feat(repository-plugin): load trusted package code

2026-08-08 19:25:14 +08:00
parent a0c64f4906
commit 033fa4b0b1
34 changed files with 590 additions and 149 deletions
--- a/packages/mcp/mcp-client/README.i18n.yaml
+++ b/packages/mcp/mcp-client/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/mcp/mcp-client/README.md
-README.md: d7966595c68ff1ec4a288caf5d9fe4b0bf580cc5
-README.zh.md: eb9e0dbdb48423cc4bc698fda355e973e42bc7a3
+README.md: 6bcc195e36d24d7e5ae3462573b30f1b41c963a7
+README.zh.md: 8886c16c3fe66d283ae2191661118729a89f1aeb
--- a/packages/mcp/mcp-client/README.md
+++ b/packages/mcp/mcp-client/README.md
@@ -56,7 +56,7 @@ Every MCP tool has two names: the raw MCP name (sent on the wire in `tools/call`

 ## Behavior

- On connect: `listTools()` → registers each tool via `ctx.tools.register()` under its public name.
+- On connect: plugin activation awaits `listTools()` and registers each tool via `ctx.tools.register()` under its public name before the composition starts its first turn. Initial connection failure is logged and activates with no tools.
 - Listens for `notifications/tools/list_changed` → re-syncs; a failed re-sync keeps the previous generation registered.
 - Tool execute: `client.callTool({ name: rawName, arguments }, { signal })` with timeout + abort support—the public name is never sent to the server.
 - Canonical success is `{ content: JsonValue[], structuredContent? }`; complete JSON MCP blocks survive for programmatic callers. A supported advertised `outputSchema` validates `structuredContent`; unsupported schema vocabulary falls back to unconstrained `JsonValue`.
@@ -101,7 +101,6 @@ Append-only; newly visible content follows the reusable request prefix and does

 ## Known Limitations and Deferred Work

- **Initial discovery is asynchronous** — plugin load does not wait for connection and `listTools()`, so a turn started immediately after boot or HMR can assemble before the MCP tools are registered.
 - **Tools are the only bridged MCP capability** — Resources and Prompts have no harness consumption surface and are deferred.
 - **Crash recovery is manual** — transport closure does not auto-reconnect; registered tools can remain visible but fail against the closed transport until an HMR reload or Host restart.
 - **Native non-text rendering is lossy** — image, audio, and resource payloads become placeholders in model context even though the execution-local canonical value preserves their JSON blocks. Richer Native multimedia projection is deferred.
--- a/packages/mcp/mcp-client/README.zh.md
+++ b/packages/mcp/mcp-client/README.zh.md
@@ -56,7 +56,7 @@ MCP 客户端桥接插件：连接外部 [Model Context Protocol](https://modelc

 ## 行为

- 连接时：`listTools()` → 通过 `ctx.tools.register()` 使用各自公开名称注册每个工具。
+- 连接时：插件激活会等待 `listTools()`，并在组合开始首个轮次前通过 `ctx.tools.register()` 以公开名称注册每个工具。初始连接失败会记录日志，插件仍会激活但不注册工具。
 - 监听 `notifications/tools/list_changed` → 重新同步；同步失败时保留上一世代的注册。
 - 工具执行：`client.callTool({ name: rawName, arguments }, { signal })`，支持超时 + 中止；公开名称绝不会发给服务器。
 - 规范成功值是 `{ content: JsonValue[], structuredContent? }`；完整的 JSON MCP 块会保留给编程调用方。受支持且已声明的 `outputSchema` 会验证 `structuredContent`；不受支持的 schema 词汇会回退为不受约束的 `JsonValue`。
@@ -101,7 +101,6 @@ MCP 客户端桥接插件：连接外部 [Model Context Protocol](https://modelc

 ## 已知限制与暂缓事项

- **初始发现是异步的**：插件加载不会等待连接和 `listTools()`，因此在启动或 HMR 后立即开始的轮次可能在 MCP 工具注册前完成组装。
 - **只桥接 MCP 的工具能力**：资源和提示词没有 harness 消费接口，暂缓实现。
 - **崩溃恢复需要手动触发**：传输关闭后不会自动重新连接；已注册工具可能仍然可见，但会因传输已关闭而调用失败，直到 HMR 重载或重启 Host。
 - **Native 非文本渲染有损**：图片、音频与资源载荷在模型上下文中会变成占位符，即使执行局部的规范值保留了其 JSON 块。更丰富的 Native 多媒体投影暂缓实现。
--- a/packages/mcp/mcp-client/src/index.ts
+++ b/packages/mcp/mcp-client/src/index.ts
@@ -116,7 +116,13 @@ export const Config = z.union([

 // ---- Plugin apply ----

-export function apply(ctx: Context, config: Config): void {
+/**
+ * Connect one MCP server and publish its initial tool generation before activation.
+ * @param ctx - plugin context carrying the tool registry.
+ * @param config - resolved transport and server namespace configuration.
+ * @returns startup readiness after connection and initial tool discovery settle.
+ */
+export function apply(ctx: Context, config: Config): Promise<void> {
  // Reserve the namespace first: a duplicate `serverName` fails THIS instance
  // at load with an actionable error and leaves the earlier instance intact.
  ctx.effect(() => {
@@ -179,4 +185,6 @@ export function apply(ctx: Context, config: Config): void {
    for (const dispose of live().values()) dispose()
    try { await client.close() } catch { /* transport already gone */ }
  }, 'mcp-client.connection')
+
+  return ready.then(() => undefined)
 }
--- a/packages/mcp/mcp-client/tests/apply.spec.ts
+++ b/packages/mcp/mcp-client/tests/apply.spec.ts
@@ -141,8 +141,7 @@ describe('apply (plugin lifecycle)', () => {
  })

  it('connects, syncs tools under the namespace, and registers a notification handler', async () => {
-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)

    expect(mockConnect).toHaveBeenCalled()
    expect(mockListTools).toHaveBeenCalled()
@@ -152,11 +151,10 @@ describe('apply (plugin lifecycle)', () => {
  })

  it('rejects a duplicate serverName at load and leaves the first instance intact', async () => {
-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)
    expect(ctx.tools.get('mcp__srv__remote')).toBeDefined()

-    expect(() => { apply(ctx, stdioConfig) }).toThrow(/serverName "srv" is already in use/)
+    expect(() => { void apply(ctx, stdioConfig) }).toThrow(/serverName "srv" is already in use/)
    // First instance unaffected.
    expect(ctx.tools.get('mcp__srv__remote')).toBeDefined()
  })
@@ -165,8 +163,7 @@ describe('apply (plugin lifecycle)', () => {
    const first = new Context()
    await first.plugin(SystemPrompt)
    await first.plugin(ToolRegistry)
-    apply(first, stdioConfig)
-    await sleep(50)
+    await apply(first, stdioConfig)

    await first.fiber.dispose()
    await sleep(50)
@@ -176,16 +173,17 @@ describe('apply (plugin lifecycle)', () => {
    const second = new Context()
    await second.plugin(SystemPrompt)
    await second.plugin(ToolRegistry)
-    expect(() => { apply(second, stdioConfig) }).not.toThrow()
+    await expect(apply(second, stdioConfig)).resolves.toBeUndefined()
+    await second.fiber.dispose()
  })

  it('scopes serverName reservations per app root', async () => {
    const other = await mountRegistry()

-    apply(ctx, stdioConfig)
+    const first = apply(ctx, stdioConfig)
    // Same serverName on a DIFFERENT root is fine.
-    expect(() => { apply(other, stdioConfig) }).not.toThrow()
-    await sleep(50)
+    const second = apply(other, stdioConfig)
+    await Promise.all([first, second])

    expect(ctx.tools.get('mcp__srv__remote')).toBeDefined()
    expect(other.tools.get('mcp__srv__remote')).toBeDefined()
@@ -194,8 +192,7 @@ describe('apply (plugin lifecycle)', () => {
  it('logs error and registers no tools when connect fails; dispose is a no-op', async () => {
    mockConnect.mockRejectedValue(new Error('connection refused'))

-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)

    expect(mockListTools).not.toHaveBeenCalled()
    expect(ctx.tools.get('mcp__srv__remote')).toBeUndefined()
@@ -208,8 +205,7 @@ describe('apply (plugin lifecycle)', () => {
  })

  it('re-syncs tools on ToolListChanged notification', async () => {
-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)

    expect(ctx.tools.get('mcp__srv__remote')).toBeDefined()

@@ -226,8 +222,7 @@ describe('apply (plugin lifecycle)', () => {
  })

  it('keeps the previous generation when a re-sync fails', async () => {
-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)
    expect(ctx.tools.get('mcp__srv__remote')).toBeDefined()

    mockListTools.mockRejectedValue(new Error('flaky server'))
@@ -242,7 +237,7 @@ describe('apply (plugin lifecycle)', () => {
    // Load through ctx.plugin so ONLY the plugin's fiber is disposed — the
    // registry must survive to observe the unregistration.
    const fiber = ctx.plugin({ name: 'mcp-client', inject: ['tools'], apply }, stdioConfig)
-    await sleep(50)
+    await fiber

    // Advance to a second generation first.
    mockListTools.mockResolvedValue({
@@ -264,8 +259,7 @@ describe('apply (plugin lifecycle)', () => {
  it('effect disposer handles client.close failure gracefully', async () => {
    mockClose.mockRejectedValue(new Error('already closed'))

-    apply(ctx, stdioConfig)
-    await sleep(50)
+    await apply(ctx, stdioConfig)

    // Should not throw when dispose is triggered.
    await ctx.fiber.dispose()
@@ -283,8 +277,7 @@ describe('apply (plugin lifecycle)', () => {
      toolCallTimeoutMs: 30_000,
    }

-    apply(ctx, httpConfig)
-    await sleep(50)
+    await apply(ctx, httpConfig)

    expect(mockConnect).toHaveBeenCalled()
    expect(ctx.tools.get('mcp__web__remote')).toBeDefined()
--- a/packages/mcp/mcp-client/tests/mcp-client.e2e.ts
+++ b/packages/mcp/mcp-client/tests/mcp-client.e2e.ts
@@ -43,21 +43,6 @@ async function mountRegistry(): Promise<Context> {
  return ctx
 }

-/** Apply the MCP client plugin and wait for tools to be registered. */
-async function applyAndWait(ctx: Context, config: Config, timeoutMs = 20_000): Promise<void> {
-  // Annotated bindings (not withResolvers<void>()): the tests lint layer runs
-  // no-invalid-void-type with default options, which rejects the explicit
-  // type argument in call position but accepts the inferred form.
-  const gate: PromiseWithResolvers<void> = Promise.withResolvers()
-  const timer = setTimeout(
-    () => { gate.reject(new Error(`applyAndWait timed out after ${timeoutMs}ms — no tools/change event`)) },
-    timeoutMs,
-  )
-  ctx.on('tools/change', () => { clearTimeout(timer); gate.resolve() })
-  apply(ctx, config)
-  await gate.promise
-}
-
 function sleep(ms: number): Promise<void> {
  const gate: PromiseWithResolvers<void> = Promise.withResolvers()
  setTimeout(gate.resolve, ms)
@@ -94,7 +79,7 @@ describe('fixture server — controlled scenarios', () => {

  beforeAll(async () => {
    ctx = await mountRegistry()
-    await applyAndWait(ctx, fixtureConfig)
+    await apply(ctx, fixtureConfig)
  }, 30_000)

  afterAll(async () => {
@@ -180,9 +165,9 @@ describe('fixture server — duplicate serverName', () => {
      cwd: packageDir,
      toolCallTimeoutMs: 15_000,
    }
-    await applyAndWait(ctx, config)
+    await apply(ctx, config)

-    expect(() => { apply(ctx, config) }).toThrow(/serverName "dup" is already in use/)
+    expect(() => { void apply(ctx, config) }).toThrow(/serverName "dup" is already in use/)

    await ctx.fiber.dispose()
    await sleep(200)
@@ -192,7 +177,7 @@ describe('fixture server — duplicate serverName', () => {
 describe('fixture server — disposal', () => {
  it('disposes cleanly without error', async () => {
    const ctx = await mountRegistry()
-    await applyAndWait(ctx, {
+    await apply(ctx, {
      transport: 'stdio',
      serverName: 'fixture',
      command: process.execPath,
@@ -229,7 +214,7 @@ describe('server-everything — official test server', () => {

  beforeAll(async () => {
    ctx = await mountRegistry()
-    await applyAndWait(ctx, config)
+    await apply(ctx, config)
  }, 60_000)

  afterAll(async () => {
@@ -293,7 +278,7 @@ describe('server-filesystem — real filesystem operations', () => {
      cwd: '',
      toolCallTimeoutMs: 30_000,
    }
-    await applyAndWait(ctx, config)
+    await apply(ctx, config)
  }, 60_000)

  afterAll(async () => {
@@ -409,7 +394,7 @@ describe('streamable-http — in-process MCP server', () => {
      headers: { Authorization: 'Bearer e2e-test-token' },
      toolCallTimeoutMs: 15_000,
    }
-    await applyAndWait(ctx, config)
+    await apply(ctx, config)
  }, 30_000)

  afterAll(async () => {
--- a/packages/self-modification/repository-plugin/README.i18n.yaml
+++ b/packages/self-modification/repository-plugin/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/self-modification/repository-plugin/README.md
-README.md: 23c4cc0dceaf0692b7ef5067f9170b8c6b311cc0
-README.zh.md: db2f3e5a5c8915836d97177f797411e17e70441c
+README.md: 52d04f16684842749e57d1b47db0a95beb22558c
+README.zh.md: 921bf70b8a2e78410510d1efce79ced5f52b4641
--- a/packages/self-modification/repository-plugin/README.md
+++ b/packages/self-modification/repository-plugin/README.md
@@ -2,7 +2,7 @@

 English | [中文](README.zh.md)

-Restricted repository Plugin format for DeepSeek Harness. A repository author declares static skill roots and an optional common `.mcp.json` in `.dsh-plugin/package.json`; the prepare helper copies those assets and emits a fixed import-free Cordis wrapper. The runtime wrapper can only delegate to this DSH-owned package, which composes [`dsh-skill-local`](../../skill/skill-local/README.md) and [`dsh-mcp-client`](../../mcp/mcp-client/README.md). Design rationale: [static repository Plugin format Agent Note](../../../.agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.md).
+Trusted repository package format for DeepSeek Harness. A `.dsh-plugin` npm package may contribute a compiled Cordis/DSH Plugin entry, skill roots, and a common `.mcp.json`; its ordinary `prepack` lifecycle owns dependency installation and source compilation before the DSH prepare helper validates the outputs and emits the Loader wrapper. Static contributions compose [`dsh-skill-local`](../../skill/skill-local/README.md) and [`dsh-mcp-client`](../../mcp/mcp-client/README.md). Design rationale: [trusted repository package code](../../../.agents/notes/implemented/architecture/2026-08-08-trusted-repository-package-code.md) and the [static contribution subformat](../../../.agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.md).

 ## Authoring format

@@ -13,17 +13,30 @@ Place an ordinary package in the repository's `.dsh-plugin` directory:
  "name": "humanize-dsh-plugin",
  "version": "0.0.0",
  "private": true,
+  "type": "module",
  "scripts": {
-    "prepack": "dsh-plugin-prepare"
+    "build": "tsc",
+    "prepack": "npm run build && dsh-plugin-prepare"
  },
  "dsh": {
+    "entry": "./lib/plugin.js",
    "skills": ["../skills"],
    "mcpServers": "../.mcp.json"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0"
+  },
+  "devDependencies": {
+    "typescript": "6.0.3"
  }
 }
 ```

-`scripts.prepack` must be exactly `dsh-plugin-prepare`. DSH supplies that command from its own installed runtime while preparing Git source, so the repository package needs no DSH or npm dependency. `dsh.skills` is an optional array of local skill roots. `dsh.mcpServers` is an optional path to one `.mcp.json`; at least one field is required. Paths are relative to `.dsh-plugin`, must stay under its parent source directory, and may therefore refer to existing repository assets such as `../skills`. A repository containing several Plugins gives each one its own `.dsh-plugin` package under a different selectable subdirectory.
+`scripts.prepack` must be non-empty and invoke `dsh-plugin-prepare`; it may run arbitrary package-owned build steps first. DSH supplies only that helper command from its installed runtime: the package declares and runs its own compiler, runtime dependencies, and other npm lifecycle code. DSH does not transpile TypeScript or infer a package entry.
+
+`dsh.entry` is an optional relative path to a compiled ESM Cordis Plugin inside `.dsh-plugin`. The module may use either namespace exports or a default export and owns its ordinary `name`, `inject`, `Config`, registrations, and effects. `dsh.skills` is an optional array of local skill roots, and `dsh.mcpServers` is an optional path to one `.mcp.json`; at least one of the three fields is required. Skill and MCP paths may reach adjacent repository assets but must remain beneath the directory containing `.dsh-plugin`; the compiled entry must remain inside the package selected and packed by the package manager. A repository containing several Plugins gives each one its own `.dsh-plugin` package under a different selectable subdirectory.
+
+The repository package and every dependency or lifecycle script it runs are trusted code, just like an npm package selected directly by the user. This format is not a sandbox: install only repositories whose code may access the host process, filesystem, network, and services declared through Cordis. Exact refs and the immutable cache provide identity and reproducibility, not isolation.

 ## Standalone app configuration

@@ -46,19 +59,17 @@ Long-lived surfaces watch both `cordis.patch.yml` layers through Cordis HMR. A v

 ## Preparation

-During exact Git installation, DSH places a temporary host-owned `dsh-plugin-prepare` command on the isolated package lifecycle `PATH`; the command is not fetched from npm. The required `prepack` lifecycle runs after the Git package's dependency installation and before its selected subdirectory is packed, including when `.dsh-plugin` sits inside another package-manager workspace. The command validates `package.json#dsh`, verifies skill-root types, parses the MCP file, copies assets under `dsh-plugin-assets`, and writes `dsh-plugin.mjs`. Before importing that wrapper, DSH revalidates that the installed package retained the exact `prepack` declaration. The wrapper contains only the normalized static manifest and fixed code that looks up the `dsh-repository-plugin` Loader builtin. It neither discovers nor compiles repository JavaScript, and the runtime never imports another repository entry point. Failure to run or complete preparation fails installation before a cache generation is published. Rationale: [host-owned Git source preparation Agent Note](../../../.agents/notes/implemented/bug-fix/2026-08-08-host-owned-git-repository-plugin-preparation.md).
-
-The containing package manager still runs the configured repository package's lifecycle scripts. This restriction defines the supported DSH contribution surface; it is not a security boundary for a repository that the user chose to install as executable package-manager source.
+During exact Git installation, DSH places a temporary host-owned `dsh-plugin-prepare` command on the isolated package lifecycle `PATH`; the command is not fetched from npm. The required `prepack` lifecycle runs after the Git package's dependency installation and before its selected subdirectory is packed, including when `.dsh-plugin` sits inside another package-manager workspace. Package-owned commands may build TypeScript or other source before invoking the helper. The helper validates `package.json#dsh`, verifies that the compiled entry is an in-package file, validates skill and MCP sources, copies static assets under `dsh-plugin-assets`, and writes `dsh-plugin.mjs`. Before importing that wrapper, DSH revalidates that the installed package retained a `prepack` declaration containing the helper command. Failure to build or prepare fails installation before a cache generation is published. Rationale: [host-owned Git source preparation Agent Note](../../../.agents/notes/implemented/bug-fix/2026-08-08-host-owned-git-repository-plugin-preparation.md).

 ## Runtime composition

-Loading this package registers one effect-scoped Loader builtin. Each generated wrapper delegates to that builtin with its own module URL and prepared manifest. The runtime validates every declared skill root as an existing in-package directory before mounting — a package whose generated outputs were dropped (a `files`/`.npmignore` mistake, a damaged cache entry) fails the plugin load instead of silently mounting a skill-less plugin. Repository skill roots mount as a uniquely named `dsh-skill-local` provider with default project/user roots excluded and watching disabled; cached package generations are immutable. Wrapper disposal removes the provider and all composed MCP clients through normal Cordis child-fiber teardown.
+Loading this package registers one effect-scoped Loader builtin. Each generated wrapper delegates its prepared static manifest to that builtin, then imports and mounts `dsh.entry` when declared. The entry is an ordinary Cordis child Plugin: its own `inject` gates activation, startup failures reject the repository generation, and all of its effects disappear on Loader removal or rollback. The runtime likewise validates every declared skill root as an existing in-package directory before mounting — a package whose generated outputs were dropped by `files`/`.npmignore` or damaged in cache fails instead of silently losing contributions. Repository skill roots mount as uniquely named `dsh-skill-local` providers with default project/user roots excluded and watching disabled; cached package generations are immutable.

 ## Common MCP format

 The `.mcp.json` root is `{ "mcpServers": { ... } }`. A stdio entry accepts only `type: "stdio"` (optional), `command`, `args`, and `env`; an HTTP entry accepts only `type: "http"`, `url`, and `headers`. String values support exact `${NAME}` process-environment expansion at Plugin load, and a missing name fails that load. HTTP URLs become the existing MCP client's `streamable-http` transport; stdio entries use the prepared package directory as `cwd`.

-Unknown fields reject, including OAuth and `auth` objects. There is no `CLAUDE_PLUGIN_ROOT` expansion or compatibility layer. After translation, the existing `dsh-mcp-client` exclusively owns transport creation, connection diagnostics, tool synchronization, calls, and disconnect lifecycle; a network or child-process connection failure retains that client's established log-and-no-tools behavior.
+Unknown fields reject, including OAuth and `auth` objects. There is no `CLAUDE_PLUGIN_ROOT` expansion or compatibility layer. After translation, the existing `dsh-mcp-client` exclusively owns transport creation, connection diagnostics, tool synchronization, calls, and disconnect lifecycle. Plugin activation waits for the initial connection and tool discovery, so the first model request observes a successful initial tool generation; a network or child-process connection failure is logged and still activates with no tools.

 ## Export shape

@@ -94,8 +105,22 @@ Conditional on successful connection and the remote tool list; schemas recur on

 Stable connected tool lists are prefix-stable. Plugin lifecycle or MCP tool-list changes can change later tool-schema prefixes from the first affected definition.

+### Repository code
+
+#### What the model sees
+
+Data-dependent. The trusted Cordis entry may contribute any DSH behavior available through its declared services and events, including tools, prompt sections, policies, commands, and transformations. Every model-visible contribution remains subject to its owning DSH seam's logging and lifecycle contract.
+
+#### Token effect
+
+Defined by the services and registrations the entry contributes; the repository format itself adds no model content.
+
+#### KV Cache effect
+
+Stable registrations preserve the owning surface's normal prefix behavior. Loading, removing, or replacing the exact repository generation can change any prefixes affected by that Plugin.
+
 ## Known Limitations and Deferred Work

- **Skills and MCP only** — commands, hooks, agents, apps, arbitrary Cordis code, marketplaces, and compatibility shims are intentionally outside this format.
+- **No code sandbox** — `dsh.entry`, npm dependencies, and package lifecycle scripts execute with the DSH host's authority; repository trust is mandatory.
 - **No MCP authentication protocol** — static headers may use environment expansion, but OAuth-bearing definitions reject and private-server login flows are not implemented here.
 - **Generated assets are immutable runtime input** — repository cache generations are not watched; source, ref, path, or configuration must select another prepared generation.
--- a/packages/self-modification/repository-plugin/README.zh.md
+++ b/packages/self-modification/repository-plugin/README.zh.md
@@ -2,7 +2,7 @@

 [English](README.md) | 中文

-这是 DeepSeek Harness 的受限 repository 插件格式。仓库作者在 `.dsh-plugin/package.json` 中声明静态 skill（技能）根和可选的通用 `.mcp.json`；prepare helper 会复制这些资源并生成固定、无 import 的 Cordis 包装模块。运行时包装模块只能委托给这个由 DSH 自有的包，再由它组合 [`dsh-skill-local`](../../skill/skill-local/README.md) 与 [`dsh-mcp-client`](../../mcp/mcp-client/README.md)。设计依据见[静态 repository 插件格式 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.md)。
+这是 DeepSeek Harness 的受信任 repository 包格式。`.dsh-plugin` NPM 包可以贡献已编译的 Cordis／DSH 插件入口、skill（技能）根和通用 `.mcp.json`；其常规 `prepack` 生命周期负责安装依赖并编译源码，随后 DSH 准备辅助程序校验输出并生成 Loader 包装层。静态贡献由 [`dsh-skill-local`](../../skill/skill-local/README.md) 与 [`dsh-mcp-client`](../../mcp/mcp-client/README.md) 组合。设计依据见[受信任 repository 包代码](../../../.agents/notes/implemented/architecture/2026-08-08-trusted-repository-package-code.md)和[静态贡献子格式](../../../.agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.md)。

 ## 创作格式

@@ -13,17 +13,30 @@
  "name": "humanize-dsh-plugin",
  "version": "0.0.0",
  "private": true,
+  "type": "module",
  "scripts": {
-    "prepack": "dsh-plugin-prepare"
+    "build": "tsc",
+    "prepack": "npm run build && dsh-plugin-prepare"
  },
  "dsh": {
+    "entry": "./lib/plugin.js",
    "skills": ["../skills"],
    "mcpServers": "../.mcp.json"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0"
+  },
+  "devDependencies": {
+    "typescript": "6.0.3"
  }
 }
 ```

-`scripts.prepack` 必须精确设为 `dsh-plugin-prepare`。DSH 会在准备 Git 源时由已安装的运行时提供该命令，因此仓库包无需添加 DSH 或 NPM 依赖。`dsh.skills` 是可选的本地 skill 根数组。`dsh.mcpServers` 是指向一个 `.mcp.json` 的可选路径；两者至少声明一个。路径相对于 `.dsh-plugin`，必须留在其父级源码目录下，因此可以引用 `../skills` 等仓库现有资源。一个仓库可以在不同的可选择子目录下放置多个各自独立的 `.dsh-plugin` 包。
+`scripts.prepack` 必须非空并调用 `dsh-plugin-prepare`；可以先运行任意包自有的构建步骤。DSH 已安装的运行时只提供该辅助命令：包自行声明并运行编译器、运行时依赖和其他 NPM 生命周期代码。DSH 不转译 TypeScript，也不推断包入口。
+
+`dsh.entry` 是指向 `.dsh-plugin` 内已编译 ESM Cordis 插件的可选相对路径。该模块可以使用 namespace 导出或 default export，并自行拥有常规的 `name`、`inject`、`Config`、注册和 effect。`dsh.skills` 是可选的本地 skill 根数组，`dsh.mcpServers` 是指向一个 `.mcp.json` 的可选路径；三个字段中至少声明一个。skill 和 MCP 路径可以引用相邻的 repository 资源，但必须留在包含 `.dsh-plugin` 的目录下；已编译入口必须留在由包管理器选中并打包的包内。一个仓库可以在不同的可选择子目录下放置多个各自独立的 `.dsh-plugin` 包。
+
+repository 包及其运行的每项依赖或生命周期脚本都是受信任代码，与用户直接选择的 NPM 包相同。本格式不是沙箱：只有在你信任仓库代码并愿意允许其访问宿主进程、文件系统、网络及其通过 Cordis 声明的服务时才应安装。精确 ref 和不可变缓存提供身份与可复现性，而非隔离。

 ## 独立应用配置

@@ -46,19 +59,17 @@ Git 传输使用宿主的常规 Git 认证。公共仓库无需凭据；私有

 ## 准备阶段

-安装精确指定的 Git 源时，DSH 会把一个临时的宿主自有 `dsh-plugin-prepare` 命令放入隔离的包生命周期 `PATH`；该命令不从 NPM 获取。必需的 `prepack` 生命周期在 Git 包完成依赖安装后、选定子目录打包前运行，即使 `.dsh-plugin` 位于另一个包管理器工作区内也不例外。该命令校验 `package.json#dsh`、确认 skill 根类型、解析 MCP 文件、把资源复制到 `dsh-plugin-assets`，并写入 `dsh-plugin.mjs`。导入该包装模块前，DSH 会重新校验已安装包是否仍保留精确的 `prepack` 声明。包装模块只包含规范化后的静态 manifest（元数据清单），以及查找 `dsh-repository-plugin` Loader builtin 的固定代码；它不会发现或编译仓库 JavaScript，运行时也不会导入仓库的其他入口。准备阶段未运行或未完成时，安装会在发布缓存 generation 前失败。设计依据见[宿主自有 Git 源准备 Agent Note](../../../.agents/notes/implemented/bug-fix/2026-08-08-host-owned-git-repository-plugin-preparation.md)。
-
-外层包管理器仍会运行已配置仓库包的生命周期脚本。这里的限制只定义 DSH 所支持的贡献表面；对于用户选择以可执行包管理器源安装的仓库，它并不是安全边界。
+安装精确指定的 Git 源时，DSH 会把一个临时的宿主自有 `dsh-plugin-prepare` 命令放入隔离的包生命周期 `PATH`；该命令不从 NPM 获取。必需的 `prepack` 生命周期在 Git 包完成依赖安装后、选定子目录打包前运行，即使 `.dsh-plugin` 位于另一个包管理器工作区内也不例外。包自有命令可以在调用辅助程序前构建 TypeScript 或其他源码。辅助程序会校验 `package.json#dsh`，确认已编译入口是包内文件，校验 skill 与 MCP 源，把静态资源复制到 `dsh-plugin-assets`，并写入 `dsh-plugin.mjs`。导入该包装层前，DSH 会重新校验已安装包是否仍保留包含该辅助命令的 `prepack` 声明。构建或准备失败时，安装会在发布缓存 generation 前失败。设计依据见[宿主自有 Git 源准备 Agent Note](../../../.agents/notes/implemented/bug-fix/2026-08-08-host-owned-git-repository-plugin-preparation.md)。

 ## 运行时组合

-加载本包会注册一个 effect-scoped Loader builtin。每个生成的包装模块都把自身模块 URL 和已准备的 manifest 委托给该 builtin。运行时在挂载前会校验每个声明的 skill 根都是包内实际存在的目录——生成输出被丢弃的包（`files`／`.npmignore` 配置失误、缓存条目损坏）会使插件加载失败，而不是静默挂载一个没有 skill 的插件。Repository skill 根以唯一命名的 `dsh-skill-local` 提供方挂载，排除默认项目／用户根并禁用监视；缓存包 generation 是不可变的。包装模块 dispose（资源释放）时，会通过正常的 Cordis 子 fiber teardown 移除提供方和所有组合的 MCP client。
+加载本包会注册一个 effect-scoped Loader builtin。每个生成的包装层都把已准备的静态 manifest（元数据清单）委托给该 builtin，再在声明了 `dsh.entry` 时导入并挂载该入口。入口是普通的 Cordis 子插件：其自有 `inject` 会门控激活，启动失败会拒绝 repository generation，Loader 移除或回滚时，其所有 effect 都会消失。运行时同样会在挂载前校验每个声明的 skill 根都是包内实际存在的目录——生成输出因 `files`／`.npmignore` 被丢弃或在缓存中损坏的包会加载失败，而不是静默丢失贡献。Repository skill 根以唯一命名的 `dsh-skill-local` 提供方挂载，排除默认项目／用户根并禁用监视；缓存包 generation 是不可变的。

 ## 通用 MCP 格式

 `.mcp.json` 根对象是 `{ "mcpServers": { ... } }`。stdio 条目只接受可选的 `type: "stdio"`、`command`、`args` 和 `env`；HTTP 条目只接受 `type: "http"`、`url` 和 `headers`。字符串值在插件加载时支持严格的 `${NAME}` 进程环境变量展开；缺失变量会使该次加载失败。HTTP URL 映射到现有 MCP client 的 `streamable-http` transport；stdio 条目以已准备的包目录作为 `cwd`。

-未知字段会被拒绝，包括 OAuth 字段与 `auth` 对象。不提供 `CLAUDE_PLUGIN_ROOT` 展开或兼容层。完成格式转换后，现有 `dsh-mcp-client` 独占 transport 创建、连接诊断、工具同步、调用和断开生命周期；网络或子进程连接失败沿用该 client 既有的“记录错误且不注册工具”行为。
+未知字段会被拒绝，包括 OAuth 字段与 `auth` 对象。不提供 `CLAUDE_PLUGIN_ROOT` 展开或兼容层。完成格式转换后，现有 `dsh-mcp-client` 独占 transport 创建、连接诊断、工具同步、调用和断开生命周期。插件激活会等待初始连接与工具发现，因此首个模型请求会看到成功的初始工具 generation；网络或子进程连接失败会记录日志，且插件仍会激活但不注册工具。

 ## 导出形状

@@ -94,8 +105,22 @@ Namespace 插件：具名导出 `name`／`inject`／`apply`、准备阶段常量

 稳定的已连接工具列表保持前缀稳定。插件生命周期或 MCP 工具列表变化可能从首个受影响定义开始改变后续工具 schema 前缀。

+### Repository 代码
+
+#### 模型看到什么
+
+取决于数据。受信任的 Cordis 入口可以通过其声明的服务和事件贡献任意可用的 DSH 行为，包括工具、提示词片段、策略、命令和转换。每项模型可见贡献仍受所属 DSH seam 的日志与生命周期契约约束。
+
+#### Token 影响
+
+由入口贡献的服务和注册决定；repository 格式本身不添加模型内容。
+
+#### KV Cache 影响
+
+稳定的注册会保留所属表面的正常前缀行为。加载、移除或替换精确的 repository generation，可能改变受该插件影响的任意前缀。
+
 ## 已知限制与暂缓事项

- **仅支持 skill 与 MCP**：commands、钩子、agent（智能体）、apps、任意 Cordis 代码、marketplace 和兼容 shim 均有意排除在该格式之外。
+- **没有代码沙箱**：`dsh.entry`、NPM 依赖和包生命周期脚本以 DSH 宿主权限执行；必须信任该 repository。
 - **没有 MCP 认证协议**：静态 header 可以使用环境变量展开，但带 OAuth 的定义会被拒绝，私有 server 登录流程不在此实现。
 - **生成资源是不可变运行时输入**：repository cache generation 不受监视；必须改变 source、ref、path 或配置才能选择另一份已准备 generation。
--- a/packages/self-modification/repository-plugin/package.json
+++ b/packages/self-modification/repository-plugin/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@deepseek-ai/dsh-repository-plugin",
-  "description": "Restricted repository plugin format and Cordis runtime for DeepSeek Harness",
+  "description": "Trusted repository package format and Cordis runtime for DeepSeek Harness",
  "version": "0.0.1",
  "private": true,
  "type": "module",
--- a/packages/self-modification/repository-plugin/src/format.ts
+++ b/packages/self-modification/repository-plugin/src/format.ts
@@ -1,5 +1,5 @@
 /**
- * Static repository-plugin preparation and prepared-manifest validation.
+ * Trusted repository-package preparation and prepared-manifest validation.
 * @module
 */

@@ -12,21 +12,36 @@ import { parseMcpDocument } from './mcp.ts'
 export const PREPARED_ENTRY_FILENAME = 'dsh-plugin.mjs'
 /** Fixed directory containing copied static plugin assets. */
 export const PREPARED_ASSET_DIRECTORY = 'dsh-plugin-assets'
-/** Loader builtin used by every generated import-free wrapper. */
+/** Loader builtin used by every generated repository wrapper. */
 export const REPOSITORY_PLUGIN_BUILTIN = 'dsh-repository-plugin'
-/** Exact host-owned command required by the repository package `prepack` lifecycle. */
+/** Host-owned command that repository package `prepack` lifecycles must invoke. */
 export const REPOSITORY_PLUGIN_PREPARE_COMMAND = 'dsh-plugin-prepare'

+/**
+ * Whether a package lifecycle declaration names the host preparation helper.
+ * @param script - package-authored lifecycle command.
+ * @returns true when the required helper command is present.
+ */
+export function hasRepositoryPrepareCommand(script: string): boolean {
+  return script.includes(REPOSITORY_PLUGIN_PREPARE_COMMAND)
+}
+
+const prepackSchema = z.string().min(1).refine(
+  hasRepositoryPrepareCommand,
+  { message: `must invoke ${REPOSITORY_PLUGIN_PREPARE_COMMAND}` },
+)
+
 const sourceMetadataSchema = z.object({
  skills: z.array(z.string().min(1)).default([]),
  mcpServers: z.string().min(1).optional(),
-}).strict().refine(value => value.skills.length > 0 || value.mcpServers !== undefined, {
-  message: 'declare at least one skill root or mcpServers file',
+  entry: z.string().min(1).optional(),
+}).strict().refine(value => value.skills.length > 0 || value.mcpServers !== undefined || value.entry !== undefined, {
+  message: 'declare at least one skill root, mcpServers file, or compiled entry',
 })
 const sourcePackageSchema = z.looseObject({
  name: z.string().min(1),
  scripts: z.looseObject({
-    prepack: z.literal(REPOSITORY_PLUGIN_PREPARE_COMMAND),
+    prepack: prepackSchema,
  }),
  dsh: sourceMetadataSchema,
 })
@@ -34,6 +49,7 @@ const preparedManifestSchema = z.object({
  name: z.string().min(1),
  skills: z.array(z.string().min(1)),
  mcpServers: z.string().min(1).optional(),
+  entry: z.string().min(1).optional(),
 }).strict()
 const preparedConfigSchema = z.object({
  // Wrappers pass import.meta.url, which is always file: for an installed
@@ -43,11 +59,12 @@ const preparedConfigSchema = z.object({
  manifest: preparedManifestSchema,
 }).strict()

-/** Static manifest embedded in the generated wrapper. */
+/** Prepared manifest embedded in the generated wrapper. */
 export interface PreparedPluginManifest {
  name: string
  skills: string[]
  mcpServers?: string
+  entry?: string
 }

 /** Untrusted generated-wrapper config accepted by the DSH-owned runtime builtin. */
@@ -74,6 +91,7 @@ export function parsePreparedPluginConfig(value: unknown): PreparedPluginConfig
      name: result.data.manifest.name,
      skills: result.data.manifest.skills,
      ...result.data.manifest.mcpServers === undefined ? {} : { mcpServers: result.data.manifest.mcpServers },
+      ...result.data.manifest.entry === undefined ? {} : { entry: result.data.manifest.entry },
    },
  }
 }
@@ -121,28 +139,49 @@ function wrapperSource(manifest: PreparedPluginManifest): string {
    ...manifest.skills.length > 0 ? ['skills'] : [],
    ...manifest.mcpServers === undefined ? [] : ['tools'],
  ]
+  const entryHelpers = manifest.entry === undefined ? [] : [
+    'function unwrap(exports) {',
+    '  const value = exports?.default ?? exports',
+    '  return value?.__esModule ? (value.default ?? value) : value',
+    '}',
+  ]
+  const entryApply = manifest.entry === undefined ? [] : [
+    '  const repositoryPlugin = unwrap(await import(manifest.entry))',
+    "  await mount(ctx, repositoryPlugin, 'repository Plugin entry')",
+  ]
  return [
    '// Generated by dsh-plugin-prepare. Do not edit.',
    `const manifest = ${JSON.stringify(manifest)}`,
+    'const FIBER_ACTIVE = 2',
    `export const name = ${JSON.stringify(manifest.name)}`,
    `export const inject = ${JSON.stringify(inject)}`,
+    ...entryHelpers,
+    'async function mount(ctx, plugin, label, config) {',
+    '  const fiber = ctx.plugin(plugin, config)',
+    '  await fiber',
+    '  if (fiber.state !== FIBER_ACTIVE) {',
+    '    const missing = Object.keys(fiber.inject).filter(service => fiber.ctx.get(service) === undefined)',
+    "    throw new Error(`${label} did not activate (waiting for services: ${missing.join(', ') || 'unknown'})`)",
+    '  }',
+    '}',
    'export async function apply(ctx) {',
    `  const runtime = ctx.loader.builtins[${JSON.stringify(REPOSITORY_PLUGIN_BUILTIN)}]`,
    `  if (runtime === undefined) throw new Error(${JSON.stringify(`missing Cordis builtin ${REPOSITORY_PLUGIN_BUILTIN}`)})`,
-    '  await ctx.plugin(runtime, { baseUrl: import.meta.url, manifest })',
+    "  await mount(ctx, runtime, 'repository Plugin runtime', { baseUrl: import.meta.url, manifest })",
+    ...entryApply,
    '}',
    '',
  ].join('\n')
 }

 /**
- * Validate and package one `.dsh-plugin` directory into static assets plus a fixed wrapper.
+ * Validate and package one `.dsh-plugin` directory into copied assets plus a generated wrapper.
 * Outputs are staged and committed by rename, but the final publish (remove
 * old outputs, rename assets, rename entry) is not one atomic step: a crash
 * mid-publish can leave assets without an entry or neither. Rerunning prepare
 * repairs the package; partial outputs are never importable as a plugin.
 * @param directory - `.dsh-plugin` package directory; defaults to the prepare process cwd.
- * @returns the generated static manifest.
+ * @returns the generated prepared manifest.
 */
 export async function prepareDshPlugin(directory: string = process.cwd()): Promise<PreparedPluginManifest> {
  const pluginDirectory = await realpath(resolve(directory))
@@ -169,11 +208,17 @@ export async function prepareDshPlugin(directory: string = process.cwd()): Promi
    mcpSource = await sourcePath(pluginDirectory, sourceRoot, parsed.data.dsh.mcpServers, 'file')
    parseMcpDocument(await readFile(mcpSource, 'utf8'))
  }
+  let entry: string | undefined
+  if (parsed.data.dsh.entry !== undefined) {
+    const entrySource = await sourcePath(pluginDirectory, pluginDirectory, parsed.data.dsh.entry, 'file')
+    entry = `./${relative(pluginDirectory, entrySource).split(sep).join('/')}`
+  }

  const manifest: PreparedPluginManifest = {
    name: parsed.data.name,
    skills: skillSources.map((_, index) => `${PREPARED_ASSET_DIRECTORY}/skills/${index}`),
    ...mcpSource === undefined ? {} : { mcpServers: `${PREPARED_ASSET_DIRECTORY}/.mcp.json` },
+    ...entry === undefined ? {} : { entry },
  }
  const staging = await mkdtemp(join(pluginDirectory, '.dsh-plugin-prepare-'))
  try {
--- a/packages/self-modification/repository-plugin/src/index.ts
+++ b/packages/self-modification/repository-plugin/src/index.ts
@@ -1,5 +1,5 @@
 /**
- * Restricted repository-plugin runtime for static skills and common MCP definitions.
+ * Trusted repository-package runtime for code, skills, and common MCP definitions.
 * @module @deepseek-ai/dsh-repository-plugin
 */

--- a/packages/self-modification/repository-plugin/src/source.ts
+++ b/packages/self-modification/repository-plugin/src/source.ts
@@ -14,6 +14,7 @@ import { z } from 'zod'
 import {
  PREPARED_ENTRY_FILENAME,
  REPOSITORY_PLUGIN_PREPARE_COMMAND,
+  hasRepositoryPrepareCommand,
 } from './format.ts'

 // Value mirror: Cordis's const enum has no runtime object to import. Keep
@@ -80,7 +81,10 @@ export async function createRepositoryPrepareCommand(): Promise<RepositoryPrepar
 const GITHUB_SOURCE_PATTERN = /^github:([^/\s#&]+)\/([^/\s#&]+)#([^\s#&]+)(?:&path:(\/[^\s&]+))?$/
 const installedPackageSchema = z.looseObject({
  scripts: z.looseObject({
-    prepack: z.literal(REPOSITORY_PLUGIN_PREPARE_COMMAND),
+    prepack: z.string().min(1).refine(
+      hasRepositoryPrepareCommand,
+      { message: `must invoke ${REPOSITORY_PLUGIN_PREPARE_COMMAND}` },
+    ),
  }),
 })

@@ -127,7 +131,7 @@ async function assertInstalledPackageMetadata(directory: string): Promise<void>
  }
  const result = installedPackageSchema.safeParse(value)
  if (!result.success) {
-    throw new Error(`installed DSH plugin package must declare scripts.prepack as ${JSON.stringify(REPOSITORY_PLUGIN_PREPARE_COMMAND)}:\n${z.prettifyError(result.error)}`)
+    throw new Error(`installed DSH plugin package must declare a non-empty scripts.prepack that invokes ${JSON.stringify(REPOSITORY_PLUGIN_PREPARE_COMMAND)}:\n${z.prettifyError(result.error)}`)
  }
 }

--- a/packages/self-modification/repository-plugin/tests/repository-plugin.spec.ts
+++ b/packages/self-modification/repository-plugin/tests/repository-plugin.spec.ts
@@ -28,13 +28,18 @@ async function temporaryDirectory(name: string): Promise<string> {
  return directory
 }

-async function writePlugin(root: string, name: string, dsh: Record<string, unknown>): Promise<string> {
+async function writePlugin(
+  root: string,
+  name: string,
+  dsh: Record<string, unknown>,
+  prepack = RepositoryPlugin.REPOSITORY_PLUGIN_PREPARE_COMMAND,
+): Promise<string> {
  const directory = join(root, '.dsh-plugin')
  await mkdir(directory, { recursive: true })
  await writeFile(join(directory, 'package.json'), `${JSON.stringify({
    name,
    version: '0.0.0',
-    scripts: { prepack: RepositoryPlugin.REPOSITORY_PLUGIN_PREPARE_COMMAND },
+    scripts: { prepack },
    dsh,
  }, undefined, 2)}\n`)
  return directory
@@ -82,6 +87,24 @@ describe('dsh-plugin-prepare', () => {
      .resolves.toContain('mcp.expo.dev')
  })

+  it('preserves a compiled package entry and accepts a build before the host prepare command', async () => {
+    const root = await temporaryDirectory('compiled-entry')
+    const directory = await writePlugin(root, 'compiled-entry-fixture', {
+      entry: './lib/plugin.mjs',
+    }, 'npm run build && dsh-plugin-prepare')
+    await mkdir(join(directory, 'lib'))
+    await writeFile(join(directory, 'lib/plugin.mjs'), 'export default { name: "compiled-entry" }\n')
+
+    await expect(RepositoryPlugin.prepareDshPlugin(directory)).resolves.toEqual({
+      name: 'compiled-entry-fixture',
+      skills: [],
+      entry: './lib/plugin.mjs',
+    })
+    const wrapper = await readFile(join(directory, RepositoryPlugin.PREPARED_ENTRY_FILENAME), 'utf8')
+    expect(wrapper).toContain('await import(manifest.entry)')
+    expect(wrapper).toContain('"entry":"./lib/plugin.mjs"')
+  })
+
  it('rejects unsupported OAuth MCP metadata before publishing outputs', async () => {
    const root = await temporaryDirectory('oauth')
    await writeFile(join(root, '.mcp.json'), JSON.stringify({
@@ -118,9 +141,18 @@ describe('dsh-plugin-prepare', () => {
    }))
    await expect(RepositoryPlugin.prepareDshPlugin(lifecycle)).rejects.toThrow('prepack')

+    const skippedPrepareRoot = await temporaryDirectory('skipped-prepare')
+    const skippedPrepare = await writePlugin(
+      skippedPrepareRoot,
+      'skipped-prepare',
+      { skills: ['../skills'] },
+      'npm run build',
+    )
+    await expect(RepositoryPlugin.prepareDshPlugin(skippedPrepare)).rejects.toThrow('must invoke dsh-plugin-prepare')
+
    const emptyRoot = await temporaryDirectory('empty-metadata')
    const empty = await writePlugin(emptyRoot, 'empty', {})
-    await expect(RepositoryPlugin.prepareDshPlugin(empty)).rejects.toThrow('declare at least one skill root or mcpServers file')
+    await expect(RepositoryPlugin.prepareDshPlugin(empty)).rejects.toThrow('declare at least one skill root, mcpServers file, or compiled entry')

    const missingRoot = await temporaryDirectory('missing-asset')
    const missing = await writePlugin(missingRoot, 'missing', { skills: ['../missing'] })
@@ -149,16 +181,21 @@ describe('dsh-plugin-prepare', () => {
    await writeSkill(outside, 'outside-skill')
    const escaped = await writePlugin(escapedRoot, 'escaped', { skills: [relative(join(escapedRoot, '.dsh-plugin'), outside)] })
    await expect(RepositoryPlugin.prepareDshPlugin(escaped)).rejects.toThrow('escapes its plugin source root')
+
+    const escapedEntryRoot = await temporaryDirectory('escaped-entry')
+    await writeFile(join(escapedEntryRoot, 'outside.mjs'), 'export default {}\n')
+    const escapedEntry = await writePlugin(escapedEntryRoot, 'escaped-entry', { entry: '../outside.mjs' })
+    await expect(RepositoryPlugin.prepareDshPlugin(escapedEntry)).rejects.toThrow('escapes its plugin source root')
  })

-  it('validates prepared wrapper configs with and without MCP assets', () => {
+  it('validates prepared wrapper configs with optional MCP assets and code entries', () => {
    expect(() => parsePreparedPluginConfig({})).toThrow('invalid prepared DSH plugin')
    expect(parsePreparedPluginConfig({
      baseUrl: 'file:///plugin/dsh-plugin.mjs',
-      manifest: { name: 'fixture', skills: [], mcpServers: 'dsh-plugin-assets/.mcp.json' },
+      manifest: { name: 'fixture', skills: [], mcpServers: 'dsh-plugin-assets/.mcp.json', entry: './lib/plugin.js' },
    })).toEqual({
      baseUrl: 'file:///plugin/dsh-plugin.mjs',
-      manifest: { name: 'fixture', skills: [], mcpServers: 'dsh-plugin-assets/.mcp.json' },
+      manifest: { name: 'fixture', skills: [], mcpServers: 'dsh-plugin-assets/.mcp.json', entry: './lib/plugin.js' },
    })
  })
 })
@@ -195,6 +232,35 @@ describe('prepared repository plugin Loader composition', () => {
    await ctx.fiber.dispose()
  })

+  it('mounts and removes the repository package code entry through the real Loader', async () => {
+    const root = await temporaryDirectory('code-loader')
+    const directory = await writePlugin(root, 'code-loader-fixture', { entry: './lib/plugin.mjs' })
+    await mkdir(join(directory, 'lib'))
+    await writeFile(join(directory, 'lib/plugin.mjs'), [
+      "export const name = 'repository-code-proof'",
+      'export function apply(ctx) {',
+      "  ctx.provide('repositoryCodeProof', { source: 'compiled-entry' })",
+      '}',
+      '',
+    ].join('\n'))
+    await RepositoryPlugin.prepareDshPlugin(directory)
+
+    const ctx = new Context()
+    ctx.baseUrl = pathToFileURL(directory).href + '/'
+    await ctx.plugin(Loader)
+    await ctx.plugin(RepositoryPlugin)
+    const id = await ctx.loader.create({
+      name: pathToFileURL(join(directory, RepositoryPlugin.PREPARED_ENTRY_FILENAME)).href,
+    })
+    await ctx.loader.await()
+    const getService = (name: string): unknown => (ctx as unknown as { get(name: string): unknown }).get(name)
+    expect(getService('repositoryCodeProof')).toEqual({ source: 'compiled-entry' })
+
+    await ctx.loader.remove(id)
+    expect(getService('repositoryCodeProof')).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
  it('delegates an MCP-only plugin to the existing client without turning connect failure into Loader failure', async () => {
    const root = await temporaryDirectory('mcp-loader')
    await writeFile(join(root, '.mcp.json'), JSON.stringify({
@@ -484,7 +550,23 @@ describe('configured GitHub repository sources', () => {
    await expect(loadPreparedRepository(ctx, { resolve: async () => root }, 'github:owner/repository#old&path:/.dsh-plugin'))
      .rejects.toMatchObject({
        cause: expect.objectContaining({
-          message: expect.stringContaining('must declare scripts.prepack') as string,
+          message: expect.stringContaining('must declare a non-empty scripts.prepack') as string,
+        }) as Error,
+      })
+    await ctx.fiber.dispose()
+  })
+
+  it('rejects an installed source whose prepack omits the host prepare command', async () => {
+    const root = await temporaryDirectory('installed-skipped-prepare')
+    await writeFile(join(root, 'package.json'), JSON.stringify({
+      name: 'installed-skipped-prepare',
+      scripts: { prepack: 'npm run build' },
+    }))
+    const ctx = new Context()
+    await expect(loadPreparedRepository(ctx, { resolve: async () => root }, 'github:owner/repository#unprepared&path:/.dsh-plugin'))
+      .rejects.toMatchObject({
+        cause: expect.objectContaining({
+          message: expect.stringContaining('must invoke dsh-plugin-prepare') as string,
        }) as Error,
      })
    await ctx.fiber.dispose()