paseo-room 0.1.0 → 0.2.0

package/README.md

@@ -64,9 +64,12 @@ starts, its exit code is preserved; a signal is returned using the conventional
 ## Requirements
 
 - Node 22 or newer, macOS or Linux.
-- A running Paseo daemon with CLI and daemon on the same version. Codex and Claude require
-  **0.8.0-beta.1 or newer**; any selection containing Pi requires **0.8.0 or newer**.
-  `paseo-room` checks this before touching anything, and never installs or upgrades Paseo.
+- A running Paseo daemon with CLI and daemon on the same version. Codex requires
+  **0.8.0-beta.1 or newer**; any selection containing Claude or Pi requires **0.8.0 or newer**.
+  Claude also requires Paseo plugins to be enabled explicitly: the generated trusted server plugin
+  is the strong contract carrier, and `paseo-room` never enables plugins for you. The plugin is
+  version-bounded to `>=0.8.0 <0.9.0`. `paseo-room` checks compatibility before touching anything,
+  and never installs or upgrades Paseo.
 - An initialised Codex home (`~/.codex/config.toml`) and/or Claude Code home (`~/.claude`).
   Codex must be new enough for `codex debug models` to print its JSON model catalog: the room
   seats Codex only if it can generate the scrubbed catalog copy.
@@ -86,6 +89,9 @@ starts, its exit code is preserved; a signal is returned using the conventional
   room.json                       # what this CLI created; verify and remove read it
   AUTHENTICATION.md               # exact per-role login commands; contains no secrets
   room/WORKSPACE_PROTOCOL.md      # the default protocol every seat carries, as one readable file
+  plugin/                         # Claude only: trusted creation-time system-prompt append carrier
+    paseo-plugin.json             # accepts Paseo >=0.8.0 <0.9.0
+    index.server.ts, server/      # exact provider map + generated role contracts
   roles/codex/<role>/
     config.toml                   # your config.toml + the room's overrides
     role-instructions.md          # readable copy of what this seat was told
@@ -237,18 +243,20 @@ holding older contract text.
 
 **The room never replaces an agent's base prompt.** Codex's `model_instructions_file`,
 Claude's `--system-prompt` and Pi's `SYSTEM.md` / `--system-prompt` all *replace* the vendor
-system prompt; using them would mean
-vendoring a full copy of that prompt and re-vendoring it on every agent release. The role
-contract is additive instead: `developer_instructions` for Codex, `CLAUDE.md` for Claude,
-and the generated Pi `APPEND_SYSTEM.md` passed with `--append-system-prompt` for Pi. Pi keeps
-normal project `AGENTS.md` / `CLAUDE.md` context loading.
-
-Claude's carrier is the weakest of the three, and knowingly so. `CLAUDE.md` is user memory,
-which a project-level `CLAUDE.md` can dilute, and Paseo runs Claude through the Claude Agent
-SDK rather than as a plain CLI process — so there is no provider-owned command line to append
-a stronger prompt through, and no CLI flag is proposed here. The real fix is a
-provider-owned SDK append field in Paseo itself. Until that exists, the room keeps the
-contract short and states the limit instead of implying parity with Codex.
+system prompt; using them would mean vendoring a full copy of that prompt and re-vendoring it
+on every agent release. The role contract is additive instead: `developer_instructions` for
+Codex, a room-owned Paseo creation hook that writes `config.systemPrompt` for Claude, and the
+generated Pi `APPEND_SYSTEM.md` passed with `--append-system-prompt` for Pi. Pi keeps normal
+project `AGENTS.md` / `CLAUDE.md` context loading.
+
+For Claude, Paseo maps `config.systemPrompt` to the Claude Code preset's SDK `append` field,
+so the native prompt remains intact while the generated role contract enters the instruction
+layer. The trusted plugin targets only exact `claude-supervisor`, `claude-lead`, and
+`claude-peer` room providers and skips internal agents; existing caller prompt text is
+preserved. `CLAUDE.md` remains unchanged as a degraded and resume fallback. `verify` fails if
+the plugin is absent, disabled, failed, registered from another path, or drifted, because a
+silently missing carrier is not a guarantee. The hook runs for newly created sessions;
+recreate an existing Claude session after setup or an update.
 
 Pi providers use a strict command tail:
 

package/dist/index.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "paseo-room",
-      version: "0.1.0",
+      version: "0.2.0",
       description: "One CLI that configures Codex, Claude Code, and Pi role homes in $HOME and registers them with your local Paseo daemon.",
       keywords: [
         "paseo",
@@ -49,7 +49,7 @@ var init_package = __esm({
         lint: "eslint . --max-warnings 0",
         test: "vitest run",
         "test:package": "vitest run --config vitest.package.config.ts",
-        build: `tsup && node --input-type=module -e "import { cpSync, rmSync } from 'node:fs'; rmSync('dist/prompts', { recursive: true, force: true }); cpSync('src/room/prompts', 'dist/prompts', { recursive: true });"`,
+        build: `tsup && node --input-type=module -e "import { cpSync, rmSync } from 'node:fs'; for (const [source, target] of [['src/room/prompts', 'dist/prompts'], ['src/plugin-assets', 'dist/plugin-assets']]) { rmSync(target, { recursive: true, force: true }); cpSync(source, target, { recursive: true }); }"`,
         prepack: "npm run build",
         verify: "npm run typecheck && npm run lint && npm test && npm run build && npm run test:package"
       },
@@ -1868,7 +1868,7 @@ var init_pi = __esm({
 import { gte, valid } from "semver";
 import { z as z2 } from "zod";
 function minimumPaseoVersion(agents) {
-  return agents.includes("pi") ? PI_MINIMUM_VERSION : MINIMUM_VERSION;
+  return agents.includes("pi") || agents.includes("claude") ? PI_MINIMUM_VERSION : MINIMUM_VERSION;
 }
 function normalizeUrl(listen) {
   const match = /^(?:ws:\/\/)?([^:/]+|\[[^\]]+\]):(\d+)$/.exec(listen.trim());
@@ -1929,15 +1929,38 @@ async function withSession(daemon, run2, options = {}) {
   }, warn() {
   }, error() {
   } };
-  const factory = options.factory ?? (await import("@getpaseo/client")).createPaseoClient;
-  const client = factory({
+  const clientConfig = {
     url: `${daemon.url}/ws`,
     ...options.password === void 0 ? {} : { password: options.password },
     appVersion: MINIMUM_VERSION,
     connectTimeoutMs: 1e4,
     reconnect: { enabled: false },
     logger: quiet
-  });
+  };
+  let client;
+  if (options.factory !== void 0) {
+    client = options.factory(clientConfig);
+  } else {
+    const [{ createPaseoApi }, { DaemonClient }] = await Promise.all([
+      import("@getpaseo/client"),
+      import("@getpaseo/client/internal/daemon-client")
+    ]);
+    const raw = new DaemonClient({ ...clientConfig, clientId: `paseo-room-${String(process.pid)}`, clientType: "cli" });
+    client = {
+      ...createPaseoApi(raw),
+      connect: () => raw.connect(),
+      close: () => raw.close(),
+      ensureConnected: () => {
+        raw.ensureConnected();
+      },
+      getConnectionState: () => raw.getConnectionState(),
+      listPlugins: () => raw.listPlugins(),
+      installDirectoryPlugin: (path, id) => raw.installDirectoryPlugin(path, id),
+      reloadPlugin: (id) => raw.reloadPlugin(id),
+      enablePlugin: (id) => raw.enablePlugin(id),
+      removePlugin: (id) => raw.removePlugin(id)
+    };
+  }
   try {
     await client.connect();
     return await run2({
@@ -1958,6 +1981,25 @@ async function withSession(daemon, run2, options = {}) {
       async writeProfiles(profiles) {
         await client.config.patch({ agentProfiles: [...profiles] });
       },
+      async pluginsEnabled() {
+        const response = configSchema.parse(await client.config.get());
+        return response.config.pluginsEnabled === true;
+      },
+      async listPlugins() {
+        return await client.listPlugins();
+      },
+      async installPlugin(path, id) {
+        return await client.installDirectoryPlugin(path, id);
+      },
+      async reloadPlugin(id) {
+        return await client.reloadPlugin(id);
+      },
+      async enablePlugin(id) {
+        return await client.enablePlugin(id);
+      },
+      async removePlugin(id) {
+        await client.removePlugin(id);
+      },
       async refresh(ids) {
         await client.providers.refresh({ providers: [...ids] });
       }
@@ -2024,14 +2066,59 @@ var init_paseo = __esm({
       config: z2.object({
         providers: z2.record(z2.string(), z2.unknown()).optional(),
         // Read loosely: entries carry operator fields the room neither knows nor touches.
-        agentProfiles: z2.array(z2.record(z2.string(), z2.unknown())).optional()
+        agentProfiles: z2.array(z2.record(z2.string(), z2.unknown())).optional(),
+        pluginsEnabled: z2.boolean().optional()
       })
     });
   }
 });
 
+// src/plugin.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join10 } from "path";
+function loadAsset(path) {
+  return readFileSync2(new URL(`./plugin-assets/${path}`, import.meta.url), "utf8");
+}
+function claudeCarrierPluginDir(layout) {
+  return join10(layout.roomHome, "plugin");
+}
+function renderClaudeCarrierContract(roles) {
+  const contracts = Object.fromEntries(roles.map((role) => [providerId("claude", role), renderInstructions(role)]));
+  return [
+    "/** Generated by paseo-room. The Markdown prompt assets remain authoritative. */",
+    `export const GENERATION = ${JSON.stringify(contractDigest())};`,
+    `export const CONTRACT: Readonly<Record<string, string>> = ${JSON.stringify(contracts, null, 2)};`,
+    ""
+  ].join("\n");
+}
+function claudeCarrierEntries(layout, roles) {
+  const root = claudeCarrierPluginDir(layout);
+  return [
+    { kind: "dir", path: root },
+    { kind: "dir", path: join10(root, "server") },
+    ...STATIC_ASSETS.map((path) => ({ kind: "file", path: join10(root, path), content: loadAsset(path) })),
+    { kind: "file", path: join10(root, "server", "contract.ts"), content: renderClaudeCarrierContract(roles) }
+  ];
+}
+var CLAUDE_CARRIER_PLUGIN_ID, STATIC_ASSETS;
+var init_plugin = __esm({
+  "src/plugin.ts"() {
+    "use strict";
+    init_roles();
+    init_instructions();
+    CLAUDE_CARRIER_PLUGIN_ID = "paseo-room-claude-carrier";
+    STATIC_ASSETS = [
+      "paseo-plugin.json",
+      "package.json",
+      "tsconfig.json",
+      "index.server.ts",
+      "server/carrier.ts"
+    ];
+  }
+});
+
 // src/commands.ts
-import { join as join10, sep as sep2 } from "path";
+import { join as join11, sep as sep2 } from "path";
 import { lstat as lstat4, rm as rm3 } from "fs/promises";
 function sessionOptions(options) {
   const password = (options.env ?? process.env).PASEO_PASSWORD;
@@ -2063,7 +2150,7 @@ async function buildDesired(layout, agents, roles) {
   const entries = [
     { kind: "dir", path: layout.roomHome },
     { kind: "dir", path: sharedRoom(layout) },
-    { kind: "file", path: join10(sharedRoom(layout), "WORKSPACE_PROTOCOL.md"), content: renderInstructions("workspace") }
+    { kind: "file", path: join11(sharedRoom(layout), "WORKSPACE_PROTOCOL.md"), content: renderInstructions("workspace") }
   ];
   const providers = {};
   const profiles = [];
@@ -2097,17 +2184,19 @@ async function buildDesired(layout, agents, roles) {
   if (agents.every((id) => binaries[id] !== void 0)) {
     entries.push({
       kind: "file",
-      path: join10(layout.roomHome, AUTHENTICATION_GUIDE),
+      path: join11(layout.roomHome, AUTHENTICATION_GUIDE),
       content: renderAuthenticationGuide(layout.roomHome, binaries, agents, roles)
     });
     checks.push(warn(
       "room.authentication-not-validated",
-      `Role authentication was not validated. Login instructions are managed at ${join10(layout.roomHome, AUTHENTICATION_GUIDE)}.`,
+      `Role authentication was not validated. Login instructions are managed at ${join11(layout.roomHome, AUTHENTICATION_GUIDE)}.`,
       "After setup --apply, follow that guide or run: paseo-room auth login <agent> <role>"
     ));
   }
-  entries.push({ kind: "file", path: join10(layout.roomHome, MARKER), content: renderMarker(package_default.version, agents, roles, contractDigest()) });
-  return { entries, providers, profiles, checks };
+  const pluginPath = agents.includes("claude") ? claudeCarrierPluginDir(layout) : void 0;
+  if (pluginPath !== void 0) entries.push(...claudeCarrierEntries(layout, roles));
+  entries.push({ kind: "file", path: join11(layout.roomHome, MARKER), content: renderMarker(package_default.version, agents, roles, contractDigest()) });
+  return { entries, providers, profiles, checks, ...pluginPath === void 0 ? {} : { pluginPath } };
 }
 function contractProvenance(previous) {
   const digest = contractDigest();
@@ -2162,10 +2251,10 @@ async function roomPathSafety(layout, agents, roles) {
   const checks = [];
   if (!await safeDirectory(layout.roomHome, checks)) return checks;
   await safeDirectory(sharedRoom(layout), checks);
-  const rolesHome = join10(layout.roomHome, "roles");
+  const rolesHome = join11(layout.roomHome, "roles");
   if (!await safeDirectory(rolesHome, checks)) return checks;
   for (const agent of agents) {
-    const agentHome = join10(rolesHome, agent);
+    const agentHome = join11(rolesHome, agent);
     if (!await safeDirectory(agentHome, checks)) continue;
     for (const role of roles) await safeDirectory(roleHome(layout, agent, role), checks);
   }
@@ -2186,14 +2275,54 @@ async function staleFrom(layout, previous, agents, roles) {
       if (await exists(path)) retainedDirectories.push(path);
     }
   }
-  return { providerIds, profileIds, retainedDirectories };
+  return {
+    providerIds,
+    profileIds,
+    removePlugin: previous.agents.includes("claude") && !agents.includes("claude"),
+    retainedDirectories
+  };
 }
-async function planRoom(session, desired, stale) {
-  const live = await session.readProviders();
-  const liveProfiles = await session.readProfiles();
+function pluginPlan(desired, stale, plugins, expectedPath) {
+  const livePlugin = plugins.find((plugin) => plugin.id === CLAUDE_CARRIER_PLUGIN_ID);
+  const shouldManage = desired.pluginPath !== void 0 || stale.removePlugin;
+  if (!shouldManage) return { checks: [] };
+  if (livePlugin !== void 0 && livePlugin.path !== expectedPath) {
+    return {
+      livePlugin,
+      checks: [fail(
+        "claude.plugin.path",
+        `Plugin ${CLAUDE_CARRIER_PLUGIN_ID} is registered from ${livePlugin.path}, not the room-owned path ${expectedPath}.`,
+        "Move or remove that conflicting plugin registration manually, then run setup again."
+      )]
+    };
+  }
+  if (desired.pluginPath !== void 0) {
+    const healthy = livePlugin?.enabled === true && livePlugin.status === "running" && livePlugin.error === void 0;
+    return {
+      ...livePlugin === void 0 ? {} : { livePlugin },
+      operation: { action: livePlugin === void 0 ? "create" : healthy ? "noop" : "update", kind: "plugin", target: CLAUDE_CARRIER_PLUGIN_ID },
+      checks: []
+    };
+  }
+  return {
+    ...livePlugin === void 0 ? {} : { livePlugin },
+    operation: { action: livePlugin === void 0 ? "noop" : "remove", kind: "plugin", target: CLAUDE_CARRIER_PLUGIN_ID },
+    checks: []
+  };
+}
+async function planRoom(session, desired, stale, expectedPluginPath) {
+  const inspectPlugins = desired.pluginPath !== void 0 || stale.removePlugin;
+  const [live, liveProfiles, plugins] = await Promise.all([
+    session.readProviders(),
+    session.readProfiles(),
+    inspectPlugins ? session.listPlugins() : Promise.resolve([])
+  ]);
   const byId = new Map(liveProfiles.map((entry) => [String(entry.id), entry]));
+  const plugin = pluginPlan(desired, stale, plugins, expectedPluginPath);
   return {
     liveProfiles,
+    ...plugin.livePlugin === void 0 ? {} : { livePlugin: plugin.livePlugin },
+    pluginChecks: plugin.checks,
     operations: [
       ...await planEntries(desired.entries),
       ...Object.entries(desired.providers).map(([id, provider]) => ({
@@ -2207,10 +2336,53 @@ async function planRoom(session, desired, stale) {
         target: profile.id
       })),
       ...stale.providerIds.filter((id) => id in live).map((id) => ({ action: "remove", kind: "provider", target: id })),
-      ...stale.profileIds.filter((id) => byId.has(id)).map((id) => ({ action: "remove", kind: "profile", target: id }))
+      ...stale.profileIds.filter((id) => byId.has(id)).map((id) => ({ action: "remove", kind: "profile", target: id })),
+      ...plugin.operation === void 0 ? [] : [plugin.operation]
     ]
   };
 }
+function pluginsEnabledCheck(enabled) {
+  return enabled ? pass("claude.plugin.enabled", "Paseo plugins are enabled for the required Claude contract carrier.") : fail(
+    "claude.plugin.enabled",
+    "Claude rooms require the paseo-room trusted server plugin, but Paseo plugins are disabled. Plugins are trusted, unsandboxed code with access to the daemon machine.",
+    "Review that trust boundary, enable plugins in Paseo Settings, reload Paseo, then run setup again."
+  );
+}
+function pluginRuntimeCheck(plugin, expectedPath) {
+  if (plugin === void 0) {
+    return fail("claude.plugin.runtime", `Plugin ${CLAUDE_CARRIER_PLUGIN_ID} is not registered.`, "Run: paseo-room setup --apply");
+  }
+  if (plugin.path !== expectedPath) {
+    return fail(
+      "claude.plugin.runtime",
+      `Plugin ${CLAUDE_CARRIER_PLUGIN_ID} is registered from ${plugin.path}, not ${expectedPath}.`,
+      "Move or remove that conflicting plugin registration manually, then run setup again."
+    );
+  }
+  if (!plugin.enabled || plugin.status !== "running" || plugin.error !== void 0) {
+    const detail = plugin.error === void 0 ? `status ${plugin.status}` : `${plugin.status}: ${plugin.error}`;
+    return fail("claude.plugin.runtime", `Plugin ${CLAUDE_CARRIER_PLUGIN_ID} is not running (${detail}).`, "Run: paseo-room setup --apply");
+  }
+  return pass("claude.plugin.runtime", `Claude contract carrier plugin is running from ${expectedPath}.`);
+}
+async function reconcilePlugin(session, desired, plan, pending, expectedPath) {
+  if (desired.pluginPath === void 0) {
+    if (plan.livePlugin !== void 0) await session.removePlugin(CLAUDE_CARRIER_PLUGIN_ID);
+    return [];
+  }
+  let plugin = plan.livePlugin;
+  if (plugin === void 0) {
+    plugin = await session.installPlugin(expectedPath, CLAUDE_CARRIER_PLUGIN_ID);
+  } else {
+    if (!plugin.enabled) plugin = await session.enablePlugin(CLAUDE_CARRIER_PLUGIN_ID);
+    const filesChanged = pending.some(
+      (operation) => (operation.kind === "file" || operation.kind === "dir") && operation.target.startsWith(`${expectedPath}${sep2}`)
+    );
+    const needsReload = filesChanged || plugin.status !== "running" || plugin.error !== void 0;
+    if (needsReload) plugin = await session.reloadPlugin(CLAUDE_CARRIER_PLUGIN_ID);
+  }
+  return [pluginRuntimeCheck(plugin, expectedPath)];
+}
 async function setup(options = {}) {
   const layout = resolveLayout(options, options.env);
   const agents = options.agents ?? ["codex"];
@@ -2222,7 +2394,8 @@ async function setup(options = {}) {
   const safetyAgents = [.../* @__PURE__ */ new Set([...agents, ...previous?.agents ?? []])];
   const pathSafety = await roomPathSafety(layout, safetyAgents, ROLES);
   if (hasFailure(pathSafety)) return failed("setup", pathSafety);
-  const daemon = await checkDaemon(layout, options.env, minimumPaseoVersion(agents));
+  const compatibilityAgents = [.../* @__PURE__ */ new Set([...agents, ...previous?.agents ?? []])];
+  const daemon = await checkDaemon(layout, options.env, minimumPaseoVersion(compatibilityAgents));
   if (!daemon.daemon) return failed("setup", daemon.checks);
   const desired = await buildDesired(layout, agents, ROLES);
   const stale = await staleFrom(layout, previous, agents, ROLES);
@@ -2234,19 +2407,24 @@ async function setup(options = {}) {
   const checks = [...daemon.checks, ...desired.checks, ...retained];
   if (hasFailure(checks)) return failed("setup", checks);
   return withSession(daemon.daemon, async (session) => {
-    const { operations, liveProfiles } = await planRoom(session, desired, stale);
+    const expectedPluginPath = claudeCarrierPluginDir(layout);
+    const plan = await planRoom(session, desired, stale, expectedPluginPath);
+    const { operations, liveProfiles } = plan;
     const pending = operations.filter((operation) => operation.action !== "noop");
-    const preApplyDiagnostics = [...checks, ...contractProvenance(previous), ...thinkingDiagnostics(liveProfiles, desired.profiles)];
-    if (!options.apply) {
+    const pluginPreconditions = desired.pluginPath === void 0 ? plan.pluginChecks : [pluginsEnabledCheck(await session.pluginsEnabled()), ...plan.pluginChecks];
+    const preApplyDiagnostics = [...checks, ...pluginPreconditions, ...contractProvenance(previous), ...thinkingDiagnostics(liveProfiles, desired.profiles)];
+    if (hasFailure(preApplyDiagnostics) || !options.apply) {
       return {
         command: "setup",
-        outcome: pending.length > 0 ? "changes-planned" : "ok",
+        outcome: hasFailure(preApplyDiagnostics) ? "failed" : pending.length > 0 ? "changes-planned" : "ok",
         changed: false,
         checks: preApplyDiagnostics,
         operations
       };
     }
-    await applyEntries(desired.entries);
+    const markerPath = join11(layout.roomHome, MARKER);
+    const markerEntries = desired.entries.filter((entry) => entry.path === markerPath);
+    await applyEntries(desired.entries.filter((entry) => entry.path !== markerPath));
     const ids = Object.keys(desired.providers);
     await session.writeProviders(desired.providers);
     if (stale.providerIds.length > 0) await session.removeProviders(stale.providerIds);
@@ -2256,24 +2434,27 @@ async function setup(options = {}) {
       await session.writeProfiles(appliedProfiles);
     }
     await session.refresh(ids);
+    const pluginChecks = await reconcilePlugin(session, desired, plan, pending, expectedPluginPath);
+    await applyEntries(markerEntries);
     const appliedMarker = {
       version: package_default.version,
       agents: [...agents],
       roles: [...ROLES],
       contract: contractDigest()
     };
+    const appliedChecks = [
+      ...checks,
+      ...pluginPreconditions,
+      ...pluginChecks,
+      pass("room.applied", `Room ready at ${layout.roomHome} with ${String(ids.length)} Paseo providers.`),
+      ...contractProvenance(appliedMarker),
+      ...thinkingDiagnostics(appliedProfiles, desired.profiles)
+    ];
     return {
       command: "setup",
-      outcome: "ok",
+      outcome: hasFailure(appliedChecks) ? "failed" : "ok",
       changed: pending.length > 0,
-      // Report success before non-blocking diagnostics so it cannot read as if a later pass
-      // cleared a warning. `appliedProfiles` is the exact array written above when one changed.
-      checks: [
-        ...checks,
-        pass("room.applied", `Room ready at ${layout.roomHome} with ${String(ids.length)} Paseo providers.`),
-        ...contractProvenance(appliedMarker),
-        ...thinkingDiagnostics(appliedProfiles, desired.profiles)
-      ],
+      checks: appliedChecks,
       operations
     };
   }, sessionOptions(options));
@@ -2296,18 +2477,26 @@ async function verify(options = {}) {
   const checks = [...daemon.checks, ...desired.checks];
   if (hasFailure(checks)) return failed("verify", checks);
   return withSession(daemon.daemon, async (session) => {
-    const { operations, liveProfiles } = await planRoom(session, desired, NOTHING_STALE);
+    const expectedPluginPath = claudeCarrierPluginDir(layout);
+    const plan = await planRoom(session, desired, NOTHING_STALE, expectedPluginPath);
+    const { operations, liveProfiles } = plan;
     const drifted = operations.filter((operation) => operation.action !== "noop");
     const count = (kind) => drifted.filter((operation) => operation.kind === kind).length;
     const providers = count("provider");
     const profiles = count("profile");
-    const driftedFiles = drifted.filter((operation) => operation.kind !== "provider" && operation.kind !== "profile");
+    const driftedFiles = drifted.filter((operation) => !["provider", "profile", "plugin"].includes(operation.kind));
     const files = driftedFiles.length;
+    const pluginChecks = desired.pluginPath === void 0 ? [] : [
+      pluginsEnabledCheck(await session.pluginsEnabled()),
+      ...plan.pluginChecks,
+      pluginRuntimeCheck(plan.livePlugin, expectedPluginPath)
+    ];
     const all = [
       ...checks,
       files === 0 ? pass("room.files", "Every managed role file matches the current definition.") : fail("room.files", `${String(files)} managed role files are missing or outdated.${fileDriftDetail(driftedFiles.map((operation) => operation.target))}`, "Run: paseo-room setup --apply"),
       providers === 0 ? pass("room.providers", `All ${String(Object.keys(desired.providers).length)} Paseo providers are registered as expected.`) : fail("room.providers", `${String(providers)} Paseo providers are missing or differ.`, "Run: paseo-room setup --apply"),
       profiles === 0 ? pass("room.profiles", `All ${String(desired.profiles.length)} Paseo agent profiles are registered as expected.`) : fail("room.profiles", `${String(profiles)} Paseo agent profiles are missing or differ.`, "Run: paseo-room setup --apply"),
+      ...pluginChecks,
       // Diagnostics last: a warning never precedes the failure it might be mistaken for.
       ...contractProvenance(marker),
       ...thinkingDiagnostics(liveProfiles, desired.profiles)
@@ -2333,9 +2522,11 @@ async function remove(options = {}) {
   if (invalid.length > 0) return failed("remove", invalid);
   const ids = marker.agents.flatMap((agent) => marker.roles.map((role) => providerId(agent, role)));
   const profiles = new Set(marker.agents.flatMap((agent) => marker.roles.map((role) => profileId(agent, role))));
+  const hasClaude = marker.agents.includes("claude");
   const operations = [
     ...ids.map((id) => ({ action: "remove", kind: "provider", target: id })),
     ...[...profiles].map((id) => ({ action: "remove", kind: "profile", target: id })),
+    ...hasClaude ? [{ action: "remove", kind: "plugin", target: CLAUDE_CARRIER_PLUGIN_ID }] : [],
     { action: "remove", kind: "dir", target: layout.roomHome }
   ];
   const credentialWarning = warn(
@@ -2360,6 +2551,14 @@ async function remove(options = {}) {
   }
   try {
     await withSession(daemon.daemon, async (session) => {
+      if (hasClaude) {
+        const plugin = (await session.listPlugins()).find((entry) => entry.id === CLAUDE_CARRIER_PLUGIN_ID);
+        const expectedPath = claudeCarrierPluginDir(layout);
+        if (plugin !== void 0 && plugin.path !== expectedPath) {
+          throw new Error(`refusing to remove foreign plugin path ${plugin.path}`);
+        }
+        if (plugin !== void 0) await session.removePlugin(CLAUDE_CARRIER_PLUGIN_ID);
+      }
       await session.removeProviders(ids);
       const live = await session.readProfiles();
       const kept = live.filter((entry) => !profiles.has(String(entry.id)));
@@ -2403,12 +2602,13 @@ var init_commands = __esm({
     init_fsops();
     init_layout();
     init_paseo();
+    init_plugin();
     init_result();
     init_instructions();
     init_room();
     init_roles();
     AGENTS = { codex: codexAgent, claude: claudeAgent, pi: piAgent };
-    NOTHING_STALE = { providerIds: [], profileIds: [], retainedDirectories: [] };
+    NOTHING_STALE = { providerIds: [], profileIds: [], removePlugin: false, retainedDirectories: [] };
   }
 });