chore(node-sdk): audit providers kimi grok qwen letta

Command files use shell-command and managedScriptReference; runtime checks use managed-runtime-status; jsonc-edit.ts and parseCommentedJsonObject replace copied JSONC helpers.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

src/plugins/common.ts

@@ -1,3 +1,4 @@
+import os from 'node:os';
 import path from 'node:path';
 
 export const MAX_SECRET_BYTES = 64 * 1024;
@@ -16,12 +17,13 @@ export function hasCode(error: unknown, code: string): boolean {
   return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
 }
 
+export function pathKey(filePath: string): string {
+  const resolved = path.resolve(filePath);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
 export function samePath(left: string, right: string): boolean {
-  const normalizedLeft = path.resolve(left);
-  const normalizedRight = path.resolve(right);
-  return process.platform === 'win32'
-    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
-    : normalizedLeft === normalizedRight;
+  return pathKey(left) === pathKey(right);
 }
 
 export function sameAgentId(left: unknown, right: string): boolean {
@@ -29,3 +31,20 @@ export function sameAgentId(left: unknown, right: string): boolean {
     ? left.toLowerCase() === right.toLowerCase()
     : left === right);
 }
+
+export interface ManagedScriptReference {
+  readonly agentId: string;
+  readonly scriptPath: string;
+}
+
+// Accepts only ~/.elydora/<agentId>/<scriptName>.
+export function managedScriptReference(
+  scriptPath: string,
+  scriptName: string,
+): ManagedScriptReference | undefined {
+  if (!path.isAbsolute(scriptPath) || path.basename(scriptPath) !== scriptName) return undefined;
+  const agentDirectory = path.dirname(scriptPath);
+  if (!samePath(path.dirname(agentDirectory), path.join(os.homedir(), '.elydora'))) return undefined;
+  const agentId = path.basename(agentDirectory);
+  return agentId && agentId !== '.' && agentId !== '..' ? { agentId, scriptPath } : undefined;
+}