feat(desktop): plugins install in one click from hermes:// deeplinks, confirm-first (salvage #82735)

[teknium1]

Summary

Plugins now install in one click from a hermes://plugin/install?repo=owner/repo deeplink (or Settings → Plugins → Install from Git), with a review step before anything touches disk — matching the confirm-first precedent set by the MCP install deeplink. Never auto-installs.

Salvage of #82735 by @serefyarar (branch carried merge commits, so the net diff was applied as a single authored commit preserving attribution). Per repo policy the preview-screenshot PNG committed on the original branch was dropped — images live in PR bodies, not the tree.

Changes

• apps/desktop/electron/desktop-plugin-install.ts (new): git URL/owner-repo resolution, shallow clone + agent/desktop artifact probe, subdir-escape guard, 60s clone timeout, non-interactive git env (GIT_TERMINAL_PROMPT=0), insecure-scheme warnings, stable install-folder naming from repo identity
• apps/desktop/src/app/settings/plugin-install-modal.tsx (new) + plugin-install-request.ts: review → probe → choose → install flow; hybrid repos (agent + desktop) get one dialog; legacy plugin-agent/plugin-desktop links route into the same modal
• apps/desktop/src/lib/deeplink-routes.ts + plugin-source-urls.ts (new): deeplink parsing and GitHub browse/clone URL derivation, with tests
• tui_gateway/methods_tools.py: plugins.manage gains an install action wrapping the existing dashboard_install_plugin (inherits the security-scan gate); runs inside the same profile-override bracket as list/toggle, so the profile param routes installs to the right HERMES_HOME
• i18n: en + zh strings

Validation

Check	Result
vitest (deeplink-routes, plugin-source-urls, desktop-plugin-install)	18/18 pass
pytest tests/tui_gateway/test_plugins_manage_install.py	3/3 pass
npm run check:lint (tsc ×3 + eslint)	0 errors
Profile routing	verified: install runs under _mcp_resolve_profile HERMES_HOME override

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 999cd3a — feat(desktop): one-click plugin install via hermes:// deepli}

⚠️ Warnings

CI timings · View report · View job

Wall time 10m1s vs 3m41s (+171.9%). 18 job(s) slower, 18 faster, 2 unchanged.

• JS & TS checks / apps/desktop / check:test:ui:shard-1of3: -44.0s
• Python tests / Run tests slice 8/12: +36.0s
• Python tests / Run tests slice 6/12: -29.0s
• Python tests / Run tests slice 11/12: +28.0s
• Python tests / Run tests slice 5/12: -23.0s

---

OSV vulnerability scan · View job

7 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

[Enough1122]

AI code review — automated review for reference; please use your judgment.

• path traversal: desktopPluginFolderName filters ''/'.'/'desktop' from subdir segments but not '..'. A deeplink like repo=owner/repo/plugins/foo/.. passes resolveSubdirWithin (it resolves inside the clone) yet yields folder name '..', so targetDir = desktopPluginsRoot/..; with force=1 the pre-install fsp.rm(targetDir, {recursive:true}) would delete outside the plugins root. Reject/sanitize .. segments when deriving the folder name.
• security posture (positive): array-args spawn (no shell), GIT_TERMINAL_PROMPT=0 + askpass neutering, 60s SIGKILL clone timeout, subdir-escape guard, inbound-deeplink scheme allowlist, and confirm-first modal are all the right calls; agent installs ride the existing dashboard_install_plugin scan gate.
• duplication: resolvePluginGitUrl and the GitHub URL parsing are duplicated near-verbatim between electron/desktop-plugin-install.ts and src/lib/plugin-source-urls.ts; drift between the two will produce browse-links that disagree with what's actually cloned. Consider extracting a shared pure module.
• nit: i18n strings hardcode ~/.hermes/plugins/ as display text (agentTargetLocal) — cosmetic today, but reads wrong for non-default profiles.
• footprint: extends the existing plugins.manage gateway method instead of adding a tool — correct rung on the ladder; tests are behavior-based (no source-reading/change-detector patterns).