@wrongstack/cli 0.308.6 → 0.308.7

package/dist/wiring/external-plugins.d.ts

@@ -0,0 +1,58 @@
+/**
+ * External (third-party) plugin loading for the CLI host.
+ *
+ * Three source kinds, in precedence order:
+ *   1. `config.plugins` entries with a bare/npm specifier — dynamically
+ *      imported exactly as before (module resolution via the host).
+ *   2. `config.plugins` entries with an explicit `path` — resolved against
+ *      the project root and imported via `file:` URL.
+ *   3. Directory discovery — `<globalRoot>/plugins/*` (user-global, active
+ *      by default) and `<projectRoot>/.wrongstack/plugins/*` (project-local,
+ *      INACTIVE by default: a cloned repo must not auto-execute plugin code
+ *      the user never opted into).
+ *
+ * Every external plugin passes through, in order:
+ *   - enablement resolution (same `resolvePluginEnablement` as built-ins),
+ *   - deprecation + builtin-spec guards (passed in by the wiring so this
+ *     module stays acyclic with wiring/plugins.ts),
+ *   - a PRE-IMPORT TOFU trust gate keyed by the resolved entry file:
+ *     the module is hashed before any of its code executes, first load
+ *     pins the hash, a changed hash refuses the load until the user
+ *     re-pins with `wstack plugin trust <name>`,
+ *   - a shape check (default-exported object with name/apiVersion/setup),
+ *   - a spoof guard (external plugins may not claim built-in names).
+ *
+ * First-party/built-in plugins never enter this module.
+ */
+import type { Config, Logger, Plugin } from '@wrongstack/core/types';
+/** Resolve a `file:` URL / absolute / relative path to an absolute fs path. */
+export declare function normalizeConfigPath(raw: string, projectRoot: string): string;
+/**
+ * Resolve a bare/npm specifier to its entry file WITHOUT importing it.
+ * Returns undefined when resolution is unavailable (bundled hosts, exotic
+ * specs) — callers then proceed without the pre-import trust gate.
+ */
+export declare function resolveSpecifierEntry(spec: string): string | undefined;
+export interface ExternalPluginHooks {
+    /** Normalize a config spec to its bare plugin name (null for paths/URLs). */
+    nameFromSpec(spec: string): string | null;
+    /** True when the spec refers to a built-in plugin (loaded elsewhere). */
+    isBuiltinSpec(spec: string): boolean;
+    /** Warn-once deprecation check; returns true when the spec is deprecated. */
+    warnIfDeprecated(name: string): boolean;
+}
+export interface LoadExternalPluginsContext {
+    config: Config;
+    log: Logger;
+    /** `~/.wrongstack` — anchors global discovery + the default trust store. */
+    globalRoot?: string | undefined;
+    projectRoot: string;
+    /** Plugin names claimed by built-ins — external plugins may not spoof them. */
+    reservedNames: ReadonlySet<string>;
+    /** Override for tests. Defaults to `~/.wrongstack/plugin-trust.json`. */
+    trustStorePath?: string | undefined;
+    /** Override for tests. Defaults to native dynamic import. */
+    importModule?: ((url: string) => Promise<unknown>) | undefined;
+}
+export declare function loadExternalPlugins(ctx: LoadExternalPluginsContext, hooks: ExternalPluginHooks): Promise<Plugin[]>;
+//# sourceMappingURL=external-plugins.d.ts.map

package/dist/wiring/plugins.d.ts

@@ -103,6 +103,14 @@ export interface PluginsWiringDeps {
         projectDir?: string;
         /** Per-project goal.json path. Useful as a sibling anchor. */
         projectGoal?: string;
+        /**
+         * The actual code project root (the directory containing
+         * `<projectRoot>/.wrongstack/`). Anchors relative `path` entries in
+         * `config.plugins` and the project-local plugin discovery root.
+         * Optional — minimal hosts may omit it, in which case only
+         * config-specifier user plugins load.
+         */
+        projectRoot?: string;
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.308.6",
+  "version": "0.308.7",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -42,32 +42,32 @@
   ],
   "dependencies": {
     "ws": "^8.21.3",
-    "@wrongstack/bench": "0.308.6",
-    "@wrongstack/acp": "0.308.6",
-    "@wrongstack/core": "0.308.6",
-    "@wrongstack/plug-lsp": "0.308.6",
-    "@wrongstack/mcp": "0.308.6",
-    "@wrongstack/kanban": "0.308.6",
-    "@wrongstack/providers": "0.308.6",
-    "@wrongstack/persistence": "0.308.6",
-    "@wrongstack/sage": "0.308.6",
-    "@wrongstack/plugins": "0.308.6",
-    "@wrongstack/requirement-intake": "0.308.6",
-    "@wrongstack/runtime": "0.308.6",
-    "@wrongstack/techstack": "0.308.6",
-    "@wrongstack/sdd": "0.308.6",
-    "@wrongstack/simpleui": "0.308.6",
-    "@wrongstack/telegram": "0.308.6",
-    "@wrongstack/tui": "0.308.6",
-    "@wrongstack/tools": "0.308.6",
-    "@wrongstack/vector-memory": "0.308.6",
-    "@wrongstack/security-scanner": "0.308.6",
-    "@wrongstack/webui": "0.308.6",
-    "@wrongstack/webui-hq": "0.308.6",
-    "@wrongstack/webui-server": "0.308.6"
+    "@wrongstack/kanban": "0.308.7",
+    "@wrongstack/mcp": "0.308.7",
+    "@wrongstack/acp": "0.308.7",
+    "@wrongstack/bench": "0.308.7",
+    "@wrongstack/core": "0.308.7",
+    "@wrongstack/plug-lsp": "0.308.7",
+    "@wrongstack/sage": "0.308.7",
+    "@wrongstack/providers": "0.308.7",
+    "@wrongstack/persistence": "0.308.7",
+    "@wrongstack/runtime": "0.308.7",
+    "@wrongstack/plugins": "0.308.7",
+    "@wrongstack/requirement-intake": "0.308.7",
+    "@wrongstack/security-scanner": "0.308.7",
+    "@wrongstack/sdd": "0.308.7",
+    "@wrongstack/tools": "0.308.7",
+    "@wrongstack/techstack": "0.308.7",
+    "@wrongstack/simpleui": "0.308.7",
+    "@wrongstack/vector-memory": "0.308.7",
+    "@wrongstack/telegram": "0.308.7",
+    "@wrongstack/tui": "0.308.7",
+    "@wrongstack/webui-hq": "0.308.7",
+    "@wrongstack/webui": "0.308.7",
+    "@wrongstack/webui-server": "0.308.7"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.308.6"
+    "@wrongstack/desktop": "0.308.7"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",