reeval 0.11.0 → 0.13.0

package/dist/{egress-2-qzPvGi.js → egress-DEAvq8Fl.js}

@@ -1,11 +1,13 @@
 import { n as UsageError } from "./errors-B6BSMs03.js";
-import { w as plannedSecrets } from "./environment-Cca6a4wB.js";
-import { a as providerServedModel, i as providerModelResponses, n as providerEndpoints, r as providerHosts, s as resolveOpenCodeProvider } from "./opencode-providers-J9colP0-.js";
+import { w as plannedSecrets } from "./environment-B4IuURK1.js";
+import { F as HARNESS_HOSTS, I as PACKAGE_HOSTS, P as DOCKER_EGRESS, dt as shellQuote, ut as run } from "./src-CIpKL45U.js";
+import { D as pluginServerName, a as PLUGIN_PARTS, n as PLUGIN_DIR, r as PLUGIN_MANIFEST, t as PART_PATHS, y as localPluginServers } from "./plugins-P-uh54VF.js";
+import { a as providerServedModel, i as providerModelResponses, n as providerEndpoints, r as providerHosts, s as resolveOpenCodeProvider } from "./opencode-providers-snfeWd6Z.js";
 import { t as InfraError } from "./types-C5vI3g1C.js";
-import { D as HARNESS_HOSTS, E as DOCKER_EGRESS, O as PACKAGE_HOSTS, nt as shellQuote, tt as run } from "./src-ftu5wPSt.js";
 import { existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, win32 } from "node:path";
+import { isIP } from "node:net";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
@@ -164,8 +166,20 @@ function opencodeMcpServers(servers) {
 		}];
 	}));
 }
+/**
+* The key Goose keeps an extension by (its `name_to_key`): whitespace dropped, anything but ASCII
+* letters, digits, `_` and `-` made `_`, lower-cased. Of two extensions with one key it keeps one.
+*/
+const gooseKey = (name) => name.replace(/\s/g, "").replace(/[^A-Za-z0-9_-]/g, "_").toLowerCase();
 /** Goose's extension shape (its `config.yaml`); it has no SSE transport. */
 function gooseMcpServers(servers) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const name of Object.keys(servers)) {
+		const key = gooseKey(name);
+		const other = byKey.get(key);
+		if (other !== void 0) throw new InfraError(`Goose keys the ${other} and ${name} MCP servers both as ${key}, and keeps only one: rename one`);
+		byKey.set(key, name);
+	}
 	return Object.fromEntries(Object.entries(servers).map(([name, s]) => {
 		if (s.transport === "sse") throw new InfraError(`Goose has no SSE MCP transport, so it can't use the ${name} server (mcp.sse): use mcp.http or mcp.stdio`);
 		return s.transport === "stdio" ? [name, {
@@ -183,11 +197,18 @@ function gooseMcpServers(servers) {
 /**
 * pi's `mcp.json` shape, which the adapter escapes and sets `"exposure": "direct"` on. pi
 * skips a server whose name isn't letters, digits, `_` and `-`, so the plan refuses it instead.
+* A plugin's server, `<plugin>:<server>`, is named `<plugin>_<server>`, so its tools are
+* `mcp__<plugin>_<server>__<tool>`.
 */
 function piMcpServers(servers) {
-	return Object.fromEntries(Object.entries(servers).map(([name, s]) => {
-		if (!/^[A-Za-z0-9_-]+$/.test(name)) throw new InfraError(`pi takes MCP server names of letters, digits, "_" and "-" only, so it can't use the ${name} server: rename it`);
-		if (s.transport === "sse") throw new InfraError(`pi has no SSE MCP transport, so it can't use the ${name} server (mcp.sse): use mcp.http or mcp.stdio`);
+	const named = /* @__PURE__ */ new Map();
+	return Object.fromEntries(Object.entries(servers).map(([key, s]) => {
+		const name = /^[a-z0-9-]+:[^:]+$/.test(key) ? key.replace(":", "_") : key;
+		if (!/^[A-Za-z0-9_-]+$/.test(name)) throw new InfraError(`pi takes MCP server names of letters, digits, "_" and "-" only, so it can't use the ${key} server: rename it`);
+		const other = named.get(name);
+		if (other) throw new InfraError(`pi names the ${key} MCP server ${name}, as it does the ${other} server, and keeps only one: rename one`);
+		named.set(name, key);
+		if (s.transport === "sse") throw new InfraError(`pi has no SSE MCP transport, so it can't use the ${key} server (mcp.sse): use mcp.http or mcp.stdio`);
 		return s.transport === "stdio" ? [name, {
 			command: s.command,
 			args: s.args,
@@ -270,58 +291,236 @@ function cursorMcpServers(servers) {
 		headers: s.headers
 	}]));
 }
+/** Claude Code's hook events as Cursor names them, as the Cursor SDK converts Claude Code's own. */
+const CURSOR_HOOK_EVENTS = {
+	SessionStart: "sessionStart",
+	SessionEnd: "sessionEnd",
+	UserPromptSubmit: "beforeSubmitPrompt",
+	PreToolUse: "preToolUse",
+	PostToolUse: "postToolUse",
+	SubagentStop: "subagentStop",
+	PreCompact: "preCompact",
+	Stop: "stop"
+};
+/** Claude Code's tool names as Cursor's hooks match them; null for one Cursor has no tool for. */
+const CURSOR_HOOK_TOOLS = {
+	Bash: "Shell",
+	Read: "Read",
+	Write: "Write",
+	Edit: "Write",
+	Glob: null,
+	Grep: "Grep",
+	WebFetch: "WebFetch",
+	WebSearch: "WebSearch",
+	Task: "Task"
+};
+/**
+* A Claude Code hook group's tool matcher as Cursor's, on the tool events only: each name mapped,
+* `mcp__<server>__<tool>` as `MCP:<tool>`; null when it names only tools Cursor lacks.
+*/
+function cursorHookMatcher(event, matcher) {
+	if (event !== "PreToolUse" && event !== "PostToolUse") return void 0;
+	if (!matcher || matcher === "*") return void 0;
+	const out = [];
+	for (const raw of matcher.split("|")) {
+		const name = raw.trim();
+		const parts = name.split("__");
+		const tool = name.startsWith("mcp__") && parts.length >= 3 ? `MCP:${parts.slice(2).join("__")}` : CURSOR_HOOK_TOOLS[name] === void 0 ? name : CURSOR_HOOK_TOOLS[name];
+		if (tool && !out.includes(tool)) out.push(tool);
+	}
+	return out.length ? out.join("|") : null;
+}
+/** Where Cursor reads what reeval unpacks from a plugin, in the workspace (settingSources `project`). */
+const CURSOR_PLUGIN_UNPACK = {
+	rules: ".cursor/rules",
+	agents: ".cursor/agents",
+	commands: ".cursor/commands",
+	hooks: {
+		file: ".cursor/hooks.json",
+		events: CURSOR_HOOK_EVENTS,
+		matcher: cursorHookMatcher
+	}
+};
+/**
+* A plugin subagent's or command's frontmatter as OpenCode 2 takes it: the description, and a
+* subagent's `mode`. OpenCode skips a file whose frontmatter its schema refuses, without saying,
+* and Claude Code's `tools: Read, Grep`, `model: sonnet` and `allowed-tools` are such keys.
+*/
+function opencodeFrontmatter(part, front) {
+	const d = front.description;
+	const description = typeof d === "string" || typeof d === "number" || typeof d === "boolean" ? String(d) : void 0;
+	return {
+		...description ? { description } : {},
+		...part === "agents" ? { mode: "subagent" } : {}
+	};
+}
+/** Where OpenCode reads plugin subagents and commands, in the workspace's config directory. */
+const OPENCODE_PLUGIN_UNPACK = {
+	agents: ".opencode/agents",
+	commands: ".opencode/commands",
+	frontmatter: opencodeFrontmatter
+};
+/**
+* Where pi reads plugin commands, as prompt templates (`/<name>`), in the workspace, which its
+* `--approve` trusts. Its frontmatter takes `description` and `argument-hint`, and ignores the
+* rest of Claude Code's.
+*/
+const PI_PLUGIN_UNPACK = { commands: ".pi/prompts" };
+/**
+* What Claude Code's plugin format bundles, which Grok Build reads too: every part but rules,
+* which neither loads from a plugin.
+*/
+const CLAUDE_FORMAT_PARTS = PLUGIN_PARTS.filter((p) => p !== "rules");
+/** The marketplace Claude Code's settings name for the session's plugins. */
+const CLAUDE_PLUGIN_MARKETPLACE = "reeval";
+/**
+* Claude Code's settings for the session's plugins: a `directory` marketplace at the directory
+* they were copied to, listing each, and each enabled as `<plugin>@reeval`. Claude Code installs
+* and loads them as it starts, since the bridge leaves every settings source on.
+*/
+function claudePluginFiles(plugins) {
+	const [first] = plugins;
+	if (!first) return [];
+	const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+	const marketplace = {
+		name: CLAUDE_PLUGIN_MARKETPLACE,
+		owner: { name: "reeval" },
+		plugins: plugins.map((p) => ({
+			name: p.name,
+			source: `./${p.name}`
+		}))
+	};
+	const settings = {
+		extraKnownMarketplaces: { [CLAUDE_PLUGIN_MARKETPLACE]: { source: {
+			source: "directory",
+			path: first.dir.slice(0, first.dir.lastIndexOf("/"))
+		} } },
+		enabledPlugins: Object.fromEntries(plugins.map((p) => [`${p.name}@${CLAUDE_PLUGIN_MARKETPLACE}`, true]))
+	};
+	return [{
+		path: `${PLUGIN_DIR}/.claude-plugin/marketplace.json`,
+		content: json(marketplace)
+	}, {
+		path: "~/.claude/settings.json",
+		content: json(settings),
+		merge: true
+	}];
+}
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/**
+* Writes the layout's plugin files into the sandbox and returns their paths. A `merge` file's keys
+* go into the JSON object already at its path (an object-valued key merged one level down), so
+* settings an environment's `files` wrote there stay.
+*/
+async function writePluginFiles(sandbox, layout, plugins) {
+	const written = [];
+	for (const f of layout.pluginFiles?.(plugins) ?? []) {
+		const existing = f.merge ? await sandbox.readFile(f.path) : null;
+		let content = f.content;
+		if (existing?.trim()) {
+			let base;
+			try {
+				base = JSON.parse(existing);
+			} catch {}
+			if (!isObject(base)) throw new InfraError(`${f.path} isn't a JSON object, so reeval can't enable the session's plugins in it: write it as one in files, or leave it out`);
+			const ours = JSON.parse(f.content);
+			const merged = { ...base };
+			for (const [k, v] of Object.entries(ours)) {
+				const was = base[k];
+				merged[k] = isObject(v) && isObject(was) ? {
+					...was,
+					...v
+				} : v;
+			}
+			content = `${JSON.stringify(merged, null, 2)}\n`;
+		}
+		await sandbox.writeFile(f.path, content);
+		written.push(f.path);
+	}
+	return written;
+}
+/**
+* The MCP servers the agent is given: all of them, less the plugins' own where it takes plugin
+* items namespaced, since it loads those from the plugin and would otherwise start each twice.
+*/
+function agentMcp(layout, mcp, plugins) {
+	if (layout.pluginPlacement !== "namespaced") return mcp;
+	const own = new Set(plugins.flatMap((p) => p.servers));
+	return Object.fromEntries(Object.entries(mcp).filter(([name]) => !own.has(name)));
+}
 /** Where each agent with an image reads rules and skills. */
 const LAYOUTS = {
 	cursor: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".cursor/skills",
-		harnessSkillDir: ".agents/skills"
+		harnessSkillDir: ".agents/skills",
+		pluginPlacement: "flat",
+		pluginUnpack: CURSOR_PLUGIN_UNPACK,
+		pluginHookEvents: Object.keys(CURSOR_HOOK_EVENTS)
 	},
 	"claude-code": {
 		rulesFile: "CLAUDE.md",
 		workspaceSkillDir: ".claude/skills",
-		harnessSkillDir: ".claude/skills"
+		harnessSkillDir: ".claude/skills",
+		pluginPlacement: "namespaced",
+		pluginFiles: claudePluginFiles
 	},
 	antigravity: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".agents/skills",
-		harnessSkillDir: ".gemini/config/skills"
+		harnessSkillDir: ".gemini/config/skills",
+		pluginPlacement: "namespaced",
+		pluginHookEvents: [
+			"SessionStart",
+			"PreToolUse",
+			"PostToolUse",
+			"Stop"
+		]
 	},
 	opencode: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".opencode/skills",
-		harnessSkillDir: ".config/opencode/skills"
+		harnessSkillDir: ".config/opencode/skills",
+		pluginPlacement: "flat",
+		pluginUnpack: OPENCODE_PLUGIN_UNPACK
 	},
 	goose: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".goose/skills",
-		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/goose/implementation/home/.config/goose/skills"
+		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/goose/implementation/home/.config/goose/skills",
+		pluginPlacement: "flat"
 	},
 	pi: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".pi/skills",
-		harnessSkillDir: ".pi/agent/skills"
+		harnessSkillDir: ".pi/agent/skills",
+		pluginPlacement: "flat",
+		pluginUnpack: PI_PLUGIN_UNPACK
 	},
 	codex: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".agents/skills",
-		harnessSkillDir: ".agents/skills"
+		harnessSkillDir: ".agents/skills",
+		pluginPlacement: "namespaced"
 	},
 	fx: {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".fx/skills",
-		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/fx/implementation/home/.fx/skills"
+		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/fx/implementation/home/.fx/skills",
+		pluginPlacement: "flat"
 	},
 	"grok-build": {
 		rulesFile: "AGENTS.md",
 		workspaceSkillDir: ".grok/skills",
-		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/grok-build/implementation/home/.grok/skills"
+		harnessSkillDir: ".ai-sdk-harness/.harness-bootstrap/grok-build/implementation/home/.grok/skills",
+		pluginPlacement: "namespaced"
 	}
 };
 /** Every real agent reeval can drive, by harness kind. */
 const AGENTS = {
 	cursor: {
 		...LAYOUTS.cursor,
+		pluginParts: PLUGIN_PARTS,
 		name: "Cursor",
 		factory: "cursor",
 		credential: "CURSOR_API_KEY",
@@ -333,7 +532,7 @@ const AGENTS = {
 		},
 		unreported: cursorUnreported,
 		mcpServers: cursorMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-WD-zgQYZ.js")).createCursorSdk({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-DrJSnoMR.js")).createCursorSdk({
 			auth,
 			...mcpServers ? { mcpServers } : {},
 			...descriptor.kind === "cursor" && descriptor.params ? { modelParams: descriptor.params } : {},
@@ -343,6 +542,7 @@ const AGENTS = {
 	},
 	"claude-code": {
 		...LAYOUTS["claude-code"],
+		pluginParts: CLAUDE_FORMAT_PARTS,
 		name: "Claude Code",
 		factory: "claudeCode",
 		credential: "ANTHROPIC_API_KEY",
@@ -369,7 +569,7 @@ const AGENTS = {
 			}
 		],
 		mcpServers: claudeMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./dist-CuY4ehEk.js")).createClaudeCode({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./dist-Dp_AJgYN.js")).createClaudeCode({
 			auth,
 			...mcpServers ? { mcpServers } : {},
 			...descriptor.kind === "claude-code" && descriptor.effort ? { effort: descriptor.effort } : {},
@@ -381,6 +581,13 @@ const AGENTS = {
 	},
 	antigravity: {
 		...LAYOUTS.antigravity,
+		pluginParts: PLUGIN_PARTS,
+		pluginManifestsFirst: [
+			"plugin.json",
+			".antigravity-plugin/plugin.json",
+			".gemini-plugin/plugin.json",
+			"gemini-extension.json"
+		],
 		name: "Antigravity",
 		factory: "antigravity",
 		credential: "GEMINI_API_KEY",
@@ -391,15 +598,25 @@ const AGENTS = {
 		},
 		servedModel: geminiServedModel,
 		mcpServers: antigravityMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-_oI9AePb.js")).createAntigravity({
+		adapter: async ({ auth, mcpServers, descriptor, plugins }) => (await import("./src-BAyg6CtQ.js")).createAntigravity({
 			auth,
 			...mcpServers ? { mcpServers } : {},
+			...plugins.length ? { plugins: plugins.map(({ name, dir }) => ({
+				name,
+				dir
+			})) } : {},
 			...descriptor.kind === "antigravity" && descriptor.effort ? { effort: descriptor.effort } : {},
 			requireCredentialBrokering: true
 		})
 	},
 	opencode: {
 		...LAYOUTS.opencode,
+		pluginParts: [
+			"skills",
+			"agents",
+			"commands",
+			"mcp"
+		],
 		name: "OpenCode",
 		factory: "opencode",
 		credential: "GOOGLE_GENERATIVE_AI_API_KEY",
@@ -407,7 +624,7 @@ const AGENTS = {
 		servedModel: geminiServedModel,
 		forModel: opencodeForModel,
 		mcpServers: opencodeMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-CLoOMVWI.js")).createOpenCode({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-B3KCLZVk.js")).createOpenCode({
 			auth,
 			model: descriptor.model,
 			vars: opencodeVars(descriptor.model),
@@ -418,13 +635,18 @@ const AGENTS = {
 	},
 	goose: {
 		...LAYOUTS.goose,
+		pluginParts: ["skills", "mcp"],
 		name: "Goose",
 		factory: "goose",
 		credential: "GOOGLE_GENERATIVE_AI_API_KEY",
 		endpoints: GOOSE_ENDPOINTS,
+		expectedBlocked: {
+			hosts: ["models.dev"],
+			why: "Goose's model catalogue refresh, which no setting turns off"
+		},
 		servedModel: geminiServedModel,
 		mcpServers: gooseMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-qsKCqv7a.js")).createGoose({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-dhSTRN50.js")).createGoose({
 			auth: { GOOGLE_API_KEY: auth.GOOGLE_GENERATIVE_AI_API_KEY ?? "" },
 			model: descriptor.model,
 			...descriptor.kind === "goose" && descriptor.effort ? { effort: descriptor.effort } : {},
@@ -434,13 +656,18 @@ const AGENTS = {
 	},
 	pi: {
 		...LAYOUTS.pi,
+		pluginParts: [
+			"skills",
+			"commands",
+			"mcp"
+		],
 		name: "pi",
 		factory: "pi",
 		credential: "GOOGLE_GENERATIVE_AI_API_KEY",
 		endpoints: GEMINI_ENDPOINTS,
 		servedModel: geminiServedModel,
 		mcpServers: piMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-DSYYPEOj.js")).createPi({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-BezgGX4X.js")).createPi({
 			auth: { GEMINI_API_KEY: auth.GOOGLE_GENERATIVE_AI_API_KEY ?? "" },
 			...descriptor.kind === "pi" && descriptor.effort ? { effort: descriptor.effort } : {},
 			...mcpServers ? { mcpServers } : {},
@@ -449,28 +676,47 @@ const AGENTS = {
 	},
 	codex: {
 		...LAYOUTS.codex,
+		pluginParts: ["skills", "mcp"],
+		pluginApps: "they need a ChatGPT login",
+		pluginManifestsFirst: ["plugin.json", ".codex-plugin/plugin.json"],
+		pluginRootManifestNeedsSchema: true,
+		pluginServersByName: true,
 		name: "Codex",
 		factory: "codex",
 		credential: "OPENAI_API_KEY",
 		endpoints: OPENAI_ENDPOINTS,
 		modelResponses: OPENAI_ENDPOINTS,
+		expectedBlocked: {
+			hosts: [
+				"github.com",
+				"api.github.com",
+				"chatgpt.com"
+			],
+			why: "Codex's plugin sync, which it runs on every turn once plugins are on",
+			withPlugins: true
+		},
 		servedModel: openaiServedModel,
 		mcpServers: codexMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-DCFtJRp0.js")).createCodex({
+		adapter: async ({ auth, mcpServers, descriptor, plugins }) => (await import("./src-ChBhk06Q.js")).createCodex({
 			auth,
 			...descriptor.kind === "codex" && descriptor.effort ? { effort: descriptor.effort } : {},
 			...mcpServers ? { mcpServers } : {},
+			...plugins.length ? { plugins: plugins.map(({ name, dir }) => ({
+				name,
+				dir
+			})) } : {},
 			requireCredentialBrokering: true
 		})
 	},
 	fx: {
 		...LAYOUTS.fx,
+		pluginParts: ["skills", "mcp"],
 		name: "fx",
 		factory: "fx",
 		...fxForModel("provider/model"),
 		forModel: fxForModel,
 		mcpServers: acpMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-BxfCKA3_.js")).createFx({
+		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-CoqZYspK.js")).createFx({
 			auth,
 			model: descriptor.model,
 			...mcpServers ? { mcpServers } : {},
@@ -479,6 +725,8 @@ const AGENTS = {
 	},
 	"grok-build": {
 		...LAYOUTS["grok-build"],
+		pluginParts: CLAUDE_FORMAT_PARTS,
+		pluginServersByName: true,
 		name: "Grok Build",
 		factory: "grokBuild",
 		credential: "XAI_API_KEY",
@@ -486,9 +734,13 @@ const AGENTS = {
 		modelResponses: XAI_MODEL_RESPONSES,
 		servedModel: xaiServedModel,
 		mcpServers: acpMcpServers,
-		adapter: async ({ auth, mcpServers, descriptor }) => (await import("./src-CcrQbpG8.js")).createGrokBuild({
+		adapter: async ({ auth, mcpServers, descriptor, plugins }) => (await import("./src-3mP821Pt.js")).createGrokBuild({
 			auth,
 			model: descriptor.model,
+			...plugins.length ? {
+				pluginDirs: plugins.map((p) => p.dir),
+				pluginMcpServers: plugins.flatMap((p) => p.servers.map((s) => s.slice(p.name.length + 1)))
+			} : {},
 			...descriptor.kind === "grok-build" && descriptor.effort ? { effort: descriptor.effort } : {},
 			...mcpServers ? { mcpServers } : {},
 			requireCredentialBrokering: true
@@ -527,6 +779,139 @@ function refusedMcp(harness, layers) {
 		throw error;
 	}
 }
+/** The first host variable a plugin MCP server reads (`${VAR}`), as `VAR`; undefined for none. */
+function hostVariable(s) {
+	const values = Object.entries(s.transport === "stdio" ? s.env : s.headers);
+	for (const [key, v] of values) {
+		if (typeof v === "string") continue;
+		if (v.kind === "secret") return v.from ?? key;
+		return /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/.exec(v.template)?.[1] ?? key;
+	}
+}
+const quoted = (parts) => parts.map((p) => `'${p}'`).join(", ");
+/**
+* Why a harness's agent can't take the plugins, in the agent's own words: a part it doesn't
+* load, apps it can't take (`pluginApps`), a hook event or type it doesn't run, a plugin MCP
+* server it refuses (named `<plugin>:<server>`) or whose `<plugin>:<server>` key `mcp` already has,
+* or, where it takes plugin items flat, a skill or MCP server whose name another already has, or a
+* subagent, command or rule another unpacks to the same file. `own` names the
+* environment's own skills and MCP servers, and `unread` the plugins not fetched yet (git and
+* npm ones, at plan time) by their call. Undefined when it can take them.
+*/
+function refusedPlugins(harness, plugins, own, unread = []) {
+	if (plugins.length === 0 && unread.length === 0) return void 0;
+	const agent = isAgentKind(harness.kind) ? AGENTS[harness.kind] : void 0;
+	const mimics = harness.kind === "fake" && harness.layout ? AGENTS[harness.layout] : void 0;
+	const loads = (agent ?? mimics)?.pluginParts ?? PLUGIN_PARTS;
+	const name = agent?.name ?? (mimics ? `The fake agent with ${mimics.name}'s layout` : "The fake agent");
+	if (loads.length === 0) return `${name} can't load plugins yet: leave ${plugins[0] ? `the ${plugins[0].name} plugin` : unread[0]} out of this cell`;
+	for (const p of plugins) {
+		const refused = p.kept.filter((part) => !loads.includes(part));
+		if (refused.length === 0) continue;
+		const can = p.kept.filter((part) => loads.includes(part));
+		const what = refused.map((part) => `${part} (${PART_PATHS[part]})`).join(" and ");
+		const fix = can.length ? `use only: [${quoted(can)}], or leave` : "leave";
+		return `${name} can't load the ${p.name} plugin's ${what}: ${fix} the plugin out of this cell`;
+	}
+	const reads = agent ?? mimics;
+	const first = reads?.pluginManifestsFirst ?? [];
+	for (const p of plugins) {
+		const other = p.manifests.find((m) => first.includes(m) && (m !== "plugin.json" || !reads?.pluginRootManifestNeedsSchema || p.rootSchema));
+		if (other) return `${name} reads the ${p.name} plugin's ${other} in place of its ${PLUGIN_MANIFEST}, so reeval can't hold it to the parts it places: remove ${other} from the plugin, or leave the plugin out of this cell`;
+	}
+	const apps = (agent ?? mimics)?.pluginApps;
+	const withApps = apps ? plugins.find((p) => p.apps) : void 0;
+	if (withApps) return `${name} can't load the ${withApps.name} plugin's apps: ${apps}`;
+	const layout = layoutOf(harness);
+	const runs = layout.pluginHookEvents;
+	for (const p of runs ? plugins : []) {
+		const event = p.hooks.events.find((e) => !runs?.includes(e));
+		const type = p.hooks.otherTypes[0];
+		if (!event && !type) continue;
+		const rest = p.kept.filter((part) => part !== "hooks");
+		const fix = rest.length ? `use only: [${quoted(rest)}], or leave` : "leave";
+		return event ? `${name} can't run the ${p.name} plugin's ${event} hooks (hooks/hooks.json): it runs ${runs?.join(", ")} hooks; ${fix} the plugin out of this cell` : `${name} can't run the ${p.name} plugin's ${type} hooks (hooks/hooks.json): it runs only command hooks; ${fix} the plugin out of this cell`;
+	}
+	const servers = Object.fromEntries(plugins.flatMap((p) => Object.entries(p.mcp).map(([server, s]) => [pluginServerName(p.name, server), s.transport === "stdio" ? {
+		...s,
+		env: {}
+	} : {
+		...s,
+		headers: {}
+	}])));
+	if (agent && Object.keys(servers).length) {
+		const alongside = agent.pluginPlacement === "flat" ? Object.fromEntries(own.mcp.map((n) => [n, {
+			transport: "stdio",
+			command: "true",
+			args: [],
+			env: {}
+		}])) : {};
+		try {
+			agent.mcpServers({
+				...alongside,
+				...servers
+			});
+		} catch (error) {
+			if (error instanceof InfraError) return error.message;
+			throw error;
+		}
+	}
+	for (const p of plugins) for (const server of Object.keys(p.mcp)) {
+		const key = pluginServerName(p.name, server);
+		if (own.mcp.includes(key)) return `the ${p.name} plugin's MCP server "${server}" would join mcp as ${key}, which mcp already names: rename mcp["${key}"]`;
+	}
+	if (layout.pluginPlacement === "namespaced") {
+		for (const p of plugins) {
+			if (!p.kept.includes("mcp")) continue;
+			for (const [server, s] of Object.entries(p.mcp)) {
+				const secret = hostVariable(s);
+				if (!secret) continue;
+				const rest = p.kept.filter((part) => part !== "mcp");
+				return `${name} loads the ${p.name} plugin's MCP server "${server}" itself, so reeval can't give it ${secret} from the host: use only: [${quoted(rest)}] and declare the server in mcp, where reeval fills it in`;
+			}
+		}
+		if (!(agent ?? mimics)?.pluginServersByName) return void 0;
+		const byName = new Map(own.mcp.map((n) => [n, `mcp.${n}`]));
+		for (const p of plugins) for (const server of Object.keys(p.mcp)) {
+			const other = byName.get(server);
+			if (other) return `${name} names the ${p.name} plugin's MCP server "${server}" by its own name, as it does ${other}, and keeps only one: rename one, or leave mcp out of the plugin with only`;
+			byName.set(server, `the ${p.name} plugin's MCP server "${server}"`);
+		}
+		return;
+	}
+	const serverOwner = new Map(own.mcp.map((n) => [n, `mcp.${n}`]));
+	for (const p of plugins) for (const server of Object.keys(p.mcp)) {
+		const other = serverOwner.get(server);
+		if (other) return `the ${p.name} plugin's MCP server "${server}" clashes with ${other}`;
+		serverOwner.set(server, `the ${p.name} plugin's MCP server "${server}"`);
+	}
+	const skillOwner = new Map(own.skills.map((s) => [s.name, `${s.call}'s "${s.name}"`]));
+	for (const p of plugins) for (const { name: skill } of p.skills) {
+		const other = skillOwner.get(skill);
+		if (other) return `the ${p.name} plugin's skill "${skill}" and ${other} would both be placed at ~/${layout.harnessSkillDir}/${skill}: rename one, or narrow it with only or exclude`;
+		skillOwner.set(skill, `the ${p.name} plugin's skill "${skill}"`);
+	}
+	for (const part of ["agents", "commands"]) {
+		const dir = layout.pluginUnpack?.[part];
+		if (!dir) continue;
+		const owner = /* @__PURE__ */ new Map();
+		for (const p of plugins) for (const item of p[part]) {
+			const other = owner.get(item);
+			const what = part === "agents" ? "subagent" : "command";
+			if (other) return `the ${p.name} plugin's ${what} "${item}" and the ${other} plugin's would both be placed at ${dir}/${item}.md: rename one, or narrow one with only`;
+			owner.set(item, p.name);
+		}
+	}
+	const rules = layout.pluginUnpack?.rules;
+	const ruleOwner = /* @__PURE__ */ new Map();
+	for (const p of rules ? plugins : []) for (const rule of p.rules) {
+		const file = `${p.name}-${rule.replace(/\.mdc?$/, "")}.mdc`;
+		const what = `the ${p.name} plugin's rule "${rule}"`;
+		const other = ruleOwner.get(file);
+		if (other) return `${what} and ${other} would both be placed at ${rules}/${file}: rename one, or narrow one with only`;
+		ruleOwner.set(file, what);
+	}
+}
 /** A real agent's catalog entry, with what its model's provider decides. */
 function agentFor(h) {
 	const agent = AGENTS[h.kind];
@@ -543,17 +928,22 @@ const credentialOf = (h) => agentOf(h)?.credential;
 const FAKE_LAYOUT = {
 	rulesFile: "AGENTS.md",
 	workspaceSkillDir: ".agents/skills",
-	harnessSkillDir: ".agents/skills"
+	harnessSkillDir: ".agents/skills",
+	pluginPlacement: "flat"
 };
 /** Where a harness's agent reads rules and skills; a fake one with `layout` mimics that agent. */
 function layoutOf(descriptor) {
 	if (descriptor.kind !== "fake") return LAYOUTS[descriptor.kind];
 	return descriptor.layout ? LAYOUTS[descriptor.layout] : FAKE_LAYOUT;
 }
-/** The hosts a harness's agent is known to try; a fake agent with `layout` expects that agent's. */
-function expectedBlockedFor(descriptor) {
+/**
+* The hosts a harness's agent is known to try in a session with or without plugins; a fake agent
+* with `layout` expects that agent's.
+*/
+function expectedBlockedFor(descriptor, plugins) {
 	const kind = descriptor.kind === "fake" ? descriptor.layout : descriptor.kind;
-	return kind ? AGENTS[kind].expectedBlocked : void 0;
+	const expected = kind ? AGENTS[kind].expectedBlocked : void 0;
+	return expected?.withPlugins && !plugins ? void 0 : expected;
 }
 /**
 * How the APIs behind the harnesses say they refused a key: an HTTP 401, Anthropic's and OpenAI's
@@ -701,10 +1091,21 @@ async function createFakeSandbox(descriptor, env = {}) {
 	const base = await mkdtemp(join(parent, "reeval-sandbox-"));
 	const workdir = join(base, "work");
 	await mkdir(workdir);
+	const stateDir = `${base}.state`;
+	await mkdir(stateDir);
 	let destroyed;
 	const resolve = (path) => path.startsWith("~/") ? join(base, path.slice(2)) : join(workdir, path);
 	return {
 		workdir,
+		stateDir,
+		execOwn: (command, { signal } = {}) => run(sh, ["-c", command], {
+			cwd: workdir,
+			env: {
+				HOME: base,
+				...env
+			},
+			signal
+		}),
 		exec: (command, { cwd, env: extra, signal } = {}) => {
 			const tag = process.platform === "win32" && signal ? randomUUID() : void 0;
 			const stop = () => killTagged(sh, tag);
@@ -730,6 +1131,10 @@ async function createFakeSandbox(descriptor, env = {}) {
 		},
 		destroy: () => {
 			destroyed ??= (async () => {
+				await rm(stateDir, {
+					recursive: true,
+					force: true
+				}).catch(() => {});
 				if (process.platform === "win32") {
 					if (existsSync(base)) await runSh(sh, KILL_UNDER, base);
 					await removeTree(base);
@@ -767,11 +1172,12 @@ function harnessHosts(harness) {
 	if (harness.kind !== "fake" && isAgentKind(harness.kind)) return agentFor(harness).hosts ?? HARNESS_HOSTS[harness.kind];
 	return harness.kind === "fake" && harness.layout ? HARNESS_HOSTS[harness.layout] : [];
 }
-/** MCP `http`/`sse` servers' hosts: the agent connects to them from the sandbox. */
+/** MCP `http`/`sse` servers' hosts, local plugins' included: the agent connects to them from the sandbox. */
 function mcpServerHosts(layers) {
 	const urls = /* @__PURE__ */ new Map();
 	for (const { spec } of layers) for (const [name, server] of Object.entries(spec.mcp ?? {})) if (server.transport === "stdio") urls.delete(name);
 	else urls.set(name, server.url);
+	for (const [name, server] of localPluginServers(layers)) if (server.transport !== "stdio") urls.set(name, server.url);
 	return [...urls.values()].flatMap((url) => URL.parse(url)?.hostname ?? []);
 }
 /**
@@ -802,6 +1208,22 @@ function allowedHosts({ policy, auto }) {
 	if (!isRestricted(policy)) return null;
 	return [.../* @__PURE__ */ new Set([...policy === "deny-all" ? [] : policy.allow, ...auto])];
 }
+/**
+* The policy the Docker sandbox's gateway enforces: `deny-all` when a restricted policy allows no
+* host at all, else an allowlist. A listed IP address is an allowed range too, since the gateway
+* reaches a private address only through one.
+*/
+function gatewayPolicy(planned) {
+	const hosts = allowedHosts(planned);
+	if (hosts === null) return { mode: "allow-all" };
+	if (!hosts.length) return { mode: "deny-all" };
+	const cidrs = hosts.filter((h) => isIP(h)).map((h) => `${h}/${isIP(h) === 6 ? 128 : 32}`);
+	return {
+		mode: "custom",
+		allowedHosts: hosts,
+		...cidrs.length ? { allowedCIDRs: cidrs } : {}
+	};
+}
 /** What enforcing the policy takes: nothing, turning egress off, or a host allowlist. */
 function egressNeeds(planned) {
 	if (!isRestricted(planned.policy)) return "none";
@@ -831,6 +1253,6 @@ function egressLabel({ policy, auto }) {
 	return auto.length ? `${own} + auto: ${auto.join(", ")}` : own;
 }
 //#endregion
-export { layoutOf as _, unenforceable as a, DEFAULT_HARNESS as c, agentFor as d, authHint as f, isAgentKind as g, expectedBlockedFor as h, plannedEgress as i, HARNESS_EXAMPLE as l, credentialOf as m, allowedHosts as n, createFakeSandbox as o, brokeringFor as p, egressLabel as r, AGENTS as s, DEFAULT_EGRESS_ALLOW as t, agentAuth as u, refusedMcp as v };
+export { writePluginFiles as C, refusedPlugins as S, credentialOf as _, plannedEgress as a, layoutOf as b, AGENTS as c, agentAuth as d, agentFor as f, claudeMcpServers as g, brokeringFor as h, gatewayPolicy as i, DEFAULT_HARNESS as l, authHint as m, allowedHosts as n, unenforceable as o, agentMcp as p, egressLabel as r, createFakeSandbox as s, DEFAULT_EGRESS_ALLOW as t, HARNESS_EXAMPLE as u, expectedBlockedFor as v, refusedMcp as x, isAgentKind as y };
 
-//# sourceMappingURL=egress-2-qzPvGi.js.map
+//# sourceMappingURL=egress-DEAvq8Fl.js.map