fix(plugins): suspend native views only for active log dialogs

application/state/usePluginAIContextHost.ts

@@ -4,7 +4,7 @@ import { getNotesSnapshot } from './notesStore';
 import { useActiveTabId } from './activeTabStore';
 import { getAppAppLockRuntime } from './appRuntimeBridge';
 import { createTrustedPluginAIHostRuntime } from '../../infrastructure/ai/plugin/trustedHostRuntime';
-import { getConfiguredPluginModel, prepareConfiguredPluginModel } from '../../infrastructure/ai/plugin/configuredModel';
+import { getConfiguredPluginModel } from '../../infrastructure/ai/plugin/configuredModel';
 import { buildSelectedPluginSources } from '../../infrastructure/ai/plugin/selectedSources';
 import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
 
@@ -29,7 +29,6 @@ export function usePluginAIContextHost({ sessions, workspaces }: { sessions: Ter
     const requests = new Map<string, { runtimeId: string; controller: AbortController }>();
     const runtime = createTrustedPluginAIHostRuntime({
       getModel: getConfiguredPluginModel,
-      prepareModel: prepareConfiguredPluginModel,
       isActive: () => mounted && document.visibilityState === 'visible' && getAppAppLockRuntime()?.locked === false,
       chooseSelected: (signal, runtimeId) => new Promise((resolve, reject) => {
         if (chooser) { reject(Error('A host selection is already pending')); return; }

components/PluginAIContextHost.test.tsx

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 
-test('cold plugin host reaches the local fixture through the actual main provider allowlist without the AI sidebar', { timeout: 20_000 }, async (t) => {
+test('default host adapter, real preload, mounted host chooser and installed assistant reach only the local fixture', { timeout: 20_000 }, async () => {
   // JSDOM + the in-process runtime prove app wiring; they are not native sandbox
   // evidence. All state is synthetic, with no real provider, key, Note or host.
   const rootPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -42,7 +42,6 @@ test('cold plugin host reaches the local fixture through the actual main provide
   const { inProcessBrowserRuntime } = require('../electron/plugins/fixtures/inProcessBrowserRuntime.cjs');
   const { createPreloadApi } = require('../electron/preload/api.cjs');
   const aiBridge = require('../electron/bridges/aiBridge.cjs');
-  const { registerProviderHandlers } = require('../electron/bridges/aiBridge/providerHandlers.cjs');
   const { server, counts } = createAssistantProviderFixture({ delayMs: 25 });
   const oldNotes = getNotesSnapshot(); const oldLock = getAppAppLockRuntime();
   let service: ReturnType<typeof createPluginHostService> | undefined;
@@ -52,30 +51,6 @@ test('cold plugin host reaches the local fixture through the actual main provide
   const lockListeners = new Set<(state: { locked: boolean }) => void>();
   const reviews: Array<Record<string, unknown>> = [];
   const trustedPayloads: unknown[] = [];
-  const streamResults: Array<{ ok: boolean; statusCode?: number; allowlistRejected: boolean }> = [];
-  const providerSyncs: Array<{ count: number; selectedPresent: boolean }> = [];
-  const sdkErrorNames: string[] = [];
-  let diagnosticPhase = 'setup';
-  const originalConsoleError = console.error;
-  // node:sqlite was imported above. Node 22 delivers its ExperimentalWarning
-  // asynchronously through console.error. Let module warnings reach normal
-  // stderr before observing SDK/renderer errors; do not suppress that warning.
-  await new Promise<void>((resolve) => setImmediate(resolve));
-  // The expected pre-fix SDK error contains request details. Keep diagnostics
-  // categorical even on the failing-before path; never print payloads/headers.
-  console.error = (value: unknown) => {
-    let category = 'unknown';
-    if (typeof value === 'string' && /not wrapped in act/.test(value)) category = 'react-act-warning';
-    else if (typeof value === 'string' && /act.*environment|environment.*act/.test(value)) category = 'react-act-environment';
-    else if (typeof value === 'string' && /ExperimentalWarning: SQLite is an experimental feature/.test(value)) category = 'node-sqlite-experimental';
-    else if (typeof value === 'string') category = 'other-string';
-    else if (value && typeof value === 'object') {
-      const name = (value as { name?: unknown }).name;
-      if (typeof name === 'string' && ['AbortError', 'AI_APICallError', 'AI_LoadAPIKeyError', 'TypeError', 'Error'].includes(name)) category = name;
-    }
-    sdkErrorNames.push(`${diagnosticPhase}:${category}`);
-  };
-  t.after(() => { console.error = originalConsoleError; });
   try {
     server.listen(0, '127.0.0.1'); await once(server, 'listening');
     const address = server.address(); assert.ok(address && typeof address !== 'string');
@@ -87,50 +62,25 @@ test('cold plugin host reaches the local fixture through the actual main provide
       ipcRenderer.emit(channel, {}, structuredClone(payload));
     } });
     const mainWindow = Object.assign(new EventEmitter(), { webContents: sender, isDestroyed: () => false, isVisible: () => true, isFocused: () => true });
-    const providerContext = {
-      ipcMain: { handle: (channel: string, handler: (...args: unknown[]) => unknown) => ipcHandlers.set(channel, handler) },
-      providerConfigs: [] as Array<{ id: string; baseURL?: string; apiKey?: string }>, webSearchApiHost: null,
-      validateSender: (event: { sender: unknown }) => event.sender === sender,
-      validateSenderOrSettings: (event: { sender: unknown }) => event.sender === sender,
-      // Only credential injection is synthetic. Admission, sync and the HTTP
-      // transport are the production implementations, not a direct-fetch seam.
-      injectApiKeyIntoRequest: (url: string, headers: Record<string, string>, providerId: string) => {
-        const config = providerContext.providerConfigs.find((item) => item.id === providerId);
-        return { url, headers: Object.fromEntries(Object.entries(headers).map(([key, value]) =>
-          [key, config?.apiKey ? value.replace('__IPC_SECURED__', config.apiKey) : value])) };
-      },
-      shouldSkipTLSVerify: () => false,
-      streamRequest: aiBridge._streamRequestForTests,
-    };
-    registerProviderHandlers(providerContext);
-    assert.equal(providerContext.providerConfigs.length, 0);
     ipcRenderer.invoke = async (channel, payload) => {
       if (channel === 'netcatty:ai:chat:stream') {
         const request = payload as { url: string; headers: Record<string, string>; body: string; requestId: string };
         assert.equal(new URL(request.url).origin, new URL(endpoint).origin);
         assert.doesNotMatch(JSON.stringify(request), /fixture-only/);
+        const status = await aiBridge._streamRequestForTests(request.url, { headers: request.headers, body: request.body }, { sender }, request.requestId, false);
+        return { ok: status.statusCode === 200, ...status };
       }
       if (channel === 'netcatty:ai:chat:cancel') return aiBridge.cancelPluginAIStreamsForSender(sender) > 0;
       const handler = ipcHandlers.get(channel);
       assert.ok(handler, `Unexpected trusted IPC: ${channel}`);
-      const result = await handler({ sender }, structuredClone(payload));
-      if (channel === 'netcatty:ai:sync-providers') providerSyncs.push({ count: providerContext.providerConfigs.length,
-        selectedPresent: providerContext.providerConfigs.some((item) => item.id === 'qa-provider') });
-      if (channel === 'netcatty:ai:chat:stream') {
-        const status = result as { ok: boolean; statusCode?: number; error?: string };
-        streamResults.push({ ok: status.ok, statusCode: status.statusCode, allowlistRejected: status.error === 'URL host is not in the allowed list' });
-      }
-      return result;
+      return handler({ sender }, structuredClone(payload));
     };
     const api = createPreloadApi({ ipcRenderer, webUtils: {} });
     Object.defineProperty(dom.window, 'netcatty', { value: api });
     const syntheticNote = { id: 'synthetic-note', title: 'Synthetic retry plan', content: 'Synthetic retry plan: add a retry button.', createdAt: 1, updatedAt: 1 };
     publishNotesSnapshot({ notes: [syntheticNote], noteGroups: [] });
     registerAppAppLockRuntime({ locked: false } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
-    dom.window.localStorage.setItem(STORAGE_KEY_AI_PROVIDERS, JSON.stringify([
-      { id: 'qa-provider', name: 'QA fixture', providerId: 'custom', enabled: true, baseURL: endpoint, defaultModel: 'deterministic-fixture', apiKey: 'fixture-only' },
-      { id: 'qa-secondary', name: 'Synthetic secondary', providerId: 'custom', enabled: true, baseURL: 'https://secondary.invalid/v1', defaultModel: 'synthetic', apiKey: 'secondary-fixture-marker' },
-    ]));
+    dom.window.localStorage.setItem(STORAGE_KEY_AI_PROVIDERS, JSON.stringify([{ id: 'qa-provider', name: 'QA fixture', providerId: 'custom', enabled: true, baseURL: endpoint, defaultModel: 'deterministic-fixture', apiKey: 'fixture-only' }]));
     dom.window.localStorage.setItem(STORAGE_KEY_AI_ACTIVE_PROVIDER, 'qa-provider');
     dom.window.localStorage.setItem(STORAGE_KEY_AI_ACTIVE_MODEL, 'deterministic-fixture');
     service = createPluginHostService({
@@ -166,7 +116,6 @@ test('cold plugin host reaches the local fixture through the actual main provide
       executeCommand: async (command: string, args: unknown) => structuredClone(await service!.contributionService.executeCommand(command, structuredClone(args))),
       onDidReceiveMessage: () => ({ dispose() {} }),
     } });
-    diagnosticPhase = 'initial-selection';
     await act(async () => panel!.window.eval(fs.readFileSync(path.join(sample, 'panel.js'), 'utf8')));
     await waitFor(() => document.getElementById('plugin-ai-note') !== null);
     const noteChoice = document.getElementById('plugin-ai-note') as HTMLSelectElement;
@@ -180,33 +129,23 @@ test('cold plugin host reaches the local fixture through the actual main provide
     assert.equal(reference.value, ''); assert.equal(reference.options.length, 2);
     assert.notEqual(reference.options[1].value, syntheticNote.id); reference.value = reference.options[1].value;
     const send = () => element('compose').dispatchEvent(new panel!.window.Event('submit', { cancelable: true }));
-    diagnosticPhase = 'deny-content';
     send(); await waitFor(() => element('status').textContent!.startsWith('Request ended'));
     assert.equal(counts.requests, 0); assert.equal(reviews.length, 0);
     contentAllowed = true;
-    diagnosticPhase = 'complete-stream';
-    send(); await waitFor(() => counts.completed === 1 || streamResults.some((result) => !result.ok));
-    assert.deepEqual(streamResults.at(-1), { ok: true, statusCode: 200, allowlistRejected: false },
-      'Cold plugin startup must synchronize host providers before the main allowlist admits transport');
-    assert.ok(providerSyncs.some((sync) => sync.selectedPresent && sync.count === 2), 'Preserve other host-configured providers in the shared registry');
-    await waitFor(() => element('status').textContent === 'Complete');
+    send(); await waitFor(() => element('status').textContent === 'Complete');
     assert.equal(reviews.length, 0, 'content policy must not open a second native sharing review');
     assert.equal(counts.completed, 1); assert.match(element('response').textContent!, /Synthetic plan/); assert.match(element('usage').textContent!, /12 input tokens/);
-    diagnosticPhase = 'stop-stream';
     send(); await waitFor(() => element('response').textContent!.startsWith('Synthetic plan: '));
     element('stop').dispatchEvent(new panel.window.Event('click'));
     await waitFor(() => element('status').textContent === 'Stopped' && counts.aborted === 1);
     const stoppedText = element('response').textContent; await new Promise((resolve) => setTimeout(resolve, 50)); assert.equal(element('response').textContent, stoppedText);
-    diagnosticPhase = 'lock-stream';
     send(); await waitFor(() => element('response').textContent!.startsWith('Synthetic plan: '));
     locked = true; registerAppAppLockRuntime({ locked: true } as NonNullable<ReturnType<typeof getAppAppLockRuntime>>);
     for (const listener of lockListeners) listener({ locked: true });
     await waitFor(() => counts.aborted === 2 && service!.aiContextService.broker.turns.size === 0);
     assert.equal(aiBridge._getActiveStreamCountForTests(), 0);
-    assert.doesNotMatch(JSON.stringify(trustedPayloads), /fixture-only|secondary-fixture-marker|apiKey|privateOwner|permissionMode|mcp/);
-    assert.deepEqual(sdkErrorNames, []);
+    assert.doesNotMatch(JSON.stringify(trustedPayloads), /fixture-only|apiKey|privateOwner|permissionMode|mcp/);
   } finally {
-    console.error = originalConsoleError;
     panel?.window.close();
     await act(async () => root.unmount());
     await service?.manager.shutdown(); aiBridge.cleanup();

components/settings/tabs/PluginLogSettings.tsx

@@ -19,7 +19,7 @@ export function PluginLogSettings() {
   const disclosure = zh
     ? '插件编写的日志文字可能包含敏感数据。截断和字段过滤不能保证任意文字安全。只为排查问题临时开启，导出前请检查。重启应用后自动关闭详细日志。'
     : 'Plugin-authored text may contain sensitive data. Truncation and field filtering cannot make arbitrary text safe. Enable temporarily for troubleshooting and review files before sharing. Verbose diagnostics turn off after app restart.';
-  return <div data-host-security-surface="">
+  return <div>
     <Dialog open={open} onOpenChange={setOpen}>
       <SettingRow label={title} description={zh ? '选择是否在此设备保存审计记录和诊断日志。' : 'Choose whether to keep audit records and diagnostics on this device.'}>
         <div className="flex items-center gap-3">
@@ -53,6 +53,6 @@ export function PluginLogSettings() {
         </DialogFooter>
       </DialogContent>
     </Dialog>
-    <ConfirmDialog open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
+    <ConfirmDialog hostSecuritySurface open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
   </div>;
 }

components/settings/tabs/PluginManagementDialog.interaction.test.tsx

@@ -68,11 +68,6 @@ test('plugin manager is single-instance, closes with Escape, restores focus and
     })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
     await click(trigger);
     await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
-    // Radix schedules close-focus cleanup after the React close commit. The
-    // settle inside click's act() can precede that commit; observe the actual
-    // handoff instead of assuming the cleanup timer already ran.
-    const handoffDeadline = Date.now() + 2_000;
-    while (!handedOff && Date.now() < handoffDeadline) await act(async () => { await settle(); });
     assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
     function ControlledEntry() {
       const [open, setOpen] = useState(false);

components/settings/tabs/PluginSettingsVisibility.test.tsx

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { JSDOM } from 'jsdom';
+const require = createRequire(import.meta.url);
+
+test('real Settings landing leaves views visible while idle; log and Ask dialogs suspend and restore them', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div><div id="native-view-mount"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'Event', 'MouseEvent', 'KeyboardEvent', 'MutationObserver', 'DocumentFragment', 'CustomEvent']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginSettingsLanding } = await import('./PluginSettingsLanding');
+  const { PluginPermissionHost } = await import('../../plugins/PluginPermissionHost');
+  const { observePluginHostSecurityVisibility } = await import('../../../application/state/pluginHostSecurityVisibility');
+  const { PluginPermissionDecisionHost } = require('../../../electron/plugins/permissionDecisionHost.cjs');
+  type Prompt = NetcattyPluginPermissionPrompt | { requestId: string; closed: true };
+  const listeners = new Set<(event: Prompt) => void>();
+  const sender = Object.assign(new EventEmitter(), { isDestroyed: () => false, send: (_channel: string, event: Prompt) => { for (const listener of listeners) listener(event); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const host = new PluginPermissionDecisionHost({ getWindows: () => [owner], isLocked: () => false });
+  let logStatus = { saveToDisk: false, verbose: false, droppedRecords: 0, writeErrors: 0, pendingBytes: 0, maxBytes: 3145728, retentionDays: 7 };
+  Object.assign(dom.window, { netcatty: {
+    async getPluginLogStatus() { return logStatus; },
+    async configurePluginLogs(value: { saveToDisk: boolean; verbose: boolean }) { logStatus = { ...logStatus, ...value }; return logStatus; },
+    onPluginPermission(listener: (event: Prompt) => void) { listeners.add(listener); return () => listeners.delete(listener); },
+    setPluginPermissionReady: async (ready: boolean) => host.setReady(sender, ready),
+    respondPluginPermission: async (response: unknown) => host.respond(sender, response),
+  } });
+  const manager = { plugins: [], available: true, statusKnown: true, busy: false, error: null, credentialStorageAvailable: true,
+    async refresh() {}, async setEnabled() {}, async importPackage() {}, async uninstall() {} };
+  let visible = true;
+  const transitions: boolean[] = [];
+  const stopVisibility = observePluginHostSecurityVisibility(document.getElementById('native-view-mount')!, (next) => { visible = next; transitions.push(next); });
+  const root = createRoot(document.getElementById('root')!);
+  const button = (label: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((element) => element.textContent === label)!;
+  const flushVisibility = () => new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginSettingsLanding manager={manager} settingsAvailable={new Set()} onManage={() => {}} /><PluginPermissionHost /></I18nProvider>));
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.ok(button('Configure'), 'real idle logging row is present');
+    assert.equal(visible, true, 'idle Settings landing must not hide the native child');
+    assert.deepEqual(transitions, []);
+    await act(async () => button('Configure').click());
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'actual logging security dialog must hide the child');
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[0].click());
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[1].click());
+    await flushVisibility();
+    assert.equal(document.querySelectorAll('[role="dialog"]').length, 2);
+    assert.equal(visible, false, 'the verbose security confirmation must also keep the child hidden');
+    await act(async () => button('Cancel').click());
+    await flushVisibility();
+    assert.equal(visible, false, 'cancelling verbose returns to the protected logging dialog');
+    await act(async () => button('Close').click());
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(visible, true, 'closing logs must restore the child while its idle row remains');
+    let pending!: Promise<{ decision: string }>;
+    await act(async () => {
+      pending = host.request({ requestId: 'settings-visibility-ask', pluginId: 'com.example.settings-visibility', pluginName: 'Settings visibility fixture', pluginVersion: '1.0.0',
+        permission: 'settings.read', resources: ['*'], reason: 'Read own synthetic setting' });
+    });
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'Ask must still hide the child above the real landing');
+    await act(async () => { button('Deny').click(); await pending; });
+    await flushVisibility();
+    assert.equal((await pending).decision, 'deny');
+    assert.equal(visible, true, 'dismissing Ask must restore the same child');
+    assert.deepEqual(transitions, [false, true, false, true]);
+  } finally {
+    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/ui/confirm-dialog.tsx

@@ -17,6 +17,7 @@ interface ConfirmDialogProps {
   confirmLabel: string;
   busy?: boolean;
   destructive?: boolean;
+  hostSecuritySurface?: boolean;
   onOpenChange: (open: boolean) => void;
   onConfirm: () => void;
 }
@@ -28,6 +29,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
   confirmLabel,
   busy = false,
   destructive = false,
+  hostSecuritySurface = false,
   onOpenChange,
   onConfirm,
 }: ConfirmDialogProps) {
@@ -35,7 +37,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
+      <DialogContent data-host-security-surface={hostSecuritySurface ? "" : undefined} className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
         <DialogHeader className="min-w-0 pr-6">
           <DialogTitle className="truncate">{title}</DialogTitle>
         </DialogHeader>

docs/plugin-platform/acceptance-candidate.md

@@ -1,9 +1,5 @@
 # Unified plugin acceptance candidate
 
-This file records the frozen 677 native baseline. For the subsequent permission
-policy and AI candidate, use [the new integration record](policy-ai-integration.md)
-and its package manifest. Historical consent flows below are not the revised UX.
-
 The dedicated branch is `integration/plugin-native-acceptance`. Its Draft PR
 records the exact current head and CI runs. Native AI, database, Host/Vault, and
 settings/logging checks use this candidate rather than separate feature trees.

docs/plugin-platform/ai-provider-startup.md

@@ -1,108 +0,0 @@
-# Plugin model transport cold start
-
-Commit `092438803bed96753bfe68cb78da9ca1137dee25` removes an independent startup
-dependency on the internal AI sidebar. It does not establish the cause or outcome
-of the original native failure; that still requires an authorized native retest.
-
-## Reproduced boundary
-
-At native candidate `677aac33b1eec9dbd4a367417a49c964cdea63e7`, the plugin model
-selector reads the saved host provider, while main's provider registry starts
-empty. The existing sidebar synchronizes that registry when visible or sending.
-The plugin startup path did not. A nondefault configured loopback port can
-therefore fail main's provider allowlist before HTTP transport starts.
-
-The revised `components/PluginAIContextHost.test.tsx` installs the browser sample,
-mounts the trusted host component, uses the real application preload, and routes
-model requests through `registerProviderHandlers` and its actual allowlist. It
-does not mount the internal sidebar or manually alter the allowlist. Credential
-injection uses synthetic fixture markers; the HTTP edge and deterministic local
-fixture use the existing transport. No paid service, real key, Note, or host is
-used. This remains DOM/in-process evidence, not native sandbox acceptance.
-
-Failed-before evidence is `/tmp/netcatty-ai-cold-provider-before-final.log`:
-
-```text
-ok: false
-allowlistRejected: true
-statusCode: undefined
-```
-
-The corrected regression passes and preserves both the selected fixture provider
-and a second host-configured synthetic provider. It checks that provider markers
-and configuration do not enter plugin-facing model/context envelopes. Expected
-SDK error output is suppressed during this diagnostic so request payloads and
-headers are not logged.
-
-## Correction
-
-Before publishing a selected model handle, the trusted renderer synchronizes the
-current host-owned provider settings through the existing `aiSyncProviders`
-application API. It checks that the selected model revision matches the snapshot
-being synchronized. The runtime rechecks activity, cancellation, model revision,
-and pending-selection ownership after the await. Pending selections count toward
-the model-handle cap; release and shutdown invalidate late results.
-
-Plugin requests supply no URL, credential, or provider configuration. The existing
-main sender validation, endpoint allowlist, source binding, and model invocation
-budgets are unchanged. No new schema feature, plugin permission, or consent
-dialog is added. The assistant package is unchanged and retains SHA-256
-`c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395`.
-
-Production integration touches `configuredModel.ts`, `trustedHostRuntime.ts`, and
-`usePluginAIContextHost.ts`. The hook's import and `prepareModel` option may
-overlap host-selection work; preserve both when integrating the separate policy
-task. Permission-engine, consent-dialog, and sample-UI changes are outside this
-correction.
-
-## Native and policy status
-
-The native open/close sidebar comparison was incomplete. Execution auto-review
-denied the Application-scope `context.selected.list` grant; that action did not
-execute. No post-sidebar inference was performed, the prompt expired, and the
-sample was disabled while the worker cleaned up. This is not native confirmation
-of the startup cause. The original `677aac33` app remains frozen for comparison;
-this fix does not authorize retrying the denied execution action.
-
-In the earlier permission engine, **Application** grants are memory-only for the
-application lifetime; **Always** grants are persisted. An explicitly authorized
-Application grant can fit bounded temporary QA. A one-use prompt on every stream
-read is not an unavoidable target UX. The separate policy task implements the
-new direction: default Allow for declared supported capabilities, per-plugin
-Allow/Ask/Deny settings, audit, and in-app Ask dialogs. That product change is
-separate from execution-tool authorization and must not be used to evade a tool
-denial. This transport correction does not redesign that policy.
-
-Native outcome, independent verification, and the sample's light-theme appearance
-follow-up remain separate acceptance work. No GUI launch, sandbox bypass, paid
-model invocation, main merge, or release was performed for this correction.
-
-## Node 22 CI observer correction
-
-The new cold-start test failed on exact head `9ca70f329` in test run
-`40436198585`, Linux job `121965743101`: 15,206 passed, 1 failed, 50 skipped.
-The sole failure was the empty SDK/renderer-error assertion receiving one
-`SDK_OR_RENDERER_ERROR` marker. This red result is retained as evidence; it is
-not an unrelated baseline failure.
-
-The CI runtime was Node `22.23.3`; local validation had used Node `24.19.0`.
-Reproduction on the exact CI version identified the safe category
-`setup:node-sqlite-experimental`, before any model operation. The existing
-`node:sqlite` import schedules its ExperimentalWarning on the next tick via
-`console.error`. The newly added observer was installed before that warning
-drained. The same test passed on Node 24, which did not emit that warning.
-
-The test now lets pending module warnings reach normal stderr before installing
-the SDK/renderer observer. The warning remains visible, and the zero-runtime-error
-assertion is unchanged. Safe phase/error categories make future failures
-diagnosable without request payloads or headers. No production behavior, timeout,
-permission, or cancellation assertion changed. Both Node versions pass the
-focused test; the Node 22 parallel fixture/UI/provider/preload group passes all
-16 tests with concurrency 4.
-
-Diagnostic evidence: `/tmp/netcatty-ai-cold-ci-node22-sqlite-category.log` fails
-before correction, `/tmp/netcatty-ai-cold-ci-node22-after.log` passes with the
-SQLite warning still visible, and `/tmp/netcatty-ai-cold-ci-node22-parallel.log`
-records the parallel check. The appearance-only sample change is independently
-published as `e325742abf9fd329f1f7858eda66367e7a62357c`; its package hash is
-`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.

docs/plugin-platform/ask-routing-integration.md

@@ -1,125 +0,0 @@
-# Managed-window Ask acceptance candidate
-
-The dedicated branch is `integration/plugin-ask-routing-acceptance`. Its Draft
-PR records the exact frozen integration head, CI and private renderer artifact
-handoff. It starts from frozen #4001 at
-`02049102b6732778adcd0f33b0a0ade6b4752327`; the old source checkout, QA workspace,
-profile and renderer artifact remain unchanged.
-
-## Exact inputs and ownership
-
-The only new input is policy owner's reviewed Ask correction
-`89beeb93749c751f255beb6d0e0f95d23bdd9a7b`, imported by ordinary merge
-`1b21c41fa26c0173084c7ae75e640ef3274285dd`. There were no merge conflicts or
-manual production edits. These seven production files exactly match that input:
-
-| File | Owned production delta |
-| --- | --- |
-| `electron/bridges/windowManager.cjs` | Enumerate managed app windows, including Settings |
-| `electron/main/registerBridges.cjs` | Supply the managed permission-window getter |
-| `electron/plugins/hostService.cjs` | Pass that getter to the existing decision host |
-| `electron/plugins/permissionDecisionHost.cjs` | Bind ready/focused/visible/unlocked managed renderer selection and request lifecycle to the chosen receiver |
-| `electron/plugins/pluginBridge.cjs` | Guard permission readiness/replies by managed app window and main frame; reject plugin/foreign/subframe senders |
-| `components/SettingsPage.tsx` | Mount the existing permission host for standalone Settings |
-| `components/plugins/PluginPermissionHost.tsx` | Mark Ask with the existing host-security surface so attached native views yield |
-
-The input also owns the Settings-installed-entrypoint regression, renderer test
-updates and policy/security documentation. AI d33 startup wiring, sample assets,
-the combined cold-start assertions and all earlier policy/transport history are
-preserved from 020. `ModelSelector.tsx` is unchanged from 020; the separate
-model-selector failure-loop repair is not imported. Diagnostic #3999 remains
-excluded. No broker resource/source rules, stream restrictions, package/lock
-inputs, native dependencies or sandbox configuration change in this integration.
-
-## Frozen 020 native evidence
-
-The parent closed that QA session and released the GUI. Its partial outcome is:
-
-| Native case on 020 | Result |
-| --- | --- |
-| Default Allow cold Send and completion | Passed |
-| Stop, AI Deny, restore without automatic replay | Passed |
-| Themes in new views | Passed |
-| Ask visible dialog | Failed: no visible dialog, timeout, zero new model requests |
-| Ask acceptance/cancel and content-read matrix | Not run; remain pending |
-
-The input's independent source-only delta review is scoped clean. Its installed
-SDK/registered IPC test reproduces the old Settings-owned failure and passes with
-the correction using represented Electron objects. That is not native Ask
-success. No new native acceptance is claimed by this coding executor.
-
-Earlier terminal solo/split core passes with corrected fixtures, unreliable/
-unverified Focus and one QA Enter in A during a palette attempt remain historical
-evidence. There is no global zero-input or full terminal native-pass claim. The
-old Rfam run failed socket transport before connect resolved, without reaching
-authentication/SELECT; its cause and auth/TLS compatibility remain unverified.
-The next native priority is the new Ask path, not more old-baseline loops.
-
-## Checks and retained CI history
-
-| Local check | Result |
-| --- | --- |
-| Registered runtime | 696 tests: 695 passed, one native skip, zero failed/cancelled |
-| Contract/SDK/CLI | 91 passed |
-| Offline examples | Five passed, one Docker opt-in skip |
-| Mounted cold-start AI/permission/selected-summary/Host group | 21 passed |
-| Settings and security-surface visibility group | 37 passed |
-| Contract/capability/Codex generation and drift | Clean |
-| Lint | Zero errors, seven existing warnings |
-| Five sample archives | Validated; two builds each are identical and match frozen 020 |
-
-The exact integration production build, renderer inventory and final CI are
-recorded in the Draft PR and artifact provenance. Local native packaging and
-unpackaged GUI acceptance are not claimed. This environment uses locked
-dependencies and standard patches; the official pinned Electron binary uses its
-documented cache/proxy support. No header workaround, native shim, HOME change
-or sandbox change is introduced.
-
-Input89 [test CI 40453446775](https://github.com/binaricat/Netcatty/actions/runs/40453446775)
-succeeded on the parent's single infrastructure-only rerun: 15,342 passed, 50
-skipped, zero failed/cancelled. The original runner interruption remains evidence;
-this worker did not duplicate its retry. Input89
-[four-platform packages](https://github.com/binaricat/Netcatty/actions/runs/40453446781)
-passed with release jobs skipped. Frozen 020's successful full/platform CI and
-all earlier diagnosed/unexplained failures remain separate predecessor evidence.
-
-The [sample manifest](ask-routing-packages.json) records exact IDs, versions,
-features, permissions/resources and archive/content hashes. All five archives
-are byte-identical to 020, including Assistant
-`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.
-No archive was activated by this executor. Its unchanged owner README retains
-old review wording; the current Allow/Ask/Deny procedure governs acceptance.
-
-## Production-renderer preparation and native Ask recipe
-
-1. Create a new isolated checkout at this Draft's exact head and a separate
-   disposable synthetic QA profile. Keep the old 020 workspace/profile intact.
-2. Match `package.json` and `package-lock.json` hashes to the renderer artifact's
-   provenance and the independently normally rebuilt native dependencies. They
-   are unchanged from 020. Prepare matching host workspace packages normally.
-   **The complete backend checkout must match the new head:** the frontend-only
-   bundle does not include the new CJS window-routing code or native binaries.
-3. Materialize the exact private Library file/version in the consumer's own
-   environment. Verify its archive SHA-256 and every dist file with the supplied
-   inventory/verification script. Producer-local paths are not portable.
-4. Use those verified production assets as a whole `dist/` in the matching
-   checkout, with the ordinary Electron entrypoint, no Vite environment and
-   normal sandbox/helper settings. This is native **unpackaged production-
-   renderer QA**, not packaged-binary certification. Process-loss causality
-   remains unclassified; no native build/header workaround is supplied.
-5. Recreate only the synthetic provider/Note/sample setup. Verify Default Allow
-   remains functional; then set the plugin operation to Ask in the active main
-   or standalone Settings window. Keep the selected receiver visible, focused,
-   ready and unlocked; opening Ask must not force focus back to main.
-6. Record visible readable Ask and native-view yielding. Check cancellation and
-   acceptance as separate explicit operations: cancel must send no model request;
-   accept must authorize only the current bounded operation. Complete the
-   content-read Allow/Ask/Deny matrix and lifecycle invalidation cases. Do not
-   treat the earlier zero-request timeout as an Ask pass.
-7. Record exact head, archive/sample hashes, request counters, prompt ownership,
-   screenshots/video and any unrun cases. Report a model-selector failure
-   separately rather than folding its other owner's repair into this candidate.
-
-Hosting/distribution/deployment and remaining DB/terminal acceptance gates stay
-parent-coordinated. No main merge, Ready transition or release is part of this
-handoff.

docs/plugin-platform/ask-routing-packages.json

@@ -1,197 +0,0 @@
-[
-  {
-    "name": "assistant",
-    "id": "com.netcatty.assistant",
-    "version": "0.1.0",
-    "fileCount": 6,
-    "bytes": 17214,
-    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
-    "contentSha256": "c3e31e9613422bf9a05ccaa5b6f234304208f1a8298b1c1ee19262ba88af6cd0",
-    "features": {
-      "required": [
-        "ai.model-invocation",
-        "context.selected-read"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        "ai.invoke",
-        "context.selected.list",
-        "context.selected.read"
-      ]
-    },
-    "package": "assistant.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395",
-    "changedEntriesFromFrozen677": [
-      "README.md",
-      "panel.css",
-      "panel.js"
-    ],
-    "previous7856Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
-    "previous020Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
-    "changedEntriesFrom020": []
-  },
-  {
-    "name": "database-owned",
-    "id": "com.netcatty.database-minimal",
-    "version": "0.1.0",
-    "fileCount": 5,
-    "bytes": 11660,
-    "sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "contentSha256": "4d628c41c7a231e31cd56dacb822acaaa37f61e1e98b285b0086a4f783be199d",
-    "features": {
-      "required": [
-        "network.byte-streams"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        {
-          "permission": "network.stream",
-          "resources": [
-            "tcp://10.77.0.20:3306"
-          ],
-          "reason": "Connect only to the prepared disposable fixture."
-        }
-      ]
-    },
-    "package": "database-owned.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
-    "previous020Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "changedEntriesFrom020": []
-  },
-  {
-    "name": "database-rfam-readonly",
-    "id": "com.netcatty.database-rfam-readonly",
-    "version": "0.1.0",
-    "fileCount": 5,
-    "bytes": 11003,
-    "sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "contentSha256": "f542ca7b8e821d684cf7f71f0930458bd3ad97bc94bf654c88b0f353111e9162",
-    "features": {
-      "required": [
-        "network.byte-streams"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        {
-          "permission": "network.stream",
-          "resources": [
-            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
-          ],
-          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
-        }
-      ]
-    },
-    "package": "database-rfam-readonly.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
-    "previous020Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "changedEntriesFrom020": []
-  },
-  {
-    "name": "host-actions",
-    "id": "com.netcatty.host-actions",
-    "version": "0.1.0",
-    "fileCount": 3,
-    "bytes": 4633,
-    "sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "contentSha256": "d6f8bf3ae9dc417ea838f673966f2e1075fc8f9ef1d939ca85b476b1bb007e6c",
-    "features": {
-      "required": [
-        "vault.host-actions",
-        "commands.interactive"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "menus"
-      ],
-      "optional": [
-        "vault.metadata",
-        "vault.write",
-        "ui.interact"
-      ]
-    },
-    "package": "host-actions.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
-    "previous020Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "changedEntriesFrom020": []
-  },
-  {
-    "name": "terminal-selection-draft",
-    "id": "com.netcatty.terminal-selection-draft",
-    "version": "0.1.0",
-    "fileCount": 2,
-    "bytes": 2954,
-    "sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "contentSha256": "99797d8679f34b96580076f922cbec067e511adc0f4ccf396ed129206acb6c4c",
-    "features": {
-      "required": [
-        "terminal.selection-sharing",
-        "terminal.input-drafts",
-        "commands.interactive"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "menus"
-      ],
-      "optional": [
-        "terminal.selection.read",
-        "terminal.input.propose"
-      ]
-    },
-    "package": "terminal-selection-draft.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "89beeb93749c751f255beb6d0e0f95d23bdd9a7b",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
-    "previous020Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "changedEntriesFrom020": []
-  }
-]

docs/plugin-platform/assistant-native-qa.md

@@ -1,10 +1,5 @@
 # Test the selected Note assistant on an isolated desktop
 
-For the permission-policy/AI acceptance candidate, first use
-[its integration record](policy-ai-integration.md) and exact package manifest.
-The older permission-dialog sequence below is historical baseline evidence;
-apply the current Allow/Ask/Deny semantics when testing the new candidate.
-
 This recipe tests a sandbox plugin against a deterministic loopback provider.
 The provider does not run a model or contact a paid service. The profile contains
 only synthetic data. The parent owns native screenshots and video on the working
@@ -34,9 +29,9 @@ browser runtime entry. It has no Node entry, networking, filesystem, secrets,
 storage, terminal, or command-execution permission. Its `commands` permission
 registers its own view callbacks. It cannot execute terminal commands.
 The six-file artifact at this checkpoint has SHA-256
-`7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274`.
-This replaces the earlier `c7d784d5...` artifact with the sample-only appearance
-update. The host provider cold-start correction remains a separate app change.
+`c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395`.
+This replaces the earlier `c0f73369...` artifact after the selected-Note expiry
+recovery repair.
 
 ## Start the deterministic fixture
 
@@ -124,11 +119,6 @@ Synthetic retry plan: add a retry button and show a connection status label.
     in the dropdown, and click Send yourself. Deny the fresh content permission
     once and cancel text review once before allowing a successful fixture run.
     The draft must survive all steps, and no request may be silently retried.
-14. With the sample idle, switch the host between light and dark and change its
-    accent. The page, controls, muted surfaces, text, focus ring, and Send button
-    must follow the existing view environment tokens without model requests or
-    new permission prompts. Capture both appearances on the same host window.
-    This check does not change or bypass the separately owned permission policy.
 
 The expiry regression in `scripts/plugin-assistant-panel.test.cjs` controls the
 panel and actual host service/selected-context authority clocks and advances past

docs/plugin-platform/global-agent-wip.md

@@ -1,161 +0,0 @@
-# Global Agent plugin bridge (work in progress)
-
-This stack starts from `integration/plugin-ask-routing-acceptance` at
-`2433cf0130d1c3274c56c39e5765349c2945de01`. The parent confirmed this dependency;
-its native Ask acceptance and integrated CI are still pending. This branch does
-not modify the frozen candidate, #3986, #3998, or #4002.
-
-The user approved a global conversation independent of a terminal or workspace,
-with a plugin-provided chat UI and selectable existing Agent backends. Core owns
-Agent execution, history, target authority, native approvals, credentials and
-audit. Global is not unrestricted inventory access or a background service.
-
-## Stage 1: dispatch authority
-
-`electron/plugins/agent/delegatedScope.cjs` is a host-only authority. It does not
-register plugin APIs, start an Agent or implement an orchestration loop.
-
-- `issue(context, hostSnapshot)` authenticates with the existing source binding.
-  Host snapshots contain backend identity/revision, target kind/id/owner/revision,
-  synchronous current-owner checks, and a supported capability subset. The public
-  result contains only an opaque handle and expiry. Plugin parameters must never
-  be used as `hostSnapshot`.
-- `begin(handle, context)` returns an internal turn ticket and AbortController.
-- `dispatch(ticket, context, resolvedAction, execute)` runs the common host policy
-  adapter once, checks current target revisions after any approval wait, invokes
-  the real dispatcher, and rejects late results. `resolvedAction` must come from
-  canonical host capability/argument resolution, not an unchecked plugin object.
-- `assertTurn` guards outgoing events. `finish` and `stop` invalidate the exact
-  ticket. Runtime/plugin release, lock/hide invalidation and shutdown abort work.
-- Handles expire in five minutes. There are at most eight per runtime owner and
-  64 overall, with at most 32 explicit resources per scope. Expiry never silently
-  refreshes a selection or revives an old turn.
-
-The focused tests use the actual `PluginAISourceBinding` with synthetic host
-registries, two terminal owners representing different workspaces, controlled
-time, and deferred approval/native completion. They cover source/runtime/target
-substitution, focus changes, revision changes across approval, policy denial,
-Stop, release, lock, late completion and bounds. They do not yet prove actual MCP
-or AgentRuntime dispatch; those remain integration gates.
-
-Initial execution failed before test discovery because the new worktree has no
-dependencies (`ajv/dist/2020` missing). Running with the existing local worktree's
-read-only CommonJS dependency path passes all 12 cases. No provider, CLI Agent,
-paid credentials or GUI was used.
-
-The adjacent run then passed 49 tests and failed one installed-entrypoint test
-because ESM could not resolve `@netcatty/plugin-cli` from the new worktree. Standard
-`npm ci --ignore-scripts` and `build:plugin-runtime-deps` repaired the setup. These
-failures are setup evidence, not failed-before product regressions.
-
-The core conversation repository stores the existing global `AISession` document
-shape in a host-only directory, namespaced by the hash of source/private-owner.
-Native session identity and compaction remain private. Commits serialize a cloned
-snapshot, revalidate provenance before atomic rename, and retain previous history
-when that check fails. Files use mode 0600 and no-follow reads. The repository
-does not register a plugin storage API or change the source database schema.
-
-The canonical schema and SDK now declare the proposed session interface and
-permissions. Runtime methods and the supported-feature advertisement are not yet
-registered. This stage must not be described as an installable working Agent
-bridge. Focused scope/history/wire and permission-copy tests pass 20 cases;
-contract/SDK/CLI tests pass 91. Focused lint and generated drift checks pass.
-
-## Independent stage-1 correction
-
-The independent review of exact `056164157f34ea779ed6cf51199909082345eca4`
-confirmed two helper defects before any runtime acceptance claim: source failure
-during the initial owner check rejected late work without aborting the active
-native signal; Stop could acquire a replacement turn after awaiting identity.
-
-Both reproduce against that exact helper using the real `PluginAISourceBinding`:
-the focused before run is 13 passed / 2 failed. The correction revokes the captured
-scope when its own host-authenticated identity fails, and captures the intended
-turn before Stop's first await. A foreign runtime cannot use a failed lookup to
-revoke another caller's scope. Focused after: 15 passed / 0 failed. The complete
-foundation/permission group passes 23 on Node 24.19.0 and Node 22.23.3; focused lint
-and diff checks pass. Logs: `/tmp/netcatty-global-agent-review-before.log`,
-`/tmp/netcatty-global-agent-review-after.log`,
-`/tmp/netcatty-global-agent-review-node22.log`.
-
-The first CI run at 0561641, test `40459522087`, Linux job `122040565759`, failed
-after an explicit runner shutdown and operation cancellation, with no assertion
-failure in its log and no complete repository test total. Package workflow
-`40459521971` and both Windows jobs passed. The parent authorized one job rerun;
-it was requested once, producing Linux job `122048349748`, still running at this
-checkpoint. Original runner failure remains historical evidence. Neither that
-rerun nor the helper fix establishes runtime, native or independent-review
-acceptance; the correction still needs reviewer recheck.
-
-### Follow-up: cancellation is not source revocation
-
-The independent recheck confirmed the first two repairs and found a remaining
-Stop race: an aborted Stop(A) RPC could enter the generic owner-failure cleanup
-after B had started, revoking B's scope. The same failure was reproduced at both
-owner-validation await paths using the actual source binding. Exact-18377 source
-with the new 18-case scope suite yields 16 passed / 2 failed; evidence is retained
-in `/tmp/netcatty-global-agent-stop-rpc-exact183-before.log`.
-
-The minimal follow-up distinguishes this request's abort/deadline from verified
-owner or resource failure, rethrows the access failure, and leaves the existing
-turn-capture rule intact. Cancellation of Stop(A) cannot revoke B. A separate
-regression confirms that a verified source mismatch still aborts native work
-even when the RPC is concurrently cancelled. Foreign caller protections remain.
-The full foundation/permission group passes 26 tests on Node 22.23.3 and Node
-24.19.0; focused lint and diff checks pass. Logs:
-`/tmp/netcatty-global-agent-stop-rpc-final.log` and
-`/tmp/netcatty-global-agent-stop-rpc-node22.log`. Independent recheck is pending.
-
-The authorized original-head Linux rerun `122048349748` ended cancelled, with an
-operation-cancelled log and no assertion failure. No second rerun was requested.
-At 18377, test workflow `40462595842`, Linux job `122050816182`, also received an
-explicit runner shutdown; `PluginLogSettings.test.tsx` was SIGKILLed immediately
-afterward. That interrupted stage reports 34 passed / 1 failed, not a complete
-repository total or an assertion failure. Both Windows jobs passed. No blind
-rerun of that job was made. Package workflow `40462595846` was still running when
-checked. These records are not substituted for exact-head green CI.
-
-## Planned public contract and adapters
-
-The proposed feature is `ai.agent-sessions`, with `ai.agent.use` for conversation
-operations and `ai.agent.actions` for actual Agent tool actions. Permission mode
-comes from the existing source-bound Allow/Ask/Deny engine. These are additive
-names, separate from the existing tools-disabled `ai.invoke` broker.
-
-The API will provide backend listing, explicit target selection, owned chat
-listing/opening, sending, bounded event reads, history, Stop and close. Backend
-references are opaque host-issued configuration revisions. Conversation references
-identify only histories owned by the calling source/private-owner; runtime handles
-are separate and cannot substitute builtin chat IDs or native SDK resume IDs.
-Messages cannot supply permissionMode, CLI/env/MCP configuration or owner fields.
-
-Core will reuse `AISession`, `AgentRuntime`, both existing turn drivers, event and
-compaction handling, SDK resume identity validation, and `stopAgentTurn`. The first
-eligible backends are Catty and configured Claude Code in MCP mode. Other backend
-entries must return explicit unsupported/unconfigured status until their native
-tool and approval boundaries are verified. Codex SDK's current unrestricted native
-configuration must not be treated as eligible merely because it has a driver.
-
-The terminal worker already exposes a suitable main-owned resource binding:
-`getPluginSessionBinding(sessionId, ownerWebContentsId)` returns worker epoch and
-session generation. Use this for dispatch-time targets; do not use menu IDs,
-focused tab, display labels, or a renderer-provided session ID as authority.
-
-The MCP dispatcher and Catty direct execution route need the same delegated
-session guard. A delegated call must not update process-global permission mode,
-or request both an Agent approval and a plugin approval for the same action.
-Policy changes, disable/restart/source replacement, lock and host disconnection
-must cancel scoped native work and invalidate outgoing event tickets. Existing
-Agent trace and plugin audit/log facilities will receive redacted correlation
-metadata, not credentials, provider diagnostics or full unreviewed tool payloads.
-
-## Remaining acceptance gates
-
-- Canonical schema/SDK/runtime registration and the installed default host path.
-- Host-owned durable history and backend references, including backend switching.
-- Actual Catty and Claude MCP dispatch, policy and worker lifecycle regressions.
-- Synthetic streaming/cancellation fixtures; these are not real inference or
-  actual authenticated Claude service acceptance.
-- Installable minimal chat UI with backend and explicit target choice.
-- Standard CI, independent review and parent-scheduled native evidence. No GUI
-  ownership, merge or release is granted to this executor.

docs/plugin-platform/permission-modes-acceptance.md

@@ -85,6 +85,32 @@ initial-checkpoint evidence.
 
 ## Latest checks and remaining environment blockers
 
+- The native candidate `2433cf0130d1c3274c56c39e5765349c2945de01` retains the
+  same idle logging-row marker as `89beeb9` (source blob
+  `4dd5a7cea4ae5a6addc5db5c162038d8fa44075c`). Actual Settings landing plus the
+  existing observer reproduces native-child suppression with no dialog open.
+  This source defect is separate from the worker's earlier GPU exit and does
+  not alone establish the cause of the recorded blank native body.
+- The scoped correction removes only the idle-row marker. Actual logging and
+  Ask dialogs remain marked. A real nested verbose confirmation test also
+  reproduced premature restoration when its parent became accessibility-hidden;
+  that confirmation now opts into the existing marker on its own dialog content.
+  The observer, window trust, permissions and data access are unchanged. The real
+  landing regression verifies idle visible, each security dialog hidden, and
+  restored on dismissal. Focused group **six passed**; Settings boundary group
+  **36 passed**. Both pre-fix failures are retained outside the source tree.
+  Production build and full lint pass (zero lint errors/seven existing warnings).
+  Full TypeScript remains baseline-equivalent at 774 diagnostics with zero
+  added/removed. Exact-head CI and the next frozen native recheck are separate
+  gates; neither is inferred from these local tests.
+- QA-only **Settings Ask QA 0.1.0** uses its supported `location: settings` entry
+  and public SDK to read only its synthetic own setting after an explicit click.
+  Exact archive SHA-256:
+  `9502a58a4804862e4b13de9fc0d1baf6ad8c2bc681c08b5c0664b552ef0aafc4`.
+  Its HTML/CSS/JS each return 200 with proper MIME/CSP through the actual plugin
+  protocol. It contains no raw IPC/test hook or external access. No GUI or running
+  app was changed by this correction; parent will build a new frozen candidate
+  after current cleanup and repeat native Settings acceptance.
 - A registered regression reproduces `Plugin permission decision provider failed`
   on exact `79a9bd6` when a Settings-owned view activates a real `settings.get`
   API configured Ask while main is unfocused. The follow-up uses the existing

docs/plugin-platform/policy-ai-integration.md

@@ -1,189 +0,0 @@
-# Permission-policy and AI acceptance candidate
-
-This records frozen 020 and its predecessor evidence. For the later managed-
-window Ask correction, use [the isolated Ask integration record](ask-routing-integration.md).
-020 native Default Allow/Stop/Deny/restore/themes passed; Ask had no visible
-dialog and timed out with zero new model requests. Ask acceptance/cancel and
-the content-read matrix remain unrun until that new candidate is checked.
-
-Use the dedicated `integration/plugin-policy-ai-acceptance` branch. Its Draft PR
-records the exact published head and aggregate CI. Frozen #3997 at
-`677aac33b1eec9dbd4a367417a49c964cdea63e7` remains the historical native baseline;
-neither that branch nor main is changed by this integration.
-
-This is a candidate for parent-coordinated acceptance. It is not a claim of
-completed native acceptance, deployment readiness or permission activation.
-
-## Preserved inputs
-
-| Input | Exact checkpoint | Integration |
-| --- | --- | --- |
-| Frozen integration | `677aac33b1eec9dbd4a367417a49c964cdea63e7` | Starting point; includes stream/source/Host/settings and prior terminal history |
-| Permission policy #4000 | `79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9` | Initial ordinary merge `9aa899059` preserved 2eee561; follow-up ordinary merge `cfa13680e` preserves the authoritative scope/sensitivity copy and tests |
-| AI #3986 | `d33c0193ccaedc1a10aed9da495f040250121bef` | Ordinary merge `5d2ff1cb8`; cold-start wiring, themed sample and Node 22 warning-drain test correction |
-| Terminal production | #3996 `8e7c28fe1bdbcdd76816d33ec926ba8e60eefe64` | Preserve the prior renderer eligibility/publication path; policy-owned interaction changes remain from #4000 |
-
-Diagnostic #3999 and its tests/docs-only `3fdaa357` continuation are not merged.
-No terminal runtime fix is required by the fixture-classification finding.
-Database protocol and fixed SQL remain solely in the minimal examples.
-
-## Direct integration decisions
-
-The initial merge conflict was `components/PluginAIContextHost.test.tsx`. The
-combined test keeps policy's absence of a second native content-sharing review
-and AI's actual main allowlist, two-provider synchronization, streamed result,
-Stop/lock cleanup and empty SDK-error assertion. The Node 22 warning drain is
-retained. The obsolete forced-review cancellation branch is superseded by the
-current in-app Ask/cancellation tests; no transport assertion is dropped.
-
-No production file needed a manual conflict resolution. Policy production files
-remain identical to the policy input; the three AI startup wiring files and
-sample assets remain identical to d33c0193. The stream service/router and prior
-terminal renderer eligibility/publication files are unchanged from frozen 677.
-
-Integration commit `7d8a354404d68071d0924532ffe74c713ace6cb9` updates two stale
-disclosure assertions in `PluginPackageManager.test.tsx` and
-`PluginMarketplace.interaction.test.tsx`. They expected the old words
-`not a grant`; the new assertions require default Allow, Ask/Deny controls and
-retained host validation/resource scope. Existing escaping, advanced-authority,
-source and README-failure assertions remain intact. Production copy is unchanged.
-
-The later authoritative 79a9bd6 policy merge overlapped those two tests. Their
-final contents are byte-identical to 79a9bd6: all three earlier policy assertions
-remain, together with the owner's additional unbounded-resource, sensitivity,
-escaping/source-order and advanced-authority checks. No assertion was dropped.
-This follow-up imports the owner's five-locale wording changes; it makes no
-manual production conflict edit and leaves the shared AI test intact.
-
-## Checks and retained failures
-
-| Local check | Result |
-| --- | --- |
-| Registered runtime | 695 tests: 694 passed, one native skip, zero failed/cancelled |
-| Contract/SDK/CLI | 91 passed |
-| Offline examples | Five passed, one explicit Docker opt-in skip |
-| Serial mounted AI/permission/selected-summary/Host/provider/panel group at 7856 | 31 passed |
-| Final settings, terminal interaction, cold-start host and locale group | 90 passed |
-| Contract/capability/Codex generation and drift | Passed |
-| Full lint | Zero errors, seven existing warnings |
-| Production build | Passed; Vite 35.50 seconds |
-| Five sample archives | Validated; repeat builds byte-identical |
-
-The initial settings group records 34 passes and two failures on the stale copy
-assertions. That run is retained separately from the corrected 36/36 result.
-
-Policy input [test CI 40443396430](https://github.com/binaricat/Netcatty/actions/runs/40443396430)
-first received an explicit runner shutdown. The parent requested one retry;
-this integration task did not duplicate it. Retry Linux job `121992430185`
-passed registered runtime (694/one skip) and examples (five/one skip), then
-failed those same two `not a grant` assertions: settings group 33 passed/two
-failed. It did not reach the full suite. The candidate includes the isolated
-test correction above; do not relabel the input CI as passing. Both input Windows
-jobs and [policy package CI](https://github.com/binaricat/Netcatty/actions/runs/40443396402)
-passed. Parent reports the independent policy correction reviews scoped clean,
-including both P2s and the three UI findings, with 71 focused/synthetic checks.
-
-The policy owner subsequently corrected these tests in predecessor
-`da4e80946d2f3fb48f205aae2a732252b2f51fca`. Its
-[test CI](https://github.com/binaricat/Netcatty/actions/runs/40444934631) passed
-15,342 cases with 50 skipped and no failures/cancellations, and its
-[four-platform package CI](https://github.com/binaricat/Netcatty/actions/runs/40444934738)
-passed. The final 79a9bd6 wording head's
-[test CI](https://github.com/binaricat/Netcatty/actions/runs/40446529092) passed;
-its [package workflow](https://github.com/binaricat/Netcatty/actions/runs/40446529100)
-is tracked separately in the Draft PR. No input retry was duplicated here.
-
-Integration predecessor `7856c664c3c2255a21badef2758bb29311b27a01` passed its
-[test CI](https://github.com/binaricat/Netcatty/actions/runs/40445809589): 15,344
-passed, 50 skipped, zero failed/cancelled, plus both Windows jobs and native
-automated checks. Its [four-platform packages](https://github.com/binaricat/Netcatty/actions/runs/40445809590)
-also passed. These are retained predecessor results; the new exact head needs
-its own aggregate CI.
-
-AI input [test CI](https://github.com/binaricat/Netcatty/actions/runs/40439111241)
-and [package CI](https://github.com/binaricat/Netcatty/actions/runs/40439111215)
-passed. Parent reports its three isolated changes scoped clean. Its prior 9ca
-Node 22 warning-observer failure remains documented in `ai-provider-startup.md`;
-the warning drain does not ignore errors or remove the empty-error assertion.
-Frozen 677's earlier unexplained MCP assertion remains separate history.
-
-This executor used locked dependencies with install scripts disabled, then the
-standard repository dependency patches. The official pinned Electron binary
-installed through its documented proxy support and executes in Node mode.
-No native-header download, alternate mirror, native shim, HOME change or
-sandbox change was used. Normal native postinstall/rebuild, local full-suite
-success and local desktop packaging are not claimed. Exact candidate CI is the
-aggregate full-suite and platform-packaging verification surface.
-
-## Exact packages and provenance
-
-The machine-readable [package record](policy-ai-packages.json) contains complete
-IDs, versions, required features, permission/resource declarations, archive and
-content hashes, and frozen-baseline comparisons. All five versions are 0.1.0.
-
-| Sample | SHA-256 | Comparison with frozen 677 |
-| --- | --- | --- |
-| Assistant | `7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274` | Matches the AI owner's new themed archive; only README.md, panel.css and panel.js differ from 677 |
-| Owned database | `f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874` | Byte-identical |
-| Rfam | `aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3` | Byte-identical |
-| Host actions | `cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2` | Byte-identical |
-| Terminal draft | `4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e` | Byte-identical |
-
-After the authoritative 79 follow-up, all five archives were rebuilt twice,
-validated and compared byte for byte with the 7856 candidate: all five remain
-identical. No sample permission/resource declaration changed. The host's new policy changes
-effective authorization behavior; identical package bytes do not certify that
-new host behavior. The old Assistant c7d784d5 archive remains historical evidence,
-not the themed archive. No handoff archive was activated by this coding executor.
-The owner-identical Assistant README retains earlier permission-review wording;
-use this candidate's Allow/Ask/Deny procedure below for acceptance. That packaged
-copy is a documentation limitation, not a requirement for repeated dialogs.
-
-## Native preparation and remaining gates
-
-Use the exact candidate head from its Draft PR in a separate disposable native
-checkout/profile. Keep normal platform sandbox/helper settings. Build and hash:
-
-```sh
-npm ci
-npm run build
-node examples/plugins/assistant/build.mjs
-node packages/plugin-cli/dist/cli.js pack examples/plugins/assistant/.package --out /tmp/assistant.ncpkg
-node examples/plugins/database-minimal/prepare.mjs tcp://10.77.0.20:3306 /tmp/database-owned.ncpkg
-node examples/plugins/database-rfam-readonly/prepare.mjs tcp://mysql-rfam-public.ebi.ac.uk:4497 /tmp/database-rfam-readonly.ncpkg
-node packages/plugin-cli/dist/cli.js pack examples/plugins/host-actions --out /tmp/host-actions.ncpkg
-node examples/plugins/terminal-selection-draft/prepare.mjs /tmp/terminal-selection-draft.ncpkg
-```
-
-Validate each archive with the plugin CLI and compare against the machine record.
-The owned DB address is packaging-only. A different approved fixture endpoint
-requires a new archive and hash. Preparation does not dial either endpoint.
-
-- Verify default Allow for declared supported capabilities without a mandatory
-  first-install permission checklist or repeated permission-only dialogs. Verify
-  per-plugin Ask/Deny, one scoped Ask receipt, readable host-selected labels,
-  lifecycle invalidation and redacted audit. Preserve necessary target selection
-  and inert draft editing, exact resources, source isolation and sandboxing.
-- Verify the assistant's cold startup through the normal host without opening
-  the AI sidebar. Native inference on frozen 677 returned unavailable; the
-  independent startup regression did not establish that native error's cause.
-  Use only the deterministic synthetic provider and Note recipe, with current
-  policy semantics. Native success is not claimed before that recheck.
-- Frozen 677 Host core passed per parent; old consent recordings describe the
-  prior policy. They do not certify the new permission implementation.
-- Terminal's source-level finding is fixture-sensitive-input fail-closed:
-  `fixture-A> ` is untrusted; `fixture@owned-A:~$ ` is confirmed shell. Parent
-  reports corrected-fixture solo/split core passed on unmodified 677. Focus
-  remained unreliable/unverified, and QA sent one Enter in A during a palette
-  attempt. Do not claim global zero input or full terminal native acceptance.
-  Keep the inert draft's no-PTY-dispatch property distinct from that QA action.
-  Exclude diagnostic instrumentation. Prior-policy results do not certify the
-  new policy; the next native priority is final-policy and cold-start AI QA.
-- Native Rfam's single baseline run failed with sanitized -32014 socket error
-  before connect resolved. Auth/SELECT were not reached; transport causality and
-  auth/TLS compatibility remain unverified. No probe/fallback or restriction
-  change is authorized by this coding task. Owned DB fixture prerequisites and
-  parent coordination remain separate.
-- Record exact head, hashes, ordered prompt/operation outcomes, screenshots and
-  video for the new candidate. Hosting/distribution/deployment remain pending;
-  no main merge, Ready transition or release is part of this handoff.

docs/plugin-platform/policy-ai-packages.json

@@ -1,187 +0,0 @@
-[
-  {
-    "name": "assistant",
-    "id": "com.netcatty.assistant",
-    "version": "0.1.0",
-    "fileCount": 6,
-    "bytes": 17214,
-    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
-    "contentSha256": "c3e31e9613422bf9a05ccaa5b6f234304208f1a8298b1c1ee19262ba88af6cd0",
-    "features": {
-      "required": [
-        "ai.model-invocation",
-        "context.selected-read"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        "ai.invoke",
-        "context.selected.list",
-        "context.selected.read"
-      ]
-    },
-    "package": "assistant.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395",
-    "changedEntriesFromFrozen677": [
-      "README.md",
-      "panel.css",
-      "panel.js"
-    ],
-    "previous7856Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef"
-  },
-  {
-    "name": "database-owned",
-    "id": "com.netcatty.database-minimal",
-    "version": "0.1.0",
-    "fileCount": 5,
-    "bytes": 11660,
-    "sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "contentSha256": "4d628c41c7a231e31cd56dacb822acaaa37f61e1e98b285b0086a4f783be199d",
-    "features": {
-      "required": [
-        "network.byte-streams"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        {
-          "permission": "network.stream",
-          "resources": [
-            "tcp://10.77.0.20:3306"
-          ],
-          "reason": "Connect only to the prepared disposable fixture."
-        }
-      ]
-    },
-    "package": "database-owned.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef"
-  },
-  {
-    "name": "database-rfam-readonly",
-    "id": "com.netcatty.database-rfam-readonly",
-    "version": "0.1.0",
-    "fileCount": 5,
-    "bytes": 11003,
-    "sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "contentSha256": "f542ca7b8e821d684cf7f71f0930458bd3ad97bc94bf654c88b0f353111e9162",
-    "features": {
-      "required": [
-        "network.byte-streams"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "views"
-      ],
-      "optional": [
-        {
-          "permission": "network.stream",
-          "resources": [
-            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
-          ],
-          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
-        }
-      ]
-    },
-    "package": "database-rfam-readonly.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef"
-  },
-  {
-    "name": "host-actions",
-    "id": "com.netcatty.host-actions",
-    "version": "0.1.0",
-    "fileCount": 3,
-    "bytes": 4633,
-    "sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "contentSha256": "d6f8bf3ae9dc417ea838f673966f2e1075fc8f9ef1d939ca85b476b1bb007e6c",
-    "features": {
-      "required": [
-        "vault.host-actions",
-        "commands.interactive"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "menus"
-      ],
-      "optional": [
-        "vault.metadata",
-        "vault.write",
-        "ui.interact"
-      ]
-    },
-    "package": "host-actions.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef"
-  },
-  {
-    "name": "terminal-selection-draft",
-    "id": "com.netcatty.terminal-selection-draft",
-    "version": "0.1.0",
-    "fileCount": 2,
-    "bytes": 2954,
-    "sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "contentSha256": "99797d8679f34b96580076f922cbec067e511adc0f4ccf396ed129206acb6c4c",
-    "features": {
-      "required": [
-        "terminal.selection-sharing",
-        "terminal.input-drafts",
-        "commands.interactive"
-      ]
-    },
-    "permissions": {
-      "required": [
-        "commands",
-        "menus"
-      ],
-      "optional": [
-        "terminal.selection.read",
-        "terminal.input.propose"
-      ]
-    },
-    "package": "terminal-selection-draft.ncpkg",
-    "repeatIdentical": true,
-    "preparedOnlyInThisExecutor": true,
-    "previousFrozen677Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "changedEntriesFromFrozen677": [],
-    "previous7856Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
-    "changedEntriesFrom7856": [],
-    "rebuiltAgainstPolicy": "79a9bd6df1c17fd8a5238aba31d7a8b4cda184b9",
-    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef"
-  }
-]

docs/plugin-platform/security-and-permissions.md

@@ -47,6 +47,9 @@ focus handoff is needed. Close, cancel, timeout, lock, hide/blur, reload, crash
 and stale runtime/source fail closed. The dialog uses the existing host security
 surface marker so attached native plugin views yield while it is visible and
 restore through their existing lifecycle on dismissal.
+Ordinary landing rows do not suspend native views. The logging dialog and its
+verbose confirmation are marked security surfaces; the confirmation opts into
+the existing marker because it temporarily accessibility-hides its parent dialog.
 A plugin DOM click never becomes a host gesture. Choosers, drafts, terminal and
 clipboard sharing use their existing host-owned action tokens. Ask integrates
 with that workflow instead of opening a second capability dialog. Allow skips

domain/pluginPermissionDescriptions.cjs

@@ -3,8 +3,6 @@
 // Presentation only. Admission and grants remain owned by the canonical schema
 // and permission engine. Tests require exact coverage of its permission enum.
 const PERMISSION_DESCRIPTIONS = {
-  "ai.agent.use": [true, "Agent conversations", "Use configured host Agents and read this plugin's own chat history. Model or Agent service usage may incur costs.", "Agent 会话", "使用宿主已配置的 Agent，并读取此插件自己的聊天历史；模型或 Agent 服务可能产生费用。"],
-  "ai.agent.actions": [true, "Agent actions", "Authorize Agent tools against explicitly selected targets under this plugin's policy. Commands can change remote systems.", "Agent 操作", "根据插件策略授权 Agent 工具操作明确选中的目标；命令可能更改远程系统。"],
   storage: [false, "Plugin storage", "Save and read this plugin's local data.", "插件存储", "保存和读取此插件自己的本地数据。"],
   "runtime.advanced": [true, "Full device access", "Run Node code with filesystem and network access outside broker restrictions. Developer mode only.", "完整设备访问", "运行 Node 代码，可直接访问文件系统和网络，不受代理权限限制。仅限开发者模式。"],
   "settings.read": [false, "Read plugin settings", "Read this plugin's configured preferences.", "读取插件设置", "读取此插件自己的设置。"],

electron/plugins/agent/contract.test.cjs

@@ -1,47 +0,0 @@
-"use strict";
-
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const { randomUUID } = require("node:crypto");
-const { createDefinitionValidator } = require("../contractValidator.cjs");
-
-test("Agent wire accepts only opaque host configuration/scope refs, never raw backend authority", () => {
-  const open = createDefinitionValidator("PluginAgentOpenParams");
-  const params = { backendRef: randomUUID(), selectionHandle: randomUUID() };
-  assert.equal(open(params), true);
-  for (const [key, value] of Object.entries({ permissionMode: "auto", owner: "source:forged", privateOwner: "forged",
-    source: "official", model: "chosen", agentId: "claude", apiKey: "synthetic-not-a-key", cli: "node",
-    env: {}, mcpServers: {}, sessionIds: ["focused-session"], externalSessionId: "native-session" })) {
-    assert.equal(open({ ...params, [key]: value }), false, key);
-  }
-  for (const key of ["backendRef", "selectionHandle", "conversationRef"]) {
-    assert.equal(open({ ...params, [key]: "internal-or-path-id" }), false, key);
-  }
-});
-
-test("Agent messages and events are bounded and do not serialize raw tools/configuration", () => {
-  const send = createDefinitionValidator("PluginAgentSendParams");
-  const params = { chatHandle: randomUUID(), text: "Synthetic user instruction" };
-  assert.equal(send(params), true);
-  assert.equal(send({ ...params, text: "x".repeat(16_385) }), false);
-  assert.equal(send({ ...params, text: "a\0b" }), false);
-  assert.equal(send({ ...params, turnId: "builtin" }), false);
-  const event = createDefinitionValidator("PluginAgentEvent");
-  assert.equal(event({ kind: "activity", capabilityId: "terminal.execute", state: "started" }), true);
-  assert.equal(event({ kind: "activity", capabilityId: "terminal.execute", state: "started", args: { command: "raw" } }), false);
-  assert.equal(event({ kind: "usage", inputTokens: 2, outputTokens: 4 }), true);
-  assert.equal(event({ kind: "usage", inputTokens: -1, outputTokens: 4 }), false);
-  assert.equal(event({ kind: "text", text: "x".repeat(4097) }), false);
-  assert.equal(event({ kind: "provider-error", message: "private diagnostics" }), false);
-});
-
-test("public chat/history summaries do not contain backend/native identifiers, prompts or tool results", () => {
-  const chats = createDefinitionValidator("PluginAgentChatsResult");
-  const chat = { conversationRef: randomUUID(), title: "Synthetic chat", backend: "claude", updatedAt: 1 };
-  assert.equal(chats({ items: [chat] }), true);
-  assert.equal(chats({ items: [{ ...chat, externalSessionId: "native" }] }), false);
-  const history = createDefinitionValidator("PluginAgentHistoryResult");
-  assert.equal(history({ items: [{ role: "assistant", text: "Summary" }] }), true);
-  assert.equal(history({ items: [{ role: "tool", text: "Raw tool result" }] }), false);
-  assert.equal(history({ items: [{ role: "assistant", text: "Summary", apiKey: "synthetic" }] }), false);
-});

electron/plugins/agent/conversationStore.cjs

@@ -1,122 +0,0 @@
-"use strict";
-
-const fs = require("node:fs/promises");
-const path = require("node:path");
-const { createHash, randomUUID } = require("node:crypto");
-
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
-const MAX_BYTES = 1_048_576;
-const MAX_CONVERSATIONS = 64;
-
-// Core-owned AISession documents, outside plugin filesystem/storage roots.
-// The caller must authenticate provenance before supplying the opaque owner.
-// Native resume identity, compaction and tool history stay in this repository;
-// only a separate public projection is returned through the plugin API.
-class PluginAgentConversationStore {
-  constructor(directory) {
-    if (!path.isAbsolute(directory)) throw new TypeError("Absolute host history directory required");
-    this.directory = directory;
-    this.pending = new Map();
-  }
-
-  #ownerDirectory(owner) {
-    if (!owner || typeof owner.privateOwner !== "string" || !owner.privateOwner
-      || typeof owner.sourceKey !== "string" || !owner.sourceKey) throw new TypeError("Host provenance required");
-    return path.join(this.directory, createHash("sha256").update(JSON.stringify([owner.sourceKey, owner.privateOwner])).digest("hex"));
-  }
-
-  #filename(owner, id) {
-    if (typeof id !== "string" || !UUID.test(id)) throw new TypeError("Invalid owned conversation reference");
-    return path.join(this.#ownerDirectory(owner), `${id}.json`);
-  }
-
-  async #prepare(owner) {
-    await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });
-    if (!(await fs.lstat(this.directory)).isDirectory() || (await fs.lstat(this.directory)).isSymbolicLink()) throw Error("History root unavailable");
-    const directory = this.#ownerDirectory(owner);
-    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
-    const stat = await fs.lstat(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("History owner unavailable");
-    return directory;
-  }
-
-  #validate(record) {
-    if (!record || typeof record !== "object" || !UUID.test(record.conversationRef)
-      || typeof record.id !== "string" || !record.id.startsWith("plugin-agent:")
-      || record.scope?.type !== "global" || record.scope.targetId !== undefined
-      || typeof record.agentId !== "string" || typeof record.title !== "string" || record.title.length > 160
-      || !Array.isArray(record.messages) || record.messages.length > 200
-      || !Number.isSafeInteger(record.createdAt) || !Number.isSafeInteger(record.updatedAt)) throw new TypeError("Invalid core Agent history");
-    const text = JSON.stringify(record);
-    if (Buffer.byteLength(text) > MAX_BYTES) throw new RangeError("Agent history budget exceeded");
-    return text;
-  }
-
-  async #serial(owner, operation) {
-    const key = this.#ownerDirectory(owner);
-    const previous = this.pending.get(key) ?? Promise.resolve();
-    const current = previous.catch(() => {}).then(operation);
-    this.pending.set(key, current);
-    try { return await current; }
-    finally { if (this.pending.get(key) === current) this.pending.delete(key); }
-  }
-
-  async list(owner, assertCurrent) {
-    await assertCurrent();
-    const directory = await this.#prepare(owner);
-    const files = await fs.readdir(directory);
-    const records = [];
-    for (const file of files) {
-      const id = file.slice(0, -5);
-      if (!file.endsWith(".json") || !UUID.test(id)) continue;
-      if (records.length >= MAX_CONVERSATIONS) break;
-      const record = await this.read(owner, id, assertCurrent);
-      if (record) records.push(record);
-    }
-    await assertCurrent();
-    return records.sort((a, b) => b.updatedAt - a.updatedAt);
-  }
-
-  async read(owner, id, assertCurrent) {
-    await assertCurrent();
-    const filename = this.#filename(owner, id);
-    await this.#prepare(owner);
-    let file;
-    try {
-      // O_NOFOLLOW avoids following a replaced final path. Core owns ancestors.
-      const { constants } = require("node:fs");
-      file = await fs.open(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-      const stat = await file.stat();
-      if (!stat.isFile() || stat.size > MAX_BYTES) throw Error("Agent history unavailable");
-      const record = JSON.parse(await file.readFile("utf8"));
-      this.#validate(record);
-      if (record.conversationRef !== id) throw Error("Agent history identity mismatch");
-      await assertCurrent();
-      return record;
-    } catch (error) {
-      if (error.code === "ENOENT") { await assertCurrent(); return null; }
-      throw error;
-    } finally { await file?.close(); }
-  }
-
-  async save(owner, record, assertCurrent) {
-    // Clone/serialize before any await so caller mutation cannot change commit.
-    const text = this.#validate(record);
-    const id = record.conversationRef;
-    return this.#serial(owner, async () => {
-      await assertCurrent();
-      const directory = await this.#prepare(owner);
-      const filename = this.#filename(owner, id);
-      const entries = (await fs.readdir(directory)).filter((name) => name.endsWith(".json"));
-      if (!entries.includes(`${id}.json`) && entries.length >= MAX_CONVERSATIONS) throw new RangeError("Agent conversation budget exceeded");
-      const temporary = path.join(directory, `.${randomUUID()}.tmp`);
-      try {
-        await fs.writeFile(temporary, text, { encoding: "utf8", mode: 0o600, flag: "wx" });
-        await assertCurrent();
-        await fs.rename(temporary, filename);
-      } finally { await fs.rm(temporary, { force: true }); }
-    });
-  }
-}
-
-module.exports = { PluginAgentConversationStore };

electron/plugins/agent/conversationStore.test.cjs

@@ -1,68 +0,0 @@
-"use strict";
-
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs/promises");
-const os = require("node:os");
-const path = require("node:path");
-const { randomUUID } = require("node:crypto");
-const { PluginAgentConversationStore } = require("./conversationStore.cjs");
-
-const owner = (source) => ({ privateOwner: `opaque:${source}:same-plugin-id`, sourceKey: `source:${source}` });
-const current = async () => {};
-function record() {
-  const conversationRef = randomUUID();
-  return { conversationRef, id: `plugin-agent:${randomUUID()}`, title: "Synthetic chat", agentId: "catty",
-    scope: { type: "global" }, messages: [{ id: randomUUID(), role: "user", content: "Synthetic only", timestamp: 1 }], createdAt: 1, updatedAt: 1 };
-}
-async function fixture(t) {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-agent-history-test-"));
-  t.after(() => fs.rm(root, { recursive: true, force: true }));
-  return { root, store: new PluginAgentConversationStore(path.join(root, "core-history")) };
-}
-
-test("core history survives reopening, uses existing AISession shape and isolates the same plugin ID across sources", async (t) => {
-  const { root, store } = await fixture(t); const chat = record();
-  await store.save(owner("a"), chat, current);
-  assert.deepEqual(await store.read(owner("a"), chat.conversationRef, current), chat);
-  const [directory] = await fs.readdir(path.join(root, "core-history"));
-  assert.doesNotMatch(directory, /opaque|same-plugin/);
-  const mode = (await fs.stat(path.join(root, "core-history", directory, `${chat.conversationRef}.json`))).mode;
-  if (process.platform !== "win32") assert.equal(mode & 0o777, 0o600);
-  assert.equal(await store.read(owner("b"), chat.conversationRef, current), null);
-  assert.deepEqual(await store.list(owner("b"), current), []);
-  const reopened = new PluginAgentConversationStore(path.join(root, "core-history"));
-  assert.deepEqual(await reopened.list(owner("a"), current), [chat]);
-});
-
-test("source revoked before async rename leaves previous history intact and cleans temporary files", async (t) => {
-  const { store, root } = await fixture(t); const chat = record(); await store.save(owner("a"), chat, current);
-  const next = { ...chat, title: "Must not commit" }; let checks = 0;
-  await assert.rejects(store.save(owner("a"), next, async () => { if (++checks === 2) throw Error("Revoked"); }));
-  assert.equal((await store.read(owner("a"), chat.conversationRef, current)).title, chat.title);
-  const [directory] = await fs.readdir(path.join(root, "core-history"));
-  assert.deepEqual(await fs.readdir(path.join(root, "core-history", directory)), [`${chat.conversationRef}.json`]);
-});
-
-test("history snapshots cannot mutate across await, and traversal/builtin IDs/oversized records are rejected", async (t) => {
-  const { store } = await fixture(t); const chat = record(); const savedTitle = chat.title;
-  const saved = store.save(owner("a"), chat, current); chat.title = "Changed after call"; await saved;
-  assert.equal((await store.read(owner("a"), chat.conversationRef, current)).title, savedTitle);
-  for (const id of ["../outside", "builtin-chat", "source:owner", ""]) await assert.rejects(store.read(owner("a"), id, current));
-  await assert.rejects(store.save({ privateOwner: "bare-plugin" }, record(), current));
-  await assert.rejects(store.save(owner("a"), { ...record(), id: "builtin-chat" }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), scope: { type: "workspace", targetId: "active" } }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), messages: Array(201).fill({}) }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), messages: [{ content: "x".repeat(1_048_576) }] }, current));
-});
-
-test("symlinked history roots and files do not become history authority", async (t) => {
-  const { root, store } = await fixture(t); const chat = record(); await store.save(owner("a"), chat, current);
-  const history = path.join(root, "core-history"); const [directory] = await fs.readdir(history);
-  const filename = path.join(history, directory, `${chat.conversationRef}.json`);
-  const unrelated = path.join(root, "unrelated.json"); await fs.writeFile(unrelated, JSON.stringify(chat));
-  await fs.rm(filename); await fs.symlink(unrelated, filename);
-  await assert.rejects(store.read(owner("a"), chat.conversationRef, current));
-  const linked = path.join(root, "linked"); await fs.symlink(history, linked, "dir");
-  await assert.rejects(new PluginAgentConversationStore(linked).list(owner("a"), current));
-});

electron/plugins/agent/delegatedScope.cjs

@@ -1,180 +0,0 @@
-"use strict";
-
-const { randomUUID } = require("node:crypto");
-const { PluginRpcError, RPC_ERRORS } = require("../rpcRouter.cjs");
-
-const fail = (code) => new PluginRpcError(RPC_ERRORS[code], "Delegated Agent scope is unavailable");
-const key = (target) => JSON.stringify([target.kind, target.id]);
-const isRequestCancellation = (error, context) => context.signal?.aborted === true
-  && (error === context.signal.reason || error?.name === "AbortError" || error?.name === "TimeoutError"
-    || error?.code === RPC_ERRORS.cancelled || error?.code === RPC_ERRORS.deadlineExceeded);
-
-// Host-only authority, not a plugin RPC interface or an Agent engine. The host
-// supplies snapshots after resolving configured backends and choosing targets.
-// Plugins never supply owner, revision, capability policy or executable adapters.
-class DelegatedAgentScopes {
-  constructor({ resolveOwner, assertHostActive, authorizeAction, clock = Date.now }) {
-    for (const fn of [resolveOwner, assertHostActive, authorizeAction, clock]) {
-      if (typeof fn !== "function") throw new TypeError("Host scope adapters are required");
-    }
-    this.resolveOwner = resolveOwner;
-    this.assertHostActive = assertHostActive;
-    this.authorizeAction = authorizeAction;
-    this.clock = clock;
-    this.scopes = new Map();
-    this.closed = false;
-  }
-
-  async #owner(context) {
-    if (this.closed) throw fail("unavailable");
-    const owner = await this.resolveOwner(context);
-    await this.assertHostActive(context);
-    context.signal?.throwIfAborted();
-    if (this.closed || await this.resolveOwner(context) !== owner) throw fail("permissionDenied");
-    return owner;
-  }
-
-  // The snapshot is host-owned. A public schema must only accept returned handles.
-  async issue(context, { backend, targets, capabilities }) {
-    const owner = await this.#owner(context);
-    if (!backend || typeof backend.key !== "string" || typeof backend.revision !== "string"
-      || typeof backend.isCurrent !== "function" || !Array.isArray(targets) || targets.length > 32
-      || !Array.isArray(capabilities) || capabilities.length > 128
-      || capabilities.some((id) => typeof id !== "string" || !id || id.length > 160)) throw fail("invalidArgument");
-    const captured = new Map();
-    for (const target of targets) {
-      if (!target || !["terminal", "host", "note"].includes(target.kind)
-        || typeof target.id !== "string" || !target.id || target.id.length > 256
-        || typeof target.revision !== "string" || !target.revision
-        || typeof target.owner !== "string" || !target.owner
-        || typeof target.isCurrent !== "function" || captured.has(key(target))) throw fail("invalidArgument");
-      captured.set(key(target), Object.freeze({ ...target }));
-    }
-    const scope = { handle: randomUUID(), owner, backend: Object.freeze({ ...backend }), targets: captured,
-      capabilities: new Set(capabilities), expiresAt: this.clock() + 300_000, activeTurn: null };
-    this.#assertSnapshots(scope);
-    if (await this.#owner(context) !== owner) throw fail("permissionDenied");
-    this.#assertSnapshots(scope);
-    for (const entry of this.scopes.values()) if (entry.expiresAt <= this.clock()) this.#revoke(entry);
-    const existing = [...this.scopes.values()].filter((entry) => entry.owner === owner);
-    if (existing.length >= 8 || this.scopes.size >= 64) throw fail("resourceExhausted");
-    this.scopes.set(scope.handle, scope);
-    return Object.freeze({ handle: scope.handle, expiresAt: scope.expiresAt });
-  }
-
-  #assertSnapshots(scope) {
-    // Current-owner/revision checks are synchronous registry lookups, so the
-    // final dispatch check and native call have no asynchronous focus gap.
-    if (scope.backend.isCurrent(scope.backend) !== true) throw fail("failedPrecondition");
-    for (const target of scope.targets.values()) {
-      if (target.isCurrent(target) !== true) throw fail("failedPrecondition");
-    }
-  }
-
-  async #resolve(handle, context) {
-    const scope = this.scopes.get(handle);
-    let owner;
-    try { owner = await this.#owner(context); }
-    catch (error) {
-      // Context identity comes from the authenticated host transport. Revoke
-      // only its own captured scope, never a victim referenced by another caller.
-      if (!isRequestCancellation(error, context) && scope && scope.owner.runtimeId === context.runtimeId && scope.owner.pluginId === context.pluginId
-        && scope.owner.pluginVersion === context.pluginVersion) this.#revoke(scope);
-      throw error;
-    }
-    if (!scope || scope.owner !== owner) throw fail("permissionDenied");
-    if (scope.expiresAt <= this.clock()) { this.#revoke(scope); throw fail("permissionDenied"); }
-    try {
-      if (await this.#owner(context) !== owner || this.scopes.get(handle) !== scope
-        || scope.expiresAt <= this.clock()) throw fail("permissionDenied");
-      this.#assertSnapshots(scope);
-    } catch (error) {
-      // A failed individual RPC has no authority to revoke another turn. Real
-      // owner/target failure still invalidates the scope, even if a request also
-      // happens to be cancelled at that time.
-      if (!isRequestCancellation(error, context)) this.#revoke(scope);
-      throw error;
-    }
-    return scope;
-  }
-
-  async begin(handle, context) {
-    const scope = await this.#resolve(handle, context);
-    if (scope.activeTurn) throw fail("alreadyExists");
-    const ticket = Object.freeze({ scope, controller: new AbortController(), id: randomUUID() });
-    scope.activeTurn = ticket;
-    return ticket;
-  }
-
-  async assertTurn(ticket, context) {
-    if (!ticket?.scope || ticket.controller.signal.aborted) throw fail("cancelled");
-    const scope = await this.#resolve(ticket.scope.handle, context);
-    if (scope.activeTurn !== ticket) throw fail("cancelled");
-    ticket.controller.signal.throwIfAborted();
-    return scope;
-  }
-
-  // Called inside the actual tool dispatcher, after canonical argument/target
-  // resolution. It must not be used merely when displaying the model tool list.
-  async dispatch(ticket, context, action, execute) {
-    const scope = await this.assertTurn(ticket, context);
-    if (!action || !scope.capabilities.has(action.capabilityId) || !Array.isArray(action.targets)
-      || action.targets.length > 32 || typeof execute !== "function") throw fail("permissionDenied");
-    const targets = action.targets.map((target) => {
-      const captured = target && scope.targets.get(key(target));
-      if (!captured || target.revision !== captured.revision || target.owner !== captured.owner) throw fail("permissionDenied");
-      return captured;
-    });
-    const request = Object.freeze({ capabilityId: action.capabilityId, targets: Object.freeze(targets) });
-    // The adapter combines plugin policy and native Agent restrictions once.
-    // No caller can select a process-global permission mode through this API.
-    await this.authorizeAction(context, scope.owner, request, ticket.controller.signal);
-    await this.assertTurn(ticket, context);
-    this.#assertSnapshots(scope);
-    ticket.controller.signal.throwIfAborted();
-    const result = await execute(Object.freeze({ signal: ticket.controller.signal,
-      assertCurrent: () => this.assertTurn(ticket, context) }));
-    await this.assertTurn(ticket, context);
-    return result;
-  }
-
-  finish(ticket) {
-    if (!ticket || ticket.scope?.activeTurn !== ticket) return false;
-    ticket.scope.activeTurn = null;
-    ticket.controller.abort();
-    return true;
-  }
-
-  async stop(handle, context) {
-    // Capture before the first await. A prior Stop cannot acquire authority over
-    // a turn that replaces the one the caller intended to stop.
-    const candidate = this.scopes.get(handle);
-    const ticket = candidate?.activeTurn;
-    const scope = await this.#resolve(handle, context);
-    return scope === candidate ? this.finish(ticket) : false;
-  }
-
-  #revoke(scope) {
-    this.finish(scope.activeTurn);
-    this.scopes.delete(scope.handle);
-  }
-
-  releaseRuntime(runtimeId) {
-    for (const scope of this.scopes.values()) if (scope.owner.runtimeId === runtimeId) this.#revoke(scope);
-  }
-
-  releasePlugin(pluginId) {
-    for (const scope of this.scopes.values()) if (scope.owner.pluginId === pluginId) this.#revoke(scope);
-  }
-
-  releaseAll() {
-    for (const scope of this.scopes.values()) this.#revoke(scope);
-  }
-
-  shutdown() {
-    this.closed = true;
-    this.releaseAll();
-  }
-}
-
-module.exports = { DelegatedAgentScopes };

electron/plugins/agent/delegatedScope.test.cjs

@@ -1,229 +0,0 @@
-"use strict";
-
-const assert = require("node:assert/strict");
-const test = require("node:test");
-const { DelegatedAgentScopes } = require("./delegatedScope.cjs");
-const { PluginAISourceBinding } = require("../ai/sourceBinding.cjs");
-
-function deferred() {
-  let resolve;
-  const promise = new Promise((finish) => { resolve = finish; });
-  return { promise, resolve };
-}
-
-function fixture() {
-  let time = 1; let locked = false; let focus = "terminal-a";
-  let source = { id: "source-a", kind: "third-party", origin: "https://example.invalid" };
-  let privateOwner = "source:opaque-owner-a:com.example.assistant";
-  let identity = { pluginId: "com.example.assistant", pluginVersion: "1", runtimeId: "r1", runtimeKind: "browser" };
-  let authorize = async () => {};
-  const context = { ...identity, assertActive: async () => {} };
-  const database = {
-    getActivePlugin: () => ({ source, enabled: true, activeVersion: "1", runtime: { status: "running" } }),
-    getRetainedPluginSource: () => source,
-    privateOwner: () => privateOwner,
-    publicPluginId: (value) => value === privateOwner ? identity.pluginId : null,
-  };
-  const binding = new PluginAISourceBinding({ database, getRuntimeIdentity: () => identity });
-  let backendRevision = "configured-1";
-  const currentTargets = new Map([
-    ["terminal-a", { owner: "window-1", revision: "session-a-v1" }],
-    ["terminal-b", { owner: "window-2", revision: "session-b-v1" }],
-  ]);
-  const backend = { key: "host-configured-claude", revision: backendRevision,
-    isCurrent: (snapshot) => snapshot.revision === backendRevision };
-  const target = (id) => ({ kind: "terminal", id, ...currentTargets.get(id),
-    isCurrent: (snapshot) => { const current = currentTargets.get(snapshot.id);
-      return current?.owner === snapshot.owner && current?.revision === snapshot.revision; } });
-  const scopes = new DelegatedAgentScopes({ resolveOwner: (ctx) => binding.resolve(ctx),
-    assertHostActive: async () => { if (locked) throw Error("Locked"); },
-    authorizeAction: (...args) => authorize(...args), clock: () => time });
-  return { scopes, context, target, targets: currentTargets, database,
-    issue: (targets = [target("terminal-a"), target("terminal-b")]) => scopes.issue(context,
-      { backend, targets, capabilities: ["terminal.execute", "session.environment"] }),
-    action: (id = "terminal-a") => ({ capabilityId: "terminal.execute", targets: [target(id)] }),
-    tick: (ms) => { time += ms; }, lock: () => { locked = true; scopes.releaseAll(); },
-    focusTo: (id) => { focus = id; }, focus: () => focus,
-    authorize: (fn) => { authorize = fn; }, backendTo: (value) => { backendRevision = value; },
-    replaceSource: () => { source = { ...source, id: "source-b" }; privateOwner = "source:opaque-owner-b:com.example.assistant"; },
-    runtimeTo: (id) => { identity = { ...identity, runtimeId: id }; },
-  };
-}
-
-test("host-issued scope exposes only opaque identity and expiry; cross-workspace focus does not change explicit targets", async () => {
-  const f = fixture(); const ref = await f.issue();
-  assert.deepEqual(Object.keys(ref).sort(), ["expiresAt", "handle"]);
-  assert.doesNotMatch(JSON.stringify(ref), /window-|terminal-|source:|configured/);
-  const ticket = await f.scopes.begin(ref.handle, f.context);
-  f.focusTo("unselected-terminal");
-  let calls = 0;
-  assert.equal(await f.scopes.dispatch(ticket, f.context, f.action("terminal-b"), async () => ++calls), 1);
-  assert.equal(f.focus(), "unselected-terminal");
-  await assert.rejects(f.scopes.dispatch(ticket, f.context,
-    { capabilityId: "terminal.execute", targets: [{ kind: "terminal", id: f.focus(), revision: "1", owner: "window-1" }] }, async () => ++calls));
-  assert.equal(calls, 1);
-});
-
-test("forged runtime, cross-runtime session and source replacement cannot use a scope", async () => {
-  const f = fixture(); const ref = await f.issue();
-  await assert.rejects(f.scopes.begin(ref.handle, { ...f.context, runtimeId: "forged" }));
-  f.runtimeTo("r2");
-  await assert.rejects(f.scopes.begin(ref.handle, { ...f.context, runtimeId: "r2" }));
-  f.runtimeTo("r1"); f.replaceSource();
-  await assert.rejects(f.scopes.begin(ref.handle, f.context));
-});
-
-test("one host policy decision; target owner/revision is revalidated after approval waits", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let decisions = 0; let effects = 0;
-  f.authorize(async (_context, owner, action) => {
-    decisions++; assert.equal(owner.privateOwner, "source:opaque-owner-a:com.example.assistant");
-    assert.equal(action.targets[0].id, "terminal-a"); entered.resolve(); await release.promise;
-  });
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++);
-  await entered.promise;
-  f.targets.set("terminal-a", { owner: "new-window", revision: "session-a-v2" });
-  release.resolve(); await assert.rejects(result);
-  assert.equal(decisions, 1); assert.equal(effects, 0); assert.equal(ticket.controller.signal.aborted, true);
-});
-
-test("copied target ID with substituted owner or revision and undelegated capabilities fail before policy/execute", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  let decisions = 0; let effects = 0; f.authorize(async () => { decisions++; });
-  for (const patch of [{ owner: "attacker" }, { revision: "old" }]) {
-    await assert.rejects(f.scopes.dispatch(ticket, f.context,
-      { capabilityId: "terminal.execute", targets: [{ ...f.target("terminal-a"), ...patch }] }, async () => effects++));
-  }
-  await assert.rejects(f.scopes.dispatch(ticket, f.context,
-    { capabilityId: "vault.host.delete", targets: [] }, async () => effects++));
-  assert.equal(decisions, 0); assert.equal(effects, 0);
-});
-
-test("Deny and revoked source during authorization never dispatch a tool", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  let effects = 0;
-  f.authorize(async () => { throw Error("Denied"); });
-  await assert.rejects(f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++));
-  f.authorize(async () => { f.replaceSource(); });
-  await assert.rejects(f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++));
-  assert.equal(effects, 0);
-});
-
-test("Stop while approval waits cancels the exact turn and prevents invocation", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let effects = 0;
-  f.authorize(async (_context, _owner, _action, signal) => {
-    assert.equal(signal, ticket.controller.signal); entered.resolve(); await release.promise;
-  });
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++);
-  await entered.promise; assert.equal(await f.scopes.stop(ref.handle, f.context), true);
-  release.resolve(); await assert.rejects(result); assert.equal(effects, 0);
-  const next = await f.scopes.begin(ref.handle, f.context);
-  assert.equal(f.scopes.finish(ticket), false); assert.equal(next.controller.signal.aborted, false);
-});
-
-for (const reason of ["runtime", "plugin", "lock", "stop"]) {
-  test(`${reason} cancellation drops late native results and invalidates the old event ticket`, async () => {
-    const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-    const entered = deferred(); const release = deferred();
-    const result = f.scopes.dispatch(ticket, f.context, f.action(), async ({ signal }) => {
-      assert.equal(signal, ticket.controller.signal); entered.resolve(); await release.promise; return "late";
-    });
-    await entered.promise;
-    if (reason === "runtime") f.scopes.releaseRuntime(f.context.runtimeId);
-    else if (reason === "plugin") f.scopes.releasePlugin(f.context.pluginId);
-    else if (reason === "lock") f.lock();
-    else await f.scopes.stop(ref.handle, f.context);
-    release.resolve(); await assert.rejects(result); await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-    assert.equal(ticket.controller.signal.aborted, true);
-  });
-}
-
-test("backend config changes and expiry invalidate scopes; host snapshots cannot silently refresh them", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  f.backendTo("new-config"); await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-  assert.equal(ticket.controller.signal.aborted, true);
-  const g = fixture(); const next = await g.issue(); const active = await g.scopes.begin(next.handle, g.context);
-  g.tick(300_000); await assert.rejects(g.scopes.assertTurn(active, g.context));
-  assert.equal(active.controller.signal.aborted, true); assert.equal(g.scopes.scopes.size, 0);
-});
-
-test("source replacement detected during owner authentication aborts already-running native work", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred();
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async ({ signal }) => {
-    entered.resolve(signal); await release.promise; return "late native result";
-  });
-  const signal = await entered.promise;
-  try {
-    f.replaceSource();
-    await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-    assert.equal(signal.aborted, true, "source detection must abort native work, not only reject its result");
-    assert.equal(f.scopes.scopes.size, 0);
-  } finally { release.resolve(); await assert.rejects(result); }
-});
-
-test("Stop captures turn A before owner validation and cannot cancel replacement turn B", async () => {
-  const f = fixture(); const ref = await f.issue(); const first = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let blocked = false;
-  const stopContext = { ...f.context, assertActive: async () => {
-    if (!blocked) { blocked = true; entered.resolve(); await release.promise; }
-  } };
-  const stopping = f.scopes.stop(ref.handle, stopContext);
-  await entered.promise; assert.equal(f.scopes.finish(first), true);
-  const second = await f.scopes.begin(ref.handle, f.context);
-  release.resolve();
-  assert.equal(await stopping, false);
-  assert.equal(second.controller.signal.aborted, false, "an earlier Stop must not cancel a later turn");
-  assert.equal(await f.scopes.assertTurn(second, f.context), second.scope);
-});
-
-for (const phase of [1, 5]) {
-  test(`cancelled Stop(A) during owner check ${phase} cannot revoke replacement turn B`, { timeout: 2_000 }, async () => {
-    const f = fixture(); const ref = await f.issue(); const first = await f.scopes.begin(ref.handle, f.context);
-    const entered = deferred(); const release = deferred(); const rpc = new AbortController(); let checks = 0;
-    const stopContext = { ...f.context, signal: rpc.signal, assertActive: async () => {
-      if (++checks === phase) { entered.resolve(); await release.promise; }
-      rpc.signal.throwIfAborted();
-    } };
-    const stopping = f.scopes.stop(ref.handle, stopContext);
-    await entered.promise; f.scopes.finish(first);
-    const second = await f.scopes.begin(ref.handle, f.context);
-    rpc.abort(phase === 1 ? new DOMException("Stop cancelled", "AbortError") : new DOMException("Stop deadline", "TimeoutError"));
-    release.resolve();
-    await assert.rejects(stopping, (error) => error === rpc.signal.reason);
-    assert.equal(second.controller.signal.aborted, false, "a cancelled RPC does not revoke source authority or stop a later turn");
-    assert.equal(f.scopes.scopes.size, 1);
-    assert.equal(await f.scopes.assertTurn(second, f.context), second.scope);
-  });
-}
-
-test("verified source failure still aborts native work when the RPC is concurrently cancelled", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const rpc = new AbortController(); const retained = f.database.getRetainedPluginSource;
-  f.database.getRetainedPluginSource = () => {
-    rpc.abort(new DOMException("Concurrent RPC cancellation", "AbortError"));
-    return { ...retained(), id: "different-retained-source" };
-  };
-  await assert.rejects(f.scopes.assertTurn(ticket, { ...f.context, signal: rpc.signal }),
-    (error) => error !== rpc.signal.reason && error.code === -32007);
-  assert.equal(ticket.controller.signal.aborted, true);
-  assert.equal(f.scopes.scopes.size, 0);
-});
-
-test("a foreign runtime cannot revoke a victim scope by failing authentication with its handle", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  await assert.rejects(f.scopes.stop(ref.handle, { ...f.context, runtimeId: "foreign-runtime" }));
-  assert.equal(ticket.controller.signal.aborted, false);
-  assert.equal(f.scopes.scopes.size, 1);
-  assert.equal(await f.scopes.assertTurn(ticket, f.context), ticket.scope);
-});
-
-test("bounded host scopes reject malformed snapshots without registering partial targets", async () => {
-  const f = fixture(); await assert.rejects(f.issue([null])); assert.equal(f.scopes.scopes.size, 0);
-  await assert.rejects(f.issue([f.target("terminal-a"), f.target("terminal-a")]));
-  for (let i = 0; i < 8; i++) await f.issue();
-  await assert.rejects(f.issue());
-  f.tick(300_000); await f.issue(); assert.equal(f.scopes.scopes.size, 1);
-  f.scopes.shutdown(); await assert.rejects(f.issue());
-});

electron/plugins/generated/plugin-contract.schema.json

@@ -1771,8 +1771,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -1817,8 +1815,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -7190,402 +7186,6 @@
         }
       },
       "additionalProperties": false
-    },
-    "PluginAgentFeature": {
-      "const": "ai.agent-sessions"
-    },
-    "PluginAgentBackendKind": {
-      "enum": [
-        "catty",
-        "claude",
-        "codex",
-        "copilot",
-        "cursor",
-        "codebuddy",
-        "opencode",
-        "grok",
-        "mimo"
-      ]
-    },
-    "PluginAgentBackend": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "label",
-        "backend",
-        "status",
-        "reason"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "label": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "status": {
-          "enum": [
-            "supported",
-            "unsupported",
-            "unavailable"
-          ]
-        },
-        "reason": {
-          "enum": [
-            "ready",
-            "not-configured",
-            "native-boundary-unverified",
-            "configuration-unavailable"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentBackendsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentBackend"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetSummary": {
-      "type": "object",
-      "required": [
-        "title",
-        "kind"
-      ],
-      "properties": {
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "kind": {
-          "const": "terminal"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetsResult": {
-      "type": "object",
-      "required": [
-        "selectionHandle",
-        "expiresAt",
-        "items"
-      ],
-      "properties": {
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        },
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentTargetSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentOpenParams": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "selectionHandle"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatRef": {
-      "type": "object",
-      "required": [
-        "chatHandle"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatResult": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "conversationRef",
-        "backendLabel",
-        "expiresAt"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "backendLabel": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatSummary": {
-      "type": "object",
-      "required": [
-        "conversationRef",
-        "title",
-        "backend",
-        "updatedAt"
-      ],
-      "properties": {
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "updatedAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 64,
-          "items": {
-            "$ref": "#/$defs/PluginAgentChatSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentSendParams": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "text"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "text": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 16384,
-          "pattern": "^[^\\u0000]*$"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnRef": {
-      "type": "object",
-      "required": [
-        "turnHandle"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnResult": {
-      "type": "object",
-      "required": [
-        "turnHandle",
-        "expiresAt"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentMessage": {
-      "type": "object",
-      "required": [
-        "role",
-        "text"
-      ],
-      "properties": {
-        "role": {
-          "enum": [
-            "user",
-            "assistant"
-          ]
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 32768
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentHistoryResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 200,
-          "items": {
-            "$ref": "#/$defs/PluginAgentMessage"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentEvent": {
-      "oneOf": [
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "text"
-          ],
-          "properties": {
-            "kind": {
-              "const": "text"
-            },
-            "text": {
-              "type": "string",
-              "maxLength": 4096
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "capabilityId",
-            "state"
-          ],
-          "properties": {
-            "kind": {
-              "const": "activity"
-            },
-            "capabilityId": {
-              "type": "string",
-              "maxLength": 160
-            },
-            "state": {
-              "enum": [
-                "started",
-                "completed",
-                "denied"
-              ]
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "inputTokens",
-            "outputTokens"
-          ],
-          "properties": {
-            "kind": {
-              "const": "usage"
-            },
-            "inputTokens": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "outputTokens": {
-              "type": "integer",
-              "minimum": 0
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "reason"
-          ],
-          "properties": {
-            "kind": {
-              "const": "end"
-            },
-            "reason": {
-              "enum": [
-                "completed",
-                "cancelled",
-                "unavailable",
-                "budget-exceeded"
-              ]
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
     }
   }
 }

electron/plugins/globalAgent.test.cjs

@@ -1,4 +0,0 @@
-"use strict";
-require("./agent/delegatedScope.test.cjs");
-require("./agent/conversationStore.test.cjs");
-require("./agent/contract.test.cjs");

examples/plugins/assistant/README.md

@@ -4,11 +4,6 @@ A minimal browser plugin that uses Netcatty's selected configured model and one
 explicitly selected reference. It provides Send, streamed text, Stop, and usage.
 It has no tools, terminal commands, direct network access, Node runtime, or storage.
 
-The page follows light/dark mode and accent updates through the existing
-`netcattyView.onDidChangeEnvironment()` API and seven public HSL theme tokens.
-Missing tokens fall back to the standard sample palettes. Its theme subscription
-is disposed on page hide and restored on page show.
-
 An expired chat is reopened before the next explicit Send. If the configured
 model changes or a request fails, use **Refresh model** to reopen the session,
 then click **Send** yourself. Refresh keeps your draft and never retries model

examples/plugins/assistant/panel.css

@@ -1,29 +1,26 @@
-:root { color-scheme: light dark; --background:0 0% 100%; --foreground:222 47% 12%; --muted:210 20% 96%; --muted-foreground:215 20% 35%; --border:215 20% 75%; --primary:221 83% 45%; --primary-foreground:0 0% 100%; font: 15px/1.5 system-ui,sans-serif; color:hsl(var(--foreground)); background:hsl(var(--background)); }
-:root[data-theme="dark"] { --background:221 39% 11%; --foreground:210 20% 98%; --muted:219 27% 21%; --muted-foreground:220 13% 91%; --border:218 11% 65%; --primary:213 97% 87%; --primary-foreground:221 39% 11%; }
-@media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --background:221 39% 11%; --foreground:210 20% 98%; --muted:219 27% 21%; --muted-foreground:220 13% 91%; --border:218 11% 65%; --primary:213 97% 87%; --primary-foreground:221 39% 11%; } }
+:root { color-scheme: dark; font: 15px/1.5 system-ui,sans-serif; color:#e9edf6; background:#10141c; }
 * { box-sizing:border-box; }
 body { margin:0; }
 main { max-width:760px; padding:36px; margin:auto; }
 header { margin-bottom:26px; }
-.badge { color:hsl(var(--primary)); font-size:11px; font-weight:700; letter-spacing:1.6px; }
+.badge { color:#8bb9ff; font-size:11px; font-weight:700; letter-spacing:1.6px; }
 h1 { font-size:27px; font-weight:650; letter-spacing:-.6px; margin:8px 0; }
-p { color:hsl(var(--muted-foreground)); margin:4px 0; }
-.card { border:1px solid hsl(var(--border)); border-radius:10px; padding:16px 18px; margin:14px 0; background:hsl(var(--muted)); }
-label { display:block; font-size:12px; font-weight:600; color:hsl(var(--muted-foreground)); margin-bottom:8px; }
+p { color:#a9b4c7; margin:4px 0; }
+.card { border:1px solid #303c4f; border-radius:10px; padding:16px 18px; margin:14px 0; background:#181f2a; }
+label { display:block; font-size:12px; font-weight:600; color:#aabbd5; margin-bottom:8px; }
 #model { font-weight:600; }
-select, textarea { width:100%; background:hsl(var(--background)); color:inherit; border:1px solid hsl(var(--border)); padding:10px 12px; border-radius:7px; font:inherit; }
-select:focus,textarea:focus,button:focus-visible { outline:2px solid hsl(var(--primary)); outline-offset:2px; }
+select, textarea { width:100%; background:#10161f; color:#e9edf6; border:1px solid #455570; padding:10px 12px; border-radius:7px; font:inherit; }
+select:focus,textarea:focus,button:focus-visible { outline:2px solid #8bb9ff; outline-offset:2px; }
 textarea { resize:vertical; min-height:84px; }
 form { margin:22px 0; }
 .actions { display:flex; flex-wrap:wrap; align-items:center; gap:10px; margin-top:12px; }
-button { border:1px solid hsl(var(--border)); border-radius:7px; background:transparent; color:inherit; padding:9px 24px; font:inherit; font-weight:600; cursor:pointer; }
-#send { border-color:transparent; background:hsl(var(--primary)); color:hsl(var(--primary-foreground)); }
+button { border:1px solid #4e8bdf; border-radius:7px; background:#3274c6; color:white; padding:9px 24px; font:inherit; font-weight:600; cursor:pointer; }
 button:disabled { opacity:.42; cursor:default; }
+#stop,#refresh,#choose-reference { background:transparent; border-color:#56657b; }
 #choose-reference { margin-top:10px; }
-#status { margin-left:4px; color:hsl(var(--muted-foreground)); font-size:12px; }
+#status { margin-left:4px; color:#b6c6dc; font-size:12px; }
 .response { min-height:160px; }
 pre { white-space:pre-wrap; overflow-wrap:anywhere; font:16px/1.7 system-ui,sans-serif; margin:0 0 12px; }
-.hint,footer { font-size:12px; color:hsl(var(--muted-foreground)); margin-top:8px; }
+.hint,footer { font-size:12px; color:#9aabc3; margin-top:8px; }
 footer { padding-top:8px; }
 @media(max-width:520px) { main { padding:22px; } h1 { font-size:23px; } }
-@media (forced-colors: active) { button, select, textarea { border:1px solid ButtonText; } }

examples/plugins/assistant/panel.js

@@ -2,31 +2,6 @@
 'use strict';
 const element = (id) => document.getElementById(id);
 const invoke = (operation, params = {}) => window.netcattyView.executeCommand(`com.netcatty.assistant.${operation}`, params);
-// Follow the same seven public semantic tokens as the other browser samples.
-// Only this page's own DOM is updated; no host settings or DOM access is used.
-(() => {
-  const names = ['--background', '--foreground', '--muted', '--muted-foreground', '--border', '--primary', '--primary-foreground'];
-  let subscription;
-  const subscribe = () => {
-    if (subscription) return;
-    subscription = window.netcattyView.onDidChangeEnvironment?.((environment) => {
-      const root = document.documentElement;
-      const theme = ['light', 'dark'].includes(environment.theme) ? environment.theme : 'system';
-      root.dataset.theme = theme;
-      root.style.colorScheme = theme === 'system' ? 'light dark' : theme;
-      root.dataset.reducedMotion = String(Boolean(environment.reducedMotion));
-      root.dataset.highContrast = String(Boolean(environment.highContrast));
-      for (const name of names) {
-        const value = environment.themeTokens?.[name];
-        if (typeof value === 'string' && value.length > 0 && value.length <= 96) root.style.setProperty(name, value);
-        else root.style.removeProperty(name);
-      }
-    });
-  };
-  subscribe();
-  window.addEventListener('pagehide', () => { subscription?.dispose(); subscription = undefined; });
-  window.addEventListener('pageshow', subscribe);
-})();
 let chat;
 let turn;
 let generation = 0;

infrastructure/ai/plugin/configuredModel.ts

@@ -1,16 +1,11 @@
 import { localStorageAdapter } from '../../persistence/localStorageAdapter';
 import { STORAGE_KEY_AI_ACTIVE_MODEL, STORAGE_KEY_AI_ACTIVE_PROVIDER, STORAGE_KEY_AI_PROVIDERS } from '../../config/storageKeys';
 import type { ProviderConfig } from '../types';
-import { netcattyBridge } from '../../services/netcattyBridge';
 
 // Host renderer only. Read the existing configured provider/model without
 // loading AgentRuntime or syncing/inheriting the Agent's permission policy.
 export function getConfiguredPluginModel() {
   const providers = localStorageAdapter.read<ProviderConfig[]>(STORAGE_KEY_AI_PROVIDERS) ?? [];
-  return selectedModel(providers);
-}
-
-function selectedModel(providers: ProviderConfig[]) {
   const activeProviderId = localStorageAdapter.readString(STORAGE_KEY_AI_ACTIVE_PROVIDER);
   const activeModelId = localStorageAdapter.readString(STORAGE_KEY_AI_ACTIVE_MODEL);
   const provider = providers.find((item) => item.id === activeProviderId && item.enabled);
@@ -19,15 +14,3 @@ function selectedModel(providers: ProviderConfig[]) {
   if (!config.defaultModel) return null;
   return { config, label: `${config.name} · ${config.defaultModel}`.slice(0, 160), revision: JSON.stringify(config) };
 }
-
-// The existing main provider transport needs its host-owned registry for both
-// credentials and endpoint admission. Do not depend on mounting the AI sidebar,
-// or replace the registry with a plugin-supplied URL / just one selected entry.
-export async function prepareConfiguredPluginModel(revision: string) {
-  const providers = localStorageAdapter.read<ProviderConfig[]>(STORAGE_KEY_AI_PROVIDERS) ?? [];
-  if (selectedModel(providers)?.revision !== revision) throw Error('Selected model changed');
-  const bridge = netcattyBridge.require();
-  if (!bridge.aiSyncProviders || !(await bridge.aiSyncProviders(providers)).ok) {
-    throw Error('Host provider configuration is unavailable');
-  }
-}

infrastructure/ai/plugin/trustedHostRuntime.test.ts

@@ -7,7 +7,7 @@ const syntheticModel = { config: { id: 'synthetic', name: 'Synthetic', providerI
 
 test('renderer-owned model handles never serialize provider config and cannot cross runtimes', async () => {
   let active = true;
-  const runtime = createTrustedPluginAIHostRuntime({ getModel: () => syntheticModel, prepareModel: async () => {}, chooseSelected: async () => [], isActive: () => active });
+  const runtime = createTrustedPluginAIHostRuntime({ getModel: () => syntheticModel, chooseSelected: async () => [], isActive: () => active });
   const model = await runtime.handle('model.select', {}, 'runtime-a') as { hostHandle: string; label: string };
   assert.doesNotMatch(JSON.stringify(model), /synthetic-not-a-secret|apiKey|providerId|config/);
   await assert.rejects(runtime.handle('model.current', model, 'runtime-b'));
@@ -36,7 +36,7 @@ test('selected metadata uses explicit safe projections and current resource iden
 
 test('selected summaries never read content; late resource changes and runtime release deny content', async () => {
   let current = true; let reads = 0; let resolve: (text: string) => void;
-  const runtime = createTrustedPluginAIHostRuntime({ getModel: () => syntheticModel, prepareModel: async () => {}, isActive: () => true,
+  const runtime = createTrustedPluginAIHostRuntime({ getModel: () => syntheticModel, isActive: () => true,
     chooseSelected: async () => [{ key: 'note', scope: 'note', title: 'Synthetic', version: '1', isCurrent: () => current,
       readText: () => { reads++; return new Promise<string>((r) => { resolve = r; }); } }] });
   const result = await runtime.handle('context.select', {}, 'runtime-a') as { items: Array<{ hostHandle: string; version: string }> };
@@ -46,22 +46,3 @@ test('selected summaries never read content; late resource changes and runtime r
   await new Promise(setImmediate); current = false; resolve!('Late synthetic text'); await assert.rejects(reading);
   runtime.releaseRuntime('runtime-a'); await assert.rejects(runtime.handle('context.current', reference, 'runtime-a')); runtime.shutdown();
 });
-
-test('provider preparation failures and late results cannot publish a model handle after release, cancellation or model change', async () => {
-  for (const action of ['failure', 'release', 'cancel', 'change', 'shutdown']) {
-    let resume!: () => void; let current = syntheticModel;
-    const waiting = new Promise<void>((resolve) => { resume = resolve; });
-    const controller = new AbortController();
-    const runtime = createTrustedPluginAIHostRuntime({ getModel: () => current, isActive: () => true, chooseSelected: async () => [],
-      prepareModel: async () => { await waiting; if (action === 'failure') throw Error('Synthetic sync denied'); } });
-    const selecting = runtime.handle('model.select', {}, 'runtime-a', controller.signal);
-    const rejection = assert.rejects(selecting);
-    if (action === 'release') runtime.releaseRuntime('runtime-a');
-    if (action === 'cancel') controller.abort();
-    if (action === 'change') current = { ...syntheticModel, revision: '2' };
-    if (action === 'shutdown') runtime.shutdown();
-    resume(); await rejection;
-    await assert.rejects(runtime.handle('model.current', { hostHandle: 'not-published' }, 'runtime-a'));
-    runtime.shutdown();
-  }
-});

infrastructure/ai/plugin/trustedHostRuntime.ts

@@ -17,12 +17,10 @@ type Owned<T> = T & { runtimeId: string };
 
 export function createTrustedPluginAIHostRuntime(options: {
   getModel: () => { config: ProviderConfig; label: string; revision: string } | null;
-  prepareModel: (revision: string) => Promise<void>;
   chooseSelected: (signal: AbortSignal, runtimeId: string) => Promise<HostSelectedSource[]>;
   isActive: () => boolean;
 }) {
   const models = new Map<string, Owned<{ model: Model }>>();
-  const selections = new Set<{ runtimeId: string; active: boolean }>();
   const turns = new Map<string, Owned<{ iterator: Iterator; controller: AbortController; reading: boolean }>>();
   const sources = new Map<string, Owned<{ source: HostSelectedSource }>>();
   let closed = false;
@@ -39,7 +37,6 @@ export function createTrustedPluginAIHostRuntime(options: {
     void turn.iterator.return(undefined).catch(() => {});
   };
   const releaseRuntime = (runtimeId: string) => {
-    for (const selection of selections) if (selection.runtimeId === runtimeId) { selection.active = false; selections.delete(selection); }
     for (const [handle, turn] of turns) if (turn.runtimeId === runtimeId) cancel(handle);
     for (const [handle, model] of models) if (model.runtimeId === runtimeId) models.delete(handle);
     for (const [handle, source] of sources) if (source.runtimeId === runtimeId) sources.delete(handle);
@@ -53,19 +50,12 @@ export function createTrustedPluginAIHostRuntime(options: {
       if (kind === 'model.select') {
         const selected = options.getModel();
         if (!selected || !selected.config.enabled || !selected.config.defaultModel) throw Error('Choose a configured model first');
-        if (models.size + selections.size >= 32) throw Error('Model handle limit reached');
-        const selection = { runtimeId, active: true };
-        selections.add(selection);
-        try {
-          await options.prepareModel(selected.revision);
-          signal.throwIfAborted(); assertActive();
-          if (!selection.active || options.getModel()?.revision !== selected.revision) throw Error('Selected model changed');
-          const handle = crypto.randomUUID();
-          const model = createPluginModelAdapter({ config: selected.config, label: selected.label, transportTag: runtimeId,
-            isCurrent: () => !closed && options.isActive() && options.getModel()?.revision === selected.revision });
-          models.set(handle, { runtimeId, model });
-          return { hostHandle: handle, label: selected.label };
-        } finally { selections.delete(selection); }
+        if (models.size >= 32) throw Error('Model handle limit reached');
+        const handle = crypto.randomUUID();
+        const model = createPluginModelAdapter({ config: selected.config, label: selected.label, transportTag: runtimeId,
+          isCurrent: () => !closed && options.isActive() && options.getModel()?.revision === selected.revision });
+        models.set(handle, { runtimeId, model });
+        return { hostHandle: handle, label: selected.label };
       }
       if (kind === 'model.release') { owned(models, payload.hostHandle, runtimeId); models.delete(String(payload.hostHandle)); return { ok: true }; }
       if (kind === 'model.current') return { current: await owned(models, payload.hostHandle, runtimeId).model.isCurrent() };
@@ -148,6 +138,6 @@ export function createTrustedPluginAIHostRuntime(options: {
       throw Error('Unsupported host operation');
     },
     releaseRuntime,
-    shutdown() { closed = true; for (const selection of selections) selection.active = false; selections.clear(); for (const handle of [...turns.keys()]) cancel(handle); models.clear(); sources.clear(); },
+    shutdown() { closed = true; for (const handle of [...turns.keys()]) cancel(handle); models.clear(); sources.clear(); },
   };
 }

packages/plugin-contract/schema/plugin-contract.schema.json

@@ -1698,8 +1698,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -1744,8 +1742,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -5008,402 +5004,6 @@
         }
       },
       "additionalProperties": false
-    },
-    "PluginAgentFeature": {
-      "const": "ai.agent-sessions"
-    },
-    "PluginAgentBackendKind": {
-      "enum": [
-        "catty",
-        "claude",
-        "codex",
-        "copilot",
-        "cursor",
-        "codebuddy",
-        "opencode",
-        "grok",
-        "mimo"
-      ]
-    },
-    "PluginAgentBackend": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "label",
-        "backend",
-        "status",
-        "reason"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "label": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "status": {
-          "enum": [
-            "supported",
-            "unsupported",
-            "unavailable"
-          ]
-        },
-        "reason": {
-          "enum": [
-            "ready",
-            "not-configured",
-            "native-boundary-unverified",
-            "configuration-unavailable"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentBackendsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentBackend"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetSummary": {
-      "type": "object",
-      "required": [
-        "title",
-        "kind"
-      ],
-      "properties": {
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "kind": {
-          "const": "terminal"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetsResult": {
-      "type": "object",
-      "required": [
-        "selectionHandle",
-        "expiresAt",
-        "items"
-      ],
-      "properties": {
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        },
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentTargetSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentOpenParams": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "selectionHandle"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatRef": {
-      "type": "object",
-      "required": [
-        "chatHandle"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatResult": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "conversationRef",
-        "backendLabel",
-        "expiresAt"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "backendLabel": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatSummary": {
-      "type": "object",
-      "required": [
-        "conversationRef",
-        "title",
-        "backend",
-        "updatedAt"
-      ],
-      "properties": {
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "updatedAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 64,
-          "items": {
-            "$ref": "#/$defs/PluginAgentChatSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentSendParams": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "text"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "text": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 16384,
-          "pattern": "^[^\\u0000]*$"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnRef": {
-      "type": "object",
-      "required": [
-        "turnHandle"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnResult": {
-      "type": "object",
-      "required": [
-        "turnHandle",
-        "expiresAt"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentMessage": {
-      "type": "object",
-      "required": [
-        "role",
-        "text"
-      ],
-      "properties": {
-        "role": {
-          "enum": [
-            "user",
-            "assistant"
-          ]
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 32768
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentHistoryResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 200,
-          "items": {
-            "$ref": "#/$defs/PluginAgentMessage"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentEvent": {
-      "oneOf": [
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "text"
-          ],
-          "properties": {
-            "kind": {
-              "const": "text"
-            },
-            "text": {
-              "type": "string",
-              "maxLength": 4096
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "capabilityId",
-            "state"
-          ],
-          "properties": {
-            "kind": {
-              "const": "activity"
-            },
-            "capabilityId": {
-              "type": "string",
-              "maxLength": 160
-            },
-            "state": {
-              "enum": [
-                "started",
-                "completed",
-                "denied"
-              ]
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "inputTokens",
-            "outputTokens"
-          ],
-          "properties": {
-            "kind": {
-              "const": "usage"
-            },
-            "inputTokens": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "outputTokens": {
-              "type": "integer",
-              "minimum": 0
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "reason"
-          ],
-          "properties": {
-            "kind": {
-              "const": "end"
-            },
-            "reason": {
-              "enum": [
-                "completed",
-                "cancelled",
-                "unavailable",
-                "budget-exceeded"
-              ]
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
     }
   }
 }

packages/plugin-contract/src/generated/plugin-contract.ts

@@ -486,7 +486,7 @@ export type MenuLocation = "commandPalette" | "application" | "host/context" | "
 
 export type NetworkCredentialLeaseFeature = "network.credential-lease";
 
-export type NonResourceScopedPermission = "storage" | "ai.invoke" | "ai.agent.use" | "ai.agent.actions" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
+export type NonResourceScopedPermission = "storage" | "ai.invoke" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
 
 export type NullableRpcId = (RpcId) | (null);
 
@@ -554,100 +554,6 @@ export type PermissionSet = {
   optional?: Array<PermissionDeclaration>;
 };
 
-export type PluginAgentBackend = {
-  backendRef: string;
-  label: string;
-  backend: PluginAgentBackendKind;
-  status: "supported" | "unsupported" | "unavailable";
-  reason: "ready" | "not-configured" | "native-boundary-unverified" | "configuration-unavailable";
-};
-
-export type PluginAgentBackendKind = "catty" | "claude" | "codex" | "copilot" | "cursor" | "codebuddy" | "opencode" | "grok" | "mimo";
-
-export type PluginAgentBackendsResult = {
-  items: Array<PluginAgentBackend>;
-};
-
-export type PluginAgentChatRef = {
-  chatHandle: string;
-};
-
-export type PluginAgentChatResult = {
-  chatHandle: string;
-  conversationRef: string;
-  backendLabel: string;
-  expiresAt: number;
-};
-
-export type PluginAgentChatsResult = {
-  items: Array<PluginAgentChatSummary>;
-};
-
-export type PluginAgentChatSummary = {
-  conversationRef: string;
-  title: string;
-  backend: PluginAgentBackendKind;
-  updatedAt: number;
-};
-
-export type PluginAgentEvent = ({
-  kind: "text";
-  text: string;
-}) | ({
-  kind: "activity";
-  capabilityId: string;
-  state: "started" | "completed" | "denied";
-}) | ({
-  kind: "usage";
-  inputTokens: number;
-  outputTokens: number;
-}) | ({
-  kind: "end";
-  reason: "completed" | "cancelled" | "unavailable" | "budget-exceeded";
-});
-
-export type PluginAgentFeature = "ai.agent-sessions";
-
-export type PluginAgentHistoryResult = {
-  items: Array<PluginAgentMessage>;
-};
-
-export type PluginAgentMessage = {
-  role: "user" | "assistant";
-  text: string;
-};
-
-export type PluginAgentOpenParams = {
-  backendRef: string;
-  selectionHandle: string;
-  conversationRef?: string;
-};
-
-export type PluginAgentSendParams = {
-  chatHandle: string;
-  text: string;
-};
-
-export type PluginAgentTargetsResult = {
-  selectionHandle: string;
-  expiresAt: number;
-  items: Array<PluginAgentTargetSummary>;
-};
-
-export type PluginAgentTargetSummary = {
-  title: string;
-  kind: "terminal";
-};
-
-export type PluginAgentTurnRef = {
-  turnHandle: string;
-};
-
-export type PluginAgentTurnResult = {
-  turnHandle: string;
-  expiresAt: number;
-};
-
 export type PluginAIBooleanResult = {
   ok: boolean;
 };
@@ -933,7 +839,7 @@ export type PluginNetworkResponse = {
   };
 };
 
-export type PluginPermission = "storage" | "ai.invoke" | "ai.agent.use" | "ai.agent.actions" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "network.stream" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
+export type PluginPermission = "storage" | "ai.invoke" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "network.stream" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
 
 export type PluginSelectedContextContent = {
   handle: string;

packages/plugin-contract/src/index.ts

@@ -55,7 +55,6 @@ export { inspectPluginBrandIcon, PLUGIN_BRAND_ICON_FEATURE, PLUGIN_BRAND_ICON_MA
 export const PLUGIN_NETWORK_CREDENTIAL_LEASE_FEATURE = "network.credential-lease" as const satisfies import("./generated/plugin-contract.js").NetworkCredentialLeaseFeature;
 export const PLUGIN_BYTE_STREAM_FEATURE = "network.byte-streams" as const satisfies import("./generated/plugin-contract.js").ByteStreamFeature;
 export const PLUGIN_AI_MODEL_INVOCATION_FEATURE = "ai.model-invocation" as const satisfies import("./generated/plugin-contract.js").PluginAIModelInvocationFeature;
-export const PLUGIN_AGENT_SESSIONS_FEATURE = "ai.agent-sessions" as const satisfies import("./generated/plugin-contract.js").PluginAgentFeature;
 export const PLUGIN_SELECTED_CONTEXT_FEATURE = "context.selected-read" as const satisfies import("./generated/plugin-contract.js").PluginSelectedContextFeature;
 
 export const PLUGIN_HOST_INTERACTION_FEATURE = "host.interactions" as const satisfies import("./generated/plugin-contract.js").HostInteractionFeature;

packages/plugin-sdk/src/index.ts

@@ -685,19 +685,6 @@ export interface PluginSelectedContextClient {
   read(params: import("@netcatty/plugin-contract").PluginSelectedContextRef): Promise<import("@netcatty/plugin-contract").PluginSelectedContextContent>;
 }
 
-/** Configurations, targets and native resume IDs stay in the trusted host. */
-export interface PluginAgentClient {
-  listBackends(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentBackendsResult>;
-  selectTargets(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentTargetsResult>;
-  listChats(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentChatsResult>;
-  openChat(params: import("@netcatty/plugin-contract").PluginAgentOpenParams): Promise<import("@netcatty/plugin-contract").PluginAgentChatResult>;
-  send(params: import("@netcatty/plugin-contract").PluginAgentSendParams): Promise<import("@netcatty/plugin-contract").PluginAgentTurnResult>;
-  read(params: import("@netcatty/plugin-contract").PluginAgentTurnRef): Promise<import("@netcatty/plugin-contract").PluginAgentEvent>;
-  history(params: import("@netcatty/plugin-contract").PluginAgentChatRef): Promise<import("@netcatty/plugin-contract").PluginAgentHistoryResult>;
-  stop(params: import("@netcatty/plugin-contract").PluginAgentTurnRef): Promise<import("@netcatty/plugin-contract").PluginAIBooleanResult>;
-  closeChat(params: import("@netcatty/plugin-contract").PluginAgentChatRef): Promise<import("@netcatty/plugin-contract").PluginAIBooleanResult>;
-}
-
 export interface PluginByteConnection extends Disposable {
   readonly endpoint: string;
   readonly readable: PluginReadableByteStream;
@@ -797,7 +784,6 @@ export interface PluginContext {
   readonly credentials: PluginCredentialBroker;
   readonly network: PluginNetworkClient;
   readonly ai: PluginAIClient;
-  readonly agent: PluginAgentClient;
   readonly selectedContext: PluginSelectedContextClient;
   readonly filesystem: PluginFilesystemClient;
   readonly companions: PluginCompanionService;

scripts/plugin-assistant-panel.test.cjs

@@ -9,24 +9,12 @@ async function fixture(t, options = {}) {
   const root = path.resolve(__dirname, "../examples/plugins/assistant");
   const dom = new JSDOM(fs.readFileSync(path.join(root, "panel.html"), "utf8"), { runScripts: "outside-only" });
   t.after(() => dom.window.close());
-  const stylesheet = dom.window.document.createElement("style");
-  stylesheet.textContent = fs.readFileSync(path.join(root, "panel.css"), "utf8");
-  dom.window.document.head.append(stylesheet);
   let now = 0; let opens = 0; let modelCalls = 0; let changed = false;
   const calls = [];
-  const environmentListeners = new Set(); let environment;
   const element = (id) => dom.window.document.getElementById(id);
   dom.window.Date.now = options.clock ?? (() => now);
   Object.defineProperty(dom.window, "netcattyView", { value: {
     onDidReceiveMessage: () => () => {},
-    onDidChangeEnvironment: (listener) => {
-      environmentListeners.add(listener);
-      if (environment) {
-        const replay = environment;
-        queueMicrotask(() => { if (environmentListeners.has(listener) && replay === environment) listener(replay); });
-      }
-      return { dispose: () => environmentListeners.delete(listener) };
-    },
     executeCommand: async (id, params) => {
       const operation = id.replace("com.netcatty.assistant.", ""); calls.push({ operation, params });
       if (options.commands) return options.commands(operation, structuredClone(params));
@@ -57,43 +45,11 @@ async function fixture(t, options = {}) {
   dom.window.eval(fs.readFileSync(path.join(root, "panel.js"), "utf8"));
   await waitFor(() => element("status").textContent === "Ready");
   element("prompt").value = "Synthetic draft must survive session recovery";
-  return { element, calls, waitFor, window: dom.window, opens: () => opens, modelCalls: () => modelCalls,
-    emitEnvironment: (value) => { environment = value; for (const listener of environmentListeners) listener(value); },
-    environmentListeners: () => environmentListeners.size,
+  return { element, calls, waitFor, opens: () => opens, modelCalls: () => modelCalls,
     timeTo: (value) => { now = value; }, changeModel: () => { changed = true; },
     send: () => element("compose").dispatchEvent(new dom.window.Event("submit", { cancelable: true })) };
 }
 
-test("assistant follows host light/dark and accent updates with safe fallbacks and subscription cleanup", async (t) => {
-  const f = await fixture(t); const root = f.window.document.documentElement;
-  const computed = () => f.window.getComputedStyle(root);
-  const calls = f.calls.length;
-  assert.equal(computed().colorScheme, "light dark");
-  assert.equal(computed().getPropertyValue("--background").trim(), "0 0% 100%");
-  assert.equal(f.environmentListeners(), 1);
-  f.emitEnvironment({ theme: "light", themeTokens: { "--background": "20 20% 98%", "--primary": "145 60% 35%", "--muted": "30 10% 90%", "--private-token": "ignored" } });
-  assert.equal(root.style.colorScheme, "light"); assert.equal(root.dataset.theme, "light");
-  assert.equal(root.style.getPropertyValue("--primary"), "145 60% 35%");
-  assert.equal(root.style.getPropertyValue("--private-token"), "");
-  f.emitEnvironment({ theme: "dark", themeTokens: { "--background": "220 20% 10%", "--primary": "280 80% 75%" } });
-  assert.equal(root.style.colorScheme, "dark");
-  assert.equal(root.style.getPropertyValue("--primary"), "280 80% 75%");
-  assert.equal(root.style.getPropertyValue("--muted"), "");
-  assert.equal(computed().getPropertyValue("--muted").trim(), "219 27% 21%");
-  f.emitEnvironment({ theme: "light", themeTokens: { "--primary": "x".repeat(97) } });
-  assert.equal(root.style.colorScheme, "light"); assert.equal(root.style.getPropertyValue("--primary"), "");
-  assert.equal(computed().getPropertyValue("--background").trim(), "0 0% 100%");
-  f.emitEnvironment({ theme: "system" }); assert.equal(root.style.colorScheme, "light dark");
-  assert.equal(f.calls.length, calls); assert.equal(f.modelCalls(), 0);
-  f.window.dispatchEvent(new f.window.Event("pagehide")); assert.equal(f.environmentListeners(), 0);
-  f.emitEnvironment({ theme: "dark", themeTokens: { "--primary": "210 90% 70%" } });
-  assert.equal(root.style.colorScheme, "light dark");
-  f.window.dispatchEvent(new f.window.Event("pageshow"));
-  await new Promise(setImmediate);
-  assert.equal(f.environmentListeners(), 1); assert.equal(root.style.colorScheme, "dark");
-  assert.equal(root.style.getPropertyValue("--primary"), "210 90% 70%");
-});
-
 test("expired sample chat reopens before one explicit send and preserves the draft", async (t) => {
   const f = await fixture(t); f.timeTo(300_001); f.send();
   await f.waitFor(() => !f.element("prompt").disabled);