chainlesschain 0.162.148 → 0.162.150

package/src/runtime/headless-runner.js

@@ -26,6 +26,7 @@ import {
   agentLoop as coreAgentLoop,
   formatToolArgs,
   killAllBackgroundShellTasks,
+  killAllBackgroundShellTasksSync,
 } from "./agent-core.js";
 import {
   resolveAgentMcp,
@@ -315,9 +316,14 @@ export async function runAgentHeadless(options = {}, deps = {}) {
       const { loadHooks, projectHookTrustNotice } =
         await import("../lib/settings-hooks.cjs");
       const loaded = loadHooks({ cwd, settingsFile: options.settingsFile });
+      // Fold in installed plugins' hooks/hooks.json (Phase 3.3c) — plugins ADD
+      // to the user's settings hooks, never replace them.
+      const { mergePluginHooks } =
+        await import("../lib/plugin-runtime/hooks.js");
+      const effectiveHooks = mergePluginHooks(loaded.hooks, { cwd });
       settingsHooks =
-        loaded.hooks && Object.keys(loaded.hooks).length > 0
-          ? loaded.hooks
+        effectiveHooks && Object.keys(effectiveHooks).length > 0
+          ? effectiveHooks
           : null;
       // First-run trust notice for an untrusted/cloned repo's shell-running
       // hooks (Claude-Code 2.1.195 parity). Best-effort, stderr-only.
@@ -335,6 +341,26 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // Put trusted plugins' bin/ executables on PATH for this headless run (Phase
+  // 3.3n) so run_shell can invoke them by name. Trust-gated. The process exits
+  // at the end of the run, so no explicit restore is needed.
+  try {
+    const { applyPluginBinPath } = await import("../lib/plugin-runtime/bin.js");
+    applyPluginBinPath({ cwd });
+  } catch {
+    /* best-effort — plugin bin PATH never blocks a headless run */
+  }
+
+  // Apply trusted plugins' default env vars for this run (Phase 3.3o) — only for
+  // keys not already set; the process exits at the end so no restore is needed.
+  try {
+    const { applyPluginSettingsEnv } =
+      await import("../lib/plugin-runtime/settings.js");
+    applyPluginSettingsEnv({ cwd });
+  } catch {
+    /* best-effort — plugin settings never block a headless run */
+  }
+
   // autoMode.classifyAllShell (Claude-Code 2.1.193): route the built-in
   // verification allowlist through the shell-policy classifier instead of
   // fast-pathing it. Explicit option wins; otherwise read settings.json.
@@ -668,6 +694,31 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // settings.json SessionResume hooks: fire when a persisted session's prior
+  // history is actually being replayed (--resume / --continue with real
+  // history), distinct from SessionStart (which also fires on a fresh startup).
+  // A SessionResume hook can react to "we're picking an existing conversation
+  // back up" — e.g. re-run a workspace sanity check. Observe-only, best-effort.
+  if (settingsHooks && resumeId && history.length > 0) {
+    try {
+      const { runObserveHooks } =
+        await import("../lib/settings-hook-events.cjs");
+      runObserveHooks(
+        settingsHooks,
+        "SessionResume",
+        {
+          session_id: sessionId,
+          resumed_from: resumeId,
+          history_messages: history.length,
+          cwd,
+        },
+        { cwd },
+      );
+    } catch (_err) {
+      // observe-only
+    }
+  }
+
   // --image <path>: attach vision input to the user turn. buildUserContent
   // returns the plain string when there are no images, so text-only runs are
   // byte-for-byte unchanged; with images it builds an OpenAI-style multimodal
@@ -810,9 +861,40 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // --otlp <file>: attach an OpenTelemetry recorder so the real agent loop's
+  // model/tool/retry spans are captured and exported as OTLP/JSON on exit.
+  // Off by default (zero cost) — only built when a path is requested.
+  let _otlpRecorder = null;
+  if (options.otlp) {
+    try {
+      const { TelemetryRecorder } =
+        await import("../lib/telemetry/span-recorder.js");
+      _otlpRecorder = new TelemetryRecorder({ serviceName: "cc-agent" });
+    } catch {
+      _otlpRecorder = null; // telemetry is best-effort, never blocks the run
+    }
+  }
+
+  // Async-hook supervisor for headless: without one, `async:true` hooks
+  // (PostToolUse / Stop) were silently skipped in `cc agent -p` (they only ran
+  // in the REPL). Create one when settings hooks are present so background
+  // checks run + get reaped here too. Fire-and-forget; drained after the loop.
+  let _hookSupervisor = null;
+  if (settingsHooks) {
+    try {
+      const { AsyncHookSupervisor } =
+        await import("../lib/async-hook-supervisor.cjs");
+      _hookSupervisor = new AsyncHookSupervisor();
+    } catch {
+      _hookSupervisor = null; // async hooks are best-effort
+    }
+  }
+
   const loopOptions = {
     model,
     provider,
+    recorder: _otlpRecorder,
+    hookSupervisor: _hookSupervisor,
     // Extended thinking (Anthropic; opt-in via --think/--ultrathink). null/off
     // → chatWithTools sends no thinking field. thinkingBudget (--thinking-budget)
     // is the legacy-model budget_tokens override; ignored when thinking is off.
@@ -824,6 +906,11 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     additionalDirectories,
     sandbox: options.sandbox || null,
     sessionId,
+    // Auto-pin (OPT-IN, off by default): pin the original task through
+    // compaction. Enable via --auto-pin or CC_AUTO_PIN=1. Falsy → agent-core
+    // passes no pin predicate and compaction is byte-identical.
+    autoPin:
+      options.autoPin === true || process.env.CC_AUTO_PIN === "1" || undefined,
     autoCheckpoint: options.autoCheckpoint || false,
     checkpointSession: options.checkpointSession || sessionId,
     hookDb: db,
@@ -950,126 +1037,248 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     goal_id: boundGoalId,
   });
 
+  // --auto-rewake: after a turn finishes, run the async Stop hooks and, if an
+  // `asyncRewake` check FAILED, append its report as a new user turn and re-run
+  // the agent to fix it — bounded by `maxRewakes` (default 1). OPT-IN: when off
+  // (the default), rewakeBudget is 0 and the loop below runs exactly once, so
+  // one-shot `cc agent -p` behavior is byte-for-byte unchanged and no script is
+  // surprised by a silent re-run. `_asyncStopHandled` tells the finally the
+  // async Stop hooks already fired here so they aren't fired twice.
+  const autoRewake = options.autoRewake === true;
+  let rewakeBudget = autoRewake
+    ? Number.isFinite(options.maxRewakes)
+      ? options.maxRewakes
+      : 1
+    : 0;
+  let _asyncStopHandled = false;
+  const _settleAsyncStop = async () => {
+    if (!settingsHooks || !_hookSupervisor) return { rewakes: [], results: [] };
+    const { dispatchAsyncHooks } =
+      await import("../lib/settings-hook-events.cjs");
+    dispatchAsyncHooks(
+      settingsHooks,
+      "Stop",
+      { reason: endReason, cwd, session_id: sessionId },
+      { cwd, supervisor: _hookSupervisor },
+    );
+    const waitMs = Number.isFinite(options.asyncHookWaitMs)
+      ? options.asyncHookWaitMs
+      : 5000;
+    const started = Date.now();
+    while (
+      _hookSupervisor.runningCount() > 0 &&
+      Date.now() - started < waitMs
+    ) {
+      await new Promise((r) => setTimeout(r, 50));
+    }
+    return {
+      rewakes: _hookSupervisor.drainRewakes(),
+      results: _hookSupervisor.drainResults(),
+    };
+  };
+
+  // A Ctrl-C (SIGINT) / SIGTERM terminates Node WITHOUT unwinding the `finally`
+  // below, so its background-task reaper is bypassed — a backgrounded run_shell
+  // task (e.g. a dev server) this run spawned would be orphaned. Install a
+  // scoped handler that reaps it synchronously + stops the async-hook
+  // supervisor, then exits with the conventional 128+signal code. Headless has
+  // no other SIGINT owner (no raw-mode keypress like the REPL), so this can't
+  // race a competing handler. Removed in `finally` so a normal return leaves no
+  // listener behind (runAgentHeadless can be called repeatedly in one process).
+  const _onHardSignal = (sig) => {
+    try {
+      killAllBackgroundShellTasksSync();
+    } catch {
+      /* best-effort — never let cleanup throw during shutdown */
+    }
+    try {
+      if (_hookSupervisor) _hookSupervisor.stopAll();
+    } catch {
+      /* best-effort */
+    }
+    process.exit(sig === "SIGTERM" ? 143 : 130);
+  };
+  process.once("SIGINT", _onHardSignal);
+  process.once("SIGTERM", _onHardSignal);
+
   try {
-    for await (const event of runLoop(messages, loopOptions)) {
-      switch (event.type) {
-        case "checkpoint": {
-          if (isText)
-            writeErr(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`);
-          emitStream({ type: "checkpoint", id: event.id, tool: event.tool });
-          break;
-        }
-        case "tool-executing": {
-          const line = `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}`;
-          if (isText) writeErr(line + "\n");
-          emitStream({
-            type: "tool_use",
-            tool: event.tool,
-            args: event.args,
-          });
-          toolCalls.push({ tool: event.tool, args: event.args });
-          break;
-        }
-        case "tool-result": {
-          const err = event.error || event.result?.error || null;
-          if (isText && err) writeErr(`  Error: ${err}\n`);
-          emitStream({
-            type: "tool_result",
-            tool: event.tool,
-            is_error: Boolean(err),
-            error: err,
-            result: event.result,
-          });
-          if (toolCalls.length > 0) {
-            toolCalls[toolCalls.length - 1].is_error = Boolean(err);
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+      for await (const event of runLoop(messages, loopOptions)) {
+        switch (event.type) {
+          case "checkpoint": {
+            if (isText)
+              writeErr(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`);
+            emitStream({ type: "checkpoint", id: event.id, tool: event.tool });
+            break;
           }
-          // Track policy denials (not plain tool failures) for the end-of-run
-          // summary. The preceding tool-executing pushed the args.
-          if (err) {
-            const last = toolCalls[toolCalls.length - 1];
-            const denial = classifyDenial({
+          case "tool-executing": {
+            const line = `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}`;
+            if (isText) writeErr(line + "\n");
+            emitStream({
+              type: "tool_use",
               tool: event.tool,
+              args: event.args,
+            });
+            toolCalls.push({ tool: event.tool, args: event.args });
+            break;
+          }
+          case "tool-result": {
+            const err = event.error || event.result?.error || null;
+            if (isText && err) writeErr(`  Error: ${err}\n`);
+            emitStream({
+              type: "tool_result",
+              tool: event.tool,
+              is_error: Boolean(err),
+              error: err,
               result: event.result,
-              error: event.error,
-              argsSummary:
-                last && last.tool === event.tool
-                  ? formatToolArgs(event.tool, last.args)
-                  : "",
             });
-            if (denial) {
-              recordDenial(denials, {
-                ...denial,
-                at: deps.now ? deps.now() : Date.now(),
+            if (toolCalls.length > 0) {
+              toolCalls[toolCalls.length - 1].is_error = Boolean(err);
+            }
+            // Track policy denials (not plain tool failures) for the end-of-run
+            // summary. The preceding tool-executing pushed the args.
+            if (err) {
+              const last = toolCalls[toolCalls.length - 1];
+              const denial = classifyDenial({
+                tool: event.tool,
+                result: event.result,
+                error: event.error,
+                argsSummary:
+                  last && last.tool === event.tool
+                    ? formatToolArgs(event.tool, last.args)
+                    : "",
               });
+              if (denial) {
+                recordDenial(denials, {
+                  ...denial,
+                  at: deps.now ? deps.now() : Date.now(),
+                });
+              }
             }
+            break;
           }
-          break;
-        }
-        case "token-usage": {
-          usage.input_tokens += event.usage?.input_tokens || 0;
-          usage.output_tokens += event.usage?.output_tokens || 0;
-          // Carry prompt-cache tokens into accumulated usage (cost accuracy).
-          usage.cache_read_input_tokens +=
-            event.usage?.cache_read_input_tokens || 0;
-          usage.cache_creation_input_tokens +=
-            event.usage?.cache_creation_input_tokens || 0;
-          emitStream({ type: "token_usage", usage: event.usage });
-          if (costBudget) {
-            costBudget.add({
-              provider: event.provider,
-              model: event.model,
-              usage: event.usage,
-            });
-            if (costBudget.shouldWarnInactive()) {
-              const m = `cost cap $${options.maxCostUsd} set but model "${event.model}" is unpriced/free — cap inactive`;
-              if (isText) writeErr(`  ${m}\n`);
-              emitStream({ type: "cost_warning", message: m });
-            }
-            if (costBudget.exceeded()) {
-              endReason = "cost-budget-exhausted";
-              stopForCost = true;
-              if (isText)
-                writeErr(
-                  `  ⛔ cost budget $${options.maxCostUsd} reached (spent ≈$${costBudget.spentUsd}) — stopping\n`,
-                );
-              emitStream({
-                type: "cost_budget_exhausted",
-                limit_usd: options.maxCostUsd,
-                spent_usd: costBudget.spentUsd,
+          case "token-usage": {
+            usage.input_tokens += event.usage?.input_tokens || 0;
+            usage.output_tokens += event.usage?.output_tokens || 0;
+            // Carry prompt-cache tokens into accumulated usage (cost accuracy).
+            usage.cache_read_input_tokens +=
+              event.usage?.cache_read_input_tokens || 0;
+            usage.cache_creation_input_tokens +=
+              event.usage?.cache_creation_input_tokens || 0;
+            emitStream({ type: "token_usage", usage: event.usage });
+            if (costBudget) {
+              costBudget.add({
+                provider: event.provider,
+                model: event.model,
+                usage: event.usage,
               });
+              if (costBudget.shouldWarnInactive()) {
+                const m = `cost cap $${options.maxCostUsd} set but model "${event.model}" is unpriced/free — cap inactive`;
+                if (isText) writeErr(`  ${m}\n`);
+                emitStream({ type: "cost_warning", message: m });
+              }
+              if (costBudget.exceeded()) {
+                endReason = "cost-budget-exhausted";
+                stopForCost = true;
+                if (isText)
+                  writeErr(
+                    `  ⛔ cost budget $${options.maxCostUsd} reached (spent ≈$${costBudget.spentUsd}) — stopping\n`,
+                  );
+                emitStream({
+                  type: "cost_budget_exhausted",
+                  limit_usd: options.maxCostUsd,
+                  spent_usd: costBudget.spentUsd,
+                });
+              }
             }
+            break;
+          }
+          case "iteration-warning": {
+            if (isText) writeErr(`  ${event.message}\n`);
+            emitStream({ type: "iteration_warning", message: event.message });
+            break;
+          }
+          case "iteration-budget-exhausted": {
+            endReason = "max_turns";
+            emitStream({
+              type: "iteration_budget_exhausted",
+              budget: event.budget,
+            });
+            break;
+          }
+          case "response-complete": {
+            finalText = event.content || "";
+            break;
+          }
+          case "run-ended": {
+            if (event.reason) endReason = event.reason;
+            break;
           }
-          break;
+          default:
+            // slot-filling, run-started, etc. — surfaced only in stream mode.
+            if (isStream && event.type) emitStream(event);
+            break;
         }
-        case "iteration-warning": {
-          if (isText) writeErr(`  ${event.message}\n`);
-          emitStream({ type: "iteration_warning", message: event.message });
-          break;
+        // Hard cost cap reached: stop consuming the loop so no further paid LLM
+        // call is made (break out of the for-await, not just the switch).
+        if (stopForCost) break;
+      }
+      // ── auto-rewake re-drive (opt-in via --auto-rewake) ─────────────────
+      // Under auto-rewake, settle the async Stop hooks after EVERY turn (so the
+      // final turn's background check still runs). If an asyncRewake check
+      // failed and re-drive budget remains, append its report as a new user
+      // turn and loop; if a rewake failed but budget is spent, surface it and
+      // stop. When auto-rewake is off, this whole block is skipped and the
+      // `finally` handles Stop exactly as before (default behavior unchanged).
+      if (
+        autoRewake &&
+        _hookSupervisor &&
+        !stopForCost &&
+        endReason !== "max_turns" &&
+        endReason !== "cost-budget-exhausted"
+      ) {
+        const { rewakes, results } = await _settleAsyncStop();
+        _asyncStopHandled = true;
+        for (const rs of results) {
+          if (rs.additionalContext)
+            writeErr(`[async-hook] ${rs.command}: ${rs.additionalContext}\n`);
         }
-        case "iteration-budget-exhausted": {
-          endReason = "max_turns";
-          emitStream({
-            type: "iteration_budget_exhausted",
-            budget: event.budget,
+        if (rewakes.length > 0 && rewakeBudget > 0) {
+          rewakeBudget--;
+          const detail = rewakes
+            .map(
+              (rw) =>
+                `- ${rw.command} failed` +
+                `${rw.exitCode != null ? ` (exit ${rw.exitCode})` : ""}` +
+                `${rw.error ? `: ${rw.error}` : ""}`,
+            )
+            .join("\n");
+          messages.push({
+            role: "user",
+            content:
+              `A background check flagged a problem after your last turn:\n${detail}\n` +
+              `Investigate and fix it, then confirm it passes.`,
           });
-          break;
-        }
-        case "response-complete": {
-          finalText = event.content || "";
-          break;
+          if (isText)
+            writeErr(
+              `  ↻ async-hook rewake — re-engaging agent (${rewakeBudget} re-drive(s) left)\n`,
+            );
+          emitStream({ type: "rewake", remaining: rewakeBudget });
+          finalText = "";
+          endReason = "complete";
+          continue; // re-drive: run another agent turn
         }
-        case "run-ended": {
-          if (event.reason) endReason = event.reason;
-          break;
+        // A rewake fired but no budget remains — surface it (couldn't auto-fix).
+        for (const rw of rewakes) {
+          writeErr(
+            `[async-hook REWAKE] ${rw.command} failed` +
+              `${rw.exitCode != null ? ` (exit ${rw.exitCode})` : ""}` +
+              `${rw.error ? `: ${rw.error}` : ""}\n`,
+          );
         }
-        default:
-          // slot-filling, run-started, etc. — surfaced only in stream mode.
-          if (isStream && event.type) emitStream(event);
-          break;
       }
-      // Hard cost cap reached: stop consuming the loop so no further paid LLM
-      // call is made (break out of the for-await, not just the switch).
-      if (stopForCost) break;
+      break;
     }
   } catch (err) {
     const message = err?.message || String(err);
@@ -1101,6 +1310,11 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
     return { exitCode: 1, result: message, isError: true };
   } finally {
+    // Drop the signal handlers first — a normal return must not leave a
+    // process-wide SIGINT/SIGTERM listener behind (a later Ctrl-C would wrongly
+    // exit with 130, and repeated in-process runs would leak listeners).
+    process.removeListener("SIGINT", _onHardSignal);
+    process.removeListener("SIGTERM", _onHardSignal);
     // Tear down ad-hoc MCP servers (--mcp-config) before returning, whether the
     // loop completed or threw. Best-effort: a failed disconnect never masks the
     // run's own outcome.
@@ -1118,11 +1332,56 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     } catch {
       // best-effort — never mask the run's own outcome
     }
-    // settings.json SessionEnd hooks (observe-only) when the run finishes.
+    // settings.json Stop + SessionEnd hooks when the run finishes. Stop is the
+    // canonical async-hook trigger ("run the test suite at turn end"); fire its
+    // async hooks fire-and-forget, then settle so a fast background check can
+    // report back within this one-shot run.
     if (settingsHooks) {
       try {
-        const { runObserveHooks } =
+        const { runObserveHooks, dispatchAsyncHooks } =
           await import("../lib/settings-hook-events.cjs");
+        const stopPayload = { reason: endReason, cwd, session_id: sessionId };
+        runObserveHooks(settingsHooks, "Stop", stopPayload, { cwd });
+        // Skip the async Stop dispatch/settle here if the auto-rewake re-drive
+        // loop already fired + drained it this run (avoids double-execution).
+        if (_hookSupervisor && !_asyncStopHandled) {
+          dispatchAsyncHooks(settingsHooks, "Stop", stopPayload, {
+            cwd,
+            supervisor: _hookSupervisor,
+          });
+          // Bounded settle: wait for in-flight async hooks (Stop + any
+          // PostToolUse dispatched during the loop) to finish, capped so a
+          // slow/hung check can never stall the run. Default 5s; tunable.
+          const waitMs = Number.isFinite(options.asyncHookWaitMs)
+            ? options.asyncHookWaitMs
+            : 5000;
+          const started = Date.now();
+          while (
+            _hookSupervisor.runningCount() > 0 &&
+            Date.now() - started < waitMs
+          ) {
+            await new Promise((r) => setTimeout(r, 50));
+          }
+          // Surface any results/rewakes out-of-band on stderr (never touches the
+          // stdout envelope). A rewake means a background check FAILED and would
+          // re-engage the agent in an interactive session — flag it clearly so a
+          // headless caller/CI can react.
+          for (const rw of _hookSupervisor.drainRewakes()) {
+            writeErr(
+              `[async-hook REWAKE] ${rw.command} failed` +
+                `${rw.exitCode != null ? ` (exit ${rw.exitCode})` : ""}` +
+                `${rw.error ? `: ${rw.error}` : ""}\n`,
+            );
+          }
+          for (const rs of _hookSupervisor.drainResults()) {
+            if (rs.additionalContext) {
+              writeErr(`[async-hook] ${rs.command}: ${rs.additionalContext}\n`);
+            }
+          }
+        }
+        // Always reap the supervisor (kills any straggler child + detaches the
+        // exit reaper), whether the async Stop was handled here or in re-drive.
+        if (_hookSupervisor) _hookSupervisor.stopAll();
         runObserveHooks(
           settingsHooks,
           "SessionEnd",
@@ -1130,7 +1389,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           { cwd },
         );
       } catch {
-        // observe-only
+        // observe-only + best-effort async surfacing
       }
     }
   }
@@ -1259,6 +1518,27 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     writeOut(finalText + (finalText.endsWith("\n") ? "" : "\n"));
   }
 
+  // --otlp: write the captured spans/counters as OTLP/JSON. Best-effort — a
+  // write failure logs to stderr but never changes the run's exit code.
+  if (_otlpRecorder && options.otlp) {
+    try {
+      const fsp = await import("node:fs");
+      fsp.writeFileSync(
+        options.otlp,
+        JSON.stringify(_otlpRecorder.toOtlp(), null, 2),
+        "utf-8",
+      );
+      if (!isStream) {
+        const sum = _otlpRecorder.summary();
+        process.stderr.write(
+          `[otlp] ${sum.spanCount} span(s) → ${options.otlp}\n`,
+        );
+      }
+    } catch (err) {
+      process.stderr.write(`[otlp] export failed: ${err.message}\n`);
+    }
+  }
+
   return { exitCode: isError ? 1 : 0, result: finalText, isError };
 }
 

package/src/runtime/mcp-config.js

@@ -33,6 +33,7 @@ import {
   jetbrainsServerToMcpConfig,
   isInJetbrainsContext,
 } from "../lib/jetbrains-bridge.js";
+import { collectPluginMcpServers } from "../lib/plugin-runtime/mcp.js";
 
 /**
  * Normalize a parsed config object into a `{ name: serverConfig }` map.
@@ -644,6 +645,39 @@ export async function loadProjectMcp(opts = {}, deps = {}) {
   return setupMcpFromConfig(servers, deps);
 }
 
+/**
+ * Load MCP servers declared by installed plugins' `.mcp.json` (Phase 3.3g —
+ * plugin MCP component reaches the agent's tool surface).
+ *
+ * Unlike a project `.mcp.json` (opt-in via --project-mcp because ANY cloned repo
+ * can carry one), plugin MCP servers load by default: installing AND trusting a
+ * plugin IS the explicit user action. `collectPluginMcpServers` already trust-
+ * gates — only user/local-scope plugins and `cc plugin trust`-ed project plugins
+ * contribute — so a server never spawns from an untrusted cloned-repo plugin.
+ *
+ * Chains onto `deps.into` after the registered + project servers, so those win
+ * on a name clash (the plugin ADDS servers without overriding the user's own).
+ *
+ * @param {object} opts { cwd, scopes }
+ * @param {object} [deps] { collect, writeErr, into, ... setupMcpFromConfig deps }
+ */
+export async function loadPluginMcp(opts = {}, deps = {}) {
+  const collect = deps.collect || collectPluginMcpServers;
+  const writeErr = deps.writeErr || (() => {});
+  let servers = {};
+  try {
+    ({ servers } = collect({ cwd: opts.cwd, scopes: opts.scopes }));
+  } catch {
+    return deps.into || null;
+  }
+  const names = Object.keys(servers || {});
+  if (names.length === 0) return deps.into || null;
+  writeErr(
+    `  mcp: ${names.length} server(s) from trusted plugin(s): ${names.join(", ")}\n`,
+  );
+  return setupMcpFromConfig(servers, deps);
+}
+
 /**
  * Resolve the full MCP tool surface for one agent run: the ad-hoc
  * `--mcp-config` file (if any) PLUS registered auto-connect servers (unless
@@ -665,6 +699,7 @@ export async function resolveAgentMcp(args = {}, deps = {}) {
   const doFile = deps.loadMcpConfig || loadMcpConfig;
   const doReg = deps.loadRegisteredMcp || loadRegisteredMcp;
   const doProject = deps.loadProjectMcp || loadProjectMcp;
+  const doPlugin = deps.loadPluginMcp || loadPluginMcp;
   const doIde = deps.loadIdeMcp || loadIdeMcp;
   const doPdh = deps.loadPdhMcp || loadPdhMcp;
   const doJetbrains = deps.loadJetbrainsMcp || loadJetbrainsMcp;
@@ -712,6 +747,17 @@ export async function resolveAgentMcp(args = {}, deps = {}) {
       { ...fwd, into: result || undefined },
     );
   }
+  // Installed-plugin `.mcp.json` servers (Claude-Code parity). Loads by default
+  // (no opt-in flag): unlike a project `.mcp.json`, a plugin only contributes
+  // when it is installed AND trusted (trust-gated inside collectPluginMcpServers)
+  // — that install+trust IS the explicit consent. Registered + project servers
+  // above win on a name clash. `pluginMcp:false` hard-skips it.
+  if (args.pluginMcp !== false) {
+    result = await doPlugin(
+      { cwd: args.cwd, scopes: args.pluginScopes },
+      { ...fwd, into: result || undefined },
+    );
+  }
   if (args.ide !== false) {
     const env = args.env || process.env;
     const inIde = (deps.isInIdeTerminal || isInIdeTerminal)(env);

package/src/assets/web-panel/assets/ChatBubbleRenderer-DCNfbdlx.js

@@ -1 +0,0 @@
-import{I as v,P as u,J as y,U as n,R as a,S,K as C,Q as w,V as x,_ as B,b as s}from"./vendor-BMxUs6UX.js";import{_ as k}from"./index-BtbbdLnf.js";import"./icons-BsDmGpcT.js";const N={__name:"ChatBubbleRenderer",props:{event:{type:Object,required:!0}},setup(c,{expose:d}){d();const t=c,r=s(()=>{const e=t.event.content||{};return e.text||e.body||e.message||e.title||JSON.stringify(e).slice(0,200)}),i=s(()=>{const e=t.event.content||{};return e.from||e.sender||e.senderName||t.event.actor||"(unknown)"}),l=s(()=>{const e=(t.event.actor||"").toLowerCase();return e.includes("self")||e==="me"||e.endsWith("_self")}),o=s(()=>{const e=t.event.source.adapter||"";return e.startsWith("messaging-qq")?"magenta":e==="wechat"?"green":"blue"}),m=s(()=>{if(!t.event.occurredAt)return"";try{const e=new Date(t.event.occurredAt),p=e.getFullYear(),b=String(e.getMonth()+1).padStart(2,"0"),f=String(e.getDate()).padStart(2,"0"),g=String(e.getHours()).padStart(2,"0"),h=String(e.getMinutes()).padStart(2,"0");return`${p}-${b}-${f} ${g}:${h}`}catch{return""}}),_={props:t,messageText:r,actorLabel:i,isMine:l,adapterColor:o,formattedTime:m,computed:s};return Object.defineProperty(_,"__isScriptSetup",{enumerable:!1,value:!0}),_}},T={class:"bubble"},M={class:"meta"},R={class:"actor"},V={class:"time"},q={class:"body"};function D(c,d,t,r,i,l){const o=v("a-tag");return u(),y("div",{class:B(["chat-row",{mine:r.isMine}])},[n("div",T,[n("div",M,[n("span",R,a(r.actorLabel),1),n("span",V,a(r.formattedTime),1)]),n("div",q,a(r.messageText),1),t.event.source.adapter?(u(),S(o,{key:0,class:"src",color:r.adapterColor},{default:C(()=>[w(a(t.event.source.adapter),1)]),_:1},8,["color"])):x("v-if",!0)])],2)}const A=k(N,[["render",D],["__scopeId","data-v-49238629"],["__file","/tmp/cc-web-panel-w66Hyb/repo/packages/web-panel/src/components/pdh/renderers/ChatBubbleRenderer.vue"]]);export{A as default};