elanous 0.2.21 → 0.2.23

package/src/plugins/install/plugin-install.ts

@@ -2,14 +2,16 @@ import { createHash, randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { dlopen, FFIType } from 'bun:ffi';
 import { loadPluginManifestFromDir, type PluginManifest } from '../core/manifest.js';
+import { inspectPluginSecurity } from '../core/capability-policy.js';
+import { decidePluginInstallation } from '../core/trust-store.js';
 import { loadPluginNodes } from '../../graph-kinds/plugin-nodes.js';
 import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind } from '../../graph-kinds/registry.js';
 import { verifyIndex, type MarketplaceIndex, type VerifyIndexResult } from '../../market/signed-index.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
-import { ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
+import { ensureInternalMarketIndex, ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
 
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/;
@@ -48,6 +50,8 @@ export interface InstallOptions {
   consent?: (capabilities: string[]) => boolean | Promise<boolean>;
   fetcher?: MarketFetchOptions['fetcher'];
   configPath?: string;
+  /** Enterprise context for knowledge packs in a private market. */
+  enterpriseId?: string;
 }
 
 export class PluginInstallError extends Error {
@@ -83,6 +87,53 @@ function safeTree(root: string): void {
   }
 }
 
+function packPathExists(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+/** Never follow a linked installation root or parent while reusing, moving or rolling back a package. */
+function assertInstallParents(root: string, destination: string): void {
+  const parts = relative(root, dirname(destination)).split(sep).filter(Boolean);
+  if (parts.some(part => part === '..') || isAbsolute(relative(root, destination))) fail('io', `unsafe installation path: ${destination}`);
+  // macOS exposes system aliases such as /var -> /private/var; inspect the
+  // canonical path after that alias, without exempting any caller-owned parent.
+  const systemAlias = process.platform === 'darwin' && ['/var', '/tmp'].find(path => root === path || root.startsWith(`${path}${sep}`));
+  const checkedRoot = systemAlias ? resolve(realpathSync(systemAlias), relative(systemAlias, root)) : root;
+  const parents = [checkedRoot];
+  while (dirname(parents[0]!) !== parents[0]) parents.unshift(dirname(parents[0]!));
+  let parent = checkedRoot;
+  for (const part of parts) {
+    parent = join(parent, part);
+    parents.push(parent);
+  }
+  for (const path of parents) {
+    try {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) fail('io', `unsafe installation parent: ${path}`);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+/** Only an unchanged, ordinary extracted tree can satisfy the verified staged artifact. */
+function samePackTree(existing: string, verified: string): boolean {
+  if (!lstatSync(existing).isDirectory()) return false;
+  const current = readdirSync(existing, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const expected = readdirSync(verified, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  if (current.length !== expected.length) return false;
+  return current.every((entry, i) => {
+    const other = expected[i]!;
+    if (entry.name !== other.name || entry.isSymbolicLink() || other.isSymbolicLink()) return false;
+    if (entry.isDirectory() && other.isDirectory()) return samePackTree(join(existing, entry.name), join(verified, entry.name));
+    return entry.isFile() && other.isFile() && readFileSync(join(existing, entry.name)).equals(readFileSync(join(verified, entry.name)));
+  });
+}
+
 function copyPlugin(source: string, destination: string): void {
   if (!existsSync(source) || !lstatSync(source).isDirectory()) fail('io', `plugin directory not found: ${source}`);
   safeTree(source);
@@ -189,21 +240,33 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
       refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys,
     });
   } catch (error) {
-    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && opts.enterpriseId !== undefined) {
+      try {
+        marketIndex = await ensureInternalMarketIndex(marketName, opts.enterpriseId, {
+          root: opts.root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+        });
+      } catch (internalError) {
+        if (internalError instanceof MarketFetchError) throw new PluginInstallError(internalError.reason, internalError.message);
+        throw internalError;
+      }
+    } else if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
       return localMarketSource(spec, target, opts);
-    }
-    if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
-    throw error;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
   }
   const matches = marketIndex.index.plugins.filter(entry => entry.name === name);
   if (matches.length !== 1) fail('io', `plugin not found or ambiguous in ${marketName}: ${name}`);
   const entry = matches[0]!;
-  const artifact = entry.artifact;
+  await fetchVerifiedArtifact(entry.artifact, marketIndex.market.url, target, opts);
+  return { market: marketName, sha256: entry.artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function fetchVerifiedArtifact(artifact: MarketplaceIndex['plugins'][number]['artifact'], marketUrl: string, target: string, opts: InstallOptions): Promise<void> {
   if (!artifact || typeof artifact.key !== 'string' || !artifact.key || !HASH.test(artifact.sha256)
     || !Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) fail('io', 'invalid artifact key, hash or size');
   // Check the key as written, before URL resolution folds `..`/`.` or percent-encoded separators away.
   if (!/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(artifact.key) || artifact.key.split('/').some(part => part === '.' || part === '..')) fail('io', 'unsafe artifact key');
-  const base = new URL(marketIndex.market.url);
+  const base = new URL(marketUrl);
   const url = new URL(artifact.key, base);
   if (url.protocol !== 'https:' || url.origin !== base.origin || !url.pathname.startsWith(base.pathname)
     || url.username || url.password || url.search || url.hash || /[\\?#]/.test(artifact.key)) fail('io', 'unsafe artifact key');
@@ -235,7 +298,77 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
     fail('scan', 'artifact sha256 or size mismatch');
   }
   unpackArchive(bytes, target);
-  return { market: marketName, sha256: artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function stageRequiredKnowledgePacks(names: string[], market: string, stage: string, root: string, opts: InstallOptions): Promise<Array<{ name: string; destination: string; staged: string }>> {
+  if (!names.length) return [];
+  if (market === 'local') fail('io', 'knowledge pack requires need a signed market');
+  const unique = [...new Set(names)];
+  if (unique.some(name => !NAME.test(name))) fail('io', 'invalid required knowledge pack name');
+  let index: MarketplaceIndex;
+  let url: string | undefined;
+  let directory: string | undefined;
+  let internalVerified = false;
+  try {
+    const options = { root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher,
+      refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys };
+    let result: Awaited<ReturnType<typeof ensureMarketIndex>>;
+    try { result = await ensureMarketIndex(market, options); }
+    catch (error) {
+      if (!(error instanceof MarketFetchError) || !/^market not configured: /.test(error.message) || opts.enterpriseId === undefined) throw error;
+      result = await ensureInternalMarketIndex(market, opts.enterpriseId, options);
+      internalVerified = true;
+    }
+    index = result.index;
+    url = result.market.url;
+  } catch (error) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(market, opts)) {
+      const path = indexPath(market, opts);
+      directory = dirname(path);
+      const sig = join(directory, 'index.sig');
+      if (!existsSync(sig)) fail('signature', `missing index.sig: ${market}`);
+      const result = (opts.verifySignature ?? verifyIndex)({ marketplaceBytes: readFileSync(path), signatureText: readFileSync(sig, 'utf8'), trustedKeys: opts.trustedKeys ?? [] });
+      if (!result.ok) fail('signature', `${result.reason}: ${result.detail}`);
+      if (result.index.name !== market) fail('io', `market index name mismatch: ${market}`);
+      index = result.index;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
+  }
+  const packs: Array<{ name: string; destination: string; staged: string }> = [];
+  for (const name of unique) {
+    const matches = (index.knowledgePacks ?? []).filter(entry => entry.name === name);
+    if (matches.length !== 1) fail('io', `required knowledge pack not found or ambiguous: ${name}`);
+    const entry = matches[0]!;
+    if (!VERSION.test(entry.version)) fail('io', `invalid required knowledge pack version: ${name}`);
+    if (entry.visibility === 'internal') {
+      if (!opts.enterpriseId || entry.enterpriseId !== opts.enterpriseId) fail('io', `knowledge pack not authorized: ${name}`);
+      if (!internalVerified) {
+        try {
+          const authorized = await ensureInternalMarketIndex(market, opts.enterpriseId, {
+            root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+          });
+          if (!authorized.index.knowledgePacks?.some(pack => pack.name === name && pack.version === entry.version
+            && pack.artifact.sha256 === entry.artifact.sha256 && pack.artifact.bytes === entry.artifact.bytes
+            && pack.artifact.key === entry.artifact.key)) fail('io', `knowledge pack not authorized: ${name}`);
+        } catch (error) {
+          if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+          throw error;
+        }
+      }
+    }
+    const staged = join(stage, `knowledge-${packs.length}`);
+    if (directory) {
+      const artifactPath = inside(directory, entry.artifact.key);
+      if (!existsSync(artifactPath) || !realpathSync(artifactPath).startsWith(`${realpathSync(directory)}${sep}`)) fail('scan', `unsafe knowledge pack artifact: ${name}`);
+      const bytes = readFileSync(artifactPath);
+      if (bytes.length !== entry.artifact.bytes || (opts.hashArtifact ?? (data => createHash('sha256').update(data).digest('hex')))(bytes).toLowerCase() !== entry.artifact.sha256.toLowerCase()) fail('scan', 'artifact sha256 or size mismatch');
+      unpackArchive(bytes, staged);
+    } else {
+      await fetchVerifiedArtifact(entry.artifact, url!, staged, opts);
+    }
+    packs.push({ name, staged, destination: join(root, 'knowledge-packs', market, name, entry.version) });
+  }
+  return packs;
 }
 
 export function resolvePluginSource(spec: string, target: string, opts: InstallOptions = {}): ResolvedPluginSource {
@@ -308,7 +441,9 @@ function declaresMain(packageRoot: string): boolean {
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   mkdirSync(stageRoot, { recursive: true });
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   const stage = mkdtempSync(join(stageRoot, 'plugin-'));
   try {
     const source = marketSpec(spec, opts)
@@ -348,11 +483,20 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const destination = join(root, 'plugins', source.market, name, version);
     const emit = (event: InstallEvent) => opts.onEvent?.(event);
     emit({ event: 'resolve', plugin: name, version, sha256: source.sha256 });
-    emit({ event: 'verify', signature: source.signature, scan: 'safe' });
+    let security: ReturnType<typeof inspectPluginSecurity>;
+    try { security = inspectPluginSecurity(packageRoot); }
+    catch { fail('scan', 'plugin static security scan failed'); }
+    emit({ event: 'verify', signature: source.signature, scan: security.scan });
     const capabilities = manifest.capabilities.map(capability => capability.kind);
     const required = capabilities.length > 0;
+    const preConsent = decidePluginInstallation(security, capabilities, false);
+    if (!preConsent.ok && preConsent.reason === 'scan') fail('scan', 'plugin static security scan rejected package');
     emit({ event: 'consent', capabilities, required });
-    if (required && !(opts.yes || await opts.consent?.(capabilities))) fail('consent-denied', 'plugin capabilities require consent');
+    const consented = !required || !!(opts.yes || await opts.consent?.(capabilities));
+    const decision = decidePluginInstallation(security, capabilities, consented);
+    if (!decision.ok) fail(decision.reason, decision.reason === 'scan'
+      ? 'plugin static security scan rejected package' : 'plugin capabilities require consent');
+    const packs = await stageRequiredKnowledgePacks(manifest.requires?.knowledgePacks ?? [], source.market, stage, root, opts);
     emit({ event: 'credentials', connectors: (manifest.contributes.connectors ?? []).map(connector => ({
       id: connector.id, fields: (connector.fields ?? connector.userConfig?.map(field => ({ name: field.key, secret: field.secret })) ?? [])
         .map(field => ({ name: field.name, secret: field.secret === true })),
@@ -370,17 +514,44 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const { nodes, nodeErrors } = inspectPluginNodes(packageRoot, manifest);
     emit({ event: 'registered', kinds, nodes, nodeErrors, graphs, skills });
     const installed = withLedgerLock(root, () => {
+      assertInstallParents(root, destination);
       if (existsSync(destination)) fail('conflict', `plugin already installed: ${name}@${version}`);
-      mkdirSync(dirname(destination), { recursive: true });
-      renameSync(join(stage, 'package'), destination);
-      const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+      for (const pack of packs) {
+        assertInstallParents(root, pack.destination);
+        if (packPathExists(pack.destination) && !samePackTree(pack.destination, pack.staged)) {
+          fail('conflict', `installed knowledge pack differs from verified artifact: ${pack.name}`);
+        }
+      }
+      const moved: string[] = [];
       try {
+        for (const pack of packs) {
+          assertInstallParents(root, pack.destination);
+          if (packPathExists(pack.destination)) continue;
+          mkdirSync(dirname(pack.destination), { recursive: true });
+          assertInstallParents(root, pack.destination);
+          renameSync(pack.staged, pack.destination);
+          moved.push(pack.destination);
+        }
+        mkdirSync(dirname(destination), { recursive: true });
+        assertInstallParents(root, destination);
+        renameSync(join(stage, 'package'), destination);
+        moved.push(destination);
+        const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+        let installedSecurity: ReturnType<typeof inspectPluginSecurity>;
+        try { installedSecurity = inspectPluginSecurity(destination); }
+        catch { fail('scan', 'plugin package integrity verification failed'); }
+        if (installedSecurity.integrity !== security.integrity || installedSecurity.scan === 'dangerous') {
+          fail('scan', 'plugin package integrity changed during installation');
+        }
         writeLedger(root, [...listInstalledPlugins(root), item]);
+        return item;
       } catch (error) {
-        rmSync(destination, { recursive: true, force: true });
+        for (const path of moved.reverse()) {
+          assertInstallParents(root, path);
+          rmSync(path, { recursive: true, force: true });
+        }
         throw error;
       }
-      return item;
     });
     // The install is committed above; a listener that throws must not turn a finished install into a failure
     // (the ledger would say «installed» while the caller saw «io», and a retry would hit «conflict»).

package/src/plugins/maker/market-bundle.ts

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
 import { userConfigPath } from '../../user-config.js';
+import { scanKnowledgePackDlp } from '../../mss/logging/redaction.js';
 import { loadPluginManifestFromDir } from '../core/manifest.js';
 import { LEAK_MARKERS, loadPrivateRedactions, privateIdentifierMarkers, scanLeaks } from '../../../scripts/public-export.js';
 
@@ -56,6 +57,14 @@ export function bundleInstalledWizardPlugin(installedPath: string, outputDir: st
   if (!redactions) throw new Error('private export redaction list unavailable; market bundle refused');
   const hits = scanLeaks(source, files, [...LEAK_MARKERS, ...privateIdentifierMarkers(redactions)]);
   if (hits.length) throw new Error(`market bundle leak: ${hits.map(hit => `${hit.file}:${hit.line} ${hit.marker}`).join(', ')}`);
+  const dlpHits: string[] = [];
+  for (const file of files) {
+    const text = readFileSync(join(source, file), 'utf8');
+    const reasons = scanKnowledgePackDlp(text);
+    if (text.includes('\u0000')) reasons.push('unscannable-content');
+    if (reasons.length) dlpHits.push(`${file}: ${reasons.join(', ')}`);
+  }
+  if (dlpHits.length) throw new Error(`market bundle DLP: ${dlpHits.join('; ')}`);
   const config: unknown = existsSync(configPath) ? JSON.parse(readFileSync(configPath, 'utf8')) : {};
   if (!config || typeof config !== 'object' || Array.isArray(config)) throw new Error('invalid market signing config');
   const signing = (config as { market?: { signing?: { keyId?: unknown; privateKey?: unknown } } }).market?.signing;

package/src/plugins/maker/plugin-maker.ts

@@ -10,6 +10,7 @@ import { dispatchOmniSearch } from '../../skills/tools/omni-search.js';
 import { runGraph } from '../../graph-runner/runner.js';
 import { parseGraphTemplateYaml } from '../../self-implement/graph-yaml.js';
 import { installPlugin } from '../install/plugin-install.js';
+import { inspectPluginSecurity } from '../core/capability-policy.js';
 import { generateWizardFiles, type WizardResearchDraft } from './wizard-generate.js';
 import { bundleInstalledWizardPlugin, type MarketBundleResult } from './market-bundle.js';
 
@@ -127,7 +128,7 @@ export async function validatePluginDir(dir: string): Promise<string[]> {
     if (lstatSync(file).isSymbolicLink()) errors.push('안전하지 않은 plugin.json 링크');
     else manifest = JSON.parse(readFileSync(file, 'utf8'));
   }
-  catch (error) { errors.push(`plugin.json 파싱 실패: ${String(error)}`); }
+  catch { errors.push('plugin.json 파싱 실패'); }
   const extension = isRecord(manifest) && isRecord(manifest.extensions) ? manifest.extensions['ai.elanous'] : undefined;
   const graphs = isRecord(extension) ? extension.graphs : undefined;
   if (isRecord(extension) && extension.contributes !== undefined) errors.push('extension contributes 덮어쓰기 금지');
@@ -143,63 +144,73 @@ export async function validatePluginDir(dir: string): Promise<string[]> {
     if (lstatSync(file).isSymbolicLink()) errors.push('안전하지 않은 recipes.yaml 링크');
     else recipes = parseYaml(readFileSync(file, 'utf8'));
   }
-  catch (error) { errors.push(`recipes.yaml 파싱 실패: ${String(error)}`); }
+  catch { errors.push('recipes.yaml 파싱 실패'); }
   if (!isRecord(recipes)) errors.push('recipes.yaml 은 맵이어야 한다');
   else for (const [id, recipe] of Object.entries(recipes)) {
-    if (!isRecord(recipe) || typeof recipe.command !== 'string' || !recipe.command.trim() ||
-      (recipe.timeout_ms !== undefined && (!Number.isSafeInteger(recipe.timeout_ms) || Number(recipe.timeout_ms) <= 0))) errors.push(`잘못된 recipe: ${id}`);
+    if (!isRecord(recipe) ||
+      (!(typeof recipe.command === 'string' && recipe.command.trim()) && !(typeof recipe.approval === 'string' && recipe.approval.trim())) ||
+      (recipe.command !== undefined && (typeof recipe.command !== 'string' || !recipe.command.trim())) ||
+      (recipe.approval !== undefined && (typeof recipe.approval !== 'string' || !recipe.approval.trim())) ||
+      (recipe.timeout_ms !== undefined && (!Number.isSafeInteger(recipe.timeout_ms) || Number(recipe.timeout_ms) <= 0))) errors.push(`잘못된 recipe: ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'}`);
   }
   for (const graph of Array.isArray(graphs) ? graphs : []) {
     if (typeof graph !== 'string') continue;
     const file = inside(dir, graph);
-    if (!file || !/^\.\/graphs\/[a-zA-Z0-9_-]+\.ya?ml$/.test(graph)) { errors.push(`안전하지 않은 graph 경로: ${graph}`); continue; }
+    if (!file || !/^\.\/graphs\/[a-zA-Z0-9_-]+\.ya?ml$/.test(graph)) { errors.push('안전하지 않은 graph 경로'); continue; }
     try {
-      if (lstatSync(file).isSymbolicLink()) { errors.push(`안전하지 않은 graph 링크: ${graph}`); continue; }
+      if (lstatSync(file).isSymbolicLink()) { errors.push('안전하지 않은 graph 링크'); continue; }
       const parsed = parseGraphTemplateYaml(readFileSync(file, 'utf8'), file);
-      errors.push(...parsed.errors.map(issue => `${issue.path}: ${issue.message}`));
+      errors.push(...parsed.errors.map(() => 'graph 정의 오류'));
       const template = parsed.template;
       if (!template) continue;
-      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(template.graphId)) errors.push(`잘못된 graph_id: ${template.graphId}`);
+      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(template.graphId)) errors.push('잘못된 graph_id');
       if (template.terminalNodes.length !== 2 || !template.terminalNodes.includes('done') || !template.terminalNodes.includes('failed')) errors.push('terminal_nodes 는 done, failed 이어야 한다');
       const executionNodes = template.nodes.filter(node => !template.terminalNodes.includes(node.nodeId));
-      if (executionNodes.length < 2 || executionNodes.length > 6) errors.push(`실행 노드는 2~6개여야 한다: ${executionNodes.length}개`);
+      if (executionNodes.length < 2) errors.push(`실행 노드는 2개 이상이어야 한다: ${executionNodes.length}개`);
       for (const node of template.nodes) {
         if (node.recipe.startsWith('cmd:')) {
           const id = node.recipe.slice(4);
-          if (!isRecord(recipes) || !isRecord(recipes[id]) || typeof recipes[id].command !== 'string' || !recipes[id].command) errors.push(`recipe ${id} 없음`);
-        } else if (node.recipe !== 'none') errors.push(`지원하지 않는 recipe: ${node.recipe}`);
+          if (!isRecord(recipes) || !isRecord(recipes[id]) || recipes[id].approval !== undefined || typeof recipes[id].command !== 'string' || !recipes[id].command.trim()) errors.push(`recipe ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'} 없음`);
+        } else if (node.recipe.startsWith('approval:')) {
+          const id = node.recipe.slice(9);
+          if (!isRecord(recipes) || !isRecord(recipes[id]) || typeof recipes[id].approval !== 'string' || !recipes[id].approval.trim()) errors.push(`approval recipe ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'} 없음`);
+        } else if (node.recipe !== 'none') errors.push(`지원하지 않는 recipe: ${/^[a-zA-Z0-9_:-]+$/.test(node.recipe) ? node.recipe : 'invalid'}`);
       }
-    } catch (error) { errors.push(`${graph} 파싱 실패: ${String(error)}`); }
+    } catch { errors.push('graph 파싱 실패'); }
   }
   const visit = (path: string): void => {
     for (const entry of readdirSync(path, { withFileTypes: true })) {
       const file = join(path, entry.name);
-      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) { errors.push(`안전하지 않은 파일: ${file}`); continue; }
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) { errors.push('안전하지 않은 파일'); continue; }
       if (entry.isDirectory()) visit(file);
       else if (/\.[cm]?[jt]sx?$/.test(entry.name)) {
         const source = readFileSync(file, 'utf8');
         for (const match of source.matchAll(/\b(?:import|export)\s*(?:[\s\S]*?\s+from\s*)?["']([^"']+)["']|\b(?:import|require)\s*\(\s*["']([^"']+)["']/g)) {
           const target = match[1] ?? match[2]!;
-          if (/(?:^|\/)src\//.test(target) && (target.startsWith('/') || target.startsWith('.'))) errors.push(`src import 금지: ${file}: ${target}`);
+          if (/(?:^|\/)src\//.test(target) && (target.startsWith('/') || target.startsWith('.'))) errors.push('src import 금지');
         }
       }
     }
   };
-  try { visit(dir); } catch (error) { errors.push(`파일 검사 실패: ${String(error)}`); }
+  try { visit(dir); } catch { errors.push('파일 검사 실패'); }
   try {
     const example = join(dir, 'examples', 'input.json');
     if (lstatSync(example).isSymbolicLink()) errors.push('안전하지 않은 examples/input.json 링크');
     else JSON.parse(readFileSync(example, 'utf8'));
-  } catch (error) { errors.push(`examples/input.json 파싱 실패: ${String(error)}`); }
+  } catch { errors.push('examples/input.json 파싱 실패'); }
+  let security: ReturnType<typeof inspectPluginSecurity>;
+  try { security = inspectPluginSecurity(dir); }
+  catch { errors.push('보안 검사 실패'); return errors; }
+  if (security.scan === 'dangerous') errors.push(...security.findings.filter(f => f.level === 'dangerous').map(f => `보안 검사 차단: ${f.code}`));
   const step = join(dir, 'graphs', 'run-step.ts');
   try {
     if (!existsSync(step)) errors.push('run-step.ts 없음');
-    else if (errors.some(error => error.startsWith('안전하지 않은 파일:'))) return errors;
+    else if (errors.some(error => error.startsWith('안전하지 않은 파일'))) return errors;
     else {
       const build = await Bun.build({ entrypoints: [step], target: 'bun' });
-      if (!build.success) errors.push(...build.logs.map(log => `run-step.ts 문법 오류: ${log.message}`));
+      if (!build.success) errors.push('run-step.ts 문법 오류');
     }
-  } catch (error) { errors.push(`run-step.ts 문법 오류: ${String(error)}`); }
+  } catch { errors.push('run-step.ts 문법 오류'); }
   return errors;
 }
 
@@ -353,7 +364,7 @@ export async function makePlugin({ request, draftFile, name, parentDir, run, mar
   const step = async (stage: keyof MakePluginResult['timings'], action: () => void | Promise<void>): Promise<void> => {
     const start = performance.now();
     try { await action(); }
-    finally { const ms = Math.round(performance.now() - start); timings[stage] = ms; debug.log('plugin.maker', stage, { ms, errors: result.errors }); }
+    finally { const ms = Math.round(performance.now() - start); timings[stage] = ms; debug.log('plugin.maker', stage, { ms, errors: redactSecrets(result.errors) }); }
   };
   try {
     emit('request', request);
@@ -455,7 +466,7 @@ export async function makePlugin({ request, draftFile, name, parentDir, run, mar
     }
   } catch (error) {
     result.status = 'failed';
-    result.errors.push(error instanceof Error ? error.message : String(error));
+    result.errors.push(redactSecretText(error instanceof Error ? error.message : String(error)));
   } finally {
     emit('done', result.status, { errors: result.errors });
   }

package/src/plugins/maker/wizard-generate.ts

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 
 /** Research is descriptive. Credential values are never an input to the generator. */
@@ -10,13 +10,14 @@ export interface WizardResearchDraft {
     credentials?: Array<{ name: string }>;
   }>;
   skill?: { description: string; instructions: string; requires?: string[] };
+  requires?: { knowledgePacks?: string[] };
 }
 
 const SLUG = /^[a-z0-9][a-z0-9-]{1,31}$/;
 const FIELD = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 
 /** Materialize a research draft; its graph steps fail until the requested processing is implemented. */
-export function generateWizardFiles(dir: string, slug: string, draft: WizardResearchDraft): string[] {
+export function generateWizardFiles(dir: string, slug: string, draft: WizardResearchDraft, options: { regenerate?: boolean } = {}): string[] {
   if (!SLUG.test(slug)) throw new Error(`invalid wizard plugin name: ${slug}`);
   if (!draft || typeof draft.description !== 'string' || !draft.description.trim()) throw new Error('wizard description is required');
   if (draft.connectors !== undefined && !Array.isArray(draft.connectors)) throw new Error('invalid wizard connectors');
@@ -46,23 +47,43 @@ export function generateWizardFiles(dir: string, slug: string, draft: WizardRese
   if (!Array.isArray(requires) || requires.some(resource => typeof resource !== 'string' || !knownResources.has(resource))) {
     throw new Error('wizard requires must reference existing resource ids');
   }
+  if (draft.requires !== undefined && (!draft.requires || typeof draft.requires !== 'object' || Array.isArray(draft.requires) ||
+    Object.keys(draft.requires).some(key => key !== 'knowledgePacks') ||
+    (draft.requires.knowledgePacks !== undefined && (!Array.isArray(draft.requires.knowledgePacks) ||
+      draft.requires.knowledgePacks.some(pack => typeof pack !== 'string' || !pack.trim()))))) {
+    throw new Error('wizard knowledge packs must be non-empty names');
+  }
   const manifestPath = join(dir, 'plugin.json');
   const existing = existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, 'utf8')) as {
-    name: string; extensions: { 'ai.elanous': { connectors?: unknown[]; graphs?: string[]; researchDraft?: boolean } };
+    name: string; description?: string; requires?: { knowledgePacks?: string[]; [key: string]: unknown };
+    extensions: { 'ai.elanous': { connectors?: unknown[]; graphs?: string[]; researchDraft?: boolean } };
   } : undefined;
   if (existing && (existing.name !== slug || !existing.extensions?.['ai.elanous'])) {
     throw new Error('wizard scaffold name or extension mismatch');
   }
-  if (existsSync(join(dir, `skills/${slug}/SKILL.md`))) {
+  const skillPath = join(dir, `skills/${slug}/SKILL.md`);
+  const readmePath = join(dir, 'README.md');
+  const wizardReadme = options.regenerate && existsSync(readmePath) &&
+    readFileSync(readmePath, 'utf8').includes('Research draft only. Connector declarations contain credential names, not values.');
+  if (options.regenerate) {
+    if (!existing || existing.extensions['ai.elanous'].researchDraft !== true || !existsSync(skillPath)) {
+      throw new Error('wizard regeneration requires an existing research draft');
+    }
+  } else if (existsSync(skillPath)) {
     throw new Error(`wizard file already exists: skills/${slug}/SKILL.md`);
   }
   const scaffoldConnectors = existing?.extensions['ai.elanous'].connectors;
-  if (scaffoldConnectors !== undefined && (!Array.isArray(scaffoldConnectors) || scaffoldConnectors.length > 0)) {
+  if (!options.regenerate && scaffoldConnectors !== undefined && (!Array.isArray(scaffoldConnectors) || scaffoldConnectors.length > 0)) {
     throw new Error('wizard cannot replace existing scaffold connectors');
   }
   const manifest = existing ?? { name: slug, version: '0.1.0', description: draft.description,
+    requires: undefined as { knowledgePacks?: string[]; [key: string]: unknown } | undefined,
     extensions: { 'ai.elanous': { graphs: [`./graphs/${slug}.yaml`],
       capabilities: ['fs:workdir', 'proc:bun', 'proc:elanous'], connectors: [] as unknown[], researchDraft: true } } };
+  if (options.regenerate) manifest.description = draft.description;
+  if (draft.requires?.knowledgePacks !== undefined) {
+    manifest.requires = { ...manifest.requires, knowledgePacks: [...new Set(draft.requires.knowledgePacks)] };
+  }
   manifest.extensions['ai.elanous'].connectors = connectors;
   manifest.extensions['ai.elanous'].researchDraft = true;
 
@@ -90,14 +111,71 @@ process.exitCode = 1;
     ['README.md', `# ${slug}\n\n${draft.description}\n\nResearch draft only. Connector declarations contain credential names, not values. The graph cannot perform the requested processing yet: implement and validate its steps, then remove extensions["ai.elanous"].researchDraft from plugin.json before installing or running it. No messages are sent.\n`],
     [`skills/${slug}/SKILL.md`, `---\n${stringifyYaml({ name: slug, description: draft.skill?.description ?? draft.description, requires: [...new Set(requires)] })}---\n\n${draft.skill?.instructions ?? draft.description}\n`],
   ];
-  const generated = existing ? files.filter(([path]) => path === 'plugin.json' || path.startsWith('skills/')) : files;
+  const generated = existing ? files.filter(([path]) => path === 'plugin.json' || path.startsWith('skills/') ||
+    (options.regenerate && wizardReadme && path === 'README.md')) : files;
   for (const [path] of generated) {
-    if (path !== 'plugin.json' && existsSync(join(dir, path))) throw new Error(`wizard file already exists: ${path}`);
+    if (path !== 'plugin.json' && !(options.regenerate && (path === 'README.md' || path.startsWith('skills/'))) && existsSync(join(dir, path))) {
+      throw new Error(`wizard file already exists: ${path}`);
+    }
   }
   for (const [path, content] of generated) {
     const target = join(dir, path);
     mkdirSync(join(target, '..'), { recursive: true });
-    writeFileSync(target, content, { flag: path === 'plugin.json' && existing ? 'w' : 'wx' });
+    writeFileSync(target, content, { flag: existing && (path === 'plugin.json' || options.regenerate) ? 'w' : 'wx' });
   }
   return generated.map(([path]) => path);
 }
+
+/** Browser wizard drafts are stored outside the install ledger. Only wizard-owned directories are listed. */
+export function listWizardDrafts(parent: string): Array<{ name: string; description: string; draft: WizardResearchDraft }> {
+  if (!existsSync(parent)) return [];
+  return readdirSync(parent, { withFileTypes: true }).filter(entry => entry.isDirectory() && SLUG.test(entry.name)).flatMap(entry => {
+    const dir = join(parent, entry.name);
+    try {
+      const manifestPath = join(dir, 'plugin.json');
+      const skillDir = join(dir, 'skills', entry.name);
+      const skillPath = join(skillDir, 'SKILL.md');
+      if (lstatSync(manifestPath).isSymbolicLink() || lstatSync(skillDir).isSymbolicLink() || lstatSync(skillPath).isSymbolicLink()) return [];
+      const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as {
+        name?: string; description?: string; requires?: { knowledgePacks?: string[] };
+        extensions?: { 'ai.elanous'?: { researchDraft?: boolean; connectors?: Array<{ id: string; fields: Array<{ name: string }> }> } } };
+      if (manifest.name !== entry.name || manifest.extensions?.['ai.elanous']?.researchDraft !== true) return [];
+      const skill = readFileSync(skillPath, 'utf8');
+      const parts = /^---\n([\s\S]*?)---\n\n([\s\S]*)$/.exec(skill);
+      if (!parts || typeof manifest.description !== 'string') return [];
+      const meta = parseYaml(parts[1]!) as { description?: string; requires?: string[] };
+      return [{ name: entry.name, description: manifest.description, draft: {
+        description: manifest.description,
+        connectors: manifest.extensions['ai.elanous'].connectors?.map(connector => ({ id: connector.id, credentials: connector.fields.map(field => ({ name: field.name })) })) ?? [],
+        ...(manifest.requires?.knowledgePacks !== undefined ? { requires: { knowledgePacks: manifest.requires.knowledgePacks } } : {}),
+        skill: { description: meta.description ?? manifest.description, instructions: parts[2]!.trimEnd(), requires: meta.requires ?? [] },
+      } }];
+    } catch { return []; }
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function saveWizardDraft(parent: string, slug: string, draft: WizardResearchDraft, regenerate = false): string[] {
+  if (!SLUG.test(slug)) throw new Error(`invalid wizard plugin name: ${slug}`);
+  const requested = resolve(parent);
+  if (existsSync(requested) && lstatSync(requested).isSymbolicLink()) throw new Error('wizard parent cannot be a symlink');
+  // Ancestors may be symlinks (macOS /var -> /private/var); compare the draft directory against the real parent.
+  const base = existsSync(requested) ? realpathSync(requested) : requested;
+  const dir = resolve(base, slug);
+  if (!dir.startsWith(`${base}${sep}`)) throw new Error('invalid wizard directory');
+  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory() || realpathSync(dir) !== dir)) {
+    throw new Error('wizard directory must be a local directory');
+  }
+  if (regenerate && existsSync(join(dir, 'skills')) && lstatSync(join(dir, 'skills')).isSymbolicLink()) {
+    throw new Error('wizard skills cannot be a symlink');
+  }
+  if (!regenerate && existsSync(dir)) throw new Error('wizard directory already exists');
+  if (regenerate && existsSync(join(dir, 'skills', slug)) && lstatSync(join(dir, 'skills', slug)).isSymbolicLink()) {
+    throw new Error('wizard skills cannot be a symlink');
+  }
+  if (regenerate && ['plugin.json', 'README.md', `skills/${slug}/SKILL.md`].some(file => {
+    const path = join(dir, file);
+    return existsSync(path) && lstatSync(path).isSymbolicLink();
+  })) throw new Error('wizard regeneration cannot follow symlinks');
+  if (!existsSync(base) && !regenerate) mkdirSync(base, { recursive: true });
+  return generateWizardFiles(dir, slug, draft, { regenerate });
+}