flavor-code 1.2.17 → 1.2.20

package/dist/desktop/plugin-worker-entry.js

@@ -0,0 +1,230 @@
+// src/plugins/plugin-worker-entry.ts
+import { readFile, realpath } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createContext, runInContext, SourceTextModule } from "vm";
+import { parentPort, workerData } from "worker_threads";
+var MAX_MODULE_BYTES = 2 * 1024 * 1024;
+var CONTRIBUTION_NAME_SOURCE = "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$";
+var data = workerData;
+var port = parentPort;
+if (port === null) throw new Error("Plugin sandbox requires a parent port");
+var activationKeepAlive = setInterval(() => void 0, 1e3);
+function send(message) {
+  port.postMessage(message);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function assertContained(root, candidate) {
+  const delta = relative(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep}`) || isAbsolute(delta)) throw new Error("Plugin module import escapes the plugin root");
+}
+var SANDBOX_BOOTSTRAP = `(() => {
+  "use strict";
+  const stores = { command: new Map(), tool: new Map(), hook: new Map(), skillRoot: new Map(), modelAdapter: new Map() };
+  let deactivate;
+  let accepting = true;
+  const signal = Object.freeze({ aborted: false, reason: undefined, addEventListener() {}, removeEventListener() {}, throwIfAborted() {} });
+  const cloneJson = (value) => value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+  const deepFreeze = (value) => {
+    if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+    for (const child of Object.values(value)) deepFreeze(child);
+    return Object.freeze(value);
+  };
+  const config = deepFreeze(JSON.parse(globalThis.__flavorConfigJson));
+  delete globalThis.__flavorConfigJson;
+  const namePattern = new RegExp(${JSON.stringify(CONTRIBUTION_NAME_SOURCE)});
+  const name = (value) => {
+    const result = String(value);
+    if (!namePattern.test(result)) throw new Error("Invalid contribution name: " + result);
+    return result;
+  };
+  const register = (kind, rawName, value, metadata) => {
+    if (!accepting) throw new Error("Plugin registrations are closed after activation");
+    const contributionName = name(rawName);
+    if (stores[kind].has(contributionName)) throw new Error("Duplicate " + kind + " contribution: " + contributionName);
+    stores[kind].set(contributionName, { value, metadata });
+    let active = true;
+    return Object.freeze(function disposeRegistration() {
+      if (!active) return;
+      active = false;
+      stores[kind].delete(contributionName);
+    });
+  };
+  const context = Object.freeze({
+    signal,
+    config,
+    logger: Object.freeze({ debug() {}, info() {}, warn() {}, error() {} }),
+    services: Object.freeze({ filesystem: Object.freeze({
+      async readFile() { throw new Error("Filesystem read is not available in sandbox"); },
+      async writeFile() { throw new Error("Filesystem write is not available in sandbox"); },
+    }) }),
+    registerCommand(rawName, handler, description) {
+      if (typeof handler !== "function") throw new Error("Sandbox command handler must be a function");
+      return register("command", rawName, handler, { description: typeof description === "string" ? description : undefined });
+    },
+    registerTool(rawName, tool) {
+      if (!tool || typeof tool !== "object" || typeof tool.execute !== "function") throw new Error("Sandbox tool must provide execute(input, signal, context)");
+      return register("tool", rawName, tool, {
+        toolName: typeof tool.name === "string" ? tool.name : String(rawName),
+        description: typeof tool.description === "string" ? tool.description : "Plugin tool " + String(rawName),
+        modelInputSchema: cloneJson(tool.modelInputSchema), readOnly: tool.readOnly === true,
+      });
+    },
+    registerHook(rawName, handler, options) {
+      if (typeof handler !== "function") throw new Error("Sandbox hook handler must be a function");
+      return register("hook", rawName, handler, { options: cloneJson(options) });
+    },
+    registerSkillRoot(rawName, root) {
+      if (typeof root !== "string") throw new Error("Sandbox skill root must be a string");
+      return register("skillRoot", rawName, root, { root });
+    },
+    registerModelAdapter(rawName, adapter) {
+      if (!adapter || typeof adapter.stream !== "function") throw new Error("Sandbox model adapter must provide stream(request)");
+      return register("modelAdapter", rawName, adapter, {});
+    },
+  });
+  const describe = () => ({
+    commands: [...stores.command].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    tools: [...stores.tool].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    hooks: [...stores.hook].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    skillRoots: [...stores.skillRoot].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    modelAdapters: [...stores.modelAdapter].map(([entryName]) => ({ name: entryName })),
+  });
+  const invoke = async (kind, entryName, args) => {
+    const entry = stores[kind]?.get(entryName);
+    if (!entry) throw new Error("Unknown sandbox contribution: " + kind + ":" + entryName);
+    if (kind === "command") return entry.value(args[0], Object.freeze({ ...(args[1] || {}), signal }));
+    if (kind === "tool") return entry.value.execute(args[0], signal, args[1]);
+    if (kind === "hook") return entry.value(args[0], signal);
+    if (kind === "modelAdapter") {
+      const events = [];
+      for await (const event of entry.value.stream(args[0])) events.push(event);
+      return events;
+    }
+    throw new Error("Unsupported sandbox invocation kind: " + kind);
+  };
+  globalThis.__flavorSandbox = Object.freeze({
+    async activate(fn) {
+      const result = await fn(context);
+      if (result !== undefined && typeof result !== "function") throw new Error("Plugin activate result must be a disposer or undefined");
+      deactivate = result;
+      accepting = false;
+      return JSON.stringify(describe());
+    },
+    async invokeJson(kind, entryName, argsJson) {
+      try { return JSON.stringify({ ok: true, value: await invoke(kind, entryName, JSON.parse(argsJson)) }); }
+      catch (error) { return JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) }); }
+    },
+    async shutdown() { if (deactivate) await deactivate(); deactivate = undefined; },
+  });
+})();`;
+async function loadPlugin(pluginRoot, entryPath) {
+  const context = createContext(/* @__PURE__ */ Object.create(null), {
+    name: `flavor-plugin:${data.pluginName}`,
+    codeGeneration: { strings: false, wasm: false }
+  });
+  context.__flavorConfigJson = data.configJson;
+  runInContext(SANDBOX_BOOTSTRAP, context, { timeout: 1e3 });
+  const modules = /* @__PURE__ */ new Map();
+  const getModule = async (input) => {
+    const physical = await realpath(input);
+    assertContained(pluginRoot, physical);
+    const existing = modules.get(physical);
+    if (existing !== void 0) return existing;
+    const source = await readFile(physical, "utf8");
+    if (Buffer.byteLength(source) > MAX_MODULE_BYTES) throw new Error(`Plugin module exceeds ${MAX_MODULE_BYTES} bytes`);
+    const module = new SourceTextModule(source, {
+      context,
+      identifier: pathToFileURL(physical).href,
+      initializeImportMeta(meta) {
+        meta.url = pathToFileURL(physical).href;
+      },
+      importModuleDynamically: async (specifier, referencingModule) => {
+        const imported = await resolveModule(specifier, referencingModule);
+        if (imported.status === "unlinked") await imported.link(linker);
+        if (imported.status === "linked") await imported.evaluate();
+        return imported;
+      }
+    });
+    modules.set(physical, module);
+    return module;
+  };
+  const resolveModule = async (specifier, referencingModule) => {
+    if (!specifier.startsWith("./") && !specifier.startsWith("../")) throw new Error(`Sandbox blocks external module import: ${specifier}`);
+    return getModule(resolve(fileURLToPath(referencingModule.identifier), "..", specifier));
+  };
+  const linker = (specifier, referencingModule) => resolveModule(specifier, referencingModule);
+  const entry = await getModule(entryPath);
+  await entry.link(linker);
+  await entry.evaluate();
+  const activate = entry.namespace.activate;
+  if (typeof activate !== "function") throw new Error("Plugin entry must export activate(context)");
+  context.__flavorActivate = activate;
+  const contributionsJson = await runInContext(
+    "globalThis.__flavorSandbox.activate(globalThis.__flavorActivate)",
+    context
+  );
+  return { context, contributions: JSON.parse(contributionsJson) };
+}
+async function main() {
+  const pluginRoot = await realpath(data.pluginRoot);
+  assertContained(pluginRoot, await realpath(data.entryPath));
+  const loaded = await loadPlugin(pluginRoot, data.entryPath);
+  const { contributions } = loaded;
+  const result = {
+    ok: true,
+    name: data.pluginName,
+    version: data.pluginVersion,
+    registeredTools: contributions.tools.map(({ name }) => name),
+    registeredCommands: contributions.commands.map(({ name }) => name),
+    registeredHooks: contributions.hooks.map(({ name }) => name),
+    registeredSkillRoots: contributions.skillRoots.map(({ name }) => name),
+    registeredModelAdapters: contributions.modelAdapters.map(({ name }) => name),
+    contributions
+  };
+  send({ type: "ready", result });
+  port.on("message", (raw) => {
+    void handleMessage(raw, loaded.context);
+  });
+  clearInterval(activationKeepAlive);
+}
+async function handleMessage(raw, context) {
+  if (typeof raw !== "object" || raw === null || !("type" in raw)) {
+    send({ type: "fatal", error: "Invalid sandbox parent message" });
+    return;
+  }
+  const message = raw;
+  if (message.type === "shutdown") {
+    try {
+      await runInContext("globalThis.__flavorSandbox.shutdown()", context);
+      send({ type: "disposed" });
+    } catch (error) {
+      send({ type: "fatal", error: `Plugin sandbox shutdown failed: ${errorMessage(error)}` });
+    }
+    return;
+  }
+  if (message.type !== "invoke" || !Number.isSafeInteger(message.id) || typeof message.name !== "string" || typeof message.argsJson !== "string" || !["command", "tool", "hook", "modelAdapter"].includes(message.kind)) {
+    send({ type: "fatal", error: "Invalid sandbox invocation message" });
+    return;
+  }
+  context.__flavorKind = message.kind;
+  context.__flavorName = message.name;
+  context.__flavorArgs = message.argsJson;
+  try {
+    const responseJson = await runInContext(
+      "globalThis.__flavorSandbox.invokeJson(globalThis.__flavorKind, globalThis.__flavorName, globalThis.__flavorArgs)",
+      context
+    );
+    const response = JSON.parse(responseJson);
+    if (response.ok) send({ type: "response", id: message.id, ok: true, valueJson: response.value === void 0 ? "null" : JSON.stringify(response.value) });
+    else send({ type: "response", id: message.id, ok: false, error: response.error ?? "Sandbox invocation failed" });
+  } catch (error) {
+    send({ type: "response", id: message.id, ok: false, error: errorMessage(error) });
+  }
+}
+main().catch((error) => {
+  clearInterval(activationKeepAlive);
+  send({ type: "fatal", error: errorMessage(error) });
+});

package/dist/evolve/loader.d.ts

@@ -13,7 +13,7 @@ export interface FixPluginVerifyReport {
     commands: string[];
     error?: string;
 }
-/** Dry-run a plugin in a shadow PluginHost sandbox. The real host is untouched. */
+/** Verify a plugin in an isolated Worker sandbox. The real host is untouched. */
 export declare function verifyFixPlugin(workspace: string, name: string): Promise<FixPluginVerifyReport>;
 /** Copy the current plugin dir into .versions/<name>/<timestamp>/. */
 export declare function snapshotFixPlugin(workspace: string, name: string): Promise<string>;

package/dist/plugin-worker-entry.js

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+
+// src/plugins/plugin-worker-entry.ts
+import { readFile, realpath } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createContext, runInContext, SourceTextModule } from "vm";
+import { parentPort, workerData } from "worker_threads";
+var MAX_MODULE_BYTES = 2 * 1024 * 1024;
+var CONTRIBUTION_NAME_SOURCE = "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$";
+var data = workerData;
+var port = parentPort;
+if (port === null) throw new Error("Plugin sandbox requires a parent port");
+var activationKeepAlive = setInterval(() => void 0, 1e3);
+function send(message) {
+  port.postMessage(message);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function assertContained(root, candidate) {
+  const delta = relative(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep}`) || isAbsolute(delta)) throw new Error("Plugin module import escapes the plugin root");
+}
+var SANDBOX_BOOTSTRAP = `(() => {
+  "use strict";
+  const stores = { command: new Map(), tool: new Map(), hook: new Map(), skillRoot: new Map(), modelAdapter: new Map() };
+  let deactivate;
+  let accepting = true;
+  const signal = Object.freeze({ aborted: false, reason: undefined, addEventListener() {}, removeEventListener() {}, throwIfAborted() {} });
+  const cloneJson = (value) => value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+  const deepFreeze = (value) => {
+    if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+    for (const child of Object.values(value)) deepFreeze(child);
+    return Object.freeze(value);
+  };
+  const config = deepFreeze(JSON.parse(globalThis.__flavorConfigJson));
+  delete globalThis.__flavorConfigJson;
+  const namePattern = new RegExp(${JSON.stringify(CONTRIBUTION_NAME_SOURCE)});
+  const name = (value) => {
+    const result = String(value);
+    if (!namePattern.test(result)) throw new Error("Invalid contribution name: " + result);
+    return result;
+  };
+  const register = (kind, rawName, value, metadata) => {
+    if (!accepting) throw new Error("Plugin registrations are closed after activation");
+    const contributionName = name(rawName);
+    if (stores[kind].has(contributionName)) throw new Error("Duplicate " + kind + " contribution: " + contributionName);
+    stores[kind].set(contributionName, { value, metadata });
+    let active = true;
+    return Object.freeze(function disposeRegistration() {
+      if (!active) return;
+      active = false;
+      stores[kind].delete(contributionName);
+    });
+  };
+  const context = Object.freeze({
+    signal,
+    config,
+    logger: Object.freeze({ debug() {}, info() {}, warn() {}, error() {} }),
+    services: Object.freeze({ filesystem: Object.freeze({
+      async readFile() { throw new Error("Filesystem read is not available in sandbox"); },
+      async writeFile() { throw new Error("Filesystem write is not available in sandbox"); },
+    }) }),
+    registerCommand(rawName, handler, description) {
+      if (typeof handler !== "function") throw new Error("Sandbox command handler must be a function");
+      return register("command", rawName, handler, { description: typeof description === "string" ? description : undefined });
+    },
+    registerTool(rawName, tool) {
+      if (!tool || typeof tool !== "object" || typeof tool.execute !== "function") throw new Error("Sandbox tool must provide execute(input, signal, context)");
+      return register("tool", rawName, tool, {
+        toolName: typeof tool.name === "string" ? tool.name : String(rawName),
+        description: typeof tool.description === "string" ? tool.description : "Plugin tool " + String(rawName),
+        modelInputSchema: cloneJson(tool.modelInputSchema), readOnly: tool.readOnly === true,
+      });
+    },
+    registerHook(rawName, handler, options) {
+      if (typeof handler !== "function") throw new Error("Sandbox hook handler must be a function");
+      return register("hook", rawName, handler, { options: cloneJson(options) });
+    },
+    registerSkillRoot(rawName, root) {
+      if (typeof root !== "string") throw new Error("Sandbox skill root must be a string");
+      return register("skillRoot", rawName, root, { root });
+    },
+    registerModelAdapter(rawName, adapter) {
+      if (!adapter || typeof adapter.stream !== "function") throw new Error("Sandbox model adapter must provide stream(request)");
+      return register("modelAdapter", rawName, adapter, {});
+    },
+  });
+  const describe = () => ({
+    commands: [...stores.command].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    tools: [...stores.tool].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    hooks: [...stores.hook].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    skillRoots: [...stores.skillRoot].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    modelAdapters: [...stores.modelAdapter].map(([entryName]) => ({ name: entryName })),
+  });
+  const invoke = async (kind, entryName, args) => {
+    const entry = stores[kind]?.get(entryName);
+    if (!entry) throw new Error("Unknown sandbox contribution: " + kind + ":" + entryName);
+    if (kind === "command") return entry.value(args[0], Object.freeze({ ...(args[1] || {}), signal }));
+    if (kind === "tool") return entry.value.execute(args[0], signal, args[1]);
+    if (kind === "hook") return entry.value(args[0], signal);
+    if (kind === "modelAdapter") {
+      const events = [];
+      for await (const event of entry.value.stream(args[0])) events.push(event);
+      return events;
+    }
+    throw new Error("Unsupported sandbox invocation kind: " + kind);
+  };
+  globalThis.__flavorSandbox = Object.freeze({
+    async activate(fn) {
+      const result = await fn(context);
+      if (result !== undefined && typeof result !== "function") throw new Error("Plugin activate result must be a disposer or undefined");
+      deactivate = result;
+      accepting = false;
+      return JSON.stringify(describe());
+    },
+    async invokeJson(kind, entryName, argsJson) {
+      try { return JSON.stringify({ ok: true, value: await invoke(kind, entryName, JSON.parse(argsJson)) }); }
+      catch (error) { return JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) }); }
+    },
+    async shutdown() { if (deactivate) await deactivate(); deactivate = undefined; },
+  });
+})();`;
+async function loadPlugin(pluginRoot, entryPath) {
+  const context = createContext(/* @__PURE__ */ Object.create(null), {
+    name: `flavor-plugin:${data.pluginName}`,
+    codeGeneration: { strings: false, wasm: false }
+  });
+  context.__flavorConfigJson = data.configJson;
+  runInContext(SANDBOX_BOOTSTRAP, context, { timeout: 1e3 });
+  const modules = /* @__PURE__ */ new Map();
+  const getModule = async (input) => {
+    const physical = await realpath(input);
+    assertContained(pluginRoot, physical);
+    const existing = modules.get(physical);
+    if (existing !== void 0) return existing;
+    const source = await readFile(physical, "utf8");
+    if (Buffer.byteLength(source) > MAX_MODULE_BYTES) throw new Error(`Plugin module exceeds ${MAX_MODULE_BYTES} bytes`);
+    const module = new SourceTextModule(source, {
+      context,
+      identifier: pathToFileURL(physical).href,
+      initializeImportMeta(meta) {
+        meta.url = pathToFileURL(physical).href;
+      },
+      importModuleDynamically: async (specifier, referencingModule) => {
+        const imported = await resolveModule(specifier, referencingModule);
+        if (imported.status === "unlinked") await imported.link(linker);
+        if (imported.status === "linked") await imported.evaluate();
+        return imported;
+      }
+    });
+    modules.set(physical, module);
+    return module;
+  };
+  const resolveModule = async (specifier, referencingModule) => {
+    if (!specifier.startsWith("./") && !specifier.startsWith("../")) throw new Error(`Sandbox blocks external module import: ${specifier}`);
+    return getModule(resolve(fileURLToPath(referencingModule.identifier), "..", specifier));
+  };
+  const linker = (specifier, referencingModule) => resolveModule(specifier, referencingModule);
+  const entry = await getModule(entryPath);
+  await entry.link(linker);
+  await entry.evaluate();
+  const activate = entry.namespace.activate;
+  if (typeof activate !== "function") throw new Error("Plugin entry must export activate(context)");
+  context.__flavorActivate = activate;
+  const contributionsJson = await runInContext(
+    "globalThis.__flavorSandbox.activate(globalThis.__flavorActivate)",
+    context
+  );
+  return { context, contributions: JSON.parse(contributionsJson) };
+}
+async function main() {
+  const pluginRoot = await realpath(data.pluginRoot);
+  assertContained(pluginRoot, await realpath(data.entryPath));
+  const loaded = await loadPlugin(pluginRoot, data.entryPath);
+  const { contributions } = loaded;
+  const result = {
+    ok: true,
+    name: data.pluginName,
+    version: data.pluginVersion,
+    registeredTools: contributions.tools.map(({ name }) => name),
+    registeredCommands: contributions.commands.map(({ name }) => name),
+    registeredHooks: contributions.hooks.map(({ name }) => name),
+    registeredSkillRoots: contributions.skillRoots.map(({ name }) => name),
+    registeredModelAdapters: contributions.modelAdapters.map(({ name }) => name),
+    contributions
+  };
+  send({ type: "ready", result });
+  port.on("message", (raw) => {
+    void handleMessage(raw, loaded.context);
+  });
+  clearInterval(activationKeepAlive);
+}
+async function handleMessage(raw, context) {
+  if (typeof raw !== "object" || raw === null || !("type" in raw)) {
+    send({ type: "fatal", error: "Invalid sandbox parent message" });
+    return;
+  }
+  const message = raw;
+  if (message.type === "shutdown") {
+    try {
+      await runInContext("globalThis.__flavorSandbox.shutdown()", context);
+      send({ type: "disposed" });
+    } catch (error) {
+      send({ type: "fatal", error: `Plugin sandbox shutdown failed: ${errorMessage(error)}` });
+    }
+    return;
+  }
+  if (message.type !== "invoke" || !Number.isSafeInteger(message.id) || typeof message.name !== "string" || typeof message.argsJson !== "string" || !["command", "tool", "hook", "modelAdapter"].includes(message.kind)) {
+    send({ type: "fatal", error: "Invalid sandbox invocation message" });
+    return;
+  }
+  context.__flavorKind = message.kind;
+  context.__flavorName = message.name;
+  context.__flavorArgs = message.argsJson;
+  try {
+    const responseJson = await runInContext(
+      "globalThis.__flavorSandbox.invokeJson(globalThis.__flavorKind, globalThis.__flavorName, globalThis.__flavorArgs)",
+      context
+    );
+    const response = JSON.parse(responseJson);
+    if (response.ok) send({ type: "response", id: message.id, ok: true, valueJson: response.value === void 0 ? "null" : JSON.stringify(response.value) });
+    else send({ type: "response", id: message.id, ok: false, error: response.error ?? "Sandbox invocation failed" });
+  } catch (error) {
+    send({ type: "response", id: message.id, ok: false, error: errorMessage(error) });
+  }
+}
+main().catch((error) => {
+  clearInterval(activationKeepAlive);
+  send({ type: "fatal", error: errorMessage(error) });
+});

package/dist/plugins/host.d.ts

@@ -1,8 +1,7 @@
 import type { LoadedPlugin, PluginDiagnostic, PluginHostOptions } from "./types.js";
 /**
- * Hosts trusted in-process plugins behind a narrow host API. Plugin roots must remain immutable
- * during activation. Concurrent malicious mutation is outside the MVP trust model because plugin
- * code already has Node.js authority; this is explicitly not a process sandbox.
+ * Hosts plugins behind a narrow host API. The default backend loads trusted plugins in-process;
+ * sandbox mode uses an isolated Worker/vm realm and RPC-backed contributions.
  */
 export declare class PluginHost {
     #private;

package/dist/plugins/sandbox-protocol.d.ts

@@ -0,0 +1,72 @@
+export type SandboxContributionKind = "command" | "tool" | "hook" | "modelAdapter";
+export interface SandboxCommandRegistration {
+    name: string;
+    description?: string;
+}
+export interface SandboxToolRegistration {
+    name: string;
+    toolName: string;
+    description: string;
+    modelInputSchema?: Record<string, unknown>;
+    readOnly?: boolean;
+}
+export interface SandboxHookRegistration {
+    name: string;
+    options?: {
+        timeoutMs?: number;
+        failurePolicy?: "error" | "allow" | "deny" | "ask";
+    };
+}
+export interface SandboxSkillRootRegistration {
+    name: string;
+    root: string;
+}
+export interface SandboxPluginContributions {
+    commands: SandboxCommandRegistration[];
+    tools: SandboxToolRegistration[];
+    hooks: SandboxHookRegistration[];
+    skillRoots: SandboxSkillRootRegistration[];
+    modelAdapters: {
+        name: string;
+    }[];
+}
+export interface SandboxedPluginResult {
+    ok: boolean;
+    name: string;
+    version: string;
+    registeredTools: string[];
+    registeredCommands: string[];
+    registeredHooks: string[];
+    registeredSkillRoots: string[];
+    registeredModelAdapters: string[];
+    contributions: SandboxPluginContributions;
+    error?: string;
+}
+export type SandboxParentMessage = {
+    type: "invoke";
+    id: number;
+    kind: SandboxContributionKind;
+    name: string;
+    argsJson: string;
+} | {
+    type: "shutdown";
+};
+export type SandboxWorkerMessage = {
+    type: "ready";
+    result: SandboxedPluginResult;
+} | {
+    type: "response";
+    id: number;
+    ok: true;
+    valueJson: string;
+} | {
+    type: "response";
+    id: number;
+    ok: false;
+    error: string;
+} | {
+    type: "disposed";
+} | {
+    type: "fatal";
+    error: string;
+};

package/dist/plugins/types.d.ts

@@ -134,4 +134,7 @@ export interface PluginHostOptions {
     emitLifecycle?: (type: "PluginLoad" | "PluginUnload", plugin: LoadedPlugin) => void | Promise<void>;
     activationTimeoutMs?: number;
     unloadTimeoutMs?: number;
+    /** When true, plugin modules run in an isolated Worker/vm realm. Only relative
+     *  modules inside the plugin root and RPC-backed contribution calls are available. */
+    sandbox?: boolean;
 }

package/dist/plugins/worker-host.d.ts

@@ -0,0 +1,19 @@
+import type { SandboxedPluginResult, SandboxContributionKind } from "./sandbox-protocol.js";
+export type { SandboxedPluginResult } from "./sandbox-protocol.js";
+export interface PluginWorkerOptions {
+    entryPath: string;
+    pluginRoot?: string;
+    pluginName: string;
+    pluginVersion: string;
+    config?: unknown;
+    activationTimeoutMs?: number;
+    invocationTimeoutMs?: number;
+    maxOldSpaceMb?: number;
+}
+export interface SandboxedPluginSession {
+    readonly result: SandboxedPluginResult;
+    invoke<T>(kind: SandboxContributionKind, name: string, args: readonly unknown[]): Promise<T>;
+    dispose(): Promise<void>;
+}
+export declare function startPluginSandbox(options: PluginWorkerOptions): Promise<SandboxedPluginSession>;
+export declare function runPluginInSandbox(options: PluginWorkerOptions): Promise<SandboxedPluginResult>;

package/dist/production.d.ts

@@ -11,6 +11,12 @@ import { type TranscriptState } from "./ui/transcript.js";
 import { MemoryReviewBridge } from "./memory/review.js";
 import { type JobSnapshot } from "./jobs/registry.js";
 import { type PalClientLike } from "./pals/tools.js";
+/**
+ * Per-step shutdown budget. On Windows a hung child-process pipe, named pipe,
+ * or MCP stdio server can block one cleanup step forever; abandoning that step
+ * after the budget lets the remaining steps — and process exit — proceed.
+ */
+export declare const DEFAULT_SHUTDOWN_STEP_TIMEOUT_MS = 3000;
 export interface ProductionRuntimeOptions {
     workspace?: string;
     home?: string;
@@ -27,6 +33,8 @@ export interface ProductionRuntimeOptions {
     resumeSession?: string | true;
     /** Test and embedding seam for creating configured MCP clients. */
     mcpClientFactory?: McpClientFactory;
+    /** Per-step timeout (ms) for shutdown/disposal steps so a hung cleanup cannot block process exit. */
+    shutdownStepTimeoutMs?: number;
     /** Additional tools provided by embedders (e.g. desktop-only D2C tools). */
     extraTools?: readonly ToolDefinition<unknown>[];
     /** Explicitly opt into CLI-local collaboration. Omit for print/RPC/eval callers. */

package/dist/sdk/index.js

@@ -4,7 +4,7 @@ import {
   FlavorRpcServer,
   TraceRecordSchema,
   TraceRecorder
-} from "../chunk-YRIPE5K5.js";
+} from "../chunk-A7PMQ22O.js";
 import {
   AgentMessageQueue,
   DockerExecutionEnvironment,
@@ -13,7 +13,7 @@ import {
   WorkspaceCheckpointStore,
   buildDockerInvocation,
   createProductionRuntime
-} from "../chunk-QQCXJC4U.js";
+} from "../chunk-AXLUVJKC.js";
 import "../chunk-IG4Z23CL.js";
 import "../chunk-RQTYHUMK.js";
 import "../chunk-S32JRDZK.js";

package/dist/skills/arguments.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Expand the portable argument placeholders used by Claude-style Agent Skills.
+ * Flavor still passes the original argument text as the user prompt; expansion
+ * makes the skill body itself equivalent across hosts and is especially useful
+ * when one skill loads another through the Skill tool.
+ */
+export declare function expandSkillArguments(body: string, argumentsText: string): string;
+export declare function splitSkillArguments(input: string): string[];

package/dist/skills/tool.d.ts

@@ -1,9 +1,14 @@
 import { z } from "zod";
 import type { ToolDefinition } from "../tools/types.js";
 import type { SkillRegistry } from "./registry.js";
+declare const SkillInput: z.ZodObject<{
+    skill: z.ZodString;
+    arguments: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 declare const SkillResourceInput: z.ZodObject<{
     skill: z.ZodString;
     reference: z.ZodString;
 }, z.core.$strict>;
+export declare function createSkillTool(registry: SkillRegistry): ToolDefinition<z.infer<typeof SkillInput>>;
 export declare function createSkillResourceTool(registry: SkillRegistry): ToolDefinition<z.infer<typeof SkillResourceInput>>;
 export {};

package/dist/ui/session.d.ts

@@ -101,6 +101,7 @@ export interface SessionServices {
     subagentModel(): string;
     llmServiceName?(): string | undefined;
     permissionMode(): PermissionMode;
+    addContext?(content: string): void | Promise<void>;
     run(prompt: string, signal: AbortSignal, options?: {
         getSteeringMessages(): readonly string[];
         initialUserMessage?: Extract<ModelMessage, {