@jini-ai/agent-plugins 0.6.17 → 0.6.19

package/cloudflare/tovu-form-destinations.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "destinations": [
+    {
+      "id": "cloudflare-d1",
+      "label": "Cloudflare (D1 in your account)",
+      "module": "form-destinations/cloudflare-d1.mjs",
+      "receive": "co-hosted",
+      "hosts": ["cloudflare-workers"]
+    }
+  ]
+}

package/cloudflare/worker/forms-receiver.mjs

@@ -0,0 +1,249 @@
+/**
+ * Form submissions receiver, uploaded as `receiver.mjs` beside the site's static assets.
+ * Runs inside the Cloudflare Workers runtime: no imports, no Node APIs, Web platform only.
+ * Forms, their fields and full validation belong to the host; this module only receives and stores.
+ * Never log answers, IPs or the management secret: only fixed reason codes.
+ */
+export const LIMITS = Object.freeze({ maxBodyBytes: 64 * 1024, maxFields: 100, maxValueLength: 5000, ratePerWindow: 5, windowSeconds: 60, maxPage: 100 });
+/** The host's reserved names: the honeypot and the double-submit attempt token. Never stored. */
+const HONEYPOT = '_hp';
+const RESERVED = new Set([HONEYPOT, '_attempt']);
+/** The host's existing result query names (`form`, `form_status`), so a returning page reads one vocabulary. */
+const RESULT_KEYS = ['form', 'form_status', 'form_errors', 'form_retry_after'];
+const SUBMIT_PATH = /^\/forms\/([a-z0-9][a-z0-9-]{0,99})\/submit\/?$/;
+
+/** Routes form POSTs and the private pull API; every other request is the static site.
+ * @complexity O(body bytes + fields) per submission; O(page) per pull. */
+export async function handleRequest({ request, env, manifest }, options = {}) {
+  const url = new URL(request.url);
+  const submit = SUBMIT_PATH.exec(url.pathname);
+  if (submit) return request.method === 'POST' ? handleSubmit({ request, env, manifest, slug: submit[1] }, options) : errorPage({ status: 405, message: 'This address only accepts form submissions.' });
+  if (url.pathname === '/_tovu/forms/pending') return request.method === 'GET' ? guarded({ request, env, work: () => listPending({ env, url }) }) : json({ status: 405, body: { error: 'METHOD_NOT_ALLOWED' } });
+  if (url.pathname === '/_tovu/forms/ack') return request.method === 'POST' ? guarded({ request, env, work: () => acknowledge({ request, env }, options) }) : json({ status: 405, body: { error: 'METHOD_NOT_ALLOWED' } });
+  const slug = sentFormSlug({ request, url, manifest });
+  return slug ? withSentNotice({ request, env, slug }, options) : env.ASSETS.fetch(request);
+}
+
+/** The form named by the host's own success query (`form=<slug>&form_status=success`) on a page GET, if
+ * it is one of this site's forms. Any other request is served untouched. */
+export function sentFormSlug({ request, url, manifest }, _options = {}) {
+  if (request.method !== 'GET' || url.searchParams.get('form_status') !== 'success') return null;
+  const slug = url.searchParams.get('form');
+  return manifest.forms.some(form => form.slug === slug) ? slug : null;
+}
+
+/** The static page with the same "sent" state the host's server renders: the form hidden and its own
+ * success slot shown. A page without a slot gets one plain accessible message after the form.
+ * Non-HTML or unsuccessful asset responses pass through unchanged. */
+export async function withSentNotice({ request, env, slug }, { Rewriter = globalThis.HTMLRewriter } = {}) {
+  const response = await env.ASSETS.fetch(request);
+  if (!response.ok || !(response.headers.get('Content-Type') ?? '').includes('text/html') || !Rewriter) return response;
+  const rewriter = new Rewriter();
+  for (const [selector, handler] of sentNoticeHandlers({ slug })) rewriter.on(selector, handler);
+  return rewriter.transform(response);
+}
+
+const SENT_MESSAGE = 'Thanks, your submission was received.';
+/** Element handlers in document order. The host renders the success slot before its form, so the form
+ * handler already knows whether a slot was shown. Selectors use the generic success hooks only. */
+export function sentNoticeHandlers({ slug }, _options = {}) {
+  const state = { slot: false, noticed: false };
+  const showSlot = { element(element) { element.removeAttribute('hidden'); state.slot = true; } };
+  const hideForm = { element(element) {
+    element.setAttribute('hidden', '');
+    if (state.slot || state.noticed) return;
+    state.noticed = true;
+    element.after(`<p class="tovu-form-success" data-form-slug="${slug}" role="status">${SENT_MESSAGE}</p>`, { html: true });
+  } };
+  return [
+    [`div.tovu-form-success[data-form-slug="${slug}"]`, showSlot],
+    [`div[data-tovu-form-success][data-form-slug="${slug}"]`, showSlot],
+    [`form[data-form-slug="${slug}"]`, hideForm],
+  ];
+}
+
+/** Honeypot, light manifest checks, D1 rate window, insert, then 303 to the success page. */
+export async function handleSubmit({ request, env, manifest, slug }, { now = () => Date.now(), randomId = () => crypto.randomUUID() } = {}) {
+  const back = backLink({ request });
+  const form = manifest.forms.find(item => item.slug === slug);
+  if (!form) return errorPage({ status: 404, message: 'This form is not available.', back });
+  const parsed = await readFields({ request });
+  if (parsed.error) return errorPage({ ...parsed.error, back });
+  if ((parsed.fields.get(HONEYPOT) ?? []).some(value => value.trim() !== '')) return successRedirect({ request, form });
+  const checked = checkFields({ form, fields: parsed.fields });
+  if (checked.error) return errorPage({ status: 400, message: checked.error, back });
+  const refused = await storeSubmission({ db: env.TOVU_FORMS, slug, answers: checked.answers, ip: request.headers.get('CF-Connecting-IP'), back }, { now, randomId });
+  return refused ?? successRedirect({ request, form });
+}
+
+/** Rate window, then insert. Returns the error page to send, or null once the row is stored. */
+async function storeSubmission({ db, slug, answers, ip, back }, { now, randomId }) {
+  try {
+    if (!await withinRate({ db, key: `${slug}:${ip ?? 'unknown'}`, nowMs: now() })) return errorPage({ status: 429, message: 'Too many submissions. Wait a minute, then try again.', back });
+    await db.prepare('INSERT INTO submissions (id, form_slug, answers_json, submitted_at, ip) VALUES (?, ?, ?, ?, ?)')
+      .bind(randomId(), slug, JSON.stringify(answers), new Date(now()).toISOString(), ip).run();
+    return null;
+  } catch {
+    console.error('FORMS_STORE_FAILED');
+    return errorPage({ status: 503, message: 'Your submission could not be saved. Try again in a few minutes.', back });
+  }
+}
+
+/** Reads at most LIMITS.maxBodyBytes while streaming, then parses URL-encoded or multipart text fields.
+ * Repeated names (checkbox groups) keep every value in order. */
+export async function readFields({ request }, _options = {}) {
+  const type = (request.headers.get('Content-Type') ?? '').toLowerCase();
+  const multipart = type.startsWith('multipart/form-data');
+  if (!multipart && !type.startsWith('application/x-www-form-urlencoded')) return { error: { status: 415, message: 'This form must be sent as a normal web form.' } };
+  const bytes = await readBounded({ request });
+  if (!bytes) return { error: { status: 413, message: 'The submission is too large.' } };
+  const entries = multipart ? await multipartEntries({ bytes, type: request.headers.get('Content-Type') }) : [...new URLSearchParams(new TextDecoder().decode(bytes))];
+  const error = entriesError({ entries });
+  if (error) return { error };
+  const fields = new Map();
+  for (const [name, value] of entries) fields.set(name, [...(fields.get(name) ?? []), value]);
+  return { fields };
+}
+
+function entriesError({ entries }, _options = {}) {
+  if (!entries) return { status: 400, message: 'The submission could not be read.' };
+  if (entries.length > LIMITS.maxFields) return { status: 413, message: 'The submission has too many fields.' };
+  if (entries.some(([, value]) => typeof value !== 'string')) return { status: 400, message: 'File uploads are not accepted by this form.' };
+  return null;
+}
+
+async function readBounded({ request }, _options = {}) {
+  if (Number(request.headers.get('Content-Length')) > LIMITS.maxBodyBytes) return null;
+  if (!request.body) return new Uint8Array();
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request.body) {
+    size += chunk.byteLength;
+    if (size > LIMITS.maxBodyBytes) return null;
+    chunks.push(chunk);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+  return bytes;
+}
+
+async function multipartEntries({ bytes, type }, _options = {}) {
+  try { return [...await new Response(bytes, { headers: { 'Content-Type': type } }).formData()]; }
+  catch { return null; }
+}
+
+/** Manifest-driven light validation; the host re-validates every answer on import.
+ * @returns {{answers: Record<string, string|string[]>} | {error: string}} */
+export function checkFields({ form, fields }, _options = {}) {
+  const known = new Map(form.fields.map(field => [field.name, field]));
+  const unknown = [...fields.keys()].find(name => !RESERVED.has(name) && !known.has(name));
+  if (unknown !== undefined) return { error: `The field "${unknown}" is not part of this form.` };
+  const answers = {};
+  for (const field of form.fields) {
+    const problem = fieldProblem({ field, values: fields.get(field.name) ?? [] });
+    if (problem) return { error: problem };
+    const values = fields.get(field.name);
+    if (values) answers[field.name] = field.multiple ? values : values[0];
+  }
+  return { answers };
+}
+
+function fieldProblem({ field, values }, _options = {}) {
+  if (field.required && !values.some(value => value.trim() !== '')) return `"${field.name}" is required.`;
+  if (!field.multiple && values.length > 1) return `"${field.name}" was sent more than once.`;
+  const max = field.maxLength ?? LIMITS.maxValueLength;
+  return values.some(value => value.length > max) ? `"${field.name}" is longer than ${max} characters.` : null;
+}
+
+/** Fixed-window counter in D1 (shared by every isolate). Counts only valid submissions.
+ * Stale windows for any key are pruned in the same batch; no matching rows means no row writes. */
+export async function withinRate({ db, key, nowMs }, _options = {}) {
+  const windowStart = Math.floor(nowMs / 1000 / LIMITS.windowSeconds) * LIMITS.windowSeconds;
+  const [counted] = await db.batch([
+    db.prepare('INSERT INTO rate_windows (key, window_start, count) VALUES (?, ?, 1) ON CONFLICT(key) DO UPDATE SET count = CASE WHEN rate_windows.window_start = excluded.window_start THEN rate_windows.count + 1 ELSE 1 END, window_start = excluded.window_start RETURNING count').bind(key, windowStart),
+    db.prepare('DELETE FROM rate_windows WHERE window_start < ?').bind(windowStart - 3600),
+  ]);
+  return Number(counted.results?.[0]?.count ?? Infinity) <= LIMITS.ratePerWindow;
+}
+
+/** The form's own success page when it has one; otherwise the referring page on this host (or `/`)
+ * with the host's result query names, exactly as the live site's 303 sets them. */
+export function successRedirect({ request, form }, _options = {}) {
+  const target = form.successPath ? new URL(form.successPath, request.url) : (sameHostReferer({ request }) ?? new URL('/', request.url));
+  if (!form.successPath) {
+    for (const key of RESULT_KEYS) target.searchParams.delete(key);
+    target.searchParams.set('form', form.slug);
+    target.searchParams.set('form_status', 'success');
+  }
+  return new Response(null, { status: 303, headers: { Location: `${target.pathname}${target.search}`, 'Cache-Control': 'no-store' } });
+}
+
+function sameHostReferer({ request }, _options = {}) {
+  try {
+    const referer = new URL(request.headers.get('Referer') ?? '');
+    return referer.host === new URL(request.url).host && !referer.pathname.startsWith('//') ? referer : null;
+  } catch { return null; }
+}
+
+function backLink({ request }, _options = {}) {
+  const referer = sameHostReferer({ request });
+  return referer ? `${referer.pathname}${referer.search}` : '/';
+}
+
+const escapeHtml = value => String(value).replace(/[&<>"']/g, char => `&#${char.charCodeAt(0)};`);
+
+/** Minimal accessible page; the site's theme is never copied here. */
+export function errorPage({ status, message, back = '/' }, _options = {}) {
+  const body = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Form not sent</title></head>`
+    + `<body><main><h1>Form not sent</h1><p role="alert">${escapeHtml(message)}</p><p><a href="${escapeHtml(back)}">Go back</a></p></main></body></html>`;
+  return new Response(body, { status, headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' } });
+}
+
+function json({ status = 200, body }, _options = {}) {
+  return Response.json(body, { status, headers: { 'Cache-Control': 'no-store' } });
+}
+
+/** Bearer check with a constant-time comparison of SHA-256 digests (equal length by construction). */
+export async function authorized({ request, env }, _options = {}) {
+  const secret = env.TOVU_FORMS_SECRET;
+  const header = request.headers.get('Authorization') ?? '';
+  if (typeof secret !== 'string' || secret.length < 32 || !header.startsWith('Bearer ')) return false;
+  const encoder = new TextEncoder();
+  const [given, expected] = await Promise.all([header.slice(7), secret].map(value => crypto.subtle.digest('SHA-256', encoder.encode(value))));
+  const left = new Uint8Array(given);
+  const right = new Uint8Array(expected);
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) difference |= left[index] ^ right[index];
+  return difference === 0;
+}
+
+async function guarded({ request, env, work }, _options = {}) {
+  if (!await authorized({ request, env })) return json({ status: 401, body: { error: 'UNAUTHORIZED' } });
+  try { return await work(); }
+  catch { console.error('FORMS_PULL_FAILED'); return json({ status: 503, body: { error: 'STORAGE_UNAVAILABLE' } }); }
+}
+
+/** Oldest unpulled rows after `after`, at most LIMITS.maxPage. */
+export async function listPending({ env, url }, _options = {}) {
+  const after = Math.max(0, Number.parseInt(url.searchParams.get('after') ?? '0', 10) || 0);
+  const limit = Math.min(LIMITS.maxPage, Math.max(1, Number.parseInt(url.searchParams.get('limit') ?? '50', 10) || 50));
+  const { results = [] } = await env.TOVU_FORMS.prepare('SELECT seq, id, form_slug, answers_json, submitted_at, ip FROM submissions WHERE pulled_at IS NULL AND seq > ? ORDER BY seq LIMIT ?').bind(after, limit).all();
+  const items = results.map(row => ({ seq: row.seq, id: row.id, formSlug: row.form_slug, answers: JSON.parse(row.answers_json), submittedAt: row.submitted_at, ip: row.ip ?? null }));
+  return json({ body: { items, nextAfter: items.length ? items[items.length - 1].seq : after, hasMore: items.length === limit } });
+}
+
+function validIds({ ids }, _options = {}) {
+  return Array.isArray(ids) && ids.length > 0 && ids.length <= LIMITS.maxPage && ids.every(id => typeof id === 'string' && id.length > 0 && id.length <= 64);
+}
+
+/** Marks committed rows as pulled. Unknown or already-pulled ids are ignored. */
+export async function acknowledge({ request, env }, { now = () => Date.now() } = {}) {
+  let body;
+  try { body = await request.json(); } catch { body = null; }
+  const ids = body?.ids;
+  if (!validIds({ ids })) return json({ status: 400, body: { error: 'INVALID_IDS' } });
+  const result = await env.TOVU_FORMS.prepare(`UPDATE submissions SET pulled_at = ? WHERE pulled_at IS NULL AND id IN (${ids.map(() => '?').join(', ')})`)
+    .bind(new Date(now()).toISOString(), ...ids).run();
+  return json({ body: { acknowledged: Number(result.meta?.changes ?? 0) } });
+}

package/composio/mcp.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "composio": {
+      "type": "streamable-http",
+      "url": "https://connect.composio.dev/mcp",
+      "tovuAuthMode": "oauth"
+    }
+  }
+}

package/composio/plugin.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "composio",
+  "version": "1.0.0",
+  "description": "Lets the assistant use the user's other apps (Gmail, Google Calendar, Slack, Notion, GitHub, HubSpot, Linear and 1000+ more) through Composio Connect, Composio's hosted MCP server. One browser sign-in to Composio connects it; each app is then connected on first use by a Composio sign-in link, with no API keys anywhere.",
+  "author": "Tovu",
+  "license": "Apache-2.0",
+  "extensions": {
+    "tovu": {
+      "maturity": "soon",
+      "summary": "Lets the assistant use your other apps, like Gmail, Google Calendar, Slack and Notion. You connect each app with one sign-in link.",
+      "id": "tovu/composio",
+      "provides": [
+        "app-connectors"
+      ],
+      "credentialCards": [
+        {
+          "target": "composio",
+          "title": "Connect Composio",
+          "label": "Composio account",
+          "category": "general",
+          "intro": "Connect Composio to use your other apps. Sign in here, then approve each app separately when you need it.",
+          "usedFor": [
+            "Finds tools for your other apps",
+            "Connects each app with your approval and carries out the tasks you request"
+          ],
+          "keyHint": "Browser sign-in only; this connection does not accept a pasted API key.",
+          "saveKind": "oauth",
+          "permissions": "Connects tool discovery, schemas, account connections and requested app actions. App permissions are approved at each app’s own sign-in. Connection management and action execution need separate write grants; do not grant remote Bash or workbench tools.",
+          "baseUrl": "https://connect.composio.dev"
+        }
+      ]
+    }
+  },
+  "keywords": [
+    "composio",
+    "apps",
+    "connect",
+    "connect-my-account",
+    "integrations",
+    "connectors",
+    "gmail",
+    "email",
+    "google-calendar",
+    "calendar",
+    "google-drive",
+    "google-sheets",
+    "slack",
+    "notion",
+    "github",
+    "linear",
+    "jira",
+    "hubspot",
+    "crm",
+    "discord",
+    "stripe",
+    "airtable",
+    "trello",
+    "asana",
+    "automation",
+    "send-email",
+    "external-mcp",
+    "mcp",
+    "oauth",
+    "sign-in",
+    "app-connectors"
+  ]
+}

package/composio/skills/composio/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: composio
+description: Use the user's other apps (Gmail, Calendar, Slack, Notion, GitHub, HubSpot, 1000+ more) through Composio Connect, Composio's hosted MCP server. Covers connecting from nothing (one browser sign-in to Composio, no API key), the grants the connection needs, and the per-app flow - search for a tool, read its schema, connect the app with a Composio sign-in link, then execute.
+---
+
+# Composio: the user's other apps
+
+## Connection card
+
+Choose the card yourself from its `usedFor` list. Reuse a saved key or working sign-in for that
+task. Never offer a replacement unless the person asks.
+
+`agent_plugin_connect {pluginId:"composio"}` shows the plugin-declared **Connect Composio** card. Review each app’s sign-in permissions and grant only the requested tools. This hosted connection declares no token fallback; do not request or save a Composio API key.
+
+Composio Connect is an **external MCP server** at `https://connect.composio.dev/mcp`. It does not
+expose one tool per app. It exposes a handful of meta-tools, and you reach every app through them.
+Its tools arrive in chat as `mcp__composio__<TOOL>`.
+
+| Tool | What it is for |
+|---|---|
+| `COMPOSIO_SEARCH_TOOLS` | Find the app tool that does what the user asked ("send an email", "create a Linear issue") |
+| `COMPOSIO_GET_TOOL_SCHEMAS` | Read the exact inputs of the tools you found |
+| `COMPOSIO_MANAGE_CONNECTIONS` | Check whether an app is connected; get a sign-in link for one that is not |
+| `COMPOSIO_WAIT_FOR_CONNECTIONS` | Wait while the user finishes that app sign-in |
+| `COMPOSIO_MULTI_EXECUTE_TOOL` | Run the app tool(s) |
+
+## Connecting from nothing
+
+**Never ask the user for a Composio API key, and never accept one pasted into chat.** Composio
+Connect signs the user in by standard MCP OAuth in their browser. The host discovers Composio's
+endpoints and registers its own client, so nobody types a URL, client id or secret.
+
+1. **Turn the plugin on.** It ships disabled. Offer to enable it; on yes call `plugins_set_enabled`
+   with `family: "agent-plugin"`, `pluginId: "composio"`, `enabled: true` (the user approves a
+   dialog), or they use the **Agent Plugins** screen. Enabling creates the `composio` connection row.
+2. **Sign in.** Call `agent_plugin_connect { pluginId: "composio" }`. It provisions the declared
+   connection, shows the secure browser sign-in card and waits. On `status: "connected"`, continue;
+   on `status: "waiting-for-sign-in"`, wait for the person to return, then call it again once.
+   Say: "Sign in to Composio (free account; sign up there if you have none)." If it refuses because
+   the site is not set up for sign-in from chat, follow the host guidance for signing in elsewhere;
+   do not retry. Never create a second connection or use Bash, curl or a remote workbench to sign in.
+3. **Grant the tools**, see [Grants](#grants). The host guidance says where grants are made and
+   whether a saved grant needs an assistant restart before it takes effect.
+
+Say plainly that steps 1 and 3 need a click from the user. Do not imply you can finish alone.
+
+## Grants
+
+In the host's settings for the `composio` connection, grant these tools:
+
+- `COMPOSIO_SEARCH_TOOLS`, `COMPOSIO_GET_TOOL_SCHEMAS`, `COMPOSIO_MANAGE_CONNECTIONS`,
+  `COMPOSIO_WAIT_FOR_CONNECTIONS`, `COMPOSIO_MULTI_EXECUTE_TOOL`.
+- Where the host asks for a separate write grant (it applies only to a tool that declares it
+  writes), grant it for `COMPOSIO_MULTI_EXECUTE_TOOL` and `COMPOSIO_MANAGE_CONNECTIONS`. Without it
+  the host refuses the tool and it simply never appears.
+
+**Do not grant** `COMPOSIO_REMOTE_WORKBENCH` or `COMPOSIO_REMOTE_BASH_TOOL`. They run code on
+Composio's servers; nothing the user asks for here needs them.
+
+If an `mcp__composio__*` tool you expect is missing, do not invent a reason. Report what the
+host's admissions or refusal notice says, or say you do not know and point the user at the host's
+connection settings.
+
+## Doing a task
+
+1. `COMPOSIO_SEARCH_TOOLS` with the user's goal in plain words.
+2. `COMPOSIO_GET_TOOL_SCHEMAS` for the tool you will use. Never guess argument names.
+3. `COMPOSIO_MANAGE_CONNECTIONS` for that app. If it is not connected, give the user the sign-in
+   link it returns ("Connect your Gmail here"), then `COMPOSIO_WAIT_FOR_CONNECTIONS`. Each app is
+   connected once; it stays connected across sessions.
+4. `COMPOSIO_MULTI_EXECUTE_TOOL`.
+
+**Ask before anything that sends, posts, pays, or deletes** (an email, a Slack message, a payment,
+removing a record): show what will go out and to whom, and run it only after the user says yes.
+Reading (listing emails, events, issues) needs no confirmation.
+
+Report what the tool actually returned. If it failed, say so with its error in one plain sentence.
+
+## When it stops working
+
+- **"is disconnected: its authorization expired or was revoked"**: call `external_mcp_reauth_prompt`
+  for `composio`. After the user signs in again, retry the original call once.
+- **An app's own sign-in expired** (the app tool fails with an auth error): run
+  `COMPOSIO_MANAGE_CONNECTIONS` for that app again and give the user the new link.
+- **The user wants to disconnect an app**: that is done in their Composio account, not on this site.

package/dist/core/identity-namespace.d.ts

@@ -0,0 +1,12 @@
+/** Selects the portable identity key without changing explicit host isolation.
+ * Legacy manifests remain readable only when no namespace was requested and `jini` is absent.
+ * A present malformed extension is left to the identity validator rather than bypassed.
+ * @returns The namespace to pass to the shared identity and metadata readers.
+ * @complexity O(1) time and space; no I/O or manifest mutation.
+ */
+export declare function resolveAgentPluginIdentityNamespace({ value }: {
+    readonly value: unknown;
+}, { identityNamespace }?: {
+    readonly identityNamespace?: string;
+}): string;
+//# sourceMappingURL=identity-namespace.d.ts.map

package/dist/core/identity-namespace.js

@@ -0,0 +1,20 @@
+/** Selects the portable identity key without changing explicit host isolation.
+ * Legacy manifests remain readable only when no namespace was requested and `jini` is absent.
+ * A present malformed extension is left to the identity validator rather than bypassed.
+ * @returns The namespace to pass to the shared identity and metadata readers.
+ * @complexity O(1) time and space; no I/O or manifest mutation.
+ */
+export function resolveAgentPluginIdentityNamespace({ value }, { identityNamespace } = {}) {
+    if (identityNamespace !== undefined)
+        return identityNamespace;
+    if (typeof value !== 'object' || value === null || !('extensions' in value))
+        return 'jini';
+    const extensions = value.extensions;
+    if (typeof extensions !== 'object' || extensions === null || Array.isArray(extensions))
+        return 'jini';
+    if (Object.hasOwn(extensions, 'jini'))
+        return 'jini';
+    // Compatibility only: existing published manifests used this product's extension key.
+    return Object.hasOwn(extensions, 'tovu') ? 'tovu' : 'jini';
+}
+//# sourceMappingURL=identity-namespace.js.map

package/dist/folder-zip-node.js

@@ -126,19 +126,41 @@ function customizeText({ text, edit }) {
     }
     return text.slice(0, index) + edit.newString + text.slice(index + edit.oldString.length);
 }
-/** A fork must not retain its publisher identity or historical aliases and supersession claims. */
+/** Plugin-level history a fork must not inherit: `renamedFrom` lets a package answer for its old
+ * ids (export ownership, saved references) and `supersedes` lets it retire other packages. */
+const HISTORICAL_IDENTITY_CLAIMS = ['renamedFrom', 'supersedes'];
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Every host key, not only the requesting host's: a manifest declares one `extensions` entry per
+ * host, so a fork read later by another host must not keep that host's publisher id or claims. */
+function sanitizeHostIdentities({ extensions, localId }) {
+    for (const extension of Object.values(extensions)) {
+        if (!isPlainObject(extension))
+            continue;
+        if ('id' in extension)
+            extension.id = localId;
+        for (const claim of HISTORICAL_IDENTITY_CLAIMS)
+            delete extension[claim];
+    }
+}
+/** A fork must not retain its publisher identity or historical aliases and supersession claims.
+ * The requesting host always gets a fresh `local/<name>` id, even when the source declared none. */
 function customizeManifest({ text, name, identityNamespace }) {
     const manifest = JSON.parse(text);
     if (!isAgentPluginName({ value: name }) || manifest.name === name) {
         throw new FolderZipError('unreadable', 'Choose a valid new Agent Plugin id different from the source.');
     }
     manifest.name = name;
-    const extension = manifest.extensions?.[identityNamespace];
-    if (extension) {
-        extension.id = `local/${name}`;
-        delete extension.renamedFrom;
-        delete extension.supersedes;
-    }
+    manifest.extensions ??= {};
+    if (!isPlainObject(manifest.extensions))
+        throw new FolderZipError('unreadable', 'plugin.json extensions must be an object.');
+    const localId = `local/${name}`;
+    manifest.extensions[identityNamespace] ??= {};
+    sanitizeHostIdentities({ extensions: manifest.extensions, localId });
+    const host = manifest.extensions[identityNamespace];
+    if (isPlainObject(host))
+        host.id = localId;
     return JSON.stringify(manifest, null, 2) + '\n';
 }
 /**

package/dist/lifecycle/bundled-digests.js

@@ -3,9 +3,10 @@
  * ships as — written by `seed-bundled.ts` on every boot, read by the surfaces that have to pick one
  * installed package for a plugin id.
  *
- * Current install policy (frpid, 2026-10-09): successful publication prunes superseded revisions.
- * The rationale below describes retained legacy stores and interrupted cleanup. This ledger still
- * selects the build's authoritative digest there; the ledger itself never deletes package bytes.
+ * Current install policy (frpid, 2026-10-09): an explicit install, update or replace prunes the
+ * plugin's superseded revisions. Bundled seeding does not (2026-11-02): it cannot tell an operator's
+ * edited or uploaded same-name copy from an old bundled one, so the rationale below applies to every
+ * reseed. This ledger selects the build's authoritative digest; it never deletes package bytes.
  *
  * ---------------------------------------------------------------------------
  * The gap this closes

package/dist/lifecycle/install.d.ts

@@ -86,6 +86,13 @@ export interface InstallAgentPluginOptional {
         readonly plugin: InstalledAgentPlugin;
         readonly publish: () => Promise<InstalledAgentPlugin>;
     }, optional: Record<string, never>) => Promise<InstalledAgentPlugin>;
+    /** Default true: an explicit install, update or replace retires this plugin's other revisions.
+     * Bundled seeding passes false. A revision's digest names the bytes it was published with, not
+     * what is on disk now, and nothing records whether a same-name copy came from an upload, an
+     * operator edit or an older build, so a boot-time seed cannot prove a copy is safe to delete.
+     * The bundled-digests ledger selects the build's digest instead (owner rule 2026-10-29: other
+     * copies are "kept unselected"). */
+    readonly pruneSupersededRevisions?: boolean;
 }
 /** Internal composition; one state/queue instance per injected host context. */
 export declare function createInstallModule(ports: AgentPluginLifecyclePorts): {

package/dist/lifecycle/install.js

@@ -65,7 +65,7 @@ import { readPluginIdentity, assertPluginIdentityAvailable } from "@jini-ai/core
 import { createPersistentStateModule } from "./persistent-state.js";
 import { createAgentPluginUpdateStore, settleAgentPluginUpdateJournal } from "./update-store.js";
 /** Extracted from the host plugin lifecycle. Effects are supplied per host context. */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import path from "node:path";
 import { PackagePathViolation } from "./package-paths.js";
@@ -223,7 +223,7 @@ function buildModule(ports) {
                     await persistentState.assertOwnedPath({ workspaceRoot: workspaceLayout.root, entryPath: path.relative(workspaceLayout.root, directory) });
                     await mkdir(directory, { recursive: true, mode: 0o700 });
                 }
-                if (await isRealDirectory(finalRoot)) {
+                if (await reuseOrSetAsideExisting({ packagesDir, finalRoot, extractionRoot, pluginId })) {
                     publishedPlugin = await indexInstalledRoot(finalRoot, digest);
                     return publishedPlugin;
                 }
@@ -241,7 +241,7 @@ function buildModule(ports) {
                     // The journal lives under the layout this install was given, the one it publishes into.
                     await settleAgentPluginUpdateJournal({ store: createAgentPluginUpdateStore({ ports: { ...ports, layout }, workspaceId, pluginId: indexed.pluginId }) });
                     const installed = await (optional.publishGuard ? optional.publishGuard({ plugin: indexed, publish: publishPackage }, {}) : publishPackage());
-                    if (publishedPlugin)
+                    if (publishedPlugin && optional.pruneSupersededRevisions !== false)
                         await pruneSupersededRevisions({ workspaceRoot: workspaceLayout.root, installed: publishedPlugin });
                     return installed;
                 } });
@@ -256,6 +256,48 @@ function buildModule(ports) {
             await rm(transactionRoot, { recursive: true, force: true });
         }
     }
+    /**
+     * Whether `finalRoot` already holds exactly the verified bytes in `extractionRoot`, so the install
+     * can deduplicate. A digest directory's NAME is only a claim: an operator with shell access can
+     * edit it in place ({@link freezeTree} is not a security boundary), and the ledger and the
+     * contribution trust gate check digest identity only — so reuse without comparing bytes would
+     * keep edited executable modules selected as shipped code. A mismatched copy is renamed aside
+     * under a non-digest name (kept for the operator, never indexed or selected) and `false` tells the
+     * caller to publish the pristine bytes in its place.
+     * @complexity O(f + b) in the file count and bytes of the two trees.
+     */
+    async function reuseOrSetAsideExisting({ packagesDir, finalRoot, extractionRoot, pluginId }) {
+        if (!(await isRealDirectory(finalRoot)))
+            return false;
+        if (await sameTree(finalRoot, extractionRoot))
+            return true;
+        const aside = path.join(packagesDir, `.modified-${path.basename(finalRoot).slice(0, 12)}-${randomUUID()}`);
+        await createUninstallModule(ports).stageForRemoval(packagesDir, finalRoot, { quarantined: aside });
+        ports.onEvent?.({ event: 'agent-plugin-modified-revision-preserved', message: `Plugin '${pluginId}': an installed revision no longer matched its digest; it was kept at '${aside}' and the verified bytes were reinstalled.` });
+        return false;
+    }
+    /** Same entry names, kinds and file bytes, recursively. @complexity O(f + b). */
+    async function sameTree(left, right) {
+        const [leftEntries, rightEntries] = await Promise.all([readdir(left, { withFileTypes: true }), readdir(right, { withFileTypes: true })]);
+        if (leftEntries.length !== rightEntries.length)
+            return false;
+        const rightByName = new Map(rightEntries.map(entry => [entry.name, entry]));
+        for (const entry of leftEntries) {
+            const other = rightByName.get(entry.name);
+            if (!other || entry.isDirectory() !== other.isDirectory() || entry.isFile() !== other.isFile())
+                return false;
+            const [leftPath, rightPath] = [path.join(left, entry.name), path.join(right, entry.name)];
+            if (!(await (entry.isDirectory() ? sameTree(leftPath, rightPath) : sameFile(leftPath, rightPath))))
+                return false;
+        }
+        return true;
+    }
+    /** Size first, so a grown file is rejected without reading it. */
+    async function sameFile(left, right) {
+        if ((await stat(left)).size !== (await stat(right)).size)
+            return false;
+        return Buffer.from(await readFile(left)).equals(Buffer.from(await readFile(right)));
+    }
     /** The `(target '...')` suffix on the symlink-rejection message, or nothing when the entry carries
    * no `linkTarget` at all — split out purely to keep that `&&`/ternary pair out of
    * {@link extractOneEntry}'s own branch count. */

package/dist/lifecycle/manifest.d.ts

@@ -37,7 +37,7 @@ export type ParseAgentPluginManifestResult = {
 };
 /**
  * Validates an already-`JSON.parse`d `plugin.json` value against the 1.0.0/1.1.0 grammar.
- * Hosts inject identityNamespace; the default retains the existing plugin extension format.
+ * Hosts inject identityNamespace; the default is `jini`, with a legacy-key fallback.
  *
  * @throws Nothing — every failure is reported via the returned `errors`, matching this codebase's
  * own convention for expected validation outcomes (`plugin-runtime/manifest.ts`,
@@ -46,7 +46,7 @@ export type ParseAgentPluginManifestResult = {
  */
 export declare function parseAgentPluginManifest({ value }: {
     readonly value: unknown;
-}, { identityNamespace }?: {
+}, optional?: {
     readonly identityNamespace?: string;
 }): ParseAgentPluginManifestResult;
 /**