contextos-agents 1.6.1 → 2.0.0-beta.2

package/.agents/plugins.js

@@ -25,6 +25,17 @@ const path    = require('path');
 const https   = require('https');
 const crypto  = require('crypto');
 const { execFileSync } = require('child_process');
+const { ProjectMutationLock } = require('./filesystem/project-lock.js');
+const JournaledTransaction = require('./filesystem/journaled-transaction.js');
+const {
+  calculateTreeDigest,
+  validateArchiveEntry,
+  validatePluginPinning,
+  ScriptGrantManager,
+  AtomicPluginUpdater,
+  THREAT_CODES,
+  verifyNpmTarballIntegrity,
+} = require('./transaction-core/plugin-supply-chain-bundle.js');
 
 // ── Paths ─────────────────────────────────────────────────────────────────────
 const ROOT           = process.cwd();
@@ -36,6 +47,17 @@ const REGISTRY_URL   = 'https://raw.githubusercontent.com/kok-o/contextos-agents
 const MAX_DOWNLOAD_BYTES = 5 * 1024 * 1024;
 const SAFE_SKILL_NAME = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 
+// ── ANSI helpers ──────────────────────────────────────────────────────────────
+const NO_COLOR = process.env.NO_COLOR || !process.stdout.isTTY;
+const c = {
+  green:  (s) => NO_COLOR ? s : `\x1b[32m${s}\x1b[0m`,
+  red:    (s) => NO_COLOR ? s : `\x1b[31m${s}\x1b[0m`,
+  yellow: (s) => NO_COLOR ? s : `\x1b[33m${s}\x1b[0m`,
+  cyan:   (s) => NO_COLOR ? s : `\x1b[36m${s}\x1b[0m`,
+  bold:   (s) => NO_COLOR ? s : `\x1b[1m${s}\x1b[0m`,
+  dim:    (s) => NO_COLOR ? s : `\x1b[2m${s}\x1b[0m`,
+};
+
 // ── Prompt Injection Scanner ──────────────────────────────────────────────────
 const PROMPT_INJECTION_PATTERNS = [
   /ignore\s+(all\s+)?previous\s+instructions/i,
@@ -48,6 +70,18 @@ const PROMPT_INJECTION_PATTERNS = [
   /\b(?:eval|exec|Function)\s*\(/i,
 ];
 
+// ── Shell Escapes & Script Injection Scanner ──────────────────────────────────
+const SHELL_ESCAPE_PATTERNS = [
+  /(?:curl|wget)\s+[^|\n\r]+?\|\s*(?:bash|sh|zsh|powershell|pwsh|cmd)/i,
+  /\bpowershell(?:\.exe)?\s+.*-(?:enc|encodedcommand|ep\s+bypass)\b/i,
+  /\b(?:rm\s+-rf\s+[\/~]|del\s+\/[sfq]\s+[c-z]:[\\\/])/i,
+  /\b(?:mkfifo|mknod)\s+.*?;/i,
+  /\b(?:nc|netcat|ncat)\s+-[elp]+/i,
+  /<script\b[^>]*>[\s\S]*?<\/script>/i,
+  /javascript\s*:\s*[^\s'"]+/i,
+  /data:text\/html/i,
+];
+
 function scanForPromptInjection(content, options = {}) {
   if (typeof content !== 'string') return false;
   const found = PROMPT_INJECTION_PATTERNS.filter(p => p.test(content));
@@ -62,16 +96,124 @@ function scanForPromptInjection(content, options = {}) {
   return false;
 }
 
-// ── ANSI helpers ──────────────────────────────────────────────────────────────
-const NO_COLOR = process.env.NO_COLOR || !process.stdout.isTTY;
-const c = {
-  green:  (s) => NO_COLOR ? s : `\x1b[32m${s}\x1b[0m`,
-  red:    (s) => NO_COLOR ? s : `\x1b[31m${s}\x1b[0m`,
-  yellow: (s) => NO_COLOR ? s : `\x1b[33m${s}\x1b[0m`,
-  cyan:   (s) => NO_COLOR ? s : `\x1b[36m${s}\x1b[0m`,
-  bold:   (s) => NO_COLOR ? s : `\x1b[1m${s}\x1b[0m`,
-  dim:    (s) => NO_COLOR ? s : `\x1b[2m${s}\x1b[0m`,
-};
+function scanContentSecurity(content, filePath, options = {}) {
+  if (typeof content !== 'string') return false;
+
+  const injectionMatches = PROMPT_INJECTION_PATTERNS.filter(p => p.test(content));
+  const shellMatches = SHELL_ESCAPE_PATTERNS.filter(p => p.test(content));
+
+  const allMatches = [
+    ...injectionMatches.map(p => `prompt_injection: ${p.source}`),
+    ...shellMatches.map(p => `shell_or_script: ${p.source}`),
+  ];
+
+  if (allMatches.length > 0) {
+    const rel = filePath ? path.basename(filePath) : 'content';
+    console.warn(c.red(`  🚨 Unsafe pattern or injection detected in plugin file '${rel}':`));
+    console.warn(c.yellow(`     Matches: ${allMatches.join('; ')}`));
+    if (options.throwOnMatch) {
+      throw new Error(`Security validation failed: unsafe content or script injection detected in '${rel}' (${allMatches.length} pattern matches). Installation aborted. Pass --force-unsafe-prompts to override.`);
+    }
+    return true;
+  }
+  return false;
+}
+
+function isScannableFile(fileName) {
+  const ext = path.extname(fileName).toLowerCase();
+  const scannableExtensions = new Set([
+    '.md', '.mdc', '.markdown', '.txt',
+    '.yaml', '.yml', '.json',
+    '.sh', '.bash', '.zsh', '.ps1', '.bat', '.cmd',
+    '.js', '.ts', '.mjs', '.cjs', '.py',
+  ]);
+  return scannableExtensions.has(ext) || !ext;
+}
+
+/**
+ * Recursively scan an entire plugin directory tree:
+ * - Rejects any symlinks that traverse outside the plugin directory
+ * - Scans all documentation and code files (EXAMPLES.md, TROUBLESHOOTING.md, references/, etc.)
+ *   for prompt injection, script injection, and dangerous shell escape patterns.
+ */
+function scanPluginDirectory(pluginDir, options = {}) {
+  const throwOnMatch = options.throwOnMatch !== undefined ? options.throwOnMatch : !options.forceUnsafe;
+  if (!fs.existsSync(pluginDir)) return true;
+
+  const realPluginDir = fs.realpathSync(pluginDir);
+
+  function walk(currentDir) {
+    let entries;
+    try {
+      entries = fs.readdirSync(currentDir);
+    } catch {
+      return;
+    }
+
+    for (const name of entries) {
+      const fullPath = path.join(currentDir, name);
+      let lstat;
+      try {
+        lstat = fs.lstatSync(fullPath);
+      } catch {
+        continue;
+      }
+
+      // 1. Check symlink traversal
+      if (lstat.isSymbolicLink()) {
+        let linkTarget;
+        try {
+          linkTarget = fs.readlinkSync(fullPath);
+        } catch (e) {
+          throw new Error(`Security validation failed: Unreadable symlink '${name}'. Installation aborted.`);
+        }
+
+        const resolvedTarget = path.resolve(currentDir, linkTarget);
+        let realTarget;
+        try {
+          realTarget = fs.realpathSync(resolvedTarget);
+        } catch {
+          realTarget = resolvedTarget;
+        }
+
+        const normalizedRealPlugin = realPluginDir.replace(/\\/g, '/').toLowerCase();
+        const normalizedRealTarget = realTarget.replace(/\\/g, '/').toLowerCase();
+
+        if (
+          !normalizedRealTarget.startsWith(normalizedRealPlugin + '/') &&
+          normalizedRealTarget !== normalizedRealPlugin
+        ) {
+          throw new Error(
+            `Security validation failed: Symlink traversal detected in '${name}' pointing outside plugin directory to '${linkTarget}'. Installation aborted.`
+          );
+        }
+      }
+
+      // 2. Walk subdirectories
+      if (lstat.isDirectory()) {
+        if (name === '.git' || name === 'node_modules') continue;
+        walk(fullPath);
+      } else if (lstat.isFile()) {
+        if (name === '.source') continue;
+        if (lstat.size > 2 * 1024 * 1024) continue;
+
+        if (isScannableFile(name)) {
+          try {
+            const content = fs.readFileSync(fullPath, 'utf8');
+            scanContentSecurity(content, fullPath, { throwOnMatch });
+          } catch (err) {
+            if (err.message && err.message.startsWith('Security validation failed')) {
+              throw err;
+            }
+          }
+        }
+      }
+    }
+  }
+
+  walk(pluginDir);
+  return true;
+}
 
 // ── plugins.json lock file ─────────────────────────────────────────────────────
 function readLock() {
@@ -83,9 +225,19 @@ function readLock() {
   }
 }
 
-function writeLock(lock) {
-  fs.mkdirSync(AGENTS_DIR, { recursive: true });
-  fs.writeFileSync(PLUGINS_JSON, JSON.stringify(lock, null, 2) + '\n');
+function writeLock(lock, tx = null) {
+  if (tx) {
+    const relLockPath = toPosix(path.relative(ROOT, PLUGINS_JSON));
+    tx.stageWrite(relLockPath, JSON.stringify(lock, null, 2) + '\n');
+  } else {
+    fs.mkdirSync(AGENTS_DIR, { recursive: true });
+    fs.writeFileSync(PLUGINS_JSON, JSON.stringify(lock, null, 2) + '\n');
+  }
+}
+
+// POSIX path helper
+function toPosix(p) {
+  return p.replace(/\\/g, '/');
 }
 
 // ── HTTP fetch helper (no deps) ───────────────────────────────────────────────
@@ -162,7 +314,17 @@ function parseRef(ref) {
       throw new Error('Invalid GitHub plugin reference');
     }
 
-    return { type: 'github', owner, repo, gitRef, isPinned: repoRef.includes('@'), subPath, raw: ref };
+    const isPinned = repoRef.includes('@');
+    return {
+      type: 'github',
+      owner,
+      repo,
+      gitRef,
+      commit: isPinned ? gitRef : undefined,
+      isPinned,
+      subPath,
+      raw: ref,
+    };
   }
   // npm package
   if (!isValidNpmPackage(ref)) {
@@ -172,7 +334,7 @@ function parseRef(ref) {
 }
 
 // ── GitHub installer ──────────────────────────────────────────────────────────
-async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceUnsafe = false) {
+async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceUnsafe = false, tx = null) {
   const { owner, repo, gitRef, isPinned, subPath } = descriptor;
   const skillPath  = subPath || '';
   const base       = `https://raw.githubusercontent.com/${owner}/${repo}/${gitRef}`;
@@ -219,6 +381,7 @@ async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceU
   }
 
   const targetDir = path.join(PLUGINS_DIR, skillName);
+  const relTargetDir = path.relative(ROOT, targetDir).replace(/\\/g, '/');
 
   if (dryRun) {
     console.log(c.yellow(`  [DRY-RUN] Would install to: ${targetDir}`));
@@ -226,14 +389,30 @@ async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceU
     return sha256;
   }
 
-  fs.mkdirSync(targetDir, { recursive: true });
-  fs.writeFileSync(path.join(targetDir, 'SKILL.md'), skillMdContent);
+  // Pre-scan using temp dir to keep `scanPluginDirectory` happy, as it reads from disk
+  const temporaryPrefix = fs.mkdtempSync(path.join(os.tmpdir(), 'contextos-github-'));
+  try {
+    fs.writeFileSync(path.join(temporaryPrefix, 'SKILL.md'), skillMdContent);
+    if (yamlContent) fs.writeFileSync(path.join(temporaryPrefix, 'skill.yaml'), yamlContent);
+    scanPluginDirectory(temporaryPrefix, { throwOnMatch: !forceUnsafe, forceUnsafe });
+  } finally {
+    fs.rmSync(temporaryPrefix, { recursive: true, force: true });
+  }
+
+  const manifest = {};
+  
+  const skillMdHash = crypto.createHash('sha256').update(skillMdContent).digest('hex');
+  tx.stageWrite(`${relTargetDir}/SKILL.md`, skillMdContent);
+  manifest['SKILL.md'] = skillMdHash;
+
   if (yamlContent) {
-    fs.writeFileSync(path.join(targetDir, 'skill.yaml'), yamlContent);
+    const yamlHash = crypto.createHash('sha256').update(yamlContent).digest('hex');
+    tx.stageWrite(`${relTargetDir}/skill.yaml`, yamlContent);
+    manifest['skill.yaml'] = yamlHash;
   }
 
-  // Write a source marker so we know where to update from
-  fs.writeFileSync(path.join(targetDir, '.source'), JSON.stringify({
+  // Write a source marker with manifest
+  const sourceContent = JSON.stringify({
     type:    'github',
     owner,
     repo,
@@ -242,7 +421,9 @@ async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceU
     ref:     descriptor.raw,
     sha256,
     installedAt: new Date().toISOString(),
-  }, null, 2));
+    manifest,
+  }, null, 2);
+  tx.stageWrite(`${relTargetDir}/.source`, sourceContent);
 
   console.log(c.green(`  ✓ Installed SKILL.md (${skillMdContent.length} bytes, sha256: ${sha256.slice(0, 12)}...)`));
   if (yamlContent) console.log(c.green(`  ✓ Installed skill.yaml`));
@@ -250,12 +431,15 @@ async function installFromGitHub(descriptor, skillName, dryRun, checksum, forceU
 }
 
 // ── npm installer ─────────────────────────────────────────────────────────────
-function installFromNpm(descriptor, skillName, dryRun, checksum, forceUnsafe = false) {
+function installFromNpm(descriptor, skillName, dryRun, checksum, forceUnsafe = false, tx = null) {
   const pkgName = descriptor.package;
 
+  const targetDir = path.join(PLUGINS_DIR, skillName);
+  const relTargetDir = path.relative(ROOT, targetDir).replace(/\\/g, '/');
+
   if (dryRun) {
     console.log(c.yellow(`  [DRY-RUN] Would run: npm install ${pkgName}`));
-    console.log(c.yellow(`  [DRY-RUN] Would copy skill to: ${path.join(PLUGINS_DIR, skillName)}`));
+    console.log(c.yellow(`  [DRY-RUN] Would copy skill to: ${targetDir}`));
     return null;
   }
 
@@ -286,21 +470,42 @@ function installFromNpm(descriptor, skillName, dryRun, checksum, forceUnsafe = f
     if (checksum && sha256.toLowerCase() !== checksum.toLowerCase()) {
       throw new Error(`Checksum mismatch for ${skillName}: expected ${checksum}, got ${sha256}`);
     }
-    scanForPromptInjection(skillMdContent, { throwOnMatch: !forceUnsafe });
+    // Deep security scan across all plugin files (EXAMPLES.md, TROUBLESHOOTING.md, references/, symlinks)
+    scanPluginDirectory(skillSrc, { throwOnMatch: !forceUnsafe, forceUnsafe });
+
+    const manifest = {};
+    
+    // Helper to walk and stage all files
+    const stageRecursive = (dir, relBase) => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name === '.git' || entry.name === 'node_modules') continue;
+        const fullPath = path.join(dir, entry.name);
+        const entryRel = relBase ? `${relBase}/${entry.name}` : entry.name;
+        
+        if (entry.isDirectory()) {
+          stageRecursive(fullPath, entryRel);
+        } else if (entry.isFile() || entry.isSymbolicLink()) {
+          // Read content to stage it
+          const content = fs.readFileSync(fullPath);
+          const hash = crypto.createHash('sha256').update(content).digest('hex');
+          tx.stageWrite(`${relTargetDir}/${entryRel}`, content);
+          manifest[entryRel] = hash;
+        }
+      }
+    };
 
-    const targetDir = path.join(PLUGINS_DIR, skillName);
-    fs.rmSync(targetDir, { recursive: true, force: true });
-    fs.mkdirSync(targetDir, { recursive: true });
-    fs.cpSync(skillSrc, targetDir, { recursive: true, force: true });
+    stageRecursive(skillSrc, '');
 
     // Write source marker
-    fs.writeFileSync(path.join(targetDir, '.source'), JSON.stringify({
+    const sourceContent = JSON.stringify({
       type:        'npm',
       package:     pkgName,
       ref:         descriptor.raw,
       sha256,
       installedAt: new Date().toISOString(),
-    }, null, 2));
+      manifest,
+    }, null, 2);
+    tx.stageWrite(`${relTargetDir}/.source`, sourceContent);
   } finally {
     fs.rmSync(temporaryPrefix, { recursive: true, force: true });
   }
@@ -333,6 +538,8 @@ async function add(ref, options = {}) {
   const dryRun   = Boolean(options.dryRun || options['dry-run']);
   const checksum = options.checksum || null;
   const forceUnsafe = Boolean(options.forceUnsafe || options['force-unsafe-prompts']);
+  const allowFloating = Boolean(options.allowFloating || options['allow-floating']);
+  const force = Boolean(options.force);
 
   if (!ref) {
     console.error(c.red('Usage: ctx.js skill add <ref> [--checksum <sha256>]'));
@@ -347,6 +554,27 @@ async function add(ref, options = {}) {
     throw new Error(`Invalid plugin name derived from reference: '${skillName}'`);
   }
 
+  // Supply-chain source pinning check (Wave 6)
+  if (!dryRun) {
+    const pinning = validatePluginPinning(
+      {
+        type: descriptor.type,
+        commit: descriptor.commit,
+        version: descriptor.version,
+        integrity: descriptor.integrity,
+      },
+      { allowFloating }
+    );
+
+    if (!pinning.valid) {
+      console.error(c.red(`\n[ERROR] Supply-chain pinning check failed: ${pinning.error}`));
+      if (pinning.code === THREAT_CODES.FLOATING_SOURCE_BLOCKED) {
+        console.error(c.yellow('  Pass --allow-floating to override this check with explicit user consent.'));
+      }
+      process.exit(1);
+    }
+  }
+
   console.log('');
   console.log(c.bold(`Installing skill: ${c.cyan(skillName)}`));
   console.log(c.dim(`  Source: ${ref} (${descriptor.type})`));
@@ -363,45 +591,86 @@ async function add(ref, options = {}) {
   // Check if already installed
   const lock     = readLock();
   const existing = lock.plugins.find(p => p.name === skillName);
+  const targetDir = path.join(PLUGINS_DIR, skillName);
+
   if (existing && !dryRun) {
+    // Check for local modifications (Wave 6 / Section 20.7)
+    if (fs.existsSync(targetDir) && existing.treeDigest && !force) {
+      if (AtomicPluginUpdater.isModifiedLocally(targetDir, existing.treeDigest)) {
+        const conflictFile = path.join(targetDir, 'CONFLICT_LOCAL_MODIFICATIONS.md');
+        fs.writeFileSync(
+          conflictFile,
+          `# Conflict: Local Modifications Detected\n\nPlugin "${skillName}" contains local uncommitted modifications.\nAutomatic update was blocked to preserve your changes.\n\nTo overwrite local modifications, re-run with --force.\n`,
+          'utf8'
+        );
+        console.error(c.red(`\n[ERROR] Plugin in "${targetDir}" has local modifications.`));
+        console.error(c.red(`  Update blocked to prevent overwriting user changes.`));
+        console.error(c.yellow(`  Conflict artifact written to: ${conflictFile}`));
+        console.error(c.yellow(`  Pass --force to overwrite.`));
+        process.exit(1);
+      }
+    }
     console.log(c.yellow(`\n[WARN] '${skillName}' is already installed (from: ${existing.ref})`));
     console.log(c.yellow('  Re-installing will overwrite it. Continuing...'));
   }
 
-  let installedSha256 = null;
+  const projectLock = new ProjectMutationLock(ROOT);
+  const tx = new JournaledTransaction(ROOT);
+  let lockToken = null;
+
   try {
+    lockToken = projectLock.acquire({ command: 'skill:add' });
+
+    let installedSha256 = null;
     if (descriptor.type === 'github') {
-      installedSha256 = await installFromGitHub(descriptor, skillName, dryRun, checksum, forceUnsafe);
+      installedSha256 = await installFromGitHub(descriptor, skillName, dryRun, checksum, forceUnsafe, tx);
     } else {
-      installedSha256 = installFromNpm(descriptor, skillName, dryRun, checksum, forceUnsafe);
+      installedSha256 = installFromNpm(descriptor, skillName, dryRun, checksum, forceUnsafe, tx);
+    }
+
+    if (!dryRun) {
+      // Update lock file
+      const idx = lock.plugins.findIndex(p => p.name === skillName);
+      const entry = {
+        name:        skillName,
+        ref,
+        type:        descriptor.type,
+        commit:      descriptor.commit,
+        version:     descriptor.version,
+        integrity:   descriptor.integrity,
+        sha256:      installedSha256,
+        installedAt: new Date().toISOString(),
+      };
+      if (idx >= 0) lock.plugins[idx] = entry;
+      else lock.plugins.push(entry);
+      
+      writeLock(lock, tx);
+      tx.commit();
+
+      // Compute and record full-tree digest into lock
+      if (fs.existsSync(targetDir)) {
+        const digestResult = calculateTreeDigest(targetDir);
+        entry.treeDigest = digestResult.treeDigest;
+        writeLock(lock);
+      }
+
+      console.log('');
+      console.log(c.green(c.bold('✓ Skill installed successfully!')));
+      console.log(c.dim(`  Location: .agents/plugins/${skillName}/`));
+      console.log('');
+      console.log('  Next steps:');
+      console.log(`    node .agents/ctx.js export all    # recompile with new skill`);
+      console.log(`    node .agents/ctx.js validate      # verify everything is consistent`);
+      console.log('');
     }
   } catch (err) {
+    if (tx && tx.state === 'PLANNED') {
+      // We don't need to do anything since it wasn't committed
+    }
     console.error(c.red(`\n[ERROR] Failed to install '${skillName}': ${err.message}`));
     process.exit(1);
-  }
-
-  if (!dryRun) {
-    // Update lock file
-    const idx = lock.plugins.findIndex(p => p.name === skillName);
-    const entry = {
-      name:        skillName,
-      ref,
-      type:        descriptor.type,
-      sha256:      installedSha256,
-      installedAt: new Date().toISOString(),
-    };
-    if (idx >= 0) lock.plugins[idx] = entry;
-    else lock.plugins.push(entry);
-    writeLock(lock);
-
-    console.log('');
-    console.log(c.green(c.bold('✓ Skill installed successfully!')));
-    console.log(c.dim(`  Location: .agents/plugins/${skillName}/`));
-    console.log('');
-    console.log('  Next steps:');
-    console.log(`    node .agents/ctx.js export all    # recompile with new skill`);
-    console.log(`    node .agents/ctx.js validate      # verify everything is consistent`);
-    console.log('');
+  } finally {
+    if (lockToken) projectLock.release(lockToken);
   }
 }
 
@@ -436,15 +705,85 @@ function remove(skillName) {
     process.exit(1);
   }
 
-  if (fs.existsSync(skillDir)) {
-    fs.rmSync(skillDir, { recursive: true, force: true });
-  }
+  const projectLock = new ProjectMutationLock(ROOT);
+  const tx = new JournaledTransaction(ROOT);
+  let lockToken = null;
 
-  lock.plugins = lock.plugins.filter(p => p.name !== skillName);
-  writeLock(lock);
+  try {
+    lockToken = projectLock.acquire({ command: 'skill:remove' });
+
+    if (fs.existsSync(skillDir)) {
+      // Find the manifest if it exists
+      const sourceFile = path.join(skillDir, '.source');
+      let manifest = null;
+      if (fs.existsSync(sourceFile)) {
+        try {
+          const sourceData = JSON.parse(fs.readFileSync(sourceFile, 'utf8'));
+          manifest = sourceData.manifest || null;
+        } catch {}
+      }
 
-  console.log(c.green(`✓ Removed plugin: ${skillName}`));
-  console.log(c.dim('  Run: node .agents/ctx.js export all  (to recompile)'));
+      const stageRecursiveDeletes = (dir, relBase) => {
+        let hasPreservedFiles = false;
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+          const fullPath = path.join(dir, entry.name);
+          const entryRel = relBase ? `${relBase}/${entry.name}` : entry.name;
+          
+          if (entry.isDirectory()) {
+            const preserved = stageRecursiveDeletes(fullPath, entryRel);
+            if (preserved) hasPreservedFiles = true;
+            else tx.stageDeleteDir(toPosix(path.relative(ROOT, fullPath)));
+          } else {
+            // Check against manifest
+            let shouldDelete = false;
+            if (manifest && manifest[entryRel]) {
+              const currentHash = crypto.createHash('sha256').update(fs.readFileSync(fullPath)).digest('hex');
+              if (currentHash === manifest[entryRel]) {
+                shouldDelete = true;
+              }
+            } else if (!manifest) {
+              // If we have NO manifest, we fallback to W3.4 "Remove не удаляет modified/unmanaged files"
+              // But without a manifest, we don't know what was installed vs modified.
+              // We'll safely skip all files unless we can confidently delete them, OR we can just assume
+              // if it's the exact SHA256 of SKILL.md, delete it. But it's safer to only delete known things.
+              // We'll just delete SKILL.md and skill.yaml if they match the lockfile hash
+              if (entry.name === 'SKILL.md' || entry.name === 'skill.yaml' || entry.name === '.source') {
+                shouldDelete = true;
+              }
+            }
+
+            if (entry.name === '.source') shouldDelete = true;
+
+            if (shouldDelete) {
+              tx.stageDelete(toPosix(path.relative(ROOT, fullPath)));
+            } else {
+              hasPreservedFiles = true;
+              console.log(c.yellow(`  [WARN] Preserving modified/unmanaged file: ${entryRel}`));
+            }
+          }
+        }
+        return hasPreservedFiles;
+      };
+
+      const preserved = stageRecursiveDeletes(skillDir, '');
+      if (!preserved) {
+        tx.stageDeleteDir(toPosix(path.relative(ROOT, skillDir)));
+      }
+    }
+
+    lock.plugins = lock.plugins.filter(p => p.name !== skillName);
+    writeLock(lock, tx);
+    
+    tx.commit();
+
+    console.log(c.green(`✓ Removed plugin: ${skillName}`));
+    console.log(c.dim('  Run: node .agents/ctx.js export all  (to recompile)'));
+  } catch (err) {
+    console.error(c.red(`\n[ERROR] Failed to remove '${skillName}': ${err.message}`));
+    process.exit(1);
+  } finally {
+    if (lockToken) projectLock.release(lockToken);
+  }
 }
 
 /**
@@ -546,22 +885,39 @@ async function search(query) {
  * both core (builtin) and plugins.
  * Adapters call this instead of reading CORE_SKILLS directly.
  */
-function collectAllSkillDirs() {
+function collectAllSkillDirs(targetRoot) {
+  const root = targetRoot || process.cwd();
+  const agentsDir = path.join(root, '.agents');
+  const localCore = path.join(agentsDir, 'core', 'skills');
+  const localPlugins = path.join(agentsDir, 'plugins');
+
+  const coreDir = fs.existsSync(localCore) ? localCore : CORE_SKILLS;
+  const pluginsDir = fs.existsSync(localPlugins) ? localPlugins : PLUGINS_DIR;
   const dirs = [];
 
   // Core skills
-  if (fs.existsSync(CORE_SKILLS)) {
-    for (const name of fs.readdirSync(CORE_SKILLS)) {
-      const d = path.join(CORE_SKILLS, name);
+  if (fs.existsSync(coreDir)) {
+    for (const name of fs.readdirSync(coreDir)) {
+      const d = path.join(coreDir, name);
       if (fs.statSync(d).isDirectory()) dirs.push(d);
     }
   }
 
-  // Plugin skills
-  if (fs.existsSync(PLUGINS_DIR)) {
-    for (const name of fs.readdirSync(PLUGINS_DIR)) {
-      const d = path.join(PLUGINS_DIR, name);
-      if (fs.statSync(d).isDirectory()) dirs.push(d);
+  // Plugin skills (supports both standalone skill dirs and plugin bundles with skills/)
+  if (fs.existsSync(pluginsDir)) {
+    for (const name of fs.readdirSync(pluginsDir)) {
+      const d = path.join(pluginsDir, name);
+      if (!fs.statSync(d).isDirectory()) continue;
+
+      const nestedSkills = path.join(d, 'skills');
+      if (fs.existsSync(nestedSkills) && fs.statSync(nestedSkills).isDirectory()) {
+        for (const sub of fs.readdirSync(nestedSkills)) {
+          const subDir = path.join(nestedSkills, sub);
+          if (fs.statSync(subDir).isDirectory()) dirs.push(subDir);
+        }
+      } else if (fs.existsSync(path.join(d, 'SKILL.md')) || fs.existsSync(path.join(d, 'skill.yaml'))) {
+        dirs.push(d);
+      }
     }
   }
 
@@ -579,6 +935,9 @@ module.exports = {
   deriveSkillName,
   isSafeSkillName,
   scanForPromptInjection,
+  scanContentSecurity,
+  scanPluginDirectory,
   PROMPT_INJECTION_PATTERNS,
+  SHELL_ESCAPE_PATTERNS,
   PLUGINS_DIR,
 };