nexrall-code 0.5.48 → 0.5.50

package/dist/index.js

@@ -1773,13 +1773,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} source - expected values are default/config/env/cli/implied
        * @return {Command} `this` command for chaining
        */
-      setOptionValueWithSource(key, value, source) {
+      setOptionValueWithSource(key, value, source2) {
         if (this._storeOptionsAsProperties) {
           this[key] = value;
         } else {
           this._optionValues[key] = value;
         }
-        this._optionValueSources[key] = source;
+        this._optionValueSources[key] = source2;
         return this;
       }
       /**
@@ -1800,13 +1800,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {string}
        */
       getOptionValueSourceWithGlobals(key) {
-        let source;
+        let source2;
         this._getCommandAndAncestors().forEach((cmd) => {
           if (cmd.getOptionValueSource(key) !== void 0) {
-            source = cmd.getOptionValueSource(key);
+            source2 = cmd.getOptionValueSource(key);
           }
         });
-        return source;
+        return source2;
       }
       /**
        * Get user arguments from implied or explicit arguments.
@@ -2615,8 +2615,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const getErrorMessage = (option2) => {
           const bestOption = findBestOptionFromValue(option2);
           const optionKey = bestOption.attributeName();
-          const source = this.getOptionValueSource(optionKey);
-          if (source === "env") {
+          const source2 = this.getOptionValueSource(optionKey);
+          if (source2 === "env") {
             return `environment variable '${bestOption.envVar}'`;
           }
           return `option '${bestOption.flags}'`;
@@ -5998,10 +5998,10 @@ var require_ponyfill_es2018 = __commonJS({
         return ctor;
       }
       const DOMException2 = getFromGlobal() || createPolyfill();
-      function ReadableStreamPipeTo(source, dest, preventClose, preventAbort, preventCancel, signal) {
-        const reader = AcquireReadableStreamDefaultReader(source);
+      function ReadableStreamPipeTo(source2, dest, preventClose, preventAbort, preventCancel, signal) {
+        const reader = AcquireReadableStreamDefaultReader(source2);
         const writer = AcquireWritableStreamDefaultWriter(dest);
-        source._disturbed = true;
+        source2._disturbed = true;
         let shuttingDown = false;
         let currentWrite = promiseResolvedWith(void 0);
         return newPromise((resolve3, reject) => {
@@ -6020,8 +6020,8 @@ var require_ponyfill_es2018 = __commonJS({
               }
               if (!preventCancel) {
                 actions.push(() => {
-                  if (source._state === "readable") {
-                    return ReadableStreamCancel(source, error);
+                  if (source2._state === "readable") {
+                    return ReadableStreamCancel(source2, error);
                   }
                   return promiseResolvedWith(void 0);
                 });
@@ -6063,7 +6063,7 @@ var require_ponyfill_es2018 = __commonJS({
               });
             });
           }
-          isOrBecomesErrored(source, reader._closedPromise, (storedError) => {
+          isOrBecomesErrored(source2, reader._closedPromise, (storedError) => {
             if (!preventAbort) {
               shutdownWithAction(() => WritableStreamAbort(dest, storedError), true, storedError);
             } else {
@@ -6073,13 +6073,13 @@ var require_ponyfill_es2018 = __commonJS({
           });
           isOrBecomesErrored(dest, writer._closedPromise, (storedError) => {
             if (!preventCancel) {
-              shutdownWithAction(() => ReadableStreamCancel(source, storedError), true, storedError);
+              shutdownWithAction(() => ReadableStreamCancel(source2, storedError), true, storedError);
             } else {
               shutdown(true, storedError);
             }
             return null;
           });
-          isOrBecomesClosed(source, reader._closedPromise, () => {
+          isOrBecomesClosed(source2, reader._closedPromise, () => {
             if (!preventClose) {
               shutdownWithAction(() => WritableStreamDefaultWriterCloseWithErrorPropagation(writer));
             } else {
@@ -6090,7 +6090,7 @@ var require_ponyfill_es2018 = __commonJS({
           if (WritableStreamCloseQueuedOrInFlight(dest) || dest._state === "closed") {
             const destClosed = new TypeError("the destination writable stream closed before all data could be piped to it");
             if (!preventCancel) {
-              shutdownWithAction(() => ReadableStreamCancel(source, destClosed), true, destClosed);
+              shutdownWithAction(() => ReadableStreamCancel(source2, destClosed), true, destClosed);
             } else {
               shutdown(true, destClosed);
             }
@@ -6726,11 +6726,11 @@ var require_ponyfill_es2018 = __commonJS({
       function isReadableStreamLike(stream) {
         return typeIsObject(stream) && typeof stream.getReader !== "undefined";
       }
-      function ReadableStreamFrom(source) {
-        if (isReadableStreamLike(source)) {
-          return ReadableStreamFromDefaultReader(source.getReader());
+      function ReadableStreamFrom(source2) {
+        if (isReadableStreamLike(source2)) {
+          return ReadableStreamFromDefaultReader(source2.getReader());
         }
-        return ReadableStreamFromIterable(source);
+        return ReadableStreamFromIterable(source2);
       }
       function ReadableStreamFromIterable(asyncIterable) {
         let stream;
@@ -6817,9 +6817,9 @@ var require_ponyfill_es2018 = __commonJS({
         stream = CreateReadableStream(startAlgorithm, pullAlgorithm, cancelAlgorithm, 0);
         return stream;
       }
-      function convertUnderlyingDefaultOrByteSource(source, context) {
-        assertDictionary(source, context);
-        const original = source;
+      function convertUnderlyingDefaultOrByteSource(source2, context) {
+        assertDictionary(source2, context);
+        const original = source2;
         const autoAllocateChunkSize = original === null || original === void 0 ? void 0 : original.autoAllocateChunkSize;
         const cancel = original === null || original === void 0 ? void 0 : original.cancel;
         const pull = original === null || original === void 0 ? void 0 : original.pull;
@@ -10819,6 +10819,144 @@ var require_editCompleteness = __commonJS({
   }
 });
 
+// ../core/dist/agent/securityLint.js
+var require_securityLint = __commonJS({
+  "../core/dist/agent/securityLint.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.checkSecurity = checkSecurity;
+    exports.securityNoteText = securityNoteText;
+    var SAMPLE_MAX = 160;
+    function redact(line) {
+      const masked = line.replace(/(['"`]?[\w.-]*(?:secret|password|passwd|token|api[_-]?key|apikey|auth|credential|private[_-]?key)[\w.-]*['"`]?\s*[:=]\s*)(['"`])([^'"`]{4,})\2/gi, (_m, head, q) => `${head}${q}[REDACTED]${q}`).replace(/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g, "[REDACTED]");
+      return masked.length > SAMPLE_MAX ? masked.slice(0, SAMPLE_MAX) + "\u2026" : masked;
+    }
+    function isLikelyCommentLine(line) {
+      return /^\s*(\/\/|\*|#|--|<!--)/.test(line);
+    }
+    var RULES = [
+      // ── Hardcoded credentials ───────────────────────────────────────────────────
+      // Provider-prefixed tokens are near-zero false positive: the prefixes are
+      // registered formats, not something that occurs naturally in source. Checked
+      // inside comments too — a key commented out is still a committed key.
+      {
+        kind: "hardcoded-secret",
+        re: /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})\b/,
+        message: "Looks like a real API key/token committed to source. Move it to an environment variable and rotate the exposed key.",
+        includeComments: true
+      },
+      // NOTE: the `private-key` check is NOT here — it needs to span multiple lines
+      // (BEGIN header on one, base64 body on the next), which this per-line loop
+      // cannot express. It runs separately in checkSecurity below.
+      {
+        kind: "hardcoded-password",
+        // An ASSIGNMENT of a credential-ish name to a non-trivial literal.
+        //
+        // Tightened after measuring against the real backend, where the looser version
+        // fired on `missingSecret:'FIREBASE_TOKEN'` — code that NAMES a secret in an
+        // error message, the opposite of leaking one. So a value that is itself just a
+        // SCREAMING_SNAKE identifier (an env-var name) is excluded, along with the
+        // usual placeholder vocabulary. The value must also look like actual secret
+        // material: mixed case or digits, not a lone lowercase word.
+        re: /(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token)['"`]?\s*[:=]\s*['"`](?![A-Z0-9_]+['"`])(?!.*(?:\$\{|process\.env|os\.environ|example|changeme|placeholder|redacted|xxx|test|dummy|fake|sample|your[_-]?|<|\*{3}))(?=[^'"`]*[0-9A-Z])[^'"`\s]{10,}['"`]/,
+        message: "Hardcoded credential literal. Read it from the environment/secret store instead, and rotate the exposed value.",
+        includeComments: true
+      },
+      // ── Injection ───────────────────────────────────────────────────────────────
+      {
+        kind: "dynamic-eval",
+        // The negative lookbehind for `.` is what makes this usable: `redisClient.eval`
+        // (a Redis Lua script), `page.eval` (Playwright), `vm.eval` and friends are
+        // METHOD calls on an object and have nothing to do with JavaScript's global
+        // eval. Without it, the real backend's Redis idempotency script was flagged.
+        // Only a bare `eval(` / `new Function(` with a non-literal argument counts.
+        re: /(?<![.\w$])(?:eval|new\s+Function)\s*\(\s*(?!['"`][^'"`]*['"`]\s*\))[^)]*[a-zA-Z_$][\w$]*/,
+        message: "eval / new Function on a non-literal value executes arbitrary code if that value is ever user-controlled. Use an explicit parser or a lookup table."
+      },
+      {
+        kind: "sql-injection",
+        // Only fires when the interpolated expression is plausibly REQUEST-DERIVED.
+        //
+        // The obvious pattern — any `${...}` inside a SQL string — was measured
+        // against the real backend and flagged 15 of 183 files, essentially all of
+        // them safe and idiomatic: `${sets.join(', ')}` for a dynamic UPDATE, `${field}`
+        // for a server-chosen column, `${CONSUMPTION}` for a module constant. At that
+        // hit rate the warning is pure noise, and noise is worse than silence because
+        // it teaches everyone to skip the channel.
+        //
+        // So the interpolation must name something that plausibly came from the
+        // outside: req/request/params/query/body/input/user/args, or a bare
+        // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
+        // review is the security-auditor agent's job, not an inline regex's.
+        re: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b[^;'"`]{0,160}(?:\$\{\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|['"`]\s*\+\s*(?:req|request|params?|query|body|input|user|args|ctx)\b|%\s*\(\s*(?:request|params?|query|body|input|user)\b)/i,
+        message: "SQL built by interpolating a request-derived value. Use a parameterised query ($1 / ? placeholders) \u2014 this is the classic injection sink."
+      },
+      {
+        kind: "command-injection",
+        // Shell execution with an interpolated or concatenated argument.
+        re: /\b(?:exec|execSync|spawnSync?|system|popen|os\.system|subprocess\.(?:call|run|Popen))\s*\(\s*(?:[`'"][^`'"]*(?:\$\{|['"]\s*\+)|[a-zA-Z_$][\w$]*\s*\+)/,
+        message: "Shell command built from a variable. Pass arguments as an array (no shell), or validate against an allowlist \u2014 a value containing ; or $() becomes command execution."
+      },
+      // ── Transport / verification ────────────────────────────────────────────────
+      {
+        kind: "tls-verification-disabled",
+        re: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/,
+        message: "TLS certificate verification is disabled, which removes protection against man-in-the-middle attacks. Trust a specific CA instead if the cert is self-signed."
+      }
+    ];
+    function checkSecurity(content, max = 5) {
+      if (!content)
+        return [];
+      const findings = [];
+      const lines = content.split(/\r?\n/);
+      const pemIdx = lines.findIndex((l) => /-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PGP)?\s*PRIVATE KEY-----/.test(l));
+      if (pemIdx !== -1) {
+        const following = lines.slice(pemIdx, pemIdx + 4).join("\n");
+        if (/[A-Za-z0-9+/]{40,}/.test(following.replace(/-----[^-]+-----/g, ""))) {
+          findings.push({
+            kind: "private-key",
+            message: "A private key with real key material is being written into source. Store it outside the repo (secret manager / env var) and rotate it.",
+            line: pemIdx + 1,
+            sample: "-----BEGIN PRIVATE KEY----- [REDACTED]"
+          });
+        }
+      }
+      const seenKinds = /* @__PURE__ */ new Set();
+      for (let i2 = 0; i2 < lines.length && findings.length < max; i2++) {
+        const line = lines[i2];
+        if (!line || line.length > 2e3)
+          continue;
+        const commentish = isLikelyCommentLine(line);
+        for (const rule of RULES) {
+          if (seenKinds.has(rule.kind))
+            continue;
+          if (commentish && !rule.includeComments)
+            continue;
+          if (!rule.re.test(line))
+            continue;
+          seenKinds.add(rule.kind);
+          findings.push({ kind: rule.kind, message: rule.message, line: i2 + 1, sample: redact(line.trim()) });
+          break;
+        }
+      }
+      return findings;
+    }
+    function securityNoteText(findings) {
+      if (process.env.NEXRALL_SECURITY_LINT === "off")
+        return "";
+      if (!findings.length)
+        return "";
+      const lines = findings.map((f3) => `  \u2022 line ${f3.line} [${f3.kind}]: ${f3.message}
+    ${f3.sample}`);
+      return `
+
+\u26A0 SECURITY REVIEW (${findings.length} finding${findings.length > 1 ? "s" : ""}) \u2014 the write succeeded; check these before moving on:
+` + lines.join("\n") + `
+If a finding is a false positive (test fixture, placeholder, intentionally dynamic), say so and continue \u2014 do NOT rewrite correct code to silence it.`;
+    }
+  }
+});
+
 // ../core/dist/agent/memory.js
 var require_memory = __commonJS({
   "../core/dist/agent/memory.js"(exports) {
@@ -11063,6 +11201,8 @@ var require_plugins = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.FILE_CANDIDATES = void 0;
+    exports.resolvePluginFile = resolvePluginFile;
     exports.loadPlugins = loadPlugins3;
     exports.pluginAssetDirs = pluginAssetDirs;
     exports.pluginHooks = pluginHooks;
@@ -11070,9 +11210,28 @@ var require_plugins = __commonJS({
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
+    exports.FILE_CANDIDATES = {
+      manifest: ["plugin.json", path6.join(".claude-plugin", "plugin.json")],
+      hooks: ["hooks.json", path6.join("hooks", "hooks.json")],
+      mcp: ["mcp.json", ".mcp.json"]
+    };
+    function resolvePluginFile(dir, kind) {
+      for (const rel of exports.FILE_CANDIDATES[kind]) {
+        const full = path6.join(dir, rel);
+        try {
+          if (fs9.statSync(full).isFile())
+            return full;
+        } catch {
+        }
+      }
+      return null;
+    }
     function readMeta(dir) {
+      const file = resolvePluginFile(dir, "manifest");
+      if (!file)
+        return {};
       try {
-        const raw = fs9.readFileSync(path6.join(dir, "plugin.json"), "utf-8");
+        const raw = fs9.readFileSync(file, "utf-8");
         const j = JSON.parse(raw);
         return {
           name: typeof j.name === "string" ? j.name : void 0,
@@ -11125,8 +11284,11 @@ var require_plugins = __commonJS({
     function pluginHooks(workDir) {
       const merged = {};
       for (const p of loadPlugins3(workDir)) {
+        const file = resolvePluginFile(p.dir, "hooks");
+        if (!file)
+          continue;
         try {
-          const raw = fs9.readFileSync(path6.join(p.dir, "hooks.json"), "utf-8");
+          const raw = fs9.readFileSync(file, "utf-8");
           const j = JSON.parse(raw);
           const hooks = j.hooks ?? j;
           for (const [phase, entries] of Object.entries(hooks)) {
@@ -11142,8 +11304,11 @@ var require_plugins = __commonJS({
     function pluginMcpServers(workDir) {
       const merged = {};
       for (const p of loadPlugins3(workDir)) {
+        const file = resolvePluginFile(p.dir, "mcp");
+        if (!file)
+          continue;
         try {
-          const raw = fs9.readFileSync(path6.join(p.dir, "mcp.json"), "utf-8");
+          const raw = fs9.readFileSync(file, "utf-8");
           const j = JSON.parse(raw);
           const servers = j.mcpServers ?? j;
           for (const [name, cfg] of Object.entries(servers)) {
@@ -11262,7 +11427,7 @@ var require_loader = __commonJS({
       }
       return { meta, body: (m2[2] ?? "").trim() };
     }
-    function loadDir(dir, source, into) {
+    function loadDir(dir, source2, into) {
       let files;
       try {
         files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
@@ -11276,7 +11441,7 @@ var require_loader = __commonJS({
           const name = (meta.name || path6.basename(file, ".md")).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
           const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
           into.set(name, {
@@ -11285,7 +11450,7 @@ var require_loader = __commonJS({
             model,
             mode: meta.mode || void 0,
             body,
-            source
+            source: source2
           });
         } catch {
         }
@@ -11431,7 +11596,7 @@ var require_skills = __commonJS({
         return false;
       return fallback;
     }
-    function toSkill(meta, body, name, source, dir) {
+    function toSkill(meta, body, name, source2, dir) {
       const model = ["turbo", "pro", "ultra"].find((x2) => x2 === (meta.model ?? "").toLowerCase());
       return {
         name,
@@ -11439,13 +11604,13 @@ var require_skills = __commonJS({
         model,
         mode: meta.mode || void 0,
         body,
-        source,
+        source: source2,
         dir,
         disableModelInvocation: parseBool(meta["disable-model-invocation"], false),
         userInvocable: parseBool(meta["user-invocable"], true)
       };
     }
-    function loadFlatCommandDir(dir, source, into) {
+    function loadFlatCommandDir(dir, source2, into) {
       let files;
       try {
         files = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
@@ -11459,14 +11624,14 @@ var require_skills = __commonJS({
           const name = (meta.name || path6.basename(file, ".md")).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
-          into.set(name, toSkill(meta, body, name, source));
+          into.set(name, toSkill(meta, body, name, source2));
         } catch {
         }
       }
     }
-    function loadSkillDir(root, source, into) {
+    function loadSkillDir(root, source2, into) {
       let entries;
       try {
         entries = fs9.readdirSync(root, { withFileTypes: true });
@@ -11490,9 +11655,9 @@ var require_skills = __commonJS({
           const name = (meta.name || entry.name).trim().toLowerCase();
           if (!name)
             continue;
-          if (source !== "project" && into.has(name))
+          if (source2 !== "project" && into.has(name))
             continue;
-          into.set(name, toSkill(meta, body, name, source, skillDir));
+          into.set(name, toSkill(meta, body, name, source2, skillDir));
         } catch {
         }
       }
@@ -12026,12 +12191,12 @@ var require_symbols = __commonJS({
       return new Set(EXT_TO_LANG.keys());
     }
     var MAX_FILE_BYTES = 1024 * 1024;
-    function extractSymbols(filePath, source) {
+    function extractSymbols(filePath, source2) {
       const lang = EXT_TO_LANG.get(path6.extname(filePath).toLowerCase());
       if (!lang)
         return [];
       const hits = [];
-      const lines = source.split("\n");
+      const lines = source2.split("\n");
       let inBlockComment = false;
       for (let i2 = 0; i2 < lines.length; i2++) {
         const trimmed = lines[i2].trim();
@@ -12068,21 +12233,21 @@ var require_symbols = __commonJS({
       if (!rel)
         return { error: "path is required" };
       const abs = resolveIn(workDir, rel);
-      let source;
+      let source2;
       try {
         const st = fs9.statSync(abs);
         if (!st.isFile())
           return { error: `Not a file: ${rel}` };
         if (st.size > MAX_FILE_BYTES)
           return { error: `File too large for symbol scan (${Math.round(st.size / 1024)} KB > 1024 KB)` };
-        source = fs9.readFileSync(abs, "utf-8");
+        source2 = fs9.readFileSync(abs, "utf-8");
       } catch (err) {
         return { error: `Cannot read ${rel}: ${err.message}` };
       }
       if (!EXT_TO_LANG.has(path6.extname(abs).toLowerCase())) {
         return { output: `No symbol support for ${path6.extname(abs) || "this file type"} (regex-based scanner). Use search_files instead.` };
       }
-      const hits = extractSymbols(abs, source);
+      const hits = extractSymbols(abs, source2);
       if (!hits.length)
         return { output: `No symbols found in ${rel}.` };
       const lines = hits.map((h2) => `${h2.kind.padEnd(10)} ${h2.name}  (line ${h2.line})`);
@@ -12124,10 +12289,10 @@ ${lines.join("\n")}` };
               const st = fs9.statSync(full);
               if (st.size > MAX_FILE_BYTES)
                 continue;
-              const source = fs9.readFileSync(full, "utf-8");
-              if (!source.toLowerCase().includes(q))
+              const source2 = fs9.readFileSync(full, "utf-8");
+              if (!source2.toLowerCase().includes(q))
                 continue;
-              for (const h2 of extractSymbols(full, source)) {
+              for (const h2 of extractSymbols(full, source2)) {
                 if (h2.name.toLowerCase().includes(q)) {
                   results.push({ ...h2, file: path6.relative(root, full) });
                   if (results.length >= MAX_RESULTS)
@@ -12314,18 +12479,18 @@ var require_tsLangService = __commonJS({
         return false;
       }
     }
-    function posToOffset(source, line, character) {
-      const lines = source.split("\n");
+    function posToOffset(source2, line, character) {
+      const lines = source2.split("\n");
       let offset = 0;
       for (let i2 = 0; i2 < line - 1 && i2 < lines.length; i2++)
         offset += lines[i2].length + 1;
       return offset + Math.max(0, character - 1);
     }
-    function offsetToPos(source, offset) {
+    function offsetToPos(source2, offset) {
       let line = 1;
       let last = 0;
-      for (let i2 = 0; i2 < offset && i2 < source.length; i2++) {
-        if (source[i2] === "\n") {
+      for (let i2 = 0; i2 < offset && i2 < source2.length; i2++) {
+        if (source2[i2] === "\n") {
           line++;
           last = i2 + 1;
         }
@@ -12342,8 +12507,8 @@ var require_tsLangService = __commonJS({
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let defs;
       try {
         defs = svc.service.getDefinitionAtPosition(deps.filePath, offset);
@@ -12366,8 +12531,8 @@ ${out.join("\n")}` };
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let refs;
       try {
         refs = svc.service.getReferencesAtPosition(deps.filePath, offset);
@@ -12394,8 +12559,8 @@ ${lines.join("\n")}` };
         return null;
       if (!ensureFile(svc, deps.filePath))
         return { error: `Cannot read ${deps.filePath}` };
-      const source = svc.snapshots.get(deps.filePath) ?? "";
-      const offset = posToOffset(source, deps.line, deps.character);
+      const source2 = svc.snapshots.get(deps.filePath) ?? "";
+      const offset = posToOffset(source2, deps.line, deps.character);
       let info;
       try {
         info = svc.service.getQuickInfoAtPosition(deps.filePath, offset);
@@ -12482,6 +12647,7 @@ var require_executor = __commonJS({
     var sandbox_1 = require_sandbox();
     var auth_1 = require_auth();
     var editCompleteness_1 = require_editCompleteness();
+    var securityLint_1 = require_securityLint();
     var memory_1 = require_memory();
     var skills_1 = require_skills();
     var testIntegrity_1 = require_testIntegrity();
@@ -12737,15 +12903,16 @@ Resolve the conflict (remove <<<<<<< / ======= / >>>>>>> markers and keep the in
         atomicWrite(resolved, content, existingMode);
         const bytes = Buffer.byteLength(content, "utf-8");
         const lines = content.split("\n").length;
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(content));
         if (isNew) {
-          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+          return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}` };
         }
         const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         let tiMarker = "";
         const ti = (0, testIntegrity_1.analyzeTestEdit)(resolved, normalizeLF(priorContent), normalizeLF(content));
         if (ti.suspicious)
           tiMarker = (0, testIntegrity_1.encodeTestIntegrityMarker)(ti.findings);
-        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${tiMarker}` };
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)${xfile}${sec}${tiMarker}` };
       } catch (err) {
         return { error: err.message };
       }
@@ -13388,14 +13555,14 @@ ${globalCapMatches(output)}` : "";
       }
     }
     async function moveFile(input, workDir) {
-      const source = typeof input.source === "string" ? input.source : "";
+      const source2 = typeof input.source === "string" ? input.source : "";
       const dest = typeof input.dest === "string" ? input.dest : "";
-      if (!source)
+      if (!source2)
         return { error: "Missing required parameter: source" };
       if (!dest)
         return { error: "Missing required parameter: dest" };
       try {
-        const resolvedSource = resolvePath(source, workDir);
+        const resolvedSource = resolvePath(source2, workDir);
         const resolvedDest = resolvePath(dest, workDir);
         fs9.mkdirSync(path6.dirname(resolvedDest), { recursive: true });
         try {
@@ -13531,22 +13698,23 @@ ${globalCapMatches(output)}` : "";
         const linesBefore = origNorm.split("\n").length;
         const linesAfter = updated.split("\n").length;
         const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(newNorm));
         return { output: `Edited ${resolved} (${linesBefore} \u2192 ${linesAfter} lines)
 
-${diff3}${xfile}` };
+${diff3}${xfile}${sec}` };
       } catch (err) {
         return { error: err.message };
       }
     }
     async function copyFile(input, workDir) {
-      const source = typeof input.source === "string" ? input.source : "";
+      const source2 = typeof input.source === "string" ? input.source : "";
       const destination = typeof input.destination === "string" ? input.destination : "";
-      if (!source)
+      if (!source2)
         return { error: "Missing required parameter: source" };
       if (!destination)
         return { error: "Missing required parameter: destination" };
       try {
-        const resolvedSrc = resolvePath(source, workDir);
+        const resolvedSrc = resolvePath(source2, workDir);
         const resolvedDest = resolvePath(destination, workDir);
         if (fs9.existsSync(resolvedDest) && fs9.statSync(resolvedDest).isDirectory()) {
           return { error: `Destination is a directory: ${resolvedDest}. Provide a full file path including the filename.` };
@@ -13801,6 +13969,7 @@ ${body}${truncNote}
         let content = normalizeLF(rawFile);
         const originalNorm = content;
         const diffs = [];
+        const insertedText = [];
         for (let i2 = 0; i2 < edits.length; i2++) {
           const edit = edits[i2];
           const oldStr = normalizeLF(typeof edit.old_string === "string" ? edit.old_string : "");
@@ -13815,16 +13984,18 @@ ${body}${truncNote}
             return { error: `Edit #${i2 + 1}: old_string appears ${count} times \u2014 it must be unique. Add more surrounding context.` };
           }
           diffs.push(buildDiff(filePath, oldStr, newStr, content));
+          insertedText.push(newStr);
           content = literalReplace(content, oldStr, newStr);
         }
         const finalContent = wasCRLF ? content.replace(/\n/g, "\r\n") : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
         const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join("\n")));
         return {
           output: `Applied ${edits.length} edit(s) to ${resolved}:
 ` + diffs.map((d, i2) => `
 --- edit #${i2 + 1} ---
-${d}`).join("\n") + xfile
+${d}`).join("\n") + xfile + sec
         };
       } catch (err) {
         return { error: err.message };
@@ -13989,7 +14160,7 @@ ${lines.join("\n")}`;
       const editType = typeof input.edit_type === "string" ? input.edit_type : "";
       const rawIdx = input.cell_index;
       const cellIndex = typeof rawIdx === "number" ? Math.floor(rawIdx) : typeof rawIdx === "string" && rawIdx.trim() !== "" ? parseInt(rawIdx, 10) : -1;
-      const source = typeof input.source === "string" ? input.source : null;
+      const source2 = typeof input.source === "string" ? input.source : null;
       const cellType = typeof input.cell_type === "string" ? input.cell_type : "code";
       if (!filePath)
         return { error: "Missing required parameter: path" };
@@ -14008,10 +14179,10 @@ ${lines.join("\n")}`;
         if (editType === "replace") {
           if (cellIndex < 0 || cellIndex >= n)
             return { error: `cell_index ${cellIndex} out of range (0\u2013${n - 1})` };
-          if (source === null)
+          if (source2 === null)
             return { error: "Missing required parameter: source (required for replace)" };
           const cell = nb.cells[cellIndex];
-          cell.source = source;
+          cell.source = source2;
           if (cell.cell_type === "code") {
             cell.outputs = [];
             cell.execution_count = null;
@@ -14026,12 +14197,12 @@ ${lines.join("\n")}`;
           save();
           return { output: `Deleted cell ${cellIndex} [${removed.cell_type}] from ${resolved}. Notebook now has ${nb.cells.length} cells.` };
         }
-        if (source === null)
+        if (source2 === null)
           return { error: "Missing required parameter: source (required for insert)" };
         const insertAt = cellIndex >= 0 ? Math.min(cellIndex + 1, n) : n;
         const newCell = {
           cell_type: cellType,
-          source,
+          source: source2,
           metadata: {},
           ...cellType === "code" ? { execution_count: null, outputs: [] } : {}
         };
@@ -14398,18 +14569,62 @@ var require_agentTypes = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.loadAgentTypes = loadAgentTypes2;
+    exports.loadAgentTypes = loadAgentTypes;
+    exports.loadAgentTypesWithWarnings = loadAgentTypesWithWarnings2;
+    exports.knownToolNames = knownToolNames;
+    exports.builtinAgents = builtinAgents;
     exports.summariseAgents = summariseAgents;
     exports.findAgentType = findAgentType;
     var fs9 = __importStar(__require("fs"));
     var path6 = __importStar(__require("path"));
     var os6 = __importStar(__require("os"));
     var index_1 = require_plugins();
+    var READ_ONLY_TOOLS = [
+      // Universal
+      "read_file",
+      "search_files",
+      "glob",
+      "list_directory",
+      "bash",
+      "bash_output",
+      // kill_shell belongs next to bash_output: an agent that can start a background
+      // process and poll it but never stop it leaks that process past its own
+      // lifetime. Stopping a shell you started is not a write to the repo.
+      "kill_shell",
+      "notebook_read",
+      "todo_write",
+      "todo_read",
+      // Skills are reusable prompt playbooks, and loop.ts advertises the skills
+      // catalogue to sub-agents at EVERY depth — so withholding the tool that loads
+      // one meant showing every sub-agent a menu it could not order from.
+      "use_skill",
+      // VS Code language server (ignored on the CLI)
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ];
+    var RESEARCH_TOOLS = [...READ_ONLY_TOOLS, "fetch_url"];
+    var WRITE_TOOLS = [
+      ...READ_ONLY_TOOLS,
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "create_directory",
+      "move_file",
+      "copy_file",
+      // notebook_edit is a write tool like any other, and allowsTestOnlyWrite already
+      // knows its shape (`source` is cell CONTENT, not a path). Omitting it just meant
+      // test-writer silently could not touch notebooks.
+      "notebook_edit"
+    ];
     var BUILTIN_AGENTS = [
       {
         name: "reviewer",
         description: "Read-only code reviewer \u2014 finds correctness bugs, edge cases, and security issues in a diff or file set. Cannot modify files.",
-        tools: ["read_file", "search_files", "glob", "list_directory", "bash", "get_symbols", "get_workspace_symbols", "find_references", "go_to_definition", "get_diagnostics"],
+        tools: READ_ONLY_TOOLS,
         source: "builtin",
         prompt: [
           "You are a meticulous senior code reviewer. You NEVER modify files \u2014 you only read, search, and report.",
@@ -14425,78 +14640,377 @@ var require_agentTypes = __commonJS({
           "Report format: \u{1F534} Critical / \u{1F7E1} Warning / \u{1F7E2} Suggestion, each with file:line and a concrete fix,",
           "then a final verdict (APPROVE or REQUEST CHANGES) with a one-paragraph rationale."
         ].join("\n")
+      },
+      // Promoted from the security-audit plugin to a builtin.
+      //
+      // Leaving it plugin-only was indefensible next to `reviewer` being builtin:
+      // reviewer's own prompt already tells it to look for security issues, so
+      // security IS treated as default work — yet the specialist agent for it was
+      // invisible unless the user happened to know the plugin existed. For an agent
+      // that WRITES code, "you only get a security review if you knew to install
+      // something" is the wrong default.
+      {
+        name: "security-auditor",
+        description: "Read-only security auditor \u2014 hunts injection, authz, secrets, and validation flaws in a path or diff. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are a security auditor. You find real, exploitable flaws \u2014 not style issues.",
+          "",
+          "Method:",
+          "1. Map the attack surface FIRST: entry points (HTTP routes, message handlers, CLI args, file/network",
+          "   input, deserialization), then trace user-controlled data inward to where it is used.",
+          "2. For each finding: file:line, the flaw class, a one-line exploit scenario, and the concrete fix.",
+          "3. Grade severity honestly: Critical = remote compromise or data breach; High = auth bypass/IDOR;",
+          "   Medium = needs unusual preconditions; Low = hardening.",
+          "",
+          "Classes worth the most attention, in order: injection (SQL/command/template/prototype), broken",
+          "authz (missing ownership checks, IDOR, trusting client-supplied ids), secrets committed to source,",
+          "path traversal, SSRF, unsafe deserialization, missing rate limits on expensive or auth endpoints,",
+          "and crypto misuse (hand-rolled comparison, predictable randomness).",
+          "",
+          "Hard rules:",
+          "- READ-ONLY: never modify, create or delete files. bash only for read-only inspection.",
+          "- NEVER print a discovered secret's value. Report its location and advise rotation.",
+          "- Distinguish EXPLOITABLE from theoretical, and say which one each finding is.",
+          '- "No issues found in scope X" is a valid, useful result. Do not pad the report to look thorough.'
+        ].join("\n")
+      },
+      // The gap Claude Code fills with its built-in `Explore`: read-heavy codebase
+      // search that would otherwise flood the parent's context. Defaults to the
+      // cheapest model on purpose — "find every caller of X" has no need of a
+      // frontier model, and this is the agent most likely to be spawned in bulk.
+      {
+        name: "explorer",
+        description: "Fast read-only codebase explorer \u2014 locates files, symbols, and call sites and reports concise findings. Use to keep bulk searching out of the main context. Cannot modify files.",
+        tools: READ_ONLY_TOOLS,
+        model: "turbo",
+        source: "builtin",
+        prompt: [
+          "You map code. You NEVER modify anything.",
+          "",
+          "Method:",
+          "1. Prefer structural search over text search where available (get_workspace_symbols, find_references,",
+          "   go_to_definition); fall back to search_files/glob otherwise.",
+          "2. Read only the sections you need \u2014 use read_file with offset/limit on large files instead of",
+          "   pulling in thousands of lines.",
+          "3. Follow the real call graph rather than guessing from names.",
+          "",
+          "Your ONLY output is a compact report: the file:line locations that matter, how they relate, and the",
+          "direct answer to the question you were given. This exists to keep bulk search OUT of the parent's",
+          "context, so do not paste large file contents back \u2014 cite locations and summarise. Say plainly when",
+          'something does not exist; a confident wrong answer is far worse than "not found".'
+        ].join("\n")
+      },
+      // Matches Claude Code's built-in `Plan`: research a change and return a
+      // strategy, deliberately WITHOUT write access so "make a plan" can never
+      // quietly become "start editing".
+      {
+        name: "planner",
+        description: "Read-only planning agent \u2014 researches a change and returns a concrete step-by-step implementation plan with risks and affected files. Cannot modify files.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You produce implementation plans. You NEVER modify files \u2014 planning and doing are separate steps,",
+          'and this agent exists so "plan it" cannot silently turn into "change it".',
+          "",
+          "Method:",
+          "1. Read the actual code before proposing anything. No plan may rest on an assumed API shape.",
+          "2. Find every affected call site (find_references / search_files) and list them.",
+          "3. Order the steps so the tree stays working after each one \u2014 types, then implementation, then",
+          "   tests, then exports/registration.",
+          "",
+          "Output:",
+          "- Goal, in one sentence.",
+          "- Numbered steps, each with the exact files touched and what changes in them.",
+          "- Risks + the specific thing that could break, and how it would be detected.",
+          "- How to verify (the exact test/build command for THIS project, taken from package.json/Makefile).",
+          "- Anything genuinely ambiguous, stated as an open question rather than a silent assumption."
+        ].join("\n")
+      },
+      // Promoted from the test-gen plugin. Needs write access — it produces test
+      // files — but is deliberately forbidden from touching source, because "make the
+      // tests pass" is the single most common way an agent destroys signal.
+      {
+        name: "test-writer",
+        description: "Writes tests that follow the project's existing conventions. May create/edit TEST files only \u2014 never production source.",
+        tools: WRITE_TOOLS,
+        // Enforced, not merely requested: the permission gate refuses a write whose
+        // path is not a test file. Without this the allowlist would grant edit_file
+        // for every path and the rule below would be a suggestion the model is free
+        // to rationalise its way past.
+        testFilesOnly: true,
+        source: "builtin",
+        prompt: [
+          "You write tests. You may create and edit TEST files only.",
+          "",
+          "Hard rules \u2014 these are the ways test-writing agents destroy value, so they are non-negotiable:",
+          "- NEVER modify production source to make a test pass. If the code looks wrong, REPORT it and stop.",
+          "- NEVER weaken, delete or skip an existing assertion or test.",
+          "- A test that cannot fail is worse than no test. Every test must be able to fail for one clear reason.",
+          "",
+          "Method:",
+          "1. Read the existing tests FIRST and copy their conventions exactly \u2014 runner, file naming, layout,",
+          "   assertion style, fixture/helper patterns. Never introduce a new framework.",
+          "2. Test observable behaviour and the contract, not private internals.",
+          "3. Cover the boring-but-real cases: empty input, null/undefined, unicode and non-BMP characters,",
+          "   boundaries, error paths, concurrency where it applies.",
+          "4. No sleeps or wall-clock dependence \u2014 those produce the flaky tests that get deleted later.",
+          "5. RUN the tests you wrote and report the real output. Never claim a test passes without running it."
+        ].join("\n")
+      },
+      // The DevOps gap — answered with a READ-ONLY advisor, not an operator.
+      //
+      // A "DevOps agent" with write/apply access is a genuinely different risk class
+      // from the others here: its mistakes are `kubectl delete`, a bad `terraform
+      // apply`, a broken deploy pipeline — often not revertible and affecting
+      // production rather than a working tree. So this one diagnoses and proposes a
+      // diff; a human applies it. That asymmetry is the whole design.
+      {
+        name: "devops-advisor",
+        description: "Read-only CI/CD, container, and infrastructure advisor \u2014 diagnoses pipelines, Dockerfiles, and k8s manifests and proposes concrete fixes as a diff. Never applies changes.",
+        tools: RESEARCH_TOOLS,
+        model: "pro",
+        source: "builtin",
+        prompt: [
+          "You are an infrastructure and delivery advisor. You DIAGNOSE and PROPOSE. You never apply changes.",
+          "",
+          "Hard rules:",
+          "- READ-ONLY, and stricter than the other read-only agents: bash is for INSPECTION only",
+          "  (git log/diff, cat, grep, `kubectl get/describe`, `docker images`, `terraform plan`).",
+          "  NEVER run anything that mutates infrastructure \u2014 no apply/delete/scale/rollout/restart/push,",
+          "  no `terraform apply`, no `helm upgrade`. If a fix needs such a command, WRITE IT OUT for a human.",
+          "- Never print secret values from env files, k8s Secrets or CI variables. Reference them by name.",
+          "",
+          "Method:",
+          "1. Read what actually exists \u2014 workflow files, Dockerfiles, manifests, kustomize overlays, the",
+          '   deploy scripts \u2014 before drawing any conclusion. Never reason from what a stack "usually" looks like.',
+          "2. Follow the real path a change takes to production, and name the step that is broken or missing.",
+          "3. Check the failure modes that bite hardest: CI path filters that skip files a workload actually",
+          "   needs, image tags that do not match what is deployed, missing health probes, absent resource",
+          "   limits, secrets baked into images, ports/timeouts inconsistent between proxy and app, and",
+          "   migrations that must run before the new image is live.",
+          "",
+          "Output: the diagnosis, the evidence (file:line or command output), the proposed change as a diff or",
+          "exact file content, and the command a human should run to apply and verify it."
+        ].join("\n")
       }
     ];
+    var KNOWN_TOOL_NAMES = /* @__PURE__ */ new Set([
+      "read_file",
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "list_directory",
+      "create_directory",
+      "move_file",
+      "copy_file",
+      "delete_file",
+      "search_files",
+      "glob",
+      "bash",
+      "bash_output",
+      "kill_shell",
+      "notebook_read",
+      "notebook_edit",
+      "todo_write",
+      "todo_read",
+      "memory_write",
+      "memory_read",
+      "use_skill",
+      "fetch_url",
+      "web_search",
+      "generate_image",
+      "stock_photo",
+      "open_in_browser",
+      "task",
+      "get_symbols",
+      "get_workspace_symbols",
+      "find_references",
+      "go_to_definition",
+      "get_hover",
+      "get_diagnostics"
+    ]);
+    var KNOWN_META_KEYS = /* @__PURE__ */ new Set([
+      "name",
+      "description",
+      "tools",
+      "model",
+      "test_files_only",
+      "testfilesonly"
+    ]);
+    var VALID_MODELS = ["turbo", "pro", "ultra"];
     function parseFrontmatter(raw) {
       const m2 = /^\s*---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(raw);
       if (!m2)
-        return { meta: {}, body: raw.trim() };
+        return { meta: {}, body: raw.trim(), ok: false };
       const meta = {};
       for (const line of m2[1].split(/\r?\n/)) {
         const kv = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line.trim());
         if (kv)
           meta[kv[1].toLowerCase()] = kv[2].trim().replace(/^["']|["']$/g, "");
       }
-      return { meta, body: (m2[2] ?? "").trim() };
+      return { meta, body: (m2[2] ?? "").trim(), ok: true };
     }
     function parseModel(v) {
       const s2 = (v ?? "").toLowerCase();
       return s2 === "turbo" || s2 === "pro" || s2 === "ultra" ? s2 : void 0;
     }
+    function parseBool(v) {
+      return /^(true|yes|1|on)$/i.test((v ?? "").trim());
+    }
     function parseToolList(v) {
       if (!v)
         return void 0;
       const tools = v.replace(/^\[|\]$/g, "").split(/[,\s]+/).map((t2) => t2.trim()).filter(Boolean);
       return tools.length ? tools : void 0;
     }
-    function loadDir(dir, source, into) {
+    function loadDir(dir, source2, into, warnings) {
       let entries;
       try {
-        entries = fs9.readdirSync(dir).filter((f3) => f3.endsWith(".md"));
+        entries = fs9.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
-      for (const file of entries) {
+      for (const entry of entries) {
+        const full = path6.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          loadDir(full, source2, into, warnings);
+          continue;
+        }
+        if (!entry.name.endsWith(".md"))
+          continue;
+        let raw;
         try {
-          const raw = fs9.readFileSync(path6.join(dir, file), "utf-8");
-          const { meta, body } = parseFrontmatter(raw);
-          const name = (meta.name || path6.basename(file, ".md")).trim();
-          if (!name)
-            continue;
-          if (source !== "project" && into.has(name))
-            continue;
-          into.set(name, {
-            name,
-            description: meta.description || `Custom ${name} agent`,
-            tools: parseToolList(meta.tools),
-            model: parseModel(meta.model),
-            prompt: body,
-            source
+          raw = fs9.readFileSync(full, "utf-8");
+        } catch (err) {
+          warnings.push({ file: full, agent: path6.basename(entry.name, ".md"), message: `could not be read (${err.message}) \u2014 this agent was skipped` });
+          continue;
+        }
+        const { meta, body, ok } = parseFrontmatter(raw);
+        const name = (meta.name || path6.basename(entry.name, ".md")).trim();
+        if (!name)
+          continue;
+        if (source2 !== "project" && into.has(name))
+          continue;
+        const tools = parseToolList(meta.tools);
+        let effectiveTools = tools;
+        if (!ok) {
+          effectiveTools = READ_ONLY_TOOLS;
+          warnings.push({
+            file: full,
+            agent: name,
+            message: "has no valid YAML frontmatter (a `---` block must be the first thing in the file), so no tool allowlist could be read. Treating it as READ-ONLY. Add frontmatter with a `tools:` line to grant more."
           });
-        } catch {
+        } else {
+          if (!meta.description) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has no `description:` \u2014 that text is the ONLY thing the model uses to decide when to delegate to this agent, so it will rarely be picked."
+            });
+          }
+          if (meta.model !== void 0 && parseModel(meta.model) === void 0) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has model: "${meta.model}", which is not valid \u2014 use one of ${VALID_MODELS.join(", ")}, or omit the line to inherit the current session's model.`
+            });
+          }
+          const unknown = (tools ?? []).filter((t2) => !KNOWN_TOOL_NAMES.has(t2) && !t2.includes("__"));
+          if (unknown.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `lists unknown tool name(s): ${unknown.join(", ")}. An allowlist only grants, so these silently do nothing and the agent cannot use them. Tool names are lower_snake_case (read_file, search_files, glob, bash).`
+            });
+          }
+          const strayKeys = Object.keys(meta).filter((k) => !KNOWN_META_KEYS.has(k));
+          if (strayKeys.length) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: `has unrecognised frontmatter key(s): ${strayKeys.join(", ")} \u2014 these are ignored.`
+            });
+          }
+          if (!body) {
+            warnings.push({
+              file: full,
+              agent: name,
+              message: "has an empty body \u2014 the text below the frontmatter IS the agent's system prompt, so it currently has no instructions."
+            });
+          }
         }
+        into.set(name, {
+          name,
+          description: meta.description || `Custom ${name} agent`,
+          tools: effectiveTools,
+          model: parseModel(meta.model),
+          prompt: body,
+          source: source2,
+          // Exposed to user/plugin definitions too — `test_files_only: true` (or
+          // `testFilesOnly`) lets anyone build a test-writing agent that genuinely
+          // cannot touch production source, rather than only the builtin getting
+          // that guarantee.
+          ...parseBool(meta.test_files_only ?? meta.testfilesonly) ? { testFilesOnly: true } : {}
+        });
       }
     }
-    function loadAgentTypes2(workDir) {
+    function loadAgentTypes(workDir) {
+      return loadAgentTypesWithWarnings2(workDir).types;
+    }
+    function loadAgentTypesWithWarnings2(workDir) {
       const out = /* @__PURE__ */ new Map();
-      loadDir(path6.join(workDir, ".nexrall", "agents"), "project", out);
-      loadDir(path6.join(os6.homedir(), ".nexrall", "agents"), "global", out);
+      const warnings = [];
+      loadDir(path6.join(workDir, ".nexrall", "agents"), "project", out, warnings);
+      loadDir(path6.join(os6.homedir(), ".nexrall", "agents"), "global", out, warnings);
       for (const dir of (0, index_1.pluginAssetDirs)(workDir, "agents"))
-        loadDir(dir, "plugin", out);
+        loadDir(dir, "plugin", out, warnings);
       for (const agent of BUILTIN_AGENTS) {
         if (!out.has(agent.name))
           out.set(agent.name, agent);
       }
-      return [...out.values()];
+      const builtinOrder = new Map(BUILTIN_AGENTS.map((a, i2) => [a.name, i2]));
+      const types3 = [...out.values()].sort((a, b) => {
+        const ai = builtinOrder.get(a.name);
+        const bi = builtinOrder.get(b.name);
+        if (ai !== void 0 && bi !== void 0)
+          return ai - bi;
+        if (ai !== void 0)
+          return -1;
+        if (bi !== void 0)
+          return 1;
+        return a.name.localeCompare(b.name);
+      });
+      return { types: types3, warnings };
+    }
+    function knownToolNames() {
+      return [...KNOWN_TOOL_NAMES].sort();
+    }
+    function builtinAgents() {
+      return BUILTIN_AGENTS;
     }
     function summariseAgents(types3) {
       if (!types3.length)
         return "";
       return types3.map((t2) => {
-        const tools = t2.tools ? ` (tools: ${t2.tools.join(", ")})` : "";
-        return `- ${t2.name}: ${t2.description}${tools}`;
+        const canWrite = !t2.tools || t2.tools.some((x2) => WRITE_TOOL_HINTS.has(x2));
+        const access = t2.testFilesOnly ? "writes TEST files only" : canWrite ? "can modify files" : "read-only";
+        const model = t2.model ? `, ${t2.model} model` : "";
+        return `- ${t2.name} (${access}${model}): ${t2.description}`;
       }).join("\n");
     }
+    var WRITE_TOOL_HINTS = /* @__PURE__ */ new Set([
+      "write_file",
+      "edit_file",
+      "multi_edit",
+      "notebook_edit",
+      "delete_file",
+      "move_file",
+      "copy_file"
+    ]);
     function findAgentType(types3, name) {
       if (!name)
         return void 0;
@@ -14896,7 +15410,7 @@ var require_loop = __commonJS({
       };
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = void 0;
+    exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.ToolNotAllowedError = void 0;
     exports.resolveMaxIterations = resolveMaxIterations;
     exports.createLimiter = createLimiter;
     exports.extractSubTaskText = extractSubTaskText;
@@ -14905,6 +15419,7 @@ var require_loop = __commonJS({
     exports.contextWindowFor = contextWindowFor2;
     exports.compactionThresholds = compactionThresholds2;
     exports.estimateBodyBytes = estimateBodyBytes2;
+    exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
     exports.findSafeCutIndex = findSafeCutIndex;
     exports.transcriptOf = transcriptOf;
     exports.createLedger = createLedger;
@@ -15172,6 +15687,13 @@ var require_loop = __commonJS({
     var _subTaskCounter = 0;
     var SUBTASK_TIMEOUT_MS = Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) > 0 ? Number(process.env.NEXRALL_SUBTASK_TIMEOUT_MS) : 10 * 60 * 1e3;
     var SUBTASK_MAX = 48e3;
+    var ToolNotAllowedError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ToolNotAllowedError";
+      }
+    };
+    exports.ToolNotAllowedError = ToolNotAllowedError;
     function sliceSafeEnd(s2, max) {
       if (s2.length <= max)
         return s2;
@@ -15235,10 +15757,18 @@ ${tail}`;
         return { error: "Sub-agents cannot spawn further sub-agents. Do this work directly, or report back so the main agent can delegate it." };
       }
       const requestedType = typeof input.subagent_type === "string" ? input.subagent_type : "";
-      const agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
+      let agent = (0, agentTypes_1.findAgentType)(agentTypes, requestedType);
+      let knownTypes = agentTypes;
+      if (requestedType && !agent) {
+        knownTypes = (0, agentTypes_1.loadAgentTypes)(options.workDir);
+        agent = (0, agentTypes_1.findAgentType)(knownTypes, requestedType);
+      }
       if (requestedType && !agent) {
-        const known = agentTypes.map((a) => a.name).join(", ") || "(none defined)";
-        return { error: `Unknown subagent_type "${requestedType}". Available types: ${known}.` };
+        const known = knownTypes.map((a) => a.name).join(", ") || "(none defined)";
+        return {
+          error: `Unknown subagent_type "${requestedType}". Available types: ${known}.
+If you just created .nexrall/agents/` + requestedType + ".md, make sure the write finished in an EARLIER tool call than this one \u2014 a file written in the same batch may not be on disk yet."
+        };
       }
       const subNexrallMd = agent ? `# Sub-agent role: ${agent.name}
 ${agent.prompt}` + (options.nexrallMd ? `
@@ -15248,8 +15778,12 @@ ${agent.prompt}` + (options.nexrallMd ? `
 ${options.nexrallMd}` : "") : options.nexrallMd;
       const allowed = agent?.tools ? new Set(agent.tools) : null;
       const gatedPermission = async (req) => {
-        if (allowed && !allowed.has(req.tool))
-          return false;
+        if (allowed && !allowed.has(req.tool)) {
+          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent is not allowed to use \`${req.tool}\` \u2014 it is not in that agent's tool allowlist. This is a restriction of the agent definition, NOT a user decision: do not ask for approval, use one of the tools you do have, or report back that the task needs a different agent.`);
+        }
+        if (agent?.testFilesOnly && !allowsTestOnlyWrite(req.tool, req.input)) {
+          throw new ToolNotAllowedError(`The "${agent.name}" sub-agent may only write to TEST files, so \`${req.tool}\` was refused for this path. Do not try to work around it: if production code must change, say so in your report instead.`);
+        }
         return options.requestPermission(req);
       };
       const subMessages = [
@@ -15394,6 +15928,15 @@ ${partial}` : "",
       return true;
     }
     exports.WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write_file", "edit_file", "multi_edit", "delete_file", "move_file", "copy_file", "notebook_edit"]);
+    function allowsTestOnlyWrite(tool, input) {
+      if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+      const pathKeys = tool === "notebook_edit" ? ["path"] : ["path", "source", "dest", "destination"];
+      const candidates = pathKeys.map((k) => input?.[k]).filter((v) => typeof v === "string" && v.length > 0);
+      if (candidates.length === 0)
+        return false;
+      return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+    }
     exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
     function findSafeCutIndex(messages, maxIdx) {
       for (let i2 = Math.min(maxIdx, messages.length - 1); i2 >= 2; i2--) {
@@ -15926,13 +16469,16 @@ Continue the work from here.` }] });
             }
             const description = humanDescription(name, input);
             let permitted;
+            let deniedReason = null;
             try {
               permitted = await options.requestPermission({ tool: name, input, description });
-            } catch {
+            } catch (err) {
               permitted = false;
+              if (err instanceof ToolNotAllowedError)
+                deniedReason = err.message;
             }
             if (!permitted) {
-              result = { error: "Permission denied by user" };
+              result = { error: deniedReason ?? "Permission denied by user" };
             } else if (name === "task") {
               result = depth === 0 ? await _subTaskLimit(() => runSubTask(input, options, agentTypes)) : await runSubTask(input, options, agentTypes);
             } else {
@@ -17373,6 +17919,175 @@ var require_destructive = __commonJS({
   }
 });
 
+// ../core/dist/plugins/sources.js
+var require_sources = __commonJS({
+  "../core/dist/plugins/sources.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.loadDeclaredSources = loadDeclaredSources2;
+    exports.allowedSourcePatterns = allowedSourcePatterns2;
+    exports.isSourceAllowed = isSourceAllowed2;
+    exports.resolveSourceAlias = resolveSourceAlias2;
+    exports.writeDeclaredSource = writeDeclaredSource2;
+    exports.removeDeclaredSource = removeDeclaredSource2;
+    exports.sourcesFileFor = sourcesFileFor2;
+    var fs9 = __importStar(__require("fs"));
+    var path6 = __importStar(__require("path"));
+    var os6 = __importStar(__require("os"));
+    function managedSettingsPath() {
+      if (process.platform === "darwin")
+        return "/Library/Application Support/Nexrall/managed-settings.json";
+      if (process.platform === "win32")
+        return path6.join(process.env.PROGRAMDATA ?? "C:\\ProgramData", "Nexrall", "managed-settings.json");
+      return "/etc/nexrall/managed-settings.json";
+    }
+    function readJson(file) {
+      try {
+        return JSON.parse(fs9.readFileSync(file, "utf-8"));
+      } catch {
+        return null;
+      }
+    }
+    var ALIAS_RE = /^[a-z0-9][\w.-]{0,63}$/i;
+    function readSpec(value) {
+      if (typeof value === "string")
+        return value.trim() || null;
+      if (value && typeof value === "object") {
+        const v = value;
+        const inner = v.source ?? v.repo ?? v.url;
+        if (typeof inner === "string")
+          return inner.trim() || null;
+        if (inner && typeof inner === "object") {
+          const deep = inner.repo ?? inner.url;
+          if (typeof deep === "string")
+            return deep.trim() || null;
+        }
+      }
+      return null;
+    }
+    function collect(file, tier, into) {
+      const obj = readJson(file);
+      const raw = obj?.pluginSources;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return;
+      for (const [name, value] of Object.entries(raw)) {
+        if (!ALIAS_RE.test(name))
+          continue;
+        const spec = readSpec(value);
+        if (!spec)
+          continue;
+        if (into.has(name))
+          continue;
+        into.set(name, { name, spec, tier, file });
+      }
+    }
+    function loadDeclaredSources2(workDir, opts = {}) {
+      const out = /* @__PURE__ */ new Map();
+      collect(managedSettingsPath(), "managed", out);
+      collect(path6.join(os6.homedir(), ".nexrall", "settings.json"), "user", out);
+      if (opts.includeProject) {
+        collect(path6.join(workDir, ".nexrall", "settings.json"), "project", out);
+        collect(path6.join(workDir, ".nexrall", "settings.local.json"), "project", out);
+      }
+      return [...out.values()];
+    }
+    function allowedSourcePatterns2() {
+      const obj = readJson(managedSettingsPath());
+      const v = obj?.allowedPluginSources;
+      if (!Array.isArray(v))
+        return null;
+      const pats = v.filter((x2) => typeof x2 === "string" && x2.trim().length > 0);
+      return pats.length ? pats : null;
+    }
+    function isSourceAllowed2(spec, patterns = allowedSourcePatterns2()) {
+      if (!patterns)
+        return true;
+      const cleaned = spec.trim().replace(/^https?:\/\/(?:www\.)?github\.com\//i, "").replace(/\.git$/, "");
+      const base = cleaned.split("#")[0].split("/").slice(0, 2).join("/").toLowerCase();
+      return patterns.some((p) => {
+        const pat = p.trim().toLowerCase().replace(/^https?:\/\/(?:www\.)?github\.com\//i, "");
+        if (pat === "*")
+          return true;
+        if (pat.endsWith("/*"))
+          return base.startsWith(pat.slice(0, -1));
+        return base === pat.split("#")[0].split("/").slice(0, 2).join("/");
+      });
+    }
+    function resolveSourceAlias2(alias, workDir, opts = {}) {
+      const want = alias.trim().toLowerCase();
+      return loadDeclaredSources2(workDir, opts).find((s2) => s2.name.toLowerCase() === want) ?? null;
+    }
+    function writeDeclaredSource2(file, name, spec) {
+      if (!ALIAS_RE.test(name)) {
+        throw new Error(`Invalid source name "${name}". Use letters, numbers, dot, dash or underscore.`);
+      }
+      const obj = readJson(file) ?? {};
+      const existing = obj.pluginSources && typeof obj.pluginSources === "object" && !Array.isArray(obj.pluginSources) ? obj.pluginSources : {};
+      obj.pluginSources = { ...existing, [name]: spec };
+      fs9.mkdirSync(path6.dirname(file), { recursive: true });
+      fs9.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n", "utf-8");
+    }
+    function removeDeclaredSource2(file, name) {
+      const obj = readJson(file);
+      if (!obj?.pluginSources || typeof obj.pluginSources !== "object")
+        return false;
+      const sources = obj.pluginSources;
+      if (!(name in sources))
+        return false;
+      delete sources[name];
+      fs9.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n", "utf-8");
+      return true;
+    }
+    function sourcesFileFor2(scope, workDir) {
+      return scope === "user" ? path6.join(os6.homedir(), ".nexrall", "settings.json") : path6.join(workDir, ".nexrall", "settings.json");
+    }
+  }
+});
+
 // ../core/dist/plugins/installer.js
 var require_installer = __commonJS({
   "../core/dist/plugins/installer.js"(exports) {
@@ -17425,8 +18140,8 @@ var require_installer = __commonJS({
     exports.searchRegistry = searchRegistry2;
     exports.getRegistryPlugin = getRegistryPlugin2;
     exports.reportInstall = reportInstall2;
-    exports.parsePluginSource = parsePluginSource;
-    exports.inspectPluginDir = inspectPluginDir;
+    exports.parsePluginSource = parsePluginSource2;
+    exports.inspectPluginDir = inspectPluginDir2;
     exports.installPlugin = installPlugin2;
     exports.readReceipt = readReceipt2;
     exports.removePlugin = removePlugin2;
@@ -17436,6 +18151,8 @@ var require_installer = __commonJS({
     var os6 = __importStar(__require("os"));
     var child_process_1 = __require("child_process");
     var client_1 = require_client();
+    var index_1 = require_plugins();
+    var sources_1 = require_sources();
     var RECEIPT_FILE = "_install.json";
     async function searchRegistry2(query, limit = 50) {
       const u = new URL(`${client_1.API_BASE}/api/code/plugins`);
@@ -17465,7 +18182,7 @@ var require_installer = __commonJS({
       fetch(`${client_1.API_BASE}/api/code/plugins/${encodeURIComponent(name)}/installed`, { method: "POST" }).catch(() => {
       });
     }
-    function parsePluginSource(spec) {
+    function parsePluginSource2(spec) {
       const raw = spec.trim();
       if (!raw)
         throw new Error("Empty plugin source.");
@@ -17512,29 +18229,45 @@ var require_installer = __commonJS({
         return [];
       }
     }
-    function inspectPluginDir(dir) {
+    function inspectPluginDir2(dir) {
       let meta = {};
-      try {
-        const j = JSON.parse(fs9.readFileSync(path6.join(dir, "plugin.json"), "utf-8"));
-        meta = {
-          name: typeof j.name === "string" ? j.name : void 0,
-          version: typeof j.version === "string" ? j.version : void 0,
-          description: typeof j.description === "string" ? j.description : void 0
-        };
-      } catch {
+      const manifest = (0, index_1.resolvePluginFile)(dir, "manifest");
+      if (manifest) {
+        try {
+          const j = JSON.parse(fs9.readFileSync(manifest, "utf-8"));
+          meta = {
+            name: typeof j.name === "string" ? j.name : void 0,
+            version: typeof j.version === "string" ? j.version : void 0,
+            description: typeof j.description === "string" ? j.description : void 0
+          };
+        } catch {
+        }
       }
       return {
         commands: listMd(path6.join(dir, "commands")),
         agents: listMd(path6.join(dir, "agents")),
-        hasHooks: fs9.existsSync(path6.join(dir, "hooks.json")),
-        hasMcp: fs9.existsSync(path6.join(dir, "mcp.json")),
+        hasHooks: (0, index_1.resolvePluginFile)(dir, "hooks") !== null,
+        hasMcp: (0, index_1.resolvePluginFile)(dir, "mcp") !== null,
         meta
       };
     }
     function looksLikePlugin(dir) {
-      const i2 = inspectPluginDir(dir);
+      const i2 = inspectPluginDir2(dir);
       return i2.commands.length > 0 || i2.agents.length > 0 || i2.hasHooks || i2.hasMcp || i2.meta.name !== void 0;
     }
+    async function resolveCommitSha(repo, ref) {
+      try {
+        const res = await fetch(`https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref || "HEAD")}`, {
+          headers: { Accept: "application/vnd.github.sha", "User-Agent": "nexrall-code" }
+        });
+        if (!res.ok)
+          return null;
+        const sha = (await res.text()).trim();
+        return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+      } catch {
+        return null;
+      }
+    }
     async function downloadTarball(repo, ref, destFile) {
       const r2 = ref || "HEAD";
       const url = `https://codeload.github.com/${repo}/tar.gz/${encodeURIComponent(r2)}`;
@@ -17585,28 +18318,33 @@ var require_installer = __commonJS({
       return scope === "project" ? path6.join(workDir || process.cwd(), ".nexrall", "plugins") : path6.join(os6.homedir(), ".nexrall", "plugins");
     }
     async function installPlugin2(spec, opts = {}) {
-      const source = parsePluginSource(spec);
+      const source2 = parsePluginSource2(spec);
       const scope = opts.scope ?? "global";
+      const patterns = (0, sources_1.allowedSourcePatterns)();
+      if (patterns && source2.kind === "github" && !(0, sources_1.isSourceAllowed)(source2.raw, patterns)) {
+        throw new Error(`Blocked by your organisation's policy: plugins may only be installed from ${patterns.join(", ")}.`);
+      }
       const tmpBase = fs9.mkdtempSync(path6.join(os6.tmpdir(), "nexrall-plugin-"));
       try {
         let repoRoot;
-        if (source.kind === "local") {
-          if (!fs9.existsSync(source.repo) || !fs9.statSync(source.repo).isDirectory()) {
-            throw new Error(`Local plugin path not found: ${source.repo}`);
+        if (source2.kind === "local") {
+          if (!fs9.existsSync(source2.repo) || !fs9.statSync(source2.repo).isDirectory()) {
+            throw new Error(`Local plugin path not found: ${source2.repo}`);
           }
-          repoRoot = source.repo;
+          repoRoot = source2.repo;
         } else {
           const tarFile = path6.join(tmpBase, "plugin.tar.gz");
-          await downloadTarball(source.repo, source.ref, tarFile);
+          await downloadTarball(source2.repo, source2.ref, tarFile);
           repoRoot = extractTarball(tarFile, path6.join(tmpBase, "x"));
         }
-        let pluginRoot = source.subdir ? path6.join(repoRoot, source.subdir) : repoRoot;
+        const sha = source2.kind === "github" ? await resolveCommitSha(source2.repo, source2.ref) : null;
+        let pluginRoot = source2.subdir ? path6.join(repoRoot, source2.subdir) : repoRoot;
         pluginRoot = path6.resolve(pluginRoot);
         if (!path6.resolve(pluginRoot).startsWith(path6.resolve(repoRoot))) {
           throw new Error("Plugin subdirectory escapes the repository \u2014 refusing.");
         }
         if (!fs9.existsSync(pluginRoot) || !fs9.statSync(pluginRoot).isDirectory()) {
-          throw new Error(`Subdirectory not found in repo: ${source.subdir}`);
+          throw new Error(`Subdirectory not found in repo: ${source2.subdir}`);
         }
         if (!looksLikePlugin(pluginRoot)) {
           const candidates = ["plugin", ".nexrall-plugin"].map((c) => path6.join(pluginRoot, c));
@@ -17617,12 +18355,16 @@ var require_installer = __commonJS({
             throw new Error("No plugin found: expected plugin.json, commands/, agents/, hooks.json or mcp.json at the source root.");
           }
         }
-        const inspection = inspectPluginDir(pluginRoot);
-        const name = opts.name || inspection.meta.name || (source.subdir ? path6.basename(source.subdir) : void 0) || (source.kind === "github" ? source.repo.split("/")[1] : path6.basename(source.repo));
+        const inspection = inspectPluginDir2(pluginRoot);
+        const name = opts.name || inspection.meta.name || (source2.subdir ? path6.basename(source2.subdir) : void 0) || (source2.kind === "github" ? source2.repo.split("/")[1] : path6.basename(source2.repo));
         if (!/^[\w.-]+$/.test(name))
           throw new Error(`Invalid plugin name "${name}".`);
         if (opts.confirm) {
-          const ok = await opts.confirm(inspection, name);
+          const ok = await opts.confirm(inspection, name, {
+            sha: sha ?? void 0,
+            previousSha: opts._previousSha,
+            isUpdate: Boolean(opts._previousSha) || Boolean(opts.force)
+          });
           if (!ok)
             throw new Error("Installation cancelled.");
         }
@@ -17635,14 +18377,15 @@ var require_installer = __commonJS({
         }
         copyPluginDir(pluginRoot, dest);
         const receipt = {
-          source: source.raw,
-          kind: source.kind,
-          ref: source.ref,
-          subdir: source.subdir,
-          installedAt: (/* @__PURE__ */ new Date()).toISOString()
+          source: source2.raw,
+          kind: source2.kind,
+          ref: source2.ref,
+          subdir: source2.subdir,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...sha ? { sha } : {}
         };
         fs9.writeFileSync(path6.join(dest, RECEIPT_FILE), JSON.stringify(receipt, null, 2));
-        return { name, dir: dest, scope, inspection };
+        return { name, dir: dest, scope, inspection, sha: sha ?? void 0, previousSha: opts._previousSha };
       } finally {
         fs9.rmSync(tmpBase, { recursive: true, force: true });
       }
@@ -17681,7 +18424,14 @@ var require_installer = __commonJS({
         if (receipt.kind === "local") {
           throw new Error(`Plugin "${name}" was installed from a local path \u2014 re-run 'nex plugin install ${receipt.source} --force'.`);
         }
-        return installPlugin2(receipt.source, { scope: s2, workDir: opts.workDir, name, force: true, confirm: opts.confirm });
+        return installPlugin2(receipt.source, {
+          scope: s2,
+          workDir: opts.workDir,
+          name,
+          force: true,
+          confirm: opts.confirm,
+          _previousSha: receipt.sha
+        });
       }
       throw new Error(`Plugin "${name}" is not installed.`);
     }
@@ -17720,6 +18470,7 @@ var require_dist2 = __commonJS({
     __exportStar(require_loop(), exports);
     __exportStar(require_testIntegrity(), exports);
     __exportStar(require_editCompleteness(), exports);
+    __exportStar(require_securityLint(), exports);
     __exportStar(require_crossFile(), exports);
     __exportStar(require_flaky(), exports);
     __exportStar(require_claimEvidence(), exports);
@@ -17735,6 +18486,7 @@ var require_dist2 = __commonJS({
     __exportStar(require_destructive(), exports);
     __exportStar(require_plugins(), exports);
     __exportStar(require_installer(), exports);
+    __exportStar(require_sources(), exports);
   }
 });
 
@@ -20550,23 +21302,23 @@ var require_react_reconciler_production = __commonJS({
           return "\nError generating stack: " + x2.message + "\n" + x2.stack;
         }
       }
-      function createCapturedValueAtFiber(value, source) {
+      function createCapturedValueAtFiber(value, source2) {
         if ("object" === typeof value && null !== value) {
           var existing = CapturedStacks.get(value);
           if (void 0 !== existing)
             return existing;
-          source = {
+          source2 = {
             value,
-            source,
-            stack: getStackByFiberInDevAndProd(source)
+            source: source2,
+            stack: getStackByFiberInDevAndProd(source2)
           };
-          CapturedStacks.set(value, source);
-          return source;
+          CapturedStacks.set(value, source2);
+          return source2;
         }
         return {
           value,
-          source,
-          stack: getStackByFiberInDevAndProd(source)
+          source: source2,
+          stack: getStackByFiberInDevAndProd(source2)
         };
       }
       function pushTreeFork(workInProgress2, totalChildren) {
@@ -29738,23 +30490,23 @@ var require_react_reconciler_development = __commonJS({
       function describeFunctionComponentFrameWithoutLineNumber(fn) {
         return (fn = fn ? fn.displayName || fn.name : "") ? describeBuiltInComponentFrame(fn) : "";
       }
-      function createCapturedValueAtFiber(value, source) {
+      function createCapturedValueAtFiber(value, source2) {
         if ("object" === typeof value && null !== value) {
           var existing = CapturedStacks.get(value);
           if (void 0 !== existing)
             return existing;
-          source = {
+          source2 = {
             value,
-            source,
-            stack: getStackByFiberInDevAndProd(source)
+            source: source2,
+            stack: getStackByFiberInDevAndProd(source2)
           };
-          CapturedStacks.set(value, source);
-          return source;
+          CapturedStacks.set(value, source2);
+          return source2;
         }
         return {
           value,
-          source,
-          stack: getStackByFiberInDevAndProd(source)
+          source: source2,
+          stack: getStackByFiberInDevAndProd(source2)
         };
       }
       function pushTreeFork(workInProgress2, totalChildren) {
@@ -42312,9 +43064,9 @@ var require_buffer_util = __commonJS({
       }
       return target;
     }
-    function _mask(source, mask, output, offset, length) {
+    function _mask(source2, mask, output, offset, length) {
       for (let i2 = 0; i2 < length; i2++) {
-        output[offset + i2] = source[i2] ^ mask[i2 & 3];
+        output[offset + i2] = source2[i2] ^ mask[i2 & 3];
       }
     }
     function _unmask(buffer, mask) {
@@ -42353,11 +43105,11 @@ var require_buffer_util = __commonJS({
     if (!process.env.WS_NO_BUFFER_UTIL) {
       try {
         const bufferUtil = __require("bufferutil");
-        module.exports.mask = function(source, mask, output, offset, length) {
+        module.exports.mask = function(source2, mask, output, offset, length) {
           if (length < 48)
-            _mask(source, mask, output, offset, length);
+            _mask(source2, mask, output, offset, length);
           else
-            bufferUtil.mask(source, mask, output, offset, length);
+            bufferUtil.mask(source2, mask, output, offset, length);
         };
         module.exports.unmask = function(buffer, mask) {
           if (buffer.length < 32)
@@ -49074,16 +49826,16 @@ var require_dist3 = __commonJS({
     }
     function _objectSpread(target) {
       for (var i2 = 1; i2 < arguments.length; i2++) {
-        var source = arguments[i2] != null ? arguments[i2] : {};
+        var source2 = arguments[i2] != null ? arguments[i2] : {};
         if (i2 % 2) {
-          ownKeys(Object(source), true).forEach(function(key) {
-            _defineProperty(target, key, source[key]);
+          ownKeys(Object(source2), true).forEach(function(key) {
+            _defineProperty(target, key, source2[key]);
           });
         } else if (Object.getOwnPropertyDescriptors) {
-          Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+          Object.defineProperties(target, Object.getOwnPropertyDescriptors(source2));
         } else {
-          ownKeys(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+          ownKeys(Object(source2)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source2, key));
           });
         }
       }
@@ -53803,6 +54555,16 @@ function trustGrantedByEnv() {
   const v = process.env[TRUST_ENV_VAR];
   return v === "1" || v === "true";
 }
+function declaresPluginSources(dir) {
+  try {
+    const raw = fs5.readFileSync(path3.join(dir, ".nexrall", "settings.json"), "utf-8");
+    const obj = JSON.parse(raw);
+    const s2 = obj.pluginSources;
+    return Boolean(s2 && typeof s2 === "object" && !Array.isArray(s2) && Object.keys(s2).length > 0);
+  } catch {
+    return false;
+  }
+}
 function detectTrustSignals(dir) {
   const signals = [];
   const exists = (...p) => {
@@ -53822,7 +54584,9 @@ function detectTrustSignals(dir) {
     signals.push(".nexrall/permissions.json \u2014 pre-approved tool permissions");
   }
   if (exists(".nexrall", "settings.json")) {
-    signals.push(".nexrall/settings.json \u2014 project settings and permission rules");
+    signals.push(
+      declaresPluginSources(dir) ? ".nexrall/settings.json \u2014 project settings, and declares plugin sources (aliases for remote plugin repos)" : ".nexrall/settings.json \u2014 project settings and permission rules"
+    );
   }
   if (exists("nexrall.md")) {
     signals.push("nexrall.md \u2014 project instructions added to the agent\u2019s prompt");
@@ -60331,15 +61095,15 @@ var generateLineNumbers = (line, around) => {
   }
   return lineNumbers;
 };
-var codeExcerpt = (source, line, options = {}) => {
+var codeExcerpt = (source2, line, options = {}) => {
   var _a;
-  if (typeof source !== "string") {
+  if (typeof source2 !== "string") {
     throw new TypeError("Source code is missing.");
   }
   if (!line || line < 1) {
     throw new TypeError("Line number must start from `1`.");
   }
-  const lines = dist_default3(source).split(/\r?\n/);
+  const lines = dist_default3(source2).split(/\r?\n/);
   if (line > lines.length) {
     return;
   }
@@ -62794,7 +63558,7 @@ var InkReadlineAdapter = class extends EventEmitter3 {
 };
 
 // src/commands/chat.ts
-var CLI_VERSION = "0.5.48";
+var CLI_VERSION = "0.5.50";
 var MODEL_LABELS = {
   turbo: "Nexrall Turbo",
   pro: "Nexrall Pro",
@@ -63012,15 +63776,23 @@ function formatContextUsage(messages, modelAlias) {
   return lines.join("\n");
 }
 function formatAgentsList(workDir) {
-  const types3 = (0, import_code_core3.loadAgentTypes)(workDir);
+  const { types: types3, warnings } = (0, import_code_core3.loadAgentTypesWithWarnings)(workDir);
   if (!types3.length)
     return source_default.dim("  No agent types found (this should not happen \u2014 builtins always register).");
   const lines = types3.map((t2) => {
-    const tools = t2.tools ? source_default.dim(` \u2014 tools: ${t2.tools.join(", ")}`) : source_default.dim(" \u2014 all tools");
+    const tools = t2.tools ? source_default.dim(` \u2014 tools: ${t2.tools.join(", ")}`) : source_default.dim(" \u2014 ALL tools (no allowlist)");
     const model = t2.model ? source_default.dim(` \u2014 model: ${t2.model}`) : "";
     const scope = source_default.dim(` (${t2.source})`);
     return "  " + source_default.cyan(t2.name.padEnd(16)) + source_default.white(t2.description) + scope + tools + model;
   });
+  if (warnings.length) {
+    lines.push("");
+    lines.push("  " + source_default.yellow.bold(`\u26A0 ${warnings.length} problem${warnings.length > 1 ? "s" : ""} in your agent definitions:`));
+    for (const w of warnings) {
+      lines.push("    " + source_default.yellow(`\u2022 ${w.agent}`) + source_default.dim(` \u2014 ${w.message}`));
+      lines.push("      " + source_default.dim(w.file));
+    }
+  }
   return lines.join("\n");
 }
 async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrallMd, mode, effort, checkpointManager, onProgress) {
@@ -64137,11 +64909,23 @@ ${caption}` : `[Attached: ${rel}]`;
 // src/commands/plugin.ts
 var import_prompts = __toESM(require_prompts3(), 1);
 var import_code_core4 = __toESM(require_dist2(), 1);
-function describeInspection(i2, name) {
+function describeInspection(i2, name, ctx) {
   console.log();
   console.log(source_default.bold(`  Plugin: ${name}`) + (i2.meta.version ? source_default.dim(`  v${i2.meta.version}`) : ""));
   if (i2.meta.description)
     console.log(source_default.dim(`  ${i2.meta.description}`));
+  if (ctx?.sha) {
+    const short = (s2) => s2.slice(0, 7);
+    if (ctx.previousSha && ctx.previousSha !== ctx.sha) {
+      console.log(source_default.dim("  commit:  ") + source_default.yellow(`${short(ctx.previousSha)} \u2192 ${short(ctx.sha)}`));
+    } else if (ctx.previousSha === ctx.sha) {
+      console.log(source_default.dim(`  commit:  ${short(ctx.sha)} (already up to date)`));
+    } else {
+      console.log(source_default.dim(`  commit:  ${short(ctx.sha)}`));
+    }
+  } else if (ctx?.isUpdate) {
+    console.log(source_default.dim("  commit:  unknown (could not reach the GitHub API)"));
+  }
   if (i2.commands.length)
     console.log(`  ${source_default.cyan("commands:")} ${i2.commands.map((c) => "/" + c).join(", ")}`);
   if (i2.agents.length)
@@ -64151,10 +64935,16 @@ function describeInspection(i2, name) {
   if (i2.hasMcp)
     console.log(`  ${source_default.yellow("mcp:")}      yes`);
 }
-async function confirmInstall(i2, name, autoYes) {
-  describeInspection(i2, name);
+async function confirmInstall(i2, name, autoYes, ctx) {
+  describeInspection(i2, name, ctx);
   const dangerous = i2.hasHooks || i2.hasMcp;
   if (dangerous) {
+    if (ctx?.isUpdate) {
+      console.log();
+      console.log(source_default.red.bold("  \u26A0 THIS UPDATE SHIPS CODE EXECUTION"));
+      console.log(source_default.red("  A version of this plugin you already trust is being replaced by one"));
+      console.log(source_default.red("  that runs commands. Review the diff before continuing."));
+    }
     console.log();
     console.log(source_default.red.bold("  \u26A0 SECURITY WARNING"));
     if (i2.hasHooks) {
@@ -64172,6 +64962,12 @@ async function confirmInstall(i2, name, autoYes) {
   if (autoYes && dangerous) {
     console.log(source_default.yellow("\n  --yes does not apply to plugins with hooks/MCP; confirmation required."));
   }
+  if (!process.stdin.isTTY) {
+    console.log();
+    console.log(source_default.red("  \u2717 Cannot ask for confirmation: stdin is not a terminal."));
+    console.log(source_default.dim(dangerous ? "    This plugin ships hooks/MCP, which always require an interactive confirmation." : "    Re-run with --yes to install non-interactively."));
+    return false;
+  }
   console.log();
   const { ok } = await (0, import_prompts.default)({
     type: "confirm",
@@ -64184,35 +64980,43 @@ async function confirmInstall(i2, name, autoYes) {
 async function pluginInstallCommand(spec, opts) {
   const scope = opts.project ? "project" : "global";
   try {
-    let source = spec;
+    let source2 = spec;
     let registryName;
     const isShortName = /^[\w.-]+$/.test(spec.trim()) && !spec.includes("/");
     if (isShortName) {
+      const alias = (0, import_code_core4.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
+      if (alias) {
+        source2 = alias.spec;
+        console.log(source_default.dim(`  Source: ${alias.name} (${alias.tier}) \u2190 ${alias.spec}`));
+      }
+    }
+    if (isShortName && source2 === spec) {
       const entry = await (0, import_code_core4.getRegistryPlugin)(spec.trim()).catch(() => null);
       if (entry) {
-        source = entry.source;
+        source2 = entry.source;
         registryName = entry.name;
         const badge = entry.official ? source_default.magenta(" [official]") : entry.verified ? source_default.green(" [verified]") : "";
         console.log(source_default.dim(`  Registry: ${entry.display_name}${badge} \u2190 ${entry.source}`));
       } else {
-        console.error(source_default.red(`  \u2717 "${spec}" not found in the registry.`));
-        console.error(source_default.dim("    Search:  nex plugin search <keyword>"));
-        console.error(source_default.dim("    Or install from GitHub directly:  nex plugin install owner/repo"));
+        console.error(source_default.red(`  \u2717 "${spec}" is not a declared source or a registry plugin.`));
+        console.error(source_default.dim("    Search:    nex plugin search <keyword>"));
+        console.error(source_default.dim("    From GitHub:  nex plugin install owner/repo"));
+        console.error(source_default.dim("    Declare it:   nex plugin source add " + spec.trim() + " owner/repo"));
         process.exitCode = 1;
         return;
       }
     }
-    const res = await (0, import_code_core4.installPlugin)(source, {
+    const res = await (0, import_code_core4.installPlugin)(source2, {
       scope,
       workDir: process.cwd(),
       name: opts.name ?? registryName,
       force: opts.force,
-      confirm: (i2, name) => confirmInstall(i2, name, opts.yes === true)
+      confirm: (i2, name, ctx) => confirmInstall(i2, name, opts.yes === true, ctx)
     });
     if (registryName)
       (0, import_code_core4.reportInstall)(registryName);
     console.log();
-    console.log(source_default.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`));
+    console.log(source_default.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`) + (res.sha ? source_default.dim(`  @ ${res.sha.slice(0, 7)}`) : ""));
     if (res.inspection.commands.length) {
       console.log(source_default.dim(`    Try: ${res.inspection.commands.map((c) => "/" + c).join(", ")}`));
     }
@@ -64246,9 +65050,10 @@ async function pluginUpdateCommand(name, opts) {
     try {
       const res = await (0, import_code_core4.updatePlugin)(t2, {
         workDir,
-        confirm: (i2, n) => confirmInstall(i2, n, opts.yes === true)
+        confirm: (i2, n, ctx) => confirmInstall(i2, n, opts.yes === true, ctx)
       });
-      console.log(source_default.green(`  \u2713 Updated "${res.name}"`));
+      const moved = res.sha && res.previousSha && res.sha !== res.previousSha ? source_default.dim(`  ${res.previousSha.slice(0, 7)} \u2192 ${res.sha.slice(0, 7)}`) : res.sha && res.previousSha === res.sha ? source_default.dim("  (unchanged)") : "";
+      console.log(source_default.green(`  \u2713 Updated "${res.name}"`) + moved);
     } catch (err) {
       console.error(source_default.red(`  \u2717 ${t2}: ${err.message}`));
       process.exitCode = 1;
@@ -64330,24 +65135,98 @@ function pluginListCommand() {
   for (const p of plugins) {
     const receipt = (0, import_code_core4.readReceipt)(p.dir);
     const src = receipt ? source_default.dim(`  \u2190 ${receipt.source}`) : source_default.dim("  (manual)");
+    const at = receipt?.sha ? source_default.dim(` @ ${receipt.sha.slice(0, 7)}`) : "";
+    const insp = (0, import_code_core4.inspectPluginDir)(p.dir);
+    const runs = insp.hasHooks || insp.hasMcp ? source_default.yellow(`  \u26A0 ${[insp.hasHooks && "hooks", insp.hasMcp && "mcp"].filter(Boolean).join("+")}`) : "";
     console.log(
-      "  " + source_default.cyan(p.name.padEnd(24)) + source_default.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src
+      "  " + source_default.cyan(p.name.padEnd(24)) + source_default.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src + at + runs
     );
   }
   console.log();
 }
+function pluginSourceListCommand() {
+  const workDir = process.cwd();
+  const sources = (0, import_code_core4.loadDeclaredSources)(workDir, { includeProject: true });
+  const patterns = (0, import_code_core4.allowedSourcePatterns)();
+  if (patterns) {
+    console.log();
+    console.log(source_default.bold("  Organisation policy: ") + source_default.dim(`installs restricted to ${patterns.join(", ")}`));
+  }
+  if (!sources.length) {
+    console.log(source_default.dim("\n  No plugin sources declared."));
+    console.log(source_default.dim("  Add one:  nex plugin source add <alias> owner/repo"));
+    console.log();
+    return;
+  }
+  console.log();
+  console.log(source_default.bold("  Declared plugin sources:"));
+  for (const s2 of sources) {
+    const tier = s2.tier === "project" ? source_default.yellow(s2.tier.padEnd(9)) : source_default.dim(s2.tier.padEnd(9));
+    const blocked = !(0, import_code_core4.isSourceAllowed)(s2.spec, patterns) ? source_default.red("  \u2717 blocked by policy") : "";
+    console.log("  " + source_default.cyan(s2.name.padEnd(20)) + tier + source_default.white(s2.spec) + blocked);
+  }
+  console.log();
+  console.log(source_default.dim("  Install from one:  nex plugin install <alias>"));
+  console.log(source_default.dim("  Declaring a source does not install anything."));
+  console.log();
+}
+function pluginSourceAddCommand(name, spec, opts) {
+  try {
+    (0, import_code_core4.parsePluginSource)(spec);
+    const patterns = (0, import_code_core4.allowedSourcePatterns)();
+    if (patterns && !(0, import_code_core4.isSourceAllowed)(spec, patterns)) {
+      console.error(source_default.red(`  \u2717 "${spec}" is not permitted by your organisation's policy.`));
+      console.error(source_default.dim(`    Allowed: ${patterns.join(", ")}`));
+      process.exitCode = 1;
+      return;
+    }
+    const scope = opts.project ? "project" : "user";
+    const file = (0, import_code_core4.sourcesFileFor)(scope, process.cwd());
+    (0, import_code_core4.writeDeclaredSource)(file, name, spec);
+    console.log();
+    console.log(source_default.green(`  \u2713 Declared "${name}" \u2192 ${spec}`) + source_default.dim(`  (${scope})`));
+    console.log(source_default.dim(`    ${file}`));
+    console.log(source_default.dim(`    Nothing installed yet \u2014 run:  nex plugin install ${name}`));
+    console.log();
+  } catch (err) {
+    console.error(source_default.red(`  \u2717 ${err.message}`));
+    process.exitCode = 1;
+  }
+}
+function pluginSourceRemoveCommand(name, opts) {
+  const workDir = process.cwd();
+  const scope = opts.project ? "project" : "user";
+  const file = (0, import_code_core4.sourcesFileFor)(scope, workDir);
+  if ((0, import_code_core4.removeDeclaredSource)(file, name)) {
+    console.log(source_default.green(`  \u2713 Removed source "${name}" (${scope})`));
+    console.log(source_default.dim("    Plugins already installed from it are untouched \u2014 remove them with  nex plugin remove <name>"));
+    return;
+  }
+  const found = (0, import_code_core4.resolveSourceAlias)(name, workDir, { includeProject: true });
+  if (found) {
+    console.error(source_default.red(`  \u2717 "${name}" is declared in the ${found.tier} tier, not ${scope}.`));
+    console.error(source_default.dim(`    ${found.file}`));
+    if (found.tier === "project")
+      console.error(source_default.dim("    Retry with --project"));
+    if (found.tier === "managed")
+      console.error(source_default.dim("    Managed sources are set by your organisation and cannot be removed here."));
+  } else {
+    console.error(source_default.red(`  \u2717 No source named "${name}".`));
+  }
+  process.exitCode = 1;
+}
 
 // src/index.ts
 var program2 = new Command();
-program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.48");
+program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version("0.5.50").enablePositionalOptions();
 program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 program2.command("logout").description("Log out of your Nexrall account").action(logoutCommand);
 program2.command("update").description("Update nex to the latest version").option("-c, --check", "Check for updates without installing").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
   await updateCommand({ check: opts.check, yes: opts.yes });
 });
 var plugin = program2.command("plugin").description("Manage plugins (install from GitHub, list, update, remove)");
-plugin.command("install <source>").description("Install a plugin: registry name, owner/repo(#ref)(/subdir), GitHub URL, or local path").option("--project", "Install into ./.nexrall/plugins (default: ~/.nexrall/plugins)").option("--name <name>", "Override the installed plugin name").option("-f, --force", "Overwrite if already installed").option("-y, --yes", "Skip confirmation (still prompts for plugins with hooks/MCP)").action(async (source, opts) => {
-  await pluginInstallCommand(source, opts);
+plugin.command("install <source>").description("Install a plugin: registry name, owner/repo(#ref)(/subdir), GitHub URL, or local path").option("--project", "Install into ./.nexrall/plugins (default: ~/.nexrall/plugins)").option("--name <name>", "Override the installed plugin name").option("-f, --force", "Overwrite if already installed").option("-y, --yes", "Skip confirmation (still prompts for plugins with hooks/MCP)").action(async (source2, opts) => {
+  await pluginInstallCommand(source2, opts);
 });
 plugin.command("remove <name>").alias("uninstall").description("Remove an installed plugin").option("--project", "Only look in ./.nexrall/plugins").action((name, opts) => {
   pluginRemoveCommand(name, opts);
@@ -64364,6 +65243,16 @@ plugin.command("search [query]").description("Search the Nexrall plugin registry
 plugin.command("info <name>").description("Show registry details for a plugin").action(async (name) => {
   await pluginInfoCommand(name);
 });
+var source = plugin.command("source").description("Declare where plugins may be installed from (aliases for plugin repos)");
+source.command("list").alias("ls").description("List declared plugin sources").action(() => {
+  pluginSourceListCommand();
+});
+source.command("add <name> <spec>").description("Declare a source: nex plugin source add acme acme/plugins").option("--project", "Write to ./.nexrall/settings.json so the team shares it (default: ~/.nexrall/settings.json)").action((name, spec, opts) => {
+  pluginSourceAddCommand(name, spec, opts);
+});
+source.command("remove <name>").alias("rm").description("Remove a declared source (installed plugins are untouched)").option("--project", "Remove from ./.nexrall/settings.json").action((name, opts) => {
+  pluginSourceRemoveCommand(name, opts);
+});
 program2.command("sessions").description("List or delete saved chat sessions").option("-d, --delete <id>", "Delete a session by id").option("--clear-all", "Delete ALL saved sessions").action((opts) => {
   if (opts.clearAll) {
     const sessions2 = listSessions();