fix(plugins): bind log provenance and enforce segment retention

# Conflicts:
#	electron/plugins/hostService.cjs
#	packages/plugin-cli/src/manifest.ts
#	packages/plugin-contract/src/index.ts
#	packages/plugin-sdk/src/index.ts

application/app/AppView.tsx

@@ -167,7 +167,8 @@ function AppPluginKeybindingThemeHost({
   sessions: any[];
   workspaces: any[];
 }) {
-  const appThemeStyle = useAppThemeStyle();
+  // View environment is global in the current host: publish committed colors only.
+  const appThemeStyle = useAppThemeStyle(false);
   const { resolvedTheme, uiLanguage } = useSettingsChromeStore();
   const pluginThemeTokens = useMemo(
     () => selectPluginThemeTokens(appThemeStyle as Record<string, unknown>),

application/app/useAppThemeStyle.ts

@@ -1,3 +1,4 @@
+import { usePluginThemeRevision } from '../state/usePluginThemeRuntime';
 import type React from 'react';
 import { useMemo } from 'react';
 
@@ -12,17 +13,20 @@ import { getUiThemeById } from '../../infrastructure/config/uiThemes';
  * settingsChromeStore so accent drags only re-render the leaf that applies the
  * vars, never the App shell.
  */
-export function useAppThemeStyle(): React.CSSProperties {
+export function useAppThemeStyle(includePreview = true): React.CSSProperties {
+  const pluginThemeRevision = usePluginThemeRevision();
   const { accentMode, customAccent } = useAppearanceChromeStore();
   const { resolvedTheme, darkUiThemeId, lightUiThemeId } = useSettingsChromeStore();
   return useMemo(() => {
+    void pluginThemeRevision; // getUiThemeById reads this external registry revision.
     const tokens = getUiThemeById(
       resolvedTheme,
       resolvedTheme === 'dark' ? darkUiThemeId : lightUiThemeId,
+      includePreview,
     ).tokens;
     return {
       ...buildAppThemeCssVars(tokens, accentMode, customAccent),
       colorScheme: resolvedTheme,
     } as React.CSSProperties;
-  }, [accentMode, customAccent, darkUiThemeId, lightUiThemeId, resolvedTheme]);
+  }, [accentMode, customAccent, darkUiThemeId, lightUiThemeId, resolvedTheme, pluginThemeRevision, includePreview]);
 }

application/i18n/locales/en/core.ts

@@ -1246,6 +1246,12 @@ Highlight the focused split pane:
   "settings.plugins.manager.remove": "Uninstall",
   "settings.plugins.manager.removeNote": "Uninstall removes package code and local KV data. User-owned settings, secrets and sync sidecars are retained.",
   "settings.plugins.permissions.statusUnknown": "Status unknown",
+  "plugins.sidebar.extensions": "Extension pages",
+  "plugins.sidebar.selectTerminal": "Select an open terminal first.",
+  "plugins.sidebar.loading": "Loading extension page…",
+  "plugins.vault.loading": "Loading plugin page…",
+  "plugins.vault.extensions": "Extensions",
+  "plugins.vault.back": "Back to hosts",
   "plugins.interaction.title": "Plugin request",
   "plugins.interaction.sharing": "Text you share becomes available to this plugin and its granted capabilities, including network access. Reading does not approve a new network destination.",
   "plugins.interaction.input": "Input text",
@@ -1274,6 +1280,19 @@ Highlight the focused split pane:
   "settings.plugins.manager.noPermissions": "No privileged permissions declared.",
   "settings.plugins.manager.required": "Required",
   "settings.plugins.manager.optional": "Optional",
+  "settings.plugins.themes.title": "Plugin themes",
+  "settings.plugins.themes.description": "Preview changes only this window. Apply saves this device’s selection. Personal accent, fonts and terminal overrides stay in control.",
+  "settings.plugins.themes.empty": "No enabled plugin themes for this mode.",
+  "settings.plugins.themes.choose": "Choose a theme",
+  "settings.plugins.themes.unavailable": "Saved theme unavailable; using the host default",
+  "settings.plugins.themes.applied": "Applied",
+  "settings.plugins.themes.preview": "Preview",
+  "settings.plugins.themes.apply": "Apply",
+  "settings.plugins.themes.cancel": "Cancel preview",
+  "settings.plugins.themes.restore": "Restore default",
+  "settings.plugins.themes.invalid": "Some theme palettes were rejected or unavailable.",
+  "settings.plugins.themes.failed": "Could not apply theme.",
+  "settings.plugins.manager.dataTheme": "Theme pack: validated colors, no executable runtime.",
   "settings.plugins.manager.browser": "Browser runtime: privileged access goes through host permission brokers.",
   "settings.plugins.manager.advanced": "Advanced runtime: full Node filesystem and network authority. Broker permissions cannot restrict this access. Development preview only.",
   "settings.plugins.manager.data": "Local KV stays on this device. Only non-secret settings explicitly marked for sync participate in encrypted cloud sidecars. Packages and permission grants do not sync.",

application/i18n/locales/es/core.ts

@@ -1246,6 +1246,12 @@ Resalta el panel dividido enfocado:
   "settings.plugins.manager.remove": "Desinstalar",
   "settings.plugins.manager.removeNote": "La desinstalación elimina el código y los datos KV locales. Se conservan los ajustes del usuario, los secretos y los datos auxiliares de sincronización.",
   "settings.plugins.permissions.statusUnknown": "Estado desconocido",
+  "plugins.sidebar.extensions": "Páginas de extensiones",
+  "plugins.sidebar.selectTerminal": "Selecciona primero un terminal abierto.",
+  "plugins.sidebar.loading": "Cargando página de extensión…",
+  "plugins.vault.loading": "Cargando página del plugin…",
+  "plugins.vault.extensions": "Extensiones",
+  "plugins.vault.back": "Volver a hosts",
   "plugins.interaction.title": "Solicitud de complemento",
   "plugins.interaction.sharing": "El texto compartido estará disponible para este complemento y sus capacidades autorizadas, incluida la red. Leer no autoriza un nuevo destino de red.",
   "plugins.interaction.input": "Introducir texto",
@@ -1274,6 +1280,19 @@ Resalta el panel dividido enfocado:
   "settings.plugins.manager.noPermissions": "No se han declarado permisos privilegiados.",
   "settings.plugins.manager.required": "Obligatorio",
   "settings.plugins.manager.optional": "Opcional",
+  "settings.plugins.themes.title": "Temas de plugins",
+  "settings.plugins.themes.description": "La vista previa solo cambia esta ventana. Aplicar guarda la selección en este dispositivo. Se conservan los ajustes personales.",
+  "settings.plugins.themes.empty": "No hay temas habilitados para este modo.",
+  "settings.plugins.themes.choose": "Elegir tema",
+  "settings.plugins.themes.unavailable": "Tema guardado no disponible; se usa el predeterminado",
+  "settings.plugins.themes.applied": "Aplicado",
+  "settings.plugins.themes.preview": "Vista previa",
+  "settings.plugins.themes.apply": "Aplicar",
+  "settings.plugins.themes.cancel": "Cancelar vista previa",
+  "settings.plugins.themes.restore": "Restaurar predeterminado",
+  "settings.plugins.themes.invalid": "Algunas paletas no están disponibles o no son válidas.",
+  "settings.plugins.themes.failed": "No se pudo aplicar el tema.",
+  "settings.plugins.manager.dataTheme": "Paquete de temas: colores validados, sin ejecución de código.",
   "settings.plugins.manager.browser": "Entorno de navegador: el acceso privilegiado pasa por los controles de permisos del anfitrión.",
   "settings.plugins.manager.advanced": "Entorno avanzado: acceso completo de Node al sistema de archivos y a la red. Los permisos del intermediario no restringen este acceso. Solo para desarrollo.",
   "settings.plugins.manager.data": "Los datos KV permanecen en este dispositivo. Solo los ajustes no secretos marcados para sincronización participan en los datos auxiliares cifrados. Los paquetes y las autorizaciones no se sincronizan.",

application/i18n/locales/ru/core.ts

@@ -1141,6 +1141,12 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.manager.remove": "Удалить",
   "settings.plugins.manager.removeNote": "Удаление очищает код пакета и локальные данные KV. Настройки пользователя, секреты и данные синхронизации сохраняются.",
   "settings.plugins.permissions.statusUnknown": "Состояние неизвестно",
+  "plugins.sidebar.extensions": "Страницы расширений",
+  "plugins.sidebar.selectTerminal": "Сначала выберите открытый терминал.",
+  "plugins.sidebar.loading": "Загрузка страницы расширения…",
+  "plugins.vault.loading": "Загрузка страницы плагина…",
+  "plugins.vault.extensions": "Расширения",
+  "plugins.vault.back": "К хостам",
   "plugins.interaction.title": "Запрос плагина",
   "plugins.interaction.sharing": "Переданный текст доступен плагину и его разрешённым возможностям, включая сеть. Чтение не разрешает новый сетевой адрес.",
   "plugins.interaction.input": "Ввести текст",
@@ -1169,6 +1175,19 @@ export const ruCoreMessages: Messages = {
   "settings.plugins.manager.noPermissions": "Привилегированные разрешения не заявлены.",
   "settings.plugins.manager.required": "Обязательно",
   "settings.plugins.manager.optional": "Необязательно",
+  "settings.plugins.themes.title": "Темы плагинов",
+  "settings.plugins.themes.description": "Предпросмотр меняет только это окно. Применение сохраняет выбор на этом устройстве. Личные настройки сохраняются.",
+  "settings.plugins.themes.empty": "Нет включённых тем для этого режима.",
+  "settings.plugins.themes.choose": "Выберите тему",
+  "settings.plugins.themes.unavailable": "Сохранённая тема недоступна; используется стандартная палитра",
+  "settings.plugins.themes.applied": "Применено",
+  "settings.plugins.themes.preview": "Предпросмотр",
+  "settings.plugins.themes.apply": "Применить",
+  "settings.plugins.themes.cancel": "Отменить предпросмотр",
+  "settings.plugins.themes.restore": "Сбросить тему",
+  "settings.plugins.themes.invalid": "Некоторые палитры недоступны или отклонены.",
+  "settings.plugins.themes.failed": "Не удалось применить тему.",
+  "settings.plugins.manager.dataTheme": "Пакет тем: проверенные цвета без выполнения кода.",
   "settings.plugins.manager.browser": "Браузерная среда: привилегированный доступ проходит через проверку разрешений приложения.",
   "settings.plugins.manager.advanced": "Расширенная среда: полный доступ Node к файловой системе и сети. Разрешения посредника не ограничивают этот доступ. Только для разработки.",
   "settings.plugins.manager.data": "Данные KV остаются на устройстве. Синхронизируются только явно отмеченные несекретные настройки в зашифрованных данных. Пакеты и разрешения не синхронизируются.",

application/i18n/locales/zh-CN/core.ts

@@ -1161,6 +1161,12 @@ Vaults 标签保持扁平，不使用这块背景。
   "settings.plugins.manager.remove": "卸载",
   "settings.plugins.manager.removeNote": "卸载会移除插件代码和本地 KV 数据，保留用户设置、秘密存储和同步 sidecar。",
   "settings.plugins.permissions.statusUnknown": "状态未知",
+  "plugins.sidebar.extensions": "扩展页面",
+  "plugins.sidebar.selectTerminal": "请先选择已打开的终端。",
+  "plugins.sidebar.loading": "正在加载扩展页面…",
+  "plugins.vault.loading": "正在加载插件页面…",
+  "plugins.vault.extensions": "扩展",
+  "plugins.vault.back": "返回主机",
   "plugins.interaction.title": "插件请求",
   "plugins.interaction.sharing": "分享的文本将交给此插件及其已授权的能力（包括网络访问）。读取文本不代表批准新的网络目标。",
   "plugins.interaction.input": "输入文本",
@@ -1189,6 +1195,19 @@ Vaults 标签保持扁平，不使用这块背景。
   "settings.plugins.manager.noPermissions": "未声明特权权限。",
   "settings.plugins.manager.required": "必需",
   "settings.plugins.manager.optional": "可选",
+  "settings.plugins.themes.title": "插件主题",
+  "settings.plugins.themes.description": "预览仅影响当前窗口；应用后保存在本设备。个人强调色、字体和终端覆盖设置仍然优先。",
+  "settings.plugins.themes.empty": "当前模式没有已启用的插件主题。",
+  "settings.plugins.themes.choose": "选择主题",
+  "settings.plugins.themes.unavailable": "已保存的主题不可用，正在使用宿主默认配色",
+  "settings.plugins.themes.applied": "已应用",
+  "settings.plugins.themes.preview": "预览",
+  "settings.plugins.themes.apply": "应用",
+  "settings.plugins.themes.cancel": "取消预览",
+  "settings.plugins.themes.restore": "恢复默认",
+  "settings.plugins.themes.invalid": "部分主题配色未通过验证或不可用。",
+  "settings.plugins.themes.failed": "无法应用主题。",
+  "settings.plugins.manager.dataTheme": "主题包：已验证配色，不启动代码运行时。",
   "settings.plugins.manager.browser": "浏览器运行时：特权访问通过宿主权限代理。",
   "settings.plugins.manager.advanced": "高级运行时：拥有完整 Node 文件系统和网络能力，代理权限无法限制这些访问。仅供开发预览。",
   "settings.plugins.manager.data": "本地 KV 仅保留在此设备。只有明确标记为同步的非秘密设置进入加密云 sidecar。插件包和权限授权不参与同步。",

application/i18n/locales/zh-TW/core.ts

@@ -1164,6 +1164,12 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "settings.plugins.manager.remove": "卸載",
   "settings.plugins.manager.removeNote": "卸載會移除插件代碼和本地 KV 數據，保留用戶設置、秘密存儲和同步 sidecar。",
   "settings.plugins.permissions.statusUnknown": "狀態不明",
+  "plugins.sidebar.extensions": "擴充功能頁面",
+  "plugins.sidebar.selectTerminal": "請先選擇已開啟的終端。",
+  "plugins.sidebar.loading": "正在載入擴充功能頁面…",
+  "plugins.vault.loading": "正在載入擴充功能頁面…",
+  "plugins.vault.extensions": "擴充功能",
+  "plugins.vault.back": "返回主機",
   "plugins.interaction.title": "外掛請求",
   "plugins.interaction.sharing": "分享的文字會交給此外掛及其已授權能力（包括網路存取）。讀取文字不代表核准新的網路目的地。",
   "plugins.interaction.input": "輸入文字",
@@ -1192,6 +1198,19 @@ Vaults 分頁維持扁平，不使用這塊背景。
   "settings.plugins.manager.noPermissions": "未聲明特權權限。",
   "settings.plugins.manager.required": "必需",
   "settings.plugins.manager.optional": "可選",
+  "settings.plugins.themes.title": "外掛主題",
+  "settings.plugins.themes.description": "預覽僅影響目前視窗；套用後儲存於本機。個人強調色、字型和終端覆寫設定仍然優先。",
+  "settings.plugins.themes.empty": "目前模式沒有已啟用的外掛主題。",
+  "settings.plugins.themes.choose": "選擇主題",
+  "settings.plugins.themes.unavailable": "已儲存的主題無法使用，正在使用宿主預設配色",
+  "settings.plugins.themes.applied": "已套用",
+  "settings.plugins.themes.preview": "預覽",
+  "settings.plugins.themes.apply": "套用",
+  "settings.plugins.themes.cancel": "取消預覽",
+  "settings.plugins.themes.restore": "恢復預設",
+  "settings.plugins.themes.invalid": "部分主題配色未通過驗證或無法使用。",
+  "settings.plugins.themes.failed": "無法套用主題。",
+  "settings.plugins.manager.dataTheme": "主題套件：已驗證配色，不啟動程式執行環境。",
   "settings.plugins.manager.browser": "瀏覽器運行時：特權訪問通過宿主權限代理。",
   "settings.plugins.manager.advanced": "高級運行時：擁有完整 Node 文件系統和網絡能力，代理權限無法限制這些訪問。僅供開發預覽。",
   "settings.plugins.manager.data": "本地 KV 僅保留在此設備。只有明確標記為同步的非秘密設置進入加密雲 sidecar。插件包和權限授權不參與同步。",

application/state/pluginVaultPages.ts

@@ -0,0 +1,27 @@
+export const PLUGIN_VAULT_PAGE_PREFIX = 'plugin-vault:';
+
+export interface PluginVaultPage {
+  key: `plugin-vault:${string}`;
+  pluginId: string;
+  pluginName: string;
+  version: string;
+  viewId: string;
+  title: string;
+  icon?: NetcattyPluginIconReference;
+  order: number;
+}
+
+export function collectPluginVaultPages(plugins: NetcattyPluginContributionSnapshot['plugins']): PluginVaultPage[] {
+  return plugins.flatMap((plugin) => plugin.views
+    .filter((view) => view.location === 'vault-page' && view.visible)
+    .map((view): PluginVaultPage => ({
+      key: `${PLUGIN_VAULT_PAGE_PREFIX}${view.id}`,
+      pluginId: plugin.id, pluginName: plugin.displayName, version: plugin.version,
+      viewId: view.id, title: view.title, icon: view.icon, order: view.order ?? 0,
+    })))
+    .sort((left, right) => left.order - right.order || left.viewId.localeCompare(right.viewId));
+}
+
+export function resolvePluginVaultPage(pages: readonly PluginVaultPage[], section: string): PluginVaultPage | null {
+  return pages.find((page) => page.key === section) ?? null;
+}

application/state/pluginViewOcclusion.ts

@@ -0,0 +1,18 @@
+/** Native child views must yield to host dialogs and overlapping portals. */
+export function isPluginViewOccluded(mount: HTMLElement): boolean {
+  const rect = mount.getBoundingClientRect();
+  if (!mount.isConnected || mount.closest('[hidden], [inert], [aria-hidden="true"]')) return true;
+  const overlays = mount.ownerDocument.querySelectorAll(
+    '[data-app-lock-overlay], [role="dialog"], [role="alertdialog"], '
+    + '[role="menu"][data-state="open"], [data-radix-popper-content-wrapper] > *, [data-native-view-occluder]',
+  );
+  return [...overlays].some((overlay) => {
+    if (mount.contains(overlay)) return false;
+    const style = getComputedStyle(overlay);
+    if (style.display === 'none' || style.visibility === 'hidden' || overlay.closest('[hidden], [inert]')) return false;
+    if (overlay.matches('[data-app-lock-overlay], [role="dialog"][aria-modal="true"], [role="alertdialog"]')) return true;
+    const other = overlay.getBoundingClientRect();
+    return other.width > 0 && other.height > 0 && other.x < rect.right && other.right > rect.x
+      && other.y < rect.bottom && other.bottom > rect.y;
+  });
+}

application/state/settingsStateDefaults.ts

@@ -1,3 +1,4 @@
+import { pluginThemeRegistry } from '../../infrastructure/config/pluginThemeRegistry';
 import {
   DEFAULT_SHIFT_ENTER_NEWLINE_TEXT,
   isLegacyDefaultShiftEnterNewlineText,
@@ -252,6 +253,9 @@ export const applyThemeTokens = (
   accentOverride: string,
 ) => {
   const root = window.document.documentElement;
+  root.toggleAttribute('data-plugin-theme-active', pluginThemeRegistry.isActive(resolvedTheme));
+  const securityVars = buildAppThemeCssVars(pluginThemeRegistry.securityTokens(resolvedTheme), 'theme', '');
+  for (const [key, value] of Object.entries(securityVars)) root.style.setProperty('--host-security' + key.slice(1), value);
   root.classList.remove('light', 'dark');
   root.classList.add(resolvedTheme);
   const cssVars = buildAppThemeCssVars(tokens, accentMode, accentOverride);

application/state/terminalSidePanelTabs.ts

@@ -13,11 +13,11 @@ import {
 } from '../../infrastructure/config/storageKeys';
 import { localStorageAdapter } from '../../infrastructure/persistence/localStorageAdapter';
 import { useToolbarItemLayout } from './useToolbarItemLayout';
-import type { SidePanelTool } from '../../domain/sidePanelLayout';
+import type { BuiltinSidePanelTool, SidePanelTool } from '../../domain/sidePanelLayout';
 
 export type TerminalSidePanelTabId = SidePanelTool;
 
-export const TERMINAL_SIDE_PANEL_TAB_DEFAULT_ORDER: TerminalSidePanelTabId[] = [
+export const TERMINAL_SIDE_PANEL_TAB_DEFAULT_ORDER: BuiltinSidePanelTool[] = [
   'sftp',
   'browser',
   'scripts',

application/state/useActiveChromeTheme.ts

@@ -1,3 +1,6 @@
+import { pluginThemeRegistry } from '../../infrastructure/config/pluginThemeRegistry';
+import { usePluginThemeRevision } from './usePluginThemeRuntime';
+import { useSettingsChromeStore } from './settingsChromeStore';
 import { useLayoutEffect, useRef } from "react";
 import type { TerminalTheme } from "../../domain/models";
 import {
@@ -271,12 +274,15 @@ export function useActiveChromeTheme({
   activeTheme: TerminalTheme | null;
   applyAppTheme: () => void;
 }) {
+  const pluginThemeRevision = usePluginThemeRevision();
+  const { resolvedTheme } = useSettingsChromeStore();
+  const effectiveTheme = pluginThemeRegistry.isActive(resolvedTheme) ? null : activeTheme;
   const applyAppThemeRef = useRef(applyAppTheme);
   applyAppThemeRef.current = applyAppTheme;
 
   useLayoutEffect(() => {
-    syncActiveChromeTheme(activeTheme, applyAppTheme);
-  }, [activeTheme, applyAppTheme]);
+    syncActiveChromeTheme(effectiveTheme, applyAppTheme);
+  }, [effectiveTheme, applyAppTheme, pluginThemeRevision]);
 
   useLayoutEffect(() => {
     return () => {

application/state/useEmbeddedPluginView.ts

@@ -0,0 +1,119 @@
+import { useEffect, useRef, useState } from 'react';
+import { PluginViewLifecycleController, type HostedPluginViewState } from './pluginViewLifecycle';
+import { resolvePluginViewWindowScope } from './pluginViewScopes';
+import { isPluginViewOccluded } from './pluginViewOcclusion';
+import type { UsePluginContributionsResult } from './usePluginContributions';
+
+type ViewAdapter = Pick<UsePluginContributionsResult, 'openView' | 'closeView' | 'focusView' | 'setViewBounds' | 'setViewVisibility' | 'onViewClosed' | 'onViewFocused'>;
+
+/** Host-owned mounting only. No plugin router, DOM, session or vault data API. */
+export function useEmbeddedPluginView({ viewId, version, slot, active, context, adapter, subscribeHidden, unavailable, focused, focusOnReveal = false }: {
+  viewId: string;
+  version: string;
+  slot: string;
+  active: boolean;
+  context: Record<string, unknown>;
+  adapter: ViewAdapter;
+  subscribeHidden(listener: () => void): () => void;
+  unavailable(): void;
+  focused?(): void;
+  focusOnReveal?: boolean;
+}) {
+  const mountRef = useRef<HTMLDivElement>(null);
+  const [loading, setLoading] = useState(true);
+  const adapterRef = useRef(adapter);
+  const unavailableRef = useRef(unavailable);
+  const focusedRef = useRef(focused);
+  const revealFocusRef = useRef(focusOnReveal);
+  const requestFocusRef = useRef<() => void>(() => {});
+  revealFocusRef.current = focusOnReveal;
+  focusedRef.current = focused;
+  adapterRef.current = adapter;
+  unavailableRef.current = unavailable;
+  useEffect(() => {
+    const mount = mountRef.current;
+    if (!active || !mount) return;
+    let cancelled = false;
+    const lifecycle = new PluginViewLifecycleController<HostedPluginViewState>();
+    const instanceId = crypto.randomUUID();
+    const scopeId = resolvePluginViewWindowScope({ pathname: window.location.pathname,
+      search: window.location.search, hash: `${window.location.hash}|plugin-slot:${slot}` });
+    const { openView, closeView, focusView, setViewBounds, setViewVisibility, onViewClosed, onViewFocused } = adapterRef.current;
+    const close = () => {
+      if (cancelled) return;
+      cancelled = true;
+      lifecycle.markViewClosed(viewId);
+      void closeView(instanceId).catch(() => {});
+    };
+    const failCurrent = () => {
+      if (cancelled) return;
+      close();
+      unavailableRef.current();
+    };
+    const unsubscribe = onViewClosed((event) => {
+      lifecycle.handleHostClose(event.instanceId);
+      if (event.instanceId === instanceId && !cancelled) {
+        close();
+        unavailableRef.current();
+      }
+    });
+    const stopOnHide = subscribeHidden(close);
+    const stopOnFocus = onViewFocused((event) => {
+      if (!cancelled && event.instanceId === instanceId) focusedRef.current?.();
+    });
+    const bounds = () => {
+      const rect = mount.getBoundingClientRect();
+      return { x: Math.round(rect.x), y: Math.round(rect.y), width: Math.max(1, Math.round(rect.width)), height: Math.max(1, Math.round(rect.height)) };
+    };
+    let opened = false;
+    let lastBounds = '';
+    let visible = false;
+    const focus = () => {
+      if (!cancelled && opened && visible && revealFocusRef.current && !isPluginViewOccluded(mount)) void focusView(instanceId).catch(() => {});
+    };
+    requestFocusRef.current = focus;
+    const updateVisibility = () => {
+      if (!opened || cancelled) return;
+      const rect = mount.getBoundingClientRect();
+      const next = rect.width > 0 && rect.height > 0 && !isPluginViewOccluded(mount);
+      if (visible === next) return;
+      visible = next;
+      void setViewVisibility(instanceId, next).then(() => { if (next) focus(); }).catch(failCurrent);
+    };
+    const resize = () => {
+      if (opened && !cancelled) {
+        const next = bounds();
+        const key = JSON.stringify(next);
+        if (key !== lastBounds) { lastBounds = key; void setViewBounds(instanceId, next).catch(failCurrent); }
+      }
+      updateVisibility();
+    };
+    const observer = typeof ResizeObserver === 'undefined' ? null : new ResizeObserver(resize);
+    observer?.observe(mount);
+    const mutations = new MutationObserver(resize);
+    mutations.observe(document.body, { childList: true, subtree: true, attributes: true,
+      attributeFilter: ['class', 'style', 'hidden', 'inert', 'role', 'aria-modal', 'aria-hidden', 'data-state', 'data-app-lock-overlay', 'data-radix-popper-content-wrapper', 'data-native-view-occluder'] });
+    window.addEventListener('resize', resize);
+    document.addEventListener('scroll', resize, true);
+    setLoading(true);
+    const opening = lifecycle.beginOpen({ viewKey: viewId });
+    void openView({ viewId, instanceId, scopeId, bounds: bounds(), context }).then(async (result) => {
+      if (cancelled || lifecycle.shouldCloseOpen(opening) || lifecycle.consumeHostClose(result.instanceId)) {
+        await closeView(result.instanceId);
+        return;
+      }
+      opened = true;
+      lifecycle.setCurrent({ id: result.instanceId, viewId, scopeId, retainContextWhenHidden: false });
+      resize();
+      setLoading(false);
+    }).catch(() => {
+      if (!cancelled) { close(); unavailableRef.current(); }
+    }).finally(() => lifecycle.finishOpen({ token: opening, viewKey: viewId }));
+    return () => {
+      close(); unsubscribe(); stopOnHide(); stopOnFocus(); observer?.disconnect(); mutations.disconnect();
+      window.removeEventListener('resize', resize); document.removeEventListener('scroll', resize, true);
+    };
+  }, [active, context, slot, subscribeHidden, version, viewId]);
+  useEffect(() => { if (focusOnReveal) requestFocusRef.current(); }, [focusOnReveal]);
+  return { mountRef, loading };
+}

application/state/usePluginContributions.ts

@@ -88,10 +88,12 @@ export interface UsePluginContributionsResult {
   selectSettingPath(kind: 'file' | 'directory', title: string, defaultPath?: string): Promise<string | null>;
   openView(payload: NetcattyPluginViewOpenRequest): Promise<{ instanceId: string }>;
   closeView(instanceId: string): Promise<void>;
+  focusView(instanceId: string): Promise<void>;
   setViewBounds(instanceId: string, bounds: { x: number; y: number; width: number; height: number }): Promise<void>;
   setViewVisibility(instanceId: string, visible: boolean): Promise<void>;
   setEnvironment(environment: NetcattyPluginEnvironment): Promise<void>;
   onViewClosed(callback: (event: NetcattyPluginViewClosedEvent) => void): () => void;
+  onViewFocused(callback: (event: import('@netcatty/plugin-contract').PluginViewFocusEvent) => void): () => void;
 }
 
 export function usePluginContributions(
@@ -196,6 +198,9 @@ export function usePluginContributions(
     if (!bridge?.closePluginView) return;
     await bridge.closePluginView(instanceId);
   }, [bridge]);
+  const focusView = useCallback(async (instanceId: string) => {
+    await bridge?.focusPluginView?.({ instanceId });
+  }, [bridge]);
 
   const setViewBounds = useCallback(async (
     instanceId: string,
@@ -218,6 +223,9 @@ export function usePluginContributions(
   const onViewClosed = useCallback((callback: (event: NetcattyPluginViewClosedEvent) => void) => (
     bridge?.onPluginViewClosed?.(callback) ?? (() => {})
   ), [bridge]);
+  const onViewFocused = useCallback((callback: (event: import('@netcatty/plugin-contract').PluginViewFocusEvent) => void) => (
+    bridge?.onPluginViewFocused?.(callback) ?? (() => {})
+  ), [bridge]);
 
   const currentLoadState = resolvePluginContributionLoadState({
     currentQueryKey: queryKey,
@@ -239,9 +247,11 @@ export function usePluginContributions(
     selectSettingPath,
     openView,
     closeView,
+    focusView,
     setViewBounds,
     setViewVisibility,
     setEnvironment,
     onViewClosed,
+    onViewFocused,
   };
 }

application/state/usePluginLogs.ts

@@ -0,0 +1,49 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge';
+
+export function usePluginLogs() {
+  const [status, setStatus] = useState<NetcattyPluginLogStatus | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const pending = useRef(false);
+  const mounted = useRef(true);
+  const run = useCallback(async (action: 'status' | 'configure' | 'open' | 'export' | 'clear', settings?: { saveToDisk: boolean; verbose: boolean }) => {
+    if (pending.current) return;
+    pending.current = true;
+    setBusy(true);
+    setError(null);
+    try {
+      const bridge = netcattyBridge.require();
+      const result = await (action === 'configure' ? bridge.configurePluginLogs?.(settings!)
+        : action === 'open' ? bridge.openPluginLogFolder?.()
+          : action === 'export' ? bridge.exportPluginLogs?.()
+            : action === 'clear' ? bridge.clearPluginLogs?.() : bridge.getPluginLogStatus?.());
+      if (!result) throw new Error('Local plugin logging is unavailable');
+      if (mounted.current) setStatus(result);
+    } catch (cause) {
+      let message = cause instanceof Error ? cause.message : String(cause);
+      if (action === 'configure') {
+        // Configuration fails closed before disk I/O. Show actual host state,
+        // even when persisting a setting failed, rather than keeping stale ON.
+        try {
+          const actual = await netcattyBridge.require().getPluginLogStatus?.();
+          if (!actual) throw new Error('Local plugin log status is unavailable');
+          if (mounted.current) setStatus(actual);
+        } catch (refreshError) {
+          if (mounted.current) setStatus(null);
+          message += `\n${refreshError instanceof Error ? refreshError.message : String(refreshError)}`;
+        }
+      }
+      if (mounted.current) setError(message);
+    } finally {
+      pending.current = false;
+      if (mounted.current) setBusy(false);
+    }
+  }, []);
+  useEffect(() => {
+    mounted.current = true;
+    void run('status');
+    return () => { mounted.current = false; };
+  }, [run]);
+  return { status, error, busy, run };
+}

application/state/usePluginTerminalSidebar.ts

@@ -0,0 +1,79 @@
+import { useEffect, useMemo, useRef, useSyncExternalStore } from 'react';
+import { useI18n } from '../i18n/I18nProvider';
+import { toast } from '../../components/ui/toast';
+import { collectSidePanelPanes, isPluginSidePanelTool, type SidePanelLayout } from '../../domain/sidePanelLayout';
+import { activeTabStore, useActiveTabId } from './activeTabStore';
+import { getSidePanelLiveSnapshot, subscribeSidePanelLiveSnapshot } from './sidePanelLiveStore';
+import { usePluginContributions } from './usePluginContributions';
+import { OPEN_PLUGIN_VIEW_EVENT, type OpenPluginViewDetail } from './usePluginViewLifecycle';
+
+export const OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT = 'netcatty:open-plugin-terminal-sidebar';
+export const PLUGIN_TERMINAL_SIDEBAR_CONTEXT = Object.freeze({ 'netcatty.surface': 'terminal-sidebar' });
+/** Required production view-context projection, not a plugin-facing API. */
+export interface PluginSidebarHostActions {
+  getActiveTerminalSessionId(): string | null;
+  handleSwitchSidePanelTab(tool: import('../../domain/sidePanelLayout').SidePanelTool): void;
+  handleWithdrawPluginSidebarPane(tabId: string, paneId: string, expectedTool: import('../../domain/sidePanelLayout').SidePanelTool): void;
+}
+export interface PluginTerminalSidebarPage {
+  tool: `plugin-view:${string}`;
+  viewId: string;
+  pluginId: string;
+  pluginName: string;
+  version: string;
+  title: string;
+  icon?: NetcattyPluginIconReference;
+  order: number;
+}
+export function collectPluginTerminalSidebarPages(plugins: NetcattyPluginContributionSnapshot['plugins']): PluginTerminalSidebarPage[] {
+  return plugins.flatMap((plugin) => plugin.views.filter((view) => view.location === 'terminal-sidebar' && view.visible)
+    .map((view): PluginTerminalSidebarPage => ({ tool: `plugin-view:${view.id}`, viewId: view.id, pluginId: plugin.id,
+      pluginName: plugin.displayName, version: plugin.version, title: view.title, icon: view.icon, order: view.order ?? 0 })))
+    .sort((a, b) => a.order - b.order || a.viewId.localeCompare(b.viewId));
+}
+export function requestOpenPluginTerminalSidebar(viewId: string, sessionId: string) {
+  window.dispatchEvent(new CustomEvent(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, { detail: { viewId, sessionId } }));
+}
+export function usePluginTerminalSidebar(host: {
+  layouts: ReadonlyMap<string, SidePanelLayout>;
+  getSession(): string | null;
+  isTerminalTab(tabId: string): boolean;
+  select(tool: `plugin-view:${string}`): void;
+  withdraw(tabId: string, paneId: string, tool: `plugin-view:${string}`): void;
+}) {
+  const { locale, t } = useI18n();
+  const activeTabId = useActiveTabId();
+  // Follow workspace focus without subscribing the whole sidebar to cwd/title
+  // or forwarding the host's live session DTO to a plugin.
+  useSyncExternalStore((listener) => subscribeSidePanelLiveSnapshot(true, listener),
+    () => getSidePanelLiveSnapshot(true).focusedSessionId, () => null);
+  const hostRef = useRef(host); hostRef.current = host;
+  const contributions = usePluginContributions({ locale, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT });
+  const pages = useMemo(() => collectPluginTerminalSidebarPages(contributions.snapshot.plugins), [contributions.snapshot.plugins]);
+  const sessionId = activeTabId && host.isTerminalTab(activeTabId) ? host.getSession() : null;
+  useEffect(() => {
+    const open = (event: Event) => {
+      const detail = (event as CustomEvent<OpenPluginViewDetail & { sessionId?: string }>).detail;
+      const page = pages.find((item) => item.viewId === detail?.viewId);
+      if (!page) return;
+      const tabId = activeTabStore.getActiveTabId();
+      const current = hostRef.current.getSession();
+      if (!hostRef.current.isTerminalTab(tabId) || !current || (detail.sessionId && detail.sessionId !== current)) {
+        toast.info(t('plugins.sidebar.selectTerminal'));
+        return;
+      }
+      hostRef.current.select(page.tool);
+    };
+    window.addEventListener(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, open);
+    window.addEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
+    return () => { window.removeEventListener(OPEN_PLUGIN_TERMINAL_SIDEBAR_EVENT, open); window.removeEventListener(OPEN_PLUGIN_VIEW_EVENT, open); };
+  }, [pages, t]);
+  useEffect(() => {
+    if (contributions.loading) return;
+    const allowed = new Set(pages.map((page) => page.tool));
+    for (const [tabId, layout] of host.layouts) for (const pane of collectSidePanelPanes(layout.root)) {
+      if (isPluginSidePanelTool(pane.tool) && !allowed.has(pane.tool)) host.withdraw(tabId, pane.id, pane.tool);
+    }
+  }, [contributions.loading, host, pages]);
+  return { pages, contributions, tabId: activeTabId, sessionId };
+}

application/state/usePluginThemeRuntime.ts

@@ -0,0 +1,77 @@
+import { useEffect, useSyncExternalStore } from "react";
+import { netcattyBridge } from "../../infrastructure/services/netcattyBridge";
+import { pluginThemeRegistry } from "../../infrastructure/config/pluginThemeRegistry";
+export function usePluginThemeRevision() {
+  return useSyncExternalStore(
+    pluginThemeRegistry.subscribe,
+    pluginThemeRegistry.getRevision,
+    pluginThemeRegistry.getRevision,
+  );
+}
+/** Host-owned selection; never stored in plugin KV or cloud sidecars. */
+let runtimeUsers = 0;
+let disconnectRuntime: (() => void) | undefined;
+function connectRuntime() {
+  const bridge = netcattyBridge.get();
+  let active = true,
+    request = 0;
+  const refresh = async () => {
+    const current = ++request;
+    try {
+      const catalog = await bridge?.getPluginThemes?.();
+      if (active && current === request && catalog)
+        pluginThemeRegistry.setCatalog(catalog);
+    } catch {
+      /* Keep the last host-validated selection; never apply unvalidated data. */
+    }
+  };
+  void refresh();
+  const dispose = bridge?.onPluginThemesChanged?.(() => {
+    pluginThemeRegistry.invalidate();
+    void refresh();
+  });
+  const forced = window.matchMedia?.("(forced-colors: active)"),
+    contrast = window.matchMedia?.("(prefers-contrast: more)");
+  const update = () =>
+    pluginThemeRegistry.setHighContrast(
+      Boolean(forced?.matches || contrast?.matches),
+    );
+  update();
+  forced?.addEventListener?.("change", update);
+  contrast?.addEventListener?.("change", update);
+  return () => {
+    active = false;
+    request++;
+    dispose?.();
+    forced?.removeEventListener?.("change", update);
+    contrast?.removeEventListener?.("change", update);
+  };
+}
+export function usePluginThemeRuntime() {
+  const revision = usePluginThemeRevision();
+  useEffect(() => {
+    if (runtimeUsers++ === 0) disconnectRuntime = connectRuntime();
+    return () => {
+      if (--runtimeUsers === 0) {
+        disconnectRuntime?.();
+        disconnectRuntime = undefined;
+      }
+    };
+  }, []);
+  return revision;
+}
+export async function applyPluginThemeSelection(
+  mode: "light" | "dark",
+  choice: import("@netcatty/plugin-contract").ThemePackChoice | null,
+) {
+  if (choice === null && !pluginThemeRegistry.isActive(mode))
+    return pluginThemeRegistry.getCatalog();
+  const bridge = netcattyBridge.require();
+  if (!bridge.applyPluginTheme) throw new Error("Plugin themes unavailable");
+  const next = await bridge.applyPluginTheme({
+    mode,
+    choice,
+    expectedRevision: pluginThemeRegistry.getCatalog().selection.revision,
+  });
+  return next; // The host change event refreshes every window; never publish a potentially stale apply response.
+}

application/state/usePluginVaultPages.ts

@@ -0,0 +1,47 @@
+import { useCallback, useEffect, useMemo, useRef } from 'react';
+import { activeTabStore, useActiveTabId } from './activeTabStore';
+import { collectPluginVaultPages, PLUGIN_VAULT_PAGE_PREFIX, resolvePluginVaultPage } from './pluginVaultPages';
+import { usePluginContributions } from './usePluginContributions';
+import { OPEN_PLUGIN_VIEW_EVENT, type OpenPluginViewDetail } from './usePluginViewLifecycle';
+
+const CONTEXT = Object.freeze({ 'netcatty.surface': 'vault-page' });
+
+export function usePluginVaultPages({ locale, section, select }: {
+  locale: string;
+  section: string;
+  select(section: 'hosts' | `plugin-vault:${string}`): void;
+}) {
+  const active = useActiveTabId() === 'vault';
+  const sectionRef = useRef(section);
+  const focusFrame = useRef<number | null>(null);
+  sectionRef.current = section;
+  useEffect(() => () => { if (focusFrame.current !== null) cancelAnimationFrame(focusFrame.current); }, []);
+  const contributions = usePluginContributions({ locale, context: CONTEXT });
+  const pages = useMemo(() => collectPluginVaultPages(contributions.snapshot.plugins), [contributions.snapshot.plugins]);
+  const selected = resolvePluginVaultPage(pages, section);
+  const fallback = useCallback(() => {
+    select('hosts');
+    if (focusFrame.current !== null) cancelAnimationFrame(focusFrame.current);
+    focusFrame.current = requestAnimationFrame(() => {
+      focusFrame.current = null;
+      if (sectionRef.current === 'hosts' && activeTabStore.getActiveTabId() === 'vault') {
+        document.querySelector<HTMLButtonElement>('[data-plugin-vault-fallback]')?.focus();
+      }
+    });
+  }, [select]);
+  useEffect(() => {
+    if (!contributions.loading && section.startsWith(PLUGIN_VAULT_PAGE_PREFIX) && !selected) fallback();
+  }, [contributions.loading, fallback, section, selected]);
+  useEffect(() => {
+    const open = (event: Event) => {
+      const detail = (event as CustomEvent<OpenPluginViewDetail>).detail;
+      const page = pages.find((item) => item.viewId === detail?.viewId);
+      if (!page) return;
+      activeTabStore.setActiveTabId('vault');
+      select(page.key);
+    };
+    window.addEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
+    return () => window.removeEventListener(OPEN_PLUGIN_VIEW_EVENT, open);
+  }, [pages, select]);
+  return { pages, selected, active, select, fallback, contributions, context: CONTEXT };
+}

application/state/usePluginViewLifecycle.ts

@@ -82,7 +82,7 @@ export function usePluginViewLifecycle({
   const mountRef = useRef<HTMLDivElement>(null);
   const resolvedActiveView = useMemo(() => viewContributions.snapshot.plugins
     .flatMap((plugin) => plugin.views.map((view) => ({ plugin, view })))
-    .find(({ view }) => view.id === effectiveRequested?.viewId && view.visible) ?? null,
+    .find(({ view }) => view.id === effectiveRequested?.viewId && view.visible && !['vault-page', 'terminal-sidebar'].includes(view.location)) ?? null,
   [effectiveRequested?.viewId, viewContributions.snapshot.plugins]);
   const stableActiveViewRef = useRef<PluginViewSnapshotSelection<ResolvedPluginView> | null>(null);
   const activeView = resolvePluginViewSnapshotSelection({

application/state/useSettingsState.ts

@@ -1,3 +1,4 @@
+import { usePluginThemeRuntime } from './usePluginThemeRuntime';
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, type SetStateAction } from 'react';
 
 import { runThemeTransition, type ThemeTransitionMode } from './themeTransition';
@@ -217,6 +218,7 @@ import {
 } from './appearanceSync';
 
 export const useSettingsState = (options: { enableSettingsSync?: boolean; enableSystemEffects?: boolean } = {}) => {
+  const pluginThemeRevision = usePluginThemeRuntime();
   const enableSettingsSync = options.enableSettingsSync !== false;
   const enableSystemEffects = options.enableSystemEffects !== false;
   const initialCustomKeyBindingsRecord =
@@ -1212,7 +1214,7 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
         notifySettingsChanged(STORAGE_KEY_COLOR, customAccentRecord);
       }
     }
-  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentRecord, notifySettingsChanged]);
+  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, customAccentRecord, notifySettingsChanged, pluginThemeRevision]);
 
   // Listen for OS color scheme changes to keep systemPreference in sync
   useEffect(() => {
@@ -1979,9 +1981,10 @@ export const useSettingsState = (options: { enableSettingsSync?: boolean; enable
   }, [setTerminalSettings]);
 
   const applyAppTheme = useCallback(() => {
+    void pluginThemeRevision; // Invalidate the closure when host theme data changes.
     const tokens = getUiThemeById(resolvedTheme, resolvedTheme === 'dark' ? darkUiThemeId : lightUiThemeId).tokens;
     applyThemeTokens(theme, resolvedTheme, tokens, accentMode, customAccent);
-  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent]);
+  }, [theme, resolvedTheme, lightUiThemeId, darkUiThemeId, accentMode, customAccent, pluginThemeRevision]);
 
   const setEditorWordWrap = useCallback((enabled: boolean) => {
     setEditorWordWrapState(enabled);

components/HostDetailsPanel.securityTheme.test.tsx

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import test from 'node:test';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { JSDOM } from 'jsdom';
+import { compile } from '@tailwindcss/node';
+import postcss from 'postcss';
+import HostDetailsPanel from './HostDetailsPanel';
+import { Card } from './ui/card';
+import { TooltipProvider } from './ui/tooltip';
+import { PluginPermissionPanel } from './settings/tabs/PluginPermissionPanel';
+import { I18nProvider } from '../application/i18n/I18nProvider';
+
+test('real Host form cards, inputs and Save consume scoped security aliases without freezing an ordinary card', async () => {
+  const markup = renderToStaticMarkup(<I18nProvider locale="en"><TooltipProvider>
+    <HostDetailsPanel availableKeys={[]} identities={[]} groups={[]} terminalThemeId="default" terminalFontSize={14} onSave={() => assert.fail('test never saves a host')} onCancel={() => {}} />
+    <PluginPermissionPanel pluginId="com.example.synthetic" onChanged={async () => {}} />
+    <Card id="ordinary-card">Outside the security surface</Card>
+  </TooltipProvider></I18nProvider>);
+  const dom = new JSDOM(`<!doctype html><html data-plugin-theme-active><body>${markup}</body></html>`);
+  try {
+    const panel = dom.window.document.querySelector('[data-section="host-details-panel"]')!;
+    assert.ok(panel, 'exercise the actual HostDetailsPanel and AsidePanel');
+    assert.ok(panel.querySelector('.bg-card'), 'General/Address/Credentials use real Card components');
+    assert.ok(panel.querySelector('input.bg-background'), 'exercise actual Input utilities');
+    assert.ok(panel.querySelector('button.bg-primary'), 'exercise the actual Save button');
+    const permissions = dom.window.document.querySelector('[data-host-security-surface]')!;
+    assert.ok(permissions.querySelector('[role="status"]'), 'exercise the real grant-panel security root without loading or changing any grants');
+    const source = await readFile(new URL('../index.css', import.meta.url), 'utf8');
+    const compiler = await compile(source, {base: path.resolve('.'), onDependency() {}});
+    const classes = [...new Set([...dom.window.document.querySelectorAll('[class]')].flatMap(el => [...el.classList]))];
+    const css = compiler.build(classes);
+    const parsed = postcss.parse(css);
+    const rules: postcss.Rule[] = [];
+    parsed.walkRules(rule => { rules.push(rule); });
+    const rule = rules.find(node => node.selector.startsWith(':root[data-plugin-theme-active]'));
+    assert.ok(rule && rule.type === 'rule');
+    const matches = [...dom.window.document.querySelectorAll(rule.selector)];
+    assert.ok(matches.includes(panel));
+    assert.ok(matches.includes(permissions));
+    assert.ok(!matches.includes(dom.window.document.getElementById('ordinary-card')!), 'security selector stays within the existing marked surfaces');
+    const declarations = new Map(rule.nodes.filter(node => node.type === 'decl').map(node => [node.prop, node]));
+    for (const name of ['background','foreground','card','card-foreground','popover','popover-foreground','primary','primary-foreground','secondary','secondary-foreground','muted','muted-foreground','accent','accent-foreground','destructive','destructive-foreground','border','input','ring']) {
+      const declaration = declarations.get(`--color-${name}`);
+      assert.equal(declaration?.value, `hsl(var(--host-security-${name}))`, `Tailwind alias ${name} cannot inherit the plugin value`);
+      assert.equal(declaration.important, true);
+    }
+    for (const name of ['card','background','primary']) {
+      const utility = rules.find(node => node.selector === `.bg-${name}`);
+      assert.ok(utility && utility.type === 'rule');
+      assert.ok(utility.nodes.some(node => node.type === 'decl' && node.prop === 'background-color' && node.value === `var(--color-${name})`), 'verify what the actual compiled utility consumes');
+    }
+    const mutedText = rules.find(node => node.selector === '.text-muted-foreground');
+    assert.ok(mutedText?.nodes.some(node => node.type === 'decl' && node.prop === 'color' && node.value === 'var(--color-muted-foreground)'));
+  } finally { dom.window.close(); }
+});

components/KeychainManager.tsx

@@ -882,6 +882,7 @@ echo $3 >> "$FILE"`);
       {/* Slide-out Panel */}
       {panel.type !== "closed" && (
         <AsidePanel
+          dataSection="keychain-security-panel"
           open={true}
           onClose={closePanel}
           title={panelTitle}

components/PluginTerminalSidebar.test.tsx

@@ -0,0 +1,128 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JSDOM } from 'jsdom';
+
+test('terminal extension pages use actual split panes, focus and session ownership without sharing session data', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'SVGElement', 'Node', 'NodeFilter', 'MutationObserver', 'CustomEvent', 'Event', 'KeyboardEvent', 'MouseEvent']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('PointerEvent', dom.window.MouseEvent);
+  install('getComputedStyle', dom.window.getComputedStyle.bind(dom.window));
+  install('requestAnimationFrame', dom.window.requestAnimationFrame.bind(dom.window)); install('cancelAnimationFrame', dom.window.cancelAnimationFrame.bind(dom.window)); install('IS_REACT_ACT_ENVIRONMENT', true);
+  let rectX = 200;
+  dom.window.HTMLElement.prototype.getBoundingClientRect = () => new dom.window.DOMRect(rectX, 100, 400, 300);
+  const { default: React, act, useCallback, useRef, useState } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const { activeTabStore } = await import('../application/state/activeTabStore');
+  const { sidePanelLiveStore, SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT } = await import('../application/state/sidePanelLiveStore');
+  const { useTerminalSidePanelLayoutState } = await import('../application/state/useTerminalSidePanelLayoutState');
+  const { usePluginTerminalSidebar } = await import('../application/state/usePluginTerminalSidebar');
+  const { PluginTerminalSidebarLauncher, PluginTerminalSidebarPageHost } = await import('./plugins/PluginTerminalSidebar');
+  const { SidePanelLayoutTree } = await import('./terminalLayer/TerminalLayerSidePanelSection');
+  const { PersistentSidePanelPortal } = await import('./terminalLayer/terminalLayerSidePanelSlots');
+  const { collectSidePanelPanes } = await import('../domain/sidePanelLayout');
+  type Tool = import('../domain/sidePanelLayout').SidePanelTool;
+  let selectedSession = 'synthetic-session-a';
+  const getSession = () => selectedSession;
+  const a = { id: 'com.example.sidebar.first', title: 'First page', location: 'terminal-sidebar', entry: 'page.html', visible: true };
+  const b = { ...a, id: 'com.example.sidebar.second', title: 'Second page' };
+  let snapshot = { locale: 'en', plugins: [{ id: 'com.example.sidebar', displayName: 'Synthetic plugin', version: '1.0.0', commands: [], keybindings: [], menus: [], settings: [], views: [a, b] }] };
+  const changed = new Set<() => void>(), focusListeners = new Set<(event: { instanceId: string }) => void>();
+  const opens: NetcattyPluginViewOpenRequest[] = [], closes: string[] = [], focus: string[] = [], bounds: Array<{ instanceId: string; x: number }> = [];
+  const visible = new Map<string, boolean>();
+  Object.assign(dom.window, { netcatty: {
+    async getPluginRuntimeStatus() { return { available: true }; }, async getPluginContributions() { return snapshot; },
+    onPluginContributionsChanged(fn: () => void) { changed.add(fn); return () => { changed.delete(fn); }; },
+    onPluginViewClosed() { return () => {}; },
+    onPluginViewFocused(fn: (event: { instanceId: string }) => void) { focusListeners.add(fn); return () => { focusListeners.delete(fn); }; },
+    async openPluginView(payload: NetcattyPluginViewOpenRequest) { opens.push(payload); return { instanceId: payload.instanceId! }; },
+    async closePluginView(id: string) { closes.push(id); },
+    async setPluginViewBounds(id: string, rect: { x: number }) { bounds.push({ instanceId: id, x: rect.x }); },
+    async setPluginViewVisibility(id: string, value: boolean) { visible.set(id, value); },
+    async focusPluginView(event: { instanceId: string }) { focus.push(event.instanceId); for (const fn of focusListeners) fn(event); },
+  } });
+  let split!: () => void;
+  function Fixture() {
+    const state = useTerminalSidePanelLayoutState(); const latest = useRef(state); latest.current = state;
+    const model = usePluginTerminalSidebar({ layouts: state.sidePanelLayouts, getSession, isTerminalTab: (id) => id === 'workspace-synthetic' || id === 'synthetic-local-terminal',
+      select: (tool) => state.selectSidePanelToolForTab(activeTabStore.getActiveTabId(), tool),
+      withdraw: (tabId, paneId, tool) => {
+        const layout = state.sidePanelLayoutsRef.current.get(tabId);
+        if (layout && collectSidePanelPanes(layout.root).some((pane) => pane.id === paneId && pane.tool === tool)) state.closePane(tabId, paneId);
+      } });
+    const [hosts, setHosts] = useState(new Map<Tool, HTMLElement>()); const parking = useRef<HTMLDivElement>(null);
+    const register = useCallback((tool: Tool, host: HTMLElement | null) => setHosts((prior) => {
+      if ((prior.get(tool) ?? null) === host) return prior;
+      const next = new Map(prior); if (host) next.set(tool, host); else next.delete(tool); return next;
+    }), []);
+    const focusPane = useCallback((id: string) => latest.current.focusPane(activeTabStore.getActiveTabId(), id), []);
+    const closePane = useCallback((id: string) => { latest.current.closePane(activeTabStore.getActiveTabId(), id); }, []);
+    const resize = useCallback(() => {}, []);
+    const layout = model.tabId ? state.sidePanelLayouts.get(model.tabId) : null;
+    const panes = layout ? collectSidePanelPanes(layout.root) : [];
+    split = () => state.splitPane('workspace-synthetic', `plugin-view:${b.id}`, 'vertical', { paneId: 'second-pane', splitId: 'plugin-split' }, 600);
+    return <><PluginTerminalSidebarLauncher sessionId={selectedSession} />
+      {layout && <SidePanelLayoutTree node={layout.root} layout={layout} paneCount={panes.length} labels={new Map(model.pages.map((page) => [page.tool, page.title]))}
+        onClose={closePane} onFocus={focusPane} onHostChange={register} onResize={resize} separator="#777" accent="#4488cc" closePaneLabel="Close pane" resizeLabel="Resize" />}
+      <div ref={parking} hidden aria-hidden="true" />
+      {model.sessionId && panes.map((pane) => {
+        const page = model.pages.find((item) => item.tool === pane.tool); const target = hosts.get(pane.tool) ?? parking.current;
+        if (!page || !target) return null;
+        return <PersistentSidePanelPortal key={`${pane.id}:${model.sessionId}`} portalKey={`plugin-${pane.id}`} target={target}>
+          <PluginTerminalSidebarPageHost page={page} tabId={model.tabId!} sessionId={model.sessionId} getSession={getSession} adapter={model.contributions}
+            focusOnReveal={layout?.focusedPaneId === pane.id} focused={() => focusPane(pane.id)} unavailable={() => closePane(pane.id)} />
+        </PersistentSidePanelPortal>;
+      })}</>;
+  }
+  const root = createRoot(document.getElementById('root')!); const settle = () => new Promise((resolve) => setTimeout(resolve, 40));
+  try {
+    activeTabStore.setActiveTabId('workspace-synthetic'); sidePanelLiveStore.update({ ...SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT, focusedSessionId: selectedSession });
+    await act(async () => { root.render(<I18nProvider locale="en"><Fixture /></I18nProvider>); await settle(); });
+    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Extension pages"]')!.click(); await settle(); });
+    const firstButton = [...document.querySelectorAll('button')].find((button) => button.textContent?.includes('First page'))!;
+    await act(async () => { firstButton.click(); await settle(); });
+    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 1);
+    assert.ok(document.querySelector('[data-pane-tool] [data-plugin-view-slot="terminal-sidebar"]'));
+    assert.equal(opens.length, 1); assert.deepEqual(opens[0].context, { 'netcatty.surface': 'terminal-sidebar' });
+    await act(async () => { split(); await settle(); });
+    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 2);
+    assert.equal(opens.length, 2);
+    const firstId = opens.find((item) => item.viewId === a.id)!.instanceId!;
+    await act(async () => { for (const fn of focusListeners) fn({ instanceId: firstId }); await settle(); });
+    assert.equal(document.querySelector(`[data-pane-tool="plugin-view:${a.id}"]`)?.getAttribute('data-focused'), 'true');
+    const dialog = document.createElement('div'); dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true');
+    await act(async () => { document.body.append(dialog); await settle(); });
+    assert.ok(opens.every((item) => visible.get(item.instanceId!) === false));
+    focus.length = 0;
+    await act(async () => { dialog.remove(); await settle(); });
+    assert.ok(focus.length > 0); assert.ok(focus.every((id) => id === firstId), 'restoring panes focuses only the host-selected pane');
+    const old = opens.map((item) => item.instanceId!);
+    await act(async () => { selectedSession = 'synthetic-session-b'; sidePanelLiveStore.update({ ...SIDE_PANEL_INACTIVE_LIVE_SNAPSHOT, focusedSessionId: selectedSession });
+      assert.ok(old.every((id) => closes.includes(id)), 'workspace focus cancels old native owners synchronously'); await settle(); });
+    assert.equal(opens.length, 4);
+    assert.notEqual(opens[0].scopeId, opens[2].scopeId);
+    assert.ok(opens.every((item) => JSON.stringify(item.context) === JSON.stringify({ 'netcatty.surface': 'terminal-sidebar' })));
+    await act(async () => { rectX = 260; snapshot = { ...snapshot, plugins: [{ ...snapshot.plugins[0], views: [{ ...a, visible: false }, b] }] }; for (const fn of changed) fn(); await settle(); });
+    assert.equal(document.querySelectorAll('[data-section="terminal-side-panel-pane"]').length, 1);
+    assert.equal(document.querySelector('[data-pane-tool]')?.getAttribute('data-pane-tool'), `plugin-view:${b.id}`);
+    assert.ok(bounds.some((item) => item.x === 260), 'portal relocation updates native geometry');
+    const last = opens.at(-1)!.instanceId!;
+    await act(async () => { activeTabStore.setActiveTabId('vault'); assert.ok(closes.includes(last)); await settle(); });
+    assert.equal(document.querySelector('[data-plugin-terminal-sidebar]'), null);
+    await act(async () => { selectedSession = 'synthetic-local-terminal'; activeTabStore.setActiveTabId(selectedSession); await settle(); });
+    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Extension pages"]')!.click(); await settle(); });
+    const localPage = [...document.querySelectorAll('button')].find((button) => button.textContent?.includes('Second page'))!;
+    await act(async () => { localPage.click(); await settle(); });
+    assert.ok(document.querySelector('[data-plugin-view-slot="terminal-sidebar"]'), 'standalone Local Terminal is a valid navigation owner');
+    assert.deepEqual(opens.at(-1)!.context, { 'netcatty.surface': 'terminal-sidebar' });
+  } finally {
+    await act(async () => { root.unmount(); await settle(); }); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/PluginVaultPages.test.tsx

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JSDOM } from 'jsdom';
+
+test('Vault navigation mounts a real content slot, yields to host dialogs, and withdraws stale pages', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'Element', 'Node', 'MutationObserver', 'CustomEvent', 'Event']) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value: key === 'window' ? dom.window : dom.window[key as keyof Window] });
+  }
+  for (const [key, value] of Object.entries({ getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
+    requestAnimationFrame: dom.window.requestAnimationFrame.bind(dom.window), cancelAnimationFrame: dom.window.cancelAnimationFrame.bind(dom.window), IS_REACT_ACT_ENVIRONMENT: true })) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key)); Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  }
+  dom.window.HTMLElement.prototype.getBoundingClientRect = () => ({ x: 200, y: 100, width: 640, height: 480, top: 100, left: 200, right: 840, bottom: 580, toJSON() {} });
+  const { default: React, act, useState } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { usePluginVaultPages } = await import('../application/state/usePluginVaultPages');
+  const { PluginVaultNavigation, PluginVaultPage } = await import('./plugins/PluginVaultPages');
+  const { activeTabStore } = await import('../application/state/activeTabStore');
+  const { requestOpenPluginView } = await import('../application/state/usePluginViewLifecycle');
+  const { I18nProvider } = await import('../application/i18n/I18nProvider');
+  const page = { id: 'com.example.page.main', title: 'Synthetic page', location: 'vault-page', entry: 'page.html', visible: true };
+  let snapshot = { locale: 'en', plugins: [{ id: 'com.example.page', version: '1.0.0', displayName: 'Synthetic plugin', commands: [], keybindings: [], menus: [], settings: [], views: [page] }] };
+  let changed: (() => void) | undefined;
+  const listeners = new Set<(event: NetcattyPluginViewClosedEvent) => void>();
+  const opens: NetcattyPluginViewOpenRequest[] = [], closes: string[] = [], visibility: boolean[] = [];
+  let defer: ((value: { instanceId: string }) => void) | undefined;
+  let deferOpen = false;
+  let delayLayout = false;
+  const rejectOldLayout: Array<(error: Error) => void> = [];
+  const layoutResult = () => delayLayout ? new Promise<void>((_resolve, reject) => { rejectOldLayout.push(reject); }) : Promise.resolve();
+  Object.assign(dom.window, { netcatty: {
+    async getPluginRuntimeStatus() { return { available: true }; },
+    async getPluginContributions() { return snapshot; },
+    onPluginContributionsChanged(fn: () => void) { changed = fn; return () => { changed = undefined; }; },
+    onPluginViewClosed(fn: (event: NetcattyPluginViewClosedEvent) => void) { listeners.add(fn); return () => { listeners.delete(fn); }; },
+    async openPluginView(payload: NetcattyPluginViewOpenRequest) { opens.push(payload); return deferOpen ? new Promise<{ instanceId: string }>((resolve) => { defer = resolve; }) : { instanceId: payload.instanceId! }; },
+    async closePluginView(id: string) { closes.push(id); }, async setPluginViewBounds() { await layoutResult(); },
+    async setPluginViewVisibility(_id: string, visible: boolean) { visibility.push(visible); await layoutResult(); },
+  } });
+  let selectSection!: (section: 'hosts' | `plugin-vault:${string}`) => void;
+  function Fixture() {
+    const [section, select] = useState<'hosts' | `plugin-vault:${string}`>('hosts'); selectSection = select;
+    const model = usePluginVaultPages({ locale: 'en', section, select });
+    return <><aside><button data-plugin-vault-fallback onClick={() => select('hosts')}>Hosts</button><PluginVaultNavigation model={model} collapsed={false} /></aside>
+      <main data-section="vault-main">{model.selected ? <PluginVaultPage key={model.selected.key} model={model} /> : <p>Built-in hosts</p>}</main></>;
+  }
+  const root = createRoot(document.getElementById('root')!);
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 35));
+  const clickPage = async () => { await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Synthetic page — Synthetic plugin"]')!.click(); await settle(); }); };
+  try {
+    activeTabStore.setActiveTabId('vault');
+    await act(async () => { root.render(<I18nProvider locale="en"><Fixture /></I18nProvider>); await settle(); });
+    assert.equal(opens.length, 0, 'catalog enumeration does not activate the plugin');
+    await clickPage();
+    assert.ok(document.querySelector('[data-section="vault-main"] [data-plugin-view-slot="vault-page"]'));
+    assert.equal(opens.length, 1);
+    assert.deepEqual(opens[0].context, { 'netcatty.surface': 'vault-page' }, 'no Vault/session data accompanies navigation');
+    assert.equal(visibility.at(-1), true);
+    const dialog = document.createElement('div'); dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true');
+    await act(async () => { document.body.append(dialog); await settle(); });
+    assert.equal(visibility.at(-1), false, 'native content yields to host security/settings dialogs');
+    await act(async () => { dialog.remove(); await settle(); });
+    assert.equal(visibility.at(-1), true);
+    await act(async () => { activeTabStore.setActiveTabId('terminal:synthetic'); assert.ok(closes.includes(opens[0].instanceId!)); await settle(); });
+    await act(async () => { activeTabStore.setActiveTabId('vault'); await settle(); });
+    assert.equal(opens.length, 2);
+    await act(async () => { snapshot = { ...snapshot, plugins: [] }; changed?.(); await settle(); });
+    await act(async () => { await settle(); });
+    assert.ok(closes.includes(opens[1].instanceId!));
+    assert.equal(document.querySelector('[data-plugin-vault-page]'), null);
+    assert.equal(document.activeElement?.textContent, 'Hosts');
+    await act(async () => { selectSection('plugin-vault:missing'); await settle(); });
+    assert.match(document.querySelector('main')!.textContent!, /Built-in hosts/);
+    await act(async () => { snapshot = { ...snapshot, plugins: [{ id: 'com.example.page', version: '1.0.0', displayName: 'Synthetic plugin', commands: [], keybindings: [], menus: [], settings: [], views: [page] }] }; changed?.(); await settle(); });
+    deferOpen = true;
+    await act(async () => { requestOpenPluginView({ viewId: page.id }); await settle(); });
+    assert.equal(opens.length, 3);
+    await act(async () => { selectSection('hosts'); await settle(); });
+    assert.ok(closes.includes(opens[2].instanceId!), 'cancel reserved instance before its open response');
+    await act(async () => { defer!({ instanceId: opens[2].instanceId! }); await settle(); });
+    assert.equal(document.querySelector('[data-plugin-vault-page]'), null, 'late open cannot restore withdrawn page');
+    assert.ok(closes.filter((id) => id === opens[2].instanceId).length >= 2, 'late native response is also closed');
+    deferOpen = false;
+    const second = { ...page, id: 'com.example.page.second', title: 'Second page' };
+    await act(async () => { snapshot = { ...snapshot, plugins: [{ ...snapshot.plugins[0], views: [page, second] }] }; changed?.(); await settle(); });
+    delayLayout = true;
+    await clickPage();
+    assert.ok(rejectOldLayout.length >= 2, 'old page has both bounds and visibility IPC in flight');
+    await act(async () => { selectSection('hosts'); await settle(); });
+    delayLayout = false;
+    await act(async () => { document.querySelector<HTMLButtonElement>('button[aria-label="Second page — Synthetic plugin"]')!.click(); await settle(); });
+    await act(async () => { for (const reject of rejectOldLayout) reject(new Error('old page layout failed')); await settle(); });
+    assert.equal(document.querySelector('[data-plugin-vault-page]')?.getAttribute('aria-label'), 'Second page', 'old bounds/visibility failures cannot withdraw the newly selected page');
+  } finally {
+    await act(async () => { root.unmount(); await settle(); }); dom.window.close();
+    for (const [key, descriptor] of previous) { if (descriptor) Object.defineProperty(globalThis, key, descriptor); else Reflect.deleteProperty(globalThis, key); }
+  }
+});

components/SettingsPage.tsx

@@ -1,3 +1,5 @@
+import { useAppThemeStyle } from "../application/app/useAppThemeStyle";
+import { selectPluginThemeTokens } from "../application/state/pluginContributionEnvironment";
 /**
  * Settings Page - Standalone settings window content
  * This component is rendered in a separate Electron window
@@ -322,6 +324,9 @@ const SettingsSyncTabWithVault: React.FC<{ onSettingsApplied?: () => void }> = (
 };
 
 const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLockState }> = ({ settings, appLock }) => {
+    // This publisher also runs in detached Settings: never broadcast a local preview.
+    const committedAppThemeStyle = useAppThemeStyle(false);
+    const pluginThemeTokens = useMemo(() => selectPluginThemeTokens(committedAppThemeStyle as Record<string, unknown>), [committedAppThemeStyle]);
     const { t } = useI18n();
     const { request, clearFocus, openSearch } = useSettingsFocus();
     const { notifyRendererReady, closeSettingsWindow, onWindowCommandCloseRequested } = useWindowControls();
@@ -715,7 +720,7 @@ const SettingsPageContent: React.FC<{ settings: SettingsState; appLock?: AppLock
             </Tabs>
         </div>
         <ExternalMcpApprovalsHost />
-        <PluginContributionHost locale={settings.uiLanguage} theme={settings.resolvedTheme} />
+        <PluginContributionHost locale={settings.uiLanguage} theme={settings.resolvedTheme} themeTokens={pluginThemeTokens} />
         </>
     );
 };

components/TerminalLayer.tsx

@@ -123,6 +123,7 @@ import {
 import { classifyDistroId, hostRestrictsExtraSshChannels, shouldProbeSessionCwd } from '../domain/host';
 import {
   collectSidePanelPanes,
+  isPluginSidePanelTool,
   sidePanelLayoutHasTool,
   type SidePanelLayout,
   type SidePanelSplitDirection,
@@ -1933,6 +1934,16 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
     resizeSidePanelSplitForTab(tabId, splitId, sizes);
   }, [resizeSidePanelSplitForTab]);
 
+  const handleWithdrawPluginSidebarPane = useCallback((tabId: string, paneId: string, expectedTool: SidePanelTab) => {
+    if (!isPluginSidePanelTool(expectedTool)) return;
+    const layout = sidePanelLayoutsRef.current.get(tabId);
+    const pane = layout && collectSidePanelPanes(layout.root).find((item) => item.id === paneId);
+    if (pane?.tool !== expectedTool) return;
+    setMagnifiedPane((current) => current?.tabId === tabId && current.target.kind === 'side-panel'
+      && current.target.paneId === paneId ? null : current);
+    closeSidePanelPaneForTab(tabId, paneId);
+  }, [closeSidePanelPaneForTab, sidePanelLayoutsRef]);
+
   // Toggle SFTP from activity bar header
   const handleToggleSftpFromBar = useCallback(() => {
     handleSwitchSidePanelTab('sftp');
@@ -2617,6 +2628,9 @@ const TerminalLayerInner: React.FC<TerminalLayerProps> = ({
     handleOpenAI,
     handleOpenSystem,
     handleOpenNotes,
+    getActiveTerminalSessionId,
+    handleSwitchSidePanelTab,
+    handleWithdrawPluginSidebarPane,
     handleOpenBrowser,
     handleFocusSidePanelPane,
     handleMagnifySidePanelPane,

components/VaultView.tsx

@@ -161,6 +161,7 @@ import { VaultViewLayout } from "./vault/VaultViewLayout";
 import { useVaultHostCollections } from "./vault/useVaultHostCollections";
 import { useVaultImportHandlers } from "../application/state/useVaultImportHandlers";
 import { useVaultGroupDragHandlers } from "./vault/useVaultGroupDragHandlers";
+import { usePluginVaultPages } from "../application/state/usePluginVaultPages";
 
 const LazyProtocolSelectDialog = lazy(() => import("./ProtocolSelectDialog"));
 const LazyConnectionLogsManager = lazy(() => import("./ConnectionLogsManager"));
@@ -178,7 +179,8 @@ export type VaultSection =
   | "notes"
   | "port"
   | "knownhosts"
-  | "logs";
+  | "logs"
+  | `plugin-vault:${string}`;
 
 const haveSameHostOrderResult = (previous: Host[], next: Host[]) => {
   if (previous.length !== next.length) return false;
@@ -365,11 +367,12 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
   onVaultFocusRequestHandled,
   terminalSettings,
 }) => {
-  const { t } = useI18n();
+  const { t, locale } = useI18n();
   const rootRef = useRef<HTMLDivElement>(null);
   const hostsRef = useRef(hosts);
   hostsRef.current = hosts;
   const [currentSection, setCurrentSection] = useState<VaultSection>("hosts");
+  const pluginVault = usePluginVaultPages({ locale, section: currentSection, select: setCurrentSection });
   const [search, setSearch] = useState("");
   const [selectedGroupPath, setSelectedGroupPath] = useState<string | null>(
     null,
@@ -1522,6 +1525,7 @@ const VaultViewInner: React.FC<VaultViewProps> = ({
           ContextMenuTrigger,
           Copy,
           currentSection,
+          pluginVault,
           customGroups,
           deleteGroupPath,
           deleteGroupPaths,

components/plugins/PluginTerminalSidebar.tsx

@@ -0,0 +1,56 @@
+import { useMemo } from 'react';
+import { Blocks } from 'lucide-react';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { activeTabStore } from '../../application/state/activeTabStore';
+import { subscribeSidePanelLiveSnapshot } from '../../application/state/sidePanelLiveStore';
+import { useEmbeddedPluginView } from '../../application/state/useEmbeddedPluginView';
+import { usePluginContributions } from '../../application/state/usePluginContributions';
+import { collectPluginTerminalSidebarPages, PLUGIN_TERMINAL_SIDEBAR_CONTEXT, requestOpenPluginTerminalSidebar,
+  type PluginTerminalSidebarPage } from '../../application/state/usePluginTerminalSidebar';
+import { PluginContributionIcon } from './PluginContributionIcon';
+import { Button } from '../ui/button';
+import { Popover, PopoverClose, PopoverContent, PopoverTrigger } from '../ui/popover';
+
+export function PluginTerminalSidebarLauncher({ sessionId }: { sessionId: string }) {
+  const { locale, t } = useI18n();
+  const contributions = usePluginContributions({ locale, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT });
+  const pages = collectPluginTerminalSidebarPages(contributions.snapshot.plugins);
+  if (!pages.length) return null;
+  return <Popover><PopoverTrigger asChild><Button variant="ghost" size="icon" className="h-6 w-6" aria-label={t('plugins.sidebar.extensions')}><Blocks size={14} /></Button></PopoverTrigger>
+    <PopoverContent align="end" className="max-h-80 w-64 overflow-y-auto p-1">
+      <p className="px-2 py-1 text-xs text-muted-foreground">{t('plugins.sidebar.extensions')}</p>
+      {pages.map((page) => <PopoverClose asChild key={page.tool}><button type="button" className="flex w-full items-center gap-2 rounded px-2 py-2 text-left text-sm hover:bg-accent"
+        onClick={() => requestOpenPluginTerminalSidebar(page.viewId, sessionId)}>
+        <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} /><span className="min-w-0"><span className="block truncate">{page.title}</span><span className="block truncate text-xs text-muted-foreground">{page.pluginName}</span></span>
+      </button></PopoverClose>)}
+    </PopoverContent></Popover>;
+}
+
+export function PluginTerminalSidebarPageHost({ page, tabId, sessionId, adapter, getSession, unavailable, focused, focusOnReveal }: {
+  page: PluginTerminalSidebarPage;
+  tabId: string;
+  sessionId: string;
+  adapter: ReturnType<typeof usePluginContributions>;
+  getSession(): string | null;
+  unavailable(): void;
+  focused(): void;
+  focusOnReveal: boolean;
+}) {
+  const { t } = useI18n();
+  const subscribeHidden = useMemo(() => (hide: () => void) => {
+    const stopTab = activeTabStore.subscribeSync((id) => { if (id !== tabId) hide(); });
+    const stopSession = subscribeSidePanelLiveSnapshot(true, () => { if (getSession() !== sessionId) hide(); });
+    return () => { stopTab(); stopSession(); };
+  }, [getSession, sessionId, tabId]);
+  const { mountRef, loading } = useEmbeddedPluginView({ viewId: page.viewId, version: page.version,
+    slot: `terminal-sidebar:${tabId}:${sessionId}`, active: true, context: PLUGIN_TERMINAL_SIDEBAR_CONTEXT,
+    adapter, subscribeHidden, unavailable, focused, focusOnReveal });
+  // The native page never receives these internal ownership IDs. Its state is
+  // scoped by the host; this does not authorize reading the terminal session.
+  return <section className="flex h-full min-h-0 flex-col overflow-hidden" aria-label={`${page.title} — ${page.pluginName}`} data-plugin-terminal-sidebar>
+    <header className="flex h-7 shrink-0 items-center gap-2 border-b border-border px-2 text-xs"><PluginContributionIcon pluginId={page.pluginId} icon={page.icon} size={12} /><span className="truncate">{page.title} · {page.pluginName}</span></header>
+    <div ref={mountRef} className="relative min-h-0 flex-1 overflow-hidden" data-plugin-view-slot="terminal-sidebar">
+      {loading && <p role="status" className="p-3 text-xs text-muted-foreground">{t('plugins.sidebar.loading')}</p>}
+    </div>
+  </section>;
+}

components/plugins/PluginVaultPages.tsx

@@ -0,0 +1,44 @@
+import { activeTabStore } from '../../application/state/activeTabStore';
+import { useI18n } from '../../application/i18n/I18nProvider';
+import { useEmbeddedPluginView } from '../../application/state/useEmbeddedPluginView';
+import type { usePluginVaultPages } from '../../application/state/usePluginVaultPages';
+import { PluginContributionIcon } from './PluginContributionIcon';
+import { Button } from '../ui/button';
+
+type VaultPages = ReturnType<typeof usePluginVaultPages>;
+const subscribeHidden = (hide: () => void) => activeTabStore.subscribeSync((id) => { if (id !== 'vault') hide(); });
+
+export function PluginVaultNavigation({ model, collapsed }: { model: VaultPages; collapsed: boolean }) {
+  const { t } = useI18n();
+  if (!model.pages.length) return null;
+  return <div role="group" aria-label={t('plugins.vault.extensions')} className="mt-3 space-y-1 border-t border-border/50 pt-3">
+    {!collapsed && <p className="px-2 text-xs text-muted-foreground">{t('plugins.vault.extensions')}</p>}
+    {model.pages.map((page) => <Button key={page.key} type="button"
+      variant={model.selected?.key === page.key ? 'secondary' : 'ghost'}
+      className={`w-full ${collapsed ? 'justify-center px-0' : 'justify-start gap-3'}`}
+      title={`${page.title} — ${page.pluginName}`}
+      aria-label={`${page.title} — ${page.pluginName}`}
+      aria-current={model.selected?.key === page.key ? 'page' : undefined}
+      onClick={() => model.select(page.key)}>
+      <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} className="shrink-0" />
+      {!collapsed && <span className="truncate">{page.title}</span>}
+    </Button>)}
+  </div>;
+}
+
+export function PluginVaultPage({ model }: { model: VaultPages }) {
+  const { t } = useI18n();
+  const page = model.selected!;
+  const { mountRef, loading } = useEmbeddedPluginView({ viewId: page.viewId, version: page.version, slot: 'vault-page',
+    active: model.active, context: model.context, adapter: model.contributions, subscribeHidden, unavailable: model.fallback });
+  return <section className="flex min-h-0 flex-1 flex-col" aria-label={page.title} data-plugin-vault-page={page.key}>
+    <header className="app-no-drag flex h-12 shrink-0 items-center justify-between gap-3 border-b border-border px-4">
+      <div className="min-w-0"><h2 className="truncate text-sm font-medium">{page.title}</h2>
+        <p className="truncate text-xs text-muted-foreground">{page.pluginName} · {page.version}</p></div>
+      <Button variant="ghost" onClick={model.fallback}>{t('plugins.vault.back')}</Button>
+    </header>
+    <div ref={mountRef} className="relative min-h-0 flex-1 overflow-hidden" data-plugin-view-slot="vault-page">
+      {loading && <p role="status" className="p-4 text-sm text-muted-foreground">{t('plugins.vault.loading')}</p>}
+    </div>
+  </section>;
+}

components/settings/tabs/PluginLogSettings.test.tsx

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JSDOM } from 'jsdom';
+
+test('local logging controls default off, disclose verbose risk, and call host-only management actions', async () => {
+  const dom = new JSDOM('<!doctype html><html><body><div id="root"></div></body></html>', { pretendToBeVisual: true, url: 'http://localhost' });
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  const install = (key: string, value: unknown) => {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  };
+  for (const key of ['window', 'document', 'navigator', 'HTMLElement', 'HTMLInputElement', 'Element', 'Node', 'Event', 'MouseEvent', 'MutationObserver', 'NodeFilter', 'DocumentFragment', 'CustomEvent', 'getComputedStyle']) {
+    install(key, key === 'window' ? dom.window : dom.window[key as keyof typeof dom.window]);
+  }
+  install('IS_REACT_ACT_ENVIRONMENT', true);
+  const { default: React, act } = await import('react');
+  const { createRoot } = await import('react-dom/client');
+  const { I18nProvider } = await import('../../../application/i18n/I18nProvider');
+  const { PluginLogSettings } = await import('./PluginLogSettings');
+  const root = createRoot(document.getElementById('root')!);
+  let status = { saveToDisk: false, verbose: false, droppedRecords: 2, writeErrors: 0, pendingBytes: 0, maxBytes: 3145728, retentionDays: 7 };
+  const settings: Array<{ saveToDisk: boolean; verbose: boolean }> = [];
+  const actions: string[] = [];
+  let failConfigure = false;
+  Object.assign(dom.window, { netcatty: {
+    async getPluginLogStatus() { return status; },
+    async configurePluginLogs(value: { saveToDisk: boolean; verbose: boolean }) { settings.push(value); status = { ...status, ...value }; if (failConfigure) throw new Error('synthetic preferences write failed'); return status; },
+    async openPluginLogFolder() { actions.push('open'); return status; },
+    async exportPluginLogs() { actions.push('export'); return status; },
+    async clearPluginLogs() { actions.push('clear-confirmed-by-native-host'); return status; },
+  } });
+  const button = (label: string) => [...document.querySelectorAll<HTMLButtonElement>('button')].find((item) => item.textContent === label)!;
+  const checkboxes = () => [...document.querySelectorAll<HTMLInputElement>('input[type="checkbox"]')];
+  try {
+    await act(async () => root.render(<React.StrictMode><I18nProvider locale="en"><PluginLogSettings /></I18nProvider></React.StrictMode>));
+    assert.equal(checkboxes()[0].checked, false);
+    assert.equal(checkboxes()[0].disabled, false, 'StrictMode initialization completes');
+    assert.equal(checkboxes()[1].disabled, true);
+    assert.match(document.body.textContent!, /no upload or sync/);
+    assert.match(document.body.textContent!, /Dropped: 2/);
+    await act(async () => checkboxes()[0].click());
+    assert.deepEqual(settings, [{ saveToDisk: true, verbose: false }]);
+    await act(async () => checkboxes()[1].click());
+    assert.equal(settings.length, 1, 'opening disclosure does not enable verbose logs');
+    assert.match(document.body.textContent!, /cannot make arbitrary text safe/);
+    await act(async () => button('Enable temporarily').click());
+    assert.deepEqual(settings[1], { saveToDisk: true, verbose: true });
+    await act(async () => button('Open folder').click());
+    await act(async () => button('Export').click());
+    await act(async () => button('Clear logs…').click());
+    assert.deepEqual(actions, ['open', 'export', 'clear-confirmed-by-native-host']);
+    failConfigure = true;
+    await act(async () => checkboxes()[0].click());
+    assert.deepEqual(settings.at(-1), { saveToDisk: false, verbose: false });
+    assert.equal(checkboxes()[0].checked, false, 'failed configuration refreshes actual OFF host state');
+    assert.equal(checkboxes()[1].checked, false);
+    assert.match(document.querySelector('[role=alert]')!.textContent!, /synthetic preferences write failed/);
+  } finally {
+    await act(async () => root.unmount());
+    dom.window.close();
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginLogSettings.tsx

@@ -0,0 +1,31 @@
+import React, { useState } from 'react';
+import { usePluginLogs } from '../../../application/state/usePluginLogs';
+import { useI18n } from '../../../application/i18n/I18nProvider';
+import { Button } from '../../ui/button';
+import { ConfirmDialog } from '../../ui/confirm-dialog';
+
+/** Embed in the existing plugin settings surface, without a new marketplace tab. */
+export function PluginLogSettings() {
+  const { resolvedLocale } = useI18n();
+  const zh = resolvedLocale.startsWith('zh');
+  const { status, error, busy, run } = usePluginLogs();
+  const [confirmVerbose, setConfirmVerbose] = useState(false);
+  const disclosure = zh
+    ? '插件编写的日志文字可能包含敏感数据。截断和字段过滤不能保证任意文字安全。只为排查问题临时开启，导出前请检查。重启应用后自动关闭详细日志。'
+    : 'Plugin-authored text may contain sensitive data. Truncation and field filtering cannot make arbitrary text safe. Enable temporarily for troubleshooting and review files before sharing. Verbose diagnostics turn off after app restart.';
+  return <section data-host-security-surface="" className="space-y-3 rounded-lg border border-border/70 p-4 text-sm" aria-label={zh ? '本地插件日志' : 'Local plugin logs'}>
+    <h4 className="font-medium">{zh ? '本地插件日志' : 'Local plugin logs'}</h4>
+    <p className="text-xs text-muted-foreground">{zh ? '默认不保存。仅保存在此设备，不上传或同步。权限面板中的有限安全历史独立保留。' : 'Saving is off by default. Files stay on this device with no upload or sync. The bounded security history in plugin permissions is separate.'}</p>
+    {error && <p role="alert" className="text-xs text-destructive">{error}</p>}
+    <label className="flex items-center gap-2"><input type="checkbox" checked={status?.saveToDisk ?? false} disabled={busy || !status} onChange={(event) => void run('configure', { saveToDisk: event.target.checked, verbose: false })} />{zh ? '将宿主审计日志保存到本地' : 'Save host audit logs locally'}</label>
+    <label className="flex items-center gap-2"><input type="checkbox" checked={status?.verbose ?? false} disabled={busy || !status?.saveToDisk} onChange={(event) => event.target.checked ? setConfirmVerbose(true) : void run('configure', { saveToDisk: true, verbose: false })} />{zh ? '包含插件详细诊断文字（可能含敏感数据）' : 'Include verbose plugin text (may contain sensitive data)'}</label>
+    {status && <p className="text-xs text-muted-foreground">{zh ? `最多 ${status.maxBytes / 1048576} MiB，最长保留 ${status.retentionDays} 天。丢弃 ${status.droppedRecords} 条，写入错误 ${status.writeErrors} 次。` : `Up to ${status.maxBytes / 1048576} MiB, up to ${status.retentionDays} days. Dropped: ${status.droppedRecords}. Write errors: ${status.writeErrors}.`}</p>}
+    <div className="flex flex-wrap gap-2">
+      <Button variant="outline" size="sm" disabled={busy || !status} onClick={() => void run('open')}>{zh ? '打开文件夹' : 'Open folder'}</Button>
+      <Button variant="outline" size="sm" disabled={busy || !status} onClick={() => void run('export')}>{zh ? '导出' : 'Export'}</Button>
+      <Button variant="ghost" size="sm" disabled={busy || !status} onClick={() => void run('clear')}>{zh ? '清除日志…' : 'Clear logs…'}</Button>
+      <Button variant="ghost" size="sm" disabled={busy} onClick={() => void run('status')}>{zh ? '刷新' : 'Refresh'}</Button>
+    </div>
+    <ConfirmDialog open={confirmVerbose} title={zh ? '开启插件详细诊断？' : 'Enable verbose plugin diagnostics?'} message={disclosure} confirmLabel={zh ? '临时开启' : 'Enable temporarily'} onOpenChange={setConfirmVerbose} onConfirm={() => { setConfirmVerbose(false); void run('configure', { saveToDisk: true, verbose: true }); }} />
+  </section>;
+}

components/settings/tabs/PluginPackageManager.tsx

@@ -28,7 +28,7 @@ export function PluginPackageDetails({ plugin }: { plugin: NetcattyInstalledPlug
       <dt className="text-muted-foreground">API</dt><dd>{manifest.engines.api}</dd>
       <dt className="text-muted-foreground">SHA-256</dt><dd className="break-all font-mono">{plugin.archiveSha256 ?? '-'}</dd>
     </dl>
-    <p className={!policy.browserOnly ? 'text-destructive' : 'text-muted-foreground'}>{t(`settings.plugins.manager.${runtimeLabel}`)}</p>
+    <p className={!policy.browserOnly && !policy.dataOnly ? 'text-destructive' : 'text-muted-foreground'}>{policy.dataOnly ? t('settings.plugins.manager.dataTheme') : t(`settings.plugins.manager.${runtimeLabel}`)}</p>
     <div className="space-y-2">
       <h4 className="font-medium">{t('settings.plugins.manager.permissions')}</h4>
       <p className="text-xs text-muted-foreground">{t('settings.plugins.manager.permissionNote')}</p>

components/settings/tabs/PluginPermissionPanel.tsx

@@ -56,7 +56,7 @@ export function PluginPermissionPanel({ pluginId, onChanged }: {
       pending.current = false; setBusy(false);
     }
   };
-  return <section className="space-y-3 border-t border-border/60 pt-4 text-sm" aria-label={t('settings.plugins.permissions.title')}>
+  return <section data-host-security-surface="" className="space-y-3 border-t border-border/60 pt-4 text-sm" aria-label={t('settings.plugins.permissions.title')}>
     <div className="flex flex-wrap items-center justify-between gap-2">
       <h4 className="font-medium">{t('settings.plugins.permissions.title')}</h4>
       <Button variant="ghost" size="sm" disabled={busy} onClick={() => void refresh()}>{t('settings.plugins.permissions.refresh')}</Button>

components/settings/tabs/PluginThemePicker.test.tsx

@@ -0,0 +1,230 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { JSDOM } from "jsdom";
+import type {
+  ThemePackCatalog,
+  ThemePackEntry,
+} from "@netcatty/plugin-contract";
+
+test("host theme picker previews without persistence, applies, restores, and cancels stale owners safely", async () => {
+  const dom = new JSDOM(
+    '<!doctype html><html><body><div id="root"></div></body></html>',
+    { url: "http://localhost", pretendToBeVisual: true },
+  );
+  const previous = new Map<string, PropertyDescriptor | undefined>();
+  for (const key of [
+    "window",
+    "document",
+    "navigator",
+    "HTMLElement",
+    "Element",
+    "Node",
+    "Event",
+    "MouseEvent",
+    "IS_REACT_ACT_ENVIRONMENT",
+  ]) {
+    previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+    Object.defineProperty(globalThis, key, {
+      configurable: true,
+      writable: true,
+      value:
+        key === "IS_REACT_ACT_ENVIRONMENT"
+          ? true
+          : key === "window"
+            ? dom.window
+            : dom.window[key as keyof typeof dom.window],
+    });
+  }
+  const { default: React, act, useLayoutEffect } = await import("react");
+  const { createRoot } = await import("react-dom/client");
+  const { I18nProvider } = await import(
+    "../../../application/i18n/I18nProvider"
+  );
+  const { PluginThemePicker } = await import("./PluginThemePicker");
+  const { pluginThemeRegistry: registry } = await import(
+    "../../../infrastructure/config/pluginThemeRegistry"
+  );
+  const { usePluginThemeRevision } = await import(
+    "../../../application/state/usePluginThemeRuntime"
+  );
+  const { getUiThemeById } = await import(
+    "../../../infrastructure/config/uiThemes"
+  );
+  const { applyThemeTokens } = await import(
+    "../../../application/state/settingsStateDefaults"
+  );
+  const entry: ThemePackEntry = {
+    ref: {
+      pluginId: "com.example.theme",
+      themeId: "com.example.theme.forest",
+      version: "1.0.0",
+      digest: "a".repeat(64),
+      variant: "light",
+    },
+    label: "Forest",
+    pluginName: "Synthetic Theme",
+    dataOnly: true,
+    palette: { formatVersion: 1, base: "light", colors: { accent: "#166534" } },
+  };
+  let writes = 0,
+    restores = 0;
+  let catalog: ThemePackCatalog = {
+    selection: {
+      formatVersion: 1,
+      revision: registry.getCatalog().selection.revision + 1,
+      light: null,
+      dark: null,
+    },
+    entries: [entry],
+    diagnostics: [],
+  };
+  registry.setCatalog(catalog);
+  Object.assign(dom.window, {
+    netcatty: {
+      async applyPluginTheme(request: {
+        expectedRevision: number;
+        choice: ThemePackCatalog["selection"]["light"];
+      }) {
+        assert.equal(request.expectedRevision, catalog.selection.revision);
+        writes++;
+        catalog = {
+          ...catalog,
+          selection: {
+            ...catalog.selection,
+            revision: catalog.selection.revision + 1,
+            light: request.choice,
+          },
+        };
+        registry.setCatalog(catalog);
+        return catalog;
+      },
+    },
+  });
+  function Fixture() {
+    const revision = usePluginThemeRevision();
+    useLayoutEffect(
+      () =>
+        applyThemeTokens(
+          "light",
+          "light",
+          getUiThemeById("light", "snow").tokens,
+          "theme",
+          "",
+        ),
+      [revision],
+    );
+    return (
+      <I18nProvider locale="en">
+        <PluginThemePicker mode="light" onRestore={() => restores++} />
+      </I18nProvider>
+    );
+  }
+  const root = createRoot(document.getElementById("root")!);
+  const button = (label: string) =>
+    [...document.querySelectorAll<HTMLButtonElement>("button")].find(
+      (b) => b.textContent === label,
+    )!;
+  try {
+    await act(async () => root.render(<Fixture />));
+    const original =
+      document.documentElement.style.getPropertyValue("--primary");
+    await act(async () => {
+      const select = document.querySelector("select")!;
+      select.value = `${entry.ref.pluginId}/${entry.ref.themeId}`;
+      select.dispatchEvent(new Event("change", { bubbles: true }));
+    });
+    await act(async () => button("Preview").click());
+    assert.equal(writes, 0);
+    assert.equal(
+      getUiThemeById("light", "snow", false).tokens.primary,
+      original,
+      "local preview does not enter the global plugin view environment",
+    );
+    assert.notEqual(
+      document.documentElement.style.getPropertyValue("--primary"),
+      original,
+    );
+    assert.ok(
+      document.documentElement.hasAttribute("data-plugin-theme-active"),
+    );
+    assert.ok(
+      document.documentElement.style.getPropertyValue(
+        "--host-security-primary",
+      ),
+    );
+    await act(async () => button("Cancel preview").click());
+    assert.equal(
+      document.documentElement.style.getPropertyValue("--primary"),
+      original,
+    );
+    assert.equal(writes, 0);
+    await act(async () => {
+      button("Preview").click();
+      button("Apply").click();
+    });
+    assert.equal(writes, 1);
+    assert.equal(catalog.selection.light?.ref.themeId, entry.ref.themeId);
+    await act(async () => button("Restore default").click());
+    assert.equal(writes, 2);
+    assert.equal(restores, 1);
+    assert.equal(catalog.selection.light, null);
+    await act(async () => {
+      registry.startPreview("old-owner", entry);
+      registry.startPreview("new-owner", entry);
+      registry.cancelPreview("old-owner");
+    });
+    assert.notEqual(
+      document.documentElement.style.getPropertyValue("--primary"),
+      original,
+    );
+    await act(async () =>
+      registry.setCatalog({
+        ...catalog,
+        selection: {
+          ...catalog.selection,
+          revision: catalog.selection.revision + 1,
+        },
+        entries: [],
+      }),
+    );
+    assert.equal(
+      document.documentElement.style.getPropertyValue("--primary"),
+      original,
+      "package withdrawal cancels previews",
+    );
+    await act(async () =>
+      registry.setCatalog({
+        ...catalog,
+        selection: {
+          ...catalog.selection,
+          revision: catalog.selection.revision + 2,
+          light: { ref: entry.ref },
+        },
+        entries: [],
+      }),
+    );
+    assert.equal(getUiThemeById("light", "snow").id, "host-plugin-fallback");
+    await act(async () => registry.setHighContrast(true));
+    assert.equal(getUiThemeById("light", "snow").id, "host-high-contrast");
+  } finally {
+    await act(async () => {
+      root.unmount();
+      registry.setHighContrast(false);
+      registry.setCatalog({
+        ...catalog,
+        selection: {
+          formatVersion: 1,
+          revision: registry.getCatalog().selection.revision + 1,
+          light: null,
+          dark: null,
+        },
+        entries: [],
+      });
+    });
+    dom.window.close();
+    for (const [key, descriptor] of previous) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else Reflect.deleteProperty(globalThis, key);
+    }
+  }
+});

components/settings/tabs/PluginThemePicker.tsx

@@ -0,0 +1,166 @@
+import { useEffect, useId, useState } from "react";
+import { useI18n } from "../../../application/i18n/I18nProvider";
+import {
+  applyPluginThemeSelection,
+  usePluginThemeRevision,
+} from "../../../application/state/usePluginThemeRuntime";
+import { pluginThemeRegistry } from "../../../infrastructure/config/pluginThemeRegistry";
+import { Button } from "../../ui/button";
+
+export function PluginThemePicker({
+  mode,
+  onRestore,
+}: {
+  mode: "light" | "dark";
+  onRestore: () => void;
+}) {
+  const { t } = useI18n();
+  usePluginThemeRevision();
+  const owner = useId();
+  const [selected, setSelected] = useState(""),
+    [pending, setPending] = useState(false),
+    [error, setError] = useState("");
+  const catalog = pluginThemeRegistry.getCatalog();
+  const entries = catalog.entries.filter((e) => e.palette.base === mode);
+  const applied = catalog.selection[mode];
+  const appliedAvailable =
+    applied &&
+    entries.some(
+      (e) =>
+        e.ref.pluginId === applied.ref.pluginId &&
+        e.ref.themeId === applied.ref.themeId &&
+        e.ref.version === applied.ref.version &&
+        e.ref.digest === applied.ref.digest,
+    );
+  const entry = entries.find(
+    (e) => `${e.ref.pluginId}/${e.ref.themeId}` === selected,
+  );
+  useEffect(
+    () => () => pluginThemeRegistry.cancelPreview(owner),
+    [owner, mode],
+  );
+  async function apply(restore = false) {
+    if (pending || (!restore && !entry)) return;
+    setPending(true);
+    setError("");
+    try {
+      await applyPluginThemeSelection(
+        mode,
+        restore ? null : { ref: entry!.ref },
+      );
+      pluginThemeRegistry.cancelPreview(owner);
+      if (restore) {
+        setSelected("");
+        onRestore();
+      }
+    } catch (e) {
+      setError(
+        e instanceof Error ? e.message : t("settings.plugins.themes.failed"),
+      );
+    } finally {
+      setPending(false);
+    }
+  }
+  return (
+    <section
+      className="space-y-3 py-3"
+      aria-label={t("settings.plugins.themes.title")}
+    >
+      <div>
+        <h4 className="text-sm font-medium">
+          {t("settings.plugins.themes.title")}
+        </h4>
+        <p className="text-xs text-muted-foreground">
+          {t("settings.plugins.themes.description")}
+        </p>
+      </div>
+      {entries.length === 0 ? (
+        <p className="text-xs text-muted-foreground">
+          {t("settings.plugins.themes.empty")}
+        </p>
+      ) : (
+        <select
+          className="h-9 w-full rounded-md border border-input bg-background px-3 text-sm"
+          aria-label={t("settings.plugins.themes.choose")}
+          value={entry ? selected : ""}
+          disabled={pending}
+          onChange={(e) => {
+            pluginThemeRegistry.cancelPreview(owner);
+            setSelected(e.target.value);
+            setError("");
+          }}
+        >
+          <option value="">{t("settings.plugins.themes.choose")}</option>
+          {entries.map((e) => (
+            <option
+              key={`${e.ref.pluginId}/${e.ref.themeId}`}
+              value={`${e.ref.pluginId}/${e.ref.themeId}`}
+            >
+              {e.label} — {e.pluginName} {e.ref.version}
+            </option>
+          ))}
+        </select>
+      )}
+      {catalog.selection[mode] && (
+        <p className="text-xs text-muted-foreground">
+          {t(
+            appliedAvailable
+              ? "settings.plugins.themes.applied"
+              : "settings.plugins.themes.unavailable",
+          )}
+          : {catalog.selection[mode]!.ref.themeId} ·{" "}
+          {catalog.selection[mode]!.ref.version}
+        </p>
+      )}
+      <div className="flex flex-wrap gap-2">
+        <Button
+          size="sm"
+          variant="outline"
+          disabled={!entry || pending}
+          onClick={() => {
+            if (entry) pluginThemeRegistry.startPreview(owner, entry);
+          }}
+        >
+          {t("settings.plugins.themes.preview")}
+        </Button>
+        <Button
+          size="sm"
+          disabled={!entry || pending}
+          onClick={() => {
+            void apply();
+          }}
+        >
+          {t("settings.plugins.themes.apply")}
+        </Button>
+        <Button
+          size="sm"
+          variant="ghost"
+          disabled={pending}
+          onClick={() => pluginThemeRegistry.cancelPreview(owner)}
+        >
+          {t("settings.plugins.themes.cancel")}
+        </Button>
+        <Button
+          size="sm"
+          variant="outline"
+          disabled={pending}
+          onClick={() => {
+            void apply(true);
+          }}
+        >
+          {t("settings.plugins.themes.restore")}
+        </Button>
+      </div>
+      {catalog.diagnostics.length > 0 && (
+        <p className="text-xs text-muted-foreground">
+          {t("settings.plugins.themes.invalid")}
+        </p>
+      )}
+      {error && (
+        <p role="alert" className="text-xs text-destructive">
+          {error}
+        </p>
+      )}
+    </section>
+  );
+}

components/settings/tabs/SettingsAppearanceTab.tsx

@@ -1,3 +1,6 @@
+import { PluginThemePicker } from './PluginThemePicker';
+import { applyPluginThemeSelection, usePluginThemeRevision } from '../../../application/state/usePluginThemeRuntime';
+import { pluginThemeRegistry } from '../../../infrastructure/config/pluginThemeRegistry';
 import React, { memo, useCallback, useMemo, useState } from "react";
 import { applyCustomCssToDocument } from "../../../lib/customCss";
 import { DebouncedTextarea } from "../DebouncedTextarea";
@@ -70,6 +73,8 @@ function SettingsAppearanceTab(props: {
   setAppIconVariant: (variant: AppIconVariant) => void;
 }) {
   const { t } = useI18n();
+  usePluginThemeRevision();
+  const [pluginThemeError, setPluginThemeError] = useState('');
   const availableUIFonts = useAvailableUIFonts();
   // Note code fonts come from the monospace-only store (fontStore); the note
   // body font follows the UI font setting instead.
@@ -231,8 +236,12 @@ function SettingsAppearanceTab(props: {
   );
 
   const visibleUiThemes = resolvedTheme === "dark" ? DARK_UI_THEMES : LIGHT_UI_THEMES;
-  const visibleUiThemeId = resolvedTheme === "dark" ? darkUiThemeId : lightUiThemeId;
-  const setVisibleUiThemeId = resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId;
+  const visibleUiThemeId = pluginThemeRegistry.isActive(resolvedTheme) ? "" : resolvedTheme === "dark" ? darkUiThemeId : lightUiThemeId;
+  const setVisibleUiThemeId = (id: string) => {
+    void applyPluginThemeSelection(resolvedTheme, null).then(() => {
+      (resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId)(id);setPluginThemeError('');
+    }).catch((error: unknown) => setPluginThemeError(error instanceof Error ? error.message : t('settings.plugins.themes.failed')));
+  };
 
   return (
     <SettingsTabContent value="appearance">
@@ -339,6 +348,8 @@ function SettingsAppearanceTab(props: {
             {renderThemeSwatches(visibleUiThemes, visibleUiThemeId, setVisibleUiThemeId)}
           </div>
         </SettingsAnchor>
+        <PluginThemePicker mode={resolvedTheme} onRestore={() => (resolvedTheme === "dark" ? setDarkUiThemeId : setLightUiThemeId)(resolvedTheme === "dark" ? "midnight" : "snow")} />
+        {pluginThemeError && <p role="alert" className="text-xs text-destructive">{pluginThemeError}</p>}
         <SettingRow
           anchorId="appearance-accent-mode"
           label={t("settings.appearance.accentColor.mode")}

components/settings/tabs/SettingsPluginsTab.tsx

@@ -4,6 +4,7 @@ import { PluginMarketplace } from './PluginMarketplace';
 import { PluginPackageManager } from './PluginPackageManager';
 import { FolderOpen } from 'lucide-react';
 import { PluginStatus } from './PluginStatus';
+import { PluginLogSettings } from './PluginLogSettings';
 import React, { useEffect, useMemo, useState } from 'react';
 
 import { normalizePluginKeyboardEvent } from '../../../application/state/pluginKeybindings';
@@ -400,6 +401,7 @@ export default function SettingsPluginsTab() {
           <p className="mt-1 text-sm text-muted-foreground">{t('settings.plugins.description')}</p>
         </div>
         <PluginManagementDialog>{(handoff) => <PluginManagementContent handoff={handoff} />}</PluginManagementDialog>
+        <PluginLogSettings />
       </SettingsAnchor>
     </SettingsTabContent>
   );

components/terminal/TerminalHostKeyVerification.tsx

@@ -30,7 +30,7 @@ export const TerminalHostKeyVerification: React.FC<TerminalHostKeyVerificationPr
     const Icon = isChanged ? AlertTriangle : Fingerprint;
 
     return (
-        <div className="space-y-3 animate-in fade-in-0 slide-in-from-bottom-1 duration-200">
+        <div data-host-security-surface="" className="space-y-3 animate-in fade-in-0 slide-in-from-bottom-1 duration-200">
             <div
                 className={cn(
                     "rounded-xl border px-3 py-2.5",

components/terminal/TerminalToolbar.tsx

@@ -44,6 +44,7 @@ import { collectOwnedPluginMenus, comparePluginMenus, usePluginContributions } f
 import { buildTerminalPluginContributionContext } from '../../application/state/pluginContributionContexts';
 import { PluginContributionIcon } from '../plugins/PluginContributionIcon';
 import { isPluginHostProtocol } from '../../domain/pluginConnection';
+import { PluginTerminalSidebarLauncher } from '../plugins/PluginTerminalSidebar';
 
 export const TERMINAL_TOOLBAR_ITEM_IDS = [
   'highlight',
@@ -1158,6 +1159,7 @@ export const TerminalToolbar: React.FC<TerminalToolbarProps> = ({
         )}
         </ToolbarCustomizeContextMenu>
 
+        {!compactToolbar && <PluginTerminalSidebarLauncher sessionId={sessionId} />}
         {pluginToolbarMenus.map((menu) => (
         <Tooltip key={menu.id}>
           <TooltipTrigger asChild>

components/terminalLayer/TerminalLayerSidePanelSection.tsx

@@ -9,7 +9,7 @@ import React, { memo, useCallback, useEffect, useLayoutEffect, useMemo, useRef,
 import { createPortal } from 'react-dom';
 import * as SelectPrimitive from '@radix-ui/react-select';
 
-import { useActiveTabId } from '../../application/state/activeTabStore';
+import { activeTabStore, useActiveTabId } from '../../application/state/activeTabStore';
 import {
   getSidePanelLiveSnapshot,
   subscribeSidePanelLiveSnapshot,
@@ -48,6 +48,7 @@ import {
   MAX_SIDE_PANEL_PANES,
   canSplitSidePanelPaneAtSize,
   collectSidePanelPanes,
+  isPluginSidePanelTool,
   getFocusedSidePanelPane,
   getSidePanelNodeMinimumPixels,
   getSidePanelSplitResizeBounds,
@@ -60,7 +61,10 @@ import {
   type SidePanelSplitNode,
 } from '../../domain/sidePanelLayout';
 import { terminalLayerSidePanelStableCtxEqual } from './terminalLayerViewMemo';
-import { SidePanelMountedContent } from './terminalLayerSidePanelSlots';
+import { PersistentSidePanelPortal, SidePanelMountedContent } from './terminalLayerSidePanelSlots';
+import { usePluginTerminalSidebar } from '../../application/state/usePluginTerminalSidebar';
+import { PluginTerminalSidebarPageHost } from '../plugins/PluginTerminalSidebar';
+import { PluginContributionIcon } from '../plugins/PluginContributionIcon';
 import { getPaneMagnificationShortcutLabel } from '../../domain/paneMagnification';
 
 const MemoizedSidePanelMountedContent = memo(
@@ -358,7 +362,7 @@ function SidePanelSplitView({
   );
 }
 
-function SidePanelLayoutTree({
+export function SidePanelLayoutTree({
   node,
   layout,
   paneCount,
@@ -568,6 +572,9 @@ function hasMountedSidePanelContent(ctx: SidePanelContext): boolean {
     && Array.from((sidePanelOpenTabs as Map<string, SidePanelTab>).values()).includes('history');
   const anyNotesOpen = sidePanelOpenTabs instanceof Map
     && Array.from((sidePanelOpenTabs as Map<string, SidePanelTab>).values()).includes('notes');
+  const anyPluginOpen = ctx.sidePanelLayouts instanceof Map
+    && [...(ctx.sidePanelLayouts as Map<string, SidePanelLayout>).values()]
+      .some((layout) => collectSidePanelPanes(layout.root).some((pane) => isPluginSidePanelTool(pane.tool)));
 
   return !(
     browserMountedTabIds.length === 0
@@ -579,10 +586,16 @@ function hasMountedSidePanelContent(ctx: SidePanelContext): boolean {
     && themeMountedTabIds.length === 0
     && !anyHistoryOpen
     && !anyNotesOpen
+    && !anyPluginOpen
   );
 }
 
 function TerminalLayerSidePanelSectionInner({ ctx }: { ctx: SidePanelContext }) {
+  const pluginSidebar = usePluginTerminalSidebar({ layouts: ctx.sidePanelLayouts ?? new Map(),
+    getSession: ctx.getActiveTerminalSessionId ?? (() => null),
+    isTerminalTab: (tabId) => (ctx.sessions ?? []).some((session: { id: string }) => session.id === tabId) || !!ctx.workspaceById?.has(tabId),
+    select: (tool) => ctx.handleSwitchSidePanelTab?.(tool),
+    withdraw: (tabId, paneId, tool) => ctx.handleWithdrawPluginSidebarPane?.(tabId, paneId, tool) });
   if (!hasMountedSidePanelContent(ctx)) {
     // Keep AI scope maintenance alive even with zero mounted tool panels so
     // merge/dissolve handoff still runs when the user closed AI before the
@@ -604,7 +617,7 @@ function TerminalLayerSidePanelSectionInner({ ctx }: { ctx: SidePanelContext })
       </AISidePanelStateRoot>
     );
   }
-  return <TerminalLayerSidePanelInner ctx={ctx} />;
+  return <TerminalLayerSidePanelInner ctx={ctx} pluginSidebar={pluginSidebar} />;
 }
 
 /** Skip chrome rebuilds when only live/workspace-focus ticks change. */
@@ -614,7 +627,7 @@ export const TerminalLayerSidePanelSection = memo(
 );
 TerminalLayerSidePanelSection.displayName = 'TerminalLayerSidePanelSection';
 
-function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
+function TerminalLayerSidePanelInner({ ctx, pluginSidebar }: { ctx: SidePanelContext; pluginSidebar: ReturnType<typeof usePluginTerminalSidebar> }) {
   const activeTabId = useActiveTabId();
   const sidePanelOpenTabs = ctx.sidePanelOpenTabs as Map<string, SidePanelTab>;
   const sidePanelLayouts = ctx.sidePanelLayouts as Map<string, SidePanelLayout>;
@@ -630,6 +643,7 @@ function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
     handleOpenAI,
     handleOpenHistory,
     handleOpenNotes,
+    handleSwitchSidePanelTab,
     handleOpenBrowser,
     handleOpenScripts,
     handleOpenSystem,
@@ -1046,6 +1060,9 @@ function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
     { id: 'system' as const, label: t('terminal.layer.system'), icon: <Activity size={15} />, onClick: handleOpenSystem },
     { id: 'notes' as const, label: t('terminal.layer.notes'), icon: <NotebookText size={15} />, onClick: handleOpenNotes },
     { id: 'ai' as const, label: t('terminal.layer.aiChat'), icon: <MessageSquare size={15} />, onClick: handleOpenAI },
+    ...pluginSidebar.pages.map((page) => ({ id: page.tool, label: `${page.title} · ${page.pluginName}`,
+      icon: <PluginContributionIcon pluginId={page.pluginId} icon={page.icon} size={15} />,
+      onClick: () => handleSwitchSidePanelTab?.(page.tool) })),
   ], [
     handleOpenAI,
     handleOpenHistory,
@@ -1056,6 +1073,8 @@ function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
     handleOpenTheme,
     handleToggleSftpFromBar,
     t,
+    handleSwitchSidePanelTab,
+    pluginSidebar.pages,
   ]);
   const sidePanelTabItemById = useMemo(
     () => new Map(sidePanelTabItems.map((item) => [item.id, item])),
@@ -1491,6 +1510,19 @@ function TerminalLayerSidePanelInner({ ctx }: { ctx: SidePanelContext }) {
             paneHosts={panePortalHosts}
             parkingHost={parkingHost}
           />
+          {activeTabId && pluginSidebar.sessionId && activeSidePanelPanes.map((pane) => {
+            const page = pluginSidebar.pages.find((item) => item.tool === pane.tool);
+            const target = panePortalHosts.get(pane.tool) ?? parkingHost;
+            if (!page || !target) return null;
+            const sessionId = pluginSidebar.sessionId!;
+            return <PersistentSidePanelPortal key={`${activeTabId}:${pane.id}:${sessionId}`} portalKey={`plugin-${pane.id}`} target={target}>
+              <PluginTerminalSidebarPageHost page={page} tabId={activeTabId} sessionId={sessionId}
+                focusOnReveal={activeSidePanelLayout?.focusedPaneId === pane.id}
+                adapter={pluginSidebar.contributions} getSession={ctx.getActiveTerminalSessionId}
+                unavailable={() => ctx.handleWithdrawPluginSidebarPane?.(activeTabId, pane.id, page.tool)}
+                focused={() => { if (activeTabStore.getActiveTabId() === activeTabId) ctx.handleFocusSidePanelPane?.(pane.id); }} />
+            </PersistentSidePanelPortal>;
+          })}
         </div>
       </div>
     </div>

components/terminalLayer/TerminalLayerTabBridge.test.ts

@@ -32,6 +32,13 @@ test('terminal layer bridge passes vault open callbacks into the side panel cont
   assert.match(source, /onOpenVaultSectionFromChat: s\.onOpenVaultSectionFromChat/);
 });
 
+test('production terminal layer context forwards extension sidebar owner and pane callbacks', () => {
+  const contextProjection = source.slice(source.indexOf('const ctx = useMemo('));
+  for (const callback of ['getActiveTerminalSessionId', 'handleSwitchSidePanelTab', 'handleWithdrawPluginSidebarPane']) {
+    assert.match(contextProjection, new RegExp(`${callback}: s\\.${callback}\\b`));
+  }
+});
+
 test('terminal layer bridge updates side panel live state after render', () => {
   assert.match(source, /const sidePanelLiveSnapshot = useMemo<SidePanelLiveSnapshot>/);
   assert.match(

components/terminalLayer/TerminalLayerTabBridge.tsx

@@ -489,6 +489,9 @@ export function TerminalLayerTabBridge({ stableRef }: { stableRef: StableRef })
     handleFontWeightResetForFocusedSession: themeState.handleFontWeightResetForFocusedSession,
     handleOpenAI: s.handleOpenAI,
     handleOpenNotes: s.handleOpenNotes,
+    getActiveTerminalSessionId: s.getActiveTerminalSessionId,
+    handleSwitchSidePanelTab: s.handleSwitchSidePanelTab,
+    handleWithdrawPluginSidebarPane: s.handleWithdrawPluginSidebarPane,
     handleOpenBrowser: s.handleOpenBrowser,
     handleOpenSystem: s.handleOpenSystem,
     handleOpenHistory: s.handleOpenHistory,

components/terminalLayer/TerminalLayerView.tsx

@@ -7,8 +7,9 @@ import { TerminalLayerWorkspaceSection } from './TerminalLayerWorkspaceSection';
 import { terminalLayerViewCtxEqual } from './terminalLayerViewMemo';
 import { useTerminalHostTreeLayoutWidth } from '../../application/state/terminalHostTreeStore';
 import { resolveTerminalLayerSurfaceStyle } from '../terminalPaneVisibility';
+import type { PluginSidebarHostActions } from '../../application/state/usePluginTerminalSidebar';
 
-type TerminalLayerViewContext = Record<string, any>;
+type TerminalLayerViewContext = Record<string, any> & PluginSidebarHostActions;
 
 function TerminalLayerViewInner({ ctx }: { ctx: TerminalLayerViewContext }) {
   const hostTreeLayoutWidth = useTerminalHostTreeLayoutWidth();

components/terminalLayer/terminalLayerSidePanelSlots.tsx

@@ -693,7 +693,7 @@ export function movePersistentPortalNode(
   }
 }
 
-function PersistentSidePanelPortal({
+export function PersistentSidePanelPortal({
   portalKey,
   target,
   children,

components/terminalLayer/terminalLayerViewMemo.ts

@@ -316,6 +316,9 @@ const SIDE_PANEL_STABLE_CTX_KEYS = [
   'handleOpenTheme',
   'handleOpenAI',
   'handleOpenNotes',
+  'getActiveTerminalSessionId',
+  'handleSwitchSidePanelTab',
+  'handleWithdrawPluginSidebarPane',
   'handleOpenBrowser',
   'handleBackFromNotes',
   'handleOpenHostFromNotes',

components/vault/VaultViewLayout.tsx

@@ -29,6 +29,7 @@ import { LazyLoadBoundary } from "../ui/lazy-load-boundary";
 import { toast } from "../ui/toast";
 import { AppWordmark } from "../AppWordmark";
 import { openHostBrowser } from "../../application/hostBrowser";
+import { PluginVaultNavigation, PluginVaultPage } from '../plugins/PluginVaultPages';
 
 type VaultViewLayoutContext = Record<string, any>;
 
@@ -156,6 +157,7 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
     ContextMenuTrigger,
     Copy,
     currentSection,
+    pluginVault,
     customGroups,
     deleteGroupPaths,
     deleteGroupWithHosts,
@@ -595,12 +597,13 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
           </div>
 
           <div
-            className={cn("space-y-1", sidebarCollapsed ? "px-1.5" : "px-2.5")}
+            className={cn("min-h-0 flex-1 overflow-y-auto space-y-1", sidebarCollapsed ? "px-1.5" : "px-2.5")}
           >
             <Tooltip>
               <TooltipTrigger asChild>
                 <RippleButton
                   variant={currentSection === "hosts" ? "secondary" : "ghost"}
+                  data-plugin-vault-fallback
                   className={cn(
                     "w-full h-10",
                     sidebarCollapsed
@@ -805,11 +808,12 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
                 </TooltipContent>
               )}
             </Tooltip>
+            {pluginVault && <PluginVaultNavigation model={pluginVault} collapsed={sidebarCollapsed} />}
           </div>
 
           <div
             className={cn(
-              "mt-auto pb-4 space-y-2",
+              "mt-auto shrink-0 pb-4 space-y-2",
               sidebarCollapsed ? "px-1.5" : "px-2.5",
             )}
           >
@@ -864,6 +868,7 @@ export function VaultViewLayout({ ctx }: { ctx: VaultViewLayoutContext }) {
             className="flex-1 min-w-0 flex flex-col min-h-0 relative"
             data-section="vault-main"
           >
+            {pluginVault?.selected && <PluginVaultPage key={pluginVault.selected.key} model={pluginVault} />}
             <VaultPageHeader
               className={cn(!isHostsSectionActive && "hidden")}
               dataSection="vault-hosts-header"

docs/plugin-platform/capability-coverage.md

@@ -17,7 +17,7 @@ mean complete. Existing APIs remain available.
 | Terminal providers | Decorations, links, completion, snapshots through provider requests | Session change delivery follows prior provider request and non-once grant | Preserve providers. Standalone selected-session watch planned | Hostnames, session state, endpoint identity | Host-selected session, runtime identity | Session-close and revoke cleanup, bounded event rate | Existing provider tests. Ordinary views cannot independently subscribe today |
 | Current context and host picker | Host context keys are boolean state | `vault.metadata` enumeration is not generic SDK | Selected host/session DTO from an explicit whitelist | Labels and endpoint metadata are sensitive | Host-owned user-action context, selected host/session | TTL, runtime and session invalidation, redacted audit | Planned. Never reuse agent `sanitizeHostForAgent` as plugin DTO |
 | Terminal selection and input draft | Provider-supplied snapshots, completion suggestions | No explicit selection-share or draft API | User shares selection, plugin proposes a visible editable draft | Terminal plaintext, accidental execution | Host action token plus exact live session/endpoint | Single-use token, size cap, no plaintext audit, active identity before commit | Planned. Reject Enter/control characters for draft insertion. No full history or direct shell |
-| Native interactions and clipboard | Native permission dialogs; new browser SDK host choice/input and explicit copy/share workflow | Progress/toast remain unimplemented | Host-owned prompts, two-phase clipboard snapshot/share, exact copy preview | Clipboard and input may contain secrets; UI discloses granted network capability; prompt spam | `ui.interact`, clipboard direction, host-signed window/runtime/version/phase/TTL action | Admission before permission prompt, byte/rate/concurrency limits, lock/blur/close/revoke cleanup, active guard, content-free audit | [Host interaction slice](./host-interactions.md) implemented and synthetic-tested; native acceptance/review/CI pending. Progress/toast still planned. No background reads or trusted plugin `userGesture` boolean |
+| Native interactions and clipboard | Native permission dialogs; new browser SDK host choice/input and explicit copy/share workflow | Progress/toast remain unimplemented | Host-owned prompts, two-phase clipboard snapshot/share, exact copy preview | Clipboard and input may contain secrets; UI discloses granted network capability; prompt spam | `ui.interact`, clipboard direction, host-signed window/runtime/version/phase/TTL action | Admission before permission prompt, byte/rate/concurrency limits, lock/blur/close/revoke cleanup, active guard, content-free audit | [Host interaction slice](./host-interactions.md) implemented and synthetic-tested. 8e4dd0c exact test/packaging CI and independent delta review passed. Parent native compose and explicit Preview/Share/copy succeeded; a separately approved 0.1.1 compose ran about 86 seconds, beyond the old 30-second deadline and within the declared 180-second budget, with no fresh command-timeout error. All five permissions were Once; cleanup is parent-owned. New navigation slices retain separate acceptance gates. Progress/toast still planned. No background reads or trusted plugin `userGesture` boolean |
 | Local filesystem | Read file, stat, overwrite existing regular file | Directory listing lacks same-handle native adapter | Keep current boundary, evaluate file picker handles | Arbitrary local file content and writes | Canonical exact path or selected file handle | Inode checks, no symlink alias, bounded bytes, active runtime | Existing filesystem tests. Directory enumeration and new arbitrary-path creation deferred until portable safe native adapter exists |
 | SFTP and remote files | No generic plugin API | `sftp.read` and `sftp.write` enumerated only | Host-selected session/path/mode/TTL handles, read and explicit save/upload | Remote secrets and destructive overwrite | Live endpoint identity, exact path, read/write split | Cancel streams, byte quota, overwrite confirmation, close/revoke cleanup | Batch 2 planned. Never forward arbitrary MCP catalog or session ID alone |
 | Editor and Notes | No plugin document API | No versioned snapshot or edit preview | Explicit snapshot and versioned proposed edit | Document secrets, lost updates, executable files | Selected document plus revision and action token | Version conflict check, preview, bounded bytes, revocation | Planned evaluation after shared action context. No unattended edits |
@@ -27,12 +27,12 @@ mean complete. Existing APIs remain available.
 | Vault and keychain | Credential references and import preview/commit | Metadata/write enums do not grant a generic Vault SDK | Only user-selected whitelist DTOs and drafts | Notes, environmentVariables, startupCommand, keys and credentials | Selected object plus field/direction | Explicit preview, identity checks, redacted audit | Full Vault export and secret reads deferred indefinitely. No agent field-exclusion DTO reuse |
 | System manager and Docker | No plugin system API | Agent/MCP adapters are separate authority | Typed read-only summaries excluding args/env/inspect | Process command lines and Docker inspect can expose secrets | Selected live session and summary kind | Bounded result, endpoint identity, cancellation | Planned evaluation. Arbitrary process/inspect forwarding deferred |
 | Port forwarding | No generic plugin API | Existing agent start is write-sensitive | Selected rule status and open host form | Rule endpoints and local exposure | Selected rule plus host action | Bounded DTO, session close and revoke | Planned evaluation. Direct start deferred until binding/listener approval design |
-| Themes, settings, appearance, i18n | Terminal theme/background Providers, isolated view CSS, scoped settings and environment updates | No host global theme contribution. Personal customCSS is not plugin authority | Accepted ThemePack stage: static palette registry, selector, local preview, revision-safe apply/cancel/reset, terminal linkage | Unreadable palettes and misleading security UI. Nineteen UiThemeTokens fields are not independent: accent derives primary/ring/foregrounds | User explicitly selects a theme; static contribution enablement separate from code permissions | Immutable version/hash, bounded JSON, contrast/security-surface gates, preview owner/revision and safe fallback | Planned independent implementation after current controlled workflow/navigation. No arbitrary DOM/CSS, remote assets, layout replacement or security UI customization |
+| Themes, settings, appearance, i18n | Terminal theme/background Providers, isolated view CSS, scoped settings and environment updates | No host global theme contribution. Personal customCSS is not plugin authority | Accepted ThemePack stage: static palette registry, selector, local preview, revision-safe apply/cancel/reset, terminal linkage | Unreadable palettes and misleading security UI. Nineteen UiThemeTokens fields are not independent: accent derives primary/ring/foregrounds | User explicitly selects a theme; static contribution enablement separate from code permissions | Immutable version/hash, bounded JSON, contrast/security-surface gates, preview owner/revision and safe fallback | First host color layer implemented; [contract/lifecycle/evidence](./theme-packs.md). Exact-SHA CI, independent review and native acceptance pending. Static terminal linkage not yet accepted; no arbitrary DOM/CSS, remote assets, layout replacement or security UI customization |
 | Transfer center | Host transfer queue exists, no plugin entry | No ownership-bound task API | Observe and cancel only plugin-created tasks | Paths and host endpoints reveal user data. Cancel may leave partial files | Own transfer handle plus source/destination authority | Shared backpressure, cancel/close cleanup, honest partial status | Planned with batch 2. Do not broadcast or cancel other tasks |
 | AI, MCP, automation | Host agent catalog and harness exist separately | No generic plugin AI or tool forwarding | Selection-to-proposal workflow through the same controlled primitives | Content disclosure, account authority and model cost | Explicit content sharing plus service origin/budget | No inherited history, tools, account, or hidden cron | Controlled workflow planned. Generic host AI and visible schedules deferred to distinct product decision |
 | Known hosts, app lock and global security | Host security management UI | No plugin management API | Future allowlisted security-page navigation | Host-key trust, unlock, keys and security policy affect all sessions | Host navigation action only | No mutation or sensitive DTO | Security policy mutation, private-key reads, auto-trust and unlocking deferred indefinitely |
 | Plugin blob/cache | Local KV exists | No exclusive blob cache | Evaluate bounded plugin-owned cache when a real workflow needs it | Disk growth and lifecycle ambiguity | Plugin namespace, no arbitrary path | Size quota, eviction and uninstall policy required | Deferred until a concrete larger-than-KV workflow establishes value and retention policy |
-| Vault and terminal navigation | `tab` mounts a sandbox page through TopTabs/QuickSwitcher; aside/panel are overlays | No Vault subpage registry or terminal side-panel plugin tool. `settings` is a detail entry, not a new settings category | Accepted independent slice: host-owned namespaced Vault pages in an Extensions group, mounted in the Vault content area through existing ViewHost; then terminal pane/split pages for the selected session | Navigation cannot disclose session contents or replace built-in/security navigation | Declared page contribution plus host selection. Content reads have independent permissions | Host order/when/focus, cancellation of late open, view cleanup on hide/update/disable/uninstall, safe invalid-link fallback | Planned after host interaction/selected-context workflow. A button that merely opens a top tab does not satisfy Vault-page acceptance. No arbitrary router/DOM API |
+| Vault and terminal navigation | `tab` mounts a sandbox page through TopTabs/QuickSwitcher; aside/panel are overlays | No Vault subpage registry or terminal side-panel plugin tool. `settings` is a detail entry, not a new settings category | Accepted independent slice: host-owned namespaced Vault pages in an Extensions group, mounted in the Vault content area through existing ViewHost; then terminal pane/split pages for the selected session | Navigation cannot disclose session contents or replace built-in/security navigation | Declared page contribution plus host selection. Content reads have independent permissions | Host order/when/focus, cancellation of late open, view cleanup on hide/update/disable/uninstall, safe invalid-link fallback | [Vault page slice](./vault-pages.md) implemented and synthetic-tested: actual Vault content slot, private Scratchpad, catalog withdrawal, host occlusion, reserved-open cancellation, owner/crash/lock cleanup. Exact CI/independent/native acceptance pending. [Terminal sidebar slice](./terminal-sidebar.md) also implemented with actual pane/split mounting, owner focus and session-change cleanup; no automatic session data. Exact CI/independent/native acceptance pending for the new stack. No arbitrary router/DOM API |
 | Distribution and runtimes | Browser-only public catalog, immutable packages, advanced developer gate | Signing/trust and release remain separate phase | Retain existing boundary | Package execution and publisher trust | Pinned catalog selection, hash, engine/features | Existing install transaction, quarantine and cleanup | No merge/release. Do not extend to arbitrary Node, IPC, shell, or global capabilities |
 
 ## Delivery order and stopping rule
@@ -83,3 +83,84 @@ Baseline code references: `electron/plugins/hostService.cjs`,
 implementations under `electron/capabilities/catalog/` are reference material,
 not plugin authority. `infrastructure/ai/vaultAgentBridgeClient.ts` is not a
 plugin DTO sanitizer.
+
+## Navigation slice checkpoint
+
+The Vault stage adds `views.vault-pages`, the `vault-page` location, and the
+existing `views` permission. It grants no Vault/session data. The ordinary
+browser Scratchpad example uses only its own bounded view-state API and
+explicit user input. It is not a Notes API or automatic sync feature.
+
+The independent integration base includes #3956 UI polish and #3960 d4ca fixes;
+frozen evidence heads and prior PR bases are unchanged. Related UI changes in
+this stage are limited to VaultView/VaultViewLayout, new independent plugin
+components/hooks, and localized strings. PluginMarketplace/PluginPackageManager
+layouts are not rewritten. Native acceptance belongs to the parent with a new
+fixture-specific own-views approval. Sidebar, ThemePack, selected context and
+SFTP remain unfinished; this checkpoint is not overall completion.
+
+## Terminal sidebar checkpoint
+
+`views.terminal-sidebar` exposes one more existing sandbox view placement,
+using only the existing own-views permission. The host owns navigation,
+selection, split/close and focus. Its context is a surface string only; no
+terminal DTO or resource authority is implied. The Session Scratchpad fixture
+uses explicitly typed synthetic text and its own view state.
+
+This stage builds on ordinary merges containing #3960 8e4dd0c and the #3971
+stale-layout callback fix. Prior QA heads and PR bases are not rewritten. The
+ThemePack implementation, selected-context/drafts and file handles remain
+unfinished; parent review/native gates still apply to each delivered head.
+
+## Color-pack and remaining workflow checkpoint
+
+The first [ThemePack color layer](./theme-packs.md) now has an implemented host
+catalog, data-only admission, Appearance selector, local preview, revision-safe
+application/reset, missing-version fallback and host security palette boundary.
+It is not native-accepted until the new exact head is independently reviewed,
+built by CI and exercised through normal Settings. Terminal palette linkage is
+not accepted by this contract yet, so a declared but ignored linkage cannot be
+counted as coverage. Font/density/icon/background packs remain separate product
+and accessibility decisions, rather than arbitrary CSS permissions.
+
+Parent native evidence for sidebar `a8adeb86` now covers the original Local
+Terminal blocker, own-views Once, save, magnify/restore, a split with empty Notes,
+and side/bottom docking. `733f44c` adds only the production bridge projection
+regression. The older `0c097a1` CI run `40308057623` remains **failed and
+unattributed**: 9447 top-level TAP results are `ok`, the aggregate footer is
+missing and the process exits 1. A newer passing run does not change that record.
+The native Vault success retains its original `0c097a1` evidence label.
+
+The next implementation stages are bounded by useful workflows:
+
+1. **Selected terminal sharing and drafts (A).** Reuse host-signed action
+   contexts for an explicit selection preview/share, then let the plugin submit
+   a bounded input draft to the host compose surface. No Enter, raw PTY, history
+   enumeration or background terminal listener. First add a host-selected
+   session handle with a minimal from-scratch DTO and independent lifecycle
+   watch; navigation alone grants no content. Bind handles to actual session and
+   connection identity, runtime/version, owner, mode and TTL. Cover cancel,
+   reconnect, close, revoke and late draft results with synthetic terminals.
+2. **Selected file conversion/transfer (A).** The host picker issues read or
+   explicit-destination write handles. Start with one file, stat/read and saveAs
+   or upload, not recursive traversal or arbitrary paths. Require destination
+   preview/overwrite confirmation, byte/concurrency limits, cancellation,
+   session/endpoint identity and final active checks. Observe/cancel only the
+   plugin's own transfer. Real native SFTP targets require parent-coordinated
+   concrete approval; local tests use isolated fixtures.
+3. **Versioned document proposals (selected B).** Reuse snapshot/handle and host
+   review primitives for one explicitly shared editor document or Note. Apply
+   only an expected-version patch to its buffer after a visible diff; saving a
+   remote file remains a separate file operation. Reuse the draft path for a
+   selected snippet or new snippet template; do not run scripts or add onConnect
+   bindings. Cover edits after snapshot, detached ownership, closure and revoke.
+4. **Final reassessment.** Recheck the matrix by actual workflow and eight gates.
+   Read-only system aggregates, selected port-rule status and bounded navigation
+   may be added only where the shared primitives leave a concrete useful gap.
+   Full process arguments/env/inspect, tunnel start, arbitrary AI/MCP tools,
+   background jobs, general KV sync and raw high-privilege access remain deferred
+   or retained boundaries. Do not invent new C work to prolong the task.
+
+These stages remain unfinished work, not API-name coverage. Exact schemas and
+ordering will follow the existing brokers/adapters rather than a parallel RPC
+stack or one namespace per product module.

docs/plugin-platform/contract-and-sdk.md

@@ -630,3 +630,13 @@ negotiated API version and runtime initialization uses and verifies that exact
 version. Host version bounds remain independently enforced; unknown required
 features still fail closed. No old manifest is rewritten and no permission grant
 is migrated by this revision.
+
+## Declarative host color contributions
+
+`appearance.theme-packs` adds `contributes.themes` and generated palette/reference
+schemas. A pure package uses `main: { "data": "theme" }`, contributes only themes
+and omits permissions/activation/companions. It has no executable runtime. Normal
+admission accepts this data-only form alongside browser-only code packages; Node
+and arbitrary IPC remain advanced/unsupported public boundaries. Selection is a
+trusted host Appearance action, not an SDK setter or `appearance.write` grant.
+See [Theme packs](./theme-packs.md) for limits, preview, persistence and fallback.

docs/plugin-platform/isolated-runtime.md

@@ -300,3 +300,8 @@ installs plugins but fails to start them outside the repository checkout.
 separate `npm run test:plugin-runtime:electron` smoke launches both a real
 sandboxed BrowserWindow plugin and a real utilityProcess plugin, verifies
 bidirectional storage RPC, and checks the recorded runtime ownership.
+
+Static `appearance.theme-packs` packages are an explicit non-executable admission
+form: `main.data = "theme"`, theme-only contributions and no permissions,
+activation events or companions. The runtime supervisor never starts them. This
+exception does not admit Node code or arbitrary host access in normal Settings.

docs/plugin-platform/local-logging-validation.md

@@ -0,0 +1,87 @@
+# Local logging validation
+
+Base: PR #3978 at `91b8927c56314e68c06e2c008e84559ddfb96d78`.
+All data used in these checks is synthetic and each persistence test creates its
+own temporary profile. No real logs or credentials were opened.
+
+| Check | Result |
+| --- | --- |
+| `node --test electron/plugins/*.test.cjs` | 561 passed, 2 expected skips (Electron live test and the #3981 database integration test on this older base) |
+| New logging settings, existing settings and permission-panel interaction tests | 4 passed |
+| `npm run build` | Passed; existing large-chunk warning |
+| `npm run lint` | No errors, 7 existing warnings; final changed-source lint also passed |
+| `npm run check:plugin-contract` | Passed, no generated drift |
+| `npx tsc --noEmit` against this change and the exact base | 773 diagnostics in each, zero added or removed after normalizing worktree paths |
+| `git diff --check` | Passed |
+
+Coverage includes disabled and enabled persistence, opt-in plugin text, sensitive
+field exclusion, host source attribution, unknown-source fallback, URL rejection,
+spoofed metadata, cyclic/accessor/proxy input, noisy writers, shared queue and disk
+limits, rotation, expiration, drop/error counts, export, clear confirmation,
+disable/revoke, stale runtime callbacks, and manager shutdown. The filesystem
+regressions cover direct paths, symlink aliases, a symlinked profile directory,
+and revocation during the final protected-storage check.
+
+## Remaining native checks
+
+Electron launch failed before application/profile startup. The executable at
+`node_modules/electron/dist/electron --version` aborted with:
+
+> The SUID sandbox helper binary was found, but is not configured correctly.
+
+Its message requires `chrome-sandbox` to be root-owned with mode 4755. No sandbox
+switch, privilege escalation, permission repair, or native retry followed. Native
+smoke execution, screenshots, and a short recording remain pending. The acceptance
+flow is in [Local plugin logging](local-logging.md#native-qa-with-synthetic-data).
+
+`npm run pack:dir` completed its production build, then failed during serialport
+native rebuilding: node-gyp returned ENOENT for mkdir
+`/home/agent/.electron-gyp`. No system-directory change or packaging retry followed.
+A native package was not produced.
+
+## Parent integration
+
+The only shared settings-page change is one import and one `<PluginLogSettings />`
+element. Preserve that element when integrating the marketplace task's page.
+There are no Installed, Official, Third-party, source-database, or unrelated host
+data changes.
+
+The default host-owned resolver is wired through `createPluginHostService`. It
+consumes #3981's confirmed API without editing its database or sync implementation.
+On the older #3987 base, missing source APIs remain explicitly unknown. No shared
+transport-registration change is needed beyond the existing logging registration.
+
+## Source and review follow-up
+
+A separate worktree at `59721f97172acffffe960a6268a2916a90a6c554` received only
+the logging backend overlay. Its logging/source/host regression command passed
+33 tests with no skips, including the real database replacement, encoded local-owner roundtrip and
+shutdown-drain case. The product branch does not import marketplace changes or bump its database
+schema.
+
+Independent review of the implementation follow-up found no remaining blocking
+findings. Independent runs passed 50 focused regressions with one expected source
+skip, 20 real-source integration regressions with no skips, and the logging UI
+interaction test. The reviewer made no edits and did not launch Electron. A further independent
+review of the newer encoded-local-owner contract found no issues; all six
+provenance tests passed on exact `59721f97172acffffe960a6268a2916a90a6c554`,
+with an additional probe confirming the local encoded owner.
+
+Fixed review findings have deterministic regressions: 31 days of low-volume
+appends and export cannot extend segment retention via mtime; stale sources cannot
+rotate away existing evidence; settings-write failure shows actual host state;
+log draining still completes when another shutdown stage rejects; and activation
+permission denial produces a fixed host record before runtime creation.
+
+Exact prior head `e3cc23bca81a4187ccc13b90d3882889d524ca3b` passed remote
+[test 40339839263](https://github.com/binaricat/Netcatty/actions/runs/40339839263)
+and [build-packages 40339839660](https://github.com/binaricat/Netcatty/actions/runs/40339839660).
+Those runs do not validate the follow-up head. Its exact-head CI is reported in
+the PR after pushing.
+
+The native fixture build is reproducible: 3,270 bytes, SHA-256
+`c3770a55676ed708f01ec1e0e0b9968ffb5e03c02303ee7cb9f739bde27c9de0`.
+The concise flow and commands are in [Local plugin logging](local-logging.md#native-qa-with-synthetic-data).
+Native screenshots and recording remain assigned to the parent's working cloud
+GUI machine. No local sandbox bypass or packaging retry is authorized by this
+handoff.

docs/plugin-platform/local-logging.md

@@ -0,0 +1,178 @@
+# Local plugin logging
+
+Local file persistence defaults to off. The existing permission panel keeps its
+bounded security history independently. Changing or clearing local log files does
+not clear that history, grant permissions, or change a plugin's source.
+
+## Saved records
+
+`PluginLogService` extends the existing `PluginLogger`. It owns one shared sink at
+`<userData>/plugins/logs/host-v1`, outside plugin storage. Files contain JSON Lines.
+They stay on the device. No cloud upload or sync path includes these files or the
+local preference at `<userData>/plugins/local-logging.json`.
+
+Host audit records contain these facts:
+
+- Host-assigned plugin ID, installed version, archive SHA-256, runtime ID and kind.
+- Source ID, source kind, and namespace from an injected host provenance resolver.
+  Missing provenance is `null`. Manifest claims never imply an official source.
+- Registered host RPC operation, authorization outcome, result, numeric error code,
+  elapsed milliseconds, and available input/output `data` field byte counts.
+- Target identifiers from host authorization descriptors, replaced with a keyed
+  SHA-256 digest. The random key stays in memory, so target correlation lasts only
+  for the current app process.
+- Cumulative dropped-record and write-error counts at enqueue time.
+
+Runtime start, running, stop, failure, protocol rejection, and permission revocation
+produce separate host facts. Required and advanced activation permission failures
+produce a fixed `runtime.authorization` event even before a runtime ID exists. The registry records known RPC attempts even when
+validation or authorization fails. Authorization has separate `allowed`, `denied`,
+`not-required`, and `not-reached` states. A handler error after approval preserves
+`allowed` and records the failed result. Unknown values remain explicit.
+
+The byte counts measure UTF-8 bytes in a string `data` field, or byte length for a
+binary `data` field. They are not total wire traffic or decoded base64 size.
+Missing measurements are `null`. Streaming traffic outside these calls does not
+become a complete per-byte trace. Host facts describe what the host observed;
+plugin-returned success cannot prove an external side effect occurred.
+
+Host audit records never copy request bodies, response bodies, error messages,
+credentials, API keys, passwords, prompts, Notes, SQL, query results, or terminal
+content. Error codes come from the host RPC error set. No audit field accepts
+plugin-supplied source identity.
+
+## Optional plugin text
+
+Verbose diagnostics require a separate confirmation and turn off after app
+restart. Console messages, utility stdout/stderr, and `logger.write` text use
+`recordType: plugin-diagnostic` and `trust: plugin-authored-unverified`. The host
+adds identity outside the nested `diagnostic` object. Plugin fields named
+`pluginId`, `sourceId`, or `recordType` cannot replace reserved metadata.
+
+Text and structured fields have traversal, length, depth and total-record limits.
+Control characters are removed and known sensitive field names are replaced.
+These bounds do **not** make arbitrary plugin text safe. A plugin can put a secret
+under an unexpected key or inside a sentence. Review files before sharing them.
+No plugin text is persisted when verbose diagnostics are off.
+
+## Limits and lifecycle
+
+The shared sink retains at most three files of 1 MiB each, for at most seven days.
+Expiry uses the first host timestamp in each segment, read within the existing
+16 KiB record bound. Appending cannot extend a segment's lifetime. Export uses
+the same cutoff. A segment is removed when its first record expires; capacity
+rotation or segment expiry can remove later records sooner. Retention runs on
+startup, writes and hourly while the app runs, including after saving is disabled. The app cannot delete expired files while it is closed.
+The asynchronous queue accepts at most 256 KiB and records drops when full.
+Plugin text can occupy only a quarter of that queue, leaving capacity for host
+facts. Diagnostics also reuse the existing per-runtime log token bucket (240
+records per minute, with a 240-record initial burst), including console output. Each
+record is limited to 16 KiB. Oversized records are dropped. Write failures increase
+both drop and error counts and never fail the plugin operation.
+
+Turning saving off stops ingress, discards queued records that have not started,
+and waits for any current write. Runtime cleanup closes its diagnostic logger.
+App shutdown drains accepted writes through the existing manager shutdown path,
+including when another cleanup stage rejects. A failed settings write refreshes
+the checkbox from actual host state while retaining the original error.
+Clearing pauses ingress, discards queued records, waits for a current write and
+removes only the sink's known files. Cancellation leaves them intact. Export takes
+a bounded snapshot on the write queue and uses the native Save dialog.
+
+Files use mode 0600 and the directory uses 0700 on systems that support them.
+The host filesystem broker rejects writes to the audit directory and preferences,
+including canonical paths reached through symlinks. Plugin views cannot invoke
+log management IPC. No plugin API exposes audit mutation. These local files are
+not a tamper-evident ledger against the OS account or the development-only utility
+runtime, which already has full Node and filesystem authority.
+
+## Integration boundaries
+
+`PluginLogSettings` is a standalone compact component, mounted by a single import
+and element in `SettingsPluginsTab`. It adds no marketplace tab and changes no
+Installed, Official, Third-party, or source-database implementation. When merging
+with the marketplace branch, preserve this element in the host settings surface.
+
+`createPluginHostService` now injects the host-owned
+`createPluginLogProvenanceResolver(database)` by default. It consumes the source
+API confirmed on #3981 at `59721f97172acffffe960a6268a2916a90a6c554`:
+
+- `getActivePlugin(pluginId)` supplies the installed version, hash and source.
+- `getRetainedPluginSource(pluginId)` must agree with the installed source.
+- `privateOwner(pluginId)` supplies the opaque namespace.
+- `publicPluginId(owner)` must round-trip to the host-assigned public ID.
+
+The adapter receives host activation identity only, after the existing caller
+guards. It never accepts source or owner fields from plugin request parameters.
+Missing APIs, an absent installation, changed version/hash, a retained-source
+mismatch or an orphaned owner leave provenance explicitly unknown. There is no
+bare-plugin-ID fallback. The current host API encodes every owner, including
+local imports; a bare ID returned as an owner remains unknown.
+
+Each logger snapshots the source binding and supplies a host-only `isCurrent`
+check. The sink checks it at enqueue, after asynchronous preflight, before
+rotation mutations and immediately before appending. Records from a replaced or
+uninstalled source are dropped and counted. They are never relabelled as the new
+source. Already saved records keep their original identity.
+
+The optional `resolvePluginProvenance` override remains host-owned. Its result
+contains `sourceId`, `sourceKind`, `namespace`, and an optional synchronous
+`isCurrent` function. Source IDs and kinds accept 1-128 ASCII letters, digits,
+periods, underscores, colons and hyphens. Opaque namespaces accept the same
+characters up to 256 bytes. URLs, display names and plugin claims are not source
+identity. `official` describes the host-bound source, not official maintenance.
+
+The source database, marketplace page and sync implementation are unchanged by
+this adapter. It also needs no new shared host-registration change for transport.
+
+## Native QA with synthetic data
+
+Use the parent's working cloud GUI machine, a fresh isolated profile, and the
+synthetic fixture below. Do not retry the blocked local Electron launch.
+Do not open real logs or credentials. Capture screenshots of the settings card,
+verbose disclosure, and native Clear confirmation. Record a short flow:
+
+1. Open Plugins settings. Confirm both options are off and no host-v1 files exist.
+2. Enable local saving. Invoke a synthetic plugin host operation and deny another.
+3. Open the folder and export to a synthetic destination. Inspect parsed JSONL for
+   host identity, outcomes, target digests, and absence of synthetic secret bodies.
+4. Open verbose disclosure and cancel. Confirm no plugin text is saved. Confirm
+   the disclosure, write synthetic text, and verify the unverified record type.
+5. Disable/revoke the plugin. Confirm its later text cannot append. Restart the
+   app and verify that local saving remains selected but verbose text is off.
+6. Cancel Clear, then confirm it. Confirm the files are removed and the permission
+   panel's separate security history remains. Turn local saving off.
+
+The fixture is `electron/plugins/fixtures/local-logging-plugin`. Build it with:
+
+```sh
+node --input-type=module -e 'import { buildPluginPackage } from "@netcatty/plugin-cli"; await buildPluginPackage("electron/plugins/fixtures/local-logging-plugin", "/tmp/netcatty-local-logging-fixture.ncpkg");'
+```
+
+Package: 3,270 bytes. SHA-256:
+`c3770a55676ed708f01ec1e0e0b9968ffb5e03c02303ee7cb9f739bde27c9de0`.
+It declares only `commands` and `menus`; its command-palette entries are under
+**Logging QA**. **Emit synthetic diagnostic** tests redaction and nested spoofed
+identity fields. **Emit synthetic diagnostic burst** emits 400 console messages
+to exercise drop accounting. **Test undeclared network denial** must return denial
+without a prompt or network I/O because the manifest declares no network access.
+No request body or credential is supplied. Do not grant additional permissions.
+
+Capture the compact settings card, verbose disclosure and native Clear dialog,
+plus a short recording of the enable/emit/export/clear flow. On a #3981 integration
+build, a normal local import must log the source and opaque owner returned by its
+host database. On the older base, both stay explicitly unknown. Do not forge an
+Official source through fixture metadata. The real-source replacement case is
+covered by `pluginLogProvenance.integration.test.cjs` on the documented source
+integration worktree; it uses only temporary synthetic database state.
+
+The execution environment for this change could not launch Electron: its SUID
+sandbox helper is not root-owned with mode 4755. Electron aborted before opening
+any profile. No sandbox-disable retry or system-permission change was attempted.
+`npm run pack:dir` also failed while rebuilding the serialport native dependency:
+node-gyp tried to create `/home/agent/.electron-gyp` and received ENOENT. No
+system-directory change or packaging retry was attempted.
+
+Native screenshots and recording therefore remain pending in the parent desktop
+QA queue. Component interaction tests are separate evidence and do not replace
+that acceptance.

docs/plugin-platform/terminal-sidebar.md

@@ -0,0 +1,74 @@
+# Terminal sidebar pages
+
+The `terminal-sidebar` view location requires `views.terminal-sidebar` and the
+existing `views` permission. This adds navigation and plugin-owned content to
+the existing terminal pane/split system. It is not a session-data capability,
+Provider subscription, terminal history reader or command execution API.
+
+## Host-owned navigation
+
+An Extension pages menu in the normal terminal toolbar lists visible pages
+with their plugin source. Selecting one switches the existing focused pane;
+selecting an already-open tool focuses that pane. Existing split menus include
+the same contributions and enforce unique tools and the eight-pane limit.
+Host-generated `plugin-view:<namespaced-view-id>` keys cannot replace built-in
+tools. Declared order and ID determine listing order; existing host docking,
+split resizing, magnification and close controls remain authoritative.
+
+The manager's internal Open event can select a page only when an open terminal
+is already selected. Otherwise the host asks the user to select a terminal; it
+does not connect or open a saved host. Launcher events target the session from
+the actual host terminal toolbar and are rechecked against current selection.
+These are internal host UI events, not public SDK router methods or trusted
+plugin `userGesture` flags.
+
+## Session ownership without data sharing
+
+The renderer binds each page to the actual terminal tab/workspace and current
+focused child session. It passes only `netcatty.surface: terminal-sidebar` as
+the view context. Internal ownership IDs are used for host state scoping, not
+returned to the page or treated as resource grants. A future selected-session
+data API must establish its own live endpoint authority and permissions.
+
+Changing terminal tabs or workspace focus closes the old native view before
+the new one can receive focus. Session removal, pane close, withdrawal of a
+visible contribution, disable/update/uninstall and runtime loss remove the
+affected page. Unknown saved routes are pruned without opening them; restoring
+a layout never grants the page or any session-data permission. State buckets
+are for the plugin's own UI data, not an isolation boundary against that same
+plugin's already-authorized own-state API. Ordinary KV does not become synced.
+
+PersistentSidePanelPortal moves a stable mount between the actual pane,
+magnification host and hidden parking host. There is no fallback native view
+over the entire terminal layer. Native geometry follows host DOM relocation,
+resize and scrolling; duplicate geometry updates are suppressed. Hidden/inert
+or parked mounts cannot reveal a native view.
+
+## Focus and security surfaces
+
+The existing sandbox ViewHost, immutable package/protocol checks, own-command
+and view-state boundaries are reused. Embedded pages start hidden. Host
+dialogs and overlapping portals hide them, and main-process App Lock closes
+them. Escape is host-owned and closes the plugin pane.
+
+Native WebContents focus is reported only to its actual owner's trusted
+renderer using a canonical instance-ID event. It updates the selected pane;
+it does not expose an Electron object to the plugin. Revealing multiple panes
+does not focus all of them: only the host-selected pane can request focus.
+The main process verifies actual owner, visibility, foreground and unlocked
+state before honoring that request. A plugin has no SDK method to invoke the
+host focus bridge. No session or page text is added to focus/audit logs.
+
+## Example and evidence
+
+`com.netcatty.session-scratchpad` 0.1.0 asks only for its own `views`. It saves,
+reopens and clears explicitly typed synthetic text. Package instructions and
+minimal native actions are in its README. Repository tests use real split
+tree, layout state, persistent portal, launcher and embedded-view components;
+host tests cover owner-bound focus, hidden/locked refusal and withdrawal.
+Feature and permission admission, limits, old APIs and previous Vault/command
+fixes are checked on the same stack. Independent review, exact-SHA CI and
+parent native QA remain separate acceptance gates recorded on the Draft PR.
+
+ThemePack, selected context/terminal drafts and SFTP handles remain subsequent
+bounded stages. Adding a sidebar page does not count as implementing them.

docs/plugin-platform/theme-packs.md

@@ -0,0 +1,159 @@
+# Host color theme packs
+
+Theme packs contribute validated light and dark host colors. They cannot inject
+CSS, access host DOM, change layout, load remote resources, replace security
+controls, or apply themselves. The feature is `appearance.theme-packs`.
+
+## Install and select
+
+Use normal Settings > Plugins to install and enable a package. In Appearance,
+choose a plugin theme for the current light or dark mode, then select Preview or
+Apply. Preview changes only the current window and writes no preference. Cancel,
+closing Appearance, changing mode, package withdrawal, or a newer committed
+revision ends that preview. Apply saves a host-owned, device-local choice and
+refreshes other application windows. Restore default clears the plugin choice
+for that mode and selects Snow or Midnight. Selecting a built-in swatch also
+clears that mode's plugin choice. Failures remain visible and are not reported as
+successful applications.
+
+The current view environment is globally broadcast. To keep temporary previews
+local, it publishes **committed** theme tokens only. Plugin pages follow an
+applied theme through their existing environment subscription; they do not
+receive another window's temporary preview. This does not add an owner-local
+view environment API.
+
+## Data-only package
+
+A pure theme uses `main: { "data": "theme" }`, contributes only `themes`, and
+omits permissions, activation events and companions. Its code runtime is never
+started, including by the runtime supervisor's startup or explicit-start path.
+Browser code plugins may also declare themes; choosing a theme does not start a
+runtime or grant their functional permissions. Only enabled packages appear.
+
+```json
+{
+  "features": { "required": ["appearance.theme-packs"] },
+  "main": { "data": "theme" },
+  "contributes": {
+    "themes": [{
+      "id": "com.example.colors.forest",
+      "label": "Forest",
+      "variant": "light",
+      "entry": "forest.json"
+    }]
+  }
+}
+```
+
+This fragment belongs in an otherwise complete manifest. Contribution IDs use
+the package namespace. Palette paths are package-relative JSON files, included
+and checked by the normal CLI/package store. Hosts lacking the required feature
+reject compatibility deterministically.
+
+```json
+{ "formatVersion": 1, "base": "light", "colors": { "accent": "#166534" } }
+```
+
+Colors merge onto a fixed accessible light/dark host base. Only opaque `#RRGGBB`
+values and canonical semantic keys are accepted. The 15 editable keys cover
+background/foreground, card and popover pairs, secondary and muted pairs, accent,
+destructive and its foreground, border and input. Primary, ring and the accent
+foregrounds are derived together, matching the existing theme conversion.
+Nineteen output fields are not nineteen independent controls.
+
+Each package has at most 32 themes; each palette is at most 64 KiB; the catalog
+and validated cache contain at most 256 entries. Schema and contrast checks run
+before catalog publication. Text pairs and state colors require at least 4.5:1;
+control borders and focus information require at least 3:1 against their
+surfaces. Invalid palettes produce bounded, content-free diagnostics and cannot
+be previewed or applied. Files are read from verified immutable package roots,
+with bounded reads and a no-follow final file open.
+
+## Ownership, recovery and security appearance
+
+The host stores selections separately from plugin KV, settings sidecars and
+cloud sync. A reference binds plugin ID, theme ID, exact version, archive digest
+and variant. Application uses a revision check plus an active-package check just
+before the atomic preference/audit transaction. An audit write failure rolls
+back the selection. Audit records contain revision/action metadata, not palette
+or user content.
+
+Disable, uninstall, update, missing entries and integrity failures withdraw the
+palette. A saved missing reference remains visible as unavailable while the
+same-mode safe host palette is used; a changed package is not automatically
+applied. Preview owner and committed revision checks prevent a late cancellation
+from replacing another preview or a newer application.
+
+Host dialogs, App Lock, grant/revoke, host details, keychain panels, host-key
+prompts and the credential picker use fixed host security variables while a
+plugin theme is active. The pack controls no font, icon, opacity, CSS selector,
+button text or ordering. System forced-colors/high-contrast preferences use a
+fixed host high-contrast fallback. Personal accent, fonts, terminal choices and
+accessibility preferences retain their authority. Existing personal custom CSS
+remains a user setting and is not exposed to plugins.
+
+This first layer changes host semantic colors. Static terminal palette linkage,
+custom high-contrast variants, fonts, density, icons and backgrounds remain
+separate bounded follow-ups; their fields are not silently accepted here.
+
+## Example and validation
+
+`examples/plugins/forest-theme-pack` is a four-file data package with light and
+dark Forest accents. It requests no permissions and contains no JavaScript.
+The starter, Vault Scratchpad and Session Scratchpad pages now subscribe to the
+existing seven public HSL tokens through `theme.js`, dispose on page hide, and
+use responsive host-colored controls. No new styling RPC is needed.
+
+Local evidence includes normal CLI validation/packing, schema/admission and
+no-runtime checks; host catalog/identity/size/contrast/CAS/migration/atomic-audit
+checks; picker preview/apply/cancel/reset and stale-owner/withdrawal/high-contrast
+checks; and view-template initial/live environment/disposal checks. Exact-SHA
+CI, independent review and parent native multi-window/security-surface acceptance
+remain separate delivery gates. Local production builds do not establish them.
+
+### First review / CI delta
+
+The first review found that muted text was validated only against its namesake
+muted surface, although host descriptions and statuses also use it on background,
+card and popover surfaces. The validator now checks generic and muted text on
+all neutral surfaces that reuse those tokens. The white-on-white counterexample
+is rejected both by the pure validator and the host catalog. Forest light/dark
+palettes remain valid.
+
+The first exact-head test run `40317690002` failed with 15187 passing tests,
+one failure and 50 skips. Its single failure was the unchanged TERM-SSHD
+concurrent failure-release test expecting a particular invocation to reach OPEN
+first. Both calls perform asynchronous local-file preparation. The test now
+requires exactly one explicit Permission denied result, one successful result
+with matching bytes, and no rejected concurrent handle; it retains concurrency
+without assuming filesystem completion order. No transfer implementation changed.
+The test file's original SHA256 was identical in e5bd294c, 733f44c and fdeeaf74:
+`8b200d9f6a05ac5cd91fe4e0a95ea36a770d22267a6a0162b4c9fc927beb52a7`.
+This is source identity and a source-based ordering diagnosis, not a claim that a
+baseline runtime failure was reproduced locally. The updated test needs the new
+exact-head CI result. That same first run passed the added Vite browser-import
+smoke, resolving the earlier local temp-directory limitation for that head.
+
+### Native security-color delta
+
+Parent native acceptance at f868 verified zero-permission installation/enabling,
+light/dark Preview and Cancel, Apply across main/Settings windows, Restore
+default, restart persistence, and Disable fallback with the unavailable notice.
+The isolated schema-3 profile was not touched. These core results remain valid.
+
+Native QA also found Forest-colored inner New Host cards/inputs/Save and some
+grant-panel text inside an otherwise fixed security container. The cause was
+Tailwind's derived `--color-*` aliases: changing only raw semantic tokens at the
+boundary does not recompute aliases already resolved on an ancestor. The same
+existing security rule now fixes both raw tokens and those color aliases. The
+selector and protected regions are unchanged; ordinary application cards remain
+theme-controlled. No host, credential or grant operation changed.
+
+The regression renders the actual HostDetailsPanel (including General, Address,
+Credentials cards, real Inputs and Save), plus the real grant-panel root. It
+compiles the production Tailwind source, verifies which aliases those utilities
+consume, checks the fixed declarations, and verifies an ordinary card is outside
+the security selector. This is component/compiled-CSS coverage, not a claim of
+native computed-color acceptance. The parent's native color delta remains the
+final visual check. A local Chromium probe aborted because its SUID sandbox was
+not configured; sandboxing was not disabled to retry.

docs/plugin-platform/vault-pages.md

@@ -0,0 +1,80 @@
+# Vault extension pages
+
+`views.vault-pages` adds the `vault-page` view location. A package must require
+the feature and declare the existing `views` permission. Hosts without the
+feature reject the package deterministically. Existing view locations and API
+versions keep their behavior; there is no public plugin router or new Vault
+read/write permission.
+
+## User workflow
+
+Visible, enabled contributions appear in Vault's **Extensions** group. The
+host generates a namespaced route from the declared view ID, orders by declared
+order and ID, localizes the label, and resolves the declared icon through the
+existing safe icon pipeline. Built-in navigation and security entry points
+remain host-owned. Collapsed navigation retains source-labelled accessible
+buttons.
+
+Selecting a page mounts its existing sandbox WebContentsView in the Vault main
+content area. It does not create a top tab, use an aside overlay, open a
+connection, or share host/session/Vault records. The trusted host context
+contains only `netcatty.surface: vault-page`. The manager's existing Open action
+can select the same page through an internal host event; this is not exposed
+as a generic SDK navigation capability.
+
+The `vault-scratchpad` browser example lets the user type synthetic text, save
+it in the plugin's own view state, return to Hosts, reopen, and clear it. It
+does not create a Vault Note or enable automatic cloud sync. The fixture asks
+for only `views`; granting it does not approve another plugin or data access.
+
+## Ownership and lifecycle
+
+The host owns the route and validates the selected contribution against the
+current visible catalog. Missing IDs, disable/uninstall/update, a false `when`,
+failed activation or a host close return to Hosts. Focus restoration checks
+the current section and active tab so an old fallback cannot steal focus after
+a newer selection. Catalog listing does not activate a plugin.
+
+The embedded host reuses PluginViewHost, its ephemeral session, CSP, no-Node
+preload, protocol validation, own-command checks, and bounded own view state.
+No DOM or Electron object enters the SDK. A window-route-and-slot scope separates
+this page's state from other view placements; actual BrowserWindow ownership is
+validated separately and does not rely on that state key. This initial embedded slice
+closes on navigation away even if `retainContextWhenHidden` is declared.
+
+Each opening reserves an instance ID owned by its actual BrowserWindow before
+asynchronous activation. Close can cancel that reservation before native
+construction. Owner closure, shutdown and renderer cleanup prevent a late open
+from attaching; late responses are also closed by the renderer lifecycle
+controller. Current plugin version/runtime and `when` are checked before
+attachment and on subsequent contribution changes. Existing owner checks apply
+to bounds, visibility, close and view-state IPC.
+
+Host reload/renderer exit and a view renderer crash close the associated native
+page. Plain Escape in a Vault page is handled by the host and returns to Hosts;
+it does not dispatch a plugin command or expose a general navigation API.
+
+Native child views sit above React portals. A Vault page starts hidden; the
+trusted renderer reveals it only after checking the mount and host dialogs,
+menus, popovers, overlay panels and lock surfaces. Overlapping host surfaces
+hide the page. App Lock additionally closes all hosted plugin views and
+cancels pending opens in the main process; showing a view while locked fails.
+
+The shared manifest bound remains 128 views per package. Only one Vault page is
+mounted per owner; listing and routing do not create a background view queue.
+View-state JSON size limits and existing runtime/permission quotas remain in
+force. No page text or state is added to audit logs by this adapter.
+
+## Validation status
+
+Source tests cover normal catalog selection, the actual embedded content slot,
+host-modal occlusion, synchronous tab-away cleanup, withdrawn and invalid
+routes, internal host selection, delayed open cancellation, feature/permission
+admission, host ownership, `when` withdrawal and App Lock. Production build,
+aggregate host tests and precise-SHA CI are reported on the accompanying Draft
+PR. Parent native acceptance must use the packed browser example through
+normal Settings and record its exact source SHA/package hash. Unit tests do
+not substitute for that native acceptance.
+
+Terminal sidebar pages and selected-session DTOs remain separate stages. This
+page location does not make those capabilities available.

domain/pluginRuntimePolicy.cjs

@@ -3,6 +3,14 @@
 // Shared by host placement, release admission, and the installed-package UI.
 // A Node entrypoint does not change default placement, but is not admitted to
 // the normal browser-only product path.
+function isStaticThemePack(manifest) {
+  return manifest?.main?.data === "theme" && Object.keys(manifest.main).length === 1
+    && Array.isArray(manifest.contributes?.themes) && manifest.contributes.themes.length > 0
+    && Object.keys(manifest.contributes).every((key) => key === "themes")
+    && !Object.keys(manifest.permissions ?? {}).length && !manifest.activationEvents?.length
+    && !manifest.companionExecutables?.length
+    && manifest.features?.required?.includes("appearance.theme-packs");
+}
 function describePluginRuntime(manifest) {
   const providers = manifest?.contributes?.providers ?? [];
   const permissions = [...(manifest?.permissions?.required ?? []), ...(manifest?.permissions?.optional ?? [])];
@@ -18,19 +26,20 @@ function describePluginRuntime(manifest) {
   const hasNode = Boolean(manifest?.main?.node);
   const defaultRuntimeKind = hasBrowser && !hasCompanions && !hasInterceptors ? "browser" : "utility";
   return {
-    defaultRuntimeKind,
+    defaultRuntimeKind: isStaticThemePack(manifest) ? "data" : defaultRuntimeKind,
+    dataOnly: isStaticThemePack(manifest),
     hasNode,
     declaresAdvanced,
-    browserOnly: hasBrowser && !hasNode && !hasCompanions && !hasInterceptors && !declaresAdvanced,
+    browserOnly: !manifest?.main?.data && hasBrowser && !hasNode && !hasCompanions && !hasInterceptors && !declaresAdvanced,
   };
 }
 
 function assertBrowserOnlyPlugin(manifest) {
-  if (!describePluginRuntime(manifest).browserOnly) {
+  if (!describePluginRuntime(manifest).browserOnly && !isStaticThemePack(manifest)) {
     const error = new Error("This package requires advanced developer mode; normal plugin management accepts browser-only packages");
     error.code = "PLUGIN_UNSUPPORTED_RUNTIME";
     throw error;
   }
 }
 
-module.exports = { describePluginRuntime, assertBrowserOnlyPlugin };
+module.exports = { describePluginRuntime, assertBrowserOnlyPlugin, isStaticThemePack };

domain/pluginRuntimePolicy.test.cjs

@@ -19,3 +19,9 @@ test('normal release admission rejects advanced declarations and privileged prov
   assert.equal(describePluginRuntime(manifest).defaultRuntimeKind, 'utility');
   assert.throws(() => assertBrowserOnlyPlugin(manifest), /developer mode/);
 });
+
+test('normal admission accepts only explicit non-executable theme-only data packages',()=>{
+ const manifest={main:{data:'theme'},features:{required:['appearance.theme-packs']},contributes:{themes:[{id:'com.example.theme.light'}]}};
+ assert.doesNotThrow(()=>assertBrowserOnlyPlugin(manifest));assert.equal(describePluginRuntime(manifest).dataOnly,true);assert.equal(describePluginRuntime(manifest).defaultRuntimeKind,'data');
+ for(const change of [{main:{data:'theme',browser:'index.js'}},{permissions:{required:['network']}},{activationEvents:['onStartupFinished']},{contributes:{themes:[],commands:[]}}])assert.throws(()=>assertBrowserOnlyPlugin({...manifest,...change}),/developer mode/);
+});

domain/pluginThemePack.cjs

@@ -0,0 +1,145 @@
+"use strict";
+// Pure color projection. Package/wire schema validation belongs to the host.
+const LIGHT = Object.freeze({
+  background: "#ffffff",
+  foreground: "#161a1d",
+  card: "#ffffff",
+  cardForeground: "#161a1d",
+  popover: "#ffffff",
+  popoverForeground: "#161a1d",
+  secondary: "#e5e7eb",
+  secondaryForeground: "#161a1d",
+  muted: "#f0f2f4",
+  mutedForeground: "#374151",
+  accent: "#1d4ed8",
+  destructive: "#b91c1c",
+  destructiveForeground: "#ffffff",
+  border: "#6b7280",
+  input: "#6b7280",
+});
+const DARK = Object.freeze({
+  background: "#111827",
+  foreground: "#f9fafb",
+  card: "#1f2937",
+  cardForeground: "#f9fafb",
+  popover: "#1f2937",
+  popoverForeground: "#f9fafb",
+  secondary: "#374151",
+  secondaryForeground: "#ffffff",
+  muted: "#273244",
+  mutedForeground: "#e5e7eb",
+  accent: "#93c5fd",
+  destructive: "#fca5a5",
+  destructiveForeground: "#111827",
+  border: "#9ca3af",
+  input: "#9ca3af",
+});
+function rgb(hex) {
+  return [1, 3, 5].map(
+    (offset) => parseInt(hex.slice(offset, offset + 2), 16) / 255,
+  );
+}
+function luminance(hex) {
+  return rgb(hex)
+    .map((v) => (v <= 0.04045 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4))
+    .reduce((s, v, i) => s + v * [0.2126, 0.7152, 0.0722][i], 0);
+}
+function contrast(a, b) {
+  const x = luminance(a),
+    y = luminance(b);
+  return (Math.max(x, y) + 0.05) / (Math.min(x, y) + 0.05);
+}
+function toHsl(hex) {
+  const [r, g, b] = rgb(hex),
+    max = Math.max(r, g, b),
+    min = Math.min(r, g, b),
+    delta = max - min,
+    l = (max + min) / 2;
+  let h = 0;
+  if (delta)
+    h =
+      (max === r
+        ? ((g - b) / delta + 6) % 6
+        : max === g
+          ? (b - r) / delta + 2
+          : (r - g) / delta + 4) * 60;
+  const s = delta ? delta / (1 - Math.abs(2 * l - 1)) : 0;
+  return `${h.toFixed(3)} ${(s * 100).toFixed(3)}% ${(l * 100).toFixed(3)}%`;
+}
+// A small margin covers rounding when hex colors become HSL CSS components.
+function resolveThemePalette(palette) {
+  const colors = {
+    ...(palette.base === "dark" ? DARK : LIGHT),
+    ...palette.colors,
+  };
+  for (const value of Object.values(colors))
+    if (!/^#[0-9a-f]{6}$/i.test(value)) throw new Error("Invalid theme color");
+  const pairs = [
+    ["foreground", "background"],
+    ["cardForeground", "card"],
+    ["popoverForeground", "popover"],
+    ["secondaryForeground", "secondary"],
+    ["mutedForeground", "muted"],
+    ["destructiveForeground", "destructive"],
+  ];
+  for (const [a, b] of pairs)
+    if (contrast(colors[a], colors[b]) < 4.51)
+      throw new Error("Theme text contrast is below 4.5:1");
+  // Host labels and descriptions reuse these text tokens across neutral
+  // surfaces; they do not always sit on their namesake background token.
+  for (const surface of ["background", "card", "popover", "secondary", "muted"])
+    for (const key of ["foreground", "mutedForeground"])
+      if (contrast(colors[key], colors[surface]) < 4.51)
+        throw new Error("Theme neutral-surface text contrast is below 4.5:1");
+  for (const surface of ["background", "card", "popover"]) {
+    for (const key of ["accent", "destructive"])
+      if (contrast(colors[key], colors[surface]) < 4.51)
+        throw new Error("Theme state contrast is below 4.5:1");
+    for (const key of ["border", "input"])
+      if (contrast(colors[key], colors[surface]) < 3.01)
+        throw new Error("Theme control contrast is below 3:1");
+  }
+  const foreground =
+    contrast(colors.accent, "#000000") >= contrast(colors.accent, "#ffffff")
+      ? "#000000"
+      : "#ffffff";
+  const tokens = Object.fromEntries(
+    Object.entries(colors).map(([k, v]) => [k, toHsl(v)]),
+  );
+  return Object.freeze({
+    ...tokens,
+    primary: tokens.accent,
+    primaryForeground: toHsl(foreground),
+    accentForeground: toHsl(foreground),
+    ring: tokens.accent,
+  });
+}
+function securityThemeTokens(mode, highContrast = false) {
+  const colors = highContrast
+    ? mode === "dark"
+      ? {
+          background: "#000000",
+          card: "#000000",
+          popover: "#000000",
+          foreground: "#ffffff",
+          cardForeground: "#ffffff",
+          popoverForeground: "#ffffff",
+          accent: "#ffff00",
+          border: "#ffffff",
+          input: "#ffffff",
+        }
+      : {
+          background: "#ffffff",
+          card: "#ffffff",
+          popover: "#ffffff",
+          foreground: "#000000",
+          cardForeground: "#000000",
+          popoverForeground: "#000000",
+          accent: "#000080",
+          border: "#000000",
+          input: "#000000",
+        }
+    : {};
+  return resolveThemePalette({ base: mode, colors });
+}
+module.exports = { resolveThemePalette, securityThemeTokens, contrast, toHsl };

domain/pluginThemePack.test.cjs

@@ -0,0 +1,33 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const {
+  resolveThemePalette,
+  securityThemeTokens,
+  contrast,
+} = require("./pluginThemePack.cjs");
+test("opaque accessible palettes derive coupled accent tokens and fixed high contrast fallback", () => {
+  for (const mode of ["light", "dark"]) {
+    const tokens = resolveThemePalette({ base: mode, colors: {} });
+    assert.equal(tokens.primary, tokens.accent);
+    assert.equal(tokens.ring, tokens.accent);
+    assert.equal(tokens.primaryForeground, tokens.accentForeground);
+    assert.ok(securityThemeTokens(mode, true));
+  }
+  assert.ok(contrast("#000000", "#ffffff") > 20);
+  assert.throws(
+    () =>
+      resolveThemePalette({ base: "light", colors: { foreground: "#ffffff" } }),
+    /contrast/,
+  );
+});
+
+test("generic and muted text stay readable on the neutral surfaces that use them", () => {
+  for (const colors of [
+    { muted: "#000000", mutedForeground: "#ffffff" },
+    { card: "#000000", cardForeground: "#ffffff" },
+    { popover: "#000000", popoverForeground: "#ffffff" },
+    { secondary: "#000000", secondaryForeground: "#ffffff" },
+  ]) {
+    assert.throws(() => resolveThemePalette({ base: "light", colors }), /contrast/);
+  }
+});

domain/sidePanelLayout.ts

@@ -1,4 +1,4 @@
-export type SidePanelTool =
+export type BuiltinSidePanelTool =
   | 'sftp'
   | 'browser'
   | 'scripts'
@@ -8,6 +8,12 @@ export type SidePanelTool =
   | 'system'
   | 'notes';
 
+export type SidePanelTool = BuiltinSidePanelTool | `plugin-view:${string}`;
+
+export function isPluginSidePanelTool(value: unknown): value is `plugin-view:${string}` {
+  return typeof value === 'string' && value.length <= 256 && /^plugin-view:[A-Za-z0-9_.-]+$/.test(value);
+}
+
 export type SidePanelSplitDirection = 'horizontal' | 'vertical';
 
 export type SidePanelPaneNode = {

domain/workspaceLayoutPreset.test.ts

@@ -90,6 +90,21 @@ test('sanitize accepts a valid saved preset and rejects malformed data', () => {
   );
 });
 
+test('plugin panes keep split uniqueness and limits; saved routes grant no availability and can be pruned', () => {
+  const tool = 'plugin-view:com.example.plugin.page' as const;
+  let layout = createSidePanelLayout('notes', 'notes');
+  layout = splitSidePanelPane(layout, 'notes', tool, 'vertical', { paneId: 'plugin', splitId: 'root' }, 600);
+  const unique = splitSidePanelPane(layout, 'notes', tool, 'vertical', { paneId: 'duplicate', splitId: 'unused' }, 600);
+  assert.equal(collectSidePanelPanes(unique.root).length, 2);
+  assert.equal(getFocusedSidePanelPane(unique).tool, tool);
+  assert.ok(createWorkspaceLayoutPreset(layout));
+  assert.equal(withoutUnavailableSidePanelTools(layout, (item) => item === 'notes')?.root.type, 'pane');
+  for (let i = 0; i < 10; i++) layout = splitSidePanelPane(layout, getFocusedSidePanelPane(layout).id,
+    `plugin-view:com.example.plugin.page${i}`, 'horizontal', { paneId: `p${i}`, splitId: `s${i}` }, 600);
+  assert.equal(collectSidePanelPanes(layout.root).length, 8);
+  assert.equal(sanitizeWorkspaceLayoutPreset({ version: 1, layout: { root: { id: 'invalid', type: 'pane', tool: 'plugin-view:../outside' }, focusedPaneId: 'invalid' } }), null);
+});
+
 test('sanitize rejects duplicate node ids', () => {
   assert.equal(
     sanitizeWorkspaceLayoutPreset({

domain/workspaceLayoutPreset.ts

@@ -3,6 +3,7 @@ import {
   closeSidePanelPane,
   collectSidePanelPanes,
   getFocusedSidePanelPane,
+  isPluginSidePanelTool,
   type SidePanelLayout,
   type SidePanelLayoutNode,
   type SidePanelTool,
@@ -32,7 +33,7 @@ const SIDE_PANEL_TOOLS: ReadonlySet<SidePanelTool> = new Set([
 ]);
 
 function isSidePanelTool(value: unknown): value is SidePanelTool {
-  return typeof value === 'string' && SIDE_PANEL_TOOLS.has(value as SidePanelTool);
+  return typeof value === 'string' && (SIDE_PANEL_TOOLS.has(value as SidePanelTool) || isPluginSidePanelTool(value));
 }
 
 function sanitizeSidePanelLayoutNode(

electron-builder.config.cjs

@@ -70,6 +70,7 @@ module.exports = {
         'domain/terminalPromptSecurity.shared.cjs',
         'domain/pluginRuntimePolicy.cjs',
         'domain/pluginPermissionDescriptions.cjs',
+        'domain/pluginThemePack.cjs',
         // Main-process SSH, SFTP, and port-forward bridges share this matcher.
         // TypeScript under domain/ is excluded below, so the .cjs must be listed.
         'domain/systemManager/containerRuntime.shared.cjs',

electron/bridges/transferBridge.termSshd.test.cjs

@@ -311,7 +311,7 @@ test("TERM-SSHD queued cancellation releases its turn without closing the owner
   assert.equal(transferBridge._getSessionFastDownloadWaiterCountForTests(fixture.sftp), 0);
 });
 
-test("TERM-SSHD failed transfer releases the physical channel for the next alias", async (t) => {
+test("TERM-SSHD failed transfer releases the physical channel for the next alias", { timeout: 5_000 }, async (t) => {
   const fixture = await createSequentialTransferFixture(t);
   const originalOpen = fixture.sftp.open;
   let rejectFirst = true;
@@ -321,10 +321,16 @@ test("TERM-SSHD failed transfer releases the physical channel for the next alias
       args.at(-1)(Object.assign(new Error("Permission denied"), { code: 3 }));
     } else originalOpen(...args);
   };
-  const [first, next] = await Promise.all([fixture.start("download"), fixture.start("download", "alias")]);
-  assert.match(first.result.error || "", /Permission denied/);
-  assert.equal(next.result.error, undefined);
-  assert.deepEqual(await fs.readFile(next.targetPath), fixture.payload);
+  const transfers = await Promise.all([fixture.start("download"), fixture.start("download", "alias")]);
+  // Both calls await local file preparation before acquiring the shared channel.
+  // Either invocation may reach the injected first OPEN failure; retain the
+  // concurrent release check without assuming filesystem completion order.
+  const failed = transfers.filter((transfer) => transfer.result.error !== undefined);
+  const succeeded = transfers.filter((transfer) => transfer.result.error === undefined);
+  assert.equal(failed.length, 1);
+  assert.equal(succeeded.length, 1);
+  assert.match(failed[0].result.error, /Permission denied/);
+  assert.deepEqual(await fs.readFile(succeeded[0].targetPath), fixture.payload);
   assert.equal(fixture.rejectedOpens(), 0);
 });
 

electron/main/registerBridges.cjs

@@ -244,6 +244,8 @@ function createBridgeRegistrar(context) {
       },
       resolveBrandIcon: (pluginId) => pluginHostService?.contributionIconService?.resolveBrand(pluginId),
       resolveContributionIcon: (payload) => pluginHostService?.contributionIconService?.resolve(payload),
+      themeService: pluginHostService?.themeService,
+      logService: pluginHostService?.logService,
       viewHost: pluginHostService?.viewHost,
       env: process.env,
       isTrustedSender: createTrustedPluginBridgeSender({ devServerUrl: effectiveDevServerUrl }),

electron/plugins/database.cjs

@@ -5,10 +5,11 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { DatabaseSync } = require("node:sqlite");
 
-const SCHEMA_VERSION = 3;
+const SCHEMA_VERSION = 4;
 const MAX_SECURITY_AUDIT_DETAILS_BYTES = 16 * 1024;
 const MAX_SECURITY_AUDIT_RECORDS_PER_PLUGIN = 1_000;
 const REQUIRED_SCHEMA_COLUMNS = Object.freeze({
+  plugin_host_preferences: ["key", "value_json", "updated_at"],
   plugins: ["id", "enabled", "active_version", "installed_at", "updated_at"],
   plugin_versions: ["plugin_id", "version", "manifest_json", "archive_sha256", "package_relative_path", "installed_at"],
   plugin_runtime_state: ["plugin_id", "plugin_version", "status", "runtime_kind", "last_error", "quarantined_at", "updated_at"],
@@ -212,6 +213,10 @@ class PluginDatabase {
         `);
       });
     }
+    if (version <= 3) this.transaction(() => this.db.exec(`
+      CREATE TABLE plugin_host_preferences (key TEXT PRIMARY KEY, value_json TEXT NOT NULL, updated_at INTEGER NOT NULL);
+      PRAGMA user_version = 4;
+    `));
     this.#assertSchemaLayout();
     // Legacy-map backfill is deferred until PackageStore.recover() has finished
     // (hostService seeds after package initialize). Running here would promote
@@ -1030,18 +1035,34 @@ class PluginDatabase {
         sha256: createHash("sha256").update(detailsJson).digest("hex"),
       });
     }
+    this.transaction(() => this.#appendSecurityAudit(pluginId, event, detailsJson));
+  }
+
+  #appendSecurityAudit(pluginId, event, detailsJson) {
+    this.db.prepare(`
+      INSERT INTO plugin_security_audit(plugin_id, event, details_json, created_at)
+      VALUES (?, ?, ?, ?)
+    `).run(pluginId, event, detailsJson, this.clock());
+    this.db.prepare(`
+      DELETE FROM plugin_security_audit
+      WHERE plugin_id = ? AND id NOT IN (
+        SELECT id FROM plugin_security_audit
+        WHERE plugin_id = ? ORDER BY id DESC LIMIT ${MAX_SECURITY_AUDIT_RECORDS_PER_PLUGIN}
+      )
+    `).run(pluginId, pluginId);
+  }
+
+  getHostThemeSelection() {
+    const row = this.db.prepare("SELECT value_json FROM plugin_host_preferences WHERE key = 'theme'").get();
+    return row ? parseJson(row.value_json, "host theme selection") : {formatVersion: 1, revision: 0, light: null, dark: null};
+  }
+
+  commitHostThemeSelection(expectedRevision, selection, pluginId) {
     this.transaction(() => {
-      this.db.prepare(`
-        INSERT INTO plugin_security_audit(plugin_id, event, details_json, created_at)
-        VALUES (?, ?, ?, ?)
-      `).run(pluginId, event, detailsJson, this.clock());
-      this.db.prepare(`
-        DELETE FROM plugin_security_audit
-        WHERE plugin_id = ? AND id NOT IN (
-          SELECT id FROM plugin_security_audit
-          WHERE plugin_id = ? ORDER BY id DESC LIMIT ${MAX_SECURITY_AUDIT_RECORDS_PER_PLUGIN}
-        )
-      `).run(pluginId, pluginId);
+      if (this.getHostThemeSelection().revision !== expectedRevision) throw new Error("Theme selection changed; refresh before applying");
+      this.db.prepare("INSERT INTO plugin_host_preferences(key,value_json,updated_at) VALUES('theme',?,?) ON CONFLICT(key) DO UPDATE SET value_json=excluded.value_json,updated_at=excluded.updated_at")
+        .run(JSON.stringify(selection), this.clock());
+      this.#appendSecurityAudit(pluginId ?? "$host.appearance", "theme-selection", JSON.stringify({revision:selection.revision, action:pluginId ? "apply" : "restore"}));
     });
   }
 

electron/plugins/filesystemBroker.cjs

@@ -187,6 +187,8 @@ function assertSameOpenedDirectory(expectedStats, pathStats) {
 class PluginFilesystemBroker {
   constructor(options = {}) {
     this.quotaManager = options.quotaManager ?? null;
+    this.protectedDirectories = options.protectedDirectories ?? [];
+    this.protectedFiles = options.protectedFiles ?? [];
     this.fileSystem = options.fileSystem ?? fsp;
     this.openDirectoryHandle = options.openDirectoryHandle ?? null;
     if (this.openDirectoryHandle != null && typeof this.openDirectoryHandle !== "function") {
@@ -261,10 +263,33 @@ class PluginFilesystemBroker {
     }
   }
 
+  async #assertWritable(canonical) {
+    const variants = async (entry) => {
+      const lexical = path.resolve(entry);
+      try { return [lexical, await this.fileSystem.realpath(lexical)]; }
+      catch (error) { if (error?.code !== "ENOENT") throw error; return [lexical]; }
+    };
+    for (const file of this.protectedFiles) {
+      if ((await variants(file)).includes(canonical)) {
+        throw new PluginRpcError(RPC_ERRORS.permissionDenied, "Host audit storage is protected");
+      }
+    }
+    for (const directory of this.protectedDirectories) {
+      for (const parent of await variants(directory)) {
+        const relative = path.relative(parent, canonical);
+        if (relative === "" || (!path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`))) {
+          throw new PluginRpcError(RPC_ERRORS.permissionDenied, "Host audit storage is protected");
+        }
+      }
+    }
+  }
+
   async writeFile(params, context) {
     const value = assertSecureWriteMode(assertWriteParams(params));
+    await this.#assertWritable(path.resolve(value.path));
     assertAuthorizedPath(context, "filesystem.write", value.path);
     const { canonical, stats } = await resolveWritePath(value.path, this.fileSystem);
+    await this.#assertWritable(canonical);
     assertAuthorizedPath(context, "filesystem.write", canonical);
     this.quotaManager?.chargeBytes(context.runtimeId, "filesystem", value.bytes.byteLength);
     await context.assertActive();
@@ -278,6 +303,7 @@ class PluginFilesystemBroker {
       ]);
       assertSameOpenedFile(openedStats, stats);
       assertSameOpenedFile(openedStats, pathStats);
+      await this.#assertWritable(canonical);
       await context.assertActive();
       if (value.overwrite) await handle.truncate(0);
       await handle.writeFile(value.bytes);

electron/plugins/filesystemBroker.test.cjs

@@ -390,3 +390,61 @@ test("filesystem broker rejects oversized and non-canonical payloads", async (co
     (error) => error.code === RPC_ERRORS.resourceExhausted,
   );
 });
+
+test("plugin writes cannot modify host audit files or preferences, including symlink aliases", async (t) => {
+  const root = createRoot(t);
+  const directory = path.join(root, "host-logs");
+  await fsp.mkdir(directory);
+  const audit = path.join(directory, "runtime.jsonl");
+  const preferences = path.join(root, "local-logging.json");
+  await fsp.writeFile(audit, "host audit");
+  await fsp.writeFile(preferences, "host preferences");
+  const alias = path.join(root, "alias");
+  await fsp.symlink(audit, alias);
+  const broker = new PluginFilesystemBroker({ protectedDirectories: [directory], protectedFiles: [preferences] });
+  for (const target of [audit, preferences, alias]) {
+    const authorization = broker.describeWriteAuthorization({ path: target, data: "overwrite", overwrite: true });
+    await assert.rejects(broker.writeFile({ path: target, data: "overwrite", overwrite: true }, runtimeContext(authorization)), { code: RPC_ERRORS.permissionDenied });
+  }
+  assert.equal(await fsp.readFile(audit, "utf8"), "host audit");
+  assert.equal(await fsp.readFile(preferences, "utf8"), "host preferences");
+});
+
+test("host audit protection resolves a symlinked userData directory", async (t) => {
+  const root = createRoot(t);
+  const actual = path.join(root, "actual-profile");
+  await fsp.mkdir(path.join(actual, "logs"), { recursive: true });
+  const profileAlias = path.join(root, "profile-alias");
+  await fsp.symlink(actual, profileAlias);
+  const target = path.join(actual, "logs", "runtime.jsonl");
+  await fsp.writeFile(target, "host audit");
+  const broker = new PluginFilesystemBroker({ protectedDirectories: [path.join(profileAlias, "logs")] });
+  const params = { path: target, data: "overwrite", overwrite: true };
+  const authorization = broker.describeWriteAuthorization(params);
+  await assert.rejects(broker.writeFile(params, runtimeContext(authorization)), { code: RPC_ERRORS.permissionDenied });
+  assert.equal(await fsp.readFile(target, "utf8"), "host audit");
+});
+
+test("revocation during the protected-storage check cannot write an unrelated granted file", async (t) => {
+  const root = createRoot(t);
+  const logs = path.join(root, "host-logs");
+  const target = path.join(root, "synthetic.txt");
+  await fsp.mkdir(logs);
+  await fsp.writeFile(target, "prior");
+  let checks = 0;
+  let active = true;
+  const broker = new PluginFilesystemBroker({ protectedDirectories: [logs], fileSystem: {
+    ...fsp, async realpath(requested) {
+      const canonical = await fsp.realpath(requested);
+      if (requested === logs && ++checks === 3) active = false;
+      return canonical;
+    },
+  } });
+  const params = { path: target, data: "overwrite", overwrite: true };
+  const authorization = broker.describeWriteAuthorization(params);
+  const context = { ...runtimeContext(authorization), async assertActive() {
+    if (!active) throw Object.assign(new Error("synthetic revocation"), { code: RPC_ERRORS.permissionDenied });
+  } };
+  await assert.rejects(broker.writeFile(params, context), { code: RPC_ERRORS.permissionDenied });
+  assert.equal(await fsp.readFile(target, "utf8"), "prior");
+});

electron/plugins/fixtures/local-logging-plugin/index.js

@@ -0,0 +1,38 @@
+import { definePlugin } from "@netcatty/plugin-sdk";
+
+export default definePlugin({
+  activate(context) {
+    const register = (suffix, handler) => context.subscriptions.add(context.commands.registerCommand(
+      `com.example.local-logging-fixture.${suffix}`, handler,
+    ));
+    register("emit", () => {
+      context.logger.info("Synthetic diagnostic for local logging QA", {
+        apiKey: "SYNTHETIC-API-KEY-NOT-A-CREDENTIAL",
+        prompt: "SYNTHETIC-PROMPT-BODY",
+        Notes: "SYNTHETIC-NOTE-BODY",
+        SQL: "SYNTHETIC-SQL-BODY",
+        results: "SYNTHETIC-RESULT-BODY",
+        terminalContent: "SYNTHETIC-TERMINAL-BODY",
+        pluginId: "synthetic-spoofed-plugin",
+        sourceId: "official",
+        runtimeId: "synthetic-spoofed-runtime",
+      });
+      return { ok: true, synthetic: true };
+    });
+    register("noise", () => {
+      for (let index = 0; index < 400; index++) console.info(`Synthetic diagnostic burst ${index}`);
+      return { ok: true, synthetic: true, emitted: 400 };
+    });
+    register("denied", async () => {
+      // No network permission is declared. The host must reject before any
+      // network I/O or approval prompt; no body or credential is ever supplied.
+      try {
+        await context.network.request({ method: "GET", url: "https://logging-fixture.example.com/should-never-be-sent" });
+        throw new Error("Synthetic undeclared request unexpectedly succeeded");
+      } catch (error) {
+        if (error?.code !== "permission_denied" && error?.code !== -32007) throw error;
+        return { denied: true, synthetic: true };
+      }
+    });
+  },
+});

electron/plugins/fixtures/local-logging-plugin/netcatty.plugin.json

@@ -0,0 +1,29 @@
+{
+  "manifestVersion": 1,
+  "id": "com.example.local-logging-fixture",
+  "name": "local-logging-fixture",
+  "displayName": "Synthetic local logging fixture",
+  "description": "Synthetic diagnostics and denied-operation checks. No real data or credentials.",
+  "version": "0.1.0",
+  "publisher": "example",
+  "engines": { "netcatty": ">=0.0.0", "api": ">=0.1.0-internal <0.2.0" },
+  "main": { "browser": "index.js" },
+  "activationEvents": [
+    "onCommand:com.example.local-logging-fixture.emit",
+    "onCommand:com.example.local-logging-fixture.noise",
+    "onCommand:com.example.local-logging-fixture.denied"
+  ],
+  "permissions": { "required": ["commands", "menus"], "optional": [] },
+  "contributes": {
+    "commands": [
+      { "id": "com.example.local-logging-fixture.emit", "title": "Emit synthetic diagnostic", "category": "Logging QA" },
+      { "id": "com.example.local-logging-fixture.noise", "title": "Emit synthetic diagnostic burst", "category": "Logging QA" },
+      { "id": "com.example.local-logging-fixture.denied", "title": "Test undeclared network denial", "category": "Logging QA" }
+    ],
+    "menus": [
+      { "command": "com.example.local-logging-fixture.emit", "location": "commandPalette" },
+      { "command": "com.example.local-logging-fixture.noise", "location": "commandPalette" },
+      { "command": "com.example.local-logging-fixture.denied", "location": "commandPalette" }
+    ]
+  }
+}

electron/plugins/generated/plugin-contract.schema.json

@@ -902,10 +902,27 @@
         },
         "node": {
           "$ref": "#/$defs/RelativePackagePath"
+        },
+        "data": {
+          "const": "theme"
         }
       },
       "minProperties": 1,
-      "additionalProperties": false
+      "additionalProperties": false,
+      "if": {
+        "required": [
+          "data"
+        ],
+        "type": "object",
+        "properties": {
+          "data": {
+            "const": "theme"
+          }
+        }
+      },
+      "then": {
+        "maxProperties": 1
+      }
     },
     "PluginEngines": {
       "type": "object",
@@ -1293,9 +1310,34 @@
         "panel",
         "tab",
         "modal",
-        "settings"
+        "settings",
+        "vault-page",
+        "terminal-sidebar"
       ]
     },
+    "VaultPagesFeature": {
+      "const": "views.vault-pages"
+    },
+    "TerminalSidebarFeature": {
+      "const": "views.terminal-sidebar"
+    },
+    "PluginViewFocusEvent": {
+      "type": "object",
+      "required": [
+        "instanceId"
+      ],
+      "properties": {
+        "instanceId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        }
+      },
+      "additionalProperties": false
+    },
+    "PluginViewFocusRequest": {
+      "$ref": "#/$defs/PluginViewFocusEvent"
+    },
     "ViewContribution": {
       "type": "object",
       "required": [
@@ -3270,6 +3312,14 @@
     "PluginContributions": {
       "type": "object",
       "properties": {
+        "themes": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "$ref": "#/$defs/ThemePackContribution"
+          },
+          "minItems": 1
+        },
         "settings": {
           "type": "array",
           "maxItems": 512,
@@ -3432,7 +3482,51 @@
           }
         }
       },
-      "additionalProperties": false
+      "additionalProperties": false,
+      "if": {
+        "properties": {
+          "main": {
+            "required": [
+              "data"
+            ],
+            "type": "object",
+            "properties": {
+              "data": {
+                "const": "theme"
+              }
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "contributes": {
+            "required": [
+              "themes"
+            ],
+            "maxProperties": 1,
+            "type": "object",
+            "properties": {
+              "themes": true
+            }
+          },
+          "permissions": {
+            "maxProperties": 0,
+            "type": "object"
+          },
+          "activationEvents": {
+            "maxItems": 0,
+            "type": "array"
+          },
+          "companionExecutables": {
+            "maxItems": 0,
+            "type": "array"
+          }
+        },
+        "required": [
+          "contributes"
+        ]
+      }
     },
     "RpcId": {
       "oneOf": [
@@ -4747,6 +4841,328 @@
           "additionalProperties": false
         }
       ]
+    },
+    "ThemePackFeature": {
+      "const": "appearance.theme-packs"
+    },
+    "ThemePackLimits": {
+      "const": {
+        "jsonBytes": 65536,
+        "catalogEntries": 256,
+        "themesPerPackage": 32
+      }
+    },
+    "ThemePackVariant": {
+      "type": "string",
+      "enum": [
+        "light",
+        "dark"
+      ]
+    },
+    "ThemePackContribution": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/ContributionId"
+        },
+        "label": {
+          "$ref": "#/$defs/LocalizedText"
+        },
+        "variant": {
+          "$ref": "#/$defs/ThemePackVariant"
+        },
+        "entry": {
+          "$ref": "#/$defs/RelativePackagePath"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "label",
+        "variant",
+        "entry"
+      ]
+    },
+    "ThemePackColors": {
+      "type": "object",
+      "properties": {
+        "background": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "foreground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "card": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "cardForeground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "popover": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "popoverForeground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "secondary": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "secondaryForeground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "muted": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "mutedForeground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "accent": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "destructive": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "destructiveForeground": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "border": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        },
+        "input": {
+          "type": "string",
+          "pattern": "^#[0-9A-Fa-f]{6}$"
+        }
+      },
+      "additionalProperties": false,
+      "minProperties": 1
+    },
+    "ThemePackPalette": {
+      "type": "object",
+      "properties": {
+        "formatVersion": {
+          "const": 1
+        },
+        "base": {
+          "type": "string",
+          "enum": [
+            "light",
+            "dark"
+          ]
+        },
+        "colors": {
+          "$ref": "#/$defs/ThemePackColors"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "formatVersion",
+        "base",
+        "colors"
+      ]
+    },
+    "ThemePackReference": {
+      "type": "object",
+      "properties": {
+        "pluginId": {
+          "$ref": "#/$defs/PluginId"
+        },
+        "themeId": {
+          "$ref": "#/$defs/ContributionId"
+        },
+        "version": {
+          "$ref": "#/$defs/SemanticVersion"
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "variant": {
+          "$ref": "#/$defs/ThemePackVariant"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "pluginId",
+        "themeId",
+        "version",
+        "digest",
+        "variant"
+      ]
+    },
+    "ThemePackChoice": {
+      "type": "object",
+      "properties": {
+        "ref": {
+          "$ref": "#/$defs/ThemePackReference"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "ref"
+      ]
+    },
+    "ThemePackSelection": {
+      "type": "object",
+      "properties": {
+        "formatVersion": {
+          "const": 1
+        },
+        "revision": {
+          "$ref": "#/$defs/SafeUnsignedInteger"
+        },
+        "light": {
+          "oneOf": [
+            {
+              "$ref": "#/$defs/ThemePackChoice"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "dark": {
+          "oneOf": [
+            {
+              "$ref": "#/$defs/ThemePackChoice"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "formatVersion",
+        "revision",
+        "light",
+        "dark"
+      ]
+    },
+    "ThemePackApplyRequest": {
+      "type": "object",
+      "properties": {
+        "expectedRevision": {
+          "$ref": "#/$defs/SafeUnsignedInteger"
+        },
+        "mode": {
+          "type": "string",
+          "enum": [
+            "light",
+            "dark"
+          ]
+        },
+        "choice": {
+          "oneOf": [
+            {
+              "$ref": "#/$defs/ThemePackChoice"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "expectedRevision",
+        "mode",
+        "choice"
+      ]
+    },
+    "ThemePackEntry": {
+      "type": "object",
+      "properties": {
+        "ref": {
+          "$ref": "#/$defs/ThemePackReference"
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "pluginName": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "dataOnly": {
+          "type": "boolean"
+        },
+        "palette": {
+          "$ref": "#/$defs/ThemePackPalette"
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "ref",
+        "label",
+        "pluginName",
+        "dataOnly",
+        "palette"
+      ]
+    },
+    "ThemePackCatalog": {
+      "type": "object",
+      "properties": {
+        "selection": {
+          "$ref": "#/$defs/ThemePackSelection"
+        },
+        "entries": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/ThemePackEntry"
+          }
+        },
+        "diagnostics": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "properties": {
+              "pluginId": {
+                "$ref": "#/$defs/PluginId"
+              },
+              "themeId": {
+                "type": "string",
+                "maxLength": 192
+              },
+              "code": {
+                "type": "string",
+                "enum": [
+                  "invalid",
+                  "unavailable",
+                  "capacity"
+                ]
+              }
+            },
+            "additionalProperties": false,
+            "required": [
+              "pluginId",
+              "code"
+            ]
+          }
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "selection",
+        "entries",
+        "diagnostics"
+      ]
     }
   }
 }

electron/plugins/hostRpcRegistry.cjs

@@ -175,45 +175,73 @@ class PluginHostRpcRegistry {
         await assertCurrent?.();
         transportContext.signal?.throwIfAborted();
       };
-      await assertActive();
-      const validatedParams = registration.validateParams
-        ? registration.validateParams(params)
-        : params;
-      if (validatedParams && typeof validatedParams.then === "function") {
-        throw new TypeError("Plugin host RPC parameter validators must be synchronous");
-      }
-      const authorizationContext = Object.freeze({
-        ...transportContext,
-        ...identity,
-        assertActive,
-        kind,
-        method,
-        metadata: registration.metadata,
-        params: validatedParams,
-      });
-      const resolvedAuthorization = typeof registration.authorization === "function"
-        ? await registration.authorization(validatedParams, authorizationContext)
-        : registration.authorization;
-      const authorization = resolvedAuthorization == null
-        ? null
-        : cloneAndFreezeMetadata(resolvedAuthorization);
-      await assertActive();
-      const context = Object.freeze({
-        ...authorizationContext,
-        authorization,
-      });
-      let index = -1;
-      const dispatch = async (nextIndex) => {
-        if (nextIndex <= index) throw new Error("Plugin host RPC middleware called next() more than once");
-        index = nextIndex;
-        const current = middleware[nextIndex];
-        if (current) return current(context, () => dispatch(nextIndex + 1));
+      const startedAt = Date.now();
+      let authorizationOutcome = "not-reached";
+      let auditResources;
+      let auditResult;
+      let auditError;
+      try {
         await assertActive();
-        return registration.handler(validatedParams, context);
-      };
-      const result = await dispatch(0);
-      await assertActive();
-      return result;
+        const validatedParams = registration.validateParams
+          ? registration.validateParams(params)
+          : params;
+        if (validatedParams && typeof validatedParams.then === "function") {
+          throw new TypeError("Plugin host RPC parameter validators must be synchronous");
+        }
+        const authorizationContext = Object.freeze({
+          ...transportContext,
+          ...identity,
+          assertActive,
+          kind,
+          method,
+          metadata: registration.metadata,
+          recordAuthorization: (outcome) => {
+            if (["allowed", "denied", "not-required"].includes(outcome)) authorizationOutcome = outcome;
+          },
+          params: validatedParams,
+        });
+        const resolvedAuthorization = typeof registration.authorization === "function"
+          ? await registration.authorization(validatedParams, authorizationContext)
+          : registration.authorization;
+        const authorization = resolvedAuthorization == null
+          ? null
+          : cloneAndFreezeMetadata(resolvedAuthorization);
+        auditResources = authorization?.resources;
+        await assertActive();
+        const context = Object.freeze({
+          ...authorizationContext,
+          authorization,
+        });
+        let index = -1;
+        const dispatch = async (nextIndex) => {
+          if (nextIndex <= index) throw new Error("Plugin host RPC middleware called next() more than once");
+          index = nextIndex;
+          const current = middleware[nextIndex];
+          if (current) return current(context, () => dispatch(nextIndex + 1));
+          await assertActive();
+          return registration.handler(validatedParams, context);
+        };
+        const result = await dispatch(0);
+        await assertActive();
+        auditResult = result;
+        return result;
+      } catch (error) {
+        auditError = error;
+        throw error;
+      } finally {
+        // Never record params, handler results, error messages or plugin text.
+        const dataBytes = (value) => {
+          if (typeof value === "string") return Buffer.byteLength(value);
+          if (Buffer.isBuffer(value) || value instanceof Uint8Array) return value.byteLength;
+          return null;
+        };
+        const field = (value, key) => value && typeof value === "object"
+          ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+        try { identity.logger?.audit?.({ operation: method, resources: auditResources,
+          authorization: authorizationOutcome, result: auditError ? "error" : "ok",
+          errorCode: auditError?.code, durationMs: Date.now() - startedAt,
+          inputBytes: dataBytes(field(params, "data")), outputBytes: dataBytes(field(auditResult, "data")) }); } catch {}
+      }
     };
     const requestHandlers = Object.freeze(Object.fromEntries(
       [...this.requests].map(([method, registration]) => [

electron/plugins/hostService.cjs

@@ -1,7 +1,11 @@
 "use strict";
 
 const path = require("node:path");
+const { PluginLogService } = require("./pluginLogService.cjs");
+const { createPluginLogProvenanceResolver } = require("./pluginLogProvenance.cjs");
 const NETWORK_CREDENTIAL_LEASE_FEATURE = require("./generated/plugin-contract.schema.json").$defs.NetworkCredentialLeaseFeature.const;
+const VAULT_PAGES_FEATURE = require("./generated/plugin-contract.schema.json").$defs.VaultPagesFeature.const;
+const TERMINAL_SIDEBAR_FEATURE = require("./generated/plugin-contract.schema.json").$defs.TerminalSidebarFeature.const;
 const INTERACTIVE_COMMAND_FEATURE = require("./generated/plugin-contract.schema.json").$defs.InteractiveCommandFeature.const;
 
 const { assertBrowserOnlyPlugin } = require("../../domain/pluginRuntimePolicy.cjs");
@@ -20,6 +24,7 @@ const {
   normalizePluginModuleResources,
 } = require("./moduleResources.cjs");
 const { RegistryCatalogService } = require("./registryCatalogService.cjs");
+const { PluginThemeService } = require("./themeService.cjs");
 const { PackageStore } = require("./packageStore.cjs");
 const { createPluginPaths } = require("./paths.cjs");
 const { PluginManager } = require("./pluginManager.cjs");
@@ -34,6 +39,7 @@ const {
   resolveDefaultRuntimeKind,
 } = require("./runtimeSupervisor.cjs");
 const { PluginQuotaManager } = require("./quotaManager.cjs");
+const { RPC_ERRORS } = require("./rpcRouter.cjs");
 const { registerSecurePluginCapabilities } = require("./secureCapabilities.cjs");
 const { PluginSecretStore } = require("./secretStore.cjs");
 const { SecretLeaseStore } = require("./secretLease.cjs");
@@ -89,6 +95,7 @@ function createPluginHostService(options) {
   const runtimeDirectory = options.runtimeDirectory ?? path.join(__dirname, "runtime");
   const database = new PluginDatabase(paths.database);
   let interactionService;
+  const logService = new PluginLogService({ paths, electron: options.electron, resolveProvenance: options.resolvePluginProvenance ?? createPluginLogProvenanceResolver(database) });
   try {
     const packageStore = new PackageStore({
       allowAdvancedPlugins,
@@ -96,7 +103,7 @@ function createPluginHostService(options) {
       database,
       netcattyVersion: options.app.getVersion(),
       apiVersion: PLUGIN_API_VERSION,
-      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
+      supportedFeatures: [...new Set(["appearance.theme-packs", "metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, VAULT_PAGES_FEATURE, TERMINAL_SIDEBAR_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
     });
     const contributionIconService = new PluginContributionIconService({
       database,
@@ -136,6 +143,8 @@ function createPluginHostService(options) {
     const filesystemBroker = new PluginFilesystemBroker({
       quotaManager,
       openDirectoryHandle: options.openPluginDirectoryHandle,
+      protectedDirectories: [paths.logs],
+      protectedFiles: [logService.preferencesPath, `${logService.preferencesPath}.tmp`],
     });
     const networkBroker = new PluginNetworkBroker({
       fetch: options.fetch ?? (options.electron.net?.fetch
@@ -202,25 +211,36 @@ function createPluginHostService(options) {
         || !context.availableKinds.includes(kind)
       ) throw new Error(`Plugin runtime selection is unavailable: ${String(kind)}`);
       if (!allowAdvancedPlugins && kind !== "browser") throw new Error("Advanced plugin runtime requires developer mode");
-      await permissionEngine.authorizeRequired(context.plugin, {
-        securityPrincipal: context.securityPrincipal,
-        signal: context.signal,
-        skipPermissions: ["runtime.advanced"],
-      });
-      if (kind === "utility") {
-        await permissionEngine.authorize({
-          pluginId: context.plugin.id,
-          pluginVersion: context.plugin.activeVersion,
-          runtimeId: null,
-          manifest: context.plugin.manifest,
+      try {
+        await permissionEngine.authorizeRequired(context.plugin, {
           securityPrincipal: context.securityPrincipal,
           signal: context.signal,
-        }, {
-          permission: "runtime.advanced",
-          resources: ["*"],
-          reason: "Start an advanced runtime with full Node, filesystem, and network authority",
-          operationId: `runtime.advanced:${context.plugin.activeVersion}`,
+          skipPermissions: ["runtime.advanced"],
         });
+        if (kind === "utility") {
+          await permissionEngine.authorize({
+            pluginId: context.plugin.id,
+            pluginVersion: context.plugin.activeVersion,
+            runtimeId: null,
+            manifest: context.plugin.manifest,
+            securityPrincipal: context.securityPrincipal,
+            signal: context.signal,
+          }, {
+            permission: "runtime.advanced",
+            resources: ["*"],
+            reason: "Start an advanced runtime with full Node, filesystem, and network authority",
+            operationId: `runtime.advanced:${context.plugin.activeVersion}`,
+          });
+        }
+      } catch (error) {
+        const identity = logService.identity({
+          pluginId: context.plugin.id, pluginVersion: context.plugin.activeVersion,
+          runtimeId: null, runtimeKind: kind, securityPrincipal: context.securityPrincipal,
+        }, context.plugin);
+        logService.audit(identity, { operation: "runtime.authorization", result: "error",
+          authorization: error?.code === RPC_ERRORS.permissionDenied ? "denied" : "unknown",
+          errorCode: error?.code });
+        throw error;
       }
       return kind;
     };
@@ -230,13 +250,14 @@ function createPluginHostService(options) {
     };
     runtimeSupervisor = new RuntimeSupervisor({
       electron: options.electron,
+      logService,
       database,
       packageStore,
       protocol,
       paths,
       netcattyVersion: options.app.getVersion(),
       apiVersion: PLUGIN_API_VERSION,
-      supportedFeatures: [...new Set(["metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
+      supportedFeatures: [...new Set(["appearance.theme-packs", "metadata.brand-icon", NETWORK_CREDENTIAL_LEASE_FEATURE, HOST_INTERACTION_FEATURE, VAULT_PAGES_FEATURE, TERMINAL_SIDEBAR_FEATURE, INTERACTIVE_COMMAND_FEATURE, ...(options.supportedFeatures ?? [])])],
       runtimeDirectory,
       appRoot,
       rpcRegistry,
@@ -253,6 +274,16 @@ function createPluginHostService(options) {
       utilityModuleMappings: options.utilityModuleMappings ?? createUtilityModuleMappings(moduleResources),
     });
     runtimeSupervisor.onDidChangeRuntime((event) => contributionService.onRuntimeStateChanged(event));
+    permissionEngine.onDidRevoke((event) => {
+      const plugin = database.getActivePlugin(event.pluginId);
+      const identity = runtimeSupervisor.getRuntimeIdentity(event.pluginId) ?? {
+        pluginId: event.pluginId, pluginVersion: plugin?.activeVersion,
+      };
+      logService.audit(logService.identity(identity, plugin), {
+        operation: "permission.revoked", authorization: "not-required", result: "ok",
+        resources: event.resource ? [event.resource] : [],
+      });
+    });
     const terminalProviderService = new PluginTerminalProviderService({
       contributionService,
       permissionEngine,
@@ -364,8 +395,11 @@ function createPluginHostService(options) {
           packageStore,
           database,
           contributionService,
+          isLocked: options.isAppLocked,
+          subscribeLock: options.subscribeAppLock,
         })
       : null;
+    const themeService = new PluginThemeService({database,packageStore,contributionService});
     const manager = new PluginManager({
       permissionEngine,
       database,
@@ -373,18 +407,25 @@ function createPluginHostService(options) {
       runtimeSupervisor,
       contributionService,
       beforeClose: async () => {
-        interactionService.shutdown();
-        terminalDataPipelineService?.shutdown();
-        extensionProviderService.shutdown();
-        credentialResolver.shutdown?.();
-        await viewHost?.shutdown();
-        await companionSupervisor.shutdown();
-        leaseStore.shutdown();
-        permissionEngine.shutdown();
-        quotaManager.shutdown();
+        try {
+          themeService.shutdown();
+          interactionService.shutdown();
+          terminalDataPipelineService?.shutdown();
+          extensionProviderService.shutdown();
+          credentialResolver.shutdown?.();
+          await viewHost?.shutdown();
+          await companionSupervisor.shutdown();
+          leaseStore.shutdown();
+          permissionEngine.shutdown();
+          quotaManager.shutdown();
+        } finally {
+          await logService.close();
+        }
       },
     });
     return {
+      logService,
+      themeService,
       interactionService,
       catalogService: new RegistryCatalogService({ manager, fetch: options.electron.net?.fetch?.bind(options.electron.net) }),
       companionSupervisor,
@@ -414,6 +455,7 @@ function createPluginHostService(options) {
     };
   } catch (error) {
     try { interactionService?.shutdown(); } catch {}
+    void logService.close();
     database.close();
     throw error;
   }

electron/plugins/hostService.test.cjs

@@ -401,3 +401,83 @@ test("normal release blocks a custom utility placement before permission prompts
   }), /requires developer mode/);
   assert.equal(prompts, 0);
 });
+
+test("host service logs revocation with injected provenance and drains through manager shutdown", async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-synthetic-log-host-"));
+  let seen;
+  const service = createPluginHostService({ ...createOptions(root), resolvePluginProvenance(input) {
+    seen = input;
+    return { sourceId: "synthetic-host-source", namespace: "test", sourceKind: "local" };
+  } });
+  t.after(async () => { await service.manager.shutdown(); fs.rmSync(root, { recursive: true, force: true }); });
+  const manifest = { manifestVersion: 1, id: "com.example.synthetic-audit", version: "1.0.0", name: "Synthetic", publisher: "example", engines: { netcatty: ">=0.0.0", api: ">=0.1.0-internal <0.2.0" }, main: { browser: "index.js" } };
+  service.database.installVersion({ pluginId: manifest.id, version: manifest.version, manifest, archiveSha256: "b".repeat(64), packageRelativePath: `${manifest.id}/${manifest.version}/package` }, { enable: true });
+  await service.logService.ready;
+  assert.equal(service.logService.status().saveToDisk, false);
+  await service.logService.configure({ saveToDisk: true, verbose: false });
+  service.permissionEngine.revokeAll(manifest.id);
+  await service.logService.sink.flush();
+  const record = JSON.parse(await fsp.readFile(service.logService.sink.file(0), "utf8"));
+  assert.equal(record.operation, "permission.revoked");
+  assert.equal(record.sourceId, "synthetic-host-source");
+  assert.equal(record.archiveSha256, "b".repeat(64));
+  assert.equal(record.pluginVersion, "1.0.0");
+  assert.equal(record.runtimeId, null);
+  assert.equal(seen.pluginId, manifest.id);
+  assert.equal(seen.archiveSha256, "b".repeat(64));
+  await service.manager.shutdown();
+  assert.equal(service.logService.sink.closed, true);
+});
+
+test("logging always drains before database close when another shutdown stage rejects", async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-synthetic-log-shutdown-failure-"));
+  const host = createPluginHostService(createOptions(root));
+  t.after(async () => { await host.manager.shutdown().catch(() => {}); fs.rmSync(root, { recursive: true, force: true }); });
+  await host.logService.ready;
+  await host.logService.configure({ saveToDisk: true, verbose: false });
+  let resume;
+  const gate = new Promise((resolve) => { resume = resolve; });
+  host.logService.sink.queue = host.logService.sink.queue.then(() => gate);
+  const logger = host.logService.createLogger({ pluginId: "com.example.synthetic", pluginVersion: "1.0.0", runtimeId: "host-shutdown", runtimeKind: "browser" }, {});
+  logger.audit({ operation: "synthetic.before-shutdown", result: "ok" });
+  host.companionSupervisor.shutdown = async () => { throw new Error("synthetic companion shutdown failure"); };
+  let settled = false;
+  const shutdown = host.manager.shutdown().finally(() => { settled = true; });
+  // Attach the rejection assertion before yielding so the expected failure is handled.
+  const rejected = assert.rejects(shutdown, /synthetic companion shutdown failure/);
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(settled, false);
+  assert.doesNotThrow(() => host.database.db.prepare("SELECT 1").get());
+  resume();
+  await rejected;
+  assert.equal(host.logService.sink.closed, true);
+  assert.equal(host.logService.retentionTimer._destroyed, true);
+  const record = JSON.parse(await fsp.readFile(host.logService.sink.file(0), "utf8"));
+  assert.equal(record.operation, "synthetic.before-shutdown");
+});
+
+test("activation permission denial is audited before a runtime logger exists", async (t) => {
+  const { defaultSecurityPrincipal } = require("./permissionResources.cjs");
+  const { RPC_ERRORS } = require("./rpcRouter.cjs");
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-synthetic-activation-log-"));
+  const host = createPluginHostService(createOptions(root));
+  t.after(async () => { await host.manager.shutdown(); fs.rmSync(root, { recursive: true, force: true }); });
+  const manifest = { manifestVersion: 1, id: "com.example.synthetic-activation", version: "1.0.0", name: "Synthetic", publisher: "example", engines: { netcatty: ">=0.0.0", api: ">=0.1.0-internal <0.2.0" }, main: { browser: "index.js" }, permissions: { required: ["commands"] } };
+  const archiveSha256 = "a".repeat(64);
+  host.database.installVersion({ pluginId: manifest.id, version: manifest.version, manifest, archiveSha256, packageRelativePath: `${manifest.id}/${manifest.version}/package` }, { enable: true });
+  await host.logService.ready;
+  await host.logService.configure({ saveToDisk: true, verbose: false });
+  await assert.rejects(host.runtimeSupervisor.resolveRuntimeKind({
+    plugin: host.database.getActivePlugin(manifest.id), availableKinds: ["browser"], signal: new AbortController().signal,
+    securityPrincipal: defaultSecurityPrincipal(manifest, archiveSha256),
+  }), { code: RPC_ERRORS.permissionDenied });
+  await host.logService.sink.flush();
+  const record = JSON.parse(await fsp.readFile(host.logService.sink.file(0), "utf8"));
+  assert.equal(record.operation, "runtime.authorization");
+  assert.equal(record.authorization, "denied");
+  assert.equal(record.runtimeId, null);
+  assert.equal(record.errorCode, RPC_ERRORS.permissionDenied);
+  assert.equal(record.archiveSha256, archiveSha256);
+  assert.equal(Object.hasOwn(record, "message"), false);
+  assert.equal(host.runtimeSupervisor.getRuntimeIdentity(manifest.id), null);
+});

electron/plugins/localLoggingFixture.test.cjs

@@ -0,0 +1,34 @@
+"use strict";
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const { pathToFileURL } = require("node:url");
+const test = require("node:test");
+
+test("native logging fixture packs reproducibly and exposes only synthetic commands", async (t) => {
+  const root = path.join(__dirname, "fixtures", "local-logging-plugin");
+  const output = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-logging-package-"));
+  t.after(() => fs.rm(output, { recursive: true, force: true }));
+  const { buildPluginPackage } = await import("@netcatty/plugin-cli");
+  await buildPluginPackage(root, path.join(output, "one.ncpkg"));
+  await buildPluginPackage(root, path.join(output, "two.ncpkg"));
+  assert.deepEqual(await fs.readFile(path.join(output, "one.ncpkg")), await fs.readFile(path.join(output, "two.ncpkg")));
+  const manifest = JSON.parse(await fs.readFile(path.join(root, "netcatty.plugin.json"), "utf8"));
+  assert.deepEqual(manifest.permissions, { required: ["commands", "menus"], optional: [] });
+  const plugin = (await import(pathToFileURL(path.join(root, "index.js")).href)).default;
+  const commands = new Map();
+  const logs = [];
+  let deniedRequests = 0;
+  plugin.activate({
+    subscriptions: { add() {} },
+    commands: { registerCommand(id, handler) { commands.set(id, handler); } },
+    logger: { info(...args) { logs.push(args); } },
+    network: { async request(request) { assert.equal(request.method, "GET"); assert.equal(request.body, undefined); deniedRequests++; throw Object.assign(new Error("synthetic permission denial"), { code: "permission_denied" }); } },
+  });
+  assert.deepEqual(await commands.get(`${manifest.id}.emit`)(), { ok: true, synthetic: true });
+  assert.match(logs[0][0], /Synthetic/);
+  assert.equal(logs[0][1].sourceId, "official", "spoofed field is deliberately nested plugin text, never host provenance");
+  assert.deepEqual(await commands.get(`${manifest.id}.denied`)(), { denied: true, synthetic: true });
+  assert.equal(deniedRequests, 1);
+});

electron/plugins/packaging.test.cjs

@@ -23,6 +23,7 @@ test("packaged application declares every plugin host runtime dependency and res
   assert.match(builderSource, /electron\/plugins\/runtime\/\*\*\/\*/);
   assert.match(builderSource, /domain\/pluginRuntimePolicy\.cjs/);
   assert.match(builderSource, /domain\/pluginPermissionDescriptions\.cjs/);
+  assert.match(builderSource, /domain\/pluginThemePack\.cjs/);
   assert.match(builderSource, /!electron\/plugins\/fixtures\/\*\*\/\*/);
 });
 

electron/plugins/permissionEngine.cjs

@@ -637,11 +637,21 @@ class PluginPermissionEngine {
 
   createMiddleware() {
     return async (context, next) => {
-      if (context.metadata.public === true) return next();
+      if (context.metadata.public === true) {
+        context.recordAuthorization?.("not-required");
+        return next();
+      }
       if (!context.authorization) {
+        context.recordAuthorization?.("denied");
         throw permissionDenied(`Plugin host method has no authorization policy: ${context.method}`);
       }
-      await this.authorize(context, context.authorization);
+      try {
+        await this.authorize(context, context.authorization);
+      } catch (error) {
+        if (error?.code === RPC_ERRORS.permissionDenied) context.recordAuthorization?.("denied");
+        throw error;
+      }
+      context.recordAuthorization?.("allowed");
       return next();
     };
   }

electron/plugins/pluginBridge.cjs

@@ -5,6 +5,7 @@ const { randomUUID } = require("node:crypto");
 
 const { createDefinitionValidator } = require("./contractValidator.cjs");
 const validateManagedPluginId = createDefinitionValidator("PluginId");
+const validateViewFocus = createDefinitionValidator("PluginViewFocusRequest");
 
 const { raceWithAbort } = require("./rpcRouter.cjs");
 const {
@@ -15,7 +16,15 @@ const {
 const { assertSecretKey } = require("./secretStore.cjs");
 
 const CHANNELS = Object.freeze({
+  themeCatalog: "netcatty:plugins:theme-catalog",
+  themeApply: "netcatty:plugins:theme-apply",
+  themesChanged: "netcatty:plugins:themes-changed",
   status: "netcatty:plugins:status",
+  logStatus: "netcatty:plugins:log-status",
+  logConfigure: "netcatty:plugins:log-configure",
+  logOpen: "netcatty:plugins:log-open",
+  logExport: "netcatty:plugins:log-export",
+  logClear: "netcatty:plugins:log-clear",
   interactionReady: "netcatty:plugins:interaction-ready",
   interactionResponse: "netcatty:plugins:interaction-response",
   list: "netcatty:plugins:list",
@@ -75,6 +84,7 @@ const CHANNELS = Object.freeze({
   importerProgress: "netcatty:plugins:importer-progress",
   openView: "netcatty:plugins:open-view",
   closeView: "netcatty:plugins:close-view",
+  focusView: "netcatty:plugins:focus-view",
   setViewBounds: "netcatty:plugins:set-view-bounds",
   setViewVisibility: "netcatty:plugins:set-view-visibility",
   viewMessage: "netcatty:plugins:view-message",
@@ -679,6 +689,14 @@ function registerPluginBridge(ipcMain, options) {
     }
     return id;
   };
+  for (const [channel, action] of [
+    [CHANNELS.logStatus, "status"], [CHANNELS.logConfigure, "configure"],
+    [CHANNELS.logOpen, "openFolder"], [CHANNELS.logExport, "exportLogs"], [CHANNELS.logClear, "clear"],
+  ]) handle(channel, async (_manager, payload) => {
+    if (!options.logService) throw new Error("Local plugin logging is unavailable");
+    await options.logService.ready;
+    return options.logService[action](payload);
+  });
   handle(CHANNELS.permissions, async (_manager, payload) => {
     const pluginId = assertManagedPluginId(payload);
     if (!options.permissionEngine || !options.database) throw new Error("Plugin permissions are unavailable");
@@ -721,6 +739,15 @@ function registerPluginBridge(ipcMain, options) {
   ));
   handle(CHANNELS.restart, async (activeManager, payload) => activeManager.restart(payload?.pluginId));
   handle(CHANNELS.uninstall, async (activeManager, payload) => activeManager.uninstall(payload?.pluginId));
+  handle(CHANNELS.themeCatalog, async () => {
+    if (!options.themeService) throw new Error("Plugin themes are unavailable");
+    return options.themeService.catalog();
+  });
+  handle(CHANNELS.themeApply, async (_manager, request) => {
+    if (!options.themeService) throw new Error("Plugin themes are unavailable");
+    return options.themeService.apply(request);
+  });
+  options.themeService?.onDidChange?.(() => options.broadcast?.(CHANNELS.themesChanged, {}));
   handle(CHANNELS.contributions, async (_activeManager, payload) => {
     if (!contributionService) throw new Error("Plugin contributions are unavailable");
     return contributionService.snapshot(payload ?? {});
@@ -1605,6 +1632,12 @@ function registerPluginBridge(ipcMain, options) {
     await viewHost.close(payload?.instanceId, event.sender);
     return null;
   });
+  handle(CHANNELS.focusView, async (_activeManager, payload, event) => {
+    if (!viewHost) throw new Error("Plugin views are unavailable");
+    if (!validateViewFocus(payload)) throw new TypeError("Plugin view focus request is invalid");
+    viewHost.focus(payload.instanceId, event.sender);
+    return null;
+  });
   handle(CHANNELS.setViewBounds, async (_activeManager, payload, event) => {
     if (!viewHost) throw new Error("Plugin views are unavailable");
     viewHost.setBounds(payload?.instanceId, payload?.bounds, event.sender);

electron/plugins/pluginBridge.test.cjs

@@ -1714,3 +1714,24 @@ test("host interaction ready and response channels reject untrusted senders befo
   await ipcMain.handlers.get(CHANNELS.interactionResponse)({ trusted: true, sender }, response);
   assert.deepEqual(calls, [[sender, true], [sender, response]]);
 });
+
+test('theme catalog and selection remain trusted app management channels',async()=>{
+ const ipc=createIpcMain();let calls=0;
+ registerPluginBridge(ipc,{manager:{initialize:async()=>{}},isTrustedSender:event=>event?.trusted===true,themeService:{catalog:async()=>{calls++;return{};},apply:async()=>{calls++;return{};}}});
+ for(const channel of [CHANNELS.themeCatalog,CHANNELS.themeApply])await assert.rejects(ipc.handlers.get(channel)({trusted:false},{}),/Untrusted/);
+ assert.equal(calls,0);await ipc.handlers.get(CHANNELS.themeCatalog)({trusted:true});await ipc.handlers.get(CHANNELS.themeApply)({trusted:true},{});assert.equal(calls,2);
+});
+
+test("local log management rejects plugin/untrusted senders before touching the sink", async () => {
+  const ipcMain = createIpcMain();
+  const actions = [];
+  const logService = { ready: Promise.resolve() };
+  for (const action of ["status", "configure", "openFolder", "exportLogs", "clear"]) logService[action] = async () => { actions.push(action); return { saveToDisk: false }; };
+  registerPluginBridge(ipcMain, { manager: { async initialize() {} }, logService, isTrustedSender: (event) => event?.trusted === true });
+  for (const channel of [CHANNELS.logStatus, CHANNELS.logConfigure, CHANNELS.logOpen, CHANNELS.logExport, CHANNELS.logClear]) {
+    await assert.rejects(ipcMain.handlers.get(channel)({}, {}), /Untrusted/);
+    assert.equal(actions.length, 0);
+  }
+  for (const channel of [CHANNELS.logStatus, CHANNELS.logConfigure, CHANNELS.logOpen, CHANNELS.logExport, CHANNELS.logClear]) await ipcMain.handlers.get(channel)({ trusted: true }, {});
+  assert.deepEqual(actions, ["status", "configure", "openFolder", "exportLogs", "clear"]);
+});

electron/plugins/pluginLogProvenance.cjs

@@ -0,0 +1,36 @@
+"use strict";
+
+/**
+ * Host-only adapter. Call with the host-assigned activation identity after the
+ * caller guard; never pass plugin request params, manifest source claims or an
+ * owner supplied by a plugin. Missing source APIs mean unknown provenance.
+ */
+function createPluginLogProvenanceResolver(database) {
+  const methods = ["getActivePlugin", "getRetainedPluginSource", "privateOwner", "publicPluginId"];
+  const resolve = (identity) => {
+    if (!methods.every((method) => typeof database?.[method] === "function")) return null;
+    const plugin = database.getActivePlugin(identity.pluginId);
+    if (!plugin || plugin.id !== identity.pluginId
+      || plugin.activeVersion !== identity.pluginVersion
+      || plugin.archiveSha256 !== identity.archiveSha256) return null;
+    const source = plugin.source;
+    const retained = database.getRetainedPluginSource(identity.pluginId);
+    if (!source || !retained || source.id !== retained.id || source.kind !== retained.kind) return null;
+    const owner = database.privateOwner(identity.pluginId);
+    if (typeof owner !== "string" || !owner || owner === identity.pluginId || database.publicPluginId(owner) !== identity.pluginId) return null;
+    return { sourceId: source.id, sourceKind: source.kind, namespace: owner };
+  };
+  return (identity) => {
+    const initial = resolve(identity);
+    if (!initial) return null;
+    return Object.freeze({ ...initial, isCurrent: () => {
+      try {
+        const current = resolve(identity);
+        return current !== null && current.sourceId === initial.sourceId
+          && current.sourceKind === initial.sourceKind && current.namespace === initial.namespace;
+      } catch { return false; }
+    } });
+  };
+}
+
+module.exports = { createPluginLogProvenanceResolver };

electron/plugins/pluginLogProvenance.integration.test.cjs

@@ -0,0 +1,70 @@
+"use strict";
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const { PluginDatabase } = require("./database.cjs");
+const { createPluginHostService } = require("./hostService.cjs");
+
+test("real source database replacement never reattributes old runtime log records", {
+  skip: typeof PluginDatabase.prototype.getRetainedPluginSource !== "function" && "requires the source API from PR #3981; run on the documented integration worktree",
+}, async (t) => {
+  const { thirdPartySource, OFFICIAL_SOURCE } = require("./sourceIdentity.cjs");
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-source-integration-"));
+  const host = createPluginHostService({
+    app: { getPath: () => root, getAppPath: () => process.cwd(), getVersion: () => "0.0.0" },
+    electron: {}, env: {},
+  });
+  const database = host.database;
+  const pluginId = "com.example.source-log-fixture";
+  // The current source contract encodes every namespace, including local.
+  const { LOCAL_SOURCE } = require("./sourceIdentity.cjs");
+  database.installVersion({ pluginId: "com.example.local-source-fixture", version: "1.0.0", manifest: {}, archiveSha256: "b".repeat(64), packageRelativePath: "com.example.local-source-fixture/1.0.0", source: LOCAL_SOURCE });
+  const localOwner = database.privateOwner("com.example.local-source-fixture");
+  assert.notEqual(localOwner, "com.example.local-source-fixture");
+  assert.equal(database.publicPluginId(localOwner), "com.example.local-source-fixture");
+
+  const first = thirdPartySource("Synthetic first source", "https://synthetic-first.example.com");
+  const install = (source) => database.installVersion({ pluginId, version: "1.0.0", manifest: {}, archiveSha256: "a".repeat(64), packageRelativePath: `${pluginId}/1.0.0`, source }, { enable: true });
+  install(first);
+  const service = host.logService;
+  t.after(async () => { await host.manager.shutdown().catch(() => {}); await fs.rm(root, { recursive: true, force: true }); });
+  await service.ready;
+  await service.configure({ saveToDisk: true, verbose: true });
+  const activation = { pluginId, pluginVersion: "1.0.0", runtimeId: "source-fixture-A", runtimeKind: "browser" };
+  const firstLogger = service.createLogger(activation, database.getActivePlugin(pluginId));
+  firstLogger.audit({ operation: "runtime.running", result: "ok", authorization: "not-required" });
+  await service.sink.flush();
+  const oldOwner = database.privateOwner(pluginId);
+  let resume;
+  const queueGate = new Promise((resolve) => { resume = resolve; });
+  service.sink.queue = service.sink.queue.then(() => queueGate);
+  await firstLogger.write("info", "synthetic queued before replacement");
+  database.removePlugin(pluginId);
+  assert.equal(database.getRetainedPluginSource(pluginId).id, first.id);
+  database.clearUninstalledSourceData(pluginId, first.id);
+  install(OFFICIAL_SOURCE);
+  assert.equal(database.publicPluginId(oldOwner), null);
+  resume();
+  await service.sink.flush();
+  assert.equal(service.status().droppedRecords, 1);
+  const replacement = service.createLogger({ ...activation, runtimeId: "source-fixture-B" }, database.getActivePlugin(pluginId));
+  replacement.audit({ operation: "runtime.running", result: "ok", authorization: "not-required" });
+  await service.sink.flush();
+  const records = (await fs.readFile(service.sink.file(0), "utf8")).trim().split("\n").map(JSON.parse);
+  assert.equal(records.length, 2);
+  assert.equal(records[0].sourceId, first.id);
+  assert.equal(records[0].namespace, oldOwner);
+  assert.equal(records[1].sourceId, "official");
+  assert.equal(records[1].namespace, database.privateOwner(pluginId));
+  assert.equal(Object.hasOwn(records[1], "officiallyMaintained"), false);
+  assert.doesNotMatch(JSON.stringify(records), /queued before replacement|synthetic-first.example.com/);
+  replacement.audit({ operation: "synthetic.before-shutdown", result: "ok" });
+  host.companionSupervisor.shutdown = async () => { throw new Error("synthetic companion shutdown failure"); };
+  await assert.rejects(host.manager.shutdown(), /synthetic companion shutdown failure/);
+  assert.equal(service.sink.closed, true);
+  const drained = (await fs.readFile(service.sink.file(0), "utf8")).trim().split("\n").map(JSON.parse);
+  assert.equal(drained.at(-1).operation, "synthetic.before-shutdown");
+  assert.equal(drained.at(-1).sourceId, "official");
+});

electron/plugins/pluginLogProvenance.test.cjs

@@ -0,0 +1,149 @@
+"use strict";
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const { createPluginLogProvenanceResolver } = require("./pluginLogProvenance.cjs");
+const { PluginLogService } = require("./pluginLogService.cjs");
+
+function sourceFixture(pluginId = "com.example.synthetic-source-logging") {
+  const identity = { pluginId, pluginVersion: "1.0.0", archiveSha256: "a".repeat(64), runtimeId: "host-runtime-A", runtimeKind: "browser" };
+  let source = { id: `third-party:${"b".repeat(64)}`, kind: "third-party", name: "Synthetic source", origin: "https://synthetic.example.com" };
+  let active = { id: pluginId, activeVersion: identity.pluginVersion, archiveSha256: identity.archiveSha256, source };
+  let retained = source;
+  const owner = () => source ? `source:${source.id === "official" ? "c".repeat(64) : "d".repeat(64)}:${pluginId}` : null;
+  const database = {
+    getActivePlugin(id) { assert.equal(id, pluginId); return active; },
+    getRetainedPluginSource(id) { assert.equal(id, pluginId); return retained; },
+    privateOwner(id) { assert.equal(id, pluginId); return owner(); },
+    publicPluginId(encoded) { return encoded === owner() ? pluginId : null; },
+  };
+  return { identity, database, plugin: () => active, setActive(value) { active = value; },
+    setRetained(value) { retained = value; },
+    replace() { source = { id: "official", kind: "official", name: "Not a maintenance claim", origin: "https://plugins.netcatty.app" }; active = { ...active, source }; retained = source; },
+    uninstall() { active = null; },
+  };
+}
+
+test("host provenance uses the bound owner and ignores plugin-supplied source metadata", () => {
+  const f = sourceFixture();
+  const resolver = createPluginLogProvenanceResolver(f.database);
+  const result = resolver({ ...f.identity, sourceId: "official", source: { id: "official" }, owner: "spoof" });
+  assert.equal(result.sourceId, f.plugin().source.id);
+  assert.equal(result.sourceKind, "third-party");
+  assert.equal(result.namespace, f.database.privateOwner(f.identity.pluginId));
+  assert.equal(result.isCurrent(), true);
+  assert.equal(Object.hasOwn(result, "officiallyMaintained"), false);
+  assert.equal(Object.hasOwn(result, "origin"), false);
+  f.replace();
+  assert.equal(result.isCurrent(), false);
+  assert.equal(resolver(f.identity).sourceId, "official");
+});
+
+test("missing source APIs, retained mismatch, orphaned owner and changed package remain unknown", () => {
+  const f = sourceFixture();
+  const resolve = createPluginLogProvenanceResolver(f.database);
+  assert.equal(createPluginLogProvenanceResolver({ getActivePlugin: f.database.getActivePlugin })(f.identity), null);
+  assert.equal(resolve({ ...f.identity, pluginVersion: "2.0.0" }), null);
+  assert.equal(resolve({ ...f.identity, archiveSha256: "c".repeat(64) }), null);
+  f.database.privateOwner = () => null;
+  assert.equal(resolve(f.identity), null, "no bare pluginId fallback");
+  f.database.privateOwner = () => f.identity.pluginId;
+  f.database.publicPluginId = (owner) => owner;
+  assert.equal(resolve(f.identity), null, "a bare owner is not an authenticated namespace");
+  f.database.privateOwner = () => "source:orphan";
+  assert.equal(resolve(f.identity), null);
+  const g = sourceFixture();
+  g.setRetained({ id: "different", kind: "third-party" });
+  assert.equal(createPluginLogProvenanceResolver(g.database)(g.identity), null);
+  const h = sourceFixture();
+  const snapshot = createPluginLogProvenanceResolver(h.database)(h.identity);
+  h.uninstall();
+  assert.equal(snapshot.isCurrent(), false);
+  assert.equal(createPluginLogProvenanceResolver(h.database)(h.identity), null, "retained source alone cannot authenticate an installed activation");
+});
+
+test("queued diagnostics and host facts are revalidated after async I/O before commit", async (t) => {
+  const f = sourceFixture(`com.${"a".repeat(120)}`);
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-source-log-"));
+  const service = new PluginLogService({ paths: { root, logs: path.join(root, "logs") }, resolveProvenance: createPluginLogProvenanceResolver(f.database) });
+  t.after(async () => { await service.close(); await fs.rm(root, { recursive: true, force: true }); });
+  await service.ready;
+  assert.equal(service.status().saveToDisk, false);
+  await service.configure({ saveToDisk: true, verbose: true });
+  const loggerA = service.createLogger(f.identity, f.plugin());
+  loggerA.audit({ operation: "runtime.running", authorization: "not-required", result: "ok" });
+  await service.sink.flush();
+  let release;
+  let entered;
+  const paused = new Promise((resolve) => { entered = resolve; });
+  const gate = new Promise((resolve) => { release = resolve; });
+  const prune = service.sink.prune.bind(service.sink);
+  service.sink.prune = async () => { entered(); await gate; return prune(); };
+  loggerA.audit({ operation: "synthetic.pending-source-A", authorization: "allowed", result: "ok" });
+  await loggerA.write("info", "synthetic pending diagnostic A");
+  await paused;
+  f.replace();
+  release();
+  await service.sink.flush();
+  assert.equal(service.status().droppedRecords, 2);
+  const loggerB = service.createLogger({ ...f.identity, runtimeId: "host-runtime-B" }, f.plugin());
+  loggerB.audit({ operation: "runtime.running", authorization: "not-required", result: "ok" });
+  await service.sink.flush();
+  const records = (await fs.readFile(service.sink.file(0), "utf8")).trim().split("\n").map(JSON.parse);
+  assert.equal(records.length, 2);
+  assert.match(records[0].sourceId, /^third-party:/u);
+  assert.equal(records[1].sourceId, "official");
+  assert.notEqual(records[0].namespace, records[1].namespace);
+  assert.equal(records[0].runtimeId, "host-runtime-A");
+  assert.equal(records[1].runtimeId, "host-runtime-B");
+  assert.doesNotMatch(JSON.stringify(records), /synthetic.pending-source-A|pending diagnostic|example.com|maintenance/i);
+  f.uninstall();
+  await loggerB.write("info", "synthetic stale callback");
+  loggerB.audit({ operation: "synthetic.after-uninstall", result: "ok" });
+  assert.equal(service.status().droppedRecords, 4);
+});
+
+test("a thrown source revalidation fails closed without breaking plugin execution", async (t) => {
+  const f = sourceFixture();
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-source-failure-"));
+  const service = new PluginLogService({ paths: { root, logs: path.join(root, "logs") }, resolveProvenance: createPluginLogProvenanceResolver(f.database) });
+  t.after(async () => { await service.close(); await fs.rm(root, { recursive: true, force: true }); });
+  await service.ready;
+  await service.configure({ saveToDisk: true, verbose: true });
+  const logger = service.createLogger(f.identity, f.plugin());
+  f.database.getActivePlugin = () => { throw new Error("synthetic unavailable source database"); };
+  await logger.write("info", "synthetic ignored");
+  logger.audit({ operation: "storage.get", result: "ok" });
+  await service.sink.flush();
+  assert.equal(service.status().droppedRecords, 2);
+  assert.equal(service.status().writeErrors, 0);
+});
+
+test("a stale queued source cannot rotate away existing audit evidence", async (t) => {
+  const f = sourceFixture();
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-source-rotation-"));
+  const service = new PluginLogService({ paths: { root, logs: path.join(root, "logs") }, limits: { maxFiles: 1 }, resolveProvenance: createPluginLogProvenanceResolver(f.database) });
+  t.after(async () => { await service.close(); await fs.rm(root, { recursive: true, force: true }); });
+  await service.ready;
+  await service.configure({ saveToDisk: true, verbose: false });
+  const logger = service.createLogger(f.identity, f.plugin());
+  logger.audit({ operation: "runtime.running", authorization: "not-required", result: "ok" });
+  await service.sink.flush();
+  const before = await fs.readFile(service.sink.file(0), "utf8");
+  service.sink.maxBytes = Buffer.byteLength(before) + 16;
+  let resume;
+  let entered;
+  const paused = new Promise((resolve) => { entered = resolve; });
+  const gate = new Promise((resolve) => { resume = resolve; });
+  const prune = service.sink.prune.bind(service.sink);
+  service.sink.prune = async () => { entered(); await gate; return prune(); };
+  logger.audit({ operation: "runtime.running", authorization: "not-required", result: "ok" });
+  await paused;
+  f.replace();
+  resume();
+  await service.sink.flush();
+  assert.equal(service.status().droppedRecords, 1);
+  assert.equal(await fs.readFile(service.sink.file(0), "utf8"), before);
+});

electron/plugins/pluginLogService.cjs

@@ -0,0 +1,150 @@
+"use strict";
+
+const fs = require("node:fs");
+const fsp = require("node:fs/promises");
+const path = require("node:path");
+const { createHmac, randomBytes } = require("node:crypto");
+const { PluginLogger, PluginLogSink } = require("./pluginLogger.cjs");
+const { RPC_ERRORS } = require("./rpcRouter.cjs");
+
+const bounded = (value, length = 128) => typeof value === "string"
+  ? value.slice(0, length).replace(/[^a-zA-Z0-9._:@/-]/gu, "_") : null;
+const sourceKey = (value) => typeof value === "string" && /^[a-zA-Z0-9._:-]{1,128}$/u.test(value) ? value : null;
+const ownerKey = (value) => typeof value === "string" && /^[a-zA-Z0-9._:-]{1,256}$/u.test(value) ? value : null;
+const count = (value) => Number.isSafeInteger(value) && value >= 0 ? value : null;
+
+class PluginLogService {
+  constructor(options) {
+    this.directory = path.join(options.paths.logs, "host-v1");
+    this.preferencesPath = path.join(options.paths.root, "local-logging.json");
+    this.resolveProvenance = options.resolveProvenance ?? (() => null);
+    this.electron = options.electron;
+    this.provenanceChecks = new WeakMap();
+    this.salt = randomBytes(32);
+    this.sink = new PluginLogSink({ directory: this.directory, ...options.limits });
+    this.settings = { saveToDisk: false, verbose: false };
+    this.management = Promise.resolve();
+    try {
+      if (fs.statSync(this.preferencesPath).size <= 1024) {
+        const saved = JSON.parse(fs.readFileSync(this.preferencesPath, "utf8"));
+        this.settings.saveToDisk = saved.saveToDisk === true;
+        // Free-form diagnostics always require fresh consent after app restart.
+      }
+    } catch {}
+    this.ready = this.sink.setEnabled(this.settings.saveToDisk).then(async () => {
+      if (!this.sink.enabled && fs.existsSync(this.directory)) await this.sink.prune();
+    }).catch(() => {
+      this.sink.writeErrors++;
+      this.settings.saveToDisk = false;
+      this.sink.enabled = false;
+    });
+    this.retentionTimer = setInterval(() => {
+      if (!fs.existsSync(this.directory) || this.sink.closed) return;
+      this.sink.queue = this.sink.queue.then(() => this.sink.prune()).catch(() => { this.sink.writeErrors++; });
+    }, 60 * 60 * 1000);
+    this.retentionTimer.unref?.();
+  }
+
+  status() {
+    return { ...this.settings, ...this.sink.status(), maxBytes: this.sink.maxBytes * this.sink.maxFiles,
+      retentionDays: this.sink.retentionMs / 86400000 };
+  }
+  async configure(request) {
+    if (!request || typeof request.saveToDisk !== "boolean" || typeof request.verbose !== "boolean") throw new TypeError("Invalid plugin log settings");
+    return this.#manage(async () => {
+      if (this.sink.closed) throw new Error("Plugin logging is closed");
+      const settings = { saveToDisk: request.saveToDisk, verbose: request.saveToDisk && request.verbose };
+      // Stop ingress before changing preferences. Failure leaves persistence off.
+      this.settings = { saveToDisk: false, verbose: false };
+      await this.sink.setEnabled(false);
+      await fsp.mkdir(path.dirname(this.preferencesPath), { recursive: true, mode: 0o700 });
+      const temporary = `${this.preferencesPath}.tmp`;
+      await fsp.writeFile(temporary, JSON.stringify({ saveToDisk: settings.saveToDisk }), { mode: 0o600 });
+      await fsp.rename(temporary, this.preferencesPath);
+      await this.sink.setEnabled(settings.saveToDisk);
+      this.settings = settings;
+      return this.status();
+    });
+  }
+  #manage(action) {
+    const result = this.management.then(() => this.ready).then(action);
+    this.management = result.catch(() => {});
+    return result;
+  }
+  identity(identity, plugin) {
+    // Only the injected HOST resolver may assign source and namespace identity.
+    let source = null;
+    try { source = this.resolveProvenance(Object.freeze({ pluginId: identity.pluginId, pluginVersion: identity.pluginVersion,
+      archiveSha256: plugin?.archiveSha256 ?? null, securityPrincipal: identity.securityPrincipal })); } catch {}
+    const metadata = Object.freeze({ pluginId: bounded(identity.pluginId), pluginVersion: bounded(identity.pluginVersion),
+      runtimeId: bounded(identity.runtimeId), runtimeKind: bounded(identity.runtimeKind),
+      archiveSha256: /^[a-f0-9]{64}$/u.test(plugin?.archiveSha256 ?? "") ? plugin.archiveSha256 : null,
+      sourceId: sourceKey(source?.sourceId), sourceKind: sourceKey(source?.sourceKind), namespace: ownerKey(source?.namespace) });
+    if (source?.isCurrent && typeof source.isCurrent === "function") {
+      this.provenanceChecks.set(metadata, () => source.isCurrent() === true);
+    }
+    return metadata;
+  }
+  createLogger(identity, plugin) {
+    const provenance = this.identity(identity, plugin);
+    return new PluginLogger({ sink: this.sink, identity: provenance, verbose: () => this.settings.verbose, isCurrent: this.provenanceChecks.get(provenance), audit: (event) => this.audit(provenance, event) });
+  }
+  audit(identity, event) {
+    if (!this.sink.enabled) return;
+    // An allowlist, never spread request/response/error objects into an audit.
+    const resources = Array.isArray(event.resources) ? event.resources.slice(0, 16) : [];
+    this.sink.enqueue({ timestamp: new Date().toISOString(), recordType: "host-audit", trust: "host-observed",
+      ...identity, operation: bounded(event.operation, 256),
+      targetIds: resources.filter((item) => typeof item === "string").map((item) =>
+        createHmac("sha256", this.salt).update(item.slice(0, 8192)).digest("hex")),
+      authorization: ["allowed", "denied", "not-required", "not-reached", "unknown"].includes(event.authorization) ? event.authorization : "unknown",
+      result: event.result === "ok" ? "ok" : "error",
+      errorCode: Object.values(RPC_ERRORS).includes(event.errorCode) ? event.errorCode : event.result === "ok" ? null : RPC_ERRORS.internal,
+      durationMs: count(event.durationMs), inputBytes: count(event.inputBytes), outputBytes: count(event.outputBytes) }, this.provenanceChecks.get(identity));
+  }
+  async openFolder() {
+    return this.#manage(async () => {
+      await fsp.mkdir(this.directory, { recursive: true, mode: 0o700 });
+      const error = await this.electron.shell.openPath(this.directory);
+      if (error) throw new Error("Could not open plugin log folder");
+      return this.status();
+    });
+  }
+  async exportLogs() {
+    return this.#manage(async () => {
+      const result = await this.electron.dialog.showSaveDialog({ title: "Export local plugin logs", defaultPath: "netcatty-plugin-logs.jsonl" });
+      if (result.canceled || !result.filePath) return this.status();
+      if (path.resolve(result.filePath).startsWith(path.resolve(this.directory) + path.sep)) throw new Error("Choose a destination outside the log folder");
+      const task = this.sink.queue.then(async () => {
+        const chunks = [];
+        for (let index = this.sink.maxFiles - 1; index >= 0; index--) {
+          try {
+            const stats = await fsp.lstat(this.sink.file(index));
+            if (!stats.isFile() || stats.isSymbolicLink() || stats.size > this.sink.maxBytes) throw new Error("Unsafe plugin log file");
+            if (await this.sink.retained(this.sink.file(index))) chunks.push(await fsp.readFile(this.sink.file(index)));
+          } catch (error) { if (error.code !== "ENOENT") throw error; }
+        }
+        await fsp.writeFile(result.filePath, Buffer.concat(chunks), { mode: 0o600 });
+      });
+      this.sink.queue = task.catch(() => {});
+      await task;
+      return this.status();
+    });
+  }
+  async clear() {
+    return this.#manage(async () => {
+      const result = await this.electron.dialog.showMessageBox({ type: "warning", title: "Clear local plugin logs?",
+        message: "Delete the saved local audit and diagnostic files? The bounded security history in plugin permissions is kept.",
+        buttons: ["Cancel", "Clear logs"], defaultId: 0, cancelId: 0, noLink: true });
+      if (result.response === 1) await this.sink.clear();
+      return this.status();
+    });
+  }
+  async close() {
+    clearInterval(this.retentionTimer);
+    await this.management;
+    await this.ready;
+    await this.sink.close();
+  }
+}
+module.exports = { PluginLogService };

electron/plugins/pluginLogger.cjs

@@ -1,96 +1,186 @@
 "use strict";
 
 const fs = require("node:fs/promises");
+const { constants } = require("node:fs");
 const path = require("node:path");
-
 const { PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_MAX_FILES } = require("./constants.cjs");
-const { assertPluginStorageSegment } = require("./paths.cjs");
+const { TokenBucket, DEFAULT_QUOTAS } = require("./quotaManager.cjs");
 
-const SENSITIVE_KEY = /(?:password|passwd|token|secret|private.?key|credential|authorization|cookie|totp|otpauth)/iu;
+const SENSITIVE_KEY = /(?:password|passwd|token|secret|api.?key|private.?key|credential|authorization|cookie|totp|otpauth|prompt|notes?|sql|results?|terminal|content|body|payload)/iu;
 
-function redactLogValue(value, key = "", depth = 0) {
+// Bounds apply to the entire traversal, including hostile, cyclic or wide input.
+// This is damage limitation for opt-in diagnostics, not a guarantee of secrecy.
+function redactLogValue(value, key = "", depth = 0, budget = { remaining: 4096 }) {
   if (SENSITIVE_KEY.test(key)) return "[REDACTED]";
-  if (depth >= 8) return "[TRUNCATED]";
-  if (value == null || typeof value === "boolean" || typeof value === "number") return value;
-  if (typeof value === "string") return value.slice(0, 2_048);
-  if (Array.isArray(value)) {
-    const output = [];
-    for (let index = 0; index < Math.min(value.length, 64); index += 1) {
-      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
-      output.push(descriptor && "value" in descriptor
-        ? redactLogValue(descriptor.value, "", depth + 1)
-        : "[UNAVAILABLE]");
-    }
-    return output;
+  if (depth >= 6 || budget.remaining <= 0) return "[TRUNCATED]";
+  budget.remaining -= 16;
+  if (value == null || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : null;
+  if (typeof value === "string") {
+    const text = value.slice(0, Math.min(2048, Math.max(0, budget.remaining))).replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, " ");
+    budget.remaining -= text.length;
+    return text;
   }
-  if (typeof value === "object") {
-    const output = {};
-    for (const entryKey of Object.keys(value).slice(0, 64)) {
-      if (SENSITIVE_KEY.test(entryKey)) {
-        output[entryKey.slice(0, 128)] = "[REDACTED]";
-        continue;
-      }
+  if (typeof value !== "object") return "[UNSUPPORTED]";
+  try {
+    const output = Array.isArray(value) ? [] : Object.create(null);
+    // Stop enumeration as soon as the budget is exhausted.
+    let count = 0;
+    for (const entryKey in value) {
+      if (budget.remaining <= 0 || count++ >= 32) break;
       const descriptor = Object.getOwnPropertyDescriptor(value, entryKey);
-      output[entryKey.slice(0, 128)] = descriptor && "value" in descriptor
-        ? redactLogValue(descriptor.value, entryKey, depth + 1)
-        : "[UNAVAILABLE]";
+      if (!descriptor?.enumerable) continue;
+      const safeKey = entryKey.slice(0, 64).replace(/[\u0000-\u001f\u007f]/gu, " ");
+      budget.remaining -= safeKey.length;
+      const item = "value" in descriptor ? redactLogValue(descriptor.value, entryKey, depth + 1, budget) : "[UNAVAILABLE]";
+      if (Array.isArray(output)) output.push(item);
+      else output[safeKey] = item;
     }
     return output;
+  } catch { return "[UNAVAILABLE]"; }
+}
+
+/** One app-owned sink gives every plugin a shared disk and queue budget. */
+class PluginLogSink {
+  constructor(options) {
+    this.directory = options.directory;
+    this.maxBytes = options.maxBytes ?? PLUGIN_LOG_MAX_BYTES;
+    this.maxFiles = options.maxFiles ?? PLUGIN_LOG_MAX_FILES;
+    this.maxPendingBytes = options.maxPendingBytes ?? 256 * 1024;
+    this.retentionMs = options.retentionMs ?? 7 * 24 * 60 * 60 * 1000;
+    for (const value of [this.maxBytes, this.maxFiles, this.maxPendingBytes, this.retentionMs]) {
+      if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError("Invalid plugin log limit");
+    }
+    this.clock = options.clock ?? Date.now;
+    this.enabled = false;
+    this.closed = false;
+    this.pendingBytes = 0;
+    this.diagnosticPendingBytes = 0;
+    this.dropped = 0;
+    this.writeErrors = 0;
+    this.queue = Promise.resolve();
+    this.generation = 0;
   }
-  return "[UNSUPPORTED]";
+
+  enqueue(record, isCurrent = () => true) {
+    if (!this.enabled || this.closed) return;
+    if (this.clearing) { this.dropped++; return; }
+    const current = () => { try { return isCurrent() === true; } catch { return false; } };
+    if (!current()) { this.dropped++; return; }
+    let line;
+    try { line = `${JSON.stringify({ ...record, timestamp: new Date(this.clock()).toISOString(), droppedRecords: this.dropped, writeErrors: this.writeErrors })}\n`; }
+    catch { this.dropped++; return; }
+    const bytes = Buffer.byteLength(line);
+    const diagnostic = record.recordType === "plugin-diagnostic";
+    if ((diagnostic && this.diagnosticPendingBytes + bytes > this.maxPendingBytes / 4) || bytes > Math.min(this.maxBytes, 16 * 1024) || this.pendingBytes + bytes > this.maxPendingBytes) {
+      this.dropped++; return;
+    }
+    const generation = this.generation;
+    this.pendingBytes += bytes;
+    if (diagnostic) this.diagnosticPendingBytes += bytes;
+    this.queue = this.queue.then(async () => {
+      if (generation !== this.generation || !current()) { this.dropped++; return; }
+      await this.prune();
+      const active = this.file(0);
+      let size = 0;
+      try { size = (await fs.stat(active)).size; } catch (error) { if (error.code !== "ENOENT") throw error; }
+      if (!current()) { this.dropped++; return; }
+      if (size + bytes > this.maxBytes) {
+        await fs.rm(this.file(this.maxFiles - 1), { force: true });
+        for (let index = this.maxFiles - 2; index >= 0; index--) {
+          if (!current()) { this.dropped++; return; }
+          try { await fs.rename(this.file(index), this.file(index + 1)); }
+          catch (error) { if (error.code !== "ENOENT") throw error; }
+        }
+      }
+      if (!current()) { this.dropped++; return; }
+      const handle = await fs.open(active, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | (constants.O_NOFOLLOW ?? 0), 0o600);
+      try {
+        if (!(await handle.stat()).isFile()) throw new Error("Unsafe plugin log file");
+        if (!current()) { this.dropped++; return; }
+        await handle.writeFile(line);
+      } finally { await handle.close(); }
+    }).catch(() => { this.dropped++; this.writeErrors++; }).finally(() => {
+      this.pendingBytes -= bytes;
+      if (diagnostic) this.diagnosticPendingBytes -= bytes;
+    });
+  }
+
+  file(index) { return path.join(this.directory, index === 0 ? "runtime.jsonl" : `runtime.${index}.jsonl`); }
+  async retained(file) {
+    // Every host record is capped at 16 KiB. Read only the first line: append
+    // updates mtime, so mtime cannot enforce record retention for active files.
+    const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+      const buffer = Buffer.alloc(16 * 1024);
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+      const newline = buffer.indexOf(10, 0);
+      if (newline < 0 || newline >= bytesRead) return false;
+      let first;
+      try { first = JSON.parse(buffer.subarray(0, newline).toString("utf8")); } catch { return false; }
+      const start = typeof first.timestamp === "string" ? Date.parse(first.timestamp) : NaN;
+      return Number.isFinite(start) && this.clock() - start < this.retentionMs;
+    } finally { await handle.close(); }
+  }
+  async prune() {
+    await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });
+    for (let index = 0; index < this.maxFiles; index++) {
+      try {
+        const file = this.file(index);
+        const stats = await fs.lstat(file);
+        if (!stats.isFile() || stats.isSymbolicLink()) throw new Error("Unsafe plugin log file");
+        if (stats.size > this.maxBytes || !await this.retained(file)) await fs.rm(file);
+      } catch (error) { if (error.code !== "ENOENT") throw error; }
+    }
+  }
+  flush() { return this.queue; }
+  async setEnabled(enabled) {
+    this.enabled = false;
+    this.generation++;
+    await this.flush();
+    if (enabled === true && !this.closed) {
+      await this.prune();
+      this.enabled = true;
+    }
+  }
+  async clear() {
+    this.clearing = true;
+    this.generation++;
+    try {
+      await this.flush();
+      for (let index = 0; index < this.maxFiles; index++) await fs.rm(this.file(index), { force: true });
+    } finally { this.clearing = false; }
+  }
+  async close() { this.closed = true; this.enabled = false; await this.flush(); }
+  status() { return { droppedRecords: this.dropped, writeErrors: this.writeErrors, pendingBytes: this.pendingBytes }; }
 }
 
 class PluginLogger {
-  constructor(options) {
-    this.pluginId = assertPluginStorageSegment(options.pluginId, "ID");
-    this.directory = path.join(options.logsDirectory, this.pluginId);
-    this.maxBytes = options.maxBytes ?? PLUGIN_LOG_MAX_BYTES;
-    this.maxFiles = options.maxFiles ?? PLUGIN_LOG_MAX_FILES;
-    this.maxPendingBytes = options.maxPendingBytes ?? Math.min(this.maxBytes, 256 * 1024);
-    this.pendingBytes = 0;
-    this.queue = Promise.resolve();
+  constructor(options = {}) {
+    this.sink = options.sink;
+    this.identity = options.identity;
+    this.verbose = options.verbose ?? (() => false);
+    this.isCurrent = options.isCurrent;
+    this.closed = false;
+    this.audit = options.audit ?? (() => {});
+    this.bucket = new TokenBucket(DEFAULT_QUOTAS.logWritesPerMinute, DEFAULT_QUOTAS.logWritesPerMinute / 60000, options.clock ?? Date.now);
   }
-
   write(level, message, fields) {
-    const record = JSON.stringify({
+    if (this.closed || !this.sink?.enabled || !this.verbose()) return Promise.resolve();
+    if (!this.bucket.consume()) { this.sink.dropped++; return Promise.resolve(); }
+    this.sink.enqueue({
       timestamp: new Date().toISOString(),
+      recordType: "plugin-diagnostic", trust: "plugin-authored-unverified",
+      ...this.identity,
       level: ["debug", "info", "warn", "error"].includes(level) ? level : "info",
-      message: String(message ?? "").slice(0, 2_048),
-      ...(fields === undefined ? {} : { fields: redactLogValue(fields) }),
-    });
-    const line = `${record}\n`;
-    const bytes = Buffer.byteLength(line);
-    if (this.pendingBytes + bytes > this.maxPendingBytes) return Promise.resolve();
-    this.pendingBytes += bytes;
-    this.queue = this.queue
-      .then(() => this.#append(line))
-      .catch(() => {})
-      .finally(() => { this.pendingBytes -= bytes; });
-    return this.queue;
-  }
-
-  async #append(line) {
-    await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });
-    const activePath = path.join(this.directory, "runtime.log");
-    let size = 0;
-    try { size = (await fs.stat(activePath)).size; } catch {}
-    if (size + Buffer.byteLength(line) > this.maxBytes) await this.#rotate();
-    await fs.appendFile(activePath, line, { encoding: "utf8", mode: 0o600 });
-  }
-
-  async #rotate() {
-    await fs.rm(path.join(this.directory, `runtime.${this.maxFiles}.log`), { force: true });
-    for (let index = this.maxFiles - 1; index >= 1; index -= 1) {
-      try {
-        await fs.rename(
-          path.join(this.directory, index === 1 ? "runtime.log" : `runtime.${index - 1}.log`),
-          path.join(this.directory, `runtime.${index}.log`),
-        );
-      } catch (error) {
-        if (error?.code !== "ENOENT") throw error;
-      }
-    }
+      diagnostic: {
+        message: redactLogValue(typeof message === "string" ? message : "[INVALID MESSAGE]"),
+        fields: redactLogValue(fields),
+      },
+    }, this.isCurrent);
+    return Promise.resolve();
   }
+  close() { this.closed = true; }
 }
 
-module.exports = { PluginLogger, redactLogValue };
+module.exports = { PluginLogger, PluginLogSink, redactLogValue };

electron/plugins/pluginLogger.test.cjs

@@ -1,43 +1,258 @@
 "use strict";
-
 const assert = require("node:assert/strict");
-const fs = require("node:fs");
+const fs = require("node:fs/promises");
 const os = require("node:os");
 const path = require("node:path");
 const test = require("node:test");
+const { PluginLogger, PluginLogSink, redactLogValue } = require("./pluginLogger.cjs");
+const { PluginLogService } = require("./pluginLogService.cjs");
+const { PluginHostRpcRegistry } = require("./hostRpcRegistry.cjs");
+const { PluginPermissionEngine } = require("./permissionEngine.cjs");
+const { RPC_ERRORS } = require("./rpcRouter.cjs");
 
-const { PluginLogger, redactLogValue } = require("./pluginLogger.cjs");
+async function fixture(t, limits = {}) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "netcatty-synthetic-plugin-logs-"));
+  const paths = { root, logs: path.join(root, "logs") };
+  let response = 0;
+  const service = new PluginLogService({ paths, limits, resolveProvenance: () => ({ sourceId: "synthetic-source", sourceKind: "local", namespace: "test" }),
+    electron: { shell: { openPath: async () => "" }, dialog: { showMessageBox: async () => ({ response }), showSaveDialog: async () => ({ filePath: path.join(root, "export.jsonl") }) } } });
+  await service.ready;
+  t.after(async () => { await service.close(); await fs.rm(root, { recursive: true, force: true }); });
+  const identity = { pluginId: "com.example.synthetic", pluginVersion: "1.2.3", runtimeId: "host-runtime-1", runtimeKind: "browser" };
+  const logger = service.createLogger(identity, { archiveSha256: "a".repeat(64) });
+  const records = async () => {
+    await service.sink.flush();
+    const files = await fs.readdir(service.directory).catch(() => []);
+    const lines = (await Promise.all(files.map((name) => fs.readFile(path.join(service.directory, name), "utf8")))).join("");
+    return lines.trim() ? lines.trim().split("\n").map(JSON.parse) : [];
+  };
+  return { service, logger, identity, root, paths, records, confirm: () => { response = 1; } };
+}
 
-test("plugin logs redact structured secrets and remain bounded on disk", async (context) => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-logs-"));
-  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const logger = new PluginLogger({
-    pluginId: "com.example.logger",
-    logsDirectory: root,
-    maxBytes: 240,
-    maxFiles: 2,
-  });
+test("persistence defaults off and disabled logger does not coerce or inspect text", async (t) => {
+  const f = await fixture(t);
+  await f.logger.write("error", { toString() { throw Error("must not execute"); } });
+  f.logger.audit({ operation: "storage.get", result: "ok" });
+  assert.deepEqual(await f.records(), []);
+  await assert.rejects(fs.stat(f.service.directory), { code: "ENOENT" });
+  assert.equal(f.service.status().saveToDisk, false);
+});
 
-  for (let index = 0; index < 8; index += 1) {
-    await logger.write("info", `record-${index}`, {
-      nested: { apiToken: "must-not-appear", visible: index },
-    });
+test("enabled host audit excludes bodies and binds host source, version, hash and runtime", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  await f.logger.write("info", "SYNTHETIC_SECRET_PROMPT");
+  f.logger.audit({ operation: "network.request", authorization: "allowed", result: "ok", resources: ["https://user:password@example.test/private?api_key=SYNTHETIC_SECRET"],
+    body: "SYNTHETIC_SECRET_BODY", error: "SYNTHETIC_SECRET_ERROR", inputBytes: 24, outputBytes: 64, durationMs: 3, pluginId: "spoof" });
+  const records = await f.records();
+  assert.equal(records.length, 1);
+  assert.equal(records[0].pluginId, f.identity.pluginId);
+  assert.equal(records[0].sourceId, "synthetic-source");
+  assert.equal(records[0].archiveSha256, "a".repeat(64));
+  assert.equal(records[0].runtimeId, "host-runtime-1");
+  assert.equal(records[0].authorization, "allowed");
+  assert.equal(records[0].inputBytes, 24);
+  assert.match(records[0].targetIds[0], /^[a-f0-9]{64}$/u);
+  assert.doesNotMatch(JSON.stringify(records), /SYNTHETIC_SECRET|example.test|password|spoof/);
+});
+
+test("verbose diagnostics are opt-in, bounded and cannot impersonate host records", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  await f.logger.write("bad", "message\u001b\n", { sourceId: "spoof", recordType: "host-audit", apiKey: "SYNTHETIC_SECRET", prompt: "SYNTHETIC_SECRET", Notes: "SYNTHETIC_SECRET", SQL: "SYNTHETIC_SECRET", results: "SYNTHETIC_SECRET", terminalContent: "SYNTHETIC_SECRET", credentialPayload: "SYNTHETIC_SECRET" });
+  const records = await f.records();
+  assert.equal(records[0].sourceId, "synthetic-source");
+  assert.equal(records[0].recordType, "plugin-diagnostic");
+  assert.equal(records[0].trust, "plugin-authored-unverified");
+  assert.equal(records[0].diagnostic.fields.sourceId, "spoof");
+  assert.doesNotMatch(JSON.stringify(records), /SYNTHETIC_SECRET|\\u001b/);
+  const cyclic = {}; cyclic.self = cyclic;
+  await f.logger.write("error", { toString() { throw Error("coercion"); } }, cyclic);
+  await f.logger.write("info", "proxy", new Proxy({}, { ownKeys() { throw Error("proxy"); } }));
+  const getter = {};
+  Object.defineProperty(getter, "value", { enumerable: true, get() { throw Error("accessor"); } });
+  assert.equal(redactLogValue(getter).value, "[UNAVAILABLE]");
+  assert.equal((await f.records()).length, 3);
+  const restored = new PluginLogService({ paths: f.paths });
+  await restored.ready;
+  assert.equal(restored.status().saveToDisk, true);
+  assert.equal(restored.status().verbose, false);
+  await restored.close();
+});
+
+test("shared disk cap, queue cap, retention and drop accounting", async (t) => {
+  const f = await fixture(t, { maxBytes: 800, maxFiles: 2, maxPendingBytes: 1600 });
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  for (let i = 0; i < 10; i++) {
+    f.logger.audit({ operation: "storage.get", result: "ok" });
+    await f.service.sink.flush();
   }
-  const files = fs.readdirSync(path.join(root, "com.example.logger"));
+  let files = await fs.readdir(f.service.directory);
   assert.ok(files.length <= 2);
-  const contents = files.map((file) => fs.readFileSync(
-    path.join(root, "com.example.logger", file),
-    "utf8",
-  )).join("\n");
-  assert.doesNotMatch(contents, /must-not-appear/);
-  assert.match(contents, /\[REDACTED\]/);
+  for (const name of files) assert.ok((await fs.stat(path.join(f.service.directory, name))).size <= 800);
+  for (let i = 0; i < 1000; i++) f.logger.audit({ operation: "storage.get", result: "ok" });
+  assert.ok(f.service.sink.pendingBytes <= 1600);
+  assert.ok(f.service.status().droppedRecords > 0);
+  await f.service.sink.flush();
+  f.logger.audit({ operation: "storage.get", result: "ok" });
+  assert.ok((await f.records()).some((record) => record.droppedRecords > 0));
+  files = await fs.readdir(f.service.directory);
+  const future = Date.now() + f.service.sink.retentionMs;
+  f.service.sink.clock = () => future;
+  await f.service.sink.prune();
+  assert.deepEqual(await fs.readdir(f.service.directory), []);
 });
 
-test("log redaction does not invoke accessors", () => {
-  const value = {};
-  Object.defineProperty(value, "secret", {
-    enumerable: true,
-    get() { throw new Error("accessor invoked"); },
-  });
-  assert.deepEqual(redactLogValue(value), { secret: "[REDACTED]" });
+test("disable, revoke, clear confirmation and shutdown stop future diagnostic writes", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  await f.logger.write("info", "before revoke");
+  await f.service.sink.flush();
+  f.logger.close();
+  await f.logger.write("info", "after revoke");
+  assert.equal((await f.records()).length, 1);
+  await f.service.clear();
+  assert.equal((await f.records()).length, 1);
+  f.confirm(); await f.service.clear();
+  assert.equal((await f.records()).length, 0);
+  const active = f.service.createLogger(f.identity, {});
+  await f.service.configure({ saveToDisk: false, verbose: false });
+  await active.write("info", "disabled");
+  assert.equal((await f.records()).length, 0);
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  await active.write("info", "before shutdown");
+  await f.service.close();
+  await active.write("info", "after shutdown");
+  assert.equal((await f.records()).length, 1);
+});
+
+test("export is local and does not alter retained files", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  f.logger.audit({ operation: "filesystem.stat", result: "ok", authorization: "allowed" });
+  await f.service.exportLogs();
+  const exported = await fs.readFile(path.join(f.root, "export.jsonl"), "utf8");
+  assert.equal(JSON.parse(exported).operation, "filesystem.stat");
+  assert.equal((await f.records()).length, 1);
+});
+
+test("RPC audit includes denied, malformed and public operations without error messages or bodies", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  const registry = new PluginHostRpcRegistry();
+  const engine = new PluginPermissionEngine({ database: { listPermissionGrants: () => [] } });
+  t.after(() => engine.shutdown());
+  registry.use(engine.createMiddleware());
+  registry.registerRequest("synthetic.public", (params) => ({ data: params.data }), { metadata: { public: true } });
+  registry.registerRequest("synthetic.denied", () => { throw Error("not reached"); });
+  registry.registerRequest("synthetic.invalid", () => null, { validateParams() { throw new Error("SYNTHETIC_SECRET_ERROR"); } });
+  const routes = registry.createRoutes({ ...f.identity, logger: f.logger });
+  await routes.requestHandlers["synthetic.public"]({ data: "SYNTHETIC_SECRET_BODY" }, {});
+  await assert.rejects(routes.requestHandlers["synthetic.denied"]({}, {}), { code: RPC_ERRORS.permissionDenied });
+  await assert.rejects(routes.requestHandlers["synthetic.invalid"]({}, {}));
+  const records = await f.records();
+  assert.deepEqual(records.map((r) => r.authorization), ["not-required", "denied", "not-reached"]);
+  assert.equal(records[0].inputBytes, 21);
+  assert.doesNotMatch(JSON.stringify(records), /SYNTHETIC_SECRET/);
+});
+
+test("I/O failure is counted and never fails plugin execution", async (t) => {
+  const f = await fixture(t);
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  await fs.writeFile(f.service.sink.file(0), "");
+  await fs.rm(f.service.sink.file(0));
+  await fs.symlink(path.join(f.root, "outside"), f.service.sink.file(0));
+  await f.logger.write("info", "synthetic");
+  await f.service.sink.flush();
+  assert.equal(f.service.status().writeErrors, 1);
+  assert.equal(f.service.status().droppedRecords, 1);
+});
+
+test("invalid sink limits fail early", () => {
+  assert.throws(() => new PluginLogSink({ directory: "/unused", maxFiles: -1 }));
+  const logger = new PluginLogger();
+  assert.doesNotThrow(() => logger.write("info", "disabled"));
+});
+
+test("unknown provenance stays unknown and a disabled restart prunes expired files", async (t) => {
+  const f = await fixture(t);
+  f.service.resolveProvenance = () => null;
+  const logger = f.service.createLogger({ ...f.identity, sourceId: "manifest-official-claim" }, { sourceId: "manifest-official-claim", archiveSha256: "c".repeat(64) });
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  logger.audit({ operation: "storage.get", result: "ok" });
+  const records = await f.records();
+  assert.equal(records[0].sourceId, null);
+  assert.equal(records[0].namespace, null);
+  assert.doesNotMatch(JSON.stringify(records), /manifest-official-claim/);
+  await f.service.configure({ saveToDisk: false, verbose: false });
+  const expired = await fs.readFile(f.service.sink.file(0), "utf8");
+  await fs.writeFile(f.service.sink.file(0), expired.replace(/"timestamp":"[^"]+"/u, '"timestamp":"2000-01-01T00:00:00.000Z"'));
+  const restored = new PluginLogService({ paths: f.paths });
+  await restored.ready;
+  assert.equal(restored.status().saveToDisk, false);
+  assert.deepEqual(await fs.readdir(restored.directory), []);
+  await restored.close();
+});
+
+test("noisy and malformed plugin diagnostics remain bounded with visible drops", async (t) => {
+  const f = await fixture(t, { maxPendingBytes: 4096 });
+  await f.service.configure({ saveToDisk: true, verbose: true });
+  const wide = {};
+  for (let index = 0; index < 100; index++) wide[`key-${index}`] = Array(100).fill("synthetic ".repeat(100));
+  await f.logger.write(Symbol("invalid"), { toString() { throw Error("must not coerce"); } }, wide);
+  for (let index = 0; index < 1000; index++) void f.logger.write("info", "synthetic noise", { pluginId: "spoof", index });
+  assert.ok(f.service.sink.pendingBytes <= 4096);
+  assert.ok(f.service.status().droppedRecords > 0);
+  for (const record of await f.records()) {
+    assert.equal(record.pluginId, f.identity.pluginId);
+    assert.ok(Buffer.byteLength(JSON.stringify(record)) < 16384);
+  }
+});
+
+test("source resolver URLs and userinfo are not persisted as source identity", async (t) => {
+  const f = await fixture(t);
+  f.service.resolveProvenance = () => ({ sourceId: "https://user:SYNTHETIC_SECRET@example.test/source?key=SYNTHETIC_SECRET", sourceKind: "local", namespace: "user@SYNTHETIC_SECRET" });
+  const logger = f.service.createLogger(f.identity, {});
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  logger.audit({ operation: "storage.get", result: "ok" });
+  const records = await f.records();
+  assert.equal(records[0].sourceId, null);
+  assert.equal(records[0].namespace, null);
+  assert.doesNotMatch(JSON.stringify(records), /SYNTHETIC_SECRET/);
+});
+
+test("31 days of low-volume appends never retain an active record for seven days", async (t) => {
+  let now = Date.UTC(2030, 0, 1);
+  const f = await fixture(t, { clock: () => now });
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  for (let day = 0; day < 31; day++) {
+    now = Date.UTC(2030, 0, 1) + day * 86400000;
+    f.logger.audit({ operation: `synthetic.day-${day}`, authorization: "not-required", result: "ok" });
+    const records = await f.records();
+    assert.ok(records.length > 0);
+    for (const record of records) assert.ok(now - Date.parse(record.timestamp) < f.service.sink.retentionMs);
+  }
+  assert.doesNotMatch(JSON.stringify(await f.records()), /synthetic.day-0"/u);
+});
+
+test("export excludes an expired active segment even when its mtime is recent", async (t) => {
+  let now = Date.UTC(2030, 0, 1);
+  const f = await fixture(t, { clock: () => now });
+  await f.service.configure({ saveToDisk: true, verbose: false });
+  f.logger.audit({ operation: "synthetic.expired", result: "ok" });
+  await f.service.sink.flush();
+  now += 86400000;
+  f.logger.audit({ operation: "synthetic.day-one", result: "ok" });
+  await f.service.sink.flush();
+  // Appending refreshed mtime; export must use the first host record's age.
+  await fs.utimes(f.service.sink.file(0), new Date(now), new Date(now));
+  now += f.service.sink.retentionMs;
+  await f.service.exportLogs();
+  assert.equal(await fs.readFile(path.join(f.root, "export.jsonl"), "utf8"), "");
+  f.logger.audit({ operation: "synthetic.new-segment", result: "ok" });
+  await f.service.sink.flush();
+  await f.service.exportLogs();
+  const records = (await fs.readFile(path.join(f.root, "export.jsonl"), "utf8")).trim().split("\n").map(JSON.parse);
+  assert.equal(records.length, 1);
+  assert.equal(records[0].operation, "synthetic.new-segment");
 });

electron/plugins/pluginViewHost.cjs

@@ -36,10 +36,19 @@ class PluginViewHost {
     this.contributionService = options.contributionService;
     this.preloadPath = options.preloadPath ?? path.join(__dirname, "runtime", "viewPreload.cjs");
     this.instances = new Map();
+    this.opening = new Map();
+    this.closed = false;
+    this.isLocked = options.isLocked ?? (() => false);
+    this.subscriptions = [];
+    const unsubscribeLock = options.subscribeLock?.((state) => {
+      if (!state.locked) return;
+      for (const opening of this.opening.values()) opening.cancelled = true;
+      for (const instanceId of [...this.instances.keys()]) void this.close(instanceId, undefined, "app-locked");
+    });
+    this.subscriptions.push({ dispose: () => unsubscribeLock?.() });
     this.byWebContentsId = new Map();
     this.closeListeners = new Set();
     this.environment = { locale: "en", theme: "system", reducedMotion: false, highContrast: false };
-    this.subscriptions = [];
     this.#registerIpc();
     this.subscriptions.push(this.contributionService.onDidPostViewMessage((event) => {
       for (const instance of this.instances.values()) {
@@ -49,10 +58,14 @@ class PluginViewHost {
       }
     }));
     this.subscriptions.push(this.contributionService.onDidChange?.((event) => {
-      if (!["plugin-disabled", "runtime-stopped", "runtime-error", "runtime-quarantined"].includes(event.reason)
-        || !event.pluginId) return;
       for (const instance of [...this.instances.values()]) {
-        if (instance.pluginId === event.pluginId) void this.close(instance.instanceId, undefined, event.reason);
+        if (["plugin-disabled", "runtime-stopped", "runtime-error", "runtime-quarantined"].includes(event.reason)
+          && instance.pluginId === event.pluginId) {
+          void this.close(instance.instanceId, undefined, event.reason);
+        } else if (["vault-page", "terminal-sidebar"].includes(instance.location)) {
+          try { this.contributionService.assertViewActivationCurrent(instance.activation, { context: instance.context }); }
+          catch { void this.close(instance.instanceId, undefined, "contribution-unavailable"); }
+        }
       }
     }));
   }
@@ -115,10 +128,45 @@ class PluginViewHost {
 
   async open(payload, sender) {
     if (!payload || typeof payload !== "object") throw new TypeError("Plugin view request is invalid");
+    const owner = this.electron.BrowserWindow.fromWebContents(sender);
+    if (this.closed || this.isLocked() || !owner || owner.isDestroyed()) throw new Error("Plugin view owner is unavailable");
+    const instanceId = typeof payload.instanceId === "string" && payload.instanceId.length <= 128
+      ? payload.instanceId : randomUUID();
+    if (this.instances.has(instanceId) || this.opening.has(instanceId)) throw new Error(`Plugin view already exists: ${instanceId}`);
+    const opening = { owner, cancelled: false };
+    const cancel = () => { opening.cancelled = true; };
+    const rendererGone = () => { void this.close(instanceId, undefined, "owner-renderer-gone"); };
+    const navigate = (details, _url, isInPlace, isMainFrame) => {
+      if ((details?.isMainFrame ?? isMainFrame) !== false && (details?.isSameDocument ?? isInPlace) !== true) rendererGone();
+    };
+    const cleanupOwner = () => {
+      sender.removeListener?.("render-process-gone", rendererGone);
+      sender.removeListener?.("did-start-navigation", navigate);
+    };
+    this.opening.set(instanceId, opening);
+    owner.once?.("closed", cancel);
+    sender.on?.("render-process-gone", rendererGone);
+    sender.on?.("did-start-navigation", navigate);
+    try { return await this.#open({ ...payload, instanceId }, sender, opening); }
+    finally {
+      owner.removeListener?.("closed", cancel);
+      const instance = this.instances.get(instanceId);
+      if (instance) instance.cleanupOwner = cleanupOwner;
+      else cleanupOwner();
+      if (this.opening.get(instanceId) === opening) this.opening.delete(instanceId);
+    }
+  }
+
+  #assertOpening(opening) {
+    if (this.closed || this.isLocked() || opening.cancelled || opening.owner.isDestroyed()) throw new Error("Plugin view opening was cancelled");
+  }
+
+  async #open(payload, sender, opening) {
     const { plugin, view, identity } = await this.contributionService.activateView(
       payload.viewId,
       { context: payload.context },
     );
+    this.#assertOpening(opening);
     const activation = Object.freeze({
       pluginId: plugin.id,
       pluginVersion: plugin.activeVersion,
@@ -135,6 +183,7 @@ class PluginViewHost {
       : randomUUID();
     if (this.instances.has(instanceId)) throw new Error(`Plugin view already exists: ${instanceId}`);
     const packageRoot = await this.packageStore.preparePackageRoot(plugin);
+    this.#assertOpening(opening);
     this.contributionService.assertViewActivationCurrent(activation, { context: payload.context });
     const partition = `netcatty-plugin-view-${randomUUID()}`;
     const pluginSession = this.electron.session.fromPartition(partition, { cache: false });
@@ -183,12 +232,22 @@ class PluginViewHost {
         if (url !== registration.url) event.preventDefault();
       });
       contents.on("will-attach-webview", (event) => event.preventDefault());
+      contents.once("render-process-gone", () => { void this.close(instanceId, undefined, "view-renderer-gone"); });
+      if (["vault-page", "terminal-sidebar"].includes(view.location)) contents.on("before-input-event", (event, input) => {
+        if (input.type === "keyDown" && input.key === "Escape" && !input.control && !input.meta && !input.alt && !input.shift) {
+          event.preventDefault();
+          void this.close(instanceId, undefined, "host-escape");
+        }
+      });
       const ownerClosed = () => { void this.close(instanceId, undefined, "owner-closed"); };
       const instance = {
         instanceId,
         pluginId: plugin.id,
         viewId: view.id,
         scopeId,
+        location: view.location,
+        activation,
+        context: structuredClone(payload.context ?? {}),
         owner,
         ownerClosed,
         view: contentsView,
@@ -197,8 +256,13 @@ class PluginViewHost {
         sessionRegistration,
         state: "opening",
         attached: false,
+        visible: !["vault-page", "terminal-sidebar"].includes(view.location),
       };
       this.instances.set(instanceId, instance);
+      contents.on("focus", () => {
+        if (this.instances.get(instanceId) !== instance || instance.state !== "open") return;
+        try { owner.webContents?.send("netcatty:plugins:view-focused", { instanceId }); } catch {}
+      });
       this.byWebContentsId.set(contents.id, instance);
       owner.once?.("closed", ownerClosed);
       contents.once("destroyed", () => { void this.close(instanceId, undefined, "contents-destroyed"); });
@@ -208,6 +272,10 @@ class PluginViewHost {
         || owner.isDestroyed() || contents.isDestroyed()) {
         throw new Error("Plugin view ownership changed while opening");
       }
+      this.#assertOpening(opening);
+      // Embedded pages start hidden until the trusted renderer checks host
+      // dialogs/lock/popovers. A late open must never cover a security surface.
+      if (["vault-page", "terminal-sidebar"].includes(view.location)) contentsView.setVisible(false);
       owner.contentView.addChildView(contentsView);
       instance.attached = true;
       contentsView.setBounds(normalizeBounds(payload.bounds));
@@ -232,7 +300,17 @@ class PluginViewHost {
   setVisible(instanceId, visible, sender) {
     if (typeof visible !== "boolean") throw new TypeError("Plugin view visibility must be a boolean");
     const instance = this.#ownedInstance(instanceId, sender);
+    if (visible && this.isLocked()) throw new Error("Plugin view owner is unavailable");
+    const rising = visible && !instance.visible;
+    instance.visible = visible;
     instance.view.setVisible(visible);
+    if (rising && instance.location === "vault-page" && instance.owner.isFocused?.()) instance.contents.focus?.();
+  }
+
+  focus(instanceId, sender) {
+    const instance = this.#ownedInstance(instanceId, sender);
+    if (!instance.visible || this.isLocked() || instance.owner.isFocused?.() !== true) return;
+    instance.contents.focus?.();
   }
 
   async postMessage(instanceId, message, sender) {
@@ -250,11 +328,17 @@ class PluginViewHost {
   }
 
   async close(instanceId, sender, reason = sender ? "renderer-requested" : "host-requested") {
+    const opening = this.opening.get(instanceId);
+    if (opening) {
+      if (sender && this.electron.BrowserWindow.fromWebContents(sender) !== opening.owner) throw new Error("Untrusted plugin view owner");
+      opening.cancelled = true;
+    }
     const instance = this.instances.get(instanceId);
     if (!instance) return;
     if (sender) this.#ownedInstance(instanceId, sender);
     this.instances.delete(instanceId);
     this.byWebContentsId.delete(instance.contents.id);
+    try { instance.cleanupOwner?.(); } catch {}
     try { instance.owner.removeListener?.("closed", instance.ownerClosed); } catch {}
     if (instance.attached) {
       try { instance.owner.contentView.removeChildView(instance.view); } catch {}
@@ -279,6 +363,8 @@ class PluginViewHost {
   }
 
   async shutdown() {
+    this.closed = true;
+    for (const opening of this.opening.values()) opening.cancelled = true;
     await Promise.all([...this.instances.keys()].map((instanceId) => this.close(instanceId)));
     for (const subscription of this.subscriptions.splice(0)) subscription?.dispose?.();
     this.closeListeners.clear();

electron/plugins/pluginViewHost.test.cjs

@@ -25,6 +25,7 @@ function fixture(options = {}) {
       if (options.loadURL) await options.loadURL(this);
     }
     send(channel, payload) { this.sent.push([channel, payload]); }
+    focus() { this.emit("focus"); }
     isDestroyed() { return this.destroyed; }
     close() { this.destroyed = true; this.emit("destroyed"); }
   }
@@ -87,9 +88,10 @@ function fixture(options = {}) {
     onDidPostViewMessage(listener) { viewListener = listener; return { dispose() {} }; },
     onDidChange(listener) { changeListener = listener; return { dispose() {} }; },
     async activateView() {
+      await options.activateView?.();
       return {
         plugin: { id: "com.example.view", activeVersion: "1.0.0" },
-        view: { id: "com.example.view.panel", entry: "view.html", location: "aside" },
+        view: { id: "com.example.view.panel", entry: "view.html", location: options.location ?? "aside" },
         identity: { runtimeId: "runtime-view-1", pluginVersion: "1.0.0" },
       };
     },
@@ -121,6 +123,8 @@ function fixture(options = {}) {
       setViewState(pluginId, viewId, scopeId, value) { state.set(`${pluginId}:${viewId}:${scopeId}`, value); },
     },
     contributionService,
+    isLocked: options.isLocked,
+    subscribeLock: options.subscribeLock,
     preloadPath: "/runtime/viewPreload.cjs",
   });
   function createOwner() {
@@ -131,7 +135,7 @@ function fixture(options = {}) {
       addChildView(view) { owner.children.push(view); },
       removeChildView(view) { owner.children = owner.children.filter((entry) => entry !== view); },
     };
-    const sender = {};
+    const sender = new EventEmitter();
     senderOwners.set(sender, owner);
     return { owner, sender };
   }
@@ -341,3 +345,132 @@ test("view cleanup failures cannot suppress owner removal or the renderer close
     reason: "renderer-requested",
   }]);
 });
+
+test("Vault pages start hidden and are withdrawn when their current contribution is no longer available", async () => {
+  const value = fixture({ location: "vault-page" });
+  const { owner, sender } = value.createOwner();
+  const result = await value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:vault-page" }, sender);
+  assert.equal(owner.children.length, 1);
+  assert.equal(value.views[0].visible, false, "host modal checks precede native visibility");
+  value.host.setVisible(result.instanceId, true, sender);
+  assert.equal(value.views[0].visible, true);
+  value.setActivationCurrent(false);
+  value.changeListener()({ reason: "context-key-changed" });
+  assert.equal(owner.children.length, 0);
+  assert.equal(value.views[0].webContents.destroyed, true);
+  await value.host.shutdown();
+});
+
+test("closing a reserved owner instance cancels activation before any native page is constructed", async () => {
+  let release;
+  const gate = new Promise((resolve) => { release = resolve; });
+  const value = fixture({ location: "vault-page", activateView: () => gate });
+  const { owner, sender } = value.createOwner();
+  const other = value.createOwner();
+  const opening = value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:vault-page", instanceId: "reserved-page" }, sender);
+  await assert.rejects(value.host.close("reserved-page", other.sender), /Untrusted/);
+  await value.host.close("reserved-page", sender);
+  release();
+  await assert.rejects(opening, /cancelled/);
+  assert.equal(value.views.length, 0);
+  assert.equal(owner.children.length, 0);
+  assert.equal(value.host.opening.size, 0);
+  await value.host.shutdown();
+});
+
+test("app lock closes attached pages and cancels pending opens, with subscription cleanup", async () => {
+  let listener, locked = false, disposed = 0;
+  const value = fixture({ location: "vault-page", isLocked: () => locked,
+    subscribeLock(fn) { listener = fn; return () => { disposed++; }; } });
+  const { owner, sender } = value.createOwner();
+  const result = await value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:vault-page" }, sender);
+  locked = true; listener({ locked: true });
+  assert.equal(owner.children.length, 0);
+  assert.equal(value.views[0].webContents.destroyed, true);
+  await assert.rejects(value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:vault-page" }, sender), /unavailable/);
+  assert.throws(() => value.host.setVisible(result.instanceId, true, sender));
+  await value.host.shutdown();
+  assert.equal(disposed, 1);
+});
+
+test("browser Scratchpad saves, reopens and clears only its own view state through the real host IPC", async () => {
+  const { readFile } = require("node:fs/promises");
+  const path = require("node:path");
+  const { JSDOM } = require("jsdom");
+  const { VIEW_CHANNELS } = require("./pluginViewHost.cjs");
+  const html = await readFile(path.join(__dirname, "../../examples/plugins/vault-scratchpad/page.html"), "utf8");
+  const script = await readFile(path.join(__dirname, "../../examples/plugins/vault-scratchpad/page.js"), "utf8");
+  const value = fixture({ location: "vault-page" });
+  const { sender } = value.createOwner();
+  async function open(scopeId) {
+    const result = await value.host.open({ viewId: "com.example.view.panel", scopeId }, sender);
+    const contents = value.host.instances.get(result.instanceId).contents;
+    const dom = new JSDOM(html, { runScripts: "outside-only" });
+    dom.window.netcattyView = {
+      getState: async () => value.ipcHandlers.get(VIEW_CHANNELS.getState)({ sender: contents }),
+      setState: async (state) => value.ipcHandlers.get(VIEW_CHANNELS.setState)({ sender: contents }, structuredClone(state)),
+    };
+    dom.window.eval(script);
+    await new Promise((resolve) => setImmediate(resolve));
+    return { dom, document: dom.window.document, id: result.instanceId, contents };
+  }
+  const first = await open("window-1:vault-page");
+  first.document.getElementById("draft").value = "synthetic private draft";
+  first.document.getElementById("save").click();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.match(first.document.getElementById("status").textContent, /saved/);
+  await value.host.close(first.id, sender); first.dom.window.close();
+  const separate = await open("window-2:vault-page");
+  assert.equal(separate.document.getElementById("draft").value, "", "a different host-owned state scope does not inherit this draft");
+  const reopened = await open("window-1:vault-page");
+  assert.equal(reopened.document.getElementById("draft").value, "synthetic private draft");
+  reopened.document.getElementById("clear").click();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(reopened.document.getElementById("draft").value, "");
+  const cleared = await open("window-1:vault-page");
+  assert.equal(cleared.document.getElementById("draft").value, "");
+  await value.host.shutdown();
+  assert.throws(() => value.ipcHandlers.get(VIEW_CHANNELS.getState)({ sender: reopened.contents }), /Untrusted/);
+  for (const panel of [separate, reopened, cleared]) panel.dom.window.close();
+});
+
+test("host reload, host/view renderer exit, and host Escape close embedded pages", async () => {
+  for (const action of ["reload", "host-exit", "view-exit", "escape"]) {
+    const value = fixture({ location: "vault-page" });
+    const { sender, owner } = value.createOwner();
+    const opened = await value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:vault-page" }, sender);
+    const contents = value.views[0].webContents;
+    sender.emit("did-start-navigation", { isMainFrame: true, isSameDocument: true });
+    assert.equal(owner.children.length, 1);
+    if (action === "reload") sender.emit("did-start-navigation", { isMainFrame: true, isSameDocument: false });
+    if (action === "host-exit") sender.emit("render-process-gone");
+    if (action === "view-exit") contents.emit("render-process-gone");
+    if (action === "escape") {
+      let prevented = false;
+      contents.emit("before-input-event", { preventDefault() { prevented = true; } }, { type: "keyDown", key: "Escape" });
+      assert.equal(prevented, true);
+    }
+    assert.equal(owner.children.length, 0, action);
+    assert.equal(value.host.instances.has(opened.instanceId), false, action);
+    assert.equal(sender.listenerCount("render-process-gone"), 0, action);
+    await value.host.shutdown();
+  }
+});
+
+test("sidebar native focus is explicit, owner-bound and cannot raise a hidden or locked page", async () => {
+  let locked = false;
+  const value = fixture({ location: "terminal-sidebar", isLocked: () => locked });
+  const { owner, sender } = value.createOwner(); const other = value.createOwner();
+  const events = [];
+  sender.send = (channel, event) => events.push({ channel, event }); owner.webContents = sender; owner.isFocused = () => true;
+  const { instanceId } = await value.host.open({ viewId: "com.example.view.panel", scopeId: "window-1:terminal-sidebar" }, sender);
+  assert.equal(value.views[0].visible, false);
+  value.host.focus(instanceId, sender); assert.deepEqual(events, []);
+  value.host.setVisible(instanceId, true, sender); assert.deepEqual(events, [], "revealing multiple panes does not focus each one");
+  assert.throws(() => value.host.focus(instanceId, other.sender), /another window/i);
+  value.host.focus(instanceId, sender);
+  assert.deepEqual(events, [{ channel: "netcatty:plugins:view-focused", event: { instanceId } }]);
+  locked = true; value.host.focus(instanceId, sender); assert.equal(events.length, 1);
+  locked = false; value.setActivationCurrent(false); value.changeListener()({ reason: "context-key-changed" });
+  assert.equal(owner.children.length, 0); await value.host.shutdown();
+});

electron/plugins/runtimeSupervisor.cjs

@@ -51,6 +51,7 @@ function resolveDefaultRuntimeKind({ plugin }) {
 class RuntimeSupervisor {
   constructor(options) {
     this.electron = options.electron;
+    this.logService = options.logService;
     this.database = options.database;
     this.packageStore = options.packageStore;
     this.protocol = options.protocol;
@@ -202,12 +203,13 @@ class RuntimeSupervisor {
         quarantinedAt: details.quarantinedAt,
       });
     }
+    if (identity) this.logService?.audit(identity.logger.identity, { operation: `runtime.${status}`, authorization: "not-required", result: ["error", "quarantined"].includes(status) ? "error" : "ok" });
     this.#emitRuntimeState(identity, status, details);
   }
 
   async startEnabled() {
     for (const plugin of this.database.listPlugins()) {
-      if (!plugin.enabled || plugin.runtime.quarantinedAt != null) continue;
+      if (!plugin.enabled || plugin.runtime.quarantinedAt != null || plugin.manifest?.main?.data) continue;
       try { await this.start(plugin.id); } catch {}
     }
   }
@@ -240,6 +242,7 @@ class RuntimeSupervisor {
     const plugin = this.database.getActivePlugin(pluginId);
     if (!plugin?.manifest || !plugin.packageRelativePath) throw new Error(`Plugin is not installed: ${pluginId}`);
     if (!plugin.enabled) throw new Error(`Plugin is disabled: ${pluginId}`);
+    if (plugin.manifest.main.data) throw new Error("Static theme packs have no executable runtime");
     if (plugin.runtime.quarantinedAt != null) throw new Error(`Plugin is quarantined: ${pluginId}`);
     const pluginCli = await import("@netcatty/plugin-cli");
     signal.throwIfAborted();
@@ -277,7 +280,7 @@ class RuntimeSupervisor {
     ) {
       throw new PluginRpcError(RPC_ERRORS.unavailable, "Plugin changed while runtime placement was resolved");
     }
-    const logger = new PluginLogger({ pluginId, logsDirectory: this.paths.logs });
+    let logger;
     let runtime;
     const identity = Object.freeze({
       pluginId,
@@ -287,7 +290,7 @@ class RuntimeSupervisor {
       securityPrincipal,
       manifest: freezeJson(structuredClone(plugin.manifest)),
       packageRoot,
-      logger,
+      get logger() { return logger; },
       assertCurrent: () => {
         const active = this.database.getActivePlugin(pluginId);
         if (
@@ -300,11 +303,13 @@ class RuntimeSupervisor {
         }
       },
     });
+    logger = this.logService?.createLogger(identity, plugin) ?? new PluginLogger();
     const routes = this.rpcRegistry.createRoutes(identity);
     const onExit = (details) => { void this.#handleExit(pluginId, runtime, identity, details); };
-    const onProtocolError = (error) => logger.write("error", "Plugin protocol violation", {
-      error: error?.message ?? String(error),
-    });
+    const onProtocolError = (error) => {
+      logger.audit({ operation: "runtime.protocol", authorization: "not-reached", result: "error", errorCode: error?.code });
+      return logger.write("error", "Plugin protocol violation", { error: error?.message });
+    };
     runtime = kind === "browser"
       ? this.runtimeFactories.browser({
           electron: this.electron,
@@ -540,6 +545,7 @@ class RuntimeSupervisor {
   }
 
   async #cleanupRuntime(identity) {
+    identity?.logger?.close();
     if (!identity || !this.runtimeCleanup) return;
     await this.runtimeCleanup(Object.freeze({
       pluginId: identity.pluginId,

electron/plugins/runtimeSupervisor.test.cjs

@@ -993,3 +993,39 @@ test('new host initializes an exact legacy API plugin with its negotiated legacy
   assert.deepEqual(observed, ['0.1.0-internal']);
   await fixture.supervisor.stop(fixture.manifest.id);
 });
+
+test('data-only themes never create a runtime on startup or explicit start',async(t)=>{
+ const fixture=createFixture(t,()=>{throw new Error('data pack must not execute');});
+ const manifest={...fixture.manifest,main:{data:'theme'},activationEvents:[],features:{required:['appearance.theme-packs']},contributes:{themes:[{id:fixture.manifest.id+'.light',label:'Light',variant:'light',entry:'light.json'}]}};
+ fixture.database.installVersion({pluginId:manifest.id,version:manifest.version,manifest,archiveSha256:'a'.repeat(64),packageRelativePath:'theme'}, {enable:true});
+ await fixture.supervisor.startEnabled();assert.equal(fixture.runtimeOptions.length,0);
+ await assert.rejects(fixture.supervisor.start(manifest.id),/no executable runtime/);assert.equal(fixture.runtimeOptions.length,0);
+ await fixture.supervisor.shutdown();
+});
+
+test("runtime cleanup closes diagnostic loggers before stale runtime callbacks can write", async (t) => {
+  const { PluginLogger } = require("./pluginLogger.cjs");
+  const loggers = [];
+  const events = [];
+  const fixture = createFixture(t, () => ({
+    async start(config) { return { pluginId: config.pluginId, pluginVersion: config.pluginVersion, apiVersion: config.apiVersion, enabledFeatures: config.enabledFeatures }; },
+    async stop() {},
+  }), { logService: {
+    createLogger(identity) {
+      const logger = new PluginLogger({ identity });
+      loggers.push(logger);
+      return logger;
+    },
+    audit(_identity, event) { events.push(event.operation); },
+  } });
+  t.after(() => fixture.supervisor.shutdown());
+  await fixture.supervisor.start(fixture.manifest.id);
+  assert.equal(loggers[0].closed, false);
+  await fixture.supervisor.stop(fixture.manifest.id);
+  assert.equal(loggers[0].closed, true);
+  assert.deepEqual(events.slice(0, 3), ["runtime.starting", "runtime.running", "runtime.stopped"]);
+  await fixture.runtimeOptions[0].logger.write("info", "synthetic stale callback");
+  await fixture.supervisor.start(fixture.manifest.id);
+  await fixture.supervisor.shutdown();
+  assert.equal(loggers[1].closed, true);
+});

electron/plugins/themeService.cjs

@@ -0,0 +1,220 @@
+"use strict";
+const fs = require("node:fs/promises");
+const { constants } = require("node:fs");
+const path = require("node:path");
+const { createDefinitionValidator } = require("./contractValidator.cjs");
+const { resolveThemePalette } = require("../../domain/pluginThemePack.cjs");
+const { isStaticThemePack } = require("../../domain/pluginRuntimePolicy.cjs");
+const validatePalette = createDefinitionValidator("ThemePackPalette");
+const validateApply = createDefinitionValidator("ThemePackApplyRequest");
+const validateSelection = createDefinitionValidator("ThemePackSelection");
+const limits = require("./generated/plugin-contract.schema.json").$defs
+  .ThemePackLimits.const;
+const key = (ref) =>
+  JSON.stringify([
+    ref.pluginId,
+    ref.themeId,
+    ref.version,
+    ref.digest,
+    ref.variant,
+  ]);
+class PluginThemeService {
+  constructor({ database, packageStore, contributionService }) {
+    Object.assign(this, { database, packageStore });
+    this.generation = 0;
+    this.cache = new Map();
+    this.listeners = new Set();
+    this.tail = Promise.resolve();
+    this.dispose = contributionService?.onDidChange?.((event) => {
+      if (
+        !["initialized", "plugin-enabled", "plugin-disabled"].includes(
+          event.reason,
+        )
+      )
+        return;
+      this.generation++;
+      this.cache.clear();
+      this.emit();
+    });
+  }
+  onDidChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit() {
+    for (const listener of this.listeners) {
+      try {
+        listener();
+      } catch {}
+    }
+  }
+  active(ref) {
+    const p = this.database.getActivePlugin(ref.pluginId);
+    return (
+      p?.enabled &&
+      p.activeVersion === ref.version &&
+      p.archiveSha256 === ref.digest &&
+      p.manifest?.contributes?.themes?.some(
+        (t) => t.id === ref.themeId && t.variant === ref.variant,
+      )
+    );
+  }
+  catalog() {
+    if (!this.pendingCatalog) {
+      const pending = this.readCatalog().finally(() => {
+        if (this.pendingCatalog === pending) this.pendingCatalog = null;
+      });
+      this.pendingCatalog = pending;
+    }
+    return this.pendingCatalog;
+  }
+  async readCatalog(retry = true) {
+    const generation = this.generation,
+      entries = [],
+      diagnostics = [];
+    for (const plugin of this.database.listPlugins()) {
+      if (!plugin.enabled) continue;
+      let packageRoot;
+      for (const theme of plugin.manifest?.contributes?.themes ?? []) {
+        if (entries.length >= limits.catalogEntries) {
+          if (diagnostics.length < 256)
+            diagnostics.push({ pluginId: plugin.id, code: "capacity" });
+          break;
+        }
+        const ref = {
+          pluginId: plugin.id,
+          themeId: theme.id,
+          version: plugin.activeVersion,
+          digest: plugin.archiveSha256,
+          variant: theme.variant,
+        };
+        try {
+          let palette = this.cache.get(key(ref));
+          if (!palette) {
+            const root = (packageRoot ??=
+              await this.packageStore.preparePackageRoot(plugin));
+            const target = path.resolve(root, theme.entry);
+            if (
+              !theme.entry.endsWith(".json") ||
+              !target.startsWith(root + path.sep)
+            )
+              throw new Error("Invalid path");
+            const handle = await fs.open(
+              target,
+              constants.O_RDONLY | constants.O_NOFOLLOW,
+            );
+            try {
+              const stat = await handle.stat();
+              if (!stat.isFile() || stat.size > limits.jsonBytes)
+                throw new Error("Invalid theme size");
+              const bytes = Buffer.alloc(limits.jsonBytes + 1);
+              const { bytesRead } = await handle.read(
+                bytes,
+                0,
+                bytes.length,
+                0,
+              );
+              if (bytesRead > limits.jsonBytes)
+                throw new Error("Invalid theme size");
+              palette = JSON.parse(
+                new TextDecoder("utf-8", { fatal: true }).decode(
+                  bytes.subarray(0, bytesRead),
+                ),
+              );
+            } finally {
+              await handle.close();
+            }
+            if (
+              !validatePalette(palette) ||
+              palette.base !==
+                (theme.variant.endsWith("dark") ? "dark" : "light")
+            )
+              throw new Error("Invalid theme palette");
+            resolveThemePalette(palette);
+            // Only immutable, validated data enters the catalog/cache.
+            palette = JSON.parse(JSON.stringify(palette));
+            if (generation === this.generation && this.active(ref))
+              this.cache.set(key(ref), palette);
+          }
+          if (generation !== this.generation || !this.active(ref)) continue;
+          const label =
+            typeof theme.label === "string"
+              ? theme.label
+              : (theme.label.en ??
+                theme.label.default ??
+                Object.values(theme.label)[0]);
+          entries.push({
+            ref,
+            label,
+            pluginName: plugin.manifest.name,
+            dataOnly: isStaticThemePack(plugin.manifest),
+            palette,
+          });
+        } catch {
+          if (diagnostics.length < 256)
+            diagnostics.push({
+              pluginId: plugin.id,
+              themeId: theme.id,
+              code: "invalid",
+            });
+        }
+      }
+    }
+    // A package change during an async read must never publish an old palette.
+    if (generation !== this.generation) {
+      if (retry) return this.readCatalog(false);
+      throw new Error("Theme packages changed; refresh again");
+    }
+    const selection = this.database.getHostThemeSelection();
+    if (!validateSelection(selection))
+      throw new Error("Invalid saved theme selection");
+    return { selection, entries, diagnostics };
+  }
+  apply(request) {
+    const run = async () => {
+      if (!validateApply(request))
+        throw new TypeError("Invalid theme selection request");
+      const { selection, entries } = await this.catalog();
+      if (selection.revision !== request.expectedRevision)
+        throw new Error("Theme selection changed; refresh before applying");
+      if (request.choice) {
+        const entry = entries.find(
+          (e) => key(e.ref) === key(request.choice.ref),
+        );
+        if (
+          !entry ||
+          entry.palette.base !== request.mode ||
+          !this.active(entry.ref)
+        )
+          throw new Error("Theme is no longer available");
+      }
+      if (selection.revision >= Number.MAX_SAFE_INTEGER)
+        throw new Error("Theme revision exhausted");
+      const next = {
+        ...selection,
+        revision: selection.revision + 1,
+        [request.mode]: request.choice,
+      };
+      // Synchronous active check immediately before the atomic preference/audit write.
+      if (request.choice && !this.active(request.choice.ref))
+        throw new Error("Theme changed before apply");
+      this.database.commitHostThemeSelection(
+        request.expectedRevision,
+        next,
+        request.choice?.ref.pluginId,
+      );
+      this.emit();
+      return this.catalog();
+    };
+    const result = this.tail.then(run);
+    this.tail = result.catch(() => {});
+    return result;
+  }
+  shutdown() {
+    if (typeof this.dispose === "function") this.dispose();
+    else this.dispose?.dispose();
+    this.cache.clear();
+    this.listeners.clear();
+  }
+}
+module.exports = { PluginThemeService };

electron/plugins/themeService.test.cjs

@@ -0,0 +1,168 @@
+"use strict";
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+const { PluginDatabase } = require("./database.cjs");
+const { PluginThemeService } = require("./themeService.cjs");
+function fixture(t) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-theme-test-"));
+  const database = new PluginDatabase(path.join(root, "plugins.sqlite"));
+  const manifest = JSON.parse(
+    fs.readFileSync(
+      path.join(
+        __dirname,
+        "../../examples/plugins/forest-theme-pack/netcatty.plugin.json",
+      ),
+      "utf8",
+    ),
+  );
+  const install = (version = "0.1.0", digest = "a".repeat(64)) =>
+    database.installVersion(
+      {
+        pluginId: manifest.id,
+        version,
+        manifest: { ...manifest, version },
+        archiveSha256: digest,
+        packageRelativePath: "theme",
+      },
+      { enable: true },
+    );
+  install();
+  for (const mode of ["light", "dark"])
+    fs.copyFileSync(
+      path.join(
+        __dirname,
+        "../../examples/plugins/forest-theme-pack",
+        mode + ".json",
+      ),
+      path.join(root, mode + ".json"),
+    );
+  let change;
+  const packageStore = {
+    async preparePackageRoot() {
+      return root;
+    },
+  };
+  const service = new PluginThemeService({
+    database,
+    packageStore,
+    contributionService: {
+      onDidChange(listener) {
+        change = listener;
+        return () => {};
+      },
+    },
+  });
+  t.after(() => {
+    service.shutdown();
+    database.close();
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+  return {
+    root,
+    database,
+    service,
+    packageStore,
+    install,
+    change: () => change({ reason: "plugin-disabled" }),
+  };
+}
+test("data-only themes enumerate without runtime, apply with CAS and fixed audit, retain missing preference after disable", async (t) => {
+  const f = fixture(t),
+    catalog = await f.service.catalog();
+  assert.equal(catalog.entries.length, 2);
+  assert.ok(catalog.entries.every((e) => e.dataOnly));
+  assert.equal(catalog.selection.revision, 0);
+  const ref = catalog.entries[0].ref;
+  const applied = await f.service.apply({
+    expectedRevision: 0,
+    mode: "light",
+    choice: { ref },
+  });
+  assert.equal(applied.selection.light.ref.digest, "a".repeat(64));
+  await assert.rejects(
+    f.service.apply({ expectedRevision: 0, mode: "light", choice: { ref } }),
+    /changed/,
+  );
+  assert.deepEqual(f.database.listSecurityAudit(ref.pluginId)[0].details, {
+    revision: 1,
+    action: "apply",
+  });
+  f.database.setEnabled(ref.pluginId, false);
+  f.change();
+  const disabled = await f.service.catalog();
+  assert.equal(disabled.entries.length, 0);
+  assert.deepEqual(disabled.selection.light, { ref });
+  await assert.rejects(
+    f.service.apply({ expectedRevision: 1, mode: "light", choice: { ref } }),
+    /no longer available/,
+  );
+  const restored = await f.service.apply({
+    expectedRevision: 1,
+    mode: "light",
+    choice: null,
+  });
+  assert.equal(restored.selection.light, null);
+});
+test("palette validation rejects unsupported values, low contrast, mode mismatch and bounded oversize", async (t) => {
+  const f = fixture(t);
+  for (const palette of [
+    { formatVersion: 1, base: "light", colors: { accent: "var(--x)" } },
+    { formatVersion: 1, base: "light", colors: { foreground: "#ffffff" } },
+    { formatVersion: 1, base: "light", colors: { muted: "#000000", mutedForeground: "#ffffff" } },
+    { formatVersion: 1, base: "dark", colors: { accent: "#86efac" } },
+    " ".repeat(65537),
+  ]) {
+    fs.writeFileSync(
+      path.join(f.root, "light.json"),
+      typeof palette === "string" ? palette : JSON.stringify(palette),
+    );
+    f.change();
+    const catalog = await f.service.catalog();
+    assert.equal(catalog.entries.length, 1);
+    assert.equal(catalog.diagnostics[0].code, "invalid");
+  }
+});
+test("replacement during an awaited package read cannot publish or apply the old identity", async (t) => {
+  const f = fixture(t);
+  const before = await f.service.catalog(),
+    ref = before.entries[0].ref;
+  f.change();
+  let once = true;
+  f.packageStore.preparePackageRoot = async () => {
+    if (once) {
+      once = false;
+      f.install("0.1.1", "b".repeat(64));
+      f.change();
+    }
+    return f.root;
+  };
+  const catalog = await f.service.catalog();
+  assert.ok(catalog.entries.every((e) => e.ref.version === "0.1.1"));
+  await assert.rejects(
+    f.service.apply({ expectedRevision: 0, mode: "light", choice: { ref } }),
+    /no longer available/,
+  );
+});
+test("preference and audit roll back together on audit failure and survive schema-3 migration", async (t) => {
+  const f = fixture(t),
+    ref = (await f.service.catalog()).entries[0].ref;
+  f.database.db.exec(
+    "CREATE TRIGGER reject_theme_audit BEFORE INSERT ON plugin_security_audit BEGIN SELECT RAISE(ABORT,'synthetic audit failure'); END",
+  );
+  await assert.rejects(
+    f.service.apply({ expectedRevision: 0, mode: "light", choice: { ref } }),
+    /synthetic audit failure/,
+  );
+  assert.equal(f.database.getHostThemeSelection().revision, 0);
+  f.database.db.exec("DROP TRIGGER reject_theme_audit");
+  const file = path.join(f.root, "v3.sqlite");
+  const old = new PluginDatabase(file);
+  old.db.exec("DROP TABLE plugin_host_preferences; PRAGMA user_version=3");
+  old.close();
+  const migrated = new PluginDatabase(file);
+  assert.equal(migrated.getHostThemeSelection().revision, 0);
+  migrated.close();
+});

electron/plugins/viewThemeExamples.test.cjs

@@ -0,0 +1,67 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const fs = require("node:fs");
+const path = require("node:path");
+const { JSDOM } = require("jsdom");
+test("official view examples consume initial/live host HSL tokens and dispose subscriptions", () => {
+  for (const name of [
+    "starter-netcatty",
+    "vault-scratchpad",
+    "session-scratchpad",
+  ]) {
+    const root = path.join(__dirname, "../../examples/plugins", name),
+      dom = new JSDOM("<!doctype html><html></html>", {
+        runScripts: "outside-only",
+      });
+    let listener,
+      disposed = 0,
+      subscriptions = 0;
+    dom.window.netcattyView = {
+      onDidChangeEnvironment(fn) {
+        subscriptions++;
+        listener = fn;
+        return {
+          dispose() {
+            disposed++;
+          },
+        };
+      },
+    };
+    dom.window.eval(fs.readFileSync(path.join(root, "theme.js"), "utf8"));
+    listener({
+      theme: "light",
+      themeTokens: {
+        "--primary": "120 50% 30%",
+        "--background": "0 0% 100%",
+        "--unsupported": "ignored",
+      },
+    });
+    assert.equal(
+      dom.window.document.documentElement.style.getPropertyValue("--primary"),
+      "120 50% 30%",
+    );
+    assert.equal(
+      dom.window.document.documentElement.style.getPropertyValue(
+        "--unsupported",
+      ),
+      "",
+    );
+    listener({
+      theme: "dark",
+      reducedMotion: true,
+      themeTokens: { "--primary": "120 50% 70%" },
+    });
+    assert.equal(dom.window.document.documentElement.style.colorScheme, "dark");
+    assert.equal(
+      dom.window.document.documentElement.style.getPropertyValue(
+        "--background",
+      ),
+      "",
+    );
+    dom.window.dispatchEvent(new dom.window.Event("pagehide"));
+    assert.equal(disposed, 1);
+    dom.window.dispatchEvent(new dom.window.Event("pageshow"));
+    assert.equal(subscriptions, 2);
+    dom.window.close();
+  }
+});

electron/preload/api.cjs

@@ -122,6 +122,18 @@ function createPreloadApi(ctx) {
   }),
   restartPlugin: (pluginId) => ipcRenderer.invoke("netcatty:plugins:restart", { pluginId }),
   uninstallPlugin: (pluginId) => ipcRenderer.invoke("netcatty:plugins:uninstall", { pluginId }),
+  getPluginLogStatus: () => ipcRenderer.invoke("netcatty:plugins:log-status"),
+  configurePluginLogs: (settings) => ipcRenderer.invoke("netcatty:plugins:log-configure", settings),
+  openPluginLogFolder: () => ipcRenderer.invoke("netcatty:plugins:log-open"),
+  exportPluginLogs: () => ipcRenderer.invoke("netcatty:plugins:log-export"),
+  clearPluginLogs: () => ipcRenderer.invoke("netcatty:plugins:log-clear"),
+  getPluginThemes: () => ipcRenderer.invoke("netcatty:plugins:theme-catalog"),
+  applyPluginTheme: (request) => ipcRenderer.invoke("netcatty:plugins:theme-apply", request),
+  onPluginThemesChanged: (callback) => {
+    const listener = () => callback();
+    ipcRenderer.on("netcatty:plugins:themes-changed", listener);
+    return () => ipcRenderer.removeListener("netcatty:plugins:themes-changed", listener);
+  },
   getPluginContributions: (options) => ipcRenderer.invoke("netcatty:plugins:contributions", options ?? {}),
   getPluginBrandIcon: (pluginId) => ipcRenderer.invoke("netcatty:plugins:brand-icon", { pluginId }),
   getPluginContributionIcon: (pluginId, icon) => ipcRenderer.invoke("netcatty:plugins:contribution-icon", { pluginId, icon }),
@@ -270,6 +282,7 @@ function createPreloadApi(ctx) {
   },
   openPluginView: (payload) => ipcRenderer.invoke("netcatty:plugins:open-view", payload),
   closePluginView: (instanceId) => ipcRenderer.invoke("netcatty:plugins:close-view", { instanceId }),
+  focusPluginView: (payload) => ipcRenderer.invoke("netcatty:plugins:focus-view", payload),
   setPluginViewBounds: (instanceId, bounds) => ipcRenderer.invoke("netcatty:plugins:set-view-bounds", { instanceId, bounds }),
   setPluginViewVisibility: (instanceId, visible) => ipcRenderer.invoke("netcatty:plugins:set-view-visibility", {
     instanceId,
@@ -290,6 +303,11 @@ function createPreloadApi(ctx) {
     ipcRenderer.on("netcatty:plugins:view-closed", listener);
     return () => ipcRenderer.removeListener("netcatty:plugins:view-closed", listener);
   },
+  onPluginViewFocused: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on("netcatty:plugins:view-focused", listener);
+    return () => ipcRenderer.removeListener("netcatty:plugins:view-focused", listener);
+  },
   getPluginScopeCatalog: () => ipcRenderer.invoke("netcatty:plugins:get-scope-catalog"),
   setPluginScopeCatalog: (catalog) => ipcRenderer.invoke("netcatty:plugins:set-scope-catalog", catalog),
   onPluginScopeCatalogChanged: (callback) => {

examples/plugins/forest-theme-pack/README.md

@@ -0,0 +1,5 @@
+# Forest Themes
+
+A data-only light/dark host color pack. No JavaScript entrypoint, runtime activation, permissions, network, fonts or external assets. Install and enable through Settings > Plugins; select the current light/dark variant in Appearance > Plugin themes. Preview is local to this window; Apply saves only this device’s host selection. Cancel preview or Restore default returns to host-owned colors. Personal accent and fonts remain authoritative.
+
+Disable, uninstall, update or integrity failure makes an applied version unavailable and falls back to a safe same-mode palette. A changed package is not automatically applied. High-contrast system preferences use the fixed host palette. Terminal palettes and font/density/icon/background changes are not part of this first color-pack contract.

examples/plugins/forest-theme-pack/dark.json

@@ -0,0 +1,19 @@
+{
+  "formatVersion": 1,
+  "base": "dark",
+  "colors": {
+    "background": "#101c16",
+    "foreground": "#f0f9f3",
+    "card": "#17281e",
+    "cardForeground": "#f0f9f3",
+    "popover": "#17281e",
+    "popoverForeground": "#f0f9f3",
+    "secondary": "#21392b",
+    "secondaryForeground": "#f0f9f3",
+    "muted": "#1b3024",
+    "mutedForeground": "#c4dbc9",
+    "accent": "#86efac",
+    "border": "#82a98d",
+    "input": "#82a98d"
+  }
+}

examples/plugins/forest-theme-pack/light.json

@@ -0,0 +1,19 @@
+{
+  "formatVersion": 1,
+  "base": "light",
+  "colors": {
+    "background": "#f4faf6",
+    "foreground": "#16251c",
+    "card": "#ffffff",
+    "cardForeground": "#16251c",
+    "popover": "#ffffff",
+    "popoverForeground": "#16251c",
+    "secondary": "#dcebe1",
+    "secondaryForeground": "#16251c",
+    "muted": "#e7f2eb",
+    "mutedForeground": "#324b3b",
+    "accent": "#166534",
+    "border": "#527360",
+    "input": "#527360"
+  }
+}

examples/plugins/forest-theme-pack/netcatty.plugin.json

@@ -0,0 +1,46 @@
+{
+  "manifestVersion": 1,
+  "id": "com.netcatty.forest-themes",
+  "name": "forest-themes",
+  "displayName": {
+    "en": "Forest Themes",
+    "zh-CN": "森林主题"
+  },
+  "version": "0.1.0",
+  "publisher": "netcatty",
+  "license": "GPL-3.0-or-later",
+  "engines": {
+    "netcatty": ">=0.0.0",
+    "api": ">=0.1.0-internal.1 <0.2.0"
+  },
+  "features": {
+    "required": [
+      "appearance.theme-packs"
+    ]
+  },
+  "main": {
+    "data": "theme"
+  },
+  "contributes": {
+    "themes": [
+      {
+        "id": "com.netcatty.forest-themes.light",
+        "label": {
+          "en": "Forest Light",
+          "zh-CN": "森林浅色"
+        },
+        "variant": "light",
+        "entry": "light.json"
+      },
+      {
+        "id": "com.netcatty.forest-themes.dark",
+        "label": {
+          "en": "Forest Dark",
+          "zh-CN": "森林深色"
+        },
+        "variant": "dark",
+        "entry": "dark.json"
+      }
+    ]
+  }
+}

examples/plugins/session-scratchpad/README.md

@@ -0,0 +1,32 @@
+# Session Scratchpad
+
+Fixture ID: `com.netcatty.session-scratchpad`, version `0.1.1`.
+Required permission: **views**, for this plugin's own pages only. Required
+feature: `views.terminal-sidebar`. No terminal/session read, clipboard, network,
+Vault, filesystem, credential or shell permission is requested.
+
+```sh
+node packages/plugin-cli/dist/cli.js pack examples/plugins/session-scratchpad --out /tmp/session-scratchpad.ncpkg
+```
+
+Import disabled through normal Settings, inspect and enable. Parent native QA
+must obtain a fixture-specific own-views approval; no previous plugin's grant
+applies. Use only an explicitly approved synthetic terminal target, without
+entering commands or connecting to real hosts for this page check.
+
+In an open terminal, choose **Extension pages** in its toolbar, then **Session
+scratchpad**. This is a real existing side-panel pane. Save synthetic text,
+split beside a built-in tool, resize/move/magnify, return and reopen. The host
+keeps this page's state in a placement/session bucket; the page never receives
+the session ID, endpoint, cwd, title, history, selection or terminal output.
+This is plugin-owned text, not a Vault Note, and is not automatically synced.
+
+For a separately approved second synthetic terminal/workspace focus target,
+verify that navigation closes the old native view and uses a separate draft
+bucket. Switch back to verify the saved first draft. Clear it to verify
+deletion. Close the pane, press Escape, disable/revoke, and verify cleanup.
+Settings/permission dialogs and overlapping menus must stay above native
+content. No new native target or persistent grant should be inferred from this
+README; parent coordinates the exact test and records source SHA/package hash.
+
+The page subscribes to `window.netcattyView.onDidChangeEnvironment()` in `theme.js`. It follows the seven public HSL theme variables, including accent changes, without reading host settings or DOM. The subscription is disposed on page hide.

examples/plugins/session-scratchpad/browser.js

@@ -0,0 +1 @@
+export default { activate() {} };

examples/plugins/session-scratchpad/netcatty.plugin.json

@@ -0,0 +1,46 @@
+{
+  "manifestVersion": 1,
+  "id": "com.netcatty.session-scratchpad",
+  "name": "session-scratchpad",
+  "displayName": {
+    "en": "Session Scratchpad",
+    "zh-CN": "会话草稿板"
+  },
+  "version": "0.1.1",
+  "publisher": "netcatty",
+  "license": "GPL-3.0-or-later",
+  "engines": {
+    "netcatty": ">=0.0.0",
+    "api": ">=0.1.0-internal.1 <0.2.0"
+  },
+  "features": {
+    "required": [
+      "views.terminal-sidebar"
+    ]
+  },
+  "main": {
+    "browser": "browser.js"
+  },
+  "activationEvents": [
+    "onView:com.netcatty.session-scratchpad.page"
+  ],
+  "permissions": {
+    "required": [
+      "views"
+    ]
+  },
+  "contributes": {
+    "views": [
+      {
+        "id": "com.netcatty.session-scratchpad.page",
+        "title": {
+          "en": "Session scratchpad",
+          "zh-CN": "会话草稿板"
+        },
+        "location": "terminal-sidebar",
+        "entry": "page.html",
+        "order": 10
+      }
+    ]
+  }
+}

examples/plugins/session-scratchpad/page.css

@@ -0,0 +1,20 @@
+:root { color-scheme: light dark; font: 14px/1.6 system-ui, sans-serif; }
+* { box-sizing: border-box; }
+body { margin: 0; padding: 24px; background: hsl(var(--background, 0 0% 100%)); color: hsl(var(--foreground, 222 47% 12%)); }
+main { min-width: 0; overflow-wrap: anywhere; max-width: 720px; margin: auto; }
+h1 { margin: 0 0 8px; font-size: 22px; line-height: 1.3; letter-spacing: -.02em; }
+p { color: hsl(var(--muted-foreground, 215 20% 35%)); }
+label { display: block; font-weight: 600; }
+textarea { display: block; width: 100%; min-width: 0; resize: vertical; min-height: 140px; margin: 10px 0 16px; padding: 12px; border: 1px solid hsl(var(--border, 215 20% 75%)); border-radius: 10px; background: hsl(var(--muted, 210 20% 96%)); color: inherit; font: inherit; }
+button { padding: 8px 14px; margin: 0 8px 8px 0; border: 1px solid hsl(var(--border, 215 20% 75%)); border-radius: 8px; background: hsl(var(--background, 0 0% 100%)); color: inherit; font: inherit; font-weight: 500; cursor: pointer; }
+#save, #greet { border-color: transparent; background: hsl(var(--primary, 221 83% 45%)); color: hsl(var(--primary-foreground, 0 0% 100%)); }
+button:hover:not(:disabled) { filter: brightness(.96); }
+button:disabled { opacity: .5; cursor: default; }
+button:focus-visible, textarea:focus-visible { outline: 2px solid hsl(var(--primary, 221 83% 45%)); outline-offset: 3px; }
+#status { min-height: 1.5em; font-size: 12px; }
+#result { white-space: pre-wrap; overflow-wrap: anywhere; padding: 16px; border-radius: 10px; background: hsl(var(--muted, 210 20% 96%)); min-height: 48px; }
+.eyebrow { color: hsl(var(--muted-foreground, 215 20% 35%)); font-size: 11px; letter-spacing: .1em; }
+@media (max-width: 360px) { body { padding: 16px; } }
+@media (forced-colors: active) { button, textarea { border: 1px solid ButtonText; } }
+
+@media (prefers-color-scheme: dark) { :root { --background: 221 39% 11%; --foreground: 210 20% 98%; --muted: 219 27% 21%; --muted-foreground: 220 13% 91%; --border: 218 11% 65%; --primary: 213 97% 87%; --primary-foreground: 221 39% 11%; } }