fix(plugins): pin every command to its activation runtime

App.tsx

@@ -12,6 +12,7 @@ import { ToastProvider } from './components/ui/toast';
 import { TooltipProvider } from './components/ui/tooltip';
 import { ScriptAutomationRoot } from './components/scripts/ScriptAutomationRoot';
 import { ExternalMcpApprovalsHost } from './components/ai/ExternalMcpApprovalsHost';
+import { PluginHostInteractionHost } from './components/plugins/PluginHostInteractionHost';
 import { PluginAuthenticationHost } from './components/plugins/PluginAuthenticationHost';
 import { MultilinePasteConfirmHost } from './components/terminal/MultilinePasteConfirmDialog';
 import { useExternalMcpGrantPersister } from './components/ai/useExternalMcpGrantPersister';
@@ -86,6 +87,7 @@ function AppWithProviders({ settings, appLock }: { settings: SettingsState; appL
               <ScriptAutomationRoot />
               <ExternalMcpApprovalsHost />
               <PluginAuthenticationHost />
+              <PluginHostInteractionHost />
               <MultilinePasteConfirmHost />
               <VaultPublisher>
                 <SessionPublisher persistSessionRestore={!isPeerSessionWindow}>

application/i18n/locales/en/core.ts

@@ -1245,10 +1245,23 @@ Highlight the focused split pane:
   "settings.plugins.manager.disable": "Disable",
   "settings.plugins.manager.remove": "Uninstall",
   "settings.plugins.manager.removeNote": "Uninstall removes package code and local KV data. User-owned settings, secrets and sync sidecars are retained.",
-  "settings.plugins.permissions.title": "Active grants",
+  "settings.plugins.permissions.statusUnknown": "Status unknown",
+  "plugins.interaction.title": "Plugin request",
+  "plugins.interaction.sharing": "Text you share becomes available to this plugin and its granted capabilities, including network access. Reading does not approve a new network destination.",
+  "plugins.interaction.input": "Input text",
+  "plugins.interaction.filter": "Filter choices",
+  "plugins.interaction.preview": "Preview clipboard",
+  "plugins.interaction.previewNote": "The clipboard is read only after you choose Preview. You can then inspect the text and separately confirm sharing it.",
+  "plugins.interaction.previewAction": "Preview clipboard",
+  "plugins.interaction.share": "Share with plugin",
+  "plugins.interaction.copy": "Copy to clipboard",
+  "plugins.interaction.failed": "This request expired or could not be completed.",
+  "settings.plugins.permissions.current": "Matches the current activation",
+  "settings.plugins.permissions.inactive": "Inactive for the current activation",
+  "settings.plugins.permissions.title": "Saved grants",
   "settings.plugins.permissions.refresh": "Refresh",
   "settings.plugins.permissions.loading": "Loading grants...",
-  "settings.plugins.permissions.empty": "No active grants. One-use decisions are not retained.",
+  "settings.plugins.permissions.empty": "No saved grants. One-use decisions are not retained.",
   "settings.plugins.permissions.always": "Until revoked",
   "settings.plugins.permissions.application": "Until Netcatty exits",
   "settings.plugins.permissions.session": "Until the session closes",

application/i18n/locales/es/core.ts

@@ -1245,10 +1245,23 @@ Resalta el panel dividido enfocado:
   "settings.plugins.manager.disable": "Desactivar",
   "settings.plugins.manager.remove": "Desinstalar",
   "settings.plugins.manager.removeNote": "La desinstalación elimina el código y los datos KV locales. Se conservan los ajustes del usuario, los secretos y los datos auxiliares de sincronización.",
-  "settings.plugins.permissions.title": "Autorizaciones activas",
+  "settings.plugins.permissions.statusUnknown": "Estado desconocido",
+  "plugins.interaction.title": "Solicitud de complemento",
+  "plugins.interaction.sharing": "El texto compartido estará disponible para este complemento y sus capacidades autorizadas, incluida la red. Leer no autoriza un nuevo destino de red.",
+  "plugins.interaction.input": "Introducir texto",
+  "plugins.interaction.filter": "Filtrar opciones",
+  "plugins.interaction.preview": "Vista previa del portapapeles",
+  "plugins.interaction.previewNote": "El portapapeles se lee al elegir Vista previa. Revise el texto y confirme por separado que desea compartirlo.",
+  "plugins.interaction.previewAction": "Vista previa del portapapeles",
+  "plugins.interaction.share": "Compartir con el complemento",
+  "plugins.interaction.copy": "Copiar al portapapeles",
+  "plugins.interaction.failed": "La solicitud caducó o no pudo completarse.",
+  "settings.plugins.permissions.current": "Coincide con la ejecución actual",
+  "settings.plugins.permissions.inactive": "No activa para la ejecución actual",
+  "settings.plugins.permissions.title": "Autorizaciones guardadas",
   "settings.plugins.permissions.refresh": "Actualizar",
   "settings.plugins.permissions.loading": "Cargando autorizaciones...",
-  "settings.plugins.permissions.empty": "No hay autorizaciones activas. Las decisiones de un solo uso no se conservan.",
+  "settings.plugins.permissions.empty": "No hay autorizaciones guardadas. Las decisiones de un solo uso no se conservan.",
   "settings.plugins.permissions.always": "Hasta su revocación",
   "settings.plugins.permissions.application": "Hasta cerrar Netcatty",
   "settings.plugins.permissions.session": "Hasta cerrar la sesión",

application/i18n/locales/ru/core.ts

@@ -1140,10 +1140,23 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.manager.disable": "Отключить",
   "settings.plugins.manager.remove": "Удалить",
   "settings.plugins.manager.removeNote": "Удаление очищает код пакета и локальные данные KV. Настройки пользователя, секреты и данные синхронизации сохраняются.",
-  "settings.plugins.permissions.title": "Действующие разрешения",
+  "settings.plugins.permissions.statusUnknown": "Состояние неизвестно",
+  "plugins.interaction.title": "Запрос плагина",
+  "plugins.interaction.sharing": "Переданный текст доступен плагину и его разрешённым возможностям, включая сеть. Чтение не разрешает новый сетевой адрес.",
+  "plugins.interaction.input": "Ввести текст",
+  "plugins.interaction.filter": "Фильтр вариантов",
+  "plugins.interaction.preview": "Предпросмотр буфера обмена",
+  "plugins.interaction.previewNote": "Буфер читается только после нажатия предпросмотра. Затем проверьте текст и отдельно подтвердите передачу.",
+  "plugins.interaction.previewAction": "Предпросмотр буфера обмена",
+  "plugins.interaction.share": "Передать плагину",
+  "plugins.interaction.copy": "Копировать в буфер обмена",
+  "plugins.interaction.failed": "Запрос истёк или не выполнен.",
+  "settings.plugins.permissions.current": "Соответствует текущему запуску",
+  "settings.plugins.permissions.inactive": "Не действует для текущего запуска",
+  "settings.plugins.permissions.title": "Сохранённые разрешения",
   "settings.plugins.permissions.refresh": "Обновить",
   "settings.plugins.permissions.loading": "Загрузка разрешений...",
-  "settings.plugins.permissions.empty": "Действующих разрешений нет. Одноразовые решения не сохраняются.",
+  "settings.plugins.permissions.empty": "Сохранённых разрешений нет. Одноразовые решения не сохраняются.",
   "settings.plugins.permissions.always": "До отзыва",
   "settings.plugins.permissions.application": "До выхода из Netcatty",
   "settings.plugins.permissions.session": "До закрытия сеанса",

application/i18n/locales/zh-CN/core.ts

@@ -1160,10 +1160,23 @@ Vaults 标签保持扁平，不使用这块背景。
   "settings.plugins.manager.disable": "停用",
   "settings.plugins.manager.remove": "卸载",
   "settings.plugins.manager.removeNote": "卸载会移除插件代码和本地 KV 数据，保留用户设置、秘密存储和同步 sidecar。",
-  "settings.plugins.permissions.title": "实际授权",
+  "settings.plugins.permissions.statusUnknown": "状态未知",
+  "plugins.interaction.title": "插件请求",
+  "plugins.interaction.sharing": "分享的文本将交给此插件及其已授权的能力（包括网络访问）。读取文本不代表批准新的网络目标。",
+  "plugins.interaction.input": "输入文本",
+  "plugins.interaction.filter": "筛选选项",
+  "plugins.interaction.preview": "剪贴板预览",
+  "plugins.interaction.previewNote": "仅在点击“预览剪贴板”后读取。检查文本后，还需单独确认才能分享给插件。",
+  "plugins.interaction.previewAction": "预览剪贴板",
+  "plugins.interaction.share": "分享给插件",
+  "plugins.interaction.copy": "复制到剪贴板",
+  "plugins.interaction.failed": "此请求已过期或无法完成。",
+  "settings.plugins.permissions.current": "匹配当前运行实例",
+  "settings.plugins.permissions.inactive": "对当前运行实例不生效",
+  "settings.plugins.permissions.title": "已保存的授权",
   "settings.plugins.permissions.refresh": "刷新",
   "settings.plugins.permissions.loading": "正在读取授权...",
-  "settings.plugins.permissions.empty": "没有有效授权。单次决定不会保留。",
+  "settings.plugins.permissions.empty": "没有已保存的授权。单次决定不会保留。",
   "settings.plugins.permissions.always": "直到撤销",
   "settings.plugins.permissions.application": "直到退出 Netcatty",
   "settings.plugins.permissions.session": "直到会话关闭",

application/i18n/locales/zh-TW/core.ts

@@ -1163,10 +1163,23 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "settings.plugins.manager.disable": "停用",
   "settings.plugins.manager.remove": "卸載",
   "settings.plugins.manager.removeNote": "卸載會移除插件代碼和本地 KV 數據，保留用戶設置、秘密存儲和同步 sidecar。",
-  "settings.plugins.permissions.title": "實際授權",
+  "settings.plugins.permissions.statusUnknown": "狀態不明",
+  "plugins.interaction.title": "外掛請求",
+  "plugins.interaction.sharing": "分享的文字會交給此外掛及其已授權能力（包括網路存取）。讀取文字不代表核准新的網路目的地。",
+  "plugins.interaction.input": "輸入文字",
+  "plugins.interaction.filter": "篩選選項",
+  "plugins.interaction.preview": "剪貼簿預覽",
+  "plugins.interaction.previewNote": "僅在點選「預覽剪貼簿」後讀取。檢查文字後，還需另外確認才能分享給外掛。",
+  "plugins.interaction.previewAction": "預覽剪貼簿",
+  "plugins.interaction.share": "分享給外掛",
+  "plugins.interaction.copy": "複製到剪貼簿",
+  "plugins.interaction.failed": "此請求已過期或無法完成。",
+  "settings.plugins.permissions.current": "符合目前執行個體",
+  "settings.plugins.permissions.inactive": "對目前執行個體不生效",
+  "settings.plugins.permissions.title": "已儲存的授權",
   "settings.plugins.permissions.refresh": "重新整理",
   "settings.plugins.permissions.loading": "正在讀取授權...",
-  "settings.plugins.permissions.empty": "沒有有效授權。單次決定不會保留。",
+  "settings.plugins.permissions.empty": "沒有已儲存的授權。單次決定不會保留。",
   "settings.plugins.permissions.always": "直到撤銷",
   "settings.plugins.permissions.application": "直到退出 Netcatty",
   "settings.plugins.permissions.session": "直到工作階段關閉",

application/state/usePluginHostInteractions.ts

@@ -0,0 +1,53 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import type { HostInteractionPrompt, HostInteractionResponse } from '@netcatty/plugin-contract';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+export function usePluginHostInteractions() {
+  const [prompt, setPrompt] = useState<HostInteractionPrompt | null>(null);
+  const [value, setValue] = useState('');
+  const [error, setError] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const current = useRef<HostInteractionPrompt | null>(null);
+  const pending = useRef(false);
+  useEffect(() => {
+    const bridge = netcattyBridge.get();
+    if (!bridge?.onPluginInteraction || !bridge.setPluginInteractionReady) return;
+    const unsubscribe = bridge.onPluginInteraction((event) => {
+      if ('closed' in event) {
+        if (current.current?.requestId !== event.requestId) return;
+        current.current = null; setPrompt(null);
+      } else {
+        current.current = event; setPrompt(event);
+        setValue(event.request.kind === 'input' ? event.request.initialValue ?? '' : '');
+      }
+      pending.current = false; setBusy(false); setError(false);
+    });
+    void bridge.setPluginInteractionReady(true).catch(() => {});
+    return () => {
+      current.current = null;
+      unsubscribe();
+      void bridge.setPluginInteractionReady?.(false).catch(() => {});
+    };
+  }, []);
+  const respond = useCallback(async (action: HostInteractionResponse['action']) => {
+    const active = current.current;
+    if (!active || pending.current) return;
+    pending.current = true; setBusy(true); setError(false);
+    try {
+      const bridge = netcattyBridge.require();
+      if (!bridge.respondPluginInteraction) throw new Error('Host interactions unavailable');
+      const accepted = await bridge.respondPluginInteraction({
+        requestId: active.requestId, actionToken: active.actionToken, action,
+        ...(action === 'submit' && (active.request.kind === 'input' || active.request.kind === 'quickPick') ? { value } : {}),
+      });
+      if (!accepted && current.current?.actionToken === active.actionToken) {
+        current.current = null; setPrompt(null);
+      }
+    } catch {
+      if (current.current?.actionToken === active.actionToken) setError(true);
+    } finally {
+      if (current.current?.actionToken === active.actionToken) { pending.current = false; setBusy(false); }
+    }
+  }, [value]);
+  return { prompt, value, setValue, error, busy, respond };
+}

application/state/usePluginManager.test.ts

@@ -0,0 +1,39 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import React from 'react';
+import { act, create, type ReactTestRenderer } from 'react-test-renderer';
+import { usePluginManager } from './usePluginManager';
+
+test('failed manager refresh marks previous enabled state unknown until a successful read', async (context) => {
+  const previous = Object.getOwnPropertyDescriptor(globalThis, 'window');
+  const actPrevious = Object.getOwnPropertyDescriptor(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
+  let fail = false;
+  const plugin = { id: 'com.example.synthetic', enabled: true } as NetcattyInstalledPlugin;
+  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', { configurable: true, value: true });
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
+    addEventListener() {}, removeEventListener() {}, netcatty: {
+      async getPluginRuntimeStatus() { return { available: true }; },
+      async listPlugins() { if (fail) throw new Error('synthetic status read failed'); return [plugin]; },
+    },
+  } });
+  context.after(() => {
+    if (previous) Object.defineProperty(globalThis, 'window', previous); else Reflect.deleteProperty(globalThis, 'window');
+    if (actPrevious) Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', actPrevious); else Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
+  });
+  let state!: ReturnType<typeof usePluginManager>;
+  function Probe() { state = usePluginManager(); return null; }
+  let renderer!: ReactTestRenderer;
+  await act(async () => { renderer = create(React.createElement(Probe)); });
+  try {
+    assert.equal(state.statusKnown, true);
+    assert.equal(state.plugins[0].enabled, true);
+    fail = true;
+    await act(async () => { await assert.rejects(state.refresh(), /synthetic status read failed/); });
+    assert.equal(state.statusKnown, false);
+    assert.match(state.error ?? '', /synthetic status read failed/);
+    fail = false; plugin.enabled = false;
+    await act(async () => { await state.refresh(); });
+    assert.equal(state.statusKnown, true);
+    assert.equal(state.plugins[0].enabled, false);
+  } finally { await act(async () => { renderer.unmount(); }); }
+});

application/state/usePluginManager.ts

@@ -4,6 +4,7 @@ import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
 export function usePluginManager() {
   const [plugins, setPlugins] = useState<NetcattyInstalledPlugin[]>([]);
   const [available, setAvailable] = useState(false);
+  const [statusKnown, setStatusKnown] = useState(false);
   const [credentialStorageAvailable, setCredentialStorageAvailable] = useState<boolean | undefined>();
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -11,13 +12,22 @@ export function usePluginManager() {
   const mutation = useRef(false);
   const refresh = useCallback(async () => {
     const current = ++generation.current;
-    const bridge = netcattyBridge.get();
-    const status = await bridge?.getPluginRuntimeStatus?.();
-    const list = status?.available ? await bridge?.listPlugins?.() ?? [] : [];
-    if (current !== generation.current) return;
-    setAvailable(status?.available === true);
-    setCredentialStorageAvailable(status?.credentialStorageAvailable);
-    setPlugins(list);
+    try {
+      const bridge = netcattyBridge.get();
+      const status = await bridge?.getPluginRuntimeStatus?.();
+      const list = status?.available ? await bridge?.listPlugins?.() ?? [] : [];
+      if (current !== generation.current) return;
+      setAvailable(status?.available === true);
+      setStatusKnown(true);
+      setCredentialStorageAvailable(status?.credentialStorageAvailable);
+      setPlugins(list);
+    } catch (cause) {
+      if (current === generation.current) {
+        setStatusKnown(false);
+        setError(cause instanceof Error ? cause.message : String(cause));
+      }
+      throw cause;
+    }
   }, []);
   useEffect(() => {
     const update = () => { void refresh().catch((cause) => setError(String(cause))); };
@@ -41,7 +51,7 @@ export function usePluginManager() {
     }
   }, [refresh]);
   return {
-    plugins, available, busy, error, credentialStorageAvailable, refresh,
+    plugins, available, statusKnown, busy, error, credentialStorageAvailable, refresh,
     importPackage: () => run(async (bridge) => {
       if (!bridge.selectFile || !bridge.installPluginPackage) throw new Error('Plugin import unavailable');
       const path = await bridge.selectFile('Import plugin package', undefined, [{ name: 'Netcatty plugin', extensions: ['ncpkg'] }]);

components/PluginHostInteractionHost.test.tsx

@@ -0,0 +1,91 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { JSDOM } from 'jsdom';
+
+test('host dialog drives choice/input/copy and the two-phase clipboard share using real service action tokens', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { PluginHostInteractionHost } = await import('./plugins/PluginHostInteractionHost');
+  const { PluginHostInteractionService, assertInteractionRequest } = await import('../electron/plugins/hostInteractionService.cjs');
+  let listener: ((event: unknown) => void) | null = null;
+  let reads = 0;
+  const writes: string[] = [];
+  const audits: unknown[] = [];
+  const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false, send(_channel: string, payload: unknown) { listener?.(payload); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const service = new PluginHostInteractionService({
+    getWindow: () => owner, isLocked: () => false,
+    permissionEngine: { onDidRevoke() { return { dispose() {} }; } },
+    database: { recordSecurityAudit(...args: unknown[]) { audits.push(args); } },
+    quotaManager: { chargeBytes() {} },
+    clipboard: { readText() { reads++; return 'synthetic private text'; }, writeText(value: string) { writes.push(value); } },
+  });
+  Object.assign(dom.window, { netcatty: {
+    onPluginInteraction(callback: (event: unknown) => void) { listener = callback; return () => { listener = null; }; },
+    async setPluginInteractionReady(ready: boolean) { return service.setReady(sender, ready); },
+    async respondPluginInteraction(response: unknown) { return service.respond(sender, response); },
+  } });
+  const context = { pluginId: 'com.example.synthetic', pluginVersion: '1.0.0', runtimeId: 'runtime-synthetic', signal: new AbortController().signal, async assertActive() {} };
+  const root = createRoot(document.getElementById('root')!);
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 20));
+  const button = (text: string) => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((item) => item.textContent === text)!;
+  const click = async (element: HTMLElement) => { assert.ok(element); await act(async () => { element.click(); await settle(); }); };
+  const begin = async (params: unknown) => {
+    let promise!: Promise<unknown>;
+    await act(async () => { promise = service.request(assertInteractionRequest(params), context); void promise.catch(() => {}); await settle(); });
+    return { promise };
+  };
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginHostInteractionHost /></I18nProvider>));
+    const choice = await begin({ kind: 'quickPick', title: 'Synthetic choice', items: [{ id: 'compose', label: 'Compose' }] });
+    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /com.example.synthetic/);
+    assert.equal(button('Continue').disabled, true);
+    await click(document.querySelector<HTMLInputElement>('input[type="radio"]')!);
+    await click(button('Continue'));
+    assert.deepEqual(await choice.promise, { cancelled: false, value: 'compose' });
+    await assert.rejects(begin({ kind: 'input', title: 'Invalid hidden newline', initialValue: 'first\nsecond' }), /invalid/);
+    assert.equal(document.querySelector('[role="dialog"]'), null, 'invalid initial text never creates a misleading single-line dialog');
+    const input = await begin({ kind: 'input', title: 'Synthetic input', initialValue: 'synthetic output' });
+    assert.equal(document.querySelector<HTMLInputElement>('input')?.value, 'synthetic output');
+    await click(button('Continue'));
+    assert.deepEqual(await input.promise, { cancelled: false, value: 'synthetic output' });
+    const copy = await begin({ kind: 'clipboard.write', title: 'Copy result', text: 'synthetic output' });
+    assert.deepEqual(writes, []);
+    assert.equal(document.querySelector('textarea')?.value, 'synthetic output');
+    await click(button('Copy to clipboard'));
+    assert.deepEqual(await copy.promise, { cancelled: false, value: true });
+    assert.deepEqual(writes, ['synthetic output']);
+    const share = await begin({ kind: 'clipboard.read', title: 'Share clipboard' });
+    assert.equal(reads, 0);
+    assert.equal(document.querySelector('textarea'), null);
+    await click(button('Preview clipboard'));
+    assert.equal(reads, 1);
+    assert.equal(document.querySelector('textarea')?.value, 'synthetic private text');
+    await click(button('Share with plugin'));
+    assert.deepEqual(await share.promise, { cancelled: false, value: 'synthetic private text' });
+    assert.equal(JSON.stringify(audits).includes('synthetic private text'), false);
+    const cancelled = await begin({ kind: 'clipboard.write', title: 'Cancelled copy', text: 'must not copy' });
+    await click(button('Cancel'));
+    assert.deepEqual(await cancelled.promise, { cancelled: true });
+    assert.deepEqual(writes, ['synthetic output']);
+    assert.equal(service.pending.size, 0);
+  } finally {
+    await act(async () => { root.unmount(); await settle(); }); service.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/plugins/PluginHostInteractionHost.tsx

@@ -0,0 +1,54 @@
+import React, { useState } from 'react';
+import { PLUGIN_HOST_INTERACTION_LIMITS } from '@netcatty/plugin-contract';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { usePluginHostInteractions } from '../../application/state/usePluginHostInteractions';
+import { Button } from '../ui/button';
+import { Input } from '../ui/input';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
+
+export function PluginHostInteractionHost() {
+  const state = usePluginHostInteractions();
+  if (!state.prompt) return null;
+  return <HostInteractionDialog key={state.prompt.requestId} state={state} prompt={state.prompt} />;
+}
+
+function HostInteractionDialog({ state, prompt }: {
+  state: ReturnType<typeof usePluginHostInteractions>;
+  prompt: NonNullable<ReturnType<typeof usePluginHostInteractions>['prompt']>;
+}) {
+  const { t } = useI18n();
+  const [search, setSearch] = useState('');
+  const request = prompt.request;
+  const previewClipboard = request.kind === 'clipboard.read' && prompt.phase === 'request';
+  const textBytes = new TextEncoder().encode(state.value).length;
+  const canSubmit = request.kind === 'quickPick' ? request.items.some((item) => item.id === state.value) : textBytes <= PLUGIN_HOST_INTERACTION_LIMITS.textBytes;
+  return <Dialog open onOpenChange={(open) => { if (!open) void state.respond('cancel'); }}>
+    <DialogContent className="sm:max-w-[520px]" hideCloseButton>
+      <DialogHeader>
+        <DialogTitle>{t('plugins.interaction.title')}</DialogTitle>
+        <DialogDescription className="break-all">{prompt.pluginId} · {prompt.pluginVersion}</DialogDescription>
+      </DialogHeader>
+      <p className="break-words text-sm font-medium">{request.title}</p>
+      <p className="text-xs text-muted-foreground">{t('plugins.interaction.sharing')}</p>
+      {request.kind === 'input' && <Input aria-label={t('plugins.interaction.input')} value={state.value} maxLength={PLUGIN_HOST_INTERACTION_LIMITS.textBytes} autoComplete="off" autoFocus disabled={state.busy} onChange={(event) => state.setValue(event.target.value)} />}
+      {request.kind === 'quickPick' && <>
+        <Input aria-label={t('plugins.interaction.filter')} value={search} onChange={(event) => setSearch(event.target.value)} autoFocus disabled={state.busy} />
+        <div className="max-h-64 space-y-2 overflow-y-auto" role="radiogroup" aria-label={request.title}>
+          {request.items.filter((item) => `${item.label} ${item.description ?? ''}`.toLocaleLowerCase().includes(search.toLocaleLowerCase())).map((item) => <label key={item.id} className="flex items-start gap-3 rounded-md border p-3">
+            <input type="radio" name="plugin-host-choice" value={item.id} checked={state.value === item.id} disabled={state.busy} onChange={() => state.setValue(item.id)} />
+            <span className="min-w-0 break-words text-sm">{item.label}{item.description && <span className="block text-xs text-muted-foreground">{item.description}</span>}</span>
+          </label>)}
+        </div>
+      </>}
+      {previewClipboard && <p className="text-sm">{t('plugins.interaction.previewNote')}</p>}
+      {(request.kind === 'clipboard.write' || prompt.phase === 'preview') && <textarea aria-label={t('plugins.interaction.preview')} readOnly className="min-h-28 max-h-64 w-full resize-none rounded-md border bg-muted/30 p-3 font-mono text-xs" value={request.kind === 'clipboard.write' ? request.text : prompt.previewText ?? ''} />}
+      {state.error && <p role="alert" className="text-sm text-destructive">{t('plugins.interaction.failed')}</p>}
+      <DialogFooter>
+        <Button variant="outline" disabled={state.busy} onClick={() => void state.respond('cancel')}>{t('common.cancel')}</Button>
+        <Button disabled={state.busy || !canSubmit} onClick={() => void state.respond(previewClipboard ? 'preview' : 'submit')}>
+          {t(previewClipboard ? 'plugins.interaction.previewAction' : request.kind === 'clipboard.read' ? 'plugins.interaction.share' : request.kind === 'clipboard.write' ? 'plugins.interaction.copy' : 'common.continue')}
+        </Button>
+      </DialogFooter>
+    </DialogContent>
+  </Dialog>;
+}

components/settings/tabs/PluginInstalledGrid.test.tsx

@@ -53,6 +53,11 @@ test('installed grid filters, opens one detail and restores search, scroll and c
     assert.equal(pane.scrollTop, 160); assert.equal(focus.at(-1), plugins[0].id);
     await act(async () => renderer.root.findByType('input').props.onChange({ target: { value: 'none' } }));
     assert.equal(cards().length, 0);
+    await act(async () => renderer.root.findByType('input').props.onChange({ target: { value: '' } }));
+    await act(async () => renderer.update(<I18nProvider locale="en"><PluginPackageManager manager={{ ...manager, statusKnown: false, error: 'synthetic state unavailable' }} onSelectionChange={(id) => selections.push(id)} /></I18nProvider>));
+    const unknown = renderer.root.findAllByType('button').filter((node) => node.children.includes('Status unknown'));
+    assert.equal(unknown.length, 2);
+    assert.ok(unknown.every((node) => node.props.disabled === true && node.props['aria-pressed'] === undefined));
     await act(async () => renderer.unmount());
   } finally { globals.IS_REACT_ACT_ENVIRONMENT = previous; globalThis.requestAnimationFrame = raf; }
 });

components/settings/tabs/PluginPackageManager.tsx

@@ -91,13 +91,13 @@ export function PluginPackageManager({ manager, onSelectionChange }: { manager:
 
         </button>
         <Button variant="ghost" size="sm" type="button"
-          className={`h-7 shrink-0 rounded-full border-0 px-3 text-xs focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background ${plugin.enabled ? 'bg-primary/10 hover:bg-primary/15' : 'bg-muted/60 text-muted-foreground hover:bg-muted hover:text-foreground'}`}
-          style={plugin.enabled ? { color: 'color-mix(in srgb, hsl(var(--primary)) 40%, hsl(var(--foreground)))' } : undefined}
-          aria-pressed={plugin.enabled} aria-busy={manager.busy}
-          aria-label={`${t(plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')} ${plugin.manifest?.name ?? plugin.id}`}
-          title={t(plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')}
-          disabled={manager.busy} onClick={() => void manager.setEnabled(plugin.id, !plugin.enabled)}>
-          {t(plugin.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}
+          className={`h-7 shrink-0 rounded-full border-0 px-3 text-xs focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background ${manager.statusKnown !== false && plugin.enabled ? 'bg-primary/10 hover:bg-primary/15' : 'bg-muted/60 text-muted-foreground hover:bg-muted hover:text-foreground'}`}
+          style={manager.statusKnown !== false && plugin.enabled ? { color: 'color-mix(in srgb, hsl(var(--primary)) 40%, hsl(var(--foreground)))' } : undefined}
+          aria-pressed={manager.statusKnown === false ? undefined : plugin.enabled} aria-busy={manager.busy}
+          aria-label={`${t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')} ${plugin.manifest?.name ?? plugin.id}`}
+          title={t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')}
+          disabled={manager.busy || manager.statusKnown === false} onClick={() => void manager.setEnabled(plugin.id, !plugin.enabled)}>
+          {t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}
         </Button>
       </div>
       {plugin.manifest?.publisher && <p className="break-words text-xs text-muted-foreground">{plugin.manifest.publisher}</p>}

components/settings/tabs/PluginPermissionPanel.test.tsx

@@ -19,7 +19,7 @@ test('permission panel refreshes real grants, revokes once, and keeps stale read
   const { PluginPermissionPanel } = await import('./PluginPermissionPanel');
   const root = createRoot(document.getElementById('root')!);
   const initial = {
-    grants: [{ permission: 'network', resource: 'https://synthetic.invalid/<text>', resourceKind: 'exact', scope: 'always' as const, sessionId: null, grantedAt: 1 }],
+    grants: [{ permission: 'network', resource: 'https://synthetic.invalid/<text>', resourceKind: 'exact', scope: 'always' as const, sessionId: null, grantedAt: 1, matchesCurrentActivation: false }],
     audit: [{ event: 'permission.used', createdAt: 2, permission: 'network' }],
   };
   let reads = 0;
@@ -43,6 +43,7 @@ test('permission panel refreshes real grants, revokes once, and keeps stale read
     assert.match(document.body.textContent!, /synthetic.invalid/);
     assert.equal(document.querySelector('text'), null, 'resource is rendered as plain text');
     assert.match(document.body.textContent!, /Until revoked/);
+    assert.match(document.body.textContent!, /Inactive for the current activation/);
     await act(async () => { button('Refresh').click(); });
     await act(async () => {
       button('Disable and revoke all grants').click();
@@ -52,7 +53,7 @@ test('permission panel refreshes real grants, revokes once, and keeps stale read
     assert.equal(button('Refresh').disabled, true);
     await act(async () => { releaseRevoke(); });
     assert.equal(changed, 1);
-    assert.match(document.body.textContent!, /No active grants/);
+    assert.match(document.body.textContent!, /No saved grants/);
     await act(async () => { staleRead(initial); });
     assert.doesNotMatch(document.body.textContent!, /synthetic.invalid/);
     Object.assign(dom.window, { netcatty: { async getPluginPermissions() { throw new Error('synthetic read failed'); } } });
@@ -67,3 +68,78 @@ test('permission panel refreshes real grants, revokes once, and keeps stale read
     }
   }
 });
+
+test('partial revocation failure refreshes actual manager and engine state without clearing the original error', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event', 'MouseEvent', 'IS_REACT_ACT_ENVIRONMENT']) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value: key === 'window' ? dom.window : key === 'IS_REACT_ACT_ENVIRONMENT' ? true : dom.window[key as keyof typeof dom.window] });
+  }
+  const { act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginPermissionPanel } = await import('./PluginPermissionPanel');
+  const { PluginManager } = await import('../../../electron/plugins/pluginManager.cjs');
+  const { PluginPermissionEngine } = await import('../../../electron/plugins/permissionEngine.cjs');
+  const { defaultSecurityPrincipal, normalizePermissionDeclarations, permissionDeclarationHash } = await import('../../../electron/plugins/permissionResources.cjs');
+  const manifest = { id: 'com.example.synthetic', publisher: 'example', permissions: { optional: ['storage'] } };
+  const principal = defaultSecurityPrincipal(manifest);
+  const grant = { pluginId: manifest.id, permission: 'storage', resource: '*', resourceKind: 'exact', grantedAt: 1,
+    declarationHash: permissionDeclarationHash(normalizePermissionDeclarations(manifest).get('storage'), principal) };
+  let enabled = true, running = true, stopped = false, readFails = false;
+  let grants = [grant];
+  let reads = 0, changed = 0;
+  const database = {
+    getActivePlugin: () => ({ id: manifest.id, enabled, manifest }),
+    listPlugins: () => [{ id: manifest.id, enabled, manifest }],
+    setEnabled(_id: string, value: boolean) { enabled = value; },
+    listPermissionGrants: () => grants,
+    deleteAllPermissionGrants() { grants = []; },
+    recordSecurityAudit() { throw new Error('synthetic audit write failed'); },
+  };
+  const engine = new PluginPermissionEngine({ database });
+  const manager = new PluginManager({ database, permissionEngine: engine,
+    packageStore: { async initialize() {} },
+    contributionService: { async initialize() {}, onPluginDisabled() {} },
+    runtimeSupervisor: { async stop() { running = false; stopped = true; } },
+  });
+  Object.assign(dom.window, { netcatty: {
+    async getPluginPermissions() {
+      reads++;
+      if (readFails) throw new Error('synthetic grants refresh failed');
+      const groups = engine.describeGrants(manifest.id, running ? { pluginId: manifest.id, manifest, securityPrincipal: principal } : null);
+      return { grants: groups.always, audit: [] };
+    },
+    async revokePluginPermissions(id: string) { return manager.revokePermissions(id); },
+  } });
+  const root = createRoot(document.getElementById('root')!);
+  const refreshManager = async () => { changed++; assert.equal((await manager.list())[0].enabled, false); };
+  const revoke = () => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((item) => item.textContent === 'Disable and revoke all grants')!;
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel key="first" pluginId={manifest.id} onChanged={refreshManager} /></I18nProvider>));
+    assert.match(document.body.textContent!, /Matches the current activation/);
+    await act(async () => { revoke().click(); });
+    assert.equal(enabled, false); assert.equal(stopped, true);
+    assert.equal(changed, 1); assert.equal(reads, 2);
+    assert.match(document.querySelector('[role="alert"]')?.textContent ?? '', /synthetic audit write failed/);
+    assert.match(document.body.textContent!, /No saved grants/);
+    assert.doesNotMatch(document.body.textContent!, /Matches the current activation/);
+    // A failed state read must also remove the old grant snapshot while
+    // retaining the mutation error and reporting the refresh failure.
+    enabled = true; running = true; stopped = false; grants = [grant];
+    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel key="second" pluginId={manifest.id} onChanged={async () => { await refreshManager(); readFails = true; throw new Error('synthetic manager refresh failed'); }} /></I18nProvider>));
+    assert.match(document.body.textContent!, /Matches the current activation/);
+    await act(async () => { revoke().click(); });
+    assert.equal(enabled, false); assert.equal(stopped, true);
+    assert.equal(changed, 2); assert.equal(reads, 4);
+    const error = document.querySelector('[role="alert"]')?.textContent ?? '';
+    assert.match(error, /synthetic audit write failed/);
+    assert.match(error, /synthetic manager refresh failed/);
+    assert.match(error, /synthetic grants refresh failed/);
+    assert.doesNotMatch(document.body.textContent!, /Matches the current activation/);
+  } finally {
+    await act(async () => root.unmount()); engine.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/settings/tabs/PluginPermissionPanel.tsx

@@ -15,16 +15,20 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
   const [busy, setBusy] = useState(false);
   const generation = useRef(0);
   const pending = useRef(false);
-  const refresh = useCallback(async () => {
+  const refresh = useCallback(async (preserveError = false) => {
     const current = ++generation.current;
-    setError(null);
+    if (!preserveError) setError(null);
     try {
       const bridge = netcattyBridge.require();
       if (!bridge.getPluginPermissions) throw new Error(t('settings.plugins.permissions.unavailable'));
       const result = await bridge.getPluginPermissions(pluginId);
       if (current === generation.current) setSnapshot(result);
     } catch (cause) {
-      if (current === generation.current) setError(cause instanceof Error ? cause.message : String(cause));
+      if (current === generation.current) {
+        setSnapshot(null);
+        const message = cause instanceof Error ? cause.message : String(cause);
+        setError((previous) => preserveError && previous ? `${previous}\n${message}` : message);
+      }
     }
   }, [pluginId, t]);
   useEffect(() => {
@@ -41,10 +45,16 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
       const bridge = netcattyBridge.require();
       if (!bridge.revokePluginPermissions) throw new Error(t('settings.plugins.permissions.unavailable'));
       await bridge.revokePluginPermissions(pluginId);
-      await onChanged();
-      await refresh();
     } catch (cause) { setError(cause instanceof Error ? cause.message : String(cause)); }
-    finally { pending.current = false; setBusy(false); }
+    finally {
+      try { await onChanged(); }
+      catch (cause) {
+        const message = cause instanceof Error ? cause.message : String(cause);
+        setError((previous) => previous ? `${previous}\n${message}` : message);
+      }
+      await refresh(true);
+      pending.current = false; setBusy(false);
+    }
   };
   return <section className="space-y-3 border-t border-border/60 pt-4 text-sm" aria-label={t('settings.plugins.permissions.title')}>
     <div className="flex flex-wrap items-center justify-between gap-2">
@@ -58,6 +68,7 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
       {snapshot.grants.map((grant, index) => <div key={index} className="rounded-md bg-muted/40 p-3 text-xs">
         <p className="font-medium">{describePluginPermission(grant.permission, resolvedLocale).label}</p>
         <p className="whitespace-pre-wrap break-all font-mono">{grant.resource}</p>
+        <p>{t(grant.matchesCurrentActivation ? 'settings.plugins.permissions.current' : 'settings.plugins.permissions.inactive')}</p>
         <p>{t(`settings.plugins.permissions.${grant.scope}`)}{grant.sessionId ? ` · ${grant.sessionId}` : ''}</p>
         <time dateTime={new Date(grant.grantedAt).toISOString()}>{new Date(grant.grantedAt).toLocaleString(resolvedLocale)}</time>
       </div>)}

docs/plugin-platform/batch1-verification.md

@@ -1,98 +0,0 @@
-# Batch 1 aggregate failure comparison
-
-Frozen base: `e5bd294cddbf58dfe04c646b6291933d980498fd`. Current:
-`9af123e5d7bdb15771d69fb427faacf32c46dfb3`. Same Node 24.19.0 executable,
-same installed dependency tree, same sandbox and environment. Tests use existing
-synthetic fixtures. No home/cache permission or native-build bypass was added.
-
-The 39 entries below were observed before stopping the local full suite.
-Later runner failures caused by that explicit termination are excluded. This
-is not a successful aggregate run and is not proof that every full-suite test
-was executed. The full suite was stopped after existing/environmental failures
-to avoid presenting an incomplete run as green.
-
-## Bounded comparison result
-
-Targeted test-name patterns selected the original 39 failures across 15 files.
-Thirty-eight fail on both frozen base and current with matching failure titles
-and key error signatures. The persistence-volume assertion passes on both.
-Three additional paired repetitions of that assertion also pass on both: four
-passing runs per side including the initial comparison. Its code is unchanged;
-the aggregate-only result remains a timing-sensitive limitation, not an
-established current-only regression.
-
-The first baseline rerun reproduced 11 entries: rows 1-2 and 4-12. It did not
-reproduce row 3. No new source change fixes unrelated baseline failures.
-
-| Rows | Signature and classification |
-| --- | --- |
-| 1-2, 14-16, 27-33, 35-39 | Host temp-dir creation fails outside writable roots (`ENOENT` from `tempDirBridge`). Both revisions fail. Environment constraint |
-| 4-9 | Markdown comparison falls back to source; expected rich-preview elements are absent. Both revisions fail. Existing baseline/dependency behavior; no source repair in this scope |
-| 10-12 | Native `pty.node` missing from normal build/prebuild lookup. Both revisions fail. Dependency/native setup constraint |
-| 13 | UI algorithm list includes `ssh-ed25519-cert-v01@openssh.com` but installed ssh2 rejects it. Both revisions fail. Existing baseline/dependency behavior |
-| 17-26 | Cursor discovery/SDK expectations differ (`false` vs `true`, then expected installation/auth DTO). Both revisions fail with matching assertion signatures. Existing environment/dependency behavior; no real account accessed |
-| 34 | Electron bootstrap fetch fails and the binary is not installed. Both revisions fail. Dependency/network setup constraint |
-| 3 | Persistence writes exceed aggregate threshold; isolated baseline/current and three repetitions each pass. Aggregate-only timing-sensitive assertion; no current-only failure reproduced |
-
-## Original titles and first error
-
-| # | Test file | Original title | First key error | Paired result |
-| --- | --- | --- | --- | --- |
-| 1 | `application/state/sftp/dedicatedTransferResume.test.ts` | large-history replace recovery retransfers retained completed children into its empty stage: late=false | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 2 | `application/state/sftp/dedicatedTransferResume.test.ts` | large-history replace recovery retransfers retained completed children into its empty stage: late=true | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 3 | `application/state/sftpTransferCenterStore.test.ts` | large directory progress coalesces synchronous persistence work | AssertionError [ERR_ASSERTION]: expected bounded persistence volume, wrote 2638624 characters for a 588644-character snapshot | base/current pass; aggregate-only |
-| 4 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | literal Markdown comparisons render without changing the note source | AssertionError [ERR_ASSERTION]: a comparison must render as ordinary text | base/current same failure |
-| 5 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | comparison variants render in paragraphs, tables and alongside HTML | assert.ok(!querySourceFallback(rootNode)) is false | base/current same failure |
-| 6 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | issue 3205 author note survives source, preview and edit without rewriting | AssertionError [ERR_ASSERTION]: preview must render the author's note | base/current same failure |
-| 7 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | editing a comparison emits Markdown that can be reopened | assert.ok(editable): actual null | base/current same failure |
-| 8 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | preview task checkboxes still save explicit changes without rewriting comparisons | assert.ok(task): actual null | base/current same failure |
-| 9 | `components/notes/InlineMarkdownEditor.unrenderableMarkdown.test.tsx` | switching between a comparison note and an unsupported note keeps the fallback scoped | assert.ok(!querySourceFallback(rootNode)) is false | base/current same failure |
-| 10 | `components/terminal/runtime/serialInputSequences.test.ts` | components/terminal/runtime/serialInputSequences.test.ts | Failed to load native module: pty.node | base/current same failure |
-| 11 | `components/terminal/runtime/terminalLinePaste.test.ts` | components/terminal/runtime/terminalLinePaste.test.ts | Failed to load native module: pty.node | base/current same failure |
-| 12 | `components/terminal/runtime/terminalPasteCancellation.test.ts` | components/terminal/runtime/terminalPasteCancellation.test.ts | Failed to load native module: pty.node | base/current same failure |
-| 13 | `domain/sshAlgorithmList.test.ts` | SUPPORTED_ALGORITHMS_BY_CATEGORY only lists algorithms ssh2 will actually accept | AssertionError [ERR_ASSERTION]: ssh-ed25519-cert-v01@openssh.com (serverHostKey) is in the UI list but ssh2 would reject it | base/current same failure |
-| 14 | `electron/bridges/ai/liveShellProbe.test.cjs` | Bash invoked as sh cleans probe history | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 15 | `electron/bridges/ai/liveShellProbe.test.cjs` | Bash invoked as renamed-bash cleans probe history | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 16 | `electron/bridges/aiBridge.externalContext.test.cjs` | electron/bridges/aiBridge.externalContext.test.cjs | ENOENT creating host temp directory from sshBridge import | base/current same failure |
-| 17 | `electron/bridges/aiBridge.test.cjs` | resolve-cli reports Cursor Agent CLI on PATH as installed without CLI login | AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: | base/current same failure |
-| 18 | `electron/bridges/aiBridge.test.cjs` | resolve-cli reports Cursor SDK installed but unavailable without an API key | AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: | base/current same failure |
-| 19 | `electron/bridges/aiBridge.test.cjs` | resolve-cli separates Cursor SDK installation from API key availability | AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: | base/current same failure |
-| 20 | `electron/bridges/aiBridge.test.cjs` | resolve-cli ignores custom Cursor paths and stores the SDK sentinel path | AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: | base/current same failure |
-| 21 | `electron/bridges/aiBridge.test.cjs` | resolve-cli exposes Cursor SDK support when installed and authenticated | AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: | base/current same failure |
-| 22 | `electron/bridges/aiBridge.test.cjs` | resolve-cli exposes Cursor SDK support when API key is saved in settings | AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: | base/current same failure |
-| 23 | `electron/bridges/aiBridge.test.cjs` | resolve-cli reports settings as Cursor auth source when settings and env keys both exist | AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: | base/current same failure |
-| 24 | `electron/bridges/aiBridge.test.cjs` | resolve-cli can refresh shell env before resolving Cursor | AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: | base/current same failure |
-| 25 | `electron/bridges/aiBridge.test.cjs` | discover exposes Cursor SDK support when API key is saved in settings | AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: | base/current same failure |
-| 26 | `electron/bridges/aiBridge.test.cjs` | discover can refresh shell env before scanning Cursor | AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: | base/current same failure |
-| 27 | `electron/bridges/aiBridge/sdk/copilotDriver.test.cjs` | listCopilotModels resolves a Windows .cmd shim to the copilot JS entry before the SDK sees it | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 28 | `electron/bridges/aiBridge/sdk/copilotDriver.test.cjs` | listCopilotModels retains the official loader when its platform runtime is unavailable | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 29 | `electron/bridges/aiBridge/sdk/copilotDriver.test.cjs` | resolveCopilotPlatformExecutable resolves the platform package exe from the loader root | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 30 | `electron/bridges/aiBridge/sdk/copilotDriver.test.cjs` | resolveCopilotExecutableForSdk resolves npm's copilot.ps1 wrapper to the JS entry on Windows | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 31 | `electron/bridges/aiBridge/sdk/copilotDriver.test.cjs` | connectCopilotStdioPath directly selects the official loader's native runtime | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 32 | `electron/bridges/aiBridge/sdk/opencodeDriver.startup.test.cjs` | OpenCode releases the process-env gate after spawning separate catalog profiles | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 33 | `electron/bridges/aiBridge/sdk/opencodeDriver.test.cjs` | createOpenCodeProcessEnv prefers an existing opencode binary | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 34 | `electron/bridges/aiEchoSuppressionOrdering.test.cjs` | electron/bridges/aiEchoSuppressionOrdering.test.cjs | fetch failed; Electron failed to install correctly | base/current same failure |
-| 35 | `electron/bridges/autoUpdateBridge.test.cjs` | recognizes packaged Linux FPM formats as auto-update capable | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 36 | `electron/bridges/autoUpdateBridge.test.cjs` | allows the update check to reach electron-updater for a packaged Linux deb | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 37 | `electron/bridges/autoUpdateBridge.test.cjs` | keeps the manual-update fallback for an unmarked Linux package | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 38 | `electron/bridges/autoUpdateBridge.test.cjs` | keeps AppImage auto-update support on Linux | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-| 39 | `electron/bridges/autoUpdateBridge.test.cjs` | install handler reports package-manager failures and restores the app state | ENOENT creating host temp directory from tempDirBridge | base/current same failure |
-
-## Reproduction method
-
-For each file above, run the existing test with the same title pattern in each
-checkout. Pass the title pattern as an argument, without interpolating it as
-shell code. Native/import failures occur before the title filter can execute.
-
-```sh
-node --test --import tsx --test-reporter=tap --test-name-pattern "<escaped original title>" <test file>
-```
-
-The comparison used bounded 90-second subprocess deadlines. None reached that
-deadline. The persistence repeat used the same existing test and a 60-second
-deadline. It added no load generator or attack payload.
-
-All 15 test files and the business modules responsible for these signatures
-are unchanged by batch 1. This classification does not resolve the two
-independently reported grant-management review findings; those receive
-separate source fixes and tests.

docs/plugin-platform/capability-coverage.md

@@ -11,13 +11,13 @@ mean complete. Existing APIs remain available.
 
 | Subsystem | Working API at baseline | Enumeration or missing adapter | Accepted bounded entry | Data and action risk | Authorization resource | Revocation, audit, quota | Verification and disposition |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| Authorization management | Engine `listGrants`, `revokeAll`, database audit | Manager shows declarations only | Host-only grant list, bounded audit summary, disable and revoke | Paths, session IDs, grant metadata are sensitive | Exact plugin ID, trusted app sender | Serialized manager mutation, disable before revoke, runtime teardown, retained audit | Batch 1 implemented: host/manager/UI tests. Native acceptance pending. No plugin RPC for managing grants |
-| Network and credential leases | `network.request`, `credentials.createLease`, single-use host redemption | SDK request omits lease and authorization fields | Canonical request types matching broker | Network mutation and credentials | Exact origin plus secret reference and operation | Existing timeout, redirects, byte quotas, runtime checks, lease TTL | Batch 1 implemented: canonical schema and SDK, synthetic fixture and lease tests, feature negotiation. Native acceptance pending. No plaintext secret API |
+| Authorization management | Engine `listGrants`, `revokeAll`, database audit | Manager shows declarations only | Host-only grant list, bounded audit summary, disable and revoke | Paths, session IDs, grant metadata are sensitive | Exact plugin ID, trusted app sender | Serialized manager mutation, disable before revoke, runtime teardown, retained audit | Batch 1 limited acceptance complete on ff3734d: independent review fixes, host/manager/UI tests, exact test/packaging CI, parent native own-views Application grant/revoke/disable/runtime-stop check. Visible view was manually closed beforehand. No plugin RPC for managing grants |
+| Network and credential leases | `network.request`, `credentials.createLease`, single-use host redemption | SDK request omits lease and authorization fields | Canonical request types matching broker | Network mutation and credentials | Exact origin plus secret reference and operation | Existing timeout, redirects, byte quotas, runtime checks, lease TTL | Batch 1 contract/SDK consistency complete: canonical types, synthetic fixture/lease tests, feature discovery and exact CI. No live network or credential acceptance claimed. No plaintext secret API |
 | Commands, menus, toolbar, status bar, views | `commands.execute`, settings, context keys, view state and messages, UI contributions | No editor or SFTP menu slots | Existing contribution system | Plugin text and arguments may be sensitive | Namespaced contributions and permissions | Existing lifecycle, rate and message limits | Existing tests. New context menu slots planned with bounded context DTOs |
 | Terminal providers | Decorations, links, completion, snapshots through provider requests | Session change delivery follows prior provider request and non-once grant | Preserve providers. Standalone selected-session watch planned | Hostnames, session state, endpoint identity | Host-selected session, runtime identity | Session-close and revoke cleanup, bounded event rate | Existing provider tests. Ordinary views cannot independently subscribe today |
 | Current context and host picker | Host context keys are boolean state | `vault.metadata` enumeration is not generic SDK | Selected host/session DTO from an explicit whitelist | Labels and endpoint metadata are sensitive | Host-owned user-action context, selected host/session | TTL, runtime and session invalidation, redacted audit | Planned. Never reuse agent `sanitizeHostForAgent` as plugin DTO |
 | Terminal selection and input draft | Provider-supplied snapshots, completion suggestions | No explicit selection-share or draft API | User shares selection, plugin proposes a visible editable draft | Terminal plaintext, accidental execution | Host action token plus exact live session/endpoint | Single-use token, size cap, no plaintext audit, active identity before commit | Planned. Reject Enter/control characters for draft insertion. No full history or direct shell |
-| Native interactions and clipboard | Native permission dialogs | Clipboard enum only. No quick-pick/input/progress/toast SDK | Host-owned prompts, explicit copy/paste with preview | Clipboard and input may contain secrets, prompt spam | Host action context plus clipboard direction | Cancellation, request count and byte caps, runtime cleanup | Planned. No background reads or trusted plugin `userGesture` boolean |
+| Native interactions and clipboard | Native permission dialogs; new browser SDK host choice/input and explicit copy/share workflow | Progress/toast remain unimplemented | Host-owned prompts, two-phase clipboard snapshot/share, exact copy preview | Clipboard and input may contain secrets; UI discloses granted network capability; prompt spam | `ui.interact`, clipboard direction, host-signed window/runtime/version/phase/TTL action | Admission before permission prompt, byte/rate/concurrency limits, lock/blur/close/revoke cleanup, active guard, content-free audit | [Host interaction slice](./host-interactions.md) implemented and synthetic-tested; native acceptance/review/CI pending. Progress/toast still planned. No background reads or trusted plugin `userGesture` boolean |
 | Local filesystem | Read file, stat, overwrite existing regular file | Directory listing lacks same-handle native adapter | Keep current boundary, evaluate file picker handles | Arbitrary local file content and writes | Canonical exact path or selected file handle | Inode checks, no symlink alias, bounded bytes, active runtime | Existing filesystem tests. Directory enumeration and new arbitrary-path creation deferred until portable safe native adapter exists |
 | SFTP and remote files | No generic plugin API | `sftp.read` and `sftp.write` enumerated only | Host-selected session/path/mode/TTL handles, read and explicit save/upload | Remote secrets and destructive overwrite | Live endpoint identity, exact path, read/write split | Cancel streams, byte quota, overwrite confirmation, close/revoke cleanup | Batch 2 planned. Never forward arbitrary MCP catalog or session ID alone |
 | Editor and Notes | No plugin document API | No versioned snapshot or edit preview | Explicit snapshot and versioned proposed edit | Document secrets, lost updates, executable files | Selected document plus revision and action token | Version conflict check, preview, bounded bytes, revocation | Planned evaluation after shared action context. No unattended edits |
@@ -27,22 +27,25 @@ mean complete. Existing APIs remain available.
 | Vault and keychain | Credential references and import preview/commit | Metadata/write enums do not grant a generic Vault SDK | Only user-selected whitelist DTOs and drafts | Notes, environmentVariables, startupCommand, keys and credentials | Selected object plus field/direction | Explicit preview, identity checks, redacted audit | Full Vault export and secret reads deferred indefinitely. No agent field-exclusion DTO reuse |
 | System manager and Docker | No plugin system API | Agent/MCP adapters are separate authority | Typed read-only summaries excluding args/env/inspect | Process command lines and Docker inspect can expose secrets | Selected live session and summary kind | Bounded result, endpoint identity, cancellation | Planned evaluation. Arbitrary process/inspect forwarding deferred |
 | Port forwarding | No generic plugin API | Existing agent start is write-sensitive | Selected rule status and open host form | Rule endpoints and local exposure | Selected rule plus host action | Bounded DTO, session close and revoke | Planned evaluation. Direct start deferred until binding/listener approval design |
-| Themes, settings, appearance, i18n | Terminal theme/background Providers, isolated view CSS, scoped settings and environment updates | No host global theme contribution. Personal customCSS is not plugin authority | Accepted ThemePack stage: static palette registry, source-labelled selector, window-local preview, revision-safe apply/cancel/reset, static terminal linkage | Unreadable colors and misleading security UI. Nineteen UiThemeTokens fields are not independent: primary/accent/ring and foregrounds derive from the effective accent | User explicitly selects a theme. Separate static contribution enablement from code permissions; no generic appearance.write or runtime activation | Immutable version/hash, bounded JSON, preview owner/token/revision, disable/update/uninstall fallback, no implicit sync, fixed host security appearance | [ThemePack design](./theme-packs-design.md) accepted for implementation after current A work; unfinished until contract, security boundary, lifecycle, contrast, samples and native gates pass. No arbitrary DOM/CSS, remote assets, free layout or security UI customization |
+| Themes, settings, appearance, i18n | Terminal theme/background Providers, isolated view CSS, scoped settings and environment updates | No host global theme contribution. Personal customCSS is not plugin authority | Accepted ThemePack stage: static palette registry, selector, local preview, revision-safe apply/cancel/reset, terminal linkage | Unreadable palettes and misleading security UI. Nineteen UiThemeTokens fields are not independent: accent derives primary/ring/foregrounds | User explicitly selects a theme; static contribution enablement separate from code permissions | Immutable version/hash, bounded JSON, contrast/security-surface gates, preview owner/revision and safe fallback | Planned independent implementation after current controlled workflow/navigation. No arbitrary DOM/CSS, remote assets, layout replacement or security UI customization |
 | Transfer center | Host transfer queue exists, no plugin entry | No ownership-bound task API | Observe and cancel only plugin-created tasks | Paths and host endpoints reveal user data. Cancel may leave partial files | Own transfer handle plus source/destination authority | Shared backpressure, cancel/close cleanup, honest partial status | Planned with batch 2. Do not broadcast or cancel other tasks |
 | AI, MCP, automation | Host agent catalog and harness exist separately | No generic plugin AI or tool forwarding | Selection-to-proposal workflow through the same controlled primitives | Content disclosure, account authority and model cost | Explicit content sharing plus service origin/budget | No inherited history, tools, account, or hidden cron | Controlled workflow planned. Generic host AI and visible schedules deferred to distinct product decision |
 | Known hosts, app lock and global security | Host security management UI | No plugin management API | Future allowlisted security-page navigation | Host-key trust, unlock, keys and security policy affect all sessions | Host navigation action only | No mutation or sensitive DTO | Security policy mutation, private-key reads, auto-trust and unlocking deferred indefinitely |
 | Plugin blob/cache | Local KV exists | No exclusive blob cache | Evaluate bounded plugin-owned cache when a real workflow needs it | Disk growth and lifecycle ambiguity | Plugin namespace, no arbitrary path | Size quota, eviction and uninstall policy required | Deferred until a concrete larger-than-KV workflow establishes value and retention policy |
+| Vault and terminal navigation | `tab` mounts a sandbox page through TopTabs/QuickSwitcher; aside/panel are overlays | No Vault subpage registry or terminal side-panel plugin tool. `settings` is a detail entry, not a new settings category | Accepted independent slice: host-owned namespaced Vault pages in an Extensions group, mounted in the Vault content area through existing ViewHost; then terminal pane/split pages for the selected session | Navigation cannot disclose session contents or replace built-in/security navigation | Declared page contribution plus host selection. Content reads have independent permissions | Host order/when/focus, cancellation of late open, view cleanup on hide/update/disable/uninstall, safe invalid-link fallback | Planned after host interaction/selected-context workflow. A button that merely opens a top tab does not satisfy Vault-page acceptance. No arbitrary router/DOM API |
 | Distribution and runtimes | Browser-only public catalog, immutable packages, advanced developer gate | Signing/trust and release remain separate phase | Retain existing boundary | Package execution and publisher trust | Pinned catalog selection, hash, engine/features | Existing install transaction, quarantine and cleanup | No merge/release. Do not extend to arbitrary Node, IPC, shell, or global capabilities |
 
 ## Delivery order and stopping rule
 
 1. Batch 1: actual authorization management plus network contract consistency.
    Keep the existing manager layout. Add one independent permission panel.
-2. Batch 1b: host action context, native interactions, selected context and terminal
+2. Batch 1b: the host text interaction slice, then selected context and terminal
    sharing/drafts. A plugin-supplied gesture is never authority.
-3. Batch 2: SFTP selected-file handles and explicit transfer destinations.
-4. Deliver the separately reviewed [declarative ThemePack stage](./theme-packs-design.md), including protected security surfaces, contrast gates, revision-safe preview/apply/reset, and safe fallback.
-5. Reassess editor, Notes, snippets, menus, system summaries, and port forwarding
+3. A separate navigation slice mounts actual Vault extension pages, then terminal
+   sidebar panes, reusing the isolated ViewHost and keeping content permissions separate.
+4. Deliver the declarative ThemePack stage with security appearance and contrast gates.
+5. Batch 2: SFTP selected-file handles and explicit transfer destinations.
+6. Reassess editor, Notes, snippets, menus, system summaries, and port forwarding
    using the tested host-action and resource primitives.
 
 Stop only when every row is implemented and tested, reasonably deferred with a

docs/plugin-platform/host-interactions.md

@@ -0,0 +1,130 @@
+# Host text interactions
+
+Status: internal preview. This layer builds on the grant management in Draft
+#3955. It adds `host.interactions` feature discovery, a generated request/result
+contract, and an ordinary browser SDK workflow. Native acceptance remains a
+separate parent-owned gate.
+
+## SDK and authorization
+
+| SDK call | Permission | Result |
+| --- | --- | --- |
+| `ui.quickPick(title, items)` | `ui.interact` | Approved item ID or `undefined` on cancel |
+| `ui.input(title, initialValue?)` | `ui.interact` | Approved single-line text or `undefined` on cancel |
+| `clipboard.readText(title)` | `clipboard.read` | Explicitly shared snapshot or `undefined` on cancel |
+| `clipboard.writeText(text, title)` | `clipboard.write` | `true` after copy, `false` on cancel |
+
+`ui.input` rejects CR and LF in initial values before any dialog is displayed,
+and rejects line breaks on submission. It does not silently remove hidden
+newlines. The displayed single-line value is the value submitted to the plugin.
+Clipboard text continues to support multiple lines.
+
+All calls use the canonical `ui.interact` RPC. No host DOM, native object,
+router, general command ID, or arbitrary IPC channel enters the SDK. Existing
+API versions remain offered. A plugin requiring the new workflow declares
+`features.required: ["host.interactions"]`; old hosts reject unsupported
+required features. Old plugins keep their existing APIs and permissions.
+
+Clipboard prompts restrict new permission decisions to once. Required or
+previously saved grants never skip the host action confirmation. Input and
+choice dialogs need their own declaration; a `views` or `menus` declaration is
+not permission to open them. Direction-specific clipboard permissions remain
+separate. The normal sample uses no network, host/session, filesystem, secret,
+Node, or shell capability.
+
+## User action and text sharing
+
+The host always displays plugin ID/version and a fixed source heading. Titles,
+choices, and text render as plain text. No plugin-supplied `userGesture` flag is
+accepted. The host creates an HMAC action token bound to request ID, runtime,
+plugin version, owner window, action kind, phase, nonce, and expiry. It sends
+that token only to the trusted host renderer. A response must come from the
+same WebContents and present the current token. Tokens are consumed before the
+first asynchronous action guard, so old-phase and duplicate responses cannot
+commit an action.
+
+Clipboard reading has two steps. **Preview clipboard** authorizes a host read
+into a bounded in-memory snapshot. The plugin receives nothing yet. **Share
+with plugin** sends exactly that snapshot after another active-identity check.
+Changes to the system clipboard after preview do not replace it. Cancel, lock,
+window loss, or revoke discards the snapshot. Copy shows the exact replacement
+text and requires its own confirmation before a native write.
+
+Shared text can be sensitive. The host explains that it becomes available to
+the plugin and its granted capabilities, including network access. Reading
+text does not approve a new network destination. This UI does not claim to
+prevent a plugin from transmitting derived text through an already granted
+capability. The example avoids network permission entirely.
+
+## Availability, limits, and cleanup
+
+The first slice supports the focused, visible, unlocked main window only.
+The host renderer registers readiness before any prompt can be presented.
+Other or unready windows return unavailable instead of inheriting an owner's
+authority. One interaction occupies an owner window at a time; there is no
+hidden prompt queue.
+
+`HostInteractionLimits` is the shared canonical source for 4,096 UTF-8 text
+bytes, 100 choices, 64 KiB serialized requests, one pending request per runtime,
+eight total, ten attempts per minute per runtime, and a 60-second lifetime.
+The current main-window-only adapter is narrower than the total pending bound.
+Admission runs before the permission prompt. The generic capability quotas and
+byte windows still apply. Text exceeding its cap is rejected without silent
+truncation. RPC uses the same generated deadline.
+
+After a native permission decision, an originally foreground request can wait
+at most one second for the same owner to regain focus. The host never focuses
+the window itself, presents content in the background, or postpones admission
+for an originally background request. Hide, lock, revoke, runtime stop, owner
+replacement and reload invalidate this admission, even during the permission
+dialog. Runtime activity and foreground state are checked again after waiting.
+
+Input cancellation, timeout, disable/update/crash/revoke, owner blur/hide/close,
+main-document reload, renderer exit, and app lock invalidate pending tokens.
+Same-document or subframe navigation does not permanently unregister a live
+host UI. Runtime teardown clears rate accounting. The broker checks runtime
+activity, owner readiness/focus, and app lock again immediately before native
+read/write or disclosure. A revoked operation cannot resume from a late reply.
+
+Commands normally retain the existing 30-second RPC deadline. A command that
+declares `interactive: true` must require `commands.interactive`; the host gives
+only that command a fixed 180-second total budget. This is not a global timeout
+increase or a UI/clipboard permission. Each individual host interaction still
+has its own 60-second deadline, including permission approval time.
+
+When an outer command fails, times out or is cancelled, the host cancels pending
+interactions and pre-prompt admissions for its captured runtime. On successful
+completion it closes orphan interactions once the last concurrent command ends.
+This cleanup does not reset rate/byte quotas and cannot affect a replacement
+runtime. A failure conservatively closes that runtime's single shared pending
+dialog even if another command is active. Late action tokens cannot commit a
+clipboard effect. Cancellation does not forcibly terminate arbitrary plugin
+JavaScript; ignored errors remain subject to permission, focus, rate and runtime
+limits. Do not start independent interactive workflows concurrently.
+
+Audit records contain only fixed event/action/kind fields. They contain no
+prompt, choices, user text, clipboard bytes, action tokens, or hashes derived
+from those values. A failed consent-audit write prevents the native action;
+no successful operation is reported for that failure.
+
+## Verification and native acceptance
+
+The [browser fixture](../../examples/plugins/host-interactions/README.md)
+exercises choice, input, copy, and clipboard transformation without a plugin
+view. Tests cover the actual runtime/SDK RPC path through permission middleware,
+actual host React dialog events against service-signed actions, denial, cancel,
+quota before prompt, overlong text, duplicate/forged actions, wrong owners,
+stale runtime, revoke during an asynchronous guard, audit failure, deadline,
+lock, blur, document navigation, and renderer teardown.
+
+Parent native acceptance uses a separately approved temporary example-plugin
+session and synthetic clipboard text. It needs no real hosts, credentials,
+network destination, shell, or persistent grant. Check both complete workflows,
+cancel before reading, cancel after preview, cancel copy, and disable/revoke
+with a pending dialog. Record the exact SHA and restore the test clipboard.
+Unit tests are not evidence of native Electron acceptance.
+
+Progress/toast, selected context and terminal sharing/drafts remain later slices.
+Navigation uses the existing sandbox ViewHost and adds no content permission.
+ThemePack and SFTP remain separate stages. This layer alone does not finish the
+capability coverage matrix.

docs/plugin-platform/security-and-permissions.md

@@ -229,9 +229,11 @@ after durable user data can exist.
 
 ## Inspect and revoke actual grants
 
-The installed package detail separates declared permissions from **Active
+The installed package detail separates declared permissions from **Saved
 grants**. The host-only panel lists resource, scope, session (when applicable),
-and grant time. One-use decisions do not appear as retained grants. Refresh
+and grant time. Each row indicates whether its declaration hash and security
+principal match the host-owned current activation. Saved grants from an older
+package or a stopped/disabled activation remain visible as inactive. One-use decisions do not appear as retained grants. Refresh
 reads the engine again. Recent security events include at most 100 entries and
 project only event, time, permission, and scope. Arbitrary database details,
 operation IDs, terminal content, and credential material never cross this UI
@@ -240,8 +242,9 @@ boundary.
 **Disable and revoke all grants** runs through the manager mutation queue. It
 persists disabled state before revoking grants, invalidates contributions, and
 waits for runtime shutdown. Existing runtime teardown cancels RPC, streams,
-leases, providers, and companions. A containment failure is reported as a
-failure and leaves the plugin disabled. Explicit enable requests fresh access.
+leases, providers, and companions. Every cleanup stage is attempted if grant deletion, audit persistence, or
+contribution invalidation fails. Multiple errors are aggregated and reported;
+the UI never claims successful revocation when persistence or cleanup failed. Explicit enable requests fresh access.
 This management bridge is available only to the trusted app renderer. It is
 not a plugin RPC method and grants no plugin authority over another package.
 

docs/plugin-platform/theme-packs-design.md

@@ -1,215 +0,0 @@
-# Declarative theme packs
-
-Status: proposed implementation plan. No theme contribution or theme permission
-is implemented by this document. The baseline is Draft #3951 at
-`e5bd294cddbf58dfe04c646b6291933d980498fd`; batch 1 grants and network contracts
-are reviewed separately in Draft #3955.
-
-## Scope and existing behavior
-
-A theme pack supplies validated color data. Users preview, apply, cancel, or
-reset it through the host Appearance UI. Selecting a theme never starts a
-plugin runtime or approves its function permissions. This extends whole-app
-appearance alongside existing `terminal.theme` and `terminal.background`
-Providers and isolated view styles.
-
-Personal `customCSS` is a user-owned advanced setting, not a third-party plugin
-surface. This plan introduces no stylesheet, selector, DOM, font URL, image URL,
-script, layout, notification, or background permission.
-
-`UiThemeTokens` has 19 fields. They are not independent controls:
-`buildAppThemeCssVars()` assigns one effective accent to primary, accent, and
-ring and computes both accent foregrounds. The initial theme contract preserves
-this relationship. It must not accept independent primary, primaryForeground,
-accentForeground, or ring overrides and then silently discard them.
-
-## Contract and package admission
-
-The proposed feature is `appearance.theme-packs`. Its schema definitions,
-generated SDK exports, runtime/package compatibility, and documentation move
-together. Plan an internal schema/API revision with legacy negotiation retained;
-do not change the current batch 1 API just to publish this proposal. Old hosts
-reject a pack that requires the unknown feature before registration.
-
-A proposed `contributes.themes` entry contains:
-
-| Field | Meaning and validation |
-| --- | --- |
-| `id` | Contribution ID under the owning plugin namespace |
-| `label` | Existing bounded localized-text contract |
-| `variant` | `light`, `dark`, `hc-light`, or `hc-dark` |
-| `path` | Canonical package-relative JSON path inside the immutable installed version |
-
-A theme JSON document contains a schema revision, a variant-matching built-in
-base ID, bounded color overrides, and an optional static terminal palette.
-It contains no cross-plugin includes, arbitrary file references, inheritance
-chains, or remote resources. Resolve the validated base and overrides into one
-immutable complete palette before registration. Never retain partially valid
-entries from a failed theme document.
-
-The initial allowed UI overrides are `background`, `foreground`, `card`,
-`cardForeground`, `popover`, `popoverForeground`, `secondary`,
-`secondaryForeground`, `muted`, `mutedForeground`, `accent`, `destructive`,
-`destructiveForeground`, `border`, and `input`. Accept only opaque `#RRGGBB`
-colors. The host converts them to its internal HSL representation. Reject
-unknown keys, alpha, CSS expressions, `url()`, `var()`, `@import`, non-finite
-values, and custom properties. Do not pass author strings to CSS parsing.
-
-The optional terminal palette uses the existing `TerminalThemeColorName`
-allowlist. It merges with a host default and is validated independently.
-Static terminal colors require neither a session snapshot nor a Provider call.
-
-Initial bounds for implementation and tests are 32 themes per package,
-64 KiB per JSON file, 2 MiB total theme JSON, depth 8, and one active preview per
-window. These are proposed defaults, not existing limits. The schema and host
-must share the final constants. No font, image, or video assets enter v1.
-
-### Static admission must remain distinct from code activation
-
-The present manifest requires `main` and browser-only policy expects a browser
-entrypoint. Removing either check without a separate package variant is unsafe.
-
-For the first usable slice, a sample can retain a no-op browser entrypoint.
-Static theme registration must not invoke it. Theme enablement has a separate
-host-owned state from function/code enablement. Installing a pack keeps both
-off until a user opts into the corresponding contribution. Enabling its themes
-never sets the code-enabled flag, grants permissions, or runs activation events.
-Disabling the package disables its theme contributions as well as its code.
-
-A later exclusive data-only manifest variant can remove the no-op entrypoint.
-It must reject `main`, activation events, permissions, companions, providers,
-commands, and every non-theme contribution. Update canonical validation,
-semantic admission, package inspection, catalog policy, manager behavior, and
-compatibility tests together. The public catalog must explicitly recognize
-this inert variant while retaining browser-only admission for executable packs.
-A theme-only exception must not admit Node or an executable mixed package.
-
-## Host registry and persistence
-
-A host registry reads only installed, immutable package versions through the
-existing package-store path boundary. Verify real paths, file kinds, byte caps,
-and package ownership. Preserve the validated source version and content hash.
-No plugin RPC can register, apply, or replace global palette data.
-
-A committed selection references plugin ID, theme ID, variant, package version,
-and validated theme hash. Store per-variant selections and a monotonic commit
-revision through the settings/persistence layer. Do not persist plugin CSS or
-turn this into implicit KV/cloud synchronization. Preserve legacy built-in theme
-IDs and existing user settings when no plugin theme is selected.
-
-Theme availability records and applied preferences are user state, separate
-from runtime KV and function permissions. Define retained missing-selection
-metadata and uninstall behavior explicitly. Missing code or theme files must
-not trigger downloads, runtime activation, or new grants.
-
-## Preview, apply, cancel, and reset
-
-A single appearance resolver feeds existing chrome/terminal effects. Do not add
-a second root effect that races `useAppThemeStyle`, `useThemeRuntime`, or active
-terminal chrome selection.
-
-| Host action | Required behavior |
-| --- | --- |
-| Preview | Create a host-owned token bound to window, preview owner, selected immutable theme, and current committed revision. Render locally without storage writes, sync events, runtime activation, or other-window changes |
-| Apply | Verify owner, token, version/hash, availability, and expected commit revision. Commit the selected theme and explicitly chosen terminal linkage as one settings action. A stale preview produces a conflict, not an overwrite |
-| Cancel or close | Clear only the matching local preview token. Render the latest committed state. Never restore a captured old settings snapshot over a newer commit |
-| Reset | Clear the selected variant's plugin reference using the same revision check and apply the host default. Preserve font, accent, per-host terminal, and accessibility preferences |
-| Another window applies | Advance the shared commit revision. End the old preview or mark it stale; later cancel cannot alter the new selection |
-| Disable/uninstall/update | Invalidate matching previews and registry entries. Immediately resolve affected selections to a safe built-in variant, retain a bounded missing-reference notice, and never silently adopt unreviewed replacement bytes |
-| Application exit or window destruction | Release local preview ownership. Only committed preferences survive startup |
-
-The preview UI always identifies plugin source/version and has host-controlled
-Apply, Cancel, and Restore default controls. Those controls live inside the
-security appearance boundary. Theme data cannot control their labels, order,
-visibility, click behavior, or layout.
-
-Applying a theme changes only the selected palette and explicit terminal linkage.
-It does not overwrite user font family/size, accent override, host terminal
-override, reduced-motion choice, or OS accessibility preferences.
-
-## Appearance precedence and terminal behavior
-
-Resolve appearance in this order:
-
-1. Host security surfaces and OS accessibility requirements.
-2. Explicit user font, size, accent, and per-host/per-terminal overrides.
-3. The selected and validated theme pack.
-4. Built-in defaults.
-
-Define one effective accent using the current host rule. Reject impossible
-contrast combinations, including a user accent override against the effective
-surface, or show an explicit host correction before apply. Do not report an
-ignored author field as a successful override.
-
-Follow App may use the pack's static terminal palette. Manual terminal choices
-and per-host overrides retain precedence. Reuse the existing active-chrome
-selection rather than resetting app appearance on tab changes. Test Vault,
-SFTP, terminal, editor, Notes, logs, split panes, and detached windows.
-
-High-contrast flags in plugin environments are not proof that the host already
-has complete high-contrast themes. Missing HC variants require a host-owned HC
-fallback. Do not downgrade a forced-colors/high-contrast preference to an
-ordinary light/dark theme. Respect reduced motion and font scaling.
-
-## Security appearance and contrast gates
-
-Native Electron permission dialogs already sit outside renderer CSS. React
-security surfaces need a new explicit boundary before a theme pack ships.
-Cover AppLock, host-key trust, credential selection, grant/revoke management,
-dangerous confirmations, and theme preview/apply controls. Use host-controlled
-colors, font, icons, and layout there. Package colors never style those surfaces.
-The existing code has no verified shared boundary covering all of them.
-
-Color validation checks complete resolved/composited pairs, not only body text:
-foreground/background, card text/card, popover text/popover, secondary/muted
-text, accent/button text, destructive/button text, focus rings, borders, inputs,
-and selected/disabled states. Ordinary text needs 4.5:1, large text 3:1, and
-required non-text indicators 3:1 against adjacent surfaces. Reject a failing
-palette with a named pair and ratio, or show an explicit host correction.
-Tests must prove the effective UI, not only a helper's arithmetic.
-
-These gates follow [WCAG text contrast](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html)
-and [non-text contrast](https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html).
-Theme screenshot review supplements contract, lifecycle, and accessibility
-checks. It does not establish safe ownership, persistence, or revocation.
-
-## Delivery stages and acceptance
-
-Current batch A grants and SDK consistency reaches review/CI first. Complete
-the controlled native interaction/context work as planned; theme work remains
-a separate small stage from marketplace card/layout changes.
-
-| Stage | Implementation and evidence |
-| --- | --- |
-| Contract and pure validation | Canonical schema/generated SDK, feature/revision negotiation, strict color parser, derived-accent semantics, static terminal palette, bounds, named contrast diagnostics, old manifest compatibility |
-| Registry and security boundary | Immutable package ownership, static registration without runtime, independent theme/code enablement, fixed security appearance, same-variant/HC fallback, unavailable/tampered version behavior |
-| Product workflow | Appearance grouping/source, local preview ownership, revision-safe apply/cancel/reset, safe defaults, system theme changes, terminal linkage and overrides, persistence and window synchronization |
-| Samples and final acceptance | Light/dark no-op-browser sample, normal settings import without advanced mode, no runtime/grants on theme apply, later data-only admission only if fully validated, exact-SHA tests/build/package/CI, Codex review/fix/review, parent-owned native recording |
-
-Boundary tests include unknown fields/feature, invalid or excessive JSON,
-unsupported variant/base, non-package and changed paths, unreadable colors,
-preview cancellation and window close, two-window apply/cancel ordering,
-update/disable/uninstall/failure fallback, startup restoration, host and accent
-overrides, forced colors, reduced motion, Chinese fonts/fallback, and every
-protected security surface. A pending gate keeps the theme row unfinished.
-
-Later controlled candidates are known-font recommendations, radius/density
-presets after component support exists, declarative file/folder icons, and
-package-local static backgrounds on fixed surfaces with contrast limits. They
-need separate contracts and acceptance. Global CSS, free layout, remote fonts,
-HTML/video backgrounds, and security-UI customization remain excluded.
-
-## Baseline source references
-
-- `infrastructure/config/uiThemes.ts`: token fields and built-in registry.
-- `application/state/settingsStateDefaults.ts`: accent derivation and built-in ID checks.
-- `application/state/appearanceSync.ts`, `appearanceChromeStore.ts`, and
-  `useSettingsState.ts`: persistence and cross-window behavior.
-- `application/app/useAppThemeStyle.ts`, `activeChromeTheme.ts`,
-  `application/state/useThemeRuntime.ts`, and `domain/terminalAppearance.ts`:
-  effective UI and terminal precedence.
-- `packages/plugin-sdk/src/index.ts`: existing terminal theme/background types.
-- `electron/plugins/pluginProtocol.cjs`: isolated view CSS/font/network CSP.
-- `lib/customCss.ts`: personal user CSS, excluded from plugin authority.
-- `domain/pluginRuntimePolicy.cjs` and the canonical manifest schema: executable admission.
-- `electron/plugins/nativePermissionDecision.cjs`: native permission prompts.

domain/pluginPermissionDescriptions.cjs

@@ -9,6 +9,7 @@ const PERMISSION_DESCRIPTIONS = {
   "settings.write": [false, "Change plugin settings", "Update this plugin's preferences.", "修改插件设置", "修改此插件自己的设置。"],
   commands: [false, "Plugin commands", "Register and run this plugin's own commands.", "插件命令", "注册和执行此插件自己的命令。"],
   menus: [false, "Menu entries", "Add this plugin's actions to host menus.", "菜单入口", "将此插件的操作加入应用菜单。"],
+  "ui.interact": [false, "Host prompts", "Ask the host to show bounded input and choice dialogs.", "宿主交互", "请求宿主显示有界的输入和选择对话框。"],
   views: [false, "Plugin panels", "Display plugin-owned panels inside the app.", "插件面板", "在应用中显示插件自己的面板。"],
   "clipboard.read": [true, "Read clipboard", "Read copied text, which may contain passwords or other sensitive data.", "读取剪贴板", "读取复制的文本，其中可能包含密码或其他敏感数据。"],
   "clipboard.write": [true, "Write clipboard", "Replace clipboard content that you may paste elsewhere.", "写入剪贴板", "替换剪贴板内容，可能影响你随后粘贴的数据。"],

electron/main/registerBridges.cjs

@@ -165,6 +165,9 @@ function createBridgeRegistrar(context) {
           app,
           electron: electronModule,
           safeStorage,
+          getInteractionWindow: () => win,
+          isAppLocked: () => getAppLockController?.()?.getRuntimeState?.()?.locked !== false,
+          subscribeAppLock: (listener) => getAppLockController?.()?.subscribe?.(listener),
           requestPermissionDecision: createNativePermissionDecisionProvider({
             getLocale: () => getWindowManager().getCurrentLanguage?.() ?? "en",
             dialog: electronModule.dialog,
@@ -217,7 +220,9 @@ function createBridgeRegistrar(context) {
     });
     registerPluginBridge(ipcMain, {
       manager: pluginHostService?.manager,
+      interactionService: pluginHostService?.interactionService,
       permissionEngine: pluginHostService?.permissionEngine,
+      runtimeSupervisor: pluginHostService?.runtimeSupervisor,
       database: pluginHostService?.database,
       catalogService: pluginHostService?.catalogService,
       contributionService: pluginHostService?.contributionService,

electron/plugins/contributionService.cjs

@@ -6,6 +6,7 @@ const { assertPluginContextKey, evaluateContextKeyExpression } = require("./cont
 const { assertPluginJsonValue } = require("./jsonBoundary.cjs");
 const { compileRestrictedJsonSchema } = require("./restrictedJsonSchema.cjs");
 const { PluginRpcError, RPC_ERRORS } = require("./rpcRouter.cjs");
+const { InteractiveCommandFeature, InteractiveCommandLimits } = require("./generated/plugin-contract.schema.json").$defs;
 
 const MAX_SETTING_BYTES = 128 * 1024;
 const MAX_PATTERN_LENGTH = 512;
@@ -149,6 +150,8 @@ class PluginContributionService {
   constructor(options) {
     this.database = options.database;
     this.runtimeSupervisor = options.runtimeSupervisor;
+    this.onCommandFinished = options.onCommandFinished;
+    this.activeCommandCalls = new Map();
     this.secretStore = options.secretStore;
     this.getLocale = options.getLocale ?? (() => "en");
     this.contextKeys = new Map();
@@ -336,12 +339,31 @@ class PluginContributionService {
       throw new PluginRpcError(RPC_ERRORS.failedPrecondition, `Plugin command is disabled: ${commandId}`);
     }
     assertJsonValue(args ?? null, "command arguments");
-    await this.#ensureActivated(plugin, `onCommand:${commandId}`);
-    return this.runtimeSupervisor.request(plugin.id, "plugin.command.execute", {
-      command: commandId,
-      ...(args === undefined ? {} : { args }),
-      invocation: freezeJson({ source: invocation.source ?? "host", context: invocation.context ?? {} }),
-    });
+    if (contribution.interactive && !plugin.manifest.features?.required?.includes(InteractiveCommandFeature.const)) {
+      throw new PluginRpcError(RPC_ERRORS.failedPrecondition, "Interactive command feature is required");
+    }
+    const identity = await this.#ensureActivated(plugin, `onCommand:${commandId}`);
+    const runtimeId = identity?.runtimeId;
+    if (runtimeId) this.activeCommandCalls.set(runtimeId, (this.activeCommandCalls.get(runtimeId) ?? 0) + 1);
+    let failed = true;
+    try {
+      const result = await this.runtimeSupervisor.request(plugin.id, "plugin.command.execute", {
+        command: commandId,
+        ...(args === undefined ? {} : { args }),
+        invocation: freezeJson({ source: invocation.source ?? "host", context: invocation.context ?? {} }),
+      }, { expectedIdentity: identity, ...(contribution.interactive ? { timeoutMs: InteractiveCommandLimits.const.timeoutMs } : {}) });
+      failed = false;
+      return result;
+    } finally {
+      if (runtimeId) {
+        const remaining = Math.max(0, (this.activeCommandCalls.get(runtimeId) ?? 1) - 1);
+        if (remaining) this.activeCommandCalls.set(runtimeId, remaining);
+        else this.activeCommandCalls.delete(runtimeId);
+        // A failed command must not leave a live native consent prompt. On
+        // success wait for other concurrent commands before closing orphans.
+        if (failed || remaining === 0) this.onCommandFinished?.(runtimeId);
+      }
+    }
   }
 
   async activateView(viewId, params = {}) {

electron/plugins/contributionService.test.cjs

@@ -87,6 +87,7 @@ function setup(context, pluginManifest, options = {}) {
     runtimeSupervisor,
     secretStore,
     getLocale: () => "zh-CN",
+    onCommandFinished: options.onCommandFinished,
   });
   return { calls, database, secretStore, service, secrets };
 }
@@ -100,6 +101,48 @@ test("plugin contribution values enforce the exact JSON value boundary", () => {
   }
 });
 
+test("only explicitly declared interactive commands receive the fixed budget and command completion is runtime-bound", async (t) => {
+  const pluginManifest = manifest();
+  delete pluginManifest.contributes.commands[0].enablement;
+  pluginManifest.features = { required: ["commands.interactive"] };
+  pluginManifest.contributes.commands.push({ id: `${pluginManifest.id}.interactive`, title: "Interactive", interactive: true });
+  const optionsSeen = [], finished = [];
+  const runtimeId = "runtime-budget";
+  const { service } = setup(t, pluginManifest, {
+    onCommandFinished: (id) => finished.push(id),
+    runtimeSupervisor: {
+      async start() { return { runtimeId, pluginVersion: pluginManifest.version }; },
+      async request(_id, _method, _params, options) { optionsSeen.push(options); return null; },
+    },
+  });
+  await service.executeCommand(`${pluginManifest.id}.hello`);
+  await service.executeCommand(`${pluginManifest.id}.interactive`);
+  assert.equal(Object.hasOwn(optionsSeen[0], "timeoutMs"), false, "ordinary commands retain the existing router deadline");
+  assert.equal(optionsSeen[0].expectedIdentity.runtimeId, runtimeId);
+  assert.equal(optionsSeen[1].timeoutMs, 180_000);
+  assert.equal(optionsSeen[1].expectedIdentity.runtimeId, runtimeId);
+  assert.deepEqual(finished, [runtimeId, runtimeId]);
+  assert.equal(service.activeCommandCalls.size, 0);
+});
+
+test("concurrent successful commands retain the runtime interaction until the last ends, while a failed command cancels it", async (t) => {
+  const pluginManifest = manifest(); delete pluginManifest.contributes.commands[0].enablement;
+  const pending = [], finished = [];
+  const { service } = setup(t, pluginManifest, { onCommandFinished: (id) => finished.push(id),
+    runtimeSupervisor: { async start() { return { runtimeId: "runtime-concurrent" }; },
+      request() { return new Promise((resolve, reject) => pending.push({ resolve, reject })); } },
+  });
+  const first = service.executeCommand(`${pluginManifest.id}.hello`);
+  const second = service.executeCommand(`${pluginManifest.id}.hello`);
+  await new Promise((resolve) => setImmediate(resolve));
+  pending[0].resolve(null); await first;
+  assert.deepEqual(finished, []);
+  pending[1].reject(new Error("synthetic timeout"));
+  await assert.rejects(second, /synthetic timeout/);
+  assert.deepEqual(finished, ["runtime-concurrent"]);
+  assert.equal(service.activeCommandCalls.size, 0);
+});
+
 test("only onStartupFinished plugins activate during contribution initialization", async (context) => {
   const pluginManifest = manifest("com.example.startup", ["onStartupFinished"]);
   const { calls, service } = setup(context, pluginManifest);

electron/plugins/generated/plugin-contract.schema.json

@@ -231,6 +231,315 @@
       },
       "additionalProperties": false
     },
+    "HostInteractionLimits": {
+      "const": {
+        "textBytes": 4096,
+        "requestBytes": 65536,
+        "items": 100,
+        "pendingPerRuntime": 1,
+        "pendingTotal": 8,
+        "requestsPerMinute": 10,
+        "timeoutMs": 60000
+      }
+    },
+    "HostInteractionFeature": {
+      "const": "host.interactions"
+    },
+    "InteractiveCommandFeature": {
+      "const": "commands.interactive"
+    },
+    "InteractiveCommandLimits": {
+      "const": {
+        "timeoutMs": 180000
+      }
+    },
+    "HostQuickPickItem": {
+      "type": "object",
+      "required": [
+        "id",
+        "label"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 512
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostQuickPickRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title",
+        "items"
+      ],
+      "properties": {
+        "kind": {
+          "const": "quickPick"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "items": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 100,
+          "items": {
+            "$ref": "#/$defs/HostQuickPickItem"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostSingleLineInputText": {
+      "description": "Single-line host input. CR and LF are rejected before display and on submission; clipboard text remains multiline.",
+      "type": "string",
+      "maxLength": 4096,
+      "pattern": "^[^\\u0000\\r\\n]*$"
+    },
+    "HostInputRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title"
+      ],
+      "properties": {
+        "kind": {
+          "const": "input"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "initialValue": {
+          "$ref": "#/$defs/HostSingleLineInputText"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostClipboardReadRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title"
+      ],
+      "properties": {
+        "kind": {
+          "const": "clipboard.read"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostClipboardWriteRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title",
+        "text"
+      ],
+      "properties": {
+        "kind": {
+          "const": "clipboard.write"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "text": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionRequest": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/HostQuickPickRequest"
+        },
+        {
+          "$ref": "#/$defs/HostInputRequest"
+        },
+        {
+          "$ref": "#/$defs/HostClipboardReadRequest"
+        },
+        {
+          "$ref": "#/$defs/HostClipboardWriteRequest"
+        }
+      ]
+    },
+    "HostInteractionResult": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "cancelled"
+          ],
+          "properties": {
+            "cancelled": {
+              "const": true
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": [
+            "cancelled",
+            "value"
+          ],
+          "properties": {
+            "cancelled": {
+              "const": false
+            },
+            "value": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "maxLength": 4096,
+                  "pattern": "^[^\\u0000]*$"
+                },
+                {
+                  "const": true
+                }
+              ]
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "HostInteractionResponse": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "actionToken",
+        "action"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "actionToken": {
+          "type": "string",
+          "minLength": 32,
+          "maxLength": 256
+        },
+        "action": {
+          "enum": [
+            "cancel",
+            "preview",
+            "submit"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionClosed": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "closed"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "maxLength": 128
+        },
+        "closed": {
+          "const": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionEvent": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/HostInteractionPrompt"
+        },
+        {
+          "$ref": "#/$defs/HostInteractionClosed"
+        }
+      ]
+    },
+    "HostInteractionPrompt": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "actionToken",
+        "pluginId",
+        "pluginVersion",
+        "expiresAt",
+        "phase",
+        "request"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "maxLength": 128
+        },
+        "actionToken": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "pluginId": {
+          "$ref": "#/$defs/PluginId"
+        },
+        "pluginVersion": {
+          "$ref": "#/$defs/SemanticVersion"
+        },
+        "expiresAt": {
+          "$ref": "#/$defs/SafePositiveInteger"
+        },
+        "phase": {
+          "enum": [
+            "request",
+            "preview"
+          ]
+        },
+        "request": {
+          "$ref": "#/$defs/HostInteractionRequest"
+        },
+        "previewText": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
     "NetworkCredentialLeaseFeature": {
       "const": "network.credential-lease"
     },
@@ -398,6 +707,7 @@
         "commands",
         "menus",
         "views",
+        "ui.interact",
         "clipboard.read",
         "clipboard.write",
         "terminal.metadata",
@@ -435,6 +745,7 @@
         "commands",
         "menus",
         "views",
+        "ui.interact",
         "clipboard.read",
         "clipboard.write",
         "terminal.metadata",
@@ -871,6 +1182,11 @@
         },
         "enablement": {
           "$ref": "#/$defs/ContextKeyExpression"
+        },
+        "interactive": {
+          "type": "boolean",
+          "default": false,
+          "description": "Require commands.interactive for this command's fixed bounded host interaction budget. Does not grant UI or clipboard permissions."
         }
       },
       "additionalProperties": false

electron/plugins/hostInteractionExample.test.cjs

@@ -0,0 +1,117 @@
+"use strict";
+const assert = require("node:assert/strict");
+const { readFile } = require("node:fs/promises");
+const { EventEmitter } = require("node:events");
+const { pathToFileURL } = require("node:url");
+const test = require("node:test");
+const { MessageChannel } = require("node:worker_threads");
+const { PluginRpcRouter } = require("./rpcRouter.cjs");
+const { PluginHostRpcRegistry } = require("./hostRpcRegistry.cjs");
+const { PluginPermissionEngine } = require("./permissionEngine.cjs");
+const { PluginHostInteractionService } = require("./hostInteractionService.cjs");
+const { PluginContributionService } = require("./contributionService.cjs");
+
+for (const source of ["compose", "share"]) test(`normal browser example completes the ${source} text workflow through permission middleware`, async () => {
+  const { startPluginRuntime } = await import("./runtime/runtimePeer.mjs");
+  const plugin = await import("../../examples/plugins/host-interactions/browser.js");
+  const manifest = JSON.parse(await readFile(new URL("../../examples/plugins/host-interactions/netcatty.plugin.json", pathToFileURL(__filename)), "utf8"));
+  const audit = [], copied = [], requests = [];
+  let reads = 0, active = true;
+  const database = { listPermissionGrants: () => [], recordSecurityAudit(...args) { audit.push(args); } };
+  const permissionEngine = new PluginPermissionEngine({ database,
+    requestDecision: async (request) => { requests.push(request.permission); return { requestId: request.requestId, decision: "allow", scope: "once" }; },
+  });
+  let service;
+  const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false,
+    send(_channel, message) {
+      if (message.closed) return;
+      queueMicrotask(() => {
+        const action = message.request.kind === "clipboard.read" && message.phase === "request" ? "preview" : "submit";
+        const value = message.request.kind === "quickPick" ? source : message.request.kind === "input" ? "synthetic output" : undefined;
+        void service.respond(sender, { requestId: message.requestId, actionToken: message.actionToken, action, ...(value === undefined ? {} : { value }) }).catch(() => {});
+      });
+    },
+  });
+  const window = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  service = new PluginHostInteractionService({ database, permissionEngine, getWindow: () => window, isLocked: () => false,
+    quotaManager: { chargeBytes() {} },
+    clipboard: { readText() { reads++; return "synthetic private text"; }, writeText(text) { copied.push(text); } },
+  });
+  service.setReady(sender, true);
+  const registry = new PluginHostRpcRegistry();
+  registry.use(permissionEngine.createMiddleware()); service.registerRpcCapabilities(registry);
+  const routes = registry.createRoutes({ pluginId: manifest.id, pluginVersion: manifest.version, runtimeId: "runtime-synthetic", runtimeKind: "browser", manifest,
+    assertCurrent() { if (!active) throw new Error("stale runtime"); },
+  });
+  const { port1, port2 } = new MessageChannel();
+  const host = new PluginRpcRouter({ pluginId: manifest.id, send: (message) => port1.postMessage(message), handlers: routes.requestHandlers });
+  port1.on("message", (message) => { void host.accept(message); });
+  const peer = await startPluginRuntime({ port: port2,
+    config: { pluginId: manifest.id, pluginVersion: manifest.version, netcattyVersion: "0.0.0", apiVersion: "0.1.0-internal.1", enabledFeatures: ["host.interactions"] },
+    loadPlugin: async () => plugin,
+  });
+  try {
+    await host.request("plugin.initialize", { netcattyVersion: "0.0.0", apiVersion: "0.1.0-internal.1", supportedFeatures: ["host.interactions"] });
+    await host.request("plugin.activate", {});
+    const result = await host.request("plugin.command.execute", { command: "com.netcatty.host-interactions.text", invocation: { source: "palette" } });
+    const output = source === "compose" ? "synthetic output" : "SYNTHETIC PRIVATE TEXT";
+    assert.deepEqual(result, { copied: true, characters: output.length });
+    assert.deepEqual(copied, [output]); assert.equal(reads, source === "share" ? 1 : 0);
+    assert.ok(requests.includes("ui.interact")); assert.ok(requests.includes("clipboard.write"));
+    assert.equal(requests.includes("clipboard.read"), source === "share");
+    assert.equal(JSON.stringify(audit).includes("synthetic private text"), false);
+    assert.equal(JSON.stringify(audit).includes("synthetic output"), false);
+    assert.equal(service.pending.size, 0);
+  } finally { active = false; await peer.dispose(); host.close(); port1.close(); service.shutdown(); permissionEngine.shutdown(); }
+});
+
+test("outer command deadline closes its real browser clipboard confirmation and rejects late commit", async () => {
+  const { startPluginRuntime } = await import("./runtime/runtimePeer.mjs");
+  const plugin = await import("../../examples/plugins/host-interactions/browser.js");
+  const manifest = JSON.parse(await readFile(new URL("../../examples/plugins/host-interactions/netcatty.plugin.json", pathToFileURL(__filename)), "utf8"));
+  const identity = { pluginId: manifest.id, pluginVersion: manifest.version, runtimeId: "runtime-deadline", runtimeKind: "browser" };
+  const writes = [], messages = [];
+  const database = { listPermissionGrants: () => [], recordSecurityAudit() {},
+    listPlugins: () => [{ id: manifest.id, activeVersion: manifest.version, manifest, enabled: true, runtime: { status: "running" } }],
+  };
+  const engine = new PluginPermissionEngine({ database, requestDecision: async (request) => ({ requestId: request.requestId, decision: "allow", scope: "once" }) });
+  let service, confirm;
+  const copyPrompt = new Promise((resolve) => { confirm = resolve; });
+  const sender = Object.assign(new EventEmitter(), { id: 8, isDestroyed: () => false, send(_channel, message) {
+    messages.push(message); if (message.closed) return;
+    if (message.request.kind === "clipboard.write") { confirm(message); return; }
+    const value = message.request.kind === "quickPick" ? "compose" : "synthetic pending copy";
+    queueMicrotask(() => { void service.respond(sender, { requestId: message.requestId, actionToken: message.actionToken, action: "submit", value }).catch(() => {}); });
+  } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  service = new PluginHostInteractionService({ database, permissionEngine: engine, getWindow: () => owner, isLocked: () => false,
+    quotaManager: { chargeBytes() {} }, clipboard: { writeText(text) { writes.push(text); } } });
+  service.setReady(sender, true);
+  const registry = new PluginHostRpcRegistry(); registry.use(engine.createMiddleware()); service.registerRpcCapabilities(registry);
+  const routes = registry.createRoutes({ ...identity, manifest, assertCurrent() {} });
+  const { port1, port2 } = new MessageChannel();
+  const host = new PluginRpcRouter({ pluginId: manifest.id, send: (message) => port1.postMessage(message), handlers: routes.requestHandlers });
+  port1.on("message", (message) => { void host.accept(message); });
+  const features = manifest.features.required;
+  const peer = await startPluginRuntime({ port: port2, config: { ...identity, netcattyVersion: "0.0.0", apiVersion: "0.1.0-internal.1", enabledFeatures: features }, loadPlugin: async () => plugin });
+  try {
+    await host.request("plugin.initialize", { netcattyVersion: "0.0.0", apiVersion: "0.1.0-internal.1", supportedFeatures: features });
+    await host.request("plugin.activate", {});
+    const contributions = new PluginContributionService({ database, onCommandFinished: (runtimeId) => service.cancelRuntimeRequests(runtimeId),
+      runtimeSupervisor: { async start() { return identity; }, request(_pluginId, method, params, options) {
+        assert.equal(options.timeoutMs, 180_000, "host chooses the fixed declared budget");
+        return host.request(method, params, { timeoutMs: 500 }); // bounded synthetic timer, no production timeout change
+      } },
+    });
+    const command = contributions.executeCommand("com.netcatty.host-interactions.text");
+    const prompt = await Promise.race([copyPrompt, command.then(() => { throw new Error("command finished before confirmation"); })]);
+    const attempts = service.rates.get(identity.runtimeId).count;
+    await assert.rejects(command, /timed out/);
+    assert.equal(service.pending.size, 0);
+    assert.equal(service.rates.get(identity.runtimeId).count, attempts);
+    assert.ok(messages.some((message) => message.closed && message.requestId === prompt.requestId));
+    assert.equal(await service.respond(sender, { requestId: prompt.requestId, actionToken: prompt.actionToken, action: "submit" }), false);
+    assert.deepEqual(writes, []);
+    assert.equal(contributions.activeCommandCalls.size, 0);
+  } finally { await peer.dispose(); host.close(); port1.close(); service.shutdown(); engine.shutdown(); }
+});

electron/plugins/hostInteractionService.cjs

@@ -0,0 +1,339 @@
+"use strict";
+
+const { createHmac, randomBytes, randomUUID, timingSafeEqual } = require("node:crypto");
+const { createDefinitionValidator } = require("./contractValidator.cjs");
+const { PluginRpcError, RPC_ERRORS } = require("./rpcRouter.cjs");
+const schema = require("./generated/plugin-contract.schema.json");
+const LIMITS = schema.$defs.HostInteractionLimits.const;
+const HOST_INTERACTION_FEATURE = schema.$defs.HostInteractionFeature.const;
+const validateRequest = createDefinitionValidator("HostInteractionRequest");
+const validateResponse = createDefinitionValidator("HostInteractionResponse");
+const validateResult = createDefinitionValidator("HostInteractionResult");
+const validateSingleLineInput = createDefinitionValidator("HostSingleLineInputText");
+const PROMPT_CHANNEL = "netcatty:plugins:host-interaction";
+
+function fail(code, message) { return new PluginRpcError(RPC_ERRORS[code], message); }
+function assertTextBytes(text) {
+  if (typeof text !== "string" || Buffer.byteLength(text, "utf8") > LIMITS.textBytes || text.includes("\0")) {
+    throw fail("resourceExhausted", "Host interaction text exceeds its limit");
+  }
+  return text;
+}
+function assertInteractionRequest(params) {
+  if (!validateRequest(params)) throw fail("invalidArgument", "Host interaction request is invalid");
+  if (Buffer.byteLength(JSON.stringify(params)) > LIMITS.requestBytes) {
+    throw fail("resourceExhausted", "Host interaction request exceeds its limit");
+  }
+  if (params.kind === "input") assertTextBytes(params.initialValue ?? "");
+  if (params.kind === "clipboard.write") assertTextBytes(params.text);
+  if (params.kind === "quickPick" && new Set(params.items.map((item) => item.id)).size !== params.items.length) {
+    throw fail("invalidArgument", "Host interaction choice IDs must be unique");
+  }
+  return Object.freeze(structuredClone(params));
+}
+function interactionAuthorization(params) {
+  const permission = params.kind === "clipboard.read" ? "clipboard.read"
+    : params.kind === "clipboard.write" ? "clipboard.write" : "ui.interact";
+  return {
+    permission,
+    resources: [permission.startsWith("clipboard.") ? "clipboard:text" : "*"],
+    reason: permission.startsWith("clipboard.") ? "Explicitly share or replace clipboard text" : "Show a host input or choice dialog",
+    operationId: `ui:${params.kind}`,
+    ...(permission.startsWith("clipboard.") ? { allowedScopes: ["once"] } : {}),
+  };
+}
+
+class PluginHostInteractionService {
+  constructor(options) {
+    this.database = options.database;
+    this.permissionEngine = options.permissionEngine;
+    this.quotaManager = options.quotaManager;
+    this.clipboard = options.clipboard;
+    this.getWindow = options.getWindow ?? (() => null);
+    this.isLocked = options.isLocked ?? (() => true);
+    this.clock = options.clock ?? Date.now;
+    this.timeoutMs = Math.min(options.timeoutMs ?? LIMITS.timeoutMs, LIMITS.timeoutMs);
+    this.key = randomBytes(32);
+    this.pending = new Map();
+    this.rates = new Map();
+    this.admissions = new WeakMap();
+    this.admissionGuards = new Map();
+    this.admissionRevision = 0;
+    this.focusRestoreMs = Math.min(options.focusRestoreMs ?? 1_000, 1_000);
+    this.owner = null;
+    this.ownerCleanup = null;
+    this.closed = false;
+    this.revocation = this.permissionEngine.onDidRevoke((event) => this.releasePlugin(event.pluginId));
+    this.unsubscribeLock = options.subscribeLock?.((state) => { if (state.locked) this.cancelAll(); });
+  }
+
+  registerRpcCapabilities(registry) {
+    registry.registerRequest("ui.interact", (params, context) => this.request(params, context), {
+      metadata: { capability: "ui", mutating: true },
+      validateParams: assertInteractionRequest,
+      authorization: (params, context) => {
+        const sender = this.#admit(params, context);
+        let guard = this.admissionGuards.get(context.runtimeId);
+        if (!guard) { guard = { active: true }; this.admissionGuards.set(context.runtimeId, guard); }
+        this.admissions.set(params, { sender, runtimeId: context.runtimeId, revision: this.admissionRevision, guard });
+        return interactionAuthorization(params);
+      },
+    });
+  }
+
+  setReady(sender, ready) {
+    const window = this.getWindow();
+    if (!sender || window?.webContents !== sender || sender.isDestroyed?.()) {
+      throw fail("permissionDenied", "Host interaction window is not the owner");
+    }
+    if (typeof ready !== "boolean") throw fail("invalidArgument", "Host interaction readiness is invalid");
+    if (!ready) { this.releaseWindow(sender); return true; }
+    if (this.closed) throw fail("unavailable", "Host interactions are unavailable");
+    if (this.owner === sender) return true;
+    if (this.owner) this.releaseWindow(this.owner);
+    this.owner = sender;
+    const close = () => this.releaseWindow(sender);
+    // A native permission dialog can temporarily blur its parent. Already
+    // displayed interactions still cancel immediately; pre-prompt admission
+    // can only resume once this same owner actually regains focus.
+    const blur = () => this.cancelAll(false);
+    const hide = () => this.cancelAll();
+    const navigate = (details, _url, isInPlace, isMainFrame) => {
+      const main = details?.isMainFrame ?? isMainFrame;
+      const sameDocument = details?.isSameDocument ?? isInPlace;
+      if (main !== false && sameDocument !== true) close();
+    };
+    sender.once?.("destroyed", close);
+    sender.on?.("did-start-navigation", navigate);
+    sender.on?.("render-process-gone", close);
+    window.on?.("blur", blur);
+    window.on?.("hide", hide);
+    this.ownerCleanup = () => {
+      sender.removeListener?.("destroyed", close);
+      sender.removeListener?.("did-start-navigation", navigate);
+      sender.removeListener?.("render-process-gone", close);
+      window.removeListener?.("blur", blur);
+      window.removeListener?.("hide", hide);
+    };
+    return true;
+  }
+
+  #assertWindow(sender = this.owner) {
+    const window = this.getWindow();
+    if (this.closed || this.isLocked() || !sender || sender !== this.owner
+      || window?.webContents !== sender || window.isDestroyed?.()
+      || sender.isDestroyed?.() || window.isVisible?.() === false || window.isFocused?.() !== true) {
+      throw fail("unavailable", "Host interactions require the focused unlocked main window");
+    }
+    return sender;
+  }
+
+  #token(entry) {
+    const nonce = randomBytes(24).toString("base64url");
+    const binding = JSON.stringify([
+      nonce, entry.id, entry.context.pluginId, entry.context.pluginVersion,
+      entry.context.runtimeId, entry.sender.id, entry.params.kind, entry.phase, entry.expiresAt,
+    ]);
+    return `${nonce}.${createHmac("sha256", this.key).update(binding).digest("base64url")}`;
+  }
+
+  #present(entry) {
+    entry.actionToken = this.#token(entry);
+    entry.sender.send(PROMPT_CHANNEL, {
+      requestId: entry.id, actionToken: entry.actionToken,
+      pluginId: entry.context.pluginId, pluginVersion: entry.context.pluginVersion,
+      expiresAt: entry.expiresAt, phase: entry.phase, request: entry.params,
+      ...(entry.previewText === undefined ? {} : { previewText: entry.previewText }),
+    });
+  }
+
+  #finish(entry, result, error) {
+    if (this.pending.get(entry.id) !== entry) return false;
+    this.pending.delete(entry.id);
+    entry.actionToken = null;
+    entry.previewText = undefined;
+    clearTimeout(entry.timer);
+    entry.context.signal?.removeEventListener("abort", entry.onAbort);
+    try { entry.sender.send(PROMPT_CHANNEL, { requestId: entry.id, closed: true }); } catch {}
+    if (error) entry.reject(error);
+    else if (!validateResult(result)) entry.reject(fail("internal", "Host interaction result is invalid"));
+    else entry.resolve(result);
+    return true;
+  }
+
+  #audit(entry, action) {
+    // Fixed metadata only. Never record title, choices, user input, clipboard
+    // bytes, action token or a hash derived from user content.
+    try {
+      this.database.recordSecurityAudit(entry.context.pluginId, "ui.interaction", { kind: entry.params.kind, action });
+    } catch {
+      throw fail("unavailable", "Host interaction audit is unavailable");
+    }
+  }
+
+  #admit(params, context) {
+    const sender = this.#assertWindow();
+    if ((params.kind === "clipboard.read" && typeof this.clipboard?.readText !== "function")
+      || (params.kind === "clipboard.write" && typeof this.clipboard?.writeText !== "function")) {
+      throw fail("unavailable", "Host clipboard text is unavailable");
+    }
+    const now = this.clock();
+    const rate = this.rates.get(context.runtimeId);
+    const nextRate = !rate || now - rate.startedAt >= 60_000 ? { startedAt: now, count: 0 } : rate;
+    if (nextRate.count >= LIMITS.requestsPerMinute || this.pending.size >= LIMITS.pendingTotal
+      || [...this.pending.values()].some((entry) => entry.context.runtimeId === context.runtimeId || entry.sender === sender)) {
+      throw fail("resourceExhausted", "Host interaction limit reached");
+    }
+    nextRate.count++;
+    this.rates.set(context.runtimeId, nextRate);
+    this.quotaManager.chargeBytes(context.runtimeId, "ui", Buffer.byteLength(JSON.stringify(params)));
+    return sender;
+  }
+
+  async request(params, context) {
+    await context.assertActive();
+    const admission = this.admissions.get(params);
+    this.admissions.delete(params);
+    let sender;
+    if (admission?.runtimeId === context.runtimeId) {
+      // Electron may resolve showMessageBox before restoring parent focus.
+      // Never focus it ourselves or defer an originally background request.
+      // Owner replacement, lock, hide, revoke and runtime stop invalidate this
+      // host-owned admission, including changes during the permission prompt.
+      const deadline = Date.now() + this.focusRestoreMs;
+      for (;;) {
+        context.signal?.throwIfAborted();
+        if (!admission.guard.active || admission.revision !== this.admissionRevision || admission.sender !== this.owner) {
+          throw fail("cancelled", "Host interaction admission was revoked");
+        }
+        const window = this.getWindow();
+        if (this.closed || this.isLocked() || window?.webContents !== admission.sender
+          || window.isDestroyed?.() || admission.sender.isDestroyed?.() || window.isVisible?.() === false) {
+          throw fail("unavailable", "Host interaction owner is unavailable");
+        }
+        if (window.isFocused?.() === true) break;
+        if (Date.now() >= deadline) throw fail("unavailable", "Host interactions require the focused unlocked main window");
+        await new Promise((resolve) => setTimeout(resolve, Math.min(20, Math.max(1, deadline - Date.now()))));
+      }
+      await context.assertActive();
+      if (!admission.guard.active || admission.revision !== this.admissionRevision) throw fail("cancelled", "Host interaction admission was revoked");
+      sender = this.#assertWindow(admission.sender);
+    } else sender = this.#admit(params, context);
+    if (this.pending.size >= LIMITS.pendingTotal || [...this.pending.values()].some((entry) => entry.context.runtimeId === context.runtimeId || entry.sender === sender)) {
+      throw fail("resourceExhausted", "Host interaction limit reached");
+    }
+    const now = this.clock();
+    return new Promise((resolve, reject) => {
+      const entry = {
+        id: randomUUID(), context, params, sender, resolve, reject,
+        expiresAt: now + this.timeoutMs, phase: "request", actionToken: null,
+      };
+      entry.onAbort = () => this.#finish(entry, null, fail("cancelled", "Host interaction was cancelled"));
+      entry.timer = setTimeout(() => this.#finish(entry, null, fail("deadlineExceeded", "Host interaction expired")), this.timeoutMs);
+      entry.timer.unref?.();
+      this.pending.set(entry.id, entry);
+      context.signal?.addEventListener("abort", entry.onAbort, { once: true });
+      if (context.signal?.aborted) { entry.onAbort(); return; }
+      try { this.#present(entry); }
+      catch { this.#finish(entry, null, fail("unavailable", "Host interaction window is unavailable")); }
+    });
+  }
+
+  async respond(sender, response) {
+    this.#assertWindow(sender);
+    if (!validateResponse(response)) throw fail("invalidArgument", "Host interaction response is invalid");
+    const entry = this.pending.get(response.requestId);
+    if (!entry || entry.sender !== sender || !entry.actionToken || this.clock() >= entry.expiresAt) return false;
+    const expected = Buffer.from(entry.actionToken);
+    const supplied = Buffer.from(response.actionToken);
+    if (expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) return false;
+    // Consume before the first asynchronous boundary. Duplicate and old-phase
+    // replies cannot race the same native action.
+    entry.actionToken = null;
+    try {
+      await entry.context.assertActive();
+      this.#assertWindow(sender);
+      if (this.pending.get(entry.id) !== entry) return false;
+      if (response.action === "cancel") {
+        this.#audit(entry, "cancelled");
+        return this.#finish(entry, { cancelled: true });
+      }
+      if (entry.params.kind === "clipboard.read" && entry.phase === "request") {
+        if (response.action !== "preview") throw fail("invalidArgument", "Clipboard sharing requires a preview action");
+        this.#audit(entry, "preview-confirmed");
+        let rawText;
+        try { rawText = this.clipboard.readText(); }
+        catch { throw fail("unavailable", "Host clipboard text is unavailable"); }
+        const text = assertTextBytes(rawText);
+        this.quotaManager.chargeBytes(entry.context.runtimeId, "clipboard", Buffer.byteLength(text));
+        entry.previewText = text;
+        entry.phase = "preview";
+        try { this.#present(entry); }
+        catch { throw fail("unavailable", "Host interaction window is unavailable"); }
+        return true;
+      }
+      if (response.action !== "submit") throw fail("invalidArgument", "Host interaction action is invalid");
+      let value;
+      if (entry.params.kind === "input") {
+        if (!validateSingleLineInput(response.value)) throw fail("invalidArgument", "Host input must be a single line");
+        value = assertTextBytes(response.value);
+      }
+      else if (entry.params.kind === "quickPick") {
+        if (!entry.params.items.some((item) => item.id === response.value)) throw fail("invalidArgument", "Host interaction choice is invalid");
+        value = response.value;
+      } else if (entry.params.kind === "clipboard.read") value = entry.previewText;
+      else value = true;
+      this.#audit(entry, entry.params.kind === "clipboard.write" ? "copy-confirmed" : "share-confirmed");
+      if (entry.params.kind === "clipboard.write") {
+        try { this.clipboard.writeText(entry.params.text); }
+        catch { throw fail("unavailable", "Host clipboard write failed"); }
+      }
+      return this.#finish(entry, { cancelled: false, value });
+    } catch (error) {
+      this.#finish(entry, null, error);
+      throw error;
+    }
+  }
+
+  releaseWindow(sender) {
+    if (this.owner !== sender) return;
+    this.admissionRevision++;
+    this.owner = null;
+    this.ownerCleanup?.(); this.ownerCleanup = null;
+    for (const entry of [...this.pending.values()]) {
+      if (entry.sender === sender) this.#finish(entry, null, fail("cancelled", "Host interaction window closed"));
+    }
+  }
+  releasePlugin(pluginId) {
+    this.admissionRevision++;
+    for (const entry of [...this.pending.values()]) {
+      if (entry.context.pluginId === pluginId) this.#finish(entry, null, fail("cancelled", "Plugin access was revoked"));
+    }
+  }
+  releaseRuntime(runtimeId) {
+    this.cancelRuntimeRequests(runtimeId, "Plugin runtime stopped");
+    this.rates.delete(runtimeId);
+  }
+  cancelRuntimeRequests(runtimeId, reason = "Host command finished") {
+    const guard = this.admissionGuards.get(runtimeId);
+    if (guard) guard.active = false;
+    this.admissionGuards.delete(runtimeId);
+    for (const entry of [...this.pending.values()]) {
+      if (entry.context.runtimeId === runtimeId) this.#finish(entry, null, fail("cancelled", reason));
+    }
+  }
+  cancelAll(invalidateAdmission = true) {
+    if (invalidateAdmission) this.admissionRevision++;
+    for (const entry of [...this.pending.values()]) this.#finish(entry, null, fail("cancelled", "Host interaction was cancelled"));
+  }
+  shutdown() {
+    if (this.closed) return;
+    this.closed = true;
+    if (this.owner) this.releaseWindow(this.owner);
+    this.cancelAll(); this.rates.clear(); this.admissionGuards.clear();
+    this.revocation.dispose(); this.unsubscribeLock?.();
+    this.key.fill(0);
+  }
+}
+
+module.exports = { HOST_INTERACTION_FEATURE, LIMITS, PROMPT_CHANNEL, PluginHostInteractionService, assertInteractionRequest, interactionAuthorization };

electron/plugins/hostInteractionService.test.cjs

@@ -0,0 +1,301 @@
+"use strict";
+const assert = require("node:assert/strict");
+const { EventEmitter } = require("node:events");
+const test = require("node:test");
+const { PluginHostInteractionService, assertInteractionRequest, interactionAuthorization, PROMPT_CHANNEL } = require("./hostInteractionService.cjs");
+
+function fixture(t, options = {}) {
+  const messages = [], audit = [], writes = [], charges = [];
+  let reads = 0, locked = false, focused = true, active = true;
+  const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false, send: (channel, message) => { assert.equal(channel, PROMPT_CHANNEL); messages.push(message); } });
+  const window = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => focused, isVisible: () => true, isDestroyed: () => false });
+  const signal = new AbortController();
+  let onRevoke;
+  const service = new PluginHostInteractionService({
+    getWindow: () => window, isLocked: () => locked,
+    permissionEngine: { onDidRevoke(fn) { onRevoke = fn; return { dispose() {} }; } },
+    database: { recordSecurityAudit(...args) { audit.push(args); } },
+    quotaManager: { chargeBytes(...args) { charges.push(args); } },
+    clipboard: { readText() { reads++; return "synthetic clipboard"; }, writeText(text) { writes.push(text); } },
+    ...options,
+  });
+  service.setReady(sender, true);
+  t.after(() => service.shutdown());
+  const context = {
+    pluginId: "com.example.synthetic", pluginVersion: "1.0.0", runtimeId: "runtime-synthetic", signal: signal.signal,
+    async assertActive() { signal.signal.throwIfAborted(); if (!active) throw new Error("stale runtime"); },
+  };
+  const begin = async (params) => {
+    const promise = service.request(assertInteractionRequest(params), context);
+    void promise.catch(() => {});
+    await new Promise((resolve) => setImmediate(resolve));
+    return { promise, prompt: messages.filter((message) => !message.closed).at(-1) };
+  };
+  const respond = (prompt, action, value) => service.respond(sender, { requestId: prompt.requestId, actionToken: prompt.actionToken, action, ...(value === undefined ? {} : { value }) });
+  return { service, sender, window, context, messages, audit, writes, charges, begin, respond, signal,
+    get reads() { return reads; }, revoke() { onRevoke({ pluginId: context.pluginId }); },
+    lock() { locked = true; }, blur() { focused = false; window.emit("blur"); }, focus() { focused = true; window.emit("focus"); }, stale() { active = false; },
+  };
+}
+
+test("normal input and quick pick return only an approved bounded value", async (t) => {
+  const f = fixture(t);
+  const input = await f.begin({ kind: "input", title: "Synthetic input", initialValue: "draft" });
+  assert.equal(await f.respond(input.prompt, "submit", "approved"), true);
+  assert.deepEqual(await input.promise, { cancelled: false, value: "approved" });
+  const choice = await f.begin({ kind: "quickPick", title: "Pick", items: [{ id: "one", label: "One" }] });
+  assert.equal(await f.respond(choice.prompt, "submit", "one"), true);
+  assert.deepEqual(await choice.promise, { cancelled: false, value: "one" });
+  assert.equal(JSON.stringify(f.audit).includes("approved"), false);
+  assert.equal(f.reads, 0); assert.deepEqual(f.writes, []);
+});
+
+test("ending a host command cancels pending native actions without resetting its quota", async (t) => {
+  const f = fixture(t);
+  const request = await f.begin({ kind: "clipboard.write", title: "Synthetic", text: "must not copy" });
+  const count = f.service.rates.get(f.context.runtimeId).count;
+  f.service.cancelRuntimeRequests(f.context.runtimeId);
+  await assert.rejects(request.promise, /command finished/);
+  assert.equal(await f.respond(request.prompt, "submit"), false);
+  assert.deepEqual(f.writes, []);
+  assert.equal(f.service.rates.get(f.context.runtimeId).count, count);
+});
+
+test("old command completion cannot invalidate a replacement runtime's host-owned admission", async (t) => {
+  const f = fixture(t);
+  let authorize;
+  f.service.registerRpcCapabilities({ registerRequest(_name, _handler, options) { authorize = options.authorization; } });
+  const old = assertInteractionRequest({ kind: "input", title: "Old" });
+  authorize(old, f.context);
+  f.service.cancelRuntimeRequests(f.context.runtimeId);
+  await assert.rejects(f.service.request(old, f.context), /revoked/);
+  const nextContext = { ...f.context, runtimeId: "runtime-replacement" };
+  const next = assertInteractionRequest({ kind: "input", title: "New" });
+  authorize(next, nextContext);
+  f.service.cancelRuntimeRequests(f.context.runtimeId);
+  const request = f.service.request(next, nextContext);
+  await new Promise((resolve) => setImmediate(resolve));
+  const prompt = f.messages.find((message) => !message.closed);
+  assert.ok(prompt);
+  await f.respond(prompt, "submit", "synthetic new input");
+  assert.deepEqual(await request, { cancelled: false, value: "synthetic new input" });
+});
+
+test("Once permission dialog may restore the same owner's focus after its decision resolves", async (t) => {
+  const { PluginHostRpcRegistry } = require("./hostRpcRegistry.cjs");
+  const { PluginPermissionEngine } = require("./permissionEngine.cjs");
+  const f = fixture(t);
+  let decisions = 0;
+  const engine = new PluginPermissionEngine({
+    database: { listPermissionGrants: () => [], recordSecurityAudit() {} },
+    requestDecision: async (request) => {
+      decisions++;
+      f.blur();
+      setTimeout(() => f.focus(), 30);
+      return { requestId: request.requestId, decision: "allow", scope: "once" };
+    },
+  });
+  t.after(() => engine.shutdown());
+  const registry = new PluginHostRpcRegistry();
+  registry.use(engine.createMiddleware());
+  f.service.registerRpcCapabilities(registry);
+  const route = registry.createRoutes({ ...f.context, runtimeKind: "browser", assertCurrent() {},
+    manifest: { id: f.context.pluginId, publisher: "example", permissions: { optional: ["ui.interact"] } },
+  }).requestHandlers["ui.interact"];
+  const result = route({ kind: "input", title: "Synthetic input", initialValue: "visible" }, { signal: f.context.signal });
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  assert.equal(f.messages.length, 0, "no dialog is delivered while the owner is backgrounded");
+  await new Promise((resolve) => setTimeout(resolve, 45));
+  const prompt = f.messages.find((message) => !message.closed);
+  assert.ok(prompt);
+  await f.respond(prompt, "submit", "visible");
+  assert.deepEqual(await result, { cancelled: false, value: "visible" });
+  assert.equal(decisions, 1);
+  assert.equal(f.reads, 0); assert.deepEqual(f.writes, []);
+});
+
+test("focus restoration is bounded and admission cannot survive owner or access lifecycle changes", async (t) => {
+  for (const action of ["timeout", "hide", "revoke", "runtime", "window", "lock", "signal", "stale"]) {
+    const f = fixture(t, { focusRestoreMs: 35 });
+    let authorize;
+    f.service.registerRpcCapabilities({ registerRequest(_name, _handler, options) { authorize = options.authorization; } });
+    const params = assertInteractionRequest({ kind: "clipboard.write", title: "Never copied", text: "synthetic" });
+    authorize(params, f.context); // admission is host-owned and originally foregrounded
+    f.blur();
+    const result = f.service.request(params, f.context);
+    void result.catch(() => {});
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    if (action === "hide") f.window.emit("hide");
+    if (action === "revoke") f.revoke();
+    if (action === "runtime") f.service.releaseRuntime(f.context.runtimeId);
+    if (action === "window") { f.sender.emit("did-start-navigation", { isMainFrame: true, isSameDocument: false }); f.service.setReady(f.sender, true); }
+    if (action === "lock") f.lock();
+    if (action === "signal") f.signal.abort();
+    if (action === "stale") f.stale();
+    if (action !== "timeout") f.focus();
+    await assert.rejects(result, /focused unlocked|revoked|unavailable|abort|stale/i, action);
+    assert.equal(f.messages.length, 0, action);
+    assert.deepEqual(f.writes, []); assert.equal(f.reads, 0);
+  }
+  const background = fixture(t);
+  background.blur();
+  await assert.rejects(background.service.request(assertInteractionRequest({ kind: "input", title: "Background" }), background.context), /focused unlocked/);
+});
+
+test("clipboard read waits for preview action and a separate single-use sharing confirmation", async (t) => {
+  const f = fixture(t);
+  const request = await f.begin({ kind: "clipboard.read", title: "Share text" });
+  let done = false; void request.promise.then(() => { done = true; });
+  assert.equal(f.reads, 0);
+  await f.respond(request.prompt, "preview");
+  const preview = f.messages.filter((message) => !message.closed).at(-1);
+  assert.equal(preview.phase, "preview"); assert.equal(preview.previewText, "synthetic clipboard");
+  assert.notEqual(preview.actionToken, request.prompt.actionToken);
+  assert.equal(f.reads, 1); assert.equal(done, false);
+  assert.equal(await f.respond(request.prompt, "submit"), false, "old-phase action cannot share text");
+  assert.equal(await f.respond(preview, "submit"), true);
+  assert.deepEqual(await request.promise, { cancelled: false, value: "synthetic clipboard" });
+  assert.equal(await f.respond(preview, "submit"), false, "no replay");
+  assert.equal(f.reads, 1); assert.equal(JSON.stringify(f.audit).includes("synthetic clipboard"), false);
+});
+
+test("clipboard copy is explicit and duplicate replies write once", async (t) => {
+  const f = fixture(t);
+  const request = await f.begin({ kind: "clipboard.write", title: "Copy", text: "synthetic output" });
+  assert.deepEqual(f.writes, []);
+  const first = f.respond(request.prompt, "submit");
+  assert.equal(await f.respond(request.prompt, "submit"), false);
+  assert.equal(await first, true);
+  assert.deepEqual(await request.promise, { cancelled: false, value: true });
+  assert.deepEqual(f.writes, ["synthetic output"]);
+});
+
+test("cancel, blur, revoke, runtime release, and incoming cancellation revoke pending action tokens", async (t) => {
+  for (const action of ["cancel", "blur", "revoke", "runtime", "signal", "window"]) {
+    const f = fixture(t);
+    const request = await f.begin({ kind: "clipboard.write", title: "Copy", text: "never written" });
+    if (action === "cancel") { await f.respond(request.prompt, "cancel"); assert.deepEqual(await request.promise, { cancelled: true }); }
+    else {
+      if (action === "blur") f.blur();
+      if (action === "revoke") f.revoke();
+      if (action === "runtime") f.service.releaseRuntime(f.context.runtimeId);
+      if (action === "signal") f.signal.abort();
+      if (action === "window") f.sender.emit("destroyed");
+      await assert.rejects(request.promise, /cancelled|revoked|stopped|closed/);
+    }
+    assert.deepEqual(f.writes, []);
+    assert.equal(f.service.pending.size, 0);
+  }
+});
+
+test("wrong windows, forged tokens and stale runtimes cannot commit a native action", async (t) => {
+  const f = fixture(t);
+  const request = await f.begin({ kind: "clipboard.write", title: "Copy", text: "never written" });
+  await assert.rejects(f.service.respond({ id: 9 }, { requestId: request.prompt.requestId, actionToken: request.prompt.actionToken, action: "submit" }), /focused unlocked/);
+  assert.equal(await f.respond({ ...request.prompt, actionToken: "x".repeat(64) }, "submit"), false);
+  f.stale();
+  await assert.rejects(f.respond(request.prompt, "submit"), /stale runtime/);
+  await assert.rejects(request.promise, /stale runtime/);
+  assert.deepEqual(f.writes, []);
+});
+
+test("quota, deadline, locked host, unknown fields, duplicate choices and text bounds fail closed", async (t) => {
+  const f = fixture(t, { timeoutMs: 20 });
+  const request = await f.begin({ kind: "input", title: "Input" });
+  await assert.rejects(f.service.request(assertInteractionRequest({ kind: "input", title: "Another" }), f.context), /limit/);
+  const keepAlive = setTimeout(() => {}, 100);
+  await assert.rejects(request.promise, /expired/); clearTimeout(keepAlive);
+  f.lock();
+  await assert.rejects(f.service.request(assertInteractionRequest({ kind: "input", title: "Locked" }), f.context), /focused unlocked/);
+  assert.throws(() => assertInteractionRequest({ kind: "clipboard.read", title: "Forged", userGesture: true }), /invalid/);
+  assert.throws(() => assertInteractionRequest({ kind: "quickPick", title: "Duplicate", items: [{ id: "same", label: "A" }, { id: "same", label: "B" }] }), /unique/);
+  assert.throws(() => assertInteractionRequest({ kind: "clipboard.write", title: "Too long", text: "文".repeat(1500) }), /limit/);
+  assert.equal(interactionAuthorization({ kind: "clipboard.read" }).permission, "clipboard.read");
+  assert.equal(interactionAuthorization({ kind: "clipboard.write" }).permission, "clipboard.write");
+  assert.equal(interactionAuthorization({ kind: "input" }).permission, "ui.interact");
+});
+
+test("manifest permission checks and interaction quota run before any host prompt", async (t) => {
+  const { PluginHostRpcRegistry } = require("./hostRpcRegistry.cjs");
+  const { PluginPermissionEngine } = require("./permissionEngine.cjs");
+  const f = fixture(t);
+  let decisions = 0;
+  const engine = new PluginPermissionEngine({
+    database: { listPermissionGrants: () => [], recordSecurityAudit() {} },
+    requestDecision: async (request) => { decisions++; return { requestId: request.requestId, decision: "deny" }; },
+  });
+  t.after(() => engine.shutdown());
+  const registry = new PluginHostRpcRegistry();
+  registry.use(engine.createMiddleware());
+  f.service.registerRpcCapabilities(registry);
+  const base = { ...f.context, runtimeKind: "browser", manifest: { id: f.context.pluginId, publisher: "example", permissions: {} }, assertCurrent() {} };
+  const denied = registry.createRoutes(base).requestHandlers["ui.interact"];
+  await assert.rejects(denied({ kind: "input", title: "Undeclared" }, { signal: f.context.signal }), /declare/);
+  assert.equal(decisions, 0); assert.equal(f.messages.length, 0);
+  const route = registry.createRoutes({ ...base, manifest: { ...base.manifest, permissions: { optional: ["ui.interact"] } } }).requestHandlers["ui.interact"];
+  for (let count = 1; count < 10; count++) {
+    await assert.rejects(route({ kind: "input", title: "Denied" }, { signal: f.context.signal }), /denied/);
+  }
+  const before = decisions;
+  await assert.rejects(route({ kind: "input", title: "Over quota" }, { signal: f.context.signal }), /limit/);
+  assert.equal(decisions, before, "over-quota work cannot open another permission prompt");
+  assert.equal(f.messages.length, 0);
+});
+
+test("revoke during an asynchronous active guard and audit failure cannot write clipboard", async (t) => {
+  const f = fixture(t);
+  const request = await f.begin({ kind: "clipboard.write", title: "Copy", text: "never copied" });
+  let resume;
+  f.context.assertActive = () => new Promise((resolve) => { resume = resolve; });
+  const reply = f.respond(request.prompt, "submit");
+  f.revoke();
+  resume();
+  assert.equal(await reply, false);
+  await assert.rejects(request.promise, /revoked/);
+  assert.deepEqual(f.writes, []);
+  const g = fixture(t, { database: { recordSecurityAudit() { throw new Error("synthetic audit failure"); } } });
+  const failed = await g.begin({ kind: "clipboard.write", title: "Copy", text: "never copied" });
+  await assert.rejects(g.respond(failed.prompt, "submit"), /audit is unavailable/);
+  await assert.rejects(failed.promise, /audit is unavailable/);
+  assert.deepEqual(g.writes, []);
+});
+
+test("same-document navigation keeps ownership, while document reload and renderer exit cancel it", async (t) => {
+  for (const event of ["reload", "renderer"]) {
+    const f = fixture(t);
+    const request = await f.begin({ kind: "clipboard.read", title: "Share" });
+    f.sender.emit("did-start-navigation", { isMainFrame: false, isSameDocument: false });
+    f.sender.emit("did-start-navigation", { isMainFrame: true, isSameDocument: true });
+    assert.equal(f.service.pending.size, 1);
+    if (event === "reload") f.sender.emit("did-start-navigation", { isMainFrame: true, isSameDocument: false });
+    else f.sender.emit("render-process-gone");
+    await assert.rejects(request.promise, /window closed/);
+    assert.equal(f.reads, 0); assert.equal(f.service.owner, null);
+  }
+});
+
+test("host lock subscription cancels previewed text before it can be shared", async (t) => {
+  let changed;
+  const f = fixture(t, { subscribeLock(listener) { changed = listener; return () => {}; } });
+  const request = await f.begin({ kind: "clipboard.read", title: "Share" });
+  await f.respond(request.prompt, "preview");
+  const preview = f.messages.filter((message) => !message.closed).at(-1);
+  changed({ locked: true });
+  await assert.rejects(request.promise, /cancelled/);
+  assert.equal(await f.respond(preview, "submit"), false);
+  assert.equal(f.reads, 1); assert.equal(f.service.pending.size, 0);
+});
+
+test("single-line inputs reject CR/LF before display and submission while clipboard text stays multiline", async (t) => {
+  const f = fixture(t);
+  for (const text of ["first\nsecond", "first\rsecond", "first\r\nsecond"]) {
+    assert.throws(() => assertInteractionRequest({ kind: "input", title: "Single line", initialValue: text }), /invalid/);
+    const request = await f.begin({ kind: "input", title: "Single line", initialValue: "first second" });
+    await assert.rejects(f.respond(request.prompt, "submit", text), /single line/);
+    await assert.rejects(request.promise, /single line/);
+  }
+  const copy = await f.begin({ kind: "clipboard.write", title: "Multiline clipboard", text: "first\nsecond" });
+  await f.respond(copy.prompt, "submit");
+  assert.deepEqual(await copy.promise, { cancelled: false, value: true });
+  assert.deepEqual(f.writes, ["first\nsecond"]);
+});

electron/plugins/hostService.cjs

@@ -2,6 +2,7 @@
 
 const path = require("node:path");
 const NETWORK_CREDENTIAL_LEASE_FEATURE = require("./generated/plugin-contract.schema.json").$defs.NetworkCredentialLeaseFeature.const;
+const INTERACTIVE_COMMAND_FEATURE = require("./generated/plugin-contract.schema.json").$defs.InteractiveCommandFeature.const;
 
 const { assertBrowserOnlyPlugin } = require("../../domain/pluginRuntimePolicy.cjs");
 const { isPluginDevelopmentEnabled, PLUGIN_API_VERSION } = require("./constants.cjs");
@@ -23,6 +24,7 @@ const { PackageStore } = require("./packageStore.cjs");
 const { createPluginPaths } = require("./paths.cjs");
 const { PluginManager } = require("./pluginManager.cjs");
 const { PluginNetworkBroker } = require("./networkBroker.cjs");
+const { HOST_INTERACTION_FEATURE, PluginHostInteractionService } = require("./hostInteractionService.cjs");
 const { PluginPermissionEngine } = require("./permissionEngine.cjs");
 const { PluginProtocol } = require("./pluginProtocol.cjs");
 const { PluginViewHost } = require("./pluginViewHost.cjs");
@@ -86,6 +88,7 @@ function createPluginHostService(options) {
   const appRoot = options.appRoot ?? options.app.getAppPath();
   const runtimeDirectory = options.runtimeDirectory ?? path.join(__dirname, "runtime");
   const database = new PluginDatabase(paths.database);
+  let interactionService;
   try {
     const packageStore = new PackageStore({
       allowAdvancedPlugins,
@@ -93,7 +96,7 @@ function createPluginHostService(options) {
       database,
       netcattyVersion: options.app.getVersion(),
       apiVersion: PLUGIN_API_VERSION,
-      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, ...(options.supportedFeatures ?? [])])],
+      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
     });
     const contributionIconService = new PluginContributionIconService({
       database,
@@ -165,6 +168,7 @@ function createPluginHostService(options) {
       runtimeSupervisor: runtimeAccess,
       secretStore,
       getLocale: options.getLocale,
+      onCommandFinished: (runtimeId) => interactionService?.cancelRuntimeRequests(runtimeId),
     });
     contributionService.registerRpcCapabilities(rpcRegistry);
     registerSecurePluginCapabilities(rpcRegistry, {
@@ -177,6 +181,14 @@ function createPluginHostService(options) {
       quotaManager,
       secretStore,
     });
+    interactionService = new PluginHostInteractionService({
+      database, permissionEngine, quotaManager,
+      clipboard: options.electron.clipboard,
+      getWindow: options.getInteractionWindow,
+      isLocked: options.isAppLocked,
+      subscribeLock: options.subscribeAppLock,
+    });
+    interactionService.registerRpcCapabilities(rpcRegistry);
     const configuredRegistry = options.configureRpcRegistry?.(rpcRegistry);
     if (configuredRegistry && typeof configuredRegistry.then === "function") {
       throw new TypeError("Plugin host RPC registry configuration must be synchronous");
@@ -224,7 +236,7 @@ function createPluginHostService(options) {
       paths,
       netcattyVersion: options.app.getVersion(),
       apiVersion: PLUGIN_API_VERSION,
-      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, ...(options.supportedFeatures ?? [])])],
+      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
       runtimeDirectory,
       appRoot,
       rpcRegistry,
@@ -234,6 +246,7 @@ function createPluginHostService(options) {
       getInitialEnvironment: () => contributionService.getEnvironment(),
       runtimeResourceMonitor: quotaManager,
       runtimeCleanup: async (identity) => {
+        interactionService?.releaseRuntime(identity.runtimeId);
         leaseStore.revokeRuntime(identity.runtimeId);
         await companionSupervisor.releaseRuntime(identity.runtimeId);
       },
@@ -360,6 +373,7 @@ function createPluginHostService(options) {
       runtimeSupervisor,
       contributionService,
       beforeClose: async () => {
+        interactionService.shutdown();
         terminalDataPipelineService?.shutdown();
         extensionProviderService.shutdown();
         credentialResolver.shutdown?.();
@@ -371,6 +385,7 @@ function createPluginHostService(options) {
       },
     });
     return {
+      interactionService,
       catalogService: new RegistryCatalogService({ manager, fetch: options.electron.net?.fetch?.bind(options.electron.net) }),
       companionSupervisor,
       contributionIconService,
@@ -398,6 +413,7 @@ function createPluginHostService(options) {
       viewHost,
     };
   } catch (error) {
+    try { interactionService?.shutdown(); } catch {}
     database.close();
     throw error;
   }

electron/plugins/permissionEngine.cjs

@@ -660,6 +660,22 @@ class PluginPermissionEngine {
     });
   }
 
+  describeGrants(pluginId, context) {
+    const groups = this.listGrants(pluginId);
+    const declarations = context ? normalizePermissionDeclarations(context.manifest) : new Map();
+    return Object.fromEntries(Object.entries(groups).map(([scope, grants]) => [scope, grants.map((grant) => {
+      const declaration = declarations.get(grant.permission);
+      const matchesCurrentActivation = Boolean(
+        context?.pluginId === pluginId
+        && context.securityPrincipal
+        && declaration
+        && declarationAllowsResource(declaration, grant.resource)
+        && grant.declarationHash === permissionDeclarationHash(declaration, context.securityPrincipal),
+      );
+      return Object.freeze({ ...grant, matchesCurrentActivation });
+    })]));
+  }
+
   revokeAlways(pluginId, permission, resource) {
     assertPluginPermission(permission);
     const canonicalResource = canonicalizePermissionResource(permission, resource);

electron/plugins/permissionEngine.test.cjs

@@ -631,3 +631,25 @@ test("permission middleware rejects unclassified methods and permits explicit pu
   }, async () => "ok"), "ok");
   database.close();
 });
+
+test("grant descriptions distinguish current activation from old package and changed declarations", async (context) => {
+  const database = createDatabase(context);
+  const engine = new PluginPermissionEngine({ database, requestDecision: async (request) => ({
+    requestId: request.requestId, decision: "allow", scope: "always",
+  }) });
+  const pluginManifest = manifest({ optional: [{ permission: "network", resources: ["https://example.invalid"] }] });
+  const first = runtimeContext(pluginManifest, { securityPrincipal: defaultSecurityPrincipal(pluginManifest, "a".repeat(64)) });
+  const descriptor = { permission: "network", resources: ["https://example.invalid"], reason: "Synthetic request" };
+  await engine.authorize(first, descriptor);
+  assert.equal(engine.describeGrants(first.pluginId, first).always[0].matchesCurrentActivation, true);
+  assert.equal(engine.describeGrants(first.pluginId, null).always[0].matchesCurrentActivation, false);
+  const upgraded = { ...first, securityPrincipal: defaultSecurityPrincipal(pluginManifest, "b".repeat(64)) };
+  assert.equal(engine.describeGrants(first.pluginId, upgraded).always[0].matchesCurrentActivation, false);
+  await assert.rejects(engine.authorize(upgraded, { ...descriptor, interactive: false }), /permission/i);
+  const changed = { ...first, manifest: { ...pluginManifest, permissions: { optional: [{ permission: "network", resources: ["https://example.invalid", "https://other.invalid"] }] } } };
+  assert.equal(engine.describeGrants(first.pluginId, changed).always[0].matchesCurrentActivation, false);
+  await assert.rejects(engine.authorize(changed, { ...descriptor, interactive: false }), /permission/i);
+  assert.equal(engine.describeGrants(first.pluginId, { ...first, manifest: { ...pluginManifest, permissions: {} } }).always[0].matchesCurrentActivation, false);
+  engine.shutdown();
+  database.close();
+});

electron/plugins/pluginBridge.cjs

@@ -16,6 +16,8 @@ const { assertSecretKey } = require("./secretStore.cjs");
 
 const CHANNELS = Object.freeze({
   status: "netcatty:plugins:status",
+  interactionReady: "netcatty:plugins:interaction-ready",
+  interactionResponse: "netcatty:plugins:interaction-response",
   list: "netcatty:plugins:list",
   permissions: "netcatty:plugins:permissions",
   revokePermissions: "netcatty:plugins:revoke-permissions",
@@ -661,6 +663,14 @@ function registerPluginBridge(ipcMain, options) {
     if (!options.catalogService) throw new Error("Plugin catalog unavailable");
     return options.catalogService.install(payload?.id, payload?.selectionToken);
   });
+  handle(CHANNELS.interactionReady, async (_manager, payload, event) => {
+    if (!options.interactionService) throw new Error("Host interactions are unavailable");
+    return options.interactionService.setReady(event.sender, payload?.ready);
+  });
+  handle(CHANNELS.interactionResponse, async (_manager, payload, event) => {
+    if (!options.interactionService) throw new Error("Host interactions are unavailable");
+    return options.interactionService.respond(event.sender, payload);
+  });
   handle(CHANNELS.list, async (activeManager) => activeManager.list());
   const assertManagedPluginId = (payload) => {
     const id = payload?.pluginId;
@@ -672,7 +682,15 @@ function registerPluginBridge(ipcMain, options) {
   handle(CHANNELS.permissions, async (_manager, payload) => {
     const pluginId = assertManagedPluginId(payload);
     if (!options.permissionEngine || !options.database) throw new Error("Plugin permissions are unavailable");
-    const groups = options.permissionEngine.listGrants(pluginId);
+    const plugin = options.database.getActivePlugin(pluginId);
+    const identity = options.runtimeSupervisor?.getRuntimeIdentity(pluginId);
+    // A stored grant is effective only for its matching host-owned activation.
+    // Disabled/lazy/stopped plugins retain saved grants without claiming they
+    // currently apply. Never infer a principal from plugin-provided metadata.
+    const context = plugin?.enabled && identity?.pluginVersion === plugin.activeVersion
+      ? { ...identity, manifest: plugin.manifest }
+      : null;
+    const groups = options.permissionEngine.describeGrants(pluginId, context);
     // Host-only summaries: never return arbitrary audit details, reasons,
     // operation IDs, credentials, terminal content or future database columns.
     const grants = ["always", "application", "session"].flatMap((scope) => (
@@ -680,6 +698,7 @@ function registerPluginBridge(ipcMain, options) {
         permission: grant.permission, resource: grant.resource,
         resourceKind: grant.resourceKind, scope,
         sessionId: grant.sessionId ?? null, grantedAt: grant.grantedAt,
+        matchesCurrentActivation: grant.matchesCurrentActivation,
       }))
     ));
     const audit = options.database.listSecurityAudit(pluginId, 100).map((entry) => ({

electron/plugins/pluginBridge.test.cjs

@@ -1643,12 +1643,13 @@ test("permission management is trusted-host-only and projects bounded audit summ
   registerPluginBridge(ipcMain, {
     manager: { async initialize() {}, async revokePermissions(id) { revoked.push(id); return { enabled: false }; } },
     isTrustedSender: (event) => event?.trusted === true,
-    permissionEngine: { listGrants(id) {
+    permissionEngine: { describeGrants(id, context) {
+      assert.equal(context, null);
       reads++;
       assert.equal(id, "com.example.synthetic");
-      return { always: [{ permission: "network", resource: "https://example.invalid", resourceKind: "exact", grantedAt: 12, declarationHash: "private" }], application: [], session: [] };
+      return { always: [{ permission: "network", resource: "https://example.invalid", resourceKind: "exact", grantedAt: 12, matchesCurrentActivation: false, declarationHash: "private" }], application: [], session: [] };
     } },
-    database: { listSecurityAudit(id, limit) {
+    database: { getActivePlugin() { return null; }, listSecurityAudit(id, limit) {
       assert.equal(id, "com.example.synthetic");
       assert.equal(limit, 100);
       return [{ event: "permission.used", createdAt: 13, details: { permission: "network", scope: "always", operationId: "hidden", secret: "synthetic-private" } }];
@@ -1661,9 +1662,55 @@ test("permission management is trusted-host-only and projects bounded audit summ
   }
   assert.equal(reads, 0);
   assert.deepEqual(await ipcMain.handlers.get(CHANNELS.permissions)({ trusted: true }, payload), {
-    grants: [{ permission: "network", resource: "https://example.invalid", resourceKind: "exact", scope: "always", sessionId: null, grantedAt: 12 }],
+    grants: [{ permission: "network", resource: "https://example.invalid", resourceKind: "exact", scope: "always", sessionId: null, grantedAt: 12, matchesCurrentActivation: false }],
     audit: [{ event: "permission.used", createdAt: 13, permission: "network", scope: "always" }],
   });
   assert.deepEqual(await ipcMain.handlers.get(CHANNELS.revokePermissions)({ trusted: true }, payload), { enabled: false });
   assert.deepEqual(revoked, [payload.pluginId]);
 });
+
+test("grant classification uses only the current host activation and stops matching after disable or upgrade", async () => {
+  const ipcMain = createIpcMain();
+  let plugin = { enabled: true, activeVersion: "1.0.0", manifest: { id: "com.example.synthetic" } };
+  let identity = { pluginId: "com.example.synthetic", pluginVersion: "1.0.0", runtimeId: "runtime-host", securityPrincipal: "host-owned-principal" };
+  const contexts = [];
+  registerPluginBridge(ipcMain, {
+    manager: { async initialize() {} }, isTrustedSender: () => true,
+    runtimeSupervisor: { getRuntimeIdentity: () => identity },
+    permissionEngine: { describeGrants(_id, context) { contexts.push(context); return { always: [], application: [], session: [] }; } },
+    database: { getActivePlugin: () => plugin, listSecurityAudit: () => [] },
+  });
+  const payload = { pluginId: "com.example.synthetic", securityPrincipal: "plugin-forgery", manifest: {} };
+  const read = ipcMain.handlers.get(CHANNELS.permissions);
+  await read({}, payload);
+  assert.deepEqual(contexts[0], { ...identity, manifest: plugin.manifest });
+  plugin = { ...plugin, enabled: false };
+  await read({}, payload);
+  assert.equal(contexts[1], null);
+  plugin = { ...plugin, enabled: true, activeVersion: "2.0.0" };
+  await read({}, payload);
+  assert.equal(contexts[2], null, "old activation cannot label upgraded package grants as current");
+  identity = null;
+  await read({}, payload);
+  assert.equal(contexts[3], null, "stopped and lazy plugins show saved grants as inactive");
+});
+
+test("host interaction ready and response channels reject untrusted senders before touching the adapter", async () => {
+  const ipcMain = createIpcMain(), calls = [];
+  const sender = { id: 7 };
+  registerPluginBridge(ipcMain, {
+    manager: { async initialize() {} }, isTrustedSender: (event) => event?.trusted === true,
+    interactionService: {
+      setReady(...args) { calls.push(args); return true; },
+      respond(...args) { calls.push(args); return true; },
+    },
+  });
+  for (const channel of [CHANNELS.interactionReady, CHANNELS.interactionResponse]) {
+    await assert.rejects(ipcMain.handlers.get(channel)({ sender }, {}), /Untrusted/);
+  }
+  assert.deepEqual(calls, []);
+  await ipcMain.handlers.get(CHANNELS.interactionReady)({ trusted: true, sender }, { ready: true });
+  const response = { requestId: "opaque", actionToken: "host-token", action: "cancel" };
+  await ipcMain.handlers.get(CHANNELS.interactionResponse)({ trusted: true, sender }, response);
+  assert.deepEqual(calls, [[sender, true], [sender, response]]);
+});

electron/plugins/pluginManager.cjs

@@ -136,10 +136,15 @@ class PluginManager {
       if (!this.database.getActivePlugin(pluginId)) throw new Error("Plugin is not installed");
       // Disable before revoking. Lazy activation cannot re-create authority while
       // runtime shutdown cancels pending RPC, streams, leases and provider work.
-      this.database.setEnabled(pluginId, false);
-      this.permissionEngine.revokeAll(pluginId);
-      this.contributionService.onPluginDisabled(pluginId);
-      await this.runtimeSupervisor.stop(pluginId);
+      const errors = [];
+      // Every containment stage must be attempted even when persistence,
+      // revocation audit, or contribution invalidation fails.
+      try { this.database.setEnabled(pluginId, false); } catch (error) { errors.push(error); }
+      try { this.permissionEngine.revokeAll(pluginId); } catch (error) { errors.push(error); }
+      try { this.contributionService.onPluginDisabled(pluginId); } catch (error) { errors.push(error); }
+      try { await this.runtimeSupervisor.stop(pluginId); } catch (error) { errors.push(error); }
+      if (errors.length === 1) throw errors[0];
+      if (errors.length > 1) throw new AggregateError(errors, "Plugin grant revocation or cleanup failed");
       return this.database.getActivePlugin(pluginId);
     });
   }

electron/plugins/pluginManager.test.cjs

@@ -556,3 +556,30 @@ test("failed runtime containment leaves the revoked plugin disabled and reports
   assert.equal(enabled, false);
   assert.equal(revoked, true);
 });
+
+test("revocation attempts every cleanup stage and aggregates independent failures", async () => {
+  for (const failedStages of [["revoke"], ["contributions"], ["disable"], ["stop"], ["disable", "revoke", "contributions", "stop"]]) {
+    const calls = [];
+    const fail = (stage) => {
+      calls.push(stage);
+      if (failedStages.includes(stage)) throw new Error(`${stage} failed`);
+    };
+    const manager = new PluginManager({
+      database: {
+        getActivePlugin: () => ({ id: "com.example.revoke", enabled: false }),
+        setEnabled() { fail("disable"); },
+      },
+      packageStore: { async initialize() {} },
+      contributionService: { async initialize() {}, onPluginDisabled() { fail("contributions"); } },
+      permissionEngine: { revokeAll() { fail("revoke"); } },
+      runtimeSupervisor: { async stop() { fail("stop"); } },
+    });
+    await assert.rejects(manager.revokePermissions("com.example.revoke"), (error) => {
+      if (failedStages.length === 1) return error.message === `${failedStages[0]} failed`;
+      assert.ok(error instanceof AggregateError);
+      assert.deepEqual(error.errors.map((entry) => entry.message), failedStages.map((stage) => `${stage} failed`));
+      return true;
+    });
+    assert.deepEqual(calls, ["disable", "revoke", "contributions", "stop"]);
+  }
+});

electron/plugins/runtime/runtimePeer.mjs

@@ -5,7 +5,7 @@ import {
   PLUGIN_ERROR_WIRE_CODES,
   pluginErrorToRpcError,
 } from "@netcatty/plugin-sdk";
-import { createMessagePortStreamEnvelope } from "@netcatty/plugin-contract";
+import { createMessagePortStreamEnvelope, PLUGIN_HOST_INTERACTION_LIMITS } from "@netcatty/plugin-contract";
 import { createPluginStreamEndpoint } from "./pluginStreamEndpoint.mjs";
 
 let terminalInterceptorTransportPromise;
@@ -365,6 +365,16 @@ function createPluginContext(config, client, runtimeApi) {
       ...(options?.ttlMs === undefined ? {} : { ttlMs: options.ttlMs }),
     }),
   };
+  const interact = (params) => client.request("ui.interact", params, { deadlineMs: PLUGIN_HOST_INTERACTION_LIMITS.timeoutMs })
+    .then((result) => result.cancelled ? undefined : result.value);
+  const ui = {
+    quickPick: (title, items) => interact({ kind: "quickPick", title, items }),
+    input: (title, initialValue) => interact({ kind: "input", title, ...(initialValue === undefined ? {} : { initialValue }) }),
+  };
+  const clipboard = {
+    readText: (title) => interact({ kind: "clipboard.read", title }),
+    writeText: (text, title) => interact({ kind: "clipboard.write", title, text }).then((value) => value === true),
+  };
   const network = {
     request: (request) => client.request("network.request", request, {
       deadlineMs: forwardedDeadline(request?.timeoutMs, 300_000),
@@ -543,6 +553,8 @@ function createPluginContext(config, client, runtimeApi) {
     secrets,
     credentials,
     network,
+    ui,
+    clipboard,
     filesystem,
     companions,
     streams,

electron/plugins/runtimeSupervisor.test.cjs

@@ -12,6 +12,7 @@ const { createPluginPaths } = require("./paths.cjs");
 const { RPC_ERRORS } = require("./rpcRouter.cjs");
 const { RuntimeSupervisor } = require("./runtimeSupervisor.cjs");
 const { createContainmentError } = require("./utilityPluginRuntime.cjs");
+const { PluginContributionService } = require("./contributionService.cjs");
 
 function pluginManifest(overrides = {}) {
   return {
@@ -66,6 +67,31 @@ function createFixture(context, runtimeFactory, supervisorOptions = {}) {
   return { database, manifest, runtimeOptions, supervisor };
 }
 
+test("ordinary command activation A cannot dispatch on replacement runtime B", async (t) => {
+  let executed = 0, activation;
+  const fixture = createFixture(t, () => ({ async start(config) { return { pluginId: config.pluginId, pluginVersion: config.pluginVersion,
+    apiVersion: config.apiVersion, enabledFeatures: config.enabledFeatures }; }, async stop() {}, async request() { executed++; return null; } }));
+  t.after(() => fixture.supervisor.shutdown());
+  const manifest = { ...fixture.manifest, contributes: { commands: [{ id: `${fixture.manifest.id}.ordinary`, title: "Ordinary" }] } };
+  const finished = [];
+  const service = new PluginContributionService({
+    database: { listPlugins: () => [{ id: manifest.id, manifest, activeVersion: manifest.version, enabled: true, runtime: {} }] },
+    onCommandFinished: (runtimeId) => finished.push(runtimeId),
+    runtimeSupervisor: {
+      async start(pluginId) {
+        activation = await fixture.supervisor.start(pluginId);
+        await fixture.supervisor.restart(pluginId);
+        return activation;
+      },
+      request: (...args) => fixture.supervisor.request(...args),
+    },
+  });
+  await assert.rejects(service.executeCommand(`${manifest.id}.ordinary`), /no longer matches the authorized activation/);
+  assert.notEqual(fixture.supervisor.getRuntimeIdentity(manifest.id).runtimeId, activation.runtimeId);
+  assert.equal(executed, 0, "replacement B receives no stale command");
+  assert.deepEqual(finished, [activation.runtimeId]);
+});
+
 test("supervisor prefers the ordinary browser runtime and enforces negotiated identity", async (context) => {
   const calls = [];
   const initialEnvironment = { locale: "en", theme: "light", reducedMotion: false, highContrast: false };

electron/preload/api.cjs

@@ -102,6 +102,13 @@ function createPreloadApi(ctx) {
   listPluginCatalog: () => ipcRenderer.invoke("netcatty:plugins:catalog"),
   getPluginCatalogReadme: (id, selectionToken) => ipcRenderer.invoke("netcatty:plugins:catalog-readme", { id, selectionToken }),
   installCatalogPlugin: (id, selectionToken) => ipcRenderer.invoke("netcatty:plugins:catalog-install", { id, selectionToken }),
+  setPluginInteractionReady: (ready) => ipcRenderer.invoke("netcatty:plugins:interaction-ready", { ready }),
+  respondPluginInteraction: (response) => ipcRenderer.invoke("netcatty:plugins:interaction-response", response),
+  onPluginInteraction: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on("netcatty:plugins:host-interaction", listener);
+    return () => ipcRenderer.removeListener("netcatty:plugins:host-interaction", listener);
+  },
   listPlugins: () => ipcRenderer.invoke("netcatty:plugins:list"),
   getPluginPermissions: (pluginId) => ipcRenderer.invoke("netcatty:plugins:permissions", { pluginId }),
   revokePluginPermissions: (pluginId) => ipcRenderer.invoke("netcatty:plugins:revoke-permissions", { pluginId }),

examples/plugins/host-interactions/README.md

@@ -0,0 +1,41 @@
+# Host text workflow
+
+This browser-only fixture uses host choice/input dialogs and explicit clipboard
+copy/share. It has no network, filesystem, host/session, credential, Node, or
+shell permission. Shared text stays in the current operation's memory and is
+not returned in the command result or written to plugin storage/logs.
+
+Version 0.1.1 requires `host.interactions` and `commands.interactive`. Its one
+command explicitly declares the fixed 180-second interactive budget; ordinary
+commands keep 30 seconds and each dialog keeps 60 seconds. The host closes
+pending confirmations when the command fails or ends, without resetting quotas.
+These features add no new data permission. The permission list remains
+required `commands`/`menus`, optional `ui.interact`/`clipboard.read`/`clipboard.write`.
+
+Pack the source after building the plugin packages:
+
+```sh
+node packages/plugin-cli/dist/cli.js pack examples/plugins/host-interactions --out /tmp/host-interactions.ncpkg
+```
+
+Import it disabled in the normal manager. Inspect permissions before enabling.
+Use one-use permissions for this check. With the unlocked main window focused,
+choose **Host text workflow** in the command palette.
+
+- **Compose synthetic text** asks for text and then previews the exact clipboard
+  replacement. Cancel leaves the clipboard unchanged.
+- **Share clipboard and uppercase it** first asks before reading the clipboard.
+  The host previews the captured text and requires a second confirmation to
+  share it with the plugin. The transformed output needs a separate copy
+  confirmation. Clipboard changes after preview do not change the shared
+  snapshot.
+
+Use only synthetic clipboard text. Do not use account data or real secrets.
+The fixture does not require a persistent grant or any network destination.
+A different plugin that also has network permission could send shared text
+through its granted capabilities; reading text does not approve a new origin.
+
+Blur/lock/close the owner window, cancel, revoke access, or disable the plugin
+to end a pending request. Late/duplicate replies cannot commit an old action.
+Only the focused unlocked main window is supported in this first slice. Other
+windows return unavailable instead of inheriting the request's authority.

examples/plugins/host-interactions/browser.js

@@ -0,0 +1,21 @@
+import { definePlugin, PLUGIN_HOST_INTERACTION_FEATURE } from '@netcatty/plugin-sdk';
+
+export default definePlugin({
+  activate(context) {
+    context.subscriptions.add(context.commands.registerCommand('com.netcatty.host-interactions.text', async () => {
+      if (!context.enabledFeatures.has(PLUGIN_HOST_INTERACTION_FEATURE)) throw new Error('Host interactions are unavailable');
+      const source = await context.ui.quickPick('Choose a text workflow', [
+        { id: 'compose', label: 'Compose synthetic text', description: 'Edit a draft, then explicitly confirm clipboard replacement.' },
+        { id: 'share', label: 'Share clipboard and uppercase it', description: 'Preview text, confirm sharing, then confirm the transformed copy.' },
+      ]);
+      if (source === undefined) return { cancelled: true };
+      const text = source === 'compose'
+        ? await context.ui.input('Edit synthetic text', 'synthetic text')
+        : await context.clipboard.readText('Share clipboard text for uppercase conversion');
+      if (text === undefined) return { cancelled: true };
+      const output = source === 'share' ? text.toUpperCase() : text;
+      const copied = await context.clipboard.writeText(output, 'Confirm the exact text to copy');
+      return { copied, characters: output.length };
+    }));
+  },
+});

examples/plugins/host-interactions/netcatty.plugin.json

@@ -0,0 +1,52 @@
+{
+  "manifestVersion": 1,
+  "id": "com.netcatty.host-interactions",
+  "name": "host-interactions",
+  "displayName": "Host text interactions",
+  "description": "Synthetic host choice, input and explicit clipboard sharing workflow.",
+  "version": "0.1.1",
+  "publisher": "netcatty",
+  "license": "GPL-3.0-or-later",
+  "engines": {
+    "netcatty": ">=0.0.0",
+    "api": ">=0.1.0-internal <0.2.0"
+  },
+  "features": {
+    "required": [
+      "host.interactions",
+      "commands.interactive"
+    ]
+  },
+  "main": {
+    "browser": "browser.js"
+  },
+  "activationEvents": [
+    "onCommand:com.netcatty.host-interactions.text"
+  ],
+  "permissions": {
+    "required": [
+      "commands",
+      "menus"
+    ],
+    "optional": [
+      "ui.interact",
+      "clipboard.read",
+      "clipboard.write"
+    ]
+  },
+  "contributes": {
+    "commands": [
+      {
+        "id": "com.netcatty.host-interactions.text",
+        "title": "Host text workflow",
+        "interactive": true
+      }
+    ],
+    "menus": [
+      {
+        "command": "com.netcatty.host-interactions.text",
+        "location": "commandPalette"
+      }
+    ]
+  }
+}

examples/plugins/lease-http/README.md

@@ -18,7 +18,7 @@ permissions, and enable it. The command palette contains **Synthetic credential
 lease request**. Reject a permission prompt to verify that the request stops.
 OS secret storage must be available to proceed past `secrets.set`.
 
-The package detail's **Active grants** panel shows retained decisions. One-use
+The package detail's **Saved grants** panel shows retained decisions. One-use
 decisions are not retained. **Disable and revoke all grants** disables the
 plugin and waits for its runtime cleanup. Re-enable it to request access again.
 Recent events show event type and permission without terminal or secret data.

global.d.ts

@@ -359,6 +359,7 @@ declare global {
     grants: Array<{
       permission: string; resource: string; resourceKind: string;
       scope: 'always' | 'application' | 'session'; sessionId: string | null; grantedAt: number;
+      matchesCurrentActivation: boolean;
     }>;
     audit: Array<{ event: string; createdAt: number; permission?: string; scope?: string }>;
   }
@@ -443,6 +444,9 @@ declare global {
     listPluginCatalog?(): Promise<NetcattyPluginCatalogSnapshot>;
     getPluginCatalogReadme?(id: string, selectionToken?: string): Promise<string>;
     installCatalogPlugin?(id: string, selectionToken?: string): Promise<NetcattyInstalledPlugin>;
+    setPluginInteractionReady?(ready: boolean): Promise<boolean>;
+    respondPluginInteraction?(response: import("@netcatty/plugin-contract").HostInteractionResponse): Promise<boolean>;
+    onPluginInteraction?(callback: (event: import("@netcatty/plugin-contract").HostInteractionEvent) => void): () => void;
     listPlugins?(): Promise<NetcattyInstalledPlugin[]>;
     getPluginPermissions?(pluginId: string): Promise<NetcattyPluginPermissionSnapshot>;
     revokePluginPermissions?(pluginId: string): Promise<NetcattyInstalledPlugin>;

packages/plugin-cli/src/interactiveCommands.test.ts

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFile } from 'node:fs/promises';
+import { validateManifestValue } from './manifest.js';
+import { checkPluginCompatibility } from './compatibility.js';
+
+const manifest = JSON.parse(await readFile(new URL('../../../examples/plugins/host-interactions/netcatty.plugin.json', import.meta.url), 'utf8'));
+test('interactive command budget requires feature negotiation without changing ordinary command admission', () => {
+  assert.equal(validateManifestValue(manifest).valid, true);
+  assert.equal(validateManifestValue({ ...manifest, features: { required: ['host.interactions'] } }).valid, false);
+  assert.equal(checkPluginCompatibility(manifest, { netcattyVersion: '1.0.0', features: ['host.interactions'] }).compatible, false);
+  assert.equal(checkPluginCompatibility(manifest, { netcattyVersion: '1.0.0', features: ['host.interactions', 'commands.interactive'] }).compatible, true);
+  const legacy = structuredClone(manifest); delete legacy.contributes.commands[0].interactive; legacy.features.required = ['host.interactions'];
+  assert.equal(validateManifestValue(legacy).valid, true);
+});

packages/plugin-cli/src/manifest.ts

@@ -367,6 +367,8 @@ function validateSemantics(manifest: PluginManifest): string[] {
   }
 
   const requiredFeatures = new Set(manifest.features?.required ?? []);
+  if (manifest.contributes?.commands?.some((command) => command.interactive)
+    && !requiredFeatures.has('commands.interactive')) errors.push('Interactive commands require commands.interactive');
   if (manifest.icon) {
     if (!requiredFeatures.has('metadata.brand-icon')) errors.push('Brand icons require metadata.brand-icon');
     if (!validRange(manifest.engines.api) || !satisfies('0.1.0-internal.1', manifest.engines.api) || satisfies('0.1.0-internal', manifest.engines.api)) errors.push('Brand icons require API >=0.1.0-internal.1 excluding the legacy revision');

packages/plugin-contract/schema/plugin-contract.schema.json

@@ -178,6 +178,311 @@
       },
       "additionalProperties": false
     },
+    "HostInteractionLimits": {
+      "const": {
+        "textBytes": 4096,
+        "requestBytes": 65536,
+        "items": 100,
+        "pendingPerRuntime": 1,
+        "pendingTotal": 8,
+        "requestsPerMinute": 10,
+        "timeoutMs": 60000
+      }
+    },
+    "HostInteractionFeature": {
+      "const": "host.interactions"
+    },
+    "InteractiveCommandFeature": {
+      "const": "commands.interactive"
+    },
+    "InteractiveCommandLimits": {
+      "const": { "timeoutMs": 180000 }
+    },
+    "HostQuickPickItem": {
+      "type": "object",
+      "required": [
+        "id",
+        "label"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 512
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostQuickPickRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title",
+        "items"
+      ],
+      "properties": {
+        "kind": {
+          "const": "quickPick"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "items": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 100,
+          "items": {
+            "$ref": "#/$defs/HostQuickPickItem"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostSingleLineInputText": {
+      "description": "Single-line host input. CR and LF are rejected before display and on submission; clipboard text remains multiline.",
+      "type": "string",
+      "maxLength": 4096,
+      "pattern": "^[^\\u0000\\r\\n]*$"
+    },
+    "HostInputRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title"
+      ],
+      "properties": {
+        "kind": {
+          "const": "input"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "initialValue": { "$ref": "#/$defs/HostSingleLineInputText" }
+      },
+      "additionalProperties": false
+    },
+    "HostClipboardReadRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title"
+      ],
+      "properties": {
+        "kind": {
+          "const": "clipboard.read"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostClipboardWriteRequest": {
+      "type": "object",
+      "required": [
+        "kind",
+        "title",
+        "text"
+      ],
+      "properties": {
+        "kind": {
+          "const": "clipboard.write"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+        },
+        "text": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionRequest": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/HostQuickPickRequest"
+        },
+        {
+          "$ref": "#/$defs/HostInputRequest"
+        },
+        {
+          "$ref": "#/$defs/HostClipboardReadRequest"
+        },
+        {
+          "$ref": "#/$defs/HostClipboardWriteRequest"
+        }
+      ]
+    },
+    "HostInteractionResult": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "cancelled"
+          ],
+          "properties": {
+            "cancelled": {
+              "const": true
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": [
+            "cancelled",
+            "value"
+          ],
+          "properties": {
+            "cancelled": {
+              "const": false
+            },
+            "value": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "maxLength": 4096,
+                  "pattern": "^[^\\u0000]*$"
+                },
+                {
+                  "const": true
+                }
+              ]
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "HostInteractionResponse": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "actionToken",
+        "action"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "actionToken": {
+          "type": "string",
+          "minLength": 32,
+          "maxLength": 256
+        },
+        "action": {
+          "enum": [
+            "cancel",
+            "preview",
+            "submit"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionClosed": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "closed"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "maxLength": 128
+        },
+        "closed": {
+          "const": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "HostInteractionEvent": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/HostInteractionPrompt"
+        },
+        {
+          "$ref": "#/$defs/HostInteractionClosed"
+        }
+      ]
+    },
+    "HostInteractionPrompt": {
+      "type": "object",
+      "required": [
+        "requestId",
+        "actionToken",
+        "pluginId",
+        "pluginVersion",
+        "expiresAt",
+        "phase",
+        "request"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "maxLength": 128
+        },
+        "actionToken": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "pluginId": {
+          "$ref": "#/$defs/PluginId"
+        },
+        "pluginVersion": {
+          "$ref": "#/$defs/SemanticVersion"
+        },
+        "expiresAt": {
+          "$ref": "#/$defs/SafePositiveInteger"
+        },
+        "phase": {
+          "enum": [
+            "request",
+            "preview"
+          ]
+        },
+        "request": {
+          "$ref": "#/$defs/HostInteractionRequest"
+        },
+        "previewText": {
+          "type": "string",
+          "maxLength": 4096,
+          "pattern": "^[^\\u0000]*$"
+        }
+      },
+      "additionalProperties": false
+    },
     "NetworkCredentialLeaseFeature": {
       "const": "network.credential-lease"
     },
@@ -335,6 +640,7 @@
         "commands",
         "menus",
         "views",
+        "ui.interact",
         "clipboard.read",
         "clipboard.write",
         "terminal.metadata",
@@ -372,6 +678,7 @@
         "commands",
         "menus",
         "views",
+        "ui.interact",
         "clipboard.read",
         "clipboard.write",
         "terminal.metadata",
@@ -648,7 +955,8 @@
         "category": { "$ref": "#/$defs/LocalizedText" },
         "description": { "$ref": "#/$defs/LocalizedText" },
         "icon": { "$ref": "#/$defs/IconReference" },
-        "enablement": { "$ref": "#/$defs/ContextKeyExpression" }
+        "enablement": { "$ref": "#/$defs/ContextKeyExpression" },
+        "interactive": { "type": "boolean", "default": false, "description": "Require commands.interactive for this command's fixed bounded host interaction budget. Does not grant UI or clipboard permissions." }
       },
       "additionalProperties": false
     },

packages/plugin-contract/src/generated/plugin-contract-limits.ts

@@ -6,6 +6,7 @@ export const PLUGIN_JSON_MAX_DEPTH = 128 as const;
 export const PLUGIN_JSON_MAX_NODES = 100000 as const;
 export const PLUGIN_WIRE_MAX_SAFE_INTEGER = 9007199254740991 as const;
 export const PLUGIN_RPC_MAX_JSON_BYTES = 1048576 as const;
+export const PLUGIN_HOST_INTERACTION_LIMITS = {"textBytes":4096,"requestBytes":65536,"items":100,"pendingPerRuntime":1,"pendingTotal":8,"requestsPerMinute":10,"timeoutMs":60000} as const;
 export const PLUGIN_RPC_ERROR_CODES = [-32700,-32600,-32601,-32602,-32603,-32001,-32002,-32003,-32004,-32005,-32006,-32007,-32008,-32009,-32010,-32011,-32012,-32013,-32014,-32015,-32016] as const;
 export const PLUGIN_STREAM_MAX_ID_LENGTH = 128 as const;
 export const PLUGIN_STREAM_MAX_CHUNK_BYTES = 16777216 as const;

packages/plugin-contract/src/generated/plugin-contract.ts

@@ -80,6 +80,7 @@ export type CommandContribution = {
   description?: LocalizedText;
   icon?: IconReference;
   enablement?: ContextKeyExpression;
+  interactive?: boolean;
 };
 
 export type CompanionExecutable = {
@@ -167,6 +168,75 @@ export type CredentialRef = {
 
 export type FeatureId = string;
 
+export type HostClipboardReadRequest = {
+  kind: "clipboard.read";
+  title: string;
+};
+
+export type HostClipboardWriteRequest = {
+  kind: "clipboard.write";
+  title: string;
+  text: string;
+};
+
+export type HostInputRequest = {
+  kind: "input";
+  title: string;
+  initialValue?: HostSingleLineInputText;
+};
+
+export type HostInteractionClosed = {
+  requestId: string;
+  closed: true;
+};
+
+export type HostInteractionEvent = (HostInteractionPrompt) | (HostInteractionClosed);
+
+export type HostInteractionFeature = "host.interactions";
+
+export type HostInteractionLimits = {"textBytes":4096,"requestBytes":65536,"items":100,"pendingPerRuntime":1,"pendingTotal":8,"requestsPerMinute":10,"timeoutMs":60000};
+
+export type HostInteractionPrompt = {
+  requestId: string;
+  actionToken: string;
+  pluginId: PluginId;
+  pluginVersion: SemanticVersion;
+  expiresAt: SafePositiveInteger;
+  phase: "request" | "preview";
+  request: HostInteractionRequest;
+  previewText?: string;
+};
+
+export type HostInteractionRequest = (HostQuickPickRequest) | (HostInputRequest) | (HostClipboardReadRequest) | (HostClipboardWriteRequest);
+
+export type HostInteractionResponse = {
+  requestId: string;
+  actionToken: string;
+  action: "cancel" | "preview" | "submit";
+  value?: string;
+};
+
+export type HostInteractionResult = ({
+  cancelled: true;
+}) | ({
+  cancelled: false;
+  value: (string) | (true);
+});
+
+export type HostQuickPickItem = {
+  id: string;
+  label: string;
+  description?: string;
+};
+
+export type HostQuickPickRequest = {
+  kind: "quickPick";
+  title: string;
+  items: Array<HostQuickPickItem>;
+};
+
+export type HostSingleLineInputText = string;
+
 export type IconReference = (ThemeIcon) | (PackageIcon);
 
 export type ImporterDetectPayload = {
@@ -319,6 +389,10 @@ export type ImporterSnippetDraft = {
   description?: string;
 };
 
+export type InteractiveCommandFeature = "commands.interactive";
+
+export type InteractiveCommandLimits = {"timeoutMs":180000};
+
 export type JsonPrimitive = (string) | (number) | (boolean) | (null);
 
 export type JsonRpcStandardErrorCode = -32700 | -32600 | -32601 | -32602 | -32603;
@@ -357,7 +431,7 @@ export type MenuLocation = "commandPalette" | "application" | "host/context" | "
 
 export type NetworkCredentialLeaseFeature = "network.credential-lease";
 
-export type NonResourceScopedPermission = "storage" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer";
+export type NonResourceScopedPermission = "storage" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer";
 
 export type NullableRpcId = (RpcId) | (null);
 
@@ -511,7 +585,7 @@ export type PluginNetworkResponse = {
   };
 };
 
-export type PluginPermission = "storage" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer";
+export type PluginPermission = "storage" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer";
 
 export type PluginWireErrorCode = -32001 | -32002 | -32003 | -32004 | -32005 | -32006 | -32007 | -32008 | -32009 | -32010 | -32011 | -32012 | -32013 | -32014 | -32015 | -32016;
 

packages/plugin-contract/src/index.ts

@@ -10,6 +10,7 @@ export {
   serializeJsonValue,
 } from "./jsonValue.js";
 export {
+  PLUGIN_HOST_INTERACTION_LIMITS,
   PLUGIN_IMPORTER_MAX_INPUT_BYTES,
   PLUGIN_IMPORTER_MAX_OUTPUT_BYTES,
   PLUGIN_IMPORTER_MAX_RECORD_BYTES,
@@ -51,3 +52,7 @@ export {
 export { inspectPluginBrandIcon, PLUGIN_BRAND_ICON_FEATURE, PLUGIN_BRAND_ICON_MAX_BYTES, PLUGIN_BRAND_ICON_MAX_EDGE } from './brandIcon.js';
 
 export const PLUGIN_NETWORK_CREDENTIAL_LEASE_FEATURE = "network.credential-lease" as const satisfies import("./generated/plugin-contract.js").NetworkCredentialLeaseFeature;
+
+export const PLUGIN_HOST_INTERACTION_FEATURE = "host.interactions" as const satisfies import("./generated/plugin-contract.js").HostInteractionFeature;
+
+export const PLUGIN_INTERACTIVE_COMMAND_FEATURE = "commands.interactive" as const satisfies import("./generated/plugin-contract.js").InteractiveCommandFeature;

packages/plugin-sdk/src/index.test.ts

@@ -413,3 +413,19 @@ test("network requests expose canonical host-consumed credential leases without
     void network.request({ url: 'https://example.invalid', authorization: { scheme: 'Digest' } });
   `);
 });
+
+test("host interaction SDK exposes bounded choice/input and explicit clipboard methods", () => {
+  assertSdkTypeChecks(`
+    import type { PluginContext } from './index.ts';
+    declare const context: PluginContext;
+    const choice: Promise<string | undefined> = context.ui.quickPick('Pick', [{ id: 'one', label: 'One' }]);
+    const input: Promise<string | undefined> = context.ui.input('Input', 'synthetic');
+    const text: Promise<string | undefined> = context.clipboard.readText('Share');
+    const copied: Promise<boolean> = context.clipboard.writeText('synthetic', 'Copy');
+    void [choice, input, text, copied];
+    // @ts-expect-error A plugin boolean cannot grant clipboard authority.
+    context.clipboard.readText('Share', { userGesture: true });
+    // @ts-expect-error No ambient clipboard watcher exists.
+    context.clipboard.watch(() => {});
+  `);
+});

packages/plugin-sdk/src/index.ts

@@ -109,6 +109,19 @@ export interface PluginCommands {
   executeCommand<T extends JsonValue = JsonValue>(commandId: string, args?: JsonValue): Promise<T>;
 }
 
+export interface PluginHostUI {
+  quickPick(title: string, items: readonly import("@netcatty/plugin-contract").HostQuickPickItem[]): Promise<string | undefined>;
+  /** Single-line text. The host rejects CR/LF in initial values and submitted responses. */
+  input(title: string, initialValue?: string): Promise<string | undefined>;
+}
+
+export interface PluginClipboard {
+  /** The host previews text only after the user asks, then separately confirms sharing it. */
+  readText(title: string): Promise<string | undefined>;
+  /** The host shows the exact text and requires explicit confirmation before replacement. */
+  writeText(text: string, title: string): Promise<boolean>;
+}
+
 export interface PluginContextKeys {
   set(key: string, value: JsonValue): Promise<void>;
 }
@@ -723,6 +736,8 @@ export interface PluginContext {
   readonly storage: PluginKeyValueStore;
   readonly settings: PluginSettings;
   readonly commands: PluginCommands;
+  readonly ui: PluginHostUI;
+  readonly clipboard: PluginClipboard;
   readonly contextKeys: PluginContextKeys;
   readonly views: PluginViews;
   readonly providers: PluginProviders;
@@ -913,3 +928,6 @@ export function throwIfCancellationRequested(token: CancellationToken): void {
 }
 
 export { PLUGIN_NETWORK_CREDENTIAL_LEASE_FEATURE } from "@netcatty/plugin-contract";
+
+export { PLUGIN_HOST_INTERACTION_FEATURE } from "@netcatty/plugin-contract";
+export { PLUGIN_INTERACTIVE_COMMAND_FEATURE } from "@netcatty/plugin-contract";

scripts/generate-plugin-contract.mjs

@@ -305,6 +305,11 @@ function schemaTypeToTs(node, level = 0) {
   return "unknown";
 }
 
+const hostInteractionLimits = schema.$defs.HostInteractionLimits?.const;
+if (!hostInteractionLimits || Object.values(hostInteractionLimits).some((value) => !Number.isSafeInteger(value) || value < 1)) {
+  throw new Error("HostInteractionLimits must contain positive bounded integers");
+}
+
 const definitionNames = Object.keys(schema.$defs).sort((left, right) =>
   left.localeCompare(right, "en"),
 );
@@ -327,6 +332,7 @@ const generatedLimits = [
   `export const PLUGIN_JSON_MAX_NODES = ${jsonValueLimits.maxNodes} as const;`,
   `export const PLUGIN_WIRE_MAX_SAFE_INTEGER = ${wireIntegerLimits.maxSafeInteger} as const;`,
   `export const PLUGIN_RPC_MAX_JSON_BYTES = ${rpcLimits.maxJsonBytes} as const;`,
+  `export const PLUGIN_HOST_INTERACTION_LIMITS = ${JSON.stringify(hostInteractionLimits)} as const;`,
   `export const PLUGIN_RPC_ERROR_CODES = ${JSON.stringify(rpcErrorCodes)} as const;`,
   `export const PLUGIN_STREAM_MAX_ID_LENGTH = ${streamLimits.maxStreamIdLength} as const;`,
   `export const PLUGIN_STREAM_MAX_CHUNK_BYTES = ${streamLimits.maxChunkBytes} as const;`,