docs(test): isolate the KI smoke app profile

Clearing identityId left a different host username next to the new
password. Copy the identity username onto the host whenever it is
non-empty, matching the vault password detach.

Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>

.github/workflows/test.yml

@@ -49,12 +49,6 @@ jobs:
       - name: Verify Codex App Server schema
         run: npm run check:codex-app-server-schema
 
-      - name: Verify plugin contract and runtime boundaries
-        run: |
-          npm run check:plugin-contract
-          npm run test:plugin-runtime
-          node --test --import tsx components/settings/tabs/Plugin*.test.tsx
-
       - name: Test
         run: npm test
 

AGENTS.md

@@ -106,13 +106,10 @@ Placement rules (`resolveAgentKinds` in `toolSurfaces.cjs`):
 
 **Harness domain (`catalog/harness.cjs`):** Catty executes these locally in `capabilityTools.executeLocalCattyCapability`. The read-only `harness.terminal.read_context` also exposes `netcatty/readContext` to MCP, with scope validation before and after the existing renderer bridge call. It reuses the sidebar reader through the screen snapshot registry (80 rows by default, maximum 300); no script or command runs. Other harness tools remain Catty-only. `harness.web.search` is omitted when web search is not configured.
 
-## Plugin host runtime
+## Plugin host runtime (internal preview)
 
-The plugin host under `electron/plugins/` exposes browser-only packages in normal
-Settings. `NETCATTY_PLUGIN_DEV=1` admits advanced development packages, without
-granting their permissions. Admission and default placement share
-`domain/pluginRuntimePolicy.cjs`; permission explanations shared with native
-prompts live in `domain/pluginPermissionDescriptions.cjs`. Public wire and package
+The phase-2 plugin host lives under `electron/plugins/` and is disabled unless
+`NETCATTY_PLUGIN_DEV=1` is present at application launch. Public wire and package
 types still come only from `packages/plugin-contract/schema/`; do not add a
 second private RPC shape when extending the host.
 

App.tsx

@@ -12,7 +12,6 @@ import { ToastProvider } from './components/ui/toast';
 import { TooltipProvider } from './components/ui/tooltip';
 import { ScriptAutomationRoot } from './components/scripts/ScriptAutomationRoot';
 import { ExternalMcpApprovalsHost } from './components/ai/ExternalMcpApprovalsHost';
-import { PluginHostInteractionHost } from './components/plugins/PluginHostInteractionHost';
 import { PluginAuthenticationHost } from './components/plugins/PluginAuthenticationHost';
 import { MultilinePasteConfirmHost } from './components/terminal/MultilinePasteConfirmDialog';
 import { useExternalMcpGrantPersister } from './components/ai/useExternalMcpGrantPersister';
@@ -87,7 +86,6 @@ function AppWithProviders({ settings, appLock }: { settings: SettingsState; appL
               <ScriptAutomationRoot />
               <ExternalMcpApprovalsHost />
               <PluginAuthenticationHost />
-              <PluginHostInteractionHost />
               <MultilinePasteConfirmHost />
               <VaultPublisher>
                 <SessionPublisher persistSessionRestore={!isPeerSessionWindow}>

application/AppHandlers.connect.test.ts

@@ -7,8 +7,9 @@ import {
   handleKeyboardInteractiveSubmitImpl,
   handleTrayPanelConnectRequestImpl,
 } from './app/AppHandlers.ts';
+import { resolveHostAuth } from '../domain/sshAuth.ts';
 import { resolveShellSetting } from '../lib/useDiscoveredShells.ts';
-import type { Host } from '../types';
+import type { Host, Identity } from '../types';
 
 const baseHost: Host = {
   id: 'host-1',
@@ -194,6 +195,219 @@ test('keyboard-interactive submit can save login password for the session host',
   assert.equal(bridgeResponses.length, 1);
 });
 
+test('keyboard-interactive submit detaches keychain identity when remembering a password change', async () => {
+  const sharedIdentity: Identity = {
+    id: 'id-1',
+    label: 'shared',
+    username: 'root',
+    authMethod: 'password',
+    password: 'stale-keychain-password',
+    created: 0,
+  };
+  let hosts: Host[] = [{
+    ...baseHost,
+    identityId: 'id-1',
+    password: 'old-host-password',
+    savePassword: false,
+  }];
+  let queue = [{
+    requestId: 'ki-rotate',
+    sessionId: 'session-1',
+    hostname: baseHost.hostname,
+    allowSavePassword: true,
+  }];
+  let identityUpdates = 0;
+
+  // resolveHostAuth prefers identity.password, so the stale keychain secret
+  // shadows whatever is already stored on the host.
+  assert.equal(
+    resolveHostAuth({ host: hosts[0], keys: [], identities: [sharedIdentity] }).password,
+    'stale-keychain-password',
+  );
+
+  await handleKeyboardInteractiveSubmitImpl(
+    () => ({
+      hosts,
+      identities: [sharedIdentity],
+      keyboardInteractiveQueue: queue,
+      netcattyBridge: {
+        get: () => ({
+          respondKeyboardInteractive: () => ({ success: true }),
+        }),
+      },
+      sessions: [{
+        id: 'session-1',
+        hostId: baseHost.id,
+        hostname: baseHost.hostname,
+      }],
+      setKeyboardInteractiveQueue: (updater: (items: typeof queue) => typeof queue) => {
+        queue = updater(queue);
+      },
+      t: (key: string) => key,
+      toast: { error: () => {} },
+      updateHosts: (nextHosts: Host[]) => {
+        hosts = nextHosts;
+      },
+      updateIdentities: () => {
+        identityUpdates += 1;
+      },
+    }),
+    'ki-rotate',
+    ['rotated-password'],
+    'rotated-password',
+  );
+
+  assert.equal(hosts[0].identityId, '');
+  assert.equal(hosts[0].password, 'rotated-password');
+  assert.equal(hosts[0].savePassword, true);
+  assert.equal(hosts[0].username, baseHost.username);
+  assert.equal(identityUpdates, 0);
+  assert.equal(sharedIdentity.password, 'stale-keychain-password');
+  assert.equal(
+    resolveHostAuth({ host: hosts[0], keys: [], identities: [sharedIdentity] }).password,
+    'rotated-password',
+  );
+  assert.deepEqual(queue, []);
+});
+
+test('keyboard-interactive submit snapshots a different keychain username when remembering a password', async () => {
+  const sharedIdentity: Identity = {
+    id: 'id-1',
+    label: 'shared',
+    username: 'deploy',
+    authMethod: 'password',
+    password: 'stale-keychain-password',
+    created: 0,
+  };
+  let hosts: Host[] = [{
+    ...baseHost,
+    username: 'root',
+    identityId: 'id-1',
+    password: 'old-host-password',
+    savePassword: false,
+  }];
+  let queue = [{
+    requestId: 'ki-rotate-user',
+    sessionId: 'session-1',
+    hostname: baseHost.hostname,
+    allowSavePassword: true,
+  }];
+  let identityUpdates = 0;
+
+  await handleKeyboardInteractiveSubmitImpl(
+    () => ({
+      hosts,
+      identities: [sharedIdentity],
+      keyboardInteractiveQueue: queue,
+      netcattyBridge: {
+        get: () => ({
+          respondKeyboardInteractive: () => ({ success: true }),
+        }),
+      },
+      sessions: [{
+        id: 'session-1',
+        hostId: baseHost.id,
+        hostname: baseHost.hostname,
+      }],
+      setKeyboardInteractiveQueue: (updater: (items: typeof queue) => typeof queue) => {
+        queue = updater(queue);
+      },
+      t: (key: string) => key,
+      toast: { error: () => {} },
+      updateHosts: (nextHosts: Host[]) => {
+        hosts = nextHosts;
+      },
+      updateIdentities: () => {
+        identityUpdates += 1;
+      },
+    }),
+    'ki-rotate-user',
+    ['new-password'],
+    'new-password',
+  );
+
+  assert.equal(hosts[0].identityId, '');
+  assert.equal(hosts[0].password, 'new-password');
+  assert.equal(hosts[0].savePassword, true);
+  assert.equal(hosts[0].username, 'deploy');
+  assert.equal(identityUpdates, 0);
+  assert.equal(sharedIdentity.username, 'deploy');
+  assert.equal(sharedIdentity.password, 'stale-keychain-password');
+  const resolved = resolveHostAuth({ host: hosts[0], keys: [], identities: [sharedIdentity] });
+  assert.equal(resolved.password, 'new-password');
+  assert.equal(resolved.username, 'deploy');
+  assert.deepEqual(queue, []);
+});
+
+test('keyboard-interactive submit fills a blank host username from the keychain identity', async () => {
+  const sharedIdentity: Identity = {
+    id: 'id-1',
+    label: 'shared',
+    username: 'alice',
+    authMethod: 'password',
+    password: 'stale-keychain-password',
+    created: 0,
+  };
+  let hosts: Host[] = [{
+    ...baseHost,
+    username: '',
+    identityId: 'id-1',
+    password: 'old-host-password',
+    savePassword: false,
+  }];
+  let queue = [{
+    requestId: 'ki-blank-user',
+    sessionId: 'session-1',
+    hostname: baseHost.hostname,
+    allowSavePassword: true,
+  }];
+  let identityUpdates = 0;
+
+  await handleKeyboardInteractiveSubmitImpl(
+    () => ({
+      hosts,
+      identities: [sharedIdentity],
+      keyboardInteractiveQueue: queue,
+      netcattyBridge: {
+        get: () => ({
+          respondKeyboardInteractive: () => ({ success: true }),
+        }),
+      },
+      sessions: [{
+        id: 'session-1',
+        hostId: baseHost.id,
+        hostname: baseHost.hostname,
+      }],
+      setKeyboardInteractiveQueue: (updater: (items: typeof queue) => typeof queue) => {
+        queue = updater(queue);
+      },
+      t: (key: string) => key,
+      toast: { error: () => {} },
+      updateHosts: (nextHosts: Host[]) => {
+        hosts = nextHosts;
+      },
+      updateIdentities: () => {
+        identityUpdates += 1;
+      },
+    }),
+    'ki-blank-user',
+    ['new-password'],
+    'new-password',
+  );
+
+  assert.equal(hosts[0].identityId, '');
+  assert.equal(hosts[0].username, 'alice');
+  assert.equal(hosts[0].password, 'new-password');
+  assert.equal(hosts[0].savePassword, true);
+  assert.equal(identityUpdates, 0);
+  assert.equal(sharedIdentity.username, 'alice');
+  assert.equal(sharedIdentity.password, 'stale-keychain-password');
+  const resolved = resolveHostAuth({ host: hosts[0], keys: [], identities: [sharedIdentity] });
+  assert.equal(resolved.password, 'new-password');
+  assert.equal(resolved.username, 'alice');
+  assert.deepEqual(queue, []);
+});
+
 test('keyboard-interactive submit does not save secondary password when allowSavePassword is false', async () => {
   let hosts: Host[] = [{
     ...baseHost,

application/app/AppHandlers.ts

@@ -393,6 +393,7 @@ export async function handleKeyboardInteractiveSubmitImpl(
   const {
     hosts,
     hostsRef,
+    identities,
     keyboardInteractiveQueue,
     sessions,
     setKeyboardInteractiveQueue,
@@ -424,12 +425,27 @@ export async function handleKeyboardInteractiveSubmitImpl(
     // Save password to host if requested - never for second-factor / EDR prompts
     // (allowSavePassword === false) so a secondary secret cannot overwrite the
     // host login password (#2150 / Codex review on #2151).
+    // Detach a Keychain identity when one is attached. resolveHostAuth prefers
+    // identity.password and identity.username, so snapshot the identity username
+    // onto the host before clearing identityId (#3982). Same as
+    // applyVaultHostUpdate's password detach. Do not mutate the identity.
     if (savePassword && host && request?.allowSavePassword !== false) {
-      updateHosts(latestHosts.map((h: Host) => h.id === host.id ? {
-        ...h,
-        password: savePassword,
-        savePassword: true,
-      } : h));
+      updateHosts(latestHosts.map((h: Host) => {
+        if (h.id !== host.id) return h;
+        const identity = h.identityId
+          ? identities?.find((item: { id?: string; username?: string }) => item.id === h.identityId)
+          : undefined;
+        const detachedUsername = identity?.username?.trim();
+        return {
+          ...h,
+          password: savePassword,
+          savePassword: true,
+          ...(h.identityId ? {
+            identityId: '',
+            ...(detachedUsername ? { username: detachedUsername } : {}),
+          } : {}),
+        };
+      }));
     }
     // Remove from queue by requestId
     setKeyboardInteractiveQueue(prev => prev.filter(r => r.requestId !== requestId));

application/app/AppSideEffects.tsx

@@ -716,7 +716,7 @@ export function AppSideEffects() {
   }, [isVaultInitialized, pendingTrayPanelConnectHostIds]);
 
   // Handle keyboard-interactive submit
-  const handleKeyboardInteractiveSubmit = useCallback((requestId: string, responses: string[], savePassword?: string) => { return handleKeyboardInteractiveSubmitImpl(() => ({ hosts, hostsRef, keyboardInteractiveQueue, netcattyBridge, requestId, responses, savePassword, sessions, setKeyboardInteractiveQueue, t, toast, updateHosts }), requestId, responses, savePassword); }, [keyboardInteractiveQueue, sessions, hosts, t, updateHosts]);
+  const handleKeyboardInteractiveSubmit = useCallback((requestId: string, responses: string[], savePassword?: string) => { return handleKeyboardInteractiveSubmitImpl(() => ({ hosts, hostsRef, identities, keyboardInteractiveQueue, netcattyBridge, requestId, responses, savePassword, sessions, setKeyboardInteractiveQueue, t, toast, updateHosts }), requestId, responses, savePassword); }, [identities, keyboardInteractiveQueue, sessions, hosts, t, updateHosts]);
 
   // Handle keyboard-interactive cancel
   const handleKeyboardInteractiveCancel = useCallback((requestId: string) => { return handleKeyboardInteractiveCancelImpl(() => ({ netcattyBridge, requestId, setKeyboardInteractiveQueue, t, toast }), requestId); }, [t]);

application/app/AppView.tsx

@@ -167,8 +167,7 @@ function AppPluginKeybindingThemeHost({
   sessions: any[];
   workspaces: any[];
 }) {
-  // View environment is global in the current host: publish committed colors only.
-  const appThemeStyle = useAppThemeStyle(false);
+  const appThemeStyle = useAppThemeStyle();
   const { resolvedTheme, uiLanguage } = useSettingsChromeStore();
   const pluginThemeTokens = useMemo(
     () => selectPluginThemeTokens(appThemeStyle as Record<string, unknown>),

application/app/useAppThemeStyle.ts

@@ -1,4 +1,3 @@
-import { usePluginThemeRevision } from '../state/usePluginThemeRuntime';
 import type React from 'react';
 import { useMemo } from 'react';
 
@@ -13,20 +12,17 @@ import { getUiThemeById } from '../../infrastructure/config/uiThemes';
  * settingsChromeStore so accent drags only re-render the leaf that applies the
  * vars, never the App shell.
  */
-export function useAppThemeStyle(includePreview = true): React.CSSProperties {
-  const pluginThemeRevision = usePluginThemeRevision();
+export function useAppThemeStyle(): React.CSSProperties {
   const { accentMode, customAccent } = useAppearanceChromeStore();
   const { resolvedTheme, darkUiThemeId, lightUiThemeId } = useSettingsChromeStore();
   return useMemo(() => {
-    void pluginThemeRevision; // getUiThemeById reads this external registry revision.
     const tokens = getUiThemeById(
       resolvedTheme,
       resolvedTheme === 'dark' ? darkUiThemeId : lightUiThemeId,
-      includePreview,
     ).tokens;
     return {
       ...buildAppThemeCssVars(tokens, accentMode, customAccent),
       colorScheme: resolvedTheme,
     } as React.CSSProperties;
-  }, [accentMode, customAccent, darkUiThemeId, lightUiThemeId, resolvedTheme, pluginThemeRevision, includePreview]);
+  }, [accentMode, customAccent, darkUiThemeId, lightUiThemeId, resolvedTheme]);
 }

application/i18n/locales/en/core.ts

@@ -1235,123 +1235,8 @@ Highlight the focused split pane:
   'deepLink.jms.invalid': 'Invalid JumpServer link',
   'deepLink.jms.unsupported': 'Unsupported JumpServer protocol: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
-  "settings.plugins.manager.installed": "Installed plugins",
-  "settings.plugins.manager.import": "Import .ncpkg",
-  "settings.plugins.manager.preview": "Imported packages stay disabled until you review and enable them.",
-  "settings.plugins.manager.empty": "Import a local plugin package to get started.",
-  "settings.plugins.manager.enabled": "Enabled",
-  "settings.plugins.manager.disabled": "Disabled",
-  "settings.plugins.manager.enable": "Enable",
-  "settings.plugins.manager.disable": "Disable",
-  "settings.plugins.manager.remove": "Uninstall",
-  "settings.plugins.manager.removeNote": "Uninstall removes package code and local KV data. User-owned settings, secrets and sync sidecars are retained.",
-  "settings.plugins.permissions.statusUnknown": "Status unknown",
-  "plugins.sidebar.extensions": "Extension pages",
-  "plugins.sidebar.selectTerminal": "Select an open terminal first.",
-  "plugins.sidebar.loading": "Loading extension page…",
-  "plugins.vault.loading": "Loading plugin page…",
-  "plugins.vault.extensions": "Extensions",
-  "plugins.vault.back": "Back to hosts",
-  "plugins.interaction.title": "Plugin request",
-  "plugins.interaction.sharing": "Text you share becomes available to this plugin and its granted capabilities, including network access. Reading does not approve a new network destination.",
-  "plugins.interaction.input": "Input text",
-  "plugins.interaction.filter": "Filter choices",
-  "plugins.interaction.preview": "Preview clipboard",
-  "plugins.interaction.previewNote": "The clipboard is read only after you choose Preview. You can then inspect the text and separately confirm sharing it.",
-  "plugins.interaction.previewAction": "Preview clipboard",
-  "plugins.interaction.share": "Share with plugin",
-  "plugins.interaction.copy": "Copy to clipboard",
-  "plugins.interaction.failed": "This request expired or could not be completed.",
-  "settings.plugins.permissions.current": "Matches the current activation",
-  "settings.plugins.permissions.inactive": "Inactive for the current activation",
-  "settings.plugins.permissions.title": "Saved grants",
-  "settings.plugins.permissions.refresh": "Refresh",
-  "settings.plugins.permissions.loading": "Loading grants...",
-  "settings.plugins.permissions.empty": "No saved grants. One-use decisions are not retained.",
-  "settings.plugins.permissions.always": "Until revoked",
-  "settings.plugins.permissions.application": "Until Netcatty exits",
-  "settings.plugins.permissions.session": "Until the session closes",
-  "settings.plugins.permissions.audit": "Recent security events (up to 100)",
-  "settings.plugins.permissions.revoke": "Disable and revoke all grants",
-  "settings.plugins.permissions.revokeNote": "This disables the plugin, cancels its work, and removes saved grants. Enable it again to request new access.",
-  "settings.plugins.permissions.unavailable": "Plugin permission management is unavailable",
-  "settings.plugins.manager.permissions": "Declared permissions",
-  "settings.plugins.manager.permissionNote": "From the manifest, not a grant. Enabled allows lazy activation; required permissions are requested before first activation and optional permissions when used. Sensitive operations still pass host checks.",
-  "settings.plugins.manager.noPermissions": "No privileged permissions declared.",
-  "settings.plugins.manager.required": "Required",
-  "settings.plugins.manager.optional": "Optional",
-  "settings.plugins.themes.title": "Plugin themes",
-  "settings.plugins.themes.description": "Preview changes only this window. Apply saves this device’s selection. Personal accent, fonts and terminal overrides stay in control.",
-  "settings.plugins.themes.empty": "No enabled plugin themes for this mode.",
-  "settings.plugins.themes.choose": "Choose a theme",
-  "settings.plugins.themes.unavailable": "Saved theme unavailable; using the host default",
-  "settings.plugins.themes.applied": "Applied",
-  "settings.plugins.themes.preview": "Preview",
-  "settings.plugins.themes.apply": "Apply",
-  "settings.plugins.themes.cancel": "Cancel preview",
-  "settings.plugins.themes.restore": "Restore default",
-  "settings.plugins.themes.invalid": "Some theme palettes were rejected or unavailable.",
-  "settings.plugins.themes.failed": "Could not apply theme.",
-  "settings.plugins.manager.dataTheme": "Theme pack: validated colors, no executable runtime.",
-  "settings.plugins.manager.browser": "Browser runtime: privileged access goes through host permission brokers.",
-  "settings.plugins.manager.advanced": "Advanced runtime: full Node filesystem and network authority. Broker permissions cannot restrict this access. Development preview only.",
-  "settings.plugins.manager.data": "Local KV stays on this device. Only non-secret settings explicitly marked for sync participate in encrypted cloud sidecars. Packages and permission grants do not sync.",
-  "settings.plugins.market.results": "{count} plugins",
-  "settings.plugins.manager.lastError": "Last recorded error",
-  "settings.plugins.sources.offline": "Source unavailable. If a previously validated catalog exists for this source, it remains available for browsing only. Installation is unavailable until refresh succeeds.",
-  "settings.plugins.sources.note": "This catalog is provided by the selected third party, not curated by Netcatty. Review the source domain and permissions before installing. Updates are manual.",
-  "settings.plugins.sources.sourceOnly": "Source-only entry from this provider. No downloadable package is available; review the author’s build and import instructions.",
-  "settings.plugins.market.offline": "Registry unavailable. Showing the last valid catalog or bundled examples. Installation is unavailable until refresh succeeds.",
-  "settings.plugins.manager.details": "View details",
-  "settings.plugins.manager.noDescription": "No description provided.",
-  "settings.plugins.status": "Notices: {count}",
-  "settings.plugins.info": "Plugin information",
-  "settings.plugins.manager.noVaultShort": "Secret storage unavailable",
-  "settings.plugins.market.offlineShort": "Offline catalog · installation unavailable",
-  "settings.plugins.market.readmeInfo": "About this README",
-  "settings.plugins.market.installed": "Installed",
-  "settings.plugins.market.sourceBadge": "Source example",
-  "settings.plugins.market.title": "Marketplace",
-  "settings.plugins.market.note": "Curated open-source plugins. Review is not a security certification. Updates are manual.",
-  "settings.plugins.market.back": "All plugins",
-  "settings.plugins.market.install": "Install this version (disabled)",
-  "settings.plugins.market.installNote": "This replaces and stops the installed version. Review its permissions in Installed plugins before enabling.",
-  "settings.plugins.market.sourceOnly": "First-party source example. Build with the local CLI and import the .ncpkg; no downloadable release has been published.",
-  "settings.plugins.market.readmeNote": "Pinned to the commit above. HTML is inert and remote images are not loaded. Written by the plugin author.",
-  "settings.plugins.manager.noVault": "System key storage is unavailable. Secret and credential operations are blocked; browsing and non-secret plugins still work.",
-  "settings.plugins.manager.sensitive": "Sensitive access: review the data and resource scope before granting.",
-  "settings.plugins.manager.dual": "Browser is the default runtime. This package also includes a Node entrypoint with full device authority; developer mode only.",
-  "settings.plugins.manager.advancedDeclaration": "Browser entrypoint with advanced permission declarations. Not eligible for normal browser-only mode; review every declared permission.",
-  "settings.plugins.market.retry": "Retry",
-  "settings.plugins.market.empty": "No catalog entries are available. You can still import a local browser plugin.",
-  "settings.plugins.market.emptyReadme": "This README is empty.",
-  "settings.plugins.market.search": "Search name, author or description",
-  "settings.plugins.market.noResults": "No matching plugins. Try another search.",
-  "settings.plugins.market.manifest": "Compatibility and permissions",
-  "settings.plugins.manager.unbounded": "No narrower resource scope is declared. Check the actual scope in the permission prompt.",
-  "settings.plugins.openView": "Open",
-  "settings.plugins.openManager": "Open plugin manager",
-  "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
-  "settings.plugins.sources.clearPrivate": "Also clear this source’s private data, grants and secrets to reinstall from another source. This cannot be undone.",
-  "settings.plugins.sources.official": "Official marketplace",
-  "settings.plugins.sources.thirdparty": "Third-party marketplace",
-  "settings.plugins.sources.manage": "Manage sources",
-  "settings.plugins.sources.select": "Select a source",
-  "settings.plugins.sources.empty": "Choose or add a third-party source.",
-  "settings.plugins.sources.add": "Add source",
-  "settings.plugins.sources.remove": "Remove source",
-  "settings.plugins.sources.name": "Source name",
-  "settings.plugins.sources.address": "HTTPS source address",
-  "settings.plugins.sources.risk": "Third-party sources are not maintained or endorsed by Netcatty. Review the real domain, package permissions and author before installing.",
-  "settings.plugins.sources.accept": "I trust this domain to supply plugin metadata and packages. This does not grant plugin permissions.",
-  "settings.plugins.sources.removeNote": "Installed plugins and their data remain. Updates from this source stop; another source will not replace it.",
-  "settings.plugins.sources.disablePlugins": "Also disable plugins installed from this source",
-  "settings.plugins.sources.installConfirm": "Review third-party installation",
-  "settings.plugins.sources.source": "Source",
-  "settings.plugins.sources.local": "Local import",
-  "settings.plugins.sources.all": "All sources",
-  "settings.plugins.title": "Plugins",
-  "settings.plugins.description": "Manage your plugins and explore the catalog.",
+  'settings.plugins.title': 'Plugin settings',
+  'settings.plugins.description': 'Native, validated settings contributed by development plugins.',
   'settings.plugins.loading': 'Loading plugin settings…',
   'settings.plugins.empty': 'No enabled plugin contributes settings.',
   'settings.plugins.scopeContext': 'Open this setting in its {scope} context.',

application/i18n/locales/es/core.ts

@@ -1235,123 +1235,8 @@ Resalta el panel dividido enfocado:
   'deepLink.jms.invalid': 'Enlace JumpServer inválido',
   'deepLink.jms.unsupported': 'Protocolo JumpServer no compatible: {{protocol}}',
   'settings.tab.plugins': 'Plugins',
-  "settings.plugins.manager.installed": "Plugins instalados",
-  "settings.plugins.manager.import": "Importar .ncpkg",
-  "settings.plugins.manager.preview": "Los paquetes importados permanecen desactivados hasta que los revises y actives.",
-  "settings.plugins.manager.empty": "Importa un paquete local para empezar.",
-  "settings.plugins.manager.enabled": "Activado",
-  "settings.plugins.manager.disabled": "Desactivado",
-  "settings.plugins.manager.enable": "Activar",
-  "settings.plugins.manager.disable": "Desactivar",
-  "settings.plugins.manager.remove": "Desinstalar",
-  "settings.plugins.manager.removeNote": "La desinstalación elimina el código y los datos KV locales. Se conservan los ajustes del usuario, los secretos y los datos auxiliares de sincronización.",
-  "settings.plugins.permissions.statusUnknown": "Estado desconocido",
-  "plugins.sidebar.extensions": "Páginas de extensiones",
-  "plugins.sidebar.selectTerminal": "Selecciona primero un terminal abierto.",
-  "plugins.sidebar.loading": "Cargando página de extensión…",
-  "plugins.vault.loading": "Cargando página del plugin…",
-  "plugins.vault.extensions": "Extensiones",
-  "plugins.vault.back": "Volver a hosts",
-  "plugins.interaction.title": "Solicitud de complemento",
-  "plugins.interaction.sharing": "El texto compartido estará disponible para este complemento y sus capacidades autorizadas, incluida la red. Leer no autoriza un nuevo destino de red.",
-  "plugins.interaction.input": "Introducir texto",
-  "plugins.interaction.filter": "Filtrar opciones",
-  "plugins.interaction.preview": "Vista previa del portapapeles",
-  "plugins.interaction.previewNote": "El portapapeles se lee al elegir Vista previa. Revise el texto y confirme por separado que desea compartirlo.",
-  "plugins.interaction.previewAction": "Vista previa del portapapeles",
-  "plugins.interaction.share": "Compartir con el complemento",
-  "plugins.interaction.copy": "Copiar al portapapeles",
-  "plugins.interaction.failed": "La solicitud caducó o no pudo completarse.",
-  "settings.plugins.permissions.current": "Coincide con la ejecución actual",
-  "settings.plugins.permissions.inactive": "No activa para la ejecución actual",
-  "settings.plugins.permissions.title": "Autorizaciones guardadas",
-  "settings.plugins.permissions.refresh": "Actualizar",
-  "settings.plugins.permissions.loading": "Cargando autorizaciones...",
-  "settings.plugins.permissions.empty": "No hay autorizaciones guardadas. Las decisiones de un solo uso no se conservan.",
-  "settings.plugins.permissions.always": "Hasta su revocación",
-  "settings.plugins.permissions.application": "Hasta cerrar Netcatty",
-  "settings.plugins.permissions.session": "Hasta cerrar la sesión",
-  "settings.plugins.permissions.audit": "Eventos de seguridad recientes (hasta 100)",
-  "settings.plugins.permissions.revoke": "Desactivar y revocar todas las autorizaciones",
-  "settings.plugins.permissions.revokeNote": "Desactiva el complemento, cancela su trabajo y elimina las autorizaciones guardadas. Actívelo para solicitar acceso de nuevo.",
-  "settings.plugins.permissions.unavailable": "La gestión de permisos no está disponible",
-  "settings.plugins.manager.permissions": "Permisos declarados",
-  "settings.plugins.manager.permissionNote": "Del manifiesto, no es una autorización. Activado permite la activación diferida; los permisos obligatorios se solicitan antes del primer uso y los opcionales cuando se necesitan. Las operaciones sensibles siguen verificándose.",
-  "settings.plugins.manager.noPermissions": "No se han declarado permisos privilegiados.",
-  "settings.plugins.manager.required": "Obligatorio",
-  "settings.plugins.manager.optional": "Opcional",
-  "settings.plugins.themes.title": "Temas de plugins",
-  "settings.plugins.themes.description": "La vista previa solo cambia esta ventana. Aplicar guarda la selección en este dispositivo. Se conservan los ajustes personales.",
-  "settings.plugins.themes.empty": "No hay temas habilitados para este modo.",
-  "settings.plugins.themes.choose": "Elegir tema",
-  "settings.plugins.themes.unavailable": "Tema guardado no disponible; se usa el predeterminado",
-  "settings.plugins.themes.applied": "Aplicado",
-  "settings.plugins.themes.preview": "Vista previa",
-  "settings.plugins.themes.apply": "Aplicar",
-  "settings.plugins.themes.cancel": "Cancelar vista previa",
-  "settings.plugins.themes.restore": "Restaurar predeterminado",
-  "settings.plugins.themes.invalid": "Algunas paletas no están disponibles o no son válidas.",
-  "settings.plugins.themes.failed": "No se pudo aplicar el tema.",
-  "settings.plugins.manager.dataTheme": "Paquete de temas: colores validados, sin ejecución de código.",
-  "settings.plugins.manager.browser": "Entorno de navegador: el acceso privilegiado pasa por los controles de permisos del anfitrión.",
-  "settings.plugins.manager.advanced": "Entorno avanzado: acceso completo de Node al sistema de archivos y a la red. Los permisos del intermediario no restringen este acceso. Solo para desarrollo.",
-  "settings.plugins.manager.data": "Los datos KV permanecen en este dispositivo. Solo los ajustes no secretos marcados para sincronización participan en los datos auxiliares cifrados. Los paquetes y las autorizaciones no se sincronizan.",
-  "settings.plugins.market.results": "{count} plugins",
-  "settings.plugins.manager.lastError": "Último error registrado",
-  "settings.plugins.sources.offline": "Fuente no disponible. Si existe un catálogo validado en caché de esta fuente, solo se permite consultarlo. La instalación no estará disponible hasta que se actualice correctamente.",
-  "settings.plugins.sources.note": "Este catálogo lo proporciona el tercero seleccionado; Netcatty no lo selecciona ni revisa. Comprueba el dominio y los permisos antes de instalar. Las actualizaciones son manuales.",
-  "settings.plugins.sources.sourceOnly": "Entrada de código fuente de este proveedor. No hay un paquete descargable; consulta las instrucciones de compilación e importación del autor.",
-  "settings.plugins.market.offline": "El registro no está disponible. Se muestra el último catálogo válido o los ejemplos incluidos. La instalación requiere una actualización correcta.",
-  "settings.plugins.manager.details": "Ver detalles",
-  "settings.plugins.manager.noDescription": "No se proporcionó una descripción.",
-  "settings.plugins.status": "{count} avisos",
-  "settings.plugins.info": "Información de plugins",
-  "settings.plugins.manager.noVaultShort": "Almacenamiento de secretos no disponible",
-  "settings.plugins.market.offlineShort": "Catálogo sin conexión · instalación no disponible",
-  "settings.plugins.market.readmeInfo": "Acerca de este README",
-  "settings.plugins.market.installed": "Instalado",
-  "settings.plugins.market.sourceBadge": "Ejemplo de código",
-  "settings.plugins.market.title": "Catálogo",
-  "settings.plugins.market.note": "Plugins de código abierto seleccionados. La revisión no certifica su seguridad. Las actualizaciones son manuales.",
-  "settings.plugins.market.back": "Todos los plugins",
-  "settings.plugins.market.install": "Instalar esta versión (desactivada)",
-  "settings.plugins.market.installNote": "Esto reemplaza y detiene la versión instalada. Revisa sus permisos antes de activarla.",
-  "settings.plugins.market.sourceOnly": "Ejemplo propio con código fuente. Compílalo con la CLI local e importa el .ncpkg; no hay versión publicada para descargar.",
-  "settings.plugins.market.readmeNote": "Fijado al commit indicado. El HTML no se ejecuta y las imágenes remotas no se cargan. Contenido del autor.",
-  "settings.plugins.manager.noVault": "El almacén de claves del sistema no está disponible. Se bloquean secretos y credenciales; el catálogo y los plugins que no los usan siguen disponibles.",
-  "settings.plugins.manager.sensitive": "Acceso sensible: revisa los datos y el alcance antes de autorizar.",
-  "settings.plugins.manager.dual": "El navegador es la opción predeterminada. El paquete también incluye una entrada Node con acceso completo al dispositivo; solo para desarrollo.",
-  "settings.plugins.manager.advancedDeclaration": "Entrada de navegador con permisos avanzados declarados. No se admite en el modo normal; revisa cada permiso.",
-  "settings.plugins.market.retry": "Reintentar",
-  "settings.plugins.market.empty": "No hay entradas en el catálogo. Puedes importar un plugin local de navegador.",
-  "settings.plugins.market.emptyReadme": "Este README está vacío.",
-  "settings.plugins.market.search": "Buscar nombre, autor o descripción",
-  "settings.plugins.market.noResults": "No hay plugins coincidentes. Prueba otra búsqueda.",
-  "settings.plugins.market.manifest": "Compatibilidad y permisos",
-  "settings.plugins.manager.unbounded": "No se declara un alcance de recursos más limitado. Revisa el alcance real en la solicitud de permiso.",
-  "settings.plugins.openView": "Abrir",
-  "settings.plugins.openManager": "Abrir gestor de plugins",
-  "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
-  "settings.plugins.sources.clearPrivate": "Also clear this source’s private data, grants and secrets to reinstall from another source. This cannot be undone.",
-  "settings.plugins.sources.official": "Official marketplace",
-  "settings.plugins.sources.thirdparty": "Third-party marketplace",
-  "settings.plugins.sources.manage": "Manage sources",
-  "settings.plugins.sources.select": "Select a source",
-  "settings.plugins.sources.empty": "Choose or add a third-party source.",
-  "settings.plugins.sources.add": "Add source",
-  "settings.plugins.sources.remove": "Remove source",
-  "settings.plugins.sources.name": "Source name",
-  "settings.plugins.sources.address": "HTTPS source address",
-  "settings.plugins.sources.risk": "Third-party sources are not maintained or endorsed by Netcatty. Review the real domain, package permissions and author before installing.",
-  "settings.plugins.sources.accept": "I trust this domain to supply plugin metadata and packages. This does not grant plugin permissions.",
-  "settings.plugins.sources.removeNote": "Installed plugins and their data remain. Updates from this source stop; another source will not replace it.",
-  "settings.plugins.sources.disablePlugins": "Also disable plugins installed from this source",
-  "settings.plugins.sources.installConfirm": "Review third-party installation",
-  "settings.plugins.sources.source": "Source",
-  "settings.plugins.sources.local": "Local import",
-  "settings.plugins.sources.all": "All sources",
-  "settings.plugins.title": "Plugins",
-  "settings.plugins.description": "Gestiona tus plugins y explora el catálogo.",
+  'settings.plugins.title': 'Configuración de plugins',
+  'settings.plugins.description': 'Ajustes nativos y validados que aportan los plugins de desarrollo.',
   'settings.plugins.loading': 'Cargando ajustes del plugin…',
   'settings.plugins.empty': 'Ningún plugin activado aporta ajustes.',
   'settings.plugins.scopeContext': 'Abre este ajuste en su contexto de {scope}.',

application/i18n/locales/ru/core.ts

@@ -1130,123 +1130,8 @@ export const ruCoreMessages: Messages = {
   'deepLink.jms.unsupported': 'Неподдерживаемый протокол JumpServer: {{protocol}}',
 
   'settings.tab.plugins': 'Плагины',
-  "settings.plugins.manager.installed": "Установленные плагины",
-  "settings.plugins.manager.import": "Импорт .ncpkg",
-  "settings.plugins.manager.preview": "Импортированные пакеты отключены до проверки и включения.",
-  "settings.plugins.manager.empty": "Импортируйте локальный пакет плагина.",
-  "settings.plugins.manager.enabled": "Включён",
-  "settings.plugins.manager.disabled": "Отключён",
-  "settings.plugins.manager.enable": "Включить",
-  "settings.plugins.manager.disable": "Отключить",
-  "settings.plugins.manager.remove": "Удалить",
-  "settings.plugins.manager.removeNote": "Удаление очищает код пакета и локальные данные KV. Настройки пользователя, секреты и данные синхронизации сохраняются.",
-  "settings.plugins.permissions.statusUnknown": "Состояние неизвестно",
-  "plugins.sidebar.extensions": "Страницы расширений",
-  "plugins.sidebar.selectTerminal": "Сначала выберите открытый терминал.",
-  "plugins.sidebar.loading": "Загрузка страницы расширения…",
-  "plugins.vault.loading": "Загрузка страницы плагина…",
-  "plugins.vault.extensions": "Расширения",
-  "plugins.vault.back": "К хостам",
-  "plugins.interaction.title": "Запрос плагина",
-  "plugins.interaction.sharing": "Переданный текст доступен плагину и его разрешённым возможностям, включая сеть. Чтение не разрешает новый сетевой адрес.",
-  "plugins.interaction.input": "Ввести текст",
-  "plugins.interaction.filter": "Фильтр вариантов",
-  "plugins.interaction.preview": "Предпросмотр буфера обмена",
-  "plugins.interaction.previewNote": "Буфер читается только после нажатия предпросмотра. Затем проверьте текст и отдельно подтвердите передачу.",
-  "plugins.interaction.previewAction": "Предпросмотр буфера обмена",
-  "plugins.interaction.share": "Передать плагину",
-  "plugins.interaction.copy": "Копировать в буфер обмена",
-  "plugins.interaction.failed": "Запрос истёк или не выполнен.",
-  "settings.plugins.permissions.current": "Соответствует текущему запуску",
-  "settings.plugins.permissions.inactive": "Не действует для текущего запуска",
-  "settings.plugins.permissions.title": "Сохранённые разрешения",
-  "settings.plugins.permissions.refresh": "Обновить",
-  "settings.plugins.permissions.loading": "Загрузка разрешений...",
-  "settings.plugins.permissions.empty": "Сохранённых разрешений нет. Одноразовые решения не сохраняются.",
-  "settings.plugins.permissions.always": "До отзыва",
-  "settings.plugins.permissions.application": "До выхода из Netcatty",
-  "settings.plugins.permissions.session": "До закрытия сеанса",
-  "settings.plugins.permissions.audit": "Последние события безопасности (до 100)",
-  "settings.plugins.permissions.revoke": "Отключить и отозвать все разрешения",
-  "settings.plugins.permissions.revokeNote": "Плагин будет отключён, его задачи отменены, а сохранённые разрешения удалены. Включите его для нового запроса доступа.",
-  "settings.plugins.permissions.unavailable": "Управление разрешениями недоступно",
-  "settings.plugins.manager.permissions": "Заявленные разрешения",
-  "settings.plugins.manager.permissionNote": "Из манифеста, а не предоставленные права. Включение допускает отложенную активацию; обязательные разрешения запрашиваются перед ней, необязательные — при использовании. Чувствительные операции проверяются приложением.",
-  "settings.plugins.manager.noPermissions": "Привилегированные разрешения не заявлены.",
-  "settings.plugins.manager.required": "Обязательно",
-  "settings.plugins.manager.optional": "Необязательно",
-  "settings.plugins.themes.title": "Темы плагинов",
-  "settings.plugins.themes.description": "Предпросмотр меняет только это окно. Применение сохраняет выбор на этом устройстве. Личные настройки сохраняются.",
-  "settings.plugins.themes.empty": "Нет включённых тем для этого режима.",
-  "settings.plugins.themes.choose": "Выберите тему",
-  "settings.plugins.themes.unavailable": "Сохранённая тема недоступна; используется стандартная палитра",
-  "settings.plugins.themes.applied": "Применено",
-  "settings.plugins.themes.preview": "Предпросмотр",
-  "settings.plugins.themes.apply": "Применить",
-  "settings.plugins.themes.cancel": "Отменить предпросмотр",
-  "settings.plugins.themes.restore": "Сбросить тему",
-  "settings.plugins.themes.invalid": "Некоторые палитры недоступны или отклонены.",
-  "settings.plugins.themes.failed": "Не удалось применить тему.",
-  "settings.plugins.manager.dataTheme": "Пакет тем: проверенные цвета без выполнения кода.",
-  "settings.plugins.manager.browser": "Браузерная среда: привилегированный доступ проходит через проверку разрешений приложения.",
-  "settings.plugins.manager.advanced": "Расширенная среда: полный доступ Node к файловой системе и сети. Разрешения посредника не ограничивают этот доступ. Только для разработки.",
-  "settings.plugins.manager.data": "Данные KV остаются на устройстве. Синхронизируются только явно отмеченные несекретные настройки в зашифрованных данных. Пакеты и разрешения не синхронизируются.",
-  "settings.plugins.market.results": "Плагинов: {count}",
-  "settings.plugins.manager.lastError": "Последняя записанная ошибка",
-  "settings.plugins.sources.offline": "Источник недоступен. Ранее проверенный каталог этого источника, если он есть в кэше, доступен только для просмотра. Установка недоступна до успешного обновления.",
-  "settings.plugins.sources.note": "Этот каталог предоставляет выбранная третья сторона; Netcatty не отбирает его содержимое. Перед установкой проверьте домен источника и разрешения. Обновления выполняются вручную.",
-  "settings.plugins.sources.sourceOnly": "Запись с исходным кодом от этого поставщика. Пакет для загрузки отсутствует; см. инструкции автора по сборке и импорту.",
-  "settings.plugins.market.offline": "Реестр недоступен. Показан последний корректный каталог или встроенные примеры. Для установки необходимо успешно обновить каталог.",
-  "settings.plugins.manager.details": "Подробнее",
-  "settings.plugins.manager.noDescription": "Описание не предоставлено.",
-  "settings.plugins.status": "Уведомления: {count}",
-  "settings.plugins.info": "Информация о плагинах",
-  "settings.plugins.manager.noVaultShort": "Хранилище секретов недоступно",
-  "settings.plugins.market.offlineShort": "Каталог офлайн · установка недоступна",
-  "settings.plugins.market.readmeInfo": "Об этом README",
-  "settings.plugins.market.installed": "Установлен",
-  "settings.plugins.market.sourceBadge": "Пример исходного кода",
-  "settings.plugins.market.title": "Каталог",
-  "settings.plugins.market.note": "Отобранные плагины с открытым кодом. Проверка не гарантирует безопасность. Обновления выполняются вручную.",
-  "settings.plugins.market.back": "Все плагины",
-  "settings.plugins.market.install": "Установить эту версию (отключённой)",
-  "settings.plugins.market.installNote": "Установленная версия будет заменена и остановлена. Проверьте разрешения перед включением.",
-  "settings.plugins.market.sourceOnly": "Пример из этого проекта. Соберите локальной CLI и импортируйте .ncpkg; готовый пакет для скачивания не опубликован.",
-  "settings.plugins.market.readmeNote": "Зафиксирован указанный коммит. HTML не выполняется, внешние изображения не загружаются. Текст автора плагина.",
-  "settings.plugins.manager.noVault": "Системное хранилище ключей недоступно. Операции с секретами и учётными данными заблокированы; каталог и плагины без секретов доступны.",
-  "settings.plugins.manager.sensitive": "Чувствительный доступ: проверьте данные и область ресурсов перед разрешением.",
-  "settings.plugins.manager.dual": "По умолчанию используется браузерная среда. Пакет также содержит вход Node с полным доступом к устройству; только для разработчиков.",
-  "settings.plugins.manager.advancedDeclaration": "Браузерная точка входа с заявленными расширенными разрешениями. Не допускается в обычном режиме; проверьте все разрешения.",
-  "settings.plugins.market.retry": "Повторить",
-  "settings.plugins.market.empty": "Каталог пуст. Можно импортировать локальный браузерный плагин.",
-  "settings.plugins.market.emptyReadme": "Этот README пуст.",
-  "settings.plugins.market.search": "Поиск по имени, автору или описанию",
-  "settings.plugins.market.noResults": "Совпадений нет. Измените запрос.",
-  "settings.plugins.market.manifest": "Совместимость и разрешения",
-  "settings.plugins.manager.unbounded": "Более узкая область ресурсов не заявлена. Проверьте фактическую область в запросе разрешения.",
-  "settings.plugins.openView": "Открыть",
-  "settings.plugins.openManager": "Открыть управление плагинами",
-  "settings.plugins.sources.conflict": "This ID is installed from another source. Uninstall and explicitly reset its private data before switching. Existing source:",
-  "settings.plugins.sources.clearPrivate": "Also clear this source’s private data, grants and secrets to reinstall from another source. This cannot be undone.",
-  "settings.plugins.sources.official": "Official marketplace",
-  "settings.plugins.sources.thirdparty": "Third-party marketplace",
-  "settings.plugins.sources.manage": "Manage sources",
-  "settings.plugins.sources.select": "Select a source",
-  "settings.plugins.sources.empty": "Choose or add a third-party source.",
-  "settings.plugins.sources.add": "Add source",
-  "settings.plugins.sources.remove": "Remove source",
-  "settings.plugins.sources.name": "Source name",
-  "settings.plugins.sources.address": "HTTPS source address",
-  "settings.plugins.sources.risk": "Third-party sources are not maintained or endorsed by Netcatty. Review the real domain, package permissions and author before installing.",
-  "settings.plugins.sources.accept": "I trust this domain to supply plugin metadata and packages. This does not grant plugin permissions.",
-  "settings.plugins.sources.removeNote": "Installed plugins and their data remain. Updates from this source stop; another source will not replace it.",
-  "settings.plugins.sources.disablePlugins": "Also disable plugins installed from this source",
-  "settings.plugins.sources.installConfirm": "Review third-party installation",
-  "settings.plugins.sources.source": "Source",
-  "settings.plugins.sources.local": "Local import",
-  "settings.plugins.sources.all": "All sources",
-  "settings.plugins.title": "Плагины",
-  "settings.plugins.description": "Управляйте плагинами и просматривайте каталог.",
+  'settings.plugins.title': 'Настройки плагинов',
+  'settings.plugins.description': 'Проверенные нативные настройки от плагинов разработки.',
   'settings.plugins.loading': 'Загрузка настроек плагинов…',
   'settings.plugins.empty': 'Включённые плагины не предоставляют настройки.',
   'settings.plugins.scopeContext': 'Откройте эту настройку в контексте {scope}.',

application/i18n/locales/zh-CN/core.ts

@@ -1150,123 +1150,8 @@ Vaults 标签保持扁平，不使用这块背景。
   'qs.localShells': '本地 Shell',
   'qs.default': '默认',
   'settings.tab.plugins': '插件',
-  "settings.plugins.manager.installed": "已安装插件",
-  "settings.plugins.manager.import": "导入 .ncpkg",
-  "settings.plugins.manager.preview": "导入的插件保持停用，请检查后再启用。",
-  "settings.plugins.manager.empty": "导入本地插件包以开始使用。",
-  "settings.plugins.manager.enabled": "已启用",
-  "settings.plugins.manager.disabled": "已停用",
-  "settings.plugins.manager.enable": "启用",
-  "settings.plugins.manager.disable": "停用",
-  "settings.plugins.manager.remove": "卸载",
-  "settings.plugins.manager.removeNote": "卸载会移除插件代码和本地 KV 数据，保留用户设置、秘密存储和同步 sidecar。",
-  "settings.plugins.permissions.statusUnknown": "状态未知",
-  "plugins.sidebar.extensions": "扩展页面",
-  "plugins.sidebar.selectTerminal": "请先选择已打开的终端。",
-  "plugins.sidebar.loading": "正在加载扩展页面…",
-  "plugins.vault.loading": "正在加载插件页面…",
-  "plugins.vault.extensions": "扩展",
-  "plugins.vault.back": "返回主机",
-  "plugins.interaction.title": "插件请求",
-  "plugins.interaction.sharing": "分享的文本将交给此插件及其已授权的能力（包括网络访问）。读取文本不代表批准新的网络目标。",
-  "plugins.interaction.input": "输入文本",
-  "plugins.interaction.filter": "筛选选项",
-  "plugins.interaction.preview": "剪贴板预览",
-  "plugins.interaction.previewNote": "仅在点击“预览剪贴板”后读取。检查文本后，还需单独确认才能分享给插件。",
-  "plugins.interaction.previewAction": "预览剪贴板",
-  "plugins.interaction.share": "分享给插件",
-  "plugins.interaction.copy": "复制到剪贴板",
-  "plugins.interaction.failed": "此请求已过期或无法完成。",
-  "settings.plugins.permissions.current": "匹配当前运行实例",
-  "settings.plugins.permissions.inactive": "对当前运行实例不生效",
-  "settings.plugins.permissions.title": "已保存的授权",
-  "settings.plugins.permissions.refresh": "刷新",
-  "settings.plugins.permissions.loading": "正在读取授权...",
-  "settings.plugins.permissions.empty": "没有已保存的授权。单次决定不会保留。",
-  "settings.plugins.permissions.always": "直到撤销",
-  "settings.plugins.permissions.application": "直到退出 Netcatty",
-  "settings.plugins.permissions.session": "直到会话关闭",
-  "settings.plugins.permissions.audit": "最近的安全事件（最多 100 条）",
-  "settings.plugins.permissions.revoke": "停用并撤销全部授权",
-  "settings.plugins.permissions.revokeNote": "此操作会停用插件、取消其工作并删除已保存的授权。重新启用后可申请新授权。",
-  "settings.plugins.permissions.unavailable": "插件授权管理不可用",
-  "settings.plugins.manager.permissions": "声明的权限",
-  "settings.plugins.manager.permissionNote": "来自 manifest，不代表已授权。启用表示允许按需激活；必需权限在首次激活前申请，可选权限在用到时申请。敏感操作仍受宿主检查。",
-  "settings.plugins.manager.noPermissions": "未声明特权权限。",
-  "settings.plugins.manager.required": "必需",
-  "settings.plugins.manager.optional": "可选",
-  "settings.plugins.themes.title": "插件主题",
-  "settings.plugins.themes.description": "预览仅影响当前窗口；应用后保存在本设备。个人强调色、字体和终端覆盖设置仍然优先。",
-  "settings.plugins.themes.empty": "当前模式没有已启用的插件主题。",
-  "settings.plugins.themes.choose": "选择主题",
-  "settings.plugins.themes.unavailable": "已保存的主题不可用，正在使用宿主默认配色",
-  "settings.plugins.themes.applied": "已应用",
-  "settings.plugins.themes.preview": "预览",
-  "settings.plugins.themes.apply": "应用",
-  "settings.plugins.themes.cancel": "取消预览",
-  "settings.plugins.themes.restore": "恢复默认",
-  "settings.plugins.themes.invalid": "部分主题配色未通过验证或不可用。",
-  "settings.plugins.themes.failed": "无法应用主题。",
-  "settings.plugins.manager.dataTheme": "主题包：已验证配色，不启动代码运行时。",
-  "settings.plugins.manager.browser": "浏览器运行时：特权访问通过宿主权限代理。",
-  "settings.plugins.manager.advanced": "高级运行时：拥有完整 Node 文件系统和网络能力，代理权限无法限制这些访问。仅供开发预览。",
-  "settings.plugins.manager.data": "本地 KV 仅保留在此设备。只有明确标记为同步的非秘密设置进入加密云 sidecar。插件包和权限授权不参与同步。",
-  "settings.plugins.market.results": "{count} 个插件",
-  "settings.plugins.manager.lastError": "上次记录的错误",
-  "settings.plugins.sources.offline": "来源暂不可用。如已缓存此来源通过校验的目录，仅可继续浏览；刷新成功前无法安装。",
-  "settings.plugins.sources.note": "此目录由所选第三方提供，不属于 Netcatty 精选目录。安装前请核对来源域名和权限，更新需手动确认。",
-  "settings.plugins.sources.sourceOnly": "此提供方仅提供源码条目，没有可下载插件包；请查看作者的构建和导入说明。",
-  "settings.plugins.market.offline": "官方目录暂时不可用，正在显示上次有效目录或内置示例。刷新成功前不能从市场安装。",
-  "settings.plugins.manager.details": "查看详情",
-  "settings.plugins.manager.noDescription": "作者暂未提供功能简介。",
-  "settings.plugins.status": "{count} 项提醒",
-  "settings.plugins.info": "插件说明",
-  "settings.plugins.manager.noVaultShort": "凭据存储不可用",
-  "settings.plugins.market.offlineShort": "目录离线 · 暂不可安装",
-  "settings.plugins.market.readmeInfo": "README 来源说明",
-  "settings.plugins.market.installed": "已安装",
-  "settings.plugins.market.sourceBadge": "源码示例",
-  "settings.plugins.market.title": "插件市场",
-  "settings.plugins.market.note": "精选开源插件。审核不代表安全认证，更新由你手动确认。",
-  "settings.plugins.market.back": "所有插件",
-  "settings.plugins.market.install": "安装此版本（保持停用）",
-  "settings.plugins.market.installNote": "这会替换并停止已安装版本。请在已安装列表检查权限后再启用。",
-  "settings.plugins.market.sourceOnly": "第一方源码示例。请用本地 CLI 构建并导入 .ncpkg；尚未发布可下载发行包。",
-  "settings.plugins.market.readmeNote": "固定到上面的提交。HTML 不执行，远程图片不加载。内容由插件作者提供。",
-  "settings.plugins.manager.noVault": "系统密钥存储不可用。秘密和凭据操作被阻止；浏览市场和不使用秘密的插件仍可使用。",
-  "settings.plugins.manager.sensitive": "敏感访问：授权前请检查涉及的数据和资源范围。",
-  "settings.plugins.manager.dual": "默认使用浏览器运行时，但包中还包含拥有完整设备权限的 Node 入口；仅限开发者模式。",
-  "settings.plugins.manager.advancedDeclaration": "浏览器入口声明了高级权限。不适用于普通浏览器插件模式；请逐项检查声明权限。",
-  "settings.plugins.market.retry": "重试",
-  "settings.plugins.market.empty": "目录暂无插件，仍可导入本地浏览器插件。",
-  "settings.plugins.market.emptyReadme": "README 内容为空。",
-  "settings.plugins.market.search": "搜索名称、作者或描述",
-  "settings.plugins.market.noResults": "没有匹配插件，请尝试其他关键词。",
-  "settings.plugins.market.manifest": "兼容性与权限",
-  "settings.plugins.manager.unbounded": "未声明更细的资源范围。请在权限提示中检查实际授权范围。",
-  "settings.plugins.openView": "打开",
-  "settings.plugins.openManager": "打开插件管理",
-  "settings.plugins.sources.conflict": "此 ID 已从其他来源安装。请先卸载并明确清理旧来源数据，再换源重装。原来源：",
-  "settings.plugins.sources.clearPrivate": "同时清除本来源的私有数据、授权和秘密，以便显式换源重装。此操作不可撤销。",
-  "settings.plugins.sources.official": "官方市场",
-  "settings.plugins.sources.thirdparty": "第三方市场",
-  "settings.plugins.sources.manage": "管理来源",
-  "settings.plugins.sources.select": "选择来源",
-  "settings.plugins.sources.empty": "选择或添加第三方来源。",
-  "settings.plugins.sources.add": "添加来源",
-  "settings.plugins.sources.remove": "移除来源",
-  "settings.plugins.sources.name": "来源名称",
-  "settings.plugins.sources.address": "HTTPS 来源地址",
-  "settings.plugins.sources.risk": "第三方来源不代表 Netcatty 维护或认可。安装前请核对真实域名、插件权限与作者。",
-  "settings.plugins.sources.accept": "我信任此域名提供插件目录和软件包。此操作不会授予插件权限。",
-  "settings.plugins.sources.removeNote": "保留已安装插件及数据，停止此来源更新，不会自动切换到其他来源。",
-  "settings.plugins.sources.disablePlugins": "同时停用来自该来源的插件",
-  "settings.plugins.sources.installConfirm": "确认第三方安装",
-  "settings.plugins.sources.source": "来源",
-  "settings.plugins.sources.local": "本地导入",
-  "settings.plugins.sources.all": "全部来源",
-  "settings.plugins.title": "插件",
-  "settings.plugins.description": "管理已安装插件，浏览精选目录。",
+  'settings.plugins.title': '插件设置',
+  'settings.plugins.description': '由开发插件提供、经 Netcatty 原生组件验证的设置。',
   'settings.plugins.loading': '正在加载插件设置…',
   'settings.plugins.empty': '当前没有已启用插件提供设置。',
   'settings.plugins.scopeContext': '请在对应的 {scope} 上下文中打开此设置。',

application/i18n/locales/zh-TW/core.ts

@@ -1153,124 +1153,9 @@ Vaults 分頁維持扁平，不使用這塊背景。
   'qs.default': '預設',
 
   'settings.tab.plugins': '外掛程式',
-  "settings.plugins.manager.installed": "已安裝插件",
-  "settings.plugins.manager.import": "導入 .ncpkg",
-  "settings.plugins.manager.preview": "導入的插件保持停用，請檢查後再啟用。",
-  "settings.plugins.manager.empty": "導入本地插件包以開始使用。",
-  "settings.plugins.manager.enabled": "已啟用",
-  "settings.plugins.manager.disabled": "已停用",
-  "settings.plugins.manager.enable": "啟用",
-  "settings.plugins.manager.disable": "停用",
-  "settings.plugins.manager.remove": "卸載",
-  "settings.plugins.manager.removeNote": "卸載會移除插件代碼和本地 KV 數據，保留用戶設置、秘密存儲和同步 sidecar。",
-  "settings.plugins.permissions.statusUnknown": "狀態不明",
-  "plugins.sidebar.extensions": "擴充功能頁面",
-  "plugins.sidebar.selectTerminal": "請先選擇已開啟的終端。",
-  "plugins.sidebar.loading": "正在載入擴充功能頁面…",
-  "plugins.vault.loading": "正在載入擴充功能頁面…",
-  "plugins.vault.extensions": "擴充功能",
-  "plugins.vault.back": "返回主機",
-  "plugins.interaction.title": "外掛請求",
-  "plugins.interaction.sharing": "分享的文字會交給此外掛及其已授權能力（包括網路存取）。讀取文字不代表核准新的網路目的地。",
-  "plugins.interaction.input": "輸入文字",
-  "plugins.interaction.filter": "篩選選項",
-  "plugins.interaction.preview": "剪貼簿預覽",
-  "plugins.interaction.previewNote": "僅在點選「預覽剪貼簿」後讀取。檢查文字後，還需另外確認才能分享給外掛。",
-  "plugins.interaction.previewAction": "預覽剪貼簿",
-  "plugins.interaction.share": "分享給外掛",
-  "plugins.interaction.copy": "複製到剪貼簿",
-  "plugins.interaction.failed": "此請求已過期或無法完成。",
-  "settings.plugins.permissions.current": "符合目前執行個體",
-  "settings.plugins.permissions.inactive": "對目前執行個體不生效",
-  "settings.plugins.permissions.title": "已儲存的授權",
-  "settings.plugins.permissions.refresh": "重新整理",
-  "settings.plugins.permissions.loading": "正在讀取授權...",
-  "settings.plugins.permissions.empty": "沒有已儲存的授權。單次決定不會保留。",
-  "settings.plugins.permissions.always": "直到撤銷",
-  "settings.plugins.permissions.application": "直到退出 Netcatty",
-  "settings.plugins.permissions.session": "直到工作階段關閉",
-  "settings.plugins.permissions.audit": "最近的安全事件（最多 100 筆）",
-  "settings.plugins.permissions.revoke": "停用並撤銷全部授權",
-  "settings.plugins.permissions.revokeNote": "此操作會停用外掛、取消其工作並刪除已儲存的授權。重新啟用後可申請新授權。",
-  "settings.plugins.permissions.unavailable": "外掛授權管理無法使用",
-  "settings.plugins.manager.permissions": "聲明的權限",
-  "settings.plugins.manager.permissionNote": "來自 manifest，不代表已授權。啟用表示允許按需激活；必需權限在首次激活前申請，可選權限在用到時申請。敏感操作仍受宿主檢查。",
-  "settings.plugins.manager.noPermissions": "未聲明特權權限。",
-  "settings.plugins.manager.required": "必需",
-  "settings.plugins.manager.optional": "可選",
-  "settings.plugins.themes.title": "外掛主題",
-  "settings.plugins.themes.description": "預覽僅影響目前視窗；套用後儲存於本機。個人強調色、字型和終端覆寫設定仍然優先。",
-  "settings.plugins.themes.empty": "目前模式沒有已啟用的外掛主題。",
-  "settings.plugins.themes.choose": "選擇主題",
-  "settings.plugins.themes.unavailable": "已儲存的主題無法使用，正在使用宿主預設配色",
-  "settings.plugins.themes.applied": "已套用",
-  "settings.plugins.themes.preview": "預覽",
-  "settings.plugins.themes.apply": "套用",
-  "settings.plugins.themes.cancel": "取消預覽",
-  "settings.plugins.themes.restore": "恢復預設",
-  "settings.plugins.themes.invalid": "部分主題配色未通過驗證或無法使用。",
-  "settings.plugins.themes.failed": "無法套用主題。",
-  "settings.plugins.manager.dataTheme": "主題套件：已驗證配色，不啟動程式執行環境。",
-  "settings.plugins.manager.browser": "瀏覽器運行時：特權訪問通過宿主權限代理。",
-  "settings.plugins.manager.advanced": "高級運行時：擁有完整 Node 文件系統和網絡能力，代理權限無法限制這些訪問。僅供開發預覽。",
-  "settings.plugins.manager.data": "本地 KV 僅保留在此設備。只有明確標記為同步的非秘密設置進入加密雲 sidecar。插件包和權限授權不參與同步。",
-  "settings.plugins.manager.unbounded": "未宣告更細的資源範圍。請在權限提示中檢查實際授權範圍。",
-  "settings.plugins.openView": "開啟",
-  "settings.plugins.openManager": "開啟插件管理",
-  "settings.plugins.sources.conflict": "此 ID 已从其他来源安装。请先卸载并明确清理旧来源数据，再换源重装。原来源：",
-  "settings.plugins.sources.clearPrivate": "同时清除本来源的私有数据、授权和秘密，以便显式换源重装。此操作不可撤销。",
-  "settings.plugins.sources.official": "官方市场",
-  "settings.plugins.sources.thirdparty": "第三方市场",
-  "settings.plugins.sources.manage": "管理来源",
-  "settings.plugins.sources.select": "选择来源",
-  "settings.plugins.sources.empty": "选择或添加第三方来源。",
-  "settings.plugins.sources.add": "添加来源",
-  "settings.plugins.sources.remove": "移除来源",
-  "settings.plugins.sources.name": "来源名称",
-  "settings.plugins.sources.address": "HTTPS 来源地址",
-  "settings.plugins.sources.risk": "第三方来源不代表 Netcatty 维护或认可。安装前请核对真实域名、插件权限与作者。",
-  "settings.plugins.sources.accept": "我信任此域名提供插件目录和软件包。此操作不会授予插件权限。",
-  "settings.plugins.sources.removeNote": "保留已安装插件及数据，停止此来源更新，不会自动切换到其他来源。",
-  "settings.plugins.sources.disablePlugins": "同时停用来自该来源的插件",
-  "settings.plugins.sources.installConfirm": "确认第三方安装",
-  "settings.plugins.sources.source": "来源",
-  "settings.plugins.sources.local": "本地导入",
-  "settings.plugins.sources.all": "全部来源",
-  "settings.plugins.title": "插件",
-  "settings.plugins.description": "管理已安裝插件，瀏覽精選目錄。",
+  'settings.plugins.title': '外掛程式設定',
+  'settings.plugins.description': '由開發外掛程式提供、經 Netcatty 原生元件驗證的設定。',
   'settings.plugins.loading': '正在載入外掛程式設定…',
-  "settings.plugins.market.results": "{count} 個插件",
-  "settings.plugins.manager.lastError": "上次記錄的錯誤",
-  "settings.plugins.sources.offline": "來源暫不可用。如已快取此來源通過驗證的目錄，僅可繼續瀏覽；重新整理成功前無法安裝。",
-  "settings.plugins.sources.note": "此目錄由所選第三方提供，不屬於 Netcatty 精選目錄。安裝前請核對來源網域和權限，更新需手動確認。",
-  "settings.plugins.sources.sourceOnly": "此提供方僅提供原始碼項目，沒有可下載外掛套件；請查看作者的建置和匯入說明。",
-  "settings.plugins.market.offline": "官方目錄暫時無法使用，正在顯示上次有效目錄或內建範例。重新整理成功前無法從市場安裝。",
-  "settings.plugins.manager.details": "查看詳情",
-  "settings.plugins.manager.noDescription": "作者尚未提供功能簡介。",
-  "settings.plugins.status": "{count} 項提醒",
-  "settings.plugins.info": "外掛說明",
-  "settings.plugins.manager.noVaultShort": "憑據儲存無法使用",
-  "settings.plugins.market.offlineShort": "目錄離線 · 暫時無法安裝",
-  "settings.plugins.market.readmeInfo": "README 來源說明",
-  "settings.plugins.market.installed": "已安裝",
-  "settings.plugins.market.sourceBadge": "原始碼範例",
-  "settings.plugins.market.title": "插件市場",
-  "settings.plugins.market.note": "精選開源插件。審核不代表安全認證，更新由你手動確認。",
-  "settings.plugins.market.back": "所有插件",
-  "settings.plugins.market.install": "安裝此版本（保持停用）",
-  "settings.plugins.market.installNote": "這會替換並停止已安裝版本。請在已安裝列表檢查權限後再啟用。",
-  "settings.plugins.market.sourceOnly": "第一方源碼示例。請用本地 CLI 構建並導入 .ncpkg；尚未發佈可下載發行包。",
-  "settings.plugins.market.readmeNote": "固定到上面的提交。HTML 不執行，遠程圖片不加載。內容由插件作者提供。",
-  "settings.plugins.manager.noVault": "系統密鑰存儲不可用。秘密和憑據操作被阻止；瀏覽市場和不使用秘密的插件仍可使用。",
-  "settings.plugins.manager.sensitive": "敏感訪問：授權前請檢查涉及的數據和資源範圍。",
-  "settings.plugins.manager.dual": "默認使用瀏覽器運行時，但包中還包含擁有完整設備權限的 Node 入口；僅限開發者模式。",
-  "settings.plugins.manager.advancedDeclaration": "瀏覽器入口聲明瞭高級權限。不適用於普通瀏覽器插件模式；請逐項檢查聲明權限。",
-  "settings.plugins.market.retry": "重試",
-  "settings.plugins.market.empty": "目錄暫無插件，仍可導入本地瀏覽器插件。",
-  "settings.plugins.market.emptyReadme": "README 內容為空。",
-  "settings.plugins.market.search": "搜索名稱、作者或描述",
-  "settings.plugins.market.noResults": "沒有匹配插件，請嘗試其他關鍵詞。",
-  "settings.plugins.market.manifest": "兼容性與權限",
   'settings.plugins.empty': '目前沒有已啟用外掛程式提供設定。',
   'settings.plugins.scopeContext': '請在對應的 {scope} 情境中開啟此設定。',
   'settings.plugins.pressKeybinding': '請按下組合鍵',

application/state/pluginVaultPages.ts

@@ -1,27 +0,0 @@
-export const PLUGIN_VAULT_PAGE_PREFIX = 'plugin-vault:';
-
-export interface PluginVaultPage {
-  key: `plugin-vault:${string}`;
-  pluginId: string;
-  pluginName: string;
-  version: string;
-  viewId: string;
-  title: string;
-  icon?: NetcattyPluginIconReference;
-  order: number;
-}
-
-export function collectPluginVaultPages(plugins: NetcattyPluginContributionSnapshot['plugins']): PluginVaultPage[] {
-  return plugins.flatMap((plugin) => plugin.views
-    .filter((view) => view.location === 'vault-page' && view.visible)
-    .map((view): PluginVaultPage => ({
-      key: `${PLUGIN_VAULT_PAGE_PREFIX}${view.id}`,
-      pluginId: plugin.id, pluginName: plugin.displayName, version: plugin.version,
-      viewId: view.id, title: view.title, icon: view.icon, order: view.order ?? 0,
-    })))
-    .sort((left, right) => left.order - right.order || left.viewId.localeCompare(right.viewId));
-}
-
-export function resolvePluginVaultPage(pages: readonly PluginVaultPage[], section: string): PluginVaultPage | null {
-  return pages.find((page) => page.key === section) ?? null;
-}

application/state/pluginViewOcclusion.ts

@@ -1,18 +0,0 @@
-/** Native child views must yield to host dialogs and overlapping portals. */
-export function isPluginViewOccluded(mount: HTMLElement): boolean {
-  const rect = mount.getBoundingClientRect();
-  if (!mount.isConnected || mount.closest('[hidden], [inert], [aria-hidden="true"]')) return true;
-  const overlays = mount.ownerDocument.querySelectorAll(
-    '[data-app-lock-overlay], [role="dialog"], [role="alertdialog"], '
-    + '[role="menu"][data-state="open"], [data-radix-popper-content-wrapper] > *, [data-native-view-occluder]',
-  );
-  return [...overlays].some((overlay) => {
-    if (mount.contains(overlay)) return false;
-    const style = getComputedStyle(overlay);
-    if (style.display === 'none' || style.visibility === 'hidden' || overlay.closest('[hidden], [inert]')) return false;
-    if (overlay.matches('[data-app-lock-overlay], [role="dialog"][aria-modal="true"], [role="alertdialog"]')) return true;
-    const other = overlay.getBoundingClientRect();
-    return other.width > 0 && other.height > 0 && other.x < rect.right && other.right > rect.x
-      && other.y < rect.bottom && other.bottom > rect.y;
-  });
-}

application/state/settingsStateDefaults.ts

@@ -1,4 +1,3 @@
-import { pluginThemeRegistry } from '../../infrastructure/config/pluginThemeRegistry';
 import {
   DEFAULT_SHIFT_ENTER_NEWLINE_TEXT,
   isLegacyDefaultShiftEnterNewlineText,
@@ -253,9 +252,6 @@ export const applyThemeTokens = (
   accentOverride: string,
 ) => {
   const root = window.document.documentElement;
-  root.toggleAttribute('data-plugin-theme-active', pluginThemeRegistry.isActive(resolvedTheme));
-  const securityVars = buildAppThemeCssVars(pluginThemeRegistry.securityTokens(resolvedTheme), 'theme', '');
-  for (const [key, value] of Object.entries(securityVars)) root.style.setProperty('--host-security' + key.slice(1), value);
   root.classList.remove('light', 'dark');
   root.classList.add(resolvedTheme);
   const cssVars = buildAppThemeCssVars(tokens, accentMode, accentOverride);

application/state/terminalSidePanelTabs.ts

@@ -13,11 +13,11 @@ import {
 } from '../../infrastructure/config/storageKeys';
 import { localStorageAdapter } from '../../infrastructure/persistence/localStorageAdapter';
 import { useToolbarItemLayout } from './useToolbarItemLayout';
-import type { BuiltinSidePanelTool, SidePanelTool } from '../../domain/sidePanelLayout';
+import type { SidePanelTool } from '../../domain/sidePanelLayout';
 
 export type TerminalSidePanelTabId = SidePanelTool;
 
-export const TERMINAL_SIDE_PANEL_TAB_DEFAULT_ORDER: BuiltinSidePanelTool[] = [
+export const TERMINAL_SIDE_PANEL_TAB_DEFAULT_ORDER: TerminalSidePanelTabId[] = [
   'sftp',
   'browser',
   'scripts',

application/state/useActiveChromeTheme.ts

@@ -1,6 +1,3 @@
-import { pluginThemeRegistry } from '../../infrastructure/config/pluginThemeRegistry';
-import { usePluginThemeRevision } from './usePluginThemeRuntime';
-import { useSettingsChromeStore } from './settingsChromeStore';
 import { useLayoutEffect, useRef } from "react";
 import type { TerminalTheme } from "../../domain/models";
 import {
@@ -274,15 +271,12 @@ export function useActiveChromeTheme({
   activeTheme: TerminalTheme | null;
   applyAppTheme: () => void;
 }) {
-  const pluginThemeRevision = usePluginThemeRevision();
-  const { resolvedTheme } = useSettingsChromeStore();
-  const effectiveTheme = pluginThemeRegistry.isActive(resolvedTheme) ? null : activeTheme;
   const applyAppThemeRef = useRef(applyAppTheme);
   applyAppThemeRef.current = applyAppTheme;
 
   useLayoutEffect(() => {
-    syncActiveChromeTheme(effectiveTheme, applyAppTheme);
-  }, [effectiveTheme, applyAppTheme, pluginThemeRevision]);
+    syncActiveChromeTheme(activeTheme, applyAppTheme);
+  }, [activeTheme, applyAppTheme]);
 
   useLayoutEffect(() => {
     return () => {

application/state/useEmbeddedPluginView.ts

@@ -1,119 +0,0 @@
-import { useEffect, useRef, useState } from 'react';
-import { PluginViewLifecycleController, type HostedPluginViewState } from './pluginViewLifecycle';
-import { resolvePluginViewWindowScope } from './pluginViewScopes';
-import { isPluginViewOccluded } from './pluginViewOcclusion';
-import type { UsePluginContributionsResult } from './usePluginContributions';
-
-type ViewAdapter = Pick<UsePluginContributionsResult, 'openView' | 'closeView' | 'focusView' | 'setViewBounds' | 'setViewVisibility' | 'onViewClosed' | 'onViewFocused'>;
-
-/** Host-owned mounting only. No plugin router, DOM, session or vault data API. */
-export function useEmbeddedPluginView({ viewId, version, slot, active, context, adapter, subscribeHidden, unavailable, focused, focusOnReveal = false }: {
-  viewId: string;
-  version: string;
-  slot: string;
-  active: boolean;
-  context: Record<string, unknown>;
-  adapter: ViewAdapter;
-  subscribeHidden(listener: () => void): () => void;
-  unavailable(): void;
-  focused?(): void;
-  focusOnReveal?: boolean;
-}) {
-  const mountRef = useRef<HTMLDivElement>(null);
-  const [loading, setLoading] = useState(true);
-  const adapterRef = useRef(adapter);
-  const unavailableRef = useRef(unavailable);
-  const focusedRef = useRef(focused);
-  const revealFocusRef = useRef(focusOnReveal);
-  const requestFocusRef = useRef<() => void>(() => {});
-  revealFocusRef.current = focusOnReveal;
-  focusedRef.current = focused;
-  adapterRef.current = adapter;
-  unavailableRef.current = unavailable;
-  useEffect(() => {
-    const mount = mountRef.current;
-    if (!active || !mount) return;
-    let cancelled = false;
-    const lifecycle = new PluginViewLifecycleController<HostedPluginViewState>();
-    const instanceId = crypto.randomUUID();
-    const scopeId = resolvePluginViewWindowScope({ pathname: window.location.pathname,
-      search: window.location.search, hash: `${window.location.hash}|plugin-slot:${slot}` });
-    const { openView, closeView, focusView, setViewBounds, setViewVisibility, onViewClosed, onViewFocused } = adapterRef.current;
-    const close = () => {
-      if (cancelled) return;
-      cancelled = true;
-      lifecycle.markViewClosed(viewId);
-      void closeView(instanceId).catch(() => {});
-    };
-    const failCurrent = () => {
-      if (cancelled) return;
-      close();
-      unavailableRef.current();
-    };
-    const unsubscribe = onViewClosed((event) => {
-      lifecycle.handleHostClose(event.instanceId);
-      if (event.instanceId === instanceId && !cancelled) {
-        close();
-        unavailableRef.current();
-      }
-    });
-    const stopOnHide = subscribeHidden(close);
-    const stopOnFocus = onViewFocused((event) => {
-      if (!cancelled && event.instanceId === instanceId) focusedRef.current?.();
-    });
-    const bounds = () => {
-      const rect = mount.getBoundingClientRect();
-      return { x: Math.round(rect.x), y: Math.round(rect.y), width: Math.max(1, Math.round(rect.width)), height: Math.max(1, Math.round(rect.height)) };
-    };
-    let opened = false;
-    let lastBounds = '';
-    let visible = false;
-    const focus = () => {
-      if (!cancelled && opened && visible && revealFocusRef.current && !isPluginViewOccluded(mount)) void focusView(instanceId).catch(() => {});
-    };
-    requestFocusRef.current = focus;
-    const updateVisibility = () => {
-      if (!opened || cancelled) return;
-      const rect = mount.getBoundingClientRect();
-      const next = rect.width > 0 && rect.height > 0 && !isPluginViewOccluded(mount);
-      if (visible === next) return;
-      visible = next;
-      void setViewVisibility(instanceId, next).then(() => { if (next) focus(); }).catch(failCurrent);
-    };
-    const resize = () => {
-      if (opened && !cancelled) {
-        const next = bounds();
-        const key = JSON.stringify(next);
-        if (key !== lastBounds) { lastBounds = key; void setViewBounds(instanceId, next).catch(failCurrent); }
-      }
-      updateVisibility();
-    };
-    const observer = typeof ResizeObserver === 'undefined' ? null : new ResizeObserver(resize);
-    observer?.observe(mount);
-    const mutations = new MutationObserver(resize);
-    mutations.observe(document.body, { childList: true, subtree: true, attributes: true,
-      attributeFilter: ['class', 'style', 'hidden', 'inert', 'role', 'aria-modal', 'aria-hidden', 'data-state', 'data-app-lock-overlay', 'data-radix-popper-content-wrapper', 'data-native-view-occluder'] });
-    window.addEventListener('resize', resize);
-    document.addEventListener('scroll', resize, true);
-    setLoading(true);
-    const opening = lifecycle.beginOpen({ viewKey: viewId });
-    void openView({ viewId, instanceId, scopeId, bounds: bounds(), context }).then(async (result) => {
-      if (cancelled || lifecycle.shouldCloseOpen(opening) || lifecycle.consumeHostClose(result.instanceId)) {
-        await closeView(result.instanceId);
-        return;
-      }
-      opened = true;
-      lifecycle.setCurrent({ id: result.instanceId, viewId, scopeId, retainContextWhenHidden: false });
-      resize();
-      setLoading(false);
-    }).catch(() => {
-      if (!cancelled) { close(); unavailableRef.current(); }
-    }).finally(() => lifecycle.finishOpen({ token: opening, viewKey: viewId }));
-    return () => {
-      close(); unsubscribe(); stopOnHide(); stopOnFocus(); observer?.disconnect(); mutations.disconnect();
-      window.removeEventListener('resize', resize); document.removeEventListener('scroll', resize, true);
-    };
-  }, [active, context, slot, subscribeHidden, version, viewId]);
-  useEffect(() => { if (focusOnReveal) requestFocusRef.current(); }, [focusOnReveal]);
-  return { mountRef, loading };
-}

application/state/usePluginBrandIcon.ts

@@ -1,19 +0,0 @@
-import { useEffect, useState } from 'react';
-import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
-
-type Raster = { light: string; dark?: string };
-export function usePluginBrandIcon(plugin?: NetcattyInstalledPlugin): Raster | null {
-  const pluginId = plugin?.id;
-  const kind = plugin?.manifest?.icon?.kind;
-  const key = JSON.stringify([pluginId, plugin?.activeVersion, plugin?.archiveSha256, plugin?.runtime?.quarantinedAt, plugin?.manifest?.icon]);
-  const [loaded, setLoaded] = useState<{ key: string; value: Raster | null } | null>(null);
-  useEffect(() => {
-    if (!pluginId || kind !== 'package') return;
-    let cancelled = false;
-    void netcattyBridge.get()?.getPluginBrandIcon?.(pluginId).then((value) => {
-      if (!cancelled) setLoaded({ key, value });
-    }).catch(() => { if (!cancelled) setLoaded({ key, value: null }); });
-    return () => { cancelled = true; };
-  }, [key, pluginId, kind]);
-  return loaded?.key === key ? loaded.value : null;
-}

application/state/usePluginCatalog.test.ts

@@ -1,84 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { usePluginCatalog } from './usePluginCatalog';
-
-function deferred<T>() {
-  let resolve!: (value: T) => void;
-  let reject!: (cause: Error) => void;
-  const promise = new Promise<T>((yes, no) => { resolve = yes; reject = no; });
-  return { promise, resolve, reject };
-}
-
-test('README failures clear on retry/switch and stale requests cannot replace the selected entry', async (context) => {
-  const original = Object.getOwnPropertyDescriptor(globalThis, 'window');
-  const calls: Array<{ id: string; request: ReturnType<typeof deferred<string>> }> = [];
-  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
-    netcatty: {
-      listPluginCatalog: async () => ({ entries: [], source: "builtin", error: null }),
-      getPluginCatalogReadme: (id: string) => { const request = deferred<string>(); calls.push({ id, request }); return request.promise; },
-    },
-  } });
-  (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
-  context.after(() => {
-    if (original) Object.defineProperty(globalThis, 'window', original); else Reflect.deleteProperty(globalThis, 'window');
-    Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-  });
-  let state!: ReturnType<typeof usePluginCatalog>;
-  let renders = 0;
-  function Probe({ id }: { id: string }) { state = usePluginCatalog(id); renders++; return null; }
-  let renderer!: ReactTestRenderer;
-  await act(async () => { renderer = create(React.createElement(Probe, { id: 'first' })); });
-  assert.equal(state.readmeStatus, 'loading');
-  await act(async () => calls[0].request.reject(new Error('temporary failure')));
-  assert.equal(state.readmeStatus, 'error');
-  assert.match(state.readmeError!, /temporary failure/);
-  await act(async () => state.retryReadme());
-  assert.equal(state.readmeStatus, 'loading'); assert.equal(state.readmeError, null);
-  await act(async () => calls[1].request.resolve(''));
-  assert.equal(state.readmeStatus, 'ready'); assert.equal(state.readme, ''); assert.equal(state.readmeError, null);
-  await act(async () => state.retryReadme());
-  await act(async () => renderer.update(React.createElement(Probe, { id: 'second' })));
-  assert.equal(state.readmeError, null);
-  await act(async () => calls[3].request.resolve('# Second'));
-  await act(async () => calls[2].request.reject(new Error('stale failure')));
-  assert.equal(state.readme, '# Second'); assert.equal(state.readmeError, null);
-  await act(async () => state.retryReadme());
-  await act(async () => renderer.unmount());
-  const unmountedRenders = renders;
-  await act(async () => calls[4].request.resolve('late content'));
-  assert.equal(renders, unmountedRenders);
-});
-
-test('offline snapshot stays browsable, retry clears warning, and operations bind the selected token', async (context) => {
-  const original = Object.getOwnPropertyDescriptor(globalThis, 'window');
-  const entry = { id: 'com.test.registry', selectionToken: 'first' } as NetcattyPluginCatalogEntry;
-  let offline = true;
-  const reads: unknown[][] = []; const installs: unknown[][] = [];
-  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
-    dispatchEvent() {}, netcatty: {
-      listPluginCatalog: async () => ({ entries: [{ ...entry, selectionToken: offline ? 'first' : 'second' }], source: offline ? 'cached' : 'registry', error: offline ? 'offline' : null }),
-      getPluginCatalogReadme: async (...args: unknown[]) => { reads.push(args); return '# Pinned'; },
-      installCatalogPlugin: async (...args: unknown[]) => { installs.push(args); },
-    },
-  } });
-  (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
-  context.after(() => {
-    if (original) Object.defineProperty(globalThis, 'window', original); else Reflect.deleteProperty(globalThis, 'window');
-    Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-  });
-  let state!: ReturnType<typeof usePluginCatalog>;
-  function Probe() { state = usePluginCatalog(entry.id); return null; }
-  let renderer!: ReactTestRenderer;
-  await act(async () => { renderer = create(React.createElement(Probe)); });
-  assert.equal(state.entries.length, 1); assert.equal(state.listStatus, 'ready'); assert.equal(state.listError, 'offline');
-  assert.equal(state.source, 'cached');
-  offline = false;
-  await act(async () => state.retryList());
-  assert.equal(state.listError, null); assert.equal(state.source, 'registry');
-  assert.deepEqual(reads.at(-1), [entry.id, 'second', 'official']);
-  await act(async () => state.install(entry.id));
-  assert.deepEqual(installs, [[entry.id, 'second', 'official', undefined]]);
-  await act(async () => renderer.unmount());
-});

application/state/usePluginCatalog.ts

@@ -1,82 +0,0 @@
-import { useEffect, useRef, useState } from 'react';
-import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
-
-type ReadmeState = { id: string; token?: string; attempt: number; status: 'loading' | 'ready' | 'error'; text: string; error: string | null };
-export function usePluginCatalog(selectedId: string | null, sourceId = 'official') {
-  const [entries, setEntries] = useState<NetcattyPluginCatalogEntry[]>([]);
-  const [listStatus, setListStatus] = useState<'loading' | 'ready' | 'error'>('loading');
-  const [source, setSource] = useState<NetcattyPluginCatalogSnapshot['source']>('builtin');
-  const [listError, setListError] = useState<string | null>(null);
-  const [listAttempt, setListAttempt] = useState(0);
-  const [readmeState, setReadmeState] = useState<ReadmeState | null>(null);
-  const [readmeAttempt, setReadmeAttempt] = useState(0);
-  const [installError, setInstallError] = useState<{ id: string; message: string } | null>(null);
-  const [busy, setBusy] = useState(false);
-  const [sourceBinding, setSourceBinding] = useState<NetcattyPluginSource | null>(null);
-  const installing = useRef(false);
-  const mounted = useRef(false);
-  useEffect(() => { mounted.current = true; return () => { mounted.current = false; }; }, []);
-  useEffect(() => {
-    let active = true;
-    setListStatus('loading'); setListError(null);
-    void (async () => {
-      try {
-        const bridge = netcattyBridge.get();
-        if (!bridge?.listPluginCatalog) throw new Error('Catalog browsing unavailable');
-        const list = await bridge.listPluginCatalog(sourceId);
-        if (active) { setEntries(list.entries); setSource(list.source); setListError(list.error); setListStatus('ready'); }
-      } catch (cause) { if (active) { setListStatus('error'); setListError(String(cause)); } }
-    })();
-    return () => { active = false; };
-  }, [listAttempt, sourceId]);
-  useEffect(() => {
-    let active = true;
-    setSourceBinding(null);
-    if (selectedId) void netcattyBridge.get()?.getPluginSourceBinding?.(selectedId).then((binding) => { if (active) setSourceBinding(binding); }).catch((cause) => { if (active) setInstallError({ id: selectedId, message: String(cause) }); });
-    return () => { active = false; };
-  }, [selectedId, sourceId]);
-  const selectionToken = entries.find((entry) => entry.id === selectedId)?.selectionToken;
-  useEffect(() => {
-    if (!selectedId) return;
-    let active = true;
-    const base = { id: selectedId, token: selectionToken, attempt: readmeAttempt, text: '', error: null };
-    setReadmeState({ ...base, status: 'loading' });
-    void (async () => {
-      try {
-        const bridge = netcattyBridge.get();
-        if (!bridge?.getPluginCatalogReadme) throw new Error('README retrieval unavailable');
-        const text = await bridge.getPluginCatalogReadme(selectedId, selectionToken, sourceId);
-        if (active) setReadmeState({ ...base, status: 'ready', text });
-      } catch (cause) { if (active) setReadmeState({ ...base, status: 'error', error: String(cause) }); }
-    })();
-    return () => { active = false; };
-  }, [selectedId, selectionToken, readmeAttempt, sourceId]);
-  const currentReadme = readmeState?.id === selectedId && readmeState.token === selectionToken && readmeState.attempt === readmeAttempt ? readmeState : null;
-  return {
-    entries, listStatus, listError, source, sourceBinding,
-    readme: currentReadme?.status === 'ready' ? currentReadme.text : null,
-    readmeStatus: currentReadme?.status ?? (selectedId ? 'loading' : 'idle'),
-    readmeError: currentReadme?.error ?? null,
-    error: installError?.id === selectedId ? installError.message : null,
-    busy,
-    retryList: () => setListAttempt((attempt) => attempt + 1),
-    retryReadme: () => setReadmeAttempt((attempt) => attempt + 1),
-    async install(id: string, acceptedSourceId?: string, clearPreviousSource = false) {
-      if (installing.current) return;
-      installing.current = true;
-      setBusy(true); setInstallError(null);
-      try {
-        const bridge = netcattyBridge.require();
-        if (!bridge.installCatalogPlugin) throw new Error('Catalog installation unavailable');
-        if (clearPreviousSource && sourceBinding && sourceBinding.id !== sourceId) {
-          if (!bridge.resetPluginSource) throw new Error('Source reset unavailable');
-          await bridge.resetPluginSource(id, sourceBinding.id);
-          setSourceBinding(null);
-        }
-        await bridge.installCatalogPlugin(id, entries.find((entry) => entry.id === id)?.selectionToken, sourceId, acceptedSourceId);
-        window.dispatchEvent(new Event('netcatty:plugin-packages-changed'));
-      } catch (cause) { if (mounted.current) setInstallError({ id, message: String(cause) }); }
-      finally { installing.current = false; if (mounted.current) setBusy(false); }
-    },
-  };
-}

application/state/usePluginContributions.ts

@@ -88,12 +88,10 @@ export interface UsePluginContributionsResult {
   selectSettingPath(kind: 'file' | 'directory', title: string, defaultPath?: string): Promise<string | null>;
   openView(payload: NetcattyPluginViewOpenRequest): Promise<{ instanceId: string }>;
   closeView(instanceId: string): Promise<void>;
-  focusView(instanceId: string): Promise<void>;
   setViewBounds(instanceId: string, bounds: { x: number; y: number; width: number; height: number }): Promise<void>;
   setViewVisibility(instanceId: string, visible: boolean): Promise<void>;
   setEnvironment(environment: NetcattyPluginEnvironment): Promise<void>;
   onViewClosed(callback: (event: NetcattyPluginViewClosedEvent) => void): () => void;
-  onViewFocused(callback: (event: import('@netcatty/plugin-contract').PluginViewFocusEvent) => void): () => void;
 }
 
 export function usePluginContributions(
@@ -198,9 +196,6 @@ export function usePluginContributions(
     if (!bridge?.closePluginView) return;
     await bridge.closePluginView(instanceId);
   }, [bridge]);
-  const focusView = useCallback(async (instanceId: string) => {
-    await bridge?.focusPluginView?.({ instanceId });
-  }, [bridge]);
 
   const setViewBounds = useCallback(async (
     instanceId: string,
@@ -223,9 +218,6 @@ export function usePluginContributions(
   const onViewClosed = useCallback((callback: (event: NetcattyPluginViewClosedEvent) => void) => (
     bridge?.onPluginViewClosed?.(callback) ?? (() => {})
   ), [bridge]);
-  const onViewFocused = useCallback((callback: (event: import('@netcatty/plugin-contract').PluginViewFocusEvent) => void) => (
-    bridge?.onPluginViewFocused?.(callback) ?? (() => {})
-  ), [bridge]);
 
   const currentLoadState = resolvePluginContributionLoadState({
     currentQueryKey: queryKey,
@@ -247,11 +239,9 @@ export function usePluginContributions(
     selectSettingPath,
     openView,
     closeView,
-    focusView,
     setViewBounds,
     setViewVisibility,
     setEnvironment,
     onViewClosed,
-    onViewFocused,
   };
 }

application/state/usePluginHostInteractions.ts

@@ -1,53 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import type { HostInteractionPrompt, HostInteractionResponse } from '@netcatty/plugin-contract';
-import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
-
-export function usePluginHostInteractions() {
-  const [prompt, setPrompt] = useState<HostInteractionPrompt | null>(null);
-  const [value, setValue] = useState('');
-  const [error, setError] = useState(false);
-  const [busy, setBusy] = useState(false);
-  const current = useRef<HostInteractionPrompt | null>(null);
-  const pending = useRef(false);
-  useEffect(() => {
-    const bridge = netcattyBridge.get();
-    if (!bridge?.onPluginInteraction || !bridge.setPluginInteractionReady) return;
-    const unsubscribe = bridge.onPluginInteraction((event) => {
-      if ('closed' in event) {
-        if (current.current?.requestId !== event.requestId) return;
-        current.current = null; setPrompt(null);
-      } else {
-        current.current = event; setPrompt(event);
-        setValue(event.request.kind === 'input' ? event.request.initialValue ?? '' : '');
-      }
-      pending.current = false; setBusy(false); setError(false);
-    });
-    void bridge.setPluginInteractionReady(true).catch(() => {});
-    return () => {
-      current.current = null;
-      unsubscribe();
-      void bridge.setPluginInteractionReady?.(false).catch(() => {});
-    };
-  }, []);
-  const respond = useCallback(async (action: HostInteractionResponse['action']) => {
-    const active = current.current;
-    if (!active || pending.current) return;
-    pending.current = true; setBusy(true); setError(false);
-    try {
-      const bridge = netcattyBridge.require();
-      if (!bridge.respondPluginInteraction) throw new Error('Host interactions unavailable');
-      const accepted = await bridge.respondPluginInteraction({
-        requestId: active.requestId, actionToken: active.actionToken, action,
-        ...(action === 'submit' && (active.request.kind === 'input' || active.request.kind === 'quickPick') ? { value } : {}),
-      });
-      if (!accepted && current.current?.actionToken === active.actionToken) {
-        current.current = null; setPrompt(null);
-      }
-    } catch {
-      if (current.current?.actionToken === active.actionToken) setError(true);
-    } finally {
-      if (current.current?.actionToken === active.actionToken) { pending.current = false; setBusy(false); }
-    }
-  }, [value]);
-  return { prompt, value, setValue, error, busy, respond };
-}

application/state/usePluginManager.test.ts

@@ -1,39 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { usePluginManager } from './usePluginManager';
-
-test('failed manager refresh marks previous enabled state unknown until a successful read', async (context) => {
-  const previous = Object.getOwnPropertyDescriptor(globalThis, 'window');
-  const actPrevious = Object.getOwnPropertyDescriptor(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-  let fail = false;
-  const plugin = { id: 'com.example.synthetic', enabled: true } as NetcattyInstalledPlugin;
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', { configurable: true, value: true });
-  Object.defineProperty(globalThis, 'window', { configurable: true, value: {
-    addEventListener() {}, removeEventListener() {}, netcatty: {
-      async getPluginRuntimeStatus() { return { available: true }; },
-      async listPlugins() { if (fail) throw new Error('synthetic status read failed'); return [plugin]; },
-    },
-  } });
-  context.after(() => {
-    if (previous) Object.defineProperty(globalThis, 'window', previous); else Reflect.deleteProperty(globalThis, 'window');
-    if (actPrevious) Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', actPrevious); else Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-  });
-  let state!: ReturnType<typeof usePluginManager>;
-  function Probe() { state = usePluginManager(); return null; }
-  let renderer!: ReactTestRenderer;
-  await act(async () => { renderer = create(React.createElement(Probe)); });
-  try {
-    assert.equal(state.statusKnown, true);
-    assert.equal(state.plugins[0].enabled, true);
-    fail = true;
-    await act(async () => { await assert.rejects(state.refresh(), /synthetic status read failed/); });
-    assert.equal(state.statusKnown, false);
-    assert.match(state.error ?? '', /synthetic status read failed/);
-    fail = false; plugin.enabled = false;
-    await act(async () => { await state.refresh(); });
-    assert.equal(state.statusKnown, true);
-    assert.equal(state.plugins[0].enabled, false);
-  } finally { await act(async () => { renderer.unmount(); }); }
-});

application/state/usePluginManager.ts

@@ -1,74 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
-
-export function usePluginManager() {
-  const [plugins, setPlugins] = useState<NetcattyInstalledPlugin[]>([]);
-  const [available, setAvailable] = useState(false);
-  const [statusKnown, setStatusKnown] = useState(false);
-  const [credentialStorageAvailable, setCredentialStorageAvailable] = useState<boolean | undefined>();
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const generation = useRef(0);
-  const mutation = useRef(false);
-  const refresh = useCallback(async () => {
-    const current = ++generation.current;
-    try {
-      const bridge = netcattyBridge.get();
-      const status = await bridge?.getPluginRuntimeStatus?.();
-      const list = status?.available ? await bridge?.listPlugins?.() ?? [] : [];
-      if (current !== generation.current) return;
-      setAvailable(status?.available === true);
-      setStatusKnown(true);
-      setCredentialStorageAvailable(status?.credentialStorageAvailable);
-      setPlugins(list);
-    } catch (cause) {
-      if (current === generation.current) {
-        setStatusKnown(false);
-        setError(cause instanceof Error ? cause.message : String(cause));
-      }
-      throw cause;
-    }
-  }, []);
-  useEffect(() => {
-    const update = () => { void refresh().catch((cause) => setError(String(cause))); };
-    update();
-    const unsubscribe = netcattyBridge.get()?.onPluginContributionsChanged?.(update);
-    window.addEventListener('netcatty:plugin-packages-changed', update);
-    const refreshGeneration = generation;
-    return () => { refreshGeneration.current++; unsubscribe?.(); window.removeEventListener('netcatty:plugin-packages-changed', update); };
-  }, [refresh]);
-  const run = useCallback(async (action: (bridge: NetcattyBridge) => Promise<unknown>) => {
-    if (mutation.current) return;
-    mutation.current = true;
-    setBusy(true);
-    setError(null);
-    try { await action(netcattyBridge.require()); }
-    catch (cause) { setError(cause instanceof Error ? cause.message : String(cause)); }
-    finally {
-      try { await refresh(); } catch (cause) { setError(String(cause)); }
-      mutation.current = false;
-      setBusy(false);
-    }
-  }, [refresh]);
-  return {
-    plugins, available, statusKnown, busy, error, credentialStorageAvailable, refresh,
-    importPackage: () => run(async (bridge) => {
-      if (!bridge.selectFile || !bridge.installPluginPackage) throw new Error('Plugin import unavailable');
-      const path = await bridge.selectFile('Import plugin package', undefined, [{ name: 'Netcatty plugin', extensions: ['ncpkg'] }]);
-      if (path) await bridge.installPluginPackage(path, { enable: false });
-    }),
-    setEnabled: (id: string, enabled: boolean) => run(async (bridge) => {
-      if (!bridge.setPluginEnabled) throw new Error('Plugin management unavailable');
-      return bridge.setPluginEnabled(id, enabled);
-    }),
-    uninstall: (id: string, clearSource = false) => run(async (bridge) => {
-      if (!bridge.uninstallPlugin) throw new Error('Plugin management unavailable');
-      const source = clearSource ? await bridge.getPluginSourceBinding?.(id) : null;
-      await bridge.uninstallPlugin(id);
-      if (clearSource && source) {
-        if (!bridge.resetPluginSource) throw new Error('Private source reset unavailable');
-        await bridge.resetPluginSource(id, source.id);
-      }
-    }),
-  };
-}

application/state/usePluginSources.ts

@@ -1,25 +0,0 @@
-import { useCallback, useEffect, useState } from 'react';
-import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
-
-export function usePluginSources() {
-  const [sources, setSources] = useState<NetcattyPluginSource[]>([]);
-  const [error, setError] = useState<string | null>(null);
-  const [busy, setBusy] = useState(false);
-  const reload = useCallback(async () => {
-    const values = await netcattyBridge.require().listPluginSources?.();
-    if (!values) throw new Error('Source management unavailable');
-    setSources(values);
-  }, []);
-  useEffect(() => { void reload().catch((cause) => setError(String(cause))); }, [reload]);
-  const mutate = async (operation: () => Promise<unknown>) => {
-    setBusy(true); setError(null);
-    try { await operation(); await reload(); window.dispatchEvent(new Event('netcatty:plugin-packages-changed')); return true; }
-    catch (cause) { setError(String(cause)); return false; }
-    finally { setBusy(false); }
-  };
-  return { sources, error, busy,
-    add: (name: string, address: string) => mutate(async () => netcattyBridge.require().addPluginSource?.({ name, address })),
-    update: (source: NetcattyPluginSource, name: string, enabled: boolean) => mutate(async () => netcattyBridge.require().updatePluginSource?.({ id: source.id, name, enabled })),
-    remove: (id: string, disablePlugins: boolean) => mutate(async () => netcattyBridge.require().removePluginSource?.(id, disablePlugins)),
-  };
-}

application/state/usePluginTerminalSidebar.ts

@@ -1,79 +0,0 @@
-import { useEffect, useMemo, useRef, useSyncExternalStore } from 'react';
-import { useI18n } from '../i18n/I18nProvider';
-import { toast } from '../../components/ui/toast';
-import { collectSidePanelPanes, isPluginSidePanelTool, type SidePanelLayout } from '../../domain/sidePanelLayout';
-import { activeTabStore, useActiveTabId } from './activeTabStore';
-import { getSidePanelLiveSnapshot, subscribeSidePanelLiveSnapshot } from './sidePanelLiveStore';
-import { usePluginContributions } from './usePluginContributions';
-import { OPEN_PLUGIN_VIEW_EVENT, type OpenPluginViewDetail } from './usePluginViewLifecycle';
-
-export const OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT = 'netcatty:open-plugin-terminal-sidebar';
-export const PLUGIN_TERMINAL_SIDEBAR_CONTEXT = Object.freeze({ 'netcatty.surface': 'terminal-sidebar' });
-/** Required production view-context projection, not a plugin-facing API. */
-export interface PluginSidebarHostActions {
-  getActiveTerminalSessionId(): string | null;
-  handleSwitchSidePanelTab(tool: import('../../domain/sidePanelLayout').SidePanelTool): void;
-  handleWithdrawPluginSidebarPane(tabId: string, paneId: string, expectedTool: import('../../domain/sidePanelLayout').SidePanelTool): void;
-}
-export interface PluginTerminalSidebarPage {
-  tool: `plugin-view:${string}`;
-  viewId: string;
-  pluginId: string;
-  pluginName: string;
-  version: string;
-  title: string;
-  icon?: NetcattyPluginIconReference;
-  order: number;
-}
-export function collectPluginTerminalSidebarPages(plugins: NetcattyPluginContributionSnapshot['plugins']): PluginTerminalSidebarPage[] {
-  return plugins.flatMap((plugin) => plugin.views.filter((view) => view.location === 'terminal-sidebar' && view.visible)
-    .map((view): PluginTerminalSidebarPage => ({ tool: `plugin-view:${view.id}`, viewId: view.id, pluginId: plugin.id,
-      pluginName: plugin.displayName, version: plugin.version, title: view.title, icon: view.icon, order: view.order ?? 0 })))
-    .sort((a, b) => a.order - b.order || a.viewId.localeCompare(b.viewId));
-}
-export function requestOpenPluginTerminalSidebar(viewId: string, sessionId: string) {
-  window.dispatchEvent(new CustomEvent(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, { detail: { viewId, sessionId } }));
-}
-export function usePluginTerminalSidebar(host: {
-  layouts: ReadonlyMap<string, SidePanelLayout>;
-  getSession(): string | null;
-  isTerminalTab(tabId: string): boolean;
-  select(tool: `plugin-view:${string}`): void;
-  withdraw(tabId: string, paneId: string, tool: `plugin-view:${string}`): void;
-}) {
-  const { locale, t } = useI18n();
-  const activeTabId = useActiveTabId();
-  // Follow workspace focus without subscribing the whole sidebar to cwd/title
-  // or forwarding the host's live session DTO to a plugin.
-  useSyncExternalStore((listener) => subscribeSidePanelLiveSnapshot(true, listener),
-    () => getSidePanelLiveSnapshot(true).focusedSessionId, () => null);
-  const hostRef = useRef(host); hostRef.current = host;
-  const contributions = usePluginContributions({ locale, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT });
-  const pages = useMemo(() => collectPluginTerminalSidebarPages(contributions.snapshot.plugins), [contributions.snapshot.plugins]);
-  const sessionId = activeTabId && host.isTerminalTab(activeTabId) ? host.getSession() : null;
-  useEffect(() => {
-    const open = (event: Event) => {
-      const detail = (event as CustomEvent<OpenPluginViewDetail & { sessionId?: string }>).detail;
-      const page = pages.find((item) => item.viewId === detail?.viewId);
-      if (!page) return;
-      const tabId = activeTabStore.getActiveTabId();
-      const current = hostRef.current.getSession();
-      if (!hostRef.current.isTerminalTab(tabId) || !current || (detail.sessionId && detail.sessionId !== current)) {
-        toast.info(t('plugins.sidebar.selectTerminal'));
-        return;
-      }
-      hostRef.current.select(page.tool);
-    };
-    window.addEventListener(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, open);
-    window.addEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
-    return () => { window.removeEventListener(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, open); window.removeEventListener(OPEN_PLUGIN_VIEW_EVENT, open); };
-  }, [pages, t]);
-  useEffect(() => {
-    if (contributions.loading) return;
-    const allowed = new Set(pages.map((page) => page.tool));
-    for (const [tabId, layout] of host.layouts) for (const pane of collectSidePanelPanes(layout.root)) {
-      if (isPluginSidePanelTool(pane.tool) && !allowed.has(pane.tool)) host.withdraw(tabId, pane.id, pane.tool);
-    }
-  }, [contributions.loading, host, pages]);
-  return { pages, contributions, tabId: activeTabId, sessionId };
-}

application/state/usePluginThemeRuntime.ts

@@ -1,77 +0,0 @@
-import { useEffect, useSyncExternalStore } from "react";
-import { netcattyBridge } from "../../infrastructure/services/netcattyBridge";
-import { pluginThemeRegistry } from "../../infrastructure/config/pluginThemeRegistry";
-export function usePluginThemeRevision() {
-  return useSyncExternalStore(
-    pluginThemeRegistry.subscribe,
-    pluginThemeRegistry.getRevision,
-    pluginThemeRegistry.getRevision,
-  );
-}
-/** Host-owned selection; never stored in plugin KV or cloud sidecars. */
-let runtimeUsers = 0;
-let disconnectRuntime: (() => void) | undefined;
-function connectRuntime() {
-  const bridge = netcattyBridge.get();
-  let active = true,
-    request = 0;
-  const refresh = async () => {
-    const current = ++request;
-    try {
-      const catalog = await bridge?.getPluginThemes?.();
-      if (active && current === request && catalog)
-        pluginThemeRegistry.setCatalog(catalog);
-    } catch {
-      /* Keep the last host-validated selection; never apply unvalidated data. */
-    }
-  };
-  void refresh();
-  const dispose = bridge?.onPluginThemesChanged?.(() => {
-    pluginThemeRegistry.invalidate();
-    void refresh();
-  });
-  const forced = window.matchMedia?.("(forced-colors: active)"),
-    contrast = window.matchMedia?.("(prefers-contrast: more)");
-  const update = () =>
-    pluginThemeRegistry.setHighContrast(
-      Boolean(forced?.matches || contrast?.matches),
-    );
-  update();
-  forced?.addEventListener?.("change", update);
-  contrast?.addEventListener?.("change", update);
-  return () => {
-    active = false;
-    request++;
-    dispose?.();
-    forced?.removeEventListener?.("change", update);
-    contrast?.removeEventListener?.("change", update);
-  };
-}
-export function usePluginThemeRuntime() {
-  const revision = usePluginThemeRevision();
-  useEffect(() => {
-    if (runtimeUsers++ === 0) disconnectRuntime = connectRuntime();
-    return () => {
-      if (--runtimeUsers === 0) {
-        disconnectRuntime?.();
-        disconnectRuntime = undefined;
-      }
-    };
-  }, []);
-  return revision;
-}
-export async function applyPluginThemeSelection(
-  mode: "light" | "dark",
-  choice: import("@netcatty/plugin-contract").ThemePackChoice | null,
-) {
-  if (choice === null && !pluginThemeRegistry.isActive(mode))
-    return pluginThemeRegistry.getCatalog();
-  const bridge = netcattyBridge.require();
-  if (!bridge.applyPluginTheme) throw new Error("Plugin themes unavailable");
-  const next = await bridge.applyPluginTheme({
-    mode,
-    choice,
-    expectedRevision: pluginThemeRegistry.getCatalog().selection.revision,
-  });
-  return next; // The host change event refreshes every window; never publish a potentially stale apply response.
-}

application/state/usePluginVaultPages.ts

@@ -1,47 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef } from 'react';
-import { activeTabStore, useActiveTabId } from './activeTabStore';
-import { collectPluginVaultPages, PLUGIN_VAULT_PAGE_PREFIX, resolvePluginVaultPage } from './pluginVaultPages';
-import { usePluginContributions } from './usePluginContributions';
-import { OPEN_PLUGIN_VIEW_EVENT, type OpenPluginViewDetail } from './usePluginViewLifecycle';
-
-const CONTEXT = Object.freeze({ 'netcatty.surface': 'vault-page' });
-
-export function usePluginVaultPages({ locale, section, select }: {
-  locale: string;
-  section: string;
-  select(section: 'hosts' | `plugin-vault:${string}`): void;
-}) {
-  const active = useActiveTabId() === 'vault';
-  const sectionRef = useRef(section);
-  const focusFrame = useRef<number | null>(null);
-  sectionRef.current = section;
-  useEffect(() => () => { if (focusFrame.current !== null) cancelAnimationFrame(focusFrame.current); }, []);
-  const contributions = usePluginContributions({ locale, context: CONTEXT });
-  const pages = useMemo(() => collectPluginVaultPages(contributions.snapshot.plugins), [contributions.snapshot.plugins]);
-  const selected = resolvePluginVaultPage(pages, section);
-  const fallback = useCallback(() => {
-    select('hosts');
-    if (focusFrame.current !== null) cancelAnimationFrame(focusFrame.current);
-    focusFrame.current = requestAnimationFrame(() => {
-      focusFrame.current = null;
-      if (sectionRef.current === 'hosts' && activeTabStore.getActiveTabId() === 'vault') {
-        document.querySelector<HTMLButtonElement>('[data-plugin-vault-fallback]')?.focus();
-      }
-    });
-  }, [select]);
-  useEffect(() => {
-    if (!contributions.loading && section.startsWith(PLUGIN_VAULT_PAGE_PREFIX) && !selected) fallback();
-  }, [contributions.loading, fallback, section, selected]);
-  useEffect(() => {
-    const open = (event: Event) => {
-      const detail = (event as CustomEvent<OpenPluginViewDetail>).detail;
-      const page = pages.find((item) => item.viewId === detail?.viewId);
-      if (!page) return;
-      activeTabStore.setActiveTabId('vault');
-      select(page.key);
-    };
-    window.addEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
-    return () => window.removeEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
-  }, [pages, select]);
-  return { pages, selected, active, select, fallback, contributions, context: CONTEXT };
-}

application/state/usePluginViewLifecycle.ts

@@ -82,7 +82,7 @@ export function usePluginViewLifecycle({
   const mountRef = useRef<HTMLDivElement>(null);
   const resolvedActiveView = useMemo(() => viewContributions.snapshot.plugins
     .flatMap((plugin) => plugin.views.map((view) => ({ plugin, view })))
-    .find(({ view }) => view.id === effectiveRequested?.viewId && view.visible && !['vault-page', 'terminal-sidebar'].includes(view.location)) ?? null,
+    .find(({ view }) => view.id === effectiveRequested?.viewId && view.visible) ?? null,
   [effectiveRequested?.viewId, viewContributions.snapshot.plugins]);
   const stableActiveViewRef = useRef<PluginViewSnapshotSelection<ResolvedPluginView> | null>(null);
   const activeView = resolvePluginViewSnapshotSelection({

application/state/useSettingsState.ts

@@ -1,4 +1,3 @@
-import { usePluginThemeRuntime } from './usePluginThemeRuntime';
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, type SetStateAction } from 'react';
 
 import { runThemeTransition, type ThemeTransitionMode } from './themeTransition';
@@ -218,7 +217,6 @@ import {
 } from './appearanceSync';
 
 export const useSettingsState = (options: { enableSettingsSync?: boolean; enableSystemEffects?: boolean } = {}) => {
-  const pluginThemeRevision = usePluginThemeRuntime();
   const enableSettingsSync = options.enableSettingsSync !== false;
   const enableSystemEffects = options.enableSystemEffects !== false;
   const initialCustomKeyBindingsRecord =
@@ -1214,7 +1212,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
         notifySettingsChanged(STORAGE_KEY_COLOR, customAccentRecord);
       }
     }
-  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentRecord, notifySettingsChanged, pluginThemeRevision]);
+  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentRecord, notifySettingsChanged]);
 
   // Listen for OS color scheme changes to keep systemPreference in sync
   useEffect(() => {
@@ -1981,10 +1979,9 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
   }, [setTerminalSettings]);
 
   const applyAppTheme = useCallback(() => {
-    void pluginThemeRevision; // Invalidate the closure when host theme data changes.
     const tokens = getUiThemeById(resolvedTheme, resolvedTheme === 'dark' ? darkUiThemeId : lightUiThemeId).tokens;
     applyThemeTokens(theme, resolvedTheme, tokens, accentMode, customAccent);
-  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, pluginThemeRevision]);
+  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent]);
 
   const setEditorWordWrap = useCallback((enabled: boolean) => {
     setEditorWordWrapState(enabled);

build/installer.nsh

@@ -1,3 +1,14 @@
+!macro customInit
+  ; #3946: external MCP hosts launch Netcatty.exe with ELECTRON_RUN_AS_NODE=1
+  ; via netcatty-external-mcp.cmd. Those processes can outlive the host UI as
+  ; orphans and keep $INSTDIR locked, so the in-app updater hangs (AppHangB1).
+  ; Force-kill leftover Netcatty.exe before files are replaced. Do not pass /T:
+  ; electron-updater spawns this installer as a child of the UI Netcatty.exe,
+  ; and /T would terminate the installer itself. Ignore a missing process.
+  nsExec::ExecToLog "taskkill /F /IM Netcatty.exe"
+  Pop $0
+!macroend
+
 !macro customInstall
   ; Open a selected folder in a new Netcatty local terminal.
   ; Args go after `--` so Electron/Chromium does not swallow them. Use

components/HostDetailsPanel.securityTheme.test.tsx

@@ -1,58 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import test from 'node:test';
-import React from 'react';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { JSDOM } from 'jsdom';
-import { compile } from '@tailwindcss/node';
-import postcss from 'postcss';
-import HostDetailsPanel from './HostDetailsPanel';
-import { Card } from './ui/card';
-import { TooltipProvider } from './ui/tooltip';
-import { PluginPermissionPanel } from './settings/tabs/PluginPermissionPanel';
-import { I18nProvider } from '../application/i18n/I18nProvider';
-
-test('real Host form cards, inputs and Save consume scoped security aliases without freezing an ordinary card', async () => {
-  const markup = renderToStaticMarkup(<I18nProvider locale="en"><TooltipProvider>
-    <HostDetailsPanel availableKeys={[]} identities={[]} groups={[]} terminalThemeId="default" terminalFontSize={14} onSave={() => assert.fail('test never saves a host')} onCancel={() => {}} />
-    <PluginPermissionPanel pluginId="com.example.synthetic" onChanged={async () => {}} />
-    <Card id="ordinary-card">Outside the security surface</Card>
-  </TooltipProvider></I18nProvider>);
-  const dom = new JSDOM(`<!doctype html><html data-plugin-theme-active><body>${markup}</body></html>`);
-  try {
-    const panel = dom.window.document.querySelector('[data-section="host-details-panel"]')!;
-    assert.ok(panel, 'exercise the actual HostDetailsPanel and AsidePanel');
-    assert.ok(panel.querySelector('.bg-card'), 'General/Address/Credentials use real Card components');
-    assert.ok(panel.querySelector('input.bg-background'), 'exercise actual Input utilities');
-    assert.ok(panel.querySelector('button.bg-primary'), 'exercise the actual Save button');
-    const permissions = dom.window.document.querySelector('[data-host-security-surface]')!;
-    assert.ok(permissions.querySelector('[role="status"]'), 'exercise the real grant-panel security root without loading or changing any grants');
-    const source = await readFile(new URL('../index.css', import.meta.url), 'utf8');
-    const compiler = await compile(source, {base: path.resolve('.'), onDependency() {}});
-    const classes = [...new Set([...dom.window.document.querySelectorAll('[class]')].flatMap(el => [...el.classList]))];
-    const css = compiler.build(classes);
-    const parsed = postcss.parse(css);
-    const rules: postcss.Rule[] = [];
-    parsed.walkRules(rule => { rules.push(rule); });
-    const rule = rules.find(node => node.selector.startsWith(':root[data-plugin-theme-active]'));
-    assert.ok(rule && rule.type === 'rule');
-    const matches = [...dom.window.document.querySelectorAll(rule.selector)];
-    assert.ok(matches.includes(panel));
-    assert.ok(matches.includes(permissions));
-    assert.ok(!matches.includes(dom.window.document.getElementById('ordinary-card')!), 'security selector stays within the existing marked surfaces');
-    const declarations = new Map(rule.nodes.filter(node => node.type === 'decl').map(node => [node.prop, node]));
-    for (const name of ['background','foreground','card','card-foreground','popover','popover-foreground','primary','primary-foreground','secondary','secondary-foreground','muted','muted-foreground','accent','accent-foreground','destructive','destructive-foreground','border','input','ring']) {
-      const declaration = declarations.get(`--color-${name}`);
-      assert.equal(declaration?.value, `hsl(var(--host-security-${name}))`, `Tailwind alias ${name} cannot inherit the plugin value`);
-      assert.equal(declaration.important, true);
-    }
-    for (const name of ['card','background','primary']) {
-      const utility = rules.find(node => node.selector === `.bg-${name}`);
-      assert.ok(utility && utility.type === 'rule');
-      assert.ok(utility.nodes.some(node => node.type === 'decl' && node.prop === 'background-color' && node.value === `var(--color-${name})`), 'verify what the actual compiled utility consumes');
-    }
-    const mutedText = rules.find(node => node.selector === '.text-muted-foreground');
-    assert.ok(mutedText?.nodes.some(node => node.type === 'decl' && node.prop === 'color' && node.value === 'var(--color-muted-foreground)'));
-  } finally { dom.window.close(); }
-});

components/KeyboardInteractiveModal.remember.test.tsx

@@ -0,0 +1,138 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import React from "react";
+import type { Host, Identity } from "../types";
+import { handleKeyboardInteractiveSubmitImpl } from "../application/app/AppHandlers";
+import { createTerminalSessionStarters } from "./terminal/runtime/createTerminalSessionStarters";
+import { createPromptLineBreakState } from "./terminal/runtime/promptLineBreak";
+import { createDomRenderer, dispatchDomEvent, installDomEnvironment } from "./test-support/renderReactDom";
+
+const noop = () => {};
+
+test("KI remember input preserves the reconnect account and leaves shared hosts unchanged", async (t) => {
+  const dom = installDomEnvironment();
+  const globals = {
+    MutationObserver: dom.window.MutationObserver,
+    NodeFilter: dom.window.NodeFilter,
+    HTMLInputElement: dom.window.HTMLInputElement,
+    localStorage: dom.window.localStorage,
+  };
+  const previous = new Map(Object.keys(globals).map((key) => [key, Object.getOwnPropertyDescriptor(globalThis, key)]));
+  for (const [key, value] of Object.entries(globals)) Object.defineProperty(globalThis, key, { configurable: true, value });
+  const { KeyboardInteractiveModal } = await import("./KeyboardInteractiveModal");
+  const { I18nProvider } = await import("../application/i18n/I18nProvider");
+  const renderer = await createDomRenderer(dom.document);
+  try {
+    for (const scenario of [
+      { name: "differing usernames", hostUsername: "old-account", identityUsername: "fixtureki", remember: true },
+      { name: "blank host username", hostUsername: "", identityUsername: "fixtureki", remember: true },
+      { name: "blank identity username", hostUsername: "fixtureki", identityUsername: "  ", remember: true },
+      { name: "no identity", hostUsername: "fixtureki", identityUsername: undefined, remember: true },
+      { name: "remember unchecked", hostUsername: "old-account", identityUsername: "fixtureki", remember: false },
+      { name: "secondary password", hostUsername: "old-account", identityUsername: "fixtureki", remember: true, allowSavePassword: false },
+    ]) {
+      await t.test(scenario.name, async () => {
+        const identity: Identity = {
+          id: "shared", label: "Fixture", username: scenario.identityUsername ?? "",
+          authMethod: "password", password: "fixture-old", created: 0,
+        };
+        const identities = scenario.identityUsername === undefined ? [] : [identity];
+        const originalIdentity = { ...identity };
+        const host: Host = {
+          id: "changed", label: "Fixture", hostname: "127.0.0.1", username: scenario.hostUsername,
+          tags: [], os: "linux", protocol: "ssh", authMethod: "password",
+          password: "fixture-host-old", savePassword: false,
+          ...(identities.length ? { identityId: identity.id } : {}),
+        };
+        const otherHost = { ...host, id: "unchanged", label: "Other fixture" };
+        let hosts = [host, otherHost];
+        let updates = 0;
+        const request = {
+          requestId: `ki-${scenario.name}`, sessionId: "fixture-session", hostname: host.hostname,
+          name: "Password expiry", instructions: "", prompts: [{ prompt: "New password:", echo: false }],
+          allowSavePassword: scenario.allowSavePassword ?? true,
+        };
+        let queue = [request];
+        const responses: unknown[][] = [];
+        await renderer.render(
+          <I18nProvider locale="en">
+            <KeyboardInteractiveModal request={request} onCancel={() => false}
+              onSubmit={(requestId, values, savePassword) => handleKeyboardInteractiveSubmitImpl(() => ({
+                hosts, identities, keyboardInteractiveQueue: queue,
+                sessions: [{ id: "fixture-session", hostId: host.id, hostname: host.hostname }],
+                netcattyBridge: { get: () => ({ respondKeyboardInteractive: (...args: unknown[]) => {
+                  responses.push(args);
+                  return { success: true };
+                } }) },
+                setKeyboardInteractiveQueue: (updater: (items: typeof queue) => typeof queue) => { queue = updater(queue); },
+                updateHosts: (next: Host[]) => { updates += 1; hosts = next; },
+                t: (key: string) => key, toast: { error: (message: string) => assert.fail(message) },
+              }), requestId, values, savePassword)} />
+          </I18nProvider>,
+        );
+        const input = dom.document.querySelector<HTMLInputElement>("#ki-prompt-0");
+        assert.ok(input);
+        Object.getOwnPropertyDescriptor(dom.window.HTMLInputElement.prototype, "value")!.set!.call(input, "fixture-new");
+        await dispatchDomEvent(input, new dom.window.Event("input", { bubbles: true }));
+        const checkbox = dom.document.querySelector<HTMLInputElement>('input[type="checkbox"]');
+        if (scenario.allowSavePassword === false) assert.equal(checkbox, null);
+        else {
+          assert.ok(checkbox);
+          assert.equal(checkbox.checked, false);
+          if (scenario.remember) await dispatchDomEvent(checkbox, new dom.window.MouseEvent("click", { bubbles: true }));
+        }
+        const submit = [...dom.document.querySelectorAll("button")].find((button) => button.textContent === "Submit");
+        assert.ok(submit);
+        await dispatchDomEvent(submit, new dom.window.MouseEvent("click", { bubbles: true }));
+        assert.deepEqual(responses, [[request.requestId, ["fixture-new"], false]]);
+        assert.deepEqual(queue, []);
+        const saved = scenario.remember && scenario.allowSavePassword !== false;
+        assert.equal(updates, saved ? 1 : 0);
+        assert.equal(hosts[0].identityId, saved && identities.length ? "" : host.identityId);
+        assert.equal(hosts[0].password, saved ? "fixture-new" : host.password);
+        assert.equal(hosts[0].savePassword, saved);
+        assert.equal(hosts[1], otherHost);
+        assert.deepEqual(identity, originalIdentity);
+
+        // Exercise the reconnect launcher that builds the actual SSH bridge request.
+        for (const [index, candidate] of hosts.entries()) {
+          let started: { username: string; password?: string } | undefined;
+          const ctx = {
+            host: candidate, identities, keys: [], knownHosts: [], resolvedChainHosts: [],
+            sessionId: `reconnect-${index}`, terminalSettings: {},
+            sessionRef: { current: null }, hasConnectedRef: { current: true },
+            hasRunStartupCommandRef: { current: true }, disposeDataRef: { current: null },
+            disposeExitRef: { current: null }, fitAddonRef: { current: null },
+            serializeAddonRef: { current: null }, pendingAuthRef: { current: null },
+            promptLineBreakStateRef: { current: createPromptLineBreakState() }, sudoAutofillRef: { current: null },
+            updateStatus: noop, setStatus: noop, setError: noop, setNeedsAuth: noop,
+            setAuthRetryMessage: noop, setAuthPassword: noop, setProgressLogs: noop,
+            setProgressValue: noop, setChainProgress: noop,
+            terminalBackend: {
+              backendAvailable: () => true,
+              startSSHSession: async (options: { username: string; password?: string }) => { started = options; return `reconnect-${index}`; },
+              onSessionData: () => noop, onSessionExit: () => noop, onChainProgress: () => noop,
+              writeToSession: noop, resizeSession: noop,
+            },
+          };
+          await createTerminalSessionStarters(ctx as never).startSSH({
+            cols: 80, rows: 24, write: noop, writeln: noop, scrollToBottom: noop,
+          } as never);
+          assert.ok(started);
+          assert.equal(started.username, scenario.identityUsername?.trim() || scenario.hostUsername);
+          assert.equal(started.password, saved && index === 0 ? "fixture-new" : identities.length ? "fixture-old" : "fixture-host-old");
+        }
+        // A fresh request resets the checkbox and submitting state for the next case.
+        await renderer.render(<I18nProvider locale="en"><KeyboardInteractiveModal request={null} onSubmit={() => false} onCancel={() => false} /></I18nProvider>);
+      });
+    }
+  } finally {
+    await renderer.unmount();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else Reflect.deleteProperty(globalThis, key);
+    }
+    dom.cleanup();
+  }
+});

components/KeychainManager.tsx

@@ -882,7 +882,6 @@ echo $3 >> "$FILE"`);
       {/* Slide-out Panel */}
       {panel.type !== "closed" && (
         <AsidePanel
-          dataSection="keychain-security-panel"
           open={true}
           onClose={closePanel}
           title={panelTitle}

components/PluginHostInteractionHost.test.tsx

@@ -1,91 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { EventEmitter } from 'node:events';
-import { JSDOM } from 'jsdom';
-
-test('host dialog drives choice/input/copy and the two-phase clipboard share using real service action tokens', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
-  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
-  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
-  install('IS_REACT_ACT_ENVIRONMENT', true);
-  const { default: React, act } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { I18nProvider } = await import('../application/i18n/I18nProvider');
-  const { PluginHostInteractionHost } = await import('./plugins/PluginHostInteractionHost');
-  const { PluginHostInteractionService, assertInteractionRequest } = await import('../electron/plugins/hostInteractionService.cjs');
-  let listener: ((event: unknown) => void) | null = null;
-  let reads = 0;
-  const writes: string[] = [];
-  const audits: unknown[] = [];
-  const sender = Object.assign(new EventEmitter(), { id: 7, isDestroyed: () => false, send(_channel: string, payload: unknown) { listener?.(payload); } });
-  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
-  const service = new PluginHostInteractionService({
-    getWindow: () => owner, isLocked: () => false,
-    permissionEngine: { onDidRevoke() { return { dispose() {} }; } },
-    database: { recordSecurityAudit(...args: unknown[]) { audits.push(args); } },
-    quotaManager: { chargeBytes() {} },
-    clipboard: { readText() { reads++; return 'synthetic private text'; }, writeText(value: string) { writes.push(value); } },
-  });
-  Object.assign(dom.window, { netcatty: {
-    onPluginInteraction(callback: (event: unknown) => void) { listener = callback; return () => { listener = null; }; },
-    async setPluginInteractionReady(ready: boolean) { return service.setReady(sender, ready); },
-    async respondPluginInteraction(response: unknown) { return service.respond(sender, response); },
-  } });
-  const context = { pluginId: 'com.example.synthetic', pluginVersion: '1.0.0', runtimeId: 'runtime-synthetic', signal: new AbortController().signal, async assertActive() {} };
-  const root = createRoot(document.getElementById('root')!);
-  const settle = () => new Promise((resolve) => setTimeout(resolve, 20));
-  const button = (text: string) => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((item) => item.textContent === text)!;
-  const click = async (element: HTMLElement) => { assert.ok(element); await act(async () => { element.click(); await settle(); }); };
-  const begin = async (params: unknown) => {
-    let promise!: Promise<unknown>;
-    await act(async () => { promise = service.request(assertInteractionRequest(params), context); void promise.catch(() => {}); await settle(); });
-    return { promise };
-  };
-  try {
-    await act(async () => root.render(<I18nProvider locale="en"><PluginHostInteractionHost /></I18nProvider>));
-    const choice = await begin({ kind: 'quickPick', title: 'Synthetic choice', items: [{ id: 'compose', label: 'Compose' }] });
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /com.example.synthetic/);
-    assert.equal(button('Continue').disabled, true);
-    await click(document.querySelector<HTMLInputElement>('input[type="radio"]')!);
-    await click(button('Continue'));
-    assert.deepEqual(await choice.promise, { cancelled: false, value: 'compose' });
-    await assert.rejects(begin({ kind: 'input', title: 'Invalid hidden newline', initialValue: 'first\nsecond' }), /invalid/);
-    assert.equal(document.querySelector('[role="dialog"]'), null, 'invalid initial text never creates a misleading single-line dialog');
-    const input = await begin({ kind: 'input', title: 'Synthetic input', initialValue: 'synthetic output' });
-    assert.equal(document.querySelector<HTMLInputElement>('input')?.value, 'synthetic output');
-    await click(button('Continue'));
-    assert.deepEqual(await input.promise, { cancelled: false, value: 'synthetic output' });
-    const copy = await begin({ kind: 'clipboard.write', title: 'Copy result', text: 'synthetic output' });
-    assert.deepEqual(writes, []);
-    assert.equal(document.querySelector('textarea')?.value, 'synthetic output');
-    await click(button('Copy to clipboard'));
-    assert.deepEqual(await copy.promise, { cancelled: false, value: true });
-    assert.deepEqual(writes, ['synthetic output']);
-    const share = await begin({ kind: 'clipboard.read', title: 'Share clipboard' });
-    assert.equal(reads, 0);
-    assert.equal(document.querySelector('textarea'), null);
-    await click(button('Preview clipboard'));
-    assert.equal(reads, 1);
-    assert.equal(document.querySelector('textarea')?.value, 'synthetic private text');
-    await click(button('Share with plugin'));
-    assert.deepEqual(await share.promise, { cancelled: false, value: 'synthetic private text' });
-    assert.equal(JSON.stringify(audits).includes('synthetic private text'), false);
-    const cancelled = await begin({ kind: 'clipboard.write', title: 'Cancelled copy', text: 'must not copy' });
-    await click(button('Cancel'));
-    assert.deepEqual(await cancelled.promise, { cancelled: true });
-    assert.deepEqual(writes, ['synthetic output']);
-    assert.equal(service.pending.size, 0);
-  } finally {
-    await act(async () => { root.unmount(); await settle(); }); service.shutdown(); dom.window.close();
-    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
-  }
-});

components/PluginTerminalSidebar.test.tsx

@@ -1,128 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-test('terminal extension pages use actual split panes, focus and session ownership without sharing session data', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'SVGElement', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('PointerEvent', dom.window.MouseEvent);
-  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
-  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window)); install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window)); install('IS_REACT_ACT_ENVIRONMENT', true);
-  let rectX = 200;
-  dom.window.HTMLElement.prototype.getBoundingClientRect = () => new dom.window.DOMRect(rectX, 100, 400, 300);
-  const { default: React, act, useCallback, useRef, useState } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { I18nProvider } = await import('../application/i18n/I18nProvider');
-  const { activeTabStore } = await import('../application/state/activeTabStore');
-  const { sidePanelLiveStore, SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT } = await import('../application/state/sidePanelLiveStore');
-  const { useTerminalSidePanelLayoutState } = await import('../application/state/useTerminalSidePanelLayoutState');
-  const { usePluginTerminalSidebar } = await import('../application/state/usePluginTerminalSidebar');
-  const { PluginTerminalSidebarLauncher, PluginTerminalSidebarPageHost } = await import('./plugins/PluginTerminalSidebar');
-  const { SidePanelLayoutTree } = await import('./terminalLayer/TerminalLayerSidePanelSection');
-  const { PersistentSidePanelPortal } = await import('./terminalLayer/terminalLayerSidePanelSlots');
-  const { collectSidePanelPanes } = await import('../domain/sidePanelLayout');
-  type Tool = import('../domain/sidePanelLayout').SidePanelTool;
-  let selectedSession = 'synthetic-session-a';
-  const getSession = () => selectedSession;
-  const a = { id: 'com.example.sidebar.first', title: 'First page', location: 'terminal-sidebar', entry: 'page.html', visible: true };
-  const b = { ...a, id: 'com.example.sidebar.second', title: 'Second page' };
-  let snapshot = { locale: 'en', plugins: [{ id: 'com.example.sidebar', displayName: 'Synthetic plugin', version: '1.0.0', commands: [], keybindings: [], menus: [], settings: [], views: [a, b] }] };
-  const changed = new Set<() => void>(), focusListeners = new Set<(event: { instanceId: string }) => void>();
-  const opens: NetcattyPluginViewOpenRequest[] = [], closes: string[] = [], focus: string[] = [], bounds: Array<{ instanceId: string; x: number }> = [];
-  const visible = new Map<string, boolean>();
-  Object.assign(dom.window, { netcatty: {
-    async getPluginRuntimeStatus() { return { available: true }; }, async getPluginContributions() { return snapshot; },
-    onPluginContributionsChanged(fn: () => void) { changed.add(fn); return () => { changed.delete(fn); }; },
-    onPluginViewClosed() { return () => {}; },
-    onPluginViewFocused(fn: (event: { instanceId: string }) => void) { focusListeners.add(fn); return () => { focusListeners.delete(fn); }; },
-    async openPluginView(payload: NetcattyPluginViewOpenRequest) { opens.push(payload); return { instanceId: payload.instanceId! }; },
-    async closePluginView(id: string) { closes.push(id); },
-    async setPluginViewBounds(id: string, rect: { x: number }) { bounds.push({ instanceId: id, x: rect.x }); },
-    async setPluginViewVisibility(id: string, value: boolean) { visible.set(id, value); },
-    async focusPluginView(event: { instanceId: string }) { focus.push(event.instanceId); for (const fn of focusListeners) fn(event); },
-  } });
-  let split!: () => void;
-  function Fixture() {
-    const state = useTerminalSidePanelLayoutState(); const latest = useRef(state); latest.current = state;
-    const model = usePluginTerminalSidebar({ layouts: state.sidePanelLayouts, getSession, isTerminalTab: (id) => id === 'workspace-synthetic' || id === 'synthetic-local-terminal',
-      select: (tool) => state.selectSidePanelToolForTab(activeTabStore.getActiveTabId(), tool),
-      withdraw: (tabId, paneId, tool) => {
-        const layout = state.sidePanelLayoutsRef.current.get(tabId);
-        if (layout && collectSidePanelPanes(layout.root).some((pane) => pane.id === paneId && pane.tool === tool)) state.closePane(tabId, paneId);
-      } });
-    const [hosts, setHosts] = useState(new Map<Tool, HTMLElement>()); const parking = useRef<HTMLDivElement>(null);
-    const register = useCallback((tool: Tool, host: HTMLElement | null) => setHosts((prior) => {
-      if ((prior.get(tool) ?? null) === host) return prior;
-      const next = new Map(prior); if (host) next.set(tool, host); else next.delete(tool); return next;
-    }), []);
-    const focusPane = useCallback((id: string) => latest.current.focusPane(activeTabStore.getActiveTabId(), id), []);
-    const closePane = useCallback((id: string) => { latest.current.closePane(activeTabStore.getActiveTabId(), id); }, []);
-    const resize = useCallback(() => {}, []);
-    const layout = model.tabId ? state.sidePanelLayouts.get(model.tabId) : null;
-    const panes = layout ? collectSidePanelPanes(layout.root) : [];
-    split = () => state.splitPane('workspace-synthetic', `plugin-view:${b.id}`, 'vertical', { paneId: 'second-pane', splitId: 'plugin-split' }, 600);
-    return <><PluginTerminalSidebarLauncher sessionId={selectedSession} />
-      {layout && <SidePanelLayoutTree node={layout.root} layout={layout} paneCount={panes.length} labels={new Map(model.pages.map((page) => [page.tool, page.title]))}
-        onClose={closePane} onFocus={focusPane} onHostChange={register} onResize={resize} separator="#777" accent="#4488cc" closePaneLabel="Close pane" resizeLabel="Resize" />}
-      <div ref={parking} hidden aria-hidden="true" />
-      {model.sessionId && panes.map((pane) => {
-        const page = model.pages.find((item) => item.tool === pane.tool); const target = hosts.get(pane.tool) ?? parking.current;
-        if (!page || !target) return null;
-        return <PersistentSidePanelPortal key={`${pane.id}:${model.sessionId}`} portalKey={`plugin-${pane.id}`} target={target}>
-          <PluginTerminalSidebarPageHost page={page} tabId={model.tabId!} sessionId={model.sessionId} getSession={getSession} adapter={model.contributions}
-            focusOnReveal={layout?.focusedPaneId === pane.id} focused={() => focusPane(pane.id)} unavailable={() => closePane(pane.id)} />
-        </PersistentSidePanelPortal>;
-      })}</>;
-  }
-  const root = createRoot(document.getElementById('root')!); const settle = () => new Promise((resolve) => setTimeout(resolve, 40));
-  try {
-    activeTabStore.setActiveTabId('workspace-synthetic'); sidePanelLiveStore.update({ ...SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT, focusedSessionId: selectedSession });
-    await act(async () => { root.render(<I18nProvider locale="en"><Fixture /></I18nProvider>); await settle(); });
-    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Extension pages"]')!.click(); await settle(); });
-    const firstButton = [...document.querySelectorAll('button')].find((button) => button.textContent?.includes('First page'))!;
-    await act(async () => { firstButton.click(); await settle(); });
-    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 1);
-    assert.ok(document.querySelector('[data-pane-tool] [data-plugin-view-slot="terminal-sidebar"]'));
-    assert.equal(opens.length, 1); assert.deepEqual(opens[0].context, { 'netcatty.surface': 'terminal-sidebar' });
-    await act(async () => { split(); await settle(); });
-    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 2);
-    assert.equal(opens.length, 2);
-    const firstId = opens.find((item) => item.viewId === a.id)!.instanceId!;
-    await act(async () => { for (const fn of focusListeners) fn({ instanceId: firstId }); await settle(); });
-    assert.equal(document.querySelector(`[data-pane-tool="plugin-view:${a.id}"]`)?.getAttribute('data-focused'), 'true');
-    const dialog = document.createElement('div'); dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true');
-    await act(async () => { document.body.append(dialog); await settle(); });
-    assert.ok(opens.every((item) => visible.get(item.instanceId!) === false));
-    focus.length = 0;
-    await act(async () => { dialog.remove(); await settle(); });
-    assert.ok(focus.length > 0); assert.ok(focus.every((id) => id === firstId), 'restoring panes focuses only the host-selected pane');
-    const old = opens.map((item) => item.instanceId!);
-    await act(async () => { selectedSession = 'synthetic-session-b'; sidePanelLiveStore.update({ ...SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT, focusedSessionId: selectedSession });
-      assert.ok(old.every((id) => closes.includes(id)), 'workspace focus cancels old native owners synchronously'); await settle(); });
-    assert.equal(opens.length, 4);
-    assert.notEqual(opens[0].scopeId, opens[2].scopeId);
-    assert.ok(opens.every((item) => JSON.stringify(item.context) === JSON.stringify({ 'netcatty.surface': 'terminal-sidebar' })));
-    await act(async () => { rectX = 260; snapshot = { ...snapshot, plugins: [{ ...snapshot.plugins[0], views: [{ ...a, visible: false }, b] }] }; for (const fn of changed) fn(); await settle(); });
-    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 1);
-    assert.equal(document.querySelector('[data-pane-tool]')?.getAttribute('data-pane-tool'), `plugin-view:${b.id}`);
-    assert.ok(bounds.some((item) => item.x === 260), 'portal relocation updates native geometry');
-    const last = opens.at(-1)!.instanceId!;
-    await act(async () => { activeTabStore.setActiveTabId('vault'); assert.ok(closes.includes(last)); await settle(); });
-    assert.equal(document.querySelector('[data-plugin-terminal-sidebar]'), null);
-    await act(async () => { selectedSession = 'synthetic-local-terminal'; activeTabStore.setActiveTabId(selectedSession); await settle(); });
-    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Extension pages"]')!.click(); await settle(); });
-    const localPage = [...document.querySelectorAll('button')].find((button) => button.textContent?.includes('Second page'))!;
-    await act(async () => { localPage.click(); await settle(); });
-    assert.ok(document.querySelector('[data-plugin-view-slot="terminal-sidebar"]'), 'standalone Local Terminal is a valid navigation owner');
-    assert.deepEqual(opens.at(-1)!.context, { 'netcatty.surface': 'terminal-sidebar' });
-  } finally {
-    await act(async () => { root.unmount(); await settle(); }); dom.window.close();
-    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
-  }
-});

components/PluginVaultPages.test.tsx

@@ -1,101 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-test('Vault navigation mounts a real content slot, yields to host dialogs, and withdraws stale pages', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'MutationObserver', 'CustomEvent', 'Event']) {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value: key === 'window' ? dom.window : dom.window[key as keyof Window] });
-  }
-  for (const [key, value] of Object.entries({ getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
-    requestAnimationFrame: dom.window.requestAnimationFrame.bind(dom.window), cancelAnimationFrame: dom.window.cancelAnimationFrame.bind(dom.window), IS_REACT_ACT_ENVIRONMENT: true })) {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  }
-  dom.window.HTMLElement.prototype.getBoundingClientRect = () => ({ x: 200, y: 100, width: 640, height: 480, top: 100, left: 200, right: 840, bottom: 580, toJSON() {} });
-  const { default: React, act, useState } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { usePluginVaultPages } = await import('../application/state/usePluginVaultPages');
-  const { PluginVaultNavigation, PluginVaultPage } = await import('./plugins/PluginVaultPages');
-  const { activeTabStore } = await import('../application/state/activeTabStore');
-  const { requestOpenPluginView } = await import('../application/state/usePluginViewLifecycle');
-  const { I18nProvider } = await import('../application/i18n/I18nProvider');
-  const page = { id: 'com.example.page.main', title: 'Synthetic page', location: 'vault-page', entry: 'page.html', visible: true };
-  let snapshot = { locale: 'en', plugins: [{ id: 'com.example.page', version: '1.0.0', displayName: 'Synthetic plugin', commands: [], keybindings: [], menus: [], settings: [], views: [page] }] };
-  let changed: (() => void) | undefined;
-  const listeners = new Set<(event: NetcattyPluginViewClosedEvent) => void>();
-  const opens: NetcattyPluginViewOpenRequest[] = [], closes: string[] = [], visibility: boolean[] = [];
-  let defer: ((value: { instanceId: string }) => void) | undefined;
-  let deferOpen = false;
-  let delayLayout = false;
-  const rejectOldLayout: Array<(error: Error) => void> = [];
-  const layoutResult = () => delayLayout ? new Promise<void>((_resolve, reject) => { rejectOldLayout.push(reject); }) : Promise.resolve();
-  Object.assign(dom.window, { netcatty: {
-    async getPluginRuntimeStatus() { return { available: true }; },
-    async getPluginContributions() { return snapshot; },
-    onPluginContributionsChanged(fn: () => void) { changed = fn; return () => { changed = undefined; }; },
-    onPluginViewClosed(fn: (event: NetcattyPluginViewClosedEvent) => void) { listeners.add(fn); return () => { listeners.delete(fn); }; },
-    async openPluginView(payload: NetcattyPluginViewOpenRequest) { opens.push(payload); return deferOpen ? new Promise<{ instanceId: string }>((resolve) => { defer = resolve; }) : { instanceId: payload.instanceId! }; },
-    async closePluginView(id: string) { closes.push(id); }, async setPluginViewBounds() { await layoutResult(); },
-    async setPluginViewVisibility(_id: string, visible: boolean) { visibility.push(visible); await layoutResult(); },
-  } });
-  let selectSection!: (section: 'hosts' | `plugin-vault:${string}`) => void;
-  function Fixture() {
-    const [section, select] = useState<'hosts' | `plugin-vault:${string}`>('hosts'); selectSection = select;
-    const model = usePluginVaultPages({ locale: 'en', section, select });
-    return <><aside><button data-plugin-vault-fallback onClick={() => select('hosts')}>Hosts</button><PluginVaultNavigation model={model} collapsed={false} /></aside>
-      <main data-section="vault-main">{model.selected ? <PluginVaultPage key={model.selected.key} model={model} /> : <p>Built-in hosts</p>}</main></>;
-  }
-  const root = createRoot(document.getElementById('root')!);
-  const settle = () => new Promise((resolve) => setTimeout(resolve, 35));
-  const clickPage = async () => { await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Synthetic page — Synthetic plugin"]')!.click(); await settle(); }); };
-  try {
-    activeTabStore.setActiveTabId('vault');
-    await act(async () => { root.render(<I18nProvider locale="en"><Fixture /></I18nProvider>); await settle(); });
-    assert.equal(opens.length, 0, 'catalog enumeration does not activate the plugin');
-    await clickPage();
-    assert.ok(document.querySelector('[data-section="vault-main"] [data-plugin-view-slot="vault-page"]'));
-    assert.equal(opens.length, 1);
-    assert.deepEqual(opens[0].context, { 'netcatty.surface': 'vault-page' }, 'no Vault/session data accompanies navigation');
-    assert.equal(visibility.at(-1), true);
-    const dialog = document.createElement('div'); dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true');
-    await act(async () => { document.body.append(dialog); await settle(); });
-    assert.equal(visibility.at(-1), false, 'native content yields to host security/settings dialogs');
-    await act(async () => { dialog.remove(); await settle(); });
-    assert.equal(visibility.at(-1), true);
-    await act(async () => { activeTabStore.setActiveTabId('terminal:synthetic'); assert.ok(closes.includes(opens[0].instanceId!)); await settle(); });
-    await act(async () => { activeTabStore.setActiveTabId('vault'); await settle(); });
-    assert.equal(opens.length, 2);
-    await act(async () => { snapshot = { ...snapshot, plugins: [] }; changed?.(); await settle(); });
-    await act(async () => { await settle(); });
-    assert.ok(closes.includes(opens[1].instanceId!));
-    assert.equal(document.querySelector('[data-plugin-vault-page]'), null);
-    assert.equal(document.activeElement?.textContent, 'Hosts');
-    await act(async () => { selectSection('plugin-vault:missing'); await settle(); });
-    assert.match(document.querySelector('main')!.textContent!, /Built-in hosts/);
-    await act(async () => { snapshot = { ...snapshot, plugins: [{ id: 'com.example.page', version: '1.0.0', displayName: 'Synthetic plugin', commands: [], keybindings: [], menus: [], settings: [], views: [page] }] }; changed?.(); await settle(); });
-    deferOpen = true;
-    await act(async () => { requestOpenPluginView({ viewId: page.id }); await settle(); });
-    assert.equal(opens.length, 3);
-    await act(async () => { selectSection('hosts'); await settle(); });
-    assert.ok(closes.includes(opens[2].instanceId!), 'cancel reserved instance before its open response');
-    await act(async () => { defer!({ instanceId: opens[2].instanceId! }); await settle(); });
-    assert.equal(document.querySelector('[data-plugin-vault-page]'), null, 'late open cannot restore withdrawn page');
-    assert.ok(closes.filter((id) => id === opens[2].instanceId).length >= 2, 'late native response is also closed');
-    deferOpen = false;
-    const second = { ...page, id: 'com.example.page.second', title: 'Second page' };
-    await act(async () => { snapshot = { ...snapshot, plugins: [{ ...snapshot.plugins[0], views: [page, second] }] }; changed?.(); await settle(); });
-    delayLayout = true;
-    await clickPage();
-    assert.ok(rejectOldLayout.length >= 2, 'old page has both bounds and visibility IPC in flight');
-    await act(async () => { selectSection('hosts'); await settle(); });
-    delayLayout = false;
-    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Second page — Synthetic plugin"]')!.click(); await settle(); });
-    await act(async () => { for (const reject of rejectOldLayout) reject(new Error('old page layout failed')); await settle(); });
-    assert.equal(document.querySelector('[data-plugin-vault-page]')?.getAttribute('aria-label'), 'Second page', 'old bounds/visibility failures cannot withdraw the newly selected page');
-  } finally {
-    await act(async () => { root.unmount(); await settle(); }); dom.window.close();
-    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
-  }
-});

components/QuickSwitcher.pluginContributions.test.tsx

@@ -151,24 +151,3 @@ test('plugin palette items keep repeated placements independently addressable',
     commandId: 'com.example.palette.run',
   }]);
 });
-
-test('packaged Starter contributions are discoverable through the real palette builder', async (context) => {
-  const { createRequire } = await import('node:module');
-  const { mkdtempSync, rmSync } = await import('node:fs');
-  const { tmpdir } = await import('node:os');
-  const { join } = await import('node:path');
-  const require = createRequire(import.meta.url);
-  const { PluginDatabase } = require('../electron/plugins/database.cjs');
-  const { PluginContributionService } = require('../electron/plugins/contributionService.cjs');
-  const manifest = JSON.parse(readFileSync(new URL('../examples/plugins/starter-netcatty/netcatty.plugin.json', import.meta.url), 'utf8'));
-  const root = mkdtempSync(join(tmpdir(), 'starter-palette-'));
-  const database = new PluginDatabase(join(root, 'plugins.sqlite'));
-  context.after(() => { database.close(); rmSync(root, { recursive: true, force: true }); });
-  database.installVersion({ pluginId: manifest.id, version: manifest.version, manifest, archiveSha256: 'a'.repeat(64), packageRelativePath: 'starter' }, { enable: true });
-  const service = new PluginContributionService({ database, runtimeSupervisor: {}, secretStore: {}, getLocale: () => 'en' });
-  const items = buildPluginPaletteItems(service.snapshot().plugins, 'Starter');
-  assert.ok(items.some((item) => item.type === 'plugin-command' && item.commandId === 'com.netcatty.starter.greet'));
-  assert.ok(items.some((item) => item.type === 'plugin-view' && item.id === 'com.netcatty.starter.panel'));
-  database.setEnabled(manifest.id, false);
-  assert.equal(buildPluginPaletteItems(service.snapshot().plugins, 'Starter').length, 0);
-});

components/SettingsPage.tsx

@@ -1,5 +1,3 @@
-import { useAppThemeStyle } from "../application/app/useAppThemeStyle";
-import { selectPluginThemeTokens } from "../application/state/pluginContributionEnvironment";
 /**
  * Settings Page - Standalone settings window content
  * This component is rendered in a separate Electron window
@@ -324,9 +322,6 @@ const SettingsSyncTabWithVault: React.FC<{ onSettingsApplied?: () => void }> = (
 };
 
 const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLockState }> = ({ settings, appLock }) => {
-    // This publisher also runs in detached Settings: never broadcast a local preview.
-    const committedAppThemeStyle = useAppThemeStyle(false);
-    const pluginThemeTokens = useMemo(() => selectPluginThemeTokens(committedAppThemeStyle as Record<string, unknown>), [committedAppThemeStyle]);
     const { t } = useI18n();
     const { request, clearFocus, openSearch } = useSettingsFocus();
     const { notifyRendererReady, closeSettingsWindow, onWindowCommandCloseRequested } = useWindowControls();
@@ -720,7 +715,7 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
             </Tabs>
         </div>
         <ExternalMcpApprovalsHost />
-        <PluginContributionHost locale={settings.uiLanguage} theme={settings.resolvedTheme} themeTokens={pluginThemeTokens} />
+        <PluginContributionHost locale={settings.uiLanguage} theme={settings.resolvedTheme} />
         </>
     );
 };

components/TerminalLayer.tsx

@@ -123,7 +123,6 @@ import {
 import { classifyDistroId, hostRestrictsExtraSshChannels, shouldProbeSessionCwd } from '../domain/host';
 import {
   collectSidePanelPanes,
-  isPluginSidePanelTool,
   sidePanelLayoutHasTool,
   type SidePanelLayout,
   type SidePanelSplitDirection,
@@ -1934,16 +1933,6 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
     resizeSidePanelSplitForTab(tabId, splitId, sizes);
   }, [resizeSidePanelSplitForTab]);
 
-  const handleWithdrawPluginSidebarPane = useCallback((tabId: string, paneId: string, expectedTool: SidePanelTab) => {
-    if (!isPluginSidePanelTool(expectedTool)) return;
-    const layout = sidePanelLayoutsRef.current.get(tabId);
-    const pane = layout && collectSidePanelPanes(layout.root).find((item) => item.id === paneId);
-    if (pane?.tool !== expectedTool) return;
-    setMagnifiedPane((current) => current?.tabId === tabId && current.target.kind === 'side-panel'
-      && current.target.paneId === paneId ? null : current);
-    closeSidePanelPaneForTab(tabId, paneId);
-  }, [closeSidePanelPaneForTab, sidePanelLayoutsRef]);
-
   // Toggle SFTP from activity bar header
   const handleToggleSftpFromBar = useCallback(() => {
     handleSwitchSidePanelTab('sftp');
@@ -2628,9 +2617,6 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
     handleOpenAI,
     handleOpenSystem,
     handleOpenNotes,
-    getActiveTerminalSessionId,
-    handleSwitchSidePanelTab,
-    handleWithdrawPluginSidebarPane,
     handleOpenBrowser,
     handleFocusSidePanelPane,
     handleMagnifySidePanelPane,

components/VaultView.tsx

@@ -161,7 +161,6 @@ import { VaultViewLayout } from "./vault/VaultViewLayout";
 import { useVaultHostCollections } from "./vault/useVaultHostCollections";
 import { useVaultImportHandlers } from "../application/state/useVaultImportHandlers";
 import { useVaultGroupDragHandlers } from "./vault/useVaultGroupDragHandlers";
-import { usePluginVaultPages } from "../application/state/usePluginVaultPages";
 
 const LazyProtocolSelectDialog = lazy(() => import("./ProtocolSelectDialog"));
 const LazyConnectionLogsManager = lazy(() => import("./ConnectionLogsManager"));
@@ -179,8 +178,7 @@ export type VaultSection =
   | "notes"
   | "port"
   | "knownhosts"
-  | "logs"
-  | `plugin-vault:${string}`;
+  | "logs";
 
 const haveSameHostOrderResult = (previous: Host[], next: Host[]) => {
   if (previous.length !== next.length) return false;
@@ -367,12 +365,11 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   onVaultFocusRequestHandled,
   terminalSettings,
 }) => {
-  const { t, locale } = useI18n();
+  const { t } = useI18n();
   const rootRef = useRef<HTMLDivElement>(null);
   const hostsRef = useRef(hosts);
   hostsRef.current = hosts;
   const [currentSection, setCurrentSection] = useState<VaultSection>("hosts");
-  const pluginVault = usePluginVaultPages({ locale, section: currentSection, select: setCurrentSection });
   const [search, setSearch] = useState("");
   const [selectedGroupPath, setSelectedGroupPath] = useState<string | null>(
     null,
@@ -1525,7 +1522,6 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
           ContextMenuTrigger,
           Copy,
           currentSection,
-          pluginVault,
           customGroups,
           deleteGroupPath,
           deleteGroupPaths,

components/plugins/PluginBrandIcon.tsx

@@ -1,26 +0,0 @@
-import React, { useState } from 'react';
-import { Package } from 'lucide-react';
-import { usePluginBrandIcon } from '../../application/state/usePluginBrandIcon';
-import { PluginContributionIcon } from './PluginContributionIcon';
-import { resolveCatalogBrandIcon } from './catalogBrandIcons';
-
-export function PluginBrandIcon({ plugin, entry, size = 32, className = '' }: {
-  plugin?: NetcattyInstalledPlugin;
-  entry?: NetcattyPluginCatalogEntry;
-  size?: number;
-  className?: string;
-}) {
-  const manifest = plugin?.manifest ?? entry?.manifest;
-  const icon = manifest?.icon;
-  const key = JSON.stringify([plugin?.id, plugin?.activeVersion, plugin?.archiveSha256, plugin?.runtime?.quarantinedAt, icon]);
-  const loaded = usePluginBrandIcon(plugin);
-  const [failed, setFailed] = useState<string | null>(null);
-  const raster = plugin ? loaded : entry ? resolveCatalogBrandIcon(entry) : null;
-  const imageKey = JSON.stringify([key, raster]);
-  if (icon?.kind === 'theme') return <PluginContributionIcon icon={icon} size={size} className={className} />;
-  if (!raster || failed === imageKey) return <Package size={size} className={className} aria-hidden="true" data-plugin-brand="fallback" />;
-  return <span className={`inline-flex shrink-0 ${className}`} style={{ width: size, height: size }} aria-hidden="true" data-plugin-brand="package">
-    <img src={raster.light} alt="" width={size} height={size} className={raster.dark ? 'h-full w-full object-contain dark:hidden' : 'h-full w-full object-contain'} onError={() => setFailed(imageKey)} />
-    {raster.dark && <img src={raster.dark} alt="" width={size} height={size} className="hidden h-full w-full object-contain dark:block" onError={() => setFailed(imageKey)} />}
-  </span>;
-}

components/plugins/PluginContributionIcon.tsx

@@ -60,7 +60,7 @@ export function PluginContributionIcon({
   const packageIcon = usePluginContributionIcon(pluginId, icon);
 
   if (icon?.kind === 'theme') {
-    const Icon = Object.hasOwn(THEME_ICONS, icon.name) ? THEME_ICONS[icon.name] : Puzzle;
+    const Icon = THEME_ICONS[icon.name] ?? Puzzle;
     return <Icon size={size} className={className} aria-hidden="true" data-plugin-icon-kind="theme" />;
   }
   if (packageIcon) {

components/plugins/PluginHostInteractionHost.tsx

@@ -1,54 +0,0 @@
-import React, { useState } from 'react';
-import { PLUGIN_HOST_INTERACTION_LIMITS } from '@netcatty/plugin-contract';
-import { useI18n } from '../../application/i18n/I18nProvider';
-import { usePluginHostInteractions } from '../../application/state/usePluginHostInteractions';
-import { Button } from '../ui/button';
-import { Input } from '../ui/input';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '../ui/dialog';
-
-export function PluginHostInteractionHost() {
-  const state = usePluginHostInteractions();
-  if (!state.prompt) return null;
-  return <HostInteractionDialog key={state.prompt.requestId} state={state} prompt={state.prompt} />;
-}
-
-function HostInteractionDialog({ state, prompt }: {
-  state: ReturnType<typeof usePluginHostInteractions>;
-  prompt: NonNullable<ReturnType<typeof usePluginHostInteractions>['prompt']>;
-}) {
-  const { t } = useI18n();
-  const [search, setSearch] = useState('');
-  const request = prompt.request;
-  const previewClipboard = request.kind === 'clipboard.read' && prompt.phase === 'request';
-  const textBytes = new TextEncoder().encode(state.value).length;
-  const canSubmit = request.kind === 'quickPick' ? request.items.some((item) => item.id === state.value) : textBytes <= PLUGIN_HOST_INTERACTION_LIMITS.textBytes;
-  return <Dialog open onOpenChange={(open) => { if (!open) void state.respond('cancel'); }}>
-    <DialogContent className="sm:max-w-[520px]" hideCloseButton>
-      <DialogHeader>
-        <DialogTitle>{t('plugins.interaction.title')}</DialogTitle>
-        <DialogDescription className="break-all">{prompt.pluginId} · {prompt.pluginVersion}</DialogDescription>
-      </DialogHeader>
-      <p className="break-words text-sm font-medium">{request.title}</p>
-      <p className="text-xs text-muted-foreground">{t('plugins.interaction.sharing')}</p>
-      {request.kind === 'input' && <Input aria-label={t('plugins.interaction.input')} value={state.value} maxLength={PLUGIN_HOST_INTERACTION_LIMITS.textBytes} autoComplete="off" autoFocus disabled={state.busy} onChange={(event) => state.setValue(event.target.value)} />}
-      {request.kind === 'quickPick' && <>
-        <Input aria-label={t('plugins.interaction.filter')} value={search} onChange={(event) => setSearch(event.target.value)} autoFocus disabled={state.busy} />
-        <div className="max-h-64 space-y-2 overflow-y-auto" role="radiogroup" aria-label={request.title}>
-          {request.items.filter((item) => `${item.label} ${item.description ?? ''}`.toLocaleLowerCase().includes(search.toLocaleLowerCase())).map((item) => <label key={item.id} className="flex items-start gap-3 rounded-md border p-3">
-            <input type="radio" name="plugin-host-choice" value={item.id} checked={state.value === item.id} disabled={state.busy} onChange={() => state.setValue(item.id)} />
-            <span className="min-w-0 break-words text-sm">{item.label}{item.description && <span className="block text-xs text-muted-foreground">{item.description}</span>}</span>
-          </label>)}
-        </div>
-      </>}
-      {previewClipboard && <p className="text-sm">{t('plugins.interaction.previewNote')}</p>}
-      {(request.kind === 'clipboard.write' || prompt.phase === 'preview') && <textarea aria-label={t('plugins.interaction.preview')} readOnly className="min-h-28 max-h-64 w-full resize-none rounded-md border bg-muted/30 p-3 font-mono text-xs" value={request.kind === 'clipboard.write' ? request.text : prompt.previewText ?? ''} />}
-      {state.error && <p role="alert" className="text-sm text-destructive">{t('plugins.interaction.failed')}</p>}
-      <DialogFooter>
-        <Button variant="outline" disabled={state.busy} onClick={() => void state.respond('cancel')}>{t('common.cancel')}</Button>
-        <Button disabled={state.busy || !canSubmit} onClick={() => void state.respond(previewClipboard ? 'preview' : 'submit')}>
-          {t(previewClipboard ? 'plugins.interaction.previewAction' : request.kind === 'clipboard.read' ? 'plugins.interaction.share' : request.kind === 'clipboard.write' ? 'plugins.interaction.copy' : 'common.continue')}
-        </Button>
-      </DialogFooter>
-    </DialogContent>
-  </Dialog>;
-}

components/plugins/PluginTerminalSidebar.tsx

@@ -1,56 +0,0 @@
-import { useMemo } from 'react';
-import { Blocks } from 'lucide-react';
-import { useI18n } from '../../application/i18n/I18nProvider';
-import { activeTabStore } from '../../application/state/activeTabStore';
-import { subscribeSidePanelLiveSnapshot } from '../../application/state/sidePanelLiveStore';
-import { useEmbeddedPluginView } from '../../application/state/useEmbeddedPluginView';
-import { usePluginContributions } from '../../application/state/usePluginContributions';
-import { collectPluginTerminalSidebarPages, PLUGIN_TERMINAL_SIDEBAR_CONTEXT, requestOpenPluginTerminalSidebar,
-  type PluginTerminalSidebarPage } from '../../application/state/usePluginTerminalSidebar';
-import { PluginContributionIcon } from './PluginContributionIcon';
-import { Button } from '../ui/button';
-import { Popover, PopoverClose, PopoverContent, PopoverTrigger } from '../ui/popover';
-
-export function PluginTerminalSidebarLauncher({ sessionId }: { sessionId: string }) {
-  const { locale, t } = useI18n();
-  const contributions = usePluginContributions({ locale, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT });
-  const pages = collectPluginTerminalSidebarPages(contributions.snapshot.plugins);
-  if (!pages.length) return null;
-  return <Popover><PopoverTrigger asChild><Button variant="ghost" size="icon" className="h-6 w-6" aria-label={t('plugins.sidebar.extensions')}><Blocks size={14} /></Button></PopoverTrigger>
-    <PopoverContent align="end" className="max-h-80 w-64 overflow-y-auto p-1">
-      <p className="px-2 py-1 text-xs text-muted-foreground">{t('plugins.sidebar.extensions')}</p>
-      {pages.map((page) => <PopoverClose asChild key={page.tool}><button type="button" className="flex w-full items-center gap-2 rounded px-2 py-2 text-left text-sm hover:bg-accent"
-        onClick={() => requestOpenPluginTerminalSidebar(page.viewId, sessionId)}>
-        <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} /><span className="min-w-0"><span className="block truncate">{page.title}</span><span className="block truncate text-xs text-muted-foreground">{page.pluginName}</span></span>
-      </button></PopoverClose>)}
-    </PopoverContent></Popover>;
-}
-
-export function PluginTerminalSidebarPageHost({ page, tabId, sessionId, adapter, getSession, unavailable, focused, focusOnReveal }: {
-  page: PluginTerminalSidebarPage;
-  tabId: string;
-  sessionId: string;
-  adapter: ReturnType<typeof usePluginContributions>;
-  getSession(): string | null;
-  unavailable(): void;
-  focused(): void;
-  focusOnReveal: boolean;
-}) {
-  const { t } = useI18n();
-  const subscribeHidden = useMemo(() => (hide: () => void) => {
-    const stopTab = activeTabStore.subscribeSync((id) => { if (id !== tabId) hide(); });
-    const stopSession = subscribeSidePanelLiveSnapshot(true, () => { if (getSession() !== sessionId) hide(); });
-    return () => { stopTab(); stopSession(); };
-  }, [getSession, sessionId, tabId]);
-  const { mountRef, loading } = useEmbeddedPluginView({ viewId: page.viewId, version: page.version,
-    slot: `terminal-sidebar:${tabId}:${sessionId}`, active: true, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT,
-    adapter, subscribeHidden, unavailable, focused, focusOnReveal });
-  // The native page never receives these internal ownership IDs. Its state is
-  // scoped by the host; this does not authorize reading the terminal session.
-  return <section className="flex h-full min-h-0 flex-col overflow-hidden" aria-label={`${page.title} — ${page.pluginName}`} data-plugin-terminal-sidebar>
-    <header className="flex h-7 shrink-0 items-center gap-2 border-b border-border px-2 text-xs"><PluginContributionIcon pluginId={page.pluginId} icon={page.icon} size={12} /><span className="truncate">{page.title} · {page.pluginName}</span></header>
-    <div ref={mountRef} className="relative min-h-0 flex-1 overflow-hidden" data-plugin-view-slot="terminal-sidebar">
-      {loading && <p role="status" className="p-3 text-xs text-muted-foreground">{t('plugins.sidebar.loading')}</p>}
-    </div>
-  </section>;
-}

components/plugins/PluginVaultPages.tsx

@@ -1,44 +0,0 @@
-import { activeTabStore } from '../../application/state/activeTabStore';
-import { useI18n } from '../../application/i18n/I18nProvider';
-import { useEmbeddedPluginView } from '../../application/state/useEmbeddedPluginView';
-import type { usePluginVaultPages } from '../../application/state/usePluginVaultPages';
-import { PluginContributionIcon } from './PluginContributionIcon';
-import { Button } from '../ui/button';
-
-type VaultPages = ReturnType<typeof usePluginVaultPages>;
-const subscribeHidden = (hide: () => void) => activeTabStore.subscribeSync((id) => { if (id !== 'vault') hide(); });
-
-export function PluginVaultNavigation({ model, collapsed }: { model: VaultPages; collapsed: boolean }) {
-  const { t } = useI18n();
-  if (!model.pages.length) return null;
-  return <div role="group" aria-label={t('plugins.vault.extensions')} className="mt-3 space-y-1 border-t border-border/50 pt-3">
-    {!collapsed && <p className="px-2 text-xs text-muted-foreground">{t('plugins.vault.extensions')}</p>}
-    {model.pages.map((page) => <Button key={page.key} type="button"
-      variant={model.selected?.key === page.key ? 'secondary' : 'ghost'}
-      className={`w-full ${collapsed ? 'justify-center px-0' : 'justify-start gap-3'}`}
-      title={`${page.title} — ${page.pluginName}`}
-      aria-label={`${page.title} — ${page.pluginName}`}
-      aria-current={model.selected?.key === page.key ? 'page' : undefined}
-      onClick={() => model.select(page.key)}>
-      <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} className="shrink-0" />
-      {!collapsed && <span className="truncate">{page.title}</span>}
-    </Button>)}
-  </div>;
-}
-
-export function PluginVaultPage({ model }: { model: VaultPages }) {
-  const { t } = useI18n();
-  const page = model.selected!;
-  const { mountRef, loading } = useEmbeddedPluginView({ viewId: page.viewId, version: page.version, slot: 'vault-page',
-    active: model.active, context: model.context, adapter: model.contributions, subscribeHidden, unavailable: model.fallback });
-  return <section className="flex min-h-0 flex-1 flex-col" aria-label={page.title} data-plugin-vault-page={page.key}>
-    <header className="app-no-drag flex h-12 shrink-0 items-center justify-between gap-3 border-b border-border px-4">
-      <div className="min-w-0"><h2 className="truncate text-sm font-medium">{page.title}</h2>
-        <p className="truncate text-xs text-muted-foreground">{page.pluginName} · {page.version}</p></div>
-      <Button variant="ghost" onClick={model.fallback}>{t('plugins.vault.back')}</Button>
-    </header>
-    <div ref={mountRef} className="relative min-h-0 flex-1 overflow-hidden" data-plugin-view-slot="vault-page">
-      {loading && <p role="status" className="p-4 text-sm text-muted-foreground">{t('plugins.vault.loading')}</p>}
-    </div>
-  </section>;
-}

components/plugins/catalog-brand-icons.json

@@ -1,17 +0,0 @@
-[
-  {
-    "id": "com.netcatty.starter",
-    "version": "0.1.2",
-    "repository": "binaricat/Netcatty",
-    "commit": "f4a6b205adca486d4e9cda0270e13a9ff0afd7be",
-    "icon": {
-      "kind": "package",
-      "light": "assets/logo-light.png",
-      "dark": "assets/logo-dark.png"
-    },
-    "light": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAADMElEQVR4nO2d200cQRAAmwuAGJAcF3E4BsfhuCwRAwEYf9lGyz5mdqZf01WfSNydqJreYbUMIgAAAFCRJ8s3e3v//WH5fpl5eX6YuFF9E4TPQysIlRdFvB6zQ5j6Yoi3Y1YIU14E8X6MhvAY/QDI92X05z8UAPJjMOLh1vhAfFx6LwndEwD5sen10xUA8nPQ42l4Ewi5aQ6A1Z+LVl9NASA/Jy3eLgNAfm6u/LEHKM5pAKz+NTjzyAQozmEArP61OPLJBCjObgCs/jXZ88oEKA4BFIcAivMlAK7/a7P1ywQoDgEUhwCKQwDFIYDiEEBxCKA4YQL49v2n90coSYgA/sonAnvcA9hKJwJbXAM4kk0EdrgFcCWZCGxwCaBVLhHoYx5Ar1Qi0MU0gLsyiUAP0wB+/Xi9/b1EoIP5JYAIYuGyCSSCOLj9GkgEMXC9EUQE/rjfCiYCX9wDECECT0IEIEIEXoQJQIQIPAgVgAgRWBMuABEisCRkACJEYEXYAESIwILQAYgQgTbhAxAhAk1SBCBCBFqkCUCECDRIFYDI/QhG4lmZdAGI9MtE/jEpAxBpl4r8c9IGwKPlc0gZAI+WzyNdADxaPpdUAYxIZC+wT5oAkK9DigCQr0f4AJCvS+gAkK9P2ACQb0PIAJBvR7gAkG9LqACQb0+YAJDvQ4gAkO+HewDI9yXkOYEtIH8OYc8JPAP58wh9TuAeyJ9L+HMCP4P8+aQ4J1AE+VqkOCcQ+Xo8bb9g8Y8jeyaBhXzvx8WsA395fvzzHvqcQFa+PmHPCUS+DSHPCUS+He63greykW+LewAi/6Uj354QAYgg34swAYAPBFAclxtB4Iv7jSCIAwEUhwCKQwDFIYDiEEBxCKA4BFCcLwF8vkkA67H1ywQoDgEUhwCKsxsA+4A12fPKBCjOYQBMgbU48skEKM5pAEyBNTjzyAQozmUATIHcXPlrmgBEkJMWb82XACLIRasv9gDF6QqAKZCDHk/dE4AIYtPrZ0gmf0QSh7sLc2gPwDSIwYiH4U0gEfgy+vOfKo9Lgh2zFp7K6iUEPWZPXNXxTQjz0LrUml6/CaId9lYAAKDMHwpGNG+oRdPRAAAAAElFTkSuQmCC",
-    "lightSha256": "ec7bcd5e470ee3d3d9f7f77d120a4de7496a9c0ba984094f84e560d240bea947",
-    "dark": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAADMElEQVR4nO2cO07EMBQAH4iSk1FyBmokToJEzRkoOdn2UCHQko8d+/3yZvrdrJjxi4kiiwAAAEBFbiwvdv/w/GV5vcxcPt9M3KheBOHz0ApC5UsRr8fsEKZ+GeLtmBXClC9BvB+jIdyO/gDk+zL69x8KAPkxGPFwaHwgPi69t4TuCYD82PT66QoA+Tno8TS8CYTcNAfA6s9Fq6+mAJCfkxZvuwEgPzd7/tgDFGczAFb/OdjyyAQozmoArP5zseaTCVCcxQBY/edkySsToDgEUBwCKM6/ALj/n5trv0yA4hBAcQigOARQHAIoDgEUhwCKEyaAj/dX759QkhAB/MgnAnvcA7iWTgS2uAawJpsI7HALYE8yEdjgEkCrXCLQxzyAXqlEoItpAEdlEoEepgE8Pr0c/iwR6GB+CyCCWLhsAokgDm7/BhJBDFwfBBGBP+6PgonAF/cARIjAkxABiBCBF2ECECECD0IFIEIE1oQLQIQILAkZgAgRWBE2ABEisCB0ACJEoE34AESIQJMUAYgQgRZpAhAhAg1SBSByPIKReM5MugBE+mUif52UAYi0S0X+NmkD4NXyOaQMgFfL55EuAF4tn0uqAEYkshdYJk0AyNchRQDI1yN8AMjXJXQAyNcnbADItyFkAMi3I1wAyLclVADItydMAMj3IUQAyPfDPQDk+xLynMAWkD+HsOcEboH8eYQ+J3AJ5M8l/DmBf0H+fFKcEyiCfC1SnBOIfD3urC/4+PTSNQks5Hu/LuYZeOhzAln5+oQ9JxD5NoQ8JxD5drg/Cr6WjXxb3AMQ+ZWOfHtCBCCCfC/CBAA+EEBxzB8ERaTy7YcJUBwCKA4BFIcAikMAxSGA4hBAcQigOP8CuHy+3Xj8ELDh2i8ToDgEUBwCKM5iAOwDzsmSVyZAcVYDYAqcizWfTIDibAbAFDgHWx6ZAMXZDYApkJs9f00TgAhy0uKt+RZABLlo9cUeoDhdATAFctDjqXsCEEFsev0Mybx/eP4a+TzM4+jCHNoDMA1iMOJheBNIBL6M/v2nyuOWYMeshaeyeglBj9kTV3V8E8I8tG61pvdvgmiHvRUAACjzDQ0NL/vgx29SAAAAAElFTkSuQmCC",
-    "darkSha256": "7a897a67ae6b652339c77a113d1c759919776fead82d2eefd0238d3c05ba87fe"
-  }
-]

components/plugins/catalogBrandIcons.ts

@@ -1,9 +0,0 @@
-import previews from './catalog-brand-icons.json';
-
-/** Only bundled reviewed assets; catalog data never becomes an image URL. */
-export function resolveCatalogBrandIcon(entry: NetcattyPluginCatalogEntry): { light: string; dark?: string } | null {
-  const preview = previews.find((item) => item.id === entry.id && item.version === entry.version
-    && item.repository === entry.repository && item.commit === entry.commit
-    && JSON.stringify(item.icon) === JSON.stringify(entry.manifest.icon));
-  return preview ? { light: preview.light, dark: preview.dark } : null;
-}

components/settings/tabs/PluginBrandIcon.test.tsx

@@ -1,70 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { readFileSync } from 'node:fs';
-import { createHash } from 'node:crypto';
-import { inspectPluginBrandIcon } from '@netcatty/plugin-contract';
-import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
-import { resolveCatalogBrandIcon } from '../../plugins/catalogBrandIcons';
-import previews from '../../plugins/catalog-brand-icons.json';
-
-const preview = previews[0];
-const entry = { ...preview, manifest: { icon: preview.icon } } as unknown as NetcattyPluginCatalogEntry;
-test('reviewed catalog brand previews bind version, source and declaration, never arbitrary URLs', () => {
-  assert.ok(resolveCatalogBrandIcon(entry));
-  const catalog = JSON.parse(readFileSync(new URL('../../../electron/plugins/catalog.json', import.meta.url), 'utf8')) as NetcattyPluginCatalogEntry[];
-  assert.ok(resolveCatalogBrandIcon(catalog.find((item) => item.id === preview.id)!));
-  for (const replacement of [{ version: '9.0.0' }, { commit: '0'.repeat(40) }, { repository: 'untrusted/plugin' }, { manifest: { icon: { kind: 'package', light: 'https://attacker.invalid/a.png' } } }]) {
-    assert.equal(resolveCatalogBrandIcon({ ...entry, ...replacement } as NetcattyPluginCatalogEntry), null);
-  }
-  for (const theme of ['light', 'dark'] as const) {
-    const bytes = Buffer.from(preview[theme].split(',')[1], 'base64');
-    assert.equal(createHash('sha256').update(bytes).digest('hex'), preview[`${theme}Sha256`]);
-    assert.equal(inspectPluginBrandIcon(bytes, preview.icon[theme]).width, 128);
-    assert.deepEqual(bytes, readFileSync(new URL(`../../../examples/plugins/starter-netcatty/${preview.icon[theme]}`, import.meta.url)));
-  }
-  const html = renderToStaticMarkup(<PluginBrandIcon entry={entry} />);
-  assert.match(html, /data-plugin-brand="package"/);
-  assert.match(html, /dark:hidden/);
-  assert.match(html, /dark:block/);
-  assert.doesNotMatch(html, /src="https?:/);
-  assert.match(renderToStaticMarkup(<PluginBrandIcon />), /data-plugin-brand="fallback"/);
-});
-test('installed brand uses metadata only, rejects stale responses, and falls back after image errors', async () => {
-  const oldWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
-  const previousAct = (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT;
-  (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
-  const requests: Array<(v: { light: string }) => void> = [];
-  Object.defineProperty(globalThis, 'window', { configurable: true, value: { netcatty: { getPluginBrandIcon: () => new Promise((resolve) => requests.push(resolve)) } } });
-  const plugin = { id: 'com.netcatty.starter', enabled: false, activeVersion: '1.0.0', archiveSha256: 'a', runtime: {}, manifest: { icon: preview.icon } } as NetcattyInstalledPlugin;
-  let renderer: ReactTestRenderer | undefined;
-  try {
-    await act(async () => { renderer = create(<PluginBrandIcon plugin={plugin} />); });
-    assert.equal(requests.length, 1);
-    await act(async () => { renderer!.update(<PluginBrandIcon plugin={{ ...plugin, archiveSha256: 'b' }} />); });
-    await act(async () => requests[0]({ light: preview.light }));
-    assert.equal(renderer!.root.findAllByType('img').length, 0);
-    await act(async () => requests[1]({ light: preview.light }));
-    assert.equal(renderer!.root.findAllByType('img').length, 1);
-    await act(async () => renderer!.root.findByType('img').props.onError());
-    assert.equal(renderer!.root.findAllByType('img').length, 0);
-    await act(async () => { renderer!.update(<PluginBrandIcon />); });
-    assert.equal(renderer!.root.findAllByType('img').length, 0);
-  } finally {
-    await act(async () => renderer?.unmount());
-    if (oldWindow) Object.defineProperty(globalThis, 'window', oldWindow); else Reflect.deleteProperty(globalThis, 'window');
-    (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = previousAct;
-  }
-});
-
-
-test('disabled brand theme names cannot resolve Object prototype members', () => {
-  for (const name of ['constructor', '__proto__', 'toString', 'valueOf', 'hasOwnProperty']) {
-    const plugin = { id: 'com.test.theme', enabled: false, activeVersion: '1.0.0', runtime: {}, manifest: { icon: { kind: 'theme', name } } } as NetcattyInstalledPlugin;
-    const html = renderToStaticMarkup(<PluginBrandIcon plugin={plugin} />);
-    assert.match(html, /lucide-puzzle/);
-    assert.doesNotMatch(html, /<img/);
-  }
-});

components/settings/tabs/PluginInfo.interaction.test.tsx

@@ -1,134 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-test('information previews on hover/focus, pins on click and Escape returns focus without closing the manager', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
-  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
-  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
-  install('IS_REACT_ACT_ENVIRONMENT', true);
-  const { default: React, act, useState } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { PluginInfo } = await import('./PluginInfo');
-  const { PluginManagementDialog } = await import('./PluginManagementDialog');
-  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
-  const root = createRoot(document.getElementById('root')!);
-  const settle = (ms = 60) => new Promise((resolve) => setTimeout(resolve, ms));
-  try {
-    await act(async () => root.render(<I18nProvider locale="en"><PluginManagementDialog><PluginInfo label="Plugin help">Packages remain disabled until reviewed.</PluginInfo><button data-other>Other control</button></PluginManagementDialog></I18nProvider>));
-    await act(async () => { document.querySelector<HTMLButtonElement>('button')!.click(); await settle(); });
-    const trigger = document.querySelector<HTMLButtonElement>('button[aria-label="Plugin help"]')!;
-    const other = document.querySelector<HTMLButtonElement>('[data-other]')!;
-    assert.ok(trigger); assert.equal(trigger.getAttribute('title'), null, 'not a native title-only hint');
-    await act(async () => { other.focus(); await settle(); });
-    const hover = new MouseEvent('pointermove', { bubbles: true });
-    Object.defineProperty(hover, 'pointerType', { value: 'mouse' });
-    await act(async () => { trigger.dispatchEvent(hover); await settle(260); });
-    assert.match(document.querySelector('[role="tooltip"]')?.textContent ?? '', /Packages remain disabled/);
-    await act(async () => { trigger.focus(); await settle(); });
-    assert.ok(document.querySelector('[role="tooltip"]'));
-    await act(async () => { trigger.click(); await settle(); });
-    const pinned = document.querySelector<HTMLElement>('[role="dialog"][aria-label="Plugin help"]');
-    assert.ok(pinned, 'click exposes a persistent readable popover');
-    assert.equal(document.querySelector('[role="tooltip"]'), null);
-    await act(async () => { pinned.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-    assert.equal(document.querySelector('[role="dialog"][aria-label="Plugin help"]'), null);
-    assert.equal(document.querySelectorAll('[role="dialog"]').length, 1, 'Escape closes only the information layer');
-    assert.equal(document.activeElement, trigger);
-    assert.equal(Boolean(document.querySelector('[role="tooltip"]')), false, 'Escape does not immediately reopen the focus preview');
-    await act(async () => { other.focus(); trigger.focus(); await settle(); });
-    assert.ok(document.querySelector('[role="tooltip"]'), 'a subsequent deliberate focus still previews help');
-
-    const { PluginMarketplaceContent } = await import('./PluginMarketplace');
-    const entry = { id: 'com.example.guide', name: 'Guide', author: 'Example', version: '1.0.0', license: 'MIT', repository: 'example/plugin', commit: 'a'.repeat(40), description: 'Synthetic metadata',
-      manifest: { id: 'com.example.guide', name: 'Guide', publisher: 'Example', main: { browser: 'index.js' }, engines: { netcatty: '*', api: '0.1.0-internal' } },
-    } as NetcattyPluginCatalogEntry;
-    const catalog = { entries: [entry], source: 'registry', sourceBinding: null, listStatus: 'ready', listError: null, readme: '# Guide', readmeStatus: 'ready', readmeError: null, error: null, busy: false, retryList() {}, retryReadme() {}, async install() {} } as ReturnType<typeof import('../../../application/state/usePluginCatalog').usePluginCatalog>;
-    function Browser() {
-      const [selected, setSelected] = useState<string | null>(null);
-      const [toolbar, setToolbar] = useState<HTMLDivElement | null>(null);
-      return <I18nProvider locale="en"><div data-toolbar ref={setToolbar} /><div data-settings-scroll-pane><PluginMarketplaceContent catalog={catalog} installed={[]} selected={selected} onSelect={setSelected} toolbarContainer={toolbar} /></div></I18nProvider>;
-    }
-    await act(async () => { root.render(<Browser />); await settle(); });
-    const pane = document.querySelector<HTMLElement>('[data-settings-scroll-pane]')!;
-    assert.match(document.querySelector('[data-toolbar]')?.textContent ?? '', /Refresh/);
-    pane.scrollTop = 450;
-    await act(async () => { document.querySelector<HTMLButtonElement>('[data-plugin-id]')!.click(); await settle(); });
-    assert.equal(document.querySelector('.plugin-marketplace-catalog'), null, 'detail replaces the candidate list');
-    assert.doesNotMatch(document.querySelector('[data-toolbar]')?.textContent ?? '', /Refresh/, 'list refresh stays out of detail');
-    assert.equal(pane.scrollTop, 0);
-    assert.equal(document.activeElement?.tagName, 'H4');
-    assert.equal(document.activeElement?.textContent, 'Guide');
-    const back = Array.from(document.querySelectorAll('button')).find((button) => button.textContent?.includes('All plugins'))!;
-    await act(async () => { back.click(); await settle(); });
-    assert.equal(pane.scrollTop, 450);
-    assert.equal(document.activeElement?.getAttribute('data-plugin-id'), entry.id);
-    assert.match(document.querySelector('[data-toolbar]')?.textContent ?? '', /Refresh/);
-
-    const { PluginStatus } = await import('./PluginStatus');
-    function StatusHarness() {
-      const [offline, setOffline] = useState(true);
-      const [noVault, setNoVault] = useState(true);
-      return <I18nProvider locale="en"><PluginStatus noVault={noVault} offlineError={offline ? 'Network unavailable' : null} retry={() => setOffline(false)} /><button onClick={() => setNoVault(false)}>Restore vault</button></I18nProvider>;
-    }
-    await act(async () => { root.render(<StatusHarness />); await settle(); });
-    const status = document.querySelector<HTMLButtonElement>('button[aria-label$="Notices: 2"]')!;
-    await act(async () => { status.focus(); await settle(); });
-    assert.match(document.querySelector('[role="tooltip"]')?.textContent ?? '', /Network unavailable/);
-    assert.equal(document.querySelector('[role="tooltip"] button'), null, 'hover preview never contains an interactive Retry');
-    await act(async () => { status.click(); await settle(); });
-    const retry = document.querySelector<HTMLButtonElement>('[role="dialog"] button')!;
-    assert.equal(retry.textContent, 'Retry');
-    assert.equal(status.textContent, '2', 'only the number badge is visible, not a second text label');
-    assert.equal(document.querySelectorAll('button[aria-label*="Notices:"]').length, 1);
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /Updates are manual/);
-    assert.ok(document.querySelector('[role="dialog"] hr'));
-    await act(async () => { retry.click(); await settle(); });
-    assert.ok(document.querySelector('button[aria-label$="Notices: 1"]'));
-    assert.doesNotMatch(document.querySelector('[role="dialog"]')?.textContent ?? '', /Network unavailable/);
-    await act(async () => { document.querySelector('[role="dialog"]')!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-    assert.match(document.activeElement?.getAttribute('aria-label') ?? '', /Notices: 1$/);
-    await act(async () => { Array.from(document.querySelectorAll('button')).find((button) => button.textContent === 'Restore vault')!.click(); await settle(); });
-    const healthy = document.querySelector<HTMLButtonElement>('button[aria-label="Plugin information"]')!;
-    assert.ok(healthy, 'one information control remains when healthy');
-    assert.equal(healthy.querySelector('span[aria-hidden="true"]'), null, 'healthy control has no count badge');
-    await act(async () => { healthy.click(); await settle(); });
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /Updates are manual/);
-    await act(async () => { document.querySelector('[role="dialog"]')!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-    const thirdParty: NetcattyPluginSource = { id: 'third-party:synthetic', kind: 'third-party', name: 'Independent source', origin: 'https://example.com' };
-    await act(async () => { root.render(<I18nProvider locale="en"><PluginMarketplaceContent marketSource={thirdParty} catalog={{ ...catalog, entries: [], listError: 'ECONNREFUSED', source: 'cached' }} installed={[]} selected={null} onSelect={() => {}} /></I18nProvider>); await settle(); });
-    const thirdStatus = document.querySelector<HTMLButtonElement>('button[aria-label$="Notices: 1"]')!;
-    await act(async () => { thirdStatus.focus(); await settle(); });
-    const thirdPreview = document.querySelector('[role="tooltip"]')?.textContent ?? '';
-    assert.match(thirdPreview, /provided by the selected third party/);
-    assert.match(thirdPreview, /If a previously validated catalog exists for this source/);
-    assert.doesNotMatch(thirdPreview, /bundled examples|Curated open-source|First-party/);
-    assert.equal(document.querySelector('[role="tooltip"] button'), null);
-    await act(async () => { thirdStatus.click(); await settle(); });
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /ECONNREFUSED/);
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /Retry/);
-    assert.doesNotMatch(document.querySelector('[role="dialog"]')?.textContent ?? '', /bundled examples|Curated open-source/);
-    await act(async () => { document.querySelector('[role="dialog"]')!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-    await act(async () => { root.render(<I18nProvider locale="en"><PluginMarketplaceContent marketSource={thirdParty} catalog={catalog} installed={[]} selected={entry.id} onSelect={() => {}} /></I18nProvider>); await settle(); });
-    const sourceInfo = document.querySelector<HTMLButtonElement>('button[aria-label="Source example"]')!;
-    await act(async () => { sourceInfo.click(); await settle(); });
-    assert.match(document.querySelector('[role="dialog"]')?.textContent ?? '', /Source-only entry from this provider/);
-    assert.doesNotMatch(document.querySelector('[role="dialog"]')?.textContent ?? '', /First-party/);
-    await act(async () => { document.querySelector('[role="dialog"]')!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-  } finally {
-    await act(async () => { root.unmount(); await settle(); });
-    dom.window.close();
-    for (const [key, descriptor] of previous) {
-      if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key);
-    }
-  }
-});

components/settings/tabs/PluginInfo.tsx

@@ -1,25 +0,0 @@
-import React, { useRef, useState } from 'react';
-import { Info } from 'lucide-react';
-import { Button } from '../../ui/button';
-import { Popover, PopoverContent, PopoverTrigger } from '../../ui/popover';
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '../../ui/tooltip';
-
-/** Hover/focus previews explanatory text; click pins it in the existing accessible popover. */
-export function PluginInfo({ label, children, badgeCount, previewContent }: { label: string; children: React.ReactNode; badgeCount?: number; previewContent?: React.ReactNode }) {
-  const [pinned, setPinned] = useState(false);
-  const [preview, setPreview] = useState(false);
-  const suppressFocusPreview = useRef(false);
-  return <Popover open={pinned} onOpenChange={(open) => { setPinned(open); setPreview(false); }}>
-    <TooltipProvider delayDuration={200}>
-      <Tooltip open={!pinned && preview} onOpenChange={(open) => { if (!open || !suppressFocusPreview.current) setPreview(open); }}>
-        <TooltipTrigger asChild><PopoverTrigger asChild>
-          <Button type="button" variant="ghost" size="sm" className="relative h-8 w-8 shrink-0 p-0 text-muted-foreground focus-visible:ring-2 focus-visible:ring-ring" aria-label={label} onBlur={() => { suppressFocusPreview.current = false; }} onPointerMove={() => { suppressFocusPreview.current = false; }}>
-            <Info size={15} />{Boolean(badgeCount) && <span aria-hidden="true" className="absolute right-0 top-0 flex h-3.5 min-w-3.5 items-center justify-center rounded-full bg-muted px-0.5 text-[9px] font-medium leading-none text-foreground">{badgeCount}</span>}
-          </Button>
-        </PopoverTrigger></TooltipTrigger>
-        <TooltipContent className="max-w-xs space-y-2 bg-popover p-3 text-xs leading-5 text-popover-foreground shadow-sm">{previewContent ?? children}</TooltipContent>
-      </Tooltip>
-    </TooltipProvider>
-    <PopoverContent onEscapeKeyDown={() => { suppressFocusPreview.current = true; }} aria-label={label} align="end" className="max-w-xs space-y-2 text-xs leading-5">{children}</PopoverContent>
-  </Popover>;
-}

components/settings/tabs/PluginInstalledGrid.test.tsx

@@ -1,63 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { I18nProvider } from '../../../application/i18n/I18nProvider';
-import { PluginPackageManager } from './PluginPackageManager';
-import type { usePluginManager } from '../../../application/state/usePluginManager';
-
-test('installed grid filters, opens one detail and restores search, scroll and card focus without pill navigation', async () => {
-  const globals = globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean };
-  const previous = globals.IS_REACT_ACT_ENVIRONMENT; globals.IS_REACT_ACT_ENVIRONMENT = true;
-  const raf = globalThis.requestAnimationFrame;
-  const frames: FrameRequestCallback[] = [];
-  globalThis.requestAnimationFrame = (fn) => { frames.push(fn); return frames.length; };
-  const selections: unknown[] = []; const toggles: unknown[] = []; const focus: string[] = [];
-  const pane = { scrollTop: 160 };
-  const plugins = ['Alpha', 'Beta'].map((name) => ({ id: `com.test.${name.toLowerCase()}`, enabled: false, activeVersion: '1.0.0',
-    manifest: { name, publisher: 'Example', description: `${name} safely formats synthetic greetings without accessing hosts or secrets.`, license: 'MIT', main: { browser: 'index.js' }, engines: { api: '0.1.0-internal', netcatty: '*' } },
-    runtime: { lastError: name === 'Beta' ? 'Incompatible version' : null },
-  })) as NetcattyInstalledPlugin[];
-  const manager = { available: true, plugins, busy: false, setEnabled: async (...args: unknown[]) => { toggles.push(args); } } as unknown as ReturnType<typeof usePluginManager>;
-  let renderer!: ReactTestRenderer;
-  try {
-    await act(async () => { renderer = create(<I18nProvider locale="en"><PluginPackageManager manager={manager} onSelectionChange={(id) => selections.push(id)} /></I18nProvider>, {
-      createNodeMock: (element) => element.type === 'section' ? {
-        closest: () => pane,
-        querySelector: () => ({ focus: () => focus.push('detail') }),
-        querySelectorAll: () => plugins.map((plugin) => ({ dataset: { pluginCard: plugin.id }, focus: () => focus.push(plugin.id) })),
-      } : null,
-    }); });
-    const cards = () => renderer.root.findAllByType('button').filter((node) => node.props['data-plugin-card']);
-    assert.equal(cards().length, 2);
-    const alphaCard = renderer.root.findAllByType('article')[0];
-    assert.match(JSON.stringify(renderer.toJSON()), /Alpha safely formats synthetic greetings/);
-    assert.ok(alphaCard.findAllByType('p').some((node) => node.children.includes('Example')), 'author has its own line');
-    assert.ok(alphaCard.findAllByType('p').some((node) => node.props.className?.includes('line-clamp-3')), 'card description is bounded');
-    assert.match(JSON.stringify(renderer.toJSON()), /MIT/);
-    assert.match(JSON.stringify(renderer.toJSON()), /Incompatible version/);
-    assert.ok(renderer.root.findAllByType('div').some((node) => node.props.className?.includes('repeat(auto-fill')));
-    const pill = renderer.root.findAllByType('button').find((node) => node.props['aria-pressed'] !== undefined)!;
-    await act(async () => pill.props.onClick());
-    assert.deepEqual(toggles, [[plugins[0].id, true]]); assert.deepEqual(selections, []);
-    await act(async () => renderer.root.findByType('input').props.onChange({ target: { value: 'Alpha' } }));
-    assert.equal(cards().length, 1);
-    await act(async () => cards()[0].props.onClick()); frames.splice(0).forEach((fn) => fn(0));
-    assert.deepEqual(selections, [plugins[0].id]); assert.equal(pane.scrollTop, 0); assert.equal(focus.at(-1), 'detail');
-    assert.equal(renderer.root.findAllByType('input').length, 0);
-    assert.match(JSON.stringify(renderer.toJSON()), /Declared permissions/);
-    assert.ok(renderer.root.findByType('article').findAllByType('p').some((node) => node.props.className?.includes('whitespace-pre-wrap')), 'detail shows the complete description');
-    const back = renderer.root.findAllByType('button').find((node) => node.children.includes('Installed plugins'))!;
-    await act(async () => back.props.onClick()); frames.splice(0).forEach((fn) => fn(0));
-    assert.equal(renderer.root.findByType('input').props.value, 'Alpha'); assert.equal(cards().length, 1);
-    assert.equal(pane.scrollTop, 160); assert.equal(focus.at(-1), plugins[0].id);
-    await act(async () => renderer.root.findByType('input').props.onChange({ target: { value: 'none' } }));
-    assert.equal(cards().length, 0);
-    await act(async () => renderer.root.findByType('input').props.onChange({ target: { value: '' } }));
-    await act(async () => renderer.update(<I18nProvider locale="en"><PluginPackageManager manager={{ ...manager, statusKnown: false, error: 'synthetic state unavailable' }} onSelectionChange={(id) => selections.push(id)} /></I18nProvider>));
-    const unknown = renderer.root.findAllByType('button').filter((node) => node.children.includes('Status unknown'));
-    assert.equal(unknown.length, 2);
-    assert.ok(unknown.every((node) => node.props.disabled === true && node.props['aria-pressed'] === undefined));
-    await act(async () => renderer.unmount());
-  } finally { globals.IS_REACT_ACT_ENVIRONMENT = previous; globalThis.requestAnimationFrame = raf; }
-});

components/settings/tabs/PluginManagementDialog.interaction.test.tsx

@@ -1,80 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-// Exercise the real Radix portal/focus lifecycle, rather than a mocked Dialog.
-test('plugin manager is single-instance, closes with Escape, restores focus and remounts on reopen', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
-  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
-  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
-  install('IS_REACT_ACT_ENVIRONMENT', true);
-  const { default: React, act, useEffect } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
-  const { PluginManagementDialog } = await import('./PluginManagementDialog');
-  const root = createRoot(document.getElementById('root')!);
-  let mounts = 0;
-  let unmounts = 0;
-  function Content() {
-    useEffect(() => { mounts++; return () => { unmounts++; }; }, []);
-    return <input aria-label="Plugin search" defaultValue="" />;
-  }
-  const settle = () => new Promise((resolve) => setTimeout(resolve, 20));
-  const click = async (element: HTMLElement) => { await act(async () => { element.click(); await settle(); }); };
-  try {
-    await act(async () => { root.render(<I18nProvider locale="en"><PluginManagementDialog><Content /></PluginManagementDialog></I18nProvider>); });
-    const trigger = document.querySelector<HTMLButtonElement>('button')!;
-    assert.equal(document.querySelector('[role="dialog"]'), null);
-    assert.equal(mounts, 0, 'closed settings entry does not mount manager subscriptions');
-    trigger.focus();
-    await click(trigger);
-    assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
-    assert.equal(mounts, 1);
-    assert.equal(document.activeElement?.getAttribute('aria-label'), 'Plugin search');
-    assert.equal(document.querySelector('[role="dialog"]')?.contains(document.querySelector('[data-settings-scroll-pane]')), true);
-    await act(async () => { root.render(<I18nProvider locale="en"><PluginManagementDialog><Content /></PluginManagementDialog></I18nProvider>); });
-    assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
-    assert.equal(mounts, 1, 'rerender does not spawn another manager');
-    const closeButton = document.querySelector<HTMLButtonElement>('[role="dialog"] button[data-dialog-close]:not([aria-hidden])')!;
-    await act(async () => {
-      closeButton.focus();
-      closeButton.dispatchEvent(new KeyboardEvent('keydown', { key: 'Tab', bubbles: true, cancelable: true }));
-    });
-    assert.equal(document.activeElement?.getAttribute('aria-label'), 'Plugin search', 'Tab wraps inside the modal');
-    await act(async () => { document.activeElement!.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true })); await settle(); });
-    assert.equal(document.querySelector('[role="dialog"]'), null);
-    assert.equal(document.activeElement, trigger);
-    assert.equal(unmounts, 1);
-    await click(trigger);
-    assert.equal(mounts, 2);
-    await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button[data-dialog-close]:not([aria-hidden])')!);
-    assert.equal(document.querySelector('[role="dialog"]'), null);
-    assert.equal(document.activeElement, trigger);
-    assert.equal(unmounts, 2);
-    let handedOff = false;
-    await act(async () => root.render(<I18nProvider locale="en"><PluginManagementDialog>{(handoff) => <button onClick={() => handoff(() => {
-      handedOff = true;
-      assert.equal(document.querySelector('[role="dialog"]'), null);
-      assert.notEqual(document.body.style.pointerEvents, 'none');
-    })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
-    await click(trigger);
-    await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
-    assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
-  } finally {
-    await act(async () => root.unmount());
-    dom.window.close();
-    for (const [key, descriptor] of previous) {
-      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
-      else Reflect.deleteProperty(globalThis, key);
-    }
-  }
-});

components/settings/tabs/PluginManagementDialog.tsx

@@ -1,38 +0,0 @@
-import React, { useRef, useState } from 'react';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { Button } from '../../ui/button';
-import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogTrigger } from '../../ui/dialog';
-
-/** Uses the existing renderer and host bridge; opening the manager never starts a plugin. */
-export function PluginManagementDialog({ children }: {
-  children: React.ReactNode | ((handoff: (action: () => void) => void) => React.ReactNode);
-}) {
-  const { t } = useI18n();
-  const [open, setOpen] = useState(false);
-  const pendingHandoff = useRef<(() => void) | null>(null);
-  const handoff = (action: () => void) => { pendingHandoff.current = action; setOpen(false); };
-  return (
-    <Dialog open={open} onOpenChange={setOpen}>
-      <DialogTrigger asChild>
-        <Button variant="outline">{t('settings.plugins.openManager')}</Button>
-      </DialogTrigger>
-      <DialogContent onCloseAutoFocus={(event) => {
-        const action = pendingHandoff.current;
-        pendingHandoff.current = null;
-        if (action) {
-          event.preventDefault();
-          // Wait for Radix to release modal pointer/focus ownership before opening
-          // the existing external plugin view host (including exit animations).
-          queueMicrotask(action);
-        }
-      }} className="flex h-[min(88dvh,900px)] w-[calc(100vw-2rem)] max-w-[1180px] flex-col gap-0 overflow-hidden p-0">
-        <DialogHeader className="shrink-0 border-b px-6 py-4 pr-12 text-left">
-          <DialogTitle>{t('settings.plugins.title')}</DialogTitle>
-        </DialogHeader>
-        <div data-settings-scroll-pane className="min-h-0 flex-1 overflow-y-auto overscroll-contain p-4 sm:p-6">
-          {typeof children === 'function' ? children(handoff) : children}
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}

components/settings/tabs/PluginMarketplace.interaction.test.tsx

@@ -1,178 +0,0 @@
-import assert from 'node:assert/strict';
-import test, { before, after } from 'node:test';
-import { JSDOM } from 'jsdom';
-import React, { useState } from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { readFileSync } from 'node:fs';
-import { I18nProvider } from '../../../application/i18n/I18nProvider';
-import { PluginMarketplaceContent } from './PluginMarketplace';
-import type { usePluginCatalog } from '../../../application/state/usePluginCatalog';
-
-const infoDom = new JSDOM('<!doctype html><html><body></body></html>');
-const previousWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
-const previousDocument = Object.getOwnPropertyDescriptor(globalThis, 'document');
-before(() => {
-  Object.defineProperty(globalThis, 'window', { configurable: true, value: infoDom.window });
-  Object.defineProperty(globalThis, 'document', { configurable: true, value: infoDom.window.document });
-});
-after(() => {
-  infoDom.window.close();
-  if (previousWindow) Object.defineProperty(globalThis, 'window', previousWindow); else Reflect.deleteProperty(globalThis, 'window');
-  if (previousDocument) Object.defineProperty(globalThis, 'document', previousDocument); else Reflect.deleteProperty(globalThis, 'document');
-});
-
-const entries = ['Alpha', 'Beta'].map((name) => ({
-  id: `com.example.${name.toLowerCase()}`, name, author: 'Example', version: '1.0.0', license: 'MIT',
-  description: `${name} local utility`, repository: 'example/plugins', commit: 'a'.repeat(40),
-  manifest: { manifestVersion: 1, id: `com.example.${name.toLowerCase()}`, name, version: '1.0.0', publisher: 'Example', engines: { netcatty: '>=1.0.0', api: '0.1.0-internal' }, main: { browser: 'index.js' }, permissions: { required: ['settings.read'] } },
-})) as NetcattyPluginCatalogEntry[];
-const catalog = {
-  entries, source: 'registry', sourceBinding: null, listStatus: 'ready', listError: null, readme: '# Author documentation', readmeStatus: 'ready', readmeError: null,
-  error: null, busy: false, retryList() {}, retryReadme() {}, async install() {},
-} as ReturnType<typeof usePluginCatalog>;
-
-test('catalog keeps search during selection/back, switches detail, and displays real installed state', async () => {
-  const previousRaf = globalThis.requestAnimationFrame;
-  globalThis.requestAnimationFrame = (callback) => { callback(0); return 0; };
-  const actGlobal = globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean };
-  const previousActEnvironment = actGlobal.IS_REACT_ACT_ENVIRONMENT;
-  actGlobal.IS_REACT_ACT_ENVIRONMENT = true;
-  let renderer: ReactTestRenderer;
-  function Harness() {
-    const [selected, setSelected] = useState<string | null>(null);
-    return <I18nProvider locale="en"><PluginMarketplaceContent catalog={catalog} selected={selected} onSelect={setSelected}
-      installed={[{ id: entries[0].id, activeVersion: '0.9.0', enabled: false, source: { id: 'official', kind: 'official', name: 'Official', origin: 'https://plugins.netcatty.app' }, runtime: { lastError: 'Incompatible with this host' } } as NetcattyInstalledPlugin]} /></I18nProvider>;
-  }
-  try {
-    await act(async () => { renderer = create(<Harness />); });
-    const cards = () => renderer.root.findAll((node) => node.type === 'button' && Boolean(node.props['data-plugin-id']));
-    const input = () => renderer.root.findByType('input');
-    assert.equal(cards().length, 2);
-    await act(async () => input().props.onChange({ target: { value: 'Alpha' } }));
-    assert.equal(cards().length, 1);
-    await act(async () => cards()[0].props.onClick());
-    assert.equal(renderer.root.findByType('article').props['aria-label'], 'Alpha');
-    assert.equal(cards().length, 0, 'detail replaces the entire grid at every width');
-    assert.equal(renderer.root.findAllByType('input').length, 0);
-    const detailText = JSON.stringify(renderer.toJSON());
-    assert.match(detailText, /0.9.0/);
-    assert.match(detailText, /Disabled/);
-    assert.match(detailText, /Incompatible with this host/);
-    assert.match(detailText, /Last recorded error/);
-    assert.equal(renderer.root.findAllByType('details').length, 0, 'permissions are not hidden in a disclosure');
-    assert.equal(renderer.root.findAll((node) => node.type === 'button' && node.children.includes('Install this version (disabled)')).length, 0, 'source-only cards have no install action');
-    const back = () => renderer.root.findAllByType('button').find((node) => node.children.includes('All plugins'))!;
-    await act(async () => back().props.onClick());
-    assert.equal(renderer.root.findAllByType('article').length, 0);
-    assert.equal(input().props.value, 'Alpha');
-    await act(async () => input().props.onChange({ target: { value: '' } }));
-    await act(async () => cards()[1].props.onClick());
-    assert.equal(renderer.root.findByType('article').props['aria-label'], 'Beta');
-    assert.equal(cards().length, 0);
-    await act(async () => back().props.onClick());
-    await act(async () => input().props.onChange({ target: { value: 'no match' } }));
-    assert.equal(cards().length, 0);
-    assert.equal(input().props.value, 'no match');
-    await act(async () => renderer.unmount());
-  } finally {
-    globalThis.requestAnimationFrame = previousRaf;
-    actGlobal.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
-  }
-});
-
-
-test('README failure leaves the permissions and source visible, before the failure message', () => {
-  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent
-    catalog={{ ...catalog, readmeStatus: 'error', readme: null, readmeError: 'Network unavailable' }}
-    selected={entries[0].id} onSelect={() => {}} installed={[]} /></I18nProvider>);
-  assert.match(html, /Compatibility and permissions/);
-  assert.match(html, /settings.read/);
-  assert.match(html, /not a grant/);
-  assert.match(html, /Source example/);
-  assert.ok(html.indexOf('settings.read') < html.indexOf('Network unavailable'));
-  assert.match(html, /Retry/);
-  assert.doesNotMatch(html, /<details/);
-});
-
-test('cards use subtle shadows and details have no breakpoint-specific columns or nested scroller', () => {
-  const css = readFileSync(new URL('./plugin-marketplace.css', import.meta.url), 'utf8');
-  assert.match(css, /box-shadow: 0 1px 4px/);
-  assert.match(css, /\.dark \.plugin-card/);
-  assert.doesNotMatch(css, /@container|248px|max-height|overflow-y/);
-});
-
-test('full-page detail starts at the top and back restores the settings scroll and card focus', async () => {
-  const previousRaf = globalThis.requestAnimationFrame;
-  const frames: FrameRequestCallback[] = [];
-  globalThis.requestAnimationFrame = (callback) => { frames.push(callback); return frames.length; };
-  const actGlobal = globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean };
-  const previousActEnvironment = actGlobal.IS_REACT_ACT_ENVIRONMENT;
-  actGlobal.IS_REACT_ACT_ENVIRONMENT = true;
-  const pane = { scrollTop: 450 };
-  let focused = false;
-  const list = { scrollTop: 0, closest: (selector: string) => selector === '.plugin-marketplace' ? { clientWidth: 1100 } : pane,
-    querySelectorAll: () => [{ dataset: { pluginId: entries[0].id }, focus: () => { focused = true; } }] };
-  let renderer!: ReactTestRenderer;
-  function Harness() {
-    const [selected, setSelected] = useState<string | null>(null);
-    return <I18nProvider locale="en"><PluginMarketplaceContent catalog={catalog} selected={selected} onSelect={setSelected} installed={[]} /></I18nProvider>;
-  }
-  try {
-    await act(async () => { renderer = create(<Harness />, { createNodeMock: (element) => element.type === 'div' && (element.props as { className?: string }).className?.includes('plugin-marketplace-catalog') ? list : null }); });
-    const card = renderer.root.findAll((node) => node.type === 'button' && node.props['data-plugin-id'] === entries[0].id)[0];
-    await act(async () => card.props.onClick());
-    frames.splice(0).forEach((frame) => frame(0));
-    assert.equal(pane.scrollTop, 0);
-    const back = renderer.root.findAllByType('button').find((node) => node.children.includes('All plugins'))!;
-    await act(async () => back.props.onClick());
-    frames.splice(0).forEach((frame) => frame(0));
-    assert.equal(pane.scrollTop, 450);
-    assert.equal(focused, true);
-    await act(async () => renderer.unmount());
-  } finally {
-    globalThis.requestAnimationFrame = previousRaf;
-    actGlobal.IS_REACT_ACT_ENVIRONMENT = previousActEnvironment;
-  }
-});
-
-test('offline catalog warning keeps details visible and disables market installation', () => {
-  const downloadable = { ...entries[0], artifact: { url: 'https://github.com/example/plugin/releases/download/v1/plugin.ncpkg', sha256: 'a'.repeat(64) } };
-  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent
-    catalog={{ ...catalog, entries: [downloadable], listError: 'Registry offline', source: 'cached' }}
-    selected={downloadable.id} onSelect={() => {}} installed={[]} /></I18nProvider>);
-  assert.match(html, /Offline catalog · installation unavailable/);
-  assert.match(html, /Compatibility and permissions/);
-  assert.match(html, /<button[^>]*disabled=""[^>]*>Install this version/);
-  assert.match(html, /Notices: 1/);
-});
-
-test('manual refresh remains available after success and is disabled while loading', () => {
-  const ready = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent catalog={catalog} selected={null} onSelect={() => {}} installed={[]} /></I18nProvider>);
-  assert.match(ready, />Refresh<\/button>/);
-  const loading = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent catalog={{ ...catalog, listStatus: 'loading' }} selected={null} onSelect={() => {}} installed={[]} /></I18nProvider>);
-  assert.match(loading, /<button[^>]*disabled=""[^>]*>Refresh<\/button>/);
-});
-
-test('replacing an installed plugin discloses that its running version will stop beside the install action', () => {
-  const downloadable = { ...entries[0], artifact: { url: 'https://github.com/example/plugin/releases/download/v1/plugin.ncpkg', sha256: 'a'.repeat(64) } };
-  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent
-    catalog={{ ...catalog, entries: [downloadable] }} selected={downloadable.id} onSelect={() => {}}
-    installed={[{ id: downloadable.id, activeVersion: '0.9.0', enabled: true, source: { id: 'official', kind: 'official', name: 'Official', origin: 'https://plugins.netcatty.app' } } as NetcattyInstalledPlugin]} /></I18nProvider>);
-  assert.match(html, /<p[^>]*>This replaces and stops the installed version\./);
-  assert.ok(html.indexOf('This replaces and stops') < html.indexOf('Install this version (disabled)'));
-});
-
-test('a mirror cannot claim another source installation or offer cross-source replacement', () => {
-  const mirror = { id: 'third-party:mirror', kind: 'third-party' as const, name: 'Netcatty', origin: 'https://mirror.example.com' };
-  const existing = { id: entries[0].id, activeVersion: '1.0.0', enabled: true, source: { id: 'official', kind: 'official', name: 'Official', origin: 'https://plugins.netcatty.app' } } as NetcattyInstalledPlugin;
-  const list = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent catalog={catalog}
-    marketSource={mirror} selected={null} onSelect={() => {}} installed={[existing]} /></I18nProvider>);
-  assert.doesNotMatch(list, />Installed</);
-  const downloadable = { ...entries[0], artifact: { url: `${mirror.origin}/assets/${'a'.repeat(64)}.ncpkg`, sha256: 'a'.repeat(64) } };
-  const detail = renderToStaticMarkup(<I18nProvider locale="en"><PluginMarketplaceContent catalog={{ ...catalog, entries: [downloadable] }}
-    marketSource={mirror} selected={downloadable.id} onSelect={() => {}} installed={[existing]} /></I18nProvider>);
-  assert.match(detail, /installed from another source/);
-  assert.match(detail, /https:\/\/plugins.netcatty.app/);
-  assert.match(detail, /disabled=""[^>]*>Install this version/);
-});

components/settings/tabs/PluginMarketplace.test.ts

@@ -1,9 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { filterPluginCatalog } from './PluginMarketplace';
-test('catalog search matches name, author and description without case sensitivity', () => {
-  const entries = [{ id: 'a', name: 'Starter', author: 'Netcatty', description: 'Local greeting' }] as NetcattyPluginCatalogEntry[];
-  for (const query of ['starter', 'NETCATTY', ' greeting ']) assert.equal(filterPluginCatalog(entries, query).length, 1);
-  assert.equal(filterPluginCatalog(entries, 'unrelated').length, 0);
-  assert.equal(filterPluginCatalog(entries, '').length, 1);
-});

components/settings/tabs/PluginMarketplace.tsx

@@ -1,122 +0,0 @@
-import { createPortal } from 'react-dom';
-import { PluginStatus } from './PluginStatus';
-import { Dialog, DialogContent, DialogDescription, DialogTitle } from '../../ui/dialog';
-import { PluginInfo } from './PluginInfo';
-import React, { useRef, useState } from 'react';
-import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
-import { ArrowLeft } from 'lucide-react';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { usePluginCatalog } from '../../../application/state/usePluginCatalog';
-import { Input } from '../../ui/input';
-import { Button } from '../../ui/button';
-import { PluginPackageDetails } from './PluginPackageManager';
-import { PluginReadme } from './PluginReadme';
-
-export function PluginMarketplace({ installed = [], toolbarContainer, noVault, source }: { source?: NetcattyPluginSource; noVault?: boolean; installed?: NetcattyInstalledPlugin[]; toolbarContainer?: HTMLElement | null }) {
-  const [selected, setSelected] = useState<string | null>(null);
-  const catalog = usePluginCatalog(selected, source?.id);
-  return <PluginMarketplaceContent catalog={catalog} marketSource={source} installed={installed} selected={selected} onSelect={setSelected} toolbarContainer={toolbarContainer} noVault={noVault} />;
-}
-
-// The browser owns only presentation state; installation and README policy stay in the existing hook.
-export function PluginMarketplaceContent({ catalog, installed, selected, onSelect, toolbarContainer, noVault, marketSource }: {
-  marketSource?: NetcattyPluginSource;
-  noVault?: boolean;
-  toolbarContainer?: HTMLElement | null;
-  catalog: ReturnType<typeof usePluginCatalog>;
-  installed: NetcattyInstalledPlugin[];
-  selected: string | null;
-  onSelect: (id: string | null) => void;
-}) {
-  const { t } = useI18n();
-  const [search, setSearch] = useState('');
-  const [confirmInstall, setConfirmInstall] = useState(false);
-  const [clearPreviousSource, setClearPreviousSource] = useState(false);
-  const listRef = useRef<HTMLDivElement>(null);
-  const detailRef = useRef<HTMLHeadingElement>(null);
-  const installButtonRef = useRef<HTMLButtonElement>(null);
-  const lastSelection = useRef<string | null>(null);
-  const pageScroll = useRef(0);
-  const entry = catalog.entries.find((item) => item.id === selected);
-  const filtered = filterPluginCatalog(catalog.entries, search);
-  const sourceId = marketSource?.id ?? 'official';
-  const sameSource = (plugin: NetcattyInstalledPlugin) => (plugin.source?.id ?? 'local') === sourceId;
-  const installedEntry = installed.find((item) => item.id === entry?.id && sameSource(item));
-  const conflictingInstall = installed.find((item) => item.id === entry?.id && !sameSource(item));
-  const choose = (id: string) => {
-    const pane = listRef.current?.closest<HTMLElement>('[data-settings-scroll-pane]');
-    pageScroll.current = pane?.scrollTop ?? 0;
-    lastSelection.current = id;
-    onSelect(id);
-    requestAnimationFrame(() => {
-      if (pane) pane.scrollTop = 0;
-      detailRef.current?.focus({ preventScroll: true });
-    });
-  };
-  const back = () => {
-    onSelect(null);
-    requestAnimationFrame(() => {
-      if (listRef.current) {
-        const pane = listRef.current.closest('[data-settings-scroll-pane]');
-        if (pane) pane.scrollTop = pageScroll.current;
-        const button = Array.from(listRef.current.querySelectorAll<HTMLButtonElement>('[data-plugin-id]'))
-          .find((item) => item.dataset.pluginId === lastSelection.current);
-        button?.focus({ preventScroll: true });
-      }
-    });
-  };
-  const refresh = !entry && <Button variant="outline" size="sm" disabled={catalog.listStatus === 'loading'} onClick={catalog.retryList}>{t('common.refresh')}</Button>;
-  return <section className="plugin-marketplace space-y-4" aria-label={t('settings.plugins.market.title')}>
-    {toolbarContainer ? createPortal(<><PluginStatus sourceKind={marketSource?.kind} noVault={noVault} offlineError={catalog.listError} retry={catalog.retryList} />{refresh}</>, toolbarContainer) : <div className="flex items-center gap-2"><PluginStatus sourceKind={marketSource?.kind} noVault={noVault} offlineError={catalog.listError} retry={catalog.retryList} />{refresh}</div>}
-    {catalog.error && <p role="alert" className="text-xs text-destructive">{catalog.error}</p>}
-    <div className="plugin-marketplace-browser">
-      {!entry && <div className="plugin-marketplace-catalog space-y-3" ref={listRef}>
-        <div className="flex items-center gap-3"><Input value={search} onChange={(event) => setSearch(event.target.value)} placeholder={t('settings.plugins.market.search')} aria-label={t('settings.plugins.market.search')} />
-        {catalog.listStatus === 'ready' && <p className="shrink-0 text-xs text-muted-foreground" aria-live="polite">{t('settings.plugins.market.results', { count: filtered.length })}</p>}</div>
-        {catalog.listStatus === 'ready' && catalog.entries.length > 0 && filtered.length === 0 && <p className="rounded-lg border border-dashed p-6 text-center text-sm text-muted-foreground">{t('settings.plugins.market.noResults')}</p>}
-        {catalog.listStatus === 'loading' && <p className="text-xs text-muted-foreground">{t('settings.plugins.loading')}</p>}
-        {catalog.listStatus === 'error' && <div role="alert" className="space-y-2 text-xs text-destructive"><p>{catalog.listError}</p><Button variant="outline" size="sm" onClick={catalog.retryList}>{t('settings.plugins.market.retry')}</Button></div>}
-        {catalog.listStatus === 'ready' && catalog.entries.length === 0 && <p className="text-xs text-muted-foreground">{t('settings.plugins.market.empty')}</p>}
-        <div className="plugin-marketplace-grid">{filtered.map((item) => {
-          const isInstalled = installed.some((plugin) => plugin.id === item.id && sameSource(plugin));
-          return <button key={item.id} type="button" data-plugin-id={item.id} aria-current={selected === item.id ? 'true' : undefined} onClick={() => choose(item.id)}
-            className="plugin-card min-w-0 flex min-h-[200px] flex-col gap-3 rounded-lg bg-card p-4 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring">
-            <div className="flex items-center gap-3"><span className="flex h-8 w-8 shrink-0 items-center justify-center"><PluginBrandIcon entry={item} size={32} className="text-muted-foreground" /></span><span className="min-w-0 break-words text-sm font-semibold leading-5">{item.name}</span></div>
-            <p className="break-words text-xs text-muted-foreground">{item.author}</p>
-            <p className="line-clamp-3 break-words text-sm leading-5 text-muted-foreground">{item.description}</p>
-            <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1 text-xs text-muted-foreground"><span>{item.version} · {item.license}</span><span className="text-foreground">{t('settings.plugins.manager.details')}</span></div>
-            <div className="flex flex-wrap gap-2 text-xs text-muted-foreground">{isInstalled && <span className="rounded bg-muted px-2 py-0.5 text-foreground">{t('settings.plugins.market.installed')}</span>}{!item.artifact && <span className="rounded bg-muted/40 px-2 py-0.5">{t('settings.plugins.market.sourceBadge')}</span>}</div>
-          </button>;
-        })}</div>
-      </div>}
-      {entry && <article key={entry.id} aria-label={entry.name} className="plugin-marketplace-detail mx-auto w-full max-w-[920px] min-w-0 space-y-6 focus:outline-none">
-        <Button variant="ghost" size="sm" onClick={back}><ArrowLeft size={14} className="mr-2" />{t('settings.plugins.market.back')}</Button>
-        <div className="space-y-2"><div className="flex items-center gap-3"><PluginBrandIcon entry={entry} size={48} /><h4 ref={detailRef} tabIndex={-1} className="break-words text-xl font-semibold focus:outline-none">{entry.name}</h4></div><p className="text-xs text-muted-foreground">{entry.author} · {entry.version} · {entry.license}</p>
-          {installedEntry && <p className="text-xs text-muted-foreground">{t('settings.plugins.market.installed')} · {installedEntry.activeVersion} · {t(installedEntry.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}</p>}
-        </div>
-        {installedEntry?.runtime?.lastError && <p role="status" className="break-words text-xs text-destructive">{t('settings.plugins.manager.lastError')}: {installedEntry.runtime.lastError}</p>}
-        <p className="text-sm leading-6 text-muted-foreground">{entry.description}</p>
-        <a className="block break-all text-xs text-primary underline underline-offset-4" href={`https://github.com/${entry.repository}/tree/${entry.commit}`} target="_blank" rel="noopener noreferrer">{entry.repository} @ {entry.commit.slice(0, 12)}</a>
-        {conflictingInstall && <p role="status" className="text-xs text-muted-foreground">{t('settings.plugins.sources.conflict')} {conflictingInstall.source?.origin ?? t('settings.plugins.sources.local')}</p>}
-        {entry.artifact ? <div className="space-y-2"><p className="text-xs text-muted-foreground">{t('settings.plugins.market.installNote')}</p>{catalog.listError && <p role="status" className="text-xs text-muted-foreground">{t('settings.plugins.market.offlineShort')}</p>}<Button ref={installButtonRef} size="sm" disabled={catalog.busy || Boolean(catalog.listError) || Boolean(conflictingInstall)} onClick={() => { if (marketSource?.kind === 'third-party' || (catalog.sourceBinding && catalog.sourceBinding.id !== (marketSource?.id ?? 'official'))) { setClearPreviousSource(false); setConfirmInstall(true); } else void catalog.install(entry.id); }}>{t('settings.plugins.market.install')}</Button></div> : <div className="flex items-center gap-1 text-xs text-muted-foreground"><span>{t('settings.plugins.market.sourceBadge')}</span><PluginInfo label={t('settings.plugins.market.sourceBadge')}>{t(marketSource?.kind === 'third-party' ? 'settings.plugins.sources.sourceOnly' : 'settings.plugins.market.sourceOnly')}</PluginInfo></div>}
-        <section><h4 className="mb-3 text-sm font-semibold">{t('settings.plugins.market.manifest')}</h4><PluginPackageDetails plugin={{ id: entry.id, activeVersion: entry.version, enabled: false, manifest: entry.manifest, archiveSha256: entry.artifact?.sha256, runtime: { status: 'stopped', kind: null, lastError: null, quarantinedAt: null } }} /></section>
-        <div className="min-w-0 border-t pt-4"><div className="flex items-center gap-1"><h4 className="text-sm font-semibold">README</h4><PluginInfo label={t('settings.plugins.market.readmeInfo')}>{t('settings.plugins.market.readmeNote')}</PluginInfo></div>{catalog.readmeStatus === 'loading' && <p className="mt-3 text-xs text-muted-foreground">{t('settings.plugins.loading')}</p>}
-          {catalog.readmeStatus === 'error' && <div role="alert" className="mt-3 space-y-2 text-xs text-destructive"><p>{catalog.readmeError}</p><Button variant="outline" size="sm" onClick={catalog.retryReadme}>{t('settings.plugins.market.retry')}</Button></div>}
-          {catalog.readmeStatus === 'ready' && (catalog.readme?.trim() ? <PluginReadme markdown={catalog.readme} /> : <p className="mt-3 text-xs text-muted-foreground">{t('settings.plugins.market.emptyReadme')}</p>)}
-        </div>
-      </article>}
-    </div>
-    <Dialog open={confirmInstall && Boolean(entry)} onOpenChange={setConfirmInstall}><DialogContent className="max-h-[85vh] overflow-y-auto" onCloseAutoFocus={(event) => { event.preventDefault(); installButtonRef.current?.focus(); }}>
-      <DialogTitle>{t('settings.plugins.sources.installConfirm')}</DialogTitle><DialogDescription>{t('settings.plugins.sources.risk')}</DialogDescription>
-      <p className="break-all text-sm font-medium">{marketSource?.origin}</p>
-      {entry && <PluginPackageDetails plugin={{ id: entry.id, activeVersion: entry.version, enabled: false, manifest: entry.manifest, source: marketSource, archiveSha256: entry.artifact?.sha256, runtime: { status: 'stopped', kind: null, lastError: null, quarantinedAt: null } }} />}
-      {catalog.sourceBinding && catalog.sourceBinding.id !== (marketSource?.id ?? 'official') && <label className="flex items-start gap-2 text-xs"><input type="checkbox" checked={clearPreviousSource} onChange={(event) => setClearPreviousSource(event.target.checked)} />{t('settings.plugins.sources.clearPrivate')}<span className="break-all">{catalog.sourceBinding.origin ?? t('settings.plugins.sources.local')}</span></label>}
-      <Button disabled={catalog.busy || Boolean(catalog.listError) || Boolean(catalog.sourceBinding && catalog.sourceBinding.id !== (marketSource?.id ?? 'official') && !clearPreviousSource)} onClick={() => { if (entry) void catalog.install(entry.id, marketSource?.id, clearPreviousSource).then(() => setConfirmInstall(false)); }}>{t('settings.plugins.market.install')}</Button>
-    </DialogContent></Dialog>
-  </section>;
-}
-
-export function filterPluginCatalog(entries: NetcattyPluginCatalogEntry[], query: string) {
-  const needle = query.trim().toLocaleLowerCase();
-  return entries.filter((entry) => `${entry.name} ${entry.author} ${entry.description}`.toLocaleLowerCase().includes(needle));
-}

components/settings/tabs/PluginPackageManager.test.tsx

@@ -1,27 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { I18nProvider } from '../../../application/i18n/I18nProvider';
-import { PluginPackageDetails } from './PluginPackageManager';
-
-test('package detail renders manifest resources as text and explains advanced authority', () => {
-  const plugin = {
-    id: 'com.example.synthetic', enabled: false, activeVersion: '1.0.0',
-    archiveSha256: 'a'.repeat(64),
-    manifest: {
-      manifestVersion: 1, id: 'com.example.synthetic', name: 'synthetic', version: '1.0.0', publisher: 'example',
-      engines: { netcatty: '>=1.0.0 <2.0.0', api: '0.1.0-internal' },
-      main: { node: 'index.js' },
-      permissions: { required: [{ permission: 'network', resources: ['https://example.com'], reason: '<script>attack()</script>' }] },
-    },
-    runtime: { status: 'stopped', kind: null, lastError: null, quarantinedAt: null },
-  } as NetcattyInstalledPlugin;
-  const html = renderToStaticMarkup(<I18nProvider locale="en"><PluginPackageDetails plugin={plugin} /></I18nProvider>);
-  assert.match(html, /full Node filesystem and network authority/);
-  assert.match(html, /https:\/\/example.com/);
-  assert.match(html, /&lt;script&gt;/);
-  assert.doesNotMatch(html, /<script>/);
-  assert.match(html, /not a grant/);
-  assert.match(html, /aaaaaaaaaaaaaaaa/);
-});

components/settings/tabs/PluginPackageManager.tsx

@@ -1,126 +0,0 @@
-import { describePluginPermission } from '@/domain/pluginPermissionDescriptions.cjs';
-import { describePluginRuntime } from '@/domain/pluginRuntimePolicy.cjs';
-import React, { useRef, useState } from 'react';
-import { PluginPermissionPanel } from './PluginPermissionPanel';
-import { PluginBrandIcon } from '../../plugins/PluginBrandIcon';
-import { ArrowLeft } from 'lucide-react';
-import { usePluginManager } from '../../../application/state/usePluginManager';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { Button } from '../../ui/button';
-import { Input } from '../../ui/input';
-
-export function PluginPackageDetails({ plugin }: { plugin: NetcattyInstalledPlugin }) {
-  const { t, resolvedLocale } = useI18n();
-  const manifest = plugin.manifest;
-  if (!manifest) return null;
-  const permissions = [
-    ...(manifest.permissions?.required ?? []).map((value) => ({ value, required: true })),
-    ...(manifest.permissions?.optional ?? []).map((value) => ({ value, required: false })),
-  ];
-  const policy = describePluginRuntime(manifest);
-  const runtimeKind = plugin.runtime.kind ?? policy.defaultRuntimeKind;
-  const runtimeLabel = runtimeKind === 'utility' ? 'advanced'
-    : policy.hasNode ? 'dual' : policy.declaresAdvanced ? 'advancedDeclaration' : 'browser';
-  return <div className="space-y-4 border-t border-border/60 pt-4 text-sm">
-    <dl className="grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-xs">
-      <dt className="text-muted-foreground">ID</dt><dd className="break-all font-mono">{plugin.id}</dd>
-      <dt className="text-muted-foreground">Netcatty</dt><dd>{manifest.engines.netcatty}</dd>
-      <dt className="text-muted-foreground">API</dt><dd>{manifest.engines.api}</dd>
-      <dt className="text-muted-foreground">SHA-256</dt><dd className="break-all font-mono">{plugin.archiveSha256 ?? '-'}</dd>
-    </dl>
-    <p className={!policy.browserOnly && !policy.dataOnly ? 'text-destructive' : 'text-muted-foreground'}>{policy.dataOnly ? t('settings.plugins.manager.dataTheme') : t(`settings.plugins.manager.${runtimeLabel}`)}</p>
-    <div className="space-y-2">
-      <h4 className="font-medium">{t('settings.plugins.manager.permissions')}</h4>
-      <p className="text-xs text-muted-foreground">{t('settings.plugins.manager.permissionNote')}</p>
-      {permissions.length === 0 && <p className="text-xs text-muted-foreground">{t('settings.plugins.manager.noPermissions')}</p>}
-      {permissions.map(({ value, required }, index) => {
-        const id = typeof value === 'string' ? value : value.permission;
-        const description = describePluginPermission(id, resolvedLocale);
-        return <div key={index} className="rounded-md bg-muted/40 p-3">
-        <div className="flex justify-between gap-3"><span className="text-sm font-medium">{description.label}</span><span className="text-xs text-muted-foreground">{t(required ? 'settings.plugins.manager.required' : 'settings.plugins.manager.optional')}</span></div>
-        <p className="mt-1 text-xs text-muted-foreground">{description.description}</p>
-        <code className="mt-1 block break-all text-[10px] text-muted-foreground">{id}</code>
-        {description.sensitive && <p className="mt-1 text-xs font-medium text-destructive">{t('settings.plugins.manager.sensitive')}</p>}
-        {(typeof value === 'string' || value.resources.length === 0) && <p className="mt-1 text-xs">{t('settings.plugins.manager.unbounded')}</p>}
-        {typeof value !== 'string' && <><p className="mt-1 whitespace-pre-wrap break-all text-xs">{value.resources.join('\n')}</p>{value.reason && <p className="mt-1 text-xs text-muted-foreground">{value.reason}</p>}</>}
-      </div>; })}
-    </div>
-    <p className="text-xs text-muted-foreground">{t('settings.plugins.manager.data')}</p>
-  </div>;
-}
-
-export function PluginPackageManager({ manager, onSelectionChange }: { manager: ReturnType<typeof usePluginManager>; onSelectionChange?: (id: string | null) => void }) {
-  const { t, resolvedLocale } = useI18n();
-  const [selected, setSelected] = useState<string | null>(null);
-  const [search, setSearch] = useState('');
-  const [sourceFilter, setSourceFilter] = useState('');
-  const rootRef = useRef<HTMLElement>(null);
-  const scrollTop = useRef(0);
-  const lastSelection = useRef<string | null>(null);
-  const selectedPlugin = manager.plugins.find((plugin) => plugin.id === selected);
-  const nameOf = (plugin: NetcattyInstalledPlugin) => typeof plugin.manifest?.displayName === 'string' ? plugin.manifest.displayName : plugin.manifest?.displayName?.[resolvedLocale] ?? plugin.manifest?.displayName?.en ?? plugin.manifest?.name ?? plugin.id;
-  const descriptionOf = (plugin: NetcattyInstalledPlugin) => {
-    const value = plugin.manifest?.description;
-    return typeof value === 'string' ? value : value?.[resolvedLocale] ?? value?.en ?? '';
-  };
-  const choose = (id: string | null) => {
-    const pane = rootRef.current?.closest<HTMLElement>('[data-settings-scroll-pane]');
-    if (id) { scrollTop.current = pane?.scrollTop ?? 0; lastSelection.current = id; }
-    setSelected(id); setRemoving(null); onSelectionChange?.(id);
-    requestAnimationFrame(() => {
-      if (pane) pane.scrollTop = id ? 0 : scrollTop.current;
-      if (id) rootRef.current?.querySelector<HTMLElement>('[data-plugin-detail]')?.focus({ preventScroll: true });
-      else Array.from(rootRef.current?.querySelectorAll<HTMLButtonElement>('[data-plugin-card]') ?? []).find((button) => button.dataset.pluginCard === lastSelection.current)?.focus({ preventScroll: true });
-    });
-  };
-  const visible = selectedPlugin ? [selectedPlugin] : manager.plugins.filter((plugin) => (!sourceFilter || (plugin.source?.id ?? 'local') === sourceFilter) && [nameOf(plugin), plugin.manifest?.publisher, plugin.manifest?.description, plugin.id].some((value) => JSON.stringify(value ?? '').toLocaleLowerCase().includes(search.trim().toLocaleLowerCase())));
-  const [removing, setRemoving] = useState<string | null>(null);
-  const [clearSource, setClearSource] = useState(false);
-  if (!manager.available) return null;
-  return <section ref={rootRef} className="space-y-4" aria-label={t('settings.plugins.manager.installed')}>
-    {selectedPlugin && <Button variant="ghost" size="sm" onClick={() => choose(null)}><ArrowLeft size={14} className="mr-2" />{t('settings.plugins.manager.installed')}</Button>}
-    {!selectedPlugin && manager.plugins.length > 0 && <select aria-label={t('settings.plugins.sources.source')} value={sourceFilter} onChange={(event) => setSourceFilter(event.target.value)} className="h-9 rounded-md border border-input bg-background px-3 text-sm"><option value="">{t('settings.plugins.sources.all')}</option>{[...new Map(manager.plugins.map((plugin) => [plugin.source?.id ?? 'local', plugin.source])).entries()].map(([id, source]) => <option key={id} value={id}>{source?.origin ?? t('settings.plugins.sources.local')}</option>)}</select>}
-    {!selectedPlugin && manager.plugins.length > 0 && <Input value={search} onChange={(event) => setSearch(event.target.value)} placeholder={t('settings.plugins.market.search')} aria-label={t('settings.plugins.market.search')} />}
-    {!selectedPlugin && manager.plugins.length > 0 && visible.length === 0 && <p className="p-6 text-center text-sm text-muted-foreground">{t('settings.plugins.market.noResults')}</p>}
-    {manager.error && <p role="alert" className="text-sm text-destructive">{manager.error}</p>}
-    {!manager.plugins.length && <div className="rounded-xl border border-dashed border-border p-8 text-center text-sm text-muted-foreground">{t('settings.plugins.manager.empty')}</div>}
-    <div className={selectedPlugin ? 'space-y-4' : 'grid grid-cols-[repeat(auto-fill,minmax(min(100%,280px),1fr))] gap-3'}>
-    {visible.map((plugin) => <article key={plugin.id} data-plugin-detail={selectedPlugin ? true : undefined} tabIndex={selectedPlugin ? -1 : undefined} aria-label={nameOf(plugin)} className={`min-w-0 rounded-lg focus:outline-none ${selectedPlugin ? 'space-y-4' : 'plugin-card flex min-h-[200px] flex-col gap-3 bg-card p-4'}`}>
-      <div className="flex flex-wrap items-center gap-3">
-        <div className="flex h-12 w-12 shrink-0 items-center justify-center"><PluginBrandIcon plugin={plugin} size={32} /></div>
-        <button type="button" data-plugin-card={plugin.id} className="min-w-0 flex-1 rounded text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring" aria-expanded={selected === plugin.id} onClick={() => choose(selected === plugin.id ? null : plugin.id)}>
-          <div className="break-words text-sm font-medium">{nameOf(plugin)}</div>
-
-        </button>
-        <Button variant="ghost" size="sm" type="button"
-          className={`h-7 shrink-0 rounded-full border-0 px-3 text-xs focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background ${manager.statusKnown !== false && plugin.enabled ? 'bg-primary/10 hover:bg-primary/15' : 'bg-muted/60 text-muted-foreground hover:bg-muted hover:text-foreground'}`}
-          style={manager.statusKnown !== false && plugin.enabled ? { color: 'color-mix(in srgb, hsl(var(--primary)) 40%, hsl(var(--foreground)))' } : undefined}
-          aria-pressed={manager.statusKnown === false ? undefined : plugin.enabled} aria-busy={manager.busy}
-          aria-label={`${t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')} ${plugin.manifest?.name ?? plugin.id}`}
-          title={t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.disable' : 'settings.plugins.manager.enable')}
-          disabled={manager.busy || manager.statusKnown === false} onClick={() => void manager.setEnabled(plugin.id, !plugin.enabled)}>
-          {t(manager.statusKnown === false ? 'settings.plugins.permissions.statusUnknown' : plugin.enabled ? 'settings.plugins.manager.enabled' : 'settings.plugins.manager.disabled')}
-        </Button>
-      </div>
-      <p className="break-all text-xs text-muted-foreground">{t('settings.plugins.sources.source')}: {t(plugin.source?.kind === 'official' ? 'settings.plugins.sources.official' : plugin.source?.kind === 'third-party' ? 'settings.plugins.sources.thirdparty' : 'settings.plugins.sources.local')}{plugin.source?.origin ? ` · ${plugin.source.origin}` : ''}</p>
-      {plugin.manifest?.publisher && <p className="break-words text-xs text-muted-foreground">{plugin.manifest.publisher}</p>}
-      <p className={`break-words text-sm leading-5 text-muted-foreground ${selectedPlugin ? 'whitespace-pre-wrap' : 'line-clamp-3'}`}>{descriptionOf(plugin) || t('settings.plugins.manager.noDescription')}</p>
-      {!selectedPlugin ? <div className="mt-auto flex flex-wrap items-center justify-between gap-2 pt-1">
-        <p className="break-words text-xs text-muted-foreground">{plugin.activeVersion}{plugin.manifest?.license ? ` · ${plugin.manifest.license}` : ''}</p>
-        <Button variant="ghost" size="sm" className="h-7 px-2 text-xs" onClick={() => choose(plugin.id)} aria-label={`${t('settings.plugins.manager.details')} ${nameOf(plugin)}`}>{t('settings.plugins.manager.details')}</Button>
-      </div> : <p className="text-xs text-muted-foreground">{plugin.activeVersion}{plugin.manifest?.license ? ` · ${plugin.manifest.license}` : ''}</p>}
-      {plugin.runtime.lastError && <p role="status" className="break-words text-xs text-destructive">{t('settings.plugins.manager.lastError')}: {plugin.runtime.lastError}</p>}
-      {selected === plugin.id && <>
-        <PluginPackageDetails plugin={plugin} />
-        <PluginPermissionPanel key={plugin.id} pluginId={plugin.id} onChanged={async () => { await manager.refresh(); }} />
-        {removing === plugin.id ? <div className="space-y-2 rounded-lg border border-destructive/30 p-3">
-          <p className="text-xs">{t('settings.plugins.manager.removeNote')}</p>
-          <label className="flex items-start gap-2 text-xs"><input type="checkbox" checked={clearSource} onChange={(event) => setClearSource(event.target.checked)} />{t('settings.plugins.sources.clearPrivate')}</label>
-          <Button variant="destructive" size="sm" disabled={manager.busy} onClick={() => { void manager.uninstall(plugin.id, clearSource); setRemoving(null); }}>{t('settings.plugins.manager.remove')}</Button>
-          <Button variant="ghost" size="sm" onClick={() => setRemoving(null)}>{t('common.cancel')}</Button>
-        </div> : <Button variant="ghost" size="sm" disabled={manager.busy} onClick={() => { setClearSource(false); setRemoving(plugin.id); }}>{t('settings.plugins.manager.remove')}</Button>}
-      </>}
-    </article>)}
-    </div>
-  </section>;
-}

components/settings/tabs/PluginPermissionPanel.test.tsx

@@ -1,145 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-test('permission panel refreshes real grants, revokes once, and keeps stale reads from replacing new results', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('IS_REACT_ACT_ENVIRONMENT', true);
-  const { default: React, act } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
-  const { PluginPermissionPanel } = await import('./PluginPermissionPanel');
-  const root = createRoot(document.getElementById('root')!);
-  const initial = {
-    grants: [{ permission: 'network', resource: 'https://synthetic.invalid/<text>', resourceKind: 'exact', scope: 'always' as const, sessionId: null, grantedAt: 1, matchesCurrentActivation: false }],
-    audit: [{ event: 'permission.used', createdAt: 2, permission: 'network' }],
-  };
-  let reads = 0;
-  let revokes = 0;
-  let changed = 0;
-  let staleRead: (value: typeof initial) => void = () => {};
-  let releaseRevoke: () => void = () => {};
-  const revokePending = new Promise<void>((resolve) => { releaseRevoke = resolve; });
-  Object.assign(dom.window, { netcatty: {
-    async getPluginPermissions(id: string) {
-      assert.equal(id, 'com.example.synthetic');
-      reads++;
-      if (reads === 2) return new Promise<typeof initial>((resolve) => { staleRead = resolve; });
-      return reads > 2 ? { grants: [], audit: [] } : initial;
-    },
-    async revokePluginPermissions(id: string) { assert.equal(id, 'com.example.synthetic'); revokes++; await revokePending; },
-  } });
-  const button = (text: string) => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((item) => item.textContent === text)!;
-  try {
-    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel pluginId="com.example.synthetic" onChanged={async () => { changed++; }} /></I18nProvider>));
-    assert.match(document.body.textContent!, /synthetic.invalid/);
-    assert.equal(document.querySelector('text'), null, 'resource is rendered as plain text');
-    assert.match(document.body.textContent!, /Until revoked/);
-    assert.match(document.body.textContent!, /Inactive for the current activation/);
-    await act(async () => { button('Refresh').click(); });
-    await act(async () => {
-      button('Disable and revoke all grants').click();
-      button('Disable and revoke all grants').click();
-    });
-    assert.equal(revokes, 1);
-    assert.equal(button('Refresh').disabled, true);
-    await act(async () => { releaseRevoke(); });
-    assert.equal(changed, 1);
-    assert.match(document.body.textContent!, /No saved grants/);
-    await act(async () => { staleRead(initial); });
-    assert.doesNotMatch(document.body.textContent!, /synthetic.invalid/);
-    Object.assign(dom.window, { netcatty: { async getPluginPermissions() { throw new Error('synthetic read failed'); } } });
-    await act(async () => { button('Refresh').click(); });
-    assert.match(document.querySelector('[role="alert"]')?.textContent ?? '', /synthetic read failed/);
-  } finally {
-    await act(async () => root.unmount());
-    dom.window.close();
-    for (const [key, descriptor] of previous) {
-      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
-      else Reflect.deleteProperty(globalThis, key);
-    }
-  }
-});
-
-test('partial revocation failure refreshes actual manager and engine state without clearing the original error', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'Event', 'MouseEvent', 'IS_REACT_ACT_ENVIRONMENT']) {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value: key === 'window' ? dom.window : key === 'IS_REACT_ACT_ENVIRONMENT' ? true : dom.window[key as keyof typeof dom.window] });
-  }
-  const { act } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
-  const { PluginPermissionPanel } = await import('./PluginPermissionPanel');
-  const { PluginManager } = await import('../../../electron/plugins/pluginManager.cjs');
-  const { PluginPermissionEngine } = await import('../../../electron/plugins/permissionEngine.cjs');
-  const { defaultSecurityPrincipal, normalizePermissionDeclarations, permissionDeclarationHash } = await import('../../../electron/plugins/permissionResources.cjs');
-  const manifest = { id: 'com.example.synthetic', publisher: 'example', permissions: { optional: ['storage'] } };
-  const principal = defaultSecurityPrincipal(manifest);
-  const grant = { pluginId: manifest.id, permission: 'storage', resource: '*', resourceKind: 'exact', grantedAt: 1,
-    declarationHash: permissionDeclarationHash(normalizePermissionDeclarations(manifest).get('storage'), principal) };
-  let enabled = true, running = true, stopped = false, readFails = false;
-  let grants = [grant];
-  let reads = 0, changed = 0;
-  const database = {
-    getActivePlugin: () => ({ id: manifest.id, enabled, manifest }),
-    listPlugins: () => [{ id: manifest.id, enabled, manifest }],
-    setEnabled(_id: string, value: boolean) { enabled = value; },
-    listPermissionGrants: () => grants,
-    deleteAllPermissionGrants() { grants = []; },
-    recordSecurityAudit() { throw new Error('synthetic audit write failed'); },
-  };
-  const engine = new PluginPermissionEngine({ database });
-  const manager = new PluginManager({ database, permissionEngine: engine,
-    packageStore: { async initialize() {} },
-    contributionService: { async initialize() {}, onPluginDisabled() {} },
-    runtimeSupervisor: { async stop() { running = false; stopped = true; } },
-  });
-  Object.assign(dom.window, { netcatty: {
-    async getPluginPermissions() {
-      reads++;
-      if (readFails) throw new Error('synthetic grants refresh failed');
-      const groups = engine.describeGrants(manifest.id, running ? { pluginId: manifest.id, manifest, securityPrincipal: principal } : null);
-      return { grants: groups.always, audit: [] };
-    },
-    async revokePluginPermissions(id: string) { return manager.revokePermissions(id); },
-  } });
-  const root = createRoot(document.getElementById('root')!);
-  const refreshManager = async () => { changed++; assert.equal((await manager.list())[0].enabled, false); };
-  const revoke = () => Array.from(document.querySelectorAll<HTMLButtonElement>('button')).find((item) => item.textContent === 'Disable and revoke all grants')!;
-  try {
-    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel key="first" pluginId={manifest.id} onChanged={refreshManager} /></I18nProvider>));
-    assert.match(document.body.textContent!, /Matches the current activation/);
-    await act(async () => { revoke().click(); });
-    assert.equal(enabled, false); assert.equal(stopped, true);
-    assert.equal(changed, 1); assert.equal(reads, 2);
-    assert.match(document.querySelector('[role="alert"]')?.textContent ?? '', /synthetic audit write failed/);
-    assert.match(document.body.textContent!, /No saved grants/);
-    assert.doesNotMatch(document.body.textContent!, /Matches the current activation/);
-    // A failed state read must also remove the old grant snapshot while
-    // retaining the mutation error and reporting the refresh failure.
-    enabled = true; running = true; stopped = false; grants = [grant];
-    await act(async () => root.render(<I18nProvider locale="en"><PluginPermissionPanel key="second" pluginId={manifest.id} onChanged={async () => { await refreshManager(); readFails = true; throw new Error('synthetic manager refresh failed'); }} /></I18nProvider>));
-    assert.match(document.body.textContent!, /Matches the current activation/);
-    await act(async () => { revoke().click(); });
-    assert.equal(enabled, false); assert.equal(stopped, true);
-    assert.equal(changed, 2); assert.equal(reads, 4);
-    const error = document.querySelector('[role="alert"]')?.textContent ?? '';
-    assert.match(error, /synthetic audit write failed/);
-    assert.match(error, /synthetic manager refresh failed/);
-    assert.match(error, /synthetic grants refresh failed/);
-    assert.doesNotMatch(document.body.textContent!, /Matches the current activation/);
-  } finally {
-    await act(async () => root.unmount()); engine.shutdown(); dom.window.close();
-    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
-  }
-});

components/settings/tabs/PluginPermissionPanel.tsx

@@ -1,86 +0,0 @@
-import React, { useCallback, useEffect, useRef, useState } from 'react';
-import { netcattyBridge } from '../../../infrastructure/services/netcattyBridge';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { describePluginPermission } from '../../../domain/pluginPermissionDescriptions.cjs';
-import { Button } from '../../ui/button';
-
-/** Host UI only. Plugin views cannot query or mutate this security state. */
-export function PluginPermissionPanel({ pluginId, onChanged }: {
-  pluginId: string;
-  onChanged: () => Promise<void>;
-}) {
-  const { t, resolvedLocale } = useI18n();
-  const [snapshot, setSnapshot] = useState<NetcattyPluginPermissionSnapshot | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const [busy, setBusy] = useState(false);
-  const generation = useRef(0);
-  const pending = useRef(false);
-  const refresh = useCallback(async (preserveError = false) => {
-    const current = ++generation.current;
-    if (!preserveError) setError(null);
-    try {
-      const bridge = netcattyBridge.require();
-      if (!bridge.getPluginPermissions) throw new Error(t('settings.plugins.permissions.unavailable'));
-      const result = await bridge.getPluginPermissions(pluginId);
-      if (current === generation.current) setSnapshot(result);
-    } catch (cause) {
-      if (current === generation.current) {
-        setSnapshot(null);
-        const message = cause instanceof Error ? cause.message : String(cause);
-        setError((previous) => preserveError && previous ? `${previous}\n${message}` : message);
-      }
-    }
-  }, [pluginId, t]);
-  useEffect(() => {
-    const requestGeneration = generation;
-    void refresh();
-    return () => { requestGeneration.current++; };
-  }, [refresh]);
-  const revoke = async () => {
-    if (pending.current) return;
-    pending.current = true;
-    setBusy(true);
-    setError(null);
-    try {
-      const bridge = netcattyBridge.require();
-      if (!bridge.revokePluginPermissions) throw new Error(t('settings.plugins.permissions.unavailable'));
-      await bridge.revokePluginPermissions(pluginId);
-    } catch (cause) { setError(cause instanceof Error ? cause.message : String(cause)); }
-    finally {
-      try { await onChanged(); }
-      catch (cause) {
-        const message = cause instanceof Error ? cause.message : String(cause);
-        setError((previous) => previous ? `${previous}\n${message}` : message);
-      }
-      await refresh(true);
-      pending.current = false; setBusy(false);
-    }
-  };
-  return <section data-host-security-surface="" className="space-y-3 border-t border-border/60 pt-4 text-sm" aria-label={t('settings.plugins.permissions.title')}>
-    <div className="flex flex-wrap items-center justify-between gap-2">
-      <h4 className="font-medium">{t('settings.plugins.permissions.title')}</h4>
-      <Button variant="ghost" size="sm" disabled={busy} onClick={() => void refresh()}>{t('settings.plugins.permissions.refresh')}</Button>
-    </div>
-    {error && <p role="alert" className="text-xs text-destructive">{error}</p>}
-    {!snapshot && !error && <p role="status">{t('settings.plugins.permissions.loading')}</p>}
-    {snapshot && <>
-      {snapshot.grants.length === 0 && <p className="text-xs text-muted-foreground">{t('settings.plugins.permissions.empty')}</p>}
-      {snapshot.grants.map((grant, index) => <div key={index} className="rounded-md bg-muted/40 p-3 text-xs">
-        <p className="font-medium">{describePluginPermission(grant.permission, resolvedLocale).label}</p>
-        <p className="whitespace-pre-wrap break-all font-mono">{grant.resource}</p>
-        <p>{t(grant.matchesCurrentActivation ? 'settings.plugins.permissions.current' : 'settings.plugins.permissions.inactive')}</p>
-        <p>{t(`settings.plugins.permissions.${grant.scope}`)}{grant.sessionId ? ` · ${grant.sessionId}` : ''}</p>
-        <time dateTime={new Date(grant.grantedAt).toISOString()}>{new Date(grant.grantedAt).toLocaleString(resolvedLocale)}</time>
-      </div>)}
-      <details className="text-xs">
-        <summary className="cursor-pointer">{t('settings.plugins.permissions.audit')}</summary>
-        <ol className="mt-2 space-y-1">{snapshot.audit.map((entry, index) => <li key={index} className="break-words">
-          <time dateTime={new Date(entry.createdAt).toISOString()}>{new Date(entry.createdAt).toLocaleString(resolvedLocale)}</time>{' · '}
-          {entry.event}{entry.permission ? ` · ${entry.permission}` : ''}{entry.scope ? ` · ${entry.scope}` : ''}
-        </li>)}</ol>
-      </details>
-      <p className="text-xs text-muted-foreground">{t('settings.plugins.permissions.revokeNote')}</p>
-      <Button variant="destructive" size="sm" disabled={busy} onClick={() => void revoke()}>{t('settings.plugins.permissions.revoke')}</Button>
-    </>}
-  </section>;
-}

components/settings/tabs/PluginReadme.test.tsx

@@ -1,14 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { PluginReadme } from './PluginReadme';
-
-test('README never creates active HTML, remote media or script links', () => {
-  const html = renderToStaticMarkup(<PluginReadme markdown={'# Example\n\n<script>alert(1)</script>\n\n<img src="https://tracker.example/pixel">\n\n![track](https://tracker.example/x.svg)\n\n[run](javascript:alert%281%29)\n\n[docs](https://example.com)\n\n```html\n<iframe src="file:///secret">\n```'} />);
-  assert.doesNotMatch(html, /<(script|img|iframe|svg)\b/);
-  assert.doesNotMatch(html, /href="(javascript|file):/);
-  assert.match(html, /href="https:\/\/example.com"/);
-  assert.match(html, /rel="noopener noreferrer"/);
-  assert.match(html, /&lt;script&gt;/);
-});

components/settings/tabs/PluginReadme.tsx

@@ -1,37 +0,0 @@
-import React, { useMemo } from 'react';
-import { fromMarkdown } from 'mdast-util-from-markdown';
-import type { RootContent, Root } from 'mdast';
-
-function renderNode(node: Root | RootContent, key: number, depth = 0): React.ReactNode {
-  if (depth > 24) return null;
-  const children = 'children' in node ? node.children.map((child, index) => renderNode(child as RootContent, index, depth + 1)) : null;
-  switch (node.type) {
-    case 'root': return <React.Fragment key={key}>{children}</React.Fragment>;
-    case 'heading': return <h4 key={key} className="mt-5 font-semibold">{children}</h4>;
-    case 'paragraph': return <p key={key} className="my-2 leading-relaxed">{children}</p>;
-    case 'text': return node.value;
-    case 'strong': return <strong key={key}>{children}</strong>;
-    case 'emphasis': return <em key={key}>{children}</em>;
-    case 'inlineCode': return <code key={key} className="rounded bg-muted px-1">{node.value}</code>;
-    case 'code': return <pre key={key} className="my-3 overflow-auto rounded-lg bg-muted p-3 text-xs"><code>{node.value}</code></pre>;
-    case 'list': return <ul key={key} className="my-2 list-disc pl-5">{children}</ul>;
-    case 'listItem': return <li key={key}>{children}</li>;
-    case 'blockquote': return <blockquote key={key} className="border-l-2 pl-3 text-muted-foreground">{children}</blockquote>;
-    case 'break': return <br key={key} />;
-    case 'thematicBreak': return <hr key={key} />;
-    case 'link': {
-      let safe = false;
-      try { const url = new URL(node.url); safe = url.protocol === 'https:' && !url.username && !url.password; } catch { /* relative and unsafe links stay text */ }
-      return safe ? <a key={key} href={node.url} target="_blank" rel="noopener noreferrer" className="underline">{children}</a> : <span key={key}>{children}</span>;
-    }
-    // Never embed HTML, media, SVG, iframes, remote images, or reference URLs.
-    case 'image': return <span key={key} className="text-muted-foreground">[{node.alt ?? 'image'}]</span>;
-    case 'html': return <span key={key}>{node.value}</span>;
-    default: return <React.Fragment key={key}>{children}</React.Fragment>;
-  }
-}
-
-export function PluginReadme({ markdown }: { markdown: string }) {
-  const tree = useMemo(() => fromMarkdown(markdown.slice(0, 256 * 1024)), [markdown]);
-  return <div className="break-words text-sm">{renderNode(tree, 0)}</div>;
-}

components/settings/tabs/PluginStatePill.test.tsx

@@ -1,43 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import React from 'react';
-import { act, create, type ReactTestRenderer } from 'react-test-renderer';
-import { I18nProvider } from '../../../application/i18n/I18nProvider';
-import { PluginPackageManager } from './PluginPackageManager';
-import type { usePluginManager } from '../../../application/state/usePluginManager';
-
-test('state pill exposes actual state, opposite action, focus styling and pending disable without granting permissions', async () => {
-  const globals = globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean };
-  const previous = globals.IS_REACT_ACT_ENVIRONMENT; globals.IS_REACT_ACT_ENVIRONMENT = true;
-  const calls: unknown[] = [];
-  const plugin = { id: 'com.test.pill', activeVersion: '1.0.0', enabled: true, manifest: { name: 'Pill' }, runtime: {} } as NetcattyInstalledPlugin;
-  const manager = { available: true, plugins: [plugin], busy: false, setEnabled: async (...args: unknown[]) => { calls.push(args); } } as unknown as ReturnType<typeof usePluginManager>;
-  let renderer: ReactTestRenderer;
-  const render = (enabled: boolean, busy = false) => <I18nProvider locale="en"><PluginPackageManager manager={{ ...manager, busy, plugins: [{ ...plugin, enabled }] }} /></I18nProvider>;
-  try {
-    await act(async () => { renderer = create(render(true)); });
-    const pill = () => renderer.root.findAllByType('button').find((node) => node.props['aria-pressed'] !== undefined)!;
-    assert.equal(pill().props['aria-pressed'], true);
-    const logoSlot = renderer.root.findAllByType('div').find((node) => node.props.className === 'flex h-12 w-12 shrink-0 items-center justify-center');
-    assert.ok(logoSlot, 'logo keeps its 48px layout slot without an extra decorative background');
-    assert.equal(pill().props['aria-label'], 'Disable Pill');
-    assert.ok(pill().children.includes('Enabled'));
-    assert.match(pill().props.className, /rounded-full/);
-    assert.match(pill().props.className, /border-0/);
-    assert.doesNotMatch(pill().props.className, /border-primary|border-border/);
-    assert.match(pill().props.className, /bg-primary\/10/);
-    assert.match(pill().props.className, /focus-visible:ring-2/);
-    assert.match(pill().props.style.color, /--primary/);
-    await act(async () => pill().props.onClick());
-    assert.deepEqual(calls, [['com.test.pill', false]]);
-    await act(async () => renderer.update(render(false, true)));
-    assert.equal(pill().props['aria-pressed'], false);
-    assert.equal(pill().props['aria-label'], 'Enable Pill');
-    assert.ok(pill().children.includes('Disabled'));
-    assert.equal(pill().props.disabled, true);
-    assert.equal(pill().props['aria-busy'], true);
-    assert.match(pill().props.className, /bg-muted/);
-    assert.equal(pill().props.style, undefined);
-    await act(async () => renderer.unmount());
-  } finally { globals.IS_REACT_ACT_ENVIRONMENT = previous; }
-});

components/settings/tabs/PluginStatus.tsx

@@ -1,14 +0,0 @@
-import React from 'react';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { Button } from '../../ui/button';
-import { PluginInfo } from './PluginInfo';
-
-export function PluginStatus({ noVault, offlineError, retry, sourceKind }: { sourceKind?: NetcattyPluginSource['kind']; noVault?: boolean; offlineError?: string | null; retry?: () => void }) {
-  const { t } = useI18n();
-  const count = Number(Boolean(noVault)) + Number(Boolean(offlineError));
-  const explanation = <>{noVault && <p>{t('settings.plugins.manager.noVault')}</p>}{offlineError && <><p>{t(sourceKind === 'third-party' ? 'settings.plugins.sources.offline' : 'settings.plugins.market.offline')}</p><p className="break-words">{offlineError}</p></>}</>;
-  const label = count ? `${t('settings.plugins.info')} · ${t('settings.plugins.status', { count })}` : t('settings.plugins.info');
-  const help = <><p>{t('settings.plugins.manager.preview')}</p><p>{t(sourceKind === 'third-party' ? 'settings.plugins.sources.note' : 'settings.plugins.market.note')}</p></>;
-  const preview = <>{count > 0 && <p>{t('settings.plugins.status', { count })}</p>}{explanation}{help}</>;
-  return <PluginInfo label={label} badgeCount={count} previewContent={preview}>{explanation}{offlineError && retry && <Button variant="outline" size="sm" onClick={retry}>{t('settings.plugins.market.retry')}</Button>}{count > 0 && <hr className="border-border/60" />}{help}</PluginInfo>;
-}

components/settings/tabs/PluginThemePicker.test.tsx

@@ -1,230 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { JSDOM } from "jsdom";
-import type {
-  ThemePackCatalog,
-  ThemePackEntry,
-} from "@netcatty/plugin-contract";
-
-test("host theme picker previews without persistence, applies, restores, and cancels stale owners safely", async () => {
-  const dom = new JSDOM(
-    '<!doctype html><html><body><div id="root"></div></body></html>',
-    { url: "http://localhost", pretendToBeVisual: true },
-  );
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  for (const key of [
-    "window",
-    "document",
-    "navigator",
-    "HTMLElement",
-    "Element",
-    "Node",
-    "Event",
-    "MouseEvent",
-    "IS_REACT_ACT_ENVIRONMENT",
-  ]) {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, {
-      configurable: true,
-      writable: true,
-      value:
-        key === "IS_REACT_ACT_ENVIRONMENT"
-          ? true
-          : key === "window"
-            ? dom.window
-            : dom.window[key as keyof typeof dom.window],
-    });
-  }
-  const { default: React, act, useLayoutEffect } = await import("react");
-  const { createRoot } = await import("react-dom/client");
-  const { I18nProvider } = await import(
-    "../../../application/i18n/I18nProvider"
-  );
-  const { PluginThemePicker } = await import("./PluginThemePicker");
-  const { pluginThemeRegistry: registry } = await import(
-    "../../../infrastructure/config/pluginThemeRegistry"
-  );
-  const { usePluginThemeRevision } = await import(
-    "../../../application/state/usePluginThemeRuntime"
-  );
-  const { getUiThemeById } = await import(
-    "../../../infrastructure/config/uiThemes"
-  );
-  const { applyThemeTokens } = await import(
-    "../../../application/state/settingsStateDefaults"
-  );
-  const entry: ThemePackEntry = {
-    ref: {
-      pluginId: "com.example.theme",
-      themeId: "com.example.theme.forest",
-      version: "1.0.0",
-      digest: "a".repeat(64),
-      variant: "light",
-    },
-    label: "Forest",
-    pluginName: "Synthetic Theme",
-    dataOnly: true,
-    palette: { formatVersion: 1, base: "light", colors: { accent: "#166534" } },
-  };
-  let writes = 0,
-    restores = 0;
-  let catalog: ThemePackCatalog = {
-    selection: {
-      formatVersion: 1,
-      revision: registry.getCatalog().selection.revision + 1,
-      light: null,
-      dark: null,
-    },
-    entries: [entry],
-    diagnostics: [],
-  };
-  registry.setCatalog(catalog);
-  Object.assign(dom.window, {
-    netcatty: {
-      async applyPluginTheme(request: {
-        expectedRevision: number;
-        choice: ThemePackCatalog["selection"]["light"];
-      }) {
-        assert.equal(request.expectedRevision, catalog.selection.revision);
-        writes++;
-        catalog = {
-          ...catalog,
-          selection: {
-            ...catalog.selection,
-            revision: catalog.selection.revision + 1,
-            light: request.choice,
-          },
-        };
-        registry.setCatalog(catalog);
-        return catalog;
-      },
-    },
-  });
-  function Fixture() {
-    const revision = usePluginThemeRevision();
-    useLayoutEffect(
-      () =>
-        applyThemeTokens(
-          "light",
-          "light",
-          getUiThemeById("light", "snow").tokens,
-          "theme",
-          "",
-        ),
-      [revision],
-    );
-    return (
-      <I18nProvider locale="en">
-        <PluginThemePicker mode="light" onRestore={() => restores++} />
-      </I18nProvider>
-    );
-  }
-  const root = createRoot(document.getElementById("root")!);
-  const button = (label: string) =>
-    [...document.querySelectorAll<HTMLButtonElement>("button")].find(
-      (b) => b.textContent === label,
-    )!;
-  try {
-    await act(async () => root.render(<Fixture />));
-    const original =
-      document.documentElement.style.getPropertyValue("--primary");
-    await act(async () => {
-      const select = document.querySelector("select")!;
-      select.value = `${entry.ref.pluginId}/${entry.ref.themeId}`;
-      select.dispatchEvent(new Event("change", { bubbles: true }));
-    });
-    await act(async () => button("Preview").click());
-    assert.equal(writes, 0);
-    assert.equal(
-      getUiThemeById("light", "snow", false).tokens.primary,
-      original,
-      "local preview does not enter the global plugin view environment",
-    );
-    assert.notEqual(
-      document.documentElement.style.getPropertyValue("--primary"),
-      original,
-    );
-    assert.ok(
-      document.documentElement.hasAttribute("data-plugin-theme-active"),
-    );
-    assert.ok(
-      document.documentElement.style.getPropertyValue(
-        "--host-security-primary",
-      ),
-    );
-    await act(async () => button("Cancel preview").click());
-    assert.equal(
-      document.documentElement.style.getPropertyValue("--primary"),
-      original,
-    );
-    assert.equal(writes, 0);
-    await act(async () => {
-      button("Preview").click();
-      button("Apply").click();
-    });
-    assert.equal(writes, 1);
-    assert.equal(catalog.selection.light?.ref.themeId, entry.ref.themeId);
-    await act(async () => button("Restore default").click());
-    assert.equal(writes, 2);
-    assert.equal(restores, 1);
-    assert.equal(catalog.selection.light, null);
-    await act(async () => {
-      registry.startPreview("old-owner", entry);
-      registry.startPreview("new-owner", entry);
-      registry.cancelPreview("old-owner");
-    });
-    assert.notEqual(
-      document.documentElement.style.getPropertyValue("--primary"),
-      original,
-    );
-    await act(async () =>
-      registry.setCatalog({
-        ...catalog,
-        selection: {
-          ...catalog.selection,
-          revision: catalog.selection.revision + 1,
-        },
-        entries: [],
-      }),
-    );
-    assert.equal(
-      document.documentElement.style.getPropertyValue("--primary"),
-      original,
-      "package withdrawal cancels previews",
-    );
-    await act(async () =>
-      registry.setCatalog({
-        ...catalog,
-        selection: {
-          ...catalog.selection,
-          revision: catalog.selection.revision + 2,
-          light: { ref: entry.ref },
-        },
-        entries: [],
-      }),
-    );
-    assert.equal(getUiThemeById("light", "snow").id, "host-plugin-fallback");
-    await act(async () => registry.setHighContrast(true));
-    assert.equal(getUiThemeById("light", "snow").id, "host-high-contrast");
-  } finally {
-    await act(async () => {
-      root.unmount();
-      registry.setHighContrast(false);
-      registry.setCatalog({
-        ...catalog,
-        selection: {
-          formatVersion: 1,
-          revision: registry.getCatalog().selection.revision + 1,
-          light: null,
-          dark: null,
-        },
-        entries: [],
-      });
-    });
-    dom.window.close();
-    for (const [key, descriptor] of previous) {
-      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
-      else Reflect.deleteProperty(globalThis, key);
-    }
-  }
-});

components/settings/tabs/PluginThemePicker.tsx

@@ -1,166 +0,0 @@
-import { useEffect, useId, useState } from "react";
-import { useI18n } from "../../../application/i18n/I18nProvider";
-import {
-  applyPluginThemeSelection,
-  usePluginThemeRevision,
-} from "../../../application/state/usePluginThemeRuntime";
-import { pluginThemeRegistry } from "../../../infrastructure/config/pluginThemeRegistry";
-import { Button } from "../../ui/button";
-
-export function PluginThemePicker({
-  mode,
-  onRestore,
-}: {
-  mode: "light" | "dark";
-  onRestore: () => void;
-}) {
-  const { t } = useI18n();
-  usePluginThemeRevision();
-  const owner = useId();
-  const [selected, setSelected] = useState(""),
-    [pending, setPending] = useState(false),
-    [error, setError] = useState("");
-  const catalog = pluginThemeRegistry.getCatalog();
-  const entries = catalog.entries.filter((e) => e.palette.base === mode);
-  const applied = catalog.selection[mode];
-  const appliedAvailable =
-    applied &&
-    entries.some(
-      (e) =>
-        e.ref.pluginId === applied.ref.pluginId &&
-        e.ref.themeId === applied.ref.themeId &&
-        e.ref.version === applied.ref.version &&
-        e.ref.digest === applied.ref.digest,
-    );
-  const entry = entries.find(
-    (e) => `${e.ref.pluginId}/${e.ref.themeId}` === selected,
-  );
-  useEffect(
-    () => () => pluginThemeRegistry.cancelPreview(owner),
-    [owner, mode],
-  );
-  async function apply(restore = false) {
-    if (pending || (!restore && !entry)) return;
-    setPending(true);
-    setError("");
-    try {
-      await applyPluginThemeSelection(
-        mode,
-        restore ? null : { ref: entry!.ref },
-      );
-      pluginThemeRegistry.cancelPreview(owner);
-      if (restore) {
-        setSelected("");
-        onRestore();
-      }
-    } catch (e) {
-      setError(
-        e instanceof Error ? e.message : t("settings.plugins.themes.failed"),
-      );
-    } finally {
-      setPending(false);
-    }
-  }
-  return (
-    <section
-      className="space-y-3 py-3"
-      aria-label={t("settings.plugins.themes.title")}
-    >
-      <div>
-        <h4 className="text-sm font-medium">
-          {t("settings.plugins.themes.title")}
-        </h4>
-        <p className="text-xs text-muted-foreground">
-          {t("settings.plugins.themes.description")}
-        </p>
-      </div>
-      {entries.length === 0 ? (
-        <p className="text-xs text-muted-foreground">
-          {t("settings.plugins.themes.empty")}
-        </p>
-      ) : (
-        <select
-          className="h-9 w-full rounded-md border border-input bg-background px-3 text-sm"
-          aria-label={t("settings.plugins.themes.choose")}
-          value={entry ? selected : ""}
-          disabled={pending}
-          onChange={(e) => {
-            pluginThemeRegistry.cancelPreview(owner);
-            setSelected(e.target.value);
-            setError("");
-          }}
-        >
-          <option value="">{t("settings.plugins.themes.choose")}</option>
-          {entries.map((e) => (
-            <option
-              key={`${e.ref.pluginId}/${e.ref.themeId}`}
-              value={`${e.ref.pluginId}/${e.ref.themeId}`}
-            >
-              {e.label} — {e.pluginName} {e.ref.version}
-            </option>
-          ))}
-        </select>
-      )}
-      {catalog.selection[mode] && (
-        <p className="text-xs text-muted-foreground">
-          {t(
-            appliedAvailable
-              ? "settings.plugins.themes.applied"
-              : "settings.plugins.themes.unavailable",
-          )}
-          : {catalog.selection[mode]!.ref.themeId} ·{" "}
-          {catalog.selection[mode]!.ref.version}
-        </p>
-      )}
-      <div className="flex flex-wrap gap-2">
-        <Button
-          size="sm"
-          variant="outline"
-          disabled={!entry || pending}
-          onClick={() => {
-            if (entry) pluginThemeRegistry.startPreview(owner, entry);
-          }}
-        >
-          {t("settings.plugins.themes.preview")}
-        </Button>
-        <Button
-          size="sm"
-          disabled={!entry || pending}
-          onClick={() => {
-            void apply();
-          }}
-        >
-          {t("settings.plugins.themes.apply")}
-        </Button>
-        <Button
-          size="sm"
-          variant="ghost"
-          disabled={pending}
-          onClick={() => pluginThemeRegistry.cancelPreview(owner)}
-        >
-          {t("settings.plugins.themes.cancel")}
-        </Button>
-        <Button
-          size="sm"
-          variant="outline"
-          disabled={pending}
-          onClick={() => {
-            void apply(true);
-          }}
-        >
-          {t("settings.plugins.themes.restore")}
-        </Button>
-      </div>
-      {catalog.diagnostics.length > 0 && (
-        <p className="text-xs text-muted-foreground">
-          {t("settings.plugins.themes.invalid")}
-        </p>
-      )}
-      {error && (
-        <p role="alert" className="text-xs text-destructive">
-          {error}
-        </p>
-      )}
-    </section>
-  );
-}

components/settings/tabs/PluginThirdPartyMarket.interaction.test.tsx

@@ -1,55 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { JSDOM } from 'jsdom';
-
-test('source management requires consent and Escape restores either opener inside the plugin window', async () => {
-  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
-  const previous = new Map<string, PropertyDescriptor | undefined>();
-  const install = (key: string, value: unknown) => {
-    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
-    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
-  };
-  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
-    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
-  }
-  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
-  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
-  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
-  install('IS_REACT_ACT_ENVIRONMENT', true);
-  // Install a synthetic preload surface on the isolated DOM window.
-  Object.defineProperty(dom.window, 'netcatty', { value: { listPluginSources: async () => [] }, configurable: true });
-  const { default: React, act } = await import('react');
-  const { createRoot } = await import('react-dom/client');
-  const { PluginThirdPartyMarket } = await import('./PluginThirdPartyMarket');
-  const { PluginManagementDialog } = await import('./PluginManagementDialog');
-  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
-  const root = createRoot(document.getElementById('root')!);
-  const settle = () => new Promise((resolve) => setTimeout(resolve, 60));
-  try {
-    await act(async () => root.render(<I18nProvider locale="en"><PluginManagementDialog><PluginThirdPartyMarket installed={[]} /></PluginManagementDialog></I18nProvider>));
-    await act(async () => { document.querySelector<HTMLButtonElement>('button')!.click(); await settle(); });
-    for (const label of ['Manage sources', 'Add source']) {
-      const opener = [...document.querySelectorAll<HTMLButtonElement>('button')].find((button) => button.textContent === label)!;
-      assert.ok(opener);
-      await act(async () => { opener.focus(); opener.click(); await settle(); });
-      assert.equal(document.querySelectorAll('[role="dialog"]').length, 2);
-      const dialogs = document.querySelectorAll<HTMLElement>('[role="dialog"]');
-      const dialog = dialogs[dialogs.length - 1];
-      assert.match(dialog.textContent ?? '', /real domain/);
-      assert.equal(dialog.querySelector<HTMLInputElement>('input[type="checkbox"]')?.checked, false);
-      assert.equal(dialog.querySelector<HTMLButtonElement>('button[type="submit"]')?.disabled, true);
-      await act(async () => { dialog.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true })); await settle(); });
-      assert.equal(document.querySelectorAll('[role="dialog"]').length, 1);
-      assert.equal(document.activeElement, opener);
-    }
-  } finally {
-    // Radix schedules unmount autofocus on a timer. Drain it while the DOM's
-    // Event constructor is still installed (Node 22 has a distinct global Event).
-    await act(async () => { root.unmount(); await settle(); });
-    dom.window.close();
-    for (const [key, descriptor] of previous) {
-      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
-      else Reflect.deleteProperty(globalThis, key);
-    }
-  }
-});

components/settings/tabs/PluginThirdPartyMarket.tsx

@@ -1,59 +0,0 @@
-import React, { useRef, useState } from 'react';
-import { usePluginSources } from '../../../application/state/usePluginSources';
-import { useI18n } from '../../../application/i18n/I18nProvider';
-import { Button } from '../../ui/button';
-import { Input } from '../../ui/input';
-import { Dialog, DialogContent, DialogDescription, DialogTitle } from '../../ui/dialog';
-import { PluginMarketplace } from './PluginMarketplace';
-
-export function PluginThirdPartyMarket({ installed, toolbarContainer, noVault }: {
-  installed: NetcattyInstalledPlugin[]; toolbarContainer?: HTMLElement | null; noVault?: boolean;
-}) {
-  const { t } = useI18n();
-  const model = usePluginSources();
-  const [selected, setSelected] = useState('');
-  const [visited, setVisited] = useState<string[]>([]);
-  const [managing, setManaging] = useState(false);
-  const opener = useRef<HTMLButtonElement | null>(null);
-  const openManager = (event: React.MouseEvent<HTMLButtonElement>) => { opener.current = event.currentTarget; setManaging(true); };
-  const [name, setName] = useState('');
-  const [address, setAddress] = useState('');
-  const [accepted, setAccepted] = useState(false);
-  const [removing, setRemoving] = useState<string | null>(null);
-  const [disablePlugins, setDisablePlugins] = useState(false);
-  const sources = model.sources.filter((source) => source.kind === 'third-party');
-  const source = sources.find((item) => item.id === selected && item.enabled);
-  let domain = '';
-  try { domain = new URL(address).host; } catch { /* Host validates before saving. */ }
-  return <div className="space-y-4">
-    <div className="flex flex-wrap items-center gap-3">
-      <select aria-label={t('settings.plugins.sources.select')} value={selected} onChange={(event) => { setSelected(event.target.value); setVisited((items) => [...new Set([...items, event.target.value])]); }} className="h-9 min-w-0 rounded-md border border-input bg-background px-3 text-sm">
-        <option value="">{t('settings.plugins.sources.select')}</option>
-        {sources.filter((item) => item.enabled).map((item) => <option key={item.id} value={item.id}>{item.name} — {new URL(item.origin!).hostname}</option>)}
-      </select>
-      <Button variant="outline" size="sm" onClick={openManager}>{t('settings.plugins.sources.manage')}</Button>
-    </div>
-    {!source && <div className="py-8 text-center text-sm text-muted-foreground"><p>{t('settings.plugins.sources.empty')}</p><Button className="mt-3" variant="outline" onClick={openManager}>{t('settings.plugins.sources.add')}</Button></div>}
-    {/* Keep each visited source mounted to preserve its own selection/search/scroll. */}
-    {sources.filter((item) => item.enabled && (item.id === selected || visited.includes(item.id))).map((item) => {
-      return <div key={item.id} hidden={item.id !== source?.id}><PluginMarketplace source={item} installed={installed} toolbarContainer={item.id === source?.id ? toolbarContainer : undefined} noVault={noVault} /></div>;
-    })}
-    <Dialog open={managing} onOpenChange={setManaging}><DialogContent className="max-h-[85vh] overflow-y-auto" onCloseAutoFocus={(event) => { event.preventDefault(); opener.current?.focus(); }}>
-      <DialogTitle>{t('settings.plugins.sources.manage')}</DialogTitle><DialogDescription>{t('settings.plugins.sources.risk')}</DialogDescription>
-      {model.error && <p role="alert" className="text-sm text-destructive">{model.error}</p>}
-      <div className="space-y-3">{sources.map((item) => <div key={item.id} className="space-y-2 rounded-lg bg-muted/30 p-3">
-        <Input aria-label={t('settings.plugins.sources.name')} defaultValue={item.name} onBlur={(event) => { if (event.target.value !== item.name) void model.update(item, event.target.value, Boolean(item.enabled)); }} disabled={model.busy} />
-        <p className="break-all text-xs text-muted-foreground">{item.origin}</p>
-        <div className="flex items-center justify-between"><label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={Boolean(item.enabled)} disabled={model.busy} onChange={(event) => void model.update(item, item.name, event.target.checked)} />{t('settings.plugins.manager.enabled')}</label><Button variant="ghost" size="sm" disabled={model.busy} onClick={() => { setRemoving(item.id); setDisablePlugins(false); }}>{t('settings.plugins.sources.remove')}</Button></div>
-        {removing === item.id && <div className="space-y-2 text-sm"><p>{t('settings.plugins.sources.removeNote')}</p><label className="flex items-center gap-2"><input type="checkbox" checked={disablePlugins} onChange={(event) => setDisablePlugins(event.target.checked)} />{t('settings.plugins.sources.disablePlugins')}</label><Button size="sm" variant="destructive" disabled={model.busy} onClick={() => void model.remove(item.id, disablePlugins).then((ok) => { if (ok) setRemoving(null); })}>{t('settings.plugins.sources.remove')}</Button></div>}
-      </div>)}</div>
-      <form className="space-y-3" onSubmit={(event) => { event.preventDefault(); if (accepted) void model.add(name, address).then((ok) => { if (ok) { setName(''); setAddress(''); setAccepted(false); } }); }}>
-        <Input required value={name} onChange={(event) => setName(event.target.value)} placeholder={t('settings.plugins.sources.name')} aria-label={t('settings.plugins.sources.name')} />
-        <Input required type="url" value={address} onChange={(event) => { setAddress(event.target.value); setAccepted(false); }} placeholder="https://plugins.example.com" aria-label={t('settings.plugins.sources.address')} />
-        {domain && <p className="break-all text-sm font-medium">{domain}</p>}
-        <label className="flex items-start gap-2 text-xs"><input type="checkbox" checked={accepted} onChange={(event) => setAccepted(event.target.checked)} />{t('settings.plugins.sources.accept')}</label>
-        <Button type="submit" disabled={model.busy || !accepted}>{t('settings.plugins.sources.add')}</Button>
-      </form>
-    </DialogContent></Dialog>
-  </div>;
-}

components/settings/tabs/SettingsAppearanceTab.tsx

@@ -1,6 +1,3 @@
-import { PluginThemePicker } from './PluginThemePicker';
-import { applyPluginThemeSelection, usePluginThemeRevision } from '../../../application/state/usePluginThemeRuntime';
-import { pluginThemeRegistry } from '../../../infrastructure/config/pluginThemeRegistry';
 import React, { memo, useCallback, useMemo, useState } from "react";
 import { applyCustomCssToDocument } from "../../../lib/customCss";
 import { DebouncedTextarea } from "../DebouncedTextarea";
@@ -73,8 +70,6 @@ function SettingsAppearanceTab(props: {
   setAppIconVariant: (variant: AppIconVariant) => void;
 }) {
   const { t } = useI18n();
-  usePluginThemeRevision();
-  const [pluginThemeError, setPluginThemeError] = useState('');
   const availableUIFonts = useAvailableUIFonts();
   // Note code fonts come from the monospace-only store (fontStore); the note
   // body font follows the UI font setting instead.
@@ -236,12 +231,8 @@ function SettingsAppearanceTab(props: {
   );
 
   const visibleUiThemes = resolvedTheme === "dark" ? DARK_UI_THEMES : LIGHT_UI_THEMES;
-  const visibleUiThemeId = pluginThemeRegistry.isActive(resolvedTheme) ? "" : resolvedTheme === "dark" ? darkUiThemeId : lightUiThemeId;
-  const setVisibleUiThemeId = (id: string) => {
-    void applyPluginThemeSelection(resolvedTheme, null).then(() => {
-      (resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId)(id);setPluginThemeError('');
-    }).catch((error: unknown) => setPluginThemeError(error instanceof Error ? error.message : t('settings.plugins.themes.failed')));
-  };
+  const visibleUiThemeId = resolvedTheme === "dark" ? darkUiThemeId : lightUiThemeId;
+  const setVisibleUiThemeId = resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId;
 
   return (
     <SettingsTabContent value="appearance">
@@ -348,8 +339,6 @@ function SettingsAppearanceTab(props: {
             {renderThemeSwatches(visibleUiThemes, visibleUiThemeId, setVisibleUiThemeId)}
           </div>
         </SettingsAnchor>
-        <PluginThemePicker mode={resolvedTheme} onRestore={() => (resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId)(resolvedTheme === "dark" ? "midnight" : "snow")} />
-        {pluginThemeError && <p role="alert" className="text-xs text-destructive">{pluginThemeError}</p>}
         <SettingRow
           anchorId="appearance-accent-mode"
           label={t("settings.appearance.accentColor.mode")}

components/settings/tabs/SettingsPluginsTab.tsx

@@ -1,16 +1,9 @@
-import { PluginThirdPartyMarket } from './PluginThirdPartyMarket';
-import { usePluginManager } from '../../../application/state/usePluginManager';
-import { PluginManagementDialog } from './PluginManagementDialog';
-import { PluginMarketplace } from './PluginMarketplace';
-import { PluginPackageManager } from './PluginPackageManager';
 import { FolderOpen } from 'lucide-react';
-import { PluginStatus } from './PluginStatus';
 import React, { useEffect, useMemo, useState } from 'react';
 
 import { normalizePluginKeyboardEvent } from '../../../application/state/pluginKeybindings';
 import { usePluginContributions } from '../../../application/state/usePluginContributions';
 import { useI18n } from '../../../application/i18n/I18nProvider';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '../../ui/tabs';
 import { Button } from '../../ui/button';
 import { Input } from '../../ui/input';
 import { SettingsAnchor, SettingsTabContent } from '../settings-ui';
@@ -285,12 +278,8 @@ export function PluginSettingField({
   );
 }
 
-function PluginManagementContent({ handoff }: { handoff: (action: () => void) => void }) {
+export default function SettingsPluginsTab() {
   const { t } = useI18n();
-  const manager = usePluginManager();
-  const [catalogToolbar, setCatalogToolbar] = useState<HTMLDivElement | null>(null);
-  const [selectedInstalled, setSelectedInstalled] = useState<string | null>(null);
-  const [pluginView, setPluginView] = useState<'installed' | 'marketplace' | 'thirdparty'>('installed');
   const availableFonts = useAvailableFonts();
   const scopeCatalog = usePluginSettingScopeCatalog();
   const [scopeIds, setScopeIds] = useState<Partial<Record<NetcattyPluginSettingScopeKind, string>>>({});
@@ -303,31 +292,21 @@ function PluginManagementContent({ handoff }: { handoff: (action: () => void) =>
   }), [scopeIds]);
   const contributions = usePluginContributions(query);
   const contextualScopes = useMemo(() => new Set(contributions.snapshot.plugins
-    .filter((plugin) => plugin.id === selectedInstalled)
     .flatMap((plugin) => plugin.settings.map((setting) => setting.scope))
     .filter((scope): scope is NetcattyPluginSettingScopeKind => scope !== 'application')),
-  [contributions.snapshot.plugins, selectedInstalled]);
-
+  [contributions.snapshot.plugins]);
+  const hasVisibleContributions = contributions.snapshot.plugins.some((plugin) => (
+    plugin.settings.some((setting) => setting.visible)
+    || plugin.views.some((view) => view.visible && view.location === 'settings')
+  ));
 
   return (
-    <div className="space-y-5">
-        <Tabs value={pluginView} onValueChange={(value) => { setSelectedInstalled(null); setPluginView(value as 'installed' | 'marketplace' | 'thirdparty'); }} className="space-y-5">
-        <div className="flex flex-wrap items-center justify-between gap-3">
-          <TabsList className="h-auto flex-wrap justify-start bg-muted/50">
-            <TabsTrigger value="installed">{t('settings.plugins.manager.installed')} <span className="ml-2 text-muted-foreground">{manager.plugins.length}</span></TabsTrigger>
-            <TabsTrigger value="marketplace">{t('settings.plugins.sources.official')}</TabsTrigger>
-            <TabsTrigger value="thirdparty">{t('settings.plugins.sources.thirdparty')}</TabsTrigger>
-          </TabsList>
-          <div className="flex items-center gap-2">
-          {pluginView === 'installed' && <PluginStatus noVault={manager.credentialStorageAvailable === false} />}
-          <div ref={setCatalogToolbar} className="flex items-center gap-2" />
-          <Button variant="outline" size="sm" disabled={!manager.available || manager.busy} onClick={() => { setPluginView('installed'); void manager.importPackage(); }}><FolderOpen size={14} className="mr-2" />{t('settings.plugins.manager.import')}</Button>
-          </div>
+    <SettingsTabContent value="plugins">
+      <SettingsAnchor anchorId="plugins-root" className="mx-auto w-full max-w-3xl space-y-6 px-8 py-8">
+        <div>
+          <h2 className="text-xl font-semibold">{t('settings.plugins.title')}</h2>
+          <p className="mt-1 text-sm text-muted-foreground">{t('settings.plugins.description')}</p>
         </div>
-        <TabsContent forceMount hidden={pluginView !== 'marketplace'} value="marketplace" className="m-0 space-y-6"><PluginMarketplace installed={manager.plugins} toolbarContainer={pluginView === 'marketplace' ? catalogToolbar : undefined} noVault={manager.credentialStorageAvailable === false} /></TabsContent>
-        <TabsContent forceMount hidden={pluginView !== 'thirdparty'} value="thirdparty" className="m-0 space-y-6"><PluginThirdPartyMarket installed={manager.plugins} toolbarContainer={pluginView === 'thirdparty' ? catalogToolbar : undefined} noVault={manager.credentialStorageAvailable === false} /></TabsContent>
-        <TabsContent value="installed" className="m-0 space-y-6">
-        <PluginPackageManager manager={manager} onSelectionChange={setSelectedInstalled} />
         {contextualScopes.size > 0 && (
           <section className="grid gap-3 rounded-lg border border-border/70 bg-muted/10 p-4 sm:grid-cols-2" aria-label={t('settings.plugins.scopeTargets')}>
             {[...contextualScopes].map((kind) => (
@@ -347,7 +326,7 @@ function PluginManagementContent({ handoff }: { handoff: (action: () => void) =>
         )}
         {contributions.loading && <p className="text-sm text-muted-foreground">{t('settings.plugins.loading')}</p>}
         {contributions.error && <p role="alert" className="text-sm text-destructive">{contributions.error.message}</p>}
-        {contributions.snapshot.plugins.filter((plugin) => plugin.id === selectedInstalled).map((plugin) => {
+        {contributions.snapshot.plugins.map((plugin) => {
           const settings = plugin.settings.filter((setting) => setting.visible);
           const views = plugin.views.filter((view) => view.visible && view.location === 'settings');
           if (!settings.length && !views.length) return null;
@@ -377,32 +356,18 @@ function PluginManagementContent({ handoff }: { handoff: (action: () => void) =>
                     <div className="font-mono text-[10px] text-muted-foreground">{view.id}</div>
                     </div>
                   </div>
-                  <Button type="button" variant="outline" size="sm" onClick={() => handoff(() => requestOpenPluginView({
+                  <Button type="button" variant="outline" size="sm" onClick={() => requestOpenPluginView({
                     viewId: view.id,
                     context: { 'netcatty.surface': 'settings' },
-                  }))}>{t('settings.plugins.openView')}</Button>
+                  })}>{t('common.open')}</Button>
                 </div>
               ))}
             </section>
           );
         })}
-        </TabsContent>
-        </Tabs>
-    </div>
-  );
-}
-
-
-export default function SettingsPluginsTab() {
-  const { t } = useI18n();
-  return (
-    <SettingsTabContent value="plugins">
-      <SettingsAnchor anchorId="plugins-root" className="space-y-5">
-        <div>
-          <h2 className="text-xl font-semibold">{t('settings.plugins.title')}</h2>
-          <p className="mt-1 text-sm text-muted-foreground">{t('settings.plugins.description')}</p>
-        </div>
-        <PluginManagementDialog>{(handoff) => <PluginManagementContent handoff={handoff} />}</PluginManagementDialog>
+        {!contributions.loading && contributions.available && !hasVisibleContributions && (
+          <p className="text-sm text-muted-foreground">{t('settings.plugins.empty')}</p>
+        )}
       </SettingsAnchor>
     </SettingsTabContent>
   );

components/settings/tabs/plugin-marketplace.css

@@ -1,9 +0,0 @@
-.plugin-marketplace-browser { min-width: 0; }
-.plugin-marketplace-catalog { min-width: 0; }
-.plugin-marketplace-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(min(100%, 280px), 1fr)); gap: 16px; }
-/* Details use only the manager's main scrolling surface at every width. */
-.plugin-marketplace-detail { overflow-wrap: anywhere; }
-.plugin-card { box-shadow: 0 1px 4px hsl(var(--foreground) / 0.06); }
-.plugin-card:hover { box-shadow: 0 2px 8px hsl(var(--foreground) / 0.09); }
-.dark .plugin-card { background: hsl(var(--muted) / 0.2); box-shadow: none; }
-.dark .plugin-card:hover { background: hsl(var(--muted) / 0.3); box-shadow: none; }

components/terminal/TerminalHostKeyVerification.tsx

@@ -30,7 +30,7 @@ export const TerminalHostKeyVerification: React.FC<TerminalHostKeyVerificationPr
     const Icon = isChanged ? AlertTriangle : Fingerprint;
 
     return (
-        <div data-host-security-surface="" className="space-y-3 animate-in fade-in-0 slide-in-from-bottom-1 duration-200">
+        <div className="space-y-3 animate-in fade-in-0 slide-in-from-bottom-1 duration-200">
             <div
                 className={cn(
                     "rounded-xl border px-3 py-2.5",

components/terminal/TerminalToolbar.tsx

@@ -44,7 +44,6 @@ import { collectOwnedPluginMenus, comparePluginMenus, usePluginContributions } f
 import { buildTerminalPluginContributionContext } from '../../application/state/pluginContributionContexts';
 import { PluginContributionIcon } from '../plugins/PluginContributionIcon';
 import { isPluginHostProtocol } from '../../domain/pluginConnection';
-import { PluginTerminalSidebarLauncher } from '../plugins/PluginTerminalSidebar';
 
 export const TERMINAL_TOOLBAR_ITEM_IDS = [
   'highlight',
@@ -1159,7 +1158,6 @@ export const TerminalToolbar: React.FC<TerminalToolbarProps> = ({
         )}
         </ToolbarCustomizeContextMenu>
 
-        {!compactToolbar && <PluginTerminalSidebarLauncher sessionId={sessionId} />}
         {pluginToolbarMenus.map((menu) => (
         <Tooltip key={menu.id}>
           <TooltipTrigger asChild>

components/terminal/TerminalView.test.tsx

@@ -10,9 +10,11 @@ import {
   formatTerminalTitleConnectionAddress,
   focusTerminalFromDisconnectedNotice,
   getLineTimestampToggleHostUpdate,
+  resolveLineTimestampGutterLayout,
   resolveNetworkDeviceTipRightInset,
   resolveTerminalRightInset,
   resolveTerminalTopOffsets,
+  subscribeTerminalAlternateScreenChanges,
   shouldBlockTerminalReconnectForTarget,
   shouldEnableStatusBarDisconnect,
   shouldEnableStatusBarReconnect,
@@ -182,6 +184,127 @@ test("line timestamp toolbar toggle is hidden when timestamps are unavailable",
   assert.equal(shouldShowLineTimestampToolbarToggle(true, undefined), false);
 });
 
+test("line timestamp gutter reserves no space while the alternate screen is active", () => {
+  assert.deepEqual(resolveLineTimestampGutterLayout({
+    showLineTimestampGutter: true,
+    alternateScreenActive: true,
+    gutterWidth: 72,
+  }), { enabled: false, width: 0 });
+  assert.deepEqual(resolveLineTimestampGutterLayout({
+    showLineTimestampGutter: true,
+    alternateScreenActive: false,
+    gutterWidth: 72,
+  }), { enabled: true, width: 72 });
+  assert.deepEqual(resolveLineTimestampGutterLayout({
+    showLineTimestampGutter: false,
+    alternateScreenActive: false,
+    gutterWidth: 72,
+  }), { enabled: false, width: 0 });
+
+  const source = readFileSync(new URL("./TerminalView.tsx", import.meta.url), "utf8");
+  assert.match(source, /const activeLineTimestampGutterWidth = lineTimestampGutterLayout\.width/);
+  assert.match(source, /enabled=\{lineTimestampGutterLayout\.enabled\}/);
+  assert.doesNotMatch(source, /enabled=\{showLineTimestampGutter\}/);
+  assert.match(source, /aria-pressed=\{showLineTimestampGutter\}/);
+  assert.doesNotMatch(source, /aria-pressed=\{[^}]*alternateScreenActive/);
+});
+
+type AlternateScreenWatchTerm = {
+  buffer: { active: { type: string } };
+  onRender: (callback: () => void) => { dispose: () => void };
+};
+
+function createAlternateScreenWatchTerm(type: "normal" | "alternate") {
+  const renders: Array<() => void> = [];
+  let disposed = 0;
+  const term: AlternateScreenWatchTerm = {
+    buffer: { active: { type } },
+    onRender(callback) {
+      renders.push(callback);
+      return { dispose: () => { disposed += 1; } };
+    },
+  };
+  return {
+    term,
+    renders,
+    disposeCount: () => disposed,
+  };
+}
+
+test("alternate screen enter and leave drive the timestamp gutter", (t) => {
+  const watched = createAlternateScreenWatchTerm("normal");
+  const seen: boolean[] = [];
+  const stop = subscribeTerminalAlternateScreenChanges(
+    () => watched.term,
+    (active) => { seen.push(active); },
+  );
+  t.after(stop);
+
+  assert.deepEqual(seen, [false]);
+  watched.term.buffer.active.type = "alternate";
+  watched.renders[0]();
+  watched.renders[0]();
+  watched.term.buffer.active.type = "normal";
+  watched.renders[0]();
+  assert.deepEqual(seen, [false, true, false]);
+
+  stop();
+  assert.equal(watched.disposeCount(), 1);
+  watched.term.buffer.active.type = "alternate";
+  watched.renders[0]();
+  assert.deepEqual(seen, [false, true, false]);
+});
+
+test("alternate screen watch attaches after the terminal runtime exists", (t) => {
+  t.mock.timers.enable({ apis: ["setTimeout"] });
+  const watched = createAlternateScreenWatchTerm("alternate");
+  let current: AlternateScreenWatchTerm | null = null;
+  const seen: boolean[] = [];
+  const stop = subscribeTerminalAlternateScreenChanges(
+    () => current,
+    (active) => { seen.push(active); },
+  );
+  t.after(() => {
+    stop();
+    t.mock.timers.reset();
+  });
+
+  assert.deepEqual(seen, [false]);
+  current = watched.term;
+  t.mock.timers.tick(50);
+  assert.deepEqual(seen, [false, true]);
+  assert.equal(watched.renders.length, 1);
+  t.mock.timers.tick(500);
+  assert.equal(watched.renders.length, 1);
+  assert.deepEqual(seen, [false, true]);
+});
+
+test("alternate screen watch follows a replacement terminal runtime", (t) => {
+  t.mock.timers.enable({ apis: ["setTimeout"] });
+  const first = createAlternateScreenWatchTerm("alternate");
+  const second = createAlternateScreenWatchTerm("normal");
+  let current: AlternateScreenWatchTerm = first.term;
+  const seen: boolean[] = [];
+  const stop = subscribeTerminalAlternateScreenChanges(
+    () => current,
+    (active) => { seen.push(active); },
+  );
+  t.after(() => {
+    stop();
+    t.mock.timers.reset();
+  });
+
+  assert.deepEqual(seen, [true]);
+  current = second.term;
+  t.mock.timers.tick(250);
+  assert.deepEqual(seen, [true, false]);
+  assert.equal(first.disposeCount(), 1);
+  assert.equal(second.renders.length, 1);
+  second.term.buffer.active.type = "alternate";
+  second.renders[0]();
+  assert.deepEqual(seen, [true, false, true]);
+});
+
 test("selection AI overlay honors the visibility preference", () => {
   const overlayPosition = { left: 120, top: 80 };
   const addSelection = () => {};

components/terminal/TerminalView.tsx

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import React, { memo, useCallback, useEffect, useRef, useState } from 'react';
+import type { Terminal as XTerm } from '@xterm/xterm';
 import { ChevronsLeft, GripVertical, Minimize2, Network, PanelLeft, X as XIcon } from 'lucide-react';
 import { isTerminalSensitiveInputActive } from './runtime/terminalSensitiveInputRegistry';
 import { isSessionReconnectDisabled } from '../top-tabs/SessionTabContextMenuContent';
@@ -18,6 +19,7 @@ import {
   resolveTerminalTimestampGutterColor,
   resolveTerminalTimestampGutterWidth,
 } from './TerminalTimestampGutter';
+import { isTerminalAlternateScreenActive } from './terminalHibernateRuntime';
 import {
   Dialog,
   DialogContent,
@@ -122,6 +124,108 @@ export function shouldShowLineTimestampToolbarToggle(
   return lineTimestampsAvailable !== false && Boolean(onUpdateHost);
 }
 
+export function resolveLineTimestampGutterLayout({
+  showLineTimestampGutter,
+  alternateScreenActive,
+  gutterWidth,
+}: {
+  showLineTimestampGutter: boolean;
+  alternateScreenActive: boolean;
+  gutterWidth: number;
+}): { enabled: boolean; width: number } {
+  const enabled = showLineTimestampGutter && !alternateScreenActive;
+  return { enabled, width: enabled ? gutterWidth : 0 };
+}
+
+const ALTERNATE_SCREEN_ATTACH_RETRY_MS = 50;
+const ALTERNATE_SCREEN_RUNTIME_WATCH_MS = 250;
+
+type TerminalAlternateScreenDisposable = { dispose: () => void };
+
+type TerminalAlternateScreenWatchTarget = {
+  buffer?: { active?: { type?: string } };
+  onRender?: (callback: () => void) => TerminalAlternateScreenDisposable;
+};
+
+const readAlternateScreenActive = (
+  term: TerminalAlternateScreenWatchTarget | null | undefined,
+): boolean => {
+  try {
+    if (!term?.buffer?.active) return false;
+    return isTerminalAlternateScreenActive(term as XTerm);
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Alternate-screen programs intentionally skip timestamp recording. onRender
+ * collapses and restores the gutter immediately. The timer attaches once xterm
+ * exists and follows a replacement runtime after hibernate or reconnect.
+ */
+export function subscribeTerminalAlternateScreenChanges(
+  getTerm: () => TerminalAlternateScreenWatchTarget | null | undefined,
+  onChange: (alternateScreenActive: boolean) => void,
+): () => void {
+  let disposed = false;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let renderDisposable: TerminalAlternateScreenDisposable | null = null;
+  let attachedTerm: TerminalAlternateScreenWatchTarget | null = null;
+  let lastActive: boolean | null = null;
+
+  const publish = (active: boolean) => {
+    if (disposed || lastActive === active) return;
+    lastActive = active;
+    onChange(active);
+  };
+
+  const detachRender = () => {
+    renderDisposable?.dispose();
+    renderDisposable = null;
+  };
+
+  const watch = () => {
+    if (disposed) return;
+    if (timer !== null) {
+      clearTimeout(timer);
+      timer = null;
+    }
+
+    const term = getTerm() ?? null;
+    if (term !== attachedTerm) {
+      detachRender();
+      attachedTerm = term;
+      if (term?.onRender) {
+        renderDisposable = term.onRender(() => {
+          if (disposed) return;
+          const current = getTerm() ?? null;
+          if (current !== term) {
+            watch();
+            return;
+          }
+          publish(readAlternateScreenActive(current));
+        });
+      }
+    }
+
+    publish(readAlternateScreenActive(term));
+    if (disposed) return;
+    const delay = term?.onRender
+      ? ALTERNATE_SCREEN_RUNTIME_WATCH_MS
+      : ALTERNATE_SCREEN_ATTACH_RETRY_MS;
+    timer = setTimeout(watch, delay);
+  };
+
+  watch();
+
+  return () => {
+    disposed = true;
+    if (timer !== null) clearTimeout(timer);
+    detachRender();
+    attachedTerm = null;
+  };
+}
+
 /** Keep the tab/pane; only tear down the live transport. */
 export function shouldEnableStatusBarDisconnect(
   status: 'connecting' | 'connected' | 'disconnected' | undefined,
@@ -486,6 +590,11 @@ function TerminalViewInner({ ctx, isPaneMagnified = false }: { ctx: TerminalView
   }, [hostTimestampsEnabled, timestampOverride]);
   const showLineTimestampGutter = lineTimestampsAvailable !== false
     && (timestampOverride ?? hostTimestampsEnabled);
+  const [alternateScreenActive, setAlternateScreenActive] = useState(false);
+  useEffect(() => subscribeTerminalAlternateScreenChanges(
+    () => termRef.current,
+    setAlternateScreenActive,
+  ), [sessionId, status, termRef]);
   const lineTimestampColor = resolveTerminalTimestampGutterColor(effectiveTheme.colors);
   const [lineTimestampGutterWidth, setLineTimestampGutterWidth] = useState(() => (
     resolveTerminalTimestampGutterWidth({ fontSize: effectiveFontSize })
@@ -497,7 +606,12 @@ function TerminalViewInner({ ctx, isPaneMagnified = false }: { ctx: TerminalView
   const handleLineTimestampGutterWidthChange = useCallback((width: number) => {
     setLineTimestampGutterWidth((current) => (current === width ? current : width));
   }, []);
-  const activeLineTimestampGutterWidth = showLineTimestampGutter ? lineTimestampGutterWidth : 0;
+  const lineTimestampGutterLayout = resolveLineTimestampGutterLayout({
+    showLineTimestampGutter,
+    alternateScreenActive,
+    gutterWidth: lineTimestampGutterWidth,
+  });
+  const activeLineTimestampGutterWidth = lineTimestampGutterLayout.width;
   const lineTimestampToggleLabel = showLineTimestampGutter
     ? t("terminal.toolbar.timestampsDisable")
     : t("terminal.toolbar.timestampsEnable");
@@ -1086,7 +1200,7 @@ function TerminalViewInner({ ctx, isPaneMagnified = false }: { ctx: TerminalView
           <TerminalTimestampGutter
             termRef={termRef}
             containerRef={containerRef}
-            enabled={showLineTimestampGutter}
+            enabled={lineTimestampGutterLayout.enabled}
             top={terminalContentTop}
             left={terminalBodyInset}
             bottom={terminalBottomInset}

components/terminal/keywordHighlight.test.ts

@@ -5,6 +5,7 @@ import { createRequire } from "node:module";
 import type { SerializeAddon as SerializeAddonType } from "@xterm/addon-serialize";
 import type { Terminal as XTermType } from "@xterm/xterm";
 
+import { DEFAULT_KEYWORD_HIGHLIGHT_RULES } from "../../domain/models/terminal.ts";
 import { writeTerminalDataWithLineTimestamps } from "./runtime/terminalLineTimestamps.ts";
 import {
   noteTerminalOutputPressureData,
@@ -81,6 +82,76 @@ test("new output is colored on the written cells without decorations", async ()
   term.dispose();
 });
 
+test("keyword highlight skips cells whose PTY foreground is already colored", async () => {
+  // Starship directory segments set a truecolor foreground (#3940). Those
+  // cells must keep the PTY color; only default-foreground matches are recolored.
+  const unixPath = DEFAULT_KEYWORD_HIGHLIGHT_RULES.find((entry) => entry.id === "unix-path");
+  assert.ok(unixPath);
+  const keywordRgb = Number.parseInt(unixPath.color.slice(1), 16);
+  const cream = 0xfbf1c7;
+  const yellow = 0xfabd2f;
+  const term = new XTerm({ allowProposedApi: true, cols: 80, rows: 5, scrollback: 20 });
+  const highlighter = new KeywordHighlighter(term);
+  highlighter.setRules([unixPath], true);
+  await write(
+    term,
+    "\x1b[38;2;251;241;199m\x1b[48;2;250;189;47m/opt\x1b[0m"
+    + " \x1b[38;5;220m/mnt\x1b[0m"
+    + " \x1b[31m/bin\x1b[0m"
+    + " /var",
+  );
+
+  const tokenCells = (text: string) => {
+    const line = term.buffer.active.getLine(0);
+    const index = (line?.translateToString(true) ?? "").indexOf(text);
+    assert.ok(index >= 0, text);
+    return Array.from({ length: text.length }, (_, offset) => {
+      const cell = line?.getCell(index + offset);
+      assert.ok(cell, `${text}[${offset}]`);
+      return cell;
+    });
+  };
+
+  for (const cell of tokenCells("/opt")) {
+    assert.equal(cell.isFgRGB(), true);
+    assert.equal(cell.getFgColorMode(), 0x3000000);
+    assert.equal(cell.getFgColor(), cream);
+    assert.equal(cell.isBgRGB(), true);
+    assert.equal(cell.getBgColor(), yellow);
+  }
+  for (const cell of tokenCells("/mnt")) {
+    assert.equal(cell.isFgPalette(), true);
+    assert.equal(cell.getFgColorMode(), 0x2000000);
+    assert.equal(cell.getFgColor(), 220);
+  }
+  for (const cell of tokenCells("/bin")) {
+    assert.equal(cell.isFgPalette(), true);
+    assert.equal(cell.getFgColorMode(), 0x1000000);
+    assert.equal(cell.getFgColor(), 1);
+  }
+  for (const cell of tokenCells("/var")) {
+    assert.equal(cell.isFgRGB(), true);
+    assert.equal(cell.getFgColor(), keywordRgb);
+  }
+
+  highlighter.setRules([{ ...unixPath, color: "#60A5FA" }], true);
+  await highlighter.whenSettled();
+  assert.equal(tokenCells("/opt")[0]?.getFgColor(), cream);
+  assert.equal(tokenCells("/mnt")[0]?.getFgColor(), 220);
+  assert.equal(tokenCells("/bin")[0]?.getFgColor(), 1);
+  assert.equal(tokenCells("/var")[0]?.getFgColor(), BLUE);
+
+  highlighter.setRules([{ ...unixPath, color: "#60A5FA" }], false);
+  await highlighter.whenSettled();
+  assert.equal(tokenCells("/opt")[0]?.getFgColor(), cream);
+  assert.equal(tokenCells("/mnt")[0]?.getFgColor(), 220);
+  assert.equal(tokenCells("/bin")[0]?.getFgColor(), 1);
+  assert.equal(tokenCells("/var")[0]?.getFgColor(), -1);
+
+  highlighter.dispose();
+  term.dispose();
+});
+
 test("ordinary Enter output does not revisit existing history", async () => {
   const term = new XTerm({ allowProposedApi: true, cols: 80, rows: 5, scrollback: 20 });
   const highlighter = new KeywordHighlighter(term);

components/terminal/keywordHighlight.ts

@@ -67,6 +67,7 @@ const CELL_INDICES = 3;
 const CELL_CONTENT = 0;
 const CELL_FG = 1;
 const STYLE_MASK = 0xfc000000;
+const CM_MASK = 0x3000000;
 const CM_RGB = 0x3000000;
 const MAX_PLUGIN_HIGHLIGHT_SCAN_CHARS = 4_096;
 const MAX_PLUGIN_HIGHLIGHT_MATCHES_PER_WRITE = 256;
@@ -1061,7 +1062,13 @@ export class KeywordHighlighter implements IDisposable {
       const dataIndex = x * CELL_INDICES;
       const content = internal._data[dataIndex + CELL_CONTENT];
       const currentFg = internal._data[dataIndex + CELL_FG];
-      if (!originals.mask[x] || originals.content[x] !== content) {
+      // A cell already carrying a PTY palette/truecolor foreground (starship
+      // directory segments, ANSI logs) must keep that color. Keyword RGB is
+      // only for the default foreground.
+      const maskedForContent = originals.mask[x] === 1 && originals.content[x] === content;
+      const ptyFg = maskedForContent ? originals.fg[x] : currentFg;
+      if ((ptyFg & CM_MASK) !== 0) continue;
+      if (!maskedForContent) {
         originals.fg[x] = currentFg;
         originals.content[x] = content;
         originals.mask[x] = 1;

components/terminalLayer/TerminalLayerSidePanelSection.tsx

@@ -9,7 +9,7 @@ import React, { memo, useCallback, useEffect, useLayoutEffect, useMemo, useRef,
 import { createPortal } from 'react-dom';
 import * as SelectPrimitive from '@radix-ui/react-select';
 
-import { activeTabStore, useActiveTabId } from '../../application/state/activeTabStore';
+import { useActiveTabId } from '../../application/state/activeTabStore';
 import {
   getSidePanelLiveSnapshot,
   subscribeSidePanelLiveSnapshot,
@@ -48,7 +48,6 @@ import {
   MAX_SIDE_PANEL_PANES,
   canSplitSidePanelPaneAtSize,
   collectSidePanelPanes,
-  isPluginSidePanelTool,
   getFocusedSidePanelPane,
   getSidePanelNodeMinimumPixels,
   getSidePanelSplitResizeBounds,
@@ -61,10 +60,7 @@ import {
   type SidePanelSplitNode,
 } from '../../domain/sidePanelLayout';
 import { terminalLayerSidePanelStableCtxEqual } from './terminalLayerViewMemo';
-import { PersistentSidePanelPortal, SidePanelMountedContent } from './terminalLayerSidePanelSlots';
-import { usePluginTerminalSidebar } from '../../application/state/usePluginTerminalSidebar';
-import { PluginTerminalSidebarPageHost } from '../plugins/PluginTerminalSidebar';
-import { PluginContributionIcon } from '../plugins/PluginContributionIcon';
+import { SidePanelMountedContent } from './terminalLayerSidePanelSlots';
 import { getPaneMagnificationShortcutLabel } from '../../domain/paneMagnification';
 
 const MemoizedSidePanelMountedContent = memo(
@@ -362,7 +358,7 @@ function SidePanelSplitView({
   );
 }
 
-export function SidePanelLayoutTree({
+function SidePanelLayoutTree({
   node,
   layout,
   paneCount,
@@ -572,9 +568,6 @@ function hasMountedSidePanelContent(ctx: SidePanelContext): boolean {
     && Array.from((sidePanelOpenTabs as Map<string, SidePanelTab>).values()).includes('history');
   const anyNotesOpen = sidePanelOpenTabs instanceof Map
     && Array.from((sidePanelOpenTabs as Map<string, SidePanelTab>).values()).includes('notes');
-  const anyPluginOpen = ctx.sidePanelLayouts instanceof Map
-    && [...(ctx.sidePanelLayouts as Map<string, SidePanelLayout>).values()]
-      .some((layout) => collectSidePanelPanes(layout.root).some((pane) => isPluginSidePanelTool(pane.tool)));
 
   return !(
     browserMountedTabIds.length === 0
@@ -586,16 +579,10 @@ function hasMountedSidePanelContent(ctx: SidePanelContext): boolean {
     && themeMountedTabIds.length === 0
     && !anyHistoryOpen
     && !anyNotesOpen
-    && !anyPluginOpen
   );
 }
 
 function TerminalLayerSidePanelSectionInner({ ctx }: { ctx: SidePanelContext }) {
-  const pluginSidebar = usePluginTerminalSidebar({ layouts: ctx.sidePanelLayouts ?? new Map(),
-    getSession: ctx.getActiveTerminalSessionId ?? (() => null),
-    isTerminalTab: (tabId) => (ctx.sessions ?? []).some((session: { id: string }) => session.id === tabId) || !!ctx.workspaceById?.has(tabId),
-    select: (tool) => ctx.handleSwitchSidePanelTab?.(tool),
-    withdraw: (tabId, paneId, tool) => ctx.handleWithdrawPluginSidebarPane?.(tabId, paneId, tool) });
   if (!hasMountedSidePanelContent(ctx)) {
     // Keep AI scope maintenance alive even with zero mounted tool panels so
     // merge/dissolve handoff still runs when the user closed AI before the
@@ -617,7 +604,7 @@ function TerminalLayerSidePanelSectionInner({ ctx }: { ctx: SidePanelContext })
       </AISidePanelStateRoot>
     );
   }
-  return <TerminalLayerSidePanelInner ctx={ctx} pluginSidebar={pluginSidebar} />;
+  return <TerminalLayerSidePanelInner ctx={ctx} />;
 }
 
 /** Skip chrome rebuilds when only live/workspace-focus ticks change. */
@@ -627,7 +614,7 @@ export const TerminalLayerSidePanelSection = memo(
 );
 TerminalLayerSidePanelSection.displayName = 'TerminalLayerSidePanelSection';
 
-function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelContext; pluginSidebar: ReturnType<typeof usePluginTerminalSidebar> }) {
+function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
   const activeTabId = useActiveTabId();
   const sidePanelOpenTabs = ctx.sidePanelOpenTabs as Map<string, SidePanelTab>;
   const sidePanelLayouts = ctx.sidePanelLayouts as Map<string, SidePanelLayout>;
@@ -643,7 +630,6 @@ function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelCon
     handleOpenAI,
     handleOpenHistory,
     handleOpenNotes,
-    handleSwitchSidePanelTab,
     handleOpenBrowser,
     handleOpenScripts,
     handleOpenSystem,
@@ -1060,9 +1046,6 @@ function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelCon
     { id: 'system' as const, label: t('terminal.layer.system'), icon: <Activity size={15} />, onClick: handleOpenSystem },
     { id: 'notes' as const, label: t('terminal.layer.notes'), icon: <NotebookText size={15} />, onClick: handleOpenNotes },
     { id: 'ai' as const, label: t('terminal.layer.aiChat'), icon: <MessageSquare size={15} />, onClick: handleOpenAI },
-    ...pluginSidebar.pages.map((page) => ({ id: page.tool, label: `${page.title} · ${page.pluginName}`,
-      icon: <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} size={15} />,
-      onClick: () => handleSwitchSidePanelTab?.(page.tool) })),
   ], [
     handleOpenAI,
     handleOpenHistory,
@@ -1073,8 +1056,6 @@ function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelCon
     handleOpenTheme,
     handleToggleSftpFromBar,
     t,
-    handleSwitchSidePanelTab,
-    pluginSidebar.pages,
   ]);
   const sidePanelTabItemById = useMemo(
     () => new Map(sidePanelTabItems.map((item) => [item.id, item])),
@@ -1510,19 +1491,6 @@ function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelCon
             paneHosts={panePortalHosts}
             parkingHost={parkingHost}
           />
-          {activeTabId && pluginSidebar.sessionId && activeSidePanelPanes.map((pane) => {
-            const page = pluginSidebar.pages.find((item) => item.tool === pane.tool);
-            const target = panePortalHosts.get(pane.tool) ?? parkingHost;
-            if (!page || !target) return null;
-            const sessionId = pluginSidebar.sessionId!;
-            return <PersistentSidePanelPortal key={`${activeTabId}:${pane.id}:${sessionId}`} portalKey={`plugin-${pane.id}`} target={target}>
-              <PluginTerminalSidebarPageHost page={page} tabId={activeTabId} sessionId={sessionId}
-                focusOnReveal={activeSidePanelLayout?.focusedPaneId === pane.id}
-                adapter={pluginSidebar.contributions} getSession={ctx.getActiveTerminalSessionId}
-                unavailable={() => ctx.handleWithdrawPluginSidebarPane?.(activeTabId, pane.id, page.tool)}
-                focused={() => { if (activeTabStore.getActiveTabId() === activeTabId) ctx.handleFocusSidePanelPane?.(pane.id); }} />
-            </PersistentSidePanelPortal>;
-          })}
         </div>
       </div>
     </div>

components/terminalLayer/TerminalLayerTabBridge.test.ts

@@ -32,13 +32,6 @@ test('terminal layer bridge passes vault open callbacks into the side panel cont
   assert.match(source, /onOpenVaultSectionFromChat: s\.onOpenVaultSectionFromChat/);
 });
 
-test('production terminal layer context forwards extension sidebar owner and pane callbacks', () => {
-  const contextProjection = source.slice(source.indexOf('const ctx = useMemo('));
-  for (const callback of ['getActiveTerminalSessionId', 'handleSwitchSidePanelTab', 'handleWithdrawPluginSidebarPane']) {
-    assert.match(contextProjection, new RegExp(`${callback}: s\\.${callback}\\b`));
-  }
-});
-
 test('terminal layer bridge updates side panel live state after render', () => {
   assert.match(source, /const sidePanelLiveSnapshot = useMemo<SidePanelLiveSnapshot>/);
   assert.match(

components/terminalLayer/TerminalLayerTabBridge.tsx

@@ -489,9 +489,6 @@ export function TerminalLayerTabBridge({ stableRef }: { stableRef: StableRef })
     handleFontWeightResetForFocusedSession: themeState.handleFontWeightResetForFocusedSession,
     handleOpenAI: s.handleOpenAI,
     handleOpenNotes: s.handleOpenNotes,
-    getActiveTerminalSessionId: s.getActiveTerminalSessionId,
-    handleSwitchSidePanelTab: s.handleSwitchSidePanelTab,
-    handleWithdrawPluginSidebarPane: s.handleWithdrawPluginSidebarPane,
     handleOpenBrowser: s.handleOpenBrowser,
     handleOpenSystem: s.handleOpenSystem,
     handleOpenHistory: s.handleOpenHistory,

components/terminalLayer/TerminalLayerView.tsx

@@ -7,9 +7,8 @@ import { TerminalLayerWorkspaceSection } from './TerminalLayerWorkspaceSection';
 import { terminalLayerViewCtxEqual } from './terminalLayerViewMemo';
 import { useTerminalHostTreeLayoutWidth } from '../../application/state/terminalHostTreeStore';
 import { resolveTerminalLayerSurfaceStyle } from '../terminalPaneVisibility';
-import type { PluginSidebarHostActions } from '../../application/state/usePluginTerminalSidebar';
 
-type TerminalLayerViewContext = Record<string, any> & PluginSidebarHostActions;
+type TerminalLayerViewContext = Record<string, any>;
 
 function TerminalLayerViewInner({ ctx }: { ctx: TerminalLayerViewContext }) {
   const hostTreeLayoutWidth = useTerminalHostTreeLayoutWidth();

components/terminalLayer/terminalLayerSidePanelSlots.tsx

@@ -693,7 +693,7 @@ export function movePersistentPortalNode(
   }
 }
 
-export function PersistentSidePanelPortal({
+function PersistentSidePanelPortal({
   portalKey,
   target,
   children,

components/terminalLayer/terminalLayerViewMemo.ts

@@ -316,9 +316,6 @@ const SIDE_PANEL_STABLE_CTX_KEYS = [
   'handleOpenTheme',
   'handleOpenAI',
   'handleOpenNotes',
-  'getActiveTerminalSessionId',
-  'handleSwitchSidePanelTab',
-  'handleWithdrawPluginSidebarPane',
   'handleOpenBrowser',
   'handleBackFromNotes',
   'handleOpenHostFromNotes',

components/vault/VaultViewLayout.tsx

@@ -29,7 +29,6 @@ import { LazyLoadBoundary } from "../ui/lazy-load-boundary";
 import { toast } from "../ui/toast";
 import { AppWordmark } from "../AppWordmark";
 import { openHostBrowser } from "../../application/hostBrowser";
-import { PluginVaultNavigation, PluginVaultPage } from '../plugins/PluginVaultPages';
 
 type VaultViewLayoutContext = Record<string, any>;
 
@@ -157,7 +156,6 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
     ContextMenuTrigger,
     Copy,
     currentSection,
-    pluginVault,
     customGroups,
     deleteGroupPaths,
     deleteGroupWithHosts,
@@ -597,13 +595,12 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
           </div>
 
           <div
-            className={cn("min-h-0 flex-1 overflow-y-auto space-y-1", sidebarCollapsed ? "px-1.5" : "px-2.5")}
+            className={cn("space-y-1", sidebarCollapsed ? "px-1.5" : "px-2.5")}
           >
             <Tooltip>
               <TooltipTrigger asChild>
                 <RippleButton
                   variant={currentSection === "hosts" ? "secondary" : "ghost"}
-                  data-plugin-vault-fallback
                   className={cn(
                     "w-full h-10",
                     sidebarCollapsed
@@ -808,12 +805,11 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
                 </TooltipContent>
               )}
             </Tooltip>
-            {pluginVault && <PluginVaultNavigation model={pluginVault} collapsed={sidebarCollapsed} />}
           </div>
 
           <div
             className={cn(
-              "mt-auto shrink-0 pb-4 space-y-2",
+              "mt-auto pb-4 space-y-2",
               sidebarCollapsed ? "px-1.5" : "px-2.5",
             )}
           >
@@ -868,7 +864,6 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
             className="flex-1 min-w-0 flex flex-col min-h-0 relative"
             data-section="vault-main"
           >
-            {pluginVault?.selected && <PluginVaultPage key={pluginVault.selected.key} model={pluginVault} />}
             <VaultPageHeader
               className={cn(!isHostsSectionActive && "hidden")}
               dataSection="vault-hosts-header"

docs/plugin-platform/ai-context-wip.md

@@ -1,152 +0,0 @@
-# Plugin AI and selected context: implementation checkpoint
-
-Base: ThemePack #3978, `91b8927c56314e68c06e2c008e84559ddfb96d78`.
-Branch: `feat/plugin-ai-context`.
-Status: isolated host internals and fixture-tested transport reuse. Public contract,
-production adapters, installable example, independent review, and native acceptance
-are pending. This source is not ready to merge or release.
-
-## Proposed public boundaries
-
-The proposed optional features are `ai.model-invocation` and
-`context.selected-read`. The parent has not confirmed these names. No canonical
-schema, generated contract, SDK, runtime peer, hostService, or installer changes
-are included in this checkpoint.
-
-The model API uses a host-selected configured model. Plugins receive a chat
-handle, a display label, an expiry, turn handles, text chunks, and usage totals.
-Plugins do not supply provider IDs, URLs, credentials, tools, or Agent policies.
-The internal operations are `open`, `start`, `read`, `stop`, and `close`.
-`read` pulls one chunk with one pending read per turn. The parent can map this
-iterator onto the existing stream router after the canonical contract is agreed.
-
-Context summary enumeration returns only references explicitly shared with the
-current runtime and source owner. Content reads require an opaque handle and an
-expected version. Summary enumeration never calls the content reader. Supported
-selected scopes are workspace, tab, session, host, and Note. There is no inventory
-or arbitrary entity-ID lookup.
-
-## File ownership
-
-| Owner | Files or responsibility |
-| --- | --- |
-| This task | `electron/plugins/ai/`, `electron/plugins/context/`, `infrastructure/ai/plugin/`, `examples/plugins/assistant/`, this document |
-| This task | Opt-in `requireBridge` and `maxStreamBytes` request context in `infrastructure/ai/sdk/providers.ts` |
-| Parent coordination | Canonical schema, generated files, SDK, runtime forwarding, hostService registration, trusted renderer adapters |
-| Market task | Source identity, private data-owner namespace, installer database, marketplace UI |
-| Transport task | Generic TCP and TLS streams |
-| Logging task | Optional local plugin logs |
-
-The existing `feat/plugin-terminal-sharing` commit
-`3cdc97782ef3262969eee9d540e03ebe6fdee210` is preserved. Its
-`terminal-sharing-wip.md` describes incomplete selection publication and review.
-This branch does not claim that workflow is complete.
-
-## Implemented authority
-
-`ModelInvocationBroker` requires host-provided `resolveDataOwner` and
-`selectModel` adapters. It keeps chats and turns in memory. It stores no chat
-history and makes no database changes. Data owners are opaque host identities;
-no private storage is keyed by `pluginId`.
-
-Each handle is bound to a data owner, a runtime ID, and a plugin version.
-Every read rechecks runtime authority, the current model, handle lifetime, and
-selected context versions. Revocation aborts pending turns. Late provider results
-are discarded. Another source with the same plugin ID cannot read, cancel, or
-close the original source's handles.
-
-`SelectedContextAuthority.share` is a trusted host operation. A plugin must never
-call it directly. Its descriptor accepts only a scope, a title, a version, a text
-reader, and a current-selection guard. Unknown Host fields are rejected. Content
-has a 16 KiB cap, excludes NUL, and rejects PEM private keys. The production host
-reader must project safe fields explicitly and exclude passwords, private keys,
-TOTP values, identity credentials, startup commands, and environment variables.
-Free-form Notes can contain secrets that field projection cannot detect. The
-trusted sharing UI must preview the selected text before sharing it.
-
-`createPluginModelAdapter` calls the existing `createModelFromConfig` and
-`streamText`, through the existing host provider transport. Credential injection
-stays in Netcatty. Direct-fetch fallback is disabled for this adapter. Incoming
-SSE payloads have an aggregate 128 KiB cap before SDK buffering. SDK retries are
-disabled. Only text and allowlisted token totals reach the broker. Provider
-errors, raw chunks, reasoning, headers, and tool payloads do not cross it.
-
-No AgentRuntime, internal prompt, full MCP catalog, tool executor, Node runtime,
-raw host IPC, or global renderer store is exposed to plugins. A model tool request
-ends the turn without executing an action. Notes edits and terminal input are
-outside this checkpoint. No command is written to a terminal or followed by Enter.
-
-The default broker limits are defined in `MODEL_INVOCATION_LIMITS` and
-`SELECTED_CONTEXT_LIMITS`. They include concurrent handles, turn and chat lifetime,
-input and output bytes, output token caps, event count, requests per minute, and
-reserved tokens per minute. Input token reservation uses UTF-8 bytes plus 1,024
-bytes for framing and the output token cap. This is a conservative estimate, not
-a tokenizer or a monetary billing cap. Provider usage is reported separately.
-Reservations are not refunded after cancellation. Rate limits survive runtime
-restart within the broker's lifetime. Host shutdown clears this in-memory state.
-
-## Required host adapters
-
-Production integration is blocked on these parent-owned contracts:
-
-1. `resolveDataOwner(context)` must return the current private source owner from
-   host provenance. A plugin-supplied source value or plugin ID is insufficient.
-2. `selectModel(context)` must return a trusted invocation adapter for the model
-   explicitly selected in the main UI. No provider configuration crosses RPC.
-3. The renderer adapter must validate the current window, selected resource,
-   lifecycle generation, version, and owner before and after asynchronous reads.
-   Reconnect, tab or session close, navigation, lock, disable, and permission
-   revocation must invalidate handles and abort turns.
-4. Summary enumeration, content reads, and model invocation need separate
-   permissions. Only the canonical schema can define their wire format.
-   Model invocation permission does not grant context or action permissions.
-5. Host review must show selected content before it becomes model input.
-   A command-palette or menu ID is never resource authority.
-6. The shared hostService adapter must register teardown and permission-revoke
-   hooks, and discard results if its renderer owner changes.
-
-## QA evidence
-
-The domain suites and transport suite use synthetic data only. The transport
-suite starts a deterministic OpenAI-compatible HTTP server on loopback and
-checks this path:
-
-`ModelInvocationBroker` -> `createPluginModelAdapter` -> `createModelFromConfig`
--> `createBridgeFetchForSDK` -> existing `_streamRequestForTests` main transport
--> local fixture -> text and usage.
-
-This is not real model inference or paid API testing. It uses no paid keys, real
-Notes, hosts, or chat history. The credential value is a fixed synthetic marker;
-the existing model factory replaces it with its IPC placeholder. The test does
-not exercise native credential storage or production credential injection.
-
-The tests cover source, runtime, and version denial; separate summaries and
-content reads; context invalidation; provider cancellation and late results;
-deadlines; request, token, event, input, output, and stream-byte limits; and
-allowlisted response serialization. Raw provider diagnostics remain inside the
-host.
-
-Commands:
-
-```sh
-node --test electron/plugins/modelInvocation.test.cjs
-node --test --import tsx infrastructure/ai/plugin/modelInvocationAdapter.test.ts
-npx eslint infrastructure/ai/plugin/*.ts infrastructure/ai/sdk/providers.ts examples/plugins/assistant/panel.js
-```
-
-The final focused domain run passes 16 tests. The transport suite passes three
-tests, including the actual assistant panel's Send, streaming, usage, and Stop
-handlers in JSDOM. The test bridge uses structured clones to model the existing
-view command boundary. It does not replace installed-plugin or native coverage.
-The wider plugin runtime run passes 556 tests with one skipped. The existing
-provider regression suites pass 34 tests.
-
-The full repository typecheck fails in existing code, including provider tool-call
-inference and plugin CLI test manifest literals. No new adapter type errors were
-reported. The focused lint passes.
-
-Native Electron launch aborts because the bundled `chrome-sandbox` is not owned
-by root with mode 4755. No sandbox bypass was attempted. Native screenshots,
-video, installed-plugin UI tests, packaged builds, and independent review are
-pending on the parent's working desktop after shared integration. The panel
-source alone is not evidence of native acceptance.

docs/plugin-platform/byte-stream-acceptance.md

@@ -1,86 +0,0 @@
-# Byte stream acceptance evidence
-
-The integration retains #3978 `91b8927c56314e68c06e2c008e84559ddfb96d78`,
-source fixes through #3981 `4213d8e6726c44e7a479418ece3adf16ea494782`, and
-AI service checkpoint #3986 `264f1d983cd1ed83fe4873974a614fff2f47f989`.
-The transport delta does not edit the source database or sync implementation.
-Draft PR #3988 records the published review head. No merge or release is authorized.
-
-## Completed local checks
-
-The delegated environment uses Node 24.19.0 on Linux.
-
-- `npm run test:plugin-contract`: 90 passed, zero skipped.
-- `npm run test:plugin-runtime`: 604 passed, one native Electron test skipped.
-  Database-specific testing is now entirely in the example directory.
-- Final focused transport, source-isolation, installed entrypoint and disposable
-  database run before the test-file move: 32 passed, zero skipped. After the
-  move, the same installed database test passed again at its example path.
-- `NETCATTY_BYTE_STREAM_DATABASE_TEST=1 node --test examples/plugins/database-minimal/protocol.live.test.cjs`:
-  real MariaDB result and server-side INSERT denial passed through both the
-  core and the ordinary installed example entrypoint. No host ports, fixture
-  override, real hosts, or real credentials were used by this database test.
-  Its container, network, package and profile were removed.
-- `node --test examples/plugins/database-minimal/panel.test.cjs`: password
-  clearing before dispatch and safe text rendering passed.
-- Production `npm run build`, generated contract drift, changed-source lint,
-  and whitespace checks passed.
-
-Real broker TLS tests validate trust and the original requested hostname using
-a disposable fixture CA. Database traffic is plain TCP inside an internal
-Docker network. Neither check proves native BrowserWindow sandbox behavior,
-database TLS, device testing, or real model inference. The registered AI/context
-entrypoint test uses a synthetic trusted adapter, not the outstanding renderer
-wiring owned by the AI task.
-
-The EOF and last-await cancellation regressions each failed before their fix
-and passed after it with real loopback sockets. Source changes before grant
-publication, source changes during a pending read, and a stream returned after
-runtime release have separate passing regressions.
-
-## Reproducible native sample
-
-Run the preparation tool for `tcp://172.30.247.2:3306` as described in
-[`examples/plugins/database-minimal/README.md`](../../examples/plugins/database-minimal/README.md).
-Two separate staging directories produced the same five-file package:
-
-- Archive bytes: 11,621.
-- SHA256: `53b1aebae27d0681d0e93b8f7529f574cc2f176f3ca34eb2eabd1c35cdfb3deb`.
-- Content SHA256: `c83c6913f4ea40eae80d7042231b083be7d35b27022d6df24de9ce09022f0016`.
-- Delegated artifact: `/workspace/artifacts/plugin-byte-stream/database-minimal.ncpkg`.
-
-The artifact contains no credentials or server setup. Changing its approved
-fixture endpoint requires a newly prepared package and a recorded new hash.
-
-## Checks that did not pass locally
-
-`npm run pack:dir` first failed in the existing Cursor SDK preparation step
-because npm could not create `/home/agent/.npm/_cacache`. Retrying with npm and
-Electron build caches under `/workspace` passed that step, then failed while
-rebuilding `@serialport/bindings-cpp`: `@electron/rebuild` hard-codes the
-unwritable `/home/agent/.electron-gyp` directory. The native rebuild was not
-disabled, HOME was not changed, and no sandbox setting was weakened. Full app
-directory packaging remains failed locally and needs the normal CI or native
-QA build environment.
-
-The broad `npm test` run reported failures in existing transfer-resume,
-Markdown editor, SSH algorithm, SDK/CLI platform, terminal paste, and updater
-tests, then stalled without a final aggregate. Its owned process tree was
-terminated. It is not reported as a passing full test run.
-
-An independent source-baseline worktree at `4213d8e` ran five affected files in
-the same environment with shared dependencies: 145 tests, 118 passed,
-24 failed, three skipped. It reproduced failures in transfer-resume,
-Markdown editor, SSH algorithms, AI bridge resolution, and updater tests;
-updater errors include the unavailable `/home/agent/.netcatty/tmp/Netcatty`.
-This diagnoses that tested subset only. It does not classify every broad-suite
-failure, replace exact-head CI, or make any failed result successful.
-
-## Pending acceptance
-
-Exact published-head CI and independent review remain pending. The parent owns
-sequential native GUI acceptance for streams and the database example, then AI,
-then logging integration. The native recipe covers ordinary install/source and
-endpoint review, deny/retry/query, cancel/revoke/disable, restart with no saved
-password, audit inspection, screenshots, and a short recording. No native GUI
-run or screenshot/video result is claimed by this delegated executor.

docs/plugin-platform/byte-stream-checkpoint.md

@@ -1,111 +0,0 @@
-# Byte stream integration checkpoint
-
-The branch starts at #3978 `91b8927c56314e68c06e2c008e84559ddfb96d78`.
-It integrates source APIs from #3981 `4213d8e6726c44e7a479418ece3adf16ea494782`
-and AI service/adapters from #3986 `264f1d983cd1ed83fe4873974a614fff2f47f989`.
-No source database or sync implementation is changed by the transport delta.
-
-## Registered transport
-
-Canonical definitions are in `packages/plugin-contract/schema/plugin-contract.schema.json`.
-`network.byte-streams` negotiates the capability. The separate `network.stream`
-permission requires explicit `tcp://host:port` or `tls://host:port` resources.
-Wildcard declarations and grants cannot authorize raw streams. HTTP grants and
-payload limits are unchanged.
-
-The SDK exposes `context.network.connect({ endpoint }, cancellationToken?)`.
-The returned connection has `endpoint`, `readable`, `writable`, `close()`, and
-`dispose()`. The control methods are `network.stream.connect`,
-`network.stream.attach`, and `network.stream.close`. Descriptors, request
-shapes, feature names, limits, generated SDK types, and host validators share
-the canonical schema. Unknown request properties are rejected.
-
-The registered service authenticates the host runtime before source lookup.
-Runtime startup captures the existing opaque source owner. Every asynchronous
-commit revalidates the runtime, active and retained source, and opaque owner
-through the source task's APIs. Caller-supplied owner/source parameters are
-rejected. Audit commits also verify the source binding.
-
-Connection and stream IDs are host-issued and bound to that runtime and owner.
-The SDK prepares its incoming waiter before attach starts the host producer.
-Both directions reuse the existing binary stream router and credit windows.
-Input credit returns after the socket write callback. Output backpressure
-bounds the producer. The router has one optional producer `onClose` hook;
-peer cancellation releases the socket even while it is idle.
-
-The host validates all DNS answers and pins a literal IP. Production rejects
-loopback, link-local, unspecified, multicast, mapped local addresses, selected
-IPv6 tunnel forms, and the machine's own interface addresses. The production
-host constructor never forwards the core's explicit local-test override.
-There is no proxy discovery, reconnect, UDP, listen, generic IPC, shell, Node
-plugin runtime, or filesystem escape.
-
-Limits are four connections per runtime, 64 globally, 64 KiB chunks and socket
-buffer thresholds, and 8 MiB combined bytes per connection, plus the existing
-runtime byte quota. Connect, idle, and lifetime deadlines are 10, 30, and 120
-seconds. Close tombstones are capped at 256 small identity records. Revocation,
-runtime stop, disable, shutdown, and stream cancellation release resources.
-
-TLS requires trust and original-hostname validation with TLS 1.2 or later.
-Plugins cannot set custom CAs, SNI, or validation exceptions. STARTTLS is not
-implemented. Generic audit records contain endpoint, runtime, handle, and byte
-counts. The host does not inspect SQL or record payloads or credentials.
-
-## Additive AI interface for the parallel owner
-
-The same canonical schema defines the relayed `AI_CONTEXT_ROUTES` types.
-The SDK/runtime expose `context.ai.openChat/startTurn/readTurn/stopTurn/closeChat`
-and `context.selectedContext.list/read`. Host registration advertises
-`ai.model-invocation` and `context.selected-read`, and wires runtime cleanup,
-plugin disable, revocation through the service, and shutdown.
-
-The trusted host adapter constructor option is `pluginAIHostAdapter`. It has
-the service owner's `assertActive`, `selectModel`, `listSelected`, `reviewText`,
-and optional lifecycle callbacks. These callbacks are never exposed to plugin
-views. The default adapter rejects model invocation, returns no selected
-resources, and refuses text review. The AI owner still owns real renderer
-wiring and model/context UX. A registered synthetic adapter test is not proof
-of that remaining production wiring.
-
-## Database example
-
-`examples/plugins/database-minimal` is an ordinary browser plugin. Its developer
-preparation tool creates an `.ncpkg` for one exact disposable private IPv4
-endpoint. The output contains a browser bundle, a normal manifest, and view
-assets. The preparation tool and its Node dependencies are not in the plugin.
-
-Only the example contains the database protocol: common protocol 4.1,
-`mysql_native_password`, and
-`SELECT value FROM plugin_demo.example_result LIMIT 1`.
-The view accepts session-only fixture credentials and clears its password
-field before dispatch. It does not save view state, settings, logs, or secrets.
-The host never exposes SSH or AI credentials. JavaScript does not promise
-memory zeroization. The account's server-side SELECT grant enforces read-only
-access. The fixed query is not a SQL security classifier.
-
-The example has no query editor, schema browser, pool, arbitrary SQL, or host
-connection-management subsystem. See the example README for native setup.
-
-## Evidence and limits
-
-- Both source-reviewed races have executable real-loopback regressions here.
-  Delayed final-byte consumption previously lost EOF after the socket closed.
-  Double-microtask cancellation previously created an untracked late socket.
-  Each regression failed before its respective fix and passed afterward.
-- The broker tests use real TCP/TLS sockets, including trusted fixture CA,
-  untrusted certificate and wrong-hostname denial. Connect and idle deadline
-  cases use mock clocks around real sockets or delayed DNS.
-- The installed entrypoint test builds and installs a normal package, executes
-  its actual browser entry module through SDK/RPC/binary streams, and exercises
-  grant denial, exact resources, unknown-field rejection, close, revoke, and
-  disable. It also exercises registered AI/context SDK routes with a synthetic
-  trusted adapter. Its runtime harness is Node and is explicitly not a browser
-  sandbox or OS sandbox test.
-- The disposable MariaDB test checks a synthetic SELECT result and server-side
-  INSERT denial. It creates an internal network, publishes no host ports, and
-  removes the container and network. Database transport is plain TCP inside
-  that disposable network, not database TLS.
-
-See `byte-stream-acceptance.md` for the current checks, local packaging blocker,
-sample hash, and remaining native/exact-head review work. Do not disable the
-Chromium sandbox to obtain that evidence.

docs/plugin-platform/capability-coverage.md

@@ -1,166 +0,0 @@
-# Sandbox capability coverage
-
-This matrix tracks expansion from Draft #3951 at
-`e5bd294cddbf58dfe04c646b6291933d980498fd`. Each accepted item requires a
-canonical schema, generated SDK, broker, permission policy, quota and audit,
-host adapter, lifecycle cleanup, synthetic boundary tests, review, and exact-SHA
-CI. Enumeration in a manifest is not a working API. Status `planned` does not
-mean complete. Existing APIs remain available.
-
-## Coverage matrix
-
-| Subsystem | Working API at baseline | Enumeration or missing adapter | Accepted bounded entry | Data and action risk | Authorization resource | Revocation, audit, quota | Verification and disposition |
-| --- | --- | --- | --- | --- | --- | --- | --- |
-| Authorization management | Engine `listGrants`, `revokeAll`, database audit | Manager shows declarations only | Host-only grant list, bounded audit summary, disable and revoke | Paths, session IDs, grant metadata are sensitive | Exact plugin ID, trusted app sender | Serialized manager mutation, disable before revoke, runtime teardown, retained audit | Batch 1 limited acceptance complete on ff3734d: independent review fixes, host/manager/UI tests, exact test/packaging CI, parent native own-views Application grant/revoke/disable/runtime-stop check. Visible view was manually closed beforehand. No plugin RPC for managing grants |
-| Network and credential leases | `network.request`, `credentials.createLease`, single-use host redemption | SDK request omits lease and authorization fields | Canonical request types matching broker | Network mutation and credentials | Exact origin plus secret reference and operation | Existing timeout, redirects, byte quotas, runtime checks, lease TTL | Batch 1 contract/SDK consistency complete: canonical types, synthetic fixture/lease tests, feature discovery and exact CI. No live network or credential acceptance claimed. No plaintext secret API |
-| Commands, menus, toolbar, status bar, views | `commands.execute`, settings, context keys, view state and messages, UI contributions | No editor or SFTP menu slots | Existing contribution system | Plugin text and arguments may be sensitive | Namespaced contributions and permissions | Existing lifecycle, rate and message limits | Existing tests. New context menu slots planned with bounded context DTOs |
-| Terminal providers | Decorations, links, completion, snapshots through provider requests | Session change delivery follows prior provider request and non-once grant | Preserve providers. Standalone selected-session watch planned | Hostnames, session state, endpoint identity | Host-selected session, runtime identity | Session-close and revoke cleanup, bounded event rate | Existing provider tests. Ordinary views cannot independently subscribe today |
-| Current context and host picker | Host context keys are boolean state | `vault.metadata` enumeration is not generic SDK | Selected host/session DTO from an explicit whitelist | Labels and endpoint metadata are sensitive | Host-owned user-action context, selected host/session | TTL, runtime and session invalidation, redacted audit | Planned. Never reuse agent `sanitizeHostForAgent` as plugin DTO |
-| Terminal selection and input draft | Provider-supplied snapshots, completion suggestions | No explicit selection-share or draft API | User shares selection, plugin proposes a visible editable draft | Terminal plaintext, accidental execution | Host action token plus exact live session/endpoint | Single-use token, size cap, no plaintext audit, active identity before commit | Planned. Reject Enter/control characters for draft insertion. No full history or direct shell |
-| Native interactions and clipboard | Native permission dialogs; new browser SDK host choice/input and explicit copy/share workflow | Progress/toast remain unimplemented | Host-owned prompts, two-phase clipboard snapshot/share, exact copy preview | Clipboard and input may contain secrets; UI discloses granted network capability; prompt spam | `ui.interact`, clipboard direction, host-signed window/runtime/version/phase/TTL action | Admission before permission prompt, byte/rate/concurrency limits, lock/blur/close/revoke cleanup, active guard, content-free audit | [Host interaction slice](./host-interactions.md) implemented and synthetic-tested. 8e4dd0c exact test/packaging CI and independent delta review passed. Parent native compose and explicit Preview/Share/copy succeeded; a separately approved 0.1.1 compose ran about 86 seconds, beyond the old 30-second deadline and within the declared 180-second budget, with no fresh command-timeout error. All five permissions were Once; cleanup is parent-owned. New navigation slices retain separate acceptance gates. Progress/toast still planned. No background reads or trusted plugin `userGesture` boolean |
-| Local filesystem | Read file, stat, overwrite existing regular file | Directory listing lacks same-handle native adapter | Keep current boundary, evaluate file picker handles | Arbitrary local file content and writes | Canonical exact path or selected file handle | Inode checks, no symlink alias, bounded bytes, active runtime | Existing filesystem tests. Directory enumeration and new arbitrary-path creation deferred until portable safe native adapter exists |
-| SFTP and remote files | No generic plugin API | `sftp.read` and `sftp.write` enumerated only | Host-selected session/path/mode/TTL handles, read and explicit save/upload | Remote secrets and destructive overwrite | Live endpoint identity, exact path, read/write split | Cancel streams, byte quota, overwrite confirmation, close/revoke cleanup | Batch 2 planned. Never forward arbitrary MCP catalog or session ID alone |
-| Editor and Notes | No plugin document API | No versioned snapshot or edit preview | Explicit snapshot and versioned proposed edit | Document secrets, lost updates, executable files | Selected document plus revision and action token | Version conflict check, preview, bounded bytes, revocation | Planned evaluation after shared action context. No unattended edits |
-| Snippets and scripts | Provider import drafts only | No generic read/run API | Explicit selection and create draft | Script contents may contain secrets. Running executes commands | Selected item, read versus draft write | Preview, byte cap, no automatic execution | Planned evaluation. Script `run` and onConnect modification deferred |
-| Connections and authentication | Connection/authentication providers, opaque credentials, streams | Generic host open/connect absent | Existing providers remain | Connect can execute saved onConnect scripts | Provider operation plus live endpoint and credential lease | Existing provider lifecycle, streams and quotas | Existing tests. Generic connect is a write/execution capability, deferred pending explicit execution design |
-| Sync and storage | Local namespaced KV, encrypted-object sync providers, opt-in setting sidecars | No general KV cloud sync | Existing opt-in provider protocol | Conflicts, deletes, credential access | Provider/account/object, settings scope | Existing limits and lifecycle, non-cascade metadata | Existing sync tests. General KV sync deferred until conflict/delete/quota/migration policy is defined |
-| Vault and keychain | Credential references and import preview/commit | Metadata/write enums do not grant a generic Vault SDK | Only user-selected whitelist DTOs and drafts | Notes, environmentVariables, startupCommand, keys and credentials | Selected object plus field/direction | Explicit preview, identity checks, redacted audit | Full Vault export and secret reads deferred indefinitely. No agent field-exclusion DTO reuse |
-| System manager and Docker | No plugin system API | Agent/MCP adapters are separate authority | Typed read-only summaries excluding args/env/inspect | Process command lines and Docker inspect can expose secrets | Selected live session and summary kind | Bounded result, endpoint identity, cancellation | Planned evaluation. Arbitrary process/inspect forwarding deferred |
-| Port forwarding | No generic plugin API | Existing agent start is write-sensitive | Selected rule status and open host form | Rule endpoints and local exposure | Selected rule plus host action | Bounded DTO, session close and revoke | Planned evaluation. Direct start deferred until binding/listener approval design |
-| Themes, settings, appearance, i18n | Terminal theme/background Providers, isolated view CSS, scoped settings and environment updates | No host global theme contribution. Personal customCSS is not plugin authority | Accepted ThemePack stage: static palette registry, selector, local preview, revision-safe apply/cancel/reset, terminal linkage | Unreadable palettes and misleading security UI. Nineteen UiThemeTokens fields are not independent: accent derives primary/ring/foregrounds | User explicitly selects a theme; static contribution enablement separate from code permissions | Immutable version/hash, bounded JSON, contrast/security-surface gates, preview owner/revision and safe fallback | First host color layer implemented; [contract/lifecycle/evidence](./theme-packs.md). Exact-SHA CI, independent review and native acceptance pending. Static terminal linkage not yet accepted; no arbitrary DOM/CSS, remote assets, layout replacement or security UI customization |
-| Transfer center | Host transfer queue exists, no plugin entry | No ownership-bound task API | Observe and cancel only plugin-created tasks | Paths and host endpoints reveal user data. Cancel may leave partial files | Own transfer handle plus source/destination authority | Shared backpressure, cancel/close cleanup, honest partial status | Planned with batch 2. Do not broadcast or cancel other tasks |
-| AI, MCP, automation | Host agent catalog and harness exist separately | No generic plugin AI or tool forwarding | Selection-to-proposal workflow through the same controlled primitives | Content disclosure, account authority and model cost | Explicit content sharing plus service origin/budget | No inherited history, tools, account, or hidden cron | Controlled workflow planned. Generic host AI and visible schedules deferred to distinct product decision |
-| Known hosts, app lock and global security | Host security management UI | No plugin management API | Future allowlisted security-page navigation | Host-key trust, unlock, keys and security policy affect all sessions | Host navigation action only | No mutation or sensitive DTO | Security policy mutation, private-key reads, auto-trust and unlocking deferred indefinitely |
-| Plugin blob/cache | Local KV exists | No exclusive blob cache | Evaluate bounded plugin-owned cache when a real workflow needs it | Disk growth and lifecycle ambiguity | Plugin namespace, no arbitrary path | Size quota, eviction and uninstall policy required | Deferred until a concrete larger-than-KV workflow establishes value and retention policy |
-| Vault and terminal navigation | `tab` mounts a sandbox page through TopTabs/QuickSwitcher; aside/panel are overlays | No Vault subpage registry or terminal side-panel plugin tool. `settings` is a detail entry, not a new settings category | Accepted independent slice: host-owned namespaced Vault pages in an Extensions group, mounted in the Vault content area through existing ViewHost; then terminal pane/split pages for the selected session | Navigation cannot disclose session contents or replace built-in/security navigation | Declared page contribution plus host selection. Content reads have independent permissions | Host order/when/focus, cancellation of late open, view cleanup on hide/update/disable/uninstall, safe invalid-link fallback | [Vault page slice](./vault-pages.md) implemented and synthetic-tested: actual Vault content slot, private Scratchpad, catalog withdrawal, host occlusion, reserved-open cancellation, owner/crash/lock cleanup. Exact CI/independent/native acceptance pending. [Terminal sidebar slice](./terminal-sidebar.md) also implemented with actual pane/split mounting, owner focus and session-change cleanup; no automatic session data. Exact CI/independent/native acceptance pending for the new stack. No arbitrary router/DOM API |
-| Distribution and runtimes | Browser-only public catalog, immutable packages, advanced developer gate | Signing/trust and release remain separate phase | Retain existing boundary | Package execution and publisher trust | Pinned catalog selection, hash, engine/features | Existing install transaction, quarantine and cleanup | No merge/release. Do not extend to arbitrary Node, IPC, shell, or global capabilities |
-
-## Delivery order and stopping rule
-
-1. Batch 1: actual authorization management plus network contract consistency.
-   Keep the existing manager layout. Add one independent permission panel.
-2. Batch 1b: the host text interaction slice, then selected context and terminal
-   sharing/drafts. A plugin-supplied gesture is never authority.
-3. A separate navigation slice mounts actual Vault extension pages, then terminal
-   sidebar panes, reusing the isolated ViewHost and keeping content permissions separate.
-4. Deliver the declarative ThemePack stage with security appearance and contrast gates.
-5. Batch 2: SFTP selected-file handles and explicit transfer destinations.
-6. Reassess editor, Notes, snippets, menus, system summaries, and port forwarding
-   using the tested host-action and resource primitives.
-
-Stop only when every row is implemented and tested, reasonably deferred with a
-specific boundary and rationale, or awaiting a concrete user decision. A
-planned row remains unfinished. Native screenshots and recordings belong to
-the parent thread. Real credentials, hosts, or transfers require approval for a
-specific target there. Synthetic checks do not establish native acceptance.
-
-## Batch 1 evidence and next workflow
-
-The independent permission panel adds only an import and a detail mount to
-`components/settings/tabs/PluginPackageManager.tsx`. It uses the manager hook's
-new `refresh()` after host revocation. Marketplace layout remains owned by the
-parallel UI layer. Five locale files contain the panel strings.
-
-The next usable workflow is a browser plugin that asks a host quick-pick/input
-question, then explicitly copies its result or asks the user to share clipboard
-text. The host displays the plugin source and action before reading or writing.
-A canonical `HostInteractionRequest` and bounded result carry only text/choice
-IDs. The host owns request IDs, requester webContents, runtime/version, TTL,
-cancellation, and the consent result. The renderer cannot reply for another
-window. Plugin `userGesture` values are ignored. Runtime/revoke shutdown aborts
-all outstanding prompts and ignores late replies. A shared prompt primitive
-then supports selected host/session context, selection share, and input drafts.
-
-Before proceeding to the sensitive context/terminal and SFTP entries, the
-native path must prove consent, cancellation, quota, and identity binding with
-synthetic data. UI screenshots and real-resource approval remain parent-owned.
-
-Baseline code references: `electron/plugins/hostService.cjs`,
-`secureCapabilities.cjs`, `permissionEngine.cjs`, `terminalProviderService.cjs`,
-`filesystemBroker.cjs`, `extensionProviderService.cjs`,
-`packages/plugin-sdk/src/index.ts`, and
-`packages/plugin-contract/schema/plugin-contract.schema.json`. Host business
-implementations under `electron/capabilities/catalog/` are reference material,
-not plugin authority. `infrastructure/ai/vaultAgentBridgeClient.ts` is not a
-plugin DTO sanitizer.
-
-## Navigation slice checkpoint
-
-The Vault stage adds `views.vault-pages`, the `vault-page` location, and the
-existing `views` permission. It grants no Vault/session data. The ordinary
-browser Scratchpad example uses only its own bounded view-state API and
-explicit user input. It is not a Notes API or automatic sync feature.
-
-The independent integration base includes #3956 UI polish and #3960 d4ca fixes;
-frozen evidence heads and prior PR bases are unchanged. Related UI changes in
-this stage are limited to VaultView/VaultViewLayout, new independent plugin
-components/hooks, and localized strings. PluginMarketplace/PluginPackageManager
-layouts are not rewritten. Native acceptance belongs to the parent with a new
-fixture-specific own-views approval. Sidebar, ThemePack, selected context and
-SFTP remain unfinished; this checkpoint is not overall completion.
-
-## Terminal sidebar checkpoint
-
-`views.terminal-sidebar` exposes one more existing sandbox view placement,
-using only the existing own-views permission. The host owns navigation,
-selection, split/close and focus. Its context is a surface string only; no
-terminal DTO or resource authority is implied. The Session Scratchpad fixture
-uses explicitly typed synthetic text and its own view state.
-
-This stage builds on ordinary merges containing #3960 8e4dd0c and the #3971
-stale-layout callback fix. Prior QA heads and PR bases are not rewritten. The
-ThemePack implementation, selected-context/drafts and file handles remain
-unfinished; parent review/native gates still apply to each delivered head.
-
-## Color-pack and remaining workflow checkpoint
-
-The first [ThemePack color layer](./theme-packs.md) now has an implemented host
-catalog, data-only admission, Appearance selector, local preview, revision-safe
-application/reset, missing-version fallback and host security palette boundary.
-It is not native-accepted until the new exact head is independently reviewed,
-built by CI and exercised through normal Settings. Terminal palette linkage is
-not accepted by this contract yet, so a declared but ignored linkage cannot be
-counted as coverage. Font/density/icon/background packs remain separate product
-and accessibility decisions, rather than arbitrary CSS permissions.
-
-Parent native evidence for sidebar `a8adeb86` now covers the original Local
-Terminal blocker, own-views Once, save, magnify/restore, a split with empty Notes,
-and side/bottom docking. `733f44c` adds only the production bridge projection
-regression. The older `0c097a1` CI run `40308057623` remains **failed and
-unattributed**: 9447 top-level TAP results are `ok`, the aggregate footer is
-missing and the process exits 1. A newer passing run does not change that record.
-The native Vault success retains its original `0c097a1` evidence label.
-
-The next implementation stages are bounded by useful workflows:
-
-1. **Selected terminal sharing and drafts (A).** Reuse host-signed action
-   contexts for an explicit selection preview/share, then let the plugin submit
-   a bounded input draft to the host compose surface. No Enter, raw PTY, history
-   enumeration or background terminal listener. First add a host-selected
-   session handle with a minimal from-scratch DTO and independent lifecycle
-   watch; navigation alone grants no content. Bind handles to actual session and
-   connection identity, runtime/version, owner, mode and TTL. Cover cancel,
-   reconnect, close, revoke and late draft results with synthetic terminals.
-2. **Selected file conversion/transfer (A).** The host picker issues read or
-   explicit-destination write handles. Start with one file, stat/read and saveAs
-   or upload, not recursive traversal or arbitrary paths. Require destination
-   preview/overwrite confirmation, byte/concurrency limits, cancellation,
-   session/endpoint identity and final active checks. Observe/cancel only the
-   plugin's own transfer. Real native SFTP targets require parent-coordinated
-   concrete approval; local tests use isolated fixtures.
-3. **Versioned document proposals (selected B).** Reuse snapshot/handle and host
-   review primitives for one explicitly shared editor document or Note. Apply
-   only an expected-version patch to its buffer after a visible diff; saving a
-   remote file remains a separate file operation. Reuse the draft path for a
-   selected snippet or new snippet template; do not run scripts or add onConnect
-   bindings. Cover edits after snapshot, detached ownership, closure and revoke.
-4. **Final reassessment.** Recheck the matrix by actual workflow and eight gates.
-   Read-only system aggregates, selected port-rule status and bounded navigation
-   may be added only where the shared primitives leave a concrete useful gap.
-   Full process arguments/env/inspect, tunnel start, arbitrary AI/MCP tools,
-   background jobs, general KV sync and raw high-privilege access remain deferred
-   or retained boundaries. Do not invent new C work to prolong the task.
-
-These stages remain unfinished work, not API-name coverage. Exact schemas and
-ordering will follow the existing brokers/adapters rather than a parallel RPC
-stack or one namespace per product module.

docs/plugin-platform/community-catalog.md

@@ -1,106 +0,0 @@
-# Curated plugin catalog
-
-The catalog lives in `electron/plugins/catalog.json` in this repository. There
-is no new marketplace account service or external directory repository. It is
-shipped with the app; catalog changes become available with an app update.
-Normal Settings exposes browser-only management and catalog browsing. Advanced
-local packages require `NETCATTY_PLUGIN_DEV=1`; that flag never grants permissions.
-Native acceptance and security/distribution review remain required before merge.
-
-## Submit or update a plugin
-
-Open a PR changing one entry. Provide:
-
-- Stable reverse-domain plugin ID, author, name and short description.
-- Public GitHub source repository and explicit license matching the package.
-- Exact version, full 40-character source commit and relative README `.md` path.
-- The complete validated manifest: engine/API ranges, required/optional permissions,
-  bounded resources, features and data/sync declarations must match package bytes.
-- Optional published artifact URL and SHA-256. No artifact means a source-only
-  example: the UI does not offer installation. Do not invent an artifact URL.
-- A concise change log, permission diff, supported OS test results, and synthetic
-  reproduction instructions. Current public runtime eligibility is browser-only
-  on the host platforms; native/platform-specific companions are excluded.
-
-Use the local CLI from the repository root:
-
-```sh
-npm ci
-npm run build:plugin-packages
-node packages/plugin-cli/dist/cli.js validate examples/plugins/hello-netcatty
-node packages/plugin-cli/dist/cli.js pack examples/plugins/hello-netcatty --out /tmp/hello-netcatty.ncpkg
-node packages/plugin-cli/dist/cli.js validate /tmp/hello-netcatty.ncpkg
-```
-
-The catalog contains first-party source examples: Plugin Starter for minimal
-settings/command use, and Hello Netcatty for terminal provider demonstrations.
-No downloadable release is fabricated or published by this change. A maintainer
-must verify real artifact provenance before adding the artifact object.
-
-## Enforced install boundary
-
-The renderer sends only a catalog ID. The main process selects the shipped
-entry, downloads over HTTPS from approved GitHub hosts with bounded size/time
-and redirects, checks SHA-256, and hands a private file to the same serialized
-PluginManager and PackageStore used for local imports. The immutable staged
-snapshot is hashed again before any version switch. Its exact ID/version,
-license and full manifest must match the catalog. Unknown permissions fail
-canonical schema validation. Browser-only eligibility rejects Node entrypoints,
-companions, raw terminal interceptors and advanced runtime declarations.
-
-The directory is a curated integrity assertion, not a publisher signature.
-Unsigned runtime grants remain bound to package digest. No latest fallback and
-no background code updates exist. Installing an update stops the old version;
-the new version remains disabled until reviewed and explicitly enabled. Required
-permissions are mediated again by the existing runtime permission engine.
-Local advanced development packages require the developer flag and use the existing permission model;
-this does not grant advanced privileges or make Node a sandbox.
-
-README is fetched only from the selected commit, on opening details. Redirects
-are refused and responses are limited to 256 KiB. Rendering constructs a small
-allowlist of React elements from Markdown; HTML remains escaped text and images
-are not fetched. Only explicit HTTPS links can be opened. README content is
-untrusted author documentation; permissions come from the manifest.
-
-## Review and maintenance
-
-CI now runs canonical plugin contract drift checks and the runtime suite,
-including catalog validation and install-boundary regression tests.
-Run `node --test electron/plugins/catalogService.test.cjs` and the plugin
-contract/runtime tests for every entry change. Review actual package/source
-provenance and permission/resource differences manually on first submission and
-sensitive updates. Packaging validation includes traversal/integrity checks but
-is not a malware audit. Human review is mandatory before adding an artifact;
-there is no automated acceptance bot in this slice.
-
-Authors maintain their plugins, document data handling and respond to security
-reports. Maintainers may remove entries or decline updates. Directory checks
-are limited checks, not a safety certification, legal waiver or a promise to
-repair third-party plugins. No third-party terms are copied here.
-
-## Data and lifecycle
-
-Local KV is per-plugin and does not sync. Only explicitly syncable non-secret
-settings enter encrypted sidecars; machine paths, grants, packages, runtime
-state and secrets do not become cloud authority. Existing sidecar conflict and
-account isolation mechanisms are reused. A generic KV sync API remains a separate
-schema/migration decision.
-
-Incompatible host/API/features disable plugins before lazy contributions are
-published, retain package/data and record a reason. A compatible downgrade never
-automatically re-enables them. Disable stops runtime and contributions; uninstall
-removes package code and local KV, while user-owned settings/secrets/sidecars
-remain. Existing crash quarantine and generation-bound cancellation apply.
-
-Missing OS-backed key storage blocks secrets/credentials, without blocking
-catalog browsing or non-secret plugins. The Settings manager reports this state;
-never switch to plaintext storage or disable Chromium sandboxing for a demo.
-
-## When permission prompts appear
-
-Enabled is an availability switch, not a security review or a grant. A lazy
-plugin can become enabled without starting code. Its first command/provider use
-starts the runtime; required permissions are authorized at that activation
-boundary. Optional permissions are requested when a broker operation needs them.
-Missing/denied decisions fail closed. Never interpret an Enabled badge as proof
-that terminal, credential, network or filesystem access has been approved.

docs/plugin-platform/contract-and-sdk.md

@@ -1,6 +1,6 @@
 # Netcatty plugin contract and SDK
 
-Status: internal preview (`0.1.0-internal.1`; legacy `0.1.0-internal` remains offered)
+Status: internal preview (`0.1.0-internal`)
 Tracking issue: [#2269](https://github.com/binaricat/Netcatty/issues/2269)
 
 Phases 2 and 3 consume this contract in the isolated host runtime and secure
@@ -615,28 +615,3 @@ npm run build:plugin-packages
 
 The complete application checks remain mandatory because workspace and root
 dependency changes affect installation and release builds.
-
-
-## Plugin brand icons (internal revision 0.1.0-internal.1)
-
-Optional top-level `icon` reuses `IconReference` from contributions. A package
-using it must require `metadata.brand-icon` and an API range accepting
-`0.1.0-internal.1` but excluding `0.1.0-internal`. See
-[the author guide](plugin-icons.md) for bounds and packaging commands.
-
-The host still offers the previous wire revision to plugins with no top-level
-icon whose range matches only that revision. Compatibility selection returns the
-negotiated API version and runtime initialization uses and verifies that exact
-version. Host version bounds remain independently enforced; unknown required
-features still fail closed. No old manifest is rewritten and no permission grant
-is migrated by this revision.
-
-## Declarative host color contributions
-
-`appearance.theme-packs` adds `contributes.themes` and generated palette/reference
-schemas. A pure package uses `main: { "data": "theme" }`, contributes only themes
-and omits permissions/activation/companions. It has no executable runtime. Normal
-admission accepts this data-only form alongside browser-only code packages; Node
-and arbitrary IPC remain advanced/unsupported public boundaries. Selection is a
-trusted host Appearance action, not an SDK setter or `appearance.write` grant.
-See [Theme packs](./theme-packs.md) for limits, preview, persistence and fallback.

docs/plugin-platform/host-interactions.md

@@ -1,130 +0,0 @@
-# Host text interactions
-
-Status: internal preview. This layer builds on the grant management in Draft
-#3955. It adds `host.interactions` feature discovery, a generated request/result
-contract, and an ordinary browser SDK workflow. Native acceptance remains a
-separate parent-owned gate.
-
-## SDK and authorization
-
-| SDK call | Permission | Result |
-| --- | --- | --- |
-| `ui.quickPick(title, items)` | `ui.interact` | Approved item ID or `undefined` on cancel |
-| `ui.input(title, initialValue?)` | `ui.interact` | Approved single-line text or `undefined` on cancel |
-| `clipboard.readText(title)` | `clipboard.read` | Explicitly shared snapshot or `undefined` on cancel |
-| `clipboard.writeText(text, title)` | `clipboard.write` | `true` after copy, `false` on cancel |
-
-`ui.input` rejects CR and LF in initial values before any dialog is displayed,
-and rejects line breaks on submission. It does not silently remove hidden
-newlines. The displayed single-line value is the value submitted to the plugin.
-Clipboard text continues to support multiple lines.
-
-All calls use the canonical `ui.interact` RPC. No host DOM, native object,
-router, general command ID, or arbitrary IPC channel enters the SDK. Existing
-API versions remain offered. A plugin requiring the new workflow declares
-`features.required: ["host.interactions"]`; old hosts reject unsupported
-required features. Old plugins keep their existing APIs and permissions.
-
-Clipboard prompts restrict new permission decisions to once. Required or
-previously saved grants never skip the host action confirmation. Input and
-choice dialogs need their own declaration; a `views` or `menus` declaration is
-not permission to open them. Direction-specific clipboard permissions remain
-separate. The normal sample uses no network, host/session, filesystem, secret,
-Node, or shell capability.
-
-## User action and text sharing
-
-The host always displays plugin ID/version and a fixed source heading. Titles,
-choices, and text render as plain text. No plugin-supplied `userGesture` flag is
-accepted. The host creates an HMAC action token bound to request ID, runtime,
-plugin version, owner window, action kind, phase, nonce, and expiry. It sends
-that token only to the trusted host renderer. A response must come from the
-same WebContents and present the current token. Tokens are consumed before the
-first asynchronous action guard, so old-phase and duplicate responses cannot
-commit an action.
-
-Clipboard reading has two steps. **Preview clipboard** authorizes a host read
-into a bounded in-memory snapshot. The plugin receives nothing yet. **Share
-with plugin** sends exactly that snapshot after another active-identity check.
-Changes to the system clipboard after preview do not replace it. Cancel, lock,
-window loss, or revoke discards the snapshot. Copy shows the exact replacement
-text and requires its own confirmation before a native write.
-
-Shared text can be sensitive. The host explains that it becomes available to
-the plugin and its granted capabilities, including network access. Reading
-text does not approve a new network destination. This UI does not claim to
-prevent a plugin from transmitting derived text through an already granted
-capability. The example avoids network permission entirely.
-
-## Availability, limits, and cleanup
-
-The first slice supports the focused, visible, unlocked main window only.
-The host renderer registers readiness before any prompt can be presented.
-Other or unready windows return unavailable instead of inheriting an owner's
-authority. One interaction occupies an owner window at a time; there is no
-hidden prompt queue.
-
-`HostInteractionLimits` is the shared canonical source for 4,096 UTF-8 text
-bytes, 100 choices, 64 KiB serialized requests, one pending request per runtime,
-eight total, ten attempts per minute per runtime, and a 60-second lifetime.
-The current main-window-only adapter is narrower than the total pending bound.
-Admission runs before the permission prompt. The generic capability quotas and
-byte windows still apply. Text exceeding its cap is rejected without silent
-truncation. RPC uses the same generated deadline.
-
-After a native permission decision, an originally foreground request can wait
-at most one second for the same owner to regain focus. The host never focuses
-the window itself, presents content in the background, or postpones admission
-for an originally background request. Hide, lock, revoke, runtime stop, owner
-replacement and reload invalidate this admission, even during the permission
-dialog. Runtime activity and foreground state are checked again after waiting.
-
-Input cancellation, timeout, disable/update/crash/revoke, owner blur/hide/close,
-main-document reload, renderer exit, and app lock invalidate pending tokens.
-Same-document or subframe navigation does not permanently unregister a live
-host UI. Runtime teardown clears rate accounting. The broker checks runtime
-activity, owner readiness/focus, and app lock again immediately before native
-read/write or disclosure. A revoked operation cannot resume from a late reply.
-
-Commands normally retain the existing 30-second RPC deadline. A command that
-declares `interactive: true` must require `commands.interactive`; the host gives
-only that command a fixed 180-second total budget. This is not a global timeout
-increase or a UI/clipboard permission. Each individual host interaction still
-has its own 60-second deadline, including permission approval time.
-
-When an outer command fails, times out or is cancelled, the host cancels pending
-interactions and pre-prompt admissions for its captured runtime. On successful
-completion it closes orphan interactions once the last concurrent command ends.
-This cleanup does not reset rate/byte quotas and cannot affect a replacement
-runtime. A failure conservatively closes that runtime's single shared pending
-dialog even if another command is active. Late action tokens cannot commit a
-clipboard effect. Cancellation does not forcibly terminate arbitrary plugin
-JavaScript; ignored errors remain subject to permission, focus, rate and runtime
-limits. Do not start independent interactive workflows concurrently.
-
-Audit records contain only fixed event/action/kind fields. They contain no
-prompt, choices, user text, clipboard bytes, action tokens, or hashes derived
-from those values. A failed consent-audit write prevents the native action;
-no successful operation is reported for that failure.
-
-## Verification and native acceptance
-
-The [browser fixture](../../examples/plugins/host-interactions/README.md)
-exercises choice, input, copy, and clipboard transformation without a plugin
-view. Tests cover the actual runtime/SDK RPC path through permission middleware,
-actual host React dialog events against service-signed actions, denial, cancel,
-quota before prompt, overlong text, duplicate/forged actions, wrong owners,
-stale runtime, revoke during an asynchronous guard, audit failure, deadline,
-lock, blur, document navigation, and renderer teardown.
-
-Parent native acceptance uses a separately approved temporary example-plugin
-session and synthetic clipboard text. It needs no real hosts, credentials,
-network destination, shell, or persistent grant. Check both complete workflows,
-cancel before reading, cancel after preview, cancel copy, and disable/revoke
-with a pending dialog. Record the exact SHA and restore the test clipboard.
-Unit tests are not evidence of native Electron acceptance.
-
-Progress/toast, selected context and terminal sharing/drafts remain later slices.
-Navigation uses the existing sandbox ViewHost and adds no content permission.
-ThemePack and SFTP remain separate stages. This layer alone does not finish the
-capability coverage matrix.

docs/plugin-platform/isolated-runtime.md

@@ -300,8 +300,3 @@ installs plugins but fails to start them outside the repository checkout.
 separate `npm run test:plugin-runtime:electron` smoke launches both a real
 sandboxed BrowserWindow plugin and a real utilityProcess plugin, verifies
 bidirectional storage RPC, and checks the recorded runtime ownership.
-
-Static `appearance.theme-packs` packages are an explicit non-executable admission
-form: `main.data = "theme"`, theme-only contributions and no permissions,
-activation events or companions. The runtime supervisor never starts them. This
-exception does not admit Node code or arbitrary host access in normal Settings.

docs/plugin-platform/market-sources.md

@@ -1,101 +0,0 @@
-# Market sources (unreleased)
-
-The plugin manager has Installed, Official marketplace and Third-party marketplace
-pages. Listing a plugin in the official market does not certify it or establish
-that Netcatty maintains it. Remote manifests, publisher names, source names and
-README content cannot create a host-issued official badge. This revision does not
-issue maintainer badges. README text and images remain author content.
-
-## Add a source
-
-Enter a public HTTPS origin, for example `https://plugins.example.com`, or that
-origin's `/v1/snapshot.json`. Names can change; identity is derived by the host
-from the canonical origin. Credentials, query strings, fragments, custom ports,
-IP literals and local hostnames are rejected. The initial third-party transport
-requires public IPv4 DNS records, pins the checked address to the TLS connection,
-and rejects private/reserved destinations. IPv6-only sources are not supported
-in this revision. No cookies, login tokens, redirects or GitHub fallback are used.
-
-Third-party sources begin empty. A failed request never substitutes the official
-catalog. Each source has its own in-memory last-known-good snapshot and selection
-tokens; an offline snapshot is browse-only. A process restart requires a fresh
-third-party fetch. The official source remains fixed to `plugins.netcatty.app`
-and retains its bundled source examples when unavailable.
-
-## Publish a static source
-
-Use the existing snapshot protocol in the registry project's
-`docs/STATIC-DISTRIBUTION.md`. Every source
-serves `/v1/snapshot.json`, pointing to hash/size-bound catalog, index and delivery
-JSON under `/snapshots/<delivery-sha256>/`. All resources remain on the source's
-origin under content-addressed `/assets/` paths. Whole-JSON budgets, schema,
-manifest, compatibility, browser-runtime admission and archive validation still
-apply. Third-party source consent is not permission consent.
-
-Delivery v1 is unchanged and source-only. Delivery **v2** has the same fields and
-strict schema as v1, with `schemaVersion: 2` and one extension: each plugin's
-`artifact` can be null or a package reference:
-
-```json
-{"path":"/assets/<64-lowercase-hex-sha256>.ncpkg","sha256":"<same-sha256>","size":12345}
-```
-
-Packages are at most 32 MiB. The catalog entry must contain
-`artifact: {url: "https://plugins.example.com/assets/<same-sha256>.ncpkg", sha256}`.
-The index's current, non-withdrawn version must exactly equal the catalog entry
-and use `distribution: "release"`. Source-only entries retain null delivery
-artifacts and `distribution: "source-only"`. Avatars remain null; remote README
-embeds are not loaded. README and PNG/WebP references retain the v1 bounds.
-Existing official bootstrap entries are not changed or made installable.
-
-Before every install, refresh and validate the entire snapshot again. A changed
-selection, withdrawal, unavailable source, altered hash or size prevents install;
-there is no fallback to another source or latest release. Packages install disabled.
-
-## Ownership and changing source
-
-A public plugin ID can have only one installed source. The package's host install
-metadata and durable database binding record that source, including across
-recovery and uninstall. Cross-source install or update is rejected, even when
-version and package bytes match. Local imports are a separate source.
-
-Private settings, view state, persistent and in-memory grants, secrets, and cloud
-sidecars are namespaced by host-derived source identity. Every source, including local imports, uses an opaque encoded owner; public plugin IDs are never storage-owner aliases in sync payloads. Before each sync entry and after every awaited contribution update/reset, the host rechecks that owner against the live source and contributions. Hydration captures its owner before yielding and never remaps a public ID for a later write. KV keys are qualified
-inside the existing per-plugin FK. Code, permissions and source configuration do
-not participate in cloud sync. Old-source cloud settings may remain orphaned;
-they cannot hydrate the same plugin ID from a different source. Generic KV still
-is not cloud-synced. No host/Vault/input migration changes are made.
-
-To change source, uninstall and explicitly select **clear this source's private
-data, grants and secrets**. The host serializes shutdown, revocation, private-file
-cleanup and binding reset. This is destructive and is never selected by default.
-Then install from the new source and review permissions again. An uninstall that
-retains data deliberately retains the binding and continues to reject other sources.
-
-Removing a market keeps its installed plugins and data. Updates stop; optionally
-disable its plugins. No other market silently takes over. Disabling a source only
-stops browsing/install/update access; it does not silently revoke existing plugins.
-
-## Validation limits
-
-Tests use synthetic source responses and first-party packages. Passing tests is
-not a sandbox certification. Native UI, real third-party hosting, network
-availability and multi-device encrypted-sync acceptance must be reported
-separately. No real credentials or untrusted community code are needed for tests.
-
-## Source-owner integration
-
-Use `PluginDatabase.getActivePlugin(context.pluginId)` to require a current host
-installation, then `database.privateOwner(plugin.id)` for an opaque data partition.
-`plugin.source` is host-owned `{id, kind, name, origin}`.
-`getRetainedPluginSource(pluginId)` returns a retained uninstall binding or null.
-`publicPluginId(owner)` resolves only an encoded owner matching the current source;
-it rejects raw public IDs and stale owners. Never accept owner/source from a plugin
-request or invent a `pluginId` fallback. Capture owner/source at async operation
-start and revalidate before committing; follow runtime lifecycle cancellation.
-
-Plugin database schema 7 atomically converts existing raw local private rows and
-KV keys to the same encoded-owner model without deleting them. This is a one-time
-conversion, not a parallel runtime compatibility path. A conflicting conversion
-fails without publishing schema 7. Old raw-ID cloud entries remain orphaned and
-cannot hydrate an installed plugin. Host/Vault/input schemas are unchanged.

docs/plugin-platform/native-acceptance.md

@@ -1,47 +0,0 @@
-# Native Electron handoff
-
-Repository: binaricat/Netcatty. Frozen baseline: 0256e7471d66bbbca077c361ef379d7b11ce8465.
-Stack: feat/plugin-compatibility-review -> feat/plugin-settings-manager -> feat/plugin-curated-catalog.
-Use the final catalog branch for all three slices. Do not merge or release.
-
-1. Check out the branch on the approved desktop. Run npm ci and npm run build.
-2. Build the first-party sample:
-   npm run build:plugin-packages
-   node packages/plugin-cli/dist/cli.js pack examples/plugins/starter-netcatty --out /tmp/starter-netcatty.ncpkg
-   node packages/plugin-cli/dist/cli.js validate /tmp/starter-netcatty.ncpkg
-3. Launch the actual Electron binary without NETCATTY_PLUGIN_DEV and with a new disposable
-   --user-data-dir path, keeping Chromium sandbox enabled. Use the desktop's working
-   display and safe configuration; never --no-sandbox or real profiles/accounts.
-4. Settings > Plugins: record Community plugins list and Plugin Starter details.
-   Open README: actual pinned first-party GitHub retrieval; HTML inert, no remote images.
-   It intentionally says source-only: no downloadable artifact/release was invented.
-5. Import /tmp/starter-netcatty.ncpkg. It must remain disabled. Expand the installed
-   item: manifest permissions/resources, sensitive markers, Netcatty/API ranges,
-   SHA-256. Enable allows lazy activation; it does not grant permissions.
-   First command/view use prompts before runtime creation. Denying must not run code.
-6. With approved non-advanced permissions for the first-party example, edit Greeting
-   and open Starter: Greeting Panel (入门：问候面板) in the command palette.
-   Click Show greeting (显示问候语) and record the preference rendered in the panel.
-   No real host, cloud account, terminal credentials, runtime.advanced or third-party code.
-   Use Starter 0.1.1 or later. Its menus/views permissions support only the declared
-   command and sandboxed panel; do not expect terminal output.
-7. Disable, re-enable, close/restart the app with the same synthetic profile. Confirm
-   settings persist. Re-import same .ncpkg and verify it stops and stays disabled.
-8. Uninstall only the synthetic plugin using the two-step confirmation. Code/local KV
-   are removed; user-owned settings/secrets/sync sidecars have documented retention.
-9. On machines without a usable OS vault, the manager shows a downgrade notice;
-   secrets remain blocked but browsing and non-secret examples work.
-
-Compatibility upgrade/downgrade, required-feature changes, integrity mismatch,
-manifest mismatch, Node rejection, cleanup and traversal have automated synthetic
-coverage. Do not claim the above native steps were executed on this executor.
-
-This executor's native launch failed at Chromium's SUID sandbox configuration:
-chrome-sandbox is not root-owned mode 4755. No sandbox weakening was attempted.
-Native video is pending on the parent task's working desktop.
-
-10. Use the same AI-settings-style subpages: Installed and Community. Search by
-    name/author/description, open details and return. Verify README error/retry UI
-    if network is unavailable; do not bypass the network restriction.
-11. Inspect human-readable permission name, effect, scope, required/optional and
-    risk. Enabled means eligible for lazy activation, not permissions granted.

docs/plugin-platform/plugin-icons-proposal.md

@@ -1,54 +0,0 @@
-# Plugin manager window and brand icons
-
-Status: historical design investigation. The manager dialog and the accepted brand-icon design are now implemented. See [the current author guide](plugin-icons.md) for the shipped contract and bounds. The sections below preserve the original investigation and recommendations.
-
-## Manager window
-
-Settings > Plugins keeps an explicit Open plugin manager entry. The existing Radix Dialog opens a modal in the current renderer, up to 1180px wide and 88dvh high. Installed and Community, local import, manifest permissions and README remain inside it. Closing releases the mounted manager hooks; reopening starts at Installed. Detail Back stays inside the manager and preserves the Community search. Escape closes the manager and restores focus to its trigger.
-
-This uses the existing theme, dialog focus handling, plugin host and trusted bridge. A separate Electron BrowserWindow would require another renderer lifecycle, preload/context provisioning and trusted-sender review without providing a needed capability here. No window IPC, plugin runtime or grants are added.
-
-## Existing icon support
-
-- `packages/plugin-contract/schema/plugin-contract.schema.json`: `IconReference` is either a host-owned theme icon or a package icon with `light` and optional `dark` paths. It exists on commands, menus and views. `PluginManifest` has no top-level icon and rejects unknown properties.
-- `packages/plugin-cli/src/manifest.ts` validates contribution icon paths. `archive.ts` checks the declared resources during packaging and archive inspection. Missing files and unsafe paths are rejected.
-- `electron/plugins/contributionIconService.cjs` checks declaration ownership and current installed version before and after loading. It requires enabled/non-quarantined status, but does not require a running runtime. It reads a verified package root through `pluginProtocol.cjs` containment/realpath checks. Current input/output limits are 512 KiB, source edge 4096px, 16 megapixels, output edge 64px. Formats include PNG/WebP and SVG, JPEG, GIF, ICO.
-- `contributionIconRasterizer.cjs` decodes in a disposable sandboxed, network-denied BrowserWindow and returns bounded PNG data. Its SVG inspection is not a general SVG sanitizer; isolation/CSP/rasterization remain essential.
-- `application/state/usePluginContributionIcon.ts` discards stale requests. `components/plugins/PluginContributionIcon.tsx` selects light/dark images or a Puzzle fallback.
-- `PluginMarketplace.tsx` currently uses the host Package glyph. The catalog has no separately verified logo asset. Installed/detail surfaces do not expose a plugin brand logo.
-
-An author can already add a contribution icon (inside a command/menu/view):
-
-```json
-"icon": { "kind": "package", "light": "assets/action.png", "dark": "assets/action-dark.png" }
-```
-
-Include both files in the package and run CLI validate/pack. This changes that contribution's icon, not its market listing logo.
-
-## Proposed minimal brand-icon contract
-
-Reuse `IconReference`, adding an **optional** `PluginManifest.icon`; do not invent a URL/logo string format. A package brand icon would look like this after support ships:
-
-```json
-"icon": {
-  "kind": "package",
-  "light": "assets/logo.png",
-  "dark": "assets/logo-dark.webp"
-}
-```
-
-Recommended first version:
-
-- Static PNG or WebP, transparent background if desired; recommend a square 128–256px image. Enforce 256 KiB per source and a 512px maximum edge, validate MIME/signature and decoded dimensions, reject animated input, output bounded raster PNG. A single `light` asset works in both themes; `dark` is optional. Host theme icons can reuse the existing allowlist without package I/O.
-- Relative package paths only: no URL, absolute/drive/UNC paths, traversal, backslash, NUL, symlink escape or archive special entries. Do not read arbitrary renderer-supplied paths. Verify exact package hash/version and declaration on each uncached resolution; key caches by package identity/hash/theme, and discard stale results on update/uninstall.
-- Old plugins omit the field and continue to work with one shared host fallback. Per `contract-and-sdk.md`, adding this optional field requires an API/schema revision. New packages using it must declare the matching API range and required feature, plus a minimum host version that understands it: older strict schemas will reject an unknown field. Do not promise new-manifest compatibility with older hosts.
-- Extend the single contract and regenerate its consumers. Extend CLI path enumeration and both pack/archive checks; enforce image bounds during validation/import, not only in the UI. Reuse contained-file reads and the bounded rasterizer instead of adding file:// or runtime resource access in the application renderer.
-- Separate brand-image availability from contribution availability. Verified installed packages may show a logo while disabled without enabling or activating code. Do not loosen the existing contribution-icon enabled gate globally. Share the decoding implementation through a narrow brand-image operation that resolves the active installed declaration itself.
-- For uninstalled market entries, do not execute or install a plugin to obtain its logo. Use a small, catalog-reviewed static asset bundled with Netcatty, with its source commit and digest bound to that catalog version; absent assets use the same fallback. In particular the two current source-only examples have no downloadable artifact to extract. A later remote asset transport would need its own bounded allowlist/hash/redirect/cache policy and is outside this first proposal.
-- Use one brand-icon component in catalog cards, catalog details and installed lists/details. On decode/read failure keep the fallback and metadata/actions usable; do not fall back to a remote URL. Icons are decorative, with plugin names remaining accessible text.
-
-Do not add brand SVG support initially. Existing contribution SVG support is not removed. SVG brings XML/CSS/external-reference, filter and decoding complexity; supporting it for distribution means retaining isolated offline rasterization, bounded dimensions/time/concurrency and malformed/hostile-source tests. Raster PNG/WebP covers the initial need with less format complexity, though image decoders still require limits and isolation.
-
-## Validation required before implementing brand icons
-
-Contract/CLI tests should cover old manifests, optional fields, missing files, both themes, spoofed MIME, animation, oversized/zero dimensions, archive traversal and symlinks. Host tests should cover disabled installed packages without activation, source-only catalog fallback, stale update/uninstall results and no remote fetch. UI/native checks should cover all three surfaces, broken-image fallback, light/dark themes and accessible names. No new host, filesystem, network or terminal permission should be granted for displaying a verified logo.

docs/plugin-platform/plugin-icons.md

@@ -1,81 +0,0 @@
-# Add a plugin brand icon
-
-Brand icons appear on Community cards/details and Installed lists/details. They
-are optional; plugins without them retain a host-owned fallback. An icon does
-not activate code or grant plugin permissions.
-
-## Declare the icon
-
-Use the existing `IconReference` shape at the top level of `netcatty.plugin.json`:
-
-```json
-{
-  "engines": { "netcatty": ">=0.0.0", "api": ">=0.1.0-internal.1 <0.2.0" },
-  "features": { "required": ["metadata.brand-icon"] },
-  "icon": {
-    "kind": "package",
-    "light": "assets/logo-light.png",
-    "dark": "assets/logo-dark.webp"
-  }
-}
-```
-
-This is a manifest fragment. Preserve the required ID, name, version, publisher,
-main and other fields. The host-version value above is for this repository's
-unreleased development build (version 0.0.0); use the actual first supporting
-Netcatty release as your lower bound when it is assigned. Do not invent a release
-number. The API range and required feature enforce support in the meantime.
-
-Alternatively use a host-owned theme glyph, for example
-`"icon": { "kind": "theme", "name": "terminal" }`, with the same API/feature
-requirements. Theme glyphs use the existing host allowlist; unknown names fall back safely.
-
-## Prepare files
-
-Use a static PNG or WebP. A square transparent 128×128 or 256×256 image is
-recommended. Each source must be at most 256 KiB, with both dimensions between
-1 and 512 pixels. `dark` is optional; otherwise `light` is used in both themes.
-Use lowercase `.png` / `.webp` extensions matching the encoded bytes. Animated
-PNG/WebP and SVG are not accepted for brand icons. Existing contribution icons
-are unchanged, including their separately isolated SVG support.
-
-Paths are relative to the package root. URLs, absolute paths, traversal,
-backslashes and symlinks escaping the package are not supported. Include each
-referenced file in the package. No external image URL is loaded as a fallback.
-The host performs offline isolated decoding and displays a bounded PNG result;
-invalid or unreadable images fall back to the host glyph.
-
-## Validate and package
-
-From this repository, after building your plugin:
-
-```sh
-npm run build:plugin-packages
-node packages/plugin-cli/dist/cli.js validate examples/plugins/starter-netcatty
-node packages/plugin-cli/dist/cli.js compatibility examples/plugins/starter-netcatty --netcatty 0.0.0 --api 0.1.0-internal.1 --features metadata.brand-icon
-node packages/plugin-cli/dist/cli.js pack examples/plugins/starter-netcatty --out /tmp/starter-netcatty.ncpkg
-```
-
-Directory validation, packaging and imported-archive validation check declared
-brand files and bounds. The host reads installed metadata by plugin ID and
-verified package identity, not a renderer-provided file path. Disabled packages
-can display their icon; quarantined, missing or changed packages fall back. The
-existing enabled-only contribution icon service gate is not relaxed.
-
-## Community previews
-
-For an uninstalled plugin, the directory maintainer includes a reviewed raster
-preview in the application bundle. The preview binds the plugin ID, version,
-repository, source commit and icon declaration. Its bytes and SHA-256 are checked
-against the reviewed source files in tests. The current Starter preview uses its
-first-party source assets; source-only listings do not pretend to have a release
-artifact. Missing or mismatched previews use the same fallback, without fetching
-an image from the author's server. Submit the source assets and updated directory
-metadata through the existing repository PR review process.
-
-## Compatibility
-
-This is API/schema revision `0.1.0-internal.1`. An older host rejects the unknown
-manifest field or missing required feature. The new host continues to offer
-`0.1.0-internal` for legacy plugins without the new field, including exact old
-API ranges. Existing plugins need no manifest or data migration.

docs/plugin-platform/registry-client.md

@@ -1,84 +0,0 @@
-# Official static distribution client
-
-Community starts at the fixed main-process endpoint
-`https://plugins.netcatty.app/v1/snapshot.json`. The renderer cannot choose an
-endpoint. All automatic catalog, README and potential package reads allow only
-that exact HTTPS origin: no credentials, query, fragment, noncanonical URL or
-redirect. No GitHub API/raw/avatar/release fallback exists. Explicit user-opened
-source links may still open GitHub in an external browser.
-
-## Snapshot contract
-
-This client implements the version-1 contract from
-`binaricat/netcatty-plugins@7bfe23e5627e16ba63806de6dded5b2667c02984`.
-The source catalog/index remain unchanged; **no `readmeAsset` field is added**.
-
-The pointer contains `schemaVersion: 1`, `registryCommit`, `snapshotId`, and
-`catalog`, `index`, `delivery` references, each `{path, sha256, size}`. Paths must
-be `/snapshots/<snapshotId>/<name>.json`; `snapshotId` equals the raw delivery
-SHA-256. The host checks the pointer before requesting its three documents,
-then checks raw byte counts/hashes, JSON budgets, schemas and cross-document
-identity. The three documents must all validate before replacing any cache.
-
-Delivery contains `schemaVersion`, `registryCommit`, `catalogSha256`,
-`indexSha256`, `sourceLockSha256`, `builderSha256` and `plugins`. Each item matches
-one exact catalog `id/version/repository/commit` tuple and supplies `readme`,
-`iconLight`, `iconDark`, `avatar`, `artifact`. Asset references are
-`{path, sha256, size}`, with `/assets/<sha256>.md` for README and `.png`/`.webp`
-for brand icons. This v1 publishing schema requires **avatar and artifact to
-be null**. The client rejects unsupported delivery metadata rather than
-inventing installable packages or deriving a GitHub avatar URL.
-
-Index is validated with its pinned schema. Plugin/version identities must be
-unique; each catalog entry must exactly equal the index's current, non-withdrawn,
-source-only entry. Withdrawal does not disable, uninstall or delete any existing
-plugin: this is catalog admission, not a remote installed-code kill switch.
-
-Schemas are vendored under `electron/plugins/distribution/`, with provenance and
-fixtures described there. All schema references resolve locally; schema validation
-does not fetch GitHub or netcatty.com.
-
-## Bounds, cache and selection
-
-Pointer reads are bounded to 16 KiB, each JSON document to 2 MiB, and each README
-to 256 KiB. Reads time out after 30 seconds. Whole JSON values retain the existing
-128-level / 100,000-value / finite-number boundary. Catalogs contain at most 1,000
-entries. Existing manifest identity, license and browser-only policies remain.
-
-The host prepares private entries, private delivery resources and all public
-selection tokens before one synchronous cache publication. Parse, integrity,
-schema, clone, tuple or network failures preserve the last complete good snapshot.
-The cache remains **in memory for this app session**; a fresh offline launch lists
-bundled examples. No new disk database, sync record or credential is introduced.
-
-A host-generated selection token binds the complete entry and its delivery item.
-This prevents silent selection changes; it is **not a signature**. README requests
-capture the matched static reference and verify its exact byte count and digest.
-Missing/offline snapshots show an error/Retry; they never synthesize a raw GitHub URL.
-README HTML and remote images remain inert in the existing safe renderer.
-
-The current v1 distribution cannot install packages. A later publishing/client
-schema revision must jointly introduce reviewed package mirroring, keep source
-manifest/hash admission, and recheck the current pointer and fresh root withdrawal
-ledger before any install. A historical snapshot alone cannot establish availability.
-The existing lower-level package downloader accepts only official static URLs and
-exact SHA-256 bytes; it does not relax those future gates or auto-enable code.
-
-## Network inventory
-
-| Path | Automatic source | Failure behavior |
-| --- | --- | --- |
-| Pointer / manual refresh | Fixed `/v1/snapshot.json` | Complete session cache, or bundled source-only entries |
-| Catalog/index/delivery | Pointer-bound same-origin immutable paths | Reject partial or mixed snapshots |
-| README details | Exact delivery `/assets/<hash>.md` | Visible error/Retry, no upstream fallback |
-| Uninstalled brand icons | Existing reviewed bundled previews | Default icon; delivery icon metadata validated but not fetched by UI |
-| Installed brand icons | Host-owned local package decoder | Default icon; no activation/network request |
-| Author avatars | Not implemented; delivery v1 requires null | Existing local presentation; no avatar lookup |
-| Package artifacts | Not published or admitted by delivery v1 | Source-only; no download action fabricated |
-| Source/README links | Explicit user-opened external HTTPS link | May open GitHub; no background dependency |
-
-The real PR3 bootstrap is retained as a test fixture with its original bytes and
-hashes. Tests also verify its brand-icon asset bytes; this does not claim a new
-remote icon renderer. The static publisher is not a proxy. Client tests do not
-prove deployment, mainland reachability or successful native CDN access. Native
-QA must independently verify the published endpoint and visible failure state.