chainlesschain 0.162.148 → 0.162.150

package/src/lib/plugin-runtime/bin.js

@@ -0,0 +1,100 @@
+/**
+ * Plugin `bin` component — put a trusted plugin's executables on PATH for the
+ * session (Phase 3.3n). A plugin ships helper executables under `bin/`; making
+ * them resolvable means the agent's `run_shell` (and monitors/hooks, which
+ * inherit the process env) can invoke `some-plugin-tool` by name.
+ *
+ * Wiring: prepend the trusted plugins' bin dirs to `process.env.PATH` at session
+ * start and RESTORE the original PATH at session end — session-scoped, so no
+ * plugin executable stays resolvable after the session. Every child process
+ * inherits process.env, so this one mutation covers run_shell (foreground +
+ * background), the monitor supervisor, and hook commands uniformly.
+ *
+ * SECURITY: an executable on PATH runs code, so — like hooks/LSP/MCP/monitors —
+ * only TRUSTED plugins contribute (user/local auto-trusted; project needs
+ * `cc plugin trust`). An untrusted cloned-repo plugin can NOT shadow a system
+ * command or get its binary invoked.
+ */
+
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+/**
+ * Collect trusted, installed plugins' `bin/` directories.
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{plugin, scope, version, dir}>}
+ */
+export function collectPluginBinDirs(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped
+      .filter((p) => p.manifest?.components?.bin?.length)
+      .map((p) => p.name),
+    "bin",
+  );
+  const out = [];
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const bins = p.manifest.components?.bin;
+    if (!Array.isArray(bins) || bins.length === 0) continue;
+    // Every bin entry's absPath is a file inside the plugin's bin dir; collect
+    // the unique parent directories (usually just `<root>/bin`).
+    const dirs = new Set(bins.map((b) => path.dirname(b.absPath)));
+    for (const dir of dirs) {
+      out.push({
+        plugin: p.name,
+        scope: p.scope,
+        version: p.version,
+        dir,
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * Prepend trusted plugins' bin dirs to `env.PATH` (defaults to process.env).
+ * Returns a `restore()` that puts PATH back, plus the dirs added. Idempotent per
+ * call — a dir already on PATH is not added twice.
+ *
+ * @param {object} [opts] { cwd, scopes, env }
+ * @returns {{ added: string[], restore: () => void }}
+ */
+export function applyPluginBinPath(opts = {}) {
+  const env = opts.env || process.env;
+  const dirs = collectPluginBinDirs({ cwd: opts.cwd, scopes: opts.scopes }).map(
+    (b) => b.dir,
+  );
+  const prevPath = env.PATH;
+  if (dirs.length === 0) {
+    return { added: [], restore: () => {} };
+  }
+  const existing = new Set(
+    String(prevPath || "")
+      .split(path.delimiter)
+      .filter(Boolean),
+  );
+  const added = dirs.filter((d) => !existing.has(d));
+  if (added.length === 0) {
+    return { added: [], restore: () => {} };
+  }
+  env.PATH = [...added, prevPath].filter(Boolean).join(path.delimiter);
+  let restored = false;
+  return {
+    added,
+    restore: () => {
+      if (restored) return;
+      restored = true;
+      // Restore only if nothing else re-touched PATH out from under us; either
+      // way, put the recorded previous value back (session-scoped semantics).
+      env.PATH = prevPath;
+    },
+  };
+}

package/src/lib/plugin-runtime/hooks.js

@@ -0,0 +1,100 @@
+/**
+ * Merge installed plugins' `hooks/hooks.json` into the effective settings-hook
+ * map (Phase 3.3c — plugin Hook component reaches the agent lifecycle).
+ *
+ * A plugin ships lifecycle hooks in the same shape as `.claude/settings.json`
+ * `hooks`: a map of event name → array of `{ matcher?, hooks: [{type,command}] }`
+ * entries, optionally wrapped under a top-level `hooks` key. Those entries are
+ * concatenated onto whatever the user's settings already declared, so a plugin
+ * ADDS hooks without being able to silently replace the user's.
+ *
+ * Only plugins whose manifest fully validated (`manifest.ok`) contribute. Note:
+ * a hook can run a shell command, so a plugin's hooks carry the same trust as
+ * the user installing it (same as an npm package's lifecycle scripts) and run
+ * through the existing hook-runner (which applies the project-hook trust model).
+ */
+
+import fs from "fs";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+export const _deps = { readFileSync: fs.readFileSync };
+
+/** Accept either `{ hooks: {Event:[...]} }` (plugin wrap) or `{Event:[...]}`. */
+function normalizeHookMap(parsed) {
+  if (
+    parsed &&
+    typeof parsed === "object" &&
+    !Array.isArray(parsed) &&
+    parsed.hooks &&
+    typeof parsed.hooks === "object" &&
+    !Array.isArray(parsed.hooks)
+  ) {
+    return parsed.hooks;
+  }
+  return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+    ? parsed
+    : {};
+}
+
+/**
+ * Collect + merge every installed plugin's hook entries into one event map.
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Record<string, Array>} event name → concatenated hook entries
+ */
+export function collectPluginHooks(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return {};
+  }
+  // A hook runs a shell command — gate it behind trust so a cloned repo's
+  // project plugin can't run commands the moment the agent starts.
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped.filter((p) => p.manifest?.components?.hooks).map((p) => p.name),
+    "hooks",
+  );
+  const merged = {};
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const h = p.manifest.components?.hooks;
+    if (!h || !h.absPath) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(_deps.readFileSync(h.absPath, "utf8"));
+    } catch {
+      continue;
+    }
+    const map = normalizeHookMap(parsed);
+    for (const [event, entries] of Object.entries(map)) {
+      if (!Array.isArray(entries)) continue;
+      merged[event] = (merged[event] || []).concat(entries);
+    }
+  }
+  return merged;
+}
+
+/**
+ * Return a settings-hook map that ADDS the installed plugins' hooks to the
+ * user's own. Returns the input unchanged when no plugin contributes hooks.
+ *
+ * @param {object|null} settingsHooks  the user's loaded settings hooks
+ * @param {object} [opts] { cwd, scopes }
+ */
+export function mergePluginHooks(settingsHooks, opts = {}) {
+  const plugin = collectPluginHooks(opts);
+  const events = Object.keys(plugin);
+  if (events.length === 0) return settingsHooks;
+  const out =
+    settingsHooks && typeof settingsHooks === "object"
+      ? { ...settingsHooks }
+      : {};
+  for (const event of events) {
+    out[event] = (Array.isArray(out[event]) ? out[event] : []).concat(
+      plugin[event],
+    );
+  }
+  return out;
+}

package/src/lib/plugin-runtime/install.js

@@ -0,0 +1,396 @@
+/**
+ * Plugin install lifecycle (Phase 3.3d) — put a plugin ONTO disk in an immutable
+ * scope version directory, so the component wirings (skills / lsp / hooks) built
+ * in 3.2–3.3c actually reach the agent for a real user instead of only for
+ * hand-placed fixtures.
+ *
+ *   installFromDirectory(src, {scope}) → validate manifest → copy into
+ *     <scopeRoot>/<encodedName>/<version>/  → mark that version active
+ *   listInstalled({cwd})                 → discover across scopes
+ *   uninstall(name, {scope, version})    → remove a version (or the whole plugin)
+ *   setActiveVersion(name, version)      → repoint `.active` (rollback)
+ *
+ * Version directories are immutable: re-installing the same version refuses
+ * unless `force`, so an in-flight session keeps running its bytes. The copy
+ * skips symlinks (a symlink could later resolve outside the sandbox) and only
+ * writes inside the destination version dir.
+ */
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { spawnSync } from "child_process";
+import { parsePluginManifest, isWithin } from "./manifest.js";
+import {
+  pluginNameDir,
+  pluginVersionDir,
+  listInstalledVersions,
+  activeVersion,
+  discoverPlugins,
+} from "./scopes.js";
+import { verifyPluginManifest } from "../plugin-security.js";
+import { writePluginLock } from "./signature.js";
+
+export const _deps = {
+  existsSync: fs.existsSync,
+  mkdirSync: fs.mkdirSync,
+  rmSync: fs.rmSync,
+  readdirSync: fs.readdirSync,
+  copyFileSync: fs.copyFileSync,
+  lstatSync: fs.lstatSync,
+  writeFileSync: fs.writeFileSync,
+  mkdtempSync: fs.mkdtempSync,
+  spawnSync,
+};
+
+/**
+ * Install a plugin from a local directory into a scope's immutable version dir.
+ * @param {string} srcDir  directory containing the plugin (with its manifest)
+ * @param {object} opts     { scope="user", cwd, force=false }
+ * @returns {{ name, version, scope, dir, warnings }}
+ */
+export function installFromDirectory(srcDir, opts = {}) {
+  const scope = opts.scope || "user";
+  const src = path.resolve(srcDir);
+  if (!_deps.existsSync(src)) {
+    throw new Error(`source directory does not exist: ${src}`);
+  }
+
+  const manifest = parsePluginManifest(src);
+  if (!manifest.ok) {
+    throw new Error(
+      `plugin manifest is invalid:\n  - ${manifest.errors.join("\n  - ")}`,
+    );
+  }
+  const { name, version } = manifest.metadata;
+
+  // Optional signature/integrity verification of the manifest at install time
+  // (Phase 3.3l). verifyPluginManifest THROWS on any mismatch/failure — a signed
+  // install that fails verification must not land on disk (fail-closed). On
+  // success we record a `.plugin-lock.json` so load-time requireSignedPlugins
+  // can re-check it without the original signature/key files.
+  let verification = null;
+  const sig = opts.signature;
+  if (sig && (sig.sha256 || sig.signatureFile || sig.requireSignature)) {
+    verification = verifyPluginManifest({
+      manifestFile: manifest.manifestPath,
+      expectedSha256: sig.sha256,
+      signatureFile: sig.signatureFile,
+      publicKeyFile: sig.publicKeyFile,
+      requireSignature: sig.requireSignature === true,
+      trustedKeySha256: sig.trustedKeySha256 || null,
+      requireTrustedKey: sig.requireTrustedKey === true,
+    });
+  }
+
+  const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
+  if (_deps.existsSync(dest)) {
+    if (!opts.force) {
+      throw new Error(
+        `${name}@${version} is already installed at ${scope} scope (immutable). ` +
+          `Use --force to reinstall, or bump the version.`,
+      );
+    }
+    _deps.rmSync(dest, { recursive: true, force: true });
+  }
+
+  _deps.mkdirSync(dest, { recursive: true });
+  copyDirGuarded(src, dest, dest);
+
+  // Record the verified signature into the installed (immutable) version dir so
+  // load-time enforcement can re-check it. The manifest was copied verbatim, so
+  // its bytes/sha in `dest` match what we verified in `src`.
+  if (verification) {
+    const destManifest = path.join(
+      dest,
+      path.relative(src, manifest.manifestPath),
+    );
+    writePluginLock(dest, {
+      manifestFile: destManifest,
+      sha256: verification.sha256,
+      publicKeySha256: verification.publicKeySha256,
+      signatureVerified: verification.signatureVerified === true,
+    });
+  }
+
+  // Make the freshly-installed version active.
+  setActiveVersion(name, version, { scope, cwd: opts.cwd });
+
+  return {
+    name,
+    version,
+    scope,
+    dir: dest,
+    warnings: manifest.warnings,
+    signatureVerified: verification?.signatureVerified === true,
+  };
+}
+
+/**
+ * Install from a source string:
+ *   - a local directory                         → copied in directly
+ *   - a git URL (https://…, git@…, ….git, file://…) → shallow-cloned then installed
+ *   - GitHub shorthand `owner/repo`             → https://github.com/owner/repo.git
+ * An optional `#ref` (branch / tag / commit) pins the checkout.
+ */
+export function installFromSource(source, opts = {}) {
+  return _withMaterializedSource(source, (dir, info) => {
+    const res = installFromDirectory(dir, opts);
+    return info ? { ...res, source: info.url, ref: info.ref || null } : res;
+  });
+}
+
+/**
+ * Materialize a source string into a local directory (cloning a git source into
+ * a temp dir), invoke `fn(dir, gitInfo|null)`, then clean up any temp checkout.
+ * Single fetch shared by installFromSource + updatePlugin.
+ */
+function _withMaterializedSource(source, fn) {
+  const raw = String(source || "");
+  const asDir = path.resolve(raw);
+  if (_deps.existsSync(asDir) && _deps.lstatSync(asDir).isDirectory()) {
+    return fn(asDir, null);
+  }
+  const git = parseGitSource(raw);
+  if (git) {
+    const cloned = fetchGitRepo(git.url, git.ref);
+    try {
+      return fn(cloned, git);
+    } finally {
+      try {
+        _deps.rmSync(path.dirname(cloned), { recursive: true, force: true });
+      } catch {
+        /* temp cleanup is best-effort */
+      }
+    }
+  }
+  throw new Error(
+    `source not found as a local directory or git URL: ${source}`,
+  );
+}
+
+/**
+ * Update an installed plugin from a source (local dir or git). Fetches the
+ * source ONCE, reads its name+version, and:
+ *   - a NEW version    → installs the new immutable version dir + repoints
+ *     `.active` (the old version stays on disk for rollback via `cc plugin use`);
+ *   - the SAME version → no-op unless `--force` reinstalls it.
+ * Returns { name, version, previousVersion, updated, reinstalled }.
+ */
+export function updatePlugin(source, opts = {}) {
+  const scope = opts.scope || "user";
+  return _withMaterializedSource(source, (dir, info) => {
+    const manifest = parsePluginManifest(dir);
+    if (!manifest.ok) {
+      throw new Error(
+        `plugin manifest is invalid:\n  - ${manifest.errors.join("\n  - ")}`,
+      );
+    }
+    const { name, version } = manifest.metadata;
+    const previousVersion = getActiveVersion(name, { scope, cwd: opts.cwd });
+    const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
+    const sameVersionExists = _deps.existsSync(dest);
+
+    if (sameVersionExists && !opts.force) {
+      // Already at this version — make sure it's the active one, but don't
+      // reinstall an immutable dir.
+      if (previousVersion !== version) {
+        setActiveVersion(name, version, { scope, cwd: opts.cwd });
+      }
+      return {
+        name,
+        version,
+        previousVersion,
+        updated: previousVersion !== version,
+        reinstalled: false,
+        source: info ? info.url : null,
+      };
+    }
+
+    const res = installFromDirectory(dir, { ...opts, scope, force: true });
+    return {
+      ...res,
+      previousVersion,
+      updated: previousVersion !== version,
+      reinstalled: sameVersionExists,
+      source: info ? info.url : null,
+      ref: info ? info.ref || null : null,
+    };
+  });
+}
+
+/**
+ * Classify a source string into a git URL (+ optional ref), or null when it is
+ * not remote-looking. `owner/repo` expands to a GitHub HTTPS URL.
+ */
+export function parseGitSource(raw) {
+  const [loc, ref] = String(raw || "").split("#");
+  if (!loc) return null;
+  if (
+    /^(https?|git|ssh|file):\/\//.test(loc) ||
+    loc.endsWith(".git") ||
+    /^git@/.test(loc)
+  ) {
+    return { url: loc, ref: ref || null };
+  }
+  if (/^[\w.-]+\/[\w.-]+$/.test(loc)) {
+    return { url: `https://github.com/${loc}.git`, ref: ref || null };
+  }
+  return null;
+}
+
+/**
+ * Shallow-clone `url` (optionally at `ref`) into a fresh temp dir and return the
+ * checkout path. Uses `git` via spawn WITHOUT a shell (url/ref are argv, not a
+ * command line — no injection). Caller removes the temp dir's parent.
+ */
+export function fetchGitRepo(url, ref) {
+  const base = _deps.mkdtempSync(path.join(os.tmpdir(), "cc-plugin-git-"));
+  const dir = path.join(base, "repo");
+  const run = (args) =>
+    _deps.spawnSync("git", args, {
+      encoding: "utf8",
+      timeout: 120000,
+      windowsHide: true,
+      shell: false,
+    });
+
+  const cloneArgs = ["clone", "--depth", "1"];
+  if (ref) cloneArgs.push("--branch", ref);
+  cloneArgs.push(url, dir);
+  let res = run(cloneArgs);
+  if (res.error && res.error.code === "ENOENT") {
+    throw new Error("git is not installed (needed to fetch a remote plugin)");
+  }
+  if (res.status !== 0) {
+    // A commit SHA can't be used with --branch/--depth; retry with a full clone
+    // then checkout the ref explicitly.
+    if (ref) {
+      try {
+        _deps.rmSync(dir, { recursive: true, force: true });
+      } catch {
+        /* ignore */
+      }
+      const full = run(["clone", url, dir]);
+      if (!full.error && full.status === 0) {
+        const co = run(["-C", dir, "checkout", ref]);
+        if (co.status === 0) return dir;
+      }
+    }
+    const reason = (res.stderr || "").trim() || `git exited ${res.status}`;
+    throw new Error(`git clone failed for ${url}: ${reason}`);
+  }
+  return dir;
+}
+
+/**
+ * List installed plugins (active version per name) across scopes. Uses
+ * `skipPolicy` so the ADMIN view shows every plugin on disk — including one an
+ * org managed policy blocks from LOADING — otherwise a denied plugin would be
+ * invisible and impossible to inspect / uninstall / un-deny.
+ */
+export function listInstalled(opts = {}) {
+  return discoverPlugins({
+    cwd: opts.cwd,
+    scopes: opts.scopes,
+    skipPolicy: true,
+  }).map((p) => ({
+    name: p.name,
+    version: p.version,
+    scope: p.scope,
+    dir: p.root,
+    ok: p.manifest?.ok === true,
+  }));
+}
+
+/**
+ * Uninstall a plugin. Without `version`, removes the whole plugin (all versions);
+ * with `version`, removes just that one and repoints `.active` if needed.
+ * @returns {{ removed: string[] }}
+ */
+export function uninstall(name, opts = {}) {
+  const scope = opts.scope || "user";
+  const cwd = opts.cwd;
+  const removed = [];
+
+  if (opts.version) {
+    const dir = pluginVersionDir(scope, name, opts.version, { cwd });
+    if (!_deps.existsSync(dir)) {
+      throw new Error(
+        `${name}@${opts.version} is not installed at ${scope} scope`,
+      );
+    }
+    // Capture the active version BEFORE removing, so we only repoint `.active`
+    // when the version we removed WAS the active one. Removing a NON-active
+    // version (e.g. cleaning up a newer version after rolling back to an older
+    // pinned one) must not silently change which version is active — the old
+    // code always rewrote `.active` to the newest remaining, so uninstalling an
+    // unrelated version could bump the user's pinned choice.
+    const removedWasActive =
+      getActiveVersion(name, { scope, cwd }) === opts.version;
+    _deps.rmSync(dir, { recursive: true, force: true });
+    removed.push(opts.version);
+    // Repoint .active to the newest remaining version, or clear it.
+    const remaining = listInstalledVersions(scope, name, { cwd });
+    const activeFile = path.join(
+      pluginNameDir(scope, name, { cwd }),
+      ".active",
+    );
+    if (remaining.length === 0) {
+      _deps.rmSync(pluginNameDir(scope, name, { cwd }), {
+        recursive: true,
+        force: true,
+      });
+    } else if (removedWasActive && _deps.existsSync(activeFile)) {
+      _deps.writeFileSync(activeFile, remaining[0], "utf8");
+    }
+    return { removed };
+  }
+
+  const nameDir = pluginNameDir(scope, name, { cwd });
+  if (!_deps.existsSync(nameDir)) {
+    throw new Error(`${name} is not installed at ${scope} scope`);
+  }
+  removed.push(...listInstalledVersions(scope, name, { cwd }));
+  _deps.rmSync(nameDir, { recursive: true, force: true });
+  return { removed };
+}
+
+/** Pin a plugin's active version (rollback / switch). */
+export function setActiveVersion(name, version, opts = {}) {
+  const scope = opts.scope || "user";
+  const cwd = opts.cwd;
+  const versionDir = pluginVersionDir(scope, name, version, { cwd });
+  if (!_deps.existsSync(versionDir)) {
+    throw new Error(`${name}@${version} is not installed at ${scope} scope`);
+  }
+  const activeFile = path.join(pluginNameDir(scope, name, { cwd }), ".active");
+  _deps.writeFileSync(activeFile, String(version), "utf8");
+  return { name, version, scope, active: version };
+}
+
+/** Which version is active for a plugin at a scope (or null). */
+export function getActiveVersion(name, opts = {}) {
+  return activeVersion(opts.scope || "user", name, { cwd: opts.cwd });
+}
+
+// ── guarded recursive copy ────────────────────────────────────────────────
+
+/**
+ * Copy `src` → `dst`, refusing to write outside `root` and skipping symlinks
+ * (which could later resolve outside the plugin sandbox). Directories recurse.
+ */
+function copyDirGuarded(src, dst, root) {
+  for (const entry of _deps.readdirSync(src, { withFileTypes: true })) {
+    const from = path.join(src, entry.name);
+    const to = path.join(dst, entry.name);
+    if (!isWithin(root, to)) continue; // never escape the version dir
+    if (entry.isSymbolicLink()) continue; // do not copy symlinks
+    if (entry.isDirectory()) {
+      _deps.mkdirSync(to, { recursive: true });
+      copyDirGuarded(from, to, root);
+    } else if (entry.isFile()) {
+      _deps.copyFileSync(from, to);
+    }
+  }
+}

package/src/lib/plugin-runtime/lsp.js

@@ -0,0 +1,75 @@
+/**
+ * Apply installed plugins' `.lsp.json` language-server contributions to the LSP
+ * registry (Phase 3.2 — first plugin component actually wired to the agent).
+ *
+ * A plugin declares extra language servers via `.lsp.json`; this bridges those
+ * declarations into `lsp-server-registry.registerLanguageServer`, so the Phase 2
+ * `code_intelligence` agent tool and `cc code-intel` command transparently gain
+ * definition/references/diagnostics for the plugin's language — no core change
+ * per new language.
+ *
+ * Idempotent + memoized per project root: the first LSP query (agent or CLI)
+ * triggers a one-time scan of the user/project/local plugin scopes.
+ */
+
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+import { registerLanguageServer } from "../lsp/lsp-server-registry.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+const _loadedRoots = new Set();
+
+/**
+ * Register every installed plugin's LSP servers for `cwd` (once per root).
+ * Never throws — a broken plugin manifest must not break code navigation.
+ *
+ * @param {object} [opts] { cwd, scopes, force }
+ * @returns {{ registered: Array<{plugin, languageId, id}> }}
+ */
+export function ensurePluginLspServers(opts = {}) {
+  const cwd = path.resolve(opts.cwd || process.cwd());
+  if (_loadedRoots.has(cwd) && !opts.force) return { registered: [] };
+  _loadedRoots.add(cwd);
+
+  const registered = [];
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd, scopes: opts.scopes });
+  } catch {
+    return { registered };
+  }
+
+  // An LSP server spawns a binary — gate it behind trust. Untrusted project
+  // plugins (e.g. from a cloned repo) don't get to launch processes silently.
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped
+      .filter((p) => (p.manifest?.components?.lsp || []).length > 0)
+      .map((p) => p.name),
+    "language servers",
+  );
+
+  for (const p of trusted) {
+    const servers = p.manifest?.components?.lsp || [];
+    for (const s of servers) {
+      try {
+        registerLanguageServer({
+          languageId: s.languageId,
+          command: s.command,
+          args: s.args,
+          extensions: s.extensions,
+          id: s.id,
+        });
+        registered.push({ plugin: p.name, languageId: s.languageId, id: s.id });
+      } catch {
+        // skip a malformed server entry; other plugins still load
+      }
+    }
+  }
+  return { registered };
+}
+
+/** Test hook: forget which roots have been scanned so a re-scan can run. */
+export function _resetPluginLspLoadState() {
+  _loadedRoots.clear();
+}