Add scripts for resolving and verifying Chromium binary paths

- Implemented `chrome-path.js` to define functions for locating Chromium binaries across different platforms and nested directories.
- Added `verify-chromium.js` to check for the presence of the Chromium binary and log the results, including candidate paths checked.
- The scripts support Linux, Windows, and macOS environments, enhancing the flexibility of Chromium binary detection.

src/StellaOps.Cli/Commands/CommandFactory.cs

@@ -1,19 +1,27 @@
 using System;
 using System.CommandLine;
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Cli.Configuration;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Cli.Configuration;
+using StellaOps.Cli.Plugins;
 
 namespace StellaOps.Cli.Commands;
 
-internal static class CommandFactory
-{
-    public static RootCommand Create(IServiceProvider services, StellaOpsCliOptions options, CancellationToken cancellationToken)
-    {
-        var verboseOption = new Option<bool>("--verbose", new[] { "-v" })
-        {
-            Description = "Enable verbose logging output."
-        };
+internal static class CommandFactory
+{
+    public static RootCommand Create(
+        IServiceProvider services,
+        StellaOpsCliOptions options,
+        CancellationToken cancellationToken,
+        ILoggerFactory loggerFactory)
+    {
+        ArgumentNullException.ThrowIfNull(loggerFactory);
+
+        var verboseOption = new Option<bool>("--verbose", new[] { "-v" })
+        {
+            Description = "Enable verbose logging output."
+        };
 
         var root = new RootCommand("StellaOps command-line interface")
         {
@@ -24,12 +32,13 @@ internal static class CommandFactory
         root.Add(BuildScannerCommand(services, verboseOption, cancellationToken));
         root.Add(BuildScanCommand(services, options, verboseOption, cancellationToken));
         root.Add(BuildDatabaseCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildExcititorCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildRuntimeCommand(services, verboseOption, cancellationToken));
         root.Add(BuildAuthCommand(services, options, verboseOption, cancellationToken));
-        root.Add(BuildOfflineCommand(services, verboseOption, cancellationToken));
         root.Add(BuildConfigCommand(options));
 
+        var pluginLogger = loggerFactory.CreateLogger<CliCommandModuleLoader>();
+        var pluginLoader = new CliCommandModuleLoader(services, options, pluginLogger);
+        pluginLoader.RegisterModules(root, verboseOption, cancellationToken);
+
         return root;
     }
 
@@ -227,300 +236,6 @@ internal static class CommandFactory
         return db;
     }
 
-    private static Command BuildExcititorCommand(IServiceProvider services, Option<bool> verboseOption, CancellationToken cancellationToken)
-    {
-        var excititor = new Command("excititor", "Manage Excititor ingest, exports, and reconciliation workflows.");
-
-        var init = new Command("init", "Initialize Excititor ingest state.");
-        var initProviders = new Option<string[]>("--provider", new[] { "-p" })
-        {
-            Description = "Optional provider identifier(s) to initialize.",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-        var resumeOption = new Option<bool>("--resume")
-        {
-            Description = "Resume ingest from the last persisted checkpoint instead of starting fresh."
-        };
-        init.Add(initProviders);
-        init.Add(resumeOption);
-        init.SetAction((parseResult, _) =>
-        {
-            var providers = parseResult.GetValue(initProviders) ?? Array.Empty<string>();
-            var resume = parseResult.GetValue(resumeOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorInitAsync(services, providers, resume, verbose, cancellationToken);
-        });
-
-        var pull = new Command("pull", "Trigger Excititor ingest for configured providers.");
-        var pullProviders = new Option<string[]>("--provider", new[] { "-p" })
-        {
-            Description = "Optional provider identifier(s) to ingest.",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-        var sinceOption = new Option<DateTimeOffset?>("--since")
-        {
-            Description = "Optional ISO-8601 timestamp to begin the ingest window."
-        };
-        var windowOption = new Option<TimeSpan?>("--window")
-        {
-            Description = "Optional window duration (e.g. 24:00:00)."
-        };
-        var forceOption = new Option<bool>("--force")
-        {
-            Description = "Force ingestion even if the backend reports no pending work."
-        };
-        pull.Add(pullProviders);
-        pull.Add(sinceOption);
-        pull.Add(windowOption);
-        pull.Add(forceOption);
-        pull.SetAction((parseResult, _) =>
-        {
-            var providers = parseResult.GetValue(pullProviders) ?? Array.Empty<string>();
-            var since = parseResult.GetValue(sinceOption);
-            var window = parseResult.GetValue(windowOption);
-            var force = parseResult.GetValue(forceOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorPullAsync(services, providers, since, window, force, verbose, cancellationToken);
-        });
-
-        var resume = new Command("resume", "Resume Excititor ingest using a checkpoint token.");
-        var resumeProviders = new Option<string[]>("--provider", new[] { "-p" })
-        {
-            Description = "Optional provider identifier(s) to resume.",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-        var checkpointOption = new Option<string?>("--checkpoint")
-        {
-            Description = "Optional checkpoint identifier to resume from."
-        };
-        resume.Add(resumeProviders);
-        resume.Add(checkpointOption);
-        resume.SetAction((parseResult, _) =>
-        {
-            var providers = parseResult.GetValue(resumeProviders) ?? Array.Empty<string>();
-            var checkpoint = parseResult.GetValue(checkpointOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorResumeAsync(services, providers, checkpoint, verbose, cancellationToken);
-        });
-
-        var list = new Command("list-providers", "List Excititor providers and their ingest status.");
-        var includeDisabledOption = new Option<bool>("--include-disabled")
-        {
-            Description = "Include disabled providers in the listing."
-        };
-        list.Add(includeDisabledOption);
-        list.SetAction((parseResult, _) =>
-        {
-            var includeDisabled = parseResult.GetValue(includeDisabledOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorListProvidersAsync(services, includeDisabled, verbose, cancellationToken);
-        });
-
-        var export = new Command("export", "Trigger Excititor export generation.");
-        var formatOption = new Option<string>("--format")
-        {
-            Description = "Export format (e.g. openvex, json)."
-        };
-        var exportDeltaOption = new Option<bool>("--delta")
-        {
-            Description = "Request a delta export when supported."
-        };
-        var exportScopeOption = new Option<string?>("--scope")
-        {
-            Description = "Optional policy scope or tenant identifier."
-        };
-        var exportSinceOption = new Option<DateTimeOffset?>("--since")
-        {
-            Description = "Optional ISO-8601 timestamp to restrict export contents."
-        };
-        var exportProviderOption = new Option<string?>("--provider")
-        {
-            Description = "Optional provider identifier when requesting targeted exports."
-        };
-        var exportOutputOption = new Option<string?>("--output")
-        {
-            Description = "Optional path to download the export artifact."
-        };
-        export.Add(formatOption);
-        export.Add(exportDeltaOption);
-        export.Add(exportScopeOption);
-        export.Add(exportSinceOption);
-        export.Add(exportProviderOption);
-        export.Add(exportOutputOption);
-        export.SetAction((parseResult, _) =>
-        {
-            var format = parseResult.GetValue(formatOption) ?? "openvex";
-            var delta = parseResult.GetValue(exportDeltaOption);
-            var scope = parseResult.GetValue(exportScopeOption);
-            var since = parseResult.GetValue(exportSinceOption);
-            var provider = parseResult.GetValue(exportProviderOption);
-            var output = parseResult.GetValue(exportOutputOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorExportAsync(services, format, delta, scope, since, provider, output, verbose, cancellationToken);
-        });
-
-        var backfill = new Command("backfill-statements", "Replay historical raw documents into Excititor statements.");
-        var backfillRetrievedSinceOption = new Option<DateTimeOffset?>("--retrieved-since")
-        {
-            Description = "Only process raw documents retrieved on or after the provided ISO-8601 timestamp."
-        };
-        var backfillForceOption = new Option<bool>("--force")
-        {
-            Description = "Reprocess documents even if statements already exist."
-        };
-        var backfillBatchSizeOption = new Option<int>("--batch-size")
-        {
-            Description = "Number of raw documents to fetch per batch (default 100)."
-        };
-        var backfillMaxDocumentsOption = new Option<int?>("--max-documents")
-        {
-            Description = "Optional maximum number of raw documents to process."
-        };
-        backfill.Add(backfillRetrievedSinceOption);
-        backfill.Add(backfillForceOption);
-        backfill.Add(backfillBatchSizeOption);
-        backfill.Add(backfillMaxDocumentsOption);
-        backfill.SetAction((parseResult, _) =>
-        {
-            var retrievedSince = parseResult.GetValue(backfillRetrievedSinceOption);
-            var force = parseResult.GetValue(backfillForceOption);
-            var batchSize = parseResult.GetValue(backfillBatchSizeOption);
-            if (batchSize <= 0)
-            {
-                batchSize = 100;
-            }
-            var maxDocuments = parseResult.GetValue(backfillMaxDocumentsOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorBackfillStatementsAsync(
-                services,
-                retrievedSince,
-                force,
-                batchSize,
-                maxDocuments,
-                verbose,
-                cancellationToken);
-        });
-
-        var verify = new Command("verify", "Verify Excititor exports or attestations.");
-        var exportIdOption = new Option<string?>("--export-id")
-        {
-            Description = "Export identifier to verify."
-        };
-        var digestOption = new Option<string?>("--digest")
-        {
-            Description = "Expected digest for the export or attestation."
-        };
-        var attestationOption = new Option<string?>("--attestation")
-        {
-            Description = "Path to a local attestation file to verify (base64 content will be uploaded)."
-        };
-        verify.Add(exportIdOption);
-        verify.Add(digestOption);
-        verify.Add(attestationOption);
-        verify.SetAction((parseResult, _) =>
-        {
-            var exportId = parseResult.GetValue(exportIdOption);
-            var digest = parseResult.GetValue(digestOption);
-            var attestation = parseResult.GetValue(attestationOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorVerifyAsync(services, exportId, digest, attestation, verbose, cancellationToken);
-        });
-
-        var reconcile = new Command("reconcile", "Trigger Excititor reconciliation against canonical advisories.");
-        var reconcileProviders = new Option<string[]>("--provider", new[] { "-p" })
-        {
-            Description = "Optional provider identifier(s) to reconcile.",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-        var maxAgeOption = new Option<TimeSpan?>("--max-age")
-        {
-            Description = "Optional maximum age window (e.g. 7.00:00:00)."
-        };
-        reconcile.Add(reconcileProviders);
-        reconcile.Add(maxAgeOption);
-        reconcile.SetAction((parseResult, _) =>
-        {
-            var providers = parseResult.GetValue(reconcileProviders) ?? Array.Empty<string>();
-            var maxAge = parseResult.GetValue(maxAgeOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleExcititorReconcileAsync(services, providers, maxAge, verbose, cancellationToken);
-        });
-
-        excititor.Add(init);
-        excititor.Add(pull);
-        excititor.Add(resume);
-        excititor.Add(list);
-        excititor.Add(export);
-        excititor.Add(backfill);
-        excititor.Add(verify);
-        excititor.Add(reconcile);
-        return excititor;
-    }
-
-    private static Command BuildRuntimeCommand(IServiceProvider services, Option<bool> verboseOption, CancellationToken cancellationToken)
-    {
-        var runtime = new Command("runtime", "Interact with runtime admission policy APIs.");
-        var policy = new Command("policy", "Runtime policy operations.");
-
-        var test = new Command("test", "Evaluate runtime policy decisions for image digests.");
-        var namespaceOption = new Option<string?>("--namespace", new[] { "--ns" })
-        {
-            Description = "Namespace or logical scope for the evaluation."
-        };
-
-        var imageOption = new Option<string[]>("--image", new[] { "-i", "--images" })
-        {
-            Description = "Image digests to evaluate (repeatable).",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-
-        var fileOption = new Option<string?>("--file", new[] { "-f" })
-        {
-            Description = "Path to a file containing image digests (one per line)."
-        };
-
-        var labelOption = new Option<string[]>("--label", new[] { "-l", "--labels" })
-        {
-            Description = "Pod labels in key=value format (repeatable).",
-            Arity = ArgumentArity.ZeroOrMore
-        };
-
-        var jsonOption = new Option<bool>("--json")
-        {
-            Description = "Emit the raw JSON response."
-        };
-
-        test.Add(namespaceOption);
-        test.Add(imageOption);
-        test.Add(fileOption);
-        test.Add(labelOption);
-        test.Add(jsonOption);
-
-        test.SetAction((parseResult, _) =>
-        {
-            var nsValue = parseResult.GetValue(namespaceOption);
-            var images = parseResult.GetValue(imageOption) ?? Array.Empty<string>();
-            var file = parseResult.GetValue(fileOption);
-            var labels = parseResult.GetValue(labelOption) ?? Array.Empty<string>();
-            var outputJson = parseResult.GetValue(jsonOption);
-            var verbose = parseResult.GetValue(verboseOption);
-
-            return CommandHandlers.HandleRuntimePolicyTestAsync(
-                services,
-                nsValue,
-                images,
-                file,
-                labels,
-                outputJson,
-                verbose,
-                cancellationToken);
-        });
-
-        policy.Add(test);
-        runtime.Add(policy);
-        return runtime;
-    }
-
     private static Command BuildAuthCommand(IServiceProvider services, StellaOpsCliOptions options, Option<bool> verboseOption, CancellationToken cancellationToken)
     {
         var auth = new Command("auth", "Manage authentication with StellaOps Authority.");
@@ -607,97 +322,6 @@ internal static class CommandFactory
         return auth;
     }
 
-    private static Command BuildOfflineCommand(IServiceProvider services, Option<bool> verboseOption, CancellationToken cancellationToken)
-    {
-        var offline = new Command("offline", "Offline kit workflows and utilities.");
-
-        var kit = new Command("kit", "Manage offline kit bundles.");
-
-        var pull = new Command("pull", "Download the latest offline kit bundle.");
-        var bundleIdOption = new Option<string?>("--bundle-id")
-        {
-            Description = "Optional bundle identifier. Defaults to the latest available."
-        };
-        var destinationOption = new Option<string?>("--destination")
-        {
-            Description = "Directory to store downloaded bundles (defaults to the configured offline kits directory)."
-        };
-        var overwriteOption = new Option<bool>("--overwrite")
-        {
-            Description = "Overwrite existing files even if checksums match."
-        };
-        var noResumeOption = new Option<bool>("--no-resume")
-        {
-            Description = "Disable resuming partial downloads."
-        };
-
-        pull.Add(bundleIdOption);
-        pull.Add(destinationOption);
-        pull.Add(overwriteOption);
-        pull.Add(noResumeOption);
-        pull.SetAction((parseResult, _) =>
-        {
-            var bundleId = parseResult.GetValue(bundleIdOption);
-            var destination = parseResult.GetValue(destinationOption);
-            var overwrite = parseResult.GetValue(overwriteOption);
-            var resume = !parseResult.GetValue(noResumeOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleOfflineKitPullAsync(services, bundleId, destination, overwrite, resume, verbose, cancellationToken);
-        });
-
-        var import = new Command("import", "Upload an offline kit bundle to the backend.");
-        var bundleArgument = new Argument<string>("bundle")
-        {
-            Description = "Path to the offline kit tarball (.tgz)."
-        };
-        var manifestOption = new Option<string?>("--manifest")
-        {
-            Description = "Offline manifest JSON path (defaults to metadata or sibling file)."
-        };
-        var bundleSignatureOption = new Option<string?>("--bundle-signature")
-        {
-            Description = "Detached signature for the offline bundle (e.g. .sig)."
-        };
-        var manifestSignatureOption = new Option<string?>("--manifest-signature")
-        {
-            Description = "Detached signature for the offline manifest (e.g. .jws)."
-        };
-
-        import.Add(bundleArgument);
-        import.Add(manifestOption);
-        import.Add(bundleSignatureOption);
-        import.Add(manifestSignatureOption);
-        import.SetAction((parseResult, _) =>
-        {
-            var bundlePath = parseResult.GetValue(bundleArgument) ?? string.Empty;
-            var manifest = parseResult.GetValue(manifestOption);
-            var bundleSignature = parseResult.GetValue(bundleSignatureOption);
-            var manifestSignature = parseResult.GetValue(manifestSignatureOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleOfflineKitImportAsync(services, bundlePath, manifest, bundleSignature, manifestSignature, verbose, cancellationToken);
-        });
-
-        var status = new Command("status", "Display offline kit installation status.");
-        var jsonOption = new Option<bool>("--json")
-        {
-            Description = "Emit status as JSON."
-        };
-        status.Add(jsonOption);
-        status.SetAction((parseResult, _) =>
-        {
-            var asJson = parseResult.GetValue(jsonOption);
-            var verbose = parseResult.GetValue(verboseOption);
-            return CommandHandlers.HandleOfflineKitStatusAsync(services, asJson, verbose, cancellationToken);
-        });
-
-        kit.Add(pull);
-        kit.Add(import);
-        kit.Add(status);
-
-        offline.Add(kit);
-        return offline;
-    }
-
     private static Command BuildConfigCommand(StellaOpsCliOptions options)
     {
         var config = new Command("config", "Inspect CLI configuration state.");

src/StellaOps.Cli/Configuration/CliBootstrapper.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IO;
+using System.Linq;
 using Microsoft.Extensions.Configuration;
 using StellaOps.Configuration;
 using StellaOps.Auth.Abstractions;
@@ -234,6 +235,93 @@ public static class CliBootstrapper
                     "Offline:MirrorUrl");
 
                 offline.MirrorUrl = string.IsNullOrWhiteSpace(mirror) ? null : mirror.Trim();
+
+                cliOptions.Plugins ??= new StellaOpsCliPluginOptions();
+                var pluginOptions = cliOptions.Plugins;
+
+                pluginOptions.BaseDirectory = ResolveWithFallback(
+                    pluginOptions.BaseDirectory,
+                    configuration,
+                    "STELLAOPS_CLI_PLUGIN_BASE_DIRECTORY",
+                    "StellaOps:Plugins:BaseDirectory",
+                    "Plugins:BaseDirectory");
+
+                pluginOptions.BaseDirectory = (pluginOptions.BaseDirectory ?? string.Empty).Trim();
+
+                if (string.IsNullOrWhiteSpace(pluginOptions.BaseDirectory))
+                {
+                    pluginOptions.BaseDirectory = AppContext.BaseDirectory;
+                }
+
+                pluginOptions.BaseDirectory = Path.GetFullPath(pluginOptions.BaseDirectory);
+
+                pluginOptions.Directory = ResolveWithFallback(
+                    pluginOptions.Directory,
+                    configuration,
+                    "STELLAOPS_CLI_PLUGIN_DIRECTORY",
+                    "StellaOps:Plugins:Directory",
+                    "Plugins:Directory");
+
+                pluginOptions.Directory = (pluginOptions.Directory ?? string.Empty).Trim();
+
+                if (string.IsNullOrWhiteSpace(pluginOptions.Directory))
+                {
+                    pluginOptions.Directory = Path.Combine("plugins", "cli");
+                }
+
+                if (!Path.IsPathRooted(pluginOptions.Directory))
+                {
+                    pluginOptions.Directory = Path.GetFullPath(Path.Combine(pluginOptions.BaseDirectory, pluginOptions.Directory));
+                }
+                else
+                {
+                    pluginOptions.Directory = Path.GetFullPath(pluginOptions.Directory);
+                }
+
+                pluginOptions.ManifestSearchPattern = ResolveWithFallback(
+                    pluginOptions.ManifestSearchPattern,
+                    configuration,
+                    "STELLAOPS_CLI_PLUGIN_MANIFEST_PATTERN",
+                    "StellaOps:Plugins:ManifestSearchPattern",
+                    "Plugins:ManifestSearchPattern");
+
+                pluginOptions.ManifestSearchPattern = (pluginOptions.ManifestSearchPattern ?? string.Empty).Trim();
+
+                if (string.IsNullOrWhiteSpace(pluginOptions.ManifestSearchPattern))
+                {
+                    pluginOptions.ManifestSearchPattern = "*.manifest.json";
+                }
+
+                if (pluginOptions.SearchPatterns is null || pluginOptions.SearchPatterns.Count == 0)
+                {
+                    pluginOptions.SearchPatterns = new List<string> { "StellaOps.Cli.Plugin.*.dll" };
+                }
+                else
+                {
+                    pluginOptions.SearchPatterns = pluginOptions.SearchPatterns
+                        .Where(pattern => !string.IsNullOrWhiteSpace(pattern))
+                        .Select(pattern => pattern.Trim())
+                        .Distinct(StringComparer.OrdinalIgnoreCase)
+                        .ToList();
+
+                    if (pluginOptions.SearchPatterns.Count == 0)
+                    {
+                        pluginOptions.SearchPatterns.Add("StellaOps.Cli.Plugin.*.dll");
+                    }
+                }
+
+                if (pluginOptions.PluginOrder is null)
+                {
+                    pluginOptions.PluginOrder = new List<string>();
+                }
+                else
+                {
+                    pluginOptions.PluginOrder = pluginOptions.PluginOrder
+                        .Where(name => !string.IsNullOrWhiteSpace(name))
+                        .Select(name => name.Trim())
+                        .Distinct(StringComparer.OrdinalIgnoreCase)
+                        .ToList();
+                }
             };
         });
 

src/StellaOps.Cli/Configuration/StellaOpsCliOptions.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using StellaOps.Auth.Abstractions;
+using System.IO;
 
 namespace StellaOps.Cli.Configuration;
 
@@ -25,6 +26,8 @@ public sealed class StellaOpsCliOptions
     public StellaOpsCliAuthorityOptions Authority { get; set; } = new();
 
     public StellaOpsCliOfflineOptions Offline { get; set; } = new();
+
+    public StellaOpsCliPluginOptions Plugins { get; set; } = new();
 }
 
 public sealed class StellaOpsCliAuthorityOptions
@@ -63,3 +66,16 @@ public sealed class StellaOpsCliOfflineOptions
 
     public string? MirrorUrl { get; set; }
 }
+
+public sealed class StellaOpsCliPluginOptions
+{
+    public string BaseDirectory { get; set; } = string.Empty;
+
+    public string Directory { get; set; } = "plugins/cli";
+
+    public IList<string> SearchPatterns { get; set; } = new List<string>();
+
+    public IList<string> PluginOrder { get; set; } = new List<string>();
+
+    public string ManifestSearchPattern { get; set; } = "*.manifest.json";
+}

src/StellaOps.Cli/Plugins/CliCommandModuleLoader.cs

@@ -0,0 +1,278 @@
+using System;
+using System.Collections.Generic;
+using System.CommandLine;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StellaOps.Cli.Configuration;
+using StellaOps.Plugin.Hosting;
+
+namespace StellaOps.Cli.Plugins;
+
+internal sealed class CliCommandModuleLoader
+{
+    private readonly IServiceProvider _services;
+    private readonly StellaOpsCliOptions _options;
+    private readonly ILogger<CliCommandModuleLoader> _logger;
+    private readonly RestartOnlyCliPluginGuard _guard = new();
+
+    private IReadOnlyList<ICliCommandModule> _modules = Array.Empty<ICliCommandModule>();
+    private bool _loaded;
+
+    public CliCommandModuleLoader(
+        IServiceProvider services,
+        StellaOpsCliOptions options,
+        ILogger<CliCommandModuleLoader> logger)
+    {
+        _services = services ?? throw new ArgumentNullException(nameof(services));
+        _options = options ?? throw new ArgumentNullException(nameof(options));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public IReadOnlyList<ICliCommandModule> LoadModules()
+    {
+        if (_loaded)
+        {
+            return _modules;
+        }
+
+        var pluginOptions = _options.Plugins ?? new StellaOpsCliPluginOptions();
+
+        var baseDirectory = ResolveBaseDirectory(pluginOptions);
+        var pluginsDirectory = ResolvePluginsDirectory(pluginOptions, baseDirectory);
+        var searchPatterns = ResolveSearchPatterns(pluginOptions);
+        var manifestPattern = string.IsNullOrWhiteSpace(pluginOptions.ManifestSearchPattern)
+            ? "*.manifest.json"
+            : pluginOptions.ManifestSearchPattern;
+
+        _logger.LogDebug("Loading CLI plug-ins from '{Directory}' (base: '{Base}').", pluginsDirectory, baseDirectory);
+
+        var manifestLoader = new CliPluginManifestLoader(pluginsDirectory, manifestPattern);
+        IReadOnlyList<CliPluginManifest> manifests;
+        try
+        {
+            manifests = manifestLoader.LoadAsync(CancellationToken.None).GetAwaiter().GetResult();
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to enumerate CLI plug-in manifests from '{Directory}'.", pluginsDirectory);
+            manifests = Array.Empty<CliPluginManifest>();
+        }
+
+        if (manifests.Count == 0)
+        {
+            _logger.LogInformation("No CLI plug-in manifests discovered under '{Directory}'.", pluginsDirectory);
+            _loaded = true;
+            _guard.Seal();
+            _modules = Array.Empty<ICliCommandModule>();
+            return _modules;
+        }
+
+        var hostOptions = new PluginHostOptions
+        {
+            BaseDirectory = baseDirectory,
+            PluginsDirectory = pluginsDirectory,
+            EnsureDirectoryExists = false,
+            RecursiveSearch = true,
+            PrimaryPrefix = "StellaOps.Cli"
+        };
+
+        foreach (var pattern in searchPatterns)
+        {
+            hostOptions.SearchPatterns.Add(pattern);
+        }
+
+        foreach (var ordered in pluginOptions.PluginOrder ?? Array.Empty<string>())
+        {
+            if (!string.IsNullOrWhiteSpace(ordered))
+            {
+                hostOptions.PluginOrder.Add(ordered);
+            }
+        }
+
+        var loadResult = PluginHost.LoadPlugins(hostOptions, _logger);
+
+        var assemblies = loadResult.Plugins.ToDictionary(
+            descriptor => Normalize(descriptor.AssemblyPath),
+            descriptor => descriptor.Assembly,
+            StringComparer.OrdinalIgnoreCase);
+
+        var modules = new List<ICliCommandModule>(manifests.Count);
+
+        foreach (var manifest in manifests)
+        {
+            try
+            {
+                var assemblyPath = ResolveAssemblyPath(manifest);
+                _guard.EnsureRegistrationAllowed(assemblyPath);
+
+                if (!assemblies.TryGetValue(assemblyPath, out var assembly))
+                {
+                    if (!File.Exists(assemblyPath))
+                    {
+                        throw new FileNotFoundException($"Plug-in assembly '{assemblyPath}' referenced by manifest '{manifest.Id}' was not found.");
+                    }
+
+                    assembly = Assembly.LoadFrom(assemblyPath);
+                    assemblies[assemblyPath] = assembly;
+                }
+
+                var module = CreateModule(assembly, manifest);
+                if (module is null)
+                {
+                    continue;
+                }
+
+                modules.Add(module);
+                _logger.LogInformation("Registered CLI plug-in '{PluginId}' ({PluginName}) from '{AssemblyPath}'.", manifest.Id, module.Name, assemblyPath);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to register CLI plug-in '{PluginId}'.", manifest.Id);
+            }
+        }
+
+        _modules = modules;
+        _loaded = true;
+        _guard.Seal();
+        return _modules;
+    }
+
+    public void RegisterModules(RootCommand root, Option<bool> verboseOption, CancellationToken cancellationToken)
+    {
+        if (root is null)
+        {
+            throw new ArgumentNullException(nameof(root));
+        }
+        if (verboseOption is null)
+        {
+            throw new ArgumentNullException(nameof(verboseOption));
+        }
+
+        var modules = LoadModules();
+        if (modules.Count == 0)
+        {
+            return;
+        }
+
+        foreach (var module in modules)
+        {
+            if (!module.IsAvailable(_services))
+            {
+                _logger.LogDebug("CLI plug-in '{Name}' reported unavailable; skipping registration.", module.Name);
+                continue;
+            }
+
+            try
+            {
+                module.RegisterCommands(root, _services, _options, verboseOption, cancellationToken);
+                _logger.LogInformation("CLI plug-in '{Name}' commands registered.", module.Name);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "CLI plug-in '{Name}' failed to register commands.", module.Name);
+            }
+        }
+    }
+
+    private static string ResolveAssemblyPath(CliPluginManifest manifest)
+    {
+        if (manifest.EntryPoint is null)
+        {
+            throw new InvalidOperationException($"Manifest '{manifest.SourcePath}' does not define an entry point.");
+        }
+
+        var assemblyPath = manifest.EntryPoint.Assembly;
+        if (string.IsNullOrWhiteSpace(assemblyPath))
+        {
+            throw new InvalidOperationException($"Manifest '{manifest.SourcePath}' specifies an empty assembly path.");
+        }
+
+        if (!Path.IsPathRooted(assemblyPath))
+        {
+            if (string.IsNullOrWhiteSpace(manifest.SourceDirectory))
+            {
+                throw new InvalidOperationException($"Manifest '{manifest.SourcePath}' cannot resolve relative assembly path without source directory metadata.");
+            }
+
+            assemblyPath = Path.Combine(manifest.SourceDirectory, assemblyPath);
+        }
+
+        return Normalize(assemblyPath);
+    }
+
+    private ICliCommandModule? CreateModule(Assembly assembly, CliPluginManifest manifest)
+    {
+        if (manifest.EntryPoint is null)
+        {
+            return null;
+        }
+
+        var type = assembly.GetType(manifest.EntryPoint.TypeName, throwOnError: true);
+        if (type is null)
+        {
+            throw new InvalidOperationException($"Plug-in type '{manifest.EntryPoint.TypeName}' could not be loaded from assembly '{assembly.FullName}'.");
+        }
+
+        var module = ActivatorUtilities.CreateInstance(_services, type) as ICliCommandModule;
+        if (module is null)
+        {
+            throw new InvalidOperationException($"Plug-in type '{manifest.EntryPoint.TypeName}' does not implement {nameof(ICliCommandModule)}.");
+        }
+
+        return module;
+    }
+
+    private static string ResolveBaseDirectory(StellaOpsCliPluginOptions options)
+    {
+        var baseDirectory = options.BaseDirectory;
+        if (string.IsNullOrWhiteSpace(baseDirectory))
+        {
+            baseDirectory = AppContext.BaseDirectory;
+        }
+
+        return Path.GetFullPath(baseDirectory);
+    }
+
+    private static string ResolvePluginsDirectory(StellaOpsCliPluginOptions options, string baseDirectory)
+    {
+        var directory = options.Directory;
+        if (string.IsNullOrWhiteSpace(directory))
+        {
+            directory = Path.Combine("plugins", "cli");
+        }
+
+        directory = directory.Trim();
+
+        if (!Path.IsPathRooted(directory))
+        {
+            directory = Path.Combine(baseDirectory, directory);
+        }
+
+        return Path.GetFullPath(directory);
+    }
+
+    private static IReadOnlyList<string> ResolveSearchPatterns(StellaOpsCliPluginOptions options)
+    {
+        if (options.SearchPatterns is null || options.SearchPatterns.Count == 0)
+        {
+            return new[] { "StellaOps.Cli.Plugin.*.dll" };
+        }
+
+        return options.SearchPatterns
+            .Where(pattern => !string.IsNullOrWhiteSpace(pattern))
+            .Select(pattern => pattern.Trim())
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+    }
+
+    private static string Normalize(string path)
+    {
+        var full = Path.GetFullPath(path);
+        return full.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+    }
+}

src/StellaOps.Cli/Plugins/CliPluginManifest.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Plugins;
+
+public sealed record CliPluginManifest
+{
+    public const string CurrentSchemaVersion = "1.0";
+
+    public string SchemaVersion { get; init; } = CurrentSchemaVersion;
+
+    public string Id { get; init; } = string.Empty;
+
+    public string DisplayName { get; init; } = string.Empty;
+
+    public string Version { get; init; } = "0.0.0";
+
+    public bool RequiresRestart { get; init; } = true;
+
+    public CliPluginEntryPoint? EntryPoint { get; init; }
+
+    public IReadOnlyList<string> Capabilities { get; init; } = Array.Empty<string>();
+
+    public IReadOnlyDictionary<string, string> Metadata { get; init; } =
+        new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+    public string? SourcePath { get; init; }
+
+    public string? SourceDirectory { get; init; }
+}
+
+public sealed record CliPluginEntryPoint
+{
+    public string Type { get; init; } = "dotnet";
+
+    public string Assembly { get; init; } = string.Empty;
+
+    public string TypeName { get; init; } = string.Empty;
+}

src/StellaOps.Cli/Plugins/CliPluginManifestLoader.cs

@@ -0,0 +1,150 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Cli.Plugins;
+
+internal sealed class CliPluginManifestLoader
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        AllowTrailingCommas = true,
+        ReadCommentHandling = JsonCommentHandling.Skip,
+        PropertyNameCaseInsensitive = true
+    };
+
+    private readonly string _directory;
+    private readonly string _searchPattern;
+
+    public CliPluginManifestLoader(string directory, string searchPattern)
+    {
+        if (string.IsNullOrWhiteSpace(directory))
+        {
+            throw new ArgumentException("Plug-in manifest directory is required.", nameof(directory));
+        }
+
+        if (string.IsNullOrWhiteSpace(searchPattern))
+        {
+            throw new ArgumentException("Manifest search pattern is required.", nameof(searchPattern));
+        }
+
+        _directory = Path.GetFullPath(directory);
+        _searchPattern = searchPattern;
+    }
+
+    public async Task<IReadOnlyList<CliPluginManifest>> LoadAsync(CancellationToken cancellationToken)
+    {
+        if (!Directory.Exists(_directory))
+        {
+            return Array.Empty<CliPluginManifest>();
+        }
+
+        var manifests = new List<CliPluginManifest>();
+
+        foreach (var file in Directory.EnumerateFiles(_directory, _searchPattern, SearchOption.AllDirectories))
+        {
+            if (IsHidden(file))
+            {
+                continue;
+            }
+
+            var manifest = await DeserializeAsync(file, cancellationToken).ConfigureAwait(false);
+            manifests.Add(manifest);
+        }
+
+        return manifests
+            .OrderBy(static m => m.Id, StringComparer.OrdinalIgnoreCase)
+            .ThenBy(static m => m.Version, StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+    }
+
+    private static bool IsHidden(string path)
+    {
+        var directory = Path.GetDirectoryName(path);
+        while (!string.IsNullOrEmpty(directory))
+        {
+            var name = Path.GetFileName(directory);
+            if (name.StartsWith(".", StringComparison.Ordinal))
+            {
+                return true;
+            }
+
+            directory = Path.GetDirectoryName(directory);
+        }
+
+        return false;
+    }
+
+    private static async Task<CliPluginManifest> DeserializeAsync(string file, CancellationToken cancellationToken)
+    {
+        await using var stream = new FileStream(file, FileMode.Open, FileAccess.Read, FileShare.Read, 4096, FileOptions.Asynchronous);
+        CliPluginManifest? manifest;
+
+        try
+        {
+            manifest = await JsonSerializer.DeserializeAsync<CliPluginManifest>(stream, SerializerOptions, cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch (JsonException ex)
+        {
+            throw new InvalidOperationException($"Failed to parse CLI plug-in manifest '{file}'.", ex);
+        }
+
+        if (manifest is null)
+        {
+            throw new InvalidOperationException($"CLI plug-in manifest '{file}' is empty or invalid.");
+        }
+
+        ValidateManifest(manifest, file);
+
+        var directory = Path.GetDirectoryName(file);
+        return manifest with
+        {
+            SourcePath = file,
+            SourceDirectory = directory
+        };
+    }
+
+    private static void ValidateManifest(CliPluginManifest manifest, string file)
+    {
+        if (!string.Equals(manifest.SchemaVersion, CliPluginManifest.CurrentSchemaVersion, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException(
+                $"Manifest '{file}' uses unsupported schema version '{manifest.SchemaVersion}'. Expected '{CliPluginManifest.CurrentSchemaVersion}'.");
+        }
+
+        if (string.IsNullOrWhiteSpace(manifest.Id))
+        {
+            throw new InvalidOperationException($"Manifest '{file}' must specify a non-empty 'id'.");
+        }
+
+        if (manifest.EntryPoint is null)
+        {
+            throw new InvalidOperationException($"Manifest '{file}' must specify an 'entryPoint'.");
+        }
+
+        if (!string.Equals(manifest.EntryPoint.Type, "dotnet", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException($"Manifest '{file}' entry point type '{manifest.EntryPoint.Type}' is not supported. Expected 'dotnet'.");
+        }
+
+        if (string.IsNullOrWhiteSpace(manifest.EntryPoint.Assembly))
+        {
+            throw new InvalidOperationException($"Manifest '{file}' must specify an entry point assembly.");
+        }
+
+        if (string.IsNullOrWhiteSpace(manifest.EntryPoint.TypeName))
+        {
+            throw new InvalidOperationException($"Manifest '{file}' must specify an entry point type.");
+        }
+
+        if (!manifest.RequiresRestart)
+        {
+            throw new InvalidOperationException($"Manifest '{file}' must set 'requiresRestart' to true.");
+        }
+    }
+}

src/StellaOps.Cli/Plugins/ICliCommandModule.cs

@@ -0,0 +1,20 @@
+using System;
+using System.CommandLine;
+using System.Threading;
+using StellaOps.Cli.Configuration;
+
+namespace StellaOps.Cli.Plugins;
+
+public interface ICliCommandModule
+{
+    string Name { get; }
+
+    bool IsAvailable(IServiceProvider services);
+
+    void RegisterCommands(
+        RootCommand root,
+        IServiceProvider services,
+        StellaOpsCliOptions options,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken);
+}

src/StellaOps.Cli/Plugins/RestartOnlyCliPluginGuard.cs

@@ -0,0 +1,41 @@
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+
+namespace StellaOps.Cli.Plugins;
+
+internal sealed class RestartOnlyCliPluginGuard
+{
+    private readonly ConcurrentDictionary<string, byte> _plugins = new(StringComparer.OrdinalIgnoreCase);
+    private bool _sealed;
+
+    public IReadOnlyCollection<string> KnownPlugins => _plugins.Keys.ToArray();
+
+    public bool IsSealed => Volatile.Read(ref _sealed);
+
+    public void EnsureRegistrationAllowed(string pluginPath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(pluginPath);
+
+        var normalized = Normalize(pluginPath);
+        if (IsSealed && !_plugins.ContainsKey(normalized))
+        {
+            throw new InvalidOperationException($"Plug-in '{pluginPath}' cannot be registered after startup. Restart required.");
+        }
+
+        _plugins.TryAdd(normalized, 0);
+    }
+
+    public void Seal()
+    {
+        Volatile.Write(ref _sealed, true);
+    }
+
+    private static string Normalize(string path)
+    {
+        var full = Path.GetFullPath(path);
+        return full.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+    }
+}

src/StellaOps.Cli/Program.cs

@@ -116,7 +116,7 @@ internal static class Program
             cts.Cancel();
         };
 
-        var rootCommand = CommandFactory.Create(serviceProvider, options, cts.Token);
+        var rootCommand = CommandFactory.Create(serviceProvider, options, cts.Token, loggerFactory);
         var commandConfiguration = new CommandLineConfiguration(rootCommand);
         var commandExit = await commandConfiguration.InvokeAsync(args, cts.Token).ConfigureAwait(false);
 

src/StellaOps.Cli/Properties/AssemblyInfo.cs

@@ -1,3 +1,4 @@
 using System.Runtime.CompilerServices;
 
-[assembly: InternalsVisibleTo("StellaOps.Cli.Tests")]
+[assembly: InternalsVisibleTo("StellaOps.Cli.Tests")]
+[assembly: InternalsVisibleTo("StellaOps.Cli.Plugins.NonCore")]

src/StellaOps.Cli/StellaOps.Cli.csproj

@@ -13,6 +13,7 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.CommandLine" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
     <PackageReference Include="NetEscapades.Configuration.Yaml" Version="2.1.0" />
@@ -39,6 +40,7 @@
     <ProjectReference Include="..\StellaOps.Configuration\StellaOps.Configuration.csproj" />
     <ProjectReference Include="..\StellaOps.Authority\StellaOps.Auth.Abstractions\StellaOps.Auth.Abstractions.csproj" />
     <ProjectReference Include="..\StellaOps.Authority\StellaOps.Auth.Client\StellaOps.Auth.Client.csproj" />
+    <ProjectReference Include="..\StellaOps.Plugin\StellaOps.Plugin.csproj" />
   </ItemGroup>
 
 </Project>

src/StellaOps.Cli/TASKS.md

@@ -19,6 +19,6 @@ If you are working on this file you need to read docs/ARCHITECTURE_EXCITITOR.md
 |EXCITITOR-CLI-01-003 – CLI docs & examples for Excititor|Docs/CLI|EXCITITOR-CLI-01-001|**DOING (2025-10-19)** – Update docs/09_API_CLI_REFERENCE.md and quickstart snippets to cover Excititor verbs, offline guidance, and attestation verification workflow.|
 |CLI-RUNTIME-13-005 – Runtime policy test verbs|DevEx/CLI|SCANNER-RUNTIME-12-302, ZASTAVA-WEBHOOK-12-102|**DONE (2025-10-19)** – Added `runtime policy test` command (stdin/file support, JSON output), backend client method + typed models, verdict table output, docs/tests updated (`dotnet test src/StellaOps.Cli.Tests`).|
 |CLI-OFFLINE-13-006 – Offline kit workflows|DevEx/CLI|DEVOPS-OFFLINE-14-002|**DONE (2025-10-21)** – Added `offline kit pull/import/status` commands with resumable downloads, digest/metadata validation, metrics, docs updates, and regression coverage (`dotnet test src/StellaOps.Cli.Tests`).|
-|CLI-PLUGIN-13-007 – Plugin packaging|DevEx/CLI|CLI-RUNTIME-13-005, CLI-OFFLINE-13-006|TODO – Package non-core verbs as restart-time plug-ins (manifest + loader updates, tests ensuring no hot reload).|
+|CLI-PLUGIN-13-007 – Plugin packaging|DevEx/CLI|CLI-RUNTIME-13-005, CLI-OFFLINE-13-006|DONE (2025-10-22) – Packaged non-core verbs as restart-time plug-ins with manifest + loader updates and tests ensuring no hot reload.|
 |CLI-RUNTIME-13-008 – Runtime policy contract sync|DevEx/CLI, Scanner WebService Guild|SCANNER-RUNTIME-12-302|**DONE (2025-10-19)** – CLI runtime table/JSON now align with SCANNER-RUNTIME-12-302 (SBOM referrers, quieted provenance, confidence, verified Rekor); docs/09 updated with joint sign-off note.|
 |CLI-RUNTIME-13-009 – Runtime policy smoke fixture|DevEx/CLI, QA Guild|CLI-RUNTIME-13-005|**DONE (2025-10-19)** – Spectre console harness + regression tests cover table and `--json` output paths for `runtime policy test`, using stubbed backend and integrated into `dotnet test` suite.|