@unbrained/pm-cli 2026.5.10 → 2026.5.11

package/dist/core/extensions/loader.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { pathExists } from "../fs/fs-utils.js";
 import { resolveGlobalPmRoot } from "../store/paths.js";
-import { KNOWN_EXTENSION_CAPABILITIES, EXTENSION_CAPABILITY_CONTRACT_VERSION, EXTENSION_CAPABILITY_LEGACY_ALIASES, } from "./extension-types.js";
+import { KNOWN_EXTENSION_CAPABILITIES, KNOWN_EXTENSION_POLICY_MODES, KNOWN_EXTENSION_POLICY_SURFACES, KNOWN_EXTENSION_SANDBOX_PROFILES, KNOWN_EXTENSION_TRUST_MODES, EXTENSION_CAPABILITY_CONTRACT_VERSION, EXTENSION_CAPABILITY_LEGACY_ALIASES, } from "./extension-types.js";
 export * from "./extension-types.js";
 const DEFAULT_EXTENSION_PRIORITY = 100;
 /* Types now in extension-types.ts - re-exported via `export * from "./extension-types.js"` above */
@@ -16,6 +16,517 @@ function isKnownExtensionCapability(value) {
 function collectUnknownExtensionCapabilities(capabilities) {
     return capabilities.filter((capability) => !isKnownExtensionCapability(capability));
 }
+const DEFAULT_EXTENSION_POLICY = Object.freeze({
+    mode: "off",
+    trust_mode: "off",
+    require_provenance: false,
+    trusted_extensions: [],
+    default_sandbox_profile: "none",
+    allowed_extensions: [],
+    blocked_extensions: [],
+    allowed_capabilities: [],
+    blocked_capabilities: [],
+    allowed_surfaces: [],
+    blocked_surfaces: [],
+    allowed_commands: [],
+    blocked_commands: [],
+    allowed_actions: [],
+    blocked_actions: [],
+    allowed_services: [],
+    blocked_services: [],
+    extension_overrides: [],
+});
+let extensionReloadEpoch = 0;
+export function nextExtensionReloadToken(seed = Date.now()) {
+    extensionReloadEpoch += 1;
+    return `${extensionReloadEpoch}-${seed}`;
+}
+function normalizePolicyName(value) {
+    if (typeof value !== "string") {
+        return "";
+    }
+    return value.trim().toLowerCase();
+}
+function normalizePolicyStringSet(values) {
+    return new Set((values ?? [])
+        .map((value) => value.trim().toLowerCase())
+        .filter((value) => value.length > 0));
+}
+function normalizePolicySurfaceToken(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length === 0) {
+        return "";
+    }
+    const segments = normalized
+        .split(/[.:/]/)
+        .map((segment) => segment.replace(/[\s_-]+/g, ""))
+        .filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+        return "";
+    }
+    if (segments.length === 1) {
+        return segments[0];
+    }
+    return `${segments[0]}.${segments.slice(1).join("")}`;
+}
+function normalizePolicySurfaceSet(values) {
+    return new Set((values ?? [])
+        .map((value) => normalizePolicySurfaceToken(value))
+        .filter((value) => value.length > 0));
+}
+function normalizePolicyMode(value) {
+    const normalized = normalizePolicyName(value);
+    if (KNOWN_EXTENSION_POLICY_MODES.includes(normalized)) {
+        return normalized;
+    }
+    return "off";
+}
+function normalizePolicyTrustMode(value) {
+    const normalized = normalizePolicyName(value);
+    if (KNOWN_EXTENSION_TRUST_MODES.includes(normalized)) {
+        return normalized;
+    }
+    return "off";
+}
+function normalizePolicySandboxProfile(value) {
+    const normalized = normalizePolicyName(value);
+    if (KNOWN_EXTENSION_SANDBOX_PROFILES.includes(normalized)) {
+        return normalized;
+    }
+    return "none";
+}
+function toSortedList(values) {
+    return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function normalizeExtensionPolicy(settings) {
+    const policy = settings.extensions.policy;
+    const mode = normalizePolicyMode(policy?.mode);
+    const trustMode = normalizePolicyTrustMode(policy?.trust_mode);
+    const requireProvenance = policy?.require_provenance === true;
+    const trustedExtensions = normalizePolicyStringSet(policy?.trusted_extensions);
+    const defaultSandboxProfile = normalizePolicySandboxProfile(policy?.default_sandbox_profile);
+    const allowedExtensions = normalizePolicyStringSet(policy?.allowed_extensions);
+    const blockedExtensions = normalizePolicyStringSet(policy?.blocked_extensions);
+    const allowedCapabilities = normalizePolicyStringSet(policy?.allowed_capabilities);
+    const blockedCapabilities = normalizePolicyStringSet(policy?.blocked_capabilities);
+    const allowedSurfaces = normalizePolicySurfaceSet(policy?.allowed_surfaces);
+    const blockedSurfaces = normalizePolicySurfaceSet(policy?.blocked_surfaces);
+    const allowedCommands = normalizePolicyStringSet(policy?.allowed_commands);
+    const blockedCommands = normalizePolicyStringSet(policy?.blocked_commands);
+    const allowedActions = normalizePolicyStringSet(policy?.allowed_actions);
+    const blockedActions = normalizePolicyStringSet(policy?.blocked_actions);
+    const allowedServices = normalizePolicyStringSet(policy?.allowed_services);
+    const blockedServices = normalizePolicyStringSet(policy?.blocked_services);
+    const overridesByName = new Map();
+    for (const rawOverride of policy?.extension_overrides ?? []) {
+        const name = normalizePolicyName(rawOverride.name);
+        if (name.length === 0) {
+            continue;
+        }
+        overridesByName.set(name, {
+            name,
+            disabled: rawOverride.disabled === true,
+            requireTrusted: rawOverride.require_trusted === true,
+            requireProvenance: rawOverride.require_provenance === true,
+            sandboxProfile: rawOverride.sandbox_profile !== undefined
+                ? normalizePolicySandboxProfile(rawOverride.sandbox_profile)
+                : undefined,
+            allowedCapabilities: normalizePolicyStringSet(rawOverride.allowed_capabilities),
+            blockedCapabilities: normalizePolicyStringSet(rawOverride.blocked_capabilities),
+            allowedSurfaces: normalizePolicySurfaceSet(rawOverride.allowed_surfaces),
+            blockedSurfaces: normalizePolicySurfaceSet(rawOverride.blocked_surfaces),
+            allowedCommands: normalizePolicyStringSet(rawOverride.allowed_commands),
+            blockedCommands: normalizePolicyStringSet(rawOverride.blocked_commands),
+            allowedActions: normalizePolicyStringSet(rawOverride.allowed_actions),
+            blockedActions: normalizePolicyStringSet(rawOverride.blocked_actions),
+            allowedServices: normalizePolicyStringSet(rawOverride.allowed_services),
+            blockedServices: normalizePolicyStringSet(rawOverride.blocked_services),
+        });
+    }
+    const warnings = [];
+    for (const capability of toSortedList([...allowedCapabilities, ...blockedCapabilities])) {
+        if (!isKnownExtensionCapability(capability)) {
+            warnings.push(`extension_policy_unknown_capability:${capability}`);
+        }
+    }
+    for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {
+        for (const capability of toSortedList([...override.allowedCapabilities, ...override.blockedCapabilities])) {
+            if (!isKnownExtensionCapability(capability)) {
+                warnings.push(`extension_policy_unknown_capability:${override.name}:${capability}`);
+            }
+        }
+    }
+    const knownSurfaces = new Set(KNOWN_EXTENSION_POLICY_SURFACES);
+    for (const surface of toSortedList([...allowedSurfaces, ...blockedSurfaces])) {
+        if (!knownSurfaces.has(surface)) {
+            warnings.push(`extension_policy_unknown_surface:${surface}`);
+        }
+    }
+    for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {
+        for (const surface of toSortedList([...override.allowedSurfaces, ...override.blockedSurfaces])) {
+            if (!knownSurfaces.has(surface)) {
+                warnings.push(`extension_policy_unknown_surface:${override.name}:${surface}`);
+            }
+        }
+    }
+    return {
+        mode,
+        trustMode,
+        requireProvenance,
+        trustedExtensions,
+        defaultSandboxProfile,
+        allowedExtensions,
+        blockedExtensions,
+        allowedCapabilities,
+        blockedCapabilities,
+        allowedSurfaces,
+        blockedSurfaces,
+        allowedCommands,
+        blockedCommands,
+        allowedActions,
+        blockedActions,
+        allowedServices,
+        blockedServices,
+        overridesByName,
+        warnings: [...new Set(warnings)].sort((left, right) => left.localeCompare(right)),
+    };
+}
+function serializeExtensionPolicy(policy) {
+    const overrides = [...policy.overridesByName.values()]
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((override) => ({
+        name: override.name,
+        ...(override.disabled ? { disabled: true } : {}),
+        ...(override.requireTrusted ? { require_trusted: true } : {}),
+        ...(override.requireProvenance ? { require_provenance: true } : {}),
+        ...(override.sandboxProfile ? { sandbox_profile: override.sandboxProfile } : {}),
+        ...(override.allowedCapabilities.size > 0 ? { allowed_capabilities: toSortedList(override.allowedCapabilities) } : {}),
+        ...(override.blockedCapabilities.size > 0 ? { blocked_capabilities: toSortedList(override.blockedCapabilities) } : {}),
+        ...(override.allowedSurfaces.size > 0 ? { allowed_surfaces: toSortedList(override.allowedSurfaces) } : {}),
+        ...(override.blockedSurfaces.size > 0 ? { blocked_surfaces: toSortedList(override.blockedSurfaces) } : {}),
+        ...(override.allowedCommands.size > 0 ? { allowed_commands: toSortedList(override.allowedCommands) } : {}),
+        ...(override.blockedCommands.size > 0 ? { blocked_commands: toSortedList(override.blockedCommands) } : {}),
+        ...(override.allowedActions.size > 0 ? { allowed_actions: toSortedList(override.allowedActions) } : {}),
+        ...(override.blockedActions.size > 0 ? { blocked_actions: toSortedList(override.blockedActions) } : {}),
+        ...(override.allowedServices.size > 0 ? { allowed_services: toSortedList(override.allowedServices) } : {}),
+        ...(override.blockedServices.size > 0 ? { blocked_services: toSortedList(override.blockedServices) } : {}),
+    }));
+    return {
+        mode: policy.mode,
+        trust_mode: policy.trustMode,
+        require_provenance: policy.requireProvenance,
+        trusted_extensions: toSortedList(policy.trustedExtensions),
+        default_sandbox_profile: policy.defaultSandboxProfile,
+        allowed_extensions: toSortedList(policy.allowedExtensions),
+        blocked_extensions: toSortedList(policy.blockedExtensions),
+        allowed_capabilities: toSortedList(policy.allowedCapabilities),
+        blocked_capabilities: toSortedList(policy.blockedCapabilities),
+        allowed_surfaces: toSortedList(policy.allowedSurfaces),
+        blocked_surfaces: toSortedList(policy.blockedSurfaces),
+        allowed_commands: toSortedList(policy.allowedCommands),
+        blocked_commands: toSortedList(policy.blockedCommands),
+        allowed_actions: toSortedList(policy.allowedActions),
+        blocked_actions: toSortedList(policy.blockedActions),
+        allowed_services: toSortedList(policy.allowedServices),
+        blocked_services: toSortedList(policy.blockedServices),
+        extension_overrides: overrides,
+    };
+}
+function hydrateExtensionPolicy(policy) {
+    const overridesByName = new Map();
+    for (const rawOverride of policy.extension_overrides ?? []) {
+        const name = normalizePolicyName(rawOverride.name);
+        if (name.length === 0) {
+            continue;
+        }
+        overridesByName.set(name, {
+            name,
+            disabled: rawOverride.disabled === true,
+            requireTrusted: rawOverride.require_trusted === true,
+            requireProvenance: rawOverride.require_provenance === true,
+            sandboxProfile: rawOverride.sandbox_profile !== undefined
+                ? normalizePolicySandboxProfile(rawOverride.sandbox_profile)
+                : undefined,
+            allowedCapabilities: normalizePolicyStringSet(rawOverride.allowed_capabilities),
+            blockedCapabilities: normalizePolicyStringSet(rawOverride.blocked_capabilities),
+            allowedSurfaces: normalizePolicySurfaceSet(rawOverride.allowed_surfaces),
+            blockedSurfaces: normalizePolicySurfaceSet(rawOverride.blocked_surfaces),
+            allowedCommands: normalizePolicyStringSet(rawOverride.allowed_commands),
+            blockedCommands: normalizePolicyStringSet(rawOverride.blocked_commands),
+            allowedActions: normalizePolicyStringSet(rawOverride.allowed_actions),
+            blockedActions: normalizePolicyStringSet(rawOverride.blocked_actions),
+            allowedServices: normalizePolicyStringSet(rawOverride.allowed_services),
+            blockedServices: normalizePolicyStringSet(rawOverride.blocked_services),
+        });
+    }
+    return {
+        mode: normalizePolicyMode(policy.mode),
+        trustMode: normalizePolicyTrustMode(policy.trust_mode),
+        requireProvenance: policy.require_provenance === true,
+        trustedExtensions: normalizePolicyStringSet(policy.trusted_extensions),
+        defaultSandboxProfile: normalizePolicySandboxProfile(policy.default_sandbox_profile),
+        allowedExtensions: normalizePolicyStringSet(policy.allowed_extensions),
+        blockedExtensions: normalizePolicyStringSet(policy.blocked_extensions),
+        allowedCapabilities: normalizePolicyStringSet(policy.allowed_capabilities),
+        blockedCapabilities: normalizePolicyStringSet(policy.blocked_capabilities),
+        allowedSurfaces: normalizePolicySurfaceSet(policy.allowed_surfaces),
+        blockedSurfaces: normalizePolicySurfaceSet(policy.blocked_surfaces),
+        allowedCommands: normalizePolicyStringSet(policy.allowed_commands),
+        blockedCommands: normalizePolicyStringSet(policy.blocked_commands),
+        allowedActions: normalizePolicyStringSet(policy.allowed_actions),
+        blockedActions: normalizePolicyStringSet(policy.blocked_actions),
+        allowedServices: normalizePolicyStringSet(policy.allowed_services),
+        blockedServices: normalizePolicyStringSet(policy.blocked_services),
+        overridesByName,
+        warnings: [],
+    };
+}
+function resolvePolicyOverride(policy, extensionName) {
+    return policy.overridesByName.get(normalizePolicyName(extensionName)) ?? null;
+}
+function evaluatePolicySet(allowed, blocked, value, notAllowlistedReason, blockedReason) {
+    if (blocked.has(value)) {
+        return blockedReason;
+    }
+    if (allowed.size > 0 && !allowed.has(value)) {
+        return notAllowlistedReason;
+    }
+    return null;
+}
+function resolvePolicyCapabilityReason(policy, extension, capability) {
+    const normalizedCapability = capability.trim().toLowerCase();
+    const override = resolvePolicyOverride(policy, extension.name);
+    const allowed = override && override.allowedCapabilities.size > 0 ? override.allowedCapabilities : policy.allowedCapabilities;
+    const blocked = new Set([
+        ...policy.blockedCapabilities,
+        ...(override ? override.blockedCapabilities : []),
+    ]);
+    return evaluatePolicySet(allowed, blocked, normalizedCapability, "capability_not_allowlisted", "capability_blocked");
+}
+function resolvePolicySurfaceReason(policy, extension, surface) {
+    const override = resolvePolicyOverride(policy, extension.name);
+    const allowed = override && override.allowedSurfaces.size > 0 ? override.allowedSurfaces : policy.allowedSurfaces;
+    const blocked = new Set([
+        ...policy.blockedSurfaces,
+        ...(override ? override.blockedSurfaces : []),
+    ]);
+    return evaluatePolicySet(allowed, blocked, surface, "surface_not_allowlisted", "surface_blocked");
+}
+function resolvePolicyCommandReason(policy, extension, command) {
+    const normalizedCommand = normalizeCommandName(command);
+    if (normalizedCommand.length === 0) {
+        return null;
+    }
+    const override = resolvePolicyOverride(policy, extension.name);
+    const allowed = override && override.allowedCommands.size > 0 ? override.allowedCommands : policy.allowedCommands;
+    const blocked = new Set([
+        ...policy.blockedCommands,
+        ...(override ? override.blockedCommands : []),
+    ]);
+    return evaluatePolicySet(allowed, blocked, normalizedCommand, "command_not_allowlisted", "command_blocked");
+}
+function resolvePolicyActionReason(policy, extension, action) {
+    const normalizedAction = normalizePolicyName(action).replace(/\s+/g, "-");
+    if (normalizedAction.length === 0) {
+        return null;
+    }
+    const override = resolvePolicyOverride(policy, extension.name);
+    const allowed = override && override.allowedActions.size > 0 ? override.allowedActions : policy.allowedActions;
+    const blocked = new Set([
+        ...policy.blockedActions,
+        ...(override ? override.blockedActions : []),
+    ]);
+    return evaluatePolicySet(allowed, blocked, normalizedAction, "action_not_allowlisted", "action_blocked");
+}
+function resolvePolicyServiceReason(policy, extension, service) {
+    const normalizedService = normalizePolicyName(service);
+    if (normalizedService.length === 0) {
+        return null;
+    }
+    const override = resolvePolicyOverride(policy, extension.name);
+    const allowed = override && override.allowedServices.size > 0 ? override.allowedServices : policy.allowedServices;
+    const blocked = new Set([
+        ...policy.blockedServices,
+        ...(override ? override.blockedServices : []),
+    ]);
+    return evaluatePolicySet(allowed, blocked, normalizedService, "service_not_allowlisted", "service_blocked");
+}
+function resolvePolicyExtensionReason(policy, extension) {
+    const name = normalizePolicyName(extension.name);
+    const override = resolvePolicyOverride(policy, extension.name);
+    if (override?.disabled === true) {
+        return "extension_override_disabled";
+    }
+    return evaluatePolicySet(policy.allowedExtensions, policy.blockedExtensions, name, "extension_not_allowlisted", "extension_blocked");
+}
+function resolvePolicyTrustReason(policy, extension) {
+    if (policy.trustMode === "off") {
+        return null;
+    }
+    const override = resolvePolicyOverride(policy, extension.name);
+    const name = normalizePolicyName(extension.name);
+    const trusted = extension.trusted === true;
+    const provenanceVerified = extension.provenanceVerified === true;
+    if (policy.trustedExtensions.size > 0 && !policy.trustedExtensions.has(name)) {
+        return "extension_not_trusted";
+    }
+    if ((override?.requireTrusted === true || policy.trustMode === "warn" || policy.trustMode === "enforce") && !trusted) {
+        return "extension_untrusted";
+    }
+    if ((policy.requireProvenance || override?.requireProvenance === true) && !provenanceVerified) {
+        return "provenance_missing_or_unverified";
+    }
+    return null;
+}
+function resolvePolicySandboxReason(policy, extension) {
+    if (policy.mode === "off") {
+        return null;
+    }
+    const override = resolvePolicyOverride(policy, extension.name);
+    const profile = override?.sandboxProfile ?? extension.sandboxProfile ?? policy.defaultSandboxProfile;
+    if (profile === "none") {
+        return null;
+    }
+    const permissions = extension.permissions;
+    if (!permissions) {
+        return "sandbox_permissions_missing";
+    }
+    const hasPermission = (name) => permissions[name] === true;
+    if (profile === "restricted") {
+        if (hasPermission("process_spawn")) {
+            return "sandbox_restricted_disallows_process_spawn";
+        }
+        if (hasPermission("env_write")) {
+            return "sandbox_restricted_disallows_env_write";
+        }
+        return null;
+    }
+    if (profile === "strict") {
+        if (hasPermission("process_spawn")) {
+            return "sandbox_strict_disallows_process_spawn";
+        }
+        if (hasPermission("network")) {
+            return "sandbox_strict_disallows_network";
+        }
+        if (hasPermission("fs_write")) {
+            return "sandbox_strict_disallows_fs_write";
+        }
+        if (hasPermission("env_write")) {
+            return "sandbox_strict_disallows_env_write";
+        }
+    }
+    return null;
+}
+function buildPolicyWarning(mode, scope, extension, reason, details = {}) {
+    const tokens = Object.entries(details)
+        .sort((left, right) => left[0].localeCompare(right[0]))
+        .map(([key, value]) => `${key}=${value}`)
+        .join(":");
+    const suffix = tokens.length > 0 ? `:${tokens}` : "";
+    return `extension_policy_${mode}_${scope}:${extension.layer}:${extension.name}:reason=${reason}${suffix}`;
+}
+function evaluateExtensionPolicyForExtension(policy, extension) {
+    if (policy.mode === "off" && policy.trustMode === "off") {
+        return { allowed: true, warning: null };
+    }
+    const reason = resolvePolicyExtensionReason(policy, extension);
+    const trustReason = resolvePolicyTrustReason(policy, extension);
+    const sandboxReason = resolvePolicySandboxReason(policy, extension);
+    const extensionEnforced = reason && policy.mode === "enforce";
+    const trustEnforced = trustReason && policy.trustMode === "enforce";
+    const sandboxEnforced = sandboxReason && policy.mode === "enforce";
+    if (!reason && !trustReason && !sandboxReason) {
+        return { allowed: true, warning: null };
+    }
+    if (extensionEnforced) {
+        return {
+            allowed: false,
+            warning: buildPolicyWarning("blocked", "extension", extension, reason),
+        };
+    }
+    if (trustEnforced) {
+        return {
+            allowed: false,
+            warning: buildPolicyWarning("blocked", "trust", extension, trustReason),
+        };
+    }
+    if (sandboxEnforced) {
+        return {
+            allowed: false,
+            warning: buildPolicyWarning("blocked", "extension", extension, sandboxReason),
+        };
+    }
+    if (reason && policy.mode === "warn") {
+        return {
+            allowed: true,
+            warning: buildPolicyWarning("violation", "extension", extension, reason),
+        };
+    }
+    if (trustReason && policy.trustMode === "warn") {
+        return {
+            allowed: true,
+            warning: buildPolicyWarning("violation", "trust", extension, trustReason),
+        };
+    }
+    if (sandboxReason && policy.mode === "warn") {
+        return {
+            allowed: true,
+            warning: buildPolicyWarning("violation", "extension", extension, sandboxReason),
+        };
+    }
+    return {
+        allowed: true,
+        warning: null,
+    };
+}
+function evaluateExtensionPolicyForCapability(policy, extension, capability) {
+    if (policy.mode === "off") {
+        return { allowed: true, warning: null };
+    }
+    const reason = resolvePolicyCapabilityReason(policy, extension, capability);
+    if (!reason) {
+        return { allowed: true, warning: null };
+    }
+    return {
+        allowed: policy.mode === "warn",
+        warning: buildPolicyWarning(policy.mode === "warn" ? "violation" : "blocked", "capability", extension, reason, { capability: capability.trim().toLowerCase() }),
+    };
+}
+function evaluateExtensionPolicyForRegistration(policy, extension, surface, method, capability, details) {
+    if (policy.mode === "off") {
+        return { allowed: true, warning: null };
+    }
+    const capabilityReason = typeof capability === "string" ? resolvePolicyCapabilityReason(policy, extension, capability) : null;
+    const surfaceReason = resolvePolicySurfaceReason(policy, extension, surface);
+    const commandReason = details?.command ? resolvePolicyCommandReason(policy, extension, details.command) : null;
+    const actionReason = details?.action ? resolvePolicyActionReason(policy, extension, details.action) : null;
+    const serviceReason = details?.service ? resolvePolicyServiceReason(policy, extension, details.service) : null;
+    const reason = capabilityReason ?? surfaceReason ?? commandReason ?? actionReason ?? serviceReason;
+    if (!reason) {
+        return { allowed: true, warning: null };
+    }
+    const warningDetails = {
+        method: normalizePolicyName(method).replace(/\s+/g, "_"),
+        surface,
+    };
+    if (capability) {
+        warningDetails.capability = capability;
+    }
+    if (details?.command) {
+        warningDetails.command = normalizeCommandName(details.command);
+    }
+    if (details?.action) {
+        warningDetails.action = normalizePolicyName(details.action).replace(/\s+/g, "-");
+    }
+    if (details?.service) {
+        warningDetails.service = normalizePolicyName(details.service);
+    }
+    const warning = buildPolicyWarning(policy.mode === "warn" ? "violation" : "blocked", "registration", extension, reason, warningDetails);
+    return {
+        allowed: policy.mode === "warn",
+        warning,
+    };
+}
 function resolveLegacyExtensionCapabilityAlias(capability) {
     const normalized = capability.trim().toLowerCase();
     if (normalized.length === 0) {
@@ -182,6 +693,94 @@ function parseManifest(raw) {
         }
         priority = candidate.priority;
     }
+    let manifestVersion;
+    if ("manifest_version" in candidate && candidate.manifest_version !== undefined && candidate.manifest_version !== null) {
+        if (typeof candidate.manifest_version !== "number" || !Number.isInteger(candidate.manifest_version)) {
+            return null;
+        }
+        manifestVersion = candidate.manifest_version;
+    }
+    let trusted;
+    if ("trusted" in candidate && candidate.trusted !== undefined && candidate.trusted !== null) {
+        if (typeof candidate.trusted !== "boolean") {
+            return null;
+        }
+        trusted = candidate.trusted;
+    }
+    let sandboxProfile;
+    if ("sandbox_profile" in candidate && candidate.sandbox_profile !== undefined && candidate.sandbox_profile !== null) {
+        if (typeof candidate.sandbox_profile !== "string") {
+            return null;
+        }
+        const normalizedProfile = normalizePolicySandboxProfile(candidate.sandbox_profile);
+        if (normalizedProfile !== candidate.sandbox_profile.trim().toLowerCase()) {
+            return null;
+        }
+        sandboxProfile = normalizedProfile;
+    }
+    let provenance;
+    if ("provenance" in candidate && candidate.provenance !== undefined && candidate.provenance !== null) {
+        const provenanceRecord = asRecord(candidate.provenance);
+        if (!provenanceRecord) {
+            return null;
+        }
+        const source = typeof provenanceRecord.source === "string" && provenanceRecord.source.trim().length > 0
+            ? provenanceRecord.source.trim()
+            : undefined;
+        const signature = typeof provenanceRecord.signature === "string" && provenanceRecord.signature.trim().length > 0
+            ? provenanceRecord.signature.trim()
+            : undefined;
+        const attestation = typeof provenanceRecord.attestation === "string" && provenanceRecord.attestation.trim().length > 0
+            ? provenanceRecord.attestation.trim()
+            : undefined;
+        const verified = provenanceRecord.verified === undefined || provenanceRecord.verified === null
+            ? undefined
+            : typeof provenanceRecord.verified === "boolean"
+                ? provenanceRecord.verified
+                : null;
+        if (verified === null) {
+            return null;
+        }
+        provenance = {
+            ...(source ? { source } : {}),
+            ...(signature ? { signature } : {}),
+            ...(attestation ? { attestation } : {}),
+            ...(typeof verified === "boolean" ? { verified } : {}),
+        };
+    }
+    let permissions;
+    if ("permissions" in candidate && candidate.permissions !== undefined && candidate.permissions !== null) {
+        const permissionsRecord = asRecord(candidate.permissions);
+        if (!permissionsRecord) {
+            return null;
+        }
+        const parseOptionalBoolean = (value) => {
+            if (value === undefined || value === null) {
+                return undefined;
+            }
+            if (typeof value !== "boolean") {
+                return null;
+            }
+            return value;
+        };
+        const fsRead = parseOptionalBoolean(permissionsRecord.fs_read);
+        const fsWrite = parseOptionalBoolean(permissionsRecord.fs_write);
+        const network = parseOptionalBoolean(permissionsRecord.network);
+        const envRead = parseOptionalBoolean(permissionsRecord.env_read);
+        const envWrite = parseOptionalBoolean(permissionsRecord.env_write);
+        const processSpawn = parseOptionalBoolean(permissionsRecord.process_spawn);
+        if ([fsRead, fsWrite, network, envRead, envWrite, processSpawn].includes(null)) {
+            return null;
+        }
+        permissions = {
+            ...(typeof fsRead === "boolean" ? { fs_read: fsRead } : {}),
+            ...(typeof fsWrite === "boolean" ? { fs_write: fsWrite } : {}),
+            ...(typeof network === "boolean" ? { network } : {}),
+            ...(typeof envRead === "boolean" ? { env_read: envRead } : {}),
+            ...(typeof envWrite === "boolean" ? { env_write: envWrite } : {}),
+            ...(typeof processSpawn === "boolean" ? { process_spawn: processSpawn } : {}),
+        };
+    }
     let capabilities = [];
     let legacyCapabilityAliases = [];
     if ("capabilities" in candidate && candidate.capabilities !== undefined && candidate.capabilities !== null) {
@@ -197,6 +796,11 @@ function parseManifest(raw) {
         version: candidate.version.trim(),
         entry: candidate.entry.trim(),
         priority,
+        manifest_version: manifestVersion,
+        trusted,
+        provenance,
+        sandbox_profile: sandboxProfile,
+        permissions,
         capabilities,
         legacy_capability_aliases: legacyCapabilityAliases.length > 0 ? legacyCapabilityAliases : undefined,
     };
@@ -303,6 +907,11 @@ function summarizeCandidate(candidate) {
         entry: candidate.manifest.entry,
         priority: candidate.manifest.priority,
         entry_path: candidate.entry_path,
+        manifest_version: candidate.manifest.manifest_version,
+        trusted: candidate.manifest.trusted,
+        provenance: candidate.manifest.provenance,
+        sandbox_profile: candidate.manifest.sandbox_profile,
+        permissions: candidate.manifest.permissions,
         capabilities: [...candidate.manifest.capabilities],
     };
 }
@@ -441,6 +1050,8 @@ export async function discoverExtensions(options) {
     const roots = resolveExtensionRoots(options.pmRoot, options.cwd ?? process.cwd());
     const configured_enabled = normalizeNames(options.settings.extensions.enabled);
     const configured_disabled = normalizeNames(options.settings.extensions.disabled);
+    const policy = normalizeExtensionPolicy(options.settings);
+    const serializedPolicy = serializeExtensionPolicy(policy);
     if (options.noExtensions) {
         return {
             disabled_by_flag: true,
@@ -449,14 +1060,50 @@ export async function discoverExtensions(options) {
             configured_disabled,
             discovered: [],
             effective: [],
-            warnings: [],
+            warnings: [...policy.warnings],
+            policy: serializedPolicy,
         };
     }
     const enabled = new Set(configured_enabled);
     const disabled = new Set(configured_disabled);
     const globalScan = await scanExtensionLayer("global", roots.global, enabled, disabled);
     const projectScan = await scanExtensionLayer("project", roots.project, enabled, disabled);
-    const effective = buildEffectiveExtensions(globalScan.candidates, projectScan.candidates).map(summarizeCandidate);
+    const policyWarnings = [...policy.warnings];
+    const effectiveCandidates = buildEffectiveExtensions(globalScan.candidates, projectScan.candidates);
+    const effective = [];
+    for (const candidate of effectiveCandidates) {
+        const extensionRef = {
+            layer: candidate.layer,
+            name: candidate.manifest.name,
+            trusted: candidate.manifest.trusted === true,
+            provenanceVerified: candidate.manifest.provenance?.verified === true,
+            sandboxProfile: candidate.manifest.sandbox_profile,
+            permissions: candidate.manifest.permissions && typeof candidate.manifest.permissions === "object"
+                ? {
+                    fs_read: candidate.manifest.permissions.fs_read,
+                    fs_write: candidate.manifest.permissions.fs_write,
+                    network: candidate.manifest.permissions.network,
+                    env_read: candidate.manifest.permissions.env_read,
+                    env_write: candidate.manifest.permissions.env_write,
+                    process_spawn: candidate.manifest.permissions.process_spawn,
+                }
+                : undefined,
+        };
+        const extensionDecision = evaluateExtensionPolicyForExtension(policy, extensionRef);
+        if (extensionDecision.warning) {
+            policyWarnings.push(extensionDecision.warning);
+        }
+        if (!extensionDecision.allowed) {
+            continue;
+        }
+        for (const capability of candidate.manifest.capabilities) {
+            const capabilityDecision = evaluateExtensionPolicyForCapability(policy, extensionRef, capability);
+            if (capabilityDecision.warning) {
+                policyWarnings.push(capabilityDecision.warning);
+            }
+        }
+        effective.push(summarizeCandidate(candidate));
+    }
     return {
         disabled_by_flag: false,
         roots,
@@ -464,7 +1111,8 @@ export async function discoverExtensions(options) {
         configured_disabled,
         discovered: [...globalScan.diagnostics, ...projectScan.diagnostics],
         effective,
-        warnings: [...globalScan.warnings, ...projectScan.warnings],
+        warnings: [...new Set([...globalScan.warnings, ...projectScan.warnings, ...policyWarnings])],
+        policy: serializedPolicy,
     };
 }
 function formatUnknownError(error) {
@@ -473,6 +1121,31 @@ function formatUnknownError(error) {
     }
     return String(error);
 }
+async function fingerprintPath(pathToInspect) {
+    try {
+        const stats = await fs.stat(pathToInspect);
+        return `${Math.trunc(stats.mtimeMs)}-${stats.size}`;
+    }
+    catch {
+        return "missing";
+    }
+}
+async function resolveExtensionImportHref(extension, options) {
+    const baseUrl = new URL(pathToFileURL(extension.entry_path).href);
+    const shouldCacheBust = options.cache_bust === true || typeof options.reload_token === "string";
+    if (!shouldCacheBust) {
+        return baseUrl.href;
+    }
+    const [entryFingerprint, manifestFingerprint] = await Promise.all([
+        fingerprintPath(extension.entry_path),
+        fingerprintPath(extension.manifest_path),
+    ]);
+    const reloadToken = options.reload_token ?? nextExtensionReloadToken();
+    baseUrl.searchParams.set("pm_ext_reload", reloadToken);
+    baseUrl.searchParams.set("pm_ext_entry", entryFingerprint);
+    baseUrl.searchParams.set("pm_ext_manifest", manifestFingerprint);
+    return baseUrl.href;
+}
 export async function loadExtensions(options) {
     const discovery = await discoverExtensions(options);
     const loaded = [];
@@ -488,7 +1161,8 @@ export async function loadExtensions(options) {
     }
     for (const extension of discovery.effective) {
         try {
-            const module = await import(pathToFileURL(extension.entry_path).href);
+            const importHref = await resolveExtensionImportHref(extension, options);
+            const module = await import(importHref);
             loaded.push({
                 ...extension,
                 module,
@@ -912,7 +1586,34 @@ function assertExtensionCapability(extension, capability, method) {
         throw new TypeError(`${method} requires capability '${capability}' in extension manifest capabilities`);
     }
 }
-function createExtensionApi(extension, hooks, commands, parsers, preflight, services, renderers, registrations, activationWarnings) {
+function createExtensionApi(extension, hooks, commands, parsers, preflight, services, renderers, registrations, activationWarnings, policy) {
+    const extensionRef = {
+        layer: extension.layer,
+        name: extension.name,
+        trusted: extension.trusted === true,
+        provenanceVerified: extension.provenance?.verified === true,
+        sandboxProfile: extension.sandbox_profile,
+        permissions: extension.permissions && typeof extension.permissions === "object"
+            ? {
+                fs_read: extension.permissions.fs_read,
+                fs_write: extension.permissions.fs_write,
+                network: extension.permissions.network,
+                env_read: extension.permissions.env_read,
+                env_write: extension.permissions.env_write,
+                process_spawn: extension.permissions.process_spawn,
+            }
+            : undefined,
+    };
+    const pushPolicyWarning = (warning) => {
+        if (warning) {
+            activationWarnings.push(warning);
+        }
+    };
+    const allowRegistration = (surface, method, capability, details) => {
+        const decision = evaluateExtensionPolicyForRegistration(policy, extensionRef, surface, method, capability, details);
+        pushPolicyWarning(decision.warning);
+        return decision.allowed;
+    };
     const registerCommandTrace = (mode, command, expectedSchema, received, hint) => ({
         method: "registerCommand",
         registration_index: mode === "override" ? commands.overrides.length : commands.handlers.length,
@@ -932,6 +1633,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
                 const trace = registerCommandTrace("override", normalizedCommand, 'registerCommand("<command>", (context) => unknown)', { command: commandOrDefinition, override }, "Provide a function as the second registerCommand argument.");
                 throw createRegistrationValidationError(`registerCommand requires an override function when command name is provided (command="${normalizedCommand}", registration_index=${trace.registration_index})`, trace);
             }
+            if (!allowRegistration("commands.override", "registerCommand", "commands", { command: normalizedCommand })) {
+                return;
+            }
             commands.overrides.push({
                 layer: extension.layer,
                 name: extension.name,
@@ -965,6 +1669,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
             assertOptionalStringField("registerCommand definition.description", commandOrDefinition.description);
             assertOptionalStringField("registerCommand definition.intent", commandOrDefinition.intent);
             const action = resolveCommandDefinitionAction(normalizedCommand, commandOrDefinition.action);
+            if (!allowRegistration("commands.handler", "registerCommand", "commands", { command: normalizedCommand, action })) {
+                return;
+            }
             const description = commandOrDefinition.description?.trim();
             const intent = commandOrDefinition.intent?.trim();
             const examples = normalizeOptionalStringArrayField("registerCommand definition.examples", commandOrDefinition.examples);
@@ -1011,6 +1718,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerParser = (command, override) => {
         assertExtensionCapability(extension, "parser", "registerParser");
+        if (!allowRegistration("parser.override", "registerParser", "parser")) {
+            return;
+        }
         const normalizedCommand = normalizeCommandName(assertNonEmptyString("registerParser command", command));
         assertFunctionHandler("registerParser override", override);
         parsers.overrides.push({
@@ -1022,6 +1732,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerPreflight = (override) => {
         assertExtensionCapability(extension, "preflight", "registerPreflight");
+        if (!allowRegistration("preflight.override", "registerPreflight", "preflight")) {
+            return;
+        }
         assertFunctionHandler("registerPreflight override", override);
         preflight.overrides.push({
             layer: extension.layer,
@@ -1035,6 +1748,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
         if (!isExtensionServiceName(normalizedService)) {
             throw new TypeError(`registerService service must be one of: ${EXTENSION_SERVICE_NAMES.join(", ")}`);
         }
+        if (!allowRegistration("services.override", "registerService", "services", { service: normalizedService })) {
+            return;
+        }
         assertFunctionHandler("registerService override", override);
         services.overrides.push({
             layer: extension.layer,
@@ -1045,6 +1761,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerRenderer = (format, renderer) => {
         assertExtensionCapability(extension, "renderers", "registerRenderer");
+        if (!allowRegistration("renderers.override", "registerRenderer", "renderers")) {
+            return;
+        }
         if (typeof renderer !== "function") {
             throw new TypeError("registerRenderer requires a renderer function");
         }
@@ -1061,6 +1780,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerFlags = (targetCommand, flags) => {
         assertExtensionCapability(extension, "schema", "registerFlags");
+        if (!allowRegistration("schema.flags", "registerFlags", "schema")) {
+            return;
+        }
         const normalizedTargetCommand = normalizeCommandName(assertNonEmptyString("registerFlags targetCommand", targetCommand));
         validateFlagDefinitions(flags);
         const normalizedFlags = normalizeRegistrationRecordList("registerFlags flags", flags);
@@ -1076,6 +1798,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerItemFields = (fields) => {
         assertExtensionCapability(extension, "schema", "registerItemFields");
+        if (!allowRegistration("schema.itemfields", "registerItemFields", "schema")) {
+            return;
+        }
         validateItemFieldDefinitions(fields);
         const normalizedFields = normalizeRegistrationRecordList("registerItemFields fields", fields);
         if (normalizedFields.length === 0) {
@@ -1089,6 +1814,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerItemTypes = (types) => {
         assertExtensionCapability(extension, "schema", "registerItemTypes");
+        if (!allowRegistration("schema.itemtypes", "registerItemTypes", "schema")) {
+            return;
+        }
         validateItemTypeDefinitions(types);
         const normalizedTypes = normalizeRegistrationRecordList("registerItemTypes types", types);
         if (normalizedTypes.length === 0) {
@@ -1102,6 +1830,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerMigration = (definition) => {
         assertExtensionCapability(extension, "schema", "registerMigration");
+        if (!allowRegistration("schema.migrations", "registerMigration", "schema")) {
+            return;
+        }
         validateMigrationDefinition(definition);
         const runtimeDefinition = normalizeRuntimeRegistrationRecord("registerMigration definition", definition);
         registrations.migrations.push(attachRuntimeDefinition({
@@ -1112,6 +1843,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerImporter = (name, importer) => {
         assertExtensionCapability(extension, "importers", "registerImporter");
+        if (!allowRegistration("importers.importer", "registerImporter", "importers")) {
+            return;
+        }
         const normalizedName = normalizeRegistrationName(assertNonEmptyString("registerImporter name", name));
         assertFunctionHandler("registerImporter importer", importer);
         const commandPath = toRegistrationCommandPath(normalizedName, "import");
@@ -1137,6 +1871,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerExporter = (name, exporter) => {
         assertExtensionCapability(extension, "importers", "registerExporter");
+        if (!allowRegistration("importers.exporter", "registerExporter", "importers")) {
+            return;
+        }
         const normalizedName = normalizeRegistrationName(assertNonEmptyString("registerExporter name", name));
         assertFunctionHandler("registerExporter exporter", exporter);
         const commandPath = toRegistrationCommandPath(normalizedName, "export");
@@ -1162,6 +1899,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerSearchProvider = (provider) => {
         assertExtensionCapability(extension, "search", "registerSearchProvider");
+        if (!allowRegistration("search.provider", "registerSearchProvider", "search")) {
+            return;
+        }
         const runtimeDefinition = normalizeRuntimeRegistrationRecord("registerSearchProvider provider", provider);
         registrations.search_providers.push(attachRuntimeDefinition({
             layer: extension.layer,
@@ -1171,6 +1911,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerVectorStoreAdapter = (adapter) => {
         assertExtensionCapability(extension, "search", "registerVectorStoreAdapter");
+        if (!allowRegistration("search.vectorstore", "registerVectorStoreAdapter", "search")) {
+            return;
+        }
         const runtimeDefinition = normalizeRuntimeRegistrationRecord("registerVectorStoreAdapter adapter", adapter);
         registrations.vector_store_adapters.push(attachRuntimeDefinition({
             layer: extension.layer,
@@ -1180,6 +1923,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerBeforeCommand = (hook) => {
         assertExtensionCapability(extension, "hooks", "api.hooks.beforeCommand");
+        if (!allowRegistration("hooks.beforecommand", "api.hooks.beforeCommand", "hooks")) {
+            return;
+        }
         assertHookHandler("beforeCommand", hook);
         hooks.beforeCommand.push({
             layer: extension.layer,
@@ -1189,6 +1935,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerAfterCommand = (hook) => {
         assertExtensionCapability(extension, "hooks", "api.hooks.afterCommand");
+        if (!allowRegistration("hooks.aftercommand", "api.hooks.afterCommand", "hooks")) {
+            return;
+        }
         assertHookHandler("afterCommand", hook);
         hooks.afterCommand.push({
             layer: extension.layer,
@@ -1198,6 +1947,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerOnWrite = (hook) => {
         assertExtensionCapability(extension, "hooks", "api.hooks.onWrite");
+        if (!allowRegistration("hooks.onwrite", "api.hooks.onWrite", "hooks")) {
+            return;
+        }
         assertHookHandler("onWrite", hook);
         hooks.onWrite.push({
             layer: extension.layer,
@@ -1207,6 +1959,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerOnRead = (hook) => {
         assertExtensionCapability(extension, "hooks", "api.hooks.onRead");
+        if (!allowRegistration("hooks.onread", "api.hooks.onRead", "hooks")) {
+            return;
+        }
         assertHookHandler("onRead", hook);
         hooks.onRead.push({
             layer: extension.layer,
@@ -1216,6 +1971,9 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     };
     const registerOnIndex = (hook) => {
         assertExtensionCapability(extension, "hooks", "api.hooks.onIndex");
+        if (!allowRegistration("hooks.onindex", "api.hooks.onIndex", "hooks")) {
+            return;
+        }
         assertHookHandler("onIndex", hook);
         hooks.onIndex.push({
             layer: extension.layer,
@@ -1374,6 +2132,7 @@ function collectServiceCollisionWarnings(services) {
     return warnings;
 }
 export async function activateExtensions(loadResult) {
+    const policy = hydrateExtensionPolicy(loadResult.policy ?? DEFAULT_EXTENSION_POLICY);
     const hooks = createEmptyExtensionHookRegistry();
     const commands = createEmptyExtensionCommandRegistry();
     const parsers = createEmptyExtensionParserRegistry();
@@ -1389,7 +2148,7 @@ export async function activateExtensions(loadResult) {
             continue;
         }
         try {
-            await activatable.activate(createExtensionApi(extension, hooks, commands, parsers, preflight, services, renderers, registrations, warnings));
+            await activatable.activate(createExtensionApi(extension, hooks, commands, parsers, preflight, services, renderers, registrations, warnings, policy));
         }
         catch (error) {
             warnings.push(`extension_activate_failed:${extension.layer}:${extension.name}`);