@hachej/boring-workspace 0.1.31 → 0.1.33

package/dist/server.js

@@ -21,10 +21,11 @@ function createInMemoryBridge() {
     async postCommand(cmd) {
       const seq = nextSeq++;
       const annotated = { ...cmd, seq };
-      if (subscribers.size === 0) enqueuePending(annotated);
+      let delivered = false;
       for (const handler of subscribers) {
-        handler(annotated);
+        if (handler(annotated) !== false) delivered = true;
       }
+      if (!delivered) enqueuePending(annotated);
       return { seq, status: "ok" };
     },
     subscribeCommands(handler) {
@@ -41,18 +42,170 @@ function createInMemoryBridge() {
 }
 
 // src/server/ui-control/http/uiRoutes.ts
+import { z as z2 } from "zod";
+
+// src/server/ui-control/panelStatus/paneRenderStatusStore.ts
+var DEFAULT_STATUS_TTL_MS = 5 * 6e4;
+var DEFAULT_UI_CONTACT_TTL_MS = 3e4;
+var DEFAULT_WORKSPACE_ID = "default";
+var MAX_ERROR_MESSAGE_LENGTH = 500;
+function normalizeWorkspaceId(workspaceId) {
+  const trimmed = workspaceId?.trim();
+  return trimmed || DEFAULT_WORKSPACE_ID;
+}
+function statusKey(input) {
+  return `${input.workspaceId}\0${input.pluginId}\0${input.panelId}\0${input.panelInstanceId}`;
+}
+function redactMessage(message) {
+  return message.replace(/\s+/g, " ").trim().slice(0, MAX_ERROR_MESSAGE_LENGTH);
+}
+function createPaneRenderStatusStore(options = {}) {
+  const ttlMs = options.ttlMs ?? DEFAULT_STATUS_TTL_MS;
+  const uiContactTtlMs = options.uiContactTtlMs ?? DEFAULT_UI_CONTACT_TTL_MS;
+  const now = options.now ?? (() => Date.now());
+  const statuses = /* @__PURE__ */ new Map();
+  const lastUiContactByWorkspace = /* @__PURE__ */ new Map();
+  function pruneExpired(current = now()) {
+    for (const [key, status] of statuses) {
+      const reportedAtMs = Date.parse(status.reportedAt);
+      if (!Number.isFinite(reportedAtMs) || current - reportedAtMs > ttlMs) {
+        statuses.delete(key);
+      }
+    }
+  }
+  function touchUi(workspaceId) {
+    lastUiContactByWorkspace.set(normalizeWorkspaceId(workspaceId), now());
+  }
+  function hasRecentUiContact(workspaceId) {
+    const last = lastUiContactByWorkspace.get(normalizeWorkspaceId(workspaceId));
+    return last !== void 0 && now() - last <= uiContactTtlMs;
+  }
+  return {
+    touchUi,
+    hasRecentUiContact,
+    report(input) {
+      pruneExpired();
+      const workspaceId = normalizeWorkspaceId(input.workspaceId);
+      touchUi(workspaceId);
+      const snapshot = {
+        workspaceId,
+        pluginId: input.pluginId,
+        panelId: input.panelId,
+        panelInstanceId: input.panelInstanceId,
+        state: input.state,
+        reportedAt: new Date(now()).toISOString(),
+        ...input.revision !== void 0 ? { revision: input.revision } : {},
+        ...input.error ? { error: { code: input.error.code, message: redactMessage(input.error.message) } } : {}
+      };
+      statuses.set(statusKey(snapshot), snapshot);
+      return snapshot;
+    },
+    get(input) {
+      pruneExpired();
+      const workspaceId = normalizeWorkspaceId(input.workspaceId);
+      if (input.pluginId && input.panelId) {
+        return statuses.get(statusKey({ workspaceId, pluginId: input.pluginId, panelId: input.panelId, panelInstanceId: input.panelInstanceId }));
+      }
+      for (const status of statuses.values()) {
+        if (status.workspaceId !== workspaceId) continue;
+        if (status.panelInstanceId !== input.panelInstanceId) continue;
+        if (input.pluginId && status.pluginId !== input.pluginId) continue;
+        if (input.panelId && status.panelId !== input.panelId) continue;
+        return status;
+      }
+      return void 0;
+    }
+  };
+}
+
+// src/server/ui-control/http/paneRenderStatusRoutes.ts
 import { z } from "zod";
+var reportBodySchema = z.object({
+  workspaceId: z.string().optional(),
+  pluginId: z.string().min(1),
+  panelId: z.string().min(1),
+  panelInstanceId: z.string().min(1),
+  revision: z.number().optional(),
+  state: z.enum(["loading", "ready", "error", "missing"]),
+  error: z.object({
+    code: z.string().min(1),
+    message: z.string().min(1)
+  }).optional()
+});
+function createBodyValidator(schema) {
+  return async function validateBody(request, reply) {
+    const parsed = schema.safeParse(request.body);
+    if (!parsed.success) {
+      const firstIssue = parsed.error.issues[0];
+      const fieldName = firstIssue?.path?.map((segment) => String(segment)).join(".");
+      reply.code(400).send({
+        error: "validation_error",
+        message: firstIssue?.message ?? "Invalid request body",
+        field: fieldName || void 0
+      });
+      return;
+    }
+    request.body = parsed.data;
+  };
+}
+function resolvePaneStatusWorkspaceId(request) {
+  const headers = request.headers;
+  const header = headers["x-boring-workspace-id"] ?? headers["X-Boring-Workspace-Id"];
+  if (Array.isArray(header)) return header[0];
+  if (typeof header === "string" && header.trim()) return header;
+  const query = request.query;
+  const workspaceId = query?.workspaceId;
+  return typeof workspaceId === "string" && workspaceId.trim() ? workspaceId : void 0;
+}
+function paneRenderStatusRoutes(app, opts = {}, done) {
+  const store = opts.store ?? createPaneRenderStatusStore();
+  const validateReport = createBodyValidator(reportBodySchema);
+  const getWorkspaceId = async (request) => {
+    return await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  };
+  app.put(
+    "/api/v1/ui/panels/status",
+    { preHandler: validateReport },
+    async (request, reply) => {
+      const body = request.body;
+      const workspaceId = await getWorkspaceId(request) ?? body.workspaceId;
+      const status = store.report({ ...body, workspaceId });
+      return reply.code(200).send({ ok: true, status });
+    }
+  );
+  app.get("/api/v1/ui/panels/status", async (request, reply) => {
+    const query = request.query;
+    const panelInstanceId = query.panelInstanceId;
+    if (typeof panelInstanceId !== "string" || !panelInstanceId.trim()) {
+      return reply.code(400).send({ error: "validation_error", message: "panelInstanceId is required", field: "panelInstanceId" });
+    }
+    const workspaceId = await getWorkspaceId(request);
+    const pluginId = typeof query.pluginId === "string" ? query.pluginId : void 0;
+    const panelId = typeof query.panelId === "string" ? query.panelId : void 0;
+    const status = store.get({ workspaceId, panelInstanceId, pluginId, panelId });
+    const connected = store.hasRecentUiContact(workspaceId);
+    return {
+      ok: true,
+      connected,
+      state: status?.state ?? (connected ? "missing" : "no-browser-connected"),
+      ...status ? { status } : {}
+    };
+  });
+  done();
+}
+
+// src/server/ui-control/http/uiRoutes.ts
 var UI_BRIDGE_PROTOCOL_VERSION = 1;
 var HEARTBEAT_MS = 15e3;
-var setStateBodySchema = z.object({
-  state: z.record(z.unknown()),
-  causedBy: z.enum(["user", "agent", "restore"]).optional()
+var setStateBodySchema = z2.object({
+  state: z2.record(z2.unknown()),
+  causedBy: z2.enum(["user", "agent", "restore"]).optional()
 });
-var postCommandBodySchema = z.object({
-  kind: z.string().min(1),
-  params: z.record(z.unknown()).default({})
+var postCommandBodySchema = z2.object({
+  kind: z2.string().min(1),
+  params: z2.record(z2.unknown()).default({})
 });
-function createBodyValidator(schema) {
+function createBodyValidator2(schema) {
   return async function validateBody(request, reply) {
     const parsed = schema.safeParse(request.body);
     if (!parsed.success) {
@@ -70,8 +223,13 @@ function createBodyValidator(schema) {
 }
 function uiRoutes(app, opts, done) {
   const fallbackBridge = opts.bridge;
-  const validateSetState = createBodyValidator(setStateBodySchema);
-  const validatePostCommand = createBodyValidator(postCommandBodySchema);
+  const paneStatusStore = opts.paneStatusStore ?? createPaneRenderStatusStore();
+  const getPaneWorkspaceId = async (request) => await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const touchUi = async (request) => {
+    paneStatusStore.touchUi(await getPaneWorkspaceId(request));
+  };
+  const validateSetState = createBodyValidator2(setStateBodySchema);
+  const validatePostCommand = createBodyValidator2(postCommandBodySchema);
   const resolveBridge = async (request) => {
     if (opts.getBridge) return await opts.getBridge(request);
     if (fallbackBridge) return fallbackBridge;
@@ -83,7 +241,10 @@ function uiRoutes(app, opts, done) {
     kind: cmd.kind,
     params: cmd.params
   });
+  paneRenderStatusRoutes(app, { store: paneStatusStore, getWorkspaceId: getPaneWorkspaceId }, () => {
+  });
   app.get("/api/v1/ui/state", async (request) => {
+    await touchUi(request);
     const bridge = await resolveBridge(request);
     return await bridge.getState() ?? {};
   });
@@ -91,6 +252,7 @@ function uiRoutes(app, opts, done) {
     "/api/v1/ui/state",
     { preHandler: validateSetState },
     async (request, reply) => {
+      await touchUi(request);
       const body = request.body;
       const bridge = await resolveBridge(request);
       const current = await bridge.getState() ?? {};
@@ -112,6 +274,7 @@ function uiRoutes(app, opts, done) {
     }
   );
   app.get("/api/v1/ui/commands/next", async (request, reply) => {
+    await touchUi(request);
     const bridge = await resolveBridge(request);
     const query = request.query;
     if (query.poll === "true") {
@@ -141,13 +304,20 @@ data: ${JSON.stringify(encodeCommand(cmd))}
       }
     }
     const unsub = bridge.subscribeCommands((cmd) => {
-      reply.raw.write(`event: command
+      if (reply.raw.destroyed || reply.raw.writableEnded) return false;
+      try {
+        reply.raw.write(`event: command
 data: ${JSON.stringify(encodeCommand(cmd))}
 
 `);
+        return true;
+      } catch {
+        return false;
+      }
     });
     const heartbeat = setInterval(() => {
       if (reply.raw.writableEnded) return;
+      void touchUi(request);
       reply.raw.write(
         `event: heartbeat
 data: ${JSON.stringify({ v: UI_BRIDGE_PROTOCOL_VERSION })}
@@ -282,9 +452,9 @@ function isVerified(kind, params, state) {
 }
 function createExecUiTool(uiBridge, opts = {}) {
   const { workspaceRoot, resolvePathKind } = opts;
-  const verifyDelayMs = opts.verifyDelayMs ?? 200;
-  const verifyRetries = opts.verifyRetries ?? 2;
-  const verifyIntervalMs = opts.verifyIntervalMs ?? 200;
+  const verifyDelayMs = opts.verifyDelayMs ?? 250;
+  const verifyRetries = opts.verifyRetries ?? 20;
+  const verifyIntervalMs = opts.verifyIntervalMs ?? 250;
   return {
     name: "exec_ui",
     readinessRequirements: ["ui-bridge"],
@@ -356,11 +526,12 @@ function createExecUiTool(uiBridge, opts = {}) {
       "  showNotification params: { msg: string, level?: 'info'|'warn'|'error' }",
       "",
       "Returns { seq, status, uiState? }. For openFile / openPanel / openSurface /",
-      "closePanel the response includes a `uiState` snapshot taken ~400ms after",
-      "dispatch \u2014 check uiState.openTabs to confirm the action took effect.",
+      "closePanel the response includes a `uiState` snapshot after waiting up",
+      "to a few seconds for the browser to dispatch the command \u2014 check",
+      "uiState.openTabs to confirm the action took effect.",
       "If the expected tab is missing from openTabs the frontend silently",
       "rejected the command (unknown panel component, unregistered surface",
-      "resolver, or surface not yet ready). For other kinds only { seq, status }",
+      "resolver, or disconnected browser). For other kinds only { seq, status }",
       "is returned. To open a FILE prefer openFile (path-aware) over openPanel",
       "(which is for non-file panes like charts)."
     ].join("\n"),
@@ -448,7 +619,7 @@ function createExecUiTool(uiBridge, opts = {}) {
           await new Promise((r) => setTimeout(r, verifyDelayMs));
           let uiState = await uiBridge.getState();
           for (let i = 0; i < verifyRetries; i++) {
-            if (isVerified(effectiveKind, cmdParams, uiState)) break;
+            if (uiState === null || isVerified(effectiveKind, cmdParams, uiState)) break;
             await new Promise((r) => setTimeout(r, verifyIntervalMs));
             uiState = await uiBridge.getState();
           }
@@ -546,6 +717,23 @@ function validateSkills(pluginId, skills) {
     }
   }
 }
+function validatePluginAssets(pluginId, assets) {
+  for (let i = 0; i < assets.length; i++) {
+    const asset = assets[i];
+    if (!asset || typeof asset !== "object") {
+      fail(pluginId, `assets[${i}] must be an object`);
+    }
+    if (!asset.name || typeof asset.name !== "string") {
+      fail(pluginId, `assets[${i}].name must be a non-empty string`);
+    }
+    if (!isPathLike(asset.source)) {
+      fail(pluginId, `assets[${i}].source must be a string or URL`);
+    }
+    if (asset.target !== void 0 && (!asset.target || typeof asset.target !== "string")) {
+      fail(pluginId, `assets[${i}].target must be a non-empty string when provided`);
+    }
+  }
+}
 function validateProvisioning(pluginId, provisioning) {
   if (!provisioning || typeof provisioning !== "object") {
     fail(pluginId, "provisioning must be an object");
@@ -659,6 +847,12 @@ function validateServerPlugin(plugin) {
     }
     plugin.agentTools.forEach((tool, index) => validateAgentTool(plugin.id, tool, index));
   }
+  if (plugin.assets !== void 0) {
+    if (!Array.isArray(plugin.assets)) {
+      fail(plugin.id, "assets must be an array when provided");
+    }
+    validatePluginAssets(plugin.id, plugin.assets);
+  }
   if (plugin.routes !== void 0 && typeof plugin.routes !== "function") {
     fail(plugin.id, "routes must be a Fastify plugin function when provided");
   }
@@ -676,6 +870,20 @@ function defineServerPlugin(plugin) {
   return { ...plugin };
 }
 
+// src/server/plugins/assets.ts
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function definePluginAsset(importMetaUrl, name, relativeSource, options = {}) {
+  return {
+    name,
+    source: new URL(relativeSource, importMetaUrl),
+    ...options.target ? { target: options.target } : {}
+  };
+}
+function resolvePluginAssetPath(importMetaUrl, assetName) {
+  return join(dirname(fileURLToPath(importMetaUrl)), assetName);
+}
+
 // src/server/plugins/bootstrapServer.ts
 function bootstrapServer(options) {
   const excludedDefaults = new Set(options.excludeDefaults ?? []);
@@ -723,13 +931,13 @@ function bootstrapServer(options) {
 
 // src/server/boringSystemPrompt.ts
 import { createRequire } from "module";
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 var require2 = createRequire(import.meta.url);
 function resolveBoringPiRoot(override) {
   if (override === null) return null;
   if (override) return override;
   try {
-    return dirname(require2.resolve("@hachej/boring-pi/package.json"));
+    return dirname2(require2.resolve("@hachej/boring-pi/package.json"));
   } catch {
     return null;
   }
@@ -738,19 +946,19 @@ function buildDocsRefs(boringPiRoot) {
   return [
     {
       topic: "Workflow + how-to + full plugin authoring reference",
-      path: join(boringPiRoot, "skills/boring-plugin-authoring/SKILL.md")
+      path: join2(boringPiRoot, "skills/boring-plugin-authoring/SKILL.md")
     },
     {
       topic: "Panels (registration, dockview, layout)",
-      path: join(boringPiRoot, "references/workspace/panels.md")
+      path: join2(boringPiRoot, "references/workspace/panels.md")
     },
     {
       topic: "Bridge / UI control (get_ui_state, exec_ui)",
-      path: join(boringPiRoot, "references/workspace/bridge.md")
+      path: join2(boringPiRoot, "references/workspace/bridge.md")
     },
     {
       topic: "Server plugins (defineServerPlugin, routes, agent tools)",
-      path: join(boringPiRoot, "references/workspace/plugins.md")
+      path: join2(boringPiRoot, "references/workspace/plugins.md")
     }
   ];
 }
@@ -762,7 +970,7 @@ function buildBoringSystemPrompt(opts) {
   if (opts.scaffoldCommand) {
     n += 1;
     steps.push(
-      `**${n}. Check plugin-root support, then scaffold.** Bash \`boring-ui plugin-status --json\`; continue only if \`workspaceLocalPluginRoots\` is \`true\`. Then bash \`${opts.scaffoldCommand} <kebab-name> "$BORING_AGENT_WORKSPACE_ROOT"\`. Read generated \`package.json\` + \`front/index.tsx\`; do NOT write from memory.`
+      `**${n}. Check plugin-root support, then scaffold.** Bash \`boring-ui-plugin status --json\`; continue only if \`workspaceLocalPluginRoots\` is \`true\`. Then bash \`${opts.scaffoldCommand} <kebab-name> "$BORING_AGENT_WORKSPACE_ROOT"\`. Read generated \`package.json\` + \`front/index.tsx\`; do NOT write from memory.`
     );
   } else {
     n += 1;
@@ -772,7 +980,11 @@ function buildBoringSystemPrompt(opts) {
   }
   n += 1;
   steps.push(
-    opts.scaffoldCommand ? `**${n}. Edit the generated files to implement the request.** Keep the scaffold imports, \`definePlugin\` shape, and manifest layout; replace only placeholder content/ids/labels with the real implementation.` : `**${n}. Create or edit the plugin files to implement what the user asked for.** Use the boring-plugin-authoring skill as the canonical source for imports, the \`definePlugin\` call shape, and the manifest layout.`
+    opts.scaffoldCommand ? `**${n}. Edit the generated files.** Keep scaffold imports/layout. Use \`@hachej/boring-ui-kit\` + workspace primitives for native UI; avoid ad-hoc inline UI.` : `**${n}. Create or edit plugin files.** Use the boring-plugin-authoring skill for imports, \`definePlugin\`, manifest layout, and boring-ui-kit design defaults.`
+  );
+  n += 1;
+  steps.push(
+    `**${n}. Install plugin-local deps only when needed.** If adding a browser package, bash \`cd "$BORING_AGENT_WORKSPACE_ROOT/.pi/extensions/<kebab-name>" && npm install <dep>\`; never install at workspace root. \`/reload\` never installs packages.`
   );
   n += 1;
   if (verify) {
@@ -796,7 +1008,7 @@ function buildBoringSystemPrompt(opts) {
     "The `boring-plugin-authoring` skill listed under `<available_skills>` is the authoritative reference (read its `<location>`). Additional reference docs (`panels.md`, `bridge.md`, `plugins.md`) are unavailable on this host \u2014 `@hachej/boring-pi` is not installed."
   ].join("\n");
   return [
-    "You are operating inside boring-ui. Before `.pi/extensions/<name>/`, run `boring-ui plugin-status --json`; continue only when `workspaceLocalPluginRoots` is `true`. Default to `.pi/extensions/<name>/`. Global `~/.pi/agent/extensions/` only for explicit requests.",
+    "You are operating inside boring-ui. Before `.pi/extensions/<name>/`, run `boring-ui-plugin status --json`; continue only when `workspaceLocalPluginRoots` is `true`. Default to `.pi/extensions/<name>/`. Global `~/.pi/agent/extensions/` only for explicit requests.",
     [
       "## Plugin authoring \u2014 required workflow",
       "",
@@ -811,6 +1023,7 @@ function buildBoringSystemPrompt(opts) {
       '- Server/Pi tool method: `handler` \u2014 use `execute`. Return shape: `{ content: [{ type: "text", text }] }` (NEVER a bare string).',
       "- Manifest values: `boring.server: true` \u2014 use `false`/omit for hot-reload user plugins, or a relative path string only for advanced boot-time/static server integration.",
       "- File layout: files at the package root, or `src/` / `dist/` / `lib/` subdirectories \u2014 the scaffold's hot-reload layout (`front/index.tsx`, optional `agent/index.ts` declared in `pi.extensions`) is the one the workspace refreshes on `/reload`.",
+      "- Dependency installs: do NOT install plugin UI dependencies at the workspace root. Install them inside `.pi/extensions/<name>/` and keep React/workspace/boring-ui-kit imports as host singletons, not plugin dependencies.",
       "- Hot-reload agent tools: do NOT put them in `.pi/extensions/<name>/server/index.ts`; use `pi.extensions` instead. `boring.server` requires static composition plus process restart."
     ].join("\n"),
     docsBlock
@@ -820,7 +1033,7 @@ function buildBoringSystemPrompt(opts) {
 // src/server/agentPlugins/manager.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join4, relative as relative3, resolve as resolve5 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join5, relative as relative3, resolve as resolve5 } from "path";
 
 // src/shared/plugins/manifest.ts
 var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
@@ -977,11 +1190,11 @@ function validateBoringPluginManifest(raw) {
 
 // src/server/agentPlugins/scan.ts
 import { existsSync as existsSync2, readdirSync, readFileSync, statSync } from "fs";
-import { basename, dirname as dirname3, join as join2, resolve as resolve3 } from "path";
+import { basename, dirname as dirname4, join as join3, resolve as resolve3 } from "path";
 
 // src/server/agentPlugins/pluginPaths.ts
 import { existsSync, realpathSync } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "path";
 function isInsideRoot(rootReal, targetReal) {
   const rel = relative2(rootReal, targetReal);
   return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
@@ -990,7 +1203,7 @@ function nearestExistingAncestor(path, rootDir) {
   let current = path;
   const root = resolve2(rootDir);
   while (!existsSync(current)) {
-    const parent = dirname2(current);
+    const parent = dirname3(current);
     if (parent === current) return void 0;
     if (!isInsideRoot(root, parent) && parent !== root) return void 0;
     current = parent;
@@ -1025,7 +1238,7 @@ function safePluginIdFromPackageJson(pkg, rootDir) {
   return isValidBoringPluginId(id) ? id : void 0;
 }
 function parsePackageJson(rootDir) {
-  return JSON.parse(readFileSync(join2(rootDir, "package.json"), "utf8"));
+  return JSON.parse(readFileSync(join3(rootDir, "package.json"), "utf8"));
 }
 function hasPluginMetadata(pkg) {
   return pkg.boring !== void 0 || pkg.pi !== void 0;
@@ -1079,12 +1292,12 @@ function discoverBoringPluginDirs(pluginDirs) {
     if (!existsSync2(dir)) continue;
     const info = statSync(dir);
     if (!info.isDirectory()) continue;
-    const hasPackageJson = existsSync2(join2(dir, "package.json"));
+    const hasPackageJson = existsSync2(join3(dir, "package.json"));
     const childPackageDirs = [];
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-      const child = join2(dir, entry.name);
-      if (existsSync2(join2(child, "package.json"))) childPackageDirs.push(child);
+      const child = join3(dir, entry.name);
+      if (existsSync2(join3(child, "package.json"))) childPackageDirs.push(child);
     }
     if (hasPackageJson) out.add(dir);
     for (const child of childPackageDirs) out.add(child);
@@ -1192,7 +1405,7 @@ function readBoringPlugins(pluginDirs) {
 
 // src/server/agentPlugins/signatureCache.ts
 import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, rmSync, statSync as statSync2, writeFileSync } from "fs";
-import { dirname as dirname4, join as join3 } from "path";
+import { dirname as dirname5, join as join4 } from "path";
 var PLUGIN_SIGNATURE_CACHE_FILE = ".boring-signature.json";
 function pluginFileSignature(path) {
   if (!path || !existsSync3(path)) return "missing";
@@ -1200,7 +1413,7 @@ function pluginFileSignature(path) {
   return `${stat2.mtimeMs}:${stat2.size}`;
 }
 function cachePath(pluginRootDir) {
-  return join3(pluginRootDir, PLUGIN_SIGNATURE_CACHE_FILE);
+  return join4(pluginRootDir, PLUGIN_SIGNATURE_CACHE_FILE);
 }
 function writePluginSignatureCache(pluginRootDir, payload) {
   const full = {
@@ -1209,7 +1422,7 @@ function writePluginSignatureCache(pluginRootDir, payload) {
     loadedAt: payload.loadedAt ?? Date.now()
   };
   const path = cachePath(pluginRootDir);
-  mkdirSync(dirname4(path), { recursive: true });
+  mkdirSync(dirname5(path), { recursive: true });
   writeFileSync(path, `${JSON.stringify(full, null, 2)}
 `, "utf8");
 }
@@ -1281,7 +1494,7 @@ function normalizeBoringPluginPiPackages(plugins) {
 
 // src/server/agentPlugins/manager.ts
 function skillPathForPiLoader(path) {
-  return existsSync4(join4(path, "SKILL.md")) ? dirname5(path) : path;
+  return existsSync4(join5(path, "SKILL.md")) ? dirname6(path) : path;
 }
 function preflightErrorId(pluginDir) {
   return `preflight-${createHash("sha256").update(pluginDir).digest("hex").slice(0, 12)}`;
@@ -1303,7 +1516,7 @@ function directorySignature(root) {
     const entries = readdirSync2(dir, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".") && entry.name !== "node_modules").sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       count++;
-      const path = join4(dir, entry.name);
+      const path = join5(dir, entry.name);
       const rel = relative3(root, path);
       const stat2 = lstatSync(path);
       if (stat2.isSymbolicLink()) {
@@ -1346,12 +1559,12 @@ function normalizePluginSubpath(rootDir, path) {
 }
 function frontSignatureRoot(plugin) {
   if (!plugin.frontPath) return void 0;
-  const frontRoot = join4(plugin.rootDir, "front");
+  const frontRoot = join5(plugin.rootDir, "front");
   const rel = relative3(frontRoot, plugin.frontPath);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel) ? frontRoot : dirname5(plugin.frontPath);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel) ? frontRoot : dirname6(plugin.frontPath);
 }
 function pluginSignature(plugin) {
-  return createHash("sha256").update(JSON.stringify(plugin.boring)).update(JSON.stringify(plugin.pi ?? {})).update(plugin.version).update(plugin.frontPath ?? "").update(pluginFileSignature(plugin.frontPath)).update(directorySignature(frontSignatureRoot(plugin))).update(directorySignature(join4(plugin.rootDir, "shared"))).update(plugin.serverPath ?? "").update(pluginFileSignature(plugin.serverPath)).update(directorySignature(plugin.serverPath ? dirname5(plugin.serverPath) : void 0)).update((plugin.extensionPaths ?? []).join("\0")).update((plugin.skillPaths ?? []).join("\0")).digest("hex");
+  return createHash("sha256").update(JSON.stringify(plugin.boring)).update(JSON.stringify(plugin.pi ?? {})).update(plugin.version).update(plugin.frontPath ?? "").update(pluginFileSignature(plugin.frontPath)).update(directorySignature(frontSignatureRoot(plugin))).update(directorySignature(join5(plugin.rootDir, "shared"))).update(plugin.serverPath ?? "").update(pluginFileSignature(plugin.serverPath)).update(directorySignature(plugin.serverPath ? dirname6(plugin.serverPath) : void 0)).update((plugin.extensionPaths ?? []).join("\0")).update((plugin.skillPaths ?? []).join("\0")).digest("hex");
 }
 function computeRequiresRestart(previous, next) {
   if (!previous) return [];
@@ -1376,7 +1589,7 @@ var BoringPluginAssetManager = class {
   reloadQueued = false;
   constructor(options) {
     this.pluginDirs = options.pluginDirs;
-    this.errorRoot = options.errorRoot ?? join4(process.cwd(), ".pi", "extensions");
+    this.errorRoot = options.errorRoot ?? join5(process.cwd(), ".pi", "extensions");
     this.frontTargetResolver = options.frontTargetResolver;
     this.includeLegacyFrontUrl = options.includeLegacyFrontUrl ?? true;
   }
@@ -1580,7 +1793,7 @@ Plugin dir: ${error.pluginDir}`;
   writeError(pluginId, message) {
     const path = this.errorPath(pluginId);
     if (!path) return;
-    mkdirSync2(dirname5(path), { recursive: true });
+    mkdirSync2(dirname6(path), { recursive: true });
     writeFileSync2(path, message, "utf8");
   }
   clearError(pluginId) {
@@ -1717,11 +1930,13 @@ export {
   createGetUiStateTool,
   createInMemoryBridge,
   createWorkspaceUiTools,
+  definePluginAsset,
   defineServerPlugin,
   pluginFileSignature,
   preflightBoringPlugins,
   readBoringPlugins,
   readPluginSignatureCache,
+  resolvePluginAssetPath,
   scanBoringPlugins,
   uiRoutes,
   validateServerPlugin,

package/dist/shared.d.ts

@@ -1,5 +1,5 @@
-export { A as AgentTool, C as CommandResult, J as JSONSchema, T as ToolExecContext, c as ToolResult, U as UiBridge, a as UiCommand, b as UiState } from './ui-bridge-Bdgl2hR8.js';
-export { C as CommandConfig, P as PaneProps, a as PanelConfig, b as PanelRegistration, S as SurfaceOpenRequest, c as SurfacePanelResolution, d as SurfaceResolverConfig, e as SurfaceResolverRegistration, W as WORKSPACE_OPEN_PATH_SURFACE_KIND, f as definePanel } from './surface-CEEkd81D.js';
+export { A as AgentTool, C as CommandResult, J as JSONSchema, T as ToolExecContext, c as ToolResult, U as UiBridge, a as UiCommand, b as UiState } from './ui-bridge-DFNem0df.js';
+export { C as CommandConfig, P as PaneProps, a as PanelConfig, b as PanelRegistration, S as SurfaceOpenRequest, c as SurfacePanelResolution, d as SurfaceResolverConfig, e as SurfaceResolverRegistration, W as WORKSPACE_OPEN_PATH_SURFACE_KIND, f as definePanel } from './surface-obE7YwJk.js';
 import 'react';
 import 'dockview-react';
 

package/dist/{surface-CEEkd81D.d.ts → surface-obE7YwJk.d.ts}

@@ -50,6 +50,8 @@ interface PanelConfig<T = any> {
     /** Source: "builtin" | "app" */
     source?: string;
     pluginId?: string;
+    /** Revision emitted by the runtime plugin asset manager for hot-loaded panels. */
+    pluginRevision?: number;
     /**
      * Whether to wrap the component with React.lazy + Suspense. Omit to let
      * the registry auto-detect: zero-arg functions (factories) are treated as

package/dist/testing.d.ts

@@ -234,6 +234,8 @@ declare interface PanelConfig<T = any> {
     /** Source: "builtin" | "app" */
     source?: string;
     pluginId?: string;
+    /** Revision emitted by the runtime plugin asset manager for hot-loaded panels. */
+    pluginRevision?: number;
     /**
      * Whether to wrap the component with React.lazy + Suspense. Omit to let
      * the registry auto-detect: zero-arg functions (factories) are treated as

package/dist/testing.js

@@ -1,7 +1,7 @@
 import { jsx as Ba } from "react/jsx-runtime";
 import * as Pa from "react";
 import { createElement as is, useMemo as wn, useLayoutEffect as us, isValidElement as ss, cloneElement as ds, useSyncExternalStore as Gi } from "react";
-import { h as cs, p as fs, o as ps } from "./WorkspaceProvider-0V-2x7AH.js";
+import { h as cs, q as fs, o as ps } from "./WorkspaceProvider-CuIZx1ua.js";
 import { d as ms } from "./panel-DnvDNQac.js";
 import * as bs from "react-dom/test-utils";
 import ka from "react-dom";

package/dist/{ui-bridge-Bdgl2hR8.d.ts → ui-bridge-DFNem0df.d.ts}

@@ -1,5 +1,5 @@
 type JSONSchema = Record<string, unknown>;
-type ToolReadinessRequirement = 'workspace-fs' | 'sandbox-exec' | 'ui-bridge';
+type ToolReadinessRequirement = 'workspace-fs' | 'sandbox-exec' | 'ui-bridge' | 'runtime-dependencies' | `runtime:${string}`;
 interface ToolExecContext {
     abortSignal: AbortSignal;
     toolCallId: string;
@@ -35,7 +35,7 @@ interface UiBridge {
     postCommand(cmd: UiCommand): Promise<CommandResult>;
     subscribeCommands(handler: (cmd: UiCommand & {
         seq: number;
-    }) => void): () => void;
+    }) => unknown): () => void;
     drainCommands?(): Promise<Array<UiCommand & {
         seq: number;
     }>>;