claude-flow 3.48.0 → 3.49.0

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -69,17 +69,126 @@ function listSessions() {
     }
     return sessions;
 }
-// Load related stores for session data
-function loadRelatedStores(options) {
-    const data = {};
-    if (options.includeMemory) {
+/** Snapshot format written by session_save since #3573. */
+const MEMORY_SNAPSHOT_FORMAT = 'ruflo-session-memory/2';
+const MEMORY_PAGE_SIZE = 500;
+async function readLiveEntries(listEntries, dbPath, encryptWrites) {
+    const rows = [];
+    // Bounded: stop on a short page, once `total` rows are in hand, or after a
+    // hard cap, so a backend that ignores `offset` cannot loop forever.
+    for (let page = 0, offset = 0; page < 10_000; page++, offset += MEMORY_PAGE_SIZE) {
+        const result = await listEntries({
+            dbPath, includeContent: true, limit: MEMORY_PAGE_SIZE, offset,
+            ...(encryptWrites === undefined ? {} : { encryptWrites }),
+        });
+        if (!result.success)
+            throw new Error(result.error || `could not list ${dbPath}`);
+        rows.push(...result.entries);
+        if (result.entries.length < MEMORY_PAGE_SIZE || rows.length >= result.total)
+            break;
+    }
+    return rows;
+}
+/**
+ * #3573: capture the memory the user actually has.
+ *
+ * Before this, session_save read only the pre-SQLite `.claude-flow/memory/store.json`,
+ * which a current install never writes, so `--include-memory` saved nothing and
+ * reported "Memory Entries: 0". The snapshot now covers the same store `memory
+ * list` reads (resolveDbPath), plus rows that exist only in the sibling AgentDB
+ * store written by the MCP path, de-duplicated by namespace+key (default CLI
+ * writes are mirrored into AgentDB, so most rows are in both). A legacy
+ * store.json is still captured for backward compatibility.
+ */
+async function captureMemorySnapshot() {
+    const report = {
+        requested: true, status: 'captured', entries: 0,
+        sources: { memoryDb: 0, agentdb: 0, legacyJson: 0 },
+    };
+    const entries = {};
+    let legacy;
+    const legacyPath = join(getProjectCwd(), STORAGE_DIR, 'memory', 'store.json');
+    if (existsSync(legacyPath)) {
         try {
-            const memoryPath = join(getProjectCwd(), STORAGE_DIR, 'memory', 'store.json');
-            if (existsSync(memoryPath)) {
-                data.memory = JSON.parse(readFileSync(memoryPath, 'utf-8'));
+            legacy = JSON.parse(readFileSync(legacyPath, 'utf-8'));
+            const legacyEntries = legacy.entries || {};
+            for (const [id, entry] of Object.entries(legacyEntries)) {
+                entries[id] = entry;
+                report.sources.legacyJson++;
             }
         }
-        catch { /* ignore */ }
+        catch { /* unreadable legacy file is not memory we can restore */ }
+    }
+    let sawStore = legacy !== undefined;
+    try {
+        const { listEntries, resolveDbPath } = await import('../memory/memory-initializer.js');
+        const primary = resolveDbPath();
+        const seen = new Set();
+        if (existsSync(primary)) {
+            sawStore = true;
+            for (const row of await readLiveEntries(listEntries, primary)) {
+                const id = `${row.namespace}::${row.key}`;
+                seen.add(id);
+                entries[id] = {
+                    key: row.key, value: row.content ?? '', namespace: row.namespace,
+                    provenanceType: row.provenanceType, source: 'memory-db',
+                };
+                report.sources.memoryDb++;
+            }
+        }
+        let sibling = null;
+        try {
+            const { siblingAgentDbPath } = await import('../memory/memory-bridge.js');
+            sibling = siblingAgentDbPath(primary);
+        }
+        catch { /* no bridge, no sibling store */ }
+        if (sibling && existsSync(sibling)) {
+            sawStore = true;
+            // The AgentDB store is read by native SQLite and must stay plaintext.
+            for (const row of await readLiveEntries(listEntries, sibling, false)) {
+                const id = `${row.namespace}::${row.key}`;
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                entries[id] = {
+                    key: row.key, value: row.content ?? '', namespace: row.namespace,
+                    provenanceType: row.provenanceType, source: 'agentdb',
+                };
+                report.sources.agentdb++;
+            }
+        }
+    }
+    catch (e) {
+        report.status = 'error';
+        report.error = e.message;
+    }
+    report.entries = Object.keys(entries).length;
+    if (report.status !== 'error' && !sawStore)
+        report.status = 'no-store';
+    if (report.entries === 0 && legacy === undefined) {
+        return { report };
+    }
+    return {
+        memory: {
+            format: MEMORY_SNAPSHOT_FORMAT,
+            entries,
+            ...(legacy !== undefined ? { legacy } : {}),
+        },
+        report,
+    };
+}
+// Load related stores for session data
+async function loadRelatedStores(options) {
+    const data = {};
+    let memoryCapture = {
+        requested: false, status: 'not-requested', entries: 0,
+        sources: { memoryDb: 0, agentdb: 0, legacyJson: 0 },
+    };
+    if (options.includeMemory) {
+        const captured = await captureMemorySnapshot();
+        memoryCapture = captured.report;
+        if (captured.memory)
+            data.memory = captured.memory;
     }
     if (options.includeTasks) {
         try {
@@ -99,7 +208,92 @@ function loadRelatedStores(options) {
         }
         catch { /* ignore */ }
     }
-    return data;
+    return { data, memoryCapture };
+}
+/** Count entries in a memory snapshot of either format. */
+function countMemoryEntries(memory) {
+    if (!memory || typeof memory !== 'object')
+        return 0;
+    return Object.keys(memory.entries || {}).length;
+}
+/**
+ * Restore a memory snapshot into the live store and report what was actually
+ * written. #3573: the previous restore swallowed every write failure and then
+ * echoed the count recorded at save time.
+ */
+async function restoreMemorySnapshot(memory) {
+    const outcome = { restored: 0, failed: 0, errors: [] };
+    const isV2 = memory.format === MEMORY_SNAPSHOT_FORMAT;
+    // Legacy snapshots are the old store.json itself; v2 snapshots carry it
+    // under `legacy` only when one existed at save time.
+    const legacyJson = isV2 ? memory.legacy : memory;
+    if (legacyJson !== undefined) {
+        const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
+        if (!existsSync(memoryDir))
+            mkdirRestricted(memoryDir);
+        writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(legacyJson, null, 2));
+    }
+    const entries = memory.entries;
+    if (!entries)
+        return outcome;
+    let storeEntry;
+    let isValidProvenanceType = () => false;
+    try {
+        const mod = await import('../memory/memory-initializer.js');
+        storeEntry = mod.storeEntry;
+        try {
+            if (typeof mod.isValidProvenanceType === 'function')
+                isValidProvenanceType = mod.isValidProvenanceType;
+        }
+        catch { /* optional: without it, provenance is simply not carried over */ }
+    }
+    catch (e) {
+        outcome.failed = Object.keys(entries).length;
+        outcome.errors.push(`memory store unavailable: ${e.message}`);
+        return outcome;
+    }
+    for (const entry of Object.values(entries)) {
+        const key = entry.key || entry.id || '';
+        const value = entry.value || entry.content || '';
+        if (!key || !value) {
+            outcome.failed++;
+            continue;
+        }
+        try {
+            // A snapshot from another version may carry a provenance value this one
+            // rejects; drop it rather than fail an otherwise-good row.
+            const provenance = entry.provenanceType && entry.provenanceType !== 'unknown'
+                && isValidProvenanceType(entry.provenanceType) ? entry.provenanceType : undefined;
+            const result = await storeEntry({
+                key,
+                value,
+                namespace: entry.namespace || 'restored',
+                upsert: true,
+                ...(provenance ? { provenanceType: provenance } : {}),
+            });
+            if (result && result.success === false) {
+                outcome.failed++;
+                if (result.error && outcome.errors.length < 5)
+                    outcome.errors.push(`${key}: ${result.error}`);
+            }
+            else {
+                outcome.restored++;
+            }
+        }
+        catch (e) {
+            outcome.failed++;
+            if (outcome.errors.length < 5)
+                outcome.errors.push(`${key}: ${e.message}`);
+        }
+    }
+    return outcome;
+}
+/** A session record is an object that carries at least one of its defining fields. */
+function isSessionRecordLike(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
 export const sessionTools = [
     {
@@ -129,7 +323,7 @@ export const sessionTools = [
             }
             const sessionId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
             // Load related data based on options
-            const data = loadRelatedStores({
+            const { data, memoryCapture } = await loadRelatedStores({
                 includeMemory: input.includeMemory,
                 includeTasks: input.includeTasks,
                 includeAgents: input.includeAgents,
@@ -138,7 +332,7 @@ export const sessionTools = [
             const stats = {
                 tasks: data.tasks ? Object.keys(data.tasks.tasks || {}).length : 0,
                 agents: data.agents ? Object.keys(data.agents.agents || {}).length : 0,
-                memoryEntries: data.memory ? Object.keys(data.memory.entries || {}).length : 0,
+                memoryEntries: countMemoryEntries(data.memory),
                 totalSize: 0,
             };
             const session = {
@@ -158,6 +352,7 @@ export const sessionTools = [
                 name: session.name,
                 savedAt: session.savedAt,
                 stats: session.stats,
+                memoryCapture,
                 path: getSessionPath(sessionId),
             };
         },
@@ -207,35 +402,11 @@ export const sessionTools = [
                 }
             }
             if (session) {
-                // Restore data to respective stores (legacy JSON for backward compat).
-                // audit_1776853149979: tighten perms on the restored stores too.
+                // Restore data to respective stores. audit_1776853149979: tighten
+                // perms on the restored stores too.
+                let memoryRestore;
                 if (input.restoreMemory !== false && session.data?.memory) {
-                    const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
-                    if (!existsSync(memoryDir))
-                        mkdirRestricted(memoryDir);
-                    writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2));
-                    // Also populate active sql.js SQLite database so memory-tools can find entries
-                    try {
-                        const { storeEntry } = await import('../memory/memory-initializer.js');
-                        const memoryData = session.data.memory;
-                        if (memoryData.entries) {
-                            for (const entry of Object.values(memoryData.entries)) {
-                                const key = entry.key || entry.id || '';
-                                const value = entry.value || entry.content || '';
-                                if (key && value) {
-                                    await storeEntry({
-                                        key,
-                                        value,
-                                        namespace: entry.namespace || 'restored',
-                                        upsert: true,
-                                    });
-                                }
-                            }
-                        }
-                    }
-                    catch {
-                        // Legacy JSON restore is the fallback -- sql.js import may not be available
-                    }
+                    memoryRestore = await restoreMemorySnapshot(session.data.memory);
                 }
                 if (input.restoreTasks !== false && session.data?.tasks) {
                     const taskDir = join(getProjectCwd(), STORAGE_DIR, 'tasks');
@@ -260,6 +431,11 @@ export const sessionTools = [
                     },
                     restoredAt: new Date().toISOString(),
                     stats: session.stats,
+                    // #3573: counts actually written, not the count recorded at save time.
+                    ...(memoryRestore ? {
+                        memoryRestore,
+                        stats: { ...session.stats, memoryEntriesRestored: memoryRestore.restored },
+                    } : {}),
                 };
             }
             return {
@@ -484,30 +660,40 @@ export const sessionTools = [
         // #1916: `ruflo session import <file>` referenced an unregistered
         // `session_import` tool. Reads a session JSON and re-saves it locally.
         name: 'session_import',
-        description: 'Import a session JSON file (produced by session_export) into the local session store and optionally activate it. Use when native Read is wrong because the file is a structured session record that must be re-registered (new id, stats recomputed) rather than just read. For reading the file, native Read is fine. Pair with session_export on the source.',
+        description: 'Import a session (produced by session_export) into the local session store and optionally activate it. Pass either inputPath (a session JSON file) or data (the session record itself). Use when native Read is wrong because the file is a structured session record that must be re-registered (new id, stats recomputed) rather than just read. For reading the file, native Read is fine. Pair with session_export on the source.',
         category: 'session',
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the session JSON file to import' },
+                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data)' },
+                data: { type: 'object', description: 'The session record itself, as written by session_export (or pass inputPath)' },
                 name: { type: 'string', description: 'Override the imported session name' },
                 activate: { type: 'boolean', description: 'Restore the imported session into the active stores' },
             },
-            required: ['inputPath'],
         },
         handler: async (input) => {
-            const inputPath = String(input.inputPath ?? '');
-            if (!inputPath || !existsSync(inputPath))
-                return { error: `File not found: ${inputPath || '(empty)'}` };
             let parsed;
-            try {
-                parsed = JSON.parse(readFileSync(inputPath, 'utf-8'));
+            if (input.data !== undefined && input.data !== null) {
+                parsed = input.data;
+            }
+            else {
+                const inputPath = String(input.inputPath ?? '');
+                if (!inputPath)
+                    return { error: 'Provide inputPath (a session JSON file) or data (a session record)' };
+                if (!existsSync(inputPath))
+                    return { error: `File not found: ${inputPath}` };
+                try {
+                    parsed = JSON.parse(readFileSync(inputPath, 'utf-8'));
+                }
+                catch (e) {
+                    return { error: `Invalid session JSON: ${e.message}` };
+                }
             }
-            catch (e) {
-                return { error: `Invalid session JSON: ${e.message}` };
+            if (!isSessionRecordLike(parsed)) {
+                return { error: 'Not a session record: expected an object produced by session export' };
             }
             const newId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
-            const stats = parsed.stats || { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0 };
+            const stats = { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0, ...(parsed.stats || {}) };
             const session = {
                 sessionId: newId,
                 name: input.name ? String(input.name) : (parsed.name || 'imported-session'),

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -15,6 +15,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { createRequire } from 'node:module';
 import { readFileMaybeEncrypted, writeFileAtomic, writeFileRestricted } from '../fs-secure.js';
 import { restoreMemoryDbFromBackup } from '../services/memory-backup.js';
+import { validateIdentifier } from '../mcp-tools/validate-input.js';
 /**
  * ADR-323 — typed memory provenance. Distinguishes WHO/WHAT wrote a memory
  * entry (a user's stated claim vs an agent's own output vs a tool result vs
@@ -3392,11 +3393,13 @@ export async function withMemoryDbLock(dbPath, fn) {
         }
     }
 }
-const NAMESPACE_PATTERN = /^[A-Za-z0-9._-]{1,128}$/;
 export async function purgeNamespace(options) {
     const { namespace, dbPath: customPath } = options;
-    if (!NAMESPACE_PATTERN.test(namespace)) {
-        return { success: false, deletedCount: 0, remainingEntries: 0, error: `Invalid namespace: ${namespace}` };
+    // #3570: the same validator store, import and export use, so any namespace
+    // that can be written can also be purged (`team:alice` included).
+    const vNs = validateIdentifier(namespace, 'namespace');
+    if (!vNs.valid) {
+        return { success: false, deletedCount: 0, remainingEntries: 0, error: `Invalid namespace: ${vNs.error}` };
     }
     const swarmDir = getMemoryRoot();
     const dbPath = customPath ? path.resolve(customPath) : path.join(swarmDir, 'memory.db');

package/v3/@claude-flow/cli/dist/src/plugins/manager.d.ts

@@ -3,6 +3,7 @@
  * Handles actual plugin installation, persistence, and lifecycle
  * Bridges discovery service with file system persistence
  */
+import { type TrustDecision } from './trust-policy.js';
 export interface InstalledPlugin {
     name: string;
     version: string;
@@ -13,6 +14,40 @@ export interface InstalledPlugin {
     commands?: string[];
     hooks?: string[];
     config?: Record<string, unknown>;
+    /** Declared (or registry-assigned) trust level, recorded at install time. */
+    trustLevel?: string;
+    /** Declared permissions, recorded at install time so they can be enforced. */
+    permissions?: string[];
+    /** How the install was verified. */
+    verification?: 'checksum' | 'npm-integrity' | 'policy' | 'skipped';
+    /** Whether npm lifecycle scripts ran during install (false = `--ignore-scripts`). */
+    scriptsRun?: boolean;
+    /** Hooks/commands the plugin declared but that were not registered, and why. */
+    withheld?: {
+        hooks: string[];
+        commands: string[];
+        reasons: string[];
+    };
+}
+/** Options for {@link PluginManager.installFromLocal} / {@link PluginManager.installFromNpm}. */
+export interface PluginInstallOptions {
+    /** `--verify` (default true). */
+    verify?: boolean;
+    /** `--trust` (default false). */
+    trust?: boolean;
+    /** Registry checksum (`sha256:<hex>`) the downloaded tarball must match. */
+    expectedChecksum?: string;
+    /** Trust level from the registry entry, when the plugin was found there. */
+    registryTrustLevel?: string;
+    /** Permissions from the registry entry, merged with the package's own declaration. */
+    registryPermissions?: string[];
+}
+export interface PluginInstallResult {
+    success: boolean;
+    error?: string;
+    plugin?: InstalledPlugin;
+    decision?: TrustDecision;
+    warnings?: string[];
 }
 export interface InstalledPluginsManifest {
     version: '1.0.0';
@@ -46,19 +81,11 @@ export declare class PluginManager {
     /**
      * Install a plugin from npm
      */
-    installFromNpm(packageName: string, version?: string): Promise<{
-        success: boolean;
-        error?: string;
-        plugin?: InstalledPlugin;
-    }>;
+    installFromNpm(packageName: string, version?: string, opts?: PluginInstallOptions): Promise<PluginInstallResult>;
     /**
      * Install a plugin from a local path
      */
-    installFromLocal(sourcePath: string): Promise<{
-        success: boolean;
-        error?: string;
-        plugin?: InstalledPlugin;
-    }>;
+    installFromLocal(sourcePath: string, opts?: PluginInstallOptions): Promise<PluginInstallResult>;
     /**
      * Uninstall a plugin
      */

package/v3/@claude-flow/cli/dist/src/plugins/manager.js

@@ -4,9 +4,11 @@
  * Bridges discovery service with file system persistence
  */
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { evaluatePluginTrust, parseSha256Checksum, readDeclaredTrust, sha256Hex, shouldRunInstallScripts, } from './trust-policy.js';
 const execFileAsync = promisify(execFile);
 // On Windows, `npm` is a shell script (no `.exe`) and `npm.cmd` is a batch
 // wrapper. Since Node 18.20.2 / 20.12.2 (CVE-2024-27980) the runtime refuses
@@ -30,6 +32,30 @@ function validatePackageName(spec) {
         throw new Error(`Invalid package name: ${spec}`);
     }
 }
+/**
+ * Apply the #3557 trust policy to a plugin's package.json: record its declared
+ * trust and permissions, and withhold hooks/commands the policy doesn't allow.
+ */
+function applyTrustPolicy(pkg, opts) {
+    const block = (pkg['claude-flow'] ?? {});
+    const commands = Array.isArray(block.commands) ? block.commands : [];
+    const hooks = Array.isArray(block.hooks) ? block.hooks : [];
+    const declared = readDeclaredTrust(pkg);
+    const permissions = [...new Set([...(opts.registryPermissions ?? []), ...declared.permissions])];
+    const trustLevel = opts.registryTrustLevel ?? declared.trustLevel;
+    const decision = evaluatePluginTrust({ trustLevel: declared.trustLevel, permissions }, { verify: opts.verify !== false, trust: opts.trust === true, registryTrustLevel: opts.registryTrustLevel });
+    if (decision.allowed) {
+        return { commands, hooks, trustLevel, permissions, decision };
+    }
+    return {
+        commands: [],
+        hooks: [],
+        trustLevel,
+        permissions,
+        withheld: { hooks, commands, reasons: decision.reasons },
+        decision,
+    };
+}
 // ============================================================================
 // Plugin Manager
 // ============================================================================
@@ -98,11 +124,14 @@ export class PluginManager {
     /**
      * Install a plugin from npm
      */
-    async installFromNpm(packageName, version) {
+    async installFromNpm(packageName, version, opts = {}) {
         if (!this.manifest) {
             await this.initialize();
         }
         const versionSpec = version ? `${packageName}@${version}` : packageName;
+        const verify = opts.verify !== false;
+        const warnings = [];
+        let tmpDir;
         try {
             // Check if already installed
             if (this.manifest.plugins[packageName]) {
@@ -116,23 +145,56 @@ export class PluginManager {
             await this.ensureDirectory(installDir);
             // Validate package name to prevent injection (S-3)
             validatePackageName(versionSpec);
+            // #3557: with --verify, a registry checksum must match the tarball we
+            // install. Pack first, hash that exact file, then install from it, so the
+            // bytes that were checked are the bytes that get installed.
+            let installTarget = versionSpec;
+            let verification = verify ? 'npm-integrity' : 'skipped';
+            const expected = verify ? parseSha256Checksum(opts.expectedChecksum) : null;
+            if (expected) {
+                tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruflo-plugin-verify-'));
+                const packed = await runNpm(['pack', versionSpec, '--pack-destination', tmpDir, '--json', '--ignore-scripts'], 120000);
+                const info = JSON.parse(packed.stdout);
+                const filename = info[0]?.filename;
+                if (!filename)
+                    throw new Error(`npm pack returned no tarball for ${versionSpec}`);
+                const tarball = path.join(tmpDir, path.basename(filename));
+                const actual = sha256Hex(fs.readFileSync(tarball));
+                if (actual !== expected) {
+                    return {
+                        success: false,
+                        error: `Checksum mismatch for ${versionSpec}: registry expects sha256:${expected}, ` +
+                            `downloaded tarball is sha256:${actual}. Refusing to install (--verify).`,
+                    };
+                }
+                installTarget = tarball;
+                verification = 'checksum';
+            }
+            else if (verify && opts.expectedChecksum) {
+                warnings.push(`Registry checksum "${opts.expectedChecksum}" is not a verifiable sha256 digest; ` +
+                    `relying on npm's own registry integrity check.`);
+            }
             // Use npm to install (array form prevents shell injection)
             console.log(`[PluginManager] Installing ${versionSpec}...`);
-            await runNpm(['install', '--prefix', this.config.pluginsDir, versionSpec], 120000);
+            // #3557 follow-up: lifecycle scripts run before the package's own trust
+            // declaration can be read, so untrusted installs skip them entirely.
+            const scriptsRun = shouldRunInstallScripts(opts);
+            const installArgs = ['install', '--prefix', this.config.pluginsDir, installTarget];
+            if (!scriptsRun) {
+                installArgs.push('--ignore-scripts');
+                warnings.push(`Install scripts were skipped for ${packageName} (--ignore-scripts): it is not registry-vouched and --trust was not given. ` +
+                    `Reinstall with --trust to run them.`);
+            }
+            await runNpm(installArgs, 120000);
             // Get installed version
             const packageJsonPath = path.join(installDir, packageName, 'package.json');
             let installedVersion = version || 'latest';
-            let commands = [];
-            let hooks = [];
+            let pkg = {};
             if (fs.existsSync(packageJsonPath)) {
-                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-                installedVersion = pkg.version;
-                // Check for claude-flow plugin metadata
-                if (pkg['claude-flow']) {
-                    commands = pkg['claude-flow'].commands || [];
-                    hooks = pkg['claude-flow'].hooks || [];
-                }
+                pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                installedVersion = String(pkg.version ?? installedVersion);
             }
+            const trusted = applyTrustPolicy(pkg, opts);
             // Create plugin entry
             const plugin = {
                 name: packageName,
@@ -141,25 +203,34 @@ export class PluginManager {
                 enabled: true,
                 source: 'npm',
                 path: path.join(installDir, packageName),
-                commands,
-                hooks,
+                commands: trusted.commands,
+                hooks: trusted.hooks,
+                trustLevel: trusted.trustLevel,
+                permissions: trusted.permissions,
+                verification,
+                scriptsRun,
+                ...(trusted.withheld ? { withheld: trusted.withheld } : {}),
             };
             // Save to manifest
             this.manifest.plugins[packageName] = plugin;
             await this.saveManifest();
             console.log(`[PluginManager] Installed ${packageName}@${installedVersion}`);
-            return { success: true, plugin };
+            return { success: true, plugin, decision: trusted.decision, warnings };
         }
         catch (error) {
             const errorMsg = error instanceof Error ? error.message : String(error);
             console.error(`[PluginManager] Failed to install ${packageName}:`, errorMsg);
             return { success: false, error: errorMsg };
         }
+        finally {
+            if (tmpDir)
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
     }
     /**
      * Install a plugin from a local path
      */
-    async installFromLocal(sourcePath) {
+    async installFromLocal(sourcePath, opts = {}) {
         if (!this.manifest) {
             await this.initialize();
         }
@@ -182,6 +253,10 @@ export class PluginManager {
                     error: `Plugin ${packageName} is already installed`,
                 };
             }
+            // #3557: record declared trust/permissions; withhold hooks and commands
+            // the policy doesn't allow without --trust. A local path has no registry
+            // entry to vouch for it, so the plugin's own declaration decides.
+            const trusted = applyTrustPolicy(pkg, { verify: opts.verify, trust: opts.trust });
             // Create plugin entry (link to local path, don't copy)
             const plugin = {
                 name: packageName,
@@ -190,14 +265,20 @@ export class PluginManager {
                 enabled: true,
                 source: 'local',
                 path: absolutePath,
-                commands: pkg['claude-flow']?.commands || [],
-                hooks: pkg['claude-flow']?.hooks || [],
+                commands: trusted.commands,
+                hooks: trusted.hooks,
+                trustLevel: trusted.trustLevel,
+                permissions: trusted.permissions,
+                verification: opts.verify === false ? 'skipped' : 'policy',
+                // A local install links the path; it never runs npm or package scripts.
+                scriptsRun: false,
+                ...(trusted.withheld ? { withheld: trusted.withheld } : {}),
             };
             // Save to manifest
             this.manifest.plugins[packageName] = plugin;
             await this.saveManifest();
             console.log(`[PluginManager] Installed local plugin ${packageName}@${pkg.version}`);
-            return { success: true, plugin };
+            return { success: true, plugin, decision: trusted.decision };
         }
         catch (error) {
             const errorMsg = error instanceof Error ? error.message : String(error);
@@ -345,8 +426,13 @@ export class PluginManager {
             const versionSpec = version ? `${packageName}@${version}` : `${packageName}@latest`;
             // Validate package name to prevent injection (S-3)
             validatePackageName(versionSpec);
-            // Reinstall with new version (array form prevents shell injection)
-            await runNpm(['install', '--prefix', this.config.pluginsDir, versionSpec], 120000);
+            // Reinstall with new version (array form prevents shell injection).
+            // An install recorded with scriptsRun:false stays script-free on upgrade;
+            // legacy entries (no field) keep their pre-#3557 behaviour.
+            const upgradeArgs = ['install', '--prefix', this.config.pluginsDir, versionSpec];
+            if (existing.scriptsRun === false)
+                upgradeArgs.push('--ignore-scripts');
+            await runNpm(upgradeArgs, 120000);
             // Update manifest
             const installDir = path.join(this.config.pluginsDir, 'node_modules');
             const packageJsonPath = path.join(installDir, packageName, 'package.json');