@yagni-app/code-staging 1.0.6-staging.1257.1 → 1.0.6-staging.1261.1

package/dist/claudeCompat.d.ts

@@ -43,6 +43,13 @@ export declare const CLAUDE_RULES_DIRS_ENV = "YAGNI_CLAUDE_RULES_DIRS";
  * the same approval the repo's `.mcp.json` would.
  */
 export declare const CLAUDE_PLUGIN_MCP_ENV = "YAGNI_CLAUDE_PLUGIN_MCP";
+/**
+ * `name@marketplace` keys of the plugins wired at launch (delimiter-joined).
+ * `/reload-plugins` diffs a fresh inventory against this baseline: pi already
+ * holds the launch-time plugins through argv, so only newer ones need the
+ * extension's `resources_discover` contribution.
+ */
+export declare const CLAUDE_PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
 export interface PluginMcpEnvEntry {
     plugin: string;
     sourcePath: string;
@@ -124,6 +131,38 @@ export interface ClaudeCompatLaunch {
  * compat can only add flags/env, never break a launch.
  */
 export declare function claudeCompatArgs(deps: ClaudeCompatDeps): Promise<ClaudeCompatLaunch>;
+/** One plugin as the in-session `/plugin` panel sees it. */
+export interface InventoryPlugin {
+    key: string;
+    name: string;
+    origin: PluginAssets["origin"];
+    version: string | null;
+    root: string;
+    /** Repo-sourced: its MCP servers ride the project approval gate. */
+    gated: boolean;
+    skillPaths: string[];
+    commandPaths: string[];
+    agentDirs: string[];
+    mcpServers: string[];
+    unsupported: string[];
+}
+export interface PluginInventory {
+    /** Plugins that load for `cwd` right now (trust respected, never prompting). */
+    plugins: InventoryPlugin[];
+    /** The MCP payload those plugins contribute (same shape as YAGNI_CLAUDE_PLUGIN_MCP). */
+    mcp: PluginMcpEnvEntry[];
+    /** Repo-sourced plugins held back because the folder is not trusted yet. */
+    pendingTrust: string[];
+    /** Plugin agent dirs, user first (same order as YAGNI_CLAUDE_AGENT_DIRS). */
+    agentDirs: string[];
+}
+/**
+ * The plugin inventory a launch from `cwd` would wire, computed without
+ * prompting: the user's own plugins always, repo-sourced ones only once the
+ * folder is trusted. Backs `yagni plugin inventory --json`, which the
+ * in-session `/plugin` panel and `/reload-plugins` call.
+ */
+export declare function pluginInventory(deps: Omit<ClaudeCompatDeps, "confirm" | "interactive">): PluginInventory;
 /** Whether pi's trust file exists yet (used only for messaging). */
 export declare function trustFileExists(agentDir: string): boolean;
 //# sourceMappingURL=claudeCompat.d.ts.map

package/dist/claudeCompat.js

@@ -47,6 +47,13 @@ export const CLAUDE_RULES_DIRS_ENV = "YAGNI_CLAUDE_RULES_DIRS";
  * the same approval the repo's `.mcp.json` would.
  */
 export const CLAUDE_PLUGIN_MCP_ENV = "YAGNI_CLAUDE_PLUGIN_MCP";
+/**
+ * `name@marketplace` keys of the plugins wired at launch (delimiter-joined).
+ * `/reload-plugins` diffs a fresh inventory against this baseline: pi already
+ * holds the launch-time plugins through argv, so only newer ones need the
+ * extension's `resources_discover` contribution.
+ */
+export const CLAUDE_PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
 const PLUGIN_ROOT_VAR = "${CLAUDE_PLUGIN_ROOT}";
 function expandPluginRoot(value, root) {
     if (typeof value === "string")
@@ -296,6 +303,10 @@ export async function claudeCompatArgs(deps) {
         ...decision.userMcp,
         ...(trusted === true ? decision.projectMcp : []),
     ];
+    const loadedKeys = [
+        ...plugins.user.map((p) => p.key),
+        ...(trusted === true ? plugins.project.map((p) => p.key) : []),
+    ];
     const extraEnv = {};
     if (agentDirs.length > 0)
         extraEnv[CLAUDE_AGENT_DIRS_ENV] = agentDirs.join(delimiter);
@@ -303,8 +314,52 @@ export async function claudeCompatArgs(deps) {
         extraEnv[CLAUDE_RULES_DIRS_ENV] = rulesDirs.join(delimiter);
     if (mcpEntries.length > 0)
         extraEnv[CLAUDE_PLUGIN_MCP_ENV] = JSON.stringify(mcpEntries);
+    if (loadedKeys.length > 0)
+        extraEnv[CLAUDE_PLUGIN_KEYS_ENV] = loadedKeys.join(delimiter);
     return { argv, env: extraEnv };
 }
+function toInventory(plugin, gated) {
+    return {
+        key: plugin.key,
+        name: plugin.name,
+        origin: plugin.origin,
+        version: plugin.version,
+        root: plugin.root,
+        gated,
+        skillPaths: plugin.skillPaths,
+        commandPaths: plugin.commandPaths,
+        agentDirs: plugin.agentDirs,
+        mcpServers: plugin.mcp ? Object.keys(plugin.mcp.servers) : [],
+        unsupported: plugin.unsupported,
+    };
+}
+/**
+ * The plugin inventory a launch from `cwd` would wire, computed without
+ * prompting: the user's own plugins always, repo-sourced ones only once the
+ * folder is trusted. Backs `yagni plugin inventory --json`, which the
+ * in-session `/plugin` panel and `/reload-plugins` call.
+ */
+export function pluginInventory(deps) {
+    const env = deps.env ?? process.env;
+    if (compatDisabled(env))
+        return { plugins: [], mcp: [], pendingTrust: [], agentDirs: [] };
+    const home = deps.homeDir ?? homedir();
+    const trusted = readTrustDecision(deps.agentDir, deps.cwd);
+    let plugins;
+    try {
+        plugins = discoverClaudePlugins({ cwd: deps.cwd, homeDir: home, yagniLedger: readLedger(pluginsHome(env, home)) });
+    }
+    catch {
+        plugins = { user: [], project: [] };
+    }
+    const project = trusted === true ? plugins.project : [];
+    return {
+        plugins: [...plugins.user.map((p) => toInventory(p, false)), ...project.map((p) => toInventory(p, true))],
+        mcp: [...pluginMcpEntries(plugins.user, false), ...pluginMcpEntries(project, true)],
+        pendingTrust: trusted === true ? [] : plugins.project.map((p) => p.key),
+        agentDirs: [...plugins.user, ...project].flatMap((p) => p.agentDirs),
+    };
+}
 /** Whether pi's trust file exists yet (used only for messaging). */
 export function trustFileExists(agentDir) {
     return existsSync(trustPath(agentDir));

package/dist/cli.js

@@ -547,6 +547,8 @@ export const HELP_TEXT = [
     "  /todos                   Show the agent's live task list.",
     "  /cost                    Session usage and credit headroom.",
     "  /mcp                     Manage MCP servers; authenticate OAuth servers.",
+    "  /plugin                  Browse, install, and remove Claude Code plugins.",
+    "  /reload-plugins          Apply plugin changes without restarting.",
     "",
     "The active environment is sticky; `use` switches it (prod is the default).",
     "Set YAGNI_BASE_URL to override the base URL for a single run.",

package/dist/extension/index.d.ts

@@ -3,6 +3,7 @@ import { type SpendResponse } from "./costHud.js";
 import { runInitPass as defaultRunInitPass } from "./initPass.js";
 import { startMcp as defaultStartMcp } from "./mcp/startup.js";
 import { type GuardianGateEvent } from "./permission/gate.js";
+import { type PluginCliRunner } from "./plugins/panel.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
 import { type CatalogResult, type ContextBrief } from "./config.js";
@@ -59,6 +60,8 @@ export interface RegisterYagniDeps {
      * homes or spawning servers. Default runs the real startup.
      */
     startMcp?: typeof defaultStartMcp;
+    /** Test seam for the /plugin panel: runs `yagni plugin …` (defaults to spawning YAGNI_CLI_PATH). */
+    runPluginCli?: PluginCliRunner;
     /**
      * The CLI init pass (Onramp Door B). Injectable so tests assert it fires on a
      * fresh-workspace first-run and is skipped otherwise, without a network or disk.

package/dist/extension/index.js

@@ -41,6 +41,7 @@ import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
 import { registerTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
+import { registerPluginPanel } from "./plugins/panel.js";
 import { registerSubagents } from "./subagents.js";
 import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
@@ -278,6 +279,9 @@ export async function registerYagni(pi, deps = {}) {
     // before_agent_start handler below) and widens the tool's fan-out ceiling.
     const ultraHolder = createUltraHolder();
     registerSubagents(pi, { isUltra: () => ultraHolder.get(), workingLine, childUsage });
+    // /plugin + /reload-plugins: manage Claude Code marketplace plugins from the
+    // session, driving the launcher's `yagni plugin …` (YAGNI_CLI_PATH).
+    registerPluginPanel(pi, { env: deps.env, runCli: deps.runPluginCli });
     registerUltraCommand(pi, ultraHolder);
     // Shared fetch timeout for the small, interactive display-path reads below
     // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):

package/dist/extension/plugins/inventory.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The session's view of Claude Code plugins, and how a mid-session change
+ * reaches pi without a restart.
+ *
+ * The launcher (yagni-code-cli) owns discovery, trust, and the ledger. This
+ * module only talks to it: `yagni plugin inventory --json` (via
+ * `YAGNI_CLI_PATH`) returns what would load for the cwd right now. Reload is
+ * pi's own `/reload` flow: before calling it we rewrite this process's env so
+ * the re-created extension runtime sees the fresh MCP payload and agent dirs,
+ * and `resources_discover` hands pi the skill/prompt paths of plugins that
+ * were not in the launch argv (see panel.ts). Everything is fail-soft.
+ */
+import { type PluginMcpEnvEntry } from "../mcp/config.js";
+/** Launcher → extension: the yagni CLI entry to run `plugin …` with. */
+export declare const CLI_PATH_ENV = "YAGNI_CLI_PATH";
+/** Launcher → extension: `name@marketplace` keys wired through argv at launch. */
+export declare const PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
+/** Set by /reload-plugins before pi reloads: the fresh inventory (JSON). */
+export declare const INVENTORY_ENV = "YAGNI_CLAUDE_PLUGIN_INVENTORY";
+export interface InventoryPlugin {
+    key: string;
+    name: string;
+    origin: "yagni" | "claude-code" | "repo-marketplace";
+    version: string | null;
+    root: string;
+    gated: boolean;
+    skillPaths: string[];
+    commandPaths: string[];
+    agentDirs: string[];
+    mcpServers: string[];
+    unsupported: string[];
+}
+export interface PluginInventory {
+    plugins: InventoryPlugin[];
+    mcp: PluginMcpEnvEntry[];
+    pendingTrust: string[];
+    agentDirs: string[];
+}
+export interface CliResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type CliRunner = (args: string[], opts: {
+    cliPath: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => Promise<CliResult>;
+export declare const defaultCliRunner: CliRunner;
+export declare function cliPath(env: NodeJS.ProcessEnv): string | null;
+export declare function launchKeys(env: NodeJS.ProcessEnv): Set<string>;
+/** The inventory recorded by the last /reload-plugins in this process, if any. */
+export declare function storedInventory(env: NodeJS.ProcessEnv): PluginInventory | null;
+export declare function parseInventory(value: unknown): PluginInventory;
+export declare function fetchInventory(opts: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    runCli?: CliRunner;
+}): Promise<PluginInventory>;
+/**
+ * The plugins the session knows about right now: launch-time keys plus
+ * anything a previous /reload-plugins in this process brought in.
+ */
+export declare function knownKeys(env: NodeJS.ProcessEnv): Set<string>;
+export interface ReloadPlan {
+    added: InventoryPlugin[];
+    removed: string[];
+    /** Env values to set on this process before pi reloads. */
+    env: Record<string, string | undefined>;
+}
+/**
+ * Diff a fresh inventory against what the session already has, and the env
+ * rewrite that makes the reloaded runtime pick the fresh state up: the MCP
+ * payload and agent dirs are re-read by the extension on startup, and the
+ * inventory itself feeds `resources_discover` for skills/prompts.
+ */
+export declare function planReload(inventory: PluginInventory, env: NodeJS.ProcessEnv): ReloadPlan;
+export declare function applyEnv(target: NodeJS.ProcessEnv, values: Record<string, string | undefined>): void;
+/**
+ * Skill/prompt paths pi does not already hold through the launch argv: the
+ * plugins that arrived via /reload-plugins. Returned from `resources_discover`
+ * on every reason so a `/new` after a reload keeps them too.
+ */
+export declare function discoverPaths(env: NodeJS.ProcessEnv): {
+    skillPaths: string[];
+    promptPaths: string[];
+};
+//# sourceMappingURL=inventory.d.ts.map

package/dist/extension/plugins/inventory.js

@@ -0,0 +1,144 @@
+/**
+ * The session's view of Claude Code plugins, and how a mid-session change
+ * reaches pi without a restart.
+ *
+ * The launcher (yagni-code-cli) owns discovery, trust, and the ledger. This
+ * module only talks to it: `yagni plugin inventory --json` (via
+ * `YAGNI_CLI_PATH`) returns what would load for the cwd right now. Reload is
+ * pi's own `/reload` flow: before calling it we rewrite this process's env so
+ * the re-created extension runtime sees the fresh MCP payload and agent dirs,
+ * and `resources_discover` hands pi the skill/prompt paths of plugins that
+ * were not in the launch argv (see panel.ts). Everything is fail-soft.
+ */
+import { execFile } from "node:child_process";
+import { delimiter } from "node:path";
+import { PLUGIN_MCP_ENV } from "../mcp/config.js";
+import { CLAUDE_AGENT_DIRS_ENV } from "../subagents.js";
+/** Launcher → extension: the yagni CLI entry to run `plugin …` with. */
+export const CLI_PATH_ENV = "YAGNI_CLI_PATH";
+/** Launcher → extension: `name@marketplace` keys wired through argv at launch. */
+export const PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
+/** Set by /reload-plugins before pi reloads: the fresh inventory (JSON). */
+export const INVENTORY_ENV = "YAGNI_CLAUDE_PLUGIN_INVENTORY";
+export const defaultCliRunner = (args, opts) => new Promise((resolve) => {
+    execFile(process.execPath, [opts.cliPath, ...args], { cwd: opts.cwd, env: { ...opts.env, YAGNI_DISABLE_UPDATE_CHECK: "1" }, timeout: 120_000, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+        const code = err && typeof err.code === "number" ? (err.code) : err ? 1 : 0;
+        resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? (err?.message ?? "")) });
+    });
+});
+export function cliPath(env) {
+    const value = env[CLI_PATH_ENV];
+    return value && value.length > 0 ? value : null;
+}
+export function launchKeys(env) {
+    const raw = env[PLUGIN_KEYS_ENV];
+    return new Set(raw ? raw.split(delimiter).filter(Boolean) : []);
+}
+/** The inventory recorded by the last /reload-plugins in this process, if any. */
+export function storedInventory(env) {
+    const raw = env[INVENTORY_ENV];
+    if (!raw)
+        return null;
+    try {
+        return parseInventory(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+export function parseInventory(value) {
+    if (!value || typeof value !== "object")
+        throw new Error("inventory is not an object");
+    const v = value;
+    const plugins = Array.isArray(v.plugins) ? v.plugins.filter((p) => !!p && typeof p === "object" && typeof p.key === "string") : [];
+    return {
+        plugins: plugins.map((p) => ({
+            key: p.key,
+            name: typeof p.name === "string" ? p.name : p.key,
+            origin: p.origin === "yagni" || p.origin === "repo-marketplace" ? p.origin : "claude-code",
+            version: typeof p.version === "string" ? p.version : null,
+            root: typeof p.root === "string" ? p.root : "",
+            gated: p.gated === true,
+            skillPaths: stringList(p.skillPaths),
+            commandPaths: stringList(p.commandPaths),
+            agentDirs: stringList(p.agentDirs),
+            mcpServers: stringList(p.mcpServers),
+            unsupported: stringList(p.unsupported),
+        })),
+        mcp: Array.isArray(v.mcp) ? v.mcp : [],
+        pendingTrust: stringList(v.pendingTrust),
+        agentDirs: stringList(v.agentDirs),
+    };
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((s) => typeof s === "string") : [];
+}
+export async function fetchInventory(opts) {
+    const path = cliPath(opts.env);
+    if (!path)
+        throw new Error("This session was not started by the yagni launcher (YAGNI_CLI_PATH is unset); run `yagni plugin …` in a terminal instead.");
+    const result = await (opts.runCli ?? defaultCliRunner)(["plugin", "inventory", "--json"], { cliPath: path, cwd: opts.cwd, env: opts.env });
+    if (result.code !== 0)
+        throw new Error(result.stderr.trim() || `yagni plugin inventory exited ${result.code}`);
+    return parseInventory(JSON.parse(result.stdout));
+}
+/**
+ * The plugins the session knows about right now: launch-time keys plus
+ * anything a previous /reload-plugins in this process brought in.
+ */
+export function knownKeys(env) {
+    const keys = launchKeys(env);
+    for (const p of storedInventory(env)?.plugins ?? [])
+        keys.add(p.key);
+    return keys;
+}
+/**
+ * Diff a fresh inventory against what the session already has, and the env
+ * rewrite that makes the reloaded runtime pick the fresh state up: the MCP
+ * payload and agent dirs are re-read by the extension on startup, and the
+ * inventory itself feeds `resources_discover` for skills/prompts.
+ */
+export function planReload(inventory, env) {
+    const before = knownKeys(env);
+    const now = new Set(inventory.plugins.map((p) => p.key));
+    const added = inventory.plugins.filter((p) => !before.has(p.key));
+    const removed = [...before].filter((key) => !now.has(key));
+    return {
+        added,
+        removed,
+        env: {
+            [PLUGIN_MCP_ENV]: inventory.mcp.length > 0 ? JSON.stringify(inventory.mcp) : undefined,
+            [CLAUDE_AGENT_DIRS_ENV]: inventory.agentDirs.length > 0 ? inventory.agentDirs.join(delimiter) : undefined,
+            [INVENTORY_ENV]: JSON.stringify(inventory),
+        },
+    };
+}
+export function applyEnv(target, values) {
+    for (const [key, value] of Object.entries(values)) {
+        if (value === undefined)
+            delete target[key];
+        else
+            target[key] = value;
+    }
+}
+/**
+ * Skill/prompt paths pi does not already hold through the launch argv: the
+ * plugins that arrived via /reload-plugins. Returned from `resources_discover`
+ * on every reason so a `/new` after a reload keeps them too.
+ */
+export function discoverPaths(env) {
+    const inventory = storedInventory(env);
+    if (!inventory)
+        return { skillPaths: [], promptPaths: [] };
+    const launched = launchKeys(env);
+    const skillPaths = [];
+    const promptPaths = [];
+    for (const plugin of inventory.plugins) {
+        if (launched.has(plugin.key))
+            continue;
+        skillPaths.push(...plugin.skillPaths);
+        promptPaths.push(...plugin.commandPaths);
+    }
+    return { skillPaths, promptPaths };
+}
+//# sourceMappingURL=inventory.js.map

package/dist/extension/plugins/panel.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `/plugin` and `/reload-plugins` — Claude Code marketplace plugins managed
+ * from inside a session.
+ *
+ * `/plugin` mirrors Claude Code's panel: the installed inventory (origin,
+ * version, what loads, what is not bridged), the marketplace catalog with
+ * one-keystroke install, and per-plugin uninstall/enable/disable. Every
+ * mutation runs the launcher's `yagni plugin …` (the single owner of the
+ * ledger, trust, and discovery) and then reloads.
+ *
+ * `/reload-plugins` is pi's own `/reload` with the plugin state refreshed
+ * first: MCP servers and agents re-read their env on the new runtime, and
+ * skills/commands of plugins that were not in the launch argv reach pi
+ * through `resources_discover`. Removed plugins stop contributing MCP servers
+ * and agents at once; their skills/commands stay until a restart, and the
+ * summary says so.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { type CliRunner, type InventoryPlugin, type PluginInventory, storedInventory } from "./inventory.js";
+export type PluginCliRunner = CliRunner;
+export interface PluginPanelDeps {
+    env?: NodeJS.ProcessEnv;
+    runCli?: CliRunner;
+}
+export declare function describePlugin(p: InventoryPlugin): string;
+export declare function renderInventory(inventory: PluginInventory, env: NodeJS.ProcessEnv): string;
+export declare function renderReloadSummary(added: InventoryPlugin[], removed: string[]): string;
+/** Wire /plugin, /reload-plugins, and the resources_discover contribution. */
+export declare function registerPluginPanel(pi: ExtensionAPI, deps?: PluginPanelDeps): void;
+export interface CatalogMarketplace {
+    name: string;
+    plugins: {
+        name: string;
+        version: string | null;
+        installable: boolean;
+    }[];
+}
+/**
+ * Parse `yagni plugin list --available` text (the CLI's stable, tested
+ * shape: `<marketplace>:` headers, then `  <name>  v<ver>  [flags]` lines).
+ */
+export declare function parseCatalog(text: string): CatalogMarketplace[];
+/** Exported for tests: the current stored inventory, if a reload happened. */
+export { storedInventory };
+//# sourceMappingURL=panel.d.ts.map

package/dist/extension/plugins/panel.js

@@ -0,0 +1,293 @@
+/**
+ * `/plugin` and `/reload-plugins` — Claude Code marketplace plugins managed
+ * from inside a session.
+ *
+ * `/plugin` mirrors Claude Code's panel: the installed inventory (origin,
+ * version, what loads, what is not bridged), the marketplace catalog with
+ * one-keystroke install, and per-plugin uninstall/enable/disable. Every
+ * mutation runs the launcher's `yagni plugin …` (the single owner of the
+ * ledger, trust, and discovery) and then reloads.
+ *
+ * `/reload-plugins` is pi's own `/reload` with the plugin state refreshed
+ * first: MCP servers and agents re-read their env on the new runtime, and
+ * skills/commands of plugins that were not in the launch argv reach pi
+ * through `resources_discover`. Removed plugins stop contributing MCP servers
+ * and agents at once; their skills/commands stay until a restart, and the
+ * summary says so.
+ */
+import { applyEnv, cliPath, defaultCliRunner, discoverPaths, fetchInventory, planReload, storedInventory, } from "./inventory.js";
+const USAGE = [
+    "/plugin                       Browse installed plugins and marketplaces.",
+    "/plugin list                  Show what loads here.",
+    "/plugin install <plugin>[@marketplace] [-s user|project]",
+    "/plugin uninstall <plugin>    (also: enable, disable, update [plugin])",
+    "/plugin marketplace add <owner/repo | git-url | path>   (also: list, update, remove)",
+    "/reload-plugins               Apply plugin changes without restarting.",
+].join("\n");
+const MUTATING = new Set(["install", "add", "uninstall", "remove", "enable", "disable", "update"]);
+export function describePlugin(p) {
+    const parts = [];
+    if (p.skillPaths.length)
+        parts.push(`${p.skillPaths.length} skill dir${p.skillPaths.length === 1 ? "" : "s"}`);
+    if (p.commandPaths.length)
+        parts.push(`${p.commandPaths.length} command dir${p.commandPaths.length === 1 ? "" : "s"}`);
+    if (p.agentDirs.length)
+        parts.push(`${p.agentDirs.length} agent dir${p.agentDirs.length === 1 ? "" : "s"}`);
+    if (p.mcpServers.length)
+        parts.push(`MCP: ${p.mcpServers.join(", ")}`);
+    const origin = p.origin === "yagni" ? "installed via yagni" : p.origin === "claude-code" ? "mirrored from Claude Code" : "from this repo's marketplace";
+    const lines = [`${p.key}${p.version ? `  v${p.version}` : ""}  ${origin}`, `  ${parts.length ? parts.join(" · ") : "nothing loadable"}`];
+    if (p.unsupported.length)
+        lines.push(`  not bridged: ${p.unsupported.join(", ")}`);
+    return lines.join("\n");
+}
+export function renderInventory(inventory, env) {
+    const lines = [];
+    if (inventory.plugins.length === 0) {
+        lines.push("No plugins load here.");
+        lines.push("Add a marketplace with `/plugin marketplace add <owner/repo | git-url | path>`, then `/plugin install <plugin>`.");
+    }
+    else {
+        lines.push(`Plugins (${inventory.plugins.length}):`);
+        for (const p of inventory.plugins)
+            lines.push(describePlugin(p));
+    }
+    if (inventory.pendingTrust.length > 0) {
+        lines.push(`Held back until this folder is trusted: ${inventory.pendingTrust.join(", ")}`);
+    }
+    const stale = staleSince(inventory, env);
+    if (stale.added.length > 0 || stale.removed.length > 0) {
+        lines.push(`Not yet applied to this session: ${[...stale.added.map((k) => `+${k}`), ...stale.removed.map((k) => `-${k}`)].join(", ")} — run /reload-plugins.`);
+    }
+    return lines.join("\n");
+}
+/** Plugins the inventory has that the session does not (and vice versa). */
+function staleSince(inventory, env) {
+    const plan = planReload(inventory, env);
+    return { added: plan.added.map((p) => p.key), removed: plan.removed };
+}
+export function renderReloadSummary(added, removed) {
+    const lines = [];
+    if (added.length === 0 && removed.length === 0) {
+        lines.push("Plugins reloaded — nothing changed since launch.");
+        return lines.join("\n");
+    }
+    if (added.length > 0) {
+        lines.push(`Loaded: ${added.map((p) => p.key).join(", ")}`);
+        const mcp = added.flatMap((p) => p.mcpServers);
+        if (mcp.length > 0)
+            lines.push(`  MCP servers connecting: ${mcp.join(", ")} (see /mcp)`);
+        const commands = added.filter((p) => p.commandPaths.length > 0).map((p) => p.key);
+        if (commands.length > 0)
+            lines.push(`  Commands and skills from ${commands.join(", ")} are available now.`);
+    }
+    if (removed.length > 0) {
+        lines.push(`Removed: ${removed.join(", ")}`);
+        lines.push("  Their MCP servers and agents are gone now; skills and commands stay until you restart (`yagni -c` keeps this conversation).");
+    }
+    return lines.join("\n");
+}
+/** Wire /plugin, /reload-plugins, and the resources_discover contribution. */
+export function registerPluginPanel(pi, deps = {}) {
+    const env = deps.env ?? process.env;
+    const runCli = deps.runCli ?? defaultCliRunner;
+    // Skills/prompts of plugins that arrived via /reload-plugins: pi re-runs
+    // this on every reload and session start, so they persist for the process.
+    pi.on("resources_discover", async () => discoverPaths(env));
+    async function runPlugin(args, cwd, ui) {
+        const path = cliPath(env);
+        if (!path) {
+            ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session). Run `yagni plugin …` in a terminal.", "warning");
+            return false;
+        }
+        const result = await runCli(["plugin", ...args], { cliPath: path, cwd, env });
+        const out = result.stdout.trim();
+        const err = result.stderr.trim();
+        if (result.code === 0) {
+            if (out)
+                ui.notify(out, "info");
+            if (err)
+                ui.notify(err, "warning");
+            return true;
+        }
+        ui.notify(err || out || `yagni plugin ${args.join(" ")} failed (exit ${result.code})`, "error");
+        return false;
+    }
+    async function reload(ctx) {
+        let inventory;
+        try {
+            inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+        }
+        catch (err) {
+            ctx.ui.notify(`Could not read the plugin inventory — ${err instanceof Error ? err.message : String(err)}`, "error");
+            return;
+        }
+        const plan = planReload(inventory, env);
+        applyEnv(env, plan.env);
+        ctx.ui.notify(renderReloadSummary(plan.added, plan.removed), "info");
+        // Treat reload as terminal for this handler (pi docs): the runtime that
+        // registered us is torn down and re-created from the rewritten env.
+        await ctx.reload();
+    }
+    async function listing(ctx) {
+        try {
+            const inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+            return inventory;
+        }
+        catch (err) {
+            ctx.ui.notify(err instanceof Error ? err.message : String(err), "error");
+            return null;
+        }
+    }
+    pi.registerCommand("reload-plugins", {
+        description: "Apply plugin installs/removals to this session without restarting.",
+        handler: async (_args, ctx) => {
+            await reload(ctx);
+        },
+    });
+    pi.registerCommand("plugin", {
+        description: "Manage Claude Code plugins: browse marketplaces, install, uninstall, enable/disable.",
+        handler: async (args, rawCtx) => {
+            const ctx = rawCtx;
+            const sub = args.trim().split(/\s+/).filter(Boolean);
+            const [verb] = sub;
+            if (verb === "help" || verb === "--help" || verb === "-h") {
+                ctx.ui.notify(USAGE, "info");
+                return;
+            }
+            if (verb === "list" || (!verb && !ctx.hasUI)) {
+                const inventory = await listing(ctx);
+                if (inventory)
+                    ctx.ui.notify(renderInventory(inventory, env), "info");
+                return;
+            }
+            if (!verb) {
+                await interactive(ctx);
+                return;
+            }
+            if (verb === "reload") {
+                await reload(ctx);
+                return;
+            }
+            // Everything else is the CLI's grammar verbatim (install, uninstall,
+            // enable, disable, update, marketplace …); mutations reload afterwards.
+            const ok = await runPlugin(sub, ctx.cwd, ctx.ui);
+            const mutates = MUTATING.has(verb) || (verb === "marketplace" && sub[1] !== "list");
+            if (ok && mutates)
+                await reload(ctx);
+        },
+    });
+    async function interactive(ctx) {
+        const inventory = await listing(ctx);
+        if (!inventory)
+            return;
+        const choice = await ctx.ui.select("Plugins", [`Installed plugins (${inventory.plugins.length})`, "Browse marketplaces", "Update all", "Reload plugins", "Exit"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Exit")
+            return;
+        if (choice.startsWith("Installed")) {
+            await installedMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Browse marketplaces") {
+            await browseMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Update all") {
+            if (await runPlugin(["update"], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (choice === "Reload plugins") {
+            await reload(ctx);
+            return;
+        }
+    }
+    async function installedMenu(ctx, inventory) {
+        if (inventory.plugins.length === 0) {
+            ctx.ui.notify(renderInventory(inventory, env), "info");
+            return;
+        }
+        const options = inventory.plugins.map((p) => `${p.key}${p.version ? ` · v${p.version}` : ""}`);
+        const choice = await ctx.ui.select("Installed plugins", [...options, "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const plugin = inventory.plugins[options.indexOf(choice)];
+        if (!plugin)
+            return;
+        const actions = ["View details"];
+        if (plugin.origin === "yagni")
+            actions.push("Uninstall", "Disable");
+        actions.push("Back");
+        const action = await ctx.ui.select(describePlugin(plugin).split("\n")[0], actions, ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!action || action === "Back")
+            return;
+        if (action === "View details") {
+            ctx.ui.notify(describePlugin(plugin), "info");
+            return;
+        }
+        if (action === "Uninstall") {
+            if (await runPlugin(["uninstall", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (action === "Disable") {
+            if (await runPlugin(["disable", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+        }
+    }
+    async function browseMenu(ctx, inventory) {
+        const path = cliPath(env);
+        if (!path) {
+            ctx.ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session).", "warning");
+            return;
+        }
+        const result = await runCli(["plugin", "list", "--available"], { cliPath: path, cwd: ctx.cwd, env });
+        const catalog = parseCatalog(result.stdout);
+        if (catalog.length === 0) {
+            ctx.ui.notify(result.stdout.trim() || "No marketplaces added. Use `/plugin marketplace add <owner/repo | git-url | path>`.", "info");
+            return;
+        }
+        const installed = new Set(inventory.plugins.map((p) => p.key));
+        const entries = catalog.flatMap((mp) => mp.plugins.map((p) => ({ key: `${p.name}@${mp.name}`, label: `${p.name}@${mp.name}${p.version ? ` · v${p.version}` : ""}${installed.has(`${p.name}@${mp.name}`) ? "  (installed)" : ""}${p.installable ? "" : "  (remote source, not installable)"}` })));
+        const choice = await ctx.ui.select("Marketplace plugins", [...entries.map((e) => e.label), "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const entry = entries[entries.map((e) => e.label).indexOf(choice)];
+        if (!entry)
+            return;
+        const scope = await ctx.ui.select(`Install ${entry.key}`, ["For all my projects (user)", "Only this repo (project)", "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!scope || scope === "Back")
+            return;
+        const args = ["install", entry.key, ...(scope.includes("project") ? ["-s", "project"] : [])];
+        if (await runPlugin(args, ctx.cwd, ctx.ui))
+            await reload(ctx);
+    }
+}
+/**
+ * Parse `yagni plugin list --available` text (the CLI's stable, tested
+ * shape: `<marketplace>:` headers, then `  <name>  v<ver>  [flags]` lines).
+ */
+export function parseCatalog(text) {
+    const out = [];
+    let current = null;
+    for (const raw of text.split("\n")) {
+        const header = /^(\S.*):$/.exec(raw);
+        if (header) {
+            current = { name: header[1], plugins: [] };
+            out.push(current);
+            continue;
+        }
+        const entry = /^  (\S+)(?:\s+v(\S+))?(?:\s+\[([^\]]*)\])?\s*$/.exec(raw);
+        if (entry && current) {
+            current.plugins.push({
+                name: entry[1],
+                version: entry[2] ?? null,
+                installable: !(entry[3] ?? "").includes("not installable"),
+            });
+        }
+    }
+    return out;
+}
+/** Exported for tests: the current stored inventory, if a reload happened. */
+export { storedInventory };
+//# sourceMappingURL=panel.js.map

package/dist/launch.js

@@ -9,6 +9,7 @@ import { randomUUID } from "node:crypto";
 import { agentDirEnvVar } from "./branding.js";
 import { otelChildEnv } from "./otel.js";
 import { PAD_X_ENV, resolvePadX } from "./padding.js";
+import { resolveCliPath } from "./paths.js";
 import { ENGINEERING_PRACTICE_SECTION, promptEnrichmentDisabled } from "./promptEnrichment.js";
 /**
  * How close to expiry the token can be before launch warns. A coding session
@@ -76,6 +77,9 @@ export function buildLaunch(creds, passthroughArgs, opts) {
         // the launcher read (0600). Absent when the caller can't resolve it.
         ...(opts.profilePath ? { YAGNI_PROFILE_PATH: opts.profilePath } : {}),
         ...(opts.stateDir ? { YAGNI_CODE_HOME: opts.stateDir } : {}),
+        // The launcher's own entry, so the in-session /plugin panel and
+        // /reload-plugins can run `yagni plugin …` with the same binary.
+        YAGNI_CLI_PATH: resolveCliPath(),
         // Forward the launcher's version so the extension's crash reports carry
         // the shipping version (the bundled extension has no package.json to read).
         ...(opts.cliVersion ? { YAGNI_CODE_VERSION: opts.cliVersion } : {}),

package/dist/paths.d.ts

@@ -19,6 +19,12 @@
  * fall back to resolving the workspace-linked package, which keeps `pnpm test`
  * and a fresh checkout working before anything is bundled.
  */
+/**
+ * Absolute path to this CLI's entry (`dist/cli.js`). Forwarded to sessions as
+ * `YAGNI_CLI_PATH` so the extension's `/plugin` panel can run
+ * `yagni plugin …` with the exact binary that launched it.
+ */
+export declare function resolveCliPath(): string;
 export declare function resolveExtensionPath(): string;
 /**
  * Absolute path to the extension's headless pipeline entry

package/dist/paths.js

@@ -25,6 +25,14 @@ function resolveModulePath(specifier) {
  * fall back to resolving the workspace-linked package, which keeps `pnpm test`
  * and a fresh checkout working before anything is bundled.
  */
+/**
+ * Absolute path to this CLI's entry (`dist/cli.js`). Forwarded to sessions as
+ * `YAGNI_CLI_PATH` so the extension's `/plugin` panel can run
+ * `yagni plugin …` with the exact binary that launched it.
+ */
+export function resolveCliPath() {
+    return fileURLToPath(new URL("./cli.js", import.meta.url));
+}
 export function resolveExtensionPath() {
     const bundled = fileURLToPath(new URL("./extension/index.js", import.meta.url));
     if (existsSync(bundled))

package/dist/pluginCommand.d.ts

@@ -29,6 +29,7 @@ export interface ParsedPluginArgs {
     scope: PluginInstallScope;
     scopeExplicit: boolean;
     available: boolean;
+    json: boolean;
 }
 export declare function parsePluginArgs(args: string[]): ParsedPluginArgs;
 /** The repo root a project-scope install applies to: nearest `.git` ancestor, else cwd. */

package/dist/pluginCommand.js

@@ -12,7 +12,7 @@
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, sep } from "node:path";
-import { readTrustDecision } from "./claudeCompat.js";
+import { pluginInventory, readTrustDecision } from "./claudeCompat.js";
 import { discoverClaudePlugins } from "./claudePlugins.js";
 import { agentDir } from "./credentials.js";
 import { DISTRIBUTION } from "./distribution.js";
@@ -30,6 +30,10 @@ const USAGE = `Usage:
   ${cmd} plugin disable <plugin>[@marketplace]
   ${cmd} plugin update [<plugin>[@marketplace]]
   ${cmd} plugin list [--available]
+  ${cmd} plugin inventory --json      (machine-readable; backs the in-session /plugin panel)
+
+In a session: /plugin opens the same panel; /reload-plugins applies changes
+without restarting.
 
 Scopes (install/uninstall):
   user     available in all your projects (default)
@@ -46,7 +50,14 @@ Examples:
   ${cmd} plugin update
 `;
 export function parsePluginArgs(args) {
-    const out = { subcommand: undefined, positionals: [], scope: "user", scopeExplicit: false, available: false };
+    const out = {
+        subcommand: undefined,
+        positionals: [],
+        scope: "user",
+        scopeExplicit: false,
+        available: false,
+        json: false,
+    };
     const scopeFrom = (value) => {
         if (value === "user" || value === "project")
             return value;
@@ -68,6 +79,10 @@ export function parsePluginArgs(args) {
             out.available = true;
             continue;
         }
+        if (arg === "--json") {
+            out.json = true;
+            continue;
+        }
         if (arg === "-h" || arg === "--help") {
             out.subcommand = "help";
             continue;
@@ -138,6 +153,8 @@ export async function pluginCommand(args, deps = {}) {
                 return await update(parsed, io);
             case "list":
                 return parsed.available ? listAvailable(io) : await list(io);
+            case "inventory":
+                return await inventory(io);
             default:
                 stderr(`Unknown plugin subcommand "${parsed.subcommand}".\n${USAGE}`);
                 return 1;
@@ -289,6 +306,12 @@ async function update(parsed, io) {
         io.stdout(`Takes effect on the next ${cmd} launch.\n`);
     return report.errors.length > 0 ? 1 : 0;
 }
+// ── inventory (machine-readable, for the in-session panel) ─────────────────
+async function inventory(io) {
+    const result = pluginInventory({ cwd: io.cwd, agentDir: await io.agentDir(), homeDir: io.home, env: io.env });
+    io.stdout(`${JSON.stringify(result)}\n`);
+    return 0;
+}
 // ── list ────────────────────────────────────────────────────────────────────
 async function list(io) {
     const discovered = discoverClaudePlugins({ cwd: io.cwd, homeDir: io.home, yagniLedger: readLedger(io.store.home) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.6-staging.1257.1",
+  "version": "1.0.6-staging.1261.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "62c167d693dbb2ae2209ae48ab39078b14995fd0"
+  "yagniSourceSha": "4f16be93d0007e813ca15b60ac80c1ce08fd04b4"
 }