elanous 0.2.22 → 0.2.23

package/src/plugins/core/manifest.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import type { Keybinding, SlashCommand } from './types.js';
+import type { Keybinding, PluginDependency, SlashCommand } from './types.js';
 import type { PromptKind, PromptScope, PromptTargetSlot } from '../../prompt-bank/types.js';
 import type {
   MissionDefinition,
@@ -223,6 +223,8 @@ export interface PluginManifest {
   activationEvents: string[];
   contributes: PluginManifestContributes;
   capabilities: PluginCapability[];
+  /** `plugin.json` requirement metadata; does not trigger installation. */
+  requires?: PluginDependency;
   dependencies?: {
     widgets?: string[];
     plugins?: string[];
@@ -328,6 +330,7 @@ export function parsePluginManifest(
       ? raw.capabilities
       : [...parseCapabilities(raw.capabilities), ...parseCapabilities(extension.capabilities)]);
   const dependencies = parseDependencies(raw.dependencies);
+  const requires = parsePluginRequires(raw.requires === undefined ? extension.requires : raw.requires);
   const description = typeof raw.description === 'string' ? raw.description : undefined;
   const allowMultiActive = typeof raw.allowMultiActive === 'boolean' ? raw.allowMultiActive : undefined;
   const activePeerCompat = parseActivePeerCompat(raw.activePeerCompat);
@@ -341,6 +344,7 @@ export function parsePluginManifest(
     activationEvents,
     contributes,
     capabilities,
+    ...(requires ? { requires } : {}),
     ...(dependencies ? { dependencies } : {}),
     ...(allowMultiActive !== undefined ? { allowMultiActive } : {}),
     ...(activePeerCompat ? { activePeerCompat } : {}),
@@ -354,7 +358,7 @@ function objectOrEmpty(value: unknown, label: string): Record<string, unknown> {
   return value as Record<string, unknown>;
 }
 
-function parseElanousExtension(value: unknown): { contributes: Record<string, unknown>; capabilities?: unknown } {
+function parseElanousExtension(value: unknown): { contributes: Record<string, unknown>; capabilities?: unknown; requires?: unknown } {
   const extensions = objectOrEmpty(value, 'extensions');
   const extension = objectOrEmpty(extensions['ai.elanous'], 'extensions["ai.elanous"]');
   const contributes = objectOrEmpty(extension.contributes, 'extensions["ai.elanous"].contributes');
@@ -365,6 +369,7 @@ function parseElanousExtension(value: unknown): { contributes: Record<string, un
         .map(key => [key, extension[key]])),
     },
     capabilities: extension.capabilities,
+    requires: extension.requires,
   };
 }
 
@@ -1117,6 +1122,18 @@ function parseCapabilities(value: unknown): PluginCapability[] {
   });
 }
 
+function parsePluginRequires(value: unknown): PluginDependency | undefined {
+  if (value === undefined) return undefined;
+  const raw = objectOrEmpty(value, 'requires');
+  return {
+    ...(raw.elanous !== undefined ? { elanous: stringOr(raw.elanous) } : {}),
+    ...(raw.tools !== undefined ? { tools: stringArrayOr(raw.tools, []) } : {}),
+    ...(raw.optionalTools !== undefined ? { optionalTools: stringArrayOr(raw.optionalTools, []) } : {}),
+    ...(raw.optionalPython !== undefined ? { optionalPython: stringArrayOr(raw.optionalPython, []) } : {}),
+    ...(raw.knowledgePacks !== undefined ? { knowledgePacks: stringArrayOr(raw.knowledgePacks, []) } : {}),
+  };
+}
+
 function parseDependencies(value: unknown): PluginManifest['dependencies'] | undefined {
   if (value === undefined) return undefined;
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('dependencies must be an object');

package/src/plugins/core/trust-store.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { DATA_DIR } from '../../config.js';
+import type { PluginSecurityDecision } from './capability-policy.js';
 
 export type PluginTrustScope = 'user' | 'workspace';
 
@@ -16,6 +17,20 @@ interface PluginTrustFile {
   records: PluginTrustRecord[];
 }
 
+/** Ephemeral installation decision; never persisted as a trust record or a credential. */
+export function decidePluginInstallation(security: PluginSecurityDecision, capabilities: readonly string[], consent: boolean):
+  { ok: true } | { ok: false; reason: 'scan' | 'consent-denied' } {
+  if (security.scan === 'dangerous') return { ok: false, reason: 'scan' };
+  if (capabilities.length > 0 && !consent) return { ok: false, reason: 'consent-denied' };
+  return { ok: true };
+}
+
+/** Hooks default off for installed (imported/generated) plugins: there is no approval path yet, so none run.
+ *  Built-in and user-dir plugins keep their declared hooks unchanged. */
+export function enabledPluginHooks<T>(hooks: readonly T[], source: string): T[] {
+  return source === 'installed' ? [] : [...hooks];
+}
+
 export class PluginTrustStore {
   constructor(private readonly path = defaultPluginTrustPath()) {}
 

package/src/plugins/core/types.ts

@@ -26,6 +26,15 @@ import type {
 
 export type PaneSlot = 'skills' | 'files' | 'preview' | 'log' | 'hud';
 
+/** Requirements declared by a plugin.json `requires` block. This is metadata, not an install request. */
+export interface PluginDependency {
+  elanous?: string;
+  tools?: string[];
+  optionalTools?: string[];
+  optionalPython?: string[];
+  knowledgePacks?: string[];
+}
+
 export interface DashboardPaneSummary {
   pane: string;
   visible: boolean;
@@ -327,6 +336,9 @@ export interface ElanousPlugin<S = unknown> {
   slashCommands?: SlashCommand[];
   keybindings?: Keybinding[];
   llmTools?: LLMToolDef[];
+  /** Host registers only adapters also declared in contributes.connectors;
+   * registration is disposed with this plugin activation. */
+  channelAdapters?: import('../../nexus/outbound/router.js').ChannelAdapter[];
   onActivate?(ctx: PluginContext): void | Promise<void>;
   onDeactivate?(ctx: PluginContext): void | Promise<void>;
   /** Plugin is executing a long-running op — host blocks input while true.

package/src/plugins/install/market-fetch.ts

@@ -13,7 +13,14 @@ export const ELANOUS_MARKET_URL = 'https://elanvitalai.github.io/elanous-plugins
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const MAX_INDEX_BYTES = 8 * 1024 * 1024;
 
-export interface MarketConfig { name: string; url: string }
+export interface MarketConfig {
+  name: string;
+  url: string;
+  /** Explicit tenant allowlist for a private market; absent for existing plugin markets. */
+  enterpriseIds?: string[];
+  /** Keys bound to this private market, never inherited from the global plugin trust pool. */
+  trustedKeys?: Array<{ keyId: string; publicKey: string }>;
+}
 export interface MarketFetchOptions {
   root?: string;
   marketDir?: string;
@@ -75,6 +82,24 @@ function configuredMarkets(settings: Record<string, unknown>): MarketConfig[] {
     return { name, url: marketUrl(url) };
   });
 }
+function internalMarkets(settings: Record<string, unknown>): MarketConfig[] {
+  const entries = settings.internalMarkets;
+  if (entries === undefined) return [];
+  if (!Array.isArray(entries)) throw new MarketFetchError('io', 'invalid internal markets configuration');
+  const names = new Set<string>();
+  return entries.map((entry: unknown) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) throw new MarketFetchError('io', 'invalid internal market configuration');
+    const { name, url, enterpriseIds, trustedKeys } = entry as Record<string, unknown>;
+    if (typeof name !== 'string' || !NAME.test(name) || names.has(name) || name === 'elanous') throw new MarketFetchError('io', `invalid or duplicate internal market name: ${String(name)}`);
+    if (!Array.isArray(enterpriseIds) || !enterpriseIds.length || !enterpriseIds.every(id => typeof id === 'string' && id.trim() && id === id.trim())
+      || new Set(enterpriseIds).size !== enterpriseIds.length) throw new MarketFetchError('io', `invalid internal market enterprise allowlist: ${name}`);
+    if (!Array.isArray(trustedKeys) || !trustedKeys.length || !trustedKeys.every(key => key && typeof key === 'object' && typeof key.keyId === 'string' && /^[a-fA-F0-9]{8}$/.test(key.keyId) && typeof key.publicKey === 'string' && key.publicKey.length > 0)
+      || new Set(trustedKeys.map(key => key.keyId)).size !== trustedKeys.length) throw new MarketFetchError('io', `invalid internal market trusted keys: ${name}`);
+    names.add(name);
+    return { name, url: marketUrl(url), enterpriseIds: enterpriseIds as string[], trustedKeys: trustedKeys as Array<{ keyId: string; publicKey: string }> };
+  });
+}
+
 function trust(settings: Record<string, unknown>, opts: MarketFetchOptions): ReadonlyArray<{ keyId: string; publicKey: string }> {
   const additional = settings.trustedKeys;
   if (additional !== undefined && (!Array.isArray(additional) || !additional.every(key => key && typeof key.keyId === 'string' && typeof key.publicKey === 'string'))) {
@@ -115,7 +140,7 @@ function location(name: string, opts: MarketFetchOptions): string {
   return join(resolve(opts.marketDir ?? join(opts.root ?? elanousStateRoot(), 'markets')), name);
 }
 
-interface CacheState { url: string; lastSequence: number; indexHash: string; signatureHash: string }
+interface CacheState { url: string; lastSequence: number; indexHash: string; signatureHash: string; trustHash?: string }
 
 function cacheState(path: string): CacheState | undefined {
   if (!existsSync(path)) return undefined;
@@ -123,13 +148,14 @@ function cacheState(path: string): CacheState | undefined {
   try { value = JSON.parse(readFileSync(path, 'utf8')); }
   catch { throw new MarketFetchError('io', 'invalid market cache state'); }
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new MarketFetchError('io', 'invalid market cache state');
-  const { url, lastSequence, indexHash, signatureHash } = value as Record<string, unknown>;
+  const { url, lastSequence, indexHash, signatureHash, trustHash } = value as Record<string, unknown>;
   if (typeof url !== 'string' || !Number.isSafeInteger(lastSequence) || (lastSequence as number) < 0
     || typeof indexHash !== 'string' || !/^[a-f0-9]{64}$/.test(indexHash)
-    || typeof signatureHash !== 'string' || !/^[a-f0-9]{64}$/.test(signatureHash)) {
+    || typeof signatureHash !== 'string' || !/^[a-f0-9]{64}$/.test(signatureHash)
+    || (trustHash !== undefined && (typeof trustHash !== 'string' || !/^[a-f0-9]{64}$/.test(trustHash)))) {
     throw new MarketFetchError('io', 'invalid market cache state');
   }
-  return { url, lastSequence: lastSequence as number, indexHash, signatureHash };
+  return { url, lastSequence: lastSequence as number, indexHash, signatureHash, ...(trustHash === undefined ? {} : { trustHash }) };
 }
 
 function digest(bytes: Uint8Array | string): string {
@@ -147,9 +173,21 @@ function checked(bytes: Uint8Array, signatureText: string, name: string, keys: R
 const marketIndexQueues = new Map<string, Promise<void>>();
 
 export function ensureMarketIndex(name: string, opts: MarketFetchOptions = {}): Promise<MarketIndex> {
-  const directory = location(name, opts);
+  return queuedMarketIndex(name, opts);
+}
+
+/** Private indices require a configured market, a bound signing key and an explicitly allowed enterprise. */
+export function ensureInternalMarketIndex(name: string, enterpriseId: string, opts: MarketFetchOptions = {}): Promise<MarketIndex> {
+  if (typeof enterpriseId !== 'string' || !enterpriseId.trim() || enterpriseId !== enterpriseId.trim()) {
+    return Promise.reject(new MarketFetchError('io', `enterprise not allowed for internal market: ${name}`));
+  }
+  return queuedMarketIndex(name, opts, enterpriseId);
+}
+
+function queuedMarketIndex(name: string, opts: MarketFetchOptions, enterpriseId?: string): Promise<MarketIndex> {
+  const directory = enterpriseId === undefined ? location(name, opts) : join(resolve(opts.marketDir ?? join(opts.root ?? elanousStateRoot(), 'markets')), '.internal', name, digest(enterpriseId));
   const previous = marketIndexQueues.get(directory) ?? Promise.resolve();
-  const result = previous.then(() => fetchMarketIndex(name, opts));
+  const result = previous.then(() => fetchMarketIndex(name, opts, enterpriseId, directory));
   const tail = result.then(() => {}, () => {});
   marketIndexQueues.set(directory, tail);
   void tail.then(() => {
@@ -158,11 +196,25 @@ export function ensureMarketIndex(name: string, opts: MarketFetchOptions = {}):
   return result;
 }
 
-async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise<MarketIndex> {
-  const market = listMarkets(opts).find(entry => entry.name === name);
+async function fetchMarketIndex(name: string, opts: MarketFetchOptions, enterpriseId: string | undefined, directory: string): Promise<MarketIndex> {
+  const settings = marketSettings(config(opts));
+  const market: MarketConfig | undefined = enterpriseId === undefined
+    ? [{ name: 'elanous', url: ELANOUS_MARKET_URL }, ...configuredMarkets(settings)].find(entry => entry.name === name)
+    : internalMarkets(settings).find(entry => entry.name === name);
   if (!market) throw new MarketFetchError('io', `market not configured: ${name}`);
-  const keys = trust(marketSettings(config(opts)), opts);
-  const directory = location(name, opts);
+  if (enterpriseId !== undefined && !market.enterpriseIds?.includes(enterpriseId)) {
+    throw new MarketFetchError('io', `enterprise not allowed for internal market: ${name}`);
+  }
+  const keys = enterpriseId === undefined ? trust(settings, opts) : market.trustedKeys!;
+  const verificationOptions = enterpriseId === undefined ? opts : { ...opts, verifySignature: verifyIndex };
+  const trustHash = enterpriseId === undefined ? undefined : digest(JSON.stringify(keys));
+  const authorized = (verified: ReturnType<typeof checked>): ReturnType<typeof checked> => {
+    if (enterpriseId !== undefined && [...(verified.index.knowledgePacks ?? []), ...(verified.index.loopBundles ?? [])]
+      .some(entry => entry.visibility !== 'internal' || entry.enterpriseId !== enterpriseId)) {
+      throw new MarketFetchError('io', `internal market contains entries outside enterprise allowlist: ${name}`);
+    }
+    return verified;
+  };
   const indexFile = join(directory, 'marketplace.json');
   const sigFile = join(directory, 'index.sig');
   const stateFile = join(directory, 'cache-state.json');
@@ -170,12 +222,12 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
   // The URL is part of the cache identity, not just the market name.
   const lastSequence = state?.url === market.url ? state.lastSequence : undefined;
   let cached: ReturnType<typeof checked> | undefined;
-  if (state?.url === market.url && existsSync(indexFile) && existsSync(sigFile)) {
+  if (state?.url === market.url && (trustHash === undefined || state.trustHash === trustHash) && existsSync(indexFile) && existsSync(sigFile)) {
     const indexBytes = readFileSync(indexFile);
     const signatureText = readFileSync(sigFile, 'utf8');
     if (digest(indexBytes) === state.indexHash && digest(signatureText) === state.signatureHash) {
       try {
-        cached = checked(indexBytes, signatureText, name, keys, opts, lastSequence);
+        cached = authorized(checked(indexBytes, signatureText, name, keys, verificationOptions, lastSequence));
       } catch (error) {
         if (!(error instanceof MarketFetchError)) throw error;
       }
@@ -216,13 +268,13 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
   };
   const bytes = await load('marketplace.json');
   const signature = new TextDecoder('utf-8', { fatal: true }).decode(await load('index.sig'));
-  const verified = checked(bytes, signature, name, keys, opts, lastSequence);
+  const verified = authorized(checked(bytes, signature, name, keys, verificationOptions, lastSequence));
   mkdirSync(directory, { recursive: true });
   // Cross-process: another CLI may have published a newer index since we read cache-state. Re-check the high-water
   // mark under a file lock right before publishing, so a slower process cannot roll the cache back (review R3).
   return withFileLockSync(join(directory, '.publish.lock'), () => {
   const current = cacheState(stateFile);
-  if (current?.url === market.url && current.lastSequence !== undefined && current.lastSequence > verified.index.sequence) {
+  if (current?.url === market.url && current.lastSequence > verified.index.sequence) {
     throw new MarketFetchError('signature', `market index rollback refused: ${name} sequence ${verified.index.sequence} < ${current.lastSequence}`);
   }
   const staging = mkdtempSync(join(directory, '.index-'));
@@ -232,7 +284,7 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
     const tempState = join(staging, 'cache-state.json');
     writeFileSync(tempIndex, bytes);
     writeFileSync(tempSig, signature);
-    writeFileSync(tempState, JSON.stringify({ url: market.url, lastSequence: verified.index.sequence, indexHash: digest(bytes), signatureHash: digest(signature) } satisfies CacheState));
+    writeFileSync(tempState, JSON.stringify({ url: market.url, lastSequence: verified.index.sequence, indexHash: digest(bytes), signatureHash: digest(signature), ...(trustHash === undefined ? {} : { trustHash }) } satisfies CacheState));
     // Commit the verified high-water mark before replacing either cache file.
     // An interrupted publication then cannot roll back a previously verified index.
     renameSync(tempState, stateFile);

package/src/plugins/install/plugin-install.ts

@@ -2,14 +2,16 @@ import { createHash, randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { dlopen, FFIType } from 'bun:ffi';
 import { loadPluginManifestFromDir, type PluginManifest } from '../core/manifest.js';
+import { inspectPluginSecurity } from '../core/capability-policy.js';
+import { decidePluginInstallation } from '../core/trust-store.js';
 import { loadPluginNodes } from '../../graph-kinds/plugin-nodes.js';
 import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind } from '../../graph-kinds/registry.js';
 import { verifyIndex, type MarketplaceIndex, type VerifyIndexResult } from '../../market/signed-index.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
-import { ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
+import { ensureInternalMarketIndex, ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
 
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/;
@@ -48,6 +50,8 @@ export interface InstallOptions {
   consent?: (capabilities: string[]) => boolean | Promise<boolean>;
   fetcher?: MarketFetchOptions['fetcher'];
   configPath?: string;
+  /** Enterprise context for knowledge packs in a private market. */
+  enterpriseId?: string;
 }
 
 export class PluginInstallError extends Error {
@@ -83,6 +87,53 @@ function safeTree(root: string): void {
   }
 }
 
+function packPathExists(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+/** Never follow a linked installation root or parent while reusing, moving or rolling back a package. */
+function assertInstallParents(root: string, destination: string): void {
+  const parts = relative(root, dirname(destination)).split(sep).filter(Boolean);
+  if (parts.some(part => part === '..') || isAbsolute(relative(root, destination))) fail('io', `unsafe installation path: ${destination}`);
+  // macOS exposes system aliases such as /var -> /private/var; inspect the
+  // canonical path after that alias, without exempting any caller-owned parent.
+  const systemAlias = process.platform === 'darwin' && ['/var', '/tmp'].find(path => root === path || root.startsWith(`${path}${sep}`));
+  const checkedRoot = systemAlias ? resolve(realpathSync(systemAlias), relative(systemAlias, root)) : root;
+  const parents = [checkedRoot];
+  while (dirname(parents[0]!) !== parents[0]) parents.unshift(dirname(parents[0]!));
+  let parent = checkedRoot;
+  for (const part of parts) {
+    parent = join(parent, part);
+    parents.push(parent);
+  }
+  for (const path of parents) {
+    try {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) fail('io', `unsafe installation parent: ${path}`);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+/** Only an unchanged, ordinary extracted tree can satisfy the verified staged artifact. */
+function samePackTree(existing: string, verified: string): boolean {
+  if (!lstatSync(existing).isDirectory()) return false;
+  const current = readdirSync(existing, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const expected = readdirSync(verified, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  if (current.length !== expected.length) return false;
+  return current.every((entry, i) => {
+    const other = expected[i]!;
+    if (entry.name !== other.name || entry.isSymbolicLink() || other.isSymbolicLink()) return false;
+    if (entry.isDirectory() && other.isDirectory()) return samePackTree(join(existing, entry.name), join(verified, entry.name));
+    return entry.isFile() && other.isFile() && readFileSync(join(existing, entry.name)).equals(readFileSync(join(verified, entry.name)));
+  });
+}
+
 function copyPlugin(source: string, destination: string): void {
   if (!existsSync(source) || !lstatSync(source).isDirectory()) fail('io', `plugin directory not found: ${source}`);
   safeTree(source);
@@ -189,21 +240,33 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
       refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys,
     });
   } catch (error) {
-    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && opts.enterpriseId !== undefined) {
+      try {
+        marketIndex = await ensureInternalMarketIndex(marketName, opts.enterpriseId, {
+          root: opts.root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+        });
+      } catch (internalError) {
+        if (internalError instanceof MarketFetchError) throw new PluginInstallError(internalError.reason, internalError.message);
+        throw internalError;
+      }
+    } else if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
       return localMarketSource(spec, target, opts);
-    }
-    if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
-    throw error;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
   }
   const matches = marketIndex.index.plugins.filter(entry => entry.name === name);
   if (matches.length !== 1) fail('io', `plugin not found or ambiguous in ${marketName}: ${name}`);
   const entry = matches[0]!;
-  const artifact = entry.artifact;
+  await fetchVerifiedArtifact(entry.artifact, marketIndex.market.url, target, opts);
+  return { market: marketName, sha256: entry.artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function fetchVerifiedArtifact(artifact: MarketplaceIndex['plugins'][number]['artifact'], marketUrl: string, target: string, opts: InstallOptions): Promise<void> {
   if (!artifact || typeof artifact.key !== 'string' || !artifact.key || !HASH.test(artifact.sha256)
     || !Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) fail('io', 'invalid artifact key, hash or size');
   // Check the key as written, before URL resolution folds `..`/`.` or percent-encoded separators away.
   if (!/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(artifact.key) || artifact.key.split('/').some(part => part === '.' || part === '..')) fail('io', 'unsafe artifact key');
-  const base = new URL(marketIndex.market.url);
+  const base = new URL(marketUrl);
   const url = new URL(artifact.key, base);
   if (url.protocol !== 'https:' || url.origin !== base.origin || !url.pathname.startsWith(base.pathname)
     || url.username || url.password || url.search || url.hash || /[\\?#]/.test(artifact.key)) fail('io', 'unsafe artifact key');
@@ -235,7 +298,77 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
     fail('scan', 'artifact sha256 or size mismatch');
   }
   unpackArchive(bytes, target);
-  return { market: marketName, sha256: artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function stageRequiredKnowledgePacks(names: string[], market: string, stage: string, root: string, opts: InstallOptions): Promise<Array<{ name: string; destination: string; staged: string }>> {
+  if (!names.length) return [];
+  if (market === 'local') fail('io', 'knowledge pack requires need a signed market');
+  const unique = [...new Set(names)];
+  if (unique.some(name => !NAME.test(name))) fail('io', 'invalid required knowledge pack name');
+  let index: MarketplaceIndex;
+  let url: string | undefined;
+  let directory: string | undefined;
+  let internalVerified = false;
+  try {
+    const options = { root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher,
+      refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys };
+    let result: Awaited<ReturnType<typeof ensureMarketIndex>>;
+    try { result = await ensureMarketIndex(market, options); }
+    catch (error) {
+      if (!(error instanceof MarketFetchError) || !/^market not configured: /.test(error.message) || opts.enterpriseId === undefined) throw error;
+      result = await ensureInternalMarketIndex(market, opts.enterpriseId, options);
+      internalVerified = true;
+    }
+    index = result.index;
+    url = result.market.url;
+  } catch (error) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(market, opts)) {
+      const path = indexPath(market, opts);
+      directory = dirname(path);
+      const sig = join(directory, 'index.sig');
+      if (!existsSync(sig)) fail('signature', `missing index.sig: ${market}`);
+      const result = (opts.verifySignature ?? verifyIndex)({ marketplaceBytes: readFileSync(path), signatureText: readFileSync(sig, 'utf8'), trustedKeys: opts.trustedKeys ?? [] });
+      if (!result.ok) fail('signature', `${result.reason}: ${result.detail}`);
+      if (result.index.name !== market) fail('io', `market index name mismatch: ${market}`);
+      index = result.index;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
+  }
+  const packs: Array<{ name: string; destination: string; staged: string }> = [];
+  for (const name of unique) {
+    const matches = (index.knowledgePacks ?? []).filter(entry => entry.name === name);
+    if (matches.length !== 1) fail('io', `required knowledge pack not found or ambiguous: ${name}`);
+    const entry = matches[0]!;
+    if (!VERSION.test(entry.version)) fail('io', `invalid required knowledge pack version: ${name}`);
+    if (entry.visibility === 'internal') {
+      if (!opts.enterpriseId || entry.enterpriseId !== opts.enterpriseId) fail('io', `knowledge pack not authorized: ${name}`);
+      if (!internalVerified) {
+        try {
+          const authorized = await ensureInternalMarketIndex(market, opts.enterpriseId, {
+            root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+          });
+          if (!authorized.index.knowledgePacks?.some(pack => pack.name === name && pack.version === entry.version
+            && pack.artifact.sha256 === entry.artifact.sha256 && pack.artifact.bytes === entry.artifact.bytes
+            && pack.artifact.key === entry.artifact.key)) fail('io', `knowledge pack not authorized: ${name}`);
+        } catch (error) {
+          if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+          throw error;
+        }
+      }
+    }
+    const staged = join(stage, `knowledge-${packs.length}`);
+    if (directory) {
+      const artifactPath = inside(directory, entry.artifact.key);
+      if (!existsSync(artifactPath) || !realpathSync(artifactPath).startsWith(`${realpathSync(directory)}${sep}`)) fail('scan', `unsafe knowledge pack artifact: ${name}`);
+      const bytes = readFileSync(artifactPath);
+      if (bytes.length !== entry.artifact.bytes || (opts.hashArtifact ?? (data => createHash('sha256').update(data).digest('hex')))(bytes).toLowerCase() !== entry.artifact.sha256.toLowerCase()) fail('scan', 'artifact sha256 or size mismatch');
+      unpackArchive(bytes, staged);
+    } else {
+      await fetchVerifiedArtifact(entry.artifact, url!, staged, opts);
+    }
+    packs.push({ name, staged, destination: join(root, 'knowledge-packs', market, name, entry.version) });
+  }
+  return packs;
 }
 
 export function resolvePluginSource(spec: string, target: string, opts: InstallOptions = {}): ResolvedPluginSource {
@@ -308,7 +441,9 @@ function declaresMain(packageRoot: string): boolean {
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   mkdirSync(stageRoot, { recursive: true });
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   const stage = mkdtempSync(join(stageRoot, 'plugin-'));
   try {
     const source = marketSpec(spec, opts)
@@ -348,11 +483,20 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const destination = join(root, 'plugins', source.market, name, version);
     const emit = (event: InstallEvent) => opts.onEvent?.(event);
     emit({ event: 'resolve', plugin: name, version, sha256: source.sha256 });
-    emit({ event: 'verify', signature: source.signature, scan: 'safe' });
+    let security: ReturnType<typeof inspectPluginSecurity>;
+    try { security = inspectPluginSecurity(packageRoot); }
+    catch { fail('scan', 'plugin static security scan failed'); }
+    emit({ event: 'verify', signature: source.signature, scan: security.scan });
     const capabilities = manifest.capabilities.map(capability => capability.kind);
     const required = capabilities.length > 0;
+    const preConsent = decidePluginInstallation(security, capabilities, false);
+    if (!preConsent.ok && preConsent.reason === 'scan') fail('scan', 'plugin static security scan rejected package');
     emit({ event: 'consent', capabilities, required });
-    if (required && !(opts.yes || await opts.consent?.(capabilities))) fail('consent-denied', 'plugin capabilities require consent');
+    const consented = !required || !!(opts.yes || await opts.consent?.(capabilities));
+    const decision = decidePluginInstallation(security, capabilities, consented);
+    if (!decision.ok) fail(decision.reason, decision.reason === 'scan'
+      ? 'plugin static security scan rejected package' : 'plugin capabilities require consent');
+    const packs = await stageRequiredKnowledgePacks(manifest.requires?.knowledgePacks ?? [], source.market, stage, root, opts);
     emit({ event: 'credentials', connectors: (manifest.contributes.connectors ?? []).map(connector => ({
       id: connector.id, fields: (connector.fields ?? connector.userConfig?.map(field => ({ name: field.key, secret: field.secret })) ?? [])
         .map(field => ({ name: field.name, secret: field.secret === true })),
@@ -370,17 +514,44 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const { nodes, nodeErrors } = inspectPluginNodes(packageRoot, manifest);
     emit({ event: 'registered', kinds, nodes, nodeErrors, graphs, skills });
     const installed = withLedgerLock(root, () => {
+      assertInstallParents(root, destination);
       if (existsSync(destination)) fail('conflict', `plugin already installed: ${name}@${version}`);
-      mkdirSync(dirname(destination), { recursive: true });
-      renameSync(join(stage, 'package'), destination);
-      const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+      for (const pack of packs) {
+        assertInstallParents(root, pack.destination);
+        if (packPathExists(pack.destination) && !samePackTree(pack.destination, pack.staged)) {
+          fail('conflict', `installed knowledge pack differs from verified artifact: ${pack.name}`);
+        }
+      }
+      const moved: string[] = [];
       try {
+        for (const pack of packs) {
+          assertInstallParents(root, pack.destination);
+          if (packPathExists(pack.destination)) continue;
+          mkdirSync(dirname(pack.destination), { recursive: true });
+          assertInstallParents(root, pack.destination);
+          renameSync(pack.staged, pack.destination);
+          moved.push(pack.destination);
+        }
+        mkdirSync(dirname(destination), { recursive: true });
+        assertInstallParents(root, destination);
+        renameSync(join(stage, 'package'), destination);
+        moved.push(destination);
+        const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+        let installedSecurity: ReturnType<typeof inspectPluginSecurity>;
+        try { installedSecurity = inspectPluginSecurity(destination); }
+        catch { fail('scan', 'plugin package integrity verification failed'); }
+        if (installedSecurity.integrity !== security.integrity || installedSecurity.scan === 'dangerous') {
+          fail('scan', 'plugin package integrity changed during installation');
+        }
         writeLedger(root, [...listInstalledPlugins(root), item]);
+        return item;
       } catch (error) {
-        rmSync(destination, { recursive: true, force: true });
+        for (const path of moved.reverse()) {
+          assertInstallParents(root, path);
+          rmSync(path, { recursive: true, force: true });
+        }
         throw error;
       }
-      return item;
     });
     // The install is committed above; a listener that throws must not turn a finished install into a failure
     // (the ledger would say «installed» while the caller saw «io», and a retry would hit «conflict»).