termdock 1.4.71 → 1.4.72

package/dist/server/agent/pluginPackages.js

@@ -0,0 +1,289 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { ICON_FILE, MANIFEST_FILE, PLUGINS_DIR, SOURCE_METADATA_FILE, validateManifest, writePluginSourceMetadata, } from './plugins.js';
+const execFileAsync = promisify(execFile);
+const MAX_PACKAGE_FILES = 512;
+const MAX_PACKAGE_BYTES = 16 * 1024 * 1024;
+const MAX_SINGLE_FILE_BYTES = 8 * 1024 * 1024;
+const GIT_TIMEOUT_MS = 45_000;
+const IGNORED_NAMES = new Set(['.git', '.github', 'node_modules', SOURCE_METADATA_FILE]);
+const DEFAULT_GIT_HOSTS = new Set(['github.com', 'gitlab.com', 'codeberg.org', 'bitbucket.org']);
+function hardenedGitEnv() {
+    return {
+        ...process.env,
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_CONFIG_COUNT: '0',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        GIT_CONFIG_SYSTEM: '/dev/null',
+    };
+}
+function allowedGitHosts() {
+    const configured = (process.env.TERMDOCK_PLUGIN_GIT_HOSTS ?? '')
+        .split(',')
+        .map((host) => host.trim().toLowerCase())
+        .filter(Boolean);
+    return new Set([...DEFAULT_GIT_HOSTS, ...configured]);
+}
+export function normalizeGitPluginSource(input) {
+    let url;
+    try {
+        url = new URL(input.trim());
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash)
+        return null;
+    if (!allowedGitHosts().has(url.hostname.toLowerCase()))
+        return null;
+    if (!/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?\/?$/.test(url.pathname))
+        return null;
+    url.pathname = url.pathname.replace(/\/$/, '');
+    return url.toString();
+}
+async function packageTreeDigest(root) {
+    const hash = createHash('sha256');
+    let files = 0;
+    let bytes = 0;
+    async function visit(directory, relative = '') {
+        const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (IGNORED_NAMES.has(entry.name))
+                continue;
+            if (entry.isSymbolicLink())
+                throw new Error(`Plugin packages may not contain symbolic links: ${path.join(relative, entry.name)}`);
+            const absolute = path.join(directory, entry.name);
+            const nextRelative = path.join(relative, entry.name);
+            if (entry.isDirectory()) {
+                await visit(absolute, nextRelative);
+                continue;
+            }
+            if (!entry.isFile())
+                throw new Error(`Unsupported plugin package entry: ${nextRelative}`);
+            const stat = await fs.promises.stat(absolute);
+            files += 1;
+            bytes += stat.size;
+            if (files > MAX_PACKAGE_FILES)
+                throw new Error(`Plugin package exceeds ${MAX_PACKAGE_FILES} files`);
+            if (stat.size > MAX_SINGLE_FILE_BYTES)
+                throw new Error(`Plugin file is too large: ${nextRelative}`);
+            if (bytes > MAX_PACKAGE_BYTES)
+                throw new Error('Plugin package exceeds the 16 MB unpacked limit');
+            hash.update(nextRelative.replaceAll(path.sep, '/'));
+            hash.update('\0');
+            hash.update(await fs.promises.readFile(absolute));
+            hash.update('\0');
+        }
+    }
+    await visit(root);
+    return hash.digest('hex');
+}
+async function copyPackageTree(source, destination) {
+    await packageTreeDigest(source); // validates limits and symlinks before any destination write
+    await fs.promises.mkdir(destination, { recursive: true });
+    async function copy(directory, output) {
+        const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            if (IGNORED_NAMES.has(entry.name))
+                continue;
+            const from = path.join(directory, entry.name);
+            const to = path.join(output, entry.name);
+            if (entry.isDirectory()) {
+                await fs.promises.mkdir(to, { recursive: true });
+                await copy(from, to);
+            }
+            else {
+                await fs.promises.copyFile(from, to);
+                const stat = await fs.promises.stat(from);
+                await fs.promises.chmod(to, stat.mode & 0o777);
+            }
+        }
+    }
+    await copy(source, destination);
+}
+function validateIcon(packageDir) {
+    const iconPath = path.join(packageDir, ICON_FILE);
+    if (!fs.existsSync(iconPath))
+        return;
+    const svg = fs.readFileSync(iconPath, 'utf8');
+    if (!/^\s*<svg\b/i.test(svg))
+        throw new Error('icon.svg must contain an SVG document');
+    if (/<(?:script|style|foreignObject|iframe|object|embed)\b/i.test(svg)
+        || /<\?(?:xml|xml-stylesheet)\b|<!DOCTYPE\b/i.test(svg)
+        || /\bon[a-z]+\s*=/i.test(svg)
+        || /(?:href|src)\s*=\s*["']?\s*(?!#)[^"'\s>]+/i.test(svg)
+        || /url\(\s*(?!["']?#)[^)]+\)/i.test(svg)) {
+        throw new Error('icon.svg contains unsafe active content');
+    }
+}
+async function readAndValidateManifest(packageDir, expectedSlug) {
+    const manifestPath = path.join(packageDir, MANIFEST_FILE);
+    let raw;
+    try {
+        raw = JSON.parse(await fs.promises.readFile(manifestPath, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Plugin package must contain a valid root manifest.json: ${error.message}`);
+    }
+    const validation = validateManifest(raw, packageDir);
+    if ('error' in validation) {
+        const error = new Error(validation.error.errors.join('\n'));
+        error.code = validation.error.code ?? 'AGENT_PLUGIN_MANIFEST_INVALID';
+        error.migration = validation.error.migration;
+        throw error;
+    }
+    if (expectedSlug && validation.manifest.slug !== expectedSlug) {
+        throw new Error(`Update source declares slug "${validation.manifest.slug}"; expected "${expectedSlug}"`);
+    }
+    validateIcon(packageDir);
+    return validation.manifest;
+}
+export async function preparePluginPackage(sourceInput, expectedSlug) {
+    const source = sourceInput.trim();
+    if (!source)
+        throw new Error('Plugin source is required');
+    const remote = normalizeGitPluginSource(source);
+    const temporaryRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'termdock-plugin-'));
+    let packageDir;
+    let type;
+    let normalizedSource;
+    let revision;
+    try {
+        if (remote) {
+            packageDir = path.join(temporaryRoot, 'repo');
+            await execFileAsync('git', [
+                '-c', 'credential.helper=',
+                '-c', 'core.hooksPath=/dev/null',
+                '-c', 'filter.lfs.smudge=',
+                '-c', 'filter.lfs.required=false',
+                'clone', '--depth', '1', '--single-branch', '--no-recurse-submodules', '--', remote, packageDir,
+            ], {
+                timeout: GIT_TIMEOUT_MS,
+                maxBuffer: 1024 * 1024,
+                env: hardenedGitEnv(),
+            });
+            const result = await execFileAsync('git', ['-C', packageDir, 'rev-parse', 'HEAD'], {
+                timeout: 5000,
+                maxBuffer: 128 * 1024,
+            });
+            revision = result.stdout.trim();
+            type = 'git';
+            normalizedSource = remote;
+        }
+        else {
+            const resolved = path.resolve(source);
+            const stat = await fs.promises.stat(resolved).catch(() => null);
+            if (!stat)
+                throw new Error('Plugin source must be an existing local path or an allowed HTTPS Git repository');
+            packageDir = stat.isDirectory() ? resolved : path.dirname(resolved);
+            if (!stat.isDirectory() && path.basename(resolved) !== MANIFEST_FILE) {
+                throw new Error('A local plugin file must be named manifest.json');
+            }
+            type = 'local';
+            normalizedSource = packageDir;
+            revision = await packageTreeDigest(packageDir);
+        }
+        const manifest = await readAndValidateManifest(packageDir, expectedSlug);
+        const previous = expectedSlug
+            ? (() => {
+                try {
+                    return JSON.parse(fs.readFileSync(path.join(PLUGINS_DIR, expectedSlug, SOURCE_METADATA_FILE), 'utf8'));
+                }
+                catch {
+                    return null;
+                }
+            })()
+            : null;
+        const now = Date.now();
+        return {
+            manifest,
+            packageDir,
+            metadata: {
+                version: 1,
+                type,
+                source: normalizedSource,
+                revision,
+                latestRevision: revision,
+                installedAt: typeof previous?.installedAt === 'number' ? previous.installedAt : now,
+                updatedAt: now,
+                checkedAt: now,
+            },
+            cleanup: () => fs.promises.rm(temporaryRoot, { recursive: true, force: true }),
+        };
+    }
+    catch (error) {
+        await fs.promises.rm(temporaryRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+export async function commitPreparedPlugin(prepared, replace = false) {
+    await fs.promises.mkdir(PLUGINS_DIR, { recursive: true });
+    const target = path.join(PLUGINS_DIR, prepared.manifest.slug);
+    if (!replace && fs.existsSync(target))
+        throw new Error(`Plugin "${prepared.manifest.slug}" already exists`);
+    const stage = path.join(PLUGINS_DIR, `.stage-${prepared.manifest.slug}-${randomUUID()}`);
+    const backup = path.join(PLUGINS_DIR, `.backup-${prepared.manifest.slug}-${randomUUID()}`);
+    try {
+        await copyPackageTree(prepared.packageDir, stage);
+        await fs.promises.writeFile(path.join(stage, MANIFEST_FILE), JSON.stringify(prepared.manifest, null, 2), 'utf8');
+        writePluginSourceMetadata(stage, prepared.metadata);
+        if (fs.existsSync(target))
+            await fs.promises.rename(target, backup);
+        try {
+            await fs.promises.rename(stage, target);
+        }
+        catch (error) {
+            if (fs.existsSync(backup))
+                await fs.promises.rename(backup, target);
+            throw error;
+        }
+        await fs.promises.rm(backup, { recursive: true, force: true });
+        return target;
+    }
+    finally {
+        await fs.promises.rm(stage, { recursive: true, force: true });
+        await prepared.cleanup();
+    }
+}
+export async function checkPluginPackageUpdate(plugin) {
+    const checkedAt = Date.now();
+    const metadata = plugin.source;
+    if (!metadata?.source || metadata.type === 'manifest') {
+        return { supported: false, updateAvailable: false, revision: metadata?.revision ?? null, latestRevision: null, checkedAt };
+    }
+    let latestRevision;
+    if (metadata.type === 'git') {
+        const remote = normalizeGitPluginSource(metadata.source);
+        if (!remote)
+            throw new Error('The stored Git source is no longer allowed');
+        const { stdout } = await execFileAsync('git', [
+            '-c', 'credential.helper=',
+            '-c', 'core.hooksPath=/dev/null',
+            'ls-remote', remote, 'HEAD',
+        ], {
+            timeout: 15_000,
+            maxBuffer: 128 * 1024,
+            env: hardenedGitEnv(),
+        });
+        latestRevision = stdout.trim().split(/\s+/)[0] ?? '';
+        if (!/^[0-9a-f]{40,64}$/i.test(latestRevision))
+            throw new Error('Unable to resolve the plugin repository HEAD');
+    }
+    else {
+        latestRevision = await packageTreeDigest(metadata.source);
+    }
+    const next = { ...metadata, latestRevision, checkedAt };
+    writePluginSourceMetadata(plugin.dir, next);
+    return {
+        supported: true,
+        updateAvailable: Boolean(metadata.revision && latestRevision !== metadata.revision),
+        revision: metadata.revision,
+        latestRevision,
+        checkedAt,
+    };
+}

package/dist/server/agent/plugins.js

@@ -13,13 +13,42 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-const PLUGINS_DIR = path.join(os.homedir(), '.termdock', 'agent-plugins');
-const MANIFEST_FILE = 'manifest.json';
-const ICON_FILE = 'icon.svg';
+export const PLUGINS_DIR = path.join(os.homedir(), '.termdock', 'agent-plugins');
+export const MANIFEST_FILE = 'manifest.json';
+export const ICON_FILE = 'icon.svg';
+export const SOURCE_METADATA_FILE = '.termdock-source.json';
 // ---------------------------------------------------------------------------
 // Manifest schema
 // ---------------------------------------------------------------------------
 export const PLUGIN_MANIFEST_VERSION = 2;
+function parseSourceMetadata(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const value = raw;
+    if (value.version !== 1 || !['git', 'local', 'manifest'].includes(String(value.type)))
+        return null;
+    return {
+        version: 1,
+        type: value.type,
+        source: typeof value.source === 'string' ? value.source : null,
+        revision: typeof value.revision === 'string' ? value.revision : null,
+        latestRevision: typeof value.latestRevision === 'string' ? value.latestRevision : null,
+        installedAt: typeof value.installedAt === 'number' ? value.installedAt : 0,
+        updatedAt: typeof value.updatedAt === 'number' ? value.updatedAt : 0,
+        checkedAt: typeof value.checkedAt === 'number' ? value.checkedAt : null,
+    };
+}
+export function readPluginSourceMetadata(dir) {
+    try {
+        return parseSourceMetadata(JSON.parse(fs.readFileSync(path.join(dir, SOURCE_METADATA_FILE), 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+export function writePluginSourceMetadata(dir, metadata) {
+    fs.writeFileSync(path.join(dir, SOURCE_METADATA_FILE), JSON.stringify(metadata, null, 2), 'utf8');
+}
 // ---------------------------------------------------------------------------
 // Known sentinel event kinds — the set of events our state machine accepts
 // ---------------------------------------------------------------------------
@@ -48,6 +77,14 @@ function isValidSlug(s) {
 // Hex color validation
 // ---------------------------------------------------------------------------
 const HEX_COLOR_RE = /^#[0-9A-Fa-f]{6}$/;
+function isSafeSvgIcon(svg) {
+    return /^\s*<svg\b/i.test(svg)
+        && !/<(?:script|style|foreignObject|iframe|object|embed)\b/i.test(svg)
+        && !/<\?(?:xml|xml-stylesheet)\b|<!DOCTYPE\b/i.test(svg)
+        && !/\bon[a-z]+\s*=/i.test(svg)
+        && !/(?:href|src)\s*=\s*["']?\s*(?!#)[^"'\s>]+/i.test(svg)
+        && !/url\(\s*(?!["']?#)[^)]+\)/i.test(svg);
+}
 // ---------------------------------------------------------------------------
 // Path resolution: ~ → home directory
 // ---------------------------------------------------------------------------
@@ -57,6 +94,33 @@ function resolveHome(p) {
     }
     return p;
 }
+function validateHookTarget(target) {
+    if (!target.startsWith('~/') || !target.toLowerCase().endsWith('.json')) {
+        return 'hooks.target must be a ~/ path to a JSON file';
+    }
+    const home = path.resolve(os.homedir());
+    const resolved = path.resolve(home, target.slice(2));
+    if (resolved === home || !resolved.startsWith(`${home}${path.sep}`)) {
+        return 'hooks.target must stay inside the user home directory';
+    }
+    // Existing symlinks in any target component could redirect a later write
+    // outside $HOME. Refuse them instead of relying on a racy realpath check.
+    let current = home;
+    for (const part of path.relative(home, resolved).split(path.sep)) {
+        current = path.join(current, part);
+        try {
+            if (fs.lstatSync(current).isSymbolicLink()) {
+                return 'hooks.target may not traverse symbolic links';
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                return 'hooks.target could not be safely inspected';
+            }
+        }
+    }
+    return null;
+}
 export const V1_MIGRATION_GUIDE_COMMAND = 'td agent-plugin --json';
 export const V1_MIGRATION_AI_PROMPT = [
     'Please migrate the attached Termdock Agent plugin manifest from v1 to v2.',
@@ -86,12 +150,13 @@ export function validateManifest(raw, dir) {
         errors.push('slug must be a lowercase alphanumeric string with hyphens (max 40 chars)');
     }
     const displayName = m.displayName;
-    if (typeof displayName !== 'string' || displayName.trim().length === 0) {
-        errors.push('displayName is required and must be a non-empty string');
+    if (typeof displayName !== 'string' || displayName.trim().length === 0 || displayName.length > 80) {
+        errors.push('displayName is required and must be a non-empty string (max 80 chars)');
     }
     const aliases = m.aliases;
-    if (!Array.isArray(aliases) || aliases.length === 0 || !aliases.every((a) => typeof a === 'string' && a.trim().length > 0)) {
-        errors.push('aliases must be a non-empty array of strings');
+    if (!Array.isArray(aliases) || aliases.length === 0 || aliases.length > 16
+        || !aliases.every((a) => typeof a === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(a))) {
+        errors.push('aliases must contain 1-16 safe command names');
     }
     const accentColor = m.accentColor;
     if (typeof accentColor !== 'string' || !HEX_COLOR_RE.test(accentColor)) {
@@ -167,6 +232,11 @@ export function validateManifest(raw, dir) {
             if (typeof target !== 'string' || target.trim().length === 0) {
                 errors.push('hooks.target is required and must be a file path (~-abbreviated ok)');
             }
+            else {
+                const targetError = validateHookTarget(target.trim());
+                if (targetError)
+                    errors.push(targetError);
+            }
             const events = h.events;
             if (!Array.isArray(events) || events.length === 0) {
                 errors.push('hooks.events must be a non-empty array');
@@ -182,15 +252,15 @@ export function validateManifest(raw, dir) {
                     const evt = e;
                     const hook = evt.hook;
                     const event = evt.event;
-                    if (typeof hook !== 'string' || hook.trim().length === 0) {
+                    if (typeof hook !== 'string' || hook.trim().length === 0 || hook.length > 120) {
                         errors.push(`hooks.events[${i}].hook is required`);
                     }
                     if (typeof event !== 'string' || !VALID_EVENT_KINDS.has(event)) {
                         errors.push(`hooks.events[${i}].event must be one of: ${[...VALID_EVENT_KINDS].join(', ')}`);
                     }
                     const matcher = evt.matcher;
-                    if (matcher !== undefined && typeof matcher !== 'string') {
-                        errors.push(`hooks.events[${i}].matcher must be a string if provided`);
+                    if (matcher !== undefined && (typeof matcher !== 'string' || matcher.length > 512)) {
+                        errors.push(`hooks.events[${i}].matcher must be a string (max 512 chars) if provided`);
                     }
                     const timeout = evt.timeout;
                     if (timeout !== undefined && (typeof timeout !== 'number' || timeout <= 0)) {
@@ -226,9 +296,20 @@ export function validateManifest(raw, dir) {
             if (typeof command !== 'string' || !command.includes('{sessionId}')) {
                 errors.push('resume.command must contain the {sessionId} placeholder');
             }
+            else {
+                const tokens = command.trim().split(/\s+/);
+                const executable = path.basename(tokens[0] ?? '');
+                if (command.length > 1024
+                    || !tokens.every((token) => /^[A-Za-z0-9_./:@%+,={}-]+$/.test(token))
+                    || !Array.isArray(aliases)
+                    || !aliases.includes(executable)) {
+                    errors.push('resume.command must be a simple argv-like command whose executable is one of aliases; shell syntax is not allowed');
+                }
+            }
             const staleFlags = r.staleFlags;
-            if (staleFlags !== undefined && (!Array.isArray(staleFlags) || !staleFlags.every((f) => typeof f === 'string'))) {
-                errors.push('resume.staleFlags must be an array of strings if provided');
+            if (staleFlags !== undefined && (!Array.isArray(staleFlags) || staleFlags.length > 32
+                || !staleFlags.every((f) => typeof f === 'string' && /^--?[A-Za-z0-9][A-Za-z0-9-]{0,79}$/.test(f)))) {
+                errors.push('resume.staleFlags must be an array of safe CLI flags if provided');
             }
             resumeConfig = {
                 command: command,
@@ -248,10 +329,12 @@ export function validateManifest(raw, dir) {
             const n = m.titleNamer;
             const command = n.command;
             const args = n.args;
-            if (typeof command !== 'string' || command.trim().length === 0) {
+            if (typeof command !== 'string' || command.trim().length === 0 || command.length > 1024) {
                 errors.push('titleNamer.command is required');
             }
-            if (!Array.isArray(args) || !args.every((arg) => typeof arg === 'string') || !args.some((arg) => arg.includes('{prompt}'))) {
+            if (!Array.isArray(args) || args.length > 64
+                || !args.every((arg) => typeof arg === 'string' && arg.length <= 16_384)
+                || !args.some((arg) => arg.includes('{prompt}'))) {
                 errors.push('titleNamer.args must be a string array containing {prompt}');
             }
             let models;
@@ -261,10 +344,11 @@ export function validateManifest(raw, dir) {
                 }
                 else {
                     const rawModels = n.models;
-                    if (typeof rawModels.command !== 'string' || rawModels.command.trim().length === 0) {
+                    if (typeof rawModels.command !== 'string' || rawModels.command.trim().length === 0 || rawModels.command.length > 1024) {
                         errors.push('titleNamer.models.command is required');
                     }
-                    if (rawModels.args !== undefined && (!Array.isArray(rawModels.args) || !rawModels.args.every((arg) => typeof arg === 'string'))) {
+                    if (rawModels.args !== undefined && (!Array.isArray(rawModels.args) || rawModels.args.length > 64
+                        || !rawModels.args.every((arg) => typeof arg === 'string' && arg.length <= 16_384))) {
                         errors.push('titleNamer.models.args must be a string array if present');
                     }
                     if (typeof rawModels.command === 'string') {
@@ -348,18 +432,27 @@ export function loadPlugins() {
         }
         const iconPath = path.join(dir, ICON_FILE);
         let iconMtime = 0;
-        const iconExists = fs.existsSync(iconPath);
+        let iconExists = fs.existsSync(iconPath);
         if (iconExists) {
             try {
-                iconMtime = fs.statSync(iconPath).mtimeMs;
+                if (!isSafeSvgIcon(fs.readFileSync(iconPath, 'utf8'))) {
+                    errors.push({ slug: result.manifest.slug, errors: ['icon.svg contains unsafe or invalid SVG content'] });
+                    iconExists = false;
+                }
+                else {
+                    iconMtime = fs.statSync(iconPath).mtimeMs;
+                }
+            }
+            catch {
+                iconExists = false;
             }
-            catch { /* keep 0 */ }
         }
         plugins.push({
             manifest: result.manifest,
             dir,
             iconPath: iconExists ? iconPath : null,
             iconMtime,
+            source: readPluginSourceMetadata(dir),
         });
     }
     return { plugins, errors };
@@ -372,6 +465,17 @@ export function savePlugin(manifest) {
     fs.mkdirSync(dir, { recursive: true });
     const manifestPath = path.join(dir, MANIFEST_FILE);
     fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf8');
+    const now = Date.now();
+    writePluginSourceMetadata(dir, {
+        version: 1,
+        type: 'manifest',
+        source: null,
+        revision: null,
+        latestRevision: null,
+        installedAt: now,
+        updatedAt: now,
+        checkedAt: null,
+    });
     return dir;
 }
 /**

package/dist/server/agent/titleNamerCatalog.js

@@ -4,10 +4,24 @@ import os from 'os';
 import path from 'path';
 import { promisify } from 'util';
 import { loadPlugins } from './plugins.js';
+import { getAutoRenameAgentsSetting, getAutoRenameNamerSetting } from '../utils/settings.js';
 const execFileAsync = promisify(execFile);
 const CACHE_FRESH_MS = 24 * 60 * 60_000;
 const PROBE_TIMEOUT_MS = 10_000;
 const CACHE_FILE = path.join(os.homedir(), '.termdock', 'title-namer-catalog.json');
+function pluginCommandEnv() {
+    const allowed = ['PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'TERM', 'TMPDIR', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME'];
+    const env = { NO_COLOR: '1', TERM: 'dumb' };
+    for (const key of allowed) {
+        if (process.env[key] !== undefined)
+            env[key] = process.env[key];
+    }
+    for (const [key, value] of Object.entries(process.env)) {
+        if (key.startsWith('LC_') && value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}
 let cached = null;
 let refreshPromise = null;
 export function invalidateTitleNamerCatalog() {
@@ -179,13 +193,17 @@ function normalizeDiscoveredModels(input) {
             }];
     });
 }
-async function listPluginModels(config) {
+function expandPluginPath(value, pluginDir) {
+    return value.replaceAll('{pluginDir}', pluginDir);
+}
+async function listPluginModels(config, pluginDir) {
     if (!config.models)
         return [];
-    const { stdout } = await execFileAsync(config.models.command, config.models.args ?? [], {
+    const { stdout } = await execFileAsync(expandPluginPath(config.models.command, pluginDir), (config.models.args ?? []).map((arg) => expandPluginPath(arg, pluginDir)), {
         timeout: PROBE_TIMEOUT_MS,
         maxBuffer: 256 * 1024,
-        env: { ...process.env, NO_COLOR: '1', TERM: 'dumb' },
+        cwd: pluginDir,
+        env: pluginCommandEnv(),
     });
     return normalizeDiscoveredModels(JSON.parse(stdout));
 }
@@ -195,12 +213,21 @@ function pluginTitleNamers() {
                 slug: plugin.manifest.slug,
                 displayName: plugin.manifest.displayName,
                 config: plugin.manifest.titleNamer,
+                dir: plugin.dir,
             }]
         : []);
 }
+export function shouldRunPluginTitleCommands(slug, selected, enabledAgents) {
+    return selected === slug
+        || (selected === 'auto' && enabledAgents.includes(slug));
+}
+function isPluginTitleExecutionEnabled(slug) {
+    return shouldRunPluginTitleCommands(slug, getAutoRenameNamerSetting(), getAutoRenameAgentsSetting());
+}
 export async function runTitleNamer(slug, prompt, model) {
     let command;
     let args;
+    let cwd;
     if (slug === 'codex') {
         command = 'codex';
         args = ['exec', '--ephemeral', '--skip-git-repo-check', '--color', 'never', ...(model ? ['--model', model] : []), prompt];
@@ -211,20 +238,22 @@ export async function runTitleNamer(slug, prompt, model) {
     }
     else {
         const provider = pluginTitleNamers().find((entry) => entry.slug === slug);
-        if (!provider)
+        if (!provider || !isPluginTitleExecutionEnabled(slug))
             return null;
-        command = provider.config.command;
+        cwd = provider.dir;
+        command = expandPluginPath(provider.config.command, provider.dir);
         args = provider.config.args.flatMap((arg) => {
             if (arg.includes('{model}') && !model)
                 return [];
-            return [arg.replaceAll('{prompt}', prompt).replaceAll('{model}', model ?? '')];
+            return [expandPluginPath(arg, provider.dir).replaceAll('{prompt}', prompt).replaceAll('{model}', model ?? '')];
         });
     }
     try {
         const { stdout } = await execFileAsync(command, args, {
             timeout: 45_000,
             maxBuffer: 256 * 1024,
-            env: { ...process.env, NO_COLOR: '1', TERM: 'dumb' },
+            cwd,
+            env: cwd ? pluginCommandEnv() : { ...process.env, NO_COLOR: '1', TERM: 'dumb' },
         });
         return stdout;
     }
@@ -240,7 +269,9 @@ async function refreshTitleNamerCatalog() {
         const [codex, claude, ...pluginResults] = await Promise.allSettled([
             listCodexModels(),
             listClaudeModels(),
-            ...plugins.map((provider) => listPluginModels(provider.config)),
+            ...plugins.map((provider) => provider.config.models && isPluginTitleExecutionEnabled(provider.slug)
+                ? listPluginModels(provider.config, provider.dir)
+                : Promise.resolve([])),
         ]);
         const previousCodex = cached?.value.find((namer) => namer.slug === 'codex');
         const previousClaude = cached?.value.find((namer) => namer.slug === 'claude');