@hachej/boring-workspace 0.1.42 → 0.1.43

package/dist/app-server.d.ts

@@ -116,10 +116,11 @@ interface CreateWorkspaceAgentServerOptions extends WorkspaceAgentCreateOptions,
     /**
      * Install and advertise the boring plugin-authoring runtime.
      *
-     * Keep this off for production/hosted workspaces unless a plugin-editing
-     * experience is explicitly enabled. Remote sandboxes can support authoring,
-     * but the CLI should be provisioned only for that activated editing mode,
-     * not for every normal workspace boot.
+     * This option is ignored when `externalPlugins` is false. Keep it off for
+     * production/hosted workspaces unless a plugin-editing experience is
+     * explicitly enabled. Remote sandboxes can support authoring, but the CLI
+     * should be provisioned only for that activated editing mode, not for every
+     * normal workspace boot.
      *
      * Defaults to true for local/standalone strong-filesystem runtimes and false
      * for remote/best-effort runtimes. Core/full-app may choose a stricter
@@ -128,6 +129,14 @@ interface CreateWorkspaceAgentServerOptions extends WorkspaceAgentCreateOptions,
     installPluginAuthoring?: boolean;
     /** Optional host-owned front-target override for boring plugin list/event payloads. */
     boringPluginFrontTargetResolver?: BoringPluginFrontTargetResolver;
+    /**
+     * Single public-mode switch for user/global external plugins. When false,
+     * the server disables .pi/~/.pi/Pi-settings discovery, authoring CLI/prompt
+     * provisioning, plugin diagnostics, and external hot-reload resources. App/
+     * internal plugins from explicit `plugins`, `defaultPluginPackages`, and
+     * `additionalBoringPluginDirs` continue to work.
+     */
+    externalPlugins?: boolean;
 }
 declare const PLUGIN_AUTHORING_PROVISIONING_IDS: Set<string>;
 declare function omitPluginAuthoringProvisioning(plugins: WorkspaceRuntimeProvisioningInput[]): WorkspaceRuntimeProvisioningInput[];
@@ -145,7 +154,9 @@ interface CollectWorkspaceAgentServerPluginsOptions extends Pick<ServerBootstrap
     /** Whether to include built-in boring plugin-authoring provisioning/prompt resources. */
     installPluginAuthoring?: boolean;
 }
-declare function buildWorkspaceContextPrompt(): string;
+declare function buildWorkspaceContextPrompt(options?: {
+    pluginAuthoringEnabled?: boolean;
+}): string;
 declare function collectWorkspaceAgentServerPlugins(opts?: CollectWorkspaceAgentServerPluginsOptions): WorkspaceAgentServerPluginCollection;
 declare function provisionWorkspaceAgentServer(opts: {
     workspaceRoot: string;

package/dist/app-server.js

@@ -1070,7 +1070,7 @@ var BoringPluginAssetManager = class {
       additionalSkillPaths: [...new Set(plugins.flatMap((plugin) => plugin.skillPaths ?? []).map(skillPathForPiLoader))],
       packages: compactPiPackages(normalizeBoringPluginPiPackages(plugins)),
       extensionPaths: plugins.flatMap((plugin) => plugin.extensionPaths ?? []),
-      ...prompts.length > 0 ? { systemPromptAppend: `# Loaded boring-ui plugin context
+      ...prompts.length > 0 ? { systemPromptAppend: `# Loaded app-provided context
 
 ${prompts.join("\n\n")}` } : {}
     };
@@ -1824,7 +1824,7 @@ async function runtimeBackendGateway(app, opts) {
 function aggregatePluginPrompts(manager) {
   const prompts = manager.list().map((plugin) => plugin.pi?.systemPrompt?.trim()).filter((prompt) => Boolean(prompt));
   if (prompts.length === 0) return void 0;
-  return `# Loaded boring-ui plugin context
+  return `# Loaded app-provided context
 
 ${prompts.join("\n\n")}`;
 }
@@ -2182,14 +2182,14 @@ function createExecUiTool(uiBridge, opts = {}) {
       "                          params:{seriesId:'GDPC1'}}}",
       "",
       "  openSurface  params: { kind: string, target: string, meta?: object }",
-      "               \u2014 Open a plugin-owned target through the workspace",
-      "                 surface resolver registry. Use this when a plugin",
+      "               \u2014 Open an app-owned target through the workspace",
+      "                 surface resolver registry. Use this when the app",
       "                 defines the mapping from domain target to panel",
       "                 component, for example a catalog row.",
       "                 Example: {kind:'openSurface', params:{",
-      "                          kind:'my-plugin.open-row',",
+      "                          kind:'catalog.open-row',",
       "                          target:'orders_daily',",
-      "                          meta:{catalogId:'my-plugin'}}}",
+      "                          meta:{catalogId:'data-catalog'}}}",
       "",
       "  closePanel   params: { id: string }",
       "  closeWorkbenchLeftPane params: {}",
@@ -2721,13 +2721,18 @@ function resolveBoringPiSkillPaths(workspaceRoot) {
   const skillFile = join7(root, "skills", "boring-plugin-authoring", "SKILL.md");
   return existsSync7(skillFile) ? [skillFile] : [];
 }
-function buildWorkspaceContextPrompt() {
+function buildWorkspaceContextPrompt(options = {}) {
   return [
     "## Workspace",
     "- Root: `$BORING_AGENT_WORKSPACE_ROOT` (exported into every bash invocation)",
-    "- Generated plugin skills: `$BORING_AGENT_WORKSPACE_ROOT/.boring-agent/skills/` \u2014 readable with normal file tools",
     "- User workspace skills: `$BORING_AGENT_WORKSPACE_ROOT/.agents/skills/`",
-    "- Runtime CLIs (`boring-ui-plugin`, `bm`, `python`, `pip`, `uv`) come from `.boring-agent/node`, `.boring-agent/venv`, and `.boring-agent/sdk/uv` and are already on PATH"
+    ...options.pluginAuthoringEnabled ? [
+      "- Generated plugin skills: `$BORING_AGENT_WORKSPACE_ROOT/.boring-agent/skills/` \u2014 readable with normal file tools",
+      "- Runtime CLIs (`boring-ui-plugin`, `bm`, `python`, `pip`, `uv`) come from `.boring-agent/node`, `.boring-agent/venv`, and `.boring-agent/sdk/uv` and are already on PATH"
+    ] : [
+      "- Runtime CLIs (`bm`, `python`, `pip`, `uv`) come from `.boring-agent/node`, `.boring-agent/venv`, and `.boring-agent/sdk/uv` when provisioned",
+      "- This public app does not expose Boring plugin creation or installation. If asked about Boring plugins, do not explain how to create/install them; say that this app does not expose that feature and continue with normal workspace tasks."
+    ]
   ].join("\n");
 }
 function collectWorkspaceAgentServerPlugins(opts = {}) {
@@ -2821,7 +2826,7 @@ function readPiSettingsBoringPluginSources(settingsPath, workspaceId) {
     }))
   );
 }
-function collectBoringPluginSources(workspaceRoot, pluginCollection, additionalPluginDirs = []) {
+function collectBoringPluginSources(workspaceRoot, pluginCollection, additionalPluginDirs = [], externalPluginsEnabled = true) {
   const extensionPaths = pluginCollection.agentOptions.pi?.extensionPaths ?? [];
   const pluginRoots = extensionPaths.flatMap((path) => {
     try {
@@ -2830,13 +2835,16 @@ function collectBoringPluginSources(workspaceRoot, pluginCollection, additionalP
       return [];
     }
   });
-  return uniquePluginSources([
+  const externalSources = externalPluginsEnabled ? [
     { rootDir: join7(workspaceRoot, ".pi", "extensions"), kind: "external", workspaceId: workspaceRoot },
     { rootDir: join7(workspaceRoot, ".pi", "npm"), kind: "external", workspaceId: workspaceRoot },
     { rootDir: join7(workspaceRoot, ".pi", "git"), kind: "external", workspaceId: workspaceRoot },
     { rootDir: join7(homedir(), ".pi", "agent", "extensions"), kind: "external" },
     ...readPiSettingsBoringPluginSources(join7(workspaceRoot, ".pi", "settings.json"), workspaceRoot),
-    ...readPiSettingsBoringPluginSources(join7(homedir(), ".pi", "agent", "settings.json")),
+    ...readPiSettingsBoringPluginSources(join7(homedir(), ".pi", "agent", "settings.json"))
+  ] : [];
+  return uniquePluginSources([
+    ...externalSources,
     ...pluginRoots.map((rootDir) => ({ rootDir, kind: "internal" })),
     ...additionalPluginDirs.map((entry) => typeof entry === "string" ? { rootDir: entry, kind: "internal" } : entry)
   ]);
@@ -2886,7 +2894,7 @@ function readWorkspacePluginPackageRuntimePlugins(pluginDirs) {
 function aggregatePluginSystemPromptsFromScan(scan) {
   const prompts = scan.plugins.map((plugin) => plugin.pi?.systemPrompt?.trim()).filter((prompt) => Boolean(prompt));
   if (prompts.length === 0) return void 0;
-  return `# Loaded boring-ui plugin context
+  return `# Loaded app-provided context
 
 ${prompts.join("\n\n")}`;
 }
@@ -2919,6 +2927,7 @@ async function createWorkspaceAgentServer(opts = {}) {
   const modeAdapter = opts.runtimeModeAdapter ?? resolveMode(resolvedMode);
   const workspaceFsCapability = modeAdapter.workspaceFsCapability ?? "best-effort";
   const validateUiPaths = opts.validateUiPaths ?? workspaceFsCapability === "strong";
+  const externalPluginsEnabled = opts.externalPlugins !== false;
   const uiTools = createWorkspaceUiTools(bridge, {
     workspaceRoot: validateUiPaths ? workspaceRoot : void 0
   });
@@ -2936,7 +2945,7 @@ async function createWorkspaceAgentServer(opts = {}) {
   const resolvedPlugins = await Promise.all(
     allPluginEntries.map((entry) => resolveOnePluginEntry(entry, ctx))
   );
-  const pluginAuthoringEnabled = (opts.installPluginAuthoring ?? workspaceFsCapability === "strong") && !(opts.excludeDefaults ?? []).includes("boring-ui-plugin-cli-package");
+  const pluginAuthoringEnabled = externalPluginsEnabled && (opts.installPluginAuthoring ?? workspaceFsCapability === "strong") && !(opts.excludeDefaults ?? []).includes("boring-ui-plugin-cli-package");
   const pluginCollection = collectWorkspaceAgentServerPlugins({
     ...opts,
     plugins: resolvedPlugins,
@@ -2956,7 +2965,7 @@ async function createWorkspaceAgentServer(opts = {}) {
   const refreshBoringPluginDirs = () => {
     const next = uniquePluginSources([
       ...defaultPluginPackagePaths.map((rootDir) => ({ rootDir, kind: "internal" })),
-      ...collectBoringPluginSources(workspaceRoot, pluginCollection, opts.additionalBoringPluginDirs)
+      ...collectBoringPluginSources(workspaceRoot, pluginCollection, opts.additionalBoringPluginDirs, externalPluginsEnabled)
     ]);
     boringPluginDirs.splice(0, boringPluginDirs.length, ...next);
     return boringPluginDirs;
@@ -3022,13 +3031,14 @@ async function createWorkspaceAgentServer(opts = {}) {
     ...opts,
     mode: resolvedMode,
     workspaceRoot,
+    externalPlugins: externalPluginsEnabled,
     extraTools: [
       ...opts.extraTools ?? [],
       ...uiTools,
       ...pluginCollection.agentOptions.extraTools ?? []
     ],
     systemPromptAppend: [
-      workspaceFsCapability === "strong" ? buildWorkspaceContextPrompt() : void 0,
+      workspaceFsCapability === "strong" ? buildWorkspaceContextPrompt({ pluginAuthoringEnabled }) : void 0,
       // `boring-ui-plugin` resolves via PATH from the provisioned workspace
       // runtime. It is the slim setup component for agent-authored plugins;
       // do not route plugin authoring through the full human-facing CLI.

package/dist/server.js

@@ -508,14 +508,14 @@ function createExecUiTool(uiBridge, opts = {}) {
       "                          params:{seriesId:'GDPC1'}}}",
       "",
       "  openSurface  params: { kind: string, target: string, meta?: object }",
-      "               \u2014 Open a plugin-owned target through the workspace",
-      "                 surface resolver registry. Use this when a plugin",
+      "               \u2014 Open an app-owned target through the workspace",
+      "                 surface resolver registry. Use this when the app",
       "                 defines the mapping from domain target to panel",
       "                 component, for example a catalog row.",
       "                 Example: {kind:'openSurface', params:{",
-      "                          kind:'my-plugin.open-row',",
+      "                          kind:'catalog.open-row',",
       "                          target:'orders_daily',",
-      "                          meta:{catalogId:'my-plugin'}}}",
+      "                          meta:{catalogId:'data-catalog'}}}",
       "",
       "  closePanel   params: { id: string }",
       "  closeWorkbenchLeftPane params: {}",
@@ -1700,7 +1700,7 @@ var BoringPluginAssetManager = class {
       additionalSkillPaths: [...new Set(plugins.flatMap((plugin) => plugin.skillPaths ?? []).map(skillPathForPiLoader))],
       packages: compactPiPackages(normalizeBoringPluginPiPackages(plugins)),
       extensionPaths: plugins.flatMap((plugin) => plugin.extensionPaths ?? []),
-      ...prompts.length > 0 ? { systemPromptAppend: `# Loaded boring-ui plugin context
+      ...prompts.length > 0 ? { systemPromptAppend: `# Loaded app-provided context
 
 ${prompts.join("\n\n")}` } : {}
     };
@@ -1968,7 +1968,7 @@ async function boringPluginRoutes(app, opts) {
 function aggregatePluginPrompts(manager) {
   const prompts = manager.list().map((plugin) => plugin.pi?.systemPrompt?.trim()).filter((prompt) => Boolean(prompt));
   if (prompts.length === 0) return void 0;
-  return `# Loaded boring-ui plugin context
+  return `# Loaded app-provided context
 
 ${prompts.join("\n\n")}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-workspace",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "type": "module",
   "license": "MIT",
   "description": "Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.",
@@ -135,9 +135,9 @@
     "tailwind-merge": "^2.0.0",
     "zod": "^3.23.0",
     "zustand": "^5.0.0",
-    "@hachej/boring-agent": "0.1.42",
-    "@hachej/boring-ui-kit": "0.1.42",
-    "@hachej/boring-ui-plugin-cli": "0.1.42"
+    "@hachej/boring-ui-kit": "0.1.43",
+    "@hachej/boring-agent": "0.1.43",
+    "@hachej/boring-ui-plugin-cli": "0.1.43"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.0.0",