elanous 0.2.4 → 0.2.5

package/src/nexus/boot/register-mcp-clients.ts

@@ -28,13 +28,21 @@
 //     daemon exit.
 
 import type { McpServerSpec } from '../../user-config.js';
-import { McpClient, McpConnectionError } from '../../mcp/client.js';
+import { McpClient, McpConnectionError, type McpToolCallResult } from '../../mcp/client.js';
 import {
   createMcpProxyRuntime,
   createMcpToolAuthorizer,
 } from '../../mcp/proxy-runtime.js';
 import { registerToolRuntime, unregisterToolRuntime } from '../../tool-runtime/registry.js';
 import { debug, redactSecretText } from '../../debug/log.js';
+import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { spawn as nodeSpawn } from 'node:child_process';
+import { listNodeKinds } from '../../graph-kinds/registry.js';
+import { syncInstalledPluginNodes } from '../../graph-kinds/installed-plugin-nodes.js';
+import { listInstalledPlugins } from '../../plugins/install/plugin-install.js';
+import { pluginEnv, credentialStatus } from '../../plugins/install/plugin-credentials.js';
+import { existsSync, realpathSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
 
 export interface McpClientsHandle {
   /** Live clients (one per successfully started server). */
@@ -172,24 +180,64 @@ export async function registerMcpClients(
   // breadcrumbs when a child (e.g. xcrun mcpbridge) deadlocked elanous's
   // boot. The trace category prefix `mcp.client.boot.*` keeps these
   // distinct from any per-call instrumentation a future PR adds.
+  const injectedValuesByServer = new Map<string, string[]>();
+  const redactPluginValues = (text: string): string => {
+    try {
+      const root = elanousStateRoot();
+      const current = [...new Set(listInstalledPlugins(root).map(item => item.name))]
+        .flatMap(name => Object.values(pluginEnv(name, root)));
+      return redactValues(text, [...current, ...injectedValuesByServer.values()].flat());
+    } catch { return '[REDACTED]'; }
+  };
   const bootLogger = (id: string) => (event: string, data?: Record<string, unknown>) => {
     try {
-      debug.log('mcp.client.boot', event, { id, ...(data ?? {}) });
+      const safe = data ? Object.fromEntries(Object.entries(data).map(([key, value]) =>
+        [key, typeof value === 'string' ? redactPluginValues(value) : value])) : {};
+      debug.log('mcp.client.boot', event, { id, ...safe });
     } catch { /* logger must never throw the boot */ }
   };
   const createClient =
     opts.createClient ??
-    ((spec: McpServerSpec) =>
-      spec.transport === 'http'
-        ? new McpClient({
-            id: spec.id,
-            url: spec.url,
-            logger: bootLogger(spec.id),
-            ...(spec.oauthIssuer ? { oauthIssuer: spec.oauthIssuer } : {}),
-            ...(spec.oauthTokenEndpoint ? { oauthTokenEndpoint: spec.oauthTokenEndpoint } : {}),
-            ...(spec.bearerTokenEnv ? { bearerTokenEnv: spec.bearerTokenEnv } : {}),
-          })
-        : new McpClient({ id: spec.id, command: spec.command, logger: bootLogger(spec.id) }));
+    ((spec: McpServerSpec) => {
+      if (spec.transport === 'http') return new McpClient({
+        id: spec.id, url: spec.url, logger: bootLogger(spec.id),
+        ...(spec.oauthIssuer ? { oauthIssuer: spec.oauthIssuer } : {}),
+        ...(spec.oauthTokenEndpoint ? { oauthTokenEndpoint: spec.oauthTokenEndpoint } : {}),
+        ...(spec.bearerTokenEnv ? { bearerTokenEnv: spec.bearerTokenEnv } : {}),
+      });
+      const root = elanousStateRoot();
+      const installed = listInstalledPlugins(root);
+      const owners = [...new Set(listNodeKinds('workflow').filter(entry =>
+        !entry.core && entry.plugin && entry.run && 'mcp' in entry.run && entry.run.mcp.server === spec.id,
+      ).map(entry => entry.plugin!))];
+      const commandOwners = [...new Set(installed.filter(item => {
+        const dir = realpathSync(item.path);
+        return spec.command.some(arg => {
+          if (typeof arg !== 'string' || !existsSync(arg)) return false;
+          try { return realpathSync(resolve(arg)).startsWith(`${dir}${sep}`); }
+          catch { return false; }
+        });
+      }).map(item => item.name))];
+      const selected = commandOwners.length === 1 && owners.length === 1 && owners[0] === commandOwners[0]
+        ? commandOwners[0] : undefined;
+      return new McpClient({ id: spec.id, command: spec.command, logger: bootLogger(spec.id),
+        spawn: (cmd, args) => {
+          const declaredEnv = [...new Set(listInstalledPlugins(root).map(item => item.name))]
+            .flatMap(name => credentialStatus(name, root).fields.map(field => field.env));
+          const childEnv = { ...process.env };
+          for (const key of declaredEnv) delete childEnv[key];
+          injectedValuesByServer.delete(spec.id);
+          if (selected) {
+            const env = pluginEnv(selected, root);
+            const fields = credentialStatus(selected, root).fields.filter(field => field.set).map(field => field.name);
+            debug.log('plugin.credentials', 'injected', { plugin: selected, fields, count: fields.length });
+            Object.assign(childEnv, env);
+            injectedValuesByServer.set(spec.id, Object.values(env));
+          }
+          return nodeSpawn(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'], env: childEnv });
+        },
+      });
+    });
   const handshakeTimeoutMs = opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
   const setTimeoutFn = opts.setTimeoutFn
     ?? ((cb: () => void, ms: number) => {
@@ -204,6 +252,11 @@ export async function registerMcpClients(
   const perServer: Record<string, McpServerBootResult> = {};
   let registered = 0;
 
+  if (opts.servers.some(spec => spec.transport === 'stdio') && !opts.createClient) {
+    try { syncInstalledPluginNodes(elanousStateRoot()); }
+    catch (error) { debug.log('graph.kinds', 'installed-sync-failed', { reason: String(error) }); }
+  }
+
   for (const spec of opts.servers) {
     const serverHandshakeTimeoutMs = spec.handshakeTimeoutMs ?? handshakeTimeoutMs;
     if (spec.enabled === false) {
@@ -213,6 +266,20 @@ export async function registerMcpClients(
     let client: McpClient | undefined;
     try {
       client = createClient(spec) as McpClient;
+      if (!opts.createClient && spec.transport === 'stdio') {
+        const originalCallTool = client.callTool.bind(client);
+        client.callTool = async (name: string, args: Record<string, unknown>): Promise<McpToolCallResult> => {
+          const values = injectedValuesByServer.get(spec.id) ?? [];
+          try {
+            const result = await originalCallTool(name, args);
+            return maskInjectedValues(result, values) as McpToolCallResult;
+          } catch (err) {
+            if (err instanceof Error) err.message = redactValues(err.message, values);
+            else throw new Error(redactValues(String(err), values));
+            throw err;
+          }
+        };
+      }
       await withTimeout(`mcp.${spec.id}.start`, () => client!.start(), serverHandshakeTimeoutMs, setTimeoutFn, clearTimeoutFn);
       const tools = await withTimeout(
         `mcp.${spec.id}.listTools`,
@@ -287,7 +354,7 @@ export async function registerMcpClients(
       }
       const msg = err instanceof Error ? err.message : String(err);
       const reasonClass = classifyMcpConnectFailure(err);
-      const detail = redactSecretText(msg);
+      const detail = redactPluginValues(redactSecretText(msg));
       perServer[spec.id] = { status: 'failed', toolCount: 0, reason: detail, reasonClass };
       try {
         debug.log('mcp.client.boot', 'connect-failed', { id: spec.id, reason: reasonClass, detail });
@@ -303,6 +370,7 @@ export async function registerMcpClients(
       if (client) {
         try { await client.dispose(); } catch { /* best-effort */ }
       }
+      injectedValuesByServer.delete(spec.id);
     }
   }
 
@@ -328,6 +396,7 @@ export async function registerMcpClients(
           }),
         ),
       );
+      injectedValuesByServer.clear();
     },
   };
 }
@@ -338,3 +407,19 @@ function defaultLogger(): McpBootLogger {
     warn: (line) => console.warn(line),
   };
 }
+
+function redactValues(text: string, values: readonly string[]): string {
+  return values.filter(value => value.length > 0)
+    .reduce((safe, value) => safe.replaceAll(value, '[REDACTED]'), text);
+}
+
+/** Mask injected credential values anywhere in an MCP result — string values **and object keys**
+ *  (a server can echo a secret back as a key, e.g. `structuredContent: { [secret]: "ok" }`). */
+export function maskInjectedValues(value: unknown, values: readonly string[]): unknown {
+  if (typeof value === 'string') return redactValues(value, values);
+  if (Array.isArray(value)) return value.map(item => maskInjectedValues(item, values));
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [redactValues(key, values), maskInjectedValues(item, values)]));
+  }
+  return value;
+}

package/src/nexus/index.ts

@@ -79,6 +79,8 @@ import { type PtyBackend, createWebtermSpawn, resolveWebtermCwd } from './webter
 import { SettingsTabController } from './config/settings-controller.js';
 import { tryRegisterSettings } from './boot/register-settings.js';
 import { registerMcpClients, type McpClientsHandle } from './boot/register-mcp-clients.js';
+import { syncInstalledPluginNodes } from '../graph-kinds/installed-plugin-nodes.js';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
 import type { McpReloadOutcome, McpReloadServerResult } from './api/admin-mcp-reload.js';
 import { loadOrCreateSigningKey, NonceStore } from './api/edit-in-pwa-core.js';
 import { subscribeErrorSnapshotWriter } from './supervisor/error-snapshot.js';
@@ -238,9 +240,8 @@ import {
   type PwaVoiceAdapter,
 } from '../voice/channel-adapters/pwa-voice-adapter.js';
 import { getIntakeStore } from '../intake-plane/runtime.js';
-import { existsSync, readFileSync } from 'node:fs';
 import { join as joinPath } from 'node:path';
-import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { ensureAuthToken } from '../auth/acp-token.js';
 import type { SupervisorSpawnBackend } from './supervisor/spawn.js';
 import type { HealthProbeBackend } from './supervisor/health.js';
 import { gracefulExit, cleanExit } from './supervisor/graceful-exit.js';
@@ -264,8 +265,10 @@ import { createGlobalSubagentCallable } from '../agent/subagent-callable.js';
 import { setAgentHopCap } from '../agent/registry.js';
 import type { SidebarTabSurface } from '../ui/widgets/sidebar-tab-surface.js';
 import { defaultIO, runOnboardingStep, type WizardIO } from '../onboarding.js';
+import { packageVersion } from '../version/code-revision.js';
 
-export const NEXUS_VERSION = '0.17.0';
+// 데몬 배너·`nexus status`·연결 라벨이 보이는 판 = 제품 판(`package.json`) — 옛 내부 상수 `0.17.0` 이 0.2.x 제품 옆에 떴다(🅞 M5 · M5c).
+export const NEXUS_VERSION = packageVersion();
 export const NEXUS_PHASE = 'N-5 PR χ (graceful exit + restart pending)';
 
 type TelegramAgentRunTurnFactory = typeof import('../telegram-agent.js').makeTelegramAgentRunTurn;
@@ -397,6 +400,8 @@ export interface RunNexusOptions {
    *  registry stays empty so the dispatcher's webterm interception
    *  is a no-op). */
   webtermSpawn?: (spec: { id: string; cwd?: string }) => PtyBackend;
+  /** Explicitly disable HTTP and ACP websocket token auth for this run. */
+  noAuth?: boolean;
   /** Skip the HTTP API server boot. Default: true in tests via
    *  detachForTesting; production runs always start the server. Tests
    *  that DO want the server can pass false explicitly. */
@@ -653,7 +658,7 @@ export interface RunNexusHandle {
 /** ACP WS auth gate for the NEXUS HTTP bridge.
  *  Same shape as `src/boot/acp-server.ts` websocket auth: pass
  *  `createAuthVerifier` only when a bearer token is configured;
- *  omit the field entirely for first-boot tokenless dogfood.
+ *  explicit no-auth opt-out omits the verifier.
  *  ⛔ `noAuth` was declared on WsBridgeOpts but the bridge NEVER read it
  *  (0 executable references) while this file assigned it — a value that
  *  flowed in and died. We removed the field rather than leave a knob that
@@ -710,7 +715,7 @@ export function buildNexusWsBridgeAuth(
   bearerToken: string | undefined,
   paths?: TokenStorePaths,
 ): Pick<NexusWsBridgeInit, 'wsAuthVerifier'> {
-  // ⛔ 첫 부팅 무인증 도그푸드는 그대로다 — 부팅 토큰이 «없으면» 검증기를 안 넘긴다.
+  // Explicit opt-out supplies no boot token, so the bridge has no verifier.
   if (!bearerToken) return {};
   return {
     // ⭐ 배열이 아니라 «공급자» — 매 핸드셰이크마다 봉투를 다시 읽는다.
@@ -764,6 +769,13 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
   }
 
   const leasePortFromLauncher = checkLauncherLeaseBoot(opts, process.env, () => resolveCurrentInstance().kind);
+  const noAuth = opts.noAuth === true || process.env.ELANOUS_NEXUS_NO_AUTH === '1';
+  // Resolve before acquiring the daemon lock or binding HTTP. A broken token
+  // store must fail closed without leaving a half-booted Nexus behind.
+  const httpBootEnabled = !(opts.skipHttpServer ?? !!opts.detachForTesting);
+  const needsToken = httpBootEnabled && !(opts.skipRuntimeApi ?? !!opts.detachForTesting) && !noAuth;
+  const bearerToken = needsToken ? ensureAuthToken().token : undefined;
+  if (needsToken && !bearerToken) throw new Error('Nexus auth token is empty');
 
   // 설치본 전환 RFC 0b — 키는 launchd plist 가 아니라 키 캐시에서(캐시 우선 · 자식도 물려받는다). 값은 안 찍고 «이름만».
   if (!opts.detachForTesting) {
@@ -973,6 +985,11 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     });
     const startLevel = resolvedLevel.level;
     dbgMod.debug.setLevel(startLevel);
+    if (httpBootEnabled && noAuth) {
+      dbgMod.debug.log('nexus.auth', 'explicit-opt-out', {
+        source: opts.noAuth === true ? '--no-auth' : 'ELANOUS_NEXUS_NO_AUTH',
+      }, { level: 'warn' });
+    }
     dbgMod.debug.log('logging.level', 'startup-resolved', {
       level: startLevel, source: resolvedLevel.source,
       gateOpen: scopedMod.hotPathGateOpen(startLevel), surface: 'nexus',
@@ -1340,6 +1357,10 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     current: () => false,
   };
 
+  // Installed graph kinds do not depend on the runtime API or MCP server configuration.
+  try { syncInstalledPluginNodes(elanousStateRoot()); }
+  catch (error) { debug.log('graph.kinds', 'installed-sync-failed', { reason: String(error) }); }
+
   if (!skipRuntime) {
     // Tool surface — flag · env · UserConfig switch · switch default.
     // See resolveToolsKind() jsdoc for resolution order.
@@ -2000,11 +2021,6 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     let metaApiOpts: import('./api/meta-api.js').MetaApiOpts | undefined;
 
     if (!skipRuntime && runtimeHistory) {
-      // Bearer token — read from getElanousConfigDir()/acp-token (the
-      // canonical store `elanous serve` uses). Loopback default is
-      // noAuth; tests opt in by writing a token file before boot.
-      const bearerToken = readAcpToken();
-
       // Voice REST + adapter. createVoiceRestHandler is stateless;
       // the STT provider singleton (getDaemonSttProvider) returns
       // null until `initDaemonSttProvider()` is called — fine, the
@@ -2081,9 +2097,8 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
       const surfaceForOpts = toolSurface(toolsKind);
       const toolCwdForOpts = resolveToolCwd({ tools: toolsKind, toolCwd: opts.toolCwd });
 
-      // Same shape as src/boot/acp-server.ts websocket auth: pass
-      // createAuthVerifier only when a token is present; omit it
-      // entirely for first-boot dogfood (tokenless ACP upgrade).
+      // ACP websocket and REST share the same boot token; explicit
+      // opt-out omits the websocket verifier as well.
       wsBridgeOpts = {
         ...(acpHandlerRef ? {
           acpOnConnection: async (conn) => {
@@ -2099,7 +2114,7 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
       metaApiOpts = {
         voiceRest,
         ...(bearerToken ? { bearerToken } : {}),
-        noAuth: !bearerToken,
+        noAuth,
         history: runtimeHistory,
         intakeStore: getIntakeStore(),
         toolSurface: surfaceForOpts,
@@ -3048,7 +3063,7 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     }
     runtime.httpPort = httpServer.port;
     runtime.httpHost = httpServer.hostname;
-    runtime.httpAuth = 'off';
+    runtime.httpAuth = metaApiOpts && !metaApiOpts.noAuth ? 'on' : 'off';
     // The actual bound port (not the requested port or registry entry) is the member endpoint.
     try {
       const configured = (getUserConfig().raw?.nexus as { primary?: unknown } | undefined)?.primary;
@@ -3475,6 +3490,9 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
   }
 
   printBootBanner(runtime, pwaStaticDir);
+  if (runtime.httpPort && noAuth) {
+    console.warn('  ⚠ NEXUS AUTH DISABLED (--no-auth / ELANOUS_NEXUS_NO_AUTH=1) — HTTP API and ACP websocket are unprotected.');
+  }
 
   // P.3 — first-boot PWA share wizard. Only runs in interactive TUI mode
   // when the switch is still 'ask'. Headless / non-TTY boots skip it (the
@@ -3784,23 +3802,6 @@ function shouldAskPwaShareSwitch(): boolean {
   }
 }
 
-/** PR k — load the persistent ACP bearer token at
- *  `getElanousConfigDir()/acp-token`. Mirrors the helper in
- *  `boot/acp-server.ts` that `elanous serve` uses, so the same token
- *  gates daemon and NEXUS HTTP. Returns undefined when the token
- *  file is absent (loopback noAuth default — first-boot dogfood
- *  works without configuration). Read failures are swallowed. */
-export function readAcpToken(): string | undefined {
-  try {
-    const tokenPath = joinPath(getElanousConfigDir(), 'acp-token');
-    if (existsSync(tokenPath)) {
-      const tok = readFileSync(tokenPath, 'utf-8').trim();
-      return tok || undefined;
-    }
-  } catch { /* swallow */ }
-  return undefined;
-}
-
 function printBootBanner(runtime: NexusRuntimeMeta, pwaStaticDir?: string): void {
   const lines = [
     '',

package/src/nexus/outbound/router.ts

@@ -141,7 +141,7 @@ export function resolveChannels(
 async function deliverTelegram(cfg: UserConfig, msg: OutboundMsg, deps: RouterDeps): Promise<ChannelResult> {
   const fmt = formatForChannel('telegram', msg);
   const send = deps.telegramSend ?? sendTelegramReport;
-  const ok = await send(cfg, fmt.text, { markdown: fmt.markdown ?? msg.markdown, fetchImpl: deps.fetchImpl });
+  const ok = await send(cfg, fmt.text, { markdown: fmt.markdown ?? msg.markdown, fetchImpl: deps.fetchImpl, kind: msg.kind });
   return ok ? { type: 'telegram', ok: true } : { type: 'telegram', ok: false, error: 'not-configured' };
 }
 

package/src/onboarding.ts

@@ -1193,6 +1193,27 @@ export function shouldRefuseInteractiveOnboarding(
   return o.ctx !== 'production' || !o.stdinIsTTY;
 }
 
+export class OnboardingRefusedError extends Error {
+  readonly code = 'onboarding-refused' as const;
+
+  constructor(message: string, readonly reason: 'non-tty' | 'autonomous-empty-universe') {
+    super(message);
+    this.name = 'OnboardingRefusedError';
+  }
+}
+
+/** Handle only typed refusals; the agent setup hint applies to its non-TTY path alone. */
+export function handleOnboardingRefusal(error: unknown, entrance: 'agent' | 'other'): boolean {
+  if (!(error instanceof OnboardingRefusedError) || error.code !== 'onboarding-refused') return false;
+  if (entrance === 'agent' && error.reason === 'non-tty') {
+    console.error('elanous agent needs a configured LLM. Run `elanous setup` in a terminal, or `elanous setup --non-interactive --config <path>` for unattended setup.');
+  } else {
+    console.error(error.message);
+  }
+  process.exitCode = 2;
+  return true;
+}
+
 function refuseInteractiveOnboardingIfNeeded(opts: RunWizardOpts, path: string): void {
   const ctx = getRunContext();
   const stdinIsTTY = !!input.isTTY;
@@ -1208,15 +1229,17 @@ function refuseInteractiveOnboardingIfNeeded(opts: RunWizardOpts, path: string):
       : '자율 컨텍스트에서 대화형 온보딩 요청 — 우주가 비어 있다(물질화 누락)',
   }, { level: 'error' });
   if (nonTTY) {
-    throw new Error(
+    throw new OnboardingRefusedError(
       '대화형 온보딩은 stdin TTY가 있는 자리에서만 실행할 수 있다. '
       + '무인 설정은 `elanous setup --non-interactive --config <path>`를 사용하라.',
+      'non-tty',
     );
   }
-  throw new Error(
+  throw new OnboardingRefusedError(
     `온보딩 마법사는 자율 컨텍스트(${ctx})에서 뜰 수 없다 — config 가 비어 있다(${path}). `
     + '자식 우주가 물질화되지 않았다는 뜻이다: `elanous config sync-test --state-dir <그 우주>` '
     + '로 깔거나, 스포너가 provisionDerivedUniverse 를 부르는지 확인하라.',
+    'autonomous-empty-universe',
   );
 }
 

package/src/plugins/core/host.ts

@@ -233,6 +233,14 @@ export const BUILTIN_DIR = resolve(import.meta.dir, '..', '..', '..', 'plugins')
 export const PACKS_DIR = resolve(import.meta.dir, '..', '..', '..', 'packs');
 export const USER_DIR = join(homedir(), '.claude', 'plugins');
 
+/** 코드 없이 스킬·그래프만 싣는 팩인가 — 진입점이 기본값(`./plugin.ts`)이고 파일이 없으며, 스킬·그래프를 선언하거나 `skills/` 폴더가 있다. */
+export function isSkillOnlyPack(pluginDir: string, manifest: { main: string; contributes?: { skills?: unknown[]; graphs?: unknown[] } }, hasLegacyEntry: boolean): boolean {
+  if (hasLegacyEntry) return false;
+  if (manifest.main !== './plugin.ts') return false; // 명시한 진입점이 없으면 그건 결함이다 — 경고를 유지한다.
+  const declares = (manifest.contributes?.skills?.length ?? 0) > 0 || (manifest.contributes?.graphs?.length ?? 0) > 0;
+  return declares || existsSync(join(pluginDir, 'skills'));
+}
+
 export class PluginHost {
   private available = new Map<string, PluginEntry>();
   private discoveredNodeKinds = new Map<string, NodeKindEntry>();
@@ -614,6 +622,12 @@ export class PluginHost {
         // ~/.claude/plugins/{cache,data,marketplaces} internal state)
         // are silently skipped: they never intended to be plugins.
         const looksLikePlugin = hasLegacyEntry || !manifestLoad.inferred;
+        // 스킬·그래프만 싣는 팩(공식 `elanous-basics` 등)은 코드 진입점이 없다 — 매니페스트가 `main` 을
+        // 적지 않아 기본값 `./plugin.ts` 가 들어온 것뿐이다. 부팅마다 «main not found» 경고를 내지 않는다.
+        if (looksLikePlugin && isSkillOnlyPack(pluginDir, manifestLoad.manifest, hasLegacyEntry)) {
+          debug.log('plugin.discovery', 'skill-only', { plugin: manifestLoad.manifest.id });
+          continue;
+        }
         if (looksLikePlugin) {
           this.hooks.log(`⚠ plugin "${manifestLoad.manifest.id}" main not found: ${manifestLoad.manifest.main}`);
           debug.log('plugin.discovery', 'error', {

package/src/plugins/install/market-fetch.ts

@@ -186,9 +186,10 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
   const load = async (file: string): Promise<Uint8Array> => {
     const url = new URL(file, market.url);
     let response: Response;
-    try { response = await fetcher(url.href); }
-    catch (error) { throw new MarketFetchError('io', `market fetch failed (${file}): ${error instanceof Error ? error.message : String(error)}`); }
+    try { response = await fetcher(url.href, { redirect: 'error' }); }
+    catch { throw new MarketFetchError('io', `market fetch failed (${file}): network error`); }
     if (!response.ok) throw new MarketFetchError('io', `market fetch failed (${file}): HTTP ${response.status}`);
+    if (response.redirected || (response.url && response.url !== url.href)) throw new MarketFetchError('io', `market fetch was redirected (${file})`);
     if (!response.body) throw new MarketFetchError('io', `market fetch failed (${file}): missing response body`);
     const reader = response.body.getReader();
     const chunks: Uint8Array[] = [];
@@ -203,7 +204,7 @@ async function fetchMarketIndex(name: string, opts: MarketFetchOptions): Promise
       }
     } catch (error) {
       if (error instanceof MarketFetchError) throw error;
-      throw new MarketFetchError('io', `market fetch failed (${file}): ${error instanceof Error ? error.message : String(error)}`);
+      throw new MarketFetchError('io', `market fetch failed (${file}): network error`);
     } finally {
       void reader.cancel().catch(() => {});
       reader.releaseLock();

package/src/plugins/install/plugin-credentials.ts

@@ -0,0 +1,106 @@
+import { randomBytes } from 'node:crypto';
+import { closeSync, existsSync, fchmodSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { loadPluginManifestFromDir } from '../core/manifest.js';
+import { listInstalledPlugins, withLedgerLock } from './plugin-install.js';
+
+const PLUGIN_NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
+const FIELD_NAME = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+type FieldStatus = { name: string; env: string; set: boolean };
+
+function credentialPath(name: string, root: string): string {
+  if (!PLUGIN_NAME.test(name)) throw new Error('invalid plugin name');
+  return join(root, 'plugins', 'credentials', `${name}.json`);
+}
+
+function declaredFields(name: string, root: string): Array<{ name: string; env: string }> {
+  if (!PLUGIN_NAME.test(name)) throw new Error('invalid plugin name');
+  const installed = listInstalledPlugins(root).filter(plugin => plugin.name === name);
+  if (installed.length === 0) throw new Error(`plugin not installed: ${name}`);
+  const fields = new Map<string, string>();
+  for (const plugin of installed) {
+    const manifest = loadPluginManifestFromDir(plugin.path, { id: plugin.name }).manifest;
+    for (const connector of manifest.contributes.connectors ?? []) {
+      for (const field of [
+        ...(connector.fields ?? []).map(item => ({ name: item.name, env: item.env })),
+        ...(connector.userConfig ?? []).map(item => ({ name: item.key, env: item.env })),
+      ]) {
+        if (!FIELD_NAME.test(field.name)) throw new Error('invalid plugin credential field name');
+        const env = field.env === undefined
+          ? `ELANOUS_PLUGIN_${name.replaceAll('-', '_').toUpperCase()}_${field.name.replaceAll('-', '_').toUpperCase()}`
+          : field.env;
+        if (typeof env !== 'string' || !ENV_NAME.test(env)) throw new Error('invalid plugin credential environment name');
+        if (fields.has(field.name) && fields.get(field.name) !== env) throw new Error('conflicting plugin credential environment name');
+        fields.set(field.name, env);
+      }
+    }
+  }
+  if (new Set(fields.values()).size !== fields.size) throw new Error('duplicate plugin credential environment name');
+  return [...fields].map(([fieldName, env]) => ({ name: fieldName, env })).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function readCredentials(path: string): Record<string, string> {
+  if (!existsSync(path)) return Object.create(null) as Record<string, string>;
+  if (!lstatSync(path).isFile()) throw new Error('invalid plugin credential file');
+  let parsed: unknown;
+  try { parsed = JSON.parse(readFileSync(path, 'utf8')); }
+  catch { throw new Error('invalid plugin credential file'); }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)
+    || Object.entries(parsed).some(([key, value]) => !FIELD_NAME.test(key) || typeof value !== 'string')) {
+    throw new Error('invalid plugin credential file');
+  }
+  return Object.assign(Object.create(null) as Record<string, string>, parsed);
+}
+
+/** Update one installed plugin's declared fields. null removes a field; omitted fields remain intact. */
+export function setPluginCredentials(name: string, fields: Record<string, string | null>, root = elanousStateRoot()): { set: string[] } {
+  const path = credentialPath(name, root);
+  if (!fields || typeof fields !== 'object' || Array.isArray(fields)) throw new Error('invalid plugin credential fields');
+  const allowed = new Set(declaredFields(name, root).map(field => field.name));
+  for (const [key, value] of Object.entries(fields)) {
+    if (!allowed.has(key) || (typeof value !== 'string' && value !== null) || (typeof value === 'string' && value.includes('\0'))) {
+      throw new Error('invalid plugin credential field');
+    }
+  }
+  return withLedgerLock(root, () => {
+    const current = readCredentials(path);
+    for (const [key, value] of Object.entries(fields)) {
+      if (value === null) delete current[key];
+      else current[key] = value;
+    }
+    if (Object.keys(fields).length === 0) return { set: [] };
+    mkdirSync(join(root, 'plugins', 'credentials'), { recursive: true, mode: 0o700 });
+    const temp = `${path}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try {
+        fchmodSync(fd, 0o600);
+        writeFileSync(fd, JSON.stringify(current));
+        fsyncSync(fd);
+      } finally { closeSync(fd); }
+      renameSync(temp, path);
+    } finally { rmSync(temp, { force: true }); }
+    return { set: Object.keys(fields).filter(key => Object.hasOwn(current, key)).sort() };
+  });
+}
+
+/** Public metadata only: values never leave the credential store. */
+export function credentialStatus(name: string, root = elanousStateRoot()): { fields: FieldStatus[] } {
+  const declared = declaredFields(name, root);
+  const saved = readCredentials(credentialPath(name, root));
+  return { fields: declared.map(field => ({ ...field, set: Object.hasOwn(saved, field.name) })) };
+}
+
+/** Environment entries intended only for this plugin's child process. */
+export function pluginEnv(name: string, root = elanousStateRoot()): Record<string, string> {
+  const declared = declaredFields(name, root);
+  const saved = readCredentials(credentialPath(name, root));
+  const env = Object.create(null) as Record<string, string>;
+  for (const field of declared) {
+    if (Object.hasOwn(saved, field.name)) env[field.env] = saved[field.name]!;
+  }
+  return env;
+}