("" = let the harness pick a default) */
   subshellName: string;
   /** Any additional CLI flags from route/request context */
@@ -169,12 +181,12 @@ interface McpRegistration {
   args?: string[];
   /**
    * Extra pane env the harness needs to discover the file (e.g. OPENCODE_CONFIG).
-   * Consumed by the HOST, which bakes it into the pane env ahead of profile env;
+   * Consumed by the HOST, which bakes it into the pane env ahead of preset env;
    * plugins never read it back.
    */
   env?: Record<string, string>;
 }
-/** One copy-paste line shown in the profile editor for manual-setup harnesses. */
+/** One copy-paste line shown in the preset editor for manual-setup harnesses. */
 interface McpSetupStep {
   /** What the user should do, and where the text goes */
   label: string;
@@ -202,10 +214,23 @@ interface SettingsField {
   label: string;
   /** Short description for the editor */
   description?: string;
-  /** One of: string, boolean, number, select */
-  type: "string" | "boolean" | "number" | "select";
+  /**
+   * One of: string, boolean, number, select, secret.
+   *
+   * `secret` is WRITE-ONLY and network-only: the host stores it through
+   * {@link PluginHost.secrets} rather than in the settings object, reads
+   * report only whether one is set, and a plugin never receives the value —
+   * it names the secret and the host hydrates it into a process it spawns
+   * ({@link SupervisedProcessSpec}). The preset editor does not render this
+   * type; a harness declaring one is a bug rather than a second secret store.
+   */
+  type: "string" | "boolean" | "number" | "select" | "secret";
   /** Choices when type === "select" */
   choices?: string[];
+  /** True when the field must be set before the plugin can act */
+  required?: boolean;
+  /** Placeholder / example, shown in the editor. Never a real credential. */
+  placeholder?: string;
   /** Default value when unset */
   default?: string | boolean | number;
 }
@@ -248,6 +273,86 @@ interface PluginHost {
     debug(message: string): void;
     warn(message: string): void;
   };
+  /**
+   * Runs a command to completion under the host's bounds and reports it.
+   *
+   * The one way a plugin executes anything. A plugin does not spawn: the host
+   * owns the deadline, the environment allowlist (the process's own
+   * environment holds the auth secret and the database path, and is never
+   * handed over), the PATH a service-run server would otherwise lack, and the
+   * output cap. Two refusals throw rather than returning a result, because
+   * both are bugs in the plugin rather than outcomes: `argv[0]` that is not an
+   * ABSOLUTE path (resolve it with {@link findBinary} — a bare name would
+   * resolve against a PATH the plugin cannot see), and `argv[0]` that is
+   * `sudo`. The server has no terminal to answer a password prompt, so a
+   * privileged command is a copy-paste instruction for the operator and never
+   * something this runs.
+   *
+   * Long-running processes are NOT this: a plugin that needs one describes it
+   * ({@link SupervisedProcessSpec}) and the host supervises it.
+   * @since apiVersion 2
+   */
+  run(argv: string[], opts?: RunOptions): Promise<RunResult>;
+  /**
+   * Write-only credential storage, scoped to this plugin.
+   *
+   * There is deliberately NO `get`. A plugin that could read a credential
+   * could put it in an argv (visible in `ps`), a log line or a hint string;
+   * every legitimate consumer is a process the HOST spawns, so the host
+   * hydrates the value itself from the name the plugin gives it. Values are
+   * stored 0600 under the host's data directory, never in the database and
+   * never in a settings row.
+   * @since apiVersion 2
+   */
+  secrets: PluginSecrets;
+  /** The operating system this host runs on. */
+  readonly platform: PluginPlatform;
+  /** The home directory of the user this host runs as. */
+  readonly homeDir: string;
+}
+/** Where a plugin can be driven at all. Mirrors the manifest's `platforms`. */
+type PluginPlatform = "darwin" | "linux";
+/** Options for {@link PluginHost.run}. */
+interface RunOptions {
+  /** Deadline in milliseconds. Default 30_000; the host caps it at 10 minutes. */
+  timeoutMs?: number;
+  /** Called per output line, ANSI already stripped, from both streams interleaved. */
+  onLine?: (line: string) => void;
+  /**
+   * Ends the run early without failing it.
+   *
+   * What an interactive login needs: `tailscale up` with no key blocks until a
+   * human finishes in a browser, having already printed the URL — so the
+   * plugin reads the URL off {@link onLine} and aborts, leaving the daemon
+   * waiting. An aborted run reports `aborted: true` and whatever was captured.
+   */
+  signal?: AbortSignal;
+  /** Extra environment on top of the host's allowlist. Never overrides PATH. */
+  env?: Record<string, string>;
+  /** Text to write to stdin. Absent means stdin is /dev/null, so a prompt cannot hang forever. */
+  stdin?: string;
+}
+/** What {@link PluginHost.run} reports. Never throws for a non-zero exit. */
+interface RunResult {
+  /** Exit code, or null when the process was signalled or never started. */
+  code: number | null;
+  /** Captured stdout, ANSI stripped, capped. */
+  stdout: string;
+  /** Captured stderr, ANSI stripped, capped. */
+  stderr: string;
+  /** True when the deadline ended it. */
+  timedOut: boolean;
+  /** True when {@link RunOptions.signal} ended it. */
+  aborted: boolean;
+}
+/** Write-only, per-plugin credential storage. See {@link PluginHost.secrets}. */
+interface PluginSecrets {
+  /** Stores (or replaces) a credential under this name. */
+  set(name: string, value: string): Promise<void>;
+  /** Whether a credential is stored under this name. The only read there is. */
+  has(name: string): Promise<boolean>;
+  /** Removes it. Absent is not an error. */
+  delete(name: string): Promise<void>;
 }
 /**
  * The plugin itself.
@@ -259,8 +364,8 @@ interface PluginHost {
 interface SubshellPlugin {
   /** Builds the argv (no shell) used to launch a subshell. */
   buildCommand(input: BuildCommandInput): string[];
-  /** Validates a profile definition before saving. */
-  validateProfile(profile: ProfileDefinition): ProfileValidationResult;
+  /** Validates a preset definition before saving. */
+  validatePreset(preset: PresetDefinition): PresetValidationResult;
   /** Which optional members below are meaningful on this plugin. */
   capabilities(): PluginCapability[];
   /** Maps a harness exit code to a human label (null = unknown). */
@@ -292,21 +397,30 @@ interface SubshellPlugin {
   mcpRegistration?(launch: McpLaunchSpec, configPath: string): McpRegistration;
   /** How users obtain the subshell MCP tools here. Declare the `mcp` capability with it. */
   mcpSetup?(launch: McpLaunchSpec): McpSetupInfo;
-  /** Settings rendered in the PROFILE editor and stored on the profile. */
-  profileSettings?(): SettingsField[];
-  /** Known extra env var suggestions for the profile editor. */
+  /** Settings rendered in the PRESET editor and stored on the preset. */
+  presetSettings?(): SettingsField[];
+  /** Known extra env var suggestions for the preset editor. */
   suggestedEnv?(): {
     key: string;
     description: string;
   }[];
-  /** Known CLI flag suggestions for the profile editor. */
+  /** Known CLI flag suggestions for the preset editor. */
   suggestedFlags?(): {
     flag: string;
     description: string;
   }[];
 }
-/** What a plugin module default-exports. */
-type PluginFactory = (host: PluginHost) => SubshellPlugin;
+/**
+ * A factory that returns a harness, for a plugin that knows which it is.
+ *
+ * {@link PluginFactory} is the LOADER's view — it must accept either shape,
+ * because it decides which to expect from the manifest. A plugin itself has no
+ * such ambiguity, and annotating its own factory with the union would widen
+ * what its tests can call: `createPlugin(host).buildCommand(...)` stops
+ * type-checking on a value that might be a network plugin. So a plugin
+ * declares the half it implements and the loader keeps the union.
+ */
+type HarnessPluginFactory = (host: PluginHost) => SubshellPlugin;
 //#endregion
 //#region ../../plugin-api/dist/index.d.ts
 /** How a host finds this plugin's binary, as data, so a scan loads no plugin code. */
@@ -315,16 +429,158 @@ interface DetectSpec {
   binaryName: string;
   /** Env var that overrides the lookup outright, e.g. "CLAUDE_PATH" */
   envOverride: string;
-  /** Well-known locations relative to HOME, tried after PATH */
+  /**
+   * Well-known locations, tried after PATH and before the version managers.
+   *
+   * HOME-relative (`.local/bin/mytool`), or ABSOLUTE when the entry starts
+   * with `/` — which is how a vendor's GUI install is named, since
+   * `/Applications/Tailscale.app/Contents/MacOS/Tailscale` is nobody's HOME.
+   * Each is a candidate to search, so an entry that does not resolve costs
+   * nothing and the ladder carries on.
+   */
   knownPaths: string[];
 }
 /** Where to send someone whose binary is missing. */
 interface InstallSpec {
-  /** Copy-pasteable install command for the official installer */
+  /**
+   * Copy-pasteable install command for the official installer.
+   *
+   * A command the HOST may run on request, which is why it may not be
+   * privileged: `sudo`, `doas` and `pkexec` are refused by the parser at any
+   * command boundary (the line is run through a shell — see
+   * {@link needsPrivileges}), so an installer that needs root is described
+   * under {@link NetworkManifest.privileged} instead and is only ever shown to
+   * copy. Without that refusal the two would be one field with two meanings,
+   * and the surface offering a button would have to guess.
+   */
   command: string;
-  /** URL of the installation documentation */
+  /**
+   * URL of the installation documentation.
+   *
+   * Rendered as a link on an admin page, so it must be `http:` or `https:`
+   * and the parser refuses anything else — see {@link isDocsUrl}.
+   */
   docsUrl: string;
 }
+/** One step an operator must run themselves, because the host may not. */
+interface PrivilegedStep {
+  /** What it does, in a few words: "Install the daemon" */
+  label: string;
+  /** The command to copy. Usually `sudo …`. */
+  command: string;
+  /** Where the vendor documents it; `http:`/`https:` only, as {@link isDocsUrl} requires. */
+  docsUrl?: string;
+  /**
+   * Which ALTERNATIVE this step belongs to, and the heading it renders under.
+   *
+   * Steps sharing a group are one sequence to run in order; different groups
+   * are different ways to arrive at the same place, and a surface renders an
+   * `or` between them rather than continuing the numbering. Steps with no
+   * group are one plain sequence, which is what every step was before this
+   * existed.
+   *
+   * It exists because a platform can genuinely offer two routes: on macOS
+   * Tailscale ships both a GUI app and a command-line daemon, and a page that
+   * numbered those 1..3 told a person to install both. Non-empty when present
+   * — it is a heading, so `""` is refused rather than coerced.
+   */
+  group?: string;
+}
+/**
+ * The `subshell.network` block. Required when `type` is `network`.
+ *
+ * Everything here is DATA a host reads without loading plugin code: which
+ * machines this plugin can run on at all, whether it can produce a login URL,
+ * what publishing it exposes, and which steps only a human with root can
+ * perform. A page can therefore say "not available on this platform" or print
+ * the two sudo commands before any plugin code has been imported — and before
+ * the vendor's CLI is anywhere on the machine.
+ */
+interface NetworkManifest {
+  /**
+   * Operating systems this plugin can be driven on.
+   *
+   * Not a hint: a host refuses every act on a platform absent from this list,
+   * and the UI renders the row as unavailable rather than offering a button
+   * that would 409. Vendors differ here for real reasons — a CLI that talks to
+   * a logged-in desktop session cannot be driven from a launchd service.
+   */
+  platforms: PluginPlatform[];
+  /**
+   * True when `join({})` with no credential can yield a URL a human finishes.
+   *
+   * Data rather than a capability because it describes what a RETURN VALUE may
+   * be, and a capability is checked against members. The UI reads it to decide
+   * whether to offer "sign in" beside "paste a key".
+   */
+  interactiveLogin?: boolean;
+  /**
+   * True when publishing leaves NOTHING the daemon can later be asked about.
+   *
+   * NetBird is the case that forced the field: a join is the whole publish,
+   * so `status()` can only ever see the join, and a plugin that declared
+   * itself `published` would claim a thing its own vendor CLI never told it.
+   * The HOST's publish record is the one witness of the transition, and this
+   * flag is what lets the host (and only the host) upgrade `joined` to
+   * `published` from it. A plugin without the flag is never upgraded: for
+   * Tailscale a serve reset outside this app is a real state, and `joined`
+   * is the honest reading of it.
+   */
+  publishImplicit?: boolean;
+  /**
+   * What publishing on this network exposes the server to.
+   *
+   * `private` is a network only invited machines are on. `public-with-gate`
+   * reaches the open internet with an identity check in front — a different
+   * security posture, stated here so every surface can say so before the act
+   * rather than after it.
+   */
+  exposure: "private" | "public-with-gate";
+  /**
+   * Steps the host can never perform, per platform, in the order to run them.
+   *
+   * Every mesh VPN installs a daemon as root and the server has no terminal to
+   * answer a password prompt, so these are printed to copy and never executed.
+   * Keeping them out of {@link InstallSpec} is what lets a surface offer a
+   * button for one and a copy row for the other without inspecting the string.
+   */
+  privileged?: Partial<Record<PluginPlatform, PrivilegedStep[]>>;
+  /**
+   * What this network calls the two things a person acts on.
+   *
+   * Vendors name the same act differently and a generic word is wrong rather
+   * than merely bland: Tailscale takes an "auth key", NetBird a "setup key",
+   * Cloudflare a "tunnel token", and a field labelled "Auth key" on the
+   * NetBird row asks for something NetBird does not have. Likewise publishing
+   * is "Tailscale Serve" on one network and starting a tunnel on another.
+   *
+   * MANIFEST data rather than something the plugin returns, for the same
+   * reason `platforms` is: a surface renders these before any plugin code has
+   * been loaded, and before the vendor's CLI is anywhere on the machine. Both
+   * are optional and both have a sensible generic default, so a plugin that
+   * says nothing is merely plain rather than broken.
+   */
+  labels?: NetworkLabels;
+}
+/** The vendor's own words for the two acts a person takes. See {@link NetworkManifest.labels}. */
+interface NetworkLabels {
+  /** What to call the pasted credential: "Auth key", "Setup key", "Tunnel token". */
+  credential?: string;
+  /** What to call publishing: "Publish with Tailscale Serve", "Start tunnel". */
+  publish?: string;
+  /**
+   * Where the credential named by `credential` comes from — the vendor page
+   * that mints one.
+   *
+   * The credential box asks for an "Auth key" on a card that otherwise says
+   * nothing about what an auth key is or where to get it, and every vendor
+   * words that differently enough that the SPA cannot write the sentence
+   * itself. So the plugin names its page, and the card renders it as a Docs
+   * link on the label row. http(s) only, refused at parse like every other
+   * URL this contract carries — it lands in an `href` on an admin page.
+   */
+  credentialDocsUrl?: string;
+}
 /** The parsed `subshell` block. */
 interface SubshellManifest {
   /** plugin-api version this plugin was built against */
@@ -337,7 +593,11 @@ interface SubshellManifest {
   name: string;
   /** One-line description shown in the UI */
   description: string;
-  /** Optional emoji/glyph */
+  /**
+   * Relative path to this plugin's icon file, e.g. `icon.svg`. Served by
+   * the control plane at `/api/plugins/<id>/icon`; absent means the UI
+   * renders a monogram instead.
+   */
   icon?: string;
   /** Module to import, relative to the package directory */
   entry: string;
@@ -355,6 +615,8 @@ interface SubshellManifest {
    * fallback, i.e. a resume that quietly never offers itself (§11).
    */
   hostEnv?: string[];
+  /** Network facts. Present exactly when `type` is `network`. */
+  network?: NetworkManifest;
 }
 //#endregion
 //#region src/manifest.d.ts
@@ -365,9 +627,9 @@ declare const manifest: SubshellManifest;
  * Built-in harness: Claude Code.
  *
  * Launch shape:
- *   claude --settings <json> --name <subshell> [profile flags] [extra flags]
+ *   claude --settings <json> --name <subshell> [preset flags] [extra flags]
  * Settings are passed as a JSON string via `--settings` (per-invocation, so
- * profile config never needs to write into the user's real ~/.claude).
+ * preset config never needs to write into the user's real ~/.claude).
  *
  * Identity, detection and install guidance live in this package's
  * package.json `subshell` block, NOT here: the host reads them without
@@ -378,6 +640,6 @@ declare const manifest: SubshellManifest;
  * version probe, shell quoting, a namespaced logger). See
  * `@subshell-ai/plugin-api`.
  */
-declare const createPlugin: PluginFactory;
+declare const createPlugin: HarnessPluginFactory;
 //#endregion
 export { createPlugin as default, manifest };

package/dist/index.js

@@ -1,7 +1,13 @@
 import { join, resolve } from "node:path";
-//#region ../../plugin-api/dist/manifest-UFScnYqn.js
+//#region ../../plugin-api/dist/manifest-DKMceUPh.js
 /** Every {@link PluginType}, for anything that has to iterate or validate them. */
-const PLUGIN_TYPES = ["agent-harness", "terminal"];
+const PLUGIN_TYPES = [
+	"agent-harness",
+	"terminal",
+	"network"
+];
+/** Every {@link PluginPlatform}, for validation. */
+const PLUGIN_PLATFORMS = ["darwin", "linux"];
 /**
 * The MCP server name every harness registers the built-in `subshell mcp`
 * server under: the config object key, and the `hermes mcp add|remove`
@@ -10,6 +16,17 @@ const PLUGIN_TYPES = ["agent-harness", "terminal"];
 */
 const MCP_SERVER_NAME = "subshell";
 /**
+* Image formats a plugin icon may be. The server maps these to a Content-Type
+* from a fixed table rather than sniffing the file, so this list and that
+* table are one decision: adding a format here without adding it there leaves
+* an icon that parses and then 500s when something asks for it.
+*/
+const ICON_EXTENSIONS = [
+	".svg",
+	".png",
+	".webp"
+];
+/**
 * Ids become directory names under `<dataDir>/plugins/`, so they are path
 * segments and nothing else: no separators, no traversal, no surprises from a
 * case-insensitive filesystem.
@@ -18,6 +35,80 @@ const ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** The privilege wrappers no install command may ever run, by first-word basename. */
+const PRIVILEGED_COMMANDS = [
+	"sudo",
+	"doas",
+	"pkexec"
+];
+/** Shell boundaries that introduce a NEW command word: `;` `|` `&` (so `&&` and `||` too) and newline. */
+const COMMAND_BOUNDARY_RE = /[;&|\n]+/;
+/** A leading `NAME=…` env assignment, which `sh` strips before choosing the command. */
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=\S*\s*/;
+/**
+* Whether a shell line runs one of {@link PRIVILEGED_COMMANDS} AS A COMMAND
+* anywhere in it — not merely at the start.
+*
+* `install.command` is the one manifest field a host RUNS, and it runs through
+* `sh -c` (`api/network/install-network.route.ts`), which means any boundary
+* in the line can start the privileged command the start of the line hides:
+* `"apt-get update && sudo apt-get install -y x"` is sudo-without-prompt on a
+* NOPASSWD host. A line-start regex was the first gate and it was not one.
+*
+* The split is CONSERVATIVE, not a shell parser: segments are taken at every
+* boundary character quote-blind (so a `;` inside a quoted string still
+* counts, which can only over-refuse), leading env assignments are stripped
+* (`FOO=bar sudo x` runs sudo), and each segment's first word is compared by
+* BASENAME (`/usr/bin/sudo` is sudo, `pkexec-demo` is not). A word merely
+* CONTAINING the token is fine — the comparison is equality on the basename.
+* The accepted limit is a wrapper hidden inside quotes (`sh -c 'sudo …'`),
+* which is the same limit `PluginHost.run`'s first-word check has, and it is
+* accepted for the same reason: a plugin whose code LOADS can already run
+* anything in this process (`docs/security.md` §11.9) — this rule refuses
+* careless manifests deterministically, it is not a sandbox.
+*/
+function needsPrivileges(command) {
+	for (const segment of command.split(COMMAND_BOUNDARY_RE)) {
+		let rest = segment.trim();
+		while (ENV_ASSIGNMENT_RE.test(rest)) rest = rest.replace(ENV_ASSIGNMENT_RE, "");
+		if (rest === "") continue;
+		const ws = rest.search(/\s/);
+		const firstWord = ws === -1 ? rest : rest.slice(0, ws);
+		const base = firstWord.slice(firstWord.lastIndexOf("/") + 1);
+		if (PRIVILEGED_COMMANDS.includes(base)) return true;
+	}
+	return false;
+}
+/**
+* Whether a string may be rendered as a link in an operator's browser.
+*
+* Every `docsUrl` in this contract ends up as the `href` of an anchor on an
+* admin page, and an `href` is not inert: a `javascript:` URL in one is script
+* running on the control plane's own origin, in the session of the one person
+* who can install plugins. So a URL this contract carries is restricted to the
+* two schemes that navigate, and both the parser below and the host check it.
+*
+* It is checked in two places on purpose. A manifest is static data, so a bad
+* value there is a plugin defect and is refused at load. A URL a plugin
+* REPORTS at runtime is often something it read off a vendor CLI — Tailscale's
+* `AuthURL` comes from whichever control server the operator pointed the
+* daemon at — so the host drops that one instead, because refusing to load a
+* working plugin over a value its control server chose would be the wrong
+* failure.
+*
+* Not a reachability claim: nothing fetches these, and a docs page that 404s
+* is a broken link rather than a hazard.
+* @param value - the candidate URL, as written in a manifest or returned by a plugin
+*/
+function isDocsUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
 /**
 * Reads and validates the `subshell` block of a plugin's package.json.
 *
@@ -32,13 +123,18 @@ function parseManifest(pkgJson) {
 	const block = pkgJson.subshell;
 	if (!isRecord(block)) return { error: "package.json has no `subshell` block, so it is not a Subshell plugin" };
 	if (typeof block.apiVersion !== "number" || !Number.isInteger(block.apiVersion)) return { error: "`subshell.apiVersion` must be an integer" };
-	if (block.apiVersion < 1) return { error: `this plugin declares plugin-api ${block.apiVersion}, which is not a version; the lowest is 1 and this host implements 1` };
-	if (block.apiVersion > 1) return { error: `this plugin needs plugin-api ${block.apiVersion}, but this host implements 1; upgrade the agent` };
+	if (block.apiVersion < 1) return { error: `this plugin declares plugin-api ${block.apiVersion}, which is not a version; the lowest is 1 and this host implements 2` };
+	if (block.apiVersion > 2) return { error: `this plugin needs plugin-api ${block.apiVersion}, but this host implements 2; upgrade Subshell` };
 	if (typeof block.id !== "string" || !ID_RE.test(block.id)) return { error: "`subshell.id` must be lowercase letters, digits and hyphens, starting alphanumeric (it becomes a directory name)" };
 	if (typeof block.type !== "string" || !PLUGIN_TYPES.includes(block.type)) return { error: `\`subshell.type\` must be one of: ${PLUGIN_TYPES.join(", ")}` };
 	if (typeof block.name !== "string" || block.name.trim() === "") return { error: "`subshell.name` must be a non-empty string" };
 	if (typeof block.description !== "string") return { error: "`subshell.description` must be a string" };
-	if (block.icon !== void 0 && typeof block.icon !== "string") return { error: "`subshell.icon` must be a string" };
+	if (block.icon !== void 0) {
+		if (typeof block.icon !== "string" || block.icon.trim() === "") return { error: "`subshell.icon` must be a non-empty relative path to an image in the package" };
+		if (block.icon.startsWith("/") || block.icon.split("/").includes("..")) return { error: "`subshell.icon` must stay inside the package (no leading `/` and no `..` segment)" };
+		const icon = block.icon;
+		if (!ICON_EXTENSIONS.some((ext) => icon.endsWith(ext))) return { error: `\`subshell.icon\` must end in one of: ${ICON_EXTENSIONS.join(", ")}` };
+	}
 	if (typeof block.entry !== "string" || block.entry.trim() === "") return { error: "`subshell.entry` must be a non-empty relative path" };
 	if (block.entry.startsWith("/") || block.entry.split("/").includes("..")) return { error: "`subshell.entry` must stay inside the package (no leading `/` and no `..` segment)" };
 	let detect;
@@ -55,6 +151,8 @@ function parseManifest(pkgJson) {
 	if (block.install !== void 0) {
 		const i = block.install;
 		if (!isRecord(i) || typeof i.command !== "string" || typeof i.docsUrl !== "string") return { error: "`subshell.install` needs a command and a docsUrl" };
+		if (needsPrivileges(i.command)) return { error: "`subshell.install.command` must not need sudo, doas or pkexec — the host runs it through a shell and has no terminal for a password prompt; put privileged steps in `subshell.network.privileged`" };
+		if (!isDocsUrl(i.docsUrl)) return { error: "`subshell.install.docsUrl` must be an http(s) URL — it is rendered as a link on an admin page" };
 		install = {
 			command: i.command,
 			docsUrl: i.docsUrl
@@ -65,39 +163,106 @@ function parseManifest(pkgJson) {
 		if (!Array.isArray(block.hostEnv) || !block.hostEnv.every((k) => typeof k === "string" && k.trim() !== "")) return { error: "`subshell.hostEnv` must be an array of environment variable names" };
 		hostEnv = [...block.hostEnv];
 	}
+	const type = block.type;
+	const parsedNetwork = parseNetworkBlock(block.network, type);
+	if (parsedNetwork !== void 0 && "error" in parsedNetwork) return parsedNetwork;
 	return {
 		apiVersion: block.apiVersion,
 		id: block.id,
-		type: block.type,
+		type,
 		name: block.name,
 		description: block.description,
 		...typeof block.icon === "string" ? { icon: block.icon } : {},
 		entry: block.entry,
 		...detect ? { detect } : {},
 		...install ? { install } : {},
-		...hostEnv ? { hostEnv } : {}
+		...hostEnv ? { hostEnv } : {},
+		...parsedNetwork ? { network: parsedNetwork } : {}
+	};
+}
+/**
+* Parses `subshell.network`, which is required for and exclusive to `network`.
+*
+* Both directions are refused rather than tolerated. A network plugin without
+* the block would be unrenderable — nothing could say which platforms it runs
+* on or what publishing it exposes, and the safe default for "what does this
+* expose" is not a default anyone should pick silently. A harness WITH one
+* declares facts nothing reads, which is how a manifest starts lying.
+* @returns the parsed block, an error, or undefined when there is none to have
+*/
+function parseNetworkBlock(raw, type) {
+	if (type !== "network") {
+		if (raw !== void 0) return { error: `\`subshell.network\` is only for \`type: "network"\` plugins, and this one is \`${type}\`` };
+		return;
+	}
+	if (!isRecord(raw)) return { error: "`subshell.network` is required for `type: \"network\"` plugins" };
+	if (!Array.isArray(raw.platforms) || raw.platforms.length === 0 || !raw.platforms.every((p) => typeof p === "string" && PLUGIN_PLATFORMS.includes(p))) return { error: `\`subshell.network.platforms\` must be a non-empty array of: ${PLUGIN_PLATFORMS.join(", ")}` };
+	if (raw.exposure !== "private" && raw.exposure !== "public-with-gate") return { error: "`subshell.network.exposure` must be \"private\" or \"public-with-gate\"" };
+	if (raw.interactiveLogin !== void 0 && typeof raw.interactiveLogin !== "boolean") return { error: "`subshell.network.interactiveLogin` must be a boolean" };
+	if (raw.publishImplicit !== void 0 && typeof raw.publishImplicit !== "boolean") return { error: "`subshell.network.publishImplicit` must be a boolean" };
+	let privileged;
+	if (raw.privileged !== void 0) {
+		if (!isRecord(raw.privileged)) return { error: "`subshell.network.privileged` must be an object keyed by platform" };
+		privileged = {};
+		for (const [platform, steps] of Object.entries(raw.privileged)) {
+			if (!PLUGIN_PLATFORMS.includes(platform)) return { error: `\`subshell.network.privileged\` has an unknown platform "${platform}"` };
+			if (!Array.isArray(steps) || !steps.every((s) => isRecord(s) && typeof s.label === "string" && s.label.trim() !== "" && typeof s.command === "string" && s.command.trim() !== "" && (s.docsUrl === void 0 || typeof s.docsUrl === "string") && (s.group === void 0 || typeof s.group === "string"))) return { error: `\`subshell.network.privileged.${platform}\` must be an array of { label, command, docsUrl?, group? }` };
+			const badGroup = steps.find((s) => s.group !== void 0 && s.group.trim() === "");
+			if (badGroup) return { error: `\`subshell.network.privileged.${platform}\` has an empty \`group\`, which is a heading with no words: "${badGroup.label}"` };
+			const badDocs = steps.find((s) => s.docsUrl !== void 0 && !isDocsUrl(s.docsUrl));
+			if (badDocs) return { error: `\`subshell.network.privileged.${platform}\` has a docsUrl that is not an http(s) URL: "${badDocs.label}"` };
+			privileged[platform] = steps.map((s) => ({
+				label: s.label,
+				command: s.command,
+				...s.docsUrl ? { docsUrl: s.docsUrl } : {},
+				...s.group ? { group: s.group } : {}
+			}));
+		}
+	}
+	let labels;
+	if (raw.labels !== void 0) {
+		if (!isRecord(raw.labels)) return { error: "`subshell.network.labels` must be an object" };
+		for (const key of ["credential", "publish"]) {
+			const value = raw.labels[key];
+			if (value !== void 0 && (typeof value !== "string" || value.trim() === "")) return { error: `\`subshell.network.labels.${key}\` must be a non-empty string` };
+		}
+		const credDocs = raw.labels.credentialDocsUrl;
+		if (credDocs !== void 0 && (typeof credDocs !== "string" || !isDocsUrl(credDocs))) return { error: "`subshell.network.labels.credentialDocsUrl` must be an http(s) URL — it is rendered as a link on an admin page" };
+		labels = {
+			...typeof raw.labels.credential === "string" ? { credential: raw.labels.credential } : {},
+			...typeof raw.labels.publish === "string" ? { publish: raw.labels.publish } : {},
+			...typeof raw.labels.credentialDocsUrl === "string" ? { credentialDocsUrl: raw.labels.credentialDocsUrl } : {}
+		};
+	}
+	return {
+		platforms: [...raw.platforms],
+		exposure: raw.exposure,
+		...raw.interactiveLogin === true ? { interactiveLogin: true } : {},
+		...raw.publishImplicit === true ? { publishImplicit: true } : {},
+		...privileged ? { privileged } : {},
+		...labels && Object.keys(labels).length > 0 ? { labels } : {}
 	};
 }
 //#endregion
 //#region ../../plugin-api/dist/index.js
 /**
-* The profile checks every built-in harness performs unchanged: a non-empty
+* The preset checks every built-in harness performs unchanged: a non-empty
 * name, string env values, and flags that look like flags. Harnesses with
 * extra rules run their own checks on top of these.
-* @param profile - The decoded profile definition to check
+* @param preset - The decoded preset definition to check
 * @returns Issues per field; `valid` is true when no issues were found
 */
-function validateGenericProfile(profile) {
+function validateGenericPreset(preset) {
 	const issues = [];
-	if (!profile.name || profile.name.trim().length === 0) issues.push({
+	if (!preset.name || preset.name.trim().length === 0) issues.push({
 		field: "name",
-		message: "Profile name is required."
+		message: "Preset name is required."
 	});
-	for (const [key, value] of Object.entries(profile.env)) if (typeof value !== "string") issues.push({
+	for (const [key, value] of Object.entries(preset.env)) if (typeof value !== "string") issues.push({
 		field: "env",
 		message: `Env var "${key}" must be a string.`
 	});
-	for (const flag of profile.flags) if (!flag.startsWith("-")) issues.push({
+	for (const flag of preset.flags) if (!flag.startsWith("-")) issues.push({
 		field: "flags",
 		message: `Flag "${flag}" must start with "-".`
 	});
@@ -119,7 +284,7 @@ function validateGenericProfile(profile) {
 const parsed = parseManifest({
 	name: "@subshell-ai/plugin-claude-code",
 	description: "Claude Code harness plugin for Subshell",
-	version: "1.0.1",
+	version: "3.0.0",
 	license: "Apache-2.0",
 	type: "module",
 	main: "dist/index.js",
@@ -153,15 +318,15 @@ const parsed = parseManifest({
 		"tsdown": "0.22.14",
 		"typescript": "7.0.2"
 	},
-	files: ["dist"],
+	files: ["dist", "icon.svg"],
 	publishConfig: { "access": "public" },
 	subshell: {
-		"apiVersion": 1,
+		"apiVersion": 2,
 		"id": "claude-code",
 		"type": "agent-harness",
 		"name": "Claude Code",
 		"description": "Anthropic's agentic coding assistant (interactive CLI)",
-		"icon": "🤖",
+		"icon": "icon.svg",
 		"entry": "dist/index.js",
 		"detect": {
 			"binaryName": "claude",
@@ -379,13 +544,29 @@ const reporterHook = (host, reporter, ...verb) => [
 * - `Stop` / `Notification` — fire-and-forget attention reporting. The server
 *   gates delivery on the subshell's bell and derives the "waiting for you"
 *   state; a missed event costs one notification, never a broken turn.
+*   `Notification` carries a matcher because the unfiltered hook rang
+*   "Needs your approval" for EVERY notification type — `idle_prompt`,
+*   `auth_success`, `elicitation_complete` after the human had already
+*   answered (spec 2026-09-23). `Stop` reports `turn_complete` blind here:
+*   the reporter reads the hook payload and stays silent for a session
+*   parked on background work (`packages/mcp-core/src/report.ts`).
+* - `UserPromptSubmit` / `PreToolUse` — the waiting CLEAR (`resumed`). The
+*   plane's idle-watcher can only clear what it can stat, so an agent-node
+*   pane — log on the node's disk — stayed "waiting for you" for its whole
+*   next turn (2026-09-24). The pane knows better: work has resumed when the
+*   human's prompt is submitted, AND when a tool starts after an approval
+*   answered in the dialog (approving is not a prompt, so
+*   UserPromptSubmit alone misses that path). PreToolUse fires on every tool
+*   call; the endpoint's clear is conditional, so the common stamp-less case
+*   is a silent no-op. Neither hook's stdin is read — their payloads are the
+*   prompt text and the tool input, and the report is only ever the fact.
 * - `SessionStart` — conversation identity. The restart-resume pin
 *   (`--session-id` at launch) only survives while the pane keeps that ONE
 *   conversation, but /clear, /resume <other> and /fork start a DIFFERENT
 *   transcript id in-pane and nothing else tells the server, so the next
 *   restart would resurrect a stale conversation (observed 2026-09-03). This
 *   fires on every such transition (source: startup|resume|clear|compact|fork)
-*   and is the one hook that reads stdin — the reporter forwards `session_id`
+*   and reads stdin like `Stop` now does — the reporter forwards `session_id`
 *   from that payload and nothing else.
 */
 const attentionHooks = (host, reporter) => ({
@@ -393,9 +574,20 @@ const attentionHooks = (host, reporter) => ({
 		type: "command",
 		command: reporterHook(host, reporter, "attention", "turn_complete")
 	}] }],
-	Notification: [{ hooks: [{
+	Notification: [{
+		matcher: "permission_prompt|agent_needs_input|elicitation_dialog|elicitation_url_dialog",
+		hooks: [{
+			type: "command",
+			command: reporterHook(host, reporter, "attention", "needs_attention")
+		}]
+	}],
+	UserPromptSubmit: [{ hooks: [{
+		type: "command",
+		command: reporterHook(host, reporter, "attention", "resumed")
+	}] }],
+	PreToolUse: [{ hooks: [{
 		type: "command",
-		command: reporterHook(host, reporter, "attention", "needs_attention")
+		command: reporterHook(host, reporter, "attention", "resumed")
 	}] }],
 	SessionStart: [{ hooks: [{
 		type: "command",
@@ -410,9 +602,9 @@ function projectSlug(cwd) {
 * Built-in harness: Claude Code.
 *
 * Launch shape:
-*   claude --settings <json> --name <subshell> [profile flags] [extra flags]
+*   claude --settings <json> --name <subshell> [preset flags] [extra flags]
 * Settings are passed as a JSON string via `--settings` (per-invocation, so
-* profile config never needs to write into the user's real ~/.claude).
+* preset config never needs to write into the user's real ~/.claude).
 *
 * Identity, detection and install guidance live in this package's
 * package.json `subshell` block, NOT here: the host reads them without
@@ -456,16 +648,16 @@ const createPlugin = (host) => ({
 		}
 	},
 	buildCommand(input) {
-		const { binary, profile, subshellName, extraFlags, mcp, harnessSession, reporter } = input;
+		const { binary, preset, subshellName, extraFlags, mcp, harnessSession, reporter } = input;
 		const args = [binary];
 		if (mcp?.args) args.push(...mcp.args);
 		if (harnessSession) args.push(harnessSession.mode === "resume" ? "--resume" : "--session-id", harnessSession.id);
-		const settings = { ...profile.settings ?? {} };
+		const settings = { ...preset.settings ?? {} };
 		if (reporter) settings.hooks = attentionHooks(host, reporter);
 		else host.log.warn("no reporter resolved for this launch: attention and conversation-identity hooks are omitted");
 		if (Object.keys(settings).length > 0) args.push("--settings", JSON.stringify(settings));
 		if (subshellName) args.push("--name", subshellName);
-		for (const flag of profile.flags) args.push(flag);
+		for (const flag of preset.flags) args.push(flag);
 		if (extraFlags) args.push(...extraFlags);
 		return args;
 	},
@@ -486,10 +678,10 @@ const createPlugin = (host) => ({
 			summary: "Subshell registers itself with every Claude Code subshell automatically (via --mcp-config)."
 		};
 	},
-	validateProfile(profile) {
-		return validateGenericProfile(profile);
+	validatePreset(preset) {
+		return validateGenericPreset(preset);
 	},
-	profileSettings() {
+	presetSettings() {
 		return CLAUDE_SETTINGS_FIELDS;
 	},
 	suggestedEnv() {

package/icon.svg

@@ -0,0 +1,3 @@
+<svg viewBox="0 0 248 248" fill="none" xmlns="http://www.w3.org/2000/svg"><title>Claude Code</title>
+<path d="M52.4285 162.873L98.7844 136.879L99.5485 134.602L98.7844 133.334H96.4921L88.7237 132.862L62.2346 132.153L39.3113 131.207L17.0249 130.026L11.4214 128.844L6.2 121.873L6.7094 118.447L11.4214 115.257L18.171 115.847L33.0711 116.911L55.485 118.447L71.6586 119.392L95.728 121.873H99.5485L100.058 120.337L98.7844 119.392L97.7656 118.447L74.5877 102.732L49.4995 86.1905L36.3823 76.62L29.3779 71.7757L25.8121 67.2858L24.2839 57.3608L30.6515 50.2716L39.3113 50.8623L41.4763 51.4531L50.2636 58.1879L68.9842 72.7209L93.4357 90.6804L97.0015 93.6343L98.4374 92.6652L98.6571 91.9801L97.0015 89.2625L83.757 65.2772L69.621 40.8192L63.2534 30.6579L61.5978 24.632C60.9565 22.1032 60.579 20.0111 60.579 17.4246L67.8381 7.49965L71.9133 6.19995L81.7193 7.49965L85.7946 11.0443L91.9074 24.9865L101.714 46.8451L116.996 76.62L121.453 85.4816L123.873 93.6343L124.764 96.1155H126.292V94.6976L127.566 77.9197L129.858 57.3608L132.15 30.8942L132.915 23.4505L136.608 14.4708L143.994 9.62643L149.725 12.344L154.437 19.0788L153.8 23.4505L150.998 41.6463L145.522 70.1215L141.957 89.2625H143.994L146.414 86.7813L156.093 74.0206L172.266 53.698L179.398 45.6635L187.803 36.802L193.152 32.5484H203.34L210.726 43.6549L207.415 55.1159L196.972 68.3492L188.312 79.5739L175.896 96.2095L168.191 109.585L168.882 110.689L170.738 110.53L198.755 104.504L213.91 101.787L231.994 98.7149L240.144 102.496L241.036 106.395L237.852 114.311L218.495 119.037L195.826 123.645L162.07 131.592L161.696 131.893L162.137 132.547L177.36 133.925L183.855 134.279H199.774L229.447 136.524L237.215 141.605L241.8 147.867L241.036 152.711L229.065 158.737L213.019 154.956L175.45 145.977L162.587 142.787H160.805V143.85L171.502 154.366L191.242 172.089L215.82 195.011L217.094 200.682L213.91 205.172L210.599 204.699L188.949 188.394L180.544 181.069L161.696 165.118H160.422V166.772L164.752 173.152L187.803 207.771L188.949 218.405L187.294 221.832L181.308 223.959L174.813 222.777L161.187 203.754L147.305 182.486L136.098 163.345L134.745 164.2L128.075 235.42L125.019 239.082L117.887 241.8L111.902 237.31L108.718 229.984L111.902 215.452L115.722 196.547L118.779 181.541L121.58 162.873L123.291 156.636L123.14 156.219L121.773 156.449L107.699 175.752L86.304 204.699L69.3663 222.777L65.291 224.431L58.2867 220.768L58.9235 214.27L62.8713 208.48L86.304 178.705L100.44 160.155L109.551 149.507L109.462 147.967L108.959 147.924L46.6977 188.512L35.6182 189.93L30.7788 185.44L31.4156 178.115L33.7079 175.752L52.4285 162.873Z" fill="#D97757"/>
+</svg>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@subshell-ai/plugin-claude-code",
   "description": "Claude Code harness plugin for Subshell",
-  "version": "1.0.1",
+  "version": "3.0.0",
   "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.js",
@@ -39,19 +39,17 @@
     "tsdown": "0.22.14",
     "typescript": "7.0.2"
   },
-  "files": [
-    "dist"
-  ],
+  "files": ["dist", "icon.svg"],
   "publishConfig": {
     "access": "public"
   },
   "subshell": {
-    "apiVersion": 1,
+    "apiVersion": 2,
     "id": "claude-code",
     "type": "agent-harness",
     "name": "Claude Code",
     "description": "Anthropic's agentic coding assistant (interactive CLI)",
-    "icon": "🤖",
+    "icon": "icon.svg",
     "entry": "dist/index.js",
     "detect": {
       "binaryName": "claude",