@x-code-cli/core 0.2.9 → 0.3.0

package/dist/plugins/paths.js

@@ -0,0 +1,89 @@
+// @x-code-cli/core — Plugin filesystem layout
+//
+// Centralised path helpers for the plugin subsystem. Every other plugin
+// module asks here rather than re-deriving paths so that the
+// `XC_PLUGINS_DIR` test override has a single chokepoint.
+//
+// Layout (under ~/.x-code/plugins/ by default):
+//
+//   known_marketplaces.json          — subscribed marketplaces registry
+//   marketplaces/<name>/marketplace.json
+//                                    — cached marketplace index
+//   cache/<marketplace>/<plugin>/<version>/
+//                                    — actual installed plugin contents
+//   data/<plugin-id>/                — plugin's persistent data dir
+//                                      (survives upgrades; plugin-id is
+//                                      "name@marketplace" with path
+//                                      separators sanitised)
+//   installed_plugins.json           — bookkeeping of installed plugins
+import path from 'node:path';
+import { XCODE_DIR, userXcodeDir } from '../utils.js';
+const PLUGINS_DIR_NAME = 'plugins';
+/** Root of the plugin subsystem. Two override knobs, checked in order:
+ *  - `XC_PLUGINS_DIR` — plugin-specific override (parallels
+ *    `XC_AGENTS_DIR` / `XC_SKILLS_DIR`; preferred when tests want to
+ *    isolate JUST plugins without redirecting MCP / config / OAuth).
+ *  - `X_CODE_HOME` — broad override of the whole `~/.x-code/` root
+ *    (resolved via {@link userXcodeDir}). Reroutes plugins along with
+ *    config, MCP state, etc. */
+export function pluginsRoot() {
+    const override = process.env.XC_PLUGINS_DIR;
+    if (override)
+        return override;
+    return path.join(userXcodeDir(), PLUGINS_DIR_NAME);
+}
+/** ~/.x-code/plugins/known_marketplaces.json */
+export function knownMarketplacesPath() {
+    return path.join(pluginsRoot(), 'known_marketplaces.json');
+}
+/** ~/.x-code/plugins/marketplaces/<name>/ */
+export function marketplaceDir(name) {
+    return path.join(pluginsRoot(), 'marketplaces', name);
+}
+/** ~/.x-code/plugins/marketplaces/<name>/marketplace.json */
+export function marketplaceIndexPath(name) {
+    return path.join(marketplaceDir(name), 'marketplace.json');
+}
+/** ~/.x-code/plugins/cache/<marketplace>/<plugin>/ — all versions live
+ *  under this directory; the active version is whichever the installer
+ *  recorded most recently in installed_plugins.json. */
+export function pluginCacheParent(marketplace, plugin) {
+    return path.join(pluginsRoot(), 'cache', marketplace, plugin);
+}
+/** ~/.x-code/plugins/cache/<marketplace>/<plugin>/<version>/ */
+export function pluginCacheDir(marketplace, plugin, version) {
+    return path.join(pluginCacheParent(marketplace, plugin), version);
+}
+/** ~/.x-code/plugins/data/<sanitised-plugin-id>/ — persistent per-plugin
+ *  data dir that survives upgrades. Plugin IDs ("name@marketplace") are
+ *  sanitised so the `@` and any accidental path separators don't break
+ *  on Windows. */
+export function pluginDataDir(pluginId) {
+    const safe = pluginId.replace(/[/\\:]/g, '_');
+    return path.join(pluginsRoot(), 'data', safe);
+}
+/** ~/.x-code/plugins/installed_plugins.json */
+export function installedPluginsPath() {
+    return path.join(pluginsRoot(), 'installed_plugins.json');
+}
+/** <cwd>/.x-code/plugins/ — rare; used when a project ships its own
+ *  plugins committed to the repo (vs. installing from a marketplace).
+ *  The loader scans this in addition to the user-scope cache. */
+export function projectPluginsDir(cwd) {
+    return path.join(cwd, XCODE_DIR, 'plugins');
+}
+// ── Manifest discovery within a plugin root ─────────────────────────────
+/** Relative manifest paths the loader probes, in priority order. The first
+ *  one found wins. We deliberately accept Claude Code's path so plugins
+ *  authored for Claude Code install in x-code-cli without modification —
+ *  see [[plugin-marketplace-design]] §3 (cross-product compatibility). */
+export const MANIFEST_CANDIDATES = [
+    { format: 'native', rel: '.x-code-plugin/plugin.json' },
+    { format: 'claude', rel: '.claude-plugin/plugin.json' },
+    { format: 'bare', rel: 'plugin.json' },
+];
+/** Gemini's manifest filename. Probed only to produce a helpful error
+ *  message when a user tries to install a Gemini-only extension —
+ *  installer rejects with a pointer to the design doc. */
+export const GEMINI_MANIFEST_REL = 'gemini-extension.json';
+//# sourceMappingURL=paths.js.map

package/dist/plugins/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/plugins/paths.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,6DAA6D;AAC7D,0DAA0D;AAC1D,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,yCAAyC;AACzC,gEAAgE;AAChE,4CAA4C;AAC5C,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,oEAAoE;AACpE,6DAA6D;AAC7D,wEAAwE;AACxE,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAElC;;;;;;gCAMgC;AAChC,MAAM,UAAU,WAAW;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAA;AACpD,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,yBAAyB,CAAC,CAAA;AAC5D,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAA;AACvD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,MAAc;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AAC/D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,MAAc,EAAE,OAAe;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;AACnE,CAAC;AAED;;;kBAGkB;AAClB,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,wBAAwB,CAAC,CAAA;AAC3D,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAE3E;;;0EAG0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAyE;IACvG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE;CACvC,CAAA;AAED;;0DAE0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}

package/dist/plugins/refresh.d.ts

@@ -0,0 +1,61 @@
+import type { SubAgentRegistry, SubAgentReloadSummary } from '../agent/sub-agents/registry.js';
+import type { CommandRegistry, CommandReloadSummary } from '../commands/registry.js';
+import type { HookBus } from '../hooks/bus.js';
+import { type LoadOptions } from '../mcp/loader.js';
+import type { McpRegistry, RestartSummary } from '../mcp/registry.js';
+import type { SkillRegistry, SkillReloadSummary } from '../skills/registry.js';
+import type { PluginRegistry, PluginReloadSummary } from './registry.js';
+export interface PluginRefreshSummary {
+    /** Plugin-level diff — what plugins appeared / disappeared / changed.
+     *  This is the headline the /plugin refresh message renders. */
+    plugins: PluginReloadSummary;
+    /** Per-sub-registry diffs — useful for /plugin doctor-style detail.
+     *  Each is optional because a caller may not have wired every registry
+     *  (e.g. tests skip them). */
+    skills?: SkillReloadSummary;
+    subAgents?: SubAgentReloadSummary;
+    commands?: CommandReloadSummary;
+    /** Number of hook entries registered after refresh — surfaced for
+     *  user feedback. We don't compute a per-event diff because hooks
+     *  don't have a stable identity (no name field); the count alone is
+     *  enough to confirm "hooks reloaded". */
+    hookCount: number;
+    /** MCP restart summary when an mcpRegistry was wired. `undefined` when
+     *  the caller didn't pass one (tests / `--no-plugins` reload paths). */
+    mcp?: RestartSummary;
+    /** Trust-gate decisions for project MCP servers, if any were skipped
+     *  during the merged-config load. Surfaced so the UI can warn the user. */
+    mcpProjectSkipped?: boolean;
+    /** Per-server MCP config parse errors during the merged-config load.
+     *  These don't abort the refresh; they're shown alongside the summary
+     *  so the user knows which server entry was ignored. */
+    mcpConfigErrors?: Array<{
+        name: string;
+        message: string;
+    }>;
+}
+export interface PluginRefreshTargets {
+    pluginRegistry: PluginRegistry;
+    /** Sub-registries that should fold in the new plugin contributions.
+     *  Pass whichever ones the caller has wired. */
+    skillRegistry?: SkillRegistry;
+    subAgentRegistry?: SubAgentRegistry;
+    commandRegistry?: CommandRegistry;
+    hookBus?: HookBus;
+    /** MCP registry to restart with the new merged config (user + plugin +
+     *  project). When set, `askUser` must also be supplied for the
+     *  project-trust gate; when omitted, MCP is left untouched (matches
+     *  the pre-existing behaviour). */
+    mcpRegistry?: McpRegistry;
+    /** Required when `mcpRegistry` is set — used by the trust dialog inside
+     *  loadMergedConfigsFromDisk for new project-level MCP servers. */
+    askUser?: LoadOptions['askUser'];
+    /** cwd defaults to process.cwd(); overridable for tests. */
+    cwd?: string;
+}
+/** Re-scan installed plugins and fold the new state into every wired
+ *  registry. Caller is responsible for invalidating systemPromptCache
+ *  afterwards (we'd need the cache reference here, which sits one layer
+ *  up in the agent options). */
+export declare function refreshPluginContributions(targets: PluginRefreshTargets): Promise<PluginRefreshSummary>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/plugins/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/plugins/refresh.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAE9C,OAAO,EAAE,KAAK,WAAW,EAA6B,MAAM,kBAAkB,CAAA;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAG9E,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExE,MAAM,WAAW,oBAAoB;IACnC;oEACgE;IAChE,OAAO,EAAE,mBAAmB,CAAA;IAC5B;;kCAE8B;IAC9B,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B;;;8CAG0C;IAC1C,SAAS,EAAE,MAAM,CAAA;IACjB;4EACwE;IACxE,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB;+EAC2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;4DAEwD;IACxD,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,cAAc,CAAA;IAC9B;oDACgD;IAChD,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;uCAGmC;IACnC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;uEACmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAA;IAChC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;gCAGgC;AAChC,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqD7G"}

package/dist/plugins/refresh.js

@@ -0,0 +1,98 @@
+// @x-code-cli/core — Plugin hot-reload orchestrator
+//
+// `/plugin refresh` enters here. The job is to re-scan installed plugins
+// from disk and propagate the new state to every downstream registry
+// without restarting xc.
+//
+// Why this is its own module and not a method on PluginRegistry:
+// reloading the plugin registry itself is one line — the work is folding
+// the new contributions into the FIVE sub-registries the rest of the
+// agent loop captured at startup (skill / sub-agent / command / hook /
+// mcp). Each captured reference must stay stable, so each registry
+// exposes a reload-in-place method instead of returning a new instance.
+//
+// MCP servers are restarted here when the caller wires an mcpRegistry +
+// askUser callback (needed by the trust-gate check for project servers).
+// Plugin-contributed MCP servers are merged with user + project servers
+// and the whole set goes through `McpRegistry.restartAll(...)` — the same
+// path `/mcp refresh` uses. Callers that don't wire an mcpRegistry get
+// the pre-existing behaviour (only skill/agent/command/hook reload).
+import { reloadSubAgentRegistry } from '../agent/sub-agents/registry.js';
+import { reloadCommandRegistry } from '../commands/registry.js';
+import { loadMergedConfigsFromDisk } from '../mcp/loader.js';
+import { reloadSkillRegistry } from '../skills/registry.js';
+import { buildPluginIntegration } from './integration.js';
+import { loadAllPlugins } from './loader.js';
+/** Re-scan installed plugins and fold the new state into every wired
+ *  registry. Caller is responsible for invalidating systemPromptCache
+ *  afterwards (we'd need the cache reference here, which sits one layer
+ *  up in the agent options). */
+export async function refreshPluginContributions(targets) {
+    const cwd = targets.cwd ?? process.cwd();
+    // 1. Re-scan plugins from disk. loadAllPlugins builds its own internal
+    //    registry — we pull the plugin list + load errors out of it and
+    //    feed them into the caller's long-lived registry via reload().
+    const load = await loadAllPlugins({ cwd });
+    // 2. Swap into the caller's plugin registry, capture the headline diff.
+    const pluginsSummary = targets.pluginRegistry.reload(load.registry.listAll(), [...load.registry.loadErrors()]);
+    // 3. Recompute downstream integration (skills dirs, agents dirs,
+    //    commands dirs, mcp servers, hook registry) from the new
+    //    plugin set.
+    const integration = await buildPluginIntegration(load);
+    // 4. Fold into each sub-registry the caller wired up.
+    const out = { plugins: pluginsSummary, hookCount: 0 };
+    if (targets.skillRegistry) {
+        out.skills = await reloadSkillRegistry(targets.skillRegistry, { extraDirs: integration.skillsDirs });
+    }
+    if (targets.subAgentRegistry) {
+        out.subAgents = await reloadSubAgentRegistry(targets.subAgentRegistry, { extraDirs: integration.agentsDirs });
+    }
+    if (targets.commandRegistry) {
+        out.commands = await reloadCommandRegistry(targets.commandRegistry, { extraDirs: integration.commandsDirs });
+    }
+    if (targets.hookBus) {
+        targets.hookBus.replaceRegistry(integration.hookRegistry);
+        // Count by summing entry counts across the new registry's events.
+        // Used for the user message — exact diff isn't worth the complexity.
+        out.hookCount = countHooks(integration.hookRegistry);
+    }
+    // 5. MCP restart — only when both mcpRegistry AND askUser are wired.
+    //    Re-reads user + project config files from disk and merges in the
+    //    fresh plugin-contributed extraServers, then tears down + reconnects
+    //    the whole MCP set. Same code path as /mcp refresh. Doing this
+    //    inside /plugin refresh means installing a plugin with an MCP
+    //    server takes effect in one command instead of two.
+    if (targets.mcpRegistry && targets.askUser) {
+        const merged = await loadMergedConfigsFromDisk({
+            cwd,
+            askUser: targets.askUser,
+            extraServers: integration.mcpServers,
+        });
+        out.mcpProjectSkipped = merged.projectSkipped;
+        out.mcpConfigErrors = merged.configErrors;
+        out.mcp = await targets.mcpRegistry.restartAll(merged.configs);
+    }
+    return out;
+}
+function countHooks(registry) {
+    // HookRegistry exposes get(eventName) → array; iterate the known event
+    // names. Names are duplicated from types.ts but importing them here
+    // would create a circular dependency, so we hardcode the small list.
+    const eventNames = [
+        'SessionStart',
+        'UserPromptSubmit',
+        'PreToolUse',
+        'PostToolUse',
+        'PreCompact',
+        'PostCompact',
+        'SubagentStart',
+        'SubagentStop',
+        'TurnComplete',
+        'SessionEnd',
+    ];
+    let n = 0;
+    for (const e of eventNames)
+        n += registry.get(e).length;
+    return n;
+}
+//# sourceMappingURL=refresh.js.map

package/dist/plugins/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/plugins/refresh.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,yBAAyB;AACzB,EAAE;AACF,iEAAiE;AACjE,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,qEAAqE;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAExE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAoB,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAkD5C;;;gCAGgC;AAChC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAA6B;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAExC,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE1C,wEAAwE;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAE9G,iEAAiE;IACjE,6DAA6D;IAC7D,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAEtD,sDAAsD;IACtD,MAAM,GAAG,GAAyB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;IAE3E,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IAC/G,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAA;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;QACzD,kEAAkE;QAClE,qEAAqE;QACrE,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;IACtD,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,yEAAyE;IACzE,mEAAmE;IACnE,kEAAkE;IAClE,wDAAwD;IACxD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,WAAW,CAAC,UAAU;SACrC,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAA;QAC7C,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC,YAAY,CAAA;QACzC,GAAG,CAAC,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,QAAsB;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,UAAU,GAAG;QACjB,cAAc;QACd,kBAAkB;QAClB,YAAY;QACZ,aAAa;QACb,YAAY;QACZ,aAAa;QACb,eAAe;QACf,cAAc;QACd,cAAc;QACd,YAAY;KACJ,CAAA;IACV,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACvD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/plugins/registry.d.ts

@@ -0,0 +1,40 @@
+import type { LoadedPlugin, PluginLoadError } from './types.js';
+/** Summary of what changed between two registry snapshots — used by
+ *  `/plugin refresh` to render an "added / removed / changed" message
+ *  the same way `/mcp refresh` and `/skill refresh` do. */
+export interface PluginReloadSummary {
+    added: string[];
+    removed: string[];
+    changed: string[];
+    unchanged: string[];
+}
+export declare class PluginRegistry {
+    private byId;
+    private errors;
+    constructor(plugins: LoadedPlugin[], errors?: PluginLoadError[]);
+    /** Enabled plugin by id. Disabled plugins are hidden from this lookup —
+     *  use [[getEntry]] when you need to inspect the disabled flag (e.g.
+     *  `/plugin list`). */
+    get(id: string): LoadedPlugin | undefined;
+    /** Plugin by id including disabled ones. */
+    getEntry(id: string): LoadedPlugin | undefined;
+    /** Enabled plugins only — what the agent loop sees. */
+    list(): LoadedPlugin[];
+    /** Every loaded plugin, with the disabled ones. */
+    listAll(): LoadedPlugin[];
+    /** Plugin ids only (enabled). */
+    ids(): string[];
+    /** Non-fatal errors collected during load. Surfaced by `/plugin doctor`. */
+    loadErrors(): readonly PluginLoadError[];
+    /** Replace the in-memory plugin list with a fresh load. Used by
+     *  `/plugin refresh` — keeps the same PluginRegistry object identity
+     *  so every cached reference stays valid. Returns a diff summary so
+     *  the caller can render an "added / removed / changed / unchanged"
+     *  message. */
+    reload(plugins: LoadedPlugin[], errors?: PluginLoadError[]): PluginReloadSummary;
+}
+/** Empty registry — used when plugin loading is disabled (e.g.
+ *  `--no-plugins` startup flag) or no plugins are installed. Cheaper than
+ *  null-checking the registry everywhere downstream. */
+export declare function emptyPluginRegistry(): PluginRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/plugins/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/plugins/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE/D;;2DAE2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,IAAI,CAA2B;IACvC,OAAO,CAAC,MAAM,CAAmB;gBAErB,OAAO,EAAE,YAAY,EAAE,EAAE,MAAM,GAAE,eAAe,EAAO;IAMnE;;2BAEuB;IACvB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAMzC,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAI9C,uDAAuD;IACvD,IAAI,IAAI,YAAY,EAAE;IAItB,mDAAmD;IACnD,OAAO,IAAI,YAAY,EAAE;IAIzB,iCAAiC;IACjC,GAAG,IAAI,MAAM,EAAE;IAIf,4EAA4E;IAC5E,UAAU,IAAI,SAAS,eAAe,EAAE;IAIxC;;;;mBAIe;IACf,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,MAAM,GAAE,eAAe,EAAO,GAAG,mBAAmB;CA6BrF;AAED;;wDAEwD;AACxD,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD"}

package/dist/plugins/registry.js

@@ -0,0 +1,80 @@
+export class PluginRegistry {
+    byId;
+    errors;
+    constructor(plugins, errors = []) {
+        this.byId = new Map();
+        for (const p of plugins)
+            this.byId.set(p.id, p);
+        this.errors = [...errors];
+    }
+    /** Enabled plugin by id. Disabled plugins are hidden from this lookup —
+     *  use [[getEntry]] when you need to inspect the disabled flag (e.g.
+     *  `/plugin list`). */
+    get(id) {
+        const p = this.byId.get(id);
+        if (!p || !p.enabled)
+            return undefined;
+        return p;
+    }
+    /** Plugin by id including disabled ones. */
+    getEntry(id) {
+        return this.byId.get(id);
+    }
+    /** Enabled plugins only — what the agent loop sees. */
+    list() {
+        return [...this.byId.values()].filter((p) => p.enabled);
+    }
+    /** Every loaded plugin, with the disabled ones. */
+    listAll() {
+        return [...this.byId.values()];
+    }
+    /** Plugin ids only (enabled). */
+    ids() {
+        return this.list().map((p) => p.id);
+    }
+    /** Non-fatal errors collected during load. Surfaced by `/plugin doctor`. */
+    loadErrors() {
+        return this.errors;
+    }
+    /** Replace the in-memory plugin list with a fresh load. Used by
+     *  `/plugin refresh` — keeps the same PluginRegistry object identity
+     *  so every cached reference stays valid. Returns a diff summary so
+     *  the caller can render an "added / removed / changed / unchanged"
+     *  message. */
+    reload(plugins, errors = []) {
+        const previous = this.byId;
+        const next = new Map();
+        for (const p of plugins)
+            next.set(p.id, p);
+        const summary = { added: [], removed: [], changed: [], unchanged: [] };
+        for (const [id, plugin] of next) {
+            const prev = previous.get(id);
+            if (!prev) {
+                summary.added.push(id);
+            }
+            else if (prev.manifest.version !== plugin.manifest.version ||
+                prev.rootDir !== plugin.rootDir ||
+                prev.enabled !== plugin.enabled ||
+                prev.scope !== plugin.scope) {
+                summary.changed.push(id);
+            }
+            else {
+                summary.unchanged.push(id);
+            }
+        }
+        for (const id of previous.keys()) {
+            if (!next.has(id))
+                summary.removed.push(id);
+        }
+        this.byId = next;
+        this.errors = [...errors];
+        return summary;
+    }
+}
+/** Empty registry — used when plugin loading is disabled (e.g.
+ *  `--no-plugins` startup flag) or no plugins are installed. Cheaper than
+ *  null-checking the registry everywhere downstream. */
+export function emptyPluginRegistry() {
+    return new PluginRegistry([], []);
+}
+//# sourceMappingURL=registry.js.map

package/dist/plugins/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/plugins/registry.ts"],"names":[],"mappings":"AAyBA,MAAM,OAAO,cAAc;IACjB,IAAI,CAA2B;IAC/B,MAAM,CAAmB;IAEjC,YAAY,OAAuB,EAAE,SAA4B,EAAE;QACjE,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;QACrB,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED;;2BAEuB;IACvB,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QACtC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,4CAA4C;IAC5C,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IAED,uDAAuD;IACvD,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IAED,mDAAmD;IACnD,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,iCAAiC;IACjC,GAAG;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrC,CAAC;IAED,4EAA4E;IAC5E,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;mBAIe;IACf,MAAM,CAAC,OAAuB,EAAE,SAA4B,EAAE;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAE1C,MAAM,OAAO,GAAwB,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAC3F,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxB,CAAC;iBAAM,IACL,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO;gBACjD,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBAC/B,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBAC/B,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAC3B,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QACzB,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED;;wDAEwD;AACxD,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/plugins/types.d.ts

@@ -0,0 +1,225 @@
+/** Where a plugin was installed from — the internal canonical form used
+ *  by the installer and recorded in `installed_plugins.json`. Marketplace
+ *  entries arrive in a different on-disk wire format (string shortcut,
+ *  `git-subdir`, `url`) and are normalised to this shape by
+ *  [[normalizeMarketplaceSource]]. `subdir` is supported on both git and
+ *  github so monorepo-published plugins (common in real Claude Code
+ *  marketplaces like `anthropics/claude-plugins-official`) install
+ *  correctly.
+ *
+ *  `expectedSha` is an optional integrity pin propagated from the
+ *  marketplace.json's `sha` field on git-backed sources. When set, the
+ *  installer clones, runs `git rev-parse HEAD`, and aborts with
+ *  `InstallError` on mismatch. Defends against the upstream ref being
+ *  force-pushed or the repo being compromised between when the
+ *  marketplace author reviewed it and when a user installs. Absent
+ *  field skips the check (so marketplaces that haven't pinned shas
+ *  still install). */
+export type PluginSource = {
+    kind: 'git';
+    url: string;
+    ref?: string;
+    subdir?: string;
+    expectedSha?: string;
+} | {
+    kind: 'github';
+    owner: string;
+    repo: string;
+    ref?: string;
+    subdir?: string;
+    expectedSha?: string;
+} | {
+    kind: 'local';
+    path: string;
+};
+/** Two-scope plugin enablement, mirroring the convention used by mcp and
+ *  skill (see packages/core/src/skills/settings.ts):
+ *
+ *    'user'     →  ~/.x-code/settings.json
+ *    'project'  →  <cwd>/.x-code/settings.local.json  (gitignored)
+ *
+ *  `'project'` reading a `.local.json` file is a slight naming quirk
+ *  inherited from skills — it's a per-user override scoped to one repo,
+ *  not a team-shared file. A separate team-shared scope (committed) can
+ *  be layered on later without changing this union. */
+export type PluginScope = 'user' | 'project';
+export interface PluginAuthor {
+    name?: string;
+    email?: string;
+    url?: string;
+}
+/** A single user-prompted config item (API key, base URL, etc.). When
+ *  `sensitive: true`, the value lives in the system keyring rather than
+ *  settings.json. Schema mirrors Claude Code's so the same plugin works
+ *  in either CLI without authors writing a separate config block. */
+export interface UserConfigItem {
+    key: string;
+    type: 'string' | 'number' | 'boolean';
+    sensitive?: boolean;
+    prompt?: string;
+    required?: boolean;
+    default?: string | number | boolean;
+    description?: string;
+}
+/** Inline hook configuration (the alternative to a hooks file path).
+ *  Loose shape here — full validation lives in
+ *  packages/core/src/hooks/config-schema.ts so that hooks-only changes
+ *  don't reach into the plugin layer. */
+export type InlineHookConfig = Record<string, unknown>;
+/** Inline mcpServers record (the alternative to a path string). Matches
+ *  the shape of `mcpServers` in ~/.x-code/config.json — validated by
+ *  the existing mcp config-schema, not duplicated here. */
+export type InlineMcpServers = Record<string, unknown>;
+/** The plugin manifest as parsed from disk. All paths are STORED RAW —
+ *  resolution against the plugin root happens in [[loader]]. Unknown
+ *  fields in the source JSON are silently stripped (zod default) so that
+ *  newer Claude Code manifests with fields we don't understand still
+ *  load cleanly. */
+export interface PluginManifest {
+    /** Schema version. Defaults to "1" when missing. Bumped by us only on
+     *  breaking changes to the manifest contract; older plugins still load
+     *  as long as their fields validate. */
+    schemaVersion: string;
+    name: string;
+    version: string;
+    description?: string;
+    author?: PluginAuthor;
+    keywords?: string[];
+    homepage?: string;
+    license?: string;
+    /** Path to a directory of skills, each in `<name>/SKILL.md` form (same
+     *  layout as `~/.x-code/skills/`). Or a single file path. */
+    skills?: string;
+    /** Path to a directory of sub-agent `.md` files (same layout as
+     *  `~/.x-code/agents/`). */
+    agents?: string;
+    /** Path to a directory of slash command `.md` files. */
+    commands?: string;
+    /** Either a path to a JSON file with `{ mcpServers: { ... } }` OR an
+     *  inline `mcpServers` record. Inline form matches the shape used in
+     *  ~/.x-code/config.json. */
+    mcpServers?: string | InlineMcpServers;
+    /** Either a path to a hooks.json OR an inline hook config. */
+    hooks?: string | InlineHookConfig;
+    userConfig?: UserConfigItem[];
+    /** Dependencies as `name@marketplace` IDs. Bare `name` resolves against
+     *  the same marketplace as the dependent plugin. */
+    dependencies?: string[];
+    engines?: {
+        'x-code'?: string;
+    };
+}
+/** Which manifest file we loaded. `'gemini'` is never reached — Gemini
+ *  extensions are rejected at install time by design (see plugin-marketplace-design.md
+ *  §3.4) and the value is only used in error reporting to say "this looks
+ *  like a Gemini extension, we don't support those". */
+export type ManifestFormat = 'native' | 'claude' | 'bare' | 'gemini';
+export interface LoadedPlugin {
+    /** Composite id `name@marketplace`. `marketplace` is `"local"` for
+     *  plugins installed from a local path (i.e. authored in-tree). */
+    id: string;
+    manifest: PluginManifest;
+    /** Absolute path to the plugin's root directory. */
+    rootDir: string;
+    /** Absolute path to the manifest file we loaded. */
+    manifestPath: string;
+    manifestFormat: ManifestFormat;
+    /** Where this plugin originally came from. `undefined` only for the
+     *  rare case of a plugin manually dropped into cache without metadata. */
+    source: PluginSource | undefined;
+    /** Marketplace name this plugin belongs to. `"local"` for plugins
+     *  installed from a local path / authored in-tree. */
+    marketplace: string;
+    scope: PluginScope;
+    /** Effective enabled state after merging all three scopes. */
+    enabled: boolean;
+}
+/** A non-fatal load error — collected by the loader and surfaced via
+ *  `/plugin doctor`. One broken plugin must never crash the CLI. */
+export interface PluginLoadError {
+    /** `name@marketplace` if we got far enough to know it. */
+    id?: string;
+    /** Filesystem path that triggered the error, even if no manifest parsed. */
+    path: string;
+    message: string;
+}
+/** One plugin listing within a marketplace. `source` tells the installer
+ *  where to fetch the plugin from. */
+export interface MarketplaceEntry {
+    name: string;
+    description?: string;
+    category?: string;
+    /** Marketplace-curator's claim of vetted-ness. We surface this in the UI
+     *  but never grant additional trust based on it — install consent still
+     *  runs. */
+    verified?: boolean;
+    source: PluginSource;
+    /** Pinned version, if any. Otherwise installer reads version from the
+     *  fetched manifest. */
+    version?: string;
+    homepage?: string;
+    keywords?: string[];
+}
+export interface Marketplace {
+    schemaVersion: string;
+    /** The user-facing canonical identity of this marketplace — the
+     *  subscription alias the user typed (e.g. `anthropic-marketplace`).
+     *  Storage paths, install ids (`<plugin>@<name>`), and lookups all key
+     *  off this. */
+    name: string;
+    /** The marketplace's own self-declared `name` from its `marketplace.json`
+     *  (e.g. `claude-plugins-official`). Kept so `info` can show users what
+     *  the upstream calls itself when it differs from their subscription
+     *  alias. Never used as an identity for lookup. */
+    upstreamName?: string;
+    displayName?: string;
+    description?: string;
+    owner?: {
+        name?: string;
+        url?: string;
+    };
+    plugins: MarketplaceEntry[];
+}
+/** One entry in `~/.x-code/plugins/known_marketplaces.json` — a
+ *  marketplace the user has subscribed to. The `source` string can be a
+ *  git URL (`github:owner/repo`, `https://...`) or a direct HTTPS URL
+ *  to the marketplace.json. */
+export interface KnownMarketplace {
+    name: string;
+    source: string;
+    /** Set on built-in entries (e.g., the default `anthropic-marketplace`).
+     *  Reserved names only accept their canonical source — see
+     *  RESERVED_MARKETPLACE_NAMES in [[marketplace]]. */
+    reservedName?: boolean;
+    /** Expected GitHub org for reserved names. The installer rejects any
+     *  attempt to register a reserved name pointing elsewhere. */
+    officialSource?: string;
+}
+export interface KnownMarketplaces {
+    marketplaces: KnownMarketplace[];
+    /** When true, plugins can only be installed from a marketplace in the
+     *  `marketplaces` list. Off by default; enterprise admins flip it on. */
+    strictKnownMarketplaces?: boolean;
+    /** Plugin IDs (`name@marketplace`) that are force-disabled regardless of
+     *  user settings. Admin-style block list. */
+    blockedPlugins?: string[];
+}
+/** One entry in the installed registry — the bookkeeping we keep about
+ *  each cached install so updates / uninstalls / scope changes work
+ *  without re-reading every manifest. */
+export interface InstalledPluginRecord {
+    id: string;
+    name: string;
+    marketplace: string;
+    version: string;
+    source: PluginSource;
+    installedAt: string;
+    /** Which scope's settings.json triggered the install (where to record
+     *  the enable). User scope is the default. */
+    installScope: PluginScope;
+}
+export interface InstalledPlugins {
+    schemaVersion: string;
+    plugins: InstalledPluginRecord[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/plugins/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;;sBAgBsB;AACtB,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACpG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnC;;;;;;;;;uDASuD;AACvD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,CAAA;AAI5C,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;qEAGqE;AACrE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;yCAGyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEtD;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEtD;;;;oBAIoB;AACpB,MAAM,WAAW,cAAc;IAC7B;;4CAEwC;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAGhB;iEAC6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;gCAC4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;iCAE6B;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAA;IACtC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAGjC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAA;IAG7B;wDACoD;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChC;AAID;;;wDAGwD;AACxD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEpE,MAAM,WAAW,YAAY;IAC3B;uEACmE;IACnE,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,cAAc,CAAA;IACxB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B;8EAC0E;IAC1E,MAAM,EAAE,YAAY,GAAG,SAAS,CAAA;IAChC;0DACsD;IACtD,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,WAAW,CAAA;IAClB,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;oEACoE;AACpE,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAID;sCACsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;gBAEY;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,YAAY,CAAA;IACpB;4BACwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB;;;oBAGgB;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ;;;uDAGmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED;;;+BAG+B;AAC/B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd;;yDAEqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;kEAC8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,gBAAgB,EAAE,CAAA;IAChC;6EACyE;IACzE,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;iDAC6C;IAC7C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAID;;yCAEyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB;kDAC8C;IAC9C,YAAY,EAAE,WAAW,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,qBAAqB,EAAE,CAAA;CACjC"}

package/dist/plugins/types.js

@@ -0,0 +1,16 @@
+// @x-code-cli/core — Plugin system core types
+//
+// A plugin bundles skills / sub-agents / slash commands / MCP servers /
+// hooks behind a single manifest and namespace. Plugins are discovered
+// at CLI startup, frozen for the session (same byte-stability constraint
+// as skills + sub-agents — see CLAUDE.md on systemPromptCache), and
+// re-loaded only via `/plugin refresh` which explicitly invalidates the
+// prompt cache.
+//
+// Manifest format is intentionally byte-compatible with Claude Code's
+// `.claude-plugin/plugin.json` so the same plugin tarball can be installed
+// in either CLI. The native `.x-code-plugin/plugin.json` path is also
+// accepted (preferred for newly-authored x-code-only plugins) and a bare
+// `plugin.json` in the root is tolerated.
+export {};
+//# sourceMappingURL=types.js.map