@wrongstack/cli 0.308.6 → 0.309.0

package/dist/{chunk-KV6DNQT6.js → chunk-BZJ4MP32.js}

@@ -1,6 +1,7 @@
 import {
-  PLUGIN_AUDIT_ENTRIES
-} from "./chunk-RK7E3IXT.js";
+  PLUGIN_AUDIT_ENTRIES,
+  loadExternalPlugins
+} from "./chunk-H6C7SO5H.js";
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
@@ -144,34 +145,23 @@ async function setupPlugins(params) {
       }
     }
   }
-  const userPlugins = [];
-  if (config.features?.plugins !== false) {
-    for (const p of config.plugins ?? []) {
-      const spec = typeof p === "string" ? p : p.name;
-      const { enabled } = resolvePluginEnablement({
-        name: pluginNameFromSpec(spec) ?? spec,
-        aliases: [spec],
-        defaultState: "active",
-        config,
-        // The resolver already extracts an entry's name before calling this.
-        matches: (configuredName) => configuredName === spec
-      });
-      if (!enabled) continue;
-      const bareName = pluginNameFromSpec(spec);
-      if (bareName && warnIfDeprecatedPluginName(bareName, log)) {
-        continue;
-      }
-      if (builtinPluginNameFromSpec(spec)) {
-        continue;
-      }
-      try {
-        const mod = await import(spec);
-        if (mod.default) userPlugins.push(mod.default);
-      } catch (err) {
-        log.warn(`Plugin "${spec}" failed to load`, err);
-      }
+  const userPlugins = config.features?.plugins === false ? [] : await loadExternalPlugins(
+    {
+      config,
+      log,
+      globalRoot: paths?.globalRoot,
+      projectRoot: paths?.projectRoot ?? process.cwd(),
+      reservedNames: /* @__PURE__ */ new Set([
+        ...BUILTIN_PLUGIN_CONFIG_NAMES,
+        ...builtinPlugins.map((p) => p.name)
+      ])
+    },
+    {
+      nameFromSpec: pluginNameFromSpec,
+      isBuiltinSpec: (spec) => builtinPluginNameFromSpec(spec) !== null,
+      warnIfDeprecated: (name) => name !== "" && warnIfDeprecatedPluginName(name, log)
     }
-  }
+  );
   const allPlugins = [...builtinPlugins, ...userPlugins];
   if (allPlugins.length === 0) return;
   const pluginOptions = buildPluginOptions(config, allPlugins);
@@ -203,6 +193,10 @@ async function setupPlugins(params) {
   const pluginHost = await loadPlugins(allPlugins, {
     log,
     pluginOptions,
+    // First-party plugins keep the historical warn-only capability checks;
+    // external (third-party) plugins are held to their declared
+    // capabilities strictly — an undeclared API call rejects the plugin.
+    enforceCapabilities: (plugin) => !builtinPlugins.includes(plugin),
     apiFactory: (plugin) => createApi(plugin.name, {
       // First-party plugins come from BUILTIN_PLUGIN_FACTORIES — trust them
       // ("official") so they can claim bare slash command names (/prompts,
@@ -262,4 +256,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-KV6DNQT6.js.map
+//# sourceMappingURL=chunk-BZJ4MP32.js.map

package/dist/{chunk-RK7E3IXT.js → chunk-H6C7SO5H.js}

@@ -1,11 +1,251 @@
 
+// src/wiring/external-plugins.ts
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { isAbsolute, join, resolve } from "node:path";
+import {
+  defaultPluginTrustPath,
+  discoverExternalPlugins,
+  hashFileContents,
+  normalizeTrustKey,
+  pinPluginTrust,
+  readPluginTrustStore,
+  resolvePluginEnablement,
+  resolvePluginTarget,
+  verifyPluginTrust
+} from "@wrongstack/core/plugin";
+function normalizeConfigPath(raw, projectRoot) {
+  if (raw.startsWith("file:")) return fileURLToPath(raw);
+  return isAbsolute(raw) ? raw : resolve(projectRoot, raw);
+}
+function resolveSpecifierEntry(spec) {
+  const metaResolve = import.meta.resolve;
+  if (typeof metaResolve !== "function") return void 0;
+  try {
+    const url = metaResolve(spec);
+    return url.startsWith("file:") ? fileURLToPath(url) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validateExternalPluginModule(mod) {
+  const candidate = mod?.default;
+  if (candidate === null || typeof candidate !== "object") {
+    return {
+      error: `default export missing (got ${candidate === null ? "null" : typeof candidate}) \u2014 external plugin modules must default-export a Plugin object`
+    };
+  }
+  const p = candidate;
+  if (typeof p.name !== "string" || p.name.length === 0) {
+    return { error: "plugin.name must be a non-empty string" };
+  }
+  if (typeof p.apiVersion !== "string" || p.apiVersion.length === 0) {
+    return { error: 'plugin.apiVersion must be a non-empty string (e.g. "^0.1")' };
+  }
+  if (typeof p.setup !== "function") {
+    return { error: "plugin.setup(api) must be a function" };
+  }
+  return { plugin: candidate };
+}
+async function loadExternalPlugins(ctx, hooks) {
+  const { config, log } = ctx;
+  if (config.features?.plugins === false) return [];
+  const importModule = ctx.importModule ?? ((url) => import(url));
+  const trustEnabled = config.features?.pluginsTrust !== false && (ctx.globalRoot !== void 0 || ctx.trustStorePath !== void 0);
+  const trustStorePath = ctx.trustStorePath ?? (ctx.globalRoot !== void 0 ? defaultPluginTrustPath(ctx.globalRoot) : void 0);
+  let trustStore;
+  if (trustEnabled && trustStorePath !== void 0) {
+    try {
+      trustStore = await readPluginTrustStore(trustStorePath);
+    } catch (err) {
+      log.error(`[plugins] ${err instanceof Error ? err.message : String(err)}`);
+      return [];
+    }
+  }
+  const sources = [];
+  const configNames = /* @__PURE__ */ new Set();
+  for (const p of config.plugins ?? []) {
+    const spec = typeof p === "string" ? p : p.name;
+    const configuredPath = typeof p === "string" || p.path === void 0 ? void 0 : p.path;
+    const { enabled } = resolvePluginEnablement({
+      name: hooks.nameFromSpec(spec) ?? (typeof p === "string" ? spec : p.name),
+      aliases: [spec],
+      defaultState: "active",
+      config,
+      matches: (configuredName) => configuredName === spec
+    });
+    if (!enabled) continue;
+    if (hooks.warnIfDeprecated(hooks.nameFromSpec(spec) ?? "")) continue;
+    if (hooks.isBuiltinSpec(spec)) continue;
+    if (configuredPath !== void 0) {
+      const target = normalizeConfigPath(configuredPath, ctx.projectRoot);
+      const entryPath = await resolvePluginTarget(target);
+      if (entryPath === null) {
+        log.warn(
+          `[plugins] config entry "${spec}" path "${configuredPath}" has no resolvable entry (not a file, and no package.json/index fallbacks)`
+        );
+        continue;
+      }
+      sources.push({ kind: "path", spec, entryPath, label: spec });
+      if (typeof p !== "string") configNames.add(p.name);
+    } else {
+      sources.push({ kind: "spec", spec, label: spec });
+      const bare = hooks.nameFromSpec(spec);
+      if (bare) configNames.add(bare);
+    }
+  }
+  const roots = [
+    ctx.globalRoot !== void 0 ? { dir: join(ctx.globalRoot, "plugins"), defaultState: "active" } : void 0,
+    {
+      dir: join(ctx.projectRoot, ".wrongstack", "plugins"),
+      // Project-local plugins are opt-in: a cloned repository must not
+      // auto-execute plugin code the user never enabled.
+      defaultState: "inactive"
+    }
+  ].filter((r) => r !== void 0);
+  const discovery = await discoverExternalPlugins(roots.map((r) => r.dir));
+  for (const skipped of discovery.skipped) {
+    log.warn(
+      `[plugins] discovered candidate "${skipped.name}" in ${skipped.root} skipped \u2014 ${skipped.reason}`
+    );
+  }
+  for (const candidate of discovery.candidates) {
+    const root = roots.find((r) => r.dir === candidate.root);
+    const defaultState = root?.defaultState ?? "inactive";
+    const { enabled, source: enablementSource } = resolvePluginEnablement({
+      name: candidate.name,
+      aliases: [candidate.name],
+      defaultState,
+      config,
+      matches: (configuredName) => configuredName === candidate.name
+    });
+    if (!enabled) {
+      if (enablementSource !== "default") {
+        log.info(
+          `[plugins] discovered plugin "${candidate.name}" disabled by ${enablementSource}`
+        );
+      }
+      continue;
+    }
+    if (configNames.has(candidate.name)) {
+      log.info(
+        `[plugins] discovered plugin "${candidate.name}" also configured in config.plugins \u2014 config entry wins`
+      );
+      continue;
+    }
+    sources.push({
+      kind: "discovery",
+      spec: candidate.entryPath,
+      entryPath: candidate.entryPath,
+      label: candidate.name
+    });
+  }
+  const loaded = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const source of sources) {
+    const entryPath = source.kind === "spec" ? resolveSpecifierEntry(source.spec) : source.entryPath;
+    if (trustEnabled && trustStorePath !== void 0 && entryPath !== void 0) {
+      const gate = await gateExternalPluginTrust({
+        entryPath,
+        spec: source.spec,
+        label: source.label,
+        store: trustStore,
+        storePath: trustStorePath,
+        log
+      });
+      if (!gate.ok) continue;
+      if (gate.pinned) trustStore = gate.store;
+    } else if (trustEnabled && trustStorePath !== void 0 && entryPath === void 0) {
+      log.warn(
+        `[plugins] trust check skipped for "${source.label}" \u2014 entry file could not be resolved pre-import`
+      );
+    }
+    const importTarget = source.kind === "spec" ? source.spec : pathToFileURL(source.entryPath).href;
+    let mod;
+    try {
+      mod = await importModule(importTarget);
+    } catch (err) {
+      log.warn(`[plugins] external plugin "${source.label}" failed to load`, err);
+      continue;
+    }
+    const validated = validateExternalPluginModule(mod);
+    if ("error" in validated) {
+      log.warn(`[plugins] external plugin "${source.label}" invalid \u2014 ${validated.error}`);
+      continue;
+    }
+    const plugin = validated.plugin;
+    if (ctx.reservedNames.has(plugin.name)) {
+      log.warn(
+        `[plugins] external plugin "${source.label}" declares reserved name "${plugin.name}" \u2014 built-in plugins own that name; rename the plugin`
+      );
+      continue;
+    }
+    if (seenNames.has(plugin.name)) {
+      log.warn(
+        `[plugins] external plugin "${source.label}" duplicates already-loaded plugin "${plugin.name}" \u2014 first one wins`
+      );
+      continue;
+    }
+    seenNames.add(plugin.name);
+    loaded.push(plugin);
+  }
+  return loaded;
+}
+async function gateExternalPluginTrust(args) {
+  const { spec, label, store, storePath, log } = args;
+  const entryPath = normalizeTrustKey(args.entryPath);
+  if (!store) return { ok: true, pinned: false };
+  let integrity;
+  try {
+    integrity = await hashFileContents(entryPath);
+  } catch (err) {
+    log.warn(
+      `[plugins] trust check skipped for "${label}" \u2014 entry could not be read (${err instanceof Error ? err.message : String(err)})`
+    );
+    return { ok: true, pinned: false };
+  }
+  const verification = verifyPluginTrust(entryPath, integrity, store);
+  if (verification.status === "trusted") return { ok: true, pinned: false };
+  if (verification.status === "unpinned") {
+    try {
+      const next = await pinPluginTrust(storePath, entryPath, entryPath, integrity, spec);
+      log.info(
+        `[plugins] external plugin "${label}" trusted on first use (pinned ${integrity.slice(0, 19)}\u2026)`
+      );
+      return { ok: true, pinned: true, store: next };
+    } catch (err) {
+      log.warn(
+        `[plugins] could not persist trust pin for "${label}" (${err instanceof Error ? err.message : String(err)})`
+      );
+      return { ok: true, pinned: false };
+    }
+  }
+  log.error(
+    `[plugins] REFUSING external plugin "${label}" \u2014 its entry file changed since it was first trusted (pinned ${verification.pinnedAt}). If you expected this update, re-pin it: wstack plugin trust ${label}`
+  );
+  return { ok: false, pinned: false };
+}
+
 // src/plugin-management.ts
+import { execFile } from "node:child_process";
 import * as fs from "node:fs/promises";
-import { resolvePluginEnablement } from "@wrongstack/core/plugin";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+import {
+  defaultPluginTrustPath as defaultPluginTrustPath2,
+  discoverExternalPlugins as discoverExternalPlugins2,
+  hashFileContents as hashFileContents2,
+  normalizeTrustKey as normalizeTrustKey2,
+  pinPluginTrust as pinPluginTrust2,
+  readPluginTrustStore as readPluginTrustStore2,
+  resolvePluginEnablement as resolvePluginEnablement2,
+  resolvePluginTarget as resolvePluginTarget2,
+  unpinPluginTrust
+} from "@wrongstack/core/plugin";
 import { atomicWrite } from "@wrongstack/core/utils";
 import {
   PLUGIN_AUDIT_ENTRIES
 } from "@wrongstack/plugins/plugin-audit-catalog";
+import { resolveExecInvocation } from "@wrongstack/plugins/runtime";
 var OFFICIAL_PLUGINS = [
   {
     alias: "telegram",
@@ -50,7 +290,12 @@ async function runPluginManagementCommand(args, deps) {
   if (sub === "add" || sub === "install") {
     const spec = args[1];
     if (!spec) {
-      return errorResult("Usage: wstack plugin add <specifier|official-alias> [--disabled]");
+      return errorResult(
+        "Usage: wstack plugin add <specifier|official-alias> [--disabled] [--install [--pm npm|pnpm|yarn|bun] [--run-scripts]]"
+      );
+    }
+    if (args.includes("--install") && !OFFICIAL_ALIASES.has(resolvePluginSpecifier(spec))) {
+      return installPluginPackage(spec, args, deps);
     }
     return upsertPlugin(
       resolvePluginSpecifier(spec),
@@ -85,6 +330,9 @@ async function runPluginManagementCommand(args, deps) {
     }
     return togglePlugin(resolvePluginToggleSpecifier(spec), deps);
   }
+  if (sub === "trust") {
+    return runPluginTrustCommand(args.slice(1), deps);
+  }
   if (sub === "manager") {
     return runPluginManagerPolicyCommand(args.slice(1), deps);
   }
@@ -93,7 +341,7 @@ async function runPluginManagementCommand(args, deps) {
   }
   return errorResult(
     `Unknown plugin subcommand: ${sub}
-Usage: wstack plugin [list|status|report|menu|official|add|install|remove|enable|disable|toggle|manager|llm]`
+Usage: wstack plugin [list|status|report|menu|official|add|install|remove|enable|disable|toggle|trust|manager|llm]`
   );
 }
 var PLUGIN_MANAGER_POLICY_USAGE = [
@@ -303,7 +551,8 @@ function renderConfiguredPlugins(config) {
     const name = pluginName(p);
     const enabled = typeof p === "object" && p.enabled === false ? "disabled" : "enabled";
     const official = OFFICIAL_PLUGINS.find((entry) => entry.specifier === name);
-    const suffix = official ? ` (${official.alias})` : "";
+    const isExternalPath = typeof p === "object" && p.path !== void 0;
+    const suffix = official ? ` (${official.alias})` : isExternalPath ? " (external)" : "";
     return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;
   }).join("\n");
 }
@@ -332,9 +581,10 @@ function renderPluginAuditReport(config) {
     for (const plugin of extra) {
       const name = pluginName(plugin);
       const state = typeof plugin === "object" && plugin.enabled === false ? "disabled" : "enabled";
-      lines.push(
-        `  ${name.padEnd(24)} ${state.padEnd(8)} config   risk=custom user-configured plugin`
-      );
+      const path = typeof plugin === "object" && plugin.path !== void 0 ? plugin.path : "";
+      const risk = path ? "external" : "custom";
+      const note = path ? `user-configured external plugin (${path})` : "user-configured plugin";
+      lines.push(`  ${name.padEnd(24)} ${state.padEnd(8)} config   risk=${risk.padEnd(6)} ${note}`);
     }
   }
   lines.push(
@@ -353,7 +603,8 @@ async function readConfig(file) {
 function pluginName(p) {
   return typeof p === "string" ? p : p.name;
 }
-function pluginEntry(spec, enabled) {
+function pluginEntry(spec, enabled, path) {
+  if (path !== void 0) return { name: spec, path, enabled };
   return enabled ? spec : { name: spec, enabled: false };
 }
 function pluginMatchesToggleSpec(p, spec) {
@@ -368,7 +619,7 @@ var AUDIT_STATE_SOURCE_LABEL = {
   default: "default"
 };
 function effectiveAuditState(config, entry) {
-  const { enabled, source } = resolvePluginEnablement({
+  const { enabled, source } = resolvePluginEnablement2({
     name: entry.name,
     defaultState: entry.defaultState,
     config,
@@ -392,7 +643,7 @@ function auditEntryFor(spec) {
 function officialPluginState(config, spec) {
   const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);
   if (!match) return "not configured";
-  const { enabled } = resolvePluginEnablement({
+  const { enabled } = resolvePluginEnablement2({
     name: spec,
     config,
     matches: (candidate) => pluginMatchesToggleSpec(candidate, spec)
@@ -409,7 +660,7 @@ async function togglePlugin(spec, deps) {
   const idx = plugins.findIndex((p) => pluginMatchesToggleSpec(p, spec));
   const configured = idx >= 0 ? plugins[idx] : void 0;
   const effectiveConfig = { ...deps.config, ...existing };
-  const { enabled } = resolvePluginEnablement({
+  const { enabled } = resolvePluginEnablement2({
     name: spec,
     defaultState: auditEntry?.defaultState,
     config: effectiveConfig,
@@ -458,7 +709,7 @@ async function upsertPlugin(spec, opts, deps, verb) {
   const existing = await readConfig(deps.configPath);
   const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
   const idx = plugins.findIndex((p) => pluginName(p) === spec);
-  const nextEntry = pluginEntry(spec, opts.enabled);
+  const nextEntry = pluginEntry(spec, opts.enabled, opts.path);
   if (idx >= 0) plugins[idx] = nextEntry;
   else plugins.push(nextEntry);
   const features = {
@@ -498,12 +749,247 @@ async function removePlugin(spec, deps) {
 function errorResult(message) {
   return { code: 1, level: "error", message };
 }
+function globalPluginsRoot(deps) {
+  return join2(deps.globalRoot ?? join2(homedir(), ".wrongstack"), "plugins");
+}
+async function resolveExternalPluginEntry(name, deps) {
+  const projectRoot = process.cwd();
+  for (const p of deps.config.plugins ?? []) {
+    if (typeof p === "object" && p.name === name && p.path !== void 0) {
+      const target = normalizeConfigPath(p.path, projectRoot);
+      const entry = await resolvePluginTarget2(target);
+      if (entry) return entry;
+    }
+  }
+  const { candidates } = await discoverExternalPlugins2([
+    globalPluginsRoot(deps),
+    join2(projectRoot, ".wrongstack", "plugins")
+  ]);
+  const discovered = candidates.find((c) => c.name === name);
+  if (discovered) return discovered.entryPath;
+  for (const p of deps.config.plugins ?? []) {
+    const spec = typeof p === "string" ? p : p.name;
+    if (spec === name) {
+      const resolved = resolveSpecifierEntry(spec);
+      if (resolved) return resolved;
+    }
+  }
+  return void 0;
+}
+var PLUGIN_TRUST_USAGE = [
+  "Usage:",
+  "  wstack plugin trust                       List pinned external plugins.",
+  "  wstack plugin trust <name>                Re-pin an external plugin whose code changed.",
+  "  wstack plugin trust <name> --remove       Drop the pin (plugin re-trusts on next load)."
+].join("\n");
+async function runPluginTrustCommand(args, deps) {
+  const storePath = defaultPluginTrustPath2(join2(deps.globalRoot ?? join2(homedir(), ".wrongstack")));
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const name = positional[0];
+  const remove = args.includes("--remove") || args.includes("--unpin");
+  if (args.includes("--list") || name === void 0 && !remove && args.length === 0) {
+    const store2 = await readPluginTrustStore2(storePath);
+    const entries = Object.entries(store2.pinned);
+    if (entries.length === 0) {
+      return { code: 0, level: "output", message: "No external plugins pinned yet." };
+    }
+    return {
+      code: 0,
+      level: "output",
+      message: [
+        `Pinned external plugins (${entries.length}):`,
+        ...entries.map(
+          ([entry2, pin]) => `  ${entry2}
+      pinned ${pin.pinnedAt}${pin.spec ? ` from ${pin.spec}` : ""}`
+        )
+      ].join("\n")
+    };
+  }
+  if (!name) return errorResult(PLUGIN_TRUST_USAGE);
+  const store = await readPluginTrustStore2(storePath);
+  let entry;
+  if (store.pinned[name] !== void 0) {
+    entry = name;
+  } else if (store.pinned[normalizeTrustKey2(name)] !== void 0) {
+    entry = normalizeTrustKey2(name);
+  } else {
+    entry = await resolveExternalPluginEntry(name, deps);
+  }
+  if (remove) {
+    if (!entry) return errorResult(`No trust pin found for "${name}".`);
+    await unpinPluginTrust(storePath, normalizeTrustKey2(entry));
+    return { code: 0, level: "info", message: `Removed trust pin for "${entry}".` };
+  }
+  if (!entry) {
+    return errorResult(
+      `Could not resolve an external plugin named "${name}" \u2014 check config.plugins entries and the plugins directories.`
+    );
+  }
+  const canonical = normalizeTrustKey2(entry);
+  let integrity;
+  try {
+    integrity = await hashFileContents2(canonical);
+  } catch (err) {
+    return errorResult(
+      `Could not read "${canonical}" (${err instanceof Error ? err.message : String(err)}).`
+    );
+  }
+  await pinPluginTrust2(storePath, canonical, canonical, integrity, name);
+  return {
+    code: 0,
+    level: "info",
+    message: `Re-pinned "${name}" \u2192 ${integrity.slice(0, 19)}\u2026 (${canonical}).`
+  };
+}
+function detectPackageManager(args) {
+  const override = args.find((a) => a.startsWith("--pm="));
+  if (override) {
+    const pm = override.slice(5);
+    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
+  }
+  const idx = args.indexOf("--pm");
+  if (idx >= 0 && args[idx + 1]) {
+    const pm = args[idx + 1];
+    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
+  }
+  const ua = process.env.npm_config_user_agent ?? "";
+  if (ua.startsWith("pnpm")) return "pnpm";
+  if (ua.startsWith("yarn")) return "yarn";
+  if (ua.startsWith("bun")) return "bun";
+  return "npm";
+}
+function packageNameFromSpec(spec) {
+  const stripped = spec.trim();
+  if (stripped.startsWith("@")) {
+    const scopedEnd = stripped.indexOf("/", 1);
+    if (scopedEnd === -1) return stripped.split("@")[0] ?? stripped;
+    const rest = stripped.slice(scopedEnd + 1);
+    const at2 = rest.lastIndexOf("@");
+    return at2 === -1 ? stripped : stripped.slice(0, scopedEnd + 1 + at2);
+  }
+  const at = stripped.indexOf("@");
+  return at === -1 ? stripped : stripped.slice(0, at);
+}
+function buildInstallArgs(pm, targetDir, runScripts, spec) {
+  const ignoreScripts = runScripts ? [] : ["--ignore-scripts"];
+  switch (pm) {
+    case "pnpm":
+      return ["add", "--dir", targetDir, ...ignoreScripts, spec];
+    case "yarn":
+      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
+    case "bun":
+      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
+    default:
+      return [
+        "install",
+        "--prefix",
+        targetDir,
+        "--no-audit",
+        "--no-fund",
+        ...ignoreScripts,
+        spec
+      ];
+  }
+}
+function runPackageManagerInstall(pm, args, cwd) {
+  return new Promise((resolvePromise) => {
+    let invocation;
+    try {
+      invocation = resolveExecInvocation(pm, args);
+    } catch (err) {
+      resolvePromise({
+        code: 127,
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err)
+      });
+      return;
+    }
+    execFile(
+      invocation.cmd,
+      invocation.args,
+      {
+        cwd,
+        timeout: 3e5,
+        maxBuffer: 16 * 1024 * 1024,
+        windowsHide: true,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      },
+      (err, stdout, stderr) => {
+        const code = err ? err.code ?? 1 : 0;
+        resolvePromise({
+          code: typeof code === "number" ? code : 1,
+          stdout: typeof stdout === "string" ? stdout : "",
+          stderr: typeof stderr === "string" ? stderr : ""
+        });
+      }
+    );
+  });
+}
+async function installPluginPackage(spec, args, deps) {
+  const pm = detectPackageManager(args);
+  const runScripts = args.includes("--run-scripts");
+  const targetDir = globalPluginsRoot(deps);
+  try {
+    await fs.mkdir(targetDir, { recursive: true });
+    const pkgJsonPath = join2(targetDir, "package.json");
+    try {
+      await fs.access(pkgJsonPath);
+    } catch {
+      await fs.writeFile(
+        pkgJsonPath,
+        `${JSON.stringify({ name: "wrongstack-user-plugins", private: true, version: "0.0.0" }, null, 2)}
+`,
+        "utf8"
+      );
+    }
+  } catch (err) {
+    return errorResult(
+      `Could not prepare plugin directory ${targetDir}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const run = deps.runPackageManager ?? runPackageManagerInstall;
+  const pmArgs = buildInstallArgs(pm, targetDir, runScripts, spec);
+  let result;
+  try {
+    result = await run(pm, pmArgs, targetDir);
+  } catch (err) {
+    return errorResult(
+      `${pm} failed to start: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (result.code !== 0) {
+    const tail = (result.stderr || result.stdout).trim().split("\n").slice(-8).join("\n");
+    return errorResult(`${pm} ${pmArgs.join(" ")} failed (exit ${result.code}):
+${tail}`);
+  }
+  const pkgName = packageNameFromSpec(spec);
+  const installPath = join2(targetDir, "node_modules", ...pkgName.split("/"));
+  try {
+    await fs.access(installPath);
+  } catch {
+    return errorResult(
+      `${pm} reported success but "${installPath}" does not exist \u2014 check the package name "${pkgName}".`
+    );
+  }
+  const upsert = await upsertPlugin(
+    pkgName,
+    { enabled: !args.includes("--disabled"), path: installPath },
+    deps,
+    "Installed"
+  );
+  if (upsert.code !== 0) return upsert;
+  return {
+    ...upsert,
+    message: `${upsert.message} Loaded from ${installPath}. It will be trusted (pinned) on first load.` + (runScripts ? "" : " Install scripts were skipped (default --ignore-scripts; pass --run-scripts if the package needs build steps).")
+  };
+}
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
 export {
+  loadExternalPlugins,
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-RK7E3IXT.js.map
+//# sourceMappingURL=chunk-H6C7SO5H.js.map