test(plugins): compose two-profile settings sidecar collect and hydration

The two-line idle prompt check only accepted a classic user@host host
line, so Oh My Zsh ys (`# user @ host ...` then a bare $/#) never became
ready and terminal_execute sent nothing. Match that host line narrowly
and still reject a lone marker.

Fixes #4007

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>

components/settings/tabs/PluginLogSettings.tsx

@@ -19,7 +19,7 @@ export function PluginLogSettings() {
   const disclosure = zh
     ? '插件编写的日志文字可能包含敏感数据。截断和字段过滤不能保证任意文字安全。只为排查问题临时开启，导出前请检查。重启应用后自动关闭详细日志。'
     : 'Plugin-authored text may contain sensitive data. Truncation and field filtering cannot make arbitrary text safe. Enable temporarily for troubleshooting and review files before sharing. Verbose diagnostics turn off after app restart.';
-  return <div data-host-security-surface="">
+  return <div>
     <Dialog open={open} onOpenChange={setOpen}>
       <SettingRow label={title} description={zh ? '选择是否在此设备保存审计记录和诊断日志。' : 'Choose whether to keep audit records and diagnostics on this device.'}>
         <div className="flex items-center gap-3">
@@ -53,6 +53,6 @@ export function PluginLogSettings() {
         </DialogFooter>
       </DialogContent>
     </Dialog>
-    <ConfirmDialog open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
+    <ConfirmDialog hostSecuritySurface open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
   </div>;
 }

components/settings/tabs/PluginManagementDialog.interaction.test.tsx

@@ -68,11 +68,6 @@ test('plugin manager is single-instance, closes with Escape, restores focus and
     })}>Open contributed settings view</button>}</PluginManagementDialog></I18nProvider>));
     await click(trigger);
     await click(document.querySelector<HTMLButtonElement>('[role="dialog"] button:not([data-dialog-close])')!);
-    // Radix schedules close-focus cleanup after the React close commit. The
-    // settle inside click's act() can precede that commit; observe the actual
-    // handoff instead of assuming the cleanup timer already ran.
-    const handoffDeadline = Date.now() + 2_000;
-    while (!handedOff && Date.now() < handoffDeadline) await act(async () => { await settle(); });
     assert.equal(handedOff, true, 'external view opens only after modal ownership is released');
     function ControlledEntry() {
       const [open, setOpen] = useState(false);

components/settings/tabs/PluginSettingsVisibility.test.tsx

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { JSDOM } from 'jsdom';
+const require = createRequire(import.meta.url);
+
+test('real Settings landing leaves views visible while idle; log and Ask dialogs suspend and restore them', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div><div id="native-view-mount"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'NodeFilter', 'Event', 'MouseEvent', 'KeyboardEvent', 'MutationObserver', 'DocumentFragment', 'CustomEvent']) install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window));
+  install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window));
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginSettingsLanding } = await import('./PluginSettingsLanding');
+  const { PluginPermissionHost } = await import('../../plugins/PluginPermissionHost');
+  const { observePluginHostSecurityVisibility } = await import('../../../application/state/pluginHostSecurityVisibility');
+  const { PluginPermissionDecisionHost } = require('../../../electron/plugins/permissionDecisionHost.cjs');
+  type Prompt = NetcattyPluginPermissionPrompt | { requestId: string; closed: true };
+  const listeners = new Set<(event: Prompt) => void>();
+  const sender = Object.assign(new EventEmitter(), { isDestroyed: () => false, send: (_channel: string, event: Prompt) => { for (const listener of listeners) listener(event); } });
+  const owner = Object.assign(new EventEmitter(), { webContents: sender, isFocused: () => true, isVisible: () => true, isDestroyed: () => false });
+  const host = new PluginPermissionDecisionHost({ getWindows: () => [owner], isLocked: () => false });
+  let logStatus = { saveToDisk: false, verbose: false, droppedRecords: 0, writeErrors: 0, pendingBytes: 0, maxBytes: 3145728, retentionDays: 7 };
+  Object.assign(dom.window, { netcatty: {
+    async getPluginLogStatus() { return logStatus; },
+    async configurePluginLogs(value: { saveToDisk: boolean; verbose: boolean }) { logStatus = { ...logStatus, ...value }; return logStatus; },
+    onPluginPermission(listener: (event: Prompt) => void) { listeners.add(listener); return () => listeners.delete(listener); },
+    setPluginPermissionReady: async (ready: boolean) => host.setReady(sender, ready),
+    respondPluginPermission: async (response: unknown) => host.respond(sender, response),
+  } });
+  const manager = { plugins: [], available: true, statusKnown: true, busy: false, error: null, credentialStorageAvailable: true,
+    async refresh() {}, async setEnabled() {}, async importPackage() {}, async uninstall() {} };
+  let visible = true;
+  const transitions: boolean[] = [];
+  const stopVisibility = observePluginHostSecurityVisibility(document.getElementById('native-view-mount')!, (next) => { visible = next; transitions.push(next); });
+  const root = createRoot(document.getElementById('root')!);
+  const button = (label: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((element) => element.textContent === label)!;
+  const flushVisibility = () => new Promise<void>((resolve) => dom.window.queueMicrotask(resolve));
+  try {
+    await act(async () => root.render(<I18nProvider locale="en"><PluginSettingsLanding manager={manager} settingsAvailable={new Set()} onManage={() => {}} /><PluginPermissionHost /></I18nProvider>));
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.ok(button('Configure'), 'real idle logging row is present');
+    assert.equal(visible, true, 'idle Settings landing must not hide the native child');
+    assert.deepEqual(transitions, []);
+    await act(async () => button('Configure').click());
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'actual logging security dialog must hide the child');
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[0].click());
+    await act(async () => document.querySelectorAll<HTMLButtonElement>('[role="switch"]')[1].click());
+    await flushVisibility();
+    assert.equal(document.querySelectorAll('[role="dialog"]').length, 2);
+    assert.equal(visible, false, 'the verbose security confirmation must also keep the child hidden');
+    await act(async () => button('Cancel').click());
+    await flushVisibility();
+    assert.equal(visible, false, 'cancelling verbose returns to the protected logging dialog');
+    await act(async () => button('Close').click());
+    await flushVisibility();
+    assert.equal(document.querySelector('[role="dialog"]'), null);
+    assert.equal(visible, true, 'closing logs must restore the child while its idle row remains');
+    let pending!: Promise<{ decision: string }>;
+    await act(async () => {
+      pending = host.request({ requestId: 'settings-visibility-ask', pluginId: 'com.example.settings-visibility', pluginName: 'Settings visibility fixture', pluginVersion: '1.0.0',
+        permission: 'settings.read', resources: ['*'], reason: 'Read own synthetic setting' });
+    });
+    await flushVisibility();
+    assert.ok(document.querySelector('[role="dialog"][data-host-security-surface]'));
+    assert.equal(visible, false, 'Ask must still hide the child above the real landing');
+    await act(async () => { button('Deny').click(); await pending; });
+    await flushVisibility();
+    assert.equal((await pending).decision, 'deny');
+    assert.equal(visible, true, 'dismissing Ask must restore the same child');
+    assert.deepEqual(transitions, [false, true, false, true]);
+  } finally {
+    await act(async () => root.unmount()); stopVisibility(); host.shutdown(); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/ui/confirm-dialog.tsx

@@ -17,6 +17,7 @@ interface ConfirmDialogProps {
   confirmLabel: string;
   busy?: boolean;
   destructive?: boolean;
+  hostSecuritySurface?: boolean;
   onOpenChange: (open: boolean) => void;
   onConfirm: () => void;
 }
@@ -28,6 +29,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
   confirmLabel,
   busy = false,
   destructive = false,
+  hostSecuritySurface = false,
   onOpenChange,
   onConfirm,
 }: ConfirmDialogProps) {
@@ -35,7 +37,7 @@ export const ConfirmDialog = memo(function ConfirmDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
+      <DialogContent data-host-security-surface={hostSecuritySurface ? "" : undefined} className="max-w-[calc(100vw-2rem)] overflow-hidden sm:max-w-[380px]">
         <DialogHeader className="min-w-0 pr-6">
           <DialogTitle className="truncate">{title}</DialogTitle>
         </DialogHeader>

docs/plugin-platform/global-agent-wip.md

@@ -1,161 +0,0 @@
-# Global Agent plugin bridge (work in progress)
-
-This stack starts from `integration/plugin-ask-routing-acceptance` at
-`2433cf0130d1c3274c56c39e5765349c2945de01`. The parent confirmed this dependency;
-its native Ask acceptance and integrated CI are still pending. This branch does
-not modify the frozen candidate, #3986, #3998, or #4002.
-
-The user approved a global conversation independent of a terminal or workspace,
-with a plugin-provided chat UI and selectable existing Agent backends. Core owns
-Agent execution, history, target authority, native approvals, credentials and
-audit. Global is not unrestricted inventory access or a background service.
-
-## Stage 1: dispatch authority
-
-`electron/plugins/agent/delegatedScope.cjs` is a host-only authority. It does not
-register plugin APIs, start an Agent or implement an orchestration loop.
-
-- `issue(context, hostSnapshot)` authenticates with the existing source binding.
-  Host snapshots contain backend identity/revision, target kind/id/owner/revision,
-  synchronous current-owner checks, and a supported capability subset. The public
-  result contains only an opaque handle and expiry. Plugin parameters must never
-  be used as `hostSnapshot`.
-- `begin(handle, context)` returns an internal turn ticket and AbortController.
-- `dispatch(ticket, context, resolvedAction, execute)` runs the common host policy
-  adapter once, checks current target revisions after any approval wait, invokes
-  the real dispatcher, and rejects late results. `resolvedAction` must come from
-  canonical host capability/argument resolution, not an unchecked plugin object.
-- `assertTurn` guards outgoing events. `finish` and `stop` invalidate the exact
-  ticket. Runtime/plugin release, lock/hide invalidation and shutdown abort work.
-- Handles expire in five minutes. There are at most eight per runtime owner and
-  64 overall, with at most 32 explicit resources per scope. Expiry never silently
-  refreshes a selection or revives an old turn.
-
-The focused tests use the actual `PluginAISourceBinding` with synthetic host
-registries, two terminal owners representing different workspaces, controlled
-time, and deferred approval/native completion. They cover source/runtime/target
-substitution, focus changes, revision changes across approval, policy denial,
-Stop, release, lock, late completion and bounds. They do not yet prove actual MCP
-or AgentRuntime dispatch; those remain integration gates.
-
-Initial execution failed before test discovery because the new worktree has no
-dependencies (`ajv/dist/2020` missing). Running with the existing local worktree's
-read-only CommonJS dependency path passes all 12 cases. No provider, CLI Agent,
-paid credentials or GUI was used.
-
-The adjacent run then passed 49 tests and failed one installed-entrypoint test
-because ESM could not resolve `@netcatty/plugin-cli` from the new worktree. Standard
-`npm ci --ignore-scripts` and `build:plugin-runtime-deps` repaired the setup. These
-failures are setup evidence, not failed-before product regressions.
-
-The core conversation repository stores the existing global `AISession` document
-shape in a host-only directory, namespaced by the hash of source/private-owner.
-Native session identity and compaction remain private. Commits serialize a cloned
-snapshot, revalidate provenance before atomic rename, and retain previous history
-when that check fails. Files use mode 0600 and no-follow reads. The repository
-does not register a plugin storage API or change the source database schema.
-
-The canonical schema and SDK now declare the proposed session interface and
-permissions. Runtime methods and the supported-feature advertisement are not yet
-registered. This stage must not be described as an installable working Agent
-bridge. Focused scope/history/wire and permission-copy tests pass 20 cases;
-contract/SDK/CLI tests pass 91. Focused lint and generated drift checks pass.
-
-## Independent stage-1 correction
-
-The independent review of exact `056164157f34ea779ed6cf51199909082345eca4`
-confirmed two helper defects before any runtime acceptance claim: source failure
-during the initial owner check rejected late work without aborting the active
-native signal; Stop could acquire a replacement turn after awaiting identity.
-
-Both reproduce against that exact helper using the real `PluginAISourceBinding`:
-the focused before run is 13 passed / 2 failed. The correction revokes the captured
-scope when its own host-authenticated identity fails, and captures the intended
-turn before Stop's first await. A foreign runtime cannot use a failed lookup to
-revoke another caller's scope. Focused after: 15 passed / 0 failed. The complete
-foundation/permission group passes 23 on Node 24.19.0 and Node 22.23.3; focused lint
-and diff checks pass. Logs: `/tmp/netcatty-global-agent-review-before.log`,
-`/tmp/netcatty-global-agent-review-after.log`,
-`/tmp/netcatty-global-agent-review-node22.log`.
-
-The first CI run at 0561641, test `40459522087`, Linux job `122040565759`, failed
-after an explicit runner shutdown and operation cancellation, with no assertion
-failure in its log and no complete repository test total. Package workflow
-`40459521971` and both Windows jobs passed. The parent authorized one job rerun;
-it was requested once, producing Linux job `122048349748`, still running at this
-checkpoint. Original runner failure remains historical evidence. Neither that
-rerun nor the helper fix establishes runtime, native or independent-review
-acceptance; the correction still needs reviewer recheck.
-
-### Follow-up: cancellation is not source revocation
-
-The independent recheck confirmed the first two repairs and found a remaining
-Stop race: an aborted Stop(A) RPC could enter the generic owner-failure cleanup
-after B had started, revoking B's scope. The same failure was reproduced at both
-owner-validation await paths using the actual source binding. Exact-18377 source
-with the new 18-case scope suite yields 16 passed / 2 failed; evidence is retained
-in `/tmp/netcatty-global-agent-stop-rpc-exact183-before.log`.
-
-The minimal follow-up distinguishes this request's abort/deadline from verified
-owner or resource failure, rethrows the access failure, and leaves the existing
-turn-capture rule intact. Cancellation of Stop(A) cannot revoke B. A separate
-regression confirms that a verified source mismatch still aborts native work
-even when the RPC is concurrently cancelled. Foreign caller protections remain.
-The full foundation/permission group passes 26 tests on Node 22.23.3 and Node
-24.19.0; focused lint and diff checks pass. Logs:
-`/tmp/netcatty-global-agent-stop-rpc-final.log` and
-`/tmp/netcatty-global-agent-stop-rpc-node22.log`. Independent recheck is pending.
-
-The authorized original-head Linux rerun `122048349748` ended cancelled, with an
-operation-cancelled log and no assertion failure. No second rerun was requested.
-At 18377, test workflow `40462595842`, Linux job `122050816182`, also received an
-explicit runner shutdown; `PluginLogSettings.test.tsx` was SIGKILLed immediately
-afterward. That interrupted stage reports 34 passed / 1 failed, not a complete
-repository total or an assertion failure. Both Windows jobs passed. No blind
-rerun of that job was made. Package workflow `40462595846` was still running when
-checked. These records are not substituted for exact-head green CI.
-
-## Planned public contract and adapters
-
-The proposed feature is `ai.agent-sessions`, with `ai.agent.use` for conversation
-operations and `ai.agent.actions` for actual Agent tool actions. Permission mode
-comes from the existing source-bound Allow/Ask/Deny engine. These are additive
-names, separate from the existing tools-disabled `ai.invoke` broker.
-
-The API will provide backend listing, explicit target selection, owned chat
-listing/opening, sending, bounded event reads, history, Stop and close. Backend
-references are opaque host-issued configuration revisions. Conversation references
-identify only histories owned by the calling source/private-owner; runtime handles
-are separate and cannot substitute builtin chat IDs or native SDK resume IDs.
-Messages cannot supply permissionMode, CLI/env/MCP configuration or owner fields.
-
-Core will reuse `AISession`, `AgentRuntime`, both existing turn drivers, event and
-compaction handling, SDK resume identity validation, and `stopAgentTurn`. The first
-eligible backends are Catty and configured Claude Code in MCP mode. Other backend
-entries must return explicit unsupported/unconfigured status until their native
-tool and approval boundaries are verified. Codex SDK's current unrestricted native
-configuration must not be treated as eligible merely because it has a driver.
-
-The terminal worker already exposes a suitable main-owned resource binding:
-`getPluginSessionBinding(sessionId, ownerWebContentsId)` returns worker epoch and
-session generation. Use this for dispatch-time targets; do not use menu IDs,
-focused tab, display labels, or a renderer-provided session ID as authority.
-
-The MCP dispatcher and Catty direct execution route need the same delegated
-session guard. A delegated call must not update process-global permission mode,
-or request both an Agent approval and a plugin approval for the same action.
-Policy changes, disable/restart/source replacement, lock and host disconnection
-must cancel scoped native work and invalidate outgoing event tickets. Existing
-Agent trace and plugin audit/log facilities will receive redacted correlation
-metadata, not credentials, provider diagnostics or full unreviewed tool payloads.
-
-## Remaining acceptance gates
-
-- Canonical schema/SDK/runtime registration and the installed default host path.
-- Host-owned durable history and backend references, including backend switching.
-- Actual Catty and Claude MCP dispatch, policy and worker lifecycle regressions.
-- Synthetic streaming/cancellation fixtures; these are not real inference or
-  actual authenticated Claude service acceptance.
-- Installable minimal chat UI with backend and explicit target choice.
-- Standard CI, independent review and parent-scheduled native evidence. No GUI
-  ownership, merge or release is granted to this executor.

docs/plugin-platform/permission-modes-acceptance.md

@@ -85,6 +85,32 @@ initial-checkpoint evidence.
 
 ## Latest checks and remaining environment blockers
 
+- The native candidate `2433cf0130d1c3274c56c39e5765349c2945de01` retains the
+  same idle logging-row marker as `89beeb9` (source blob
+  `4dd5a7cea4ae5a6addc5db5c162038d8fa44075c`). Actual Settings landing plus the
+  existing observer reproduces native-child suppression with no dialog open.
+  This source defect is separate from the worker's earlier GPU exit and does
+  not alone establish the cause of the recorded blank native body.
+- The scoped correction removes only the idle-row marker. Actual logging and
+  Ask dialogs remain marked. A real nested verbose confirmation test also
+  reproduced premature restoration when its parent became accessibility-hidden;
+  that confirmation now opts into the existing marker on its own dialog content.
+  The observer, window trust, permissions and data access are unchanged. The real
+  landing regression verifies idle visible, each security dialog hidden, and
+  restored on dismissal. Focused group **six passed**; Settings boundary group
+  **36 passed**. Both pre-fix failures are retained outside the source tree.
+  Production build and full lint pass (zero lint errors/seven existing warnings).
+  Full TypeScript remains baseline-equivalent at 774 diagnostics with zero
+  added/removed. Exact-head CI and the next frozen native recheck are separate
+  gates; neither is inferred from these local tests.
+- QA-only **Settings Ask QA 0.1.0** uses its supported `location: settings` entry
+  and public SDK to read only its synthetic own setting after an explicit click.
+  Exact archive SHA-256:
+  `9502a58a4804862e4b13de9fc0d1baf6ad8c2bc681c08b5c0664b552ef0aafc4`.
+  Its HTML/CSS/JS each return 200 with proper MIME/CSP through the actual plugin
+  protocol. It contains no raw IPC/test hook or external access. No GUI or running
+  app was changed by this correction; parent will build a new frozen candidate
+  after current cleanup and repeat native Settings acceptance.
 - A registered regression reproduces `Plugin permission decision provider failed`
   on exact `79a9bd6` when a Settings-owned view activates a real `settings.get`
   API configured Ask while main is unfocused. The follow-up uses the existing

docs/plugin-platform/security-and-permissions.md

@@ -47,6 +47,9 @@ focus handoff is needed. Close, cancel, timeout, lock, hide/blur, reload, crash
 and stale runtime/source fail closed. The dialog uses the existing host security
 surface marker so attached native plugin views yield while it is visible and
 restore through their existing lifecycle on dismissal.
+Ordinary landing rows do not suspend native views. The logging dialog and its
+verbose confirmation are marked security surfaces; the confirmation opts into
+the existing marker because it temporarily accessibility-hides its parent dialog.
 A plugin DOM click never becomes a host gesture. Choosers, drafts, terminal and
 clipboard sharing use their existing host-owned action tokens. Ask integrates
 with that workflow instead of opening a second capability dialog. Allow skips

docs/plugin-platform/settings-main-integration.md

@@ -0,0 +1,140 @@
+# Settings visibility and current-main acceptance candidate
+
+This isolated branch, `integration/plugin-settings-main-acceptance`, starts at
+frozen #4004 `2433cf0130d1c3274c56c39e5765349c2945de01`. Its Draft PR and private
+renderer provenance record the final exact head and CI. Frozen2433 source,
+artifact, QA workspace/profile and earlier evidence remain intact.
+
+## Inputs and production ownership
+
+Both inputs were ordinarily merged, without conflicts or manual production edits:
+
+| Input | Import | Production files and behavior |
+| --- | --- | --- |
+| Current main `a0cf2b487c9ff0b0472d622e66bc5ee20de32c71` | Merge `c4aedfa9ed8c9f2647ac26f0e6e144edab341c2d` | `domain/workspaceAiScopeHandoff.ts` keeps inherited AI chat on a surviving owner when a workspace dissolves (#4003/e3e2dcfe); `electron/bridges/ai/shellUtils.cjs` narrowly recognizes Oh My Zsh ys two-line idle prompts (#4008/a0cf2b48) |
+| Policy `1551fa8355021b5a811d737d16f81e8070f99f5d` | Merge `714e2397a43dc6c083dce8afeeb7a0475de11384` | `PluginLogSettings.tsx` removes the idle-row security marker and opts the nested verbose confirmation into it; `confirm-dialog.tsx` adds the optional host-only marker with default false |
+
+All four production files exactly match their respective owners. Main has only
+those two new commits since common base f0897c3c. Neither changed file overlaps
+the prior plugin changes. The new prompt utility is not imported by plugin
+production modules; plugin sensitive-input, selection and source guards remain
+unchanged. Existing prompt and live-PTY-byte suffix tests still reject bare
+markers and pending input. These are synthetic tests, not a new native SSH pass.
+
+The input also owns its real Settings landing regression and documentation.
+The existing observer, Ask marker, IPC/window authority, sandbox, resource/source
+controls, AI d33 wiring, schemas, sample bytes and package/lock inputs are
+unchanged. `ModelSelector.tsx` equals2433: separate #4002 is not included. Global
+Agent/custom Chat #4006 and terminal diagnostic #3999 are excluded. No main merge,
+Ready transition, original-PR closure or release is part of this handoff.
+
+The parent reports the1551-vs89 independent delta review scoped clean: idle
+Settings no longer requests suspension, the real logging dialog remains marked,
+its nested verbose portal protects itself while the parent is accessibility-
+hidden, closing the nested dialog leaves the parent protected, and closing all
+dialogs permits restoration. This source-only result is not native resolution
+of the recorded Settings blank body.
+
+## Frozen2433 native results
+
+The parent supplied these results; this coding executor did not run the GUI:
+
+| Case | Result on2433 |
+| --- | --- |
+| Main Ask visible | Passed |
+| Cancel | Passed; zero provider POSTs |
+| Accept | Passed; one provider POST |
+| Stream chunks | Passed; no repeated permission prompts |
+| Content Deny | Passed |
+| Real five-minute chat expiry | Passed |
+| Settings sample body | Blank; not accepted |
+
+The idle-row suppression defect is source-confirmed. The correction requires a
+new native Settings recheck; no native success is inferred from the DOM regression.
+A later GPU exit9 and incomplete cleanup were reported separately. Its cause is
+unclassified; no source hotpatch or sandbox/GPU workaround was used here.
+
+Consumer verification of2433's Library renderer is complete: the parent checked
+the matching full source/backend and all1001 renderer hashes, with native inputs
+unchanged. The earlier producer download failure remains historical evidence,
+not an outstanding consumer transfer blocker. That verified artifact still
+certifies2433 only; it does not include1551 or the new main renderer behavior.
+
+Earlier020 Default Allow cold Send/completion, Stop/Deny/restore and themes,
+677 Host core, and corrected-fixture terminal solo/split results remain scoped
+historical evidence. Terminal Focus is unreliable/unverified and QA sent one
+Enter inA during a palette attempt: no global zero-input/full-terminal-pass claim.
+The historical Rfam attempt failed socket transport before connect resolved;
+authentication/SELECT were not reached and cause/auth/TLS compatibility remain
+unverified. Final source-policy, DB, placement/lifecycle and actual hosting/CDN
+gates remain separately reconciled by the parent.
+
+## Local checks and sample provenance
+
+| Check | Result |
+| --- | --- |
+| Registered plugin runtime | 695 passed, one native skip; zero failed/cancelled |
+| Contract/SDK/CLI | 91 passed |
+| Offline examples | Five passed, one Docker opt-in skip |
+| Changed main owner/scope/prompt/suffix and terminal lifecycle group | 139 passed |
+| Actual mounted AI/permission/selected-context/Host group | 21 passed |
+| Settings boundary and security visibility group | 38 passed |
+| Contract/capability/Codex generation and committed drift | Clean |
+| Lint | Zero errors, seven existing warnings |
+| Five sample archives | Validated, built twice and byte-identical to2433 |
+
+The final exact-head normal production build, renderer inventory, bounded
+credential check, CI and Codex review are recorded in the Draft PR/artifact
+handoff. Local full-suite, native packaging and GUI success are not claimed.
+Locked dependencies, standard patches and the official pinned Electron binary
+were prepared normally; no header, HOME, sandbox or native shim workaround.
+
+[Exact sample IDs, permissions/resources and hashes](settings-main-packages.json)
+preserve all prior provenance, including Assistant7943d4c3, ownedDBf01c6a24,
+Rfamaaca5866, Hostcf04f82d and terminal4c9c2388. Whole archive equality was
+asserted, rather than inferred from unchanged source. The owned10.77.0.20 endpoint
+is packaging-only, not a running fixture. No package was activated or service
+queried by this executor.
+
+The owner's separate QA-only Settings Ask sample has reported SHA-256
+`9502a58a4804862e4b13de9fc0d1baf6ad8c2bc681c08b5c0664b552ef0aafc4`.
+It is not one of these five repository examples and was not rebuilt here. The
+native owner must retain its exact verified manifest/source/permissions and
+fixture provenance; no package ID, permission expansion or hash equivalence is
+invented by this integration.
+
+## Native preparation and bounded recheck
+
+1. After the parent's GUI/Nginx slot is released, use a NEW isolated checkout of
+   the final exact head and a separate synthetic QA profile. Preserve the old2433
+   workspace/profile and recordings. Materialize the new private Library artifact
+   in the consumer's own workspace and verify archive and every renderer hash.
+2. Use the complete matching backend checkout: frontend-only dist does not carry
+   the CJS prompt helper or native dependencies. Match package/lock hashes to
+   independently normally rebuilt native inputs and prepare workspace packages
+   normally. Install dist as a whole; use the ordinary Electron launch without
+   Vite and with normal sandbox/helper settings. This is unpackaged native
+   production-renderer QA, not packaged-binary certification.
+3. Open the verified Settings sample through its existing supported settings
+   entry. Check the idle body is visible/clickable with the logging row present.
+   Open logging and the nested verbose confirmation separately; native content
+   must yield to each, remain hidden after cancelling the nested confirmation,
+   and restore only after the parent closes. Do not enable real verbose logging
+   or collect real content for this check.
+4. In the ready/focused/visible/unlocked Settings owner, exercise its synthetic
+   own-setting Ask operation. Record visible Ask, explicit cancel/accept, exact
+   current operation outcome and restoration. Recheck main Ask briefly. Preserve
+   the2433 main/content/expiry counters and any unrun matrix cases separately.
+5. Use owned synthetic A/B AI chats: form a workspace, prefer B, dissolve while A
+   survives and confirm both histories stay with their owners. Remove A and
+   check bounded fallback to B. Confirm handoff alone does not invoke a model or
+   re-share content. Exercise selected-target invalidation across the transition
+   with inert drafts and no PTY input. Do not treat earlier Focus uncertainty as
+   resolved by this main domain fix.
+6. Record exact source/artifact/sample identities, screenshots/video, request
+   counters, cleanup and unrun cases. No fallback endpoint/probe, real credentials,
+   paid API, security relaxation or unrecognized installation is authorized here.
+
+If main advances after this pinned a0cf snapshot, compare the new delta and assess
+its affected checks before landing. The current candidate deliberately does not
+chase unrelated changes while native preparation is in progress.

docs/plugin-platform/settings-main-packages.json

@@ -0,0 +1,217 @@
+[
+  {
+    "name": "assistant",
+    "id": "com.netcatty.assistant",
+    "version": "0.1.0",
+    "fileCount": 6,
+    "bytes": 17214,
+    "sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "contentSha256": "c3e31e9613422bf9a05ccaa5b6f234304208f1a8298b1c1ee19262ba88af6cd0",
+    "features": {
+      "required": [
+        "ai.model-invocation",
+        "context.selected-read"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        "ai.invoke",
+        "context.selected.list",
+        "context.selected.read"
+      ]
+    },
+    "package": "assistant.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "c7d784d5c3bd2feb463afd58eae3a9594615395b168174cb8a3d0677584ae395",
+    "changedEntriesFromFrozen677": [
+      "README.md",
+      "panel.css",
+      "panel.js"
+    ],
+    "previous7856Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "7943d4c3800914fe0acd3d0f3a3d7f7c1910c212a5dc58a044871a6a82485274",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "database-owned",
+    "id": "com.netcatty.database-minimal",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11660,
+    "sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "contentSha256": "4d628c41c7a231e31cd56dacb822acaaa37f61e1e98b285b0086a4f783be199d",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://10.77.0.20:3306"
+          ],
+          "reason": "Connect only to the prepared disposable fixture."
+        }
+      ]
+    },
+    "package": "database-owned.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "f01c6a24382897d4b0bf4130941274abacb9a9a963f9b56ecaceb2c020f36874",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "database-rfam-readonly",
+    "id": "com.netcatty.database-rfam-readonly",
+    "version": "0.1.0",
+    "fileCount": 5,
+    "bytes": 11003,
+    "sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "contentSha256": "f542ca7b8e821d684cf7f71f0930458bd3ad97bc94bf654c88b0f353111e9162",
+    "features": {
+      "required": [
+        "network.byte-streams"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "views"
+      ],
+      "optional": [
+        {
+          "permission": "network.stream",
+          "resources": [
+            "tcp://mysql-rfam-public.ebi.ac.uk:4497"
+          ],
+          "reason": "Run the fixed public Rfam acceptance query only after explicit authorization."
+        }
+      ]
+    },
+    "package": "database-rfam-readonly.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "aaca586669db454e91d61487e576ed524d1b7190eed182bc2cd0035e59caa0d3",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "host-actions",
+    "id": "com.netcatty.host-actions",
+    "version": "0.1.0",
+    "fileCount": 3,
+    "bytes": 4633,
+    "sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "contentSha256": "d6f8bf3ae9dc417ea838f673966f2e1075fc8f9ef1d939ca85b476b1bb007e6c",
+    "features": {
+      "required": [
+        "vault.host-actions",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "vault.metadata",
+        "vault.write",
+        "ui.interact"
+      ]
+    },
+    "package": "host-actions.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "cf04f82dfe25ab5cda6f5f3dad0a8fb06c37bedf9924f556bee2b8402e542ef2",
+    "changedEntriesFrom2433": []
+  },
+  {
+    "name": "terminal-selection-draft",
+    "id": "com.netcatty.terminal-selection-draft",
+    "version": "0.1.0",
+    "fileCount": 2,
+    "bytes": 2954,
+    "sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "contentSha256": "99797d8679f34b96580076f922cbec067e511adc0f4ccf396ed129206acb6c4c",
+    "features": {
+      "required": [
+        "terminal.selection-sharing",
+        "terminal.input-drafts",
+        "commands.interactive"
+      ]
+    },
+    "permissions": {
+      "required": [
+        "commands",
+        "menus"
+      ],
+      "optional": [
+        "terminal.selection.read",
+        "terminal.input.propose"
+      ]
+    },
+    "package": "terminal-selection-draft.ncpkg",
+    "repeatIdentical": true,
+    "preparedOnlyInThisExecutor": true,
+    "previousFrozen677Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFromFrozen677": [],
+    "previous7856Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom7856": [],
+    "rebuiltAgainstPolicy": "1551fa8355021b5a811d737d16f81e8070f99f5d",
+    "rebuiltAgainstAI": "d33c0193ccaedc1a10aed9da495f040250121bef",
+    "previous020Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom020": [],
+    "rebuiltAgainstMain": "a0cf2b487c9ff0b0472d622e66bc5ee20de32c71",
+    "productionMerge": "714e2397a43dc6c083dce8afeeb7a0475de11384",
+    "previous2433Sha256": "4c9c2388b7f891156192a0b5ab7b23291beba3555e7ec8cf24fbe2dfe1242d5e",
+    "changedEntriesFrom2433": []
+  }
+]

domain/pluginPermissionDescriptions.cjs

@@ -3,8 +3,6 @@
 // Presentation only. Admission and grants remain owned by the canonical schema
 // and permission engine. Tests require exact coverage of its permission enum.
 const PERMISSION_DESCRIPTIONS = {
-  "ai.agent.use": [true, "Agent conversations", "Use configured host Agents and read this plugin's own chat history. Model or Agent service usage may incur costs.", "Agent 会话", "使用宿主已配置的 Agent，并读取此插件自己的聊天历史；模型或 Agent 服务可能产生费用。"],
-  "ai.agent.actions": [true, "Agent actions", "Authorize Agent tools against explicitly selected targets under this plugin's policy. Commands can change remote systems.", "Agent 操作", "根据插件策略授权 Agent 工具操作明确选中的目标；命令可能更改远程系统。"],
   storage: [false, "Plugin storage", "Save and read this plugin's local data.", "插件存储", "保存和读取此插件自己的本地数据。"],
   "runtime.advanced": [true, "Full device access", "Run Node code with filesystem and network access outside broker restrictions. Developer mode only.", "完整设备访问", "运行 Node 代码，可直接访问文件系统和网络，不受代理权限限制。仅限开发者模式。"],
   "settings.read": [false, "Read plugin settings", "Read this plugin's configured preferences.", "读取插件设置", "读取此插件自己的设置。"],

domain/workspaceAiScopeHandoff.test.ts

@@ -108,7 +108,7 @@ test('handoffDissolvedWorkspaceAIScope retargets inherited chat when its pane is
   });
 });
 
-test('handoffDissolvedWorkspaceAIScope retargets inherited chat when original pane also survives', () => {
+test('handoffDissolvedWorkspaceAIScope keeps inherited chat on its surviving owner pane', () => {
   const result = handoffDissolvedWorkspaceAIScope({
     activeSessionIdMap: {
       'workspace:ws-1': 'chat-a',
@@ -132,12 +132,52 @@ test('handoffDissolvedWorkspaceAIScope retargets inherited chat when original pa
     preferredTerminalId: 'term-b',
   });
 
-  assert.equal(result.changed, true);
-  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-a');
-  assert.equal(result.activeSessionIdMap['terminal:term-a'], null);
-  assert.equal(result.sessions[0]?.scope.targetId, 'term-b');
+  assert.equal(result.activeSessionIdMap['terminal:term-a'], 'chat-a');
+  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-b');
+  assert.equal(result.sessions[0]?.scope.type, 'terminal');
+  assert.equal(result.sessions[0]?.scope.targetId, 'term-a');
+  assert.equal(result.sessions[0]?.updatedAt, 1);
   assert.equal(result.sessions[1]?.scope.targetId, 'term-b');
-  assert.deepEqual(result.panelViewByScope['terminal:term-b'], {
+  assert.deepEqual(result.panelViewByScope['terminal:term-a'], {
+    mode: 'session',
+    sessionId: 'chat-a',
+  });
+  assert.equal(result.panelViewByScope['terminal:term-b'], undefined);
+});
+
+test('handoffDissolvedWorkspaceAIScope keeps owner history when the other pane is preferred', () => {
+  const result = handoffDissolvedWorkspaceAIScope({
+    activeSessionIdMap: {
+      'workspace:ws-1': 'chat-a',
+      'terminal:term-b': 'chat-b',
+    },
+    sessions: [
+      {
+        id: 'chat-a',
+        scope: { type: 'terminal', targetId: 'term-a', hostIds: ['host-a'] },
+        updatedAt: 1,
+      },
+      {
+        id: 'chat-b',
+        scope: { type: 'terminal', targetId: 'term-b', hostIds: ['host-b'] },
+        updatedAt: 1,
+      },
+    ],
+    workspaceId: 'ws-1',
+    terminalIds: ['term-a', 'term-b'],
+    preferredTerminalId: 'term-b',
+    panelViewByScope: {
+      'workspace:ws-1': { mode: 'session', sessionId: 'chat-a' },
+    },
+  });
+
+  assert.equal(result.changed, true);
+  assert.equal(result.activeSessionIdMap['terminal:term-a'], 'chat-a');
+  assert.equal(result.activeSessionIdMap['terminal:term-b'], 'chat-b');
+  assert.equal(result.sessions[0]?.scope.targetId, 'term-a');
+  assert.equal(result.sessions[1]?.id, 'chat-b');
+  assert.equal(result.sessions[1]?.scope.targetId, 'term-b');
+  assert.deepEqual(result.panelViewByScope['terminal:term-a'], {
     mode: 'session',
     sessionId: 'chat-a',
   });

domain/workspaceAiScopeHandoff.ts

@@ -78,13 +78,15 @@ export function seedWorkspaceAIActiveSessionFromMembers(input: {
 }
 
 /**
- * When a workspace tab dissolves, copy its active chat onto the preferred
- * surviving terminal before the workspace scope key is pruned. Also remint
- * workspace-scoped chats and the handed-off active chat when it still lives
- * under a different terminal (including one that also survives dissolve),
- * clear that previous terminal selection so ownership filters do not hide the
- * chat, and seed a session panel view so terminal scopes do not fall back to
- * a blank draft.
+ * When a workspace tab dissolves, copy its active chat onto a surviving
+ * terminal before the workspace scope key is pruned. An inherited chat that
+ * is already terminal-scoped to a pane still in `terminalIds` stays on that
+ * owner, even when focus/preferred is a different survivor. Otherwise the
+ * target is the preferred survivor, or the first remaining terminal when the
+ * original pane is gone. Workspace-scoped chats are reminted onto that
+ * target, duplicate terminal map entries for the same chat are cleared, and
+ * a session panel view is seeded so terminal scopes do not fall back to a
+ * blank draft.
  */
 export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoffLike>(input: {
   activeSessionIdMap: AIActiveSessionIdMap;
@@ -99,7 +101,7 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
   panelViewByScope: Record<string, AIPanelViewHandoffLike>;
   changed: boolean;
 } {
-  const preferredTerminalId = (
+  const fallbackTerminalId = (
     input.preferredTerminalId
     && input.terminalIds.includes(input.preferredTerminalId)
       ? input.preferredTerminalId
@@ -109,6 +111,17 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
   const workspaceKey = buildAIScopeKey('workspace', input.workspaceId);
   const workspaceActive = input.activeSessionIdMap[workspaceKey];
   const hasWorkspaceActive = typeof workspaceActive === 'string' && workspaceActive.length > 0;
+  const activeSession = hasWorkspaceActive
+    ? input.sessions.find((session) => session.id === workspaceActive)
+    : undefined;
+  const survivingOwnerTerminalId = (
+    activeSession?.scope.type === 'terminal'
+    && activeSession.scope.targetId
+    && input.terminalIds.includes(activeSession.scope.targetId)
+      ? activeSession.scope.targetId
+      : null
+  );
+  const handoffTargetTerminalId = survivingOwnerTerminalId ?? fallbackTerminalId;
   const previousPanelViewByScope = (
     input.panelViewByScope as Record<string, AIPanelViewHandoffLike> | undefined
   ) ?? {};
@@ -118,8 +131,8 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
   };
   let mapChanged = false;
 
-  if (preferredTerminalId && hasWorkspaceActive) {
-    const terminalKey = buildAIScopeKey('terminal', preferredTerminalId);
+  if (handoffTargetTerminalId && hasWorkspaceActive) {
+    const terminalKey = buildAIScopeKey('terminal', handoffTargetTerminalId);
     let map = nextMap;
     let changed = false;
     if (map[terminalKey] !== workspaceActive) {
@@ -145,24 +158,23 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
 
   let sessionsChanged = false;
   const nextSessions = input.sessions.map((session) => {
-    if (!preferredTerminalId) return session;
+    if (!handoffTargetTerminalId) return session;
 
     const isWorkspaceScoped = (
       session.scope.type === 'workspace'
       && session.scope.targetId === input.workspaceId
     );
-    // Inherited member chats stay terminal-scoped under the original pane.
-    // Prefer the focused survivor even when that original pane also survives
-    // dissolve, otherwise B's history ownership filter excludes A's chat.
+    // Keep an inherited chat on its owner when that pane survives. Remint
+    // only when the handoff target is a different terminal (original pane gone).
     const isInheritedActiveChatOnOtherTerminal = (
       hasWorkspaceActive
       && session.id === workspaceActive
       && session.scope.type === 'terminal'
       && Boolean(session.scope.targetId)
-      && session.scope.targetId !== preferredTerminalId
+      && session.scope.targetId !== handoffTargetTerminalId
     );
     if (!isWorkspaceScoped && !isInheritedActiveChatOnOtherTerminal) return session;
-    if (session.scope.type === 'terminal' && session.scope.targetId === preferredTerminalId) {
+    if (session.scope.type === 'terminal' && session.scope.targetId === handoffTargetTerminalId) {
       return session;
     }
 
@@ -172,7 +184,7 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
       scope: {
         ...session.scope,
         type: 'terminal',
-        targetId: preferredTerminalId,
+        targetId: handoffTargetTerminalId,
       },
       updatedAt: Date.now(),
     };
@@ -182,8 +194,8 @@ export function handoffDissolvedWorkspaceAIScope<T extends AISessionScopeHandoff
   const nextPanelViewByScope: Record<string, AIPanelViewHandoffLike> = {
     ...previousPanelViewByScope,
   };
-  if (preferredTerminalId && hasWorkspaceActive) {
-    const terminalKey = buildAIScopeKey('terminal', preferredTerminalId);
+  if (handoffTargetTerminalId && hasWorkspaceActive) {
+    const terminalKey = buildAIScopeKey('terminal', handoffTargetTerminalId);
     const workspacePanelView = previousPanelViewByScope[workspaceKey];
     const terminalPanelView = previousPanelViewByScope[terminalKey];
     const nextView: AIPanelViewHandoffLike = (

electron/bridges/ai/shellUtils.cjs

@@ -71,9 +71,17 @@ const POSIX_PROMPT_PATTERN = /^(?:[^\s@]+@[^\s:]+(?::[^\n\r]*)?|\[[^\s@\]]+@[^\s
 
 // Host line of a two-line bash PS1 (`\u@\h: \w` then a following `$` or `#`).
 // Same user@host[:path] class as POSIX_PROMPT_PATTERN's first alternative,
-// without a prompt marker on this line. A bare `$`/`#` alone is not a prompt.
+// without a prompt marker on this line. Oh My Zsh `ys` uses a different host
+// line (`# user @ host ...`), matched separately below. A bare `$`/`#` alone
+// is not a prompt.
 const POSIX_PROMPT_HOST_LINE_PATTERN = /^[^\s@]+@[^\s:]+(?::[^\n\r]*)?$/;
 
+// Oh My Zsh `ys` status line: a decorative `#`, then `user @ host` with
+// spaces around `@`, then an optional remainder (directory, git, venv, time,
+// exit code). Example: `# user @ host in ~ [12:34:56]`. Arbitrary text before
+// a bare `$`/`#` still does not match.
+const OH_MY_ZSH_YS_HOST_LINE_PATTERN = /^#\s+[^\s@]+\s+@\s+[^\s]+(?:\s+[^\n\r]+)?$/;
+
 // Alpine's default ash PS1 omits the username: `\h:\w\$ ` -> `localhost:~# `.
 // Require a hostname and a home/absolute path, excluding prompt delimiters
 // within the path so partially entered commands do not count as idle prompts.
@@ -124,12 +132,15 @@ function extractTrailingIdlePrompt(output) {
     return lastLine;
   }
 
-  // Two-line PS1 (`export PS1="\u@\h: \w\n$ "`). Bash emits the newline as
-  // CR and the PTY's ONLCR adds another, so the bytes are `\r\r\n`. The
-  // CR-to-LF normalize above turns that into blank lines between the host
-  // line and `$`/`#`. Keep those blanks in the cache: getFreshIdlePrompt
-  // uses the same normalize, and hasExpectedPromptSuffix compares this
-  // CR-as-LF form against live PTY bytes. A lone `$` must not satisfy endsWith.
+  // Two-line PS1. Classic bash is `export PS1="\u@\h: \w\n$ "`. Oh My Zsh
+  // `ys` paints `# user @ host ...` and then a bare `$` or `#`. Bash emits
+  // the newline as CR and the PTY's ONLCR adds another, so the bytes are
+  // `\r\r\n`. The CR-to-LF normalize above turns that into blank lines
+  // between the host line and `$`/`#`. Keep those blanks in the cache:
+  // getFreshIdlePrompt uses the same normalize, and hasExpectedPromptSuffix
+  // compares this CR-as-LF form against live PTY bytes. A lone `$`/`#` must
+  // not satisfy endsWith; the previous non-empty line has to be a recognized
+  // host line (classic `user@host[:path]` or Oh My Zsh `ys`).
   if (rightTrimmed === "$" || rightTrimmed === "#") {
     let hostIndex = lines.length - 1;
     while (hostIndex >= 0 && lines[hostIndex].replace(/\s+$/, "") === "") {
@@ -137,7 +148,13 @@ function extractTrailingIdlePrompt(output) {
     }
     const previousLine = hostIndex >= 0 ? lines[hostIndex] : "";
     const previousRightTrimmed = previousLine.replace(/\s+$/, "");
-    if (POSIX_PROMPT_HOST_LINE_PATTERN.test(previousRightTrimmed)) {
+    // Same optional "(name) " env prefix as isDefaultPosixPromptLine (#3947).
+    // Recognition only; the returned prompt keeps the visible prefix.
+    const previousHostLine = previousRightTrimmed.replace(/^\([^()\n\r]+\)\s+/, "");
+    if (
+      POSIX_PROMPT_HOST_LINE_PATTERN.test(previousHostLine)
+      || OH_MY_ZSH_YS_HOST_LINE_PATTERN.test(previousHostLine)
+    ) {
       return `${lines.slice(hostIndex).join("\n")}\n${lastLine}`;
     }
   }
@@ -202,8 +219,9 @@ function trackSessionIdlePrompt(session, chunk) {
 // Return `session.lastIdlePrompt` only if the PTY's recent rolling tail
 // still ends with it. The cached prompt is updated only when
 // extractTrailingIdlePrompt recognizes a known shape (PowerShell, cmd.exe,
-// `user@host[:path][#$]`, two-line `user@host[:path]` + `$`/`#`,
-// RHEL `[user@host path][#$]`, or Alpine `host:path[#$]`);
+// `user@host[:path][#$]`, two-line classic `user@host[:path]` or Oh My Zsh
+// `ys` (`# user @ host ...`) + `$`/`#`, RHEL `[user@host path][#$]`, or
+// Alpine `host:path[#$]`);
 // a remote shell switch into another shell, an oh-my-posh / starship / custom
 // PS1, or any unrecognized prompt would
 // otherwise leave a stale value behind, which `resolveEffectiveShellKind`

electron/bridges/ai/shellUtils.test.cjs

@@ -262,6 +262,83 @@ test("trackSessionIdlePrompt and getFreshIdlePrompt accept a two-line user@host
   assert.equal(getFreshIdlePrompt(ptySession), "user@host: /home/foo\n\n\n$ ");
 });
 
+test("extractTrailingIdlePrompt recognizes an Oh My Zsh ys two-line idle prompt", () => {
+  // ys paints `# user @ host ...` then a bare `$` or `#`. Spaces around `@`
+  // and the leading decorative `#` are required; a lone marker is not a prompt.
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\n$ "),
+    "# user @ host in ~ [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\n# user @ host in ~ [12:34:56]\n# "),
+    "# user @ host in ~ [12:34:56]\n# ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~/proj on git:main [12:34:56]\n$ "),
+    "# user @ host in ~/proj on git:main [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("welcome\r\n# ys @ ys-mbp in ~/.oh-my-zsh on git:master x [21:47:42] C:127\n$ "),
+    "# ys @ ys-mbp in ~/.oh-my-zsh on git:master x [21:47:42] C:127\n$ ",
+  );
+  // Same CR / CRLF blank lines as the classic two-line PS1.
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\r\r\n$ "),
+    "# user @ host in ~ [12:34:56]\n\n\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\r\n# "),
+    "# user @ host in ~ [12:34:56]\n\n# ",
+  );
+  // Optional "(name) " env prefix is stripped only for recognition (#3947).
+  assert.equal(
+    extractTrailingIdlePrompt("(venv) # user @ host in ~ [12:34:56]\n$ "),
+    "(venv) # user @ host in ~ [12:34:56]\n$ ",
+  );
+  assert.equal(
+    extractTrailingIdlePrompt("(venv) user@host: /home/foo\n$ "),
+    "(venv) user@host: /home/foo\n$ ",
+  );
+
+  assert.equal(extractTrailingIdlePrompt("$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# "), "");
+  assert.equal(extractTrailingIdlePrompt("welcome\r\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("not a host line\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("user @ host in ~\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# user host in ~ [12:34:56]\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("# user@host in ~ [12:34:56]\n$ "), "");
+  assert.equal(extractTrailingIdlePrompt("copied output\n# "), "");
+  assert.equal(extractTrailingIdlePrompt("# user @ host in ~ [12:34:56]\n$ ls"), "");
+  assert.equal(extractTrailingIdlePrompt("# user @ host in ~ [12:34:56] $"), "");
+  assert.equal(extractTrailingIdlePrompt("echo $"), "");
+  assert.equal(extractTrailingIdlePrompt("price is 5$"), "");
+  assert.equal(extractTrailingIdlePrompt("(venv) not a host line\n$ "), "");
+});
+
+test("trackSessionIdlePrompt and getFreshIdlePrompt accept an Oh My Zsh ys two-line prompt", () => {
+  const session = {};
+  const prompt = "# user @ host in ~ [12:34:56]\n$ ";
+  trackSessionIdlePrompt(session, `welcome\r\n${prompt}`);
+  assert.equal(getFreshIdlePrompt(session), prompt);
+
+  const extra = {};
+  trackSessionIdlePrompt(extra, "# user @ host in ~/proj on git:main [12:34:56]\r\r\n$ ");
+  assert.equal(
+    getFreshIdlePrompt(extra),
+    "# user @ host in ~/proj on git:main [12:34:56]\n\n\n$ ",
+  );
+
+  const root = {};
+  trackSessionIdlePrompt(root, "# user @ host in ~ [12:34:56]\n# ");
+  assert.equal(getFreshIdlePrompt(root), "# user @ host in ~ [12:34:56]\n# ");
+
+  const bare = {};
+  assert.equal(trackSessionIdlePrompt(bare, "$ "), "");
+  assert.equal(getFreshIdlePrompt(bare), "");
+  assert.equal(trackSessionIdlePrompt(bare, "not a host line\n$ "), "");
+  assert.equal(getFreshIdlePrompt(bare), "");
+});
+
 test("extractTrailingIdlePrompt still recognizes a classic single-line POSIX prompt", () => {
   assert.equal(extractTrailingIdlePrompt("welcome\r\nuser@host:~$ "), "user@host:~$ ");
 });

electron/plugins/agent/contract.test.cjs

@@ -1,47 +0,0 @@
-"use strict";
-
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const { randomUUID } = require("node:crypto");
-const { createDefinitionValidator } = require("../contractValidator.cjs");
-
-test("Agent wire accepts only opaque host configuration/scope refs, never raw backend authority", () => {
-  const open = createDefinitionValidator("PluginAgentOpenParams");
-  const params = { backendRef: randomUUID(), selectionHandle: randomUUID() };
-  assert.equal(open(params), true);
-  for (const [key, value] of Object.entries({ permissionMode: "auto", owner: "source:forged", privateOwner: "forged",
-    source: "official", model: "chosen", agentId: "claude", apiKey: "synthetic-not-a-key", cli: "node",
-    env: {}, mcpServers: {}, sessionIds: ["focused-session"], externalSessionId: "native-session" })) {
-    assert.equal(open({ ...params, [key]: value }), false, key);
-  }
-  for (const key of ["backendRef", "selectionHandle", "conversationRef"]) {
-    assert.equal(open({ ...params, [key]: "internal-or-path-id" }), false, key);
-  }
-});
-
-test("Agent messages and events are bounded and do not serialize raw tools/configuration", () => {
-  const send = createDefinitionValidator("PluginAgentSendParams");
-  const params = { chatHandle: randomUUID(), text: "Synthetic user instruction" };
-  assert.equal(send(params), true);
-  assert.equal(send({ ...params, text: "x".repeat(16_385) }), false);
-  assert.equal(send({ ...params, text: "a\0b" }), false);
-  assert.equal(send({ ...params, turnId: "builtin" }), false);
-  const event = createDefinitionValidator("PluginAgentEvent");
-  assert.equal(event({ kind: "activity", capabilityId: "terminal.execute", state: "started" }), true);
-  assert.equal(event({ kind: "activity", capabilityId: "terminal.execute", state: "started", args: { command: "raw" } }), false);
-  assert.equal(event({ kind: "usage", inputTokens: 2, outputTokens: 4 }), true);
-  assert.equal(event({ kind: "usage", inputTokens: -1, outputTokens: 4 }), false);
-  assert.equal(event({ kind: "text", text: "x".repeat(4097) }), false);
-  assert.equal(event({ kind: "provider-error", message: "private diagnostics" }), false);
-});
-
-test("public chat/history summaries do not contain backend/native identifiers, prompts or tool results", () => {
-  const chats = createDefinitionValidator("PluginAgentChatsResult");
-  const chat = { conversationRef: randomUUID(), title: "Synthetic chat", backend: "claude", updatedAt: 1 };
-  assert.equal(chats({ items: [chat] }), true);
-  assert.equal(chats({ items: [{ ...chat, externalSessionId: "native" }] }), false);
-  const history = createDefinitionValidator("PluginAgentHistoryResult");
-  assert.equal(history({ items: [{ role: "assistant", text: "Summary" }] }), true);
-  assert.equal(history({ items: [{ role: "tool", text: "Raw tool result" }] }), false);
-  assert.equal(history({ items: [{ role: "assistant", text: "Summary", apiKey: "synthetic" }] }), false);
-});

electron/plugins/agent/conversationStore.cjs

@@ -1,122 +0,0 @@
-"use strict";
-
-const fs = require("node:fs/promises");
-const path = require("node:path");
-const { createHash, randomUUID } = require("node:crypto");
-
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
-const MAX_BYTES = 1_048_576;
-const MAX_CONVERSATIONS = 64;
-
-// Core-owned AISession documents, outside plugin filesystem/storage roots.
-// The caller must authenticate provenance before supplying the opaque owner.
-// Native resume identity, compaction and tool history stay in this repository;
-// only a separate public projection is returned through the plugin API.
-class PluginAgentConversationStore {
-  constructor(directory) {
-    if (!path.isAbsolute(directory)) throw new TypeError("Absolute host history directory required");
-    this.directory = directory;
-    this.pending = new Map();
-  }
-
-  #ownerDirectory(owner) {
-    if (!owner || typeof owner.privateOwner !== "string" || !owner.privateOwner
-      || typeof owner.sourceKey !== "string" || !owner.sourceKey) throw new TypeError("Host provenance required");
-    return path.join(this.directory, createHash("sha256").update(JSON.stringify([owner.sourceKey, owner.privateOwner])).digest("hex"));
-  }
-
-  #filename(owner, id) {
-    if (typeof id !== "string" || !UUID.test(id)) throw new TypeError("Invalid owned conversation reference");
-    return path.join(this.#ownerDirectory(owner), `${id}.json`);
-  }
-
-  async #prepare(owner) {
-    await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });
-    if (!(await fs.lstat(this.directory)).isDirectory() || (await fs.lstat(this.directory)).isSymbolicLink()) throw Error("History root unavailable");
-    const directory = this.#ownerDirectory(owner);
-    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
-    const stat = await fs.lstat(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("History owner unavailable");
-    return directory;
-  }
-
-  #validate(record) {
-    if (!record || typeof record !== "object" || !UUID.test(record.conversationRef)
-      || typeof record.id !== "string" || !record.id.startsWith("plugin-agent:")
-      || record.scope?.type !== "global" || record.scope.targetId !== undefined
-      || typeof record.agentId !== "string" || typeof record.title !== "string" || record.title.length > 160
-      || !Array.isArray(record.messages) || record.messages.length > 200
-      || !Number.isSafeInteger(record.createdAt) || !Number.isSafeInteger(record.updatedAt)) throw new TypeError("Invalid core Agent history");
-    const text = JSON.stringify(record);
-    if (Buffer.byteLength(text) > MAX_BYTES) throw new RangeError("Agent history budget exceeded");
-    return text;
-  }
-
-  async #serial(owner, operation) {
-    const key = this.#ownerDirectory(owner);
-    const previous = this.pending.get(key) ?? Promise.resolve();
-    const current = previous.catch(() => {}).then(operation);
-    this.pending.set(key, current);
-    try { return await current; }
-    finally { if (this.pending.get(key) === current) this.pending.delete(key); }
-  }
-
-  async list(owner, assertCurrent) {
-    await assertCurrent();
-    const directory = await this.#prepare(owner);
-    const files = await fs.readdir(directory);
-    const records = [];
-    for (const file of files) {
-      const id = file.slice(0, -5);
-      if (!file.endsWith(".json") || !UUID.test(id)) continue;
-      if (records.length >= MAX_CONVERSATIONS) break;
-      const record = await this.read(owner, id, assertCurrent);
-      if (record) records.push(record);
-    }
-    await assertCurrent();
-    return records.sort((a, b) => b.updatedAt - a.updatedAt);
-  }
-
-  async read(owner, id, assertCurrent) {
-    await assertCurrent();
-    const filename = this.#filename(owner, id);
-    await this.#prepare(owner);
-    let file;
-    try {
-      // O_NOFOLLOW avoids following a replaced final path. Core owns ancestors.
-      const { constants } = require("node:fs");
-      file = await fs.open(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-      const stat = await file.stat();
-      if (!stat.isFile() || stat.size > MAX_BYTES) throw Error("Agent history unavailable");
-      const record = JSON.parse(await file.readFile("utf8"));
-      this.#validate(record);
-      if (record.conversationRef !== id) throw Error("Agent history identity mismatch");
-      await assertCurrent();
-      return record;
-    } catch (error) {
-      if (error.code === "ENOENT") { await assertCurrent(); return null; }
-      throw error;
-    } finally { await file?.close(); }
-  }
-
-  async save(owner, record, assertCurrent) {
-    // Clone/serialize before any await so caller mutation cannot change commit.
-    const text = this.#validate(record);
-    const id = record.conversationRef;
-    return this.#serial(owner, async () => {
-      await assertCurrent();
-      const directory = await this.#prepare(owner);
-      const filename = this.#filename(owner, id);
-      const entries = (await fs.readdir(directory)).filter((name) => name.endsWith(".json"));
-      if (!entries.includes(`${id}.json`) && entries.length >= MAX_CONVERSATIONS) throw new RangeError("Agent conversation budget exceeded");
-      const temporary = path.join(directory, `.${randomUUID()}.tmp`);
-      try {
-        await fs.writeFile(temporary, text, { encoding: "utf8", mode: 0o600, flag: "wx" });
-        await assertCurrent();
-        await fs.rename(temporary, filename);
-      } finally { await fs.rm(temporary, { force: true }); }
-    });
-  }
-}
-
-module.exports = { PluginAgentConversationStore };

electron/plugins/agent/conversationStore.test.cjs

@@ -1,68 +0,0 @@
-"use strict";
-
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs/promises");
-const os = require("node:os");
-const path = require("node:path");
-const { randomUUID } = require("node:crypto");
-const { PluginAgentConversationStore } = require("./conversationStore.cjs");
-
-const owner = (source) => ({ privateOwner: `opaque:${source}:same-plugin-id`, sourceKey: `source:${source}` });
-const current = async () => {};
-function record() {
-  const conversationRef = randomUUID();
-  return { conversationRef, id: `plugin-agent:${randomUUID()}`, title: "Synthetic chat", agentId: "catty",
-    scope: { type: "global" }, messages: [{ id: randomUUID(), role: "user", content: "Synthetic only", timestamp: 1 }], createdAt: 1, updatedAt: 1 };
-}
-async function fixture(t) {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-agent-history-test-"));
-  t.after(() => fs.rm(root, { recursive: true, force: true }));
-  return { root, store: new PluginAgentConversationStore(path.join(root, "core-history")) };
-}
-
-test("core history survives reopening, uses existing AISession shape and isolates the same plugin ID across sources", async (t) => {
-  const { root, store } = await fixture(t); const chat = record();
-  await store.save(owner("a"), chat, current);
-  assert.deepEqual(await store.read(owner("a"), chat.conversationRef, current), chat);
-  const [directory] = await fs.readdir(path.join(root, "core-history"));
-  assert.doesNotMatch(directory, /opaque|same-plugin/);
-  const mode = (await fs.stat(path.join(root, "core-history", directory, `${chat.conversationRef}.json`))).mode;
-  if (process.platform !== "win32") assert.equal(mode & 0o777, 0o600);
-  assert.equal(await store.read(owner("b"), chat.conversationRef, current), null);
-  assert.deepEqual(await store.list(owner("b"), current), []);
-  const reopened = new PluginAgentConversationStore(path.join(root, "core-history"));
-  assert.deepEqual(await reopened.list(owner("a"), current), [chat]);
-});
-
-test("source revoked before async rename leaves previous history intact and cleans temporary files", async (t) => {
-  const { store, root } = await fixture(t); const chat = record(); await store.save(owner("a"), chat, current);
-  const next = { ...chat, title: "Must not commit" }; let checks = 0;
-  await assert.rejects(store.save(owner("a"), next, async () => { if (++checks === 2) throw Error("Revoked"); }));
-  assert.equal((await store.read(owner("a"), chat.conversationRef, current)).title, chat.title);
-  const [directory] = await fs.readdir(path.join(root, "core-history"));
-  assert.deepEqual(await fs.readdir(path.join(root, "core-history", directory)), [`${chat.conversationRef}.json`]);
-});
-
-test("history snapshots cannot mutate across await, and traversal/builtin IDs/oversized records are rejected", async (t) => {
-  const { store } = await fixture(t); const chat = record(); const savedTitle = chat.title;
-  const saved = store.save(owner("a"), chat, current); chat.title = "Changed after call"; await saved;
-  assert.equal((await store.read(owner("a"), chat.conversationRef, current)).title, savedTitle);
-  for (const id of ["../outside", "builtin-chat", "source:owner", ""]) await assert.rejects(store.read(owner("a"), id, current));
-  await assert.rejects(store.save({ privateOwner: "bare-plugin" }, record(), current));
-  await assert.rejects(store.save(owner("a"), { ...record(), id: "builtin-chat" }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), scope: { type: "workspace", targetId: "active" } }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), messages: Array(201).fill({}) }, current));
-  await assert.rejects(store.save(owner("a"), { ...record(), messages: [{ content: "x".repeat(1_048_576) }] }, current));
-});
-
-test("symlinked history roots and files do not become history authority", async (t) => {
-  const { root, store } = await fixture(t); const chat = record(); await store.save(owner("a"), chat, current);
-  const history = path.join(root, "core-history"); const [directory] = await fs.readdir(history);
-  const filename = path.join(history, directory, `${chat.conversationRef}.json`);
-  const unrelated = path.join(root, "unrelated.json"); await fs.writeFile(unrelated, JSON.stringify(chat));
-  await fs.rm(filename); await fs.symlink(unrelated, filename);
-  await assert.rejects(store.read(owner("a"), chat.conversationRef, current));
-  const linked = path.join(root, "linked"); await fs.symlink(history, linked, "dir");
-  await assert.rejects(new PluginAgentConversationStore(linked).list(owner("a"), current));
-});

electron/plugins/agent/delegatedScope.cjs

@@ -1,180 +0,0 @@
-"use strict";
-
-const { randomUUID } = require("node:crypto");
-const { PluginRpcError, RPC_ERRORS } = require("../rpcRouter.cjs");
-
-const fail = (code) => new PluginRpcError(RPC_ERRORS[code], "Delegated Agent scope is unavailable");
-const key = (target) => JSON.stringify([target.kind, target.id]);
-const isRequestCancellation = (error, context) => context.signal?.aborted === true
-  && (error === context.signal.reason || error?.name === "AbortError" || error?.name === "TimeoutError"
-    || error?.code === RPC_ERRORS.cancelled || error?.code === RPC_ERRORS.deadlineExceeded);
-
-// Host-only authority, not a plugin RPC interface or an Agent engine. The host
-// supplies snapshots after resolving configured backends and choosing targets.
-// Plugins never supply owner, revision, capability policy or executable adapters.
-class DelegatedAgentScopes {
-  constructor({ resolveOwner, assertHostActive, authorizeAction, clock = Date.now }) {
-    for (const fn of [resolveOwner, assertHostActive, authorizeAction, clock]) {
-      if (typeof fn !== "function") throw new TypeError("Host scope adapters are required");
-    }
-    this.resolveOwner = resolveOwner;
-    this.assertHostActive = assertHostActive;
-    this.authorizeAction = authorizeAction;
-    this.clock = clock;
-    this.scopes = new Map();
-    this.closed = false;
-  }
-
-  async #owner(context) {
-    if (this.closed) throw fail("unavailable");
-    const owner = await this.resolveOwner(context);
-    await this.assertHostActive(context);
-    context.signal?.throwIfAborted();
-    if (this.closed || await this.resolveOwner(context) !== owner) throw fail("permissionDenied");
-    return owner;
-  }
-
-  // The snapshot is host-owned. A public schema must only accept returned handles.
-  async issue(context, { backend, targets, capabilities }) {
-    const owner = await this.#owner(context);
-    if (!backend || typeof backend.key !== "string" || typeof backend.revision !== "string"
-      || typeof backend.isCurrent !== "function" || !Array.isArray(targets) || targets.length > 32
-      || !Array.isArray(capabilities) || capabilities.length > 128
-      || capabilities.some((id) => typeof id !== "string" || !id || id.length > 160)) throw fail("invalidArgument");
-    const captured = new Map();
-    for (const target of targets) {
-      if (!target || !["terminal", "host", "note"].includes(target.kind)
-        || typeof target.id !== "string" || !target.id || target.id.length > 256
-        || typeof target.revision !== "string" || !target.revision
-        || typeof target.owner !== "string" || !target.owner
-        || typeof target.isCurrent !== "function" || captured.has(key(target))) throw fail("invalidArgument");
-      captured.set(key(target), Object.freeze({ ...target }));
-    }
-    const scope = { handle: randomUUID(), owner, backend: Object.freeze({ ...backend }), targets: captured,
-      capabilities: new Set(capabilities), expiresAt: this.clock() + 300_000, activeTurn: null };
-    this.#assertSnapshots(scope);
-    if (await this.#owner(context) !== owner) throw fail("permissionDenied");
-    this.#assertSnapshots(scope);
-    for (const entry of this.scopes.values()) if (entry.expiresAt <= this.clock()) this.#revoke(entry);
-    const existing = [...this.scopes.values()].filter((entry) => entry.owner === owner);
-    if (existing.length >= 8 || this.scopes.size >= 64) throw fail("resourceExhausted");
-    this.scopes.set(scope.handle, scope);
-    return Object.freeze({ handle: scope.handle, expiresAt: scope.expiresAt });
-  }
-
-  #assertSnapshots(scope) {
-    // Current-owner/revision checks are synchronous registry lookups, so the
-    // final dispatch check and native call have no asynchronous focus gap.
-    if (scope.backend.isCurrent(scope.backend) !== true) throw fail("failedPrecondition");
-    for (const target of scope.targets.values()) {
-      if (target.isCurrent(target) !== true) throw fail("failedPrecondition");
-    }
-  }
-
-  async #resolve(handle, context) {
-    const scope = this.scopes.get(handle);
-    let owner;
-    try { owner = await this.#owner(context); }
-    catch (error) {
-      // Context identity comes from the authenticated host transport. Revoke
-      // only its own captured scope, never a victim referenced by another caller.
-      if (!isRequestCancellation(error, context) && scope && scope.owner.runtimeId === context.runtimeId && scope.owner.pluginId === context.pluginId
-        && scope.owner.pluginVersion === context.pluginVersion) this.#revoke(scope);
-      throw error;
-    }
-    if (!scope || scope.owner !== owner) throw fail("permissionDenied");
-    if (scope.expiresAt <= this.clock()) { this.#revoke(scope); throw fail("permissionDenied"); }
-    try {
-      if (await this.#owner(context) !== owner || this.scopes.get(handle) !== scope
-        || scope.expiresAt <= this.clock()) throw fail("permissionDenied");
-      this.#assertSnapshots(scope);
-    } catch (error) {
-      // A failed individual RPC has no authority to revoke another turn. Real
-      // owner/target failure still invalidates the scope, even if a request also
-      // happens to be cancelled at that time.
-      if (!isRequestCancellation(error, context)) this.#revoke(scope);
-      throw error;
-    }
-    return scope;
-  }
-
-  async begin(handle, context) {
-    const scope = await this.#resolve(handle, context);
-    if (scope.activeTurn) throw fail("alreadyExists");
-    const ticket = Object.freeze({ scope, controller: new AbortController(), id: randomUUID() });
-    scope.activeTurn = ticket;
-    return ticket;
-  }
-
-  async assertTurn(ticket, context) {
-    if (!ticket?.scope || ticket.controller.signal.aborted) throw fail("cancelled");
-    const scope = await this.#resolve(ticket.scope.handle, context);
-    if (scope.activeTurn !== ticket) throw fail("cancelled");
-    ticket.controller.signal.throwIfAborted();
-    return scope;
-  }
-
-  // Called inside the actual tool dispatcher, after canonical argument/target
-  // resolution. It must not be used merely when displaying the model tool list.
-  async dispatch(ticket, context, action, execute) {
-    const scope = await this.assertTurn(ticket, context);
-    if (!action || !scope.capabilities.has(action.capabilityId) || !Array.isArray(action.targets)
-      || action.targets.length > 32 || typeof execute !== "function") throw fail("permissionDenied");
-    const targets = action.targets.map((target) => {
-      const captured = target && scope.targets.get(key(target));
-      if (!captured || target.revision !== captured.revision || target.owner !== captured.owner) throw fail("permissionDenied");
-      return captured;
-    });
-    const request = Object.freeze({ capabilityId: action.capabilityId, targets: Object.freeze(targets) });
-    // The adapter combines plugin policy and native Agent restrictions once.
-    // No caller can select a process-global permission mode through this API.
-    await this.authorizeAction(context, scope.owner, request, ticket.controller.signal);
-    await this.assertTurn(ticket, context);
-    this.#assertSnapshots(scope);
-    ticket.controller.signal.throwIfAborted();
-    const result = await execute(Object.freeze({ signal: ticket.controller.signal,
-      assertCurrent: () => this.assertTurn(ticket, context) }));
-    await this.assertTurn(ticket, context);
-    return result;
-  }
-
-  finish(ticket) {
-    if (!ticket || ticket.scope?.activeTurn !== ticket) return false;
-    ticket.scope.activeTurn = null;
-    ticket.controller.abort();
-    return true;
-  }
-
-  async stop(handle, context) {
-    // Capture before the first await. A prior Stop cannot acquire authority over
-    // a turn that replaces the one the caller intended to stop.
-    const candidate = this.scopes.get(handle);
-    const ticket = candidate?.activeTurn;
-    const scope = await this.#resolve(handle, context);
-    return scope === candidate ? this.finish(ticket) : false;
-  }
-
-  #revoke(scope) {
-    this.finish(scope.activeTurn);
-    this.scopes.delete(scope.handle);
-  }
-
-  releaseRuntime(runtimeId) {
-    for (const scope of this.scopes.values()) if (scope.owner.runtimeId === runtimeId) this.#revoke(scope);
-  }
-
-  releasePlugin(pluginId) {
-    for (const scope of this.scopes.values()) if (scope.owner.pluginId === pluginId) this.#revoke(scope);
-  }
-
-  releaseAll() {
-    for (const scope of this.scopes.values()) this.#revoke(scope);
-  }
-
-  shutdown() {
-    this.closed = true;
-    this.releaseAll();
-  }
-}
-
-module.exports = { DelegatedAgentScopes };

electron/plugins/agent/delegatedScope.test.cjs

@@ -1,229 +0,0 @@
-"use strict";
-
-const assert = require("node:assert/strict");
-const test = require("node:test");
-const { DelegatedAgentScopes } = require("./delegatedScope.cjs");
-const { PluginAISourceBinding } = require("../ai/sourceBinding.cjs");
-
-function deferred() {
-  let resolve;
-  const promise = new Promise((finish) => { resolve = finish; });
-  return { promise, resolve };
-}
-
-function fixture() {
-  let time = 1; let locked = false; let focus = "terminal-a";
-  let source = { id: "source-a", kind: "third-party", origin: "https://example.invalid" };
-  let privateOwner = "source:opaque-owner-a:com.example.assistant";
-  let identity = { pluginId: "com.example.assistant", pluginVersion: "1", runtimeId: "r1", runtimeKind: "browser" };
-  let authorize = async () => {};
-  const context = { ...identity, assertActive: async () => {} };
-  const database = {
-    getActivePlugin: () => ({ source, enabled: true, activeVersion: "1", runtime: { status: "running" } }),
-    getRetainedPluginSource: () => source,
-    privateOwner: () => privateOwner,
-    publicPluginId: (value) => value === privateOwner ? identity.pluginId : null,
-  };
-  const binding = new PluginAISourceBinding({ database, getRuntimeIdentity: () => identity });
-  let backendRevision = "configured-1";
-  const currentTargets = new Map([
-    ["terminal-a", { owner: "window-1", revision: "session-a-v1" }],
-    ["terminal-b", { owner: "window-2", revision: "session-b-v1" }],
-  ]);
-  const backend = { key: "host-configured-claude", revision: backendRevision,
-    isCurrent: (snapshot) => snapshot.revision === backendRevision };
-  const target = (id) => ({ kind: "terminal", id, ...currentTargets.get(id),
-    isCurrent: (snapshot) => { const current = currentTargets.get(snapshot.id);
-      return current?.owner === snapshot.owner && current?.revision === snapshot.revision; } });
-  const scopes = new DelegatedAgentScopes({ resolveOwner: (ctx) => binding.resolve(ctx),
-    assertHostActive: async () => { if (locked) throw Error("Locked"); },
-    authorizeAction: (...args) => authorize(...args), clock: () => time });
-  return { scopes, context, target, targets: currentTargets, database,
-    issue: (targets = [target("terminal-a"), target("terminal-b")]) => scopes.issue(context,
-      { backend, targets, capabilities: ["terminal.execute", "session.environment"] }),
-    action: (id = "terminal-a") => ({ capabilityId: "terminal.execute", targets: [target(id)] }),
-    tick: (ms) => { time += ms; }, lock: () => { locked = true; scopes.releaseAll(); },
-    focusTo: (id) => { focus = id; }, focus: () => focus,
-    authorize: (fn) => { authorize = fn; }, backendTo: (value) => { backendRevision = value; },
-    replaceSource: () => { source = { ...source, id: "source-b" }; privateOwner = "source:opaque-owner-b:com.example.assistant"; },
-    runtimeTo: (id) => { identity = { ...identity, runtimeId: id }; },
-  };
-}
-
-test("host-issued scope exposes only opaque identity and expiry; cross-workspace focus does not change explicit targets", async () => {
-  const f = fixture(); const ref = await f.issue();
-  assert.deepEqual(Object.keys(ref).sort(), ["expiresAt", "handle"]);
-  assert.doesNotMatch(JSON.stringify(ref), /window-|terminal-|source:|configured/);
-  const ticket = await f.scopes.begin(ref.handle, f.context);
-  f.focusTo("unselected-terminal");
-  let calls = 0;
-  assert.equal(await f.scopes.dispatch(ticket, f.context, f.action("terminal-b"), async () => ++calls), 1);
-  assert.equal(f.focus(), "unselected-terminal");
-  await assert.rejects(f.scopes.dispatch(ticket, f.context,
-    { capabilityId: "terminal.execute", targets: [{ kind: "terminal", id: f.focus(), revision: "1", owner: "window-1" }] }, async () => ++calls));
-  assert.equal(calls, 1);
-});
-
-test("forged runtime, cross-runtime session and source replacement cannot use a scope", async () => {
-  const f = fixture(); const ref = await f.issue();
-  await assert.rejects(f.scopes.begin(ref.handle, { ...f.context, runtimeId: "forged" }));
-  f.runtimeTo("r2");
-  await assert.rejects(f.scopes.begin(ref.handle, { ...f.context, runtimeId: "r2" }));
-  f.runtimeTo("r1"); f.replaceSource();
-  await assert.rejects(f.scopes.begin(ref.handle, f.context));
-});
-
-test("one host policy decision; target owner/revision is revalidated after approval waits", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let decisions = 0; let effects = 0;
-  f.authorize(async (_context, owner, action) => {
-    decisions++; assert.equal(owner.privateOwner, "source:opaque-owner-a:com.example.assistant");
-    assert.equal(action.targets[0].id, "terminal-a"); entered.resolve(); await release.promise;
-  });
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++);
-  await entered.promise;
-  f.targets.set("terminal-a", { owner: "new-window", revision: "session-a-v2" });
-  release.resolve(); await assert.rejects(result);
-  assert.equal(decisions, 1); assert.equal(effects, 0); assert.equal(ticket.controller.signal.aborted, true);
-});
-
-test("copied target ID with substituted owner or revision and undelegated capabilities fail before policy/execute", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  let decisions = 0; let effects = 0; f.authorize(async () => { decisions++; });
-  for (const patch of [{ owner: "attacker" }, { revision: "old" }]) {
-    await assert.rejects(f.scopes.dispatch(ticket, f.context,
-      { capabilityId: "terminal.execute", targets: [{ ...f.target("terminal-a"), ...patch }] }, async () => effects++));
-  }
-  await assert.rejects(f.scopes.dispatch(ticket, f.context,
-    { capabilityId: "vault.host.delete", targets: [] }, async () => effects++));
-  assert.equal(decisions, 0); assert.equal(effects, 0);
-});
-
-test("Deny and revoked source during authorization never dispatch a tool", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  let effects = 0;
-  f.authorize(async () => { throw Error("Denied"); });
-  await assert.rejects(f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++));
-  f.authorize(async () => { f.replaceSource(); });
-  await assert.rejects(f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++));
-  assert.equal(effects, 0);
-});
-
-test("Stop while approval waits cancels the exact turn and prevents invocation", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let effects = 0;
-  f.authorize(async (_context, _owner, _action, signal) => {
-    assert.equal(signal, ticket.controller.signal); entered.resolve(); await release.promise;
-  });
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async () => effects++);
-  await entered.promise; assert.equal(await f.scopes.stop(ref.handle, f.context), true);
-  release.resolve(); await assert.rejects(result); assert.equal(effects, 0);
-  const next = await f.scopes.begin(ref.handle, f.context);
-  assert.equal(f.scopes.finish(ticket), false); assert.equal(next.controller.signal.aborted, false);
-});
-
-for (const reason of ["runtime", "plugin", "lock", "stop"]) {
-  test(`${reason} cancellation drops late native results and invalidates the old event ticket`, async () => {
-    const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-    const entered = deferred(); const release = deferred();
-    const result = f.scopes.dispatch(ticket, f.context, f.action(), async ({ signal }) => {
-      assert.equal(signal, ticket.controller.signal); entered.resolve(); await release.promise; return "late";
-    });
-    await entered.promise;
-    if (reason === "runtime") f.scopes.releaseRuntime(f.context.runtimeId);
-    else if (reason === "plugin") f.scopes.releasePlugin(f.context.pluginId);
-    else if (reason === "lock") f.lock();
-    else await f.scopes.stop(ref.handle, f.context);
-    release.resolve(); await assert.rejects(result); await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-    assert.equal(ticket.controller.signal.aborted, true);
-  });
-}
-
-test("backend config changes and expiry invalidate scopes; host snapshots cannot silently refresh them", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  f.backendTo("new-config"); await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-  assert.equal(ticket.controller.signal.aborted, true);
-  const g = fixture(); const next = await g.issue(); const active = await g.scopes.begin(next.handle, g.context);
-  g.tick(300_000); await assert.rejects(g.scopes.assertTurn(active, g.context));
-  assert.equal(active.controller.signal.aborted, true); assert.equal(g.scopes.scopes.size, 0);
-});
-
-test("source replacement detected during owner authentication aborts already-running native work", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred();
-  const result = f.scopes.dispatch(ticket, f.context, f.action(), async ({ signal }) => {
-    entered.resolve(signal); await release.promise; return "late native result";
-  });
-  const signal = await entered.promise;
-  try {
-    f.replaceSource();
-    await assert.rejects(f.scopes.assertTurn(ticket, f.context));
-    assert.equal(signal.aborted, true, "source detection must abort native work, not only reject its result");
-    assert.equal(f.scopes.scopes.size, 0);
-  } finally { release.resolve(); await assert.rejects(result); }
-});
-
-test("Stop captures turn A before owner validation and cannot cancel replacement turn B", async () => {
-  const f = fixture(); const ref = await f.issue(); const first = await f.scopes.begin(ref.handle, f.context);
-  const entered = deferred(); const release = deferred(); let blocked = false;
-  const stopContext = { ...f.context, assertActive: async () => {
-    if (!blocked) { blocked = true; entered.resolve(); await release.promise; }
-  } };
-  const stopping = f.scopes.stop(ref.handle, stopContext);
-  await entered.promise; assert.equal(f.scopes.finish(first), true);
-  const second = await f.scopes.begin(ref.handle, f.context);
-  release.resolve();
-  assert.equal(await stopping, false);
-  assert.equal(second.controller.signal.aborted, false, "an earlier Stop must not cancel a later turn");
-  assert.equal(await f.scopes.assertTurn(second, f.context), second.scope);
-});
-
-for (const phase of [1, 5]) {
-  test(`cancelled Stop(A) during owner check ${phase} cannot revoke replacement turn B`, { timeout: 2_000 }, async () => {
-    const f = fixture(); const ref = await f.issue(); const first = await f.scopes.begin(ref.handle, f.context);
-    const entered = deferred(); const release = deferred(); const rpc = new AbortController(); let checks = 0;
-    const stopContext = { ...f.context, signal: rpc.signal, assertActive: async () => {
-      if (++checks === phase) { entered.resolve(); await release.promise; }
-      rpc.signal.throwIfAborted();
-    } };
-    const stopping = f.scopes.stop(ref.handle, stopContext);
-    await entered.promise; f.scopes.finish(first);
-    const second = await f.scopes.begin(ref.handle, f.context);
-    rpc.abort(phase === 1 ? new DOMException("Stop cancelled", "AbortError") : new DOMException("Stop deadline", "TimeoutError"));
-    release.resolve();
-    await assert.rejects(stopping, (error) => error === rpc.signal.reason);
-    assert.equal(second.controller.signal.aborted, false, "a cancelled RPC does not revoke source authority or stop a later turn");
-    assert.equal(f.scopes.scopes.size, 1);
-    assert.equal(await f.scopes.assertTurn(second, f.context), second.scope);
-  });
-}
-
-test("verified source failure still aborts native work when the RPC is concurrently cancelled", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  const rpc = new AbortController(); const retained = f.database.getRetainedPluginSource;
-  f.database.getRetainedPluginSource = () => {
-    rpc.abort(new DOMException("Concurrent RPC cancellation", "AbortError"));
-    return { ...retained(), id: "different-retained-source" };
-  };
-  await assert.rejects(f.scopes.assertTurn(ticket, { ...f.context, signal: rpc.signal }),
-    (error) => error !== rpc.signal.reason && error.code === -32007);
-  assert.equal(ticket.controller.signal.aborted, true);
-  assert.equal(f.scopes.scopes.size, 0);
-});
-
-test("a foreign runtime cannot revoke a victim scope by failing authentication with its handle", async () => {
-  const f = fixture(); const ref = await f.issue(); const ticket = await f.scopes.begin(ref.handle, f.context);
-  await assert.rejects(f.scopes.stop(ref.handle, { ...f.context, runtimeId: "foreign-runtime" }));
-  assert.equal(ticket.controller.signal.aborted, false);
-  assert.equal(f.scopes.scopes.size, 1);
-  assert.equal(await f.scopes.assertTurn(ticket, f.context), ticket.scope);
-});
-
-test("bounded host scopes reject malformed snapshots without registering partial targets", async () => {
-  const f = fixture(); await assert.rejects(f.issue([null])); assert.equal(f.scopes.scopes.size, 0);
-  await assert.rejects(f.issue([f.target("terminal-a"), f.target("terminal-a")]));
-  for (let i = 0; i < 8; i++) await f.issue();
-  await assert.rejects(f.issue());
-  f.tick(300_000); await f.issue(); assert.equal(f.scopes.scopes.size, 1);
-  f.scopes.shutdown(); await assert.rejects(f.issue());
-});

electron/plugins/generated/plugin-contract.schema.json

@@ -1771,8 +1771,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -1817,8 +1815,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -7190,402 +7186,6 @@
         }
       },
       "additionalProperties": false
-    },
-    "PluginAgentFeature": {
-      "const": "ai.agent-sessions"
-    },
-    "PluginAgentBackendKind": {
-      "enum": [
-        "catty",
-        "claude",
-        "codex",
-        "copilot",
-        "cursor",
-        "codebuddy",
-        "opencode",
-        "grok",
-        "mimo"
-      ]
-    },
-    "PluginAgentBackend": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "label",
-        "backend",
-        "status",
-        "reason"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "label": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "status": {
-          "enum": [
-            "supported",
-            "unsupported",
-            "unavailable"
-          ]
-        },
-        "reason": {
-          "enum": [
-            "ready",
-            "not-configured",
-            "native-boundary-unverified",
-            "configuration-unavailable"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentBackendsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentBackend"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetSummary": {
-      "type": "object",
-      "required": [
-        "title",
-        "kind"
-      ],
-      "properties": {
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "kind": {
-          "const": "terminal"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetsResult": {
-      "type": "object",
-      "required": [
-        "selectionHandle",
-        "expiresAt",
-        "items"
-      ],
-      "properties": {
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        },
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentTargetSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentOpenParams": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "selectionHandle"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatRef": {
-      "type": "object",
-      "required": [
-        "chatHandle"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatResult": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "conversationRef",
-        "backendLabel",
-        "expiresAt"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "backendLabel": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatSummary": {
-      "type": "object",
-      "required": [
-        "conversationRef",
-        "title",
-        "backend",
-        "updatedAt"
-      ],
-      "properties": {
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "updatedAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 64,
-          "items": {
-            "$ref": "#/$defs/PluginAgentChatSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentSendParams": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "text"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "text": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 16384,
-          "pattern": "^[^\\u0000]*$"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnRef": {
-      "type": "object",
-      "required": [
-        "turnHandle"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnResult": {
-      "type": "object",
-      "required": [
-        "turnHandle",
-        "expiresAt"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentMessage": {
-      "type": "object",
-      "required": [
-        "role",
-        "text"
-      ],
-      "properties": {
-        "role": {
-          "enum": [
-            "user",
-            "assistant"
-          ]
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 32768
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentHistoryResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 200,
-          "items": {
-            "$ref": "#/$defs/PluginAgentMessage"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentEvent": {
-      "oneOf": [
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "text"
-          ],
-          "properties": {
-            "kind": {
-              "const": "text"
-            },
-            "text": {
-              "type": "string",
-              "maxLength": 4096
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "capabilityId",
-            "state"
-          ],
-          "properties": {
-            "kind": {
-              "const": "activity"
-            },
-            "capabilityId": {
-              "type": "string",
-              "maxLength": 160
-            },
-            "state": {
-              "enum": [
-                "started",
-                "completed",
-                "denied"
-              ]
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "inputTokens",
-            "outputTokens"
-          ],
-          "properties": {
-            "kind": {
-              "const": "usage"
-            },
-            "inputTokens": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "outputTokens": {
-              "type": "integer",
-              "minimum": 0
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "reason"
-          ],
-          "properties": {
-            "kind": {
-              "const": "end"
-            },
-            "reason": {
-              "enum": [
-                "completed",
-                "cancelled",
-                "unavailable",
-                "budget-exceeded"
-              ]
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
     }
   }
 }

electron/plugins/globalAgent.test.cjs

@@ -1,4 +0,0 @@
-"use strict";
-require("./agent/delegatedScope.test.cjs");
-require("./agent/conversationStore.test.cjs");
-require("./agent/contract.test.cjs");

electron/plugins/pluginSyncServiceComposition.test.cjs

@@ -0,0 +1,90 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const { PluginDatabase } = require("./database.cjs");
+const { PluginContributionService } = require("./contributionService.cjs");
+const { PluginSyncSidecarService } = require("./pluginSyncSidecarService.cjs");
+const { registerPluginBridge, CHANNELS } = require("./pluginBridge.cjs");
+const { OFFICIAL_SOURCE, thirdPartySource } = require("./sourceIdentity.cjs");
+
+const id = "com.example.sync-composition";
+const synced = `${id}.synced`, local = `${id}.local`;
+const manifest = {
+  manifestVersion: 1, id, name: "Synthetic sync composition", version: "1.0.0", publisher: "example",
+  engines: { netcatty: ">=0.0.0", api: ">=0.1.0-internal <0.2.0" }, main: { browser: "index.js" },
+  contributes: { settings: [
+    { id: synced, label: "Synced", control: "text", scope: "application", default: "default-sync", sync: true },
+    { id: local, label: "Local", control: "text", scope: "application", default: "default-local", sync: false },
+  ] },
+};
+function install(database, source = OFFICIAL_SOURCE, enabled = true) {
+  database.installVersion({ pluginId: id, version: manifest.version, manifest, source,
+    archiveSha256: "a".repeat(64), packageRelativePath: "synthetic/no-executable-package" }, { enable: enabled });
+}
+function profile(context, label, clock) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `netcatty-sync-composition-${label}-`));
+  const database = new PluginDatabase(path.join(root, "plugins.sqlite"), { clock: () => clock });
+  context.after(() => { database.close(); fs.rmSync(root, { recursive: true, force: true }); });
+  const runtimeSupervisor = {
+    start: async () => { throw new Error("composition test must not execute a plugin"); },
+    request: async () => { throw new Error("composition test must not call a plugin"); },
+    notify: async () => {},
+  };
+  const contributions = new PluginContributionService({ database, runtimeSupervisor, getLocale: () => "en" });
+  const sidecars = new PluginSyncSidecarService({ database, contributionService: contributions });
+  const handlers = new Map();
+  registerPluginBridge({ handle: (name, handler) => handlers.set(name, handler), on() {} }, {
+    manager: { initialize: async () => {}, database }, contributionService: contributions,
+    syncSidecarService: sidecars, isTrustedSender: (event) => event?.trusted === true,
+  });
+  return { database, contributions, sidecars,
+    collect: () => handlers.get(CHANNELS.syncSidecarsCollect)({ trusted: true }),
+    apply: (bundle) => handlers.get(CHANNELS.syncSidecarsApply)({ trusted: true }, bundle),
+    untrustedApply: (bundle) => handlers.get(CHANNELS.syncSidecarsApply)({ trusted: false }, bundle) };
+}
+
+test("two real profiles collect/apply/hydrate only opted-in source-bound settings through registered host entries", async (context) => {
+  for (const state of ["enabled", "disabled", "missing", "other-source"]) {
+    await context.test(state, async (context) => {
+      const a = profile(context, "sender", 200), b = profile(context, "recipient", 100);
+      install(a.database);
+      await a.contributions.updateSetting(id, synced, "synthetic-shared-value");
+      await a.contributions.updateSetting(id, local, "synthetic-device-only-value");
+      const bundle = await a.collect();
+      assert.equal(bundle.entries.filter((entry) => entry.kind === "settings").length, 1);
+      assert.equal(bundle.entries.some((entry) => entry.value === "synthetic-device-only-value"), false);
+      const owner = a.database.privateOwner(id);
+      assert.equal(bundle.entries[0].pluginId, owner);
+      if (state !== "missing") install(b.database,
+        state === "other-source" ? thirdPartySource("Synthetic community", "https://community.example.com") : OFFICIAL_SOURCE,
+        state !== "disabled");
+      await assert.rejects(b.untrustedApply(bundle), /Untrusted/);
+      assert.equal(b.database.listAllSyncSidecars().length, 0, "untrusted sender never applies remote rows");
+      const result = await b.apply(bundle);
+      assert.equal(result.applied, true);
+      assert.equal(b.database.getSetting(id, local, "application", "application"), undefined);
+      if (state === "enabled") {
+        assert.equal(await b.contributions.getSetting(id, synced), "synthetic-shared-value");
+        assert.equal(await b.contributions.getSetting(id, local), "default-local");
+      } else {
+        assert.equal(b.database.getSetting(id, synced, "application", "application"), undefined,
+          "missing, disabled or different-source plugins cannot receive active settings");
+        assert.ok(b.database.listAllSyncSidecars().some((entry) => entry.pluginId === owner), "remote row is retained without execution");
+        await b.sidecars.hydrateInstalledPluginSettings(id);
+        assert.equal(b.database.getSetting(id, synced, "application", "application"), undefined);
+        if (state === "disabled") b.database.setEnabled(id, true);
+        if (state === "missing") install(b.database);
+        await b.sidecars.hydrateInstalledPluginSettings(id);
+        assert.equal(await b.contributions.getSetting(id, synced), state === "other-source" ? "default-sync" : "synthetic-shared-value");
+        if (state === "other-source") assert.notEqual(b.database.privateOwner(id), owner);
+      }
+      const collected = await b.collect();
+      assert.equal(collected.entries.some((entry) => entry.value === "synthetic-device-only-value"), false);
+      assert.equal(await a.contributions.getSetting(id, local), "synthetic-device-only-value", "sender's local-only setting stays local");
+    });
+  }
+});

packages/plugin-contract/schema/plugin-contract.schema.json

@@ -1698,8 +1698,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -1744,8 +1742,6 @@
       "enum": [
         "storage",
         "ai.invoke",
-        "ai.agent.use",
-        "ai.agent.actions",
         "context.selected.list",
         "context.selected.read",
         "runtime.advanced",
@@ -5008,402 +5004,6 @@
         }
       },
       "additionalProperties": false
-    },
-    "PluginAgentFeature": {
-      "const": "ai.agent-sessions"
-    },
-    "PluginAgentBackendKind": {
-      "enum": [
-        "catty",
-        "claude",
-        "codex",
-        "copilot",
-        "cursor",
-        "codebuddy",
-        "opencode",
-        "grok",
-        "mimo"
-      ]
-    },
-    "PluginAgentBackend": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "label",
-        "backend",
-        "status",
-        "reason"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "label": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "status": {
-          "enum": [
-            "supported",
-            "unsupported",
-            "unavailable"
-          ]
-        },
-        "reason": {
-          "enum": [
-            "ready",
-            "not-configured",
-            "native-boundary-unverified",
-            "configuration-unavailable"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentBackendsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentBackend"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetSummary": {
-      "type": "object",
-      "required": [
-        "title",
-        "kind"
-      ],
-      "properties": {
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "kind": {
-          "const": "terminal"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTargetsResult": {
-      "type": "object",
-      "required": [
-        "selectionHandle",
-        "expiresAt",
-        "items"
-      ],
-      "properties": {
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        },
-        "items": {
-          "type": "array",
-          "maxItems": 32,
-          "items": {
-            "$ref": "#/$defs/PluginAgentTargetSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentOpenParams": {
-      "type": "object",
-      "required": [
-        "backendRef",
-        "selectionHandle"
-      ],
-      "properties": {
-        "backendRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "selectionHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatRef": {
-      "type": "object",
-      "required": [
-        "chatHandle"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatResult": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "conversationRef",
-        "backendLabel",
-        "expiresAt"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "backendLabel": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatSummary": {
-      "type": "object",
-      "required": [
-        "conversationRef",
-        "title",
-        "backend",
-        "updatedAt"
-      ],
-      "properties": {
-        "conversationRef": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "title": {
-          "type": "string",
-          "maxLength": 160
-        },
-        "backend": {
-          "$ref": "#/$defs/PluginAgentBackendKind"
-        },
-        "updatedAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentChatsResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 64,
-          "items": {
-            "$ref": "#/$defs/PluginAgentChatSummary"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentSendParams": {
-      "type": "object",
-      "required": [
-        "chatHandle",
-        "text"
-      ],
-      "properties": {
-        "chatHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "text": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 16384,
-          "pattern": "^[^\\u0000]*$"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnRef": {
-      "type": "object",
-      "required": [
-        "turnHandle"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentTurnResult": {
-      "type": "object",
-      "required": [
-        "turnHandle",
-        "expiresAt"
-      ],
-      "properties": {
-        "turnHandle": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "expiresAt": {
-          "type": "integer",
-          "minimum": 0
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentMessage": {
-      "type": "object",
-      "required": [
-        "role",
-        "text"
-      ],
-      "properties": {
-        "role": {
-          "enum": [
-            "user",
-            "assistant"
-          ]
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 32768
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentHistoryResult": {
-      "type": "object",
-      "required": [
-        "items"
-      ],
-      "properties": {
-        "items": {
-          "type": "array",
-          "maxItems": 200,
-          "items": {
-            "$ref": "#/$defs/PluginAgentMessage"
-          }
-        }
-      },
-      "additionalProperties": false
-    },
-    "PluginAgentEvent": {
-      "oneOf": [
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "text"
-          ],
-          "properties": {
-            "kind": {
-              "const": "text"
-            },
-            "text": {
-              "type": "string",
-              "maxLength": 4096
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "capabilityId",
-            "state"
-          ],
-          "properties": {
-            "kind": {
-              "const": "activity"
-            },
-            "capabilityId": {
-              "type": "string",
-              "maxLength": 160
-            },
-            "state": {
-              "enum": [
-                "started",
-                "completed",
-                "denied"
-              ]
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "inputTokens",
-            "outputTokens"
-          ],
-          "properties": {
-            "kind": {
-              "const": "usage"
-            },
-            "inputTokens": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "outputTokens": {
-              "type": "integer",
-              "minimum": 0
-            }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": [
-            "kind",
-            "reason"
-          ],
-          "properties": {
-            "kind": {
-              "const": "end"
-            },
-            "reason": {
-              "enum": [
-                "completed",
-                "cancelled",
-                "unavailable",
-                "budget-exceeded"
-              ]
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
     }
   }
 }

packages/plugin-contract/src/generated/plugin-contract.ts

@@ -486,7 +486,7 @@ export type MenuLocation = "commandPalette" | "application" | "host/context" | "
 
 export type NetworkCredentialLeaseFeature = "network.credential-lease";
 
-export type NonResourceScopedPermission = "storage" | "ai.invoke" | "ai.agent.use" | "ai.agent.actions" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
+export type NonResourceScopedPermission = "storage" | "ai.invoke" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "secrets" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
 
 export type NullableRpcId = (RpcId) | (null);
 
@@ -554,100 +554,6 @@ export type PermissionSet = {
   optional?: Array<PermissionDeclaration>;
 };
 
-export type PluginAgentBackend = {
-  backendRef: string;
-  label: string;
-  backend: PluginAgentBackendKind;
-  status: "supported" | "unsupported" | "unavailable";
-  reason: "ready" | "not-configured" | "native-boundary-unverified" | "configuration-unavailable";
-};
-
-export type PluginAgentBackendKind = "catty" | "claude" | "codex" | "copilot" | "cursor" | "codebuddy" | "opencode" | "grok" | "mimo";
-
-export type PluginAgentBackendsResult = {
-  items: Array<PluginAgentBackend>;
-};
-
-export type PluginAgentChatRef = {
-  chatHandle: string;
-};
-
-export type PluginAgentChatResult = {
-  chatHandle: string;
-  conversationRef: string;
-  backendLabel: string;
-  expiresAt: number;
-};
-
-export type PluginAgentChatsResult = {
-  items: Array<PluginAgentChatSummary>;
-};
-
-export type PluginAgentChatSummary = {
-  conversationRef: string;
-  title: string;
-  backend: PluginAgentBackendKind;
-  updatedAt: number;
-};
-
-export type PluginAgentEvent = ({
-  kind: "text";
-  text: string;
-}) | ({
-  kind: "activity";
-  capabilityId: string;
-  state: "started" | "completed" | "denied";
-}) | ({
-  kind: "usage";
-  inputTokens: number;
-  outputTokens: number;
-}) | ({
-  kind: "end";
-  reason: "completed" | "cancelled" | "unavailable" | "budget-exceeded";
-});
-
-export type PluginAgentFeature = "ai.agent-sessions";
-
-export type PluginAgentHistoryResult = {
-  items: Array<PluginAgentMessage>;
-};
-
-export type PluginAgentMessage = {
-  role: "user" | "assistant";
-  text: string;
-};
-
-export type PluginAgentOpenParams = {
-  backendRef: string;
-  selectionHandle: string;
-  conversationRef?: string;
-};
-
-export type PluginAgentSendParams = {
-  chatHandle: string;
-  text: string;
-};
-
-export type PluginAgentTargetsResult = {
-  selectionHandle: string;
-  expiresAt: number;
-  items: Array<PluginAgentTargetSummary>;
-};
-
-export type PluginAgentTargetSummary = {
-  title: string;
-  kind: "terminal";
-};
-
-export type PluginAgentTurnRef = {
-  turnHandle: string;
-};
-
-export type PluginAgentTurnResult = {
-  turnHandle: string;
-  expiresAt: number;
-};
-
 export type PluginAIBooleanResult = {
   ok: boolean;
 };
@@ -933,7 +839,7 @@ export type PluginNetworkResponse = {
   };
 };
 
-export type PluginPermission = "storage" | "ai.invoke" | "ai.agent.use" | "ai.agent.actions" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "network.stream" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
+export type PluginPermission = "storage" | "ai.invoke" | "context.selected.list" | "context.selected.read" | "runtime.advanced" | "settings.read" | "settings.write" | "commands" | "menus" | "views" | "ui.interact" | "clipboard.read" | "clipboard.write" | "terminal.metadata" | "terminal.output" | "terminal.input" | "terminal.decorate" | "terminal.complete" | "terminal.intercept.input" | "terminal.intercept.output" | "vault.metadata" | "vault.write" | "vault.credentials" | "sftp.read" | "sftp.write" | "network" | "network.stream" | "filesystem.read" | "filesystem.write" | "secrets" | "companion.execute" | "provider.terminal" | "provider.connection" | "provider.authentication" | "provider.sync" | "provider.importer" | "terminal.selection.read" | "terminal.input.propose";
 
 export type PluginSelectedContextContent = {
   handle: string;

packages/plugin-contract/src/index.ts

@@ -55,7 +55,6 @@ export { inspectPluginBrandIcon, PLUGIN_BRAND_ICON_FEATURE, PLUGIN_BRAND_ICON_MA
 export const PLUGIN_NETWORK_CREDENTIAL_LEASE_FEATURE = "network.credential-lease" as const satisfies import("./generated/plugin-contract.js").NetworkCredentialLeaseFeature;
 export const PLUGIN_BYTE_STREAM_FEATURE = "network.byte-streams" as const satisfies import("./generated/plugin-contract.js").ByteStreamFeature;
 export const PLUGIN_AI_MODEL_INVOCATION_FEATURE = "ai.model-invocation" as const satisfies import("./generated/plugin-contract.js").PluginAIModelInvocationFeature;
-export const PLUGIN_AGENT_SESSIONS_FEATURE = "ai.agent-sessions" as const satisfies import("./generated/plugin-contract.js").PluginAgentFeature;
 export const PLUGIN_SELECTED_CONTEXT_FEATURE = "context.selected-read" as const satisfies import("./generated/plugin-contract.js").PluginSelectedContextFeature;
 
 export const PLUGIN_HOST_INTERACTION_FEATURE = "host.interactions" as const satisfies import("./generated/plugin-contract.js").HostInteractionFeature;

packages/plugin-sdk/src/index.ts

@@ -685,19 +685,6 @@ export interface PluginSelectedContextClient {
   read(params: import("@netcatty/plugin-contract").PluginSelectedContextRef): Promise<import("@netcatty/plugin-contract").PluginSelectedContextContent>;
 }
 
-/** Configurations, targets and native resume IDs stay in the trusted host. */
-export interface PluginAgentClient {
-  listBackends(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentBackendsResult>;
-  selectTargets(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentTargetsResult>;
-  listChats(params: import("@netcatty/plugin-contract").PluginAIEmptyParams): Promise<import("@netcatty/plugin-contract").PluginAgentChatsResult>;
-  openChat(params: import("@netcatty/plugin-contract").PluginAgentOpenParams): Promise<import("@netcatty/plugin-contract").PluginAgentChatResult>;
-  send(params: import("@netcatty/plugin-contract").PluginAgentSendParams): Promise<import("@netcatty/plugin-contract").PluginAgentTurnResult>;
-  read(params: import("@netcatty/plugin-contract").PluginAgentTurnRef): Promise<import("@netcatty/plugin-contract").PluginAgentEvent>;
-  history(params: import("@netcatty/plugin-contract").PluginAgentChatRef): Promise<import("@netcatty/plugin-contract").PluginAgentHistoryResult>;
-  stop(params: import("@netcatty/plugin-contract").PluginAgentTurnRef): Promise<import("@netcatty/plugin-contract").PluginAIBooleanResult>;
-  closeChat(params: import("@netcatty/plugin-contract").PluginAgentChatRef): Promise<import("@netcatty/plugin-contract").PluginAIBooleanResult>;
-}
-
 export interface PluginByteConnection extends Disposable {
   readonly endpoint: string;
   readonly readable: PluginReadableByteStream;
@@ -797,7 +784,6 @@ export interface PluginContext {
   readonly credentials: PluginCredentialBroker;
   readonly network: PluginNetworkClient;
   readonly ai: PluginAIClient;
-  readonly agent: PluginAgentClient;
   readonly selectedContext: PluginSelectedContextClient;
   readonly filesystem: PluginFilesystemClient;
   readonly companions: PluginCompanionService;