chainlesschain 0.162.148 → 0.162.149

package/src/lib/plugin-runtime/policy.js

@@ -0,0 +1,144 @@
+/**
+ * Managed org policy for plugin LOADING (Phase 3.3j — fail-closed allow/deny at
+ * discovery time, not just at `cc plugin install`).
+ *
+ * The security primitives already exist in ../plugin-security.js
+ * (`enforcePluginPolicy` for name/source allow-deny, `verifyPluginManifest` for
+ * SHA-256 + Ed25519 signature). But before this, they were consulted only when a
+ * user ran `cc plugin validate`/`install` — a plugin that an org later added to
+ * `deniedPlugins`, or one dropped into a scope dir out-of-band, still loaded its
+ * skills/agents/hooks/MCP/LSP/monitors at runtime.
+ *
+ * This wires the SAME `enforcePluginPolicy` into `discoverPlugins`, the single
+ * chokepoint every component collector funnels through, so an org's
+ * allowedPlugins / deniedPlugins is enforced fail-closed across ALL six
+ * component types in one place. When there is no managed settings file the
+ * policy is null and nothing is filtered (zero impact on the common case).
+ *
+ * NOTE: source allow/deny (blockedPluginSources / allowedPluginSources) stays an
+ * INSTALL-time gate — an installed plugin doesn't carry its origin on disk, so
+ * only the name allow/deny applies at load. Signature enforcement
+ * (requireSignedPlugins) is a separate follow-up: it needs the installer to
+ * persist a verified-signature marker, else every plugin would fail closed.
+ */
+
+import { enforcePluginPolicy } from "../plugin-security.js";
+import { loadManagedSettings } from "../settings-loader.cjs";
+import { verifyInstalledSignature } from "./signature.js";
+
+// Managed settings are org-admin controlled and effectively static for a
+// session, and discoverPlugins is called by every collector — memoize the load
+// (keyed by resolved file path) so we don't re-read the file on every call.
+let _cache = new Map();
+
+export const _deps = { loadManagedSettings };
+
+/**
+ * Load the managed plugin policy (memoized). Returns the managed settings object
+ * or null when there is no managed settings file.
+ * @param {object} [opts] { env, managedSettingsFile }
+ */
+export function loadManagedPluginPolicy(opts = {}) {
+  const env = opts.env || process.env;
+  const key = String(
+    opts.managedSettingsFile || env.CC_MANAGED_SETTINGS || "<default>",
+  );
+  if (_cache.has(key)) return _cache.get(key);
+  let settings = null;
+  try {
+    const loaded = _deps.loadManagedSettings({
+      env: opts.env,
+      managedSettingsFile: opts.managedSettingsFile,
+    });
+    settings = loaded.settings;
+  } catch (err) {
+    // Malformed managed settings → fail closed by propagating: a caller that
+    // wants org enforcement must not silently proceed with no policy.
+    _cache.set(key, { __invalid: err });
+    throw err;
+  }
+  _cache.set(key, settings);
+  return settings;
+}
+
+/** Clear the memoized policy (tests / after a managed-settings change). */
+export function _resetPolicyCache() {
+  _cache = new Map();
+}
+
+/**
+ * Filter a discovered-plugin list by managed name allow/deny. Non-throwing:
+ * a plugin the org denies (or omits from a required allowlist) is DROPPED and
+ * collected in `dropped`, rather than throwing — so one denied plugin never
+ * breaks loading of the rest.
+ *
+ * @param {Array<{name}>} plugins
+ * @param {object|null} managed  managed settings (null = no policy → keep all)
+ * @returns {{ kept: Array, dropped: Array<{name, reason}> }}
+ */
+export function filterByManagedPolicy(plugins, managed) {
+  if (!managed) return { kept: plugins, dropped: [] };
+  // requireSignedPlugins (fail-closed): every plugin must carry a valid recorded
+  // signature whose locked manifest hash still matches on disk. Optionally the
+  // signing key must be among managed.trustedPluginKeySha256.
+  const requireSigned =
+    managed.requireSignedPlugins === true ||
+    managed.requireSignedPlugins === "require";
+  const trustedKeys = requireSigned
+    ? new Set(
+        (Array.isArray(managed.trustedPluginKeySha256)
+          ? managed.trustedPluginKeySha256
+          : []
+        )
+          .map((k) => String(k || "").trim())
+          .filter(Boolean),
+      )
+    : null;
+  const kept = [];
+  const dropped = [];
+  for (const p of plugins) {
+    try {
+      enforcePluginPolicy(
+        { name: p.name, source: null, action: "load" },
+        managed,
+      );
+    } catch (err) {
+      dropped.push({ name: p.name, reason: err.message });
+      continue;
+    }
+    if (requireSigned) {
+      const v = verifyInstalledSignature(p, { trustedKeys });
+      if (!v.signed) {
+        dropped.push({
+          name: p.name,
+          reason: `requireSignedPlugins: ${v.reason}`,
+        });
+        continue;
+      }
+    }
+    kept.push(p);
+  }
+  return { kept, dropped };
+}
+
+let _warnedDropped = new Set();
+
+/** One-time stderr warning naming plugins an org policy blocked from loading. */
+export function warnDroppedOnce(dropped) {
+  const fresh = dropped.filter((d) => !_warnedDropped.has(d.name));
+  if (fresh.length === 0) return;
+  for (const d of fresh) _warnedDropped.add(d.name);
+  try {
+    process.stderr.write(
+      `[plugins] blocked by managed policy: ${fresh
+        .map((d) => `${d.name} (${d.reason})`)
+        .join(", ")}\n`,
+    );
+  } catch {
+    /* best-effort */
+  }
+}
+
+export function _resetPolicyWarnings() {
+  _warnedDropped = new Set();
+}

package/src/lib/plugin-runtime/reload.js

@@ -0,0 +1,79 @@
+/**
+ * Hot-reload the plugin runtime (Phase 3.3m — `/reload-plugins`).
+ *
+ * Installing / trusting / upgrading a plugin mid-session normally needs a
+ * restart because several collectors memoize their work (LSP registration is
+ * registered once per root; the managed-policy load + trust/untrusted warnings
+ * are cached). This resets that memoized state and re-runs the declarative
+ * collectors so a freshly-installed/trusted plugin's components appear without
+ * restarting.
+ *
+ * Returns a summary of what is now discovered (per-component counts) so the REPL
+ * can report it. The caller (agent-repl) additionally re-merges hooks and
+ * restarts the monitor supervisor with the fresh set — those hold live session
+ * state (the effective hook map, running child processes) the pure collectors
+ * can't touch. Already-connected MCP servers stay connected for this session
+ * (reconnecting mid-turn is out of scope); newly-added MCP servers are picked up
+ * on the next session.
+ */
+
+import { discoverPlugins } from "./scopes.js";
+import { ensurePluginLspServers, _resetPluginLspLoadState } from "./lsp.js";
+import { _resetPluginServers } from "../lsp/lsp-server-registry.js";
+import { _resetPolicyCache, _resetPolicyWarnings } from "./policy.js";
+import { _resetTrustWarnings } from "./trust.js";
+import { discoverPluginSkillLayers } from "./skills.js";
+import { discoverPluginAgentLayers } from "./agents.js";
+import { collectPluginHooks } from "./hooks.js";
+import { collectPluginMcpServers } from "./mcp.js";
+import { collectPluginMonitors } from "./monitors.js";
+
+/**
+ * Reset memoized plugin-runtime state and re-scan. Pure w.r.t. session state —
+ * the REPL layer applies the hooks/monitors side of the reload.
+ *
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {{ plugins, lspRegistered, skills, agents, hooks, mcp, monitors }}
+ */
+export function reloadPluginRuntime(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const scopes = opts.scopes;
+
+  // 1) Clear caches so the next discovery re-reads managed policy + re-evaluates
+  //    trust, and LSP servers can be cleanly re-registered.
+  _resetPolicyCache();
+  _resetPolicyWarnings();
+  _resetTrustWarnings();
+  _resetPluginServers();
+  _resetPluginLspLoadState();
+
+  // 2) Re-register plugin LSP servers from scratch (force past the per-root memo).
+  let lspRegistered = 0;
+  try {
+    const res = ensurePluginLspServers({ cwd, scopes, force: true });
+    lspRegistered = res?.registered?.length || 0;
+  } catch {
+    lspRegistered = 0;
+  }
+
+  // 3) Re-scan the declarative collectors for a fresh summary.
+  const count = (fn, pick) => {
+    try {
+      const r = fn({ cwd, scopes });
+      return pick(r);
+    } catch {
+      return 0;
+    }
+  };
+  const plugins = count(discoverPlugins, (r) => r.length);
+  const skills = count(discoverPluginSkillLayers, (r) => r.length);
+  const agents = count(discoverPluginAgentLayers, (r) => r.length);
+  const hooks = count(collectPluginHooks, (r) => Object.keys(r).length);
+  const mcp = count(
+    collectPluginMcpServers,
+    (r) => Object.keys(r.servers).length,
+  );
+  const monitors = count(collectPluginMonitors, (r) => r.length);
+
+  return { plugins, lspRegistered, skills, agents, hooks, mcp, monitors };
+}

package/src/lib/plugin-runtime/scopes.js

@@ -0,0 +1,197 @@
+/**
+ * Plugin install scopes + on-disk discovery (Phase 3).
+ *
+ * A plugin can be installed at three scopes, mirroring the skill-loader layering:
+ *
+ *   user     — <userData>/plugins/            global to the machine/user
+ *   project  — <root>/.chainlesschain/plugins/       committed, shared via the repo
+ *   local    — <root>/.chainlesschain/plugins.local/ gitignored, per-developer
+ *
+ * Precedence on a name collision: local > project > user (the most specific
+ * wins, same spirit as the skill layers).
+ *
+ * Each plugin lives in an IMMUTABLE version directory:
+ *
+ *   <scopeRoot>/<encodedName>/<version>/   (+ the plugin body)
+ *
+ * so an in-flight session keeps running its version even while another is
+ * installed. The active version per (scope,name) is the one named by a
+ * `.active` file, or the highest semver present if none is set.
+ */
+
+import fs from "fs";
+import path from "path";
+import semver from "semver";
+import { getElectronUserDataDir } from "../paths.js";
+import { parsePluginManifest } from "./manifest.js";
+import {
+  loadManagedPluginPolicy,
+  filterByManagedPolicy,
+  warnDroppedOnce,
+} from "./policy.js";
+
+export const _deps = {
+  existsSync: fs.existsSync,
+  readdirSync: fs.readdirSync,
+  readFileSync: fs.readFileSync,
+  statSync: fs.statSync,
+};
+
+// Lowest → highest precedence.
+export const SCOPES = ["user", "project", "local"];
+
+/** Filesystem-safe encoding of a (possibly scoped, e.g. @org/name) plugin name. */
+export function encodeName(name) {
+  return String(name || "").replace(/[^a-zA-Z0-9._-]/g, "__");
+}
+
+/**
+ * Resolve the root directory for a scope.
+ * @param {"user"|"project"|"local"} scope
+ * @param {object} [opts] { cwd }
+ */
+export function scopeRoot(scope, opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  switch (scope) {
+    case "user":
+      return path.join(getElectronUserDataDir(), "plugins");
+    case "project":
+      return path.join(cwd, ".chainlesschain", "plugins");
+    case "local":
+      return path.join(cwd, ".chainlesschain", "plugins.local");
+    default:
+      throw new Error(`unknown plugin scope: ${scope}`);
+  }
+}
+
+/** Directory that holds all versions of one plugin at a scope. */
+export function pluginNameDir(scope, name, opts = {}) {
+  return path.join(scopeRoot(scope, opts), encodeName(name));
+}
+
+/** Immutable install dir for a specific plugin version. */
+export function pluginVersionDir(scope, name, version, opts = {}) {
+  return path.join(pluginNameDir(scope, name, opts), String(version));
+}
+
+/** Versions present on disk for a plugin, newest semver first. */
+export function listInstalledVersions(scope, name, opts = {}) {
+  const dir = pluginNameDir(scope, name, opts);
+  if (!dirExists(dir)) return [];
+  return _deps
+    .readdirSync(dir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .filter((v) => semver.valid(v))
+    .sort(semver.rcompare);
+}
+
+/** The active version for a plugin: `.active` file if valid, else highest semver. */
+export function activeVersion(scope, name, opts = {}) {
+  const versions = listInstalledVersions(scope, name, opts);
+  if (versions.length === 0) return null;
+  const activeFile = path.join(pluginNameDir(scope, name, opts), ".active");
+  if (_deps.existsSync(activeFile)) {
+    try {
+      const pinned = _deps.readFileSync(activeFile, "utf8").trim();
+      if (versions.includes(pinned)) return pinned;
+    } catch {
+      /* fall through to highest */
+    }
+  }
+  return versions[0];
+}
+
+/**
+ * Discover every installed plugin's ACTIVE version across all scopes, applying
+ * scope precedence (local > project > user) so a name installed at multiple
+ * scopes resolves to one parsed manifest.
+ *
+ * Managed org policy (allowedPlugins / deniedPlugins) is enforced fail-closed
+ * here — the single chokepoint every component collector funnels through — so a
+ * denied plugin loads NONE of its six component types. Pass `skipPolicy:true`
+ * for tooling that must see even blocked plugins (e.g. `cc plugin installed`
+ * showing why something is blocked). No managed settings file → no filtering.
+ *
+ * @param {object} [opts] { cwd, scopes?, skipPolicy?, env?, managedSettingsFile? }
+ * @returns {Array<{scope, name, version, root, manifest}>}
+ */
+export function discoverPlugins(opts = {}) {
+  const scopes = opts.scopes || SCOPES;
+  const byName = new Map(); // name → record (later scope overrides earlier)
+  for (const scope of scopes) {
+    const root = scopeRoot(scope, opts);
+    if (!dirExists(root)) continue;
+    for (const encoded of listDirs(root)) {
+      const nameDir = path.join(root, encoded);
+      const version = activeVersionForDir(nameDir);
+      if (!version) continue;
+      const versionDir = path.join(nameDir, version);
+      const manifest = parsePluginManifest(versionDir);
+      manifest.scope = scope;
+      const name = manifest.metadata?.name || encoded;
+      byName.set(name, {
+        scope,
+        name,
+        version: manifest.metadata?.version || version,
+        root: versionDir,
+        manifest,
+      });
+    }
+  }
+  const all = [...byName.values()];
+  if (opts.skipPolicy) return all;
+  // Enforce managed org allow/deny at load time (fail-closed). A malformed
+  // managed settings file throws out of loadManagedPluginPolicy — that
+  // propagates so a broken org policy never silently degrades to "no policy".
+  const managed = loadManagedPluginPolicy({
+    env: opts.env,
+    managedSettingsFile: opts.managedSettingsFile,
+  });
+  if (!managed) return all;
+  const { kept, dropped } = filterByManagedPolicy(all, managed);
+  if (dropped.length > 0) warnDroppedOnce(dropped);
+  return kept;
+}
+
+// ── internals ────────────────────────────────────────────────────────────
+
+function activeVersionForDir(nameDir) {
+  if (!dirExists(nameDir)) return null;
+  const versions = _deps
+    .readdirSync(nameDir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .filter((v) => semver.valid(v))
+    .sort(semver.rcompare);
+  if (versions.length === 0) return null;
+  const activeFile = path.join(nameDir, ".active");
+  if (_deps.existsSync(activeFile)) {
+    try {
+      const pinned = _deps.readFileSync(activeFile, "utf8").trim();
+      if (versions.includes(pinned)) return pinned;
+    } catch {
+      /* fall through */
+    }
+  }
+  return versions[0];
+}
+
+function dirExists(dir) {
+  try {
+    return _deps.existsSync(dir) && _deps.statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function listDirs(dir) {
+  try {
+    return _deps
+      .readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isDirectory())
+      .map((e) => e.name);
+  } catch {
+    return [];
+  }
+}

package/src/lib/plugin-runtime/settings.js

@@ -0,0 +1,119 @@
+/**
+ * Plugin `settings` component — a plugin's default configuration (Phase 3.3o).
+ *
+ * A plugin ships a `settings.json` with defaults. We contribute ONLY the safe,
+ * non-security config-override keys — `env` (default environment variables) and
+ * `model` (a default model) — as the LOWEST-priority layer: the user's own
+ * settings, the system environment, and managed settings ALL override them.
+ *
+ * SECURITY: a plugin's settings deliberately CANNOT contribute permission rules,
+ * hooks, MCP servers, or any security-relevant key — those either have their own
+ * dedicated (trust-gated) wiring or must come from the user/managed settings, so
+ * a plugin can never widen the permission envelope through `settings.json`. Even
+ * so, because `env` can influence tool behavior, collection is trust-gated:
+ * only user/local-scope and explicitly-trusted project plugins contribute.
+ */
+
+import fs from "fs";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+export const _deps = { readFileSync: fs.readFileSync };
+
+/** Keys a plugin's settings.json is allowed to contribute (safe subset). */
+const SAFE_KEYS = new Set(["env", "model"]);
+
+/**
+ * Merge trusted plugins' settings.json into a safe defaults object. A later
+ * plugin (in discovery precedence) wins on an env-key / model clash.
+ *
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {{ env: Record<string,string>, model: string|null, sources: string[] }}
+ */
+export function collectPluginSettings(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return { env: {}, model: null, sources: [] };
+  }
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped.filter((p) => p.manifest?.components?.settings).map((p) => p.name),
+    "settings",
+  );
+  const env = {};
+  let model = null;
+  const sources = [];
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const s = p.manifest.components?.settings;
+    if (!s || !s.absPath) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(_deps.readFileSync(s.absPath, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      continue;
+    let contributed = false;
+    // ONLY the safe subset — everything else (permissions/hooks/mcp/…) ignored.
+    if (
+      SAFE_KEYS.has("env") &&
+      parsed.env &&
+      typeof parsed.env === "object" &&
+      !Array.isArray(parsed.env)
+    ) {
+      for (const [k, v] of Object.entries(parsed.env)) {
+        if (typeof v === "string") {
+          env[k] = v;
+          contributed = true;
+        }
+      }
+    }
+    if (
+      SAFE_KEYS.has("model") &&
+      typeof parsed.model === "string" &&
+      parsed.model.trim()
+    ) {
+      model = parsed.model.trim();
+      contributed = true;
+    }
+    if (contributed) sources.push(s.absPath);
+  }
+  return { env, model, sources };
+}
+
+/**
+ * Apply trusted plugins' default env vars to `env` (defaults to process.env) —
+ * but ONLY for keys not already set, so the user's / system's environment always
+ * wins. Session-scoped: returns `restore()` + the keys added.
+ *
+ * @param {object} [opts] { cwd, scopes, env }
+ * @returns {{ added: string[], model: string|null, restore: () => void }}
+ */
+export function applyPluginSettingsEnv(opts = {}) {
+  const env = opts.env || process.env;
+  const { env: pluginEnv, model } = collectPluginSettings({
+    cwd: opts.cwd,
+    scopes: opts.scopes,
+  });
+  const added = [];
+  for (const [k, v] of Object.entries(pluginEnv)) {
+    if (env[k] === undefined) {
+      env[k] = v;
+      added.push(k);
+    }
+  }
+  let restored = false;
+  return {
+    added,
+    model,
+    restore: () => {
+      if (restored) return;
+      restored = true;
+      for (const k of added) delete env[k];
+    },
+  };
+}

package/src/lib/plugin-runtime/signature.js

@@ -0,0 +1,107 @@
+/**
+ * Plugin signature lock (Phase 3.3l — `requireSignedPlugins` load enforcement).
+ *
+ * `verifyPluginManifest` (../plugin-security.js) verifies a plugin manifest's
+ * SHA-256 + detached Ed25519 signature, but only at the moment of `cc plugin
+ * add/validate`. To enforce signing at LOAD time (an org's requireSignedPlugins),
+ * install records the verification result in a `.plugin-lock.json` inside the
+ * immutable version dir; discovery then re-checks it fail-closed.
+ *
+ * The lock records the manifest's sha256 + the signing key's fingerprint. At
+ * load we RE-HASH the on-disk manifest and compare — so a manifest tampered with
+ * after install (even inside the version dir) fails the check. The signature
+ * itself covers only the manifest file, not every component file — that is a
+ * known limitation (documented), an integrity anchor rather than a full
+ * supply-chain seal; the immutable version dir + this re-hash catch manifest
+ * tampering, which is where the component wiring is declared.
+ */
+
+import { createHash } from "node:crypto";
+import fs from "fs";
+import path from "path";
+
+const LOCK = ".plugin-lock.json";
+
+export const _deps = {
+  readFileSync: fs.readFileSync,
+  writeFileSync: fs.writeFileSync,
+  existsSync: fs.existsSync,
+};
+
+/** Record a verified signature into the version dir. */
+export function writePluginLock(
+  versionDir,
+  { manifestFile, sha256, publicKeySha256, signatureVerified },
+) {
+  const rel = path.relative(versionDir, manifestFile).replace(/\\/g, "/");
+  const lock = {
+    lockVersion: 1,
+    manifest: rel || "plugin.json",
+    sha256,
+    publicKeySha256: publicKeySha256 || null,
+    signatureVerified: signatureVerified === true,
+  };
+  _deps.writeFileSync(
+    path.join(versionDir, LOCK),
+    JSON.stringify(lock, null, 2),
+    "utf8",
+  );
+  return lock;
+}
+
+/** Read a version dir's signature lock, or null when absent/unreadable. */
+export function readPluginLock(versionDir) {
+  const p = path.join(versionDir, LOCK);
+  if (!_deps.existsSync(p)) return null;
+  try {
+    return JSON.parse(_deps.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Verify an installed plugin's recorded signature against its on-disk manifest.
+ * `signed:true` ONLY when a lock exists, was signature-verified, the manifest
+ * still hashes to the locked sha256 (tamper detection), and — when trustedKeys
+ * is a non-empty Set — the signing key fingerprint is among them.
+ *
+ * @param {{root:string}} plugin
+ * @param {object} [opts] { trustedKeys?: Set<string> }
+ * @returns {{ signed:boolean, reason?:string, publicKeySha256?:string }}
+ */
+export function verifyInstalledSignature(plugin, opts = {}) {
+  const lock = readPluginLock(plugin.root);
+  if (!lock) return { signed: false, reason: "no signature lock" };
+  if (lock.signatureVerified !== true) {
+    return { signed: false, reason: "lock is not signature-verified" };
+  }
+  const manifestFile = path.join(plugin.root, lock.manifest || "plugin.json");
+  if (!_deps.existsSync(manifestFile)) {
+    return { signed: false, reason: "locked manifest file is missing" };
+  }
+  let sha;
+  try {
+    sha = createHash("sha256")
+      .update(_deps.readFileSync(manifestFile))
+      .digest("hex");
+  } catch {
+    return { signed: false, reason: "manifest unreadable" };
+  }
+  if (sha.toLowerCase() !== String(lock.sha256 || "").toLowerCase()) {
+    return {
+      signed: false,
+      reason: "manifest tampered since install (sha256 mismatch)",
+    };
+  }
+  const trustedKeys = opts.trustedKeys;
+  if (trustedKeys && trustedKeys.size > 0) {
+    if (!lock.publicKeySha256 || !trustedKeys.has(lock.publicKeySha256)) {
+      return {
+        signed: false,
+        reason: `signing key not trusted (${lock.publicKeySha256 || "unsigned"})`,
+      };
+    }
+  }
+  return { signed: true, publicKeySha256: lock.publicKeySha256 };
+}

package/src/lib/plugin-runtime/skills.js

@@ -0,0 +1,43 @@
+/**
+ * Discover installed plugins' skill directories so the skill-loader can expose
+ * them to the agent (Phase 3.3 — plugin Skill component reaches the agent).
+ *
+ * A plugin ships skills under `<pluginRoot>/skills/<name>/SKILL.md` (the same
+ * `<group>/<skill>/SKILL.md` layout every skill layer uses), so each installed
+ * plugin's `skills/` directory becomes an extra skill layer. Only plugins whose
+ * manifest fully validated (`manifest.ok`) contribute — a plugin with a
+ * traversal/schema error in ANY component loads nothing.
+ */
+
+import fs from "fs";
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+
+export const _deps = { existsSync: fs.existsSync };
+
+/**
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{ name, scope, version, path }>} one entry per plugin that has
+ *   a `skills/` directory; `path` is that directory (a scan root for the loader).
+ */
+export function discoverPluginSkillLayers(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const p of plugins) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const skillsDir = path.join(p.root, "skills");
+    if (!_deps.existsSync(skillsDir)) continue;
+    out.push({
+      name: p.name,
+      scope: p.scope,
+      version: p.version,
+      path: skillsDir,
+    });
+  }
+  return out;
+}