@axiom-lattice/core 6.3.3 → 6.4.1

package/dist/index.js

@@ -1621,6 +1621,7 @@ __export(index_exports, {
   CapabilityBundleValidationError: () => CapabilityBundleValidationError,
   CapabilityToolNameConflictError: () => CapabilityToolNameConflictError,
   CapabilityToolRegistry: () => CapabilityToolRegistry,
+  ChannelConnectionLeader: () => ChannelConnectionLeader,
   ChunkBuffer: () => ChunkBuffer,
   ChunkBufferLatticeManager: () => ChunkBufferLatticeManager,
   CollectionLatticeManager: () => CollectionLatticeManager,
@@ -1632,7 +1633,9 @@ __export(index_exports, {
   DEFAULT_CALIBRATION_PROBES: () => DEFAULT_CALIBRATION_PROBES,
   DEFAULT_CONNECT_TIMEOUT_MS: () => DEFAULT_CONNECT_TIMEOUT_MS,
   DEFAULT_DELAY_MS: () => DEFAULT_DELAY_MS,
+  DEFAULT_HANDLER_TIMEOUT_MS: () => DEFAULT_HANDLER_TIMEOUT_MS,
   DEFAULT_MAX_ATTEMPTS: () => DEFAULT_MAX_ATTEMPTS,
+  DEFAULT_RESIDENT_INVOKE_TIMEOUT_MS: () => DEFAULT_RESIDENT_INVOKE_TIMEOUT_MS,
   DaytonaInstance: () => DaytonaInstance,
   DaytonaProvider: () => DaytonaProvider,
   DefaultScheduleClient: () => DefaultScheduleClient,
@@ -1650,6 +1653,7 @@ __export(index_exports, {
   HEALTH_CHECK_INTERVAL_MS: () => HEALTH_CHECK_INTERVAL_MS,
   HEALTH_CHECK_TIMEOUT_MS: () => HEALTH_CHECK_TIMEOUT_MS,
   HumanMessage: () => import_messages9.HumanMessage,
+  INLINE_INPUT_LIMIT_BYTES: () => INLINE_INPUT_LIMIT_BYTES2,
   IdRemapper: () => IdRemapper,
   InMemoryA2AApiKeyStore: () => InMemoryA2AApiKeyStore,
   InMemoryAgentWebAppStore: () => InMemoryAgentWebAppStore,
@@ -1690,10 +1694,12 @@ __export(index_exports, {
   LocalSandboxProvider: () => LocalSandboxProvider,
   LoggerLatticeManager: () => LoggerLatticeManager,
   MAX_BACKOFF_MS: () => MAX_BACKOFF_MS,
+  MAX_HANDLER_TIMEOUT_MS: () => MAX_HANDLER_TIMEOUT_MS,
   MAX_LINE_LENGTH: () => MAX_LINE_LENGTH,
   MAX_PACK_ENTRIES: () => MAX_PACK_ENTRIES,
   MAX_PACK_FILE_BYTES: () => MAX_PACK_FILE_BYTES,
   MAX_PACK_TOTAL_BYTES: () => MAX_PACK_TOTAL_BYTES,
+  MIN_HANDLER_TIMEOUT_MS: () => MIN_HANDLER_TIMEOUT_MS,
   ManagedTaskStartError: () => ManagedTaskStartError,
   McpLatticeManager: () => McpLatticeManager,
   MemoryBackend: () => MemoryBackend,
@@ -1712,8 +1718,12 @@ __export(index_exports, {
   PACK_DIRECTORY_TIMEOUT_SECONDS: () => PACK_DIRECTORY_TIMEOUT_SECONDS,
   PLATFORM_SECRET_ENV_VARS: () => PLATFORM_SECRET_ENV_VARS,
   PLUGIN_CATALOG_CHANGED_TOPIC: () => PLUGIN_CATALOG_CHANGED_TOPIC,
+  PLUGIN_HOST_DIR: () => PLUGIN_HOST_DIR,
+  PLUGIN_HOST_SERVER_SOURCE: () => PLUGIN_HOST_SERVER_SOURCE,
+  PLUGIN_HOST_VERSION: () => PLUGIN_HOST_VERSION,
   PersonalAssistantConfig: () => PersonalAssistantConfig,
   PinoLoggerClient: () => PinoLoggerClient,
+  PluginDeploymentRuntimeRegistry: () => PluginDeploymentRuntimeRegistry,
   PluginRegistry: () => PluginRegistry,
   PostgresDatabase: () => PostgresDatabase,
   ProjectBotMembershipIdConflictError: () => ProjectBotMembershipIdConflictError,
@@ -1775,7 +1785,9 @@ __export(index_exports, {
   appendUiFence: () => appendUiFence,
   assertSafeUpstreamUrl: () => assertSafeUpstreamUrl,
   buildBundleFromDist: () => buildBundleFromDist,
+  buildConnectionPayload: () => buildConnectionPayload2,
   buildGrepResultsDict: () => buildGrepResultsDict,
+  buildHandlerCommand: () => buildHandlerCommand,
   buildInput: () => buildInput,
   buildNamedVolumeName: () => buildNamedVolumeName,
   buildRemotePackDirectoryCommand: () => buildRemotePackDirectoryCommand,
@@ -1843,9 +1855,11 @@ __export(index_exports, {
   decrypt: () => decrypt,
   decryptConfigFields: () => decryptConfigFields,
   describeCronExpression: () => describeCronExpression,
+  disconnectAllChannels: () => disconnectAllChannels,
   documentLearningPlugin: () => documentLearningPlugin,
   documentParserPlugin: () => documentParserPlugin,
   embeddingsLatticeManager: () => embeddingsLatticeManager,
+  encodeInput: () => encodeInput,
   encrypt: () => encrypt,
   encryptConfigFields: () => encryptConfigFields,
   ensureBuiltinAgentsForTenant: () => ensureBuiltinAgentsForTenant,
@@ -1889,6 +1903,7 @@ __export(index_exports, {
   getModelLattice: () => getModelLattice,
   getNextCronTime: () => getNextCronTime,
   getOrCreateCollectionVectorStore: () => getOrCreateCollectionVectorStore,
+  getPluginDeploymentService: () => getPluginDeploymentService,
   getPluginSkillManifestVersion: () => getPluginSkillManifestVersion,
   getQueueLattice: () => getQueueLattice,
   getReplicaId: () => getReplicaId,
@@ -1914,9 +1929,12 @@ __export(index_exports, {
   globSearchFiles: () => globSearchFiles,
   grepMatchesFromFiles: () => grepMatchesFromFiles,
   grepSearchFiles: () => grepSearchFiles,
+  handlerResultText: () => handlerResultText,
   hasChunkBuffer: () => hasChunkBuffer,
   hasDelegatedWorkerToken: () => hasDelegatedWorkerToken,
   hasRuntimeCapabilityPolicy: () => hasRuntimeCapabilityPolicy,
+  installPluginHost: () => installPluginHost,
+  invokeResident: () => invokeResident,
   invokeWithRetry: () => invokeWithRetry,
   isBuiltInSkill: () => isBuiltInSkill,
   isDirectRoom: () => isDirectRoom,
@@ -1944,6 +1962,8 @@ __export(index_exports, {
   parallelLimit: () => parallelLimit,
   parseCronExpression: () => parseCronExpression,
   parseDirectRoomType: () => parseDirectRoomType,
+  parseHandlerEnvelope: () => parseHandlerEnvelope,
+  parseHostArgs: () => parseHostArgs,
   parseJudgeVerdict: () => parseJudgeVerdict,
   parsePackSize: () => parsePackSize,
   parseQueuedExecutionMode: () => import_protocols2.parseQueuedExecutionMode,
@@ -1952,6 +1972,7 @@ __export(index_exports, {
   parseTrustedRunContext: () => import_protocols2.parseTrustedRunContext,
   parseYaml: () => parseYaml,
   performStringReplacement: () => performStringReplacement,
+  pluginHostContentHash: () => pluginHostContentHash,
   postProcessTaskMutationResponse: () => postProcessTaskMutationResponse,
   prepareTaskDispatch: () => prepareTaskDispatch,
   projectMutationMutex: () => projectMutationMutex,
@@ -1990,6 +2011,7 @@ __export(index_exports, {
   renderTemplate: () => renderTemplate,
   resetReplicaIdForTests: () => resetReplicaIdForTests,
   resolveEnabledPluginSkill: () => resolveEnabledPluginSkill,
+  resolveHandlerTimeoutMs: () => resolveHandlerTimeoutMs,
   resolveJudgeModelKey: () => resolveJudgeModelKey,
   resolvePath: () => resolvePath,
   resolvePluginConnections: () => resolvePluginConnections,
@@ -2009,6 +2031,7 @@ __export(index_exports, {
   setBindingRegistry: () => setBindingRegistry,
   setEvalRunService: () => setEvalRunService,
   setMenuRegistry: () => setMenuRegistry,
+  setPluginDeploymentService: () => setPluginDeploymentService,
   setSandboxPluginCatalog: () => setSandboxPluginCatalog,
   skillLatticeManager: () => skillLatticeManager,
   sqlDatabaseManager: () => sqlDatabaseManager,
@@ -3706,6 +3729,9 @@ var InMemoryProjectStore = class {
         workspaceId,
         name: data.name,
         description: data.description,
+        // Persist `kind` like the Local/PostgreSQL stores so `public`/`personal`/
+        // `training` project semantics survive in in-memory deployments.
+        ...data.kind === void 0 ? {} : { kind: data.kind },
         config: data.config === void 0 && Object.keys(capabilityBundleIds).length === 0 ? void 0 : { ...data.config ?? {}, ...capabilityBundleIds },
         createdAt: existing?.createdAt ?? now,
         updatedAt: now
@@ -5325,6 +5351,93 @@ var InMemoryOutboxStore = class {
   }
 };
 
+// src/store_lattice/InMemoryPluginDeploymentStore.ts
+var InMemoryPluginDeploymentStore = class {
+  constructor() {
+    this.entries = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Lists every deployment for a tenant.
+   *
+   * @param tenantId - Tenant whose deployments are listed
+   * @returns Defensive copies of the tenant's deployments
+   */
+  async listByTenant(tenantId2) {
+    return [...this.entries.values()].filter((entry) => entry.tenantId === tenantId2).map((entry) => structuredClone(entry));
+  }
+  /**
+   * Returns the deployment for a tenant + plugin type.
+   *
+   * @param tenantId - Owning tenant
+   * @param pluginType - Plugin type key
+   * @returns Defensive copy of the deployment, or undefined when absent
+   */
+  async get(tenantId2, pluginType) {
+    const entry = this.entries.get(entryKey2(tenantId2, pluginType));
+    return entry ? structuredClone(entry) : void 0;
+  }
+  /**
+   * Inserts or replaces a deployment keyed by tenant + plugin type.
+   *
+   * On conflict the existing `id` and `createdAt` are preserved while every
+   * other field (including `updatedAt`, when supplied) is updated — mirroring
+   * the PostgreSQL store's `ON CONFLICT` semantics.
+   *
+   * @param deployment - Deployment record to persist
+   * @returns Defensive copy of the stored deployment
+   */
+  async upsert(deployment) {
+    const key5 = entryKey2(deployment.tenantId, deployment.pluginType);
+    const existing = this.entries.get(key5);
+    const next = {
+      ...structuredClone(deployment),
+      id: existing?.id ?? deployment.id,
+      createdAt: existing?.createdAt ?? deployment.createdAt,
+      updatedAt: deployment.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.entries.set(key5, next);
+    return structuredClone(next);
+  }
+  /**
+   * Applies a partial update to a deployment.
+   *
+   * `patch.createdAt` is ignored (immutable) and `updatedAt` is taken from the
+   * patch when supplied, otherwise set to the current time — matching the
+   * PostgreSQL store.
+   *
+   * @param tenantId - Owning tenant
+   * @param pluginType - Plugin type key
+   * @param patch - Mutable fields to apply
+   * @returns Defensive copy of the updated deployment, or undefined when absent
+   */
+  async updateStatus(tenantId2, pluginType, patch) {
+    const key5 = entryKey2(tenantId2, pluginType);
+    const existing = this.entries.get(key5);
+    if (!existing) return void 0;
+    const next = {
+      ...existing,
+      ...patch,
+      createdAt: existing.createdAt,
+      updatedAt: patch.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.entries.set(key5, next);
+    return structuredClone(next);
+  }
+  /**
+   * Deletes a deployment by tenant + plugin type.
+   *
+   * @param tenantId - Owning tenant
+   * @param pluginType - Plugin type key
+   * @returns Whether a record was removed
+   */
+  async delete(tenantId2, pluginType) {
+    return this.entries.delete(entryKey2(tenantId2, pluginType));
+  }
+};
+function entryKey2(tenantId2, pluginType) {
+  return JSON.stringify([tenantId2, pluginType]);
+}
+
 // src/store_lattice/InMemoryUserStore.ts
 var InMemoryUserStore = class {
   constructor() {
@@ -6987,6 +7100,7 @@ var defaultProjectRoomReadStateStore = new InMemoryProjectRoomReadStateStore();
 var defaultUserPushSubscriptionStore = new InMemoryUserPushSubscriptionStore();
 var defaultLeaseStore = new InMemoryLeaseStore();
 var defaultOutboxStore = new InMemoryOutboxStore();
+var defaultPluginDeploymentStore = new InMemoryPluginDeploymentStore();
 storeLatticeManager.registerLattice("default", "thread", defaultThreadStore);
 storeLatticeManager.registerLattice(
   "default",
@@ -7010,6 +7124,7 @@ storeLatticeManager.registerLattice("default", "projectRoomReadState", defaultPr
 storeLatticeManager.registerLattice("default", "userPushSubscription", defaultUserPushSubscriptionStore);
 storeLatticeManager.registerLattice("default", "lease", defaultLeaseStore);
 storeLatticeManager.registerLattice("default", "outbox", defaultOutboxStore);
+storeLatticeManager.registerLattice("default", "pluginDeployment", defaultPluginDeploymentStore);
 var defaultUserStore = new InMemoryUserStore();
 var defaultTenantStore = new InMemoryTenantStore();
 var defaultUserTenantLinkStore = new InMemoryUserTenantLinkStore();
@@ -15069,6 +15184,82 @@ var evalPlugin = {
   })
 };
 
+// src/sandbox_plugin/residentTransport.ts
+var DEFAULT_RESIDENT_INVOKE_TIMEOUT_MS = 6e4;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEnvelope(value) {
+  return isRecord3(value) && typeof value.ok === "boolean";
+}
+function errorFromBody(value) {
+  if (isRecord3(value) && typeof value.error === "string" && value.error.length > 0) {
+    return value.error;
+  }
+  return void 0;
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+async function invokeResident(args) {
+  const {
+    baseUrl,
+    endpointPath,
+    serviceKey,
+    payload,
+    timeoutMs = DEFAULT_RESIDENT_INVOKE_TIMEOUT_MS
+  } = args;
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const url = `${baseUrl.replace(/\/$/, "")}${endpointPath}/invoke`;
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (serviceKey) {
+    headers["Authorization"] = `Bearer ${serviceKey}`;
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ ...payload, timeoutMs: payload.timeoutMs ?? timeoutMs }),
+      signal: controller.signal
+    });
+    const parsed = await readJson(response);
+    if (!response.ok) {
+      return {
+        ok: false,
+        error: errorFromBody(parsed) ?? `resident service responded with HTTP ${response.status}`,
+        status: response.status
+      };
+    }
+    if (!isEnvelope(parsed)) {
+      return {
+        ok: false,
+        error: "resident service returned an invalid envelope",
+        status: response.status
+      };
+    }
+    if (!parsed.ok) {
+      return {
+        ok: false,
+        error: errorFromBody(parsed) ?? "resident handler reported failure",
+        status: response.status
+      };
+    }
+    return { ok: true, result: parsed.result, status: response.status };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/sandbox_plugin/SandboxPluginExecutor.ts
 var PLUGINS_ROOT = "/root/.agents/plugins";
 var INLINE_INPUT_LIMIT_BYTES = 48 * 1024;
@@ -15081,11 +15272,11 @@ var MAX_MAX_RESULT_BYTES = 1048576;
 function encode(value) {
   return Buffer.from(JSON.stringify(value ?? null), "utf8").toString("base64");
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isEnvelope(value) {
-  return isRecord3(value) && typeof value.ok === "boolean";
+function isEnvelope2(value) {
+  return isRecord4(value) && typeof value.ok === "boolean";
 }
 function clamp(value, min, max) {
   return Math.min(Math.max(value, min), max);
@@ -15106,7 +15297,7 @@ function parseEnvelope(stdout) {
   const trimmed = stdout.trim();
   try {
     const parsed = JSON.parse(trimmed || "null");
-    if (isEnvelope(parsed)) return parsed;
+    if (isEnvelope2(parsed)) return parsed;
   } catch {
   }
   const lines = stdout.split("\n");
@@ -15115,7 +15306,7 @@ function parseEnvelope(stdout) {
     if (!line) continue;
     try {
       const parsed = JSON.parse(line);
-      if (isEnvelope(parsed)) return parsed;
+      if (isEnvelope2(parsed)) return parsed;
     } catch {
     }
   }
@@ -15128,26 +15319,264 @@ function truncate(value, cap) {
   while (end > 0 && (buf[end] & 192) === 128) end -= 1;
   return buf.subarray(0, end).toString("utf8") + "\n...[truncated]";
 }
+function capResult(result, cap) {
+  const serialized = typeof result === "string" ? result : JSON.stringify(result ?? null);
+  return Buffer.byteLength(serialized, "utf8") <= cap ? result : truncate(serialized, cap);
+}
+function handlerResultText(result) {
+  const value = result.result;
+  if (typeof value === "string") return value;
+  if (value === void 0) return (result.stdout ?? "").trim();
+  return JSON.stringify(value);
+}
 function errorFromStdout(stdout) {
   let text = stdout;
   try {
     const parsed = JSON.parse(stdout);
-    if (isRecord3(parsed)) {
+    if (isRecord4(parsed)) {
       text = JSON.stringify(sanitize(parsed)) ?? stdout;
     }
   } catch {
   }
   return text.slice(0, 4096);
 }
+function buildResidentPayload(args, timeoutMs) {
+  return {
+    handler: args.handler,
+    input: args.input,
+    ...args.connection === void 0 ? {} : { connection: args.connection },
+    ...args.connections === void 0 ? {} : { connections: args.connections },
+    context: args.context,
+    timeoutMs
+  };
+}
 var SandboxPluginExecutor = class {
   /**
-   * @param deps - Sandbox resolver and optional logger
+   * @param deps - Sandbox resolver, optional logger, and optional resident routing
    */
   constructor(deps) {
     this.deps = deps;
   }
   /**
-   * Invoke a plugin handler inside the tenant sandbox shell.
+   * Invoke a plugin handler.
+   *
+   * Routes to the published plugin's resident service when {@link
+   * SandboxPluginExecutorDeps.resident} is configured and a deployment is
+   * routable (`running` with an endpoint, or a resumed `onDemand` deployment).
+   * Otherwise, or when the resident call fails and degradation is enabled, runs
+   * the handler as a short `node <handler>` process inside the tenant sandbox.
+   *
+   * @param args - Invocation arguments including manifest, handler, and input
+   * @returns The normalized handler result, exit code, timing, and raw stdout
+   * @throws When `args.handler` is not a safe relative path
+   */
+  async invoke(args) {
+    const started = Date.now();
+    validateRelativePath(args.handler, "handler");
+    if (this.deps.resident) {
+      const resident = await this.tryResident(args, this.deps.resident, started);
+      if (resident) return resident;
+    }
+    return this.invokeShortProcess(args, started);
+  }
+  /**
+   * Attempt to route an invocation to a published plugin's resident service.
+   *
+   * @param args - Invocation arguments
+   * @param resident - Resident routing dependencies
+   * @param started - Invocation start timestamp used for `durationMs`
+   * @returns A terminal result (success, or failure with degradation disabled),
+   *   or `undefined` when the caller should fall back to the short-process path
+   */
+  async tryResident(args, resident, started) {
+    const tenantId2 = args.runConfig?.tenantId ?? args.context.tenantId;
+    const pluginType = args.manifest.type;
+    if (!tenantId2) return void 0;
+    const deployment = await this.lookupDeployment(resident, tenantId2, pluginType);
+    if (!deployment) return void 0;
+    const timeoutMs = clamp(args.timeoutMs ?? DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS);
+    const payload = buildResidentPayload(args, timeoutMs);
+    if (deployment.status === "running" && deployment.endpoint) {
+      let outcome = await this.callResident(resident, deployment.endpoint, payload, timeoutMs);
+      if (!outcome.ok && deployment.mode === "onDemand" && resident.ensureRunning) {
+        outcome = await this.ensureRunningAndRetry(
+          resident,
+          tenantId2,
+          pluginType,
+          deployment.endpoint,
+          payload,
+          timeoutMs,
+          outcome
+        );
+      }
+      return this.finalizeResident(outcome, args, resident, pluginType, tenantId2, started);
+    }
+    if (deployment.mode === "onDemand" && resident.ensureRunning) {
+      const outcome = await this.wakeOnDemand(resident, tenantId2, pluginType, payload, timeoutMs);
+      if (outcome) {
+        return this.finalizeResident(outcome, args, resident, pluginType, tenantId2, started);
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Normalize a resident invocation outcome into the caller-facing result.
+   *
+   * @param outcome - Normalized resident transport result
+   * @param args - Invocation arguments (for the result-size cap)
+   * @param resident - Resident routing dependencies (degradation policy)
+   * @param pluginType - Plugin type, for diagnostics
+   * @param tenantId - Tenant owning the plugin, for diagnostics
+   * @param started - Invocation start timestamp used for `durationMs`
+   * @returns The normalized result, or `undefined` when the caller should fall
+   *   back to the short-process path
+   */
+  finalizeResident(outcome, args, resident, pluginType, tenantId2, started) {
+    if (outcome.ok) {
+      const cap = clamp(
+        args.maxResultBytes ?? DEFAULT_MAX_RESULT_BYTES,
+        MIN_MAX_RESULT_BYTES,
+        MAX_MAX_RESULT_BYTES
+      );
+      return {
+        ok: true,
+        result: capResult(outcome.result, cap),
+        exitCode: 0,
+        httpStatus: outcome.status,
+        durationMs: Date.now() - started,
+        stdout: "",
+        stderr: ""
+      };
+    }
+    const error = outcome.error ?? "resident plugin invocation failed";
+    if (resident.degradeToShortProcess ?? true) {
+      this.deps.logger?.info(
+        { event: "sandbox-plugin.resident.degrade", pluginType, tenantId: tenantId2, error },
+        "resident plugin invocation failed; falling back to short process"
+      );
+      return void 0;
+    }
+    return {
+      ok: false,
+      error,
+      exitCode: 1,
+      httpStatus: outcome.status,
+      durationMs: Date.now() - started,
+      stdout: "",
+      stderr: ""
+    };
+  }
+  /**
+   * Look up a deployment, degrading to `undefined` when the lookup throws.
+   *
+   * @param resident - Resident routing dependencies
+   * @param tenantId - Tenant owning the plugin
+   * @param pluginType - Plugin type addressed by the invocation
+   * @returns The deployment, or `undefined` when absent or lookup failed
+   */
+  async lookupDeployment(resident, tenantId2, pluginType) {
+    try {
+      return await resident.getDeployment(tenantId2, pluginType);
+    } catch (error) {
+      this.deps.logger?.info(
+        {
+          event: "sandbox-plugin.resident.lookup.failed",
+          pluginType,
+          tenantId: tenantId2,
+          error: error instanceof Error ? error.message : String(error)
+        },
+        "resident deployment lookup failed; falling back to short process"
+      );
+      return void 0;
+    }
+  }
+  /**
+   * Resume a non-running `onDemand` deployment once, then invoke it.
+   *
+   * Re-reads the deployment after the resume so a cold-started endpoint is
+   * picked up. Never throws: a failed resume or a deployment that is still not
+   * `running` with an endpoint resolves to `undefined`, letting the caller use
+   * the short-process path.
+   *
+   * @param resident - Resident routing dependencies
+   * @param tenantId - Tenant owning the plugin
+   * @param pluginType - Plugin type addressed by the invocation
+   * @param payload - Invocation payload
+   * @param timeoutMs - Clamped per-call timeout
+   * @returns The resident outcome when routed, or `undefined` to short-process
+   */
+  async wakeOnDemand(resident, tenantId2, pluginType, payload, timeoutMs) {
+    try {
+      await resident.ensureRunning?.(tenantId2, pluginType);
+    } catch (error) {
+      this.deps.logger?.info(
+        {
+          event: "sandbox-plugin.resident.ensure.failed",
+          pluginType,
+          tenantId: tenantId2,
+          error: error instanceof Error ? error.message : String(error)
+        },
+        "resident service resume failed; falling back to short process"
+      );
+      return void 0;
+    }
+    const refreshed = await this.lookupDeployment(resident, tenantId2, pluginType);
+    if (!refreshed || refreshed.status !== "running" || !refreshed.endpoint) {
+      return void 0;
+    }
+    return this.callResident(resident, refreshed.endpoint, payload, timeoutMs);
+  }
+  /**
+   * Resume an `onDemand` deployment once and retry the resident call once.
+   *
+   * @param resident - Resident routing dependencies
+   * @param tenantId - Tenant owning the plugin
+   * @param pluginType - Plugin type addressed by the invocation
+   * @param endpoint - Endpoint used by the first attempt
+   * @param payload - Invocation payload
+   * @param timeoutMs - Clamped per-call timeout
+   * @param firstOutcome - Failed first attempt, returned when resume fails
+   * @returns The retry outcome, or `firstOutcome` when resume itself failed
+   */
+  async ensureRunningAndRetry(resident, tenantId2, pluginType, endpoint, payload, timeoutMs, firstOutcome) {
+    try {
+      await resident.ensureRunning?.(tenantId2, pluginType);
+    } catch (error) {
+      this.deps.logger?.info(
+        {
+          event: "sandbox-plugin.resident.ensure.failed",
+          pluginType,
+          tenantId: tenantId2,
+          error: error instanceof Error ? error.message : String(error)
+        },
+        "resident service resume failed"
+      );
+      return firstOutcome;
+    }
+    const refreshed = await this.lookupDeployment(resident, tenantId2, pluginType);
+    return this.callResident(resident, refreshed?.endpoint ?? endpoint, payload, timeoutMs);
+  }
+  /**
+   * Invoke the resident host over the sandbox-service proxy path.
+   *
+   * @param resident - Resident routing dependencies
+   * @param endpointPath - Relative proxy path
+   * @param payload - Invocation payload matching the host contract
+   * @param timeoutMs - Clamped per-call timeout
+   * @returns The normalized resident invocation result
+   */
+  callResident(resident, endpointPath, payload, timeoutMs) {
+    return invokeResident({
+      baseUrl: resident.baseUrl,
+      endpointPath,
+      serviceKey: resident.serviceKey,
+      payload,
+      timeoutMs,
+      fetchImpl: resident.fetchImpl
+    });
+  }
+  /**
+   * Invoke a plugin handler as a short `node <handler>` process.
    *
    * Resolves the sandbox, injects small input as a base64 env var (or writes a
    * temp `input.json` for large input), writes connection credentials to a temp
@@ -15157,12 +15586,10 @@ var SandboxPluginExecutor = class {
    * in all cases, including setup failures.
    *
    * @param args - Invocation arguments including manifest, handler, and input
+   * @param started - Invocation start timestamp used for `durationMs`
    * @returns The normalized handler result, exit code, timing, and raw stdout
-   * @throws When `args.handler` is not a safe relative path
    */
-  async invoke(args) {
-    const started = Date.now();
-    validateRelativePath(args.handler, "handler");
+  async invokeShortProcess(args, started) {
     const pluginDir = `${PLUGINS_ROOT}/${args.manifest.type}`;
     const handlerAbs = `${pluginDir}/${args.handler}`;
     const tenantId2 = args.runConfig?.tenantId ?? args.context.tenantId;
@@ -15250,11 +15677,9 @@ var SandboxPluginExecutor = class {
       }
       const parsed = parseEnvelope(stdout);
       if (parsed) {
-        const result = parsed.ok ? parsed.result : void 0;
-        const serialized = typeof result === "string" ? result : JSON.stringify(result ?? null);
         return {
           ok: parsed.ok,
-          result: Buffer.byteLength(serialized, "utf8") <= cap ? result : truncate(serialized, cap),
+          result: capResult(parsed.ok ? parsed.result : void 0, cap),
           error: typeof parsed.error === "string" ? parsed.error : void 0,
           exitCode,
           durationMs,
@@ -15265,7 +15690,7 @@ var SandboxPluginExecutor = class {
       const text = stdout.trim();
       return {
         ok: true,
-        result: truncate(text, cap),
+        result: capResult(text, cap),
         exitCode,
         durationMs,
         stdout,
@@ -15282,24 +15707,33 @@ var SandboxPluginExecutor = class {
   }
 };
 
+// src/sandbox_plugin/pluginDeploymentServiceRuntime.ts
+var service2 = null;
+function setPluginDeploymentService(instance) {
+  service2 = instance ?? null;
+}
+function getPluginDeploymentService() {
+  return service2;
+}
+
 // src/sandbox_plugin/TenantPluginCatalog.ts
 var import_node_crypto3 = require("crypto");
 
 // src/sandbox_plugin/jsonSchemaToZod.ts
 var import_zod45 = require("zod");
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function withDescription(schema6, raw) {
-  const description = isRecord4(raw) ? raw.description : void 0;
+  const description = isRecord5(raw) ? raw.description : void 0;
   return typeof description === "string" ? schema6.describe(description) : schema6;
 }
 function jsonSchemaToZod(schema6) {
-  if (!isRecord4(schema6)) throw new Error("schema must be an object");
+  if (!isRecord5(schema6)) throw new Error("schema must be an object");
   const type = schema6.type;
   switch (type) {
     case "object": {
-      const props = isRecord4(schema6.properties) ? schema6.properties : {};
+      const props = isRecord5(schema6.properties) ? schema6.properties : {};
       const required = Array.isArray(schema6.required) ? schema6.required.filter((x) => typeof x === "string") : [];
       const shape = {};
       for (const [key5, sub] of Object.entries(props)) {
@@ -15339,7 +15773,7 @@ var DISPLAY_MODES = ["inline", "fullscreen", "pip"];
 var MAX_MANIFEST_BYTES = 262144;
 var MAX_TOOLS = 32;
 var MAX_PLUGINS_PER_TENANT = 50;
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isSafeHandler(path8) {
@@ -15364,7 +15798,7 @@ function validateSandboxPluginManifest(args) {
   const diagnostics = [];
   const error = (code, message, pluginType, tool68) => diagnostics.push({ level: "error", code, message, pluginType, tool: tool68 });
   const raw = args.raw;
-  if (!isRecord5(raw)) {
+  if (!isRecord6(raw)) {
     error("MANIFEST_NOT_OBJECT", "manifest must be a JSON object", args.dirName);
     return { tools: [], diagnostics };
   }
@@ -15417,7 +15851,7 @@ function validateSandboxPluginManifest(args) {
   const tools = [];
   const seenToolNames = /* @__PURE__ */ new Set();
   for (const candidate of toolCandidates.slice(0, MAX_TOOLS)) {
-    if (!isRecord5(candidate)) {
+    if (!isRecord6(candidate)) {
       error("TOOL_INVALID", "tool must be an object", type);
       continue;
     }
@@ -15434,7 +15868,7 @@ function validateSandboxPluginManifest(args) {
       error("HANDLER_MISSING", `handler "${String(candidate.handler)}" not found`, type, name);
       continue;
     }
-    if (!isRecord5(candidate.schema)) {
+    if (!isRecord6(candidate.schema)) {
       error("TOOL_SCHEMA", `tool "${name}" schema must be an object`, type, name);
       continue;
     }
@@ -15448,17 +15882,17 @@ function validateSandboxPluginManifest(args) {
     let ui;
     if (candidate.ui !== void 0) {
       const rawUi = candidate.ui;
-      if (!isRecord5(rawUi) || !isSafeUiPath(rawUi.resource) || !args.handlerExists(rawUi.resource)) {
+      if (!isRecord6(rawUi) || !isSafeUiPath(rawUi.resource) || !args.handlerExists(rawUi.resource)) {
         error("TOOL_UI", `tool "${name}" ui.resource must be an existing .html file within the plugin dir`, type, name);
       } else {
-        const csp = isRecord5(rawUi.csp) ? {
+        const csp = isRecord6(rawUi.csp) ? {
           connectDomains: Array.isArray(rawUi.csp.connectDomains) ? rawUi.csp.connectDomains.filter((d) => typeof d === "string") : void 0,
           resourceDomains: Array.isArray(rawUi.csp.resourceDomains) ? rawUi.csp.resourceDomains.filter((d) => typeof d === "string") : void 0,
           frameDomains: Array.isArray(rawUi.csp.frameDomains) ? rawUi.csp.frameDomains.filter((d) => typeof d === "string") : void 0,
           baseUriDomains: Array.isArray(rawUi.csp.baseUriDomains) ? rawUi.csp.baseUriDomains.filter((d) => typeof d === "string") : void 0
         } : void 0;
         const displayMode = DISPLAY_MODES.includes(rawUi.displayMode) ? rawUi.displayMode : void 0;
-        const permissions = isRecord5(rawUi.permissions) ? {
+        const permissions = isRecord6(rawUi.permissions) ? {
           camera: rawUi.permissions.camera === true ? true : void 0,
           microphone: rawUi.permissions.microphone === true ? true : void 0,
           geolocation: rawUi.permissions.geolocation === true ? true : void 0,
@@ -15488,7 +15922,7 @@ function validateSandboxPluginManifest(args) {
   }
   const skills = {};
   if (raw.skills !== void 0) {
-    if (!isRecord5(raw.skills)) {
+    if (!isRecord6(raw.skills)) {
       error("SKILLS_INVALID", "skills must be an object", type);
     } else {
       const prefix = `${type}-`;
@@ -15503,12 +15937,12 @@ function validateSandboxPluginManifest(args) {
           error("SKILL_NAME", `skill "${name}" must be a safe relative path prefixed with "${prefix}"`, type);
           continue;
         }
-        if (!isRecord5(definition) || typeof definition.version !== "string" || typeof definition.content !== "string") {
+        if (!isRecord6(definition) || typeof definition.version !== "string" || typeof definition.content !== "string") {
           error("SKILL_INVALID", `skill "${name}" requires string version and content`, type);
           continue;
         }
         if (definition.resources !== void 0) {
-          if (!isRecord5(definition.resources)) {
+          if (!isRecord6(definition.resources)) {
             error("SKILL_RESOURCES", `skill "${name}" resources must be an object`, type);
             continue;
           }
@@ -15520,7 +15954,7 @@ function validateSandboxPluginManifest(args) {
               resourcesOk = false;
               break;
             }
-            if (!isRecord5(resource) || typeof resource.content !== "string") {
+            if (!isRecord6(resource) || typeof resource.content !== "string") {
               resourcesOk = false;
               break;
             }
@@ -15536,11 +15970,11 @@ function validateSandboxPluginManifest(args) {
   }
   const agents = {};
   if (raw.agents !== void 0) {
-    if (!isRecord5(raw.agents)) {
+    if (!isRecord6(raw.agents)) {
       error("AGENTS_INVALID", "agents must be an object", type);
     } else {
       for (const [key5, config] of Object.entries(raw.agents)) {
-        if (!isRecord5(config)) {
+        if (!isRecord6(config)) {
           error("AGENT_INVALID", `agent "${key5}" must be an object`, type);
           continue;
         }
@@ -15561,7 +15995,7 @@ function validateSandboxPluginManifest(args) {
     }
   }
   let connection;
-  if (isRecord5(raw.connection)) {
+  if (isRecord6(raw.connection)) {
     const fields = raw.connection.fields;
     if (!Array.isArray(fields)) {
       error("CONNECTION_INVALID", "connection.fields must be an array", type);
@@ -15575,7 +16009,7 @@ function validateSandboxPluginManifest(args) {
       for (const key5 of ["test", "discover"]) {
         const entry = raw.connection[key5];
         if (entry === void 0) continue;
-        const handler = isRecord5(entry) ? entry.handler : void 0;
+        const handler = isRecord6(entry) ? entry.handler : void 0;
         if (!isSafeHandler(handler) || !args.handlerExists(handler)) {
           error("CONNECTION_HANDLER", `connection.${key5} handler "${String(handler)}" not found`, type);
           continue;
@@ -15593,8 +16027,8 @@ function validateSandboxPluginManifest(args) {
     version: raw.version,
     icon: typeof raw.icon === "string" ? raw.icon : void 0,
     category: typeof raw.category === "string" ? raw.category : void 0,
-    configSchema: isRecord5(raw.configSchema) ? raw.configSchema : void 0,
-    defaultConfig: isRecord5(raw.defaultConfig) ? raw.defaultConfig : void 0,
+    configSchema: isRecord6(raw.configSchema) ? raw.configSchema : void 0,
+    defaultConfig: isRecord6(raw.defaultConfig) ? raw.defaultConfig : void 0,
     connection,
     tools,
     skills: Object.keys(skills).length > 0 ? skills : void 0,
@@ -15774,7 +16208,7 @@ var STANDARD_CONNECTION_DEFAULT_CONFIG = Object.freeze({
   connectAll: false
 });
 var EMPTY_DEFAULT_CONFIG = Object.freeze({});
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function runConfigFrom(exeConfig) {
@@ -15826,7 +16260,7 @@ function compileSandboxPlugin(args) {
               maxResultBytes: t.maxResultBytes
             });
             if (!result.ok) return result.error ?? "sandbox plugin execution failed";
-            const text = typeof result.result === "string" ? result.result : JSON.stringify(result.result ?? null);
+            const text = handlerResultText(result);
             const ref = t.ui ? { kind: "plugin", pluginType: manifest.type, resource: t.ui.resource, displayMode: t.ui.displayMode ?? "inline" } : null;
             return ref ? appendUiFence(text, ref) : text;
           },
@@ -15864,11 +16298,11 @@ async function runConnectionHandler(executor, manifest, handler, config, tenantI
     return { ok: false, message: result.error ?? "connection test failed" };
   }
   const value = result.result;
-  if (isRecord6(value) && typeof value.ok === "boolean" && typeof value.message === "string") {
+  if (isRecord7(value) && typeof value.ok === "boolean" && typeof value.message === "string") {
     return {
       ok: value.ok,
       message: value.message,
-      details: isRecord6(value.details) ? value.details : void 0
+      details: isRecord7(value.details) ? value.details : void 0
     };
   }
   return { ok: false, message: result.error ?? "connection test returned an invalid result" };
@@ -16221,13 +16655,29 @@ var TenantPluginCatalog = class {
 
 // src/sandbox_plugin/sandboxPluginRuntime.ts
 var catalog = null;
+function buildResidentRouting() {
+  const baseUrl = process.env.MICROSANDBOX_SERVICE_BASE_URL;
+  if (!baseUrl) return void 0;
+  return {
+    getDeployment: async (tenantId2, pluginType) => await getPluginDeploymentService()?.getDeployment(tenantId2, pluginType) ?? void 0,
+    ensureRunning: async (tenantId2, pluginType) => {
+      await getPluginDeploymentService()?.ensureRunning(tenantId2, pluginType);
+    },
+    baseUrl,
+    serviceKey: process.env.MICROSANDBOX_API_KEY
+  };
+}
+function buildExecutor(resolveSandbox) {
+  const resident = buildResidentRouting();
+  return new SandboxPluginExecutor({ resolveSandbox, ...resident ? { resident } : {} });
+}
 function emptyCatalog() {
   const resolveSandbox = async () => {
     throw new Error("sandbox manager not configured");
   };
   return new TenantPluginCatalog({
     resolveSandbox,
-    executor: new SandboxPluginExecutor({ resolveSandbox }),
+    executor: buildExecutor(resolveSandbox),
     reservedTypes: () => new Set(PluginRegistry.list())
   });
 }
@@ -16244,7 +16694,7 @@ function getSandboxPluginCatalog() {
   const resolveSandbox = createSandboxResolver((config) => manager.getSandboxFromConfig(config));
   catalog = new TenantPluginCatalog({
     resolveSandbox,
-    executor: new SandboxPluginExecutor({ resolveSandbox }),
+    executor: buildExecutor(resolveSandbox),
     reservedTypes: () => new Set(PluginRegistry.list())
   });
   return catalog;
@@ -16391,23 +16841,23 @@ function toolName(tool68) {
   return typeof tool68.name === "string" ? tool68.name : void 0;
 }
 function schemaHasConnectionKey(schema6) {
-  const definition = isRecord7(schema6._def) ? schema6._def : void 0;
+  const definition = isRecord8(schema6._def) ? schema6._def : void 0;
   const shape = definition?.shape;
   const fields = typeof shape === "function" ? shape() : shape;
-  return isRecord7(fields) && Object.prototype.hasOwnProperty.call(fields, "connectionKey");
+  return isRecord8(fields) && Object.prototype.hasOwnProperty.call(fields, "connectionKey");
 }
 function hasConnectionKeySchema(tool68) {
-  if (!isRecord7(tool68) || !isRecord7(tool68.schema)) return false;
+  if (!isRecord8(tool68) || !isRecord8(tool68.schema)) return false;
   if (schemaHasConnectionKey(tool68.schema)) return true;
-  const definition = isRecord7(tool68.schema._def) ? tool68.schema._def : void 0;
+  const definition = isRecord8(tool68.schema._def) ? tool68.schema._def : void 0;
   if (Array.isArray(definition?.options) && definition.options.length > 0) {
     return definition.options.every(
-      (option) => isRecord7(option) && schemaHasConnectionKey(option)
+      (option) => isRecord8(option) && schemaHasConnectionKey(option)
     );
   }
   return false;
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var CapabilityToolRegistry = class {
@@ -16499,17 +16949,17 @@ var CapabilityToolRegistry = class {
 // src/middlewares/capabilityGuardMiddleware.ts
 var import_messages4 = require("@langchain/core/messages");
 var import_langchain49 = require("langchain");
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function capabilityRuntimeFromRequest(request) {
-  if (!isRecord8(request) || !isRecord8(request.runtime)) return void 0;
+  if (!isRecord9(request) || !isRecord9(request.runtime)) return void 0;
   const configurable = request.runtime.configurable;
   const context = request.runtime.context;
-  const runConfig = isRecord8(configurable) && isRecord8(configurable.runConfig) ? configurable.runConfig : isRecord8(context) && isRecord8(context.runConfig) ? context.runConfig : void 0;
+  const runConfig = isRecord9(configurable) && isRecord9(configurable.runConfig) ? configurable.runConfig : isRecord9(context) && isRecord9(context.runConfig) ? context.runConfig : void 0;
   if (!runConfig) return void 0;
   const value = runConfig.capabilityRuntime;
-  if (!isRecord8(value) || typeof value.revision !== "string" || !isRecord8(value.middleware)) {
+  if (!isRecord9(value) || typeof value.revision !== "string" || !isRecord9(value.middleware)) {
     return void 0;
   }
   return value;
@@ -16521,10 +16971,10 @@ function hasActiveRuntimePolicy(runtime) {
   return Object.keys(runtime.middleware).length > 0;
 }
 function tenantIdFromRequest(request) {
-  if (!isRecord8(request) || !isRecord8(request.runtime)) return void 0;
+  if (!isRecord9(request) || !isRecord9(request.runtime)) return void 0;
   const configurable = request.runtime.configurable;
   const context = request.runtime.context;
-  const runConfig = isRecord8(configurable) && isRecord8(configurable.runConfig) ? configurable.runConfig : isRecord8(context) && isRecord8(context.runConfig) ? context.runConfig : void 0;
+  const runConfig = isRecord9(configurable) && isRecord9(configurable.runConfig) ? configurable.runConfig : isRecord9(context) && isRecord9(context.runConfig) ? context.runConfig : void 0;
   return runConfig && typeof runConfig.tenantId === "string" ? runConfig.tenantId : void 0;
 }
 async function standardConnectionAllowed(request, capabilityType, config) {
@@ -16532,8 +16982,8 @@ async function standardConnectionAllowed(request, capabilityType, config) {
   const hasConnectAll = Object.prototype.hasOwnProperty.call(config, "connectAll");
   if (!hasConnections && (!hasConnectAll || config.connectAll !== true)) return false;
   const tenantId2 = tenantIdFromRequest(request);
-  const resource = isRecord8(request.toolCall) && isRecord8(request.toolCall.args) ? request.toolCall.args.connectionKey : void 0;
-  const hasConnectionKey = isRecord8(request.toolCall) && isRecord8(request.toolCall.args) && Object.prototype.hasOwnProperty.call(
+  const resource = isRecord9(request.toolCall) && isRecord9(request.toolCall.args) ? request.toolCall.args.connectionKey : void 0;
+  const hasConnectionKey = isRecord9(request.toolCall) && isRecord9(request.toolCall.args) && Object.prototype.hasOwnProperty.call(
     request.toolCall.args,
     "connectionKey"
   );
@@ -16599,10 +17049,10 @@ function createCapabilityGuardMiddleware(registry4) {
           toolName: toolName2
         });
       }
-      const standardConfig = isRecord8(policy.config) ? policy.config : {};
+      const standardConfig = isRecord9(policy.config) ? policy.config : {};
       if (registry4.isStandardConnectionTool(toolName2) && !await standardConnectionAllowed(request, metadata.capabilityType, standardConfig)) {
         const args2 = request.toolCall.args;
-        const resource = isRecord8(args2) && typeof args2.connectionKey === "string" ? args2.connectionKey : void 0;
+        const resource = isRecord9(args2) && typeof args2.connectionKey === "string" ? args2.connectionKey : void 0;
         return denialMessage(request.toolCall, {
           code: "RESOURCE_NOT_ALLOWED",
           message: typeof resource === "string" ? `Resource '${resource}' is not allowed by the capability policy` : "Resource selector 'connectionKey' must be a permitted string",
@@ -16615,8 +17065,8 @@ function createCapabilityGuardMiddleware(registry4) {
       const selector = metadata.resourceSelector;
       const args = request.toolCall.args;
       if (selector) {
-        const resource = isRecord8(args) ? args[selector.argumentField] : void 0;
-        const config = isRecord8(policy.config) ? policy.config : {};
+        const resource = isRecord9(args) ? args[selector.argumentField] : void 0;
+        const config = isRecord9(policy.config) ? policy.config : {};
         const hasExplicitResources = Object.prototype.hasOwnProperty.call(config, selector.configField);
         const allowsAll = !hasExplicitResources && selector.allowAllField !== void 0 && config[selector.allowAllField] === true;
         const allowedResources = config[selector.configField];
@@ -32391,6 +32841,7 @@ function assistantToConfig(assistant) {
     prompt: typeof assistant.graphDefinition === "string" ? assistant.graphDefinition : JSON.stringify(assistant.graphDefinition)
   };
   Object.assign(config, graphDef);
+  if (assistant.ownerUserId !== void 0) config.ownerUserId = assistant.ownerUserId;
   return config;
 }
 var _AgentLatticeManager = class _AgentLatticeManager extends BaseLatticeManager {
@@ -34788,6 +35239,9 @@ var MicrosandboxRemoteInstance = class {
     }
     return "unknown";
   }
+  async getEndpoint(port) {
+    return this.client.getEndpoint(this.name, port);
+  }
   /**
    * Pack a sandbox folder into a sibling ZIP through the microsandbox shell.
    *
@@ -34854,6 +35308,19 @@ var MicrosandboxServiceClient = class {
       method: "GET"
     });
   }
+  /**
+   * Resolve the endpoint for a published guest port of a sandbox.
+   *
+   * @param name - Sandbox name
+   * @param port - Guest port published via `ensureSandbox({ exposePorts })`
+   * @returns The scheme-less endpoint string and optional headers
+   */
+  async getEndpoint(name, port) {
+    return this.request(
+      `/api/sandboxes/${encodeURIComponent(name)}/endpoints/${port}`,
+      { method: "GET" }
+    );
+  }
   async readFile(sandboxName, path8) {
     return this.request("/api/files/read", {
       method: "POST",
@@ -35009,7 +35476,9 @@ var MicrosandboxServiceClient = class {
         }
       } catch {
       }
-      throw new Error(`Microsandbox service request failed: ${detail}`);
+      const error = new Error(`Microsandbox service request failed: ${detail}`);
+      error.statusCode = response.status;
+      throw error;
     }
     const payload = await response.json();
     if (payload?.success === false) {
@@ -35118,9 +35587,9 @@ var MicrosandboxRemoteProvider = class {
   }
   buildEnsureInput(config) {
     const defaultMicrosandboxRemoteConfig = getDefaultMicrosandboxRemoteConfig();
-    const image = this.config.image ?? defaultMicrosandboxRemoteConfig.image;
+    const image = config.image ?? this.config.image ?? defaultMicrosandboxRemoteConfig.image;
     console.log(
-      `[MicrosandboxRemote] buildEnsureInput image=${image} from=${this.config.image ? "providerConfig" : "defaultConfig"}`
+      `[MicrosandboxRemote] buildEnsureInput image=${image} from=${config.image ? "runConfig" : this.config.image ? "providerConfig" : "defaultConfig"}`
     );
     return {
       image,
@@ -35130,7 +35599,10 @@ var MicrosandboxRemoteProvider = class {
         ...this.config.env,
         ...buildSandboxMetadataEnv(config)
       },
-      volumes: config?.volumes ?? this.buildDefaultVolumes(config)
+      volumes: config?.volumes ?? this.buildDefaultVolumes(config),
+      entrypoint: config.entrypoint,
+      timeoutSeconds: config.timeoutSeconds,
+      exposePorts: config.exposePorts
     };
   }
   buildDefaultVolumes(config) {
@@ -36856,6 +37328,157 @@ async function connectAllChannels(getAdapter, options = {}) {
     }
   }
 }
+async function disconnectAllChannels(getAdapter) {
+  const store = getStoreLattice("default", "channelInstallation").store;
+  const installations = await store.getAllInstallations();
+  console.log(`[disconnectAllChannels] total=${installations.length} enabled=${installations.filter((i) => i.enabled).length}`);
+  for (const inst of installations) {
+    if (!inst.enabled) continue;
+    const adapter = getAdapter(inst.channel);
+    if (!adapter?.disconnect) continue;
+    try {
+      await adapter.disconnect(inst.id);
+    } catch (error) {
+      console.error(`[disconnectAllChannels] disconnect failed: channel=${inst.channel} tenant=${inst.tenantId} id=${inst.id}`, error);
+    }
+  }
+}
+
+// src/channel/ChannelConnectionLeader.ts
+var import_node_crypto8 = require("crypto");
+var LEASE_KEY = "leader:channel-connections";
+var ChannelConnectionLeader = class {
+  constructor(deps) {
+    this.holder = null;
+    this.connected = false;
+    this.attempted = false;
+    this.inFlight = null;
+    this.timer = null;
+    this.running = false;
+    this.stopped = false;
+    this.deps = deps;
+    this.ttlMs = deps.ttlMs ?? 6e4;
+    this.retryMs = deps.retryMs ?? Math.max(5e3, Math.floor(this.ttlMs / 3));
+  }
+  /** Starts the ownership loop (immediate tick, then every `retryMs`). */
+  start() {
+    if (this.timer || this.stopped) return;
+    void this.tickOnce();
+    this.timer = setInterval(() => {
+      void this.tickOnce();
+    }, this.retryMs);
+    this.timer.unref?.();
+  }
+  /**
+   * Releases ownership (if held) and disconnects.
+   *
+   * @returns A promise that settles after teardown completes.
+   * @remarks Terminal: a stopped leader does not restart.
+   */
+  async stop() {
+    this.stopped = true;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (this.inFlight) await this.inFlight.catch(() => void 0);
+    if (this.holder) {
+      const holder = this.holder;
+      this.holder = null;
+      await this.deps.leaseStore.release(LEASE_KEY, holder).catch((error) => {
+        this.deps.log?.warn("Channel leader lease release failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
+    await this.disconnectChannels();
+  }
+  /**
+   * Runs one ownership/health step. Public for deterministic tests.
+   *
+   * @returns A promise that settles when this step completes.
+   */
+  async tickOnce() {
+    if (this.running || this.stopped) return;
+    this.running = true;
+    const run = this.runTick();
+    this.inFlight = run;
+    try {
+      await run;
+    } finally {
+      if (this.inFlight === run) this.inFlight = null;
+      this.running = false;
+    }
+  }
+  /**
+   * Performs one acquire/renew/step decision.
+   *
+   * @remarks A transient lease-store error while renewing keeps the current
+   * holder and connections intact (retry next tick); only a confirmed
+   * `renewed === false` triggers teardown.
+   */
+  async runTick() {
+    if (this.holder) {
+      let renewed = false;
+      let renewFailed = false;
+      try {
+        renewed = await this.deps.leaseStore.renew(LEASE_KEY, this.holder, this.ttlMs);
+      } catch (error) {
+        renewFailed = true;
+        this.deps.log?.warn("Channel leader lease renew failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      if (renewFailed) return;
+      if (renewed) {
+        if (!this.connected) await this.connectChannels();
+        return;
+      }
+      await this.loseLeadership();
+    }
+    await this.tryAcquire();
+  }
+  async tryAcquire() {
+    const holder = `${this.deps.owner}#${(0, import_node_crypto8.randomUUID)()}`;
+    const acquired = await this.deps.leaseStore.tryAcquire(LEASE_KEY, holder, this.ttlMs).catch((error) => {
+      this.deps.log?.warn("Channel leader lease acquire failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return false;
+    });
+    if (!acquired) return;
+    this.holder = holder;
+    await this.connectChannels();
+  }
+  async loseLeadership() {
+    this.holder = null;
+    await this.disconnectChannels();
+  }
+  async connectChannels() {
+    this.attempted = true;
+    try {
+      await this.deps.connect();
+      this.connected = true;
+    } catch (error) {
+      this.connected = false;
+      this.deps.log?.warn("Channel leader connect failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  async disconnectChannels() {
+    if (!this.attempted) return;
+    this.attempted = false;
+    this.connected = false;
+    try {
+      await this.deps.disconnect();
+    } catch (error) {
+      this.deps.log?.warn("Channel leader disconnect failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+};
 
 // src/eval_lattice/LatticeEval.ts
 var import_messages7 = require("@langchain/core/messages");
@@ -38304,6 +38927,7 @@ var OutboxPoller = class {
 };
 
 // src/services/ProjectMutationMutex.ts
+var import_node_async_hooks = require("async_hooks");
 var import_protocols28 = require("@axiom-lattice/protocols");
 
 // src/services/coordinationLease.ts
@@ -38316,7 +38940,7 @@ function getCoordinationLeaseStore() {
 }
 
 // src/services/withLease.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var LeaseAcquisitionTimeoutError = class extends Error {
   /**
    * @param key Lease key that could not be acquired.
@@ -38341,7 +38965,7 @@ async function withLease(store, key5, ownerLabel, fn, options = {}) {
   const acquireTimeoutMs = options.acquireTimeoutMs ?? 1e4;
   const retryDelayMs = options.retryDelayMs ?? 50;
   const heartbeatMs = options.heartbeatMs ?? Math.max(1e3, Math.floor(ttlMs / 3));
-  const holder = `${ownerLabel}#${(0, import_node_crypto8.randomUUID)()}`;
+  const holder = `${ownerLabel}#${(0, import_node_crypto9.randomUUID)()}`;
   const deadline = Date.now() + acquireTimeoutMs;
   for (; ; ) {
     if (await store.tryAcquire(key5, holder, ttlMs)) break;
@@ -38373,16 +38997,24 @@ var ProjectMutationMutex = class {
   constructor() {
     this.queues = /* @__PURE__ */ new Map();
     this.active = /* @__PURE__ */ new Set();
+    /** Project keys already held by the current async context (reentrancy). */
+    this.held = new import_node_async_hooks.AsyncLocalStorage();
   }
   /** Runs one mutation after all earlier mutations for the same Tenant and Project. */
   async runExclusive(scope, operation, signal) {
     const key5 = projectKey(scope);
+    const inherited = this.held.getStore();
+    if (inherited?.has(key5)) return operation();
     const leaseKey = `project-mutation:${encodeURIComponent(scope.tenantId)}:${encodeURIComponent(scope.projectId)}`;
     await this.acquire(key5, signal);
+    const held = new Set(inherited);
+    held.add(key5);
     try {
-      const store = getCoordinationLeaseStore();
-      if (!store) return await operation();
-      return await withLease(store, leaseKey, getReplicaId(), operation, MUTATION_LEASE_OPTIONS);
+      return await this.held.run(held, async () => {
+        const store = getCoordinationLeaseStore();
+        if (!store) return await operation();
+        return await withLease(store, leaseKey, getReplicaId(), operation, MUTATION_LEASE_OPTIONS);
+      });
     } finally {
       this.release(key5);
     }
@@ -38456,6 +39088,7 @@ var INPUT_KEYS = [
 ];
 var REPLY_INPUT_KEYS = ["tenantId", "membershipId", "text", "sourceRoomMessageId", "inputMessageId", "sourceId", "idempotencyKey"];
 var INTERRUPT_INPUT_KEYS = ["tenantId", "membershipId", "text", "sourceRoomMessageId", "inputMessageId"];
+var CORRELATED_INTERRUPT_INPUT_KEYS = ["tenantId", "membershipId", "correlationKey", "text"];
 var RoomAgentMessageService = class {
   /**
    * Creates a room writer over the durable membership and message stores.
@@ -38503,6 +39136,50 @@ var RoomAgentMessageService = class {
       idempotencyKey: `room-interrupt:${snapshot.sourceRoomMessageId}:${snapshot.membershipId}:${sourceId}`
     });
   }
+  /**
+   * Persists a correlated HITL interrupt that has no human source message.
+   *
+   * @param input Explicit tenant, active membership, caller-supplied correlation key, and text.
+   * @returns A deep clone of the canonical idempotent room message.
+   * @remarks Business-agnostic: the caller owns the correlation key. Scope is
+   * validated against the durable membership; no source message is required.
+   */
+  postCorrelatedInterrupt(input) {
+    const snapshot = exactStringRecord(input, CORRELATED_INTERRUPT_INPUT_KEYS, "Invalid project room interrupt input");
+    return this.persistScoped({
+      tenantId: snapshot.tenantId,
+      membershipId: snapshot.membershipId,
+      text: snapshot.text,
+      sourceId: `interrupt:${snapshot.correlationKey}`,
+      idempotencyKey: `room-interrupt:${snapshot.membershipId}:${snapshot.correlationKey}`
+    });
+  }
+  async persistScoped(input) {
+    const text = input.text.trim();
+    if (text.length < 1 || text.length > 2e4) throw new Error("Invalid project room message text");
+    const member = snapshotMembership(await this.deps.memberships.findById(input.tenantId, input.membershipId));
+    if (!member || member.id !== input.membershipId || member.status !== "active" || member.tenantId !== input.tenantId) {
+      throw new Error("Invalid project room membership");
+    }
+    const candidate = {
+      id: (this.deps.idFactory ?? import_crypto8.randomUUID)(),
+      tenantId: member.tenantId,
+      workspaceId: member.workspaceId,
+      projectId: member.projectId,
+      roomId: member.roomId,
+      author: { type: "bot", membershipId: member.id, assistantId: member.assistantId },
+      content: { type: "text", text },
+      mentions: [],
+      source: "agent",
+      sourceId: input.sourceId,
+      idempotencyKey: input.idempotencyKey
+    };
+    const canonical = snapshotCanonicalScoped(await this.deps.messages.createIdempotent(candidate), candidate);
+    if (!canonical) throw new Error("Invalid canonical project room message");
+    const result = structuredClone(canonical);
+    this.notifyCommitted(result);
+    return result;
+  }
   async persistDerived(input) {
     const source = snapshotSource(await this.deps.messages.findById(input.tenantId, input.sourceRoomMessageId));
     if (!source || source.id !== input.sourceRoomMessageId || source.tenantId !== input.tenantId) throw new Error("Invalid project room message");
@@ -38658,6 +39335,27 @@ function snapshotCanonical(value, expected) {
     createdAt
   };
 }
+function snapshotCanonicalScoped(value, expected) {
+  const values = exactValues(value, ["id", "tenantId", "workspaceId", "projectId", "roomId", "author", "content", "mentions", "source", "sourceId", "idempotencyKey", "createdAt"], ["replyToMessageId"]);
+  const author = exactValues(values?.author, ["type", "membershipId", "assistantId"]);
+  const content = exactValues(values?.content, ["type", "text"]);
+  const createdAt = date(values?.createdAt);
+  if (!values || !createdAt || typeof values.id !== "string" || values.id.length === 0 || (0, import_protocols29.snapshotExactArray)(values.mentions)?.length !== 0 || author?.type !== "bot" || expected.author.type !== "bot" || author.membershipId !== expected.author.membershipId || author.assistantId !== expected.author.assistantId || content?.type !== "text" || content.text !== expected.content.text || values.tenantId !== expected.tenantId || values.workspaceId !== expected.workspaceId || values.projectId !== expected.projectId || values.roomId !== expected.roomId || values.source !== "agent" || values.sourceId !== expected.sourceId || values.idempotencyKey !== expected.idempotencyKey) return void 0;
+  return {
+    id: values.id,
+    tenantId: expected.tenantId,
+    workspaceId: expected.workspaceId,
+    projectId: expected.projectId,
+    roomId: expected.roomId,
+    author: { type: "bot", membershipId: expected.author.membershipId, assistantId: expected.author.assistantId },
+    content: { type: "text", text: expected.content.text },
+    mentions: [],
+    source: "agent",
+    sourceId: expected.sourceId,
+    idempotencyKey: expected.idempotencyKey,
+    createdAt
+  };
+}
 
 // src/services/ProjectTaskOwnerPolicy.ts
 var import_protocols30 = require("@axiom-lattice/protocols");
@@ -38819,11 +39517,11 @@ function snapshotDate(value) {
 }
 
 // src/services/TaskLifecycleService.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_protocols31 = require("@axiom-lattice/protocols");
 
 // src/middlewares/taskBelief.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 function buildBeliefCompletionEventKey(taskId, result, impacts) {
   const canonical = JSON.stringify({
     beliefImpact: impacts.map((impact) => ({
@@ -38834,7 +39532,7 @@ function buildBeliefCompletionEventKey(taskId, result, impacts) {
     })),
     result: result.trim()
   });
-  return (0, import_node_crypto9.createHash)("sha256").update(canonical).digest("hex");
+  return (0, import_node_crypto10.createHash)("sha256").update(canonical).digest("hex");
 }
 function buildCompletionEvidenceDetail(result, impacts, eventKey) {
   return { result, beliefImpact: impacts, eventKey };
@@ -39037,7 +39735,7 @@ function canonicalJson(value) {
   return JSON.stringify(value);
 }
 function sha256(value) {
-  return (0, import_node_crypto10.createHash)("sha256").update(canonicalJson(value)).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(canonicalJson(value)).digest("hex");
 }
 function sameEvidenceDetail(detail, taskId, result, impacts, eventKey, beliefOwner) {
   const storedOwner = detail.beliefOwner;
@@ -41115,7 +41813,7 @@ function createTaskLifecycleService(deps) {
 }
 
 // src/services/TaskExecutionService.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_node_util3 = require("util");
 var import_protocols32 = require("@axiom-lattice/protocols");
 
@@ -41438,13 +42136,13 @@ async function reconcileAllTenantTaskRuns(input) {
 }
 
 // src/services/taskRunLease.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 function taskRunLeaseKey(taskId) {
   return `task-run:${taskId}`;
 }
 async function tryAcquireTaskRun(input) {
   const key5 = taskRunLeaseKey(input.taskId);
-  const holder = `${input.owner}#${(0, import_node_crypto11.randomUUID)()}`;
+  const holder = `${input.owner}#${(0, import_node_crypto12.randomUUID)()}`;
   if (!await input.store.tryAcquire(key5, holder, input.ttlMs)) return null;
   const heartbeatMs = input.heartbeatMs ?? Math.max(1e3, Math.floor(input.ttlMs / 3));
   let released = false;
@@ -41811,11 +42509,11 @@ function createTaskExecutionService(deps) {
     let threadId;
     let runId;
     try {
-      threadId = storedThreadId ?? (deps.createThreadId ?? import_node_crypto12.randomUUID)();
+      threadId = storedThreadId ?? (deps.createThreadId ?? import_node_crypto13.randomUUID)();
       if (task.status === "interrupted" && reuseCurrentRun) {
         runId = storedRunId;
       } else if (task.status === "interrupted" || task.status === "failed") {
-        runId = (deps.createRunId ?? import_node_crypto12.randomUUID)();
+        runId = (deps.createRunId ?? import_node_crypto13.randomUUID)();
       }
     } catch (error) {
       return {
@@ -42074,11 +42772,11 @@ function createTaskExecutionService(deps) {
 }
 
 // src/services/leadership.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 async function runAsLeader(store, name, fn, options = {}) {
   const key5 = `leader:${name}`;
   const owner2 = options.owner ?? getReplicaId();
-  const holder = `${owner2}#${(0, import_node_crypto13.randomUUID)()}`;
+  const holder = `${owner2}#${(0, import_node_crypto14.randomUUID)()}`;
   const ttlMs = options.ttlMs ?? 6e4;
   if (!await store.tryAcquire(key5, holder, ttlMs)) return { ran: false };
   const heartbeat = setInterval(() => {
@@ -43311,16 +44009,16 @@ function createAskUserToClarifyTool() {
 }
 
 // src/middlewares/askUserClarifyMiddleware.ts
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isProjectRoomRun(request) {
-  if (!isRecord9(request) || !isRecord9(request.runtime)) return false;
+  if (!isRecord10(request) || !isRecord10(request.runtime)) return false;
   const runtime = request.runtime;
-  const configurable = isRecord9(runtime.configurable) ? runtime.configurable.runConfig : void 0;
-  const context = isRecord9(runtime.context) ? runtime.context.runConfig : void 0;
-  const runConfig = isRecord9(configurable) ? configurable : isRecord9(context) ? context : void 0;
-  return isRecord9(runConfig?.projectRoom);
+  const configurable = isRecord10(runtime.configurable) ? runtime.configurable.runConfig : void 0;
+  const context = isRecord10(runtime.context) ? runtime.context.runConfig : void 0;
+  const runConfig = isRecord10(configurable) ? configurable : isRecord10(context) ? context : void 0;
+  return isRecord10(runConfig?.projectRoom);
 }
 function createAskUserClarifyMiddleware() {
   return (0, import_langchain79.createMiddleware)({
@@ -44760,15 +45458,16 @@ function executorString(value) {
 }
 async function renderAvailableExecutors(rc, tenantId2) {
   const authority = classifyTaskAuthority(rc);
-  const governed = authority.kind === "projectRoom" || authority.kind === "projectTask";
-  const projectId = governed ? (authority.trusted.projectTask ?? authority.trusted.projectRoom)?.projectId : void 0;
-  const cacheKey = `${tenantId2}:${governed ? `project:${projectId ?? ""}` : "ordinary"}`;
+  const trusted = authority.kind === "projectRoom" || authority.kind === "projectTask" ? authority.trusted : void 0;
+  const useRoster = trusted !== void 0 && !trustedRosterExempt(trusted);
+  const projectId = trusted ? (trusted.projectTask ?? trusted.projectRoom)?.projectId : void 0;
+  const cacheKey = `${tenantId2}:${useRoster ? `project:${projectId ?? ""}` : "tenant"}`;
   const cached2 = executorCache.get(cacheKey);
   const now = Date.now();
   if (cached2 && now - cached2.at < EXECUTOR_CACHE_TTL_MS) return cached2.text;
   const lines = [];
   try {
-    if (governed && projectId) {
+    if (useRoster && projectId) {
       const store = getStoreLattice("default", "projectBotMembership").store;
       if (typeof store.list === "function") {
         const bots = await store.list(tenantId2, projectId);
@@ -44783,11 +45482,15 @@ async function renderAvailableExecutors(rc, tenantId2) {
         }
       }
     } else {
+      const exempt = trusted !== void 0 && trustedRosterExempt(trusted) ? trusted : void 0;
+      const excluded = exempt ? await excludedRosterExecutors(exempt) : /* @__PURE__ */ new Set();
       const configs = await agentLatticeManager.getAllAgentConfigsByTenant(tenantId2);
       for (const config of configs.slice(0, 40)) {
         const row = config;
         const id = executorString(row.key);
         if (!id) continue;
+        if (row.ownerUserId !== void 0) continue;
+        if (excluded.has(id)) continue;
         const name = executorString(row.name);
         const description = executorString(row.description);
         lines.push(`- ${id}${name ? ` \u2014 ${name}` : ""}${description ? ` (${description.slice(0, 120)})` : ""}`);
@@ -44799,7 +45502,7 @@ async function renderAvailableExecutors(rc, tenantId2) {
     executorCache.set(cacheKey, { at: now, text: "" });
     return "";
   }
-  const header = governed ? "## Available task executors (Project roster)" : "## Available task executors";
+  const header = useRoster ? "## Available task executors (Project roster)" : "## Available task executors";
   const text = `
 
 ${header}
@@ -44811,6 +45514,22 @@ ${lines.join("\n")}
   executorCache.set(cacheKey, { at: now, text });
   return text;
 }
+async function excludedRosterExecutors(trusted) {
+  const excluded = /* @__PURE__ */ new Set();
+  const context = trusted.projectTask ?? trusted.projectRoom;
+  if (!context) return excluded;
+  try {
+    const store = getStoreLattice("default", "projectBotMembership").store;
+    if (typeof store.list !== "function") return excluded;
+    const rows = await store.list(context.tenantId, context.projectId);
+    for (const row of Array.isArray(rows) ? rows : []) {
+      const record = row;
+      if (record.status !== "active" && typeof record.assistantId === "string") excluded.add(record.assistantId);
+    }
+  } catch {
+  }
+  return excluded;
+}
 function delegatedTaskScopeError(taskId) {
   return JSON.stringify({
     success: false,
@@ -44860,7 +45579,7 @@ function trustedRosterScope(trusted) {
   };
 }
 function trustedRosterExempt(trusted) {
-  return trusted.projectTask?.rosterExempt === true;
+  return trusted.projectTask?.rosterExempt === true || trusted.projectRoom?.rosterExempt === true;
 }
 async function requireTrustedOwner(trusted, targetAssistantId) {
   const context = trusted.projectTask ?? trusted.projectRoom;
@@ -44876,6 +45595,17 @@ async function requireTrustedOwner(trusted, targetAssistantId) {
     targetAssistantId
   });
 }
+async function rosterExemptOwnerError(tenantId2, targetAssistantId) {
+  try {
+    const lattice = await agentLatticeManager.getOrLoadWithTenant(tenantId2, targetAssistantId);
+    if (lattice && lattice.config.ownerUserId === void 0) return void 0;
+  } catch {
+  }
+  return projectPolicyError(new ProjectTaskOwnerPolicyError(
+    "PROJECT_TASK_OWNER_INACTIVE",
+    "Target Project task owner is not a shared agent of this tenant."
+  ));
+}
 function trustedTaskContextFailure(task, trusted) {
   if (task.tenantId === trusted.tenantId && task.workspaceId === trusted.workspaceId && task.projectId === trusted.projectId) return void 0;
   return JSON.stringify({
@@ -45480,6 +46210,12 @@ function createTaskMiddleware(options = {}) {
                 "Target Project task owner is not active in the exact roster."
               ));
             }
+          } else {
+            const ownerError = await rosterExemptOwnerError(
+              (trustedProject.projectTask ?? trustedProject.projectRoom)?.tenantId ?? tenantId2,
+              ownerId
+            );
+            if (ownerError) return ownerError;
           }
         }
         if (!delegatedTaskId && (typeof effectiveOwnerId !== "string" || effectiveOwnerId.length === 0)) {
@@ -45541,6 +46277,12 @@ function createTaskMiddleware(options = {}) {
               } catch (error) {
                 return projectPolicyError(error);
               }
+            } else {
+              const ownerError = await rosterExemptOwnerError(
+                (trustedProject.projectTask ?? trustedProject.projectRoom)?.tenantId ?? tenantId2,
+                ownerId
+              );
+              if (ownerError) return ownerError;
             }
           }
           return store.create({
@@ -46588,7 +47330,7 @@ function createTaskMiddleware(options = {}) {
     }
     const callerAssistantId = rc.assistant_id;
     const agentId = input.agentId === "general-purpose" && callerAssistantId ? `${callerAssistantId}-general-purpose` : input.agentId;
-    const service2 = createTaskExecutionService({
+    const service3 = createTaskExecutionService({
       taskStore: getTaskStore(),
       workItemStore: getTaskWorkItemStore(),
       resolveAgent: async (targetTenantId, agentId2) => !!await agentLatticeManager.getOrLoadWithTenant(targetTenantId, agentId2),
@@ -46613,7 +47355,7 @@ function createTaskMiddleware(options = {}) {
       }
     });
     const trustedCaller = authority.kind === "projectTask" || authority.kind === "projectRoom" ? authority.trusted.projectTask ?? authority.trusted.projectRoom : void 0;
-    return JSON.stringify(await service2.start({
+    return JSON.stringify(await service3.start({
       tenantId: tenantId2,
       workspaceId: rc.workspaceId,
       projectId: rc.projectId,
@@ -48130,6 +48872,24 @@ function snapshotMembership3(value) {
 function snapshotRows(value) {
   return (0, import_protocols37.snapshotExactArray)(value) ?? [];
 }
+async function rosterExemptMembershipProjection(scope) {
+  const excluded = /* @__PURE__ */ new Set();
+  const roles = /* @__PURE__ */ new Map();
+  try {
+    const rows = snapshotRows(await getStoreLattice("default", "projectBotMembership").store.list(scope.tenantId, scope.projectId));
+    for (const row of rows) {
+      const member = snapshotMembership3(row);
+      if (!member) continue;
+      if (member.status !== "active") {
+        excluded.add(member.assistantId);
+        continue;
+      }
+      roles.set(member.assistantId, member.role);
+    }
+  } catch {
+  }
+  return { excluded, roles };
+}
 async function hasActiveCurrentMembership(scope) {
   const memberships = getStoreLattice("default", "projectBotMembership").store;
   const member = snapshotMembership3(await memberships.findById(scope.tenantId, scope.membershipId));
@@ -48146,11 +48906,11 @@ function createProjectRoomMiddleware() {
         if (!scope) return CONTEXT_REQUIRED;
         const digest = (0, import_crypto10.createHash)("sha256").update(text).digest("hex");
         try {
-          const service2 = new RoomAgentMessageService({
+          const service3 = new RoomAgentMessageService({
             memberships: getStoreLattice("default", "projectBotMembership").store,
             messages: getStoreLattice("default", "projectRoomMessage").store
           });
-          await service2.post({
+          await service3.post({
             tenantId: scope.tenantId,
             workspaceId: scope.workspaceId,
             projectId: scope.projectId,
@@ -48176,6 +48936,25 @@ function createProjectRoomMiddleware() {
         if (!scope) return CONTEXT_REQUIRED;
         try {
           if (!await hasActiveCurrentMembership(scope)) return CONTEXT_REQUIRED;
+          if (scope.rosterExempt === true) {
+            const { excluded, roles } = await rosterExemptMembershipProjection(scope);
+            const configs = await agentLatticeManager.getAllAgentConfigsByTenant(scope.tenantId);
+            const members2 = configs.filter((entry) => entry.ownerUserId === void 0).filter((entry) => {
+              const key5 = entry.key;
+              return typeof key5 === "string" && !excluded.has(key5);
+            }).map((entry) => {
+              const row = entry;
+              const name = typeof row.name === "string" ? row.name : "";
+              const assistantId = typeof row.key === "string" ? row.key : "";
+              return {
+                assistantId,
+                mentionName: name,
+                title: name,
+                role: roles.get(assistantId) ?? "specialist"
+              };
+            }).filter((member) => member.assistantId !== "" && member.mentionName !== "").sort((left, right) => left.assistantId < right.assistantId ? -1 : left.assistantId > right.assistantId ? 1 : 0);
+            return JSON.stringify({ success: true, members: members2 });
+          }
           const rows = await getStoreLattice("default", "projectBotMembership").store.list(scope.tenantId, scope.projectId);
           const members = snapshotRows(rows).map(snapshotMembership3).filter((member) => member !== void 0 && member.status === "active" && member.tenantId === scope.tenantId && member.workspaceId === scope.workspaceId && member.projectId === scope.projectId && member.roomId === scope.roomId).sort((left, right) => left.joinedAt.getTime() - right.joinedAt.getTime() || (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)).map((member) => ({
             assistantId: member.assistantId,
@@ -48446,6 +49225,18 @@ On top of that, add any of three combinable classes:
 ## Combinations
 A plugin is the SET of classes it needs, e.g. \`connection + tools + skills\` or \`UI + connection\`.
 
+## Scenarios \u2192 skills
+| Scenario | Read |
+|---|---|
+| Tool that returns/transforms data | \`sandbox-plugins-manifest\` + \`sandbox-plugins-handlers\` |
+| Skills-only (procedural knowledge, no tools) | \`sandbox-plugins-authoring\` (skills) |
+| Tool needs credentials / resource discovery | \`sandbox-plugins-connection\` |
+| Tool shows an interactive panel | \`sandbox-plugins-ui\` |
+| Tool orchestrates platform tools/agents | \`sandbox-plugins-consume-open\` |
+| Tool callable by external MCP clients | \`sandbox-plugins-expose\` |
+| Run as a long-lived resident service | \`sandbox-plugins-deploy\` |
+| Validate / test / debug | \`sandbox-plugins-testing\` |
+
 ## Agents (not a supported authoring path)
 The manifest schema accepts an \`agents\` block and tenant plugin agents are
 registered, but building agents this way is not supported or designed for tenant
@@ -48656,10 +49447,38 @@ lifecycle handshake:
    - \`ui/notifications/tool-result\` \u2192 a \`CallToolResult\` \`{ content: [{ type: "text", text }] }\` (the tool output text, with any \`mcp_app\` fence stripped).
 
 Register the \`message\` listener **before** \`ui/initialize\` so nothing is missed.
-The result carries **TEXT content only** \u2014 no \`structuredContent\` or \`artifact\`;
-parse the JSON yourself if the tool emitted JSON. To re-query or refresh, call
-\`tools/call\` from the View and render its response (the host does not re-push
-\`tool-result\` for your own calls).
+Read the payload from \`params.content[0].text\` \u2014 the notification is a
+\`CallToolResult\`, **not** your handler payload at the top level. The result
+carries **TEXT content only** \u2014 no \`structuredContent\` or \`artifact\`; parse the
+JSON yourself if the tool emitted JSON (it is the handler's \`result\`, so the
+handler must wrap it under \`result\`). To re-query or refresh, call \`tools/call\`
+from the View and render its response (the host does not re-push \`tool-result\`
+for your own calls).
+
+When you call \`tools/call\` from the View, the JSON-RPC response \`result\` is the
+handler's own \`result\` value **directly** \u2014 it is **not wrapped in a**
+\`CallToolResult\` \`{ content: [...] }\` (that wrapper is only used for the host's
+\`tool-result\` push). Parse it as your tool's data.
+
+## Push vs re-execute (key for debugging)
+The host pushes \`tool-result\` from the tool result **recorded when the agent ran** \u2014
+it does **not** re-execute the handler. The push therefore always reflects that
+run's output (and the handler's \`result\` at that time). A \`tools/call\` from the
+View, by contrast, **re-executes** the handler live every time.
+
+So if the push looks stale/wrong but a fresh \`tools/call\` returns the right data,
+the recorded run predates your change \u2014 re-run the tool (a new agent call) to get
+a fresh push. Do not assume the push re-reads the handler.
+
+## Self-check / debug
+- Log the raw frame: \`console.log(JSON.stringify(ev.data))\` in the \`message\`
+  listener, and open the browser console inside the sandboxed frame.
+- If the pushed text looks like the raw handler envelope (e.g. it starts with
+  \`{"ok":true,...\`), the handler omitted the \`result\` wrapper \u2014 the host falls
+  back to the raw stdout instead of your payload. Fix the handler (see
+  \`sandbox-plugins-handlers\`).
+- The push only happens after \`ui/initialize\` **and**
+  \`ui/notifications/initialized\`; a listener registered later misses it.
 
 \`templates/ui.html\` implements all of this in vanilla JS and renders both payloads
 into a \`#data\` element.
@@ -48779,6 +49598,76 @@ Templates: see \`sandbox-plugins-manifest\` for the exact \`tools[]\` fields; th
 \`templates/plugin.json\` already includes \`"expose": true\` (the tool is grantable via
 an API key but not callable until a key grants it). Remove it for tools that should
 not be externally grantable at all.
+`,
+    resources: {}
+  },
+  "sandbox-plugins-consume-open": {
+    version: "1.0.0",
+    content: `---
+name: sandbox-plugins-consume-open
+description: Call the platform's Open MCP surface from a tenant plugin handler (discover and invoke other tools/agents). Trigger: a plugin tool must orchestrate platform capabilities, call another tool or agent, or reuse an existing capability instead of re-implementing it.
+---
+
+# Calling the platform from a handler (Open MCP)
+
+A plugin handler can call **the platform's own tools and agents** through the Open
+MCP endpoint. Reach for this when a tool should orchestrate existing capabilities
+(read the knowledge base, create a task, invoke an agent) instead of
+re-implementing them.
+
+## What the handler gets
+When the gateway injects the credential, each handler process starts with:
+- \`API_GATEWAY_URL\` \u2014 the gateway base URL.
+- \`OPEN_API_TOKEN\` \u2014 a short-lived bearer **scoped to this tenant's plugin callers**.
+
+If the deployment does not inject them (no \`PUBLIC_GATEWAY_URL\`), the variables are
+**absent** \u2014 detect that and degrade gracefully (report "platform tools
+unavailable") rather than crashing.
+
+## Discover, then call
+Never hardcode the tool list: the callable set is **reflected per tenant** and
+changes as plugins are exposed. Call \`listTools()\` at runtime.
+\`\`\`js
+const { OpenMcpClient } = require("@axiom-lattice/open-mcp-client");
+// or require("/root/.agents/sdk/open-mcp-client/index.js") when provisioned there
+
+async function main() {
+  const input = process.env.PLUGIN_INPUT_FILE
+    ? JSON.parse(require("fs").readFileSync(process.env.PLUGIN_INPUT_FILE, "utf8"))
+    : JSON.parse(process.env.PLUGIN_INPUT || "{}");
+
+  const client = OpenMcpClient.fromEnv(); // API_GATEWAY_URL + OPEN_API_TOKEN
+  const tools = await client.listTools(); // exactly what this handler may call
+  const kb = await client.callTool("kb_search", { collection: "docs", query: input.q });
+
+  process.stdout.write(JSON.stringify({ ok: true, result: kb }));
+}
+main().catch((err) => {
+  process.stdout.write(JSON.stringify({ ok: false, error: String(err && err.message ? err.message : err) }));
+});
+\`\`\`
+
+- Tool names are \`{domain}_{action}\` (e.g. \`kb_search\`, \`task_manage_task\`).
+- Args follow the tool's \`inputSchema\`; \`listTools()\` returns name/description.
+- Return the result through the normal handler envelope (\`{ ok: true, result }\`)
+  so it becomes this tool's output \u2014 see \`sandbox-plugins-handlers\`.
+
+## What the handler may call
+The token carries the conservative sandbox defaults (\`sandbox_*\`, \`kb_search\`)
+**plus the tenant's grantable Open catalog**: every exposed tenant/global plugin
+tool and the tenant's agents. A call outside that set fails (tool-not-found or
+\`GRANT_DENIED\`); retrying will not help.
+
+## Client availability
+The zero-dependency \`@axiom-lattice/open-mcp-client\` must be present in the
+sandbox: preinstalled in the image, at \`/root/.agents/sdk/open-mcp-client\`, or
+installed in this run (\`npm install @axiom-lattice/open-mcp-client\`). The CLI is
+also available: \`npx @axiom-lattice/open-mcp-client tools list --json\`.
+
+## Limits
+- Nested sandbox orchestration is depth-limited (5); past the cap no token is
+  re-issued, so deep recursion fails fast.
+- Only call what \`listTools()\` returns, and handle a missing tool gracefully.
 `,
     resources: {}
   },
@@ -48819,10 +49708,23 @@ for the single/first connection, or \`data.connections\` (entries of
 \`{ key, config }\`) when the plugin selects multiple connections.
 
 ## Writing output
-Print a JSON envelope to stdout:
+Every tool handler must print **one** JSON envelope to stdout, with your payload
+under \`result\`:
 \`\`\`js
-process.stdout.write(JSON.stringify({ ok: true, result: "done" }));
+process.stdout.write(JSON.stringify({ ok: true, result: <payload> }));
 \`\`\`
+
+> **The payload MUST go under \`result\`.** \`result\` may be any JSON value
+> (object, array, string, number).
+> \`\`\`js
+> // \u2705 correct \u2014 data under \`result\`
+> process.stdout.write(JSON.stringify({ ok: true, result: { tasks, count } }));
+>
+> // \u274C wrong \u2014 \`result\` missing; the host surfaces the raw stdout (this
+> //    envelope), so callers and MCP App UIs never see \`tasks\`
+> process.stdout.write(JSON.stringify({ ok: true, tasks, count }));
+> \`\`\`
+
 Non-JSON stdout is treated as a plain-text result. To fail, either print
 \`{ ok: false, error }\` or exit non-zero (stderr is not required; stdout is
 captured).
@@ -48923,6 +49825,70 @@ Fall back to \`execute_code\`/\`shell\` to run \`node handlers/x.js\` manually w
 \`PLUGIN_INPUT\` and a synthetic \`PLUGIN_CONNECTION_FILE\` to reproduce logic bugs.
 A synthetic fixture only verifies plumbing \u2014 a real upstream call requires a real
 \`connectionKey\` configured by a human.
+`,
+    resources: {}
+  },
+  "sandbox-plugins-deploy": {
+    version: "1.0.0",
+    content: `---
+name: sandbox-plugins-deploy
+description: Deploy a validated tenant plugin as a resident service (alwaysOn vs onDemand), check its status, and undeploy it. Trigger: after a plugin's tests pass and it should run as a long-lived service, or when inspecting/removing a deployment.
+---
+
+# Deploying a Plugin as a Resident Service
+
+By default a plugin handler runs as a short-lived process on each tool call.
+Optionally, you can **deploy** the plugin as a **resident service**: one
+long-lived sandbox per plugin that serves every call. This is faster for
+frequent or heavy calls, but costs a running sandbox.
+
+## Precondition: tests must pass first
+Deploy ONLY after the plugin is validated AND its tests pass:
+1. \`manage_plugin validate\` \u2014 no diagnostics.
+2. \`manage_plugin create\`/\`update\` \u2014 written and reloaded.
+3. \`manage_plugin test\` \u2014 every tool/connection test returns \`ok: true\`
+   (a real \`connectionKey\` test for credentialed tools).
+Never deploy a plugin you have not tested: a resident service wraps the same
+handlers, so an untested handler fails identically \u2014 just in a service you now
+have to undeploy.
+
+## Choose a mode
+- \`"onDemand"\` (default) \u2014 the service is paused when idle and resumed on the
+  next call. Best for plugins used occasionally. Lower steady cost.
+- \`"alwaysOn"\` \u2014 the service stays resident and is restarted if it becomes
+  unhealthy. Best for plugins on a hot path or with expensive startup.
+
+## Deploy
+\`\`\`jsonc
+{ "action": "deploy", "type": "my-plugin", "mode": "alwaysOn" }
+\`\`\`
+Returns \`{ deployed, status, endpoint, mode }\`. \`status\` is \`"running"\` when
+the service answered its health check. On failure you get
+\`{ deployed: false, error }\` \u2014 report it, do not treat it as success.
+Deploying again is idempotent: it reuses the same service.
+
+## Check status
+\`\`\`jsonc
+{ "action": "status", "type": "my-plugin" }
+\`\`\`
+Returns \`{ status, endpoint?, mode?, lastHealthAt?, lastError? }\`. \`"absent"\`
+means no deployment exists; \`"failed"\` (with \`lastError\`) means the service is
+down. Inspect this before reporting the plugin as serving.
+
+## Undeploy
+\`\`\`jsonc
+{ "action": "undeploy", "type": "my-plugin" }
+\`\`\`
+Returns \`{ undeployed }\`. Undeploy removes the resident sandbox and its
+deployment record; the plugin files and manifest are untouched, so tool calls
+fall back to the short-process path. Use it to stop paying for a service you no
+longer need.
+
+## When resident services are unavailable
+If the environment has no deployment service registered, deploy/undeploy/status
+return a diagnostic (\`{ deployed: false, error }\` etc.) instead of throwing.
+That is not a plugin defect: the plugin still works through the default
+short-process path, so report it as not-deployed rather than broken.
 `,
     resources: {}
   }
@@ -48944,6 +49910,8 @@ Follow the authoring skill's "Decide first" steps to confirm the goal
 (inputs/outputs). If the UI class applies, load "sandbox-plugins-ui" before
 authoring it. If the tool must be callable by external MCP clients via an API key,
 load "sandbox-plugins-expose" and follow it (\`expose: true\` + key grants).
+If a tool must call the platform's own tools/agents from its handler, load
+"sandbox-plugins-consume-open".
 
 Plan with persistent Tasks: MANDATORY until you load "task-tracking" with the
 \`skill\` tool, call neither \`manage_task\` nor any other task operation. Use
@@ -48959,10 +49927,197 @@ the connector and give you its key. Only after a real \`connectionKey\` test
 passes may you call the tool verified; without it, report functionality as
 unverified (missing credentials), not as passing. Use \`shell_exec\` (the tool
 provided by the \`code_eval\` middleware) to run \`node handlers/x.js\` for manual
-checks when reproducing a failure.`;
+checks when reproducing a failure.
+
+After the plugin passes \`validate\` and its tests, deploy it as a resident
+service: load "sandbox-plugins-deploy" and follow it. Choose \`onDemand\`
+(default) or \`alwaysOn\` for hot paths, call \`manage_plugin deploy\` with the
+chosen \`mode\`, then confirm with \`manage_plugin status\` (\`running\`). Only claim
+the plugin is deployed and serving once \`status\` reports \`running\`; if the
+environment reports no deployment service, say so and treat deployment as
+unavailable \u2014 do NOT claim success. \`undeploy\` removes the service without
+touching the plugin files.`;
+
+// src/middlewares/sandboxPluginsUi.ts
+var SANDBOX_PLUGINS_UI_RESOURCE = "ui://sandbox-plugins/app";
+var SANDBOX_PLUGINS_APP_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Plugin Deployments</title>
+    <style>
+      :root { color-scheme: light dark; }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        padding: 14px 16px;
+        font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+        font-size: 13px;
+        color: #1f2430;
+        background: transparent;
+      }
+      h1 { font-size: 14px; font-weight: 600; margin: 0 0 2px; }
+      .subtitle { color: #6b7280; font-size: 12px; margin: 0 0 12px; }
+      table { width: 100%; border-collapse: collapse; }
+      th, td { text-align: left; padding: 8px 10px; border-bottom: 1px solid #eceef2; vertical-align: top; }
+      th { font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em; color: #6b7280; font-weight: 600; }
+      td.type { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-weight: 600; white-space: nowrap; }
+      td.mode { white-space: nowrap; color: #4b5563; }
+      td.detail { color: #4b5563; word-break: break-word; max-width: 280px; }
+      .muted { color: #9ca3af; }
+      .status { display: inline-flex; align-items: center; gap: 6px; white-space: nowrap; }
+      .dot { width: 8px; height: 8px; border-radius: 50%; flex: 0 0 auto; background: #9ca3af; }
+      .dot.running { background: #22c55e; }
+      .dot.failed { background: #ef4444; }
+      .dot.requested, .dot.provisioning, .dot.stopping { background: #f59e0b; }
+      .dot.paused, .dot.stopped { background: #94a3b8; }
+      .state { color: #6b7280; padding: 14px 2px; }
+      .error { margin: 0 0 10px; padding: 8px 10px; border-radius: 8px; background: #fef2f2; color: #b91c1c; }
+    </style>
+  </head>
+  <body>
+    <h1>Plugin Deployments</h1>
+    <p class="subtitle">Resident services deployed for this tenant. Read-only.</p>
+    <div id="root"><p class="state">Loading\u2026</p></div>
+    <script>
+      (function () {
+        var root = document.getElementById("root");
+
+        function post(message) {
+          window.parent.postMessage(message, "*");
+        }
+        function notify(method, params) {
+          post({ jsonrpc: "2.0", method: method, params: params });
+        }
+        var nextId = 1;
+        function rpc(method, params) {
+          var id = nextId++;
+          return new Promise(function (resolve, reject) {
+            function onMessage(event) {
+              var data = event.data;
+              if (!data || data.id !== id) return;
+              window.removeEventListener("message", onMessage);
+              if (data.error) reject(new Error((data.error && data.error.message) || "rpc error"));
+              else resolve(data.result);
+            }
+            window.addEventListener("message", onMessage);
+            post({ jsonrpc: "2.0", id: id, method: method, params: params });
+          });
+        }
+
+        function sendSize() {
+          var width = Math.ceil(document.documentElement.scrollWidth || document.body.scrollWidth);
+          var height = Math.ceil(document.documentElement.scrollHeight || document.body.scrollHeight);
+          notify("ui/notifications/size-changed", { width: width, height: height });
+        }
+
+        function esc(value) {
+          return String(value === null || value === undefined ? "" : value).replace(/[&<>"']/g, function (ch) {
+            return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch];
+          });
+        }
+
+        function statusClass(status) {
+          switch (status) {
+            case "running": return "running";
+            case "failed": return "failed";
+            case "requested":
+            case "provisioning":
+            case "stopping": return "requested";
+            case "paused":
+            case "stopped": return "paused";
+            default: return "";
+          }
+        }
+
+        function healthCell(item) {
+          if (item.lastError) return '<span style="color:#b91c1c">' + esc(item.lastError) + "</span>";
+          if (item.lastHealthAt) return '<span class="muted">' + esc(item.lastHealthAt) + "</span>";
+          return '<span class="muted">\u2014</span>';
+        }
+
+        function render(payload) {
+          var deployments = payload && Array.isArray(payload.deployments) ? payload.deployments : [];
+          var error = payload && payload.error ? String(payload.error) : "";
+          var html = "";
+          if (error) html += '<div class="error">' + esc(error) + "</div>";
+          if (deployments.length === 0) {
+            html += '<p class="state">' + (error ? "No deployments available." : "No resident plugin deployments.") + "</p>";
+            root.innerHTML = html;
+            sendSize();
+            return;
+          }
+          html += "<table><thead><tr><th>Plugin</th><th>Status</th><th>Mode</th><th>Endpoint</th><th>Health</th></tr></thead><tbody>";
+          deployments.forEach(function (item) {
+            var status = item && item.status ? String(item.status) : "unknown";
+            html += "<tr>";
+            html += '<td class="type">' + esc(item && item.pluginType) + "</td>";
+            html += '<td><span class="status"><span class="dot ' + statusClass(status) + '"></span>' + esc(status) + "</span></td>";
+            html += '<td class="mode">' + esc(item && item.mode) + "</td>";
+            html += '<td class="detail">' + (item && item.endpoint ? esc(item.endpoint) : '<span class="muted">\u2014</span>') + "</td>";
+            html += '<td class="detail">' + healthCell(item || {}) + "</td>";
+            html += "</tr>";
+          });
+          html += "</tbody></table>";
+          root.innerHTML = html;
+          sendSize();
+        }
+
+        function readResult(params) {
+          if (!params || typeof params !== "object") return null;
+          if (params.structuredContent && typeof params.structuredContent === "object") {
+            return params.structuredContent;
+          }
+          var content = params.content;
+          var text = content && content[0] && typeof content[0].text === "string" ? content[0].text : "";
+          if (!text) return null;
+          try { return JSON.parse(text); } catch (err) { return null; }
+        }
+
+        // 1) Register the tool-result listener BEFORE initializing so the data
+        // the host pushes right after the handshake is never missed.
+        window.addEventListener("message", function (event) {
+          var data = event.data;
+          if (!data || typeof data !== "object" || typeof data.method !== "string") return;
+          if (data.method === "ui/notifications/tool-result") {
+            render(readResult(data.params));
+          }
+        });
+
+        if (typeof ResizeObserver !== "undefined") {
+          new ResizeObserver(sendSize).observe(document.documentElement);
+        } else {
+          window.addEventListener("resize", sendSize);
+        }
+
+        // 2) MCP Apps lifecycle: initialize, then signal readiness. The host
+        // pushes tool data only after this completes.
+        rpc("ui/initialize", {
+          protocolVersion: "2025-06-18",
+          capabilities: {},
+          clientInfo: { name: "sandbox-plugins-ui", version: "1.0.0" },
+          appCapabilities: { availableDisplayModes: ["inline"] }
+        }).then(function () {
+          notify("ui/notifications/initialized", {});
+          sendSize();
+        }).catch(function (err) {
+          root.innerHTML = '<p class="state">Failed to initialize: ' + esc((err && err.message) || err) + "</p>";
+          sendSize();
+        });
+      })();
+    </script>
+  </body>
+</html>
+`;
 
 // src/middlewares/sandboxPluginsMiddleware.ts
-var PLUGIN_BUILDER_SKILLS = [...Object.keys(SANDBOX_PLUGIN_SKILLS), "task-tracking"];
+var SANDBOX_PLUGINS_UI_REF = {
+  kind: "plugin",
+  pluginType: "sandbox-plugins",
+  resource: SANDBOX_PLUGINS_UI_RESOURCE,
+  displayMode: "inline"
+};
 function tenantIdFrom(exeConfig) {
   const c = exeConfig;
   return c?.configurable?.runConfig?.tenantId ?? "default";
@@ -48979,6 +50134,15 @@ function collectSecretValues(connection, fields) {
 function errorText(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function deploymentUnavailable(action) {
+  const error = `plugin deployment service is not configured; cannot ${action}. Resident plugin services are unavailable in this environment.`;
+  if (action === "undeploy") return JSON.stringify({ undeployed: false, error });
+  if (action === "status") return JSON.stringify({ status: "unavailable", error });
+  return JSON.stringify({ deployed: false, error });
+}
+function deploymentsResult(payload) {
+  return appendUiFence(JSON.stringify(payload), SANDBOX_PLUGINS_UI_REF);
+}
 function redactString(value, secrets) {
   let out = value;
   for (const secret of secrets) out = out.split(secret).join("[redacted]");
@@ -48999,10 +50163,24 @@ function redactSecretValues(payload, secrets) {
   return walk(payload);
 }
 var managePluginSchema = import_zod71.z.object({
-  action: import_zod71.z.enum(["list", "get", "validate", "create", "update", "delete", "reload", "test"]),
+  action: import_zod71.z.enum([
+    "list",
+    "get",
+    "validate",
+    "create",
+    "update",
+    "delete",
+    "reload",
+    "test",
+    "deploy",
+    "undeploy",
+    "status",
+    "deployments"
+  ]),
   type: import_zod71.z.string().optional(),
   manifest: import_zod71.z.record(import_zod71.z.unknown()).optional(),
   handlers: import_zod71.z.record(import_zod71.z.string()).optional(),
+  mode: import_zod71.z.enum(["onDemand", "alwaysOn"]).optional(),
   target: import_zod71.z.object({
     kind: import_zod71.z.enum(["tool", "connection-test", "connection-discover"]),
     name: import_zod71.z.string().optional(),
@@ -49015,9 +50193,18 @@ var sandboxPluginsPlugin = {
     type: "sandbox-plugins",
     category: "execution",
     name: "Sandbox Plugins",
-    description: "Author and manage tenant plugins stored in the sandbox: list/validate/create/update/delete/reload/test. Tools are agent-callable JS handlers and may declare an optional interactive HTML UI (rendered as a sandboxed MCP App). Pairs with the Skill plugin for authoring guidance.",
+    description: "Author and manage tenant plugins stored in the sandbox: list/validate/create/update/delete/reload/test, and deploy/undeploy/status/deployments to run a plugin as a resident service. Tools are agent-callable JS handlers and may declare an optional interactive HTML UI (rendered as a sandboxed MCP App). Pairs with the Skill plugin for authoring guidance.",
     recommends: ["skill"],
-    tools: [{ name: "manage_plugin", description: "Author and manage tenant sandbox plugins (tools, optional per-tool HTML UI, connections, and Open/MCP exposure)" }],
+    tools: [
+      {
+        name: "manage_plugin",
+        description: "Author and manage tenant sandbox plugins (tools, optional per-tool HTML UI, connections, Open/MCP exposure, and resident deployment). Actions: list/get/validate/create/update/delete/reload/test, deploy/undeploy/status, and `deployments` to list every resident deployment for the tenant.",
+        ui: { resource: SANDBOX_PLUGINS_UI_RESOURCE, displayMode: "inline" }
+      }
+    ],
+    uiResources: {
+      [SANDBOX_PLUGINS_UI_RESOURCE]: { html: SANDBOX_PLUGINS_APP_HTML }
+    },
     configSchema: { type: "object", properties: {} },
     defaultConfig: {}
   },
@@ -49038,7 +50225,7 @@ var sandboxPluginsPlugin = {
           id: "sandbox-plugins",
           type: "sandbox-plugins",
           name: "Sandbox Plugins",
-          description: "Author and manage tenant plugins (list/validate/create/update/delete/reload/test)",
+          description: "Author and manage tenant plugins (list/validate/create/update/delete/reload/test/deploy/undeploy/status)",
           enabled: true,
           config: {}
         },
@@ -49046,9 +50233,9 @@ var sandboxPluginsPlugin = {
           id: "skill",
           type: "skill",
           name: "Skill",
-          description: "Load the sandbox-plugins authoring, patterns, manifest, handler, connection, UI, and testing skills",
+          description: "Load any available skill, including the sandbox-plugins authoring, patterns, manifest, handler, connection, UI, and testing skills",
           enabled: true,
-          config: { readAll: false, skills: PLUGIN_BUILDER_SKILLS }
+          config: { readAll: true }
         },
         {
           id: "task",
@@ -49229,18 +50416,79 @@ var sandboxPluginsPlugin = {
                     assistantId: typeof runCfg.assistant_id === "string" ? runCfg.assistant_id : void 0
                   }
                 });
-                return JSON.stringify(redactSecretValues(result, secrets));
+                return handlerResultText(redactSecretValues(result, secrets));
               } catch (err) {
                 return JSON.stringify(redactSecretValues({ ok: false, error: errorText(err) }, secrets));
               }
             }
+            case "deploy": {
+              if (!input.type) return "type is required";
+              const service3 = getPluginDeploymentService();
+              if (!service3) return deploymentUnavailable("deploy");
+              try {
+                const result = await service3.deploy(tenantId2, input.type, {
+                  ...input.mode === void 0 ? {} : { mode: input.mode }
+                });
+                return JSON.stringify({
+                  deployed: true,
+                  status: result.status,
+                  endpoint: result.endpoint,
+                  mode: result.mode
+                });
+              } catch (err) {
+                return JSON.stringify({ deployed: false, error: errorText(err) });
+              }
+            }
+            case "undeploy": {
+              if (!input.type) return "type is required";
+              const service3 = getPluginDeploymentService();
+              if (!service3) return deploymentUnavailable("undeploy");
+              try {
+                const result = await service3.undeploy(tenantId2, input.type);
+                return JSON.stringify({ undeployed: result.undeployed });
+              } catch (err) {
+                return JSON.stringify({ undeployed: false, error: errorText(err) });
+              }
+            }
+            case "status": {
+              if (!input.type) return "type is required";
+              const service3 = getPluginDeploymentService();
+              if (!service3) return deploymentUnavailable("status");
+              try {
+                const result = await service3.status(tenantId2, input.type);
+                return JSON.stringify({
+                  status: result.status,
+                  endpoint: result.endpoint,
+                  mode: result.mode,
+                  lastHealthAt: result.lastHealthAt,
+                  lastError: result.lastError
+                });
+              } catch (err) {
+                return JSON.stringify({ status: "unavailable", error: errorText(err) });
+              }
+            }
+            case "deployments": {
+              const service3 = getPluginDeploymentService();
+              if (!service3) {
+                return deploymentsResult({
+                  deployments: [],
+                  error: "plugin deployment service is not configured; cannot list deployments. Resident plugin services are unavailable in this environment."
+                });
+              }
+              try {
+                const deployments = await service3.list(tenantId2);
+                return deploymentsResult({ deployments });
+              } catch (err) {
+                return deploymentsResult({ deployments: [], error: errorText(err) });
+              }
+            }
             default:
               return `unsupported action: ${input.action}`;
           }
         },
         {
           name: "manage_plugin",
-          description: "Author and manage tenant sandbox plugins (list/get/validate/create/update/delete/reload/test).",
+          description: "Author and manage tenant sandbox plugins (list/get/validate/create/update/delete/reload/test) and deploy/undeploy/status a plugin as a resident service.",
           schema: managePluginSchema
         }
       )
@@ -49295,6 +50543,526 @@ function buildBundleFromDist(distDir, version) {
   };
 }
 
+// src/sandbox_plugin/PluginDeploymentRuntimeRegistry.ts
+var PluginDeploymentRuntimeRegistry = class {
+  /**
+   * @param options - Optional injectable clock for deterministic health timestamps.
+   */
+  constructor(options = {}) {
+    this.entries = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.now = options.now ?? Date.now;
+  }
+  /**
+   * Cache the resolved proxy endpoint for a deployment.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   * @param endpoint - Relative proxy path, e.g. `/api/sandboxes/plugin-abc/proxy/8080`.
+   */
+  setEndpoint(id, endpoint) {
+    this.entry(id).endpoint = endpoint;
+  }
+  /**
+   * Read the cached endpoint for a deployment.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   * @returns The cached endpoint, or `undefined` when none is known.
+   */
+  getEndpoint(id) {
+    return this.entries.get(id)?.endpoint;
+  }
+  /**
+   * Record a successful health observation and clear any prior error.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   */
+  markHealthy(id) {
+    const entry = this.entry(id);
+    entry.lastHealthAt = this.now();
+    delete entry.lastError;
+  }
+  /**
+   * Record a failed health observation.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   * @param error - Human-readable failure description.
+   */
+  markUnhealthy(id, error) {
+    const entry = this.entry(id);
+    entry.lastHealthAt = this.now();
+    entry.lastError = error;
+  }
+  /**
+   * Read the last observed health for a deployment.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   * @returns The cached health, or `undefined` when the id is unknown.
+   */
+  getHealth(id) {
+    const entry = this.entries.get(id);
+    if (!entry) return void 0;
+    const health = {};
+    if (entry.lastHealthAt !== void 0) health.lastHealthAt = entry.lastHealthAt;
+    if (entry.lastError !== void 0) health.lastError = entry.lastError;
+    return health;
+  }
+  /**
+   * Run a cold start/resume factory at most once per id at a time.
+   *
+   * Concurrent calls for the same id return the same in-flight promise and run
+   * `factory` exactly once. The in-flight entry is cleared when the factory
+   * settles, so a later call runs it again (retry after failure is allowed).
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   * @param factory - Idempotent start/resume operation for the resident service.
+   * @returns A promise that settles with the factory outcome.
+   */
+  ensureRunning(id, factory) {
+    const existing = this.inFlight.get(id);
+    if (existing) return existing;
+    let started;
+    try {
+      started = factory();
+    } catch (error) {
+      started = Promise.reject(error);
+    }
+    const tracked = started.finally(() => {
+      if (this.inFlight.get(id) === tracked) {
+        this.inFlight.delete(id);
+      }
+    });
+    this.inFlight.set(id, tracked);
+    return tracked;
+  }
+  /**
+   * Drop cached endpoint and health for one deployment.
+   *
+   * @param id - Composed key `${tenantId}:${pluginType}`.
+   */
+  clear(id) {
+    this.entries.delete(id);
+  }
+  /** Drop all cached endpoints, health, and in-flight coordination entries. */
+  reset() {
+    this.entries.clear();
+    this.inFlight.clear();
+  }
+  entry(id) {
+    const existing = this.entries.get(id);
+    if (existing) return existing;
+    const created = {};
+    this.entries.set(id, created);
+    return created;
+  }
+};
+
+// src/sandbox_plugin/host/pluginHostProtocol.ts
+var INLINE_INPUT_LIMIT_BYTES2 = 48 * 1024;
+var DEFAULT_HANDLER_TIMEOUT_MS = 6e4;
+var MIN_HANDLER_TIMEOUT_MS = 1e3;
+var MAX_HANDLER_TIMEOUT_MS = 3e5;
+function isRecord11(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEnvelope3(value) {
+  return isRecord11(value) && typeof value.ok === "boolean";
+}
+function parseHostArgs(argv) {
+  let type;
+  let port;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--type" && index + 1 < argv.length) {
+      type = argv[index + 1];
+      index += 1;
+    } else if (token.startsWith("--type=")) {
+      type = token.slice("--type=".length);
+    } else if (token === "--port" && index + 1 < argv.length) {
+      port = argv[index + 1];
+      index += 1;
+    } else if (token.startsWith("--port=")) {
+      port = token.slice("--port=".length);
+    }
+  }
+  const parsedPort = Number(port);
+  if (typeof type !== "string" || type.length === 0) {
+    throw new Error("parseHostArgs: missing or empty --type");
+  }
+  if (!Number.isInteger(parsedPort) || parsedPort <= 0 || parsedPort > 65535) {
+    throw new Error("parseHostArgs: invalid --port");
+  }
+  return { type, port: parsedPort };
+}
+function resolveHandlerTimeoutMs(value) {
+  if (value === null || value === void 0 || value === "") return DEFAULT_HANDLER_TIMEOUT_MS;
+  const numeric = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(numeric)) return DEFAULT_HANDLER_TIMEOUT_MS;
+  return Math.min(Math.max(Math.round(numeric), MIN_HANDLER_TIMEOUT_MS), MAX_HANDLER_TIMEOUT_MS);
+}
+function parseHandlerEnvelope(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return { ok: false, error: "empty handler output" };
+  const whole = tryParse(trimmed);
+  if (isEnvelope3(whole)) return normalizeEnvelope(whole);
+  const lines = stdout.split("\n");
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const line = lines[index]?.trim();
+    if (!line) continue;
+    const candidate = tryParse(line);
+    if (isEnvelope3(candidate)) return normalizeEnvelope(candidate);
+  }
+  return { ok: true, result: trimmed };
+}
+function buildHandlerCommand(handlerPath) {
+  return `node ${quotePosixShellArg2(handlerPath)}`;
+}
+function encodeInput(input) {
+  return Buffer.from(JSON.stringify(input ?? null), "utf8").toString("base64");
+}
+function buildConnectionPayload2(args) {
+  if (Array.isArray(args.connections) && args.connections.length > 0) {
+    return {
+      connection: args.connection ?? args.connections[0]?.config,
+      connections: args.connections
+    };
+  }
+  if (args.connection) {
+    return { connection: args.connection };
+  }
+  return null;
+}
+function quotePosixShellArg2(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function tryParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function normalizeEnvelope(parsed) {
+  if (parsed.ok) return { ok: true, result: parsed.result };
+  return { ok: false, error: typeof parsed.error === "string" ? parsed.error : void 0 };
+}
+
+// src/sandbox_plugin/host/pluginHostSource.ts
+var import_node_crypto15 = require("crypto");
+var PLUGIN_HOST_VERSION = "1.1.0";
+var PLUGIN_HOST_SERVER_SOURCE = String.raw`#!/usr/bin/env node
+"use strict";
+
+var http = require("node:http");
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+var crypto = require("node:crypto");
+var execFile = require("node:child_process").execFile;
+
+var VERSION = "${PLUGIN_HOST_VERSION}";
+var PLUGINS_ROOT = "/root/.agents/plugins";
+var INLINE_INPUT_LIMIT_BYTES = 48 * 1024;
+var MAX_BODY_BYTES = 8 * 1024 * 1024;
+var MAX_RESULT_BYTES = 16 * 1024 * 1024;
+var DEFAULT_HANDLER_TIMEOUT_MS = 60000;
+var MIN_HANDLER_TIMEOUT_MS = 1000;
+var MAX_HANDLER_TIMEOUT_MS = 300000;
+
+function resolveHandlerTimeoutMs(value) {
+  if (value === null || value === undefined || value === "") {
+    return DEFAULT_HANDLER_TIMEOUT_MS;
+  }
+  var numeric = typeof value === "number" ? value : Number(value);
+  if (!isFinite(numeric)) {
+    return DEFAULT_HANDLER_TIMEOUT_MS;
+  }
+  return Math.min(Math.max(Math.round(numeric), MIN_HANDLER_TIMEOUT_MS), MAX_HANDLER_TIMEOUT_MS);
+}
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isEnvelope(value) {
+  return isRecord(value) && typeof value.ok === "boolean";
+}
+
+function tryParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    return undefined;
+  }
+}
+
+function normalizeEnvelope(parsed) {
+  if (parsed.ok) {
+    return { ok: true, result: parsed.result };
+  }
+  return { ok: false, error: typeof parsed.error === "string" ? parsed.error : undefined };
+}
+
+function parseHandlerEnvelope(stdout) {
+  var text = String(stdout == null ? "" : stdout);
+  var trimmed = text.trim();
+  if (!trimmed) {
+    // Deliberate divergence from SandboxPluginExecutor, which returns
+    // { ok: true, result: "" } for empty stdout; the resident host treats empty
+    // output as a handler failure so a crashed/no-op handler is not a "success".
+    return { ok: false, error: "empty handler output" };
+  }
+  var whole = tryParse(trimmed);
+  if (isEnvelope(whole)) {
+    return normalizeEnvelope(whole);
+  }
+  var lines = text.split("\n");
+  for (var index = lines.length - 1; index >= 0; index -= 1) {
+    var line = lines[index].trim();
+    if (!line) {
+      continue;
+    }
+    var candidate = tryParse(line);
+    if (isEnvelope(candidate)) {
+      return normalizeEnvelope(candidate);
+    }
+  }
+  return { ok: true, result: trimmed };
+}
+
+function quotePosixShellArg(value) {
+  return "'" + String(value).replace(/'/g, "'\"'\"'") + "'";
+}
+
+function buildHandlerCommand(handlerPath) {
+  return "node " + quotePosixShellArg(handlerPath);
+}
+
+function parseHostArgs(argv) {
+  var type;
+  var port;
+  for (var index = 0; index < argv.length; index += 1) {
+    var token = argv[index];
+    if (token === "--type" && index + 1 < argv.length) {
+      type = argv[index + 1];
+      index += 1;
+    } else if (token.indexOf("--type=") === 0) {
+      type = token.slice("--type=".length);
+    } else if (token === "--port" && index + 1 < argv.length) {
+      port = argv[index + 1];
+      index += 1;
+    } else if (token.indexOf("--port=") === 0) {
+      port = token.slice("--port=".length);
+    }
+  }
+  var parsedPort = Number(port);
+  if (typeof type !== "string" || type.length === 0) {
+    throw new Error("parseHostArgs: missing or empty --type");
+  }
+  if (!Number.isInteger(parsedPort) || parsedPort <= 0 || parsedPort > 65535) {
+    throw new Error("parseHostArgs: invalid --port");
+  }
+  return { type: type, port: parsedPort };
+}
+
+function encodeInput(input) {
+  return Buffer.from(JSON.stringify(input === undefined ? null : input), "utf8").toString("base64");
+}
+
+function buildConnectionPayload(body) {
+  if (Array.isArray(body.connections) && body.connections.length > 0) {
+    return {
+      connection: body.connection !== undefined ? body.connection : body.connections[0].config,
+      connections: body.connections,
+    };
+  }
+  if (body.connection) {
+    return { connection: body.connection };
+  }
+  return null;
+}
+
+function resolveHandlerPath(type, handler) {
+  if (typeof handler !== "string" || handler.length === 0) {
+    throw new Error("missing handler");
+  }
+  if (handler.charAt(0) === "/" || handler.split("/").indexOf("..") !== -1) {
+    throw new Error("invalid handler path");
+  }
+  return path.join(PLUGINS_ROOT, type, handler);
+}
+
+function readJsonBody(req) {
+  return new Promise(function (resolve, reject) {
+    var chunks = [];
+    var size = 0;
+    req.on("data", function (chunk) {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error("request body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", function () {
+      try {
+        var text = Buffer.concat(chunks).toString("utf8");
+        resolve(text ? JSON.parse(text) : {});
+      } catch (err) {
+        reject(new Error("invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+
+function runNode(handlerPath, pluginDir, env, timeoutMs) {
+  return new Promise(function (resolve) {
+    execFile(
+      process.execPath,
+      [handlerPath],
+      { cwd: pluginDir, env: env, timeout: timeoutMs, maxBuffer: MAX_RESULT_BYTES },
+      function (error, stdout, stderr) {
+        resolve({ error: error, stdout: stdout || "", stderr: stderr || "" });
+      }
+    );
+  });
+}
+
+function failureFromExec(exec, command) {
+  var parsed = parseHandlerEnvelope(exec.stdout);
+  if (!parsed.ok) {
+    return parsed;
+  }
+  var code = exec.error && typeof exec.error.code === "number" ? exec.error.code : "n/a";
+  var detail = exec.stdout ? exec.stdout.slice(0, 4096) : exec.error ? String(exec.error.message) : "";
+  return { ok: false, error: "handler failed (exit " + code + "): " + detail + " [" + command + "]" };
+}
+
+async function runHandler(body) {
+  var pluginDir = path.join(PLUGINS_ROOT, config.type);
+  var handlerPath = resolveHandlerPath(config.type, body.handler);
+  var command = buildHandlerCommand(handlerPath);
+  var inputJson = JSON.stringify(body.input === undefined ? null : body.input);
+  var connectionPayload = buildConnectionPayload(body);
+  var inputIsLarge = Buffer.byteLength(inputJson, "utf8") > INLINE_INPUT_LIMIT_BYTES;
+  var needsTempDir = inputIsLarge || connectionPayload !== null;
+  var tempDir = null;
+  var env = Object.assign({}, process.env);
+  try {
+    if (needsTempDir) {
+      tempDir = path.join(os.tmpdir(), "plugin-run-" + Date.now() + "-" + Math.random().toString(36).slice(2));
+      fs.mkdirSync(tempDir, { recursive: true });
+    }
+    if (inputIsLarge) {
+      var inputFile = path.join(tempDir, "input.json");
+      fs.writeFileSync(inputFile, inputJson);
+      env.PLUGIN_INPUT_FILE = inputFile;
+    } else {
+      env.PLUGIN_INPUT = encodeInput(body.input);
+    }
+    if (connectionPayload !== null) {
+      var connectionFile = path.join(tempDir, "connection.json");
+      fs.writeFileSync(connectionFile, JSON.stringify(connectionPayload));
+      env.PLUGIN_CONNECTION_FILE = connectionFile;
+    }
+    env.PLUGIN_CONTEXT = encodeInput(body.context || {});
+    var handlerTimeoutMs = resolveHandlerTimeoutMs(body.timeoutMs);
+    var exec = await runNode(handlerPath, pluginDir, env, handlerTimeoutMs);
+    if (exec.error) {
+      return failureFromExec(exec, command);
+    }
+    return parseHandlerEnvelope(exec.stdout);
+  } finally {
+    if (tempDir) {
+      try {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+      } catch (err) {
+        // best-effort cleanup
+      }
+    }
+  }
+}
+
+function manifestHash() {
+  try {
+    var content = fs.readFileSync(path.join(PLUGINS_ROOT, config.type, "plugin.json"), "utf8");
+    return crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  } catch (err) {
+    return "";
+  }
+}
+
+function sendJson(res, status, payload) {
+  var body = JSON.stringify(payload);
+  res.writeHead(status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+function handleRequest(req, res) {
+  var url = String(req.url || "").split("?")[0];
+  if (req.method === "GET" && url === "/health") {
+    sendJson(res, 200, { ok: true, version: VERSION });
+    return;
+  }
+  if (req.method === "GET" && url === "/meta") {
+    sendJson(res, 200, { type: config.type, manifestHash: manifestHash() });
+    return;
+  }
+  if (req.method === "POST" && url === "/invoke") {
+    readJsonBody(req)
+      .then(function (body) {
+        if (!isRecord(body)) {
+          sendJson(res, 400, { ok: false, error: "invalid body" });
+          return;
+        }
+        return runHandler(body).then(function (result) {
+          sendJson(res, 200, result);
+        });
+      })
+      .catch(function (err) {
+        sendJson(res, 400, { ok: false, error: String(err && err.message ? err.message : err) });
+      });
+    return;
+  }
+  sendJson(res, 404, { ok: false, error: "not found" });
+}
+
+var config = parseHostArgs(process.argv);
+var server = http.createServer(handleRequest);
+server.listen(config.port, "0.0.0.0", function () {
+  process.stdout.write(
+    "[plugin-host] listening type=" + config.type + " port=" + config.port + " version=" + VERSION + "\n"
+  );
+});
+`;
+function pluginHostContentHash() {
+  return (0, import_node_crypto15.createHash)("sha256").update(`${PLUGIN_HOST_VERSION}:${PLUGIN_HOST_SERVER_SOURCE}`).digest("hex").slice(0, 16);
+}
+
+// src/sandbox_plugin/host/pluginHostInstaller.ts
+var PLUGIN_HOST_DIR = "/root/.agents/.plugin-host";
+var SERVER_PATH = `${PLUGIN_HOST_DIR}/server.js`;
+var VERSION_PATH = `${PLUGIN_HOST_DIR}/version.json`;
+async function installPluginHost(sandbox) {
+  const hash = pluginHostContentHash();
+  try {
+    const existing = await sandbox.file.readFile(VERSION_PATH);
+    const parsed = JSON.parse(existing.content);
+    if (parsed.hash === hash) {
+      return { path: SERVER_PATH, version: PLUGIN_HOST_VERSION, hash, changed: false };
+    }
+  } catch {
+  }
+  await sandbox.file.createDirectory(PLUGIN_HOST_DIR).catch(() => void 0);
+  await sandbox.file.writeFile(SERVER_PATH, PLUGIN_HOST_SERVER_SOURCE);
+  await sandbox.file.writeFile(VERSION_PATH, JSON.stringify({ version: PLUGIN_HOST_VERSION, hash }, null, 2));
+  return { path: SERVER_PATH, version: PLUGIN_HOST_VERSION, hash, changed: true };
+}
+
 // src/workflow/index.ts
 init_compile();
 init_parse_yaml();
@@ -49686,16 +51454,16 @@ var IdRemapper = class {
 };
 
 // src/util/directRoomId.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto16 = require("crypto");
 function generateDirectHumanProjectId(tenantId2, workspaceId, userId1, userId2) {
   const sortedUserIds = [userId1, userId2].sort();
   const parts = [tenantId2, workspaceId, ...sortedUserIds];
-  const hash = (0, import_node_crypto14.createHash)("sha256").update(parts.join(":")).digest("hex");
+  const hash = (0, import_node_crypto16.createHash)("sha256").update(parts.join(":")).digest("hex");
   return `direct_human_${hash}`;
 }
 function generateDirectBotProjectId(tenantId2, workspaceId, userId, assistantId) {
   const parts = [tenantId2, workspaceId, userId, assistantId];
-  const hash = (0, import_node_crypto14.createHash)("sha256").update(parts.join(":")).digest("hex");
+  const hash = (0, import_node_crypto16.createHash)("sha256").update(parts.join(":")).digest("hex");
   return `direct_bot_${hash}`;
 }
 function parseDirectRoomType(projectId) {
@@ -49725,6 +51493,7 @@ registerBuiltinPlugins();
   CapabilityBundleValidationError,
   CapabilityToolNameConflictError,
   CapabilityToolRegistry,
+  ChannelConnectionLeader,
   ChunkBuffer,
   ChunkBufferLatticeManager,
   CollectionLatticeManager,
@@ -49736,7 +51505,9 @@ registerBuiltinPlugins();
   DEFAULT_CALIBRATION_PROBES,
   DEFAULT_CONNECT_TIMEOUT_MS,
   DEFAULT_DELAY_MS,
+  DEFAULT_HANDLER_TIMEOUT_MS,
   DEFAULT_MAX_ATTEMPTS,
+  DEFAULT_RESIDENT_INVOKE_TIMEOUT_MS,
   DaytonaInstance,
   DaytonaProvider,
   DefaultScheduleClient,
@@ -49754,6 +51525,7 @@ registerBuiltinPlugins();
   HEALTH_CHECK_INTERVAL_MS,
   HEALTH_CHECK_TIMEOUT_MS,
   HumanMessage,
+  INLINE_INPUT_LIMIT_BYTES,
   IdRemapper,
   InMemoryA2AApiKeyStore,
   InMemoryAgentWebAppStore,
@@ -49794,10 +51566,12 @@ registerBuiltinPlugins();
   LocalSandboxProvider,
   LoggerLatticeManager,
   MAX_BACKOFF_MS,
+  MAX_HANDLER_TIMEOUT_MS,
   MAX_LINE_LENGTH,
   MAX_PACK_ENTRIES,
   MAX_PACK_FILE_BYTES,
   MAX_PACK_TOTAL_BYTES,
+  MIN_HANDLER_TIMEOUT_MS,
   ManagedTaskStartError,
   McpLatticeManager,
   MemoryBackend,
@@ -49816,8 +51590,12 @@ registerBuiltinPlugins();
   PACK_DIRECTORY_TIMEOUT_SECONDS,
   PLATFORM_SECRET_ENV_VARS,
   PLUGIN_CATALOG_CHANGED_TOPIC,
+  PLUGIN_HOST_DIR,
+  PLUGIN_HOST_SERVER_SOURCE,
+  PLUGIN_HOST_VERSION,
   PersonalAssistantConfig,
   PinoLoggerClient,
+  PluginDeploymentRuntimeRegistry,
   PluginRegistry,
   PostgresDatabase,
   ProjectBotMembershipIdConflictError,
@@ -49879,7 +51657,9 @@ registerBuiltinPlugins();
   appendUiFence,
   assertSafeUpstreamUrl,
   buildBundleFromDist,
+  buildConnectionPayload,
   buildGrepResultsDict,
+  buildHandlerCommand,
   buildInput,
   buildNamedVolumeName,
   buildRemotePackDirectoryCommand,
@@ -49947,9 +51727,11 @@ registerBuiltinPlugins();
   decrypt,
   decryptConfigFields,
   describeCronExpression,
+  disconnectAllChannels,
   documentLearningPlugin,
   documentParserPlugin,
   embeddingsLatticeManager,
+  encodeInput,
   encrypt,
   encryptConfigFields,
   ensureBuiltinAgentsForTenant,
@@ -49993,6 +51775,7 @@ registerBuiltinPlugins();
   getModelLattice,
   getNextCronTime,
   getOrCreateCollectionVectorStore,
+  getPluginDeploymentService,
   getPluginSkillManifestVersion,
   getQueueLattice,
   getReplicaId,
@@ -50018,9 +51801,12 @@ registerBuiltinPlugins();
   globSearchFiles,
   grepMatchesFromFiles,
   grepSearchFiles,
+  handlerResultText,
   hasChunkBuffer,
   hasDelegatedWorkerToken,
   hasRuntimeCapabilityPolicy,
+  installPluginHost,
+  invokeResident,
   invokeWithRetry,
   isBuiltInSkill,
   isDirectRoom,
@@ -50048,6 +51834,8 @@ registerBuiltinPlugins();
   parallelLimit,
   parseCronExpression,
   parseDirectRoomType,
+  parseHandlerEnvelope,
+  parseHostArgs,
   parseJudgeVerdict,
   parsePackSize,
   parseQueuedExecutionMode,
@@ -50056,6 +51844,7 @@ registerBuiltinPlugins();
   parseTrustedRunContext,
   parseYaml,
   performStringReplacement,
+  pluginHostContentHash,
   postProcessTaskMutationResponse,
   prepareTaskDispatch,
   projectMutationMutex,
@@ -50094,6 +51883,7 @@ registerBuiltinPlugins();
   renderTemplate,
   resetReplicaIdForTests,
   resolveEnabledPluginSkill,
+  resolveHandlerTimeoutMs,
   resolveJudgeModelKey,
   resolvePath,
   resolvePluginConnections,
@@ -50113,6 +51903,7 @@ registerBuiltinPlugins();
   setBindingRegistry,
   setEvalRunService,
   setMenuRegistry,
+  setPluginDeploymentService,
   setSandboxPluginCatalog,
   skillLatticeManager,
   sqlDatabaseManager,