praxis-agent 0.40.0 → 0.42.0

package/README.md

@@ -170,7 +170,9 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   exclusions, violation reporting, and bare-repository control-file cleanup,
   safe-property Skill auto-allow, interactive
   workspace-directory add/remove controls, path confinement, credential
-  redaction, and sanitized child processes.
+  redaction, sanitized child processes, and exact-fingerprint workspace trust
+  that blocks automatically discovered project/local hooks and MCP servers
+  until the canonical workspace configuration is explicitly accepted.
 - **Durable local work** — resumable sessions, full-history forks, file
   checkpoints, tasks, foreground/background subagents, top-level agents, and
   Claude-compatible main-thread agent definitions with native prompt, model,
@@ -198,7 +200,8 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   imports, memory, skills, commands, agents, hooks, settings, MCP servers,
   plugins, and append-only `praxis.transcript` JSONL sessions under `~/.praxis`.
 - **Provider-neutral models** — native Anthropic Messages and OpenAI-compatible
-  streaming adapters with explicit capability checks and metering controls.
+  streaming adapters with explicit capability checks, metering controls, and
+  a bounded absolute deadline for every provider attempt.
 
 Detailed feature status and executable evidence live in the
 [parity matrix](https://github.com/Forest-Isle/Praxis/blob/main/docs/PARITY_MATRIX.md),

package/dist/cli/controls.js

@@ -7,6 +7,7 @@ export const DEFAULT_CLI_CONTROLS = {
     settingSources: undefined,
     safeMode: false,
     bare: false,
+    trustProject: false,
     systemPrompt: undefined,
     systemPromptFile: undefined,
     appendSystemPrompt: undefined,
@@ -180,6 +181,7 @@ export async function resolveCliControls(controls, cwd) {
         settingSources: controls.settingSources,
         safeMode: controls.safeMode,
         bare: controls.bare,
+        trustProject: controls.trustProject,
         systemPrompt,
         appendSystemPrompt,
         excludeDynamicSystemPromptSections: controls.excludeDynamicSystemPromptSections,

package/dist/cli/protocol.d.ts

@@ -14,6 +14,7 @@ export interface CliControls {
     settingSources: readonly ('user' | 'project' | 'local')[] | undefined;
     safeMode: boolean;
     bare: boolean;
+    trustProject: boolean;
     systemPrompt: string | undefined;
     systemPromptFile: string | undefined;
     appendSystemPrompt: string | undefined;

package/dist/cli/protocol.js

@@ -359,6 +359,7 @@ export function parseCliInvocation(argv) {
     let autocompact;
     let safeMode = false;
     let bare = false;
+    let trustProject = false;
     let systemPrompt;
     let systemPromptFile;
     let appendSystemPrompt;
@@ -1082,6 +1083,10 @@ export function parseCliInvocation(argv) {
             bare = true;
             continue;
         }
+        if (value === '--trust-project') {
+            trustProject = true;
+            continue;
+        }
         if (value === '--init') {
             init = true;
             continue;
@@ -1343,6 +1348,7 @@ export function parseCliInvocation(argv) {
         settingSources,
         safeMode,
         bare,
+        trustProject,
         systemPrompt,
         systemPromptFile,
         appendSystemPrompt,

package/dist/cli/workspace-trust-prompt.d.ts

@@ -0,0 +1,10 @@
+import { type WorkspaceTrustInventory } from '../security/workspace-trust.js';
+export interface WorkspaceTrustPromptIO {
+    input?: AsyncIterable<string>;
+    output?: (text: string) => void;
+    signal?: AbortSignal;
+}
+export declare function createWorkspaceTrustDecisionCache(decide: (inventory: WorkspaceTrustInventory) => boolean | Promise<boolean>): (inventory: WorkspaceTrustInventory) => Promise<boolean>;
+export declare function safeWorkspaceTrustDisplayField(value: string): string;
+export declare function promptWorkspaceTrust(inventory: WorkspaceTrustInventory, io?: WorkspaceTrustPromptIO): Promise<boolean>;
+//# sourceMappingURL=workspace-trust-prompt.d.ts.map

package/dist/cli/workspace-trust-prompt.js

@@ -0,0 +1,53 @@
+import { workspaceTrustDecisionKey, } from '../security/workspace-trust.js';
+export function createWorkspaceTrustDecisionCache(decide) {
+    const decisions = new Map();
+    return async (inventory) => {
+        const key = workspaceTrustDecisionKey(inventory);
+        const cached = decisions.get(key);
+        if (cached !== undefined)
+            return cached;
+        const decision = await decide(inventory);
+        decisions.set(key, decision);
+        return decision;
+    };
+}
+export function safeWorkspaceTrustDisplayField(value) {
+    return [...value]
+        .map((character) => {
+        return /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character) ? '?' : character;
+    })
+        .join('')
+        .slice(0, 512);
+}
+export async function promptWorkspaceTrust(inventory, io = {}) {
+    const output = io.output ?? ((text) => process.stderr.write(text));
+    if (io.signal?.aborted)
+        return false;
+    output(`Workspace executable resources found for ${safeWorkspaceTrustDisplayField(inventory.canonicalPath)}\n`);
+    for (const origin of inventory.origins)
+        output(`  ${origin.kind} (${origin.scope}) ${safeWorkspaceTrustDisplayField(origin.path)}: ${safeWorkspaceTrustDisplayField(origin.label)}\n`);
+    output('Trust these workspace executables? [y/N] ');
+    const input = io.input ?? process.stdin;
+    const iterator = input[Symbol.asyncIterator]();
+    const abortedResult = Symbol('workspace-trust-prompt-aborted');
+    let abort;
+    try {
+        const aborted = new Promise((resolve) => {
+            abort = () => resolve(abortedResult);
+            io.signal?.addEventListener('abort', abort, { once: true });
+            if (io.signal?.aborted)
+                abort();
+        });
+        const result = await Promise.race([iterator.next(), aborted]);
+        if (result === abortedResult)
+            return false;
+        if (result.done)
+            return false;
+        return /^(?:y|yes)$/iu.test(String(result.value).trim());
+    }
+    finally {
+        if (abort)
+            io.signal?.removeEventListener('abort', abort);
+    }
+}
+//# sourceMappingURL=workspace-trust-prompt.js.map

package/dist/cli-runtime.d.ts

@@ -11,6 +11,7 @@ import type { TuiSlashCommand } from './cli/tui/slash-commands.js';
 import { type TuiHookConfiguration } from './cli/tui/hook-settings.js';
 import { type PraxisRuntimeSettings } from './cli/tui/runtime-settings.js';
 import { type ClaudePermissionMode } from './permissions/claude-permission-resolver.js';
+import { type WorkspaceTrustInventory } from './security/workspace-trust.js';
 import { type ClaudeMcpServerStatus, type ClaudeMcpToolInspection } from './mcp/claude-mcp-tools.js';
 import { authenticateMcpServer } from './mcp/claude-mcp-oauth.js';
 import { servePraxisMcpStdio } from './mcp/praxis-mcp-server.js';
@@ -138,6 +139,7 @@ export interface CliDependencies extends InteractiveServiceFactory {
         onElicitation?: (request: CliElicitationRequest) => Promise<CliElicitationResult>;
         askUser?: ClaudeInteractiveToolCallbacks['askUser'];
         approvePlan?: ClaudeInteractiveToolCallbacks['approvePlan'];
+        approveWorkspaceTrust?: (request: WorkspaceTrustInventory) => boolean | Promise<boolean>;
     }): Promise<SessionCommands>;
     createAutoModeCritic?(options: {
         model?: string;

package/dist/cli-runtime.js

@@ -33,6 +33,8 @@ import { createClaudeModelAutoClassifier, defaultClaudeAutoModeConfig, loadClaud
 import { ClaudeExtensionPermissionResolver, ClaudeExtensionToolRegistry, } from './extensions/claude-extension-tools.js';
 import { ClaudeExtensionCatalog } from './extensions/claude-extensions.js';
 import { ClaudeHookRunner } from './hooks/claude-hooks.js';
+import { allowedWorkspaceHookSettings, allowedWorkspaceMcpResources, assessWorkspaceTrust, persistWorkspaceTrust, workspaceTrustDecisionKey, workspaceTrustInventory, } from './security/workspace-trust.js';
+import { createWorkspaceTrustDecisionCache, promptWorkspaceTrust, safeWorkspaceTrustDisplayField, } from './cli/workspace-trust-prompt.js';
 import { ClaudeSessionEnvironment } from './hooks/claude-session-environment.js';
 import { ClaudeMcpToolRegistry, } from './mcp/claude-mcp-tools.js';
 import { ClaudeMcpManagement, filterDisabledMcpResources, mcpScope, } from './mcp/claude-mcp-management.js';
@@ -45,6 +47,7 @@ import { redactSensitiveText, sensitiveEnvironmentValues, } from './platform/sen
 import { AnthropicCompatibleProvider } from './providers/anthropic-compatible.js';
 import { createAnthropicPromptCachePolicyResolver } from './providers/anthropic-prompt-cache.js';
 import { FallbackModelProvider } from './providers/fallback-provider.js';
+import { DeadlineModelProvider } from './providers/deadline-provider.js';
 import { OpenAICompatibleProvider } from './providers/openai-compatible.js';
 import { parseContextEnvironment, parseProviderEnvironment, } from './providers/environment.js';
 import { ModelPricingRegistry, usageCostUsd } from './core/usage.js';
@@ -105,7 +108,7 @@ function createProviderForModel({ apiKey, environment, provider, context, contro
                 ? { contextWindowTokens: context.contextWindowTokens }
                 : {}),
         };
-        return provider.provider === 'anthropic'
+        const concrete = provider.provider === 'anthropic'
             ? new AnthropicCompatibleProvider({
                 ...providerOptions,
                 promptCaching: resolvePromptCachePolicy({
@@ -124,7 +127,9 @@ function createProviderForModel({ apiKey, environment, provider, context, contro
                 ...('anthropicVersion' in provider
                     ? { anthropicVersion: provider.anthropicVersion }
                     : {}),
-                ...('webSearch' in provider ? { webSearch: provider.webSearch } : {}),
+                ...('webSearch' in provider
+                    ? { webSearch: provider.webSearch }
+                    : {}),
             })
             : new OpenAICompatibleProvider({
                 ...providerOptions,
@@ -140,6 +145,10 @@ function createProviderForModel({ apiKey, environment, provider, context, contro
                         },
                     }),
             });
+        return new DeadlineModelProvider({
+            provider: concrete,
+            deadlineMs: provider.deadlineMs,
+        });
     };
 }
 const HELP = `Praxis — local-first general agent
@@ -216,6 +225,7 @@ Options:
   --setting-sources <sources>         user, project, local, or an empty list
   --safe-mode                         Disable shared customizations
   --bare                              Use only explicitly supplied context
+  --trust-project                     Trust current workspace executables
   --system-prompt <prompt>            Set system prompt
   --append-system-prompt <prompt>     Append system prompt
   --exclude-dynamic-system-prompt-sections
@@ -755,6 +765,12 @@ const consoleIO = {
     isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     readStdinLines: () => process.stdin,
 };
+function warningEventSink(io) {
+    return (event) => {
+        if (event.type === 'warning')
+            io.stderr(`${event.message}\n`);
+    };
+}
 /**
  * Shared runtime model precedence used by every consumer (provider
  * construction, status/doctor output, and the interactive display):
@@ -789,7 +805,7 @@ export function resolveUnknownCostSidecarPath(dataPlane, configRoot) {
     assertNativeDataPlane(dataPlane);
     return join(configRoot, 'state', 'unknown-cost-sidecar.json');
 }
-const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
+const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, approveWorkspaceTrust, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
     const runtimeEnvironment = requestedProviderEnvironment ?? process.env;
     const sandboxEnvironment = { ...runtimeEnvironment, ...environment };
     const claudeVersion = VERIFIED_CLAUDE_SCHEMA_VERSION;
@@ -971,11 +987,58 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             }
             : {}),
     };
+    const warnedWorkspaceFingerprints = new Set();
+    let trustProjectRequestAvailable = cli.trustProject;
+    const authorizeWorkspaceExecutables = async (automaticSettings, automaticMcp, runtimeCwd) => {
+        if (cli.safeMode || simpleMode)
+            return true;
+        const trustRequested = trustProjectRequestAvailable;
+        trustProjectRequestAvailable = false;
+        const inventory = await workspaceTrustInventory({
+            cwd: runtimeCwd,
+            settings: automaticSettings,
+            mcp: automaticMcp,
+        });
+        const assessment = await assessWorkspaceTrust(inventory, claudeStatePath);
+        if (assessment.status !== 'untrusted')
+            return true;
+        let approved = trustRequested;
+        if (!approved && approveWorkspaceTrust) {
+            try {
+                approved = await approveWorkspaceTrust(assessment);
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    (error.name === 'AbortError' || error.name === 'CancellationError'))) {
+                    throw error;
+                }
+                approved = false;
+            }
+        }
+        if (approved) {
+            await persistWorkspaceTrust(assessment, claudeStatePath);
+            return true;
+        }
+        const warningKey = workspaceTrustDecisionKey(assessment);
+        if (!warnedWorkspaceFingerprints.has(warningKey)) {
+            warnedWorkspaceFingerprints.add(warningKey);
+            runtimeEventSink({
+                type: 'warning',
+                message: `Workspace executable resources blocked for ${safeWorkspaceTrustDisplayField(assessment.canonicalPath)}; restart to review them interactively, or rerun with --trust-project to approve the current fingerprint.`,
+            });
+        }
+        return false;
+    };
     const hookConfiguration = async () => {
-        const [settings, pluginResources] = await Promise.all([
+        const [sharedResources, pluginResources] = await Promise.all([
             cli.safeMode || simpleMode
-                ? []
-                : loadNativeSettings({ root: configRoot, cwd }),
+                ? Promise.resolve({ settings: [], mcp: [] })
+                : loadNativeSharedResources({
+                    root: configRoot,
+                    cwd,
+                    environment: runtimeEnvironment,
+                    includeProjectMemory: false,
+                }),
             loadClaudePlugins({
                 configRoot,
                 cwd,
@@ -983,13 +1046,20 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                 pluginUrls: cli.pluginUrls,
                 strictPluginDirectories: cli.pluginDirectories.length + cli.pluginUrls.length > 0,
                 loadInstalled: !cli.safeMode && !simpleMode,
-                readOnlyHooks: true,
+                readOnlyExecutables: true,
                 environment: runtimeEnvironment,
             }),
         ]);
-        return projectTuiHooks([
-            ...settings,
+        const automaticSettings = [
+            ...sharedResources.settings,
             ...pluginResources.settings,
+        ];
+        const automaticMcp = cli.strictMcpConfig
+            ? []
+            : [...sharedResources.mcp, ...pluginResources.mcp];
+        const trusted = await authorizeWorkspaceExecutables(automaticSettings, automaticMcp, cwd);
+        return projectTuiHooks([
+            ...allowedWorkspaceHookSettings(automaticSettings, trusted),
             ...(cli.additionalSettings ? [cli.additionalSettings] : []),
         ]);
     };
@@ -1001,7 +1071,10 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const service = new ClaudeSessionService(options);
         if (!interactive)
             return service;
-        return Object.assign(service, { hookConfiguration });
+        const initialHookConfiguration = await hookConfiguration();
+        return Object.assign(service, {
+            hookConfiguration: () => Promise.resolve(initialHookConfiguration),
+        });
     }
     const toolProvider = provider ?? {
         model: 'praxis/provider',
@@ -1034,7 +1107,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
     const baseSettings = nativeSharedResourcesEnabled
         ? await loadNativeSettings({ root: configRoot, cwd })
         : [];
-    const pluginResources = await loadClaudePlugins({
+    const pluginLoadOptions = {
         configRoot,
         cwd,
         pluginDirectories: cli.pluginDirectories,
@@ -1042,6 +1115,10 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         strictPluginDirectories: cli.pluginDirectories.length + cli.pluginUrls.length > 0,
         loadInstalled: !cli.safeMode && !simpleMode,
         environment: runtimeEnvironment,
+    };
+    const executablePluginResources = await loadClaudePlugins({
+        ...pluginLoadOptions,
+        readOnlyExecutables: true,
     });
     const projectMemoryPolicy = cli.safeMode || simpleMode
         ? { enabled: false, extraction: false, recall: false }
@@ -1049,7 +1126,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             dataPlane,
             settings: [
                 ...baseSettings,
-                ...pluginResources.settings,
+                ...executablePluginResources.settings,
                 ...(cli.additionalSettings ? [cli.additionalSettings] : []),
             ],
             environment: runtimeEnvironment,
@@ -1071,7 +1148,42 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             settings: [],
             mcp: [],
         };
-    const settings = [
+    const trustSettings = [
+        ...loadedResources.settings,
+        ...executablePluginResources.settings,
+    ];
+    const trustMcp = cli.strictMcpConfig
+        ? []
+        : [...loadedResources.mcp, ...executablePluginResources.mcp];
+    const workspaceExecutablesTrusted = await authorizeWorkspaceExecutables(trustSettings, trustMcp, cwd);
+    const loadedPluginResources = await loadClaudePlugins({
+        ...pluginLoadOptions,
+        allowWorkspaceMcpb: workspaceExecutablesTrusted,
+    });
+    const materializedPluginMcp = new Map(loadedPluginResources.mcp.map((resource) => [resource.path, resource]));
+    const pluginResources = {
+        ...loadedPluginResources,
+        settings: executablePluginResources.settings,
+        mcp: executablePluginResources.mcp.flatMap((resource) => {
+            if (resource.pluginExecutableSource?.kind !== 'mcpb')
+                return [resource];
+            const materialized = materializedPluginMcp.get(resource.path);
+            if (!materialized)
+                return [];
+            if (materialized.pluginExecutableSource?.source !==
+                resource.pluginExecutableSource.source ||
+                materialized.pluginExecutableSource.fingerprint !==
+                    resource.pluginExecutableSource.fingerprint) {
+                runtimeEventSink({
+                    type: 'warning',
+                    message: `Workspace MCPB source changed during trust preflight and was blocked: ${safeWorkspaceTrustDisplayField(resource.path)}. Restart to review the new fingerprint.`,
+                });
+                return [];
+            }
+            return [materialized];
+        }),
+    };
+    const allSettings = [
         ...loadedResources.settings,
         ...pluginResources.settings,
         ...(cli.additionalSettings ? [cli.additionalSettings] : []),
@@ -1084,7 +1196,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             });
         }
     }
-    const configuredAgent = [...settings]
+    const configuredAgent = [...allSettings]
         .reverse()
         .map((resource) => resource.value &&
         typeof resource.value === 'object' &&
@@ -1093,6 +1205,21 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         : undefined)
         .find((value) => typeof value === 'string' && value.length > 0);
     const selectedMainAgent = agent ?? configuredAgent;
+    const automaticSettings = [
+        ...loadedResources.settings,
+        ...pluginResources.settings,
+    ];
+    const automaticMcp = cli.strictMcpConfig
+        ? []
+        : [...loadedResources.mcp, ...pluginResources.mcp];
+    const hookSettings = [
+        ...allowedWorkspaceHookSettings(automaticSettings, workspaceExecutablesTrusted),
+        ...(cli.additionalSettings ? [cli.additionalSettings] : []),
+    ];
+    const executableMcp = [
+        ...allowedWorkspaceMcpResources(automaticMcp, workspaceExecutablesTrusted),
+        ...cli.mcpResources,
+    ];
     const resources = {
         ...loadedResources,
         commands: [...loadedResources.commands, ...pluginResources.commands],
@@ -1102,10 +1229,8 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             ...pluginResources.agents,
             ...cli.inlineAgents,
         ],
-        settings,
-        mcp: cli.strictMcpConfig
-            ? cli.mcpResources
-            : [...loadedResources.mcp, ...pluginResources.mcp, ...cli.mcpResources],
+        settings: allSettings,
+        mcp: executableMcp,
     };
     const extensions = new ClaudeExtensionCatalog(resources, {
         disableSlashCommands: cli.disableSlashCommands,
@@ -1174,7 +1299,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...(exposePlanDirectory ? [resolve(configRoot, 'plans')] : []),
     ];
     const sandboxSettings = loadClaudeSandboxSettings({
-        resources: settings.filter((resource) => resource.plugin !== true),
+        resources: allSettings.filter((resource) => resource.plugin !== true),
         cwd: workspace.cwd(),
         originalCwd: sandboxOriginalCwd ?? workspace.cwd(),
         configRoot,
@@ -1200,7 +1325,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         cwd,
         cwdProvider: () => workspace.cwd(),
         configRoot,
-        settings,
+        settings: allSettings,
         allowedTools: cli.allowedTools,
         disallowedTools: cli.disallowedTools,
         additionalDirectories: permissionAdditionalDirectories,
@@ -1275,9 +1400,14 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                     settings: [],
                     mcp: [],
                 };
+            const refreshedSettings = [
+                ...refreshed.settings,
+                ...pluginResources.settings,
+            ];
+            const refreshedMcp = [...refreshed.mcp, ...pluginResources.mcp];
+            const trusted = await authorizeWorkspaceExecutables(refreshedSettings, refreshedMcp, workspace.cwd());
             return runtimeMcpResources([
-                ...refreshed.mcp,
-                ...pluginResources.mcp,
+                ...allowedWorkspaceMcpResources(refreshedMcp, trusted),
                 ...cli.mcpResources,
             ]);
         },
@@ -1439,7 +1569,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const hooks = cli.safeMode || simpleMode
             ? undefined
             : new ClaudeHookRunner({
-                settings,
+                settings: hookSettings,
                 cwd,
                 onEvent: (event) => runtimeEventSink({ type: 'hook', event }),
                 sessionEnvironment: hookSessionEnvironment,
@@ -1771,7 +1901,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                     ? {}
                     : { progressMessage: definition.progressMessage }),
             })),
-            hookConfiguration: async () => projectTuiHooks(settings),
+            hookConfiguration: async () => projectTuiHooks(hookSettings),
             mcpInspect: () => service.mcpInspect(),
             mcpReconnect: (name) => service.mcpReconnect(name),
             mcpAuthenticate: (name) => service.mcpAuthenticate(name),
@@ -2051,6 +2181,14 @@ export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta
         runInteractive: async ({ agent, controls, initialPrompt, resume, signal, }) => {
             const { runInteractive } = await import('./cli/interactive.js');
             const interactiveControls = controls ?? DEFAULT_CLI_CONTROLS;
+            let workspaceTrustPreflightOpen = true;
+            const cachedWorkspaceTrustDecision = createWorkspaceTrustDecisionCache((request) => promptWorkspaceTrust(request, {
+                output: (text) => process.stderr.write(text),
+                ...(signal ? { signal } : {}),
+            }));
+            const approveInteractiveWorkspaceTrust = (request) => workspaceTrustPreflightOpen
+                ? cachedWorkspaceTrustDecision(request)
+                : Promise.resolve(false);
             const initialAdditionalDirectories = interactiveControls.addDirectories.map((directory) => realpathSync(resolve(process.cwd(), directory)));
             const interactiveDataPlane = interactiveControls.dataPlane ?? resolveDataPlane();
             const { configRoot: interactiveConfigRoot, statePath: interactiveStatePath, } = resolveInteractiveRuntimeSettingsLocation(interactiveDataPlane);
@@ -2079,11 +2217,14 @@ export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta
                     ...(agent === undefined ? {} : { agent }),
                     controls: {
                         ...interactiveControls,
+                        trustProject: workspaceTrustPreflightOpen && interactiveControls.trustProject,
                         addDirectories: options.additionalDirectories ??
                             interactiveControls.addDirectories,
                     },
                     interactive: true,
+                    approveWorkspaceTrust: approveInteractiveWorkspaceTrust,
                 });
+                workspaceTrustPreflightOpen = false;
                 if (resumePath !== undefined) {
                     await commands.registerResumePath?.(resumePath);
                 }
@@ -3491,7 +3632,7 @@ async function executeMcpCommand(args, invocation, io, dependencies, signal) {
             writeError: (message) => io.stderr(message),
             createToolRegistry: async () => {
                 const service = await dependencies.createService({
-                    eventSink: () => undefined,
+                    eventSink: warningEventSink(io),
                     requireProvider: false,
                     exposeToolRegistry: true,
                     approveTool: async () => true,
@@ -4273,7 +4414,7 @@ async function executeTeamCommand(args, io, dependencies, signal) {
         dataPlane: 'native',
     };
     const service = await dependencies.createService({
-        eventSink: () => undefined,
+        eventSink: warningEventSink(io),
         requireProvider: !['list', 'status', 'logs', 'attach'].includes(parsed.command),
         exposeToolRegistry: true,
         controls: nativeControls,
@@ -4594,7 +4735,7 @@ async function execute(argv, io, dependencies, signal) {
     }
     if (invocation.initOnly) {
         const lifecycleService = await dependencies.createService({
-            eventSink: () => undefined,
+            eventSink: warningEventSink(io),
             requireProvider: false,
             exposeToolRegistry: true,
             ...(signal ? { signal } : {}),

package/dist/core/resources.d.ts

@@ -13,6 +13,11 @@ export interface JsonResource {
     plugin?: true;
     pluginName?: string;
     pluginSource?: string;
+    pluginExecutableSource?: {
+        kind: 'mcpb';
+        source: string;
+        fingerprint: string;
+    };
     environment?: Readonly<Record<string, string>>;
     sensitiveValues?: readonly string[];
 }

package/dist/plugins/claude-plugin-mcpb.d.ts

@@ -1,4 +1,5 @@
 import { type DataPlane } from '../persistence/data-plane.js';
+export declare const CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES: number;
 export type ClaudePluginMcpbUserValue = string | number | boolean | readonly string[];
 export interface ClaudePluginMcpbManifest {
     manifest_version: string;
@@ -60,6 +61,7 @@ export interface LoadClaudePluginMcpbOptions {
     signal?: AbortSignal;
     timeoutMs?: number;
     refresh?: boolean;
+    requireHttps?: boolean;
     limits?: ClaudePluginMcpbLimits;
     fetch?: typeof fetch;
 }

package/dist/plugins/claude-plugin-mcpb.js

@@ -13,6 +13,7 @@ import manifestSchemaV04 from './mcpb-schemas/mcpb-manifest-v0.4.schema.json' wi
 import { ExclusiveFileLease, } from '../platform/exclusive-file-lease.js';
 import { resolveDataPlaneRoot, } from '../persistence/data-plane.js';
 const DEFAULT_ARCHIVE_BYTES = 512 * 1024 * 1024;
+export const CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES = DEFAULT_ARCHIVE_BYTES;
 const DEFAULT_EXTRACTED_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_FILE_BYTES = 512 * 1024 * 1024;
 const DEFAULT_FILES = 100_000;
@@ -540,9 +541,14 @@ async function fetchArchive(source, cached, options, signal, archiveLimit) {
                 throw new Error('MCPB download redirect is missing Location');
             }
             const redirected = new URL(location, requestUrl);
-            if (redirected.protocol !== 'http:' && redirected.protocol !== 'https:') {
+            if ((options.requireHttps && redirected.protocol !== 'https:') ||
+                (!options.requireHttps &&
+                    redirected.protocol !== 'http:' &&
+                    redirected.protocol !== 'https:')) {
                 await response.body?.cancel();
-                throw new Error('MCPB download redirect must use HTTP or HTTPS');
+                throw new Error(options.requireHttps
+                    ? 'MCPB download redirect must use HTTPS'
+                    : 'MCPB download redirect must use HTTP or HTTPS');
             }
             await response.body?.cancel();
             if (++redirects > 5) {
@@ -627,6 +633,9 @@ async function resolveMcpbSource(options, signal) {
     const pluginRoot = await realpath(resolve(options.pluginRoot));
     signal.throwIfAborted();
     const remote = /^https?:\/\//u.test(options.source);
+    if (options.requireHttps && remote && !/^https:\/\//u.test(options.source)) {
+        throw new Error('MCPB download source must use HTTPS');
+    }
     if (!remote && /^[a-z][a-z0-9+.-]*:\/\//iu.test(options.source))
         throw new Error('MCPB source URL must use HTTP or HTTPS');
     if (!['.mcpb', '.dxt'].some((extension) => options.source.endsWith(extension))) {

package/dist/plugins/claude-plugin-runtime.d.ts

@@ -108,6 +108,8 @@ export declare function loadClaudePlugins(options: {
     pluginUrls?: readonly string[];
     loadInstalled?: boolean;
     readOnlyHooks?: boolean;
+    readOnlyExecutables?: boolean;
+    allowWorkspaceMcpb?: boolean;
     environment?: Readonly<Record<string, string | undefined>>;
 }): Promise<ClaudePluginResources>;
 export declare function validateClaudePlugin(path: string, options?: {