@vellumai/assistant 0.11.2 → 0.11.3-dev.202608080427.92f668a

package/src/plugins/defaults/memory/v2/router.ts

@@ -41,6 +41,7 @@ import {
 import { z } from "zod";
 
 import type { AssistantConfig } from "../../../../config/types.js";
+import { warmGuardianBindings } from "../../../../contacts/guardian-delivery-reader.js";
 import {
   cachedTextBlock,
   extractToolUse,
@@ -393,6 +394,13 @@ async function runRouterBatch(
     provider,
   } = params;
 
+  // Warm both guardian-delivery cache keys (vellum + unfiltered) so
+  // resolveUserName's sync guardian-file resolution, including its
+  // any-channel fallback, hits fresh keys instead of falling back to
+  // users/default.md on a cold/TTL-expired cache. Two local-socket IPC
+  // reads per batch, dwarfed by the batch's provider call.
+  await warmGuardianBindings();
+
   const systemPrompt = resolveRouterPrompt(
     config.memory?.v2?.router?.router_prompt_path ?? null,
     workspaceDir,

package/src/plugins/defaults/turn-context/unified-turn-context.ts

@@ -29,7 +29,6 @@ export interface UnifiedTurnContextOptions {
     name: string;
     /** Directory stem: the handle a human would recognize the app by. */
     slug: string;
-    sourceDir: string;
     /** Set when the app is bundled by an installed plugin rather than built here. */
     pluginName?: string;
   } | null;
@@ -127,7 +126,7 @@ export function buildUnifiedTurnContextBlock(
       ? ` It is bundled by the "${sanitizeInlineContextValue(app.pluginName)}" plugin, not built in the sandbox.`
       : "";
     lines.push(
-      `visible_app: "${sanitizeInlineContextValue(app.name)}" (app_id: "${sanitizeInlineContextValue(app.appId)}", slug: "${sanitizeInlineContextValue(app.slug)}", source: "${sanitizeInlineContextValue(app.sourceDir)}"). The user has this app open on screen; unqualified references to "the app" mean this one. The app tools take the app_id.${provenance}`,
+      `visible_app: "${sanitizeInlineContextValue(app.name)}" (app_id: "${sanitizeInlineContextValue(app.appId)}", slug: "${sanitizeInlineContextValue(app.slug)}"). The user has this app open on screen; unqualified references to "the app" mean this one.${provenance}`,
     );
   }
 

package/src/plugins/external-plugin-loader.ts

@@ -92,6 +92,12 @@ const PluginPackageJsonSchema = z
     version: z.string().optional(),
     peerDependencies: z.record(z.string(), z.string()).optional(),
     credentialKeyPatterns: z.unknown().optional(),
+    /** Human title, when the package name is not one ("@vellumai/imessage"). */
+    displayName: z.string().min(1).optional(),
+    /** Standard npm field, reused as the one-line description clients show. */
+    description: z.string().min(1).optional(),
+    /** Lucide icon name without the `lucide-` prefix, matching `ChannelInfo`. */
+    icon: z.string().min(1).optional(),
   })
   .passthrough();
 
@@ -461,9 +467,55 @@ export async function loadExternalPlugin(
  * Exported so the mtime cache can discover plugin identity without going
  * through the full `buildExternalPlugin` path. The identity mirrors
  * {@link buildPluginFromDir}: the directory name, not `package.json` `name`.
+ *
+ * `quiet` suppresses the failure logs, for callers that poll on a timer and
+ * surface the failure through their own channel (e.g. the schedule
+ * reconciler's per-day deduped notification).
+ */
+/**
+ * How a plugin presents itself: its title, its one line, its glyph.
+ *
+ * Every field is optional and none of them gate anything. A surface that
+ * shows a plugin falls back rather than hiding it, so a missing `icon`
+ * costs an icon and not the row.
+ */
+export interface PluginPresentation {
+  displayName?: string;
+  description?: string;
+  icon?: string;
+}
+
+/**
+ * Read a plugin's presentation fields from its manifest.
+ *
+ * Separate from {@link parsePluginManifest} because the two answer different
+ * questions: that one decides whether a plugin is loadable, this one only
+ * dresses it for display. An unreadable or invalid manifest yields `undefined`
+ * here rather than an error, since a caller showing a plugin has already
+ * established it exists.
  */
+export async function parsePluginPresentation(
+  pluginDir: string,
+): Promise<PluginPresentation | undefined> {
+  let rawPkg: unknown;
+  try {
+    rawPkg = JSON.parse(
+      await readFile(join(pluginDir, "package.json"), "utf8"),
+    );
+  } catch {
+    return undefined;
+  }
+  const parsed = PluginPackageJsonSchema.safeParse(rawPkg);
+  if (!parsed.success) {
+    return undefined;
+  }
+  const { displayName, description, icon } = parsed.data;
+  return { displayName, description, icon };
+}
+
 export async function parsePluginManifest(
   pluginDir: string,
+  opts: { quiet?: boolean } = {},
 ): Promise<
   Pick<PluginManifest, "name" | "version" | "credentialKeyPatterns"> | undefined
 > {
@@ -473,18 +525,22 @@ export async function parsePluginManifest(
     rawPkg = JSON.parse(await readFile(pkgPath, "utf8"));
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
-    log.error(
-      { err, pluginDir },
-      `package.json at ${pluginDir} could not be read or parsed: ${reason}`,
-    );
+    if (!opts.quiet) {
+      log.error(
+        { err, pluginDir },
+        `package.json at ${pluginDir} could not be read or parsed: ${reason}`,
+      );
+    }
     return undefined;
   }
   const parsed = PluginPackageJsonSchema.safeParse(rawPkg);
   if (!parsed.success) {
-    log.error(
-      { err: parsed.error, pluginDir },
-      `package.json at ${pluginDir} failed schema validation: ${parsed.error.message}`,
-    );
+    if (!opts.quiet) {
+      log.error(
+        { err: parsed.error, pluginDir },
+        `package.json at ${pluginDir} failed schema validation: ${parsed.error.message}`,
+      );
+    }
     return undefined;
   }
   const pkg: PluginPackageJson = parsed.data;

package/src/plugins/installed-plugin-dirs.ts

@@ -0,0 +1,101 @@
+/**
+ * Enumerate installed plugin directories under the workspace plugins dir.
+ *
+ * An installed plugin is a non-hidden directory carrying a `package.json`,
+ * whose realpath stays under the realpath of the plugins directory. This walk
+ * is shared by the plugin source-version collector
+ * (`./collect-source-versions.ts`) and the schedule reconciler
+ * (`../schedule/plugin-schedule-reconciler.ts`) so both agree on what counts
+ * as an installed plugin. Disabled-state and manifest validation are caller
+ * concerns: the source collector fingerprints disabled plugins too, while the
+ * reconciler skips them and additionally gates on `parsePluginManifest`.
+ *
+ * The containment half of that definition is exported on its own
+ * ({@link isInsidePluginRoot}) for the plugin loader, which applies the same
+ * boundary at boot discovery and before it imports a plugin directory, and for
+ * the schedule fire-time probe, which applies it before answering that a
+ * declaration is available to run.
+ */
+
+import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { join, sep } from "node:path";
+
+import { getWorkspacePluginsDir } from "../util/platform.js";
+
+export interface InstalledPluginDir {
+  /** Directory basename: the plugin's install identity. */
+  readonly name: string;
+  /** Absolute path to the plugin directory. */
+  readonly dir: string;
+}
+
+/**
+ * True when `dir` resolves to a location strictly inside `root`, where `root`
+ * is the tree the caller requires `dir` to stay in: an allowed plugin root
+ * (the workspace plugins directory, or the standalone workspace hooks
+ * directory) for a plugin directory, or a plugin directory for something
+ * installed under it.
+ *
+ * Both sides are resolved before the comparison. Resolving the candidate is
+ * what judges a symlinked entry by where it points rather than by where it
+ * sits; resolving the root is what keeps a root that itself sits behind a
+ * symlinked path component (macOS `/tmp` to `/private/tmp`, a workspace under
+ * a linked home) matching its own children. A resolved candidate compared
+ * against an unresolved root reports every entry as outside.
+ *
+ * This is the one containment boundary the plugin loader applies: enumeration
+ * here, boot discovery, and the pre-import check before a plugin directory is
+ * dynamic-imported (`scanPlugins` and `isAllowedPluginDir` in
+ * `./mtime-cache.ts`) all go through it, so a root the loader refuses to
+ * activate is never reported as installed either. A link pointing at the root
+ * itself is outside the boundary: it aliases the root, not a plugin. The
+ * schedule fire-time probe
+ * (`../schedule/plugin-schedule-declarations.ts`) applies the same boundary,
+ * so such a root cannot be run by a declared schedule either.
+ */
+export function isInsidePluginRoot(dir: string, root: string): boolean {
+  try {
+    return realpathSync(dir).startsWith(realpathSync(root) + sep);
+  } catch {
+    // Unresolvable (dangling link, races with an uninstall, unreadable): not
+    // provably contained, so it is not inside.
+    return false;
+  }
+}
+
+/**
+ * List every installed plugin directory, sorted by the underlying readdir
+ * order. A missing plugins directory yields `[]`.
+ */
+export function listInstalledPluginDirs(): InstalledPluginDir[] {
+  const pluginsDir = getWorkspacePluginsDir();
+  let entries: string[] = [];
+  try {
+    entries = readdirSync(pluginsDir);
+  } catch {
+    // No plugins directory yet, so nothing installed.
+    return [];
+  }
+  const out: InstalledPluginDir[] = [];
+  for (const entry of entries) {
+    if (entry.startsWith(".")) {
+      continue;
+    }
+    const dir = join(pluginsDir, entry);
+    try {
+      if (!statSync(dir).isDirectory()) {
+        continue;
+      }
+    } catch {
+      continue;
+    }
+    if (!isInsidePluginRoot(dir, pluginsDir)) {
+      continue;
+    }
+    if (!existsSync(join(dir, "package.json"))) {
+      continue;
+    }
+    out.push({ name: entry, dir });
+  }
+  return out;
+}

package/src/plugins/mcp-servers.ts

@@ -0,0 +1,343 @@
+/**
+ * Plugin-contributed MCP servers.
+ *
+ * A plugin declares MCP servers in a root `mcp.json`, per the Agent
+ * Plugins 1.0.0 specification:
+ *
+ *     {
+ *       "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+ *       "mcpServers": {
+ *         "unabyss": { "type": "streamable-http", "url": "https://mcp.unabyss.com" }
+ *       }
+ *     }
+ *
+ * This module reads those files and projects each entry onto the
+ * assistant's own `McpServerConfig` shape, so a plugin-declared server can
+ * flow through the same surfaces as one configured in the workspace
+ * `config.json`.
+ *
+ * Failure isolation follows the spec: an invalid top-level `mcp.json`
+ * disables MCP for that plugin only, and an invalid individual server
+ * disables only that entry. Neither ever throws, because a malformed file
+ * in one plugin must not remove another plugin's servers from a listing.
+ *
+ * Authentication is deliberately absent. Agent Plugins 1.0.0 defines no
+ * portable OAuth or credential-reference fields; authentication is
+ * client-managed, and any `headers` in the file are literal package data.
+ * A plugin therefore cannot ship a credential, and the assistant's own
+ * credential store stays the only place secrets live.
+ *
+ * Consumers must not resolve a plugin server's id against the
+ * `mcp:<serverId>:*` credential namespace. Those keys belong to
+ * workspace-configured servers, and a plugin controls both its server key
+ * and its URL, so honoring them for a plugin-declared server would send a
+ * workspace credential to an endpoint the plugin chose.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { z } from "zod";
+
+import {
+  type AllPluginInfo,
+  listAllPlugins,
+  type ListInstalledPluginsOptions,
+} from "../cli/lib/list-installed-plugins.js";
+import type { McpServerConfig, McpTransport } from "../config/schemas/mcp.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("plugin-mcp-servers");
+
+/** Filename a plugin declares its MCP servers in, at the plugin root. */
+export const PLUGIN_MCP_MANIFEST = "mcp.json";
+
+/**
+ * Risk level assigned to a plugin-declared server. `mcp.json` has no risk
+ * field, since the spec defines none, so the assistant's own default
+ * applies. `high` matches `McpServerConfigSchema` and is the safe
+ * direction: a plugin cannot lower the approval bar for the tools it
+ * introduces.
+ */
+const PLUGIN_SERVER_DEFAULT_RISK = "high" as const;
+
+/** Matches the `maxTools` default in `McpServerConfigSchema`. */
+const PLUGIN_SERVER_DEFAULT_MAX_TOOLS = 20;
+
+// ---------------------------------------------------------------------------
+// Wire schema (Agent Plugins 1.0.0)
+// ---------------------------------------------------------------------------
+
+const PluginStdioServerSchema = z.object({
+  type: z.literal("stdio"),
+  command: z.string().min(1),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  cwd: z.string().optional(),
+});
+
+const PluginHttpServerSchema = z.object({
+  type: z.enum(["streamable-http", "sse"]),
+  url: z.string().min(1),
+  headers: z.record(z.string(), z.string()).optional(),
+});
+
+const PluginMcpServerSchema = z.discriminatedUnion("type", [
+  PluginStdioServerSchema,
+  PluginHttpServerSchema,
+]);
+
+const PluginMcpManifestSchema = z.object({
+  mcpServers: z.record(z.string(), z.unknown()),
+});
+
+// ---------------------------------------------------------------------------
+// Public shape
+// ---------------------------------------------------------------------------
+
+/** One MCP server declared by one plugin. */
+export interface PluginMcpServer {
+  /** Server id in the assistant's namespace. See {@link buildServerId}. */
+  readonly id: string;
+  /** Directory name of the plugin that declared it. */
+  readonly pluginName: string;
+  /** Key this server appears under in the plugin's `mcp.json`. */
+  readonly serverKey: string;
+  /** Projected onto the assistant's own server-config shape. */
+  readonly config: McpServerConfig;
+}
+
+/** A plugin's `mcp.json` that could not be used, in whole or in part. */
+export interface PluginMcpIssue {
+  readonly pluginName: string;
+  /** Absent when the whole manifest is unusable rather than one entry. */
+  readonly serverKey?: string;
+  readonly message: string;
+}
+
+export interface PluginMcpServersResult {
+  readonly servers: readonly PluginMcpServer[];
+  readonly issues: readonly PluginMcpIssue[];
+}
+
+/**
+ * Server id for a plugin-declared server.
+ *
+ * Plugin servers share one namespace with workspace servers and with each
+ * other, so the plugin name is the qualifier. The redundant case is
+ * collapsed: a plugin named `unabyss` whose server key is also `unabyss`
+ * yields `unabyss`, not `unabyss__unabyss`, which matters because the id
+ * is embedded in every tool name the server contributes
+ * (`mcp__<id>__<tool>`).
+ */
+export function buildServerId(pluginName: string, serverKey: string): string {
+  return pluginName === serverKey ? pluginName : `${pluginName}__${serverKey}`;
+}
+
+/**
+ * Expand the two path variables the Agent Plugins spec defines for stdio
+ * servers. They interpolate textually in `args`, `env` values, and `cwd`
+ * only, never in `command`, a URL, or a header, so a manifest cannot use
+ * them to build the executable path itself.
+ */
+export function interpolatePluginPaths(
+  value: string,
+  pluginRoot: string,
+  pluginData: string,
+): string {
+  return value
+    .replaceAll("${PLUGIN_ROOT}", pluginRoot)
+    .replaceAll("${PLUGIN_DATA}", pluginData);
+}
+
+/**
+ * Whether a directory is a plugin the runtime would actually load.
+ *
+ * `listAllPlugins` is an inventory of directories and reports a malformed
+ * entry rather than dropping it, so it happily returns a directory with no
+ * usable `package.json`. The runtime loader rejects those in
+ * `parsePluginManifest`: the manifest must parse and carry a non-empty
+ * `name`. Applying the same gate here keeps `mcp.json` from being honored
+ * for a directory that will never load as a plugin.
+ */
+export function hasLoadableManifest(plugin: AllPluginInfo): boolean {
+  const name = plugin.packageJson?.name;
+  return typeof name === "string" && name.length > 0;
+}
+
+// ---------------------------------------------------------------------------
+// Reading
+// ---------------------------------------------------------------------------
+
+/**
+ * Read every installed plugin's `mcp.json` and return the servers they
+ * declare, plus anything that could not be read.
+ *
+ * A disabled plugin is skipped entirely: `.disabled` means the plugin
+ * contributes no hooks and no tools, and an MCP server it declares is no
+ * different.
+ */
+export function readPluginMcpServers(
+  opts: ListInstalledPluginsOptions = {},
+): PluginMcpServersResult {
+  const servers: PluginMcpServer[] = [];
+  const issues: PluginMcpIssue[] = [];
+  const seen = new Map<string, string>();
+
+  let plugins: readonly AllPluginInfo[];
+  try {
+    plugins = listAllPlugins(opts);
+  } catch (err) {
+    // The plugins directory being unreadable is not a reason to fail a
+    // listing that also has workspace-configured servers in it.
+    log.warn({ err }, "Could not enumerate plugins for MCP declarations");
+    return { servers: [], issues: [] };
+  }
+
+  for (const plugin of plugins) {
+    if (plugin.disabled) {
+      continue;
+    }
+    const manifestPath = join(plugin.target, PLUGIN_MCP_MANIFEST);
+    if (!existsSync(manifestPath)) {
+      continue;
+    }
+
+    if (!hasLoadableManifest(plugin)) {
+      issues.push({
+        pluginName: plugin.name,
+        message: `${PLUGIN_MCP_MANIFEST} ignored: package.json is missing, unparseable, or has no name, so the runtime will not load this directory as a plugin`,
+      });
+      continue;
+    }
+
+    const parsed = parseManifest(manifestPath);
+    if ("error" in parsed) {
+      issues.push({ pluginName: plugin.name, message: parsed.error });
+      continue;
+    }
+
+    for (const [serverKey, raw] of Object.entries(parsed.mcpServers)) {
+      if (serverKey.trim().length === 0) {
+        issues.push({
+          pluginName: plugin.name,
+          message: "server key must be a non-empty string; skipping",
+        });
+        continue;
+      }
+
+      const entry = PluginMcpServerSchema.safeParse(raw);
+      if (!entry.success) {
+        issues.push({
+          pluginName: plugin.name,
+          serverKey,
+          message: `invalid server entry: ${entry.error.issues
+            .map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`)
+            .join("; ")}`,
+        });
+        continue;
+      }
+
+      const id = buildServerId(plugin.name, serverKey);
+      const previous = seen.get(id);
+      if (previous) {
+        // Two plugins claiming one id would silently shadow each other, and
+        // the loser's tools would just be missing. Report both instead.
+        issues.push({
+          pluginName: plugin.name,
+          serverKey,
+          message: `server id "${id}" is already declared by plugin "${previous}"; skipping`,
+        });
+        continue;
+      }
+      seen.set(id, plugin.name);
+
+      // The spec allows `cwd` on a stdio server; the assistant's transport
+      // has no such field. Dropping it silently would leave a server that
+      // resolves its relative paths against the wrong directory and fails
+      // for no visible reason, so say so.
+      if (entry.data.type === "stdio" && entry.data.cwd) {
+        issues.push({
+          pluginName: plugin.name,
+          serverKey,
+          message: `"cwd" is not supported by this host and was ignored; the server runs in the daemon's working directory`,
+        });
+      }
+
+      servers.push({
+        id,
+        pluginName: plugin.name,
+        serverKey,
+        config: {
+          transport: projectTransport(entry.data, plugin.target),
+          enabled: true,
+          defaultRiskLevel: PLUGIN_SERVER_DEFAULT_RISK,
+          maxTools: PLUGIN_SERVER_DEFAULT_MAX_TOOLS,
+        },
+      });
+    }
+  }
+
+  return { servers, issues };
+}
+
+function parseManifest(
+  path: string,
+): { mcpServers: Record<string, unknown> } | { error: string } {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    return {
+      error: `${PLUGIN_MCP_MANIFEST} unreadable: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch (err) {
+    return {
+      error: `${PLUGIN_MCP_MANIFEST} invalid JSON: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+
+  const manifest = PluginMcpManifestSchema.safeParse(json);
+  if (!manifest.success) {
+    return {
+      error: `${PLUGIN_MCP_MANIFEST} is missing a valid "mcpServers" object`,
+    };
+  }
+  return { mcpServers: manifest.data.mcpServers };
+}
+
+/**
+ * Project one spec-shaped entry onto the assistant's transport union. The
+ * two vocabularies already agree on type names and required fields, so this
+ * is a field copy plus path interpolation for the stdio case.
+ */
+function projectTransport(
+  entry: z.infer<typeof PluginMcpServerSchema>,
+  pluginRoot: string,
+): McpTransport {
+  if (entry.type === "stdio") {
+    const pluginData = join(pluginRoot, "data");
+    const expand = (v: string): string =>
+      interpolatePluginPaths(v, pluginRoot, pluginData);
+    return {
+      type: "stdio",
+      command: entry.command,
+      args: (entry.args ?? []).map(expand),
+      ...(entry.env && {
+        env: Object.fromEntries(
+          Object.entries(entry.env).map(([k, v]) => [k, expand(v)]),
+        ),
+      }),
+    };
+  }
+  return {
+    type: entry.type,
+    url: entry.url,
+    ...(entry.headers && { headers: entry.headers }),
+  };
+}

package/src/plugins/mtime-cache.ts

@@ -31,13 +31,7 @@
  * each hook through the hook loader on demand.
  */
 
-import {
-  existsSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  statSync,
-} from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import type { Logger } from "pino";
@@ -72,6 +66,7 @@ import {
   listSurfaceDir,
   parsePluginManifest,
 } from "./external-plugin-loader.js";
+import { isInsidePluginRoot } from "./installed-plugin-dirs.js";
 import { snapshotPluginSource } from "./source-fingerprint.js";
 import type { PluginSourceVersion } from "./source-versions.js";
 import {
@@ -293,6 +288,18 @@ export async function reconcilePluginSourcesNow(): Promise<void> {
     } catch (err) {
       log.error({ err }, "imperative plugin reconcile failed");
     }
+    // Converge plugin-declared schedules against the plugin set this apply
+    // just settled, so install/uninstall/upgrade arm and disarm rows in the
+    // same poke. Imported lazily to keep the notification pipeline out of
+    // this module's static graph (sidecar workers import it for hook reads).
+    // Self-contained: never throws and checks DB readiness itself.
+    try {
+      const { reconcilePluginSchedules } =
+        await import("../schedule/plugin-schedule-reconciler.js");
+      await reconcilePluginSchedules();
+    } catch (err) {
+      log.error({ err }, "plugin schedule reconcile failed");
+    }
   })().finally(() => {
     reconcileInFlight = null;
   });
@@ -306,32 +313,26 @@ export async function reconcilePluginSourcesNow(): Promise<void> {
  * never dynamically imports code from outside the designated plugin roots,
  * regardless of what the collector walked.
  *
- * Uses `realpathSync` to resolve symlinks before the prefix check, so a
- * symlinked path that looks like it's under the plugins dir but points
- * elsewhere is rejected.
+ * Containment runs through {@link isInsidePluginRoot}, which resolves the
+ * candidate and the root, so a symlinked path that looks like it's under the
+ * plugins dir but points elsewhere is rejected while a plugins dir reached
+ * through a symlinked path component still accepts its own children.
  */
 function isAllowedPluginDir(
   dir: string,
   pluginsDir: string,
   hooksDir: string,
 ): boolean {
-  let resolved: string;
-  try {
-    resolved = realpathSync(dir);
-  } catch {
-    // Directory doesn't exist or is inaccessible — allow it through so
-    // bringUpPlugin/parsePluginManifest can log the normal failure. The
+  if (!existsSync(dir)) {
+    // Directory doesn't exist or is inaccessible: allow it through so
+    // bringUpPlugin/parsePluginManifest can log the normal failure, and so a
+    // directory that just went away still reaches its teardown branch. The
     // danger is importing code from an unexpected location, not a missing
     // directory.
     return true;
   }
-  const normalizedPluginsDir = pluginsDir + "/";
-  const normalizedHooksDir = hooksDir + "/";
   return (
-    resolved === pluginsDir ||
-    resolved.startsWith(normalizedPluginsDir) ||
-    resolved === hooksDir ||
-    resolved.startsWith(normalizedHooksDir)
+    isInsidePluginRoot(dir, pluginsDir) || isInsidePluginRoot(dir, hooksDir)
   );
 }
 
@@ -754,6 +755,17 @@ async function scanPlugins(): Promise<void> {
     } catch {
       continue;
     }
+    // Judge the entry by where it resolves. A symlinked plugin root pointing
+    // out of the plugins directory is not an install, and activating one at
+    // boot would run code that enumeration and the reload path both refuse to
+    // touch.
+    if (!isInsidePluginRoot(pluginDir, pluginsDir)) {
+      log.warn(
+        { pluginDir },
+        "plugin root resolves outside the plugins directory, skipping",
+      );
+      continue;
+    }
     if (!existsSync(join(pluginDir, "package.json"))) {
       continue;
     }