chainlesschain 0.162.148 → 0.162.149

package/src/lib/lsp/lsp-server-registry.js

@@ -0,0 +1,196 @@
+/**
+ * LSP server registry — maps a language id to the language-server command that
+ * serves it, and probes whether that command is actually installed.
+ *
+ * Design constraint (see optimization plan): the CLI must NOT depend on any
+ * language server as an npm dependency (they are heavy and language-specific).
+ * Instead we DETECT servers on PATH / `node_modules/.bin`, and when none is
+ * available the caller degrades gracefully to text search. Plugins may register
+ * extra servers via `.lsp.json`.
+ *
+ * Pure + injectable: filesystem/exec probing goes through `_deps` so the
+ * detection logic is unit-testable without a real toolchain.
+ */
+
+import fs from "fs";
+import path from "path";
+import { execFileSync } from "child_process";
+
+export const _deps = {
+  existsSync: fs.existsSync,
+  execFileSync,
+};
+
+// Extension → LSP languageId. Kept small and explicit; unknown extensions get
+// no LSP (text-search fallback).
+const EXTENSION_LANGUAGE = {
+  ".ts": "typescript",
+  ".tsx": "typescriptreact",
+  ".mts": "typescript",
+  ".cts": "typescript",
+  ".js": "javascript",
+  ".jsx": "javascriptreact",
+  ".mjs": "javascript",
+  ".cjs": "javascript",
+  ".py": "python",
+  ".pyi": "python",
+  ".go": "go",
+  ".rs": "rust",
+  ".java": "java",
+  ".vue": "vue",
+};
+
+// languageId → server definition. `bin` names are tried in order; the first one
+// resolvable wins. `args` is passed verbatim. Several languageIds can share one
+// server family (TS server handles JS too).
+const BUILTIN_SERVERS = {
+  typescript: tsServer(),
+  typescriptreact: tsServer(),
+  javascript: tsServer(),
+  javascriptreact: tsServer(),
+  python: {
+    id: "pyright",
+    bins: ["pyright-langserver", "pylsp"],
+    // pyright wants --stdio; pylsp defaults to stdio with no args. Resolved per-bin.
+    argsFor: (bin) => (bin.startsWith("pyright") ? ["--stdio"] : []),
+  },
+  go: { id: "gopls", bins: ["gopls"], argsFor: () => [] },
+  rust: { id: "rust-analyzer", bins: ["rust-analyzer"], argsFor: () => [] },
+  java: { id: "jdtls", bins: ["jdtls"], argsFor: () => [] },
+};
+
+function tsServer() {
+  return {
+    id: "typescript-language-server",
+    bins: ["typescript-language-server"],
+    argsFor: () => ["--stdio"],
+  };
+}
+
+// Registry of plugin-contributed servers, keyed by languageId. Wins over
+// builtins if a plugin explicitly overrides.
+const pluginServers = new Map();
+
+/**
+ * Register an extra language server (from a plugin `.lsp.json`).
+ * @param {object} def { languageId, extensions?, command, args?, id? }
+ */
+export function registerLanguageServer(def) {
+  if (!def || !def.languageId || !def.command) {
+    throw new Error("registerLanguageServer requires { languageId, command }");
+  }
+  pluginServers.set(def.languageId, {
+    id: def.id || def.command,
+    bins: [def.command],
+    argsFor: () => (Array.isArray(def.args) ? def.args : []),
+    fromPlugin: true,
+  });
+  if (Array.isArray(def.extensions)) {
+    for (const ext of def.extensions) {
+      EXTENSION_LANGUAGE[ext.startsWith(".") ? ext : "." + ext] =
+        def.languageId;
+    }
+  }
+}
+
+/** Test/reset hook — clears plugin registrations. */
+export function _resetPluginServers() {
+  pluginServers.clear();
+}
+
+/** Map a file path to its LSP languageId, or null if unsupported. */
+export function languageIdForFile(filePath) {
+  const ext = path.extname(String(filePath || "")).toLowerCase();
+  return EXTENSION_LANGUAGE[ext] || null;
+}
+
+/**
+ * Resolve a runnable server command for a languageId within a project root, or
+ * null if none is installed. Checks (in order): project `node_modules/.bin`,
+ * then PATH (via `resolveBin`).
+ *
+ * @returns {{ languageId, id, command, args } | null}
+ */
+export function resolveServer(languageId, projectRoot) {
+  const def = pluginServers.get(languageId) || BUILTIN_SERVERS[languageId];
+  if (!def) return null;
+  for (const bin of def.bins) {
+    const command = resolveBin(bin, projectRoot);
+    if (command) {
+      return {
+        languageId,
+        id: def.id,
+        command,
+        args: def.argsFor(bin),
+      };
+    }
+  }
+  return null;
+}
+
+/**
+ * Find an executable by name: project-local `node_modules/.bin` first (so a
+ * repo-pinned server wins), then the system PATH. Returns an absolute path, or
+ * null. On Windows the `.cmd`/`.exe` variants are probed too.
+ */
+export function resolveBin(bin, projectRoot) {
+  const isWin = process.platform === "win32";
+  const candidates = isWin ? [bin + ".cmd", bin + ".exe", bin] : [bin];
+
+  // 1) project node_modules/.bin (walk up a couple levels for monorepos)
+  if (projectRoot) {
+    let dir = projectRoot;
+    for (let i = 0; i < 4; i++) {
+      const binDir = path.join(dir, "node_modules", ".bin");
+      for (const c of candidates) {
+        const full = path.join(binDir, c);
+        if (_deps.existsSync(full)) return full;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+
+  // 2) PATH
+  const pathEnv = process.env.PATH || process.env.Path || "";
+  const sep = isWin ? ";" : ":";
+  for (const entry of pathEnv.split(sep)) {
+    if (!entry) continue;
+    for (const c of candidates) {
+      const full = path.join(entry, c);
+      if (_deps.existsSync(full)) return full;
+    }
+  }
+  return null;
+}
+
+/**
+ * Report which builtin servers are available on this machine — used by
+ * `cc doctor` and `cc code-intel status` so the user sees why LSP is or isn't
+ * active without guessing.
+ * @returns {Array<{ languageId, id, available, command }>}
+ */
+export function probeServers(projectRoot) {
+  const seen = new Set();
+  const out = [];
+  const all = { ...BUILTIN_SERVERS };
+  for (const [lid, def] of pluginServers) all[lid] = def;
+  for (const [languageId, def] of Object.entries(all)) {
+    if (seen.has(def.id)) continue; // one row per server family
+    seen.add(def.id);
+    const resolved = resolveServer(languageId, projectRoot);
+    out.push({
+      languageId,
+      id: def.id,
+      available: Boolean(resolved),
+      command: resolved ? resolved.command : null,
+    });
+  }
+  return out;
+}
+
+/** All extensions the registry can currently map (for docs/diagnostics). */
+export function supportedExtensions() {
+  return Object.keys(EXTENSION_LANGUAGE).sort();
+}

package/src/lib/plugin-monitor-supervisor.js

@@ -0,0 +1,238 @@
+/**
+ * PluginMonitorSupervisor — runs installed plugins' background monitors
+ * (Phase 3.3i / Phase 6 down payment). Two modes:
+ *
+ *   - longRunning: spawn the command ONCE and keep it alive (e.g. `tail -f`).
+ *   - interval:    re-run the command every `intervalMs`, capturing each run's
+ *                  output (e.g. a periodic health/log check).
+ *
+ * Captured stdout/stderr lines are buffered as structured records; the agent
+ * loop can `drainOutputs()` them and inject them into the next turn's context
+ * (Phase 6: "后台结果可在下一轮注入 additionalContext"). The supervisor owns
+ * its children and reaps ALL of them on `stopAll()` plus a `process.once('exit')`
+ * backstop, so no monitor process leaks past session end.
+ *
+ * Guardrails (Phase 6 "去重、并发上限、超时、进程回收"): a per-monitor id
+ * dedupes double-starts, `maxConcurrent` caps simultaneous interval runs, and
+ * `timeoutMs` kills a hung interval run. Commands run with shell:false (argv,
+ * never a shell string) — no injection.
+ *
+ * spawn is injected via `_deps` so the whole thing is unit-testable without
+ * real processes.
+ */
+
+import { spawn } from "node:child_process";
+
+export const _deps = { spawn };
+
+const DEFAULT_INTERVAL_MS = 60_000;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_CONCURRENT = 8;
+const OUTPUT_RING = 200; // max buffered output records before dropping oldest
+
+export class PluginMonitorSupervisor {
+  constructor(opts = {}) {
+    this.maxConcurrent = opts.maxConcurrent || DEFAULT_MAX_CONCURRENT;
+    this.defaultIntervalMs = opts.defaultIntervalMs || DEFAULT_INTERVAL_MS;
+    this.timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
+    this._spawn = opts.spawn || _deps.spawn;
+    // id -> { desc, timer?, child?, running }
+    this._monitors = new Map();
+    this._outputs = []; // structured records awaiting drain
+    this._runningIntervalRuns = 0;
+    this._stopped = false;
+    this._exitHook = () => this.stopAll();
+    this._exitHookInstalled = false;
+  }
+
+  /** True when at least one monitor is registered and not stopped. */
+  get size() {
+    return this._monitors.size;
+  }
+
+  /**
+   * Start a batch of monitor descriptors (from collectPluginMonitors). Skips a
+   * monitor whose id is already running (dedupe). Returns the ids started.
+   * @param {Array<object>} monitors
+   * @returns {string[]} ids actually started
+   */
+  start(monitors = []) {
+    if (this._stopped) return [];
+    const started = [];
+    for (const desc of monitors) {
+      if (!desc || !desc.id) continue;
+      if (this._monitors.has(desc.id)) continue; // dedupe double-start
+      const entry = { desc, timer: null, child: null, running: false };
+      this._monitors.set(desc.id, entry);
+      if (desc.mode === "longRunning") {
+        this._spawnLongRunning(entry);
+      } else {
+        // interval: run once immediately, then on a cadence.
+        const ms = desc.intervalMs || this.defaultIntervalMs;
+        this._runIntervalOnce(entry);
+        entry.timer = setInterval(() => this._runIntervalOnce(entry), ms);
+        if (typeof entry.timer.unref === "function") entry.timer.unref();
+      }
+      started.push(desc.id);
+    }
+    if (started.length > 0) this._installExitHook();
+    return started;
+  }
+
+  _installExitHook() {
+    if (this._exitHookInstalled) return;
+    this._exitHookInstalled = true;
+    // Backstop: if the caller forgets stopAll(), reap on process exit so no
+    // monitor process outlives the session.
+    process.once("exit", this._exitHook);
+  }
+
+  _record(desc, stream, text) {
+    const lines = String(text)
+      .split(/\r?\n/)
+      .filter((l) => l.length > 0);
+    for (const line of lines) {
+      this._outputs.push({
+        id: desc.id,
+        plugin: desc.plugin,
+        monitor: desc.name,
+        stream,
+        line,
+      });
+      if (this._outputs.length > OUTPUT_RING) this._outputs.shift();
+    }
+  }
+
+  _spawnLongRunning(entry) {
+    const { desc } = entry;
+    let child;
+    try {
+      child = this._spawn(desc.command, desc.args, {
+        cwd: desc.cwd,
+        env: desc.env ? { ...process.env, ...desc.env } : process.env,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (err) {
+      this._record(desc, "error", `spawn failed: ${err.message}`);
+      return;
+    }
+    entry.child = child;
+    child.stdout?.on("data", (d) =>
+      this._record(desc, "stdout", d.toString("utf8")),
+    );
+    child.stderr?.on("data", (d) =>
+      this._record(desc, "stderr", d.toString("utf8")),
+    );
+    child.on("error", (err) => this._record(desc, "error", err.message));
+    child.on("exit", (code) => {
+      entry.child = null;
+      this._record(desc, "exit", `longRunning monitor exited (code ${code})`);
+    });
+  }
+
+  _runIntervalOnce(entry) {
+    const { desc } = entry;
+    if (this._stopped) return;
+    if (entry.running) return; // previous run still in flight — skip this tick
+    if (this._runningIntervalRuns >= this.maxConcurrent) return; // cap
+    entry.running = true;
+    this._runningIntervalRuns++;
+    let child;
+    try {
+      child = this._spawn(desc.command, desc.args, {
+        cwd: desc.cwd,
+        env: desc.env ? { ...process.env, ...desc.env } : process.env,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (err) {
+      this._record(desc, "error", `spawn failed: ${err.message}`);
+      entry.running = false;
+      this._runningIntervalRuns--;
+      return;
+    }
+    entry.child = child;
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      if (killTimer) clearTimeout(killTimer);
+      entry.child = null;
+      entry.running = false;
+      this._runningIntervalRuns--;
+    };
+    const killTimer = setTimeout(() => {
+      this._record(
+        desc,
+        "error",
+        `interval run timed out after ${this.timeoutMs}ms`,
+      );
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        /* already gone */
+      }
+    }, this.timeoutMs);
+    if (typeof killTimer.unref === "function") killTimer.unref();
+    child.stdout?.on("data", (d) =>
+      this._record(desc, "stdout", d.toString("utf8")),
+    );
+    child.stderr?.on("data", (d) =>
+      this._record(desc, "stderr", d.toString("utf8")),
+    );
+    child.on("error", (err) => {
+      this._record(desc, "error", err.message);
+      finish();
+    });
+    child.on("exit", () => finish());
+  }
+
+  /**
+   * Take and clear all buffered monitor output records (for injection into the
+   * next agent turn). Returns [] when nothing has been captured.
+   */
+  drainOutputs() {
+    const out = this._outputs;
+    this._outputs = [];
+    return out;
+  }
+
+  /** Peek at buffered output without clearing it. */
+  peekOutputs() {
+    return this._outputs.slice();
+  }
+
+  /** Ids of every registered monitor. */
+  ids() {
+    return [...this._monitors.keys()];
+  }
+
+  /**
+   * Stop and reap EVERYTHING: clear interval timers, kill all children. Safe to
+   * call more than once. After this, `start` is a no-op.
+   */
+  stopAll() {
+    this._stopped = true;
+    for (const entry of this._monitors.values()) {
+      if (entry.timer) {
+        clearInterval(entry.timer);
+        entry.timer = null;
+      }
+      if (entry.child) {
+        try {
+          entry.child.kill("SIGTERM");
+        } catch {
+          /* already gone */
+        }
+        entry.child = null;
+      }
+    }
+    this._monitors.clear();
+    this._runningIntervalRuns = 0;
+    if (this._exitHookInstalled) {
+      process.removeListener("exit", this._exitHook);
+      this._exitHookInstalled = false;
+    }
+  }
+}

package/src/lib/plugin-runtime/agents.js

@@ -0,0 +1,51 @@
+/**
+ * Discover installed plugins' agent-definition directories so `discoverAgents`
+ * can expose them as named subagents (Phase 3.3h — plugin Agent component
+ * reaches the agent chain).
+ *
+ * A plugin ships subagents under `<pluginRoot>/agents/<name>.md` (the same
+ * markdown-with-frontmatter shape as `.claude/agents/*.md`), so each installed
+ * plugin's `agents/` directory becomes an extra agent-scan layer. Only plugins
+ * whose manifest fully validated (`manifest.ok`) contribute.
+ *
+ * NOT trust-gated: an agent definition is declarative (a system prompt + an
+ * optional tool ALLOW-list + model — it can only narrow, never expand,
+ * capability) and runs only when the user invokes it BY NAME (`cc agents run …`),
+ * exactly like a skill. It is never auto-executed at startup (unlike a hook), so
+ * it carries the same trust as a skill's SKILL.md, which is also not gated. The
+ * code-bearing components (hooks/LSP/MCP) remain trust-gated.
+ */
+
+import fs from "fs";
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+
+export const _deps = { existsSync: fs.existsSync };
+
+/**
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{ name, scope, version, dir }>} one entry per plugin that has
+ *   an `agents/` directory; `dir` is that directory (a scan root for
+ *   discoverAgents' walkMd).
+ */
+export function discoverPluginAgentLayers(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const p of plugins) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const agentsDir = path.join(p.root, "agents");
+    if (!_deps.existsSync(agentsDir)) continue;
+    out.push({
+      name: p.name,
+      scope: p.scope,
+      version: p.version,
+      dir: agentsDir,
+    });
+  }
+  return out;
+}

package/src/lib/plugin-runtime/bin.js

@@ -0,0 +1,100 @@
+/**
+ * Plugin `bin` component — put a trusted plugin's executables on PATH for the
+ * session (Phase 3.3n). A plugin ships helper executables under `bin/`; making
+ * them resolvable means the agent's `run_shell` (and monitors/hooks, which
+ * inherit the process env) can invoke `some-plugin-tool` by name.
+ *
+ * Wiring: prepend the trusted plugins' bin dirs to `process.env.PATH` at session
+ * start and RESTORE the original PATH at session end — session-scoped, so no
+ * plugin executable stays resolvable after the session. Every child process
+ * inherits process.env, so this one mutation covers run_shell (foreground +
+ * background), the monitor supervisor, and hook commands uniformly.
+ *
+ * SECURITY: an executable on PATH runs code, so — like hooks/LSP/MCP/monitors —
+ * only TRUSTED plugins contribute (user/local auto-trusted; project needs
+ * `cc plugin trust`). An untrusted cloned-repo plugin can NOT shadow a system
+ * command or get its binary invoked.
+ */
+
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+/**
+ * Collect trusted, installed plugins' `bin/` directories.
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{plugin, scope, version, dir}>}
+ */
+export function collectPluginBinDirs(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped
+      .filter((p) => p.manifest?.components?.bin?.length)
+      .map((p) => p.name),
+    "bin",
+  );
+  const out = [];
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const bins = p.manifest.components?.bin;
+    if (!Array.isArray(bins) || bins.length === 0) continue;
+    // Every bin entry's absPath is a file inside the plugin's bin dir; collect
+    // the unique parent directories (usually just `<root>/bin`).
+    const dirs = new Set(bins.map((b) => path.dirname(b.absPath)));
+    for (const dir of dirs) {
+      out.push({
+        plugin: p.name,
+        scope: p.scope,
+        version: p.version,
+        dir,
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * Prepend trusted plugins' bin dirs to `env.PATH` (defaults to process.env).
+ * Returns a `restore()` that puts PATH back, plus the dirs added. Idempotent per
+ * call — a dir already on PATH is not added twice.
+ *
+ * @param {object} [opts] { cwd, scopes, env }
+ * @returns {{ added: string[], restore: () => void }}
+ */
+export function applyPluginBinPath(opts = {}) {
+  const env = opts.env || process.env;
+  const dirs = collectPluginBinDirs({ cwd: opts.cwd, scopes: opts.scopes }).map(
+    (b) => b.dir,
+  );
+  const prevPath = env.PATH;
+  if (dirs.length === 0) {
+    return { added: [], restore: () => {} };
+  }
+  const existing = new Set(
+    String(prevPath || "")
+      .split(path.delimiter)
+      .filter(Boolean),
+  );
+  const added = dirs.filter((d) => !existing.has(d));
+  if (added.length === 0) {
+    return { added: [], restore: () => {} };
+  }
+  env.PATH = [...added, prevPath].filter(Boolean).join(path.delimiter);
+  let restored = false;
+  return {
+    added,
+    restore: () => {
+      if (restored) return;
+      restored = true;
+      // Restore only if nothing else re-touched PATH out from under us; either
+      // way, put the recorded previous value back (session-scoped semantics).
+      env.PATH = prevPath;
+    },
+  };
+}

package/src/lib/plugin-runtime/hooks.js

@@ -0,0 +1,100 @@
+/**
+ * Merge installed plugins' `hooks/hooks.json` into the effective settings-hook
+ * map (Phase 3.3c — plugin Hook component reaches the agent lifecycle).
+ *
+ * A plugin ships lifecycle hooks in the same shape as `.claude/settings.json`
+ * `hooks`: a map of event name → array of `{ matcher?, hooks: [{type,command}] }`
+ * entries, optionally wrapped under a top-level `hooks` key. Those entries are
+ * concatenated onto whatever the user's settings already declared, so a plugin
+ * ADDS hooks without being able to silently replace the user's.
+ *
+ * Only plugins whose manifest fully validated (`manifest.ok`) contribute. Note:
+ * a hook can run a shell command, so a plugin's hooks carry the same trust as
+ * the user installing it (same as an npm package's lifecycle scripts) and run
+ * through the existing hook-runner (which applies the project-hook trust model).
+ */
+
+import fs from "fs";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+export const _deps = { readFileSync: fs.readFileSync };
+
+/** Accept either `{ hooks: {Event:[...]} }` (plugin wrap) or `{Event:[...]}`. */
+function normalizeHookMap(parsed) {
+  if (
+    parsed &&
+    typeof parsed === "object" &&
+    !Array.isArray(parsed) &&
+    parsed.hooks &&
+    typeof parsed.hooks === "object" &&
+    !Array.isArray(parsed.hooks)
+  ) {
+    return parsed.hooks;
+  }
+  return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+    ? parsed
+    : {};
+}
+
+/**
+ * Collect + merge every installed plugin's hook entries into one event map.
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Record<string, Array>} event name → concatenated hook entries
+ */
+export function collectPluginHooks(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return {};
+  }
+  // A hook runs a shell command — gate it behind trust so a cloned repo's
+  // project plugin can't run commands the moment the agent starts.
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped.filter((p) => p.manifest?.components?.hooks).map((p) => p.name),
+    "hooks",
+  );
+  const merged = {};
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const h = p.manifest.components?.hooks;
+    if (!h || !h.absPath) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(_deps.readFileSync(h.absPath, "utf8"));
+    } catch {
+      continue;
+    }
+    const map = normalizeHookMap(parsed);
+    for (const [event, entries] of Object.entries(map)) {
+      if (!Array.isArray(entries)) continue;
+      merged[event] = (merged[event] || []).concat(entries);
+    }
+  }
+  return merged;
+}
+
+/**
+ * Return a settings-hook map that ADDS the installed plugins' hooks to the
+ * user's own. Returns the input unchanged when no plugin contributes hooks.
+ *
+ * @param {object|null} settingsHooks  the user's loaded settings hooks
+ * @param {object} [opts] { cwd, scopes }
+ */
+export function mergePluginHooks(settingsHooks, opts = {}) {
+  const plugin = collectPluginHooks(opts);
+  const events = Object.keys(plugin);
+  if (events.length === 0) return settingsHooks;
+  const out =
+    settingsHooks && typeof settingsHooks === "object"
+      ? { ...settingsHooks }
+      : {};
+  for (const event of events) {
+    out[event] = (Array.isArray(out[event]) ? out[event] : []).concat(
+      plugin[event],
+    );
+  }
+  return out;
+}