chainlesschain 0.162.176 → 0.162.177

package/src/lib/hook-runner.cjs

@@ -17,10 +17,9 @@
  *                               agent — only an explicit block decision blocks).
  *
  * Returns a normalized `{ decision, reason, exitCode, stdout, stderr, ... }`.
- * `_deps.spawnSync` is injected for unit tests (no real process needed).
+ * Process runners are injected for unit tests and by the ESM Broker facade.
  */
 
-const cpDefault = require("node:child_process");
 const {
   normalizeShellKind,
   buildPowershellArgv,
@@ -28,7 +27,27 @@ const {
 } = require("./shell-selector.cjs");
 const { mergeHookDecisions } = require("./hook-event-bus.cjs");
 
-const _deps = { spawnSync: cpDefault.spawnSync, spawn: cpDefault.spawn };
+const _deps = { runSync: null, run: null };
+Object.defineProperties(_deps, {
+  spawnSync: {
+    enumerable: true,
+    get() {
+      return this.runSync;
+    },
+    set(value) {
+      this.runSync = value;
+    },
+  },
+  spawn: {
+    enumerable: true,
+    get() {
+      return this.run;
+    },
+    set(value) {
+      this.run = value;
+    },
+  },
+});
 
 const HOOK_DECISIONS = Object.freeze({
   BLOCK: "block",
@@ -232,20 +251,29 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
         CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
       },
     };
-    const brokerOptions = {
+    const processOptions = {
       ...common,
       origin: opts.origin || "hook",
-      policy: opts.origin === "plugin:hook" ? "allow" : undefined,
+      policy: "allow",
+      scope: "hook",
       pluginId: opts.pluginId || null,
       pluginVersion: opts.pluginVersion || null,
       pluginSource: opts.pluginSource || null,
     };
-    if (opts.broker && opts.origin === "plugin:hook") {
-      res = opts.broker.spawnSync(
-        usePowershell ? buildPowershellArgv(command, shellKind, { executionPolicy: loadShellConfig({ cwd: common.cwd }).executionPolicy }).file : command,
-        usePowershell ? buildPowershellArgv(command, shellKind, { executionPolicy: loadShellConfig({ cwd: common.cwd }).executionPolicy }).argv : [],
-        brokerOptions,
-      );
+    const brokerRunSync =
+      opts.broker &&
+      opts.origin === "plugin:hook" &&
+      typeof opts.broker["spawnSync"] === "function"
+        ? opts.broker["spawnSync"].bind(opts.broker)
+        : null;
+    if (brokerRunSync) {
+      const invocation = usePowershell
+        ? buildPowershellArgv(command, shellKind, {
+            executionPolicy: loadShellConfig({ cwd: common.cwd })
+              .executionPolicy,
+          })
+        : { file: command, argv: [] };
+      res = brokerRunSync(invocation.file, invocation.argv, processOptions);
     } else if (usePowershell) {
       // Per-hook `shell: powershell|pwsh` (settings hook entry): explicit argv
       // instead of the default shell; the enterprise ExecutionPolicy override
@@ -254,9 +282,15 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
         cwd: common.cwd,
       });
       const inv = buildPowershellArgv(command, shellKind, { executionPolicy });
-      res = _deps.spawnSync(inv.file, inv.argv, common);
+      if (typeof _deps.runSync !== "function") {
+        throw new Error("hook process runner unavailable");
+      }
+      res = _deps.runSync(inv.file, inv.argv, processOptions);
     } else {
-      res = _deps.spawnSync(command, { ...common, shell: true });
+      if (typeof _deps.runSync !== "function") {
+        throw new Error("hook process runner unavailable");
+      }
+      res = _deps.runSync(command, { ...processOptions, shell: true });
     }
   } catch (err) {
     return {
@@ -360,36 +394,37 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
     ...process.env,
     CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
   };
+  const processOptions = {
+    cwd: wd,
+    env: spawnEnv,
+    origin: opts.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+    pluginId: opts.pluginId || null,
+    pluginVersion: opts.pluginVersion || null,
+    pluginSource: opts.pluginSource || null,
+  };
 
   let child;
   try {
+    const brokerRun =
+      opts.broker &&
+      opts.origin === "plugin:hook" &&
+      typeof opts.broker["spawn"] === "function"
+        ? opts.broker["spawn"].bind(opts.broker)
+        : null;
+    const run = brokerRun || _deps.run;
+    if (typeof run !== "function") {
+      throw new Error("hook process runner unavailable");
+    }
     if (usePowershell) {
       const { executionPolicy } = loadShellConfig({ cwd: wd });
       const inv = buildPowershellArgv(command, shellKind, { executionPolicy });
-      child = opts.broker && opts.origin === "plugin:hook"
-        ? opts.broker.spawn(inv.file, inv.argv, {
-            cwd: wd,
-            env: spawnEnv,
-            origin: opts.origin,
-            policy: "allow",
-            pluginId: opts.pluginId || null,
-            pluginVersion: opts.pluginVersion || null,
-            pluginSource: opts.pluginSource || null,
-          })
-        : _deps.spawn(inv.file, inv.argv, { cwd: wd, env: spawnEnv });
+      child = run(inv.file, inv.argv, processOptions);
     } else {
-      child = opts.broker && opts.origin === "plugin:hook"
-        ? opts.broker.spawn(command, [], {
-            cwd: wd,
-            env: spawnEnv,
-            shell: true,
-            origin: opts.origin,
-            policy: "allow",
-            pluginId: opts.pluginId || null,
-            pluginVersion: opts.pluginVersion || null,
-            pluginSource: opts.pluginSource || null,
-          })
-        : _deps.spawn(command, { cwd: wd, env: spawnEnv, shell: true });
+      child = brokerRun
+        ? run(command, [], { ...processOptions, shell: true })
+        : run(command, { ...processOptions, shell: true });
     }
   } catch (err) {
     return {

package/src/lib/hook-runner.js

@@ -0,0 +1,55 @@
+import runner from "./hook-runner.cjs";
+import executionBroker from "./process-execution-broker/index.js";
+
+const brokerRunner = executionBroker.spawn.bind(executionBroker);
+const brokerSyncRunner = executionBroker.spawnSync.bind(executionBroker);
+
+export const _processDeps = {
+  run: brokerRunner,
+  runSync: brokerSyncRunner,
+};
+
+function normalizeInvocation(argsOrOptions, maybeOptions) {
+  return Array.isArray(argsOrOptions)
+    ? { args: argsOrOptions, options: maybeOptions || {} }
+    : { args: [], options: argsOrOptions || {} };
+}
+
+function runHookProcess(file, argsOrOptions, maybeOptions) {
+  const { args, options } = normalizeInvocation(argsOrOptions, maybeOptions);
+  return _processDeps.run(file, args, {
+    ...options,
+    origin: options.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+  });
+}
+
+function runHookProcessSync(file, argsOrOptions, maybeOptions) {
+  const { args, options } = normalizeInvocation(argsOrOptions, maybeOptions);
+  return _processDeps.runSync(file, args, {
+    ...options,
+    origin: options.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+  });
+}
+
+runner._deps.run = runHookProcess;
+runner._deps.runSync = runHookProcessSync;
+
+export const {
+  runCommandHook,
+  runCommandHookAsync,
+  runHooks,
+  runHooksParallel,
+  interpretHookOutcome,
+  tryParseDecision,
+  HOOK_DECISIONS,
+  HOOK_PAYLOAD_SCHEMA_VERSION,
+  hookBreakerConfig,
+  _resetHookBreaker,
+  _deps,
+} = runner;
+
+export default runner;

package/src/lib/host-adb-bridge.js

@@ -31,10 +31,20 @@
  *     `\n` / EOS — every parse routine strips `\r+$` first.
  */
 
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import executionBroker from "./process-execution-broker/index.js";
 
-const execFileP = promisify(execFile);
+export const _deps = {
+  execFile: (...args) => executionBroker.execFile(...args),
+};
+
+function execFileP(file, args, options) {
+  return new Promise((resolve, reject) => {
+    _deps.execFile(file, args, options, (error, stdout, stderr) => {
+      if (error) reject(error);
+      else resolve({ stdout, stderr });
+    });
+  });
+}
 
 export class HostAdbBridgeUnavailableError extends Error {
   constructor(reason) {
@@ -52,6 +62,10 @@ async function adb(args, opts = {}) {
       timeout: opts.timeoutMs || 30_000,
       maxBuffer: 32 * 1024 * 1024,
       encoding: "utf8",
+      origin: "host-adb:command",
+      policy: "allow",
+      scope: "host-adb",
+      shell: false,
     });
     if (stderr && /error:|failed:|protocol fault/i.test(stderr)) {
       throw new HostAdbBridgeUnavailableError(stderr.trim().split("\n")[0]);
@@ -585,6 +599,7 @@ export function createHostAdbBridge(opts = {}) {
 
 // Exposed for unit testing without spawning real adb.
 export const _internals = {
+  adb,
   parseContentQueryRows,
   mergeContactRows,
   listDevices,

package/src/lib/lsp/__tests__/benchmark.test.js

@@ -8,6 +8,7 @@ import { describe, it, expect } from "vitest";
 import {
   percentile,
   summarize,
+  sampleRssDefault,
   sumSubtreeRss,
   sumSubtreeRssFromWmicCsv,
 } from "../benchmark.js";
@@ -86,3 +87,63 @@ describe("sumSubtreeRssFromWmicCsv", () => {
     expect(sumSubtreeRssFromWmicCsv("garbage\r\n", 100)).toBeNull();
   });
 });
+
+describe("sampleRssDefault", () => {
+  it("routes the POSIX process snapshot through the Broker contract", async () => {
+    const calls = [];
+    const execFileSync = (...args) => {
+      calls.push(args);
+      return "100 1 1024\n200 100 512\n400 1 9999\n";
+    };
+
+    await expect(
+      sampleRssDefault(100, { execFileSync, platform: "linux" }),
+    ).resolves.toBe(2);
+    expect(calls).toEqual([
+      [
+        "ps",
+        ["-o", "pid=,ppid=,rss="],
+        expect.objectContaining({
+          origin: "lsp:benchmark-rss",
+          policy: "allow",
+          scope: "lsp",
+          shell: false,
+        }),
+      ],
+    ]);
+  });
+
+  it("routes the Windows process snapshot through literal argv", async () => {
+    const calls = [];
+    const execFileSync = (...args) => {
+      calls.push(args);
+      return [
+        "Node,ParentProcessId,ProcessId,WorkingSetSize",
+        "HOST,1,100,1048576",
+        "HOST,100,200,1048576",
+      ].join("\r\n");
+    };
+
+    await expect(
+      sampleRssDefault(100, { execFileSync, platform: "win32" }),
+    ).resolves.toBe(2);
+    expect(calls).toEqual([
+      [
+        "wmic",
+        [
+          "process",
+          "get",
+          "ProcessId,ParentProcessId,WorkingSetSize",
+          "/format:csv",
+        ],
+        expect.objectContaining({
+          origin: "lsp:benchmark-rss",
+          policy: "allow",
+          scope: "lsp",
+          shell: false,
+          windowsHide: true,
+        }),
+      ],
+    ]);
+  });
+});

package/src/lib/lsp/__tests__/lsp-client.test.js

@@ -87,7 +87,12 @@ describe("LSPClient handshake", () => {
     expect(_deps.spawn).toHaveBeenCalledWith(
       "fake-lsp",
       ["--stdio"],
-      expect.objectContaining({ shell: false }),
+      expect.objectContaining({
+        origin: "lsp:server",
+        policy: "allow",
+        scope: "lsp",
+        shell: false,
+      }),
     );
   });
 

package/src/lib/lsp/benchmark.js

@@ -12,11 +12,13 @@
  */
 
 import { CodeIntelligence } from "./code-intelligence.js";
+import executionBroker from "../process-execution-broker/index.js";
 
 /** now() in fractional milliseconds — injectable for deterministic tests. */
 export const _deps = {
   now: () => Number(process.hrtime.bigint() / 1000n) / 1000,
   sampleRss: sampleRssDefault,
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
 };
 
 /** p-th percentile (0..100) of an UNSORTED sample via linear interpolation. */
@@ -167,10 +169,12 @@ async function captureServerInfo(ci) {
  * lies. We sum the whole subtree. Returns null if it can't be read (never throws
  * — memory is a bonus metric, not load-bearing).
  */
-async function sampleRssDefault(pid) {
-  const { execFileSync } = await import("child_process");
+export async function sampleRssDefault(
+  pid,
+  { execFileSync = _deps.execFileSync, platform = process.platform } = {},
+) {
   try {
-    if (process.platform === "win32") {
+    if (platform === "win32") {
       // One snapshot of every process → parent map → sum the subtree at `pid`.
       const csv = execFileSync(
         "wmic",
@@ -180,7 +184,15 @@ async function sampleRssDefault(pid) {
           "ProcessId,ParentProcessId,WorkingSetSize",
           "/format:csv",
         ],
-        { encoding: "utf8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 },
+        {
+          encoding: "utf8",
+          windowsHide: true,
+          maxBuffer: 16 * 1024 * 1024,
+          origin: "lsp:benchmark-rss",
+          policy: "allow",
+          scope: "lsp",
+          shell: false,
+        },
       );
       const bytes = sumSubtreeRssFromWmicCsv(csv, pid);
       return bytes != null ? Math.round(bytes / (1024 * 1024)) : null;
@@ -188,6 +200,10 @@ async function sampleRssDefault(pid) {
     // POSIX: not wrapped, so the pid is the real server. Sum pid + children.
     const out = execFileSync("ps", ["-o", "pid=,ppid=,rss="], {
       encoding: "utf8",
+      origin: "lsp:benchmark-rss",
+      policy: "allow",
+      scope: "lsp",
+      shell: false,
     });
     const rows = out
       .trim()

package/src/lib/lsp/lsp-client.js

@@ -13,7 +13,6 @@
  * does not intercept this file). Nothing here is language-specific.
  */
 
-import { spawn as nodeSpawn } from "child_process";
 import { EventEmitter } from "events";
 import { encodeMessage, MessageBuffer } from "./jsonrpc-stream.js";
 import { executionBroker } from "../process-execution-broker/index.js";
@@ -22,7 +21,9 @@ const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
 const DEFAULT_INIT_TIMEOUT_MS = 30_000;
 
 // Injectable so unit tests can supply a fake child process.
-export const _deps = { spawn: nodeSpawn };
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 export class LSPClient extends EventEmitter {
   /**
@@ -88,10 +89,11 @@ export class LSPClient extends EventEmitter {
       shell: false,
       windowsHide: true,
       windowsVerbatimArguments: spawnSpec.windowsVerbatimArguments,
+      origin: this.origin || "lsp:server",
+      policy: "allow",
+      scope: "lsp",
       ...(this.origin
         ? {
-            origin: this.origin,
-            policy: "allow",
             pluginId: this.pluginId,
             pluginVersion: this.pluginVersion,
             pluginSource: this.pluginSource,

package/src/lib/lsp/lsp-server-registry.js

@@ -14,11 +14,9 @@
 
 import fs from "fs";
 import path from "path";
-import { execFileSync } from "child_process";
 
 export const _deps = {
   existsSync: fs.existsSync,
-  execFileSync,
 };
 
 // Extension → LSP languageId. Kept small and explicit; unknown extensions get

package/src/lib/orchestrator.js

@@ -22,15 +22,17 @@
  */
 
 import { EventEmitter } from "events";
-import { execSync } from "child_process";
 import crypto from "crypto";
 import { AgentRouter } from "./agent-router.js";
 import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
 import { firstBalancedJson } from "./json-schema-output.js";
+import executionBroker from "./process-execution-broker/index.js";
 
 /* ---------- _deps injection (Vitest CJS mock pattern) ---------- */
-export const _deps = { execSync };
+export const _deps = {
+  execSync: (...args) => executionBroker.execSync(...args),
+};
 
 // ─── Task statuses ────────────────────────────────────────────────
 export const TASK_STATUS = {
@@ -389,6 +391,10 @@ export class Orchestrator extends EventEmitter {
         // re-dispatch). Give CI output generous headroom.
         maxBuffer: 64 * 1024 * 1024,
         stdio: "pipe",
+        origin: "orchestrator:ci",
+        policy: "allow",
+        scope: "orchestrator",
+        shell: true,
       });
       return {
         pass: true,

package/src/lib/packer/pack-update-applier.js

@@ -27,7 +27,11 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawn } from "node:child_process";
+import executionBroker from "../process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 /**
  * @param {object} ctx
@@ -55,7 +59,7 @@ export async function scheduleReplace(ctx) {
     dryRun = false,
     platform = process.platform === "win32" ? "win32" : "posix",
     parentPid = process.pid,
-    spawnImpl = spawn,
+    spawnImpl = _deps.spawn,
   } = ctx;
 
   if (!newExePath || typeof newExePath !== "string") {
@@ -92,6 +96,10 @@ export async function scheduleReplace(ctx) {
     // Detach so the sidecar survives our process exit. `windowsHide: true`
     // keeps the cmd window from flashing — the replace itself is silent.
     const child = spawnImpl("cmd.exe", ["/c", sidecarPath], {
+      origin: "packer:update-sidecar",
+      scope: "pack-update",
+      policy: "allow",
+      shell: false,
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -123,6 +131,10 @@ export async function scheduleReplace(ctx) {
 
   if (restart) {
     const child = spawnImpl(targetExePath, process.argv.slice(2), {
+      origin: "packer:update-restart",
+      scope: "pack-update",
+      policy: "allow",
+      shell: false,
       detached: true,
       stdio: "ignore",
     });

package/src/lib/packer/smoke-runner.js

@@ -19,11 +19,15 @@
  * Called from `runPack()` as Phase 8 when `cliOpts.smokeTest !== false`.
  */
 
-import { spawn } from "node:child_process";
 import { createConnection } from "node:net";
 import http from "node:http";
 import path from "node:path";
 import { PackError, EXIT } from "./errors.js";
+import executionBroker from "../process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const DEFAULT_BOOT_TIMEOUT_MS = 45_000;
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
@@ -80,7 +84,10 @@ export async function smokeTestExe(ctx) {
   // artifacts are always .exe so this only kicks in during tests that use
   // a shim — kept here so the smoke-runner is self-testable.
   const needsShell = /\.(cmd|bat|sh)$/i.test(exePath);
-  const child = spawn(exePath, ["ui", "--no-open"], {
+  const child = _deps.spawn(exePath, ["ui", "--no-open"], {
+    origin: "packer:smoke-launch",
+    scope: "pack",
+    policy: "allow",
     env,
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
@@ -116,9 +123,15 @@ export async function smokeTestExe(ctx) {
         // unrelated process tree that inherited the number (on CI: another
         // vitest worker or a test's helper child).
         if (child.exitCode !== null || child.signalCode !== null) return;
-        spawn("taskkill", ["/F", "/T", "/PID", String(child.pid)], {
-          stdio: "ignore",
-        }).unref();
+        _deps
+          .spawn("taskkill", ["/F", "/T", "/PID", String(child.pid)], {
+            origin: "packer:smoke-taskkill",
+            scope: "pack",
+            policy: "allow",
+            shell: false,
+            stdio: "ignore",
+          })
+          .unref();
       } else if (child.pid) {
         // Negative pid → the whole process group from the detached spawn above,
         // so a shell:true wrapper's exec'd/forked `node` grandchild dies too

package/src/lib/paths.js

@@ -5,7 +5,7 @@ import { CONFIG_DIR_NAME } from "../constants.js";
 import { getPlatform } from "./platform.js";
 
 export function getHomeDir() {
-  return join(homedir(), CONFIG_DIR_NAME);
+  return process.env.CHAINLESSCHAIN_HOME || join(homedir(), CONFIG_DIR_NAME);
 }
 
 export function getBinDir() {

package/src/lib/plugin-monitor-supervisor.js

@@ -21,13 +21,14 @@
  * real processes.
  */
 
-import { spawn } from "node:child_process";
 import { executionBroker } from "./process-execution-broker/index.js";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
 import { monitorEventId } from "./monitor-event.js";
 
-export const _deps = { spawn };
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const DEFAULT_INTERVAL_MS = 60_000;
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -40,8 +41,7 @@ export class PluginMonitorSupervisor {
     this.defaultIntervalMs = opts.defaultIntervalMs || DEFAULT_INTERVAL_MS;
     this.timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
     this._spawn = opts.spawn || _deps.spawn;
-    this._brokerSpawn =
-      opts.brokerSpawn || executionBroker.spawn.bind(executionBroker);
+    this._pluginSpawn = opts.brokerSpawn || this._spawn;
     const eventRuntimeStore =
       opts.eventRuntimeStore ||
       (process.env.CC_EVENT_RUNTIME_DURABLE === "1" ? new EventRuntimeStore() : null);
@@ -210,17 +210,24 @@ export class PluginMonitorSupervisor {
   }
 
   _spawnForDescriptor(desc, options) {
-    if (desc?.origin === "plugin:monitor") {
-      return this._brokerSpawn(desc.command, desc.args, {
+    const isPlugin = desc?.origin === "plugin:monitor";
+    return (isPlugin ? this._pluginSpawn : this._spawn)(
+      desc.command,
+      desc.args,
+      {
         ...options,
-        origin: desc.origin,
+        origin: isPlugin ? desc.origin : "plugin-monitor:process",
         policy: "allow",
-        pluginId: desc.pluginId,
-        pluginVersion: desc.pluginVersion,
-        pluginSource: desc.pluginSource,
-      });
-    }
-    return this._spawn(desc.command, desc.args, options);
+        scope: "plugin-monitor",
+        ...(isPlugin
+          ? {
+              pluginId: desc.pluginId,
+              pluginVersion: desc.pluginVersion,
+              pluginSource: desc.pluginSource,
+            }
+          : {}),
+      },
+    );
   }
 
   /**

package/src/lib/plugin-runtime/install.js

@@ -19,7 +19,6 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { spawnSync } from "child_process";
 import { parsePluginManifest, isWithin } from "./manifest.js";
 import {
   pluginNameDir,
@@ -29,7 +28,12 @@ import {
   discoverPlugins,
 } from "./scopes.js";
 import { verifyPluginManifest } from "../plugin-security.js";
-import { writePluginLock, buildPluginSbom, LOCK_FILENAME } from "./signature.js";
+import {
+  writePluginLock,
+  buildPluginSbom,
+  LOCK_FILENAME,
+} from "./signature.js";
+import executionBroker from "../process-execution-broker/index.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -40,7 +44,7 @@ export const _deps = {
   lstatSync: fs.lstatSync,
   writeFileSync: fs.writeFileSync,
   mkdtempSync: fs.mkdtempSync,
-  spawnSync,
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
 };
 
 /**
@@ -272,6 +276,9 @@ export function fetchGitRepo(url, ref) {
       encoding: "utf8",
       timeout: 120000,
       windowsHide: true,
+      origin: "plugin:install-git",
+      policy: "allow",
+      scope: "plugin-install",
       shell: false,
     });