feat(plugins): wire extraKnownMarketplaces + enabledPlugins via container.json

[yaniv-golan]

Summary

Add per-group plugin support via the SDK's settings-driven install path. Operators declare marketplaces + enabled plugins in groups/<folder>/container.json:plugins; the host mirrors them into per-group settings.json (extraKnownMarketplaces / enabledPlugins) on every spawn, and the container env gets CLAUDE_CODE_SYNC_PLUGIN_INSTALL=1 + CLAUDE_CODE_REMOTE=1 (gated on plugins being non-empty).

Also lays the foundation for safe concurrent writes to container.json (needed by the per-group operator skills in a follow-up PR).

What's new

Host:

• ContainerConfig.plugins field with the SDK's typed extraKnownMarketplaces source schema (8 variants) and enabledPlugins value union (boolean | string[] | object).
• New updateContainerConfig(folder, mutate) async helper. Atomic write-then-rename in writeContainerConfig. Advisory file lock (60s stale TTL, jittered polling). Existing applyInstallPackages / applyAddMcpServer callers routed through the locked path; ensureRuntimeFields and per-group imageTag write also locked.
• ensurePluginsConfig() in group-init mirrors container.json:plugins into settings.json on every spawn. Defensive against malformed/non-object/stale-format settings.json. Additive merge (entries already present in settings.json that aren't in container.json are preserved).
• container-runner sets CLAUDE_CODE_SYNC_PLUGIN_INSTALL=1 + CLAUDE_CODE_REMOTE=1 when plugins block is non-empty. CLAUDE_CODE_REMOTE is mandatory — without it, github source URLs default to SSH and bypass the OneCLI gateway entirely.
• Drive-by fix bundled: GIT_SSL_CAINFO is now set to mirror NODE_EXTRA_CA_CERTS. OneCLI's applyContainerConfig() injects the latter for various language runtimes but not for git, so the SDK's marketplace clones (which shell out to git clone) failed with "server certificate verification failed" through the gateway. With the new env, git trusts the OneCLI MITM cert and clones complete normally.

Container:

• Provider event types: new plugin_install_failed variant on ProviderEvent.
• claude.ts:translateEvents() handles SDK plugin_install system messages — failed status emits the new event, others are activity-only.
• poll-loop.ts:handleEvent logs plugin_install_failed events for operator visibility.

Tests

• 12 new vitest cases in src/container-config.test.ts and src/group-init.test.ts:
  • Atomic write (no .tmp.* leftovers after rename)
  • 10 concurrent writers serialized via the lock (vitest spawns in parallel)
  • Lock release on mutator throw (no deadlock)
  • Defensive parsing: malformed JSON, non-object top level, missing blocks
  • First-init with plugins pre-declared in container.json
  • Idempotent re-merge
  • Additive merge preserves pre-existing settings.json entries
  • container.json wins on key collision
  • Plugins-config round-trip through write+read
• Vitest config exclude pattern added so **/container/** (which uses bun:test) doesn't get picked up by host vitest under v4's auto-workspace discovery.

How operators use it

Without follow-up operator skills, an operator can already use this PR by hand-editing groups/<folder>/container.json:

{
  "plugins": {
    "marketplaces": {
      "anthropic": {
        "source": { "source": "github", "repo": "anthropics/skills", "ref": "main" }
      }
    },
    "enabled": { "doc-coauthoring@anthropic": true }
  }
}

Restart the group; the SDK installs the marketplace + plugins at next session init.

Empirical verification

End-to-end: container respawned after declaring xiaolai-marketplace in container.json:plugins. plugin_install:installed fires inside the container; SDK clones marketplace into ~/.claude/plugins/marketplaces/xiaolai/; installed_plugins.json and known_marketplaces.json both written by SDK as expected; agent's init event lists the new codex-toolkit plugin.

For the failure path: declaring a private repo without the corresponding OneCLI vault github auth produces a plugin_install:failed event with a clear "marketplace.json not found" or "authentication failed" message — surfaced via the new plugin_install_failed provider event.

Test plan

• pnpm test (host) passes — 435 tests, including 12 new ones for this change
• bun run typecheck (container) clean
• End-to-end: container spawns with new env, SDK installs marketplace, plugin loads in agent's init event
• Failure mode: clone fails → plugin_install_failed event → operator sees error in host log

🤖 Generated with Claude Code