elanous 0.2.22 → 0.2.24

package/src/plugins/install/market-fetch.ts

@@ -13,7 +13,14 @@ export const ELANOUS_MARKET_URL = 'https://elanvitalai.github.io/elanous-plugins
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const MAX_INDEX_BYTES = 8 * 1024 * 1024;
 
-export interface MarketConfig { name: string; url: string }
+export interface MarketConfig {
+  name: string;
+  url: string;
+  /** Explicit tenant allowlist for a private market; absent for existing plugin markets. */
+  enterpriseIds?: string[];
+  /** Keys bound to this private market, never inherited from the global plugin trust pool. */
+  trustedKeys?: Array<{ keyId: string; publicKey: string }>;
+}
 export interface MarketFetchOptions {
   root?: string;
   marketDir?: string;
@@ -75,6 +82,24 @@ function configuredMarkets(settings: Record<string, unknown>): MarketConfig[] {
     return { name, url: marketUrl(url) };
   });
 }
+function internalMarkets(settings: Record<string, unknown>): MarketConfig[] {
+  const entries = settings.internalMarkets;
+  if (entries === undefined) return [];
+  if (!Array.isArray(entries)) throw new MarketFetchError('io', 'invalid internal markets configuration');
+  const names = new Set<string>();
+  return entries.map((entry: unknown) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) throw new MarketFetchError('io', 'invalid internal market configuration');
+    const { name, url, enterpriseIds, trustedKeys } = entry as Record<string, unknown>;
+    if (typeof name !== 'string' || !NAME.test(name) || names.has(name) || name === 'elanous') throw new MarketFetchError('io', `invalid or duplicate internal market name: ${String(name)}`);
+    if (!Array.isArray(enterpriseIds) || !enterpriseIds.length || !enterpriseIds.every(id => typeof id === 'string' && id.trim() && id === id.trim())
+      || new Set(enterpriseIds).size !== enterpriseIds.length) throw new MarketFetchError('io', `invalid internal market enterprise allowlist: ${name}`);
+    if (!Array.isArray(trustedKeys) || !trustedKeys.length || !trustedKeys.every(key => key && typeof key === 'object' && typeof key.keyId === 'string' && /^[a-fA-F0-9]{8}$/.test(key.keyId) && typeof key.publicKey === 'string' && key.publicKey.length > 0)
+      || new Set(trustedKeys.map(key => key.keyId)).size !== trustedKeys.length) throw new MarketFetchError('io', `invalid internal market trusted keys: ${name}`);
+    names.add(name);
+    return { name, url: marketUrl(url), enterpriseIds: enterpriseIds as string[], trustedKeys: trustedKeys as Array<{ keyId: string; publicKey: string }> };
+  });
+}
+
 function trust(settings: Record<string, unknown>, opts: MarketFetchOptions): ReadonlyArray<{ keyId: string; publicKey: string }> {
   const additional = settings.trustedKeys;
   if (additional !== undefined && (!Array.isArray(additional) || !additional.every(key => key && typeof key.keyId === 'string' && typeof key.publicKey === 'string'))) {
@@ -115,7 +140,7 @@ function location(name: string, opts: MarketFetchOptions): string {
   return join(resolve(opts.marketDir ?? join(opts.root ?? elanousStateRoot(), 'markets')), name);
 }
 
-interface CacheState { url: string; lastSequence: number; indexHash: string; signatureHash: string }
+interface CacheState { url: string; lastSequence: number; indexHash: string; signatureHash: string; trustHash?: string }
 
 function cacheState(path: string): CacheState | undefined {
   if (!existsSync(path)) return undefined;
@@ -123,13 +148,14 @@ function cacheState(path: string): CacheState | undefined {
   try { value = JSON.parse(readFileSync(path, 'utf8')); }
   catch { throw new MarketFetchError('io', 'invalid market cache state'); }
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new MarketFetchError('io', 'invalid market cache state');
-  const { url, lastSequence, indexHash, signatureHash } = value as Record<string, unknown>;
+  const { url, lastSequence, indexHash, signatureHash, trustHash } = value as Record<string, unknown>;
   if (typeof url !== 'string' || !Number.isSafeInteger(lastSequence) || (lastSequence as number) < 0
     || typeof indexHash !== 'string' || !/^[a-f0-9]{64}$/.test(indexHash)
-    || typeof signatureHash !== 'string' || !/^[a-f0-9]{64}$/.test(signatureHash)) {
+    || typeof signatureHash !== 'string' || !/^[a-f0-9]{64}$/.test(signatureHash)
+    || (trustHash !== undefined && (typeof trustHash !== 'string' || !/^[a-f0-9]{64}$/.test(trustHash)))) {
     throw new MarketFetchError('io', 'invalid market cache state');
   }
-  return { url, lastSequence: lastSequence as number, indexHash, signatureHash };
+  return { url, lastSequence: lastSequence as number, indexHash, signatureHash, ...(trustHash === undefined ? {} : { trustHash }) };
 }
 
 function digest(bytes: Uint8Array | string): string {
@@ -147,9 +173,21 @@ function checked(bytes: Uint8Array, signatureText: string, name: string, keys: R
 const marketIndexQueues = new Map<string, Promise<void>>();
 
 export function ensureMarketIndex(name: string, opts: MarketFetchOptions = {}): Promise<MarketIndex> {
-  const directory = location(name, opts);
+  return queuedMarketIndex(name, opts);
+}
+
+/** Private indices require a configured market, a bound signing key and an explicitly allowed enterprise. */
+export function ensureInternalMarketIndex(name: string, enterpriseId: string, opts: MarketFetchOptions = {}): Promise<MarketIndex> {
+  if (typeof enterpriseId !== 'string' || !enterpriseId.trim() || enterpriseId !== enterpriseId.trim()) {
+    return Promise.reject(new MarketFetchError('io', `enterprise not allowed for internal market: ${name}`));
+  }
+  return queuedMarketIndex(name, opts, enterpriseId);
+}
+
+function queuedMarketIndex(name: string, opts: MarketFetchOptions, enterpriseId?: string): Promise<MarketIndex> {
+  const directory = enterpriseId === undefined ? location(name, opts) : join(resolve(opts.marketDir ?? join(opts.root ?? elanousStateRoot(), 'markets')), '.internal', name, digest(enterpriseId));
   const previous = marketIndexQueues.get(directory) ?? Promise.resolve();
-  const result = previous.then(() => fetchMarketIndex(name, opts));
+  const result = previous.then(() => fetchMarketIndex(name, opts, enterpriseId, directory));
   const tail = result.then(() => {}, () => {});
   marketIndexQueues.set(directory, tail);
   void tail.then(() => {
@@ -158,11 +196,25 @@ export function ensureMarketIndex(name: string, opts: MarketFetchOptions = {}):
   return result;
 }
 
-async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise<MarketIndex> {
-  const market = listMarkets(opts).find(entry => entry.name === name);
+async function fetchMarketIndex(name: string, opts: MarketFetchOptions, enterpriseId: string | undefined, directory: string): Promise<MarketIndex> {
+  const settings = marketSettings(config(opts));
+  const market: MarketConfig | undefined = enterpriseId === undefined
+    ? [{ name: 'elanous', url: ELANOUS_MARKET_URL }, ...configuredMarkets(settings)].find(entry => entry.name === name)
+    : internalMarkets(settings).find(entry => entry.name === name);
   if (!market) throw new MarketFetchError('io', `market not configured: ${name}`);
-  const keys = trust(marketSettings(config(opts)), opts);
-  const directory = location(name, opts);
+  if (enterpriseId !== undefined && !market.enterpriseIds?.includes(enterpriseId)) {
+    throw new MarketFetchError('io', `enterprise not allowed for internal market: ${name}`);
+  }
+  const keys = enterpriseId === undefined ? trust(settings, opts) : market.trustedKeys!;
+  const verificationOptions = enterpriseId === undefined ? opts : { ...opts, verifySignature: verifyIndex };
+  const trustHash = enterpriseId === undefined ? undefined : digest(JSON.stringify(keys));
+  const authorized = (verified: ReturnType<typeof checked>): ReturnType<typeof checked> => {
+    if (enterpriseId !== undefined && [...(verified.index.knowledgePacks ?? []), ...(verified.index.loopBundles ?? [])]
+      .some(entry => entry.visibility !== 'internal' || entry.enterpriseId !== enterpriseId)) {
+      throw new MarketFetchError('io', `internal market contains entries outside enterprise allowlist: ${name}`);
+    }
+    return verified;
+  };
   const indexFile = join(directory, 'marketplace.json');
   const sigFile = join(directory, 'index.sig');
   const stateFile = join(directory, 'cache-state.json');
@@ -170,12 +222,12 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
   // The URL is part of the cache identity, not just the market name.
   const lastSequence = state?.url === market.url ? state.lastSequence : undefined;
   let cached: ReturnType<typeof checked> | undefined;
-  if (state?.url === market.url && existsSync(indexFile) && existsSync(sigFile)) {
+  if (state?.url === market.url && (trustHash === undefined || state.trustHash === trustHash) && existsSync(indexFile) && existsSync(sigFile)) {
     const indexBytes = readFileSync(indexFile);
     const signatureText = readFileSync(sigFile, 'utf8');
     if (digest(indexBytes) === state.indexHash && digest(signatureText) === state.signatureHash) {
       try {
-        cached = checked(indexBytes, signatureText, name, keys, opts, lastSequence);
+        cached = authorized(checked(indexBytes, signatureText, name, keys, verificationOptions, lastSequence));
       } catch (error) {
         if (!(error instanceof MarketFetchError)) throw error;
       }
@@ -216,13 +268,13 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
   };
   const bytes = await load('marketplace.json');
   const signature = new TextDecoder('utf-8', { fatal: true }).decode(await load('index.sig'));
-  const verified = checked(bytes, signature, name, keys, opts, lastSequence);
+  const verified = authorized(checked(bytes, signature, name, keys, verificationOptions, lastSequence));
   mkdirSync(directory, { recursive: true });
   // Cross-process: another CLI may have published a newer index since we read cache-state. Re-check the high-water
   // mark under a file lock right before publishing, so a slower process cannot roll the cache back (review R3).
   return withFileLockSync(join(directory, '.publish.lock'), () => {
   const current = cacheState(stateFile);
-  if (current?.url === market.url && current.lastSequence !== undefined && current.lastSequence > verified.index.sequence) {
+  if (current?.url === market.url && current.lastSequence > verified.index.sequence) {
     throw new MarketFetchError('signature', `market index rollback refused: ${name} sequence ${verified.index.sequence} < ${current.lastSequence}`);
   }
   const staging = mkdtempSync(join(directory, '.index-'));
@@ -232,7 +284,7 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
     const tempState = join(staging, 'cache-state.json');
     writeFileSync(tempIndex, bytes);
     writeFileSync(tempSig, signature);
-    writeFileSync(tempState, JSON.stringify({ url: market.url, lastSequence: verified.index.sequence, indexHash: digest(bytes), signatureHash: digest(signature) } satisfies CacheState));
+    writeFileSync(tempState, JSON.stringify({ url: market.url, lastSequence: verified.index.sequence, indexHash: digest(bytes), signatureHash: digest(signature), ...(trustHash === undefined ? {} : { trustHash }) } satisfies CacheState));
     // Commit the verified high-water mark before replacing either cache file.
     // An interrupted publication then cannot roll back a previously verified index.
     renameSync(tempState, stateFile);

package/src/plugins/install/plugin-install.ts

@@ -2,14 +2,16 @@ import { createHash, randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { dlopen, FFIType } from 'bun:ffi';
 import { loadPluginManifestFromDir, type PluginManifest } from '../core/manifest.js';
+import { inspectPluginSecurity } from '../core/capability-policy.js';
+import { decidePluginInstallation } from '../core/trust-store.js';
 import { loadPluginNodes } from '../../graph-kinds/plugin-nodes.js';
 import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind } from '../../graph-kinds/registry.js';
 import { verifyIndex, type MarketplaceIndex, type VerifyIndexResult } from '../../market/signed-index.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
-import { ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
+import { ensureInternalMarketIndex, ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
 
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/;
@@ -48,6 +50,8 @@ export interface InstallOptions {
   consent?: (capabilities: string[]) => boolean | Promise<boolean>;
   fetcher?: MarketFetchOptions['fetcher'];
   configPath?: string;
+  /** Enterprise context for knowledge packs in a private market. */
+  enterpriseId?: string;
 }
 
 export class PluginInstallError extends Error {
@@ -83,6 +87,53 @@ function safeTree(root: string): void {
   }
 }
 
+function packPathExists(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+/** Never follow a linked installation root or parent while reusing, moving or rolling back a package. */
+function assertInstallParents(root: string, destination: string): void {
+  const parts = relative(root, dirname(destination)).split(sep).filter(Boolean);
+  if (parts.some(part => part === '..') || isAbsolute(relative(root, destination))) fail('io', `unsafe installation path: ${destination}`);
+  // macOS exposes system aliases such as /var -> /private/var; inspect the
+  // canonical path after that alias, without exempting any caller-owned parent.
+  const systemAlias = process.platform === 'darwin' && ['/var', '/tmp'].find(path => root === path || root.startsWith(`${path}${sep}`));
+  const checkedRoot = systemAlias ? resolve(realpathSync(systemAlias), relative(systemAlias, root)) : root;
+  const parents = [checkedRoot];
+  while (dirname(parents[0]!) !== parents[0]) parents.unshift(dirname(parents[0]!));
+  let parent = checkedRoot;
+  for (const part of parts) {
+    parent = join(parent, part);
+    parents.push(parent);
+  }
+  for (const path of parents) {
+    try {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) fail('io', `unsafe installation parent: ${path}`);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+/** Only an unchanged, ordinary extracted tree can satisfy the verified staged artifact. */
+function samePackTree(existing: string, verified: string): boolean {
+  if (!lstatSync(existing).isDirectory()) return false;
+  const current = readdirSync(existing, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const expected = readdirSync(verified, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  if (current.length !== expected.length) return false;
+  return current.every((entry, i) => {
+    const other = expected[i]!;
+    if (entry.name !== other.name || entry.isSymbolicLink() || other.isSymbolicLink()) return false;
+    if (entry.isDirectory() && other.isDirectory()) return samePackTree(join(existing, entry.name), join(verified, entry.name));
+    return entry.isFile() && other.isFile() && readFileSync(join(existing, entry.name)).equals(readFileSync(join(verified, entry.name)));
+  });
+}
+
 function copyPlugin(source: string, destination: string): void {
   if (!existsSync(source) || !lstatSync(source).isDirectory()) fail('io', `plugin directory not found: ${source}`);
   safeTree(source);
@@ -189,21 +240,33 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
       refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys,
     });
   } catch (error) {
-    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && opts.enterpriseId !== undefined) {
+      try {
+        marketIndex = await ensureInternalMarketIndex(marketName, opts.enterpriseId, {
+          root: opts.root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+        });
+      } catch (internalError) {
+        if (internalError instanceof MarketFetchError) throw new PluginInstallError(internalError.reason, internalError.message);
+        throw internalError;
+      }
+    } else if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
       return localMarketSource(spec, target, opts);
-    }
-    if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
-    throw error;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
   }
   const matches = marketIndex.index.plugins.filter(entry => entry.name === name);
   if (matches.length !== 1) fail('io', `plugin not found or ambiguous in ${marketName}: ${name}`);
   const entry = matches[0]!;
-  const artifact = entry.artifact;
+  await fetchVerifiedArtifact(entry.artifact, marketIndex.market.url, target, opts);
+  return { market: marketName, sha256: entry.artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function fetchVerifiedArtifact(artifact: MarketplaceIndex['plugins'][number]['artifact'], marketUrl: string, target: string, opts: InstallOptions): Promise<void> {
   if (!artifact || typeof artifact.key !== 'string' || !artifact.key || !HASH.test(artifact.sha256)
     || !Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) fail('io', 'invalid artifact key, hash or size');
   // Check the key as written, before URL resolution folds `..`/`.` or percent-encoded separators away.
   if (!/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(artifact.key) || artifact.key.split('/').some(part => part === '.' || part === '..')) fail('io', 'unsafe artifact key');
-  const base = new URL(marketIndex.market.url);
+  const base = new URL(marketUrl);
   const url = new URL(artifact.key, base);
   if (url.protocol !== 'https:' || url.origin !== base.origin || !url.pathname.startsWith(base.pathname)
     || url.username || url.password || url.search || url.hash || /[\\?#]/.test(artifact.key)) fail('io', 'unsafe artifact key');
@@ -235,7 +298,77 @@ async function fetchedMarketSource(spec: string, target: string, opts: InstallOp
     fail('scan', 'artifact sha256 or size mismatch');
   }
   unpackArchive(bytes, target);
-  return { market: marketName, sha256: artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+async function stageRequiredKnowledgePacks(names: string[], market: string, stage: string, root: string, opts: InstallOptions): Promise<Array<{ name: string; destination: string; staged: string }>> {
+  if (!names.length) return [];
+  if (market === 'local') fail('io', 'knowledge pack requires need a signed market');
+  const unique = [...new Set(names)];
+  if (unique.some(name => !NAME.test(name))) fail('io', 'invalid required knowledge pack name');
+  let index: MarketplaceIndex;
+  let url: string | undefined;
+  let directory: string | undefined;
+  let internalVerified = false;
+  try {
+    const options = { root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher,
+      refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys };
+    let result: Awaited<ReturnType<typeof ensureMarketIndex>>;
+    try { result = await ensureMarketIndex(market, options); }
+    catch (error) {
+      if (!(error instanceof MarketFetchError) || !/^market not configured: /.test(error.message) || opts.enterpriseId === undefined) throw error;
+      result = await ensureInternalMarketIndex(market, opts.enterpriseId, options);
+      internalVerified = true;
+    }
+    index = result.index;
+    url = result.market.url;
+  } catch (error) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(market, opts)) {
+      const path = indexPath(market, opts);
+      directory = dirname(path);
+      const sig = join(directory, 'index.sig');
+      if (!existsSync(sig)) fail('signature', `missing index.sig: ${market}`);
+      const result = (opts.verifySignature ?? verifyIndex)({ marketplaceBytes: readFileSync(path), signatureText: readFileSync(sig, 'utf8'), trustedKeys: opts.trustedKeys ?? [] });
+      if (!result.ok) fail('signature', `${result.reason}: ${result.detail}`);
+      if (result.index.name !== market) fail('io', `market index name mismatch: ${market}`);
+      index = result.index;
+    } else if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    else throw error;
+  }
+  const packs: Array<{ name: string; destination: string; staged: string }> = [];
+  for (const name of unique) {
+    const matches = (index.knowledgePacks ?? []).filter(entry => entry.name === name);
+    if (matches.length !== 1) fail('io', `required knowledge pack not found or ambiguous: ${name}`);
+    const entry = matches[0]!;
+    if (!VERSION.test(entry.version)) fail('io', `invalid required knowledge pack version: ${name}`);
+    if (entry.visibility === 'internal') {
+      if (!opts.enterpriseId || entry.enterpriseId !== opts.enterpriseId) fail('io', `knowledge pack not authorized: ${name}`);
+      if (!internalVerified) {
+        try {
+          const authorized = await ensureInternalMarketIndex(market, opts.enterpriseId, {
+            root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher, refresh: opts.refresh,
+          });
+          if (!authorized.index.knowledgePacks?.some(pack => pack.name === name && pack.version === entry.version
+            && pack.artifact.sha256 === entry.artifact.sha256 && pack.artifact.bytes === entry.artifact.bytes
+            && pack.artifact.key === entry.artifact.key)) fail('io', `knowledge pack not authorized: ${name}`);
+        } catch (error) {
+          if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+          throw error;
+        }
+      }
+    }
+    const staged = join(stage, `knowledge-${packs.length}`);
+    if (directory) {
+      const artifactPath = inside(directory, entry.artifact.key);
+      if (!existsSync(artifactPath) || !realpathSync(artifactPath).startsWith(`${realpathSync(directory)}${sep}`)) fail('scan', `unsafe knowledge pack artifact: ${name}`);
+      const bytes = readFileSync(artifactPath);
+      if (bytes.length !== entry.artifact.bytes || (opts.hashArtifact ?? (data => createHash('sha256').update(data).digest('hex')))(bytes).toLowerCase() !== entry.artifact.sha256.toLowerCase()) fail('scan', 'artifact sha256 or size mismatch');
+      unpackArchive(bytes, staged);
+    } else {
+      await fetchVerifiedArtifact(entry.artifact, url!, staged, opts);
+    }
+    packs.push({ name, staged, destination: join(root, 'knowledge-packs', market, name, entry.version) });
+  }
+  return packs;
 }
 
 export function resolvePluginSource(spec: string, target: string, opts: InstallOptions = {}): ResolvedPluginSource {
@@ -308,7 +441,9 @@ function declaresMain(packageRoot: string): boolean {
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   mkdirSync(stageRoot, { recursive: true });
+  assertInstallParents(root, join(stageRoot, 'plugin'));
   const stage = mkdtempSync(join(stageRoot, 'plugin-'));
   try {
     const source = marketSpec(spec, opts)
@@ -348,11 +483,20 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const destination = join(root, 'plugins', source.market, name, version);
     const emit = (event: InstallEvent) => opts.onEvent?.(event);
     emit({ event: 'resolve', plugin: name, version, sha256: source.sha256 });
-    emit({ event: 'verify', signature: source.signature, scan: 'safe' });
+    let security: ReturnType<typeof inspectPluginSecurity>;
+    try { security = inspectPluginSecurity(packageRoot); }
+    catch { fail('scan', 'plugin static security scan failed'); }
+    emit({ event: 'verify', signature: source.signature, scan: security.scan });
     const capabilities = manifest.capabilities.map(capability => capability.kind);
     const required = capabilities.length > 0;
+    const preConsent = decidePluginInstallation(security, capabilities, false);
+    if (!preConsent.ok && preConsent.reason === 'scan') fail('scan', 'plugin static security scan rejected package');
     emit({ event: 'consent', capabilities, required });
-    if (required && !(opts.yes || await opts.consent?.(capabilities))) fail('consent-denied', 'plugin capabilities require consent');
+    const consented = !required || !!(opts.yes || await opts.consent?.(capabilities));
+    const decision = decidePluginInstallation(security, capabilities, consented);
+    if (!decision.ok) fail(decision.reason, decision.reason === 'scan'
+      ? 'plugin static security scan rejected package' : 'plugin capabilities require consent');
+    const packs = await stageRequiredKnowledgePacks(manifest.requires?.knowledgePacks ?? [], source.market, stage, root, opts);
     emit({ event: 'credentials', connectors: (manifest.contributes.connectors ?? []).map(connector => ({
       id: connector.id, fields: (connector.fields ?? connector.userConfig?.map(field => ({ name: field.key, secret: field.secret })) ?? [])
         .map(field => ({ name: field.name, secret: field.secret === true })),
@@ -370,17 +514,44 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const { nodes, nodeErrors } = inspectPluginNodes(packageRoot, manifest);
     emit({ event: 'registered', kinds, nodes, nodeErrors, graphs, skills });
     const installed = withLedgerLock(root, () => {
+      assertInstallParents(root, destination);
       if (existsSync(destination)) fail('conflict', `plugin already installed: ${name}@${version}`);
-      mkdirSync(dirname(destination), { recursive: true });
-      renameSync(join(stage, 'package'), destination);
-      const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+      for (const pack of packs) {
+        assertInstallParents(root, pack.destination);
+        if (packPathExists(pack.destination) && !samePackTree(pack.destination, pack.staged)) {
+          fail('conflict', `installed knowledge pack differs from verified artifact: ${pack.name}`);
+        }
+      }
+      const moved: string[] = [];
       try {
+        for (const pack of packs) {
+          assertInstallParents(root, pack.destination);
+          if (packPathExists(pack.destination)) continue;
+          mkdirSync(dirname(pack.destination), { recursive: true });
+          assertInstallParents(root, pack.destination);
+          renameSync(pack.staged, pack.destination);
+          moved.push(pack.destination);
+        }
+        mkdirSync(dirname(destination), { recursive: true });
+        assertInstallParents(root, destination);
+        renameSync(join(stage, 'package'), destination);
+        moved.push(destination);
+        const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
+        let installedSecurity: ReturnType<typeof inspectPluginSecurity>;
+        try { installedSecurity = inspectPluginSecurity(destination); }
+        catch { fail('scan', 'plugin package integrity verification failed'); }
+        if (installedSecurity.integrity !== security.integrity || installedSecurity.scan === 'dangerous') {
+          fail('scan', 'plugin package integrity changed during installation');
+        }
         writeLedger(root, [...listInstalledPlugins(root), item]);
+        return item;
       } catch (error) {
-        rmSync(destination, { recursive: true, force: true });
+        for (const path of moved.reverse()) {
+          assertInstallParents(root, path);
+          rmSync(path, { recursive: true, force: true });
+        }
         throw error;
       }
-      return item;
     });
     // The install is committed above; a listener that throws must not turn a finished install into a failure
     // (the ledger would say «installed» while the caller saw «io», and a retry would hit «conflict»).

package/src/plugins/maker/plugin-maker.ts

@@ -10,6 +10,7 @@ import { dispatchOmniSearch } from '../../skills/tools/omni-search.js';
 import { runGraph } from '../../graph-runner/runner.js';
 import { parseGraphTemplateYaml } from '../../self-implement/graph-yaml.js';
 import { installPlugin } from '../install/plugin-install.js';
+import { inspectPluginSecurity } from '../core/capability-policy.js';
 import { generateWizardFiles, type WizardResearchDraft } from './wizard-generate.js';
 import { bundleInstalledWizardPlugin, type MarketBundleResult } from './market-bundle.js';
 
@@ -127,7 +128,7 @@ export async function validatePluginDir(dir: string): Promise<string[]> {
     if (lstatSync(file).isSymbolicLink()) errors.push('안전하지 않은 plugin.json 링크');
     else manifest = JSON.parse(readFileSync(file, 'utf8'));
   }
-  catch (error) { errors.push(`plugin.json 파싱 실패: ${String(error)}`); }
+  catch { errors.push('plugin.json 파싱 실패'); }
   const extension = isRecord(manifest) && isRecord(manifest.extensions) ? manifest.extensions['ai.elanous'] : undefined;
   const graphs = isRecord(extension) ? extension.graphs : undefined;
   if (isRecord(extension) && extension.contributes !== undefined) errors.push('extension contributes 덮어쓰기 금지');
@@ -143,69 +144,73 @@ export async function validatePluginDir(dir: string): Promise<string[]> {
     if (lstatSync(file).isSymbolicLink()) errors.push('안전하지 않은 recipes.yaml 링크');
     else recipes = parseYaml(readFileSync(file, 'utf8'));
   }
-  catch (error) { errors.push(`recipes.yaml 파싱 실패: ${String(error)}`); }
+  catch { errors.push('recipes.yaml 파싱 실패'); }
   if (!isRecord(recipes)) errors.push('recipes.yaml 은 맵이어야 한다');
   else for (const [id, recipe] of Object.entries(recipes)) {
     if (!isRecord(recipe) ||
       (!(typeof recipe.command === 'string' && recipe.command.trim()) && !(typeof recipe.approval === 'string' && recipe.approval.trim())) ||
       (recipe.command !== undefined && (typeof recipe.command !== 'string' || !recipe.command.trim())) ||
       (recipe.approval !== undefined && (typeof recipe.approval !== 'string' || !recipe.approval.trim())) ||
-      (recipe.timeout_ms !== undefined && (!Number.isSafeInteger(recipe.timeout_ms) || Number(recipe.timeout_ms) <= 0))) errors.push(`잘못된 recipe: ${id}`);
+      (recipe.timeout_ms !== undefined && (!Number.isSafeInteger(recipe.timeout_ms) || Number(recipe.timeout_ms) <= 0))) errors.push(`잘못된 recipe: ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'}`);
   }
   for (const graph of Array.isArray(graphs) ? graphs : []) {
     if (typeof graph !== 'string') continue;
     const file = inside(dir, graph);
-    if (!file || !/^\.\/graphs\/[a-zA-Z0-9_-]+\.ya?ml$/.test(graph)) { errors.push(`안전하지 않은 graph 경로: ${graph}`); continue; }
+    if (!file || !/^\.\/graphs\/[a-zA-Z0-9_-]+\.ya?ml$/.test(graph)) { errors.push('안전하지 않은 graph 경로'); continue; }
     try {
-      if (lstatSync(file).isSymbolicLink()) { errors.push(`안전하지 않은 graph 링크: ${graph}`); continue; }
+      if (lstatSync(file).isSymbolicLink()) { errors.push('안전하지 않은 graph 링크'); continue; }
       const parsed = parseGraphTemplateYaml(readFileSync(file, 'utf8'), file);
-      errors.push(...parsed.errors.map(issue => `${issue.path}: ${issue.message}`));
+      errors.push(...parsed.errors.map(() => 'graph 정의 오류'));
       const template = parsed.template;
       if (!template) continue;
-      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(template.graphId)) errors.push(`잘못된 graph_id: ${template.graphId}`);
+      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(template.graphId)) errors.push('잘못된 graph_id');
       if (template.terminalNodes.length !== 2 || !template.terminalNodes.includes('done') || !template.terminalNodes.includes('failed')) errors.push('terminal_nodes 는 done, failed 이어야 한다');
       const executionNodes = template.nodes.filter(node => !template.terminalNodes.includes(node.nodeId));
       if (executionNodes.length < 2) errors.push(`실행 노드는 2개 이상이어야 한다: ${executionNodes.length}개`);
       for (const node of template.nodes) {
         if (node.recipe.startsWith('cmd:')) {
           const id = node.recipe.slice(4);
-          if (!isRecord(recipes) || !isRecord(recipes[id]) || recipes[id].approval !== undefined || typeof recipes[id].command !== 'string' || !recipes[id].command.trim()) errors.push(`recipe ${id} 없음`);
+          if (!isRecord(recipes) || !isRecord(recipes[id]) || recipes[id].approval !== undefined || typeof recipes[id].command !== 'string' || !recipes[id].command.trim()) errors.push(`recipe ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'} 없음`);
         } else if (node.recipe.startsWith('approval:')) {
           const id = node.recipe.slice(9);
-          if (!isRecord(recipes) || !isRecord(recipes[id]) || typeof recipes[id].approval !== 'string' || !recipes[id].approval.trim()) errors.push(`approval recipe ${id} 없음`);
-        } else if (node.recipe !== 'none') errors.push(`지원하지 않는 recipe: ${node.recipe}`);
+          if (!isRecord(recipes) || !isRecord(recipes[id]) || typeof recipes[id].approval !== 'string' || !recipes[id].approval.trim()) errors.push(`approval recipe ${/^[a-zA-Z0-9_-]+$/.test(id) ? id : 'invalid'} 없음`);
+        } else if (node.recipe !== 'none') errors.push(`지원하지 않는 recipe: ${/^[a-zA-Z0-9_:-]+$/.test(node.recipe) ? node.recipe : 'invalid'}`);
       }
-    } catch (error) { errors.push(`${graph} 파싱 실패: ${String(error)}`); }
+    } catch { errors.push('graph 파싱 실패'); }
   }
   const visit = (path: string): void => {
     for (const entry of readdirSync(path, { withFileTypes: true })) {
       const file = join(path, entry.name);
-      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) { errors.push(`안전하지 않은 파일: ${file}`); continue; }
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) { errors.push('안전하지 않은 파일'); continue; }
       if (entry.isDirectory()) visit(file);
       else if (/\.[cm]?[jt]sx?$/.test(entry.name)) {
         const source = readFileSync(file, 'utf8');
         for (const match of source.matchAll(/\b(?:import|export)\s*(?:[\s\S]*?\s+from\s*)?["']([^"']+)["']|\b(?:import|require)\s*\(\s*["']([^"']+)["']/g)) {
           const target = match[1] ?? match[2]!;
-          if (/(?:^|\/)src\//.test(target) && (target.startsWith('/') || target.startsWith('.'))) errors.push(`src import 금지: ${file}: ${target}`);
+          if (/(?:^|\/)src\//.test(target) && (target.startsWith('/') || target.startsWith('.'))) errors.push('src import 금지');
         }
       }
     }
   };
-  try { visit(dir); } catch (error) { errors.push(`파일 검사 실패: ${String(error)}`); }
+  try { visit(dir); } catch { errors.push('파일 검사 실패'); }
   try {
     const example = join(dir, 'examples', 'input.json');
     if (lstatSync(example).isSymbolicLink()) errors.push('안전하지 않은 examples/input.json 링크');
     else JSON.parse(readFileSync(example, 'utf8'));
-  } catch (error) { errors.push(`examples/input.json 파싱 실패: ${String(error)}`); }
+  } catch { errors.push('examples/input.json 파싱 실패'); }
+  let security: ReturnType<typeof inspectPluginSecurity>;
+  try { security = inspectPluginSecurity(dir); }
+  catch { errors.push('보안 검사 실패'); return errors; }
+  if (security.scan === 'dangerous') errors.push(...security.findings.filter(f => f.level === 'dangerous').map(f => `보안 검사 차단: ${f.code}`));
   const step = join(dir, 'graphs', 'run-step.ts');
   try {
     if (!existsSync(step)) errors.push('run-step.ts 없음');
-    else if (errors.some(error => error.startsWith('안전하지 않은 파일:'))) return errors;
+    else if (errors.some(error => error.startsWith('안전하지 않은 파일'))) return errors;
     else {
       const build = await Bun.build({ entrypoints: [step], target: 'bun' });
-      if (!build.success) errors.push(...build.logs.map(log => `run-step.ts 문법 오류: ${log.message}`));
+      if (!build.success) errors.push('run-step.ts 문법 오류');
     }
-  } catch (error) { errors.push(`run-step.ts 문법 오류: ${String(error)}`); }
+  } catch { errors.push('run-step.ts 문법 오류'); }
   return errors;
 }
 
@@ -359,7 +364,7 @@ export async function makePlugin({ request, draftFile, name, parentDir, run, mar
   const step = async (stage: keyof MakePluginResult['timings'], action: () => void | Promise<void>): Promise<void> => {
     const start = performance.now();
     try { await action(); }
-    finally { const ms = Math.round(performance.now() - start); timings[stage] = ms; debug.log('plugin.maker', stage, { ms, errors: result.errors }); }
+    finally { const ms = Math.round(performance.now() - start); timings[stage] = ms; debug.log('plugin.maker', stage, { ms, errors: redactSecrets(result.errors) }); }
   };
   try {
     emit('request', request);
@@ -461,7 +466,7 @@ export async function makePlugin({ request, draftFile, name, parentDir, run, mar
     }
   } catch (error) {
     result.status = 'failed';
-    result.errors.push(error instanceof Error ? error.message : String(error));
+    result.errors.push(redactSecretText(error instanceof Error ? error.message : String(error)));
   } finally {
     emit('done', result.status, { errors: result.errors });
   }

package/src/plugins/maker/wizard-generate.ts

@@ -10,6 +10,7 @@ export interface WizardResearchDraft {
     credentials?: Array<{ name: string }>;
   }>;
   skill?: { description: string; instructions: string; requires?: string[] };
+  requires?: { knowledgePacks?: string[] };
 }
 
 const SLUG = /^[a-z0-9][a-z0-9-]{1,31}$/;
@@ -46,9 +47,16 @@ export function generateWizardFiles(dir: string, slug: string, draft: WizardRese
   if (!Array.isArray(requires) || requires.some(resource => typeof resource !== 'string' || !knownResources.has(resource))) {
     throw new Error('wizard requires must reference existing resource ids');
   }
+  if (draft.requires !== undefined && (!draft.requires || typeof draft.requires !== 'object' || Array.isArray(draft.requires) ||
+    Object.keys(draft.requires).some(key => key !== 'knowledgePacks') ||
+    (draft.requires.knowledgePacks !== undefined && (!Array.isArray(draft.requires.knowledgePacks) ||
+      draft.requires.knowledgePacks.some(pack => typeof pack !== 'string' || !pack.trim()))))) {
+    throw new Error('wizard knowledge packs must be non-empty names');
+  }
   const manifestPath = join(dir, 'plugin.json');
   const existing = existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, 'utf8')) as {
-    name: string; description?: string; extensions: { 'ai.elanous': { connectors?: unknown[]; graphs?: string[]; researchDraft?: boolean } };
+    name: string; description?: string; requires?: { knowledgePacks?: string[]; [key: string]: unknown };
+    extensions: { 'ai.elanous': { connectors?: unknown[]; graphs?: string[]; researchDraft?: boolean } };
   } : undefined;
   if (existing && (existing.name !== slug || !existing.extensions?.['ai.elanous'])) {
     throw new Error('wizard scaffold name or extension mismatch');
@@ -69,9 +77,13 @@ export function generateWizardFiles(dir: string, slug: string, draft: WizardRese
     throw new Error('wizard cannot replace existing scaffold connectors');
   }
   const manifest = existing ?? { name: slug, version: '0.1.0', description: draft.description,
+    requires: undefined as { knowledgePacks?: string[]; [key: string]: unknown } | undefined,
     extensions: { 'ai.elanous': { graphs: [`./graphs/${slug}.yaml`],
       capabilities: ['fs:workdir', 'proc:bun', 'proc:elanous'], connectors: [] as unknown[], researchDraft: true } } };
   if (options.regenerate) manifest.description = draft.description;
+  if (draft.requires?.knowledgePacks !== undefined) {
+    manifest.requires = { ...manifest.requires, knowledgePacks: [...new Set(draft.requires.knowledgePacks)] };
+  }
   manifest.extensions['ai.elanous'].connectors = connectors;
   manifest.extensions['ai.elanous'].researchDraft = true;
 
@@ -125,7 +137,8 @@ export function listWizardDrafts(parent: string): Array<{ name: string; descript
       const skillPath = join(skillDir, 'SKILL.md');
       if (lstatSync(manifestPath).isSymbolicLink() || lstatSync(skillDir).isSymbolicLink() || lstatSync(skillPath).isSymbolicLink()) return [];
       const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as {
-        name?: string; description?: string; extensions?: { 'ai.elanous'?: { researchDraft?: boolean; connectors?: Array<{ id: string; fields: Array<{ name: string }> }> } } };
+        name?: string; description?: string; requires?: { knowledgePacks?: string[] };
+        extensions?: { 'ai.elanous'?: { researchDraft?: boolean; connectors?: Array<{ id: string; fields: Array<{ name: string }> }> } } };
       if (manifest.name !== entry.name || manifest.extensions?.['ai.elanous']?.researchDraft !== true) return [];
       const skill = readFileSync(skillPath, 'utf8');
       const parts = /^---\n([\s\S]*?)---\n\n([\s\S]*)$/.exec(skill);
@@ -134,6 +147,7 @@ export function listWizardDrafts(parent: string): Array<{ name: string; descript
       return [{ name: entry.name, description: manifest.description, draft: {
         description: manifest.description,
         connectors: manifest.extensions['ai.elanous'].connectors?.map(connector => ({ id: connector.id, credentials: connector.fields.map(field => ({ name: field.name })) })) ?? [],
+        ...(manifest.requires?.knowledgePacks !== undefined ? { requires: { knowledgePacks: manifest.requires.knowledgePacks } } : {}),
         skill: { description: meta.description ?? manifest.description, instructions: parts[2]!.trimEnd(), requires: meta.requires ?? [] },
       } }];
     } catch { return []; }