feat: allow 3rd party plugins with user confirmation and CI pre-caching

[Copilot]

• Remove hard block for non-@varlock/* plugins
• Allow 3rd party plugins installed via node_modules automatically
• Add confirmation prompt before downloading 3rd party plugins in binary mode
• Handle non-interactive TTY environments with a clear error (updated to mention varlock install-plugin)
• Update documentation in plugins.mdx
• Add changeset
• Extract npm fetch logic into exported downloadPluginToCache() in plugins.ts
• Add new varlock install-plugin <name@version> CLI command (pre-caches plugins without confirmation, since the explicit invocation is consent)
• Register the new command in cli-executable.ts
• Use lastIndexOf('@') for robust scoped-package parsing
• Add typed interface for npm registry response (no more as any)
• Run lint and validate
• Guard install-plugin command to only work with standalone binary; show helpful message directing JS project users to their package manager instead

[changeset-bot]

🦋 Changeset detected

Latest commit: 95e70ed

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
varlock	Patch
@varlock/astro-integration	Patch
@varlock/cloudflare-integration	Patch
@varlock/expo-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/dashlane-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/hashicorp-vault-plugin	Patch
@varlock/infisical-plugin	Patch
@varlock/keepass-plugin	Patch
@varlock/pass-plugin	Patch
@varlock/passbolt-plugin	Patch
@varlock/proton-pass-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	a8aab1c	Commit Preview URL Branch Preview URL	Apr 02 2026, 07:25 PM

[philmillman]

@theoephraim we may need a --dangerously-accept style flag for CI (or non-interactive workflows) maybe with some sort of allowList?

[theoephraim]

@copilot we need some way for users to pre-install the plugins into the cache in non-interactive environments while using the binary. Perhaps a cli command? Something like varlock install-plugin plugin-name@1.2.3 which would download the plugin into the plugin cache location? This way a user could add this step to their CI steps or however they set up their environment.

[Copilot]

@copilot we need some way for users to pre-install the plugins into the cache in non-interactive environments while using the binary. Perhaps a cli command? Something like `varlock install-plugin plug...

Added a new varlock install-plugin <name@version> command in commit 3e9c208. Since the user explicitly runs the command, no confirmation prompt is shown — the invocation itself is the consent.

Usage in CI setup steps:

varlock install-plugin my-plugin@1.2.3
varlock install-plugin @my-scope/my-plugin@2.0.0

The command validates the input (must be an exact semver version), fetches the tarball URL from npm, downloads and caches it, then prints the cache location. Once pre-cached, varlock load/varlock run will find it in the cache and skip the confirmation prompt entirely.

The non-TTY error message in the plugin loading flow was also updated to point users to this command.

[pkg-pr-new]

Open in StackBlitz

varlock

npm i https://pkg.pr.new/varlock@538

@varlock/astro-integration

npm i https://pkg.pr.new/@varlock/astro-integration@538

@varlock/cloudflare-integration

npm i https://pkg.pr.new/@varlock/cloudflare-integration@538

@varlock/expo-integration

npm i https://pkg.pr.new/@varlock/expo-integration@538

@varlock/nextjs-integration

npm i https://pkg.pr.new/@varlock/nextjs-integration@538

@varlock/vite-integration

npm i https://pkg.pr.new/@varlock/vite-integration@538

@varlock/1password-plugin

npm i https://pkg.pr.new/@varlock/1password-plugin@538

@varlock/aws-secrets-plugin

npm i https://pkg.pr.new/@varlock/aws-secrets-plugin@538

@varlock/azure-key-vault-plugin

npm i https://pkg.pr.new/@varlock/azure-key-vault-plugin@538

@varlock/bitwarden-plugin

npm i https://pkg.pr.new/@varlock/bitwarden-plugin@538

@varlock/dashlane-plugin

npm i https://pkg.pr.new/@varlock/dashlane-plugin@538

@varlock/google-secret-manager-plugin

npm i https://pkg.pr.new/@varlock/google-secret-manager-plugin@538

@varlock/hashicorp-vault-plugin

npm i https://pkg.pr.new/@varlock/hashicorp-vault-plugin@538

@varlock/infisical-plugin

npm i https://pkg.pr.new/@varlock/infisical-plugin@538

@varlock/keepass-plugin

npm i https://pkg.pr.new/@varlock/keepass-plugin@538

@varlock/pass-plugin

npm i https://pkg.pr.new/@varlock/pass-plugin@538

@varlock/passbolt-plugin

npm i https://pkg.pr.new/@varlock/passbolt-plugin@538

@varlock/proton-pass-plugin

npm i https://pkg.pr.new/@varlock/proton-pass-plugin@538

commit: 95e70ed