kynjal-cli 3.1.3 → 4.0.0

package/dist/src/plugins/manager.js

@@ -3,11 +3,67 @@
  * Handles actual plugin installation, persistence, and lifecycle
  * Bridges discovery service with file system persistence
  */
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
 import * as fs from 'fs';
 import * as path from 'path';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
-const execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
+/**
+ * Validate npm package name to prevent shell injection (S-3)
+ */
+var VALID_PACKAGE_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-z0-9._\-^~>=<]+)?$/;
+function validatePackageName(spec) {
+    if (!VALID_PACKAGE_RE.test(spec)) {
+        throw new Error("Invalid package name: " + spec);
+    }
+}
 // ============================================================================
 // Plugin Manager
 // ============================================================================
@@ -20,14 +76,14 @@ const execAsync = promisify(exec);
  * - Tracks enabled/disabled state
  * - Loads plugin modules
  */
-export class PluginManager {
-    config;
-    manifest = null;
-    constructor(baseDir = process.cwd()) {
-        const pluginsDir = path.join(baseDir, '.claude-flow', 'plugins');
+var PluginManager = /** @class */ (function () {
+    function PluginManager(baseDir) {
+        if (baseDir === void 0) { baseDir = process.cwd(); }
+        this.manifest = null;
+        var pluginsDir = path.join(baseDir, '.claude-flow', 'plugins');
         this.config = {
-            pluginsDir,
-            manifestPath: path.join(pluginsDir, 'installed.json'),
+            pluginsDir: pluginsDir,
+            manifestPath: path.join(pluginsDir, 'installed.json')
         };
     }
     // =========================================================================
@@ -36,345 +92,542 @@ export class PluginManager {
     /**
      * Initialize the plugin manager, creating directories and loading manifest
      */
-    async initialize() {
-        // Ensure plugins directory exists
-        await this.ensureDirectory(this.config.pluginsDir);
-        // Load or create manifest
-        this.manifest = await this.loadManifest();
-    }
-    async ensureDirectory(dir) {
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-    }
-    async loadManifest() {
-        try {
-            if (fs.existsSync(this.config.manifestPath)) {
-                const content = fs.readFileSync(this.config.manifestPath, 'utf-8');
-                return JSON.parse(content);
-            }
-        }
-        catch (error) {
-            console.warn('[PluginManager] Failed to load manifest, creating new one');
-        }
-        return {
-            version: '1.0.0',
-            lastUpdated: new Date().toISOString(),
-            plugins: {},
-        };
-    }
-    async saveManifest() {
-        if (!this.manifest)
-            return;
-        this.manifest.lastUpdated = new Date().toISOString();
-        await this.ensureDirectory(path.dirname(this.config.manifestPath));
-        fs.writeFileSync(this.config.manifestPath, JSON.stringify(this.manifest, null, 2), 'utf-8');
-    }
+    PluginManager.prototype.initialize = function () {
+        return __awaiter(this, void 0, Promise, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: 
+                    // Ensure plugins directory exists
+                    return [4 /*yield*/, this.ensureDirectory(this.config.pluginsDir)];
+                    case 1:
+                        // Ensure plugins directory exists
+                        _b.sent();
+                        // Load or create manifest
+                        _a = this;
+                        return [4 /*yield*/, this.loadManifest()];
+                    case 2:
+                        // Load or create manifest
+                        _a.manifest = _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    PluginManager.prototype.ensureDirectory = function (dir) {
+        return __awaiter(this, void 0, Promise, function () {
+            return __generator(this, function (_a) {
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true });
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    PluginManager.prototype.loadManifest = function () {
+        return __awaiter(this, void 0, Promise, function () {
+            var content;
+            return __generator(this, function (_a) {
+                try {
+                    if (fs.existsSync(this.config.manifestPath)) {
+                        content = fs.readFileSync(this.config.manifestPath, 'utf-8');
+                        return [2 /*return*/, JSON.parse(content)];
+                    }
+                }
+                catch (error) {
+                    console.warn('[PluginManager] Failed to load manifest, creating new one');
+                }
+                return [2 /*return*/, {
+                        version: '1.0.0',
+                        lastUpdated: new Date().toISOString(),
+                        plugins: {}
+                    }];
+            });
+        });
+    };
+    PluginManager.prototype.saveManifest = function () {
+        return __awaiter(this, void 0, Promise, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!this.manifest)
+                            return [2 /*return*/];
+                        this.manifest.lastUpdated = new Date().toISOString();
+                        return [4 /*yield*/, this.ensureDirectory(path.dirname(this.config.manifestPath))];
+                    case 1:
+                        _a.sent();
+                        fs.writeFileSync(this.config.manifestPath, JSON.stringify(this.manifest, null, 2), 'utf-8');
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Installation
     // =========================================================================
     /**
      * Install a plugin from npm
      */
-    async installFromNpm(packageName, version) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const versionSpec = version ? `${packageName}@${version}` : packageName;
-        try {
-            // Check if already installed
-            if (this.manifest.plugins[packageName]) {
-                return {
-                    success: false,
-                    error: `Plugin ${packageName} is already installed. Use upgrade to update.`,
-                };
-            }
-            // Install to local plugins directory
-            const installDir = path.join(this.config.pluginsDir, 'node_modules');
-            await this.ensureDirectory(installDir);
-            // Use npm to install
-            console.log(`[PluginManager] Installing ${versionSpec}...`);
-            const { stdout, stderr } = await execAsync(`npm install --prefix "${this.config.pluginsDir}" ${versionSpec}`, { timeout: 120000 });
-            // Get installed version
-            const packageJsonPath = path.join(installDir, packageName, 'package.json');
-            let installedVersion = version || 'latest';
-            let commands = [];
-            let hooks = [];
-            if (fs.existsSync(packageJsonPath)) {
-                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-                installedVersion = pkg.version;
-                // Check for claude-flow plugin metadata
-                if (pkg['kynjalflow']) {
-                    commands = pkg['kynjalflow'].commands || [];
-                    hooks = pkg['kynjalflow'].hooks || [];
+    PluginManager.prototype.installFromNpm = function (packageName, version) {
+        return __awaiter(this, void 0, Promise, function () {
+            var versionSpec, installDir, packageJsonPath, installedVersion, commands, hooks, pkg, plugin, error_1, errorMsg;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        versionSpec = version ? packageName + "@" + version : packageName;
+                        _a.label = 3;
+                    case 3:
+                        _a.trys.push([3, 7, , 8]);
+                        // Check if already installed
+                        if (this.manifest.plugins[packageName]) {
+                            return [2 /*return*/, {
+                                    success: false,
+                                    error: "Plugin " + packageName + " is already installed. Use upgrade to update."
+                                }];
+                        }
+                        installDir = path.join(this.config.pluginsDir, 'node_modules');
+                        return [4 /*yield*/, this.ensureDirectory(installDir)];
+                    case 4:
+                        _a.sent();
+                        // Validate package name to prevent injection (S-3)
+                        validatePackageName(versionSpec);
+                        // Use npm to install (array form prevents shell injection)
+                        console.log("[PluginManager] Installing " + versionSpec + "...");
+                        return [4 /*yield*/, execFileAsync('npm', ['install', '--prefix', this.config.pluginsDir, versionSpec], { timeout: 120000 })];
+                    case 5:
+                        _a.sent();
+                        packageJsonPath = path.join(installDir, packageName, 'package.json');
+                        installedVersion = version || 'latest';
+                        commands = [];
+                        hooks = [];
+                        if (fs.existsSync(packageJsonPath)) {
+                            pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                            installedVersion = pkg.version;
+                            // Check for claude-flow plugin metadata
+                            if (pkg['claude-flow']) {
+                                commands = pkg['claude-flow'].commands || [];
+                                hooks = pkg['claude-flow'].hooks || [];
+                            }
+                        }
+                        plugin = {
+                            name: packageName,
+                            version: installedVersion,
+                            installedAt: new Date().toISOString(),
+                            enabled: true,
+                            source: 'npm',
+                            path: path.join(installDir, packageName),
+                            commands: commands,
+                            hooks: hooks
+                        };
+                        // Save to manifest
+                        this.manifest.plugins[packageName] = plugin;
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 6:
+                        _a.sent();
+                        console.log("[PluginManager] Installed " + packageName + "@" + installedVersion);
+                        return [2 /*return*/, { success: true, plugin: plugin }];
+                    case 7:
+                        error_1 = _a.sent();
+                        errorMsg = error_1 instanceof Error ? error_1.message : String(error_1);
+                        console.error("[PluginManager] Failed to install " + packageName + ":", errorMsg);
+                        return [2 /*return*/, { success: false, error: errorMsg }];
+                    case 8: return [2 /*return*/];
                 }
-            }
-            // Create plugin entry
-            const plugin = {
-                name: packageName,
-                version: installedVersion,
-                installedAt: new Date().toISOString(),
-                enabled: true,
-                source: 'npm',
-                path: path.join(installDir, packageName),
-                commands,
-                hooks,
-            };
-            // Save to manifest
-            this.manifest.plugins[packageName] = plugin;
-            await this.saveManifest();
-            console.log(`[PluginManager] Installed ${packageName}@${installedVersion}`);
-            return { success: true, plugin };
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[PluginManager] Failed to install ${packageName}:`, errorMsg);
-            return { success: false, error: errorMsg };
-        }
-    }
+            });
+        });
+    };
     /**
      * Install a plugin from a local path
      */
-    async installFromLocal(sourcePath) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        try {
-            const absolutePath = path.resolve(sourcePath);
-            if (!fs.existsSync(absolutePath)) {
-                return { success: false, error: `Path does not exist: ${absolutePath}` };
-            }
-            // Read package.json
-            const packageJsonPath = path.join(absolutePath, 'package.json');
-            if (!fs.existsSync(packageJsonPath)) {
-                return { success: false, error: 'No package.json found at path' };
-            }
-            const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-            const packageName = pkg.name;
-            // Check if already installed
-            if (this.manifest.plugins[packageName]) {
-                return {
-                    success: false,
-                    error: `Plugin ${packageName} is already installed`,
-                };
-            }
-            // Create plugin entry (link to local path, don't copy)
-            const plugin = {
-                name: packageName,
-                version: pkg.version,
-                installedAt: new Date().toISOString(),
-                enabled: true,
-                source: 'local',
-                path: absolutePath,
-                commands: pkg['kynjalflow']?.commands || [],
-                hooks: pkg['kynjalflow']?.hooks || [],
-            };
-            // Save to manifest
-            this.manifest.plugins[packageName] = plugin;
-            await this.saveManifest();
-            console.log(`[PluginManager] Installed local plugin ${packageName}@${pkg.version}`);
-            return { success: true, plugin };
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[PluginManager] Failed to install from local:`, errorMsg);
-            return { success: false, error: errorMsg };
-        }
-    }
+    PluginManager.prototype.installFromLocal = function (sourcePath) {
+        var _a, _b;
+        return __awaiter(this, void 0, Promise, function () {
+            var absolutePath, packageJsonPath, pkg, packageName, plugin, error_2, errorMsg;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _c.sent();
+                        _c.label = 2;
+                    case 2:
+                        _c.trys.push([2, 4, , 5]);
+                        absolutePath = path.resolve(sourcePath);
+                        if (!fs.existsSync(absolutePath)) {
+                            return [2 /*return*/, { success: false, error: "Path does not exist: " + absolutePath }];
+                        }
+                        packageJsonPath = path.join(absolutePath, 'package.json');
+                        if (!fs.existsSync(packageJsonPath)) {
+                            return [2 /*return*/, { success: false, error: 'No package.json found at path' }];
+                        }
+                        pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                        packageName = pkg.name;
+                        // Check if already installed
+                        if (this.manifest.plugins[packageName]) {
+                            return [2 /*return*/, {
+                                    success: false,
+                                    error: "Plugin " + packageName + " is already installed"
+                                }];
+                        }
+                        plugin = {
+                            name: packageName,
+                            version: pkg.version,
+                            installedAt: new Date().toISOString(),
+                            enabled: true,
+                            source: 'local',
+                            path: absolutePath,
+                            commands: ((_a = pkg['claude-flow']) === null || _a === void 0 ? void 0 : _a.commands) || [],
+                            hooks: ((_b = pkg['claude-flow']) === null || _b === void 0 ? void 0 : _b.hooks) || []
+                        };
+                        // Save to manifest
+                        this.manifest.plugins[packageName] = plugin;
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 3:
+                        _c.sent();
+                        console.log("[PluginManager] Installed local plugin " + packageName + "@" + pkg.version);
+                        return [2 /*return*/, { success: true, plugin: plugin }];
+                    case 4:
+                        error_2 = _c.sent();
+                        errorMsg = error_2 instanceof Error ? error_2.message : String(error_2);
+                        console.error("[PluginManager] Failed to install from local:", errorMsg);
+                        return [2 /*return*/, { success: false, error: errorMsg }];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Uninstallation
     // =========================================================================
     /**
      * Uninstall a plugin
      */
-    async uninstall(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const plugin = this.manifest.plugins[packageName];
-        if (!plugin) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        try {
-            // For npm-installed plugins, remove from node_modules
-            if (plugin.source === 'npm') {
-                await execAsync(`npm uninstall --prefix "${this.config.pluginsDir}" ${packageName}`, { timeout: 60000 });
-            }
-            // Remove from manifest
-            delete this.manifest.plugins[packageName];
-            await this.saveManifest();
-            console.log(`[PluginManager] Uninstalled ${packageName}`);
-            return { success: true };
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[PluginManager] Failed to uninstall ${packageName}:`, errorMsg);
-            return { success: false, error: errorMsg };
-        }
-    }
+    PluginManager.prototype.uninstall = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            var plugin, error_3, errorMsg;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        plugin = this.manifest.plugins[packageName];
+                        if (!plugin) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        _a.label = 3;
+                    case 3:
+                        _a.trys.push([3, 7, , 8]);
+                        if (!(plugin.source === 'npm')) return [3 /*break*/, 5];
+                        validatePackageName(packageName);
+                        return [4 /*yield*/, execFileAsync('npm', ['uninstall', '--prefix', this.config.pluginsDir, packageName], { timeout: 60000 })];
+                    case 4:
+                        _a.sent();
+                        _a.label = 5;
+                    case 5:
+                        // Remove from manifest
+                        delete this.manifest.plugins[packageName];
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 6:
+                        _a.sent();
+                        console.log("[PluginManager] Uninstalled " + packageName);
+                        return [2 /*return*/, { success: true }];
+                    case 7:
+                        error_3 = _a.sent();
+                        errorMsg = error_3 instanceof Error ? error_3.message : String(error_3);
+                        console.error("[PluginManager] Failed to uninstall " + packageName + ":", errorMsg);
+                        return [2 /*return*/, { success: false, error: errorMsg }];
+                    case 8: return [2 /*return*/];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Enable/Disable
     // =========================================================================
     /**
      * Enable a plugin
      */
-    async enable(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const plugin = this.manifest.plugins[packageName];
-        if (!plugin) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        plugin.enabled = true;
-        await this.saveManifest();
-        return { success: true };
-    }
+    PluginManager.prototype.enable = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            var plugin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        plugin = this.manifest.plugins[packageName];
+                        if (!plugin) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        plugin.enabled = true;
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, { success: true }];
+                }
+            });
+        });
+    };
     /**
      * Disable a plugin
      */
-    async disable(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const plugin = this.manifest.plugins[packageName];
-        if (!plugin) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        plugin.enabled = false;
-        await this.saveManifest();
-        return { success: true };
-    }
+    PluginManager.prototype.disable = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            var plugin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        plugin = this.manifest.plugins[packageName];
+                        if (!plugin) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        plugin.enabled = false;
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, { success: true }];
+                }
+            });
+        });
+    };
     /**
      * Toggle a plugin's enabled state
      */
-    async toggle(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const plugin = this.manifest.plugins[packageName];
-        if (!plugin) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        plugin.enabled = !plugin.enabled;
-        await this.saveManifest();
-        return { success: true, enabled: plugin.enabled };
-    }
+    PluginManager.prototype.toggle = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            var plugin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        plugin = this.manifest.plugins[packageName];
+                        if (!plugin) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        plugin.enabled = !plugin.enabled;
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, { success: true, enabled: plugin.enabled }];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Query
     // =========================================================================
     /**
      * Get all installed plugins
      */
-    async getInstalled() {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        return Object.values(this.manifest.plugins);
-    }
+    PluginManager.prototype.getInstalled = function () {
+        return __awaiter(this, void 0, Promise, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, Object.values(this.manifest.plugins)];
+                }
+            });
+        });
+    };
     /**
      * Get enabled plugins
      */
-    async getEnabled() {
-        const all = await this.getInstalled();
-        return all.filter(p => p.enabled);
-    }
+    PluginManager.prototype.getEnabled = function () {
+        return __awaiter(this, void 0, Promise, function () {
+            var all;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.getInstalled()];
+                    case 1:
+                        all = _a.sent();
+                        return [2 /*return*/, all.filter(function (p) { return p.enabled; })];
+                }
+            });
+        });
+    };
     /**
      * Check if a plugin is installed
      */
-    async isInstalled(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        return packageName in this.manifest.plugins;
-    }
+    PluginManager.prototype.isInstalled = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, packageName in this.manifest.plugins];
+                }
+            });
+        });
+    };
     /**
      * Get a specific installed plugin
      */
-    async getPlugin(packageName) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        return this.manifest.plugins[packageName];
-    }
+    PluginManager.prototype.getPlugin = function (packageName) {
+        return __awaiter(this, void 0, Promise, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, this.manifest.plugins[packageName]];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Upgrade
     // =========================================================================
     /**
      * Upgrade a plugin to a new version
      */
-    async upgrade(packageName, version) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const existing = this.manifest.plugins[packageName];
-        if (!existing) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        if (existing.source !== 'npm') {
-            return { success: false, error: 'Can only upgrade npm-installed plugins' };
-        }
-        try {
-            const versionSpec = version ? `${packageName}@${version}` : `${packageName}@latest`;
-            // Reinstall with new version
-            await execAsync(`npm install --prefix "${this.config.pluginsDir}" ${versionSpec}`, { timeout: 120000 });
-            // Update manifest
-            const installDir = path.join(this.config.pluginsDir, 'node_modules');
-            const packageJsonPath = path.join(installDir, packageName, 'package.json');
-            if (fs.existsSync(packageJsonPath)) {
-                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-                existing.version = pkg.version;
-                existing.commands = pkg['kynjalflow']?.commands || existing.commands;
-                existing.hooks = pkg['kynjalflow']?.hooks || existing.hooks;
-            }
-            await this.saveManifest();
-            console.log(`[PluginManager] Upgraded ${packageName} to ${existing.version}`);
-            return { success: true, plugin: existing };
-        }
-        catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            return { success: false, error: errorMsg };
-        }
-    }
+    PluginManager.prototype.upgrade = function (packageName, version) {
+        var _a, _b;
+        return __awaiter(this, void 0, Promise, function () {
+            var existing, versionSpec, installDir, packageJsonPath, pkg, error_4, errorMsg;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _c.sent();
+                        _c.label = 2;
+                    case 2:
+                        existing = this.manifest.plugins[packageName];
+                        if (!existing) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        if (existing.source !== 'npm') {
+                            return [2 /*return*/, { success: false, error: 'Can only upgrade npm-installed plugins' }];
+                        }
+                        _c.label = 3;
+                    case 3:
+                        _c.trys.push([3, 6, , 7]);
+                        versionSpec = version ? packageName + "@" + version : packageName + "@latest";
+                        // Validate package name to prevent injection (S-3)
+                        validatePackageName(versionSpec);
+                        // Reinstall with new version (array form prevents shell injection)
+                        return [4 /*yield*/, execFileAsync('npm', ['install', '--prefix', this.config.pluginsDir, versionSpec], { timeout: 120000 })];
+                    case 4:
+                        // Reinstall with new version (array form prevents shell injection)
+                        _c.sent();
+                        installDir = path.join(this.config.pluginsDir, 'node_modules');
+                        packageJsonPath = path.join(installDir, packageName, 'package.json');
+                        if (fs.existsSync(packageJsonPath)) {
+                            pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                            existing.version = pkg.version;
+                            existing.commands = ((_a = pkg['claude-flow']) === null || _a === void 0 ? void 0 : _a.commands) || existing.commands;
+                            existing.hooks = ((_b = pkg['claude-flow']) === null || _b === void 0 ? void 0 : _b.hooks) || existing.hooks;
+                        }
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 5:
+                        _c.sent();
+                        console.log("[PluginManager] Upgraded " + packageName + " to " + existing.version);
+                        return [2 /*return*/, { success: true, plugin: existing }];
+                    case 6:
+                        error_4 = _c.sent();
+                        errorMsg = error_4 instanceof Error ? error_4.message : String(error_4);
+                        return [2 /*return*/, { success: false, error: errorMsg }];
+                    case 7: return [2 /*return*/];
+                }
+            });
+        });
+    };
     // =========================================================================
     // Config
     // =========================================================================
     /**
      * Update plugin config
      */
-    async setConfig(packageName, config) {
-        if (!this.manifest) {
-            await this.initialize();
-        }
-        const plugin = this.manifest.plugins[packageName];
-        if (!plugin) {
-            return { success: false, error: `Plugin ${packageName} is not installed` };
-        }
-        plugin.config = { ...plugin.config, ...config };
-        await this.saveManifest();
-        return { success: true };
-    }
+    PluginManager.prototype.setConfig = function (packageName, config) {
+        return __awaiter(this, void 0, Promise, function () {
+            var plugin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!!this.manifest) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.initialize()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        plugin = this.manifest.plugins[packageName];
+                        if (!plugin) {
+                            return [2 /*return*/, { success: false, error: "Plugin " + packageName + " is not installed" }];
+                        }
+                        plugin.config = __assign(__assign({}, plugin.config), config);
+                        return [4 /*yield*/, this.saveManifest()];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, { success: true }];
+                }
+            });
+        });
+    };
     /**
      * Get plugins directory path
      */
-    getPluginsDir() {
+    PluginManager.prototype.getPluginsDir = function () {
         return this.config.pluginsDir;
-    }
+    };
     /**
      * Get manifest path
      */
-    getManifestPath() {
+    PluginManager.prototype.getManifestPath = function () {
         return this.config.manifestPath;
-    }
-}
+    };
+    return PluginManager;
+}());
+export { PluginManager };
 // ============================================================================
 // Singleton Instance
 // ============================================================================
-let defaultManager = null;
+var defaultManager = null;
 export function getPluginManager(baseDir) {
     if (!defaultManager) {
         defaultManager = new PluginManager(baseDir);
     }
+    else if (baseDir && defaultManager.getPluginsDir() !== path.join(baseDir, '.claude-flow', 'plugins')) {
+        console.warn("[PluginManager] Warning: getPluginManager called with different baseDir. Using existing instance. Call resetPluginManager() first to change.");
+    }
     return defaultManager;
 }
 export function resetPluginManager() {