6f91f87f3b
refactor(tasks): move task-flow ownership under tasks
2026-04-02 21:40:40 +09:00
9823833383
fix(plugins): preserve activation provenance ( #59641 )
...
* fix(plugins): preserve activation provenance
* fix(gateway): preserve activation reason metadata
* fix(plugins): harden activation state policy
2026-04-02 20:57:14 +09:00
6eca1949d5
refactor(plugins): tighten web fetch provider boundary ( #59646 )
...
* refactor(plugins): tighten web fetch provider boundary
* fix(config): sync fetch secret parity and baseline
* fix(ci): enforce web fetch boundary guard
2026-04-02 20:53:57 +09:00
b6c3ecedd8
refactor(tasks): update plugin and acp task-flow consumers
2026-04-02 20:43:03 +09:00
c405bcfa98
refactor(providers): centralize request capabilities ( #59636 )
...
* refactor(providers): centralize request capabilities
* fix(providers): harden comparable base url parsing
2026-04-02 20:26:22 +09:00
38d2faee20
!feat(plugins): add web fetch provider boundary ( #59465 )
...
* feat(plugins): add web fetch provider boundary
* feat(plugins): add web fetch provider modules
* refactor(web-fetch): remove remaining core firecrawl fetch config
* fix(web-fetch): address review follow-ups
* fix(web-fetch): harden provider runtime boundaries
* fix(web-fetch): restore firecrawl compare helper
* fix(web-fetch): restore env-based provider autodetect
* fix(web-fetch): tighten provider hardening
* fix(web-fetch): restore fetch autodetect and compat args
* chore(changelog): note firecrawl fetch config break
2026-04-02 20:25:19 +09:00
bbf9800a8e
Plugins: add bound TaskFlow runtime ( #59622 )
...
Merged via squash.
Prepared head SHA: b4649f3238132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-04-02 13:17:09 +02:00
f65da8711a
fix(plugin-sdk): narrow cli discord and matrix contract seams ( #59565 )
2026-04-02 19:40:04 +09:00
d90c8db491
fix(plugin-sdk): narrow discord and matrix core seam imports ( #59557 )
2026-04-02 17:40:06 +09:00
a5cd921053
revert: remove TinyFish bundled plugin
2026-04-02 03:07:33 -04:00
b880118d2d
feat: add TinyFish as bundled browser automation plugin ( #58645 )
...
* feat: add TinyFish as bundled browser automation plugin
Add a default-off bundled `tinyfish` plugin with one tool
(`tinyfish_automation`) for hosted browser automation of complex public
web workflows. Follows the existing plugin architecture pattern.
- Plugin entry, manifest with contracts, config schema, SecretRef support
- SSE stream parser with COMPLETE-terminal, SSRF guards, credential rejection
- Bundled skill with escalation guidance (web_fetch -> web_search -> tinyfish -> browser)
- Docs page, labeler rule, glossary entry, changelog entry
- 21 tests covering request serialization, auth, security, streaming, and error paths
Closes #41300
* plugins: address review feedback and regenerate baselines
- Split API_INTEGRATION into TINYFISH_API_INTEGRATION and CLIENT_SOURCE
for semantic clarity (Greptile P2)
- Wrap post-finally parseEventBlock in try/catch so trailing malformed
data does not mask "stream ended before COMPLETE" error (Greptile P2)
- Regenerate config-baseline and plugin-sdk-api-baseline for new plugin
---------
Co-authored-by: Simantak Dabhade <simantak@mac.local >
2026-04-02 01:46:05 -04:00
7771c69caf
fix(plugins): enforce activation before shipped imports ( #59136 )
...
* fix(plugins): enforce activation before shipped imports
* fix(plugins): remove more ambient bundled loads
* fix(plugins): tighten scoped loader matching
* fix(plugins): remove channel-id scoped loader matches
* refactor(plugin-sdk): relocate ambient provider helpers
* fix(plugin-sdk): preserve unicode ADC credential paths
* fix(plugins): restore safe setup fallback
2026-04-02 11:18:49 +09:00
c22233d96c
Revert "refactor(plugins): remove before_install hook"
2026-04-01 19:57:07 -05:00
71346940ad
refactor: add provider replay runtime hook surfaces ( #59143 )
...
Merged via squash.
Prepared head SHA: 56b41e87a5d6d6df4d0a978c3b44d536790d036b
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-04-01 13:45:41 -07:00
7cb323d84f
feat(plugins): add before_agent_reply hook (claiming pattern) ( #20067 )
...
Merged via squash.
Prepared head SHA: e40dfbdfb9a66debccb3ef80c7092f76d1db97a5
Co-authored-by: JoshuaLelon <23615754+JoshuaLelon@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-04-01 13:31:11 -07:00
90eb5b073f
fix: pass session identity to plugin commands ( #59044 )
...
Merged via squash.
Prepared head SHA: 0f7a23f139437ac549519f137054a6fb77a3bf4e
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-04-01 13:07:17 -07:00
32ae841098
feat(web-search): add SearXNG as bundled web search provider plugin ( #57317 )
...
* feat(web-search): add bundled searxng plugin
* test(web-search): cover searxng config wiring
* test(web-search): include searxng in bundled provider inventory
* test(web-search): keep searxng ordering aligned
* fix(web-search): sanitize searxng result rows
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-04-01 19:24:33 +09:00
fbe3ca4d7d
fix(plugins): pass dangerouslyForceUnsafeInstall through archive and … ( #58879 )
...
Merged via squash.
Prepared head SHA: 87eb27d902e03fa9ae5804e652b931464ed3d970
Co-authored-by: ryanlee-gemini <181323138+ryanlee-gemini@users.noreply.github.com >
Co-authored-by: odysseus0 <8635094+odysseus0@users.noreply.github.com >
Reviewed-by: @odysseus0
2026-04-01 02:52:01 -07:00
fb28b02540
fix: preserve bundled channel plugin compat ( #58873 )
...
* fix: preserve bundled channel plugin compat
* fix: preserve bundled channel plugin compat (#58873 )
* fix: scope channel plugin compat to bundled plugins (#58873 )
2026-04-01 14:42:36 +05:30
d4643e06bd
fix(line): resolve dist runtime contract path
2026-04-01 13:20:50 +05:30
042a9ab48a
test: fix plugin-sdk subpaths contract imports
2026-04-01 03:02:34 +01:00
f5a23b710c
test: move plugin-sdk index and root alias guardrails
2026-04-01 02:50:22 +01:00
016f065d7e
test: move remaining plugin-sdk guardrails to contracts
2026-04-01 02:46:50 +01:00
7e02005ca9
test: move plugin-sdk guardrails to contracts suite
2026-04-01 02:41:02 +01:00
3c69e1ea4e
test: drop low-signal plugin runtime type contract
2026-04-01 02:29:18 +01:00
ed8e6b0a74
plugins: suppress provenance warning for allowlisted local plugins ( #58604 )
...
Co-authored-by: me <shlomo@vmi1916417.contaboserver.net >
2026-03-31 21:10:30 -04:00
4af52a7428
test: centralize provider runtime, discovery, and auth contracts
2026-04-01 01:49:11 +01:00
78be556299
test: consolidate plugin registration contracts
2026-04-01 01:46:56 +01:00
63819bb383
test: consolidate provider and web-search contracts
2026-04-01 01:44:43 +01:00
c41df4873e
test: consolidate package manifest and core-extension contracts
2026-04-01 01:44:43 +01:00
ce58f55fe0
fix: require doctor migration for legacy web search config
2026-04-01 04:22:41 +09:00
62e13bbf21
style: format sandbox and helper files
2026-03-31 18:44:39 +01:00
fcb802e826
refactor(plugins): remove before_install hook
2026-04-01 02:28:06 +09:00
8bf8baef87
Revert "refactor: move tasks into bundled plugin"
...
This reverts commit c75f4695b7
2026-04-01 01:30:22 +09:00
759d37635d
Revert "refactor: move tasks behind plugin-sdk seam"
...
This reverts commit da6e9bb76f
2026-04-01 01:30:22 +09:00
78e74d4a64
Plugins: preserve prompt build system prompt precedence ( #58375 )
2026-03-31 16:52:09 +01:00
85611f0021
fix: tighten gateway startup plugin loading
2026-04-01 00:20:06 +09:00
bf96c67fd1
fix: align skill install security gate
2026-03-31 15:53:29 +01:00
0d7f1e2c84
feat(security): fail closed on dangerous skill installs
2026-03-31 23:27:20 +09:00
da6e9bb76f
refactor: move tasks behind plugin-sdk seam
2026-03-31 15:22:09 +01:00
c75f4695b7
refactor: move tasks into bundled plugin
2026-03-31 15:22:08 +01:00
0ed7f1fd22
refactor: remove core WhatsApp runtime channel seam
2026-03-31 15:17:13 +01:00
44b9936136
feat(plugins): add dangerous unsafe install override
2026-03-31 23:16:11 +09:00
c1ea0ae9c8
build: update deps and align pi sdk usage
2026-03-31 22:56:20 +09:00
5a93344d82
fix: ship bundled runtime support packages
2026-03-31 14:25:32 +01:00
2ce44ca6a1
fix(plugins): guard marketplace archive downloads ( #58267 )
...
* Plugins: guard marketplace archive downloads
* Plugins: harden marketplace download cleanup
* Plugins: bound marketplace archive downloads
* Plugins: harden marketplace archive failures
* Plugins: reject drive-relative marketplace archives
* Plugins: stream marketplace archive downloads
2026-03-31 12:59:42 +01:00
8dfbcaa200
fix(ci): default local low-memory checks
2026-03-31 15:05:04 +09:00
3059eadca2
test: fix provider runtime mocks and test planner load shedding
2026-03-31 11:04:28 +05:30
ab8d999917
docs: fix sandbox scope default (session -> agent per resolveSandboxScope)
2026-03-31 14:24:19 +09:00
235908c30e
fix: support multi-kind plugins for dual slot ownership ( #57507 ) (thanks @fuller-stack-dev)
...
* feat(plugins): support multi-kind plugins for dual slot ownership
* fix: address review feedback on multi-kind plugin support
- Use sorted normalizeKinds() for kind-mismatch comparison in loader.ts
(fixes order-sensitive JSON.stringify for arrays)
- Derive slot-to-kind reverse mapping from SLOT_BY_KIND in slots.ts
(removes hardcoded ternary that would break for future slot types)
- Use shared hasKind() helper in config-state.ts instead of inline logic
* fix: don't disable dual-kind plugin that still owns another slot
When a new plugin takes over one slot, a dual-kind plugin that still
owns the other slot must not be disabled — otherwise context engine
resolution fails at runtime.
* fix: exempt dual-kind plugins from memory slot disablement
A plugin with kind: ["memory", "context-engine"] must stay enabled even
when it loses the memory slot, so its context engine role can still load.
* fix: address remaining review feedback
- Pass manifest kind (not hardcoded "memory") in early memory gating
- Extract kindsEqual() helper for DRY kind comparison in loader.ts
- Narrow slotKeyForPluginKind back to single PluginKind with JSDoc
- Reject empty array in parsePluginKind
- Add kindsEqual tests
* fix: use toSorted() instead of sort() per lint rules
* plugins: include default slot ownership in disable checks and gate dual-kind memory registration
2026-03-31 10:06:48 +05:30
Vincent Koc