[saphid]

Current verification

At a81bb2429720a158ae5389ebfb2b7cff0cdb0a85, revalidated the responding plugin under the actual thread dispatch lock, after planning and immediately before committing new response events. Disabled, removed, replaced or consent-revoked registrations are refused, leaving the request pending for the user. All four deterministic lock-wait regressions failed before the guard and now pass; the complete selected check passed 35 tests in four files, three affected package typechecks and static checks. The required vp run check:changed 2d6634ef1ab1d3e06f2b656614233c0b6217bb48 passed for this follow-up delta. The earlier main-integration verification below describes its recorded revision and scope.

All eight required hosted checks passed at a81bb24. The current-head Agent context budget job fails on the unchanged inherited MCP tool-list increase, 46,109 → 47,478 bytes (+1,369). The approval-revocation repair adds no further tool-list growth. Maintainer acceptance remains outstanding; no acceptance label or bypass was applied.

Macroscope now marks the approval-revocation finding as no longer relevant at this head. Its updated verdict retains human assessment of the full platform/client scope, lint suppressions and raw-RPC exceptions; it no longer lists the revocation race as blocking. The PR remains excluded from the ready-for-review batch pending those decisions, budget acceptance and current client verification.

Hosted checks and reviews must be assessed at this head. No integrated web/desktop or native-client verification was performed for this follow-up. Existing approval requirements remain.

Follow-up implementation and verification: GPT-6.1 Sol, Codex harness through T3 Code.

Earlier verification

At 2d6634ef1ab1d3e06f2b656614233c0b6217bb48, main 79f1fadfc6020b820d541ca4691d2feebb15dd1b is integrated while preserving the original PR head and branch history. The inherited schema limits, secret-temporary cleanup and frame safeguards passed their recorded intermediate checks. This final update requires full-access/default mode for trusted agent plugin calls, while restricted and planning callers can still list tools. Asset and manifest readers use nonblocking opened handles; manifest reads stop at 64 KiB plus one byte. The common mode/read implementation matches the validated #16056 repair and carries its existing regressions.

vp run check:changed 9de50ee0cb82732f4a891693783bcef3915aa80a passed for the final delta: 172 tests across 13 selected files, 11 compiler cases, 39 affected package typechecks, formatting, lint, knip, applicable patch checks and server GraphQL checks. The intermediate inherited-fix check also passed before this delta. These are staged local checks; earlier evidence below applies to its stated revision.

All eight required checks passed at this head. The separate Agent context budget job fails because mcpToolListJsonBytes grows from 46,109 to 47,478 bytes (+1,369), matching the inherited plugin tool-list increase. Maintainer acceptance of that growth remains outstanding, along with plugin scope and diagnostic-suppression approval. Other hosted checks and reviews must be assessed at this head. This PR is excluded from the ready-for-review batch while these gates remain. Macroscope’s current verdict also retains a queued approval revocation race: a reply can wait for the thread dispatch lock after catalogue invocation, then commit after the plugin is disabled, removed or replaced. Source inspection confirms there is no authorization recheck after this wait. A deterministic regression and repair are in progress; no fix or passing proof is claimed yet. No integrated web/desktop or native-client pass was performed for this update. Standard pairings retain main's access:write; mobile keeps its read-only plugin screens.

Implementation and verification: GPT-6.1 Sol, Codex harness through T3 Code.

Earlier source checkpoint

Source revision 7d5cb86e08, integrated main 49597c77db579062bb70a26e416df7efbb14db71. Later live main d7a8d6f32001444e013aa07c8a468ce3e987f9cf had a clean virtual merge; shared-file edits occupy disjoint source ranges and the complete feature patch is unchanged against that live base. Three selected shell-resume/query tests and server types also passed on the separately recorded synthetic merge at push time; it is recorded separately from the tested integrated base.

Verified hosted fixture failures were addressed at source with narrow runtime mocks, typed prepared-connection state and visible lazy-panel readiness receipts. Pinned scoped formatting, type-aware lint, web types, source mock/assertion audits and the recorded affected non-browser panel tests pass. These focused checks do not certify the hosted browser suite; browser tests were not executed locally. Device discovery-warning, centered-loading and cross-scope pending/success cases removed during integration are restored: six parameterized/nonparameterized definitions retain 34 assertions. The late-failure expectation explicitly follows current scope-retained error semantics, rather than asserting the obsolete hidden-on-return behavior. Remaining plugin fixtures use disposable rendering with per-test cleanup; all feature browser fixtures receive scoped lint and mock-export audit. The large timeline change follows main’s existing component/test extraction: MessagesTimeline.tsx is byte-identical to integrated main and all 13 main browser test definitions and assertions remain, with plugin context/approval cases added. Original monolithic baseline tests are not claimed preserved test-for-test. Migration compatibility runs transactionally before the V2 guard: upstream 67/68 and historical migration bodies are preserved, plugin slots are 69–71 where applicable, and only exact known legacy histories are reconciled. All 14 focused compatibility tests pass, including sentinel data/timestamps, reentry, unknown-history rejection and injected SQL rollback. RunMetrics retains exact run.updated/run.finalized payload assertions and the unrelated thread.created event. Live create() secret temporaries include the writer PID; the concurrent-initializer regression is retained. npm replacement journals and persisted outcomes carry an optional exact attempt ID; earlier same-digest markers cannot authenticate a new failed repair. Both service signatures expose the optional ID, legacy journals retain compatibility, and all 49 npm/catalog tests pass, including failed repair/retry and restart regressions. Update equality uses installed source bytes; the header now describes persisted settlement and cleanup retry. The mobile notification banner import now resolves to components/ui/AppText.

No browser, desktop, native-client or dev-server execution was performed. Local source/non-browser proof is separate from hosted acceptance; earlier CI and media retain their named historical revisions. Vite Plus 1.3.0 (oxfmt 0.73.0, oxlint 1.88.0, Vitest 5.0.5) supersedes the earlier 1.0 formatter evidence. Mobile types are not certified green: the 12 native dependency/API diagnostics reproduced on the integrated-main baseline. Existing maintainer/product/client/native acceptance requirements remain where applicable; this repair pass grants no product approval. The implementation descriptions, media and validation below remain historical at their named revisions, including dated uses of current/head.

Scope and approval

The actual target is main: 359 files, +50,110 / −975, from comparison merge base 07cb902 to c7456b5. Observed upstream main is 16918b5, distinct from the merge base. Review the complete base-to-head contribution. The old top-commit-only instruction and 12-file size described the original example increment, not this full main-targeted PR.

The full contribution includes the shared panel registry/host refactor, provider/Pi contribution status, and trusted plugin platform: source inspection/consent, supervised execution/IPC, persistent installations/settings/event cursors, event delivery, actions, tools, views, npm installation/updates, authorization/RPC contracts, contribution descriptions, notifications, context transforms, plugin approval handling, and web/desktop/mobile workflows. The final layer adds examples and trust documentation. Original preceding layers include #16064 and #15010.

Maintainer direction and approval remain outstanding. No approval of the plugin-system proposal in #6837 / #6714 has been identified. The full contribution also needs assessment of execution, authorization, orchestration, product-default changes and diagnostic suppressions. Macroscope's human-approval verdict remains applicable; the repairs below address its two concrete findings without granting platform approval. The PR stays open and unmerged.

Change

• examples/plugins/turn-notifier: events + notifications. Notifies when a turn ends ("finished: Fix login", "failed: Upgrade deps"), or when finishing it fails (names the failed step), and offers to open the thread.
• examples/plugins/todo-count: tools. Gives agents a count_todos tool with a declared input schema; read-only, skips hidden entries and node_modules, caps files and size, honours cancellation.
• examples/plugins/machine-label: events + settings + status. Shows a configurable label and color on threads that finish a turn, defaulting to the host name.
• Each is a plain directory (manifest, one .mjs, a README with install steps) using only the documented proposed API. They are not workspace packages and nothing imports them.
• apps/server/src/plugins/examplePlugins.test.ts installs each copy through the real manifest loader, catalogue (add → approve → enable) and supervisor, running real plugin child processes, and asserts the notifications, tool results and statuses a user would see.
• docs/user/plugins.md "Writing a plugin" points to the examples.
• docs/internals/plugins.md records the cross-PR decisions a maintainer could otherwise get wrong, now that every capability in this stack exists: plugins are trusted code and the child process is an availability boundary, not a sandbox; consent binds an inspected tree, not executed-artifact identity; contributions are static manifest declarations and new requirements are new capability names; per-session capability gating at send time; reserved t3. names and host-method prefixes; the generation as revocation epoch and disable ordering.

Current recovery

c7456b5 follows cf89377: 47 files, +840 / −328, with renames detected.

• Fix cold activation exceeding the enrichment deadline. Startup now belongs to a supervisor-scoped fiber that publishes one shared outcome. The first caller waits interruptibly, just like later callers, so PluginContextEnrichment can skip at its declared deadline without waiting for the activation deadline. Activation continues under its existing timeout and lifecycle controls, and other waiters still receive its outcome. No detached or unsupervised process is introduced.
• Fix notification outcomes lost on long thread titles. The example puts the outcome first in both finalized and finalization-failed titles. Server truncation to 80 characters preserves whether a turn finished, failed, was interrupted, was cancelled, or failed during finalization. Existing short-title expectations now match the new wording.
• Carry the matching preceding-layer repairs: plugin management requires both access:write and terminal:operate, with matching client gating/guidance and restricted-credential regressions; moved mobile UI imports; DOM/browser migration away from the removed renderer; compiler-compatible cleanup; formatting; multiline text/secret settings; interrupted stop/enable sequencing; invalid UTF-8 source-name refusal; reconnect coverage; view-state reset during disconnect/replacement; and the failed-context timeline test's full accessible name. Later approvals, examples and context changes are preserved. No new baseline reproduction is claimed for these inherited repairs.

Historical verification at c7456b5

Checks ran in an exact-parent non-Git archive with the frozen repair, using existing dependencies. Temporary configs and artifacts are excluded from the commit. Shared worktrees were not switched or staged.

• Both new regressions failed before the production fixes. The cold-start test waits for a real child's activation receipt, advances TestClock to the 2-second enrichment deadline while the 10-second startup remains pending, and verifies enrichment has finished; original code reported false. The notification test installs the real example and delivers completed, failed, interrupted, cancelled and finalization-failed events with 100-character thread names; original code lost every outcome. Both pass after repair, with no timing sleeps.
• Server: 15 files, 182 passed; 2 Linux-only skips. This includes source/catalogue/npm/settings and RPC authorization, context enrichment, notifications, supervisor lifecycle, plugin approvals and the example plugins. The new-finding suites contribute 13 tests, lifecycle/approvals 53, and the remaining inherited suites 116. Existing concurrent-start waiters, cancellation, disable/re-enable, activation failures, process limits and approval behavior remain covered.
• Shared runtime: 12 files, 223 passed, including plugin state, access gating, view reset, notification state and work-log presentation/detail.
• Contracts: 2 files, 36 passed — authentication and transform schemas.
• Web: 17 files, 69 passed with a temporary compiler-enabled jsdom config; 9 targeted React Compiler checks passed with a temporary Node config.
• Mobile pure logic: 4 files, 18 passed — plugin actions, settings values, notification banners and contribution status.
• tsc-rs --noEmit -p <package>/tsconfig.json passed for server, web, mobile, client-runtime and contracts. Targeted lint and formatting passed, with three inherited warnings: two schema-compilation warnings and one array-index key in a panel test fixture.

Total: 528 focused tests plus 9 compiler checks passed; 2 Linux-only raw-filename cases skipped on macOS. No repo-wide suite was run. Native Chromium is unavailable locally because @vitest/browser-playwright is missing; jsdom results do not verify native rendering or the virtualized timeline case. No fresh integrated web, desktop, iOS or Android proof was captured. Node is 24.12.0, below the declared ^24.13.1. No dependencies were installed.

Historical CI at c7456b5 is blocked by Test Web and its aggregate Check. The web log exits with an unhandled route.fulfill: Route is already handled! rejection at @vitest/browser-playwright/dist/index.js:1113; it does not identify a source-level cause. Lint, Build and Typecheck, Test, all eight server shards, Release Smoke and Rust passed. Native fingerprint diff has a successful run after an earlier cancellation. Local jsdom results do not establish that this CI browser failure or the virtualized timeline case is fixed.

Fresh independent review was skipped under the recovery instruction forbidding delegates. Source review of the frozen repair found no additional actionable issue; this is not independent approval of the complete platform. No bot replies, resolutions, dismissals, retriggers or billing/seat changes were made.

Historical visual evidence

The following observations and images belong to the original example layer at f2955898a3 or its earlier capture revision; the later rebased description named af081bceca21f00c49b53ee3a6b4dddaf0f6c737. They were captured on macOS arm64 against an isolated dev server labelled “Proof server”, fresh state, using web and Codex GPT-6.1 Sol turns, with examples copied unchanged and added, approved and enabled through Settings. Each example was also disabled to check its reverse state.

These are historical observations, not verification of this recovery. The notifier image uses the old thread-first wording; the outcome-first wording and cold-start deadline fix have not been captured in a current client. Fresh comparable images/video remain outstanding. No server, browser, desktop or device session was launched during this recovery.

Example	Effect observed
Machine label (Label set to "Proof server", Color Green)	after a finished turn, a status frame and a green "Proof server" chip on the thread; disabling clears it and the next turn does not restore it
Turn notifier	after a finished turn, a notification frame (example.turn-notifier, " finished", tone success) and a toast with Open thread; disabled → no notification on the next turn
TODO count	in a new session the agent called plugin_tools_list then plugin_tool_call and reported 3 markers (index.js 2, README.md 1); disabled → the next turn does not call it

Remaining limits

• Platform direction, orchestration conventions, product-default changes and diagnostic suppressions still need human assessment; no merge or close is authorized here.
• Native Chromium, fresh integrated-client proof and Linux raw-filename regressions remain unverified locally. The inherited failed-context timeline assertion needs CI confirmation.
• Historical example proof used web and Codex only. Desktop/mobile renderer equivalence and other providers were not live-tested by this recovery; local, remote/relay and tunnel paths have no new integrated proof.
• The example tests do not cover notification rate-limit drops, status eviction after 16 threads, or TODO scan truncation/cancellation.
• Mobile plugin administration and npm updates remain deferred. Permission defaults and stored credentials are unchanged by the recovery.

Original implementation: Claude Opus 5.5 through Claude Code/T3 Code; historical attribution names GPT-6.1 Sol for review and GPT-6 Astra for captures. Current recovery: GPT-6.1 Sol (high), Codex harness in T3 Code. No fresh independent reviewer participated.

2026-10-23 source repair: GPT-6.1 Sol, Codex harness through T3 Code.

[macroscopeapp]

Macroscope has since reviewed this pull request. An earlier review was skipped by a cost limit; a review has now completed, so that notice no longer applies.

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This PR includes the plugin platform and client integrations, beyond its documentation title. New lint-suppression directives and expanded raw-RPC analysis exceptions require human assessment.

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[saphid]

Review requested

Date (UTC)	Reviewer	Where
2026-10-06	Julius	Discord DM

_{Logged so this PR shows when a maintainer was asked to review it.}