elanous 0.2.22 → 0.2.24

package/src/ops/overview-cache.ts

@@ -0,0 +1,175 @@
+import { debug } from '../debug/log.js';
+import { parentPort, Worker } from 'node:worker_threads';
+import { collectOverview, type CollectOptions } from './overview-collect.js';
+import { computeVerdict, unmeasured, okCell, type OverviewSnapshot, type PodMemberRow } from './overview.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { getElanousConfigDirOverride, setElanousConfigDir } from '../elanous-config-dir.js';
+
+const SNAPSHOT_MS = 10_000;
+const POD_MS = 60_000;
+const POD_STALE_MS = 2 * POD_MS;
+/** Bounds for distinct (version, owner, since) keys: memo entries kept and collections in flight. */
+const MAX_MEMO = 32;
+const MAX_PENDING = 2;
+
+type PodReading = { context: string; occupied: number | null; reason: string | null; observedAt: number };
+type OverviewData = OverviewSnapshot & ReturnType<typeof computeVerdict> & { cacheAgeMs: number; durationMs: number; sources: string[]; refreshFailed: string | null };
+type WorkerMessage = ({ kind: 'pods' } | { kind: 'snapshot'; options: CollectOptions }) & { configDir?: string };
+
+/** The kubectl-capable grid reader lives in a worker, never on the HTTP event loop. */
+const port = parentPort;
+if (port) {
+  port.on('message', async (message: WorkerMessage) => {
+    try {
+      // A worker does not share the main thread's module state: carry the daemon's universe in.
+      if (message.configDir) setElanousConfigDir(message.configDir);
+      if (message.kind === 'pods') {
+        const { buildGridData } = await import('../nexus/api/grid.js');
+        const rows = buildGridData().members.map((m) => ({ context: m.context, occupied: m.occupied, reason: m.reason, observedAt: Date.now() }));
+        port.postMessage({ rows });
+      } else port.postMessage({ snapshot: await collectOverview(message.options) });
+    } catch (error) {
+      port.postMessage({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+}
+
+function workerRead<T>(message: WorkerMessage, timeoutMs: number, field: 'rows' | 'snapshot'): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(new URL('./overview-cache.ts', import.meta.url));
+    let settled = false;
+    const finish = (error?: Error, result?: T) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      void worker.terminate();
+      if (error) reject(error);
+      else resolve(result!);
+    };
+    const timeout = setTimeout(() => finish(new Error(`${field} 측정 시간 초과`)), timeoutMs);
+    worker.on('message', (result: { rows?: PodReading[]; snapshot?: OverviewSnapshot; error?: string }) => {
+      if (result.error) finish(new Error(result.error));
+      else finish(undefined, result[field] as T);
+    });
+    worker.on('error', (error) => finish(error instanceof Error ? error : new Error(String(error))));
+    const configDir = getElanousConfigDirOverride();
+    worker.postMessage({ ...message, ...(configDir ? { configDir } : {}) });
+  });
+}
+
+const measurePodsInWorker = () => workerRead<PodReading[]>({ kind: 'pods' }, 55_000, 'rows');
+const collectInWorker = (options: CollectOptions) => workerRead<OverviewSnapshot>({ kind: 'snapshot', options: { ...options, root: options.root ?? effectiveInstanceRoot() } }, 30_000, 'snapshot');
+
+function pendingSnapshot(at: number, since: string, reason: string): OverviewSnapshot {
+  const missing = <T>(name: string) => unmeasured<T>(name, reason);
+  return {
+    // Same resolution the collector uses; never the daemon's cwd.
+    generatedAt: new Date(at).toISOString(), instanceRoot: effectiveInstanceRoot(), since,
+    release: { version: missing('release.version'), run: missing('release.run'), schedule: missing('release.schedule'), checklist: missing('release.checklist') },
+    tasks: { byOwner: missing('tasks.byOwner'), done: missing('tasks.done'), launchable: missing('tasks.launchable'), capacity: missing('tasks.capacity') },
+    machines: { hosts: [], pods: [], parents: missing('machines.parents') },
+    landings: missing('landings'), loops: [],
+  };
+}
+
+export function createOverviewCache(deps: {
+  collect?: (opts: CollectOptions) => Promise<OverviewSnapshot>;
+  measurePods?: () => Promise<PodReading[]>;
+  now?: () => number;
+  schedule?: (tick: () => void, ms: number) => NodeJS.Timeout;
+} = {}) {
+  const now = deps.now ?? Date.now;
+  const collect = deps.collect ?? collectInWorker;
+  const backgroundSnapshot = !deps.collect;
+  const measurePods = deps.measurePods ?? measurePodsInWorker;
+  const schedule = deps.schedule ?? ((tick: () => void, ms: number): NodeJS.Timeout => setInterval(tick, ms));
+  // The memo holds the collected snapshot only; Pod occupancy and the verdict are
+  // overlaid at response time so a failed or stale (120 s) measurement shows at once.
+  type Entry = { at: number; snapshot: OverviewSnapshot; durationMs: number; failure?: string; retryAt?: number };
+  const memo = new Map<string, Entry>();
+  const pending = new Map<string, Promise<void>>();
+  let podRows: PodReading[] = [];
+  let podFailure: string | null = null;
+  let podTimer: ReturnType<typeof setInterval> | null = null;
+  let podPending = false;
+
+  const refreshPods = async () => {
+    if (podPending) return;
+    podPending = true;
+    try { podRows = await measurePods(); podFailure = null; }
+    catch (error) { podRows = []; podFailure = error instanceof Error ? error.message : String(error); }
+    finally { podPending = false; }
+  };
+  const start = () => {
+    if (podTimer) return;
+    // The timer starts on the first authorized read; measurement never runs on the request stack.
+    podTimer = schedule(() => { void refreshPods(); }, POD_MS);
+    podTimer.unref();
+  };
+  const present = (entry: Entry): OverviewData => {
+    const at = now();
+    const byContext = new Map(podRows.map((row) => [row.context, row]));
+    const pods: PodMemberRow[] = entry.snapshot.machines.pods.map((pod) => {
+      const row = byContext.get(pod.context);
+      const stale = row && at - row.observedAt >= POD_STALE_MS;
+      const occupied = !podFailure && row && !stale && row.occupied !== null
+        ? okCell(row.occupied, 'pod pool background measure', new Date(row.observedAt).toISOString())
+        : unmeasured<number>('pod pool background measure', podFailure ?? (stale ? '낡음(120초)' : row?.reason ?? '측정 대기'), row ? new Date(row.observedAt).toISOString() : null);
+      return { ...pod, occupied };
+    });
+    const full = { ...entry.snapshot, machines: { ...entry.snapshot.machines, pods } };
+    return { ...full, ...computeVerdict(full), durationMs: entry.durationMs,
+      sources: [full.release.run.source, full.tasks.launchable.source, full.tasks.capacity.source],
+      cacheAgeMs: Math.max(0, at - entry.at), refreshFailed: entry.failure ?? null };
+  };
+  const get = async (options: Pick<CollectOptions, 'version' | 'owner'> & { sinceMs?: number; sinceLabel?: string } = {}): Promise<OverviewData> => {
+    start();
+    const key = JSON.stringify([options.version ?? null, options.owner ?? null, options.sinceMs ?? 3_600_000]);
+    const at = now();
+    // Drop expired entries of other keys, then cap the memo (oldest first).
+    for (const [other, entry] of memo) if (other !== key && !pending.has(other) && at - entry.at >= SNAPSHOT_MS && (entry.retryAt ?? 0) <= at) memo.delete(other);
+    const cached = memo.get(key);
+    // A failed refresh keeps the original collection time (true age) and only delays the retry.
+    if (cached && (at - cached.at < SNAPSHOT_MS || backgroundSnapshot && pending.has(key) || (cached.retryAt ?? 0) > at)) return present(cached);
+    let current = pending.get(key);
+    if (!current && pending.size >= MAX_PENDING) {
+      // Collections in flight are capped; answer from what we have instead of starting another worker.
+      const entry = cached ?? { at, snapshot: pendingSnapshot(at, options.sinceLabel ?? '최근 1h', '동시 수집 상한'), durationMs: 0 };
+      return present({ ...entry, failure: entry.failure ?? `동시 수집 상한(${MAX_PENDING})` });
+    }
+    if (!current) {
+      // Evict only when a new key is about to be stored, never on a hit for an existing key.
+      if (!memo.has(key)) while (memo.size >= MAX_MEMO) { const oldest = [...memo.keys()].find((other) => !pending.has(other)); if (!oldest) break; memo.delete(oldest); }
+      if (backgroundSnapshot && !cached) {
+        // Placeholder until the worker answers; it is not a collection.
+        memo.set(key, { at, snapshot: pendingSnapshot(at, options.sinceLabel ?? '최근 1h', '백그라운드 스냅숏 수집 대기'), durationMs: 0 });
+      }
+      current = (async () => {
+        const startAt = now();
+        const snapshot = await collect({ sinceMs: options.sinceMs ?? 3_600_000, sinceLabel: options.sinceLabel ?? '최근 1h',
+          ...(options.version ? { version: options.version } : {}), ...(options.owner ? { owner: options.owner } : {}), now: startAt });
+        // Age counts from when collection started (= snapshot.generatedAt), not when it finished.
+        const entry = { at: startAt, snapshot, durationMs: now() - startAt };
+        memo.set(key, entry);
+        const verdict = present(entry);
+        debug.log('ops.overview', 'verdict', { verdict: verdict.verdict, reasons: verdict.reasons, cacheAgeMs: verdict.cacheAgeMs, durationMs: entry.durationMs });
+      })();
+      pending.set(key, current);
+      void current.then(
+        () => { pending.delete(key); },
+        (error) => {
+          pending.delete(key);
+          debug.log('ops.overview', 'refresh-failed', { reason: error instanceof Error ? error.message : String(error) });
+          const prior = memo.get(key);
+          if (prior) memo.set(key, { ...prior, failure: error instanceof Error ? error.message : String(error), retryAt: now() + SNAPSHOT_MS });
+        },
+      );
+    }
+    if (!backgroundSnapshot) {
+      try { await current; }
+      catch (error) { if (!memo.has(key)) throw error; }
+    }
+    return present(memo.get(key)!);
+  };
+  return { get, memoSize: () => memo.size, stop: () => { if (podTimer) clearInterval(podTimer); podTimer = null; memo.clear(); } };
+}

package/src/ops/overview.ts

@@ -6,6 +6,8 @@
  * ⛔ «못 잼»은 `value:null` ⊕ `reason` 이다 — 절대 0 으로 읽지 않는다(판정도 그렇다).
  */
 
+import { formatLandingThroughput, type LandingThroughput } from '../task-agent/cover.js';
+
 export type CellStatus = 'ok' | 'unmeasured' | 'partial';
 export interface Cell<T> {
   value: T | null;
@@ -84,6 +86,8 @@ export interface OverviewSnapshot {
     parents: Cell<ParentsInfo>;
   };
   landings: Cell<{ count: number; recent: string[] }>;
+  /** Optional until launch/PR/age sources are wired; existing snapshots keep their exact output. */
+  throughput?: Cell<LandingThroughput>;
   loops: LoopRow[];
 }
 
@@ -176,6 +180,7 @@ export function unmeasuredCells(s: OverviewSnapshot): string[] {
   for (const h of s.machines.hosts) visit(`machines.${h.name}`, h.load);
   for (const p of s.machines.pods) visit(`pods.${p.context}`, p.occupied);
   visit('machines.parents', s.machines.parents); visit('landings', s.landings);
+  if (s.throughput) visit('throughput', s.throughput);
   for (const l of s.loops) visit(`loops.${l.name}`, l.beat);
   return out;
 }
@@ -215,6 +220,9 @@ export function renderOverview(s: OverviewSnapshot, v: VerdictResult, meta: { el
   lines.push(`       Pod ${s.machines.pods.map((p) => `${p.context} ${show(p.occupied, String)}/${p.capacity}`).join(' · ') || '못 잼(풀 설정 없음)'}`);
   lines.push(`       하니스 부모(이 기계) ${show(s.machines.parents, (p) => `${p.count} · 6h 넘음 ${p.staleOver6h}${p.oldestHours !== null ? ` · 최고 ${p.oldestHours}h` : ''}`)}`);
   lines.push(`착지   ${s.since} ${show(s.landings, (l) => `${l.count}`)} [${s.landings.source}]`);
+  if (s.throughput) {
+    lines.push(`${show(s.throughput, formatLandingThroughput)} [${s.throughput.source}]`);
+  }
   for (const l of s.loops) {
     lines.push(`루프   ${l.name}${l.era === 'seat-era' ? ' [자리 시대 원천]' : ''} ${show(l.beat, (b) => `${kst(b.lastAt)} (${Math.round(b.ageSeconds / 60)}분 전)${b.alive === null ? '' : b.alive ? ' 살아 있음' : ' 프로세스 없음'}${l.staleAfterSeconds === null ? ' · 주기 미상(판정 제외)' : ''}`)}`);
   }

package/src/plugins/adapters/claude-package.ts

@@ -72,25 +72,17 @@ export function readClaudePackageLedger(
     return { status: 'installed-plugins-unreadable', packages: [] };
   }
 
-  const marketplacesRaw = readJsonFile(marketplacesPath);
-  if (marketplacesRaw === undefined) {
-    return { status: 'known-marketplaces-unreadable', packages: [] };
-  }
-
   const plugins = asPluginMap(installedRaw);
   if (plugins === undefined) {
     return { status: 'installed-plugins-unreadable', packages: [] };
   }
 
-  const marketplaces = asMarketplaceMap(marketplacesRaw);
-  if (marketplaces === undefined) {
-    return { status: 'known-marketplaces-unreadable', packages: [] };
-  }
-
+  const marketplaces = asMarketplaceMap(readJsonFile(marketplacesPath));
+  const status: ClaudePackageLedgerStatus = marketplaces === undefined ? 'known-marketplaces-unreadable' : 'ok';
   const packages: ClaudeInstalledPackage[] = [];
   for (const [key, records] of Object.entries(plugins)) {
     const { plugin, marketplace } = splitClaudePluginKey(key);
-    const source = formatMarketplaceSource(marketplaces[marketplace]);
+    const source = formatMarketplaceSource(marketplaces?.[marketplace]);
     for (const record of records) {
       packages.push({
         name: key,
@@ -104,7 +96,7 @@ export function readClaudePackageLedger(
     }
   }
 
-  return { status: 'ok', packages };
+  return { status, packages };
 }
 
 function readJsonFile(path: string): unknown {

package/src/plugins/core/capability-policy.ts

@@ -1,3 +1,6 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
 import type { ExecutionSurfaceSpec } from '../../display/index.js';
 import type { PluginCapability, PluginSource } from './manifest.js';
 
@@ -83,6 +86,144 @@ export class PluginCapabilityPolicy {
   }
 }
 
+export type PluginScanLevel = 'safe' | 'caution' | 'dangerous';
+export interface PluginSecurityFinding { level: Exclude<PluginScanLevel, 'safe'>; code: string }
+export interface PluginSecurityDecision {
+  scan: PluginScanLevel;
+  findings: PluginSecurityFinding[];
+  integrity: string;
+  license: 'redistributable' | 'restricted' | 'unknown';
+}
+
+/** Scan bytes before consent or installation. Only non-identifying codes leave this boundary. */
+export function inspectPluginSecurity(dir: string): PluginSecurityDecision {
+  const findings: PluginSecurityFinding[] = [];
+  const hash = createHash('sha256');
+  let license: PluginSecurityDecision['license'] = 'unknown';
+  // Code files are collected first; import/exec checks run after we know which files are reachable at runtime.
+  const code = new Map<string, { text: string; test: boolean }>();
+  const entrypoints: string[] = [];
+  const visit = (folder: string): void => {
+    for (const entry of readdirSync(folder, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+      const file = join(folder, entry.name);
+      const rel = relative(dir, file).replaceAll('\\', '/');
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+        findings.push({ level: 'dangerous', code: 'unsafe-entry' });
+        hash.update(rel).update('!\0');
+        continue;
+      }
+      if (entry.isDirectory()) { hash.update(rel).update('/\0'); visit(file); continue; }
+      hash.update(rel).update('\0');
+      // Size is checked before reading so an oversized import cannot exhaust memory in the scanner.
+      const size = statSync(file).size;
+      if (size > 2_000_000) {
+        hash.update(String(size)).update('\0').update('oversize');
+        findings.push({ level: 'dangerous', code: 'unscannable-file' });
+        continue;
+      }
+      const bytes = readFileSync(file);
+      hash.update(String(bytes.length)).update('\0').update(bytes);
+      if (/(?:^|\/)(?:\.env(?:\.|$)|id_rsa$|credentials?\.json$)/i.test(rel)) {
+        findings.push({ level: 'dangerous', code: 'credential-file' });
+      }
+      if (/(?:api[_-]?key|secret|token)\s*[:=]\s*[A-Za-z0-9_-]{16,}/i.test(rel)) {
+        findings.push({ level: 'dangerous', code: 'credential-filename' });
+      }
+      if (/^(?:LICENSE|LICENCE)(?:\.[^/]*)?$/i.test(rel)) {
+        if (/\b(?:MIT License|Apache License, Version 2\.0|BSD [23]-Clause|ISC License)\b/i.test(bytes.toString('utf8'))) license = 'redistributable';
+        else if (license !== 'redistributable') license = 'restricted';
+      }
+      if (bytes.includes(0)) {
+        findings.push({ level: 'dangerous', code: 'unscannable-file' });
+        continue;
+      }
+      const text = bytes.toString('utf8');
+      if (/^plugin\.json$/.test(rel)) {
+        try {
+          const manifest: unknown = JSON.parse(text);
+          if (manifest && typeof manifest === 'object' && !Array.isArray(manifest)) {
+            const raw = manifest as Record<string, unknown>;
+            const ext = raw.extensions && typeof raw.extensions === 'object' ? (raw.extensions as Record<string, unknown>)['ai.elanous'] : undefined;
+            for (const main of [raw.main, ext && typeof ext === 'object' ? (ext as Record<string, unknown>).main : undefined]) {
+              if (typeof main === 'string' && main.trim()) entrypoints.push(resolve(dir, main));
+            }
+            if (typeof raw.license === 'string' && raw.license.trim()) {
+              license = /^(?:MIT|Apache-2\.0|BSD-2-Clause|BSD-3-Clause|ISC|0BSD|CC0-1\.0)$/.test(raw.license.trim())
+                ? 'redistributable' : 'restricted';
+            }
+            const contributes = raw.contributes ?? (ext && typeof ext === 'object' ? (ext as Record<string, unknown>).contributes : undefined);
+            if (contributes && typeof contributes === 'object' && Array.isArray((contributes as Record<string, unknown>).hooks)
+              && ((contributes as Record<string, unknown>).hooks as unknown[]).length) {
+              findings.push({ level: 'caution', code: 'hooks-disabled' });
+            }
+          }
+        } catch { findings.push({ level: 'dangerous', code: 'invalid-manifest' }); }
+      }
+      // Quotes may be JSON-escaped (a value nested inside a JSON string field), so allow a backslash before them.
+      const sensitive = /(?:-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:\\?["'])?(?:api[_-]?key|secret|token)(?:\\?["'])?\s*[:=]\s*(\\?["'])?([A-Za-z0-9_\-]{16,})(\(?))/gi;
+      // Two narrow non-secrets: a documented placeholder (`tvly-YOUR_API_KEY`, `xxxxxxxx…`, `REPLACE_ME`) and an
+      // unquoted call result (`apiKey = getUpstageApiKey()`). Anything else that matches — quoted or not — still counts.
+      // Both exemptions look at the WHOLE value: a placeholder shape (optional vendor prefix), or a digit-free
+      // camelCase function name immediately called. A key with `xxxxxxxx` or `YOUR_` inside it still counts.
+      const placeholder = /^(?:[A-Za-z0-9]+[_-])*(?:YOUR[_-][A-Za-z_-]+|PLACEHOLDER[A-Za-z_-]*|REPLACE[_-]?ME[A-Za-z_-]*|x{8,})$/i;
+      const callee = /^[a-z_$][A-Za-z_$]*[a-z][A-Z][A-Za-z_$]*$/;
+      const hasSecret = [...text.matchAll(sensitive)].some(([, quote, value, call]) => value === undefined
+        || !(placeholder.test(value) || (!quote && call === '(' && callee.test(value))));
+      if (/(?:^|\/)(?:knowledge|knowledge-packs?)(?:\/|$)/i.test(rel) && hasSecret) {
+        findings.push({ level: 'dangerous', code: 'knowledge-dlp' });
+      } else if (hasSecret && !/\.lock$/.test(rel)) {
+        findings.push({ level: 'dangerous', code: 'embedded-secret' });
+      }
+      if (/\.[cm]?[jt]sx?$/.test(rel)) code.set(resolve(file), { text, test: /(?:^|\/)[^/]+\.(?:test|spec)\.[cm]?[jt]sx?$/.test(rel) });
+      if (/(?:curl|wget)\b[^\n|]*\|\s*(?:sh|bash)\b|\b(?:rm\s+-rf|sudo)\b/i.test(text)) {
+        findings.push({ level: 'dangerous', code: 'unsafe-command' });
+      }
+    }
+  };
+  visit(dir);
+  if (!entrypoints.length) entrypoints.push(resolve(dir, 'plugin.ts'));
+  // Shipped test fixtures are skipped only while nothing executable reaches them: the manifest `main`
+  // and every non-test code file are roots, and any test file they import (transitively) is scanned too.
+  const importsOf = (text: string): string[] =>
+    [...text.matchAll(/\b(?:import|export)\s*(?:[\s\S]*?\s+from\s*)?["']([^"']+)["']|\b(?:import|require)\s*\(\s*["']([^"']+)["']/g)]
+      .map(match => match[1] ?? match[2] ?? '').filter(Boolean);
+  const resolveLocal = (from: string, target: string): string | undefined => {
+    if (!target.startsWith('.')) return undefined;
+    const base = resolve(from, '..', target);
+    const swapped = base.replace(/\.([cm]?)js(x?)$/, '.$1ts$2');
+    return [base, swapped, `${base}.ts`, `${base}.tsx`, `${base}.js`, `${base}.mjs`, join(base, 'index.ts'), join(base, 'index.js')]
+      .find(candidate => code.has(candidate));
+  };
+  const reachable = new Set<string>();
+  const queue = [...entrypoints.filter(path => code.has(path)), ...[...code].filter(([, info]) => !info.test).map(([path]) => path)];
+  while (queue.length) {
+    const file = queue.pop()!;
+    if (reachable.has(file)) continue;
+    reachable.add(file);
+    for (const target of importsOf(code.get(file)!.text)) {
+      const next = resolveLocal(file, target);
+      if (next && !reachable.has(next)) queue.push(next);
+    }
+  }
+  for (const file of reachable) {
+    const text = code.get(file)!.text;
+    if (/\b(?:eval\s*\(|new\s+Function\s*\(|child_process\b|Bun\.spawn\s*\()/i.test(text)) {
+      findings.push({ level: 'caution', code: 'executable-code' });
+    }
+    for (const target of importsOf(text)) {
+      // A relative or absolute import must stay inside the package; the package's own `./src/…` is fine,
+      // while `../…/src/`, `/abs/…/src/` or a `file:` URL that can leave the package root is unsafe.
+      if (/^file:/i.test(target)
+        || ((target.startsWith('.') || target.startsWith('/')) && !resolve(file, '..', target).startsWith(`${resolve(dir)}${sep}`))) {
+        findings.push({ level: 'dangerous', code: 'unsafe-import' });
+      }
+    }
+  }
+  if ((license as PluginSecurityDecision['license']) !== 'redistributable') findings.push({ level: 'caution', code: 'private-only-license' });
+  return { scan: findings.some(f => f.level === 'dangerous') ? 'dangerous' : findings.length ? 'caution' : 'safe',
+    findings, integrity: hash.digest('hex'), license };
+}
+
 export function assertCapability(decision: CapabilityDecision): void {
   if (!decision.ok) throw new Error(decision.reason);
 }

package/src/plugins/core/host.ts

@@ -38,7 +38,7 @@ import { debug } from '../../debug/log.js';
 import { getSessionCwd } from '../../session/working-dir.js';
 import { CommandRegistry, type CommandDisposable, type RegisteredCommand } from '../../command-registry.js';
 import { PluginCapabilityPolicy, assertCapability } from './capability-policy.js';
-import { PluginTrustStore } from './trust-store.js';
+import { PluginTrustStore, enabledPluginHooks } from './trust-store.js';
 import { PluginTaskService } from './task-service.js';
 import { readClipboardText, writeClipboard } from '../../clipboard/index.js';
 import {
@@ -54,6 +54,7 @@ import { getGlobalElementRegistry, publishElementEvent } from '../../element-reg
 import { mintPluginUri } from '../../mss/uri/builder.js';
 import type { PluginUri } from '../../mss/uri/brand.js';
 import { loadPluginNodes } from '../../graph-kinds/plugin-nodes.js';
+import { registerOutboundAdapter } from '../../nexus/outbound/router.js';
 import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind, type NodeKindEntry } from '../../graph-kinds/registry.js';
 
 /** Clamp a tool handler's return value to something short enough for
@@ -113,8 +114,10 @@ export interface ActivePlugin {
   ownedCommandDisposables: CommandDisposable[];
   /** Task registrations for this activation. */
   ownedTaskDisposables: Array<{ dispose(): void }>;
-  /** PX-3: hook registrations (from manifest.contributes.hooks[] +
-   *  ctx.hooks.register calls). Disposed on deactivate. */
+  /** Connector registrations are owner-scoped and removed on deactivate. */
+  ownedChannelDisposers: Array<() => void>;
+  /** Hook registrations from manifest.contributes.hooks[]; disposed on deactivate.
+   *  PluginContext does not expose a programmatic hooks registration API. */
   ownedHookDisposers: Array<() => void>;
   /** PX-4: mission registrations (one per contributes.missions[] entry).
    *  Disposers tear down globalMissionRegistry entries on deactivate. */
@@ -369,13 +372,12 @@ export class PluginHost {
     }
   }
 
-  /** PX-3 P4: register all manifest-declared shell hooks for the
-   *  plugin we're activating. Disposers are tracked on the active
-   *  entry so deactivate() unregisters them. In-process hooks go
-   *  through ctx.hooks.register inside onActivate (see buildContext). */
+  /** Register manifest-declared shell hooks for the plugin being activated.
+   *  Installed plugins' hooks stay off (no approval path); disposers unregister them on deactivate. */
   private registerManifestHooks(entry: PluginEntry): void {
     if (!this.activeEntry) return;
-    const specs = entry.manifest.contributes.hooks ?? [];
+    const declared = entry.manifest.contributes.hooks ?? [];
+    const specs = enabledPluginHooks(declared, entry.source);
     if (specs.length === 0) return;
     // Lazy imports so headless tests that don't exercise hooks never
     // pull in the dispatcher stack.
@@ -770,6 +772,7 @@ export class PluginHost {
       ownedDisplayDisposables: [],
       ownedCommandDisposables: [],
       ownedTaskDisposables: [],
+      ownedChannelDisposers: [],
       ownedHookDisposers: [],
       ownedMissionDisposers: [],
       ownedRouteDisposers: [],
@@ -822,6 +825,13 @@ export class PluginHost {
     const ctx = this.buildContext();
     try {
       await plugin.onActivate?.(ctx);
+      for (const adapter of plugin.channelAdapters ?? []) {
+        if (!entry.manifest.contributes.connectors?.some(connector => connector.id === adapter.type)) {
+          throw new Error(`channel connector ${adapter.type} must be declared in contributes.connectors`);
+        }
+        // The manifest declaration alone is not an active channel.
+        this.activeEntry.ownedChannelDisposers.push(registerOutboundAdapter(adapter));
+      }
       // Resolve layout after onActivate so the plugin can initialize
       // state first (e.g. fetch remote rows). buildLayout can spawn
       // widgets via the tracked helper — we record ids for dispose.
@@ -848,6 +858,7 @@ export class PluginHost {
         for (const d of this.activeEntry.ownedDisplayDisposables) d.dispose();
         for (const d of this.activeEntry.ownedCommandDisposables) d.dispose();
         for (const d of this.activeEntry.ownedTaskDisposables) d.dispose();
+        for (const d of this.activeEntry.ownedChannelDisposers) d();
         for (const d of this.activeEntry.ownedHookDisposers) d();
         for (const d of this.activeEntry.ownedMissionDisposers) d();
         for (const d of this.activeEntry.ownedRouteDisposers) d();
@@ -880,6 +891,7 @@ export class PluginHost {
     for (const d of this.activeEntry.ownedDisplayDisposables) d.dispose();
     for (const d of this.activeEntry.ownedCommandDisposables) d.dispose();
     for (const d of this.activeEntry.ownedTaskDisposables) d.dispose();
+    for (const d of this.activeEntry.ownedChannelDisposers) d();
     const promptStore = getPromptBankStore();
     for (const id of this.activeEntry.promptFragmentIds) promptStore.delete(id);
     // PX-3: dispose hook registrations for this plugin.
@@ -1746,6 +1758,7 @@ function normalizePluginExport(plugin: Partial<ElanousPlugin>, manifest: PluginM
     ...(plugin.slashCommands ? { slashCommands: plugin.slashCommands } : {}),
     ...(plugin.keybindings ? { keybindings: plugin.keybindings } : {}),
     ...(plugin.llmTools ? { llmTools: plugin.llmTools } : {}),
+    ...(plugin.channelAdapters ? { channelAdapters: plugin.channelAdapters } : {}),
     ...(plugin.onActivate ? { onActivate: plugin.onActivate } : {}),
     ...(plugin.onDeactivate ? { onDeactivate: plugin.onDeactivate } : {}),
     ...(plugin.isBusy ? { isBusy: plugin.isBusy } : {}),

package/src/plugins/core/manifest.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import type { Keybinding, SlashCommand } from './types.js';
+import type { Keybinding, PluginDependency, SlashCommand } from './types.js';
 import type { PromptKind, PromptScope, PromptTargetSlot } from '../../prompt-bank/types.js';
 import type {
   MissionDefinition,
@@ -223,6 +223,8 @@ export interface PluginManifest {
   activationEvents: string[];
   contributes: PluginManifestContributes;
   capabilities: PluginCapability[];
+  /** `plugin.json` requirement metadata; does not trigger installation. */
+  requires?: PluginDependency;
   dependencies?: {
     widgets?: string[];
     plugins?: string[];
@@ -328,6 +330,7 @@ export function parsePluginManifest(
       ? raw.capabilities
       : [...parseCapabilities(raw.capabilities), ...parseCapabilities(extension.capabilities)]);
   const dependencies = parseDependencies(raw.dependencies);
+  const requires = parsePluginRequires(raw.requires === undefined ? extension.requires : raw.requires);
   const description = typeof raw.description === 'string' ? raw.description : undefined;
   const allowMultiActive = typeof raw.allowMultiActive === 'boolean' ? raw.allowMultiActive : undefined;
   const activePeerCompat = parseActivePeerCompat(raw.activePeerCompat);
@@ -341,6 +344,7 @@ export function parsePluginManifest(
     activationEvents,
     contributes,
     capabilities,
+    ...(requires ? { requires } : {}),
     ...(dependencies ? { dependencies } : {}),
     ...(allowMultiActive !== undefined ? { allowMultiActive } : {}),
     ...(activePeerCompat ? { activePeerCompat } : {}),
@@ -354,7 +358,7 @@ function objectOrEmpty(value: unknown, label: string): Record<string, unknown> {
   return value as Record<string, unknown>;
 }
 
-function parseElanousExtension(value: unknown): { contributes: Record<string, unknown>; capabilities?: unknown } {
+function parseElanousExtension(value: unknown): { contributes: Record<string, unknown>; capabilities?: unknown; requires?: unknown } {
   const extensions = objectOrEmpty(value, 'extensions');
   const extension = objectOrEmpty(extensions['ai.elanous'], 'extensions["ai.elanous"]');
   const contributes = objectOrEmpty(extension.contributes, 'extensions["ai.elanous"].contributes');
@@ -365,6 +369,7 @@ function parseElanousExtension(value: unknown): { contributes: Record<string, un
         .map(key => [key, extension[key]])),
     },
     capabilities: extension.capabilities,
+    requires: extension.requires,
   };
 }
 
@@ -1117,6 +1122,18 @@ function parseCapabilities(value: unknown): PluginCapability[] {
   });
 }
 
+function parsePluginRequires(value: unknown): PluginDependency | undefined {
+  if (value === undefined) return undefined;
+  const raw = objectOrEmpty(value, 'requires');
+  return {
+    ...(raw.elanous !== undefined ? { elanous: stringOr(raw.elanous) } : {}),
+    ...(raw.tools !== undefined ? { tools: stringArrayOr(raw.tools, []) } : {}),
+    ...(raw.optionalTools !== undefined ? { optionalTools: stringArrayOr(raw.optionalTools, []) } : {}),
+    ...(raw.optionalPython !== undefined ? { optionalPython: stringArrayOr(raw.optionalPython, []) } : {}),
+    ...(raw.knowledgePacks !== undefined ? { knowledgePacks: stringArrayOr(raw.knowledgePacks, []) } : {}),
+  };
+}
+
 function parseDependencies(value: unknown): PluginManifest['dependencies'] | undefined {
   if (value === undefined) return undefined;
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('dependencies must be an object');

package/src/plugins/core/trust-store.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { DATA_DIR } from '../../config.js';
+import type { PluginSecurityDecision } from './capability-policy.js';
 
 export type PluginTrustScope = 'user' | 'workspace';
 
@@ -16,6 +17,20 @@ interface PluginTrustFile {
   records: PluginTrustRecord[];
 }
 
+/** Ephemeral installation decision; never persisted as a trust record or a credential. */
+export function decidePluginInstallation(security: PluginSecurityDecision, capabilities: readonly string[], consent: boolean):
+  { ok: true } | { ok: false; reason: 'scan' | 'consent-denied' } {
+  if (security.scan === 'dangerous') return { ok: false, reason: 'scan' };
+  if (capabilities.length > 0 && !consent) return { ok: false, reason: 'consent-denied' };
+  return { ok: true };
+}
+
+/** Hooks default off for installed (imported/generated) plugins: there is no approval path yet, so none run.
+ *  Built-in and user-dir plugins keep their declared hooks unchanged. */
+export function enabledPluginHooks<T>(hooks: readonly T[], source: string): T[] {
+  return source === 'installed' ? [] : [...hooks];
+}
+
 export class PluginTrustStore {
   constructor(private readonly path = defaultPluginTrustPath()) {}
 

package/src/plugins/core/types.ts

@@ -26,6 +26,15 @@ import type {
 
 export type PaneSlot = 'skills' | 'files' | 'preview' | 'log' | 'hud';
 
+/** Requirements declared by a plugin.json `requires` block. This is metadata, not an install request. */
+export interface PluginDependency {
+  elanous?: string;
+  tools?: string[];
+  optionalTools?: string[];
+  optionalPython?: string[];
+  knowledgePacks?: string[];
+}
+
 export interface DashboardPaneSummary {
   pane: string;
   visible: boolean;
@@ -327,6 +336,9 @@ export interface ElanousPlugin<S = unknown> {
   slashCommands?: SlashCommand[];
   keybindings?: Keybinding[];
   llmTools?: LLMToolDef[];
+  /** Host registers only adapters also declared in contributes.connectors;
+   * registration is disposed with this plugin activation. */
+  channelAdapters?: import('../../nexus/outbound/router.js').ChannelAdapter[];
   onActivate?(ctx: PluginContext): void | Promise<void>;
   onDeactivate?(ctx: PluginContext): void | Promise<void>;
   /** Plugin is executing a long-running op — host blocks input while true.