chainlesschain 0.162.182 → 0.162.184

package/src/commands/plugin.js

@@ -20,10 +20,8 @@ import {
   removePlugin,
   updatePlugin,
   getPluginSettings,
-  setPluginSetting,
   searchRegistry,
   listRegistry,
-  registerInMarketplace,
   getPluginSummary,
   installPluginSkills,
   removePluginSkills,
@@ -39,7 +37,12 @@ import {
  * (for --json folding) or null when the plugin declares nothing / can't be
  * resolved.
  */
-async function resolvePluginCapabilityNotice(name, scope, cwd) {
+async function resolvePluginCapabilityNotice(
+  name,
+  scope,
+  cwd,
+  { strict = false } = {},
+) {
   try {
     const { discoverPlugins } = await import("../lib/plugin-runtime/scopes.js");
     const { describeCapabilities } =
@@ -48,7 +51,12 @@ async function resolvePluginCapabilityNotice(name, scope, cwd) {
     const installed = discoverPlugins({ cwd, skipPolicy: true }).find(
       (p) => p.name === name && p.scope === scope,
     );
-    if (!installed) return null;
+    if (!installed) {
+      if (strict) {
+        throw new Error(`${name} is not discoverable at ${scope} scope`);
+      }
+      return null;
+    }
     const declared = installed.manifest?.capabilities;
     if (!declared || consent.capabilitiesAreEmpty(declared)) return null;
     const entry = consent.loadConsentStore()[`${scope}:${name}`] || null;
@@ -59,7 +67,12 @@ async function resolvePluginCapabilityNotice(name, scope, cwd) {
       reason: status.reason,
       added: status.added,
     };
-  } catch {
+  } catch (error) {
+    if (strict) {
+      throw new Error(
+        `installed plugin capability validation failed: ${error.message}`,
+      );
+    }
     return null; // capability rendering is advisory — never break an install
   }
 }
@@ -404,8 +417,28 @@ export function registerPluginCommand(program) {
     .command("enable")
     .description("Enable a plugin")
     .argument("<name>", "Plugin name")
-    .action(async (name) => {
+    .option(
+      "--scope <scope>",
+      "Enable the unified-runtime install at this scope (user|project|local)",
+    )
+    .option("--json", "Output unified-runtime result as JSON")
+    .action(async (name, options) => {
       try {
+        if (options.scope) {
+          const { setPluginEnabled } =
+            await import("../lib/plugin-runtime/install.js");
+          const result = setPluginEnabled(name, true, {
+            scope: options.scope,
+            cwd: process.cwd(),
+          });
+          if (options.json) console.log(JSON.stringify(result, null, 2));
+          else {
+            logger.success(
+              `Enabled ${name} (${options.scope} scope). Reload active plugin sessions to apply the change.`,
+            );
+          }
+          return;
+        }
         enforcePluginPolicy(
           { name, action: "enable" },
           loadPluginManagedPolicy(),
@@ -436,8 +469,28 @@ export function registerPluginCommand(program) {
     .command("disable")
     .description("Disable a plugin")
     .argument("<name>", "Plugin name")
-    .action(async (name) => {
+    .option(
+      "--scope <scope>",
+      "Disable the unified-runtime install at this scope (user|project|local)",
+    )
+    .option("--json", "Output unified-runtime result as JSON")
+    .action(async (name, options) => {
       try {
+        if (options.scope) {
+          const { setPluginEnabled } =
+            await import("../lib/plugin-runtime/install.js");
+          const result = setPluginEnabled(name, false, {
+            scope: options.scope,
+            cwd: process.cwd(),
+          });
+          if (options.json) console.log(JSON.stringify(result, null, 2));
+          else {
+            logger.success(
+              `Disabled ${name} (${options.scope} scope). Reload active plugin sessions to apply the change.`,
+            );
+          }
+          return;
+        }
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
           logger.error("Database not available");
@@ -860,6 +913,7 @@ export function registerPluginCommand(program) {
       // plugin name) resolves to a git source the installer already handles.
       let installSource = source;
       let integritySha = null;
+      let sourceMetadata = null;
       const { isRemoteSource, resolveRemoteSource } =
         await import("../lib/plugin-runtime/remote-source.js");
       if (options.registry || isRemoteSource(source)) {
@@ -883,6 +937,19 @@ export function registerPluginCommand(program) {
           });
           installSource = resolved.source;
           integritySha = resolved.sha256;
+          sourceMetadata = {
+            type: "registry",
+            source: url,
+            registry: url,
+            package: name || source,
+            resolvedSource: resolved.source,
+            ref:
+              (typeof resolved.source === "string" &&
+                resolved.source.includes("#") &&
+                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
+              null,
+            offline: resolved.fromCache === true,
+          };
           if (resolved.fromCache) {
             logger.warn(
               chalk.yellow(
@@ -897,13 +964,31 @@ export function registerPluginCommand(program) {
         }
       }
 
+      let managed = null;
+      try {
+        managed = loadPluginManagedPolicy();
+      } catch (err) {
+        logger.error(`Managed plugin policy is invalid: ${err.message}`);
+        process.exitCode = 1;
+        return;
+      }
+      const requiresManagedSignature =
+        managed?.requireSignedPlugins === true ||
+        managed?.requireSignedPlugins === "require";
       const signature =
-        options.sha256 || options.signature || options.publicKey || integritySha
+        options.sha256 ||
+        options.signature ||
+        options.publicKey ||
+        integritySha ||
+        requiresManagedSignature
           ? {
               sha256: options.sha256 || integritySha,
               signatureFile: options.signature,
               publicKeyFile: options.publicKey,
-              requireSignature: Boolean(options.signature),
+              requireSignature:
+                Boolean(options.signature) || requiresManagedSignature,
+              trustedKeySha256: managed?.trustedPluginKeySha256 || null,
+              requireTrustedKey: requiresManagedSignature,
             }
           : null;
       try {
@@ -912,6 +997,9 @@ export function registerPluginCommand(program) {
           cwd: process.cwd(),
           force: options.force === true,
           signature,
+          sourceMetadata,
+          managedPolicy: managed,
+          policySource: options.registry || source,
         });
         const capNotice = await resolvePluginCapabilityNotice(
           res.name,
@@ -1060,8 +1148,21 @@ export function registerPluginCommand(program) {
         const trust = isPluginTrusted(r)
           ? chalk.green("trusted")
           : chalk.yellow("untrusted");
+        const state =
+          r.enabled === false
+            ? chalk.yellow("disabled")
+            : chalk.green("enabled");
+        const signed = r.integrity?.signature?.verified
+          ? chalk.green("signed")
+          : chalk.gray("unsigned");
+        const policy =
+          r.policy?.allowed === false
+            ? chalk.red("policy-blocked")
+            : r.policy?.managed
+              ? chalk.cyan("managed")
+              : "";
         logger.log(
-          `  ${ok} ${chalk.cyan(r.name)} v${r.version} ${chalk.gray(`[${r.scope}]`)} ${trust}`,
+          `  ${ok} ${chalk.cyan(r.name)} v${r.version} ${chalk.gray(`[${r.scope}]`)} ${state} ${trust} ${signed}${policy ? ` ${policy}` : ""}`,
         );
       }
     });
@@ -1456,23 +1557,212 @@ export function registerPluginCommand(program) {
   plugin
     .command("upgrade <source>")
     .description(
-      "Update a runtime plugin from its source (local dir or git); repoints .active",
+      "Update a runtime plugin from its pinned local, git, or registry source; repoints .active",
     )
     .option("--scope <scope>", `Scope to update in (${SCOPES})`, "user")
     .option("--force", "Reinstall even if the version is unchanged")
+    .option("--sha256 <hex>", "Expected SHA-256 of the manifest file")
+    .option("--signature <path>", "Detached Ed25519 signature of the manifest")
+    .option("--public-key <path>", "Public key for signature verification")
+    .option(
+      "--registry <url>",
+      "Resolve <source> as a plugin NAME in this registry URL",
+    )
+    .option(
+      "--name <plugin>",
+      "Plugin name to select from a multi-plugin registry",
+    )
+    .option("--token <token>", "Bearer token for a private registry")
+    .option(
+      "--allow-insecure-registry",
+      "Allow a plain-HTTP registry URL (MITM risk — trusted networks only)",
+    )
     .option(
       "--grant-capabilities",
       "Grant any newly declared capabilities during the upgrade (no separate consent step)",
     )
+    .option("--json", "Output as JSON")
     .action(async (source, options) => {
-      const { updatePlugin } = await import("../lib/plugin-runtime/install.js");
+      const { updatePlugin, finalizePluginUpdate, rollbackPluginUpdate } =
+        await import("../lib/plugin-runtime/install.js");
+      let installSource = source;
+      let integritySha = null;
+      let sourceMetadata = null;
+      const { isRemoteSource, resolveRemoteSource } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      if (options.registry || isRemoteSource(source)) {
+        const url = options.registry || source;
+        const name = options.registry ? source : options.name;
+        let config = null;
+        try {
+          const cm = await import("../lib/config-manager.js");
+          config = cm.loadConfig();
+        } catch {
+          config = null;
+        }
+        try {
+          const resolved = await resolveRemoteSource(url, {
+            name,
+            token: options.token,
+            config,
+            allowInsecure: options.allowInsecureRegistry === true,
+          });
+          installSource = resolved.source;
+          integritySha = resolved.sha256;
+          sourceMetadata = {
+            type: "registry",
+            source: url,
+            registry: url,
+            package: name || source,
+            resolvedSource: resolved.source,
+            ref:
+              (typeof resolved.source === "string" &&
+                resolved.source.includes("#") &&
+                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
+              null,
+            offline: resolved.fromCache === true,
+          };
+          if (resolved.fromCache && !options.json) {
+            logger.warn(
+              chalk.yellow(
+                "  ⚠ registry unreachable — using cached copy (offline)",
+              ),
+            );
+          }
+        } catch (err) {
+          logger.error(`Registry resolution failed: ${err.message}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
+
+      let managed = null;
+      try {
+        managed = loadPluginManagedPolicy();
+      } catch (err) {
+        logger.error(`Managed plugin policy is invalid: ${err.message}`);
+        process.exitCode = 1;
+        return;
+      }
+      const requiresManagedSignature =
+        managed?.requireSignedPlugins === true ||
+        managed?.requireSignedPlugins === "require";
+      const signature =
+        options.sha256 ||
+        options.signature ||
+        options.publicKey ||
+        integritySha ||
+        requiresManagedSignature
+          ? {
+              sha256: options.sha256 || integritySha,
+              signatureFile: options.signature,
+              publicKeyFile: options.publicKey,
+              requireSignature:
+                Boolean(options.signature) || requiresManagedSignature,
+              trustedKeySha256: managed?.trustedPluginKeySha256 || null,
+              requireTrustedKey: requiresManagedSignature,
+            }
+          : null;
+      let res = null;
       try {
-        const res = updatePlugin(source, {
+        res = updatePlugin(installSource, {
           scope: options.scope,
           cwd: process.cwd(),
           force: options.force,
+          signature,
+          sourceMetadata,
+          managedPolicy: managed,
+          policySource: options.registry || source,
+          transactional: true,
         });
-        if (res.updated) {
+        const upgradeNotice = await resolvePluginCapabilityNotice(
+          res.name,
+          options.scope,
+          process.cwd(),
+          { strict: true },
+        );
+        if (res.updated || res.reinstalled)
+          await auditPluginInstall(
+            "upgrade",
+            { ...res, scope: options.scope },
+            installSource,
+            upgradeNotice,
+          );
+
+        let capabilitiesGranted = false;
+        if (options.json) {
+          if (options.grantCapabilities && upgradeNotice?.consented === false) {
+            capabilitiesGranted = await grantInstalledPluginCapabilities(
+              res.name,
+              options.scope,
+              process.cwd(),
+            );
+          }
+        } else {
+          capabilitiesGranted = await applyCapabilityConsentGate(
+            res.name,
+            options.scope,
+            upgradeNotice,
+            process.cwd(),
+            {
+              grant: options.grantCapabilities === true,
+              interactive: Boolean(process.stdin.isTTY),
+            },
+          );
+        }
+
+        const changed = res.updated || res.reinstalled;
+        const consentBlocked =
+          changed &&
+          upgradeNotice?.consented === false &&
+          capabilitiesGranted !== true;
+        const rollbackReason = consentBlocked
+          ? options.grantCapabilities
+            ? "capability_consent_failed"
+            : "capability_consent_required"
+          : null;
+        let activationStatus = changed ? "activated" : "unchanged";
+        let rollbackVersion = null;
+        let cleanupPending = false;
+        if (rollbackReason) {
+          const recovery = rollbackPluginUpdate(res);
+          if (!recovery.rolledBack) {
+            throw new Error("upgrade rollback transaction was unavailable");
+          }
+          activationStatus = "rolled_back";
+          rollbackVersion = recovery.version;
+        } else {
+          cleanupPending = finalizePluginUpdate(res).cleanupPending === true;
+        }
+
+        if (options.json) {
+          console.log(
+            JSON.stringify(
+              {
+                ...res,
+                scope: options.scope,
+                capabilities: upgradeNotice,
+                capabilitiesGranted,
+                activationStatus,
+                rollbackVersion,
+                rollbackReason,
+                cleanupPending,
+              },
+              null,
+              2,
+            ),
+          );
+          return;
+        }
+
+        if (activationStatus === "rolled_back") {
+          logger.warn(
+            `Upgrade not activated: ${rollbackReason.replaceAll("_", " ")}; ` +
+              (rollbackVersion
+                ? `restored ${res.name} v${rollbackVersion}`
+                : `removed the rejected ${res.name} v${res.version} install`),
+          );
+        } else if (res.updated) {
           logger.success(
             `Updated ${res.name}: ${res.previousVersion ? `v${res.previousVersion} → ` : ""}v${res.version} (${options.scope} scope)`,
           );
@@ -1485,36 +1775,21 @@ export function registerPluginCommand(program) {
             `${res.name} is already up to date at v${res.version} (use --force to reinstall)`,
           );
         }
-        // Surface the (possibly widened) capability set + re-consent hint. An
-        // upgrade that adds a capability shows a `⚠ capability consent required`
-        // notice diffed against the prior consent, then either auto-grants
-        // (--grant-capabilities) or blocks interactively to re-consent now.
-        const upgradeNotice = await resolvePluginCapabilityNotice(
-          res.name,
-          options.scope,
-          process.cwd(),
-        );
-        // Only a version that actually landed on disk is an install; an
-        // already-up-to-date no-op fetched nothing new to run.
-        if (res.updated || res.reinstalled)
-          await auditPluginInstall(
-            "upgrade",
-            { ...res, scope: options.scope },
-            source,
-            upgradeNotice,
-          );
-        await applyCapabilityConsentGate(
-          res.name,
-          options.scope,
-          upgradeNotice,
-          process.cwd(),
-          {
-            grant: options.grantCapabilities === true,
-            interactive: Boolean(process.stdin.isTTY),
-          },
-        );
       } catch (err) {
-        logger.error(`Upgrade failed: ${err.message}`);
+        let recoveryNote = "";
+        if (res) {
+          try {
+            const recovery = rollbackPluginUpdate(res);
+            if (recovery.rolledBack) {
+              recoveryNote = recovery.version
+                ? `; restored v${recovery.version}`
+                : "; removed the rejected install";
+            }
+          } catch (recoveryError) {
+            recoveryNote = `; automatic recovery failed: ${recoveryError.message}`;
+          }
+        }
+        logger.error(`Upgrade failed: ${err.message}${recoveryNote}`);
         process.exitCode = 1;
       }
     });

package/src/commands/session.js

@@ -1333,6 +1333,8 @@ export function registerSessionCommand(program) {
     "subagent",
     "tool",
     "mcp",
+    "plugin",
+    "retry",
     "model",
   ];
 
@@ -1346,9 +1348,19 @@ export function registerSessionCommand(program) {
       logger.log(
         `  ${chalk.gray(String(label).padEnd(28))} in=${r.inputTokens}  out=${r.outputTokens}  total=${chalk.cyan(r.totalTokens.toLocaleString())}  calls=${r.calls}`,
       );
+    const elapsed = (ms) => {
+      const value = Math.max(0, Number(ms) || 0);
+      if (value < 1000) return `${Math.round(value)}ms`;
+      return `${(value / 1000).toFixed(2)}s`;
+    };
     const toolRow = (label, r) =>
       logger.log(
-        `  ${chalk.gray(String(label).padEnd(28))} calls=${r.calls}  errors=${r.errors}  turnTokens≈${chalk.cyan((r.turnTokens || 0).toLocaleString())}`,
+        `  ${chalk.gray(String(label).padEnd(28))} calls=${r.calls}  errors=${r.errors}` +
+          (r.retries != null ? `  retries=${r.retries}` : "") +
+          (r.timedCalls != null
+            ? `  observed=${elapsed(r.durationMs)} (${r.timedCalls} timed)`
+            : "") +
+          `  turnTokens≈${chalk.cyan((r.turnTokens || 0).toLocaleString())}`,
       );
     const empty = (what) => logger.log(chalk.gray(`  (no ${what} recorded)`));
 
@@ -1403,6 +1415,37 @@ export function registerSessionCommand(program) {
         );
         return;
       }
+      case "plugin": {
+        const rows = a.tools?.byPlugin || [];
+        if (rows.length === 0) return empty("plugin-attributed tool calls");
+        for (const r of rows)
+          toolRow(`${r.plugin}${r.version ? `@${r.version}` : ""}`, r);
+        logger.log(
+          chalk.gray(
+            "  turnTokens = tokens of turns that used the plugin (approximation; do not sum across rows)",
+          ),
+        );
+        return;
+      }
+      case "retry": {
+        const retry = a.retries || null;
+        if (!retry || !retry.totalRetries)
+          return empty("automatic LLM retries");
+        logger.log(
+          `  ${chalk.gray("all".padEnd(28))} retries=${retry.totalRetries}  failedAttemptTime=${chalk.cyan(elapsed(retry.durationMs))}`,
+        );
+        for (const r of retry.byReason || []) {
+          logger.log(
+            `  ${chalk.gray(String(r.reason || "unknown").padEnd(28))} retries=${r.retries}  failedAttemptTime=${chalk.cyan(elapsed(r.durationMs))}`,
+          );
+        }
+        for (const r of retry.byModel || []) {
+          logger.log(
+            `  ${chalk.gray(`${r.provider || "?"}/${r.model || "?"}`.padEnd(28))} retries=${r.retries}  failedAttemptTime=${chalk.cyan(elapsed(r.durationMs))}`,
+          );
+        }
+        return;
+      }
       default:
         break;
     }