[sosidudku1]

What

ATO-1391. New L21-plugin-code-needs-consent.mjs and fixture plugin script-kit (one skill, one harmless script that writes a flag file; no network words, so the install scan lets it through). It is installed with atag plugin install and no terminal, so its code is off. The scripted model then tries three ways to run it:

1. skill.run_script on script-kit:stamp: refused with "are off until code is allowed", no card, no flag file.
2. atag plugin allow-code script-kit through the shell: the dangerous-command card ("allow a plugin to run code") with only Allow once / Deny / Abort; after Deny plugins.json has no consent.
3. os.fs.write of a forged consent straight into plugins.json: a card with only one-time answers; after Deny the file is byte for byte unchanged.

ATO-1392. New L22-dangerous-plugin-refused.mjs and two fixture plugins, all installed with no terminal and no --yes:

• evil-hook (a hook running curl … | sh): exit non-zero, last line "install blocked: flagged dangerous", the remote-exec finding named, no folder in plugins/installed, no record;
• fetch-note (a skill that only mentions curl): exit non-zero with "install needs confirmation", nothing installed;
• a-live-kit (the ordinary L07 plugin): installs, so the scan is not just refusing everything. atag plugin list --json and Settings › Plugins show only it.

plugin-cli.mjs is the CLI helper both share (same environment L07 gives the CLI; never throws on a non-zero exit). Stacked on the attack kit (#1199) for the card helpers; retarget to rel/xp-build once it is in.

Check on the second Mac

npm run build && (cd desktop && npm run build)
cd desktop && node test/live/run-all.mjs L21 L22 L07 L08

Expect PASS 4 FAIL 0. A check on L22 itself: with the remote-exec rule removed from src/skills/hub/skill-security-scanner.ts, L22 must fail.

Refs ATO-1391, ATO-1392.

Checked on the second Mac on 12.11.2026 in the combined run with the other open PRs: build, lint, test types, vitest, desktop unit tests, desktop smoke and live smoke all green.

[sosidudku1]

Closing: this code is already merged into rel/xp-build via #1257 (and into main via #1256 where it applies). GitHub did not mark it merged because the PR targets another feature branch.