open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/package-manager.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 function getEnv() {
     if (process.platform !== "linux" || Object.keys(process.env).length > 0) {
@@ -29,15 +29,95 @@ import { spawnProcess, spawnProcessSync } from "../utils/child-process.js";
 import { parseGitUrl } from "../utils/git.js";
 import { canonicalizePath, isLocalPath, markPathIgnoredByCloudSync, resolvePath } from "../utils/paths.js";
 import { isStdoutTakenOver } from "./output-guard.js";
+import { isPathInsideRootByRealpath, resolveManifestEntryInsideRoot } from "./package-gallery.js";
+import { validateExactNpmVersion, validateGitRef } from "./package-procurement.js";
+import { createTrialRuntimePlan } from "./package-trial-runtime.js";
 const NETWORK_TIMEOUT_MS = 10000;
 const UPDATE_CHECK_CONCURRENCY = 4;
 const GIT_UPDATE_CONCURRENCY = 4;
 function isOfflineModeEnabled() {
-    const value = process.env.OMK_OFFLINE ?? process.env.PI_OFFLINE;
+    const value = process.env.OMK_OFFLINE;
     if (!value)
         return false;
     return value === "1" || value.toLowerCase() === "true" || value.toLowerCase() === "yes";
 }
+export function buildGitDependencyInstallArgs(hasConfiguredNpmCommand, allowScripts = false) {
+    // Default (allowScripts=false) appends --ignore-scripts, leaving the historical arg vector byte-identical.
+    // Opt-in allowScripts simply omits --ignore-scripts so reviewed packages may run lifecycle scripts.
+    const scriptArgs = allowScripts ? [] : ["--ignore-scripts"];
+    if (hasConfiguredNpmCommand) {
+        return ["install", ...scriptArgs];
+    }
+    return ["install", "--omit=dev", ...scriptArgs];
+}
+export function buildNpmInstallArgs(packageManagerName, specs, installRoot, allowScripts = false) {
+    // Extension packages run inside OMK and resolve OMK APIs through loader aliases/virtual modules.
+    // Disable peer dependency resolution for managed installs (npm's --legacy-peer-deps, and
+    // equivalent bun/pnpm settings) so package managers do not install or solve host-provided
+    // @earendil-works/omk-* peers. Stale auto-installed legacy peers can otherwise block updates.
+    //
+    // Lifecycle scripts stay disabled by default (--ignore-scripts). allowScripts=true omits that flag
+    // for the whole install unit; npm/pnpm/bun cannot scope script execution to specific top-level specs.
+    const scriptArgs = allowScripts ? [] : ["--ignore-scripts"];
+    if (packageManagerName === "bun") {
+        return ["install", ...specs, "--cwd", installRoot, "--omit=peer", ...scriptArgs];
+    }
+    if (packageManagerName === "pnpm") {
+        return [
+            "install",
+            ...specs,
+            "--prefix",
+            installRoot,
+            "--config.auto-install-peers=false",
+            "--config.strict-peer-dependencies=false",
+            "--config.strict-dep-builds=false",
+            ...scriptArgs,
+        ];
+    }
+    return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps", ...scriptArgs];
+}
+// Entries that can never describe a real npm/git canonical key. Rejecting them keeps membership a strict
+// exact-string match (no glob/minimatch/semver/override semantics) even if such junk lands in settings.
+const ALLOW_SCRIPT_ENTRY_FORBIDDEN = /[*?\s\u0000-\u001f]/;
+function isUsableAllowScriptEntry(entry) {
+    if (!entry)
+        return false;
+    if (ALLOW_SCRIPT_ENTRY_FORBIDDEN.test(entry))
+        return false;
+    // Filter-style override prefixes are not allowlist semantics.
+    if (entry.startsWith("!") || entry.startsWith("+") || entry.startsWith("-"))
+        return false;
+    return true;
+}
+function parseNpmPackageName(spec) {
+    const match = spec.match(/^(@?[^@]+(?:\/[^@]+)?)(?:@(.+))?$/);
+    return match?.[1] ?? spec;
+}
+/**
+ * Exact-match membership for npm install units. Returns true only when the install unit is non-empty and
+ * EVERY top-level spec is listed (by `npm:<name>` identity or `npm:<spec>`). Mixed/partial lists stay false
+ * so a single unlisted spec keeps the whole install fail-closed under --ignore-scripts.
+ */
+export function isNpmInstallAllowed(specs, allowList) {
+    if (specs.length === 0)
+        return false;
+    const allowed = new Set(allowList.filter(isUsableAllowScriptEntry));
+    if (allowed.size === 0)
+        return false;
+    return specs.every((spec) => {
+        const name = parseNpmPackageName(spec);
+        return allowed.has(`npm:${name}`) || allowed.has(`npm:${spec}`);
+    });
+}
+/** Exact-match membership for a git install unit by `git:<host>/<path>` identity or `...@<ref>` spec. */
+export function isGitInstallAllowed(source, allowList) {
+    const allowed = new Set(allowList.filter(isUsableAllowScriptEntry));
+    if (allowed.size === 0)
+        return false;
+    const identity = `git:${source.host}/${source.path}`;
+    const spec = source.ref ? `${identity}@${source.ref}` : identity;
+    return allowed.has(identity) || allowed.has(spec);
+}
 /** Thrown when an `onMissing` callback explicitly requests aborting resolution. */
 export class MissingSourceError extends Error {
     constructor(source) {
@@ -74,6 +154,14 @@ const IGNORE_FILE_NAMES = [".gitignore", ".ignore", ".fdignore"];
 function toPosixPath(p) {
     return p.split(sep).join("/");
 }
+function realpathKey(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
 function getHomeDir() {
     return process.env.HOME || homedir();
 }
@@ -146,10 +234,16 @@ function splitPatterns(entries) {
     }
     return { plain, patterns };
 }
-function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, rootDir) {
+function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, rootDir, containmentRoot, seenDirs = new Set()) {
     const files = [];
     if (!existsSync(dir))
         return files;
+    if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, dir))
+        return files;
+    const dirKey = realpathKey(dir);
+    if (seenDirs.has(dirKey))
+        return files;
+    seenDirs.add(dirKey);
     const root = rootDir ?? dir;
     const ig = ignoreMatcher ?? ignore();
     addIgnoreRules(ig, dir, root);
@@ -161,6 +255,8 @@ function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, r
             if (skipNodeModules && entry.name === "node_modules")
                 continue;
             const fullPath = join(dir, entry.name);
+            if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, fullPath))
+                continue;
             let isDir = entry.isDirectory();
             let isFile = entry.isFile();
             if (entry.isSymbolicLink()) {
@@ -178,7 +274,7 @@ function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, r
             if (ig.ignores(ignorePath))
                 continue;
             if (isDir) {
-                files.push(...collectFiles(fullPath, filePattern, skipNodeModules, ig, root));
+                files.push(...collectFiles(fullPath, filePattern, skipNodeModules, ig, root, containmentRoot, seenDirs));
             }
             else if (isFile && filePattern.test(entry.name)) {
                 files.push(fullPath);
@@ -190,10 +286,16 @@ function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, r
     }
     return files;
 }
-function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
+function collectSkillEntries(dir, mode, ignoreMatcher, rootDir, containmentRoot, seenDirs = new Set()) {
     const entries = [];
     if (!existsSync(dir))
         return entries;
+    if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, dir))
+        return entries;
+    const dirKey = realpathKey(dir);
+    if (seenDirs.has(dirKey))
+        return entries;
+    seenDirs.add(dirKey);
     const root = rootDir ?? dir;
     const ig = ignoreMatcher ?? ignore();
     addIgnoreRules(ig, dir, root);
@@ -204,6 +306,8 @@ function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
                 continue;
             }
             const fullPath = join(dir, entry.name);
+            if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, fullPath))
+                continue;
             let isFile = entry.isFile();
             if (entry.isSymbolicLink()) {
                 try {
@@ -225,6 +329,8 @@ function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
             if (entry.name === "node_modules")
                 continue;
             const fullPath = join(dir, entry.name);
+            if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, fullPath))
+                continue;
             let isDir = entry.isDirectory();
             let isFile = entry.isFile();
             if (entry.isSymbolicLink()) {
@@ -238,7 +344,7 @@ function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
                 }
             }
             const relPath = toPosixPath(relative(root, fullPath));
-            if (mode === "pi" && dir === root && isFile && entry.name.endsWith(".md") && !ig.ignores(relPath)) {
+            if (mode === "omk" && dir === root && isFile && entry.name.endsWith(".md") && !ig.ignores(relPath)) {
                 entries.push(fullPath);
                 continue;
             }
@@ -246,7 +352,7 @@ function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
                 continue;
             if (ig.ignores(`${relPath}/`))
                 continue;
-            entries.push(...collectSkillEntries(fullPath, mode, ig, root));
+            entries.push(...collectSkillEntries(fullPath, mode, ig, root, containmentRoot, seenDirs));
         }
     }
     catch {
@@ -370,16 +476,25 @@ function readOmkManifestFile(packageJsonPath) {
         return null;
     }
 }
-function resolveExtensionEntries(dir) {
+function resolveExtensionEntries(dir, containmentRoot) {
+    if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, dir))
+        return null;
     const packageJsonPath = join(dir, "package.json");
     if (existsSync(packageJsonPath)) {
         const manifest = readOmkManifestFile(packageJsonPath);
         if (manifest?.extensions?.length) {
             const entries = [];
             for (const extPath of manifest.extensions) {
-                const resolvedExtPath = resolve(dir, extPath);
-                if (existsSync(resolvedExtPath)) {
-                    entries.push(resolvedExtPath);
+                const resolvedExtPath = containmentRoot
+                    ? resolveManifestEntryInsideRoot(containmentRoot, extPath, dir)
+                    : extPath.trim()
+                        ? resolve(dir, extPath)
+                        : undefined;
+                if (!resolvedExtPath)
+                    continue;
+                const candidate = containmentRoot ? resolve(containmentRoot, resolvedExtPath) : resolvedExtPath;
+                if (existsSync(candidate) && (!containmentRoot || isPathInsideRootByRealpath(containmentRoot, candidate))) {
+                    entries.push(candidate);
                 }
             }
             if (entries.length > 0) {
@@ -389,20 +504,26 @@ function resolveExtensionEntries(dir) {
     }
     const indexTs = join(dir, "index.ts");
     const indexJs = join(dir, "index.js");
-    if (existsSync(indexTs)) {
+    if (existsSync(indexTs) && (!containmentRoot || isPathInsideRootByRealpath(containmentRoot, indexTs))) {
         return [indexTs];
     }
-    if (existsSync(indexJs)) {
+    if (existsSync(indexJs) && (!containmentRoot || isPathInsideRootByRealpath(containmentRoot, indexJs))) {
         return [indexJs];
     }
     return null;
 }
-function collectAutoExtensionEntries(dir) {
+function collectAutoExtensionEntries(dir, containmentRoot, seenDirs = new Set()) {
     const entries = [];
     if (!existsSync(dir))
         return entries;
+    if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, dir))
+        return entries;
+    const dirKey = realpathKey(dir);
+    if (seenDirs.has(dirKey))
+        return entries;
+    seenDirs.add(dirKey);
     // First check if this directory itself has explicit extension entries (package.json or index)
-    const rootEntries = resolveExtensionEntries(dir);
+    const rootEntries = resolveExtensionEntries(dir, containmentRoot);
     if (rootEntries) {
         return rootEntries;
     }
@@ -417,6 +538,8 @@ function collectAutoExtensionEntries(dir) {
             if (entry.name === "node_modules")
                 continue;
             const fullPath = join(dir, entry.name);
+            if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, fullPath))
+                continue;
             let isDir = entry.isDirectory();
             let isFile = entry.isFile();
             if (entry.isSymbolicLink()) {
@@ -437,7 +560,7 @@ function collectAutoExtensionEntries(dir) {
                 entries.push(fullPath);
             }
             else if (isDir) {
-                const resolvedEntries = resolveExtensionEntries(fullPath);
+                const resolvedEntries = resolveExtensionEntries(fullPath, containmentRoot);
                 if (resolvedEntries) {
                     entries.push(...resolvedEntries);
                 }
@@ -453,14 +576,14 @@ function collectAutoExtensionEntries(dir) {
  * Collect resource files from a directory based on resource type.
  * Extensions use smart discovery (index.ts in subdirs), others use recursive collection.
  */
-function collectResourceFiles(dir, resourceType) {
+function collectResourceFiles(dir, resourceType, containmentRoot) {
     if (resourceType === "skills") {
-        return collectSkillEntries(dir, "pi");
+        return collectSkillEntries(dir, "omk", undefined, undefined, containmentRoot);
     }
     if (resourceType === "extensions") {
-        return collectAutoExtensionEntries(dir);
+        return collectAutoExtensionEntries(dir, containmentRoot);
     }
-    return collectFiles(dir, FILE_PATTERNS[resourceType]);
+    return collectFiles(dir, FILE_PATTERNS[resourceType], true, undefined, undefined, containmentRoot);
 }
 function matchesAnyPattern(filePath, patterns, baseDir) {
     const rel = toPosixPath(relative(baseDir, filePath));
@@ -586,6 +709,8 @@ export class DefaultPackageManager {
     cwd;
     agentDir;
     settingsManager;
+    trialRuntime;
+    trialCleanups = [];
     globalNpmRoot;
     globalNpmRootCommandKey;
     progressCallback;
@@ -593,10 +718,18 @@ export class DefaultPackageManager {
         this.cwd = resolvePath(options.cwd);
         this.agentDir = resolvePath(options.agentDir);
         this.settingsManager = options.settingsManager;
+        this.trialRuntime = options.trialRuntime;
     }
     setProgressCallback(callback) {
         this.progressCallback = callback;
     }
+    cleanupTemporaryTrialInstalls() {
+        const cleanups = this.trialCleanups;
+        this.trialCleanups = [];
+        for (const cleanup of cleanups) {
+            this.cleanupTrialInstall(cleanup, cleanup.installRoot);
+        }
+    }
     addSourceToSettings(source, options) {
         const scope = options?.local ? "project" : "user";
         const currentSettings = scope === "project" ? this.settingsManager.getProjectSettings() : this.settingsManager.getGlobalSettings();
@@ -677,6 +810,29 @@ export class DefaultPackageManager {
             throw error;
         }
     }
+    cleanupTrialInstall(plan, source) {
+        this.emitProgress({ type: "start", action: "remove", source, message: "Cleaning temporary trial install..." });
+        try {
+            const tempRoot = resolve(getExtensionTempFolder(this.agentDir));
+            const installRoot = resolve(plan.installRoot);
+            if (installRoot !== tempRoot && !installRoot.startsWith(`${tempRoot}${sep}`)) {
+                throw new Error(`Refusing to clean trial install outside temp root: ${installRoot}`);
+            }
+            for (const removePath of plan.removePaths) {
+                const resolvedRemovePath = resolve(removePath);
+                if (resolvedRemovePath !== installRoot) {
+                    throw new Error(`Refusing to clean unexpected trial path: ${resolvedRemovePath}`);
+                }
+                rmSync(resolvedRemovePath, { recursive: plan.recursive, force: plan.force });
+            }
+            this.emitProgress({ type: "complete", action: "remove", source });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.emitProgress({ type: "error", action: "remove", source, message });
+            console.error(`Warning: failed to clean temporary trial install ${source}: ${message}`);
+        }
+    }
     async resolve(onMissing) {
         const accumulator = this.createAccumulator();
         const globalSettings = this.settingsManager.getGlobalSettings();
@@ -747,6 +903,9 @@ export class DefaultPackageManager {
         const parsed = this.parseSource(source);
         const scope = options?.local ? "project" : "user";
         await this.withProgress("install", source, `Installing ${source}...`, async () => {
+            // Procurement admission: enforce exact pinning before any install side effect. This is a pure
+            // gate (no fetch/clone/npm install). Local sources are exempt to preserve existing behavior.
+            this.assertInstallAdmission(parsed, source, options?.resolvedCommit);
             if (parsed.type === "npm") {
                 await this.installNpm(parsed, scope, false);
                 return;
@@ -766,9 +925,42 @@ export class DefaultPackageManager {
         });
     }
     async installAndPersist(source, options) {
+        // install() runs the procurement admission gate first; if it throws, settings are never mutated,
+        // so a non-pinned/non-local source can be neither installed nor persisted.
         await this.install(source, options);
         this.addSourceToSettings(source, options);
     }
+    /**
+     * Procurement admission gate for explicit installs (and installAndPersist via install()).
+     *
+     * Pure check: no fetch, clone, npm install, or other dependency-install side effect. It reuses the
+     * native procurement validators (`validateExactNpmVersion`, `validateGitRef`) so the installer never
+     * runs against an unpinned, mutable, or range/dist-tag source. Rules:
+     *   - non-local npm packages must carry an exact pinned version (no missing/range/wildcard/dist-tag);
+     *   - git packages must use a full commit SHA, or a tag anchored to a reviewed resolved commit SHA
+     *     supplied through `options.resolvedCommit`.
+     * Local sources are exempt so local development paths keep working unchanged.
+     *
+     * Only the explicit install/persist entry point is gated. resolve()'s auto-install of
+     * already-configured packages is intentionally left unchanged so existing settings keep loading.
+     */
+    assertInstallAdmission(parsed, source, resolvedCommit) {
+        if (parsed.type === "local") {
+            return;
+        }
+        if (parsed.type === "npm") {
+            const { version } = this.parseNpmSpec(parsed.spec);
+            const verdict = validateExactNpmVersion(version);
+            if (!verdict.ok) {
+                throw new Error(`Refusing to install ${source}: non-local npm packages require an exact pinned version (e.g. npm:${parsed.name}@1.2.3). ${verdict.message}.`);
+            }
+            return;
+        }
+        const verdict = validateGitRef(parsed.ref, resolvedCommit);
+        if (!verdict.ok) {
+            throw new Error(`Refusing to install ${source}: git packages require a full commit SHA, or a reviewed resolved tag (pass options.resolvedCommit with the full SHA the tag points to). ${verdict.message}.`);
+        }
+    }
     async remove(source, options) {
         const parsed = this.parseSource(source);
         const scope = options?.local ? "project" : "user";
@@ -900,7 +1092,10 @@ export class DefaultPackageManager {
     async installNpmBatch(specs, scope) {
         const installRoot = this.getNpmInstallRoot(scope, false);
         this.ensureNpmProject(installRoot);
-        await this.runNpmCommand(this.getNpmInstallArgs(specs, installRoot));
+        const allowScripts = this.shouldAllowNpmInstallScripts(specs);
+        const unit = specs.length === 1 ? `npm:${parseNpmPackageName(specs[0])}` : `${scope} npm packages`;
+        this.logInstallScriptDecision(unit, allowScripts);
+        await this.runNpmCommand(this.getNpmInstallArgs(specs, installRoot, allowScripts));
     }
     async checkForAvailableUpdates() {
         if (isOfflineModeEnabled()) {
@@ -1064,8 +1259,12 @@ export class DefaultPackageManager {
         }
     }
     async installParsedSource(parsed, scope) {
+        if (scope === "temporary") {
+            await this.installTemporaryTrialSource(parsed);
+            return;
+        }
         if (parsed.type === "npm") {
-            await this.installNpm(parsed, scope, scope === "temporary");
+            await this.installNpm(parsed, scope, false);
             return;
         }
         if (parsed.type === "git") {
@@ -1073,6 +1272,15 @@ export class DefaultPackageManager {
             return;
         }
     }
+    async installTemporaryTrialSource(parsed) {
+        if (parsed.type === "npm") {
+            await this.installTemporaryNpmTrial(parsed);
+            return;
+        }
+        if (parsed.type === "git") {
+            throw new Error("git temporary trial installs are deferred until package-trial-sandbox exposes shell-free git executor steps");
+        }
+    }
     getPackageSourceString(pkg) {
         return typeof pkg === "string" ? pkg : pkg.source;
     }
@@ -1419,47 +1627,123 @@ export class DefaultPackageManager {
         const packageManagerCommand = separatorIndex >= 0 ? commandParts[separatorIndex + 1] : npmCommand.command;
         return packageManagerCommand ? basename(packageManagerCommand).replace(/\.(cmd|exe)$/i, "") : "";
     }
+    getTrialPackageManagerName() {
+        const packageManagerName = this.getPackageManagerName();
+        if (packageManagerName === "npm" || packageManagerName === "pnpm" || packageManagerName === "bun") {
+            return packageManagerName;
+        }
+        throw new Error(`temporary npm trial installs do not support package manager: ${packageManagerName || "unknown"}`);
+    }
     async runNpmCommand(args, options) {
         const npmCommand = this.getNpmCommand();
         await this.runCommand(npmCommand.command, [...npmCommand.args, ...args], options);
     }
-    getGitDependencyInstallArgs() {
+    getGitDependencyInstallArgs(allowScripts) {
         const configuredCommand = this.settingsManager.getNpmCommand();
-        if (configuredCommand && configuredCommand.length > 0) {
-            return ["install"];
-        }
-        return ["install", "--omit=dev"];
+        return buildGitDependencyInstallArgs(Boolean(configuredCommand && configuredCommand.length > 0), allowScripts);
     }
     runNpmCommandSync(args) {
         const npmCommand = this.getNpmCommand();
         return this.runCommandSync(npmCommand.command, [...npmCommand.args, ...args]);
     }
-    getNpmInstallArgs(specs, installRoot) {
-        const packageManagerName = this.getPackageManagerName();
-        // Extension packages run inside pi and resolve pi APIs through loader aliases/virtual modules.
-        // Disable peer dependency resolution for managed installs (npm's --legacy-peer-deps, and
-        // equivalent bun/pnpm settings) so package managers do not install or solve host-provided
-        // @earendil-works/omk-* peers. Stale auto-installed pi peers can otherwise block updates.
-        if (packageManagerName === "bun") {
-            return ["install", ...specs, "--cwd", installRoot, "--omit=peer"];
-        }
-        if (packageManagerName === "pnpm") {
-            return [
-                "install",
-                ...specs,
-                "--prefix",
-                installRoot,
-                "--config.auto-install-peers=false",
-                "--config.strict-peer-dependencies=false",
-                "--config.strict-dep-builds=false",
-            ];
-        }
-        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps"];
+    getNpmInstallArgs(specs, installRoot, allowScripts) {
+        return buildNpmInstallArgs(this.getPackageManagerName(), specs, installRoot, allowScripts);
+    }
+    // Caller-side exact-match membership. The pure builders stay membership-agnostic; only here do we read the
+    // configured allowlist and decide whether an install unit may run lifecycle scripts.
+    shouldAllowNpmInstallScripts(specs) {
+        return isNpmInstallAllowed(specs, this.settingsManager.getInstallAllowScripts());
+    }
+    shouldAllowGitInstallScripts(source) {
+        return isGitInstallAllowed(source, this.settingsManager.getInstallAllowScripts());
+    }
+    logInstallScriptDecision(unit, allowScripts) {
+        if (allowScripts) {
+            console.error(`[omk install] lifecycle scripts enabled for ${unit} via install.allowScripts; dependency tree scripts may run.`);
+        }
+        else {
+            console.error(`[omk install] lifecycle scripts disabled for ${unit} (default --ignore-scripts).`);
+        }
+    }
+    /**
+     * Validate a CLI `--allow-scripts <name>` value against an install source and return the canonical allowlist
+     * entry to persist. Exact match only; an unrelated name yields `{ ok: false, expected }` so the CLI can abort
+     * and print the manual settings example.
+     */
+    resolveInstallAllowScriptEntry(source, requested) {
+        const parsed = this.parseSource(source);
+        const value = requested.trim();
+        if (parsed.type === "npm") {
+            const identity = `npm:${parsed.name}`;
+            const spec = `npm:${parsed.spec}`;
+            const accepted = new Set([identity, spec, parsed.name, parsed.spec]);
+            if (accepted.has(value)) {
+                return { ok: true, entry: parsed.pinned ? spec : identity };
+            }
+            return { ok: false, expected: parsed.pinned ? [identity, spec] : [identity] };
+        }
+        if (parsed.type === "git") {
+            const identity = `git:${parsed.host}/${parsed.path}`;
+            const spec = parsed.ref ? `${identity}@${parsed.ref}` : identity;
+            const shorthand = `${parsed.host}/${parsed.path}`;
+            const shorthandSpec = parsed.ref ? `${shorthand}@${parsed.ref}` : shorthand;
+            const accepted = new Set([identity, spec, shorthand, shorthandSpec]);
+            if (accepted.has(value)) {
+                return { ok: true, entry: spec };
+            }
+            return { ok: false, expected: parsed.ref ? [identity, spec] : [identity] };
+        }
+        return { ok: false, expected: [] };
+    }
+    async installTemporaryNpmTrial(source) {
+        const trial = this.trialRuntime;
+        if (!trial) {
+            throw new Error("temporary npm trial installs require PackageManagerOptions.trialRuntime");
+        }
+        if (trial.policy.mode === "off") {
+            throw new Error("temporary npm trial installs require audit or enforce sandbox mode");
+        }
+        const installRoot = this.getTemporaryNpmInstallRoot(source);
+        const npmCommand = this.getNpmCommand();
+        const runtime = createTrialRuntimePlan({
+            source: `npm:${source.spec}`,
+            installRoot,
+            packageManagerName: this.getTrialPackageManagerName(),
+            packageManagerCommand: [npmCommand.command, ...npmCommand.args],
+            policy: trial.policy,
+            backend: trial.backend ?? { platform: "unsupported", backendAvailable: false },
+            resolver: trial.resolver,
+            env: trial.env?.() ?? getEnv(),
+        });
+        if (!runtime.ok) {
+            throw new Error(`temporary npm trial install rejected: ${runtime.reason}`);
+        }
+        this.emitProgress({
+            type: "progress",
+            action: "install",
+            source: `npm:${source.spec}`,
+            message: `trial plan accepted: ${runtime.audit.sandboxRule}`,
+        });
+        try {
+            this.ensureNpmProject(installRoot);
+            await this.runCommand(runtime.executor.command, [...runtime.executor.args], {
+                cwd: runtime.executor.cwd,
+                env: runtime.executor.env,
+            });
+            trial.onAudit?.(runtime.audit);
+            this.trialCleanups.push(runtime.cleanup);
+        }
+        catch (error) {
+            this.cleanupTrialInstall(runtime.cleanup, `npm:${source.spec}`);
+            throw error;
+        }
     }
     async installNpm(source, scope, temporary) {
         const installRoot = this.getNpmInstallRoot(scope, temporary);
         this.ensureNpmProject(installRoot);
-        await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot));
+        const allowScripts = this.shouldAllowNpmInstallScripts([source.spec]);
+        this.logInstallScriptDecision(`npm:${source.name}`, allowScripts);
+        await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot, allowScripts));
     }
     async uninstallNpm(source, scope) {
         const installRoot = this.getNpmInstallRoot(scope, false);
@@ -1473,14 +1757,15 @@ export class DefaultPackageManager {
         await this.runNpmCommand(["uninstall", source.name, "--prefix", installRoot]);
     }
     async installGit(source, scope) {
+        const allowScripts = this.shouldAllowGitInstallScripts(source);
         const targetDir = this.getGitInstallPath(source, scope);
         if (existsSync(targetDir)) {
             if (source.ref) {
-                await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD");
+                await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD", allowScripts);
                 return;
             }
             const target = await this.getLocalGitUpdateTarget(targetDir);
-            await this.ensureGitRef(targetDir, target.fetchArgs, target.ref);
+            await this.ensureGitRef(targetDir, target.fetchArgs, target.ref, allowScripts);
             return;
         }
         const gitRoot = this.getGitInstallRoot(scope);
@@ -1494,7 +1779,8 @@ export class DefaultPackageManager {
         }
         const packageJsonPath = join(targetDir, "package.json");
         if (existsSync(packageJsonPath)) {
-            await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+            this.logInstallScriptDecision(`git:${source.host}/${source.path}`, allowScripts);
+            await this.runNpmCommand(this.getGitDependencyInstallArgs(allowScripts), { cwd: targetDir });
         }
     }
     async updateGit(source, scope) {
@@ -1503,14 +1789,15 @@ export class DefaultPackageManager {
             await this.installGit(source, scope);
             return;
         }
+        const allowScripts = this.shouldAllowGitInstallScripts(source);
         if (source.ref) {
-            await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD");
+            await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD", allowScripts);
             return;
         }
         const target = await this.getLocalGitUpdateTarget(targetDir);
-        await this.ensureGitRef(targetDir, target.fetchArgs, target.ref);
+        await this.ensureGitRef(targetDir, target.fetchArgs, target.ref, allowScripts);
     }
-    async ensureGitRef(targetDir, fetchArgs, ref) {
+    async ensureGitRef(targetDir, fetchArgs, ref, allowScripts) {
         // Fetch only the ref we will reset to, avoiding unrelated branch/tag noise.
         await this.runCommand("git", fetchArgs, { cwd: targetDir });
         const localHead = await this.runCommandCapture("git", ["rev-parse", "HEAD"], {
@@ -1530,7 +1817,8 @@ export class DefaultPackageManager {
         await this.runCommand("git", ["clean", "-fdx"], { cwd: targetDir });
         const packageJsonPath = join(targetDir, "package.json");
         if (existsSync(packageJsonPath)) {
-            await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+            this.logInstallScriptDecision(`git:${basename(targetDir)}`, allowScripts);
+            await this.runNpmCommand(this.getGitDependencyInstallArgs(allowScripts), { cwd: targetDir });
         }
     }
     async refreshTemporaryGitSource(source, sourceStr) {
@@ -1584,7 +1872,7 @@ export class DefaultPackageManager {
         this.ensureGitIgnore(installRoot);
         const packageJsonPath = join(installRoot, "package.json");
         if (!existsSync(packageJsonPath)) {
-            const pkgJson = { name: "pi-extensions", private: true };
+            const pkgJson = { name: "omk-extensions", private: true };
             writeFileSync(packageJsonPath, JSON.stringify(pkgJson, null, 2), "utf-8");
         }
     }
@@ -1635,9 +1923,12 @@ export class DefaultPackageManager {
         }
         return undefined;
     }
+    getTemporaryNpmInstallRoot(source) {
+        return this.getTemporaryDir("npm", source.spec);
+    }
     getManagedNpmInstallPath(source, scope) {
         if (scope === "temporary") {
-            return join(this.getTemporaryDir("npm"), "node_modules", source.name);
+            return join(this.getTemporaryNpmInstallRoot(source), "node_modules", source.name);
         }
         if (scope === "project") {
             return join(this.cwd, CONFIG_DIR_NAME, "npm", "node_modules", source.name);
@@ -1737,7 +2028,7 @@ export class DefaultPackageManager {
             const dir = join(packageRoot, resourceType);
             if (existsSync(dir)) {
                 // Collect all files from the directory (all enabled by default)
-                const files = collectResourceFiles(dir, resourceType);
+                const files = collectResourceFiles(dir, resourceType, packageRoot);
                 for (const f of files) {
                     this.addResource(this.getTargetMap(accumulator, resourceType), f, metadata, true);
                 }
@@ -1756,7 +2047,7 @@ export class DefaultPackageManager {
         const dir = join(packageRoot, resourceType);
         if (existsSync(dir)) {
             // Collect all files from the directory (all enabled by default)
-            const files = collectResourceFiles(dir, resourceType);
+            const files = collectResourceFiles(dir, resourceType, packageRoot);
             for (const f of files) {
                 this.addResource(target, f, metadata, true);
             }
@@ -1796,7 +2087,7 @@ export class DefaultPackageManager {
         if (!existsSync(conventionDir)) {
             return { allFiles: [], enabledByManifest: new Set() };
         }
-        const allFiles = collectResourceFiles(conventionDir, resourceType);
+        const allFiles = collectResourceFiles(conventionDir, resourceType, packageRoot);
         return { allFiles, enabledByManifest: new Set(allFiles) };
     }
     readOmkManifest(packageRoot) {
@@ -1826,7 +2117,10 @@ export class DefaultPackageManager {
         }
     }
     collectFilesFromManifestEntries(entries, root, resourceType) {
-        const sourceEntries = entries.filter((entry) => !isOverridePattern(entry));
+        const sourceEntries = entries
+            .filter((entry) => !isOverridePattern(entry))
+            .map((entry) => resolveManifestEntryInsideRoot(root, entry))
+            .filter((entry) => Boolean(entry));
         const resolved = sourceEntries.flatMap((entry) => {
             if (!hasGlobPattern(entry)) {
                 return [resolve(root, entry)];
@@ -1836,9 +2130,11 @@ export class DefaultPackageManager {
                 absolute: true,
                 dot: false,
                 nodir: false,
-            }).map((match) => resolve(match));
+            })
+                .map((match) => resolve(match))
+                .filter((match) => isPathInsideRootByRealpath(root, match));
         });
-        return this.collectFilesFromPaths(resolved, resourceType);
+        return this.collectFilesFromPaths(resolved, resourceType, root);
     }
     resolveLocalEntries(entries, resourceType, target, metadata, baseDir) {
         if (entries.length === 0)
@@ -1903,7 +2199,7 @@ export class DefaultPackageManager {
         // Project extensions from .omk/
         addResources("extensions", collectAutoExtensionEntries(projectDirs.extensions), projectMetadata, projectOverrides.extensions, projectBaseDir);
         // Project skills from .omk/
-        addResources("skills", collectAutoSkillEntries(projectDirs.skills, "pi"), projectMetadata, projectOverrides.skills, projectBaseDir);
+        addResources("skills", collectAutoSkillEntries(projectDirs.skills, "omk"), projectMetadata, projectOverrides.skills, projectBaseDir);
         // Project skills from .agents/ (each with its own baseDir)
         for (const agentsSkillsDir of projectAgentsSkillDirs) {
             const agentsBaseDir = dirname(agentsSkillsDir); // the .agents directory
@@ -1918,7 +2214,7 @@ export class DefaultPackageManager {
         // User extensions from ~/.omk/agent/
         addResources("extensions", collectAutoExtensionEntries(userDirs.extensions), userMetadata, userOverrides.extensions, globalBaseDir);
         // User skills from ~/.omk/agent/
-        addResources("skills", collectAutoSkillEntries(userDirs.skills, "pi"), userMetadata, userOverrides.skills, globalBaseDir);
+        addResources("skills", collectAutoSkillEntries(userDirs.skills, "omk"), userMetadata, userOverrides.skills, globalBaseDir);
         // User skills from ~/.agents/ (with its own baseDir)
         const userAgentsBaseDir = dirname(userAgentsSkillsDir);
         const userAgentsMetadata = {
@@ -1929,18 +2225,20 @@ export class DefaultPackageManager {
         addResources("prompts", collectAutoPromptEntries(userDirs.prompts), userMetadata, userOverrides.prompts, globalBaseDir);
         addResources("themes", collectAutoThemeEntries(userDirs.themes), userMetadata, userOverrides.themes, globalBaseDir);
     }
-    collectFilesFromPaths(paths, resourceType) {
+    collectFilesFromPaths(paths, resourceType, containmentRoot) {
         const files = [];
         for (const p of paths) {
             if (!existsSync(p))
                 continue;
+            if (containmentRoot && !isPathInsideRootByRealpath(containmentRoot, p))
+                continue;
             try {
                 const stats = statSync(p);
                 if (stats.isFile()) {
                     files.push(p);
                 }
                 else if (stats.isDirectory()) {
-                    files.push(...collectResourceFiles(p, resourceType));
+                    files.push(...collectResourceFiles(p, resourceType, containmentRoot));
                 }
             }
             catch {
@@ -2003,7 +2301,7 @@ export class DefaultPackageManager {
         };
     }
     spawnCommand(command, args, options) {
-        const env = getEnv();
+        const env = options?.env ?? getEnv();
         return spawnProcess(command, args, {
             cwd: options?.cwd,
             stdio: isStdoutTakenOver() ? ["ignore", 2, 2] : "inherit",