@hachej/boring-workspace 0.1.31 → 0.1.32

package/dist/app-server.d.ts

@@ -1,10 +1,10 @@
 import { PiPackageSource, PiExtensionFactory, CreateAgentAppOptions, ProvisionWorkspaceRuntimeOptions } from '@hachej/boring-agent/server';
 export { PiPackageSource as WorkspacePiPackageSource } from '@hachej/boring-agent/server';
 import { FastifyInstance } from 'fastify';
-import { W as WorkspaceServerPlugin, S as ServerBootstrapOptions, B as BoringPluginFrontTargetResolver, a as WorkspaceProvisioningContribution, b as WorkspaceRouteContribution, c as createInMemoryBridge } from './createInMemoryBridge--ZFPAgXy.js';
-export { d as ServerWorkspaceRuntimeProvisioningInput } from './createInMemoryBridge--ZFPAgXy.js';
+import { W as WorkspaceServerPlugin, S as ServerBootstrapOptions, B as BoringPluginFrontTargetResolver, a as WorkspaceProvisioningContribution, b as WorkspaceRouteContribution, c as createInMemoryBridge } from './createInMemoryBridge-HJopAIbo.js';
+export { d as ServerWorkspaceRuntimeProvisioningInput } from './createInMemoryBridge-HJopAIbo.js';
 import './manifest-C2vVgH_e.js';
-import './ui-bridge-Bdgl2hR8.js';
+import './ui-bridge-DFNem0df.js';
 
 /**
  * Directory-source entry: `{ dir, options?, hotReload? }`. Resolved via
@@ -133,11 +133,26 @@ interface CreateWorkspaceAgentServerOptions extends WorkspaceAgentCreateOptions,
     appPackageJsonPath?: string;
     /** Additional plugin collection roots to scan alongside workspace .pi/extensions and package/plugin-derived roots. */
     additionalBoringPluginDirs?: string[];
+    /**
+     * Install and advertise the boring plugin-authoring runtime.
+     *
+     * Keep this off for production/hosted workspaces unless a plugin-editing
+     * experience is explicitly enabled. Remote sandboxes can support authoring,
+     * but the CLI should be provisioned only for that activated editing mode,
+     * not for every normal workspace boot.
+     *
+     * Defaults to true for local/standalone strong-filesystem runtimes and false
+     * for remote/best-effort runtimes. Core/full-app may choose a stricter
+     * default at its composition boundary.
+     */
+    installPluginAuthoring?: boolean;
     /** Optional host-owned front-target override for boring plugin list/event payloads. */
     boringPluginFrontTargetResolver?: BoringPluginFrontTargetResolver;
     /** Preserve legacy `/@fs/...` frontUrl payloads alongside frontTarget. Defaults to true. */
     boringPluginIncludeLegacyFrontUrl?: boolean;
 }
+declare const PLUGIN_AUTHORING_PROVISIONING_IDS: Set<string>;
+declare function omitPluginAuthoringProvisioning(plugins: WorkspaceRuntimeProvisioningInput[]): WorkspaceRuntimeProvisioningInput[];
 interface WorkspaceAgentServerPluginCollection {
     provisioningContributions: WorkspaceProvisioningContribution[];
     runtimePlugins: WorkspaceRuntimeProvisioningInput[];
@@ -149,6 +164,8 @@ interface CollectWorkspaceAgentServerPluginsOptions extends Pick<ServerBootstrap
     workspaceRoot?: string;
     systemPromptAppend?: string;
     pi?: WorkspaceAgentPiOptions;
+    /** Whether to include built-in boring plugin-authoring provisioning/prompt resources. */
+    installPluginAuthoring?: boolean;
 }
 declare function buildWorkspaceContextPrompt(): string;
 declare function collectWorkspaceAgentServerPlugins(opts?: CollectWorkspaceAgentServerPluginsOptions): WorkspaceAgentServerPluginCollection;
@@ -181,4 +198,4 @@ interface ResolveDefaultWorkspacePluginPackagePathsOptions {
  */
 declare function resolveDefaultWorkspacePluginPackagePaths({ workspaceRoot, defaultPluginPackages, appPackageJsonPath, }?: ResolveDefaultWorkspacePluginPackagePathsOptions): string[];
 
-export { type CollectWorkspaceAgentServerPluginsOptions, type CreateWorkspaceAgentServerOptions, type DirPluginEntry, type PluginResolveContext, type ResolveDefaultWorkspacePluginPackagePathsOptions, type WorkspaceAgentPiOptions, type WorkspaceAgentServerPluginCollection, type WorkspaceAgentServerPluginContext, type WorkspacePluginEntry, type WorkspacePluginPackagePiSnapshot, WorkspaceProvisioningContribution, WorkspaceRouteContribution, type WorkspaceRuntimeProvisioningInput, buildWorkspaceContextPrompt, collectWorkspaceAgentServerPlugins, createWorkspaceAgentServer, hasDirServerPlugin, provisionWorkspaceAgentServer, readWorkspacePluginPackagePiSnapshot, readWorkspacePluginPackageRuntimePlugins, resolveDefaultWorkspacePluginPackagePaths, resolveOnePluginEntry };
+export { type CollectWorkspaceAgentServerPluginsOptions, type CreateWorkspaceAgentServerOptions, type DirPluginEntry, PLUGIN_AUTHORING_PROVISIONING_IDS, type PluginResolveContext, type ResolveDefaultWorkspacePluginPackagePathsOptions, type WorkspaceAgentPiOptions, type WorkspaceAgentServerPluginCollection, type WorkspaceAgentServerPluginContext, type WorkspacePluginEntry, type WorkspacePluginPackagePiSnapshot, WorkspaceProvisioningContribution, WorkspaceRouteContribution, type WorkspaceRuntimeProvisioningInput, buildWorkspaceContextPrompt, collectWorkspaceAgentServerPlugins, createWorkspaceAgentServer, hasDirServerPlugin, omitPluginAuthoringProvisioning, provisionWorkspaceAgentServer, readWorkspacePluginPackagePiSnapshot, readWorkspacePluginPackageRuntimePlugins, resolveDefaultWorkspacePluginPackagePaths, resolveOnePluginEntry };

package/dist/app-server.js

@@ -54,7 +54,7 @@ function buildBoringSystemPrompt(opts) {
   if (opts.scaffoldCommand) {
     n += 1;
     steps.push(
-      `**${n}. Check plugin-root support, then scaffold.** Bash \`boring-ui plugin-status --json\`; continue only if \`workspaceLocalPluginRoots\` is \`true\`. Then bash \`${opts.scaffoldCommand} <kebab-name> "$BORING_AGENT_WORKSPACE_ROOT"\`. Read generated \`package.json\` + \`front/index.tsx\`; do NOT write from memory.`
+      `**${n}. Check plugin-root support, then scaffold.** Bash \`boring-ui-plugin status --json\`; continue only if \`workspaceLocalPluginRoots\` is \`true\`. Then bash \`${opts.scaffoldCommand} <kebab-name> "$BORING_AGENT_WORKSPACE_ROOT"\`. Read generated \`package.json\` + \`front/index.tsx\`; do NOT write from memory.`
     );
   } else {
     n += 1;
@@ -64,7 +64,11 @@ function buildBoringSystemPrompt(opts) {
   }
   n += 1;
   steps.push(
-    opts.scaffoldCommand ? `**${n}. Edit the generated files to implement the request.** Keep the scaffold imports, \`definePlugin\` shape, and manifest layout; replace only placeholder content/ids/labels with the real implementation.` : `**${n}. Create or edit the plugin files to implement what the user asked for.** Use the boring-plugin-authoring skill as the canonical source for imports, the \`definePlugin\` call shape, and the manifest layout.`
+    opts.scaffoldCommand ? `**${n}. Edit the generated files.** Keep scaffold imports/layout. Use \`@hachej/boring-ui-kit\` + workspace primitives for native UI; avoid ad-hoc inline UI.` : `**${n}. Create or edit plugin files.** Use the boring-plugin-authoring skill for imports, \`definePlugin\`, manifest layout, and boring-ui-kit design defaults.`
+  );
+  n += 1;
+  steps.push(
+    `**${n}. Install plugin-local deps only when needed.** If adding a browser package, bash \`cd "$BORING_AGENT_WORKSPACE_ROOT/.pi/extensions/<kebab-name>" && npm install <dep>\`; never install at workspace root. \`/reload\` never installs packages.`
   );
   n += 1;
   if (verify) {
@@ -88,7 +92,7 @@ function buildBoringSystemPrompt(opts) {
     "The `boring-plugin-authoring` skill listed under `<available_skills>` is the authoritative reference (read its `<location>`). Additional reference docs (`panels.md`, `bridge.md`, `plugins.md`) are unavailable on this host \u2014 `@hachej/boring-pi` is not installed."
   ].join("\n");
   return [
-    "You are operating inside boring-ui. Before `.pi/extensions/<name>/`, run `boring-ui plugin-status --json`; continue only when `workspaceLocalPluginRoots` is `true`. Default to `.pi/extensions/<name>/`. Global `~/.pi/agent/extensions/` only for explicit requests.",
+    "You are operating inside boring-ui. Before `.pi/extensions/<name>/`, run `boring-ui-plugin status --json`; continue only when `workspaceLocalPluginRoots` is `true`. Default to `.pi/extensions/<name>/`. Global `~/.pi/agent/extensions/` only for explicit requests.",
     [
       "## Plugin authoring \u2014 required workflow",
       "",
@@ -103,6 +107,7 @@ function buildBoringSystemPrompt(opts) {
       '- Server/Pi tool method: `handler` \u2014 use `execute`. Return shape: `{ content: [{ type: "text", text }] }` (NEVER a bare string).',
       "- Manifest values: `boring.server: true` \u2014 use `false`/omit for hot-reload user plugins, or a relative path string only for advanced boot-time/static server integration.",
       "- File layout: files at the package root, or `src/` / `dist/` / `lib/` subdirectories \u2014 the scaffold's hot-reload layout (`front/index.tsx`, optional `agent/index.ts` declared in `pi.extensions`) is the one the workspace refreshes on `/reload`.",
+      "- Dependency installs: do NOT install plugin UI dependencies at the workspace root. Install them inside `.pi/extensions/<name>/` and keep React/workspace/boring-ui-kit imports as host singletons, not plugin dependencies.",
       "- Hot-reload agent tools: do NOT put them in `.pi/extensions/<name>/server/index.ts`; use `pi.extensions` instead. `boring.server` requires static composition plus process restart."
     ].join("\n"),
     docsBlock
@@ -662,6 +667,23 @@ function validateSkills(pluginId, skills) {
     }
   }
 }
+function validatePluginAssets(pluginId, assets) {
+  for (let i = 0; i < assets.length; i++) {
+    const asset = assets[i];
+    if (!asset || typeof asset !== "object") {
+      fail(pluginId, `assets[${i}] must be an object`);
+    }
+    if (!asset.name || typeof asset.name !== "string") {
+      fail(pluginId, `assets[${i}].name must be a non-empty string`);
+    }
+    if (!isPathLike(asset.source)) {
+      fail(pluginId, `assets[${i}].source must be a string or URL`);
+    }
+    if (asset.target !== void 0 && (!asset.target || typeof asset.target !== "string")) {
+      fail(pluginId, `assets[${i}].target must be a non-empty string when provided`);
+    }
+  }
+}
 function validateProvisioning(pluginId, provisioning) {
   if (!provisioning || typeof provisioning !== "object") {
     fail(pluginId, "provisioning must be an object");
@@ -775,6 +797,12 @@ function validateServerPlugin(plugin) {
     }
     plugin.agentTools.forEach((tool, index) => validateAgentTool(plugin.id, tool, index));
   }
+  if (plugin.assets !== void 0) {
+    if (!Array.isArray(plugin.assets)) {
+      fail(plugin.id, "assets must be an array when provided");
+    }
+    validatePluginAssets(plugin.id, plugin.assets);
+  }
   if (plugin.routes !== void 0 && typeof plugin.routes !== "function") {
     fail(plugin.id, "routes must be a Fastify plugin function when provided");
   }
@@ -1465,10 +1493,11 @@ function createInMemoryBridge() {
     async postCommand(cmd) {
       const seq = nextSeq++;
       const annotated = { ...cmd, seq };
-      if (subscribers.size === 0) enqueuePending(annotated);
+      let delivered = false;
       for (const handler of subscribers) {
-        handler(annotated);
+        if (handler(annotated) !== false) delivered = true;
       }
+      if (!delivered) enqueuePending(annotated);
       return { seq, status: "ok" };
     },
     subscribeCommands(handler) {
@@ -1602,9 +1631,9 @@ function isVerified(kind, params, state) {
 }
 function createExecUiTool(uiBridge, opts = {}) {
   const { workspaceRoot, resolvePathKind } = opts;
-  const verifyDelayMs = opts.verifyDelayMs ?? 200;
-  const verifyRetries = opts.verifyRetries ?? 2;
-  const verifyIntervalMs = opts.verifyIntervalMs ?? 200;
+  const verifyDelayMs = opts.verifyDelayMs ?? 250;
+  const verifyRetries = opts.verifyRetries ?? 20;
+  const verifyIntervalMs = opts.verifyIntervalMs ?? 250;
   return {
     name: "exec_ui",
     readinessRequirements: ["ui-bridge"],
@@ -1676,11 +1705,12 @@ function createExecUiTool(uiBridge, opts = {}) {
       "  showNotification params: { msg: string, level?: 'info'|'warn'|'error' }",
       "",
       "Returns { seq, status, uiState? }. For openFile / openPanel / openSurface /",
-      "closePanel the response includes a `uiState` snapshot taken ~400ms after",
-      "dispatch \u2014 check uiState.openTabs to confirm the action took effect.",
+      "closePanel the response includes a `uiState` snapshot after waiting up",
+      "to a few seconds for the browser to dispatch the command \u2014 check",
+      "uiState.openTabs to confirm the action took effect.",
       "If the expected tab is missing from openTabs the frontend silently",
       "rejected the command (unknown panel component, unregistered surface",
-      "resolver, or surface not yet ready). For other kinds only { seq, status }",
+      "resolver, or disconnected browser). For other kinds only { seq, status }",
       "is returned. To open a FILE prefer openFile (path-aware) over openPanel",
       "(which is for non-file panes like charts)."
     ].join("\n"),
@@ -1768,7 +1798,7 @@ function createExecUiTool(uiBridge, opts = {}) {
           await new Promise((r) => setTimeout(r, verifyDelayMs));
           let uiState = await uiBridge.getState();
           for (let i = 0; i < verifyRetries; i++) {
-            if (isVerified(effectiveKind, cmdParams, uiState)) break;
+            if (uiState === null || isVerified(effectiveKind, cmdParams, uiState)) break;
             await new Promise((r) => setTimeout(r, verifyIntervalMs));
             uiState = await uiBridge.getState();
           }
@@ -1794,18 +1824,170 @@ function createWorkspaceUiTools(uiBridge, opts = {}) {
 }
 
 // src/server/ui-control/http/uiRoutes.ts
+import { z as z2 } from "zod";
+
+// src/server/ui-control/panelStatus/paneRenderStatusStore.ts
+var DEFAULT_STATUS_TTL_MS = 5 * 6e4;
+var DEFAULT_UI_CONTACT_TTL_MS = 3e4;
+var DEFAULT_WORKSPACE_ID = "default";
+var MAX_ERROR_MESSAGE_LENGTH = 500;
+function normalizeWorkspaceId(workspaceId) {
+  const trimmed = workspaceId?.trim();
+  return trimmed || DEFAULT_WORKSPACE_ID;
+}
+function statusKey(input) {
+  return `${input.workspaceId}\0${input.pluginId}\0${input.panelId}\0${input.panelInstanceId}`;
+}
+function redactMessage(message) {
+  return message.replace(/\s+/g, " ").trim().slice(0, MAX_ERROR_MESSAGE_LENGTH);
+}
+function createPaneRenderStatusStore(options = {}) {
+  const ttlMs = options.ttlMs ?? DEFAULT_STATUS_TTL_MS;
+  const uiContactTtlMs = options.uiContactTtlMs ?? DEFAULT_UI_CONTACT_TTL_MS;
+  const now = options.now ?? (() => Date.now());
+  const statuses = /* @__PURE__ */ new Map();
+  const lastUiContactByWorkspace = /* @__PURE__ */ new Map();
+  function pruneExpired(current = now()) {
+    for (const [key, status] of statuses) {
+      const reportedAtMs = Date.parse(status.reportedAt);
+      if (!Number.isFinite(reportedAtMs) || current - reportedAtMs > ttlMs) {
+        statuses.delete(key);
+      }
+    }
+  }
+  function touchUi(workspaceId) {
+    lastUiContactByWorkspace.set(normalizeWorkspaceId(workspaceId), now());
+  }
+  function hasRecentUiContact(workspaceId) {
+    const last = lastUiContactByWorkspace.get(normalizeWorkspaceId(workspaceId));
+    return last !== void 0 && now() - last <= uiContactTtlMs;
+  }
+  return {
+    touchUi,
+    hasRecentUiContact,
+    report(input) {
+      pruneExpired();
+      const workspaceId = normalizeWorkspaceId(input.workspaceId);
+      touchUi(workspaceId);
+      const snapshot = {
+        workspaceId,
+        pluginId: input.pluginId,
+        panelId: input.panelId,
+        panelInstanceId: input.panelInstanceId,
+        state: input.state,
+        reportedAt: new Date(now()).toISOString(),
+        ...input.revision !== void 0 ? { revision: input.revision } : {},
+        ...input.error ? { error: { code: input.error.code, message: redactMessage(input.error.message) } } : {}
+      };
+      statuses.set(statusKey(snapshot), snapshot);
+      return snapshot;
+    },
+    get(input) {
+      pruneExpired();
+      const workspaceId = normalizeWorkspaceId(input.workspaceId);
+      if (input.pluginId && input.panelId) {
+        return statuses.get(statusKey({ workspaceId, pluginId: input.pluginId, panelId: input.panelId, panelInstanceId: input.panelInstanceId }));
+      }
+      for (const status of statuses.values()) {
+        if (status.workspaceId !== workspaceId) continue;
+        if (status.panelInstanceId !== input.panelInstanceId) continue;
+        if (input.pluginId && status.pluginId !== input.pluginId) continue;
+        if (input.panelId && status.panelId !== input.panelId) continue;
+        return status;
+      }
+      return void 0;
+    }
+  };
+}
+
+// src/server/ui-control/http/paneRenderStatusRoutes.ts
 import { z } from "zod";
+var reportBodySchema = z.object({
+  workspaceId: z.string().optional(),
+  pluginId: z.string().min(1),
+  panelId: z.string().min(1),
+  panelInstanceId: z.string().min(1),
+  revision: z.number().optional(),
+  state: z.enum(["loading", "ready", "error", "missing"]),
+  error: z.object({
+    code: z.string().min(1),
+    message: z.string().min(1)
+  }).optional()
+});
+function createBodyValidator(schema) {
+  return async function validateBody(request, reply) {
+    const parsed = schema.safeParse(request.body);
+    if (!parsed.success) {
+      const firstIssue = parsed.error.issues[0];
+      const fieldName = firstIssue?.path?.map((segment) => String(segment)).join(".");
+      reply.code(400).send({
+        error: "validation_error",
+        message: firstIssue?.message ?? "Invalid request body",
+        field: fieldName || void 0
+      });
+      return;
+    }
+    request.body = parsed.data;
+  };
+}
+function resolvePaneStatusWorkspaceId(request) {
+  const headers = request.headers;
+  const header = headers["x-boring-workspace-id"] ?? headers["X-Boring-Workspace-Id"];
+  if (Array.isArray(header)) return header[0];
+  if (typeof header === "string" && header.trim()) return header;
+  const query = request.query;
+  const workspaceId = query?.workspaceId;
+  return typeof workspaceId === "string" && workspaceId.trim() ? workspaceId : void 0;
+}
+function paneRenderStatusRoutes(app, opts = {}, done) {
+  const store = opts.store ?? createPaneRenderStatusStore();
+  const validateReport = createBodyValidator(reportBodySchema);
+  const getWorkspaceId = async (request) => {
+    return await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  };
+  app.put(
+    "/api/v1/ui/panels/status",
+    { preHandler: validateReport },
+    async (request, reply) => {
+      const body = request.body;
+      const workspaceId = await getWorkspaceId(request) ?? body.workspaceId;
+      const status = store.report({ ...body, workspaceId });
+      return reply.code(200).send({ ok: true, status });
+    }
+  );
+  app.get("/api/v1/ui/panels/status", async (request, reply) => {
+    const query = request.query;
+    const panelInstanceId = query.panelInstanceId;
+    if (typeof panelInstanceId !== "string" || !panelInstanceId.trim()) {
+      return reply.code(400).send({ error: "validation_error", message: "panelInstanceId is required", field: "panelInstanceId" });
+    }
+    const workspaceId = await getWorkspaceId(request);
+    const pluginId = typeof query.pluginId === "string" ? query.pluginId : void 0;
+    const panelId = typeof query.panelId === "string" ? query.panelId : void 0;
+    const status = store.get({ workspaceId, panelInstanceId, pluginId, panelId });
+    const connected = store.hasRecentUiContact(workspaceId);
+    return {
+      ok: true,
+      connected,
+      state: status?.state ?? (connected ? "missing" : "no-browser-connected"),
+      ...status ? { status } : {}
+    };
+  });
+  done();
+}
+
+// src/server/ui-control/http/uiRoutes.ts
 var UI_BRIDGE_PROTOCOL_VERSION = 1;
 var HEARTBEAT_MS = 15e3;
-var setStateBodySchema = z.object({
-  state: z.record(z.unknown()),
-  causedBy: z.enum(["user", "agent", "restore"]).optional()
+var setStateBodySchema = z2.object({
+  state: z2.record(z2.unknown()),
+  causedBy: z2.enum(["user", "agent", "restore"]).optional()
 });
-var postCommandBodySchema = z.object({
-  kind: z.string().min(1),
-  params: z.record(z.unknown()).default({})
+var postCommandBodySchema = z2.object({
+  kind: z2.string().min(1),
+  params: z2.record(z2.unknown()).default({})
 });
-function createBodyValidator(schema) {
+function createBodyValidator2(schema) {
   return async function validateBody(request, reply) {
     const parsed = schema.safeParse(request.body);
     if (!parsed.success) {
@@ -1823,8 +2005,13 @@ function createBodyValidator(schema) {
 }
 function uiRoutes(app, opts, done) {
   const fallbackBridge = opts.bridge;
-  const validateSetState = createBodyValidator(setStateBodySchema);
-  const validatePostCommand = createBodyValidator(postCommandBodySchema);
+  const paneStatusStore = opts.paneStatusStore ?? createPaneRenderStatusStore();
+  const getPaneWorkspaceId = async (request) => await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const touchUi = async (request) => {
+    paneStatusStore.touchUi(await getPaneWorkspaceId(request));
+  };
+  const validateSetState = createBodyValidator2(setStateBodySchema);
+  const validatePostCommand = createBodyValidator2(postCommandBodySchema);
   const resolveBridge = async (request) => {
     if (opts.getBridge) return await opts.getBridge(request);
     if (fallbackBridge) return fallbackBridge;
@@ -1836,7 +2023,10 @@ function uiRoutes(app, opts, done) {
     kind: cmd.kind,
     params: cmd.params
   });
+  paneRenderStatusRoutes(app, { store: paneStatusStore, getWorkspaceId: getPaneWorkspaceId }, () => {
+  });
   app.get("/api/v1/ui/state", async (request) => {
+    await touchUi(request);
     const bridge = await resolveBridge(request);
     return await bridge.getState() ?? {};
   });
@@ -1844,6 +2034,7 @@ function uiRoutes(app, opts, done) {
     "/api/v1/ui/state",
     { preHandler: validateSetState },
     async (request, reply) => {
+      await touchUi(request);
       const body = request.body;
       const bridge = await resolveBridge(request);
       const current = await bridge.getState() ?? {};
@@ -1865,6 +2056,7 @@ function uiRoutes(app, opts, done) {
     }
   );
   app.get("/api/v1/ui/commands/next", async (request, reply) => {
+    await touchUi(request);
     const bridge = await resolveBridge(request);
     const query = request.query;
     if (query.poll === "true") {
@@ -1894,13 +2086,20 @@ data: ${JSON.stringify(encodeCommand(cmd))}
       }
     }
     const unsub = bridge.subscribeCommands((cmd) => {
-      reply.raw.write(`event: command
+      if (reply.raw.destroyed || reply.raw.writableEnded) return false;
+      try {
+        reply.raw.write(`event: command
 data: ${JSON.stringify(encodeCommand(cmd))}
 
 `);
+        return true;
+      } catch {
+        return false;
+      }
     });
     const heartbeat = setInterval(() => {
       if (reply.raw.writableEnded) return;
+      void touchUi(request);
       reply.raw.write(
         `event: heartbeat
 data: ${JSON.stringify({ v: UI_BRIDGE_PROTOCOL_VERSION })}
@@ -1949,41 +2148,9 @@ function readPackageVersion(packageRoot) {
     return void 0;
   }
 }
-function nodePackageContribution(contributionId, nodePackageId, packageName, packageRoot) {
-  if (!packageRoot || !existsSync7(join7(packageRoot, "package.json"))) return null;
-  return {
-    id: contributionId,
-    provisioning: {
-      nodePackages: [{ id: nodePackageId, packageName, packageRoot }]
-    }
-  };
-}
-function publishedNodePackageContribution(contributionId, nodePackageId, packageName, version, expectedBins) {
-  return {
-    id: contributionId,
-    provisioning: {
-      nodePackages: [
-        {
-          id: nodePackageId,
-          packageName,
-          ...version ? { version } : {},
-          ...expectedBins ? { expectedBins } : {}
-        }
-      ]
-    }
-  };
-}
 function useLocalPackageProvisioning() {
   return process.env.BORING_USE_LOCAL_PACKAGES === "1";
 }
-function createWorkspacePackageProvisioningContribution() {
-  return nodePackageContribution(
-    "boring-workspace-package",
-    "boring-workspace",
-    "@hachej/boring-workspace",
-    resolveWorkspacePackageRoot()
-  );
-}
 function resolveBoringPiPackageRoot() {
   const workspacePackageRoot = resolveWorkspacePackageRoot();
   const candidates = [
@@ -2003,45 +2170,48 @@ function resolveBoringPiPackageRoot() {
     return null;
   }
 }
-function createBoringPiPackageProvisioningContribution() {
-  return nodePackageContribution("boring-pi-package", "boring-pi", "@hachej/boring-pi", resolveBoringPiPackageRoot());
+function isUsableBoringUiPluginCliPackageRoot(candidate) {
+  try {
+    const pkg = JSON.parse(readFileSync6(join7(candidate, "package.json"), "utf8"));
+    return pkg.name === "@hachej/boring-ui-plugin-cli" && existsSync7(join7(candidate, "dist", "bin.js"));
+  } catch {
+    return false;
+  }
 }
-function resolveBoringUiCliPackageRoot() {
+function resolveBoringUiPluginCliPackageRoot() {
   const workspacePackageRoot = resolveWorkspacePackageRoot();
   const candidates = [
-    join7(workspacePackageRoot, "..", "cli"),
-    join7(workspacePackageRoot, "node_modules", "@hachej", "boring-ui-cli")
+    join7(workspacePackageRoot, "..", "plugin-cli"),
+    join7(workspacePackageRoot, "node_modules", "@hachej", "boring-ui-plugin-cli")
   ];
   for (const candidate of candidates) {
-    try {
-      const pkg = JSON.parse(readFileSync6(join7(candidate, "package.json"), "utf8"));
-      if (pkg.name === "@hachej/boring-ui-cli") return candidate;
-    } catch {
-    }
+    if (isUsableBoringUiPluginCliPackageRoot(candidate)) return candidate;
   }
   try {
-    return dirname7(require4.resolve("@hachej/boring-ui-cli/package.json"));
+    const resolved = dirname7(require4.resolve("@hachej/boring-ui-plugin-cli/package.json"));
+    return isUsableBoringUiPluginCliPackageRoot(resolved) ? resolved : null;
   } catch {
     return null;
   }
 }
-function createBoringUiCliPackageProvisioningContribution() {
-  const packageRoot = resolveBoringUiCliPackageRoot();
-  if (useLocalPackageProvisioning()) {
-    return nodePackageContribution(
-      "boring-ui-cli-package",
-      "boring-ui-cli",
-      "@hachej/boring-ui-cli",
-      packageRoot
-    );
-  }
-  return publishedNodePackageContribution(
-    "boring-ui-cli-package",
-    "boring-ui-cli",
-    "@hachej/boring-ui-cli",
-    packageRoot === join7(resolveWorkspacePackageRoot(), "..", "cli") ? void 0 : readPackageVersion(packageRoot) ?? readPackageVersion(resolveWorkspacePackageRoot()),
-    ["boring-ui"]
-  );
+var PLUGIN_AUTHORING_PROVISIONING_IDS = /* @__PURE__ */ new Set(["boring-ui-plugin-cli-package"]);
+function omitPluginAuthoringProvisioning(plugins) {
+  return plugins.filter((plugin) => !PLUGIN_AUTHORING_PROVISIONING_IDS.has(plugin.id));
+}
+function createBoringUiPluginCliPackageProvisioningContribution() {
+  const packageRoot = useLocalPackageProvisioning() ? resolveBoringUiPluginCliPackageRoot() : null;
+  const version = readPackageVersion(resolveWorkspacePackageRoot());
+  return {
+    id: "boring-ui-plugin-cli-package",
+    provisioning: {
+      nodePackages: [{
+        id: "boring-ui-plugin-cli",
+        packageName: "@hachej/boring-ui-plugin-cli",
+        ...packageRoot ? { packageRoot } : { version },
+        expectedBins: ["boring-ui-plugin"]
+      }]
+    }
+  };
 }
 function createBoringPiPackageSource(workspaceRoot) {
   const workspacePackageRoot = join7(workspaceRoot, "node_modules", "@hachej", "boring-pi");
@@ -2062,7 +2232,7 @@ function buildWorkspaceContextPrompt() {
     "- Root: `$BORING_AGENT_WORKSPACE_ROOT` (exported into every bash invocation)",
     "- Generated plugin skills: `$BORING_AGENT_WORKSPACE_ROOT/.boring-agent/skills/` \u2014 readable with normal file tools",
     "- User workspace skills: `$BORING_AGENT_WORKSPACE_ROOT/.agents/skills/`",
-    "- Runtime CLIs (`boring-ui`, `bm`, `python`, `pip`, `uv`) come from `.boring-agent/node`, `.boring-agent/venv`, and `.boring-agent/sdk/uv` and are already on PATH"
+    "- Runtime CLIs (`boring-ui-plugin`, `bm`, `python`, `pip`, `uv`) come from `.boring-agent/node`, `.boring-agent/venv`, and `.boring-agent/sdk/uv` and are already on PATH"
   ].join("\n");
 }
 function collectWorkspaceAgentServerPlugins(opts = {}) {
@@ -2076,11 +2246,8 @@ function collectWorkspaceAgentServerPlugins(opts = {}) {
   const callerAdditional = opts.pi?.additionalSkillPaths ?? [];
   const callerPiPackages = opts.pi?.packages ?? [];
   const callerExtensionPaths = opts.pi?.extensionPaths ?? [];
-  const builtinProvisioningContributions = [
-    createWorkspacePackageProvisioningContribution(),
-    createBoringPiPackageProvisioningContribution(),
-    createBoringUiCliPackageProvisioningContribution()
-  ].filter((entry) => Boolean(entry));
+  const excludedDefaults = new Set(opts.excludeDefaults ?? []);
+  const builtinProvisioningContributions = (opts.installPluginAuthoring === false ? [] : [createBoringUiPluginCliPackageProvisioningContribution()]).filter((entry) => Boolean(entry)).filter((entry) => !excludedDefaults.has(entry.id));
   return {
     provisioningContributions: [
       ...builtinProvisioningContributions,
@@ -2226,13 +2393,15 @@ async function createWorkspaceAgentServer(opts = {}) {
   const resolvedPlugins = await Promise.all(
     allPluginEntries.map((entry) => resolveOnePluginEntry(entry, ctx))
   );
+  const pluginAuthoringEnabled = (opts.installPluginAuthoring ?? workspaceFsCapability === "strong") && !(opts.excludeDefaults ?? []).includes("boring-ui-plugin-cli-package");
   const pluginCollection = collectWorkspaceAgentServerPlugins({
     ...opts,
-    plugins: resolvedPlugins
+    plugins: resolvedPlugins,
+    installPluginAuthoring: pluginAuthoringEnabled
   });
-  const workspacePackagePiPackage = createBoringPiPackageSource(workspaceRoot);
+  const workspacePackagePiPackage = pluginAuthoringEnabled ? createBoringPiPackageSource(workspaceRoot) : void 0;
   const baseStaticPiSkillPaths = [
-    ...resolveBoringPiSkillPaths(workspaceRoot),
+    ...pluginAuthoringEnabled ? resolveBoringPiSkillPaths(workspaceRoot) : [],
     ...pluginCollection.agentOptions.pi?.additionalSkillPaths ?? []
   ];
   const baseStaticPiPackages = [
@@ -2264,10 +2433,14 @@ async function createWorkspaceAgentServer(opts = {}) {
     frontTargetResolver: opts.boringPluginFrontTargetResolver,
     includeLegacyFrontUrl: opts.boringPluginIncludeLegacyFrontUrl
   });
-  const buildRuntimeProvisioningInputs = () => mergeRuntimeProvisioningInputs([
-    ...pluginCollection.runtimePlugins,
-    ...readWorkspacePluginPackageRuntimePlugins(boringPluginDirs)
-  ]);
+  const buildRuntimeProvisioningInputs = () => {
+    const inputs = mergeRuntimeProvisioningInputs([
+      ...pluginCollection.runtimePlugins,
+      ...readWorkspacePluginPackageRuntimePlugins(boringPluginDirs)
+    ]);
+    if (resolvedMode === "direct") return omitPluginAuthoringProvisioning(inputs);
+    return inputs;
+  };
   let currentRuntimeProvisioning = opts.runtimeProvisioning;
   const runtimeWorkspaceRoot = resolvedMode === "vercel-sandbox" ? VERCEL_SANDBOX_WORKSPACE_ROOT : workspaceRoot;
   const runtimeLayout = getBoringAgentRuntimePaths(runtimeWorkspaceRoot);
@@ -2307,20 +2480,18 @@ async function createWorkspaceAgentServer(opts = {}) {
     ],
     systemPromptAppend: [
       workspaceFsCapability === "strong" ? buildWorkspaceContextPrompt() : void 0,
-      // `boring-ui` resolves via PATH (pnpm's workspace bin or the
-      // user's npx/global install). We deliberately do NOT prefix with
-      // `npx @hachej/boring-ui-cli` here — that would pull the
-      // published version, which lags the locally-installed CLI when
-      // the agent is iterating in a monorepo. Keep the bin name short.
-      buildBoringSystemPrompt({
-        scaffoldCommand: "boring-ui scaffold-plugin",
-        verifyCommand: "boring-ui verify-plugin",
+      // `boring-ui-plugin` resolves via PATH from the provisioned workspace
+      // runtime. It is the slim setup component for agent-authored plugins;
+      // do not route plugin authoring through the full human-facing CLI.
+      pluginAuthoringEnabled ? buildBoringSystemPrompt({
+        scaffoldCommand: "boring-ui-plugin scaffold",
+        verifyCommand: "boring-ui-plugin verify",
         boringPiRootOverride: boringPiRootVisibleToAgentTools(
           workspaceRoot,
           resolvedMode,
           opts.provisionWorkspace !== false
         )
-      }),
+      }) : void 0,
       pluginCollection.agentOptions.systemPromptAppend,
       staticPluginPackagePiSnapshot.systemPromptAppend
     ].filter(Boolean).join("\n\n") || void 0,
@@ -2378,10 +2549,12 @@ async function createWorkspaceAgentServer(opts = {}) {
   return app;
 }
 export {
+  PLUGIN_AUTHORING_PROVISIONING_IDS,
   buildWorkspaceContextPrompt,
   collectWorkspaceAgentServerPlugins,
   createWorkspaceAgentServer,
   hasDirServerPlugin,
+  omitPluginAuthoringProvisioning,
   provisionWorkspaceAgentServer,
   readWorkspacePluginPackagePiSnapshot,
   readWorkspacePluginPackageRuntimePlugins,