@subshell-ai/plugin-codex 0.1.1 → 1.0.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-//#region ../../plugin-api/dist/types-CSNepTNr.d.ts
+//#region ../../plugin-api/dist/types-D6R-hjGN.d.ts
 //#region src/types.d.ts
 /**
  * The contract a Subshell plugin implements.
@@ -20,16 +20,28 @@
  * For humans: it groups and labels in the UI and filters the catalog. Code
  * branches on {@link PluginCapability} instead, so adding a type here touches
  * labels while adding a capability touches the launch pipeline.
+ *
+ * ONE exception, and it is structural rather than a branch on a label: a
+ * `network` plugin implements {@link NetworkPlugin} instead of
+ * {@link SubshellPlugin}, so the loader picks WHICH members to require by
+ * type. A harness drives a thing in a pane; a network plugin connects this
+ * host to one network. They share the store, the manifest and the capability
+ * vocabulary, and nothing else.
  */
-type PluginType = "agent-harness" | "terminal";
+type PluginType = "agent-harness" | "terminal" | "network";
 /**
  * What a plugin can DO. The launch pipeline and the UI read this; neither
  * branches on {@link PluginType}.
+ *
+ * The union is shared across types and the applicable SUBSET is not, so
+ * {@link capabilityMismatches} takes the type: a harness claiming `publish`
+ * and a network plugin claiming `resume` are both refused at load, for the
+ * same reason a claimed-but-unimplemented capability is.
  */
-type PluginCapability = "mcp" | "resume" | "attention" | "settings";
-/** A harness profile as defined by the user (decoded JSON blobs). */
-interface ProfileDefinition {
-  /** Human-friendly profile name */
+type PluginCapability = "mcp" | "resume" | "attention" | "publish" | "supervise" | "guard" | "settings";
+/** A harness preset as defined by the user (decoded JSON blobs). */
+interface PresetDefinition {
+  /** Human-friendly preset name */
   name: string;
   /** Optional longer description */
   description?: string | null;
@@ -39,21 +51,21 @@ interface ProfileDefinition {
   flags: string[];
   /** Settings blob passed to the harness (e.g. claude --settings JSON) */
   settings: Record<string, unknown> | null;
-  /** If true, only this profile's config sources apply (isolation) */
+  /** If true, only this preset's config sources apply (isolation) */
   configIsolation: boolean;
-  /** If true, new subshells from this profile auto-restart on exit */
+  /** If true, new subshells from this preset auto-restart on exit */
   restartOnExit?: boolean;
 }
-/** Snapshot of a single field-level validation error on a profile. */
-interface ProfileValidationIssue {
+/** Snapshot of a single field-level validation error on a preset. */
+interface PresetValidationIssue {
   /** Field name (e.g. "name", "env", "settings") */
   field: string;
   /** Human-readable problem description */
   message: string;
 }
-interface ProfileValidationResult {
+interface PresetValidationResult {
   valid: boolean;
-  issues: ProfileValidationIssue[];
+  issues: PresetValidationIssue[];
 }
 /** Everything a plugin needs to build a launch command. */
 interface BuildCommandInput {
@@ -61,8 +73,8 @@ interface BuildCommandInput {
   binary: string;
   /** Working directory the harness runs in */
   cwd: string;
-  /** The validated profile being used */
-  profile: ProfileDefinition;
+  /** The validated preset being used */
+  preset: PresetDefinition;
   /** Subshell display name ("" = let the harness pick a default) */
   subshellName: string;
   /** Any additional CLI flags from route/request context */
@@ -169,12 +181,12 @@ interface McpRegistration {
   args?: string[];
   /**
    * Extra pane env the harness needs to discover the file (e.g. OPENCODE_CONFIG).
-   * Consumed by the HOST, which bakes it into the pane env ahead of profile env;
+   * Consumed by the HOST, which bakes it into the pane env ahead of preset env;
    * plugins never read it back.
    */
   env?: Record<string, string>;
 }
-/** One copy-paste line shown in the profile editor for manual-setup harnesses. */
+/** One copy-paste line shown in the preset editor for manual-setup harnesses. */
 interface McpSetupStep {
   /** What the user should do, and where the text goes */
   label: string;
@@ -202,10 +214,23 @@ interface SettingsField {
   label: string;
   /** Short description for the editor */
   description?: string;
-  /** One of: string, boolean, number, select */
-  type: "string" | "boolean" | "number" | "select";
+  /**
+   * One of: string, boolean, number, select, secret.
+   *
+   * `secret` is WRITE-ONLY and network-only: the host stores it through
+   * {@link PluginHost.secrets} rather than in the settings object, reads
+   * report only whether one is set, and a plugin never receives the value —
+   * it names the secret and the host hydrates it into a process it spawns
+   * ({@link SupervisedProcessSpec}). The preset editor does not render this
+   * type; a harness declaring one is a bug rather than a second secret store.
+   */
+  type: "string" | "boolean" | "number" | "select" | "secret";
   /** Choices when type === "select" */
   choices?: string[];
+  /** True when the field must be set before the plugin can act */
+  required?: boolean;
+  /** Placeholder / example, shown in the editor. Never a real credential. */
+  placeholder?: string;
   /** Default value when unset */
   default?: string | boolean | number;
 }
@@ -248,6 +273,86 @@ interface PluginHost {
     debug(message: string): void;
     warn(message: string): void;
   };
+  /**
+   * Runs a command to completion under the host's bounds and reports it.
+   *
+   * The one way a plugin executes anything. A plugin does not spawn: the host
+   * owns the deadline, the environment allowlist (the process's own
+   * environment holds the auth secret and the database path, and is never
+   * handed over), the PATH a service-run server would otherwise lack, and the
+   * output cap. Two refusals throw rather than returning a result, because
+   * both are bugs in the plugin rather than outcomes: `argv[0]` that is not an
+   * ABSOLUTE path (resolve it with {@link findBinary} — a bare name would
+   * resolve against a PATH the plugin cannot see), and `argv[0]` that is
+   * `sudo`. The server has no terminal to answer a password prompt, so a
+   * privileged command is a copy-paste instruction for the operator and never
+   * something this runs.
+   *
+   * Long-running processes are NOT this: a plugin that needs one describes it
+   * ({@link SupervisedProcessSpec}) and the host supervises it.
+   * @since apiVersion 2
+   */
+  run(argv: string[], opts?: RunOptions): Promise<RunResult>;
+  /**
+   * Write-only credential storage, scoped to this plugin.
+   *
+   * There is deliberately NO `get`. A plugin that could read a credential
+   * could put it in an argv (visible in `ps`), a log line or a hint string;
+   * every legitimate consumer is a process the HOST spawns, so the host
+   * hydrates the value itself from the name the plugin gives it. Values are
+   * stored 0600 under the host's data directory, never in the database and
+   * never in a settings row.
+   * @since apiVersion 2
+   */
+  secrets: PluginSecrets;
+  /** The operating system this host runs on. */
+  readonly platform: PluginPlatform;
+  /** The home directory of the user this host runs as. */
+  readonly homeDir: string;
+}
+/** Where a plugin can be driven at all. Mirrors the manifest's `platforms`. */
+type PluginPlatform = "darwin" | "linux";
+/** Options for {@link PluginHost.run}. */
+interface RunOptions {
+  /** Deadline in milliseconds. Default 30_000; the host caps it at 10 minutes. */
+  timeoutMs?: number;
+  /** Called per output line, ANSI already stripped, from both streams interleaved. */
+  onLine?: (line: string) => void;
+  /**
+   * Ends the run early without failing it.
+   *
+   * What an interactive login needs: `tailscale up` with no key blocks until a
+   * human finishes in a browser, having already printed the URL — so the
+   * plugin reads the URL off {@link onLine} and aborts, leaving the daemon
+   * waiting. An aborted run reports `aborted: true` and whatever was captured.
+   */
+  signal?: AbortSignal;
+  /** Extra environment on top of the host's allowlist. Never overrides PATH. */
+  env?: Record<string, string>;
+  /** Text to write to stdin. Absent means stdin is /dev/null, so a prompt cannot hang forever. */
+  stdin?: string;
+}
+/** What {@link PluginHost.run} reports. Never throws for a non-zero exit. */
+interface RunResult {
+  /** Exit code, or null when the process was signalled or never started. */
+  code: number | null;
+  /** Captured stdout, ANSI stripped, capped. */
+  stdout: string;
+  /** Captured stderr, ANSI stripped, capped. */
+  stderr: string;
+  /** True when the deadline ended it. */
+  timedOut: boolean;
+  /** True when {@link RunOptions.signal} ended it. */
+  aborted: boolean;
+}
+/** Write-only, per-plugin credential storage. See {@link PluginHost.secrets}. */
+interface PluginSecrets {
+  /** Stores (or replaces) a credential under this name. */
+  set(name: string, value: string): Promise<void>;
+  /** Whether a credential is stored under this name. The only read there is. */
+  has(name: string): Promise<boolean>;
+  /** Removes it. Absent is not an error. */
+  delete(name: string): Promise<void>;
 }
 /**
  * The plugin itself.
@@ -259,8 +364,8 @@ interface PluginHost {
 interface SubshellPlugin {
   /** Builds the argv (no shell) used to launch a subshell. */
   buildCommand(input: BuildCommandInput): string[];
-  /** Validates a profile definition before saving. */
-  validateProfile(profile: ProfileDefinition): ProfileValidationResult;
+  /** Validates a preset definition before saving. */
+  validatePreset(preset: PresetDefinition): PresetValidationResult;
   /** Which optional members below are meaningful on this plugin. */
   capabilities(): PluginCapability[];
   /** Maps a harness exit code to a human label (null = unknown). */
@@ -292,21 +397,30 @@ interface SubshellPlugin {
   mcpRegistration?(launch: McpLaunchSpec, configPath: string): McpRegistration;
   /** How users obtain the subshell MCP tools here. Declare the `mcp` capability with it. */
   mcpSetup?(launch: McpLaunchSpec): McpSetupInfo;
-  /** Settings rendered in the PROFILE editor and stored on the profile. */
-  profileSettings?(): SettingsField[];
-  /** Known extra env var suggestions for the profile editor. */
+  /** Settings rendered in the PRESET editor and stored on the preset. */
+  presetSettings?(): SettingsField[];
+  /** Known extra env var suggestions for the preset editor. */
   suggestedEnv?(): {
     key: string;
     description: string;
   }[];
-  /** Known CLI flag suggestions for the profile editor. */
+  /** Known CLI flag suggestions for the preset editor. */
   suggestedFlags?(): {
     flag: string;
     description: string;
   }[];
 }
-/** What a plugin module default-exports. */
-type PluginFactory = (host: PluginHost) => SubshellPlugin;
+/**
+ * A factory that returns a harness, for a plugin that knows which it is.
+ *
+ * {@link PluginFactory} is the LOADER's view — it must accept either shape,
+ * because it decides which to expect from the manifest. A plugin itself has no
+ * such ambiguity, and annotating its own factory with the union would widen
+ * what its tests can call: `createPlugin(host).buildCommand(...)` stops
+ * type-checking on a value that might be a network plugin. So a plugin
+ * declares the half it implements and the loader keeps the union.
+ */
+type HarnessPluginFactory = (host: PluginHost) => SubshellPlugin;
 //#endregion
 //#region ../../plugin-api/dist/index.d.ts
 /** How a host finds this plugin's binary, as data, so a scan loads no plugin code. */
@@ -315,16 +429,158 @@ interface DetectSpec {
   binaryName: string;
   /** Env var that overrides the lookup outright, e.g. "CLAUDE_PATH" */
   envOverride: string;
-  /** Well-known locations relative to HOME, tried after PATH */
+  /**
+   * Well-known locations, tried after PATH and before the version managers.
+   *
+   * HOME-relative (`.local/bin/mytool`), or ABSOLUTE when the entry starts
+   * with `/` — which is how a vendor's GUI install is named, since
+   * `/Applications/Tailscale.app/Contents/MacOS/Tailscale` is nobody's HOME.
+   * Each is a candidate to search, so an entry that does not resolve costs
+   * nothing and the ladder carries on.
+   */
   knownPaths: string[];
 }
 /** Where to send someone whose binary is missing. */
 interface InstallSpec {
-  /** Copy-pasteable install command for the official installer */
+  /**
+   * Copy-pasteable install command for the official installer.
+   *
+   * A command the HOST may run on request, which is why it may not be
+   * privileged: `sudo`, `doas` and `pkexec` are refused by the parser at any
+   * command boundary (the line is run through a shell — see
+   * {@link needsPrivileges}), so an installer that needs root is described
+   * under {@link NetworkManifest.privileged} instead and is only ever shown to
+   * copy. Without that refusal the two would be one field with two meanings,
+   * and the surface offering a button would have to guess.
+   */
   command: string;
-  /** URL of the installation documentation */
+  /**
+   * URL of the installation documentation.
+   *
+   * Rendered as a link on an admin page, so it must be `http:` or `https:`
+   * and the parser refuses anything else — see {@link isDocsUrl}.
+   */
   docsUrl: string;
 }
+/** One step an operator must run themselves, because the host may not. */
+interface PrivilegedStep {
+  /** What it does, in a few words: "Install the daemon" */
+  label: string;
+  /** The command to copy. Usually `sudo …`. */
+  command: string;
+  /** Where the vendor documents it; `http:`/`https:` only, as {@link isDocsUrl} requires. */
+  docsUrl?: string;
+  /**
+   * Which ALTERNATIVE this step belongs to, and the heading it renders under.
+   *
+   * Steps sharing a group are one sequence to run in order; different groups
+   * are different ways to arrive at the same place, and a surface renders an
+   * `or` between them rather than continuing the numbering. Steps with no
+   * group are one plain sequence, which is what every step was before this
+   * existed.
+   *
+   * It exists because a platform can genuinely offer two routes: on macOS
+   * Tailscale ships both a GUI app and a command-line daemon, and a page that
+   * numbered those 1..3 told a person to install both. Non-empty when present
+   * — it is a heading, so `""` is refused rather than coerced.
+   */
+  group?: string;
+}
+/**
+ * The `subshell.network` block. Required when `type` is `network`.
+ *
+ * Everything here is DATA a host reads without loading plugin code: which
+ * machines this plugin can run on at all, whether it can produce a login URL,
+ * what publishing it exposes, and which steps only a human with root can
+ * perform. A page can therefore say "not available on this platform" or print
+ * the two sudo commands before any plugin code has been imported — and before
+ * the vendor's CLI is anywhere on the machine.
+ */
+interface NetworkManifest {
+  /**
+   * Operating systems this plugin can be driven on.
+   *
+   * Not a hint: a host refuses every act on a platform absent from this list,
+   * and the UI renders the row as unavailable rather than offering a button
+   * that would 409. Vendors differ here for real reasons — a CLI that talks to
+   * a logged-in desktop session cannot be driven from a launchd service.
+   */
+  platforms: PluginPlatform[];
+  /**
+   * True when `join({})` with no credential can yield a URL a human finishes.
+   *
+   * Data rather than a capability because it describes what a RETURN VALUE may
+   * be, and a capability is checked against members. The UI reads it to decide
+   * whether to offer "sign in" beside "paste a key".
+   */
+  interactiveLogin?: boolean;
+  /**
+   * True when publishing leaves NOTHING the daemon can later be asked about.
+   *
+   * NetBird is the case that forced the field: a join is the whole publish,
+   * so `status()` can only ever see the join, and a plugin that declared
+   * itself `published` would claim a thing its own vendor CLI never told it.
+   * The HOST's publish record is the one witness of the transition, and this
+   * flag is what lets the host (and only the host) upgrade `joined` to
+   * `published` from it. A plugin without the flag is never upgraded: for
+   * Tailscale a serve reset outside this app is a real state, and `joined`
+   * is the honest reading of it.
+   */
+  publishImplicit?: boolean;
+  /**
+   * What publishing on this network exposes the server to.
+   *
+   * `private` is a network only invited machines are on. `public-with-gate`
+   * reaches the open internet with an identity check in front — a different
+   * security posture, stated here so every surface can say so before the act
+   * rather than after it.
+   */
+  exposure: "private" | "public-with-gate";
+  /**
+   * Steps the host can never perform, per platform, in the order to run them.
+   *
+   * Every mesh VPN installs a daemon as root and the server has no terminal to
+   * answer a password prompt, so these are printed to copy and never executed.
+   * Keeping them out of {@link InstallSpec} is what lets a surface offer a
+   * button for one and a copy row for the other without inspecting the string.
+   */
+  privileged?: Partial<Record<PluginPlatform, PrivilegedStep[]>>;
+  /**
+   * What this network calls the two things a person acts on.
+   *
+   * Vendors name the same act differently and a generic word is wrong rather
+   * than merely bland: Tailscale takes an "auth key", NetBird a "setup key",
+   * Cloudflare a "tunnel token", and a field labelled "Auth key" on the
+   * NetBird row asks for something NetBird does not have. Likewise publishing
+   * is "Tailscale Serve" on one network and starting a tunnel on another.
+   *
+   * MANIFEST data rather than something the plugin returns, for the same
+   * reason `platforms` is: a surface renders these before any plugin code has
+   * been loaded, and before the vendor's CLI is anywhere on the machine. Both
+   * are optional and both have a sensible generic default, so a plugin that
+   * says nothing is merely plain rather than broken.
+   */
+  labels?: NetworkLabels;
+}
+/** The vendor's own words for the two acts a person takes. See {@link NetworkManifest.labels}. */
+interface NetworkLabels {
+  /** What to call the pasted credential: "Auth key", "Setup key", "Tunnel token". */
+  credential?: string;
+  /** What to call publishing: "Publish with Tailscale Serve", "Start tunnel". */
+  publish?: string;
+  /**
+   * Where the credential named by `credential` comes from — the vendor page
+   * that mints one.
+   *
+   * The credential box asks for an "Auth key" on a card that otherwise says
+   * nothing about what an auth key is or where to get it, and every vendor
+   * words that differently enough that the SPA cannot write the sentence
+   * itself. So the plugin names its page, and the card renders it as a Docs
+   * link on the label row. http(s) only, refused at parse like every other
+   * URL this contract carries — it lands in an `href` on an admin page.
+   */
+  credentialDocsUrl?: string;
+}
 /** The parsed `subshell` block. */
 interface SubshellManifest {
   /** plugin-api version this plugin was built against */
@@ -337,7 +593,11 @@ interface SubshellManifest {
   name: string;
   /** One-line description shown in the UI */
   description: string;
-  /** Optional emoji/glyph */
+  /**
+   * Relative path to this plugin's icon file, e.g. `icon.svg`. Served by
+   * the control plane at `/api/plugins/<id>/icon`; absent means the UI
+   * renders a monogram instead.
+   */
   icon?: string;
   /** Module to import, relative to the package directory */
   entry: string;
@@ -355,6 +615,8 @@ interface SubshellManifest {
    * fallback, i.e. a resume that quietly never offers itself (§11).
    */
   hostEnv?: string[];
+  /** Network facts. Present exactly when `type` is `network`. */
+  network?: NetworkManifest;
 }
 //#endregion
 //#region src/manifest.d.ts
@@ -366,7 +628,7 @@ declare const manifest: SubshellManifest;
  *
  * Launch shape:
  *   codex [-m <model>] [-s <sandbox>] [-a <approval>] [mcp -c pairs]
- *         [profile flags] [extra flags]
+ *         [preset flags] [extra flags]
  * A bare launch (no subcommand, no prompt) opens the interactive TUI. Codex
  * has no create-time flag for naming its own session and no way to pin a
  * conversation id, so neither the subshell name nor a resume capability is
@@ -374,7 +636,7 @@ declare const manifest: SubshellManifest;
  * The pane's
  * cwd is already the working directory, so `-C/--cd` is never passed, and
  * `--dangerously-bypass-approvals-and-sandbox` is NEVER baked into a launch
- * (a user may put it in their own profile flags — that is their call).
+ * (a user may put it in their own preset flags — that is their call).
  *
  * subshell MCP is wired automatically WITHOUT touching user state: every
  * launch carries `-c mcp_servers.subshell.command=… -c mcp_servers.subshell.args=…`
@@ -392,6 +654,6 @@ declare const manifest: SubshellManifest;
  *
  * `host` carries what this module cannot import. See `@subshell-ai/plugin-api`.
  */
-declare const createPlugin: PluginFactory;
+declare const createPlugin: HarnessPluginFactory;
 //#endregion
 export { createPlugin as default, manifest };

package/dist/index.js

@@ -1,6 +1,12 @@
-//#region ../../plugin-api/dist/manifest-UFScnYqn.js
+//#region ../../plugin-api/dist/manifest-DKMceUPh.js
 /** Every {@link PluginType}, for anything that has to iterate or validate them. */
-const PLUGIN_TYPES = ["agent-harness", "terminal"];
+const PLUGIN_TYPES = [
+	"agent-harness",
+	"terminal",
+	"network"
+];
+/** Every {@link PluginPlatform}, for validation. */
+const PLUGIN_PLATFORMS = ["darwin", "linux"];
 /**
 * The MCP server name every harness registers the built-in `subshell mcp`
 * server under: the config object key, and the `hermes mcp add|remove`
@@ -9,6 +15,17 @@ const PLUGIN_TYPES = ["agent-harness", "terminal"];
 */
 const MCP_SERVER_NAME = "subshell";
 /**
+* Image formats a plugin icon may be. The server maps these to a Content-Type
+* from a fixed table rather than sniffing the file, so this list and that
+* table are one decision: adding a format here without adding it there leaves
+* an icon that parses and then 500s when something asks for it.
+*/
+const ICON_EXTENSIONS = [
+	".svg",
+	".png",
+	".webp"
+];
+/**
 * Ids become directory names under `<dataDir>/plugins/`, so they are path
 * segments and nothing else: no separators, no traversal, no surprises from a
 * case-insensitive filesystem.
@@ -17,6 +34,80 @@ const ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** The privilege wrappers no install command may ever run, by first-word basename. */
+const PRIVILEGED_COMMANDS = [
+	"sudo",
+	"doas",
+	"pkexec"
+];
+/** Shell boundaries that introduce a NEW command word: `;` `|` `&` (so `&&` and `||` too) and newline. */
+const COMMAND_BOUNDARY_RE = /[;&|\n]+/;
+/** A leading `NAME=…` env assignment, which `sh` strips before choosing the command. */
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=\S*\s*/;
+/**
+* Whether a shell line runs one of {@link PRIVILEGED_COMMANDS} AS A COMMAND
+* anywhere in it — not merely at the start.
+*
+* `install.command` is the one manifest field a host RUNS, and it runs through
+* `sh -c` (`api/network/install-network.route.ts`), which means any boundary
+* in the line can start the privileged command the start of the line hides:
+* `"apt-get update && sudo apt-get install -y x"` is sudo-without-prompt on a
+* NOPASSWD host. A line-start regex was the first gate and it was not one.
+*
+* The split is CONSERVATIVE, not a shell parser: segments are taken at every
+* boundary character quote-blind (so a `;` inside a quoted string still
+* counts, which can only over-refuse), leading env assignments are stripped
+* (`FOO=bar sudo x` runs sudo), and each segment's first word is compared by
+* BASENAME (`/usr/bin/sudo` is sudo, `pkexec-demo` is not). A word merely
+* CONTAINING the token is fine — the comparison is equality on the basename.
+* The accepted limit is a wrapper hidden inside quotes (`sh -c 'sudo …'`),
+* which is the same limit `PluginHost.run`'s first-word check has, and it is
+* accepted for the same reason: a plugin whose code LOADS can already run
+* anything in this process (`docs/security.md` §11.9) — this rule refuses
+* careless manifests deterministically, it is not a sandbox.
+*/
+function needsPrivileges(command) {
+	for (const segment of command.split(COMMAND_BOUNDARY_RE)) {
+		let rest = segment.trim();
+		while (ENV_ASSIGNMENT_RE.test(rest)) rest = rest.replace(ENV_ASSIGNMENT_RE, "");
+		if (rest === "") continue;
+		const ws = rest.search(/\s/);
+		const firstWord = ws === -1 ? rest : rest.slice(0, ws);
+		const base = firstWord.slice(firstWord.lastIndexOf("/") + 1);
+		if (PRIVILEGED_COMMANDS.includes(base)) return true;
+	}
+	return false;
+}
+/**
+* Whether a string may be rendered as a link in an operator's browser.
+*
+* Every `docsUrl` in this contract ends up as the `href` of an anchor on an
+* admin page, and an `href` is not inert: a `javascript:` URL in one is script
+* running on the control plane's own origin, in the session of the one person
+* who can install plugins. So a URL this contract carries is restricted to the
+* two schemes that navigate, and both the parser below and the host check it.
+*
+* It is checked in two places on purpose. A manifest is static data, so a bad
+* value there is a plugin defect and is refused at load. A URL a plugin
+* REPORTS at runtime is often something it read off a vendor CLI — Tailscale's
+* `AuthURL` comes from whichever control server the operator pointed the
+* daemon at — so the host drops that one instead, because refusing to load a
+* working plugin over a value its control server chose would be the wrong
+* failure.
+*
+* Not a reachability claim: nothing fetches these, and a docs page that 404s
+* is a broken link rather than a hazard.
+* @param value - the candidate URL, as written in a manifest or returned by a plugin
+*/
+function isDocsUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
 /**
 * Reads and validates the `subshell` block of a plugin's package.json.
 *
@@ -31,13 +122,18 @@ function parseManifest(pkgJson) {
 	const block = pkgJson.subshell;
 	if (!isRecord(block)) return { error: "package.json has no `subshell` block, so it is not a Subshell plugin" };
 	if (typeof block.apiVersion !== "number" || !Number.isInteger(block.apiVersion)) return { error: "`subshell.apiVersion` must be an integer" };
-	if (block.apiVersion < 1) return { error: `this plugin declares plugin-api ${block.apiVersion}, which is not a version; the lowest is 1 and this host implements 1` };
-	if (block.apiVersion > 1) return { error: `this plugin needs plugin-api ${block.apiVersion}, but this host implements 1; upgrade the agent` };
+	if (block.apiVersion < 1) return { error: `this plugin declares plugin-api ${block.apiVersion}, which is not a version; the lowest is 1 and this host implements 2` };
+	if (block.apiVersion > 2) return { error: `this plugin needs plugin-api ${block.apiVersion}, but this host implements 2; upgrade Subshell` };
 	if (typeof block.id !== "string" || !ID_RE.test(block.id)) return { error: "`subshell.id` must be lowercase letters, digits and hyphens, starting alphanumeric (it becomes a directory name)" };
 	if (typeof block.type !== "string" || !PLUGIN_TYPES.includes(block.type)) return { error: `\`subshell.type\` must be one of: ${PLUGIN_TYPES.join(", ")}` };
 	if (typeof block.name !== "string" || block.name.trim() === "") return { error: "`subshell.name` must be a non-empty string" };
 	if (typeof block.description !== "string") return { error: "`subshell.description` must be a string" };
-	if (block.icon !== void 0 && typeof block.icon !== "string") return { error: "`subshell.icon` must be a string" };
+	if (block.icon !== void 0) {
+		if (typeof block.icon !== "string" || block.icon.trim() === "") return { error: "`subshell.icon` must be a non-empty relative path to an image in the package" };
+		if (block.icon.startsWith("/") || block.icon.split("/").includes("..")) return { error: "`subshell.icon` must stay inside the package (no leading `/` and no `..` segment)" };
+		const icon = block.icon;
+		if (!ICON_EXTENSIONS.some((ext) => icon.endsWith(ext))) return { error: `\`subshell.icon\` must end in one of: ${ICON_EXTENSIONS.join(", ")}` };
+	}
 	if (typeof block.entry !== "string" || block.entry.trim() === "") return { error: "`subshell.entry` must be a non-empty relative path" };
 	if (block.entry.startsWith("/") || block.entry.split("/").includes("..")) return { error: "`subshell.entry` must stay inside the package (no leading `/` and no `..` segment)" };
 	let detect;
@@ -54,6 +150,8 @@ function parseManifest(pkgJson) {
 	if (block.install !== void 0) {
 		const i = block.install;
 		if (!isRecord(i) || typeof i.command !== "string" || typeof i.docsUrl !== "string") return { error: "`subshell.install` needs a command and a docsUrl" };
+		if (needsPrivileges(i.command)) return { error: "`subshell.install.command` must not need sudo, doas or pkexec — the host runs it through a shell and has no terminal for a password prompt; put privileged steps in `subshell.network.privileged`" };
+		if (!isDocsUrl(i.docsUrl)) return { error: "`subshell.install.docsUrl` must be an http(s) URL — it is rendered as a link on an admin page" };
 		install = {
 			command: i.command,
 			docsUrl: i.docsUrl
@@ -64,39 +162,106 @@ function parseManifest(pkgJson) {
 		if (!Array.isArray(block.hostEnv) || !block.hostEnv.every((k) => typeof k === "string" && k.trim() !== "")) return { error: "`subshell.hostEnv` must be an array of environment variable names" };
 		hostEnv = [...block.hostEnv];
 	}
+	const type = block.type;
+	const parsedNetwork = parseNetworkBlock(block.network, type);
+	if (parsedNetwork !== void 0 && "error" in parsedNetwork) return parsedNetwork;
 	return {
 		apiVersion: block.apiVersion,
 		id: block.id,
-		type: block.type,
+		type,
 		name: block.name,
 		description: block.description,
 		...typeof block.icon === "string" ? { icon: block.icon } : {},
 		entry: block.entry,
 		...detect ? { detect } : {},
 		...install ? { install } : {},
-		...hostEnv ? { hostEnv } : {}
+		...hostEnv ? { hostEnv } : {},
+		...parsedNetwork ? { network: parsedNetwork } : {}
+	};
+}
+/**
+* Parses `subshell.network`, which is required for and exclusive to `network`.
+*
+* Both directions are refused rather than tolerated. A network plugin without
+* the block would be unrenderable — nothing could say which platforms it runs
+* on or what publishing it exposes, and the safe default for "what does this
+* expose" is not a default anyone should pick silently. A harness WITH one
+* declares facts nothing reads, which is how a manifest starts lying.
+* @returns the parsed block, an error, or undefined when there is none to have
+*/
+function parseNetworkBlock(raw, type) {
+	if (type !== "network") {
+		if (raw !== void 0) return { error: `\`subshell.network\` is only for \`type: "network"\` plugins, and this one is \`${type}\`` };
+		return;
+	}
+	if (!isRecord(raw)) return { error: "`subshell.network` is required for `type: \"network\"` plugins" };
+	if (!Array.isArray(raw.platforms) || raw.platforms.length === 0 || !raw.platforms.every((p) => typeof p === "string" && PLUGIN_PLATFORMS.includes(p))) return { error: `\`subshell.network.platforms\` must be a non-empty array of: ${PLUGIN_PLATFORMS.join(", ")}` };
+	if (raw.exposure !== "private" && raw.exposure !== "public-with-gate") return { error: "`subshell.network.exposure` must be \"private\" or \"public-with-gate\"" };
+	if (raw.interactiveLogin !== void 0 && typeof raw.interactiveLogin !== "boolean") return { error: "`subshell.network.interactiveLogin` must be a boolean" };
+	if (raw.publishImplicit !== void 0 && typeof raw.publishImplicit !== "boolean") return { error: "`subshell.network.publishImplicit` must be a boolean" };
+	let privileged;
+	if (raw.privileged !== void 0) {
+		if (!isRecord(raw.privileged)) return { error: "`subshell.network.privileged` must be an object keyed by platform" };
+		privileged = {};
+		for (const [platform, steps] of Object.entries(raw.privileged)) {
+			if (!PLUGIN_PLATFORMS.includes(platform)) return { error: `\`subshell.network.privileged\` has an unknown platform "${platform}"` };
+			if (!Array.isArray(steps) || !steps.every((s) => isRecord(s) && typeof s.label === "string" && s.label.trim() !== "" && typeof s.command === "string" && s.command.trim() !== "" && (s.docsUrl === void 0 || typeof s.docsUrl === "string") && (s.group === void 0 || typeof s.group === "string"))) return { error: `\`subshell.network.privileged.${platform}\` must be an array of { label, command, docsUrl?, group? }` };
+			const badGroup = steps.find((s) => s.group !== void 0 && s.group.trim() === "");
+			if (badGroup) return { error: `\`subshell.network.privileged.${platform}\` has an empty \`group\`, which is a heading with no words: "${badGroup.label}"` };
+			const badDocs = steps.find((s) => s.docsUrl !== void 0 && !isDocsUrl(s.docsUrl));
+			if (badDocs) return { error: `\`subshell.network.privileged.${platform}\` has a docsUrl that is not an http(s) URL: "${badDocs.label}"` };
+			privileged[platform] = steps.map((s) => ({
+				label: s.label,
+				command: s.command,
+				...s.docsUrl ? { docsUrl: s.docsUrl } : {},
+				...s.group ? { group: s.group } : {}
+			}));
+		}
+	}
+	let labels;
+	if (raw.labels !== void 0) {
+		if (!isRecord(raw.labels)) return { error: "`subshell.network.labels` must be an object" };
+		for (const key of ["credential", "publish"]) {
+			const value = raw.labels[key];
+			if (value !== void 0 && (typeof value !== "string" || value.trim() === "")) return { error: `\`subshell.network.labels.${key}\` must be a non-empty string` };
+		}
+		const credDocs = raw.labels.credentialDocsUrl;
+		if (credDocs !== void 0 && (typeof credDocs !== "string" || !isDocsUrl(credDocs))) return { error: "`subshell.network.labels.credentialDocsUrl` must be an http(s) URL — it is rendered as a link on an admin page" };
+		labels = {
+			...typeof raw.labels.credential === "string" ? { credential: raw.labels.credential } : {},
+			...typeof raw.labels.publish === "string" ? { publish: raw.labels.publish } : {},
+			...typeof raw.labels.credentialDocsUrl === "string" ? { credentialDocsUrl: raw.labels.credentialDocsUrl } : {}
+		};
+	}
+	return {
+		platforms: [...raw.platforms],
+		exposure: raw.exposure,
+		...raw.interactiveLogin === true ? { interactiveLogin: true } : {},
+		...raw.publishImplicit === true ? { publishImplicit: true } : {},
+		...privileged ? { privileged } : {},
+		...labels && Object.keys(labels).length > 0 ? { labels } : {}
 	};
 }
 //#endregion
 //#region ../../plugin-api/dist/index.js
 /**
-* The profile checks every built-in harness performs unchanged: a non-empty
+* The preset checks every built-in harness performs unchanged: a non-empty
 * name, string env values, and flags that look like flags. Harnesses with
 * extra rules run their own checks on top of these.
-* @param profile - The decoded profile definition to check
+* @param preset - The decoded preset definition to check
 * @returns Issues per field; `valid` is true when no issues were found
 */
-function validateGenericProfile(profile) {
+function validateGenericPreset(preset) {
 	const issues = [];
-	if (!profile.name || profile.name.trim().length === 0) issues.push({
+	if (!preset.name || preset.name.trim().length === 0) issues.push({
 		field: "name",
-		message: "Profile name is required."
+		message: "Preset name is required."
 	});
-	for (const [key, value] of Object.entries(profile.env)) if (typeof value !== "string") issues.push({
+	for (const [key, value] of Object.entries(preset.env)) if (typeof value !== "string") issues.push({
 		field: "env",
 		message: `Env var "${key}" must be a string.`
 	});
-	for (const flag of profile.flags) if (!flag.startsWith("-")) issues.push({
+	for (const flag of preset.flags) if (!flag.startsWith("-")) issues.push({
 		field: "flags",
 		message: `Flag "${flag}" must start with "-".`
 	});
@@ -118,7 +283,7 @@ function validateGenericProfile(profile) {
 const parsed = parseManifest({
 	name: "@subshell-ai/plugin-codex",
 	description: "Codex harness plugin for Subshell",
-	version: "0.1.1",
+	version: "1.0.0",
 	license: "Apache-2.0",
 	type: "module",
 	main: "dist/index.js",
@@ -152,15 +317,15 @@ const parsed = parseManifest({
 		"tsdown": "0.22.14",
 		"typescript": "7.0.2"
 	},
-	files: ["dist"],
+	files: ["dist", "icon.svg"],
 	publishConfig: { "access": "public" },
 	subshell: {
-		"apiVersion": 1,
+		"apiVersion": 2,
 		"id": "codex",
 		"type": "agent-harness",
 		"name": "Codex",
 		"description": "OpenAI's agentic coding CLI (interactive TUI)",
-		"icon": "📖",
+		"icon": "icon.svg",
 		"entry": "dist/index.js",
 		"detect": {
 			"binaryName": "codex",
@@ -239,7 +404,7 @@ function tomlStringArray(values) {
 *
 * Launch shape:
 *   codex [-m <model>] [-s <sandbox>] [-a <approval>] [mcp -c pairs]
-*         [profile flags] [extra flags]
+*         [preset flags] [extra flags]
 * A bare launch (no subcommand, no prompt) opens the interactive TUI. Codex
 * has no create-time flag for naming its own session and no way to pin a
 * conversation id, so neither the subshell name nor a resume capability is
@@ -247,7 +412,7 @@ function tomlStringArray(values) {
 * The pane's
 * cwd is already the working directory, so `-C/--cd` is never passed, and
 * `--dangerously-bypass-approvals-and-sandbox` is NEVER baked into a launch
-* (a user may put it in their own profile flags — that is their call).
+* (a user may put it in their own preset flags — that is their call).
 *
 * subshell MCP is wired automatically WITHOUT touching user state: every
 * launch carries `-c mcp_servers.subshell.command=… -c mcp_servers.subshell.args=…`
@@ -268,14 +433,14 @@ function tomlStringArray(values) {
 const createPlugin = (_host) => ({
 	capabilities: () => ["mcp", "settings"],
 	buildCommand(input) {
-		const { binary, profile, extraFlags, mcp } = input;
+		const { binary, preset, extraFlags, mcp } = input;
 		const args = [binary];
-		const s = profile.settings ?? {};
+		const s = preset.settings ?? {};
 		if (typeof s.model === "string" && s.model) args.push("-m", s.model);
 		if (typeof s.sandbox === "string" && s.sandbox) args.push("-s", s.sandbox);
 		if (typeof s.askForApproval === "string" && s.askForApproval) args.push("-a", s.askForApproval);
 		if (mcp?.args) args.push(...mcp.args);
-		for (const flag of profile.flags) args.push(flag);
+		for (const flag of preset.flags) args.push(flag);
 		if (extraFlags) args.push(...extraFlags);
 		return args;
 	},
@@ -317,10 +482,10 @@ const createPlugin = (_host) => ({
 			summary: "Subshell registers itself with every Codex subshell automatically (per-invocation -c mcp_servers.subshell.* overrides; your ~/.codex config is never modified)."
 		};
 	},
-	validateProfile(profile) {
-		return validateGenericProfile(profile);
+	validatePreset(preset) {
+		return validateGenericPreset(preset);
 	},
-	profileSettings() {
+	presetSettings() {
 		return CODEX_SETTINGS_FIELDS;
 	},
 	suggestedEnv() {

package/icon.svg

@@ -0,0 +1,4 @@
+<svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><title>Codex</title>
+<circle cx="12" cy="12" r="12" fill="#0080F7"/>
+<path d="M9.94494 9.59163V8.13227C9.94494 8.00935 9.99105 7.91713 10.0985 7.85575L13.0327 6.16599C13.4321 5.93558 13.9083 5.8281 14.3998 5.8281C16.2432 5.8281 17.4108 7.25677 17.4108 8.77751C17.4108 8.885 17.4108 9.00792 17.3953 9.13083L14.3537 7.34884C14.1694 7.24135 13.985 7.24135 13.8007 7.34884L9.94494 9.59163ZM16.7963 15.2755V11.7883C16.7963 11.5732 16.704 11.4196 16.5197 11.3121L12.664 9.0693L13.9236 8.34725C14.0311 8.28587 14.1234 8.28587 14.2308 8.34725L17.165 10.037C18.0099 10.5287 18.5782 11.5732 18.5782 12.587C18.5782 13.7544 17.887 14.8298 16.7963 15.2753V15.2755ZM9.03861 12.2031L7.77896 11.4658C7.67146 11.4045 7.62535 11.3122 7.62535 11.1893V7.8098C7.62535 6.16613 8.88501 4.92176 10.5902 4.92176C11.2354 4.92176 11.8344 5.13689 12.3415 5.52089L9.31526 7.27218C9.13097 7.37968 9.03875 7.53328 9.03875 7.74841V12.2033L9.03861 12.2031ZM11.75 13.77L9.94494 12.7562V10.6056L11.75 9.59178L13.5549 10.6056V12.7562L11.75 13.77ZM12.9098 18.44C12.2645 18.44 11.6655 18.2249 11.1585 17.8409L14.1847 16.0896C14.369 15.9821 14.4612 15.8285 14.4612 15.6134V11.1585L15.7363 11.8958C15.8438 11.9572 15.8899 12.0494 15.8899 12.1723V15.5519C15.8899 17.1955 14.6148 18.44 12.9098 18.44ZM9.26901 15.0144L6.33486 13.3246C5.4899 12.833 4.92161 11.7885 4.92161 10.7746C4.92161 9.59177 5.62824 8.53183 6.71886 8.0863V11.5887C6.71886 11.8039 6.81109 11.9575 6.99538 12.065L10.8359 14.2923L9.57621 15.0144C9.46872 15.0758 9.37649 15.0758 9.26901 15.0144ZM9.10013 17.5337C7.36426 17.5337 6.08919 16.2279 6.08919 14.6149C6.08919 14.492 6.1046 14.3691 6.11988 14.2462L9.1461 15.9975C9.33039 16.105 9.51483 16.105 9.69912 15.9975L13.5549 13.7702V15.2295C13.5549 15.3524 13.5088 15.4446 13.4013 15.506L10.4671 17.1958C10.0677 17.4262 9.59148 17.5337 9.09999 17.5337H9.10013ZM12.9098 19.3616C14.7685 19.3616 16.32 18.0406 16.6735 16.2893C18.3939 15.8438 19.5 14.2308 19.5 12.5872C19.5 11.5118 19.0391 10.4673 18.2096 9.71454C18.2864 9.39192 18.3326 9.0693 18.3326 8.74682C18.3326 6.55014 16.5505 4.90634 14.4921 4.90634C14.0774 4.90634 13.6779 4.96772 13.2785 5.10605C12.5872 4.43011 11.6347 4 10.5902 4C8.7314 4 7.17996 5.32103 6.8265 7.07232C5.10605 7.51786 4 9.13083 4 10.7745C4 11.8498 4.4608 12.8944 5.29035 13.6471C5.21354 13.9697 5.16743 14.2923 5.16743 14.6148C5.16743 16.8114 6.94941 18.4552 9.00792 18.4552C9.42261 18.4552 9.82204 18.3939 10.2215 18.2556C10.9127 18.9315 11.8651 19.3616 12.9098 19.3616Z" fill="white"/>
+</svg>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@subshell-ai/plugin-codex",
   "description": "Codex harness plugin for Subshell",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.js",
@@ -39,19 +39,17 @@
     "tsdown": "0.22.14",
     "typescript": "7.0.2"
   },
-  "files": [
-    "dist"
-  ],
+  "files": ["dist", "icon.svg"],
   "publishConfig": {
     "access": "public"
   },
   "subshell": {
-    "apiVersion": 1,
+    "apiVersion": 2,
     "id": "codex",
     "type": "agent-harness",
     "name": "Codex",
     "description": "OpenAI's agentic coding CLI (interactive TUI)",
-    "icon": "📖",
+    "icon": "icon.svg",
     "entry": "dist/index.js",
     "detect": {
       "binaryName": "codex",