Plugin system needs further investigation

[laynepenney]

Summary

The plugin system (/plugins command and related infrastructure) has been disabled pending further investigation.

Current State

• Plugin loading code exists in src/plugins.ts
• Plugin commands exist in src/commands/plugin-commands.ts
• The system is designed to load plugins from ~/.codi/plugins/
• Currently disabled in src/index.ts

Reasons for Disabling

1. Plugin infrastructure requires additional testing and documentation
2. Security review needed for loading arbitrary code
3. Plugin API stability needs to be established before encouraging plugin development

Files Involved

• src/plugins.ts - Core plugin loading logic
• src/commands/plugin-commands.ts - Plugin management commands
• src/index.ts - Plugin initialization (currently commented out)
• tests/plugins.test.ts - Plugin tests

Tasks

• Review plugin security model
• Document plugin API
• Add plugin validation/sandboxing
• Re-enable once ready

Labels

enhancement, needs-investigation

[laynepenney]

Completed. Plugin investigation document created in docs/PLUGIN-INVESTIGATION.md (PR #181).

The document covers:

• Security analysis and risk assessment
• API stability assessment
• Phased re-enablement roadmap
• Example plugin structure

Plugin loading remains disabled pending implementation of the security recommendations.