@abot-ai/runtime 1.5.0 → 1.7.0

package/dist/src/web-ui/plugin-configuration-service.js

@@ -0,0 +1,66 @@
+import { realpathSync } from "node:fs";
+import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/configured-manifests.js";
+import { configuredPluginSecret, } from "../runtime/plugins/configuration-context.js";
+import { PluginConfigurationError, readPluginConfigurationStore, } from "../runtime/plugins/configuration-store.js";
+import { commitPluginConfigurationStore, withPluginConfigurationLock, } from "../runtime/plugins/configuration-write.js";
+import { withConfigDashboardRootTransaction } from "./config-dashboard-save-transaction.js";
+import { parsePluginConfigurationUpdate } from "./plugin-configuration-input.js";
+import { pluginConfigurationRevision, projectPluginConfiguration, } from "./plugin-configuration-view.js";
+function installedPluginDeclaration(rootDir, pluginId) {
+    const plugin = discoverConfiguredRuntimePluginManifests(rootDir).find((entry) => entry.manifest.name === pluginId);
+    if (!plugin)
+        throw new PluginConfigurationError("plugin_not_found", "The selected plugin is not installed.", 404);
+    const extension = plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION];
+    return { settings: extension.settings, secrets: extension.secrets };
+}
+export function getRuntimePluginConfiguration(options, pluginId) {
+    return projectPluginConfiguration(pluginId, installedPluginDeclaration(options.rootDir, pluginId), readPluginConfigurationStore(options.rootDir));
+}
+function requireInstallationSecrets(declaration, configuration) {
+    for (const [name, secret] of Object.entries(declaration.secrets ?? {})) {
+        if (!secret.required)
+            continue;
+        if (configuredPluginSecret(name, secret, configuration))
+            continue;
+        throw new PluginConfigurationError("plugin_secret_required", `Configure the required secret ${name} before installing.`);
+    }
+}
+/** Configuration and package selection commit under the same locks as Apply. */
+export async function saveRuntimePluginConfiguration(options, params) {
+    const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
+    if (!source.exists)
+        throw new PluginConfigurationError("runtime_setup_required", "Complete Runtime setup before configuring plugins.", 409);
+    const rootDir = realpathSync(options.rootDir);
+    return withConfigDashboardRootTransaction(realpathSync(source.path), params.transaction, () => withPluginConfigurationLock(rootDir, async () => {
+        options.requireMutationIdle?.();
+        const declaration = installedPluginDeclaration(rootDir, params.pluginId);
+        const previous = readPluginConfigurationStore(rootDir);
+        const local = Object.hasOwn(previous.plugins, params.pluginId)
+            ? previous.plugins[params.pluginId]
+            : undefined;
+        if (params.installation && params.input === undefined) {
+            requireInstallationSecrets(declaration, local);
+            return {
+                result: await params.commit?.(),
+                configuration: projectPluginConfiguration(params.pluginId, declaration, previous),
+            };
+        }
+        const update = parsePluginConfigurationUpdate(params.input, declaration, local);
+        if (update.revision !==
+            pluginConfigurationRevision(params.pluginId, declaration, previous))
+            throw new PluginConfigurationError("plugin_configuration_changed", "Plugin configuration changed. Reload the form before saving.", 409);
+        if (params.installation)
+            requireInstallationSecrets(declaration, update.configuration);
+        options.requireMutationIdle?.();
+        const result = await commitPluginConfigurationStore(rootDir, previous, {
+            ...previous.plugins,
+            [params.pluginId]: update.configuration,
+        }, async () => params.commit?.());
+        return {
+            result,
+            configuration: projectPluginConfiguration(params.pluginId, declaration, readPluginConfigurationStore(rootDir)),
+        };
+    }));
+}

package/dist/src/web-ui/plugin-configuration-view.d.ts

@@ -0,0 +1,25 @@
+import { type PluginConfigurationDeclaration } from "../runtime/plugins/configuration-context.js";
+import type { PluginConfigurationSnapshot, PluginLocalConfiguration } from "../runtime/plugins/configuration-store.js";
+export declare function pluginConfigurationRevision(pluginId: string, declaration: PluginConfigurationDeclaration, store: PluginConfigurationSnapshot): string;
+/** Password values never enter browser projections, including installation review. */
+export declare function projectPluginConfiguration(pluginId: string, declaration: PluginConfigurationDeclaration, store: PluginConfigurationSnapshot): {
+    pluginId: string;
+    revision: string;
+    scope: "installation";
+    defaults: Readonly<Record<string, unknown>>;
+    settings: Record<string, unknown>;
+    settingOverrides: string[];
+    retainedSecrets: {
+        name: string;
+        env: string;
+        configured: boolean;
+    }[];
+    secrets: {
+        name: string;
+        env: string;
+        required: boolean;
+        configured: boolean;
+        locallyConfigured: boolean;
+    }[];
+};
+export declare function hasConfigurablePluginValues(declaration: PluginConfigurationDeclaration, local?: PluginLocalConfiguration): boolean;

package/dist/src/web-ui/plugin-configuration-view.js

@@ -0,0 +1,45 @@
+import { retainedPluginSecrets } from "./plugin-configuration-retained-secrets.js";
+import { createHmac, randomBytes } from "node:crypto";
+import { configuredPluginSecret, effectivePluginSettings, } from "../runtime/plugins/configuration-context.js";
+// Tokens stay stable within this Web process; a restart requires reloading forms.
+// The private key prevents browser-visible revisions from verifying secret guesses.
+const configurationRevisionKey = randomBytes(32);
+export function pluginConfigurationRevision(pluginId, declaration, store) {
+    return createHmac("sha256", configurationRevisionKey)
+        .update(JSON.stringify([
+        pluginId,
+        declaration.settings?.defaults ?? {},
+        declaration.secrets ?? {},
+        store.revision,
+    ]))
+        .digest("hex");
+}
+/** Password values never enter browser projections, including installation review. */
+export function projectPluginConfiguration(pluginId, declaration, store) {
+    const local = Object.hasOwn(store.plugins, pluginId)
+        ? store.plugins[pluginId]
+        : undefined;
+    return {
+        pluginId,
+        revision: pluginConfigurationRevision(pluginId, declaration, store),
+        scope: "installation",
+        defaults: declaration.settings?.defaults ?? {},
+        settings: effectivePluginSettings(declaration, local),
+        settingOverrides: Object.keys(declaration.settings?.defaults ?? {}).filter((name) => !!local && Object.hasOwn(local.settings, name)),
+        retainedSecrets: retainedPluginSecrets(declaration, local),
+        secrets: Object.entries(declaration.secrets ?? {}).map(([name, secret]) => ({
+            name,
+            env: secret.env,
+            required: secret.required,
+            configured: Boolean(configuredPluginSecret(name, secret, local)),
+            locallyConfigured: local?.secrets[name]?.env === secret.env,
+        })),
+    };
+}
+export function hasConfigurablePluginValues(declaration, local) {
+    if (Object.keys(declaration.settings?.defaults ?? {}).length > 0)
+        return true;
+    if (Object.keys(declaration.secrets ?? {}).length > 0)
+        return true;
+    return retainedPluginSecrets(declaration, local).length > 0;
+}

package/dist/src/web-ui/plugin-disabled-selection.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimePluginConfig } from "../runtime/ports.js";
+/** Update only the exact plugin-ID block; leave all tool policy untouched. */
+export declare function updatePluginDisabledIds(params: {
+    current: RuntimePluginConfig;
+    pluginId: string;
+    enabled: boolean;
+}): RuntimePluginConfig;

package/dist/src/web-ui/plugin-disabled-selection.js

@@ -0,0 +1,17 @@
+/** Update only the exact plugin-ID block; leave all tool policy untouched. */
+export function updatePluginDisabledIds(params) {
+    const { current, pluginId, enabled } = params;
+    const disabledPluginIds = current.disabledPluginIds ?? [];
+    if (enabled) {
+        const { disabledPluginIds: _disabled, ...settings } = current;
+        const remaining = disabledPluginIds.filter((id) => id.trim() !== pluginId);
+        return {
+            ...settings,
+            ...(remaining.length ? { disabledPluginIds: remaining } : {}),
+        };
+    }
+    const alreadyDisabled = disabledPluginIds.some((id) => id.trim() === pluginId);
+    if (alreadyDisabled)
+        return current;
+    return { ...current, disabledPluginIds: [...disabledPluginIds, pluginId] };
+}

package/dist/src/web-ui/plugin-management-catalog.d.ts

@@ -15,6 +15,8 @@ export type RuntimePluginSnapshot = {
         description?: string;
         version?: string;
         pluginEnabled: boolean;
+        removable: boolean;
+        configurable: boolean;
         capabilities: RuntimePluginCapabilitySnapshot[];
         capabilityCount: number;
         selectedCapabilityCount: number;
@@ -23,4 +25,4 @@ export type RuntimePluginSnapshot = {
     }>;
     application: "restart_required";
 };
-export declare function projectPluginSnapshot(manifests: readonly DiscoveredAgentPluginManifest[], config: RuntimePluginConfig): RuntimePluginSnapshot;
+export declare function projectPluginSnapshot(manifests: readonly DiscoveredAgentPluginManifest[], config: RuntimePluginConfig, consumerRoot?: string): RuntimePluginSnapshot;

package/dist/src/web-ui/plugin-management-catalog.js

@@ -1,3 +1,6 @@
+import { readPluginConfigurationStore } from "../runtime/plugins/configuration-store.js";
+import { hasConfigurablePluginValues } from "./plugin-configuration-view.js";
+import { installedPluginPackage } from "../runtime/plugins/installation/installed-package.js";
 import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
 import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
 import { capabilityPolicyBlockReason, pluginParentBlockReason, } from "./plugin-capability-selection.js";
@@ -30,8 +33,11 @@ function projectPluginCapabilities(plugin, selection) {
         };
     });
 }
-export function projectPluginSnapshot(manifests, config) {
+export function projectPluginSnapshot(manifests, config, consumerRoot) {
     const selection = normalizePluginSelection(config);
+    const local = consumerRoot
+        ? readPluginConfigurationStore(consumerRoot).plugins
+        : {};
     return {
         selection,
         plugins: manifests.map((plugin) => {
@@ -41,6 +47,10 @@ export function projectPluginSnapshot(manifests, config) {
             const selectedCapabilityCount = capabilities.filter((capability) => capability.enabled).length;
             return {
                 id: manifest.name,
+                configurable: hasConfigurablePluginValues(manifest.extensions[ABOT_RUNTIME_EXTENSION], Object.hasOwn(local, manifest.name)
+                    ? local[manifest.name]
+                    : undefined),
+                removable: !!consumerRoot && !!installedPluginPackage(consumerRoot, plugin),
                 ...(manifest.description ? { description: manifest.description } : {}),
                 ...(manifest.version ? { version: manifest.version } : {}),
                 pluginEnabled: pluginParentBlockReason(manifest.name, selection) === undefined,

package/dist/src/web-ui/plugin-management-selection.js

@@ -1,6 +1,7 @@
 import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { updatePluginDisabledIds } from "./plugin-disabled-selection.js";
 import { updatePluginCapabilitySelection } from "./plugin-capability-selection.js";
-import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+import { isPluginToolSelected, isPluginDisabledById, normalizePluginSelection, } from "../runtime/plugins/selection.js";
 export function updatePluginSelection(params) {
     if (params.capabilityId !== undefined) {
         return updatePluginCapabilitySelection({
@@ -9,14 +10,14 @@ export function updatePluginSelection(params) {
         });
     }
     const { current, pluginId } = params;
-    if (!params.enabled) {
-        const deny = [...(current.deny ?? [])];
-        if (!deny.some((id) => id.trim() === pluginId))
-            deny.push(pluginId);
-        return { ...current, deny };
-    }
+    const selection = updatePluginDisabledIds(params);
+    if (!params.enabled)
+        return selection;
+    const wasDisabledById = isPluginDisabledById(pluginId, normalizePluginSelection(current));
+    if (wasDisabledById)
+        return selection;
     const deny = current.deny?.filter((id) => id.trim() !== pluginId);
-    const next = { ...current, ...(deny ? { deny } : {}) };
+    const next = { ...selection, ...(deny ? { deny } : {}) };
     if (hasAllowedPluginCapability(params))
         return next;
     return { ...next, allow: [...(current.allow ?? []), pluginId] };
@@ -26,6 +27,7 @@ function hasAllowedPluginCapability(params) {
         ...params.current,
         enabled: true,
         deny: [],
+        disabledPluginIds: [],
     });
     return params.capabilityIds.some((toolName) => isPluginToolSelected({ pluginId: params.pluginId, toolName, selection }));
 }
@@ -48,12 +50,14 @@ function selectorMatchesOtherCapability(params) {
     return params.changedEntries.some((entry) => isPluginToolSelected({
         pluginId: params.pluginId,
         toolName: params.toolName,
-        selection: { enabled: true, allow: [entry], deny: [] },
+        selection: normalizePluginSelection({ allow: [entry] }),
     }));
 }
 export function pluginSelectionEscapesRequestedScope(params) {
     const before = normalizePluginSelection(params.before);
     const after = normalizePluginSelection(params.after);
+    if (hasUnrequestedPluginDisableChange(params, before, after))
+        return true;
     const changedEntries = changedSelectionEntries(before, after);
     return params.manifests.some((plugin) => {
         const pluginId = plugin.manifest.name;
@@ -69,3 +73,12 @@ export function pluginSelectionEscapesRequestedScope(params) {
         });
     });
 }
+function hasUnrequestedPluginDisableChange(params, before, after) {
+    const changedIds = [
+        ...before.disabledPluginIds.filter((id) => !after.disabledPluginIds.includes(id)),
+        ...after.disabledPluginIds.filter((id) => !before.disabledPluginIds.includes(id)),
+    ];
+    if (params.capabilityId !== undefined)
+        return changedIds.length > 0;
+    return changedIds.some((id) => id !== params.pluginId);
+}

package/dist/src/web-ui/plugin-management-service.d.ts

@@ -1,8 +1,10 @@
+import { type ConfigFileTransaction } from "../runtime/adapters/config-file-transaction.js";
 import { type RuntimePluginSnapshot } from "./plugin-management-catalog.js";
 export type { RuntimePluginSnapshot } from "./plugin-management-catalog.js";
 export type PluginManagementOptions = {
     rootDir: string;
     configPath?: string;
+    requireMutationIdle?: () => void;
 };
 export declare class PluginManagementError extends Error {
     readonly code: string;
@@ -10,7 +12,7 @@ export declare class PluginManagementError extends Error {
     constructor(code: string, message: string, statusCode?: number);
 }
 export declare function getRuntimePluginSnapshot(options: PluginManagementOptions): RuntimePluginSnapshot;
-export declare function setRuntimePluginEnabled(options: PluginManagementOptions, input: unknown): Promise<{
+export declare function setRuntimePluginEnabled(options: PluginManagementOptions, input: unknown, transaction?: ConfigFileTransaction): Promise<{
     backupPath?: string | undefined;
     restartRequired: boolean;
     selection: import("../runtime/plugins/selection.js").PluginSelection;
@@ -19,6 +21,8 @@ export declare function setRuntimePluginEnabled(options: PluginManagementOptions
         description?: string;
         version?: string;
         pluginEnabled: boolean;
+        removable: boolean;
+        configurable: boolean;
         capabilities: import("./plugin-management-catalog.js").RuntimePluginCapabilitySnapshot[];
         capabilityCount: number;
         selectedCapabilityCount: number;

package/dist/src/web-ui/plugin-management-service.js

@@ -1,5 +1,5 @@
 import { realpathSync } from "node:fs";
-import { ConfigFileConflictError, withConfigFileTransaction, } from "../runtime/adapters/config-file-transaction.js";
+import { ConfigFileConflictError, } from "../runtime/adapters/config-file-transaction.js";
 import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
 import { isRecord } from "../runtime/config/utils.js";
 import { validatePluginConfig } from "../runtime/config/validation/runtime-root-section-validation.js";
@@ -8,6 +8,7 @@ import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/con
 import { normalizePluginSelection } from "../runtime/plugins/selection.js";
 import { capabilityPolicyBlockReason } from "./plugin-capability-selection.js";
 import { projectPluginSnapshot, } from "./plugin-management-catalog.js";
+import { withConfigDashboardRootTransaction } from "./config-dashboard-save-transaction.js";
 import { saveConfigDashboardFile } from "./config-dashboard-backend.js";
 import { pluginSelectionEscapesRequestedScope, updatePluginSelection, } from "./plugin-management-selection.js";
 export class PluginManagementError extends Error {
@@ -34,7 +35,7 @@ function readPluginSelection(value) {
 }
 export function getRuntimePluginSnapshot(options) {
     const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
-    return projectPluginSnapshot(discoverConfiguredRuntimePluginManifests(options.rootDir), readPluginSelection(source.config.plugins));
+    return projectPluginSnapshot(discoverConfiguredRuntimePluginManifests(options.rootDir), readPluginSelection(source.config.plugins), options.rootDir);
 }
 function isPluginSelectionIdentifier(value) {
     if (typeof value !== "string")
@@ -93,16 +94,17 @@ function configuredPluginSource(options) {
     }
     return source;
 }
-export async function setRuntimePluginEnabled(options, input) {
+export async function setRuntimePluginEnabled(options, input, transaction) {
     const toggle = parsePluginToggle(input);
     const source = configuredPluginSource(options);
     const configPath = realpathSync(source.path);
     const canonicalOptions = {
         rootDir: realpathSync(options.rootDir),
         configPath,
+        requireMutationIdle: options.requireMutationIdle,
     };
     try {
-        return await withConfigFileTransaction(configPath, (transaction) => savePluginSelection(canonicalOptions, toggle, transaction));
+        return await withConfigDashboardRootTransaction(configPath, transaction, (transaction) => savePluginSelection(canonicalOptions, toggle, transaction));
     }
     catch (error) {
         if (error instanceof ConfigFileConflictError)
@@ -119,13 +121,14 @@ async function savePluginSelection(options, toggle, transaction) {
     const current = readPluginSelection(source.config.plugins);
     const capabilityId = toggle.capabilityId;
     requireCapabilityUpdateAllowed(plugin, toggle, current);
-    const next = updatePluginSelection({
+    const selectionInput = {
         current,
         ...(capabilityId ? { capabilityId } : {}),
         pluginId: toggle.pluginId,
         capabilityIds: Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities),
         enabled: toggle.enabled,
-    });
+    };
+    const next = updatePluginSelection(selectionInput);
     const escapesRequestedScope = pluginSelectionEscapesRequestedScope({
         manifests,
         pluginId: toggle.pluginId,
@@ -136,6 +139,7 @@ async function savePluginSelection(options, toggle, transaction) {
     if (escapesRequestedScope) {
         throw new PluginManagementError("plugin_selection_conflict", "This selection would also change other capabilities. Review the selection in Advanced settings.", 409);
     }
+    options.requireMutationIdle?.();
     const result = await saveConfigDashboardFile({
         ...options,
         kind: "runtime",
@@ -143,7 +147,7 @@ async function savePluginSelection(options, toggle, transaction) {
         transaction,
     });
     return {
-        ...projectPluginSnapshot(manifests, next),
+        ...projectPluginSnapshot(manifests, next, options.rootDir),
         restartRequired: true,
         ...(result.backupPath ? { backupPath: result.backupPath } : {}),
     };

package/dist/src/web-ui/plugin-removal-error.d.ts

@@ -0,0 +1,7 @@
+import { PluginManagementError } from "./plugin-management-service.js";
+import type { RuntimeSetupActivation } from "./local-runtime/runtime-setup-input.js";
+/** Keep confirmed activation evidence when the later file removal fails. */
+export declare class PluginRemovalActivationError extends PluginManagementError {
+    readonly activation: RuntimeSetupActivation;
+    constructor(error: unknown, activation: RuntimeSetupActivation);
+}

package/dist/src/web-ui/plugin-removal-error.js

@@ -0,0 +1,16 @@
+import { ConfigFileConflictError } from "../runtime/adapters/config-file-transaction.js";
+import { PluginManagementError } from "./plugin-management-service.js";
+/** Keep confirmed activation evidence when the later file removal fails. */
+export class PluginRemovalActivationError extends PluginManagementError {
+    activation;
+    constructor(error, activation) {
+        const known = error instanceof PluginManagementError ||
+            error instanceof ConfigFileConflictError;
+        const status = error instanceof PluginManagementError ? error.statusCode : 500;
+        super(known ? error.code : "plugin_removal_failed", known
+            ? error.message
+            : "Plugin removal could not complete. Refresh plugins before trying again.", error instanceof ConfigFileConflictError ? 409 : status);
+        this.activation = activation;
+        this.cause = error;
+    }
+}

package/dist/src/web-ui/plugin-removal-service.d.ts

@@ -0,0 +1,30 @@
+import type { RuntimeSetupActivation } from "./local-runtime/runtime-setup-input.js";
+import { type PluginManagementOptions } from "./plugin-management-service.js";
+export type PluginRemovalRuntime = {
+    applyConfiguration: (expectedRevision: string) => Promise<RuntimeSetupActivation>;
+    requireInactive: (pluginId: string, capabilityIds: readonly string[]) => void;
+};
+/** Disable, activate at the owner, then remove while configuration writers are fenced. */
+export declare function removeRuntimePlugin(options: PluginManagementOptions & PluginRemovalRuntime, input: unknown): Promise<{
+    removed: boolean;
+    activation: Readonly<{
+        status: "ready" | "restart_required";
+        message?: string;
+    }>;
+    message: string;
+    selection: import("../runtime/plugins/selection.js").PluginSelection;
+    plugins: Array<{
+        id: string;
+        description?: string;
+        version?: string;
+        pluginEnabled: boolean;
+        removable: boolean;
+        configurable: boolean;
+        capabilities: import("./plugin-management-catalog.js").RuntimePluginCapabilitySnapshot[];
+        capabilityCount: number;
+        selectedCapabilityCount: number;
+        state: "enabled" | "partial" | "disabled";
+        blockedByGlobalPolicy: boolean;
+    }>;
+    application: "restart_required";
+}>;

package/dist/src/web-ui/plugin-removal-service.js

@@ -0,0 +1,109 @@
+import { realpathSync, renameSync } from "node:fs";
+import { mkdtemp, rm, rmdir } from "node:fs/promises";
+import { join } from "node:path";
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { withConfigFileTransaction } from "../runtime/adapters/config-file-transaction.js";
+import { withFileLock } from "../runtime/adapters/long-term-memory/file-lock.js";
+import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
+import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/configured-manifests.js";
+import { evictPluginModules } from "../runtime/plugins/module-cache.js";
+import { installedPluginPackage, installedPluginPackageIdentity, } from "../runtime/plugins/installation/installed-package.js";
+import { normalizePluginSelection, isPluginToolSelected, } from "../runtime/plugins/selection.js";
+import { PluginRemovalActivationError } from "./plugin-removal-error.js";
+import { getRuntimePluginSnapshot, PluginManagementError, setRuntimePluginEnabled, } from "./plugin-management-service.js";
+function removablePackage(rootDir, pluginId, afterSave = false) {
+    const plugin = discoverConfiguredRuntimePluginManifests(rootDir).find((entry) => entry.manifest.name === pluginId);
+    const installed = plugin && installedPluginPackage(rootDir, plugin);
+    if (!plugin || !installed)
+        throw new PluginManagementError(afterSave ? "plugin_changed" : "plugin_not_removable", "Only plugins installed from GitHub in this Runtime can be removed.", 409);
+    return {
+        ...installed,
+        capabilityIds: Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities),
+    };
+}
+/** Disable, activate at the owner, then remove while configuration writers are fenced. */
+export async function removeRuntimePlugin(options, input) {
+    const value = input;
+    if (!value ||
+        typeof value !== "object" ||
+        Object.keys(value).some((key) => key !== "pluginId") ||
+        typeof value.pluginId !== "string" ||
+        !value.pluginId.trim())
+        throw new PluginManagementError("invalid_plugin_removal", "Choose an installed plugin to remove.");
+    const pluginId = value.pluginId.trim();
+    const rootDir = realpathSync(options.rootDir);
+    const source = inspectRuntimeConfigFileWithMeta(rootDir, options.configPath);
+    if (!source.exists)
+        throw new PluginManagementError("runtime_setup_required", "Complete Runtime setup before removing plugins.", 409);
+    const configPath = realpathSync(source.path);
+    const canonical = {
+        rootDir,
+        configPath,
+        requireMutationIdle: options.requireMutationIdle,
+    };
+    return withFileLock(join(rootDir, ".abot-plugin-installation"), async () => {
+        const original = removablePackage(rootDir, pluginId);
+        const expectedRevision = await withConfigFileTransaction(configPath, async (transaction) => {
+            await setRuntimePluginEnabled(canonical, { pluginId, enabled: false }, transaction);
+            return transaction.snapshot.revision;
+        });
+        const activation = await options.applyConfiguration(expectedRevision);
+        if (activation.status !== "ready")
+            return {
+                ...getRuntimePluginSnapshot(canonical),
+                removed: false,
+                activation,
+                message: "Plugin disable saved. Files are still installed. " +
+                    (activation.message ?? "Runtime application is required.") +
+                    " Then choose Remove again.",
+            };
+        // Apply takes this same lock; acquire it only after activation has completed.
+        return withConfigFileTransaction(configPath, async (transaction) => {
+            if (transaction.snapshot.revision !== expectedRevision)
+                throw new PluginManagementError("config_changed", "Configuration changed after the plugin disable. Refresh and try Remove again.", 409);
+            const current = removablePackage(rootDir, pluginId, true);
+            if (current.identity !== original.identity)
+                throw new PluginManagementError("plugin_changed", "The installed plugin changed. Refresh and try again.", 409);
+            const saved = inspectRuntimeConfigFileWithMeta(rootDir, configPath);
+            const selection = normalizePluginSelection(saved.config.plugins);
+            if (current.capabilityIds.some((toolName) => isPluginToolSelected({ pluginId, toolName, selection })))
+                throw new PluginManagementError("plugin_selection_changed", "The plugin was enabled again. Refresh and try again.", 409);
+            const staging = await mkdtemp(join(rootDir, ".abot-plugin-removal-"));
+            try {
+                // No asynchronous gap between the loaded-owner check and moving the directory.
+                options.requireInactive(pluginId, current.capabilityIds);
+                const final = removablePackage(rootDir, pluginId, true);
+                if (final.identity !== original.identity)
+                    throw new PluginManagementError("plugin_changed", "The installed plugin changed. Refresh and try again.", 409);
+                renameSync(final.path, join(staging, pluginId));
+            }
+            catch (error) {
+                // Remove only an empty staging directory; never erase an unexpectedly moved object.
+                await rmdir(staging).catch(() => undefined);
+                throw error;
+            }
+            if (installedPluginPackageIdentity(join(staging, pluginId)) !==
+                original.packageIdentity)
+                throw new PluginManagementError("plugin_changed", `The plugin directory changed during removal. Its files were preserved at ${staging}. Refresh before trying again.`, 409);
+            evictPluginModules(original.path);
+            // Preserve deny/allow selectors: deleting the last allow rule would enable other plugins.
+            let cleanupPending = false;
+            try {
+                await rm(staging, { recursive: true, force: true });
+            }
+            catch {
+                cleanupPending = true;
+            }
+            return {
+                ...getRuntimePluginSnapshot(canonical),
+                removed: true,
+                activation,
+                message: cleanupPending
+                    ? `${pluginId} removed from Plugins. Some files could not be deleted from ${staging}.`
+                    : `${pluginId} removed.`,
+            };
+        }).catch((error) => {
+            throw new PluginRemovalActivationError(error, activation);
+        });
+    });
+}

package/dist/src/web-ui/runtime-setup-gateway.d.ts

@@ -3,6 +3,7 @@ import type { RuntimeSetupActivation } from "./local-runtime/runtime-setup-input
 export type RuntimeSetupGatewayRestorePoint = {
     restore(): Promise<void>;
 };
+export type AppliedGatewayConfigurations = readonly (string | null)[];
 /** Owns only a gateway started by this Web/CLI process, never an external service. */
 export declare class RuntimeSetupGateway {
     private readonly options;
@@ -15,7 +16,10 @@ export declare class RuntimeSetupGateway {
     });
     private requireGatewayOpen;
     private configuredBinding;
-    checkActivation(configPath?: string): Promise<RuntimeSetupActivation>;
+    captureConfiguration(configPath?: string): string | null;
+    private matchesAppliedConfiguration;
+    checkActivation(configPath?: string, applied?: AppliedGatewayConfigurations): Promise<RuntimeSetupActivation>;
+    private planActivation;
     private captureGatewayCheckpoint;
     /** Retains the old server's compiled handlers, without rereading saved config. */
     createRestorePoint(): RuntimeSetupGatewayRestorePoint;
@@ -24,6 +28,6 @@ export declare class RuntimeSetupGateway {
     private replaceOwnedGateway;
     private closeGatewayListener;
     private failAfterGatewayCleanup;
-    activate(configPath?: string): Promise<RuntimeSetupActivation>;
+    activate(configPath?: string, applied?: AppliedGatewayConfigurations): Promise<RuntimeSetupActivation>;
     close(): Promise<void>;
 }