@abot-ai/runtime 1.6.0 → 1.8.0

package/dist/src/web-ui/local-runtime-backend.js

@@ -3,6 +3,9 @@ import { LocalRuntimeApiRouter } from "./local-runtime/api-router.js";
 import { LocalRuntimeControlRoutes } from "./local-runtime/control-routes.js";
 import { RuntimeEnvironmentRegistry } from "./local-runtime/environment-registry.js";
 import { sendJson } from "./local-runtime/http.js";
+import { RequestBodyInputError } from "./local-runtime/request-body-error.js";
+import { RuntimeSetupError } from "./local-runtime/runtime-setup-input.js";
+import { requireRuntimeSetupEditSettled } from "./local-runtime/runtime-setup-edit-recovery.js";
 import { LocalRealtimeController } from "./local-runtime/realtime-controller.js";
 import { RealtimeClientHub } from "./local-runtime/realtime-hub.js";
 import { LocalRequestExecution } from "./local-runtime/request-execution.js";
@@ -21,6 +24,7 @@ export class LocalRuntimeWebBackend {
     notifications;
     notificationRoutes;
     constructor(options) {
+        requireRuntimeSetupEditSettled(options.rootDir ?? process.cwd());
         const resolvedOptions = {
             ...options,
             providerAdapters: resolveProviderAdapters({
@@ -87,6 +91,16 @@ export class LocalRuntimeWebBackend {
             return false;
         }
         catch (error) {
+            const requiresSetupRecovery = error instanceof RuntimeSetupError &&
+                error.code === "setup_edit_recovery_required";
+            if (error instanceof RequestBodyInputError || requiresSetupRecovery) {
+                sendJson(res, error.statusCode, {
+                    ok: false,
+                    error: error.code,
+                    message: error.message,
+                });
+                return true;
+            }
             sendJson(res, 500, {
                 ok: false,
                 error: "local_runtime_backend_error",

package/dist/src/web-ui/plugin-capability-selection.js

@@ -1,9 +1,11 @@
-import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+import { isPluginToolSelected, isPluginDisabledById, normalizePluginSelection, } from "../runtime/plugins/selection.js";
 export function pluginParentBlockReason(pluginId, selection) {
     if (!selection.enabled)
         return "Plugins are disabled globally.";
     if (selection.deny.includes("*"))
         return "The global deny rule blocks all plugins.";
+    if (isPluginDisabledById(pluginId, selection))
+        return "Enable this plugin before changing its capabilities.";
     if (selection.deny.includes(pluginId))
         return "Enable this plugin before changing its capabilities.";
     return undefined;
@@ -25,6 +27,7 @@ function isCapabilityAllowed(params) {
             ...params.current,
             enabled: true,
             deny: [],
+            disabledPluginIds: [],
         }),
     });
 }

package/dist/src/web-ui/plugin-configuration-input.d.ts

@@ -0,0 +1,12 @@
+import type { PluginConfigurationDeclaration } from "../runtime/plugins/configuration-context.js";
+import { type PluginLocalConfiguration } from "../runtime/plugins/configuration-store.js";
+export declare function parsePluginConfigurationUpdate(input: unknown, declaration: PluginConfigurationDeclaration, previous?: PluginLocalConfiguration): {
+    revision: string;
+    configuration: {
+        settings: Record<string, unknown>;
+        secrets: Record<string, {
+            env: string;
+            value: string | null;
+        }>;
+    };
+};

package/dist/src/web-ui/plugin-configuration-input.js

@@ -0,0 +1,68 @@
+import { clearRetainedPluginSecrets, requireRetainedSecretClearedBeforeReplacement, } from "./plugin-configuration-retained-secrets.js";
+import { pluginSettingMatchesDefault } from "../runtime/plugins/configuration-settings.js";
+import { isRecord } from "../runtime/config/utils.js";
+import { PluginConfigurationError, } from "../runtime/plugins/configuration-store.js";
+function invalidConfiguration(message) {
+    throw new PluginConfigurationError("invalid_plugin_configuration", message);
+}
+function parseSettings(input, declaration) {
+    if (!isRecord(input))
+        return invalidConfiguration("Plugin settings must be an object.");
+    const defaults = declaration.settings?.defaults ?? {};
+    for (const [name, value] of Object.entries(input)) {
+        if (!Object.hasOwn(defaults, name))
+            return invalidConfiguration("Only declared plugin settings can be edited.");
+        if (!pluginSettingMatchesDefault(value, defaults[name]))
+            return invalidConfiguration(`The value for ${name} must match its default type.`);
+    }
+    return input;
+}
+function parseSecretChanges(input, declaration, previous) {
+    if (!isRecord(input))
+        return invalidConfiguration("Plugin secrets must be an object.");
+    const declarations = declaration.secrets ?? {};
+    const changes = Object.entries(input).map(([name, change]) => {
+        if (!Object.hasOwn(declarations, name))
+            return invalidConfiguration("Only declared plugin secrets can be edited.");
+        requireRetainedSecretClearedBeforeReplacement(name, declaration, previous);
+        if (!isRecord(change))
+            return invalidConfiguration("Choose how to update each secret.");
+        if (change.action === "clear") {
+            if (Object.keys(change).length !== 1)
+                return invalidConfiguration("Clear accepts no secret value.");
+            return [name, { env: declarations[name].env, value: null }];
+        }
+        if (change.action !== "set")
+            return invalidConfiguration("A secret change must be set or clear; omit it to keep the current value.");
+        if (Object.keys(change).some((key) => !["action", "value"].includes(key)))
+            return invalidConfiguration("Unsupported secret change.");
+        if (typeof change.value !== "string" || !change.value.trim())
+            return invalidConfiguration("Enter a non-empty secret or explicitly clear it.");
+        return [
+            name,
+            { env: declarations[name].env, value: change.value },
+        ];
+    });
+    return { ...previous?.secrets, ...Object.fromEntries(changes) };
+}
+export function parsePluginConfigurationUpdate(input, declaration, previous) {
+    if (!isRecord(input))
+        return invalidConfiguration("Reload plugin configuration before saving.");
+    if (Object.keys(input).some((key) => !["revision", "settings", "secrets", "clearRetainedSecrets"].includes(key)))
+        return invalidConfiguration("Unsupported plugin configuration fields.");
+    if (typeof input.revision !== "string" || !input.revision)
+        return invalidConfiguration("Reload plugin configuration before saving.");
+    if (Buffer.byteLength(JSON.stringify(input)) > 128 * 1024)
+        return invalidConfiguration("Plugin configuration is too large.");
+    const kept = {
+        settings: previous?.settings ?? {},
+        secrets: clearRetainedPluginSecrets(input.clearRetainedSecrets, declaration, previous),
+    };
+    return {
+        revision: input.revision,
+        configuration: {
+            settings: parseSettings(input.settings, declaration),
+            secrets: parseSecretChanges(input.secrets ?? {}, declaration, kept),
+        },
+    };
+}

package/dist/src/web-ui/plugin-configuration-retained-secrets.d.ts

@@ -0,0 +1,9 @@
+import type { PluginConfigurationDeclaration } from "../runtime/plugins/configuration-context.js";
+import { type PluginLocalConfiguration } from "../runtime/plugins/configuration-store.js";
+export declare function retainedPluginSecrets(declaration: PluginConfigurationDeclaration, local?: PluginLocalConfiguration): {
+    name: string;
+    env: string;
+    configured: boolean;
+}[];
+export declare function clearRetainedPluginSecrets(input: unknown, declaration: PluginConfigurationDeclaration, previous?: PluginLocalConfiguration): PluginLocalConfiguration["secrets"];
+export declare function requireRetainedSecretClearedBeforeReplacement(name: string, declaration: PluginConfigurationDeclaration, previous?: PluginLocalConfiguration): void;

package/dist/src/web-ui/plugin-configuration-retained-secrets.js

@@ -0,0 +1,48 @@
+import { isRecord } from "../runtime/config/utils.js";
+import { PluginConfigurationError, } from "../runtime/plugins/configuration-store.js";
+function isDeclaredSecretBinding(declaration, name, env) {
+    const secrets = declaration.secrets ?? {};
+    if (!Object.hasOwn(secrets, name))
+        return false;
+    return secrets[name].env === env;
+}
+export function retainedPluginSecrets(declaration, local) {
+    return Object.entries(local?.secrets ?? {})
+        .filter(([name, saved]) => !isDeclaredSecretBinding(declaration, name, saved.env))
+        .map(([name, saved]) => ({
+        name,
+        env: saved.env,
+        configured: Boolean(saved.value?.trim()),
+    }));
+}
+function invalidRetainedSecretChange(message) {
+    throw new PluginConfigurationError("invalid_plugin_configuration", message);
+}
+export function clearRetainedPluginSecrets(input, declaration, previous) {
+    const kept = { ...previous?.secrets };
+    if (input === undefined)
+        return kept;
+    if (!Array.isArray(input))
+        return invalidRetainedSecretChange("Choose which unused saved keys to delete.");
+    for (const entry of input) {
+        if (!isRecord(entry))
+            return invalidRetainedSecretChange("Choose an unused saved key to delete.");
+        if (Object.keys(entry).some((key) => !["name", "env"].includes(key)))
+            return invalidRetainedSecretChange("An unused key removal accepts only its name and environment binding.");
+        if (typeof entry.name !== "string" || typeof entry.env !== "string")
+            return invalidRetainedSecretChange("An unused key removal requires its name and environment binding.");
+        if (!Object.hasOwn(kept, entry.name) || kept[entry.name].env !== entry.env)
+            return invalidRetainedSecretChange("The unused saved key changed. Reload the form before deleting it.");
+        if (isDeclaredSecretBinding(declaration, entry.name, entry.env))
+            return invalidRetainedSecretChange("Use the declared key's Clear value action to clear it.");
+        delete kept[entry.name];
+    }
+    return kept;
+}
+export function requireRetainedSecretClearedBeforeReplacement(name, declaration, previous) {
+    if (!previous || !Object.hasOwn(previous.secrets, name))
+        return;
+    if (isDeclaredSecretBinding(declaration, name, previous.secrets[name].env))
+        return;
+    throw new PluginConfigurationError("invalid_plugin_configuration", `Delete the unused saved key ${name} explicitly before configuring its new environment binding.`);
+}

package/dist/src/web-ui/plugin-configuration-service.d.ts

@@ -0,0 +1,52 @@
+import type { ConfigFileTransaction } from "../runtime/adapters/config-file-transaction.js";
+import type { PluginManagementOptions } from "./plugin-management-service.js";
+export declare function getRuntimePluginConfiguration(options: PluginManagementOptions, pluginId: string): {
+    pluginId: string;
+    revision: string;
+    scope: "installation";
+    defaults: Readonly<Record<string, unknown>>;
+    settings: Record<string, unknown>;
+    settingOverrides: string[];
+    retainedSecrets: {
+        name: string;
+        env: string;
+        configured: boolean;
+    }[];
+    secrets: {
+        name: string;
+        env: string;
+        required: boolean;
+        configured: boolean;
+        locallyConfigured: boolean;
+    }[];
+};
+/** Configuration and package selection commit under the same locks as Apply. */
+export declare function saveRuntimePluginConfiguration<T>(options: PluginManagementOptions, params: {
+    pluginId: string;
+    input: unknown;
+    transaction?: ConfigFileTransaction;
+    installation?: boolean;
+    commit?: () => Promise<T>;
+}): Promise<{
+    result: Awaited<T> | undefined;
+    configuration: {
+        pluginId: string;
+        revision: string;
+        scope: "installation";
+        defaults: Readonly<Record<string, unknown>>;
+        settings: Record<string, unknown>;
+        settingOverrides: string[];
+        retainedSecrets: {
+            name: string;
+            env: string;
+            configured: boolean;
+        }[];
+        secrets: {
+            name: string;
+            env: string;
+            required: boolean;
+            configured: boolean;
+            locallyConfigured: boolean;
+        }[];
+    };
+}>;

package/dist/src/web-ui/plugin-configuration-service.js

@@ -0,0 +1,66 @@
+import { realpathSync } from "node:fs";
+import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/configured-manifests.js";
+import { configuredPluginSecret, } from "../runtime/plugins/configuration-context.js";
+import { PluginConfigurationError, readPluginConfigurationStore, } from "../runtime/plugins/configuration-store.js";
+import { commitPluginConfigurationStore, withPluginConfigurationLock, } from "../runtime/plugins/configuration-write.js";
+import { withConfigDashboardRootTransaction } from "./config-dashboard-save-transaction.js";
+import { parsePluginConfigurationUpdate } from "./plugin-configuration-input.js";
+import { pluginConfigurationRevision, projectPluginConfiguration, } from "./plugin-configuration-view.js";
+function installedPluginDeclaration(rootDir, pluginId) {
+    const plugin = discoverConfiguredRuntimePluginManifests(rootDir).find((entry) => entry.manifest.name === pluginId);
+    if (!plugin)
+        throw new PluginConfigurationError("plugin_not_found", "The selected plugin is not installed.", 404);
+    const extension = plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION];
+    return { settings: extension.settings, secrets: extension.secrets };
+}
+export function getRuntimePluginConfiguration(options, pluginId) {
+    return projectPluginConfiguration(pluginId, installedPluginDeclaration(options.rootDir, pluginId), readPluginConfigurationStore(options.rootDir));
+}
+function requireInstallationSecrets(declaration, configuration) {
+    for (const [name, secret] of Object.entries(declaration.secrets ?? {})) {
+        if (!secret.required)
+            continue;
+        if (configuredPluginSecret(name, secret, configuration))
+            continue;
+        throw new PluginConfigurationError("plugin_secret_required", `Configure the required secret ${name} before installing.`);
+    }
+}
+/** Configuration and package selection commit under the same locks as Apply. */
+export async function saveRuntimePluginConfiguration(options, params) {
+    const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
+    if (!source.exists)
+        throw new PluginConfigurationError("runtime_setup_required", "Complete Runtime setup before configuring plugins.", 409);
+    const rootDir = realpathSync(options.rootDir);
+    return withConfigDashboardRootTransaction(realpathSync(source.path), params.transaction, () => withPluginConfigurationLock(rootDir, async () => {
+        options.requireMutationIdle?.();
+        const declaration = installedPluginDeclaration(rootDir, params.pluginId);
+        const previous = readPluginConfigurationStore(rootDir);
+        const local = Object.hasOwn(previous.plugins, params.pluginId)
+            ? previous.plugins[params.pluginId]
+            : undefined;
+        if (params.installation && params.input === undefined) {
+            requireInstallationSecrets(declaration, local);
+            return {
+                result: await params.commit?.(),
+                configuration: projectPluginConfiguration(params.pluginId, declaration, previous),
+            };
+        }
+        const update = parsePluginConfigurationUpdate(params.input, declaration, local);
+        if (update.revision !==
+            pluginConfigurationRevision(params.pluginId, declaration, previous))
+            throw new PluginConfigurationError("plugin_configuration_changed", "Plugin configuration changed. Reload the form before saving.", 409);
+        if (params.installation)
+            requireInstallationSecrets(declaration, update.configuration);
+        options.requireMutationIdle?.();
+        const result = await commitPluginConfigurationStore(rootDir, previous, {
+            ...previous.plugins,
+            [params.pluginId]: update.configuration,
+        }, async () => params.commit?.());
+        return {
+            result,
+            configuration: projectPluginConfiguration(params.pluginId, declaration, readPluginConfigurationStore(rootDir)),
+        };
+    }));
+}

package/dist/src/web-ui/plugin-configuration-view.d.ts

@@ -0,0 +1,25 @@
+import { type PluginConfigurationDeclaration } from "../runtime/plugins/configuration-context.js";
+import type { PluginConfigurationSnapshot, PluginLocalConfiguration } from "../runtime/plugins/configuration-store.js";
+export declare function pluginConfigurationRevision(pluginId: string, declaration: PluginConfigurationDeclaration, store: PluginConfigurationSnapshot): string;
+/** Password values never enter browser projections, including installation review. */
+export declare function projectPluginConfiguration(pluginId: string, declaration: PluginConfigurationDeclaration, store: PluginConfigurationSnapshot): {
+    pluginId: string;
+    revision: string;
+    scope: "installation";
+    defaults: Readonly<Record<string, unknown>>;
+    settings: Record<string, unknown>;
+    settingOverrides: string[];
+    retainedSecrets: {
+        name: string;
+        env: string;
+        configured: boolean;
+    }[];
+    secrets: {
+        name: string;
+        env: string;
+        required: boolean;
+        configured: boolean;
+        locallyConfigured: boolean;
+    }[];
+};
+export declare function hasConfigurablePluginValues(declaration: PluginConfigurationDeclaration, local?: PluginLocalConfiguration): boolean;

package/dist/src/web-ui/plugin-configuration-view.js

@@ -0,0 +1,45 @@
+import { retainedPluginSecrets } from "./plugin-configuration-retained-secrets.js";
+import { createHmac, randomBytes } from "node:crypto";
+import { configuredPluginSecret, effectivePluginSettings, } from "../runtime/plugins/configuration-context.js";
+// Tokens stay stable within this Web process; a restart requires reloading forms.
+// The private key prevents browser-visible revisions from verifying secret guesses.
+const configurationRevisionKey = randomBytes(32);
+export function pluginConfigurationRevision(pluginId, declaration, store) {
+    return createHmac("sha256", configurationRevisionKey)
+        .update(JSON.stringify([
+        pluginId,
+        declaration.settings?.defaults ?? {},
+        declaration.secrets ?? {},
+        store.revision,
+    ]))
+        .digest("hex");
+}
+/** Password values never enter browser projections, including installation review. */
+export function projectPluginConfiguration(pluginId, declaration, store) {
+    const local = Object.hasOwn(store.plugins, pluginId)
+        ? store.plugins[pluginId]
+        : undefined;
+    return {
+        pluginId,
+        revision: pluginConfigurationRevision(pluginId, declaration, store),
+        scope: "installation",
+        defaults: declaration.settings?.defaults ?? {},
+        settings: effectivePluginSettings(declaration, local),
+        settingOverrides: Object.keys(declaration.settings?.defaults ?? {}).filter((name) => !!local && Object.hasOwn(local.settings, name)),
+        retainedSecrets: retainedPluginSecrets(declaration, local),
+        secrets: Object.entries(declaration.secrets ?? {}).map(([name, secret]) => ({
+            name,
+            env: secret.env,
+            required: secret.required,
+            configured: Boolean(configuredPluginSecret(name, secret, local)),
+            locallyConfigured: local?.secrets[name]?.env === secret.env,
+        })),
+    };
+}
+export function hasConfigurablePluginValues(declaration, local) {
+    if (Object.keys(declaration.settings?.defaults ?? {}).length > 0)
+        return true;
+    if (Object.keys(declaration.secrets ?? {}).length > 0)
+        return true;
+    return retainedPluginSecrets(declaration, local).length > 0;
+}

package/dist/src/web-ui/plugin-disabled-selection.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimePluginConfig } from "../runtime/ports.js";
+/** Update only the exact plugin-ID block; leave all tool policy untouched. */
+export declare function updatePluginDisabledIds(params: {
+    current: RuntimePluginConfig;
+    pluginId: string;
+    enabled: boolean;
+}): RuntimePluginConfig;

package/dist/src/web-ui/plugin-disabled-selection.js

@@ -0,0 +1,17 @@
+/** Update only the exact plugin-ID block; leave all tool policy untouched. */
+export function updatePluginDisabledIds(params) {
+    const { current, pluginId, enabled } = params;
+    const disabledPluginIds = current.disabledPluginIds ?? [];
+    if (enabled) {
+        const { disabledPluginIds: _disabled, ...settings } = current;
+        const remaining = disabledPluginIds.filter((id) => id.trim() !== pluginId);
+        return {
+            ...settings,
+            ...(remaining.length ? { disabledPluginIds: remaining } : {}),
+        };
+    }
+    const alreadyDisabled = disabledPluginIds.some((id) => id.trim() === pluginId);
+    if (alreadyDisabled)
+        return current;
+    return { ...current, disabledPluginIds: [...disabledPluginIds, pluginId] };
+}

package/dist/src/web-ui/plugin-management-catalog.d.ts

@@ -1,3 +1,4 @@
+import { resolvePluginPlatformCompatibility } from "../runtime/plugins/platform-compatibility.js";
 import type { RuntimePluginConfig } from "../runtime/ports.js";
 import type { DiscoveredAgentPluginManifest } from "../runtime/plugins/discovered-manifest.js";
 import { type PluginSelection } from "../runtime/plugins/selection.js";
@@ -15,6 +16,9 @@ export type RuntimePluginSnapshot = {
         description?: string;
         version?: string;
         pluginEnabled: boolean;
+        compatibility: ReturnType<typeof resolvePluginPlatformCompatibility>;
+        removable: boolean;
+        configurable: boolean;
         capabilities: RuntimePluginCapabilitySnapshot[];
         capabilityCount: number;
         selectedCapabilityCount: number;
@@ -23,4 +27,4 @@ export type RuntimePluginSnapshot = {
     }>;
     application: "restart_required";
 };
-export declare function projectPluginSnapshot(manifests: readonly DiscoveredAgentPluginManifest[], config: RuntimePluginConfig): RuntimePluginSnapshot;
+export declare function projectPluginSnapshot(manifests: readonly DiscoveredAgentPluginManifest[], config: RuntimePluginConfig, consumerRoot?: string, runtimePlatform?: NodeJS.Platform): RuntimePluginSnapshot;

package/dist/src/web-ui/plugin-management-catalog.js

@@ -1,3 +1,7 @@
+import { resolvePluginPlatformCompatibility } from "../runtime/plugins/platform-compatibility.js";
+import { readPluginConfigurationStore } from "../runtime/plugins/configuration-store.js";
+import { hasConfigurablePluginValues } from "./plugin-configuration-view.js";
+import { installedPluginPackage } from "../runtime/plugins/installation/installed-package.js";
 import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
 import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
 import { capabilityPolicyBlockReason, pluginParentBlockReason, } from "./plugin-capability-selection.js";
@@ -30,8 +34,11 @@ function projectPluginCapabilities(plugin, selection) {
         };
     });
 }
-export function projectPluginSnapshot(manifests, config) {
+export function projectPluginSnapshot(manifests, config, consumerRoot, runtimePlatform = process.platform) {
     const selection = normalizePluginSelection(config);
+    const local = consumerRoot
+        ? readPluginConfigurationStore(consumerRoot).plugins
+        : {};
     return {
         selection,
         plugins: manifests.map((plugin) => {
@@ -41,6 +48,11 @@ export function projectPluginSnapshot(manifests, config) {
             const selectedCapabilityCount = capabilities.filter((capability) => capability.enabled).length;
             return {
                 id: manifest.name,
+                compatibility: resolvePluginPlatformCompatibility(manifest, runtimePlatform),
+                configurable: hasConfigurablePluginValues(manifest.extensions[ABOT_RUNTIME_EXTENSION], Object.hasOwn(local, manifest.name)
+                    ? local[manifest.name]
+                    : undefined),
+                removable: !!consumerRoot && !!installedPluginPackage(consumerRoot, plugin),
                 ...(manifest.description ? { description: manifest.description } : {}),
                 ...(manifest.version ? { version: manifest.version } : {}),
                 pluginEnabled: pluginParentBlockReason(manifest.name, selection) === undefined,

package/dist/src/web-ui/plugin-management-selection.js

@@ -1,6 +1,7 @@
 import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { updatePluginDisabledIds } from "./plugin-disabled-selection.js";
 import { updatePluginCapabilitySelection } from "./plugin-capability-selection.js";
-import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+import { isPluginToolSelected, isPluginDisabledById, normalizePluginSelection, } from "../runtime/plugins/selection.js";
 export function updatePluginSelection(params) {
     if (params.capabilityId !== undefined) {
         return updatePluginCapabilitySelection({
@@ -9,14 +10,14 @@ export function updatePluginSelection(params) {
         });
     }
     const { current, pluginId } = params;
-    if (!params.enabled) {
-        const deny = [...(current.deny ?? [])];
-        if (!deny.some((id) => id.trim() === pluginId))
-            deny.push(pluginId);
-        return { ...current, deny };
-    }
+    const selection = updatePluginDisabledIds(params);
+    if (!params.enabled)
+        return selection;
+    const wasDisabledById = isPluginDisabledById(pluginId, normalizePluginSelection(current));
+    if (wasDisabledById)
+        return selection;
     const deny = current.deny?.filter((id) => id.trim() !== pluginId);
-    const next = { ...current, ...(deny ? { deny } : {}) };
+    const next = { ...selection, ...(deny ? { deny } : {}) };
     if (hasAllowedPluginCapability(params))
         return next;
     return { ...next, allow: [...(current.allow ?? []), pluginId] };
@@ -26,6 +27,7 @@ function hasAllowedPluginCapability(params) {
         ...params.current,
         enabled: true,
         deny: [],
+        disabledPluginIds: [],
     });
     return params.capabilityIds.some((toolName) => isPluginToolSelected({ pluginId: params.pluginId, toolName, selection }));
 }
@@ -48,12 +50,14 @@ function selectorMatchesOtherCapability(params) {
     return params.changedEntries.some((entry) => isPluginToolSelected({
         pluginId: params.pluginId,
         toolName: params.toolName,
-        selection: { enabled: true, allow: [entry], deny: [] },
+        selection: normalizePluginSelection({ allow: [entry] }),
     }));
 }
 export function pluginSelectionEscapesRequestedScope(params) {
     const before = normalizePluginSelection(params.before);
     const after = normalizePluginSelection(params.after);
+    if (hasUnrequestedPluginDisableChange(params, before, after))
+        return true;
     const changedEntries = changedSelectionEntries(before, after);
     return params.manifests.some((plugin) => {
         const pluginId = plugin.manifest.name;
@@ -69,3 +73,12 @@ export function pluginSelectionEscapesRequestedScope(params) {
         });
     });
 }
+function hasUnrequestedPluginDisableChange(params, before, after) {
+    const changedIds = [
+        ...before.disabledPluginIds.filter((id) => !after.disabledPluginIds.includes(id)),
+        ...after.disabledPluginIds.filter((id) => !before.disabledPluginIds.includes(id)),
+    ];
+    if (params.capabilityId !== undefined)
+        return changedIds.length > 0;
+    return changedIds.some((id) => id !== params.pluginId);
+}

package/dist/src/web-ui/plugin-management-service.d.ts

@@ -1,8 +1,10 @@
+import { type ConfigFileTransaction } from "../runtime/adapters/config-file-transaction.js";
 import { type RuntimePluginSnapshot } from "./plugin-management-catalog.js";
 export type { RuntimePluginSnapshot } from "./plugin-management-catalog.js";
 export type PluginManagementOptions = {
     rootDir: string;
     configPath?: string;
+    requireMutationIdle?: () => void;
 };
 export declare class PluginManagementError extends Error {
     readonly code: string;
@@ -10,7 +12,7 @@ export declare class PluginManagementError extends Error {
     constructor(code: string, message: string, statusCode?: number);
 }
 export declare function getRuntimePluginSnapshot(options: PluginManagementOptions): RuntimePluginSnapshot;
-export declare function setRuntimePluginEnabled(options: PluginManagementOptions, input: unknown): Promise<{
+export declare function setRuntimePluginEnabled(options: PluginManagementOptions, input: unknown, transaction?: ConfigFileTransaction): Promise<{
     backupPath?: string | undefined;
     restartRequired: boolean;
     selection: import("../runtime/plugins/selection.js").PluginSelection;
@@ -19,6 +21,9 @@ export declare function setRuntimePluginEnabled(options: PluginManagementOptions
         description?: string;
         version?: string;
         pluginEnabled: boolean;
+        compatibility: ReturnType<typeof import("../runtime/plugins/platform-compatibility.js").resolvePluginPlatformCompatibility>;
+        removable: boolean;
+        configurable: boolean;
         capabilities: import("./plugin-management-catalog.js").RuntimePluginCapabilitySnapshot[];
         capabilityCount: number;
         selectedCapabilityCount: number;

package/dist/src/web-ui/plugin-management-service.js

@@ -1,5 +1,5 @@
 import { realpathSync } from "node:fs";
-import { ConfigFileConflictError, withConfigFileTransaction, } from "../runtime/adapters/config-file-transaction.js";
+import { ConfigFileConflictError, } from "../runtime/adapters/config-file-transaction.js";
 import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
 import { isRecord } from "../runtime/config/utils.js";
 import { validatePluginConfig } from "../runtime/config/validation/runtime-root-section-validation.js";
@@ -8,6 +8,7 @@ import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/con
 import { normalizePluginSelection } from "../runtime/plugins/selection.js";
 import { capabilityPolicyBlockReason } from "./plugin-capability-selection.js";
 import { projectPluginSnapshot, } from "./plugin-management-catalog.js";
+import { withConfigDashboardRootTransaction } from "./config-dashboard-save-transaction.js";
 import { saveConfigDashboardFile } from "./config-dashboard-backend.js";
 import { pluginSelectionEscapesRequestedScope, updatePluginSelection, } from "./plugin-management-selection.js";
 export class PluginManagementError extends Error {
@@ -34,7 +35,7 @@ function readPluginSelection(value) {
 }
 export function getRuntimePluginSnapshot(options) {
     const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
-    return projectPluginSnapshot(discoverConfiguredRuntimePluginManifests(options.rootDir), readPluginSelection(source.config.plugins));
+    return projectPluginSnapshot(discoverConfiguredRuntimePluginManifests(options.rootDir), readPluginSelection(source.config.plugins), options.rootDir);
 }
 function isPluginSelectionIdentifier(value) {
     if (typeof value !== "string")
@@ -93,16 +94,17 @@ function configuredPluginSource(options) {
     }
     return source;
 }
-export async function setRuntimePluginEnabled(options, input) {
+export async function setRuntimePluginEnabled(options, input, transaction) {
     const toggle = parsePluginToggle(input);
     const source = configuredPluginSource(options);
     const configPath = realpathSync(source.path);
     const canonicalOptions = {
         rootDir: realpathSync(options.rootDir),
         configPath,
+        requireMutationIdle: options.requireMutationIdle,
     };
     try {
-        return await withConfigFileTransaction(configPath, (transaction) => savePluginSelection(canonicalOptions, toggle, transaction));
+        return await withConfigDashboardRootTransaction(configPath, transaction, (transaction) => savePluginSelection(canonicalOptions, toggle, transaction));
     }
     catch (error) {
         if (error instanceof ConfigFileConflictError)
@@ -119,13 +121,14 @@ async function savePluginSelection(options, toggle, transaction) {
     const current = readPluginSelection(source.config.plugins);
     const capabilityId = toggle.capabilityId;
     requireCapabilityUpdateAllowed(plugin, toggle, current);
-    const next = updatePluginSelection({
+    const selectionInput = {
         current,
         ...(capabilityId ? { capabilityId } : {}),
         pluginId: toggle.pluginId,
         capabilityIds: Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities),
         enabled: toggle.enabled,
-    });
+    };
+    const next = updatePluginSelection(selectionInput);
     const escapesRequestedScope = pluginSelectionEscapesRequestedScope({
         manifests,
         pluginId: toggle.pluginId,
@@ -136,6 +139,7 @@ async function savePluginSelection(options, toggle, transaction) {
     if (escapesRequestedScope) {
         throw new PluginManagementError("plugin_selection_conflict", "This selection would also change other capabilities. Review the selection in Advanced settings.", 409);
     }
+    options.requireMutationIdle?.();
     const result = await saveConfigDashboardFile({
         ...options,
         kind: "runtime",
@@ -143,7 +147,7 @@ async function savePluginSelection(options, toggle, transaction) {
         transaction,
     });
     return {
-        ...projectPluginSnapshot(manifests, next),
+        ...projectPluginSnapshot(manifests, next, options.rootDir),
         restartRequired: true,
         ...(result.backupPath ? { backupPath: result.backupPath } : {}),
     };