@livx.cc/appwrap 0.55.0 → 0.57.0

package/src/desktop.ts

@@ -1,300 +0,0 @@
-/**
- * Pure desktop (Tauri-chassis) config derivation + stamp transforms — side-effect-free (no fs, no
- * config I/O) so they unit-test against fixtures, same standard as derive.ts. The CLI wires these into
- * the `dev|build desktop` lane: `deriveDesktopConfig` → the JSON the Rust shell reads (`shell_config.json`,
- * embedded at compile time), `stampTauriConf` → the generated `tauri.conf.json`.
- */
-import type { AppwrapConfig } from './config';
-
-/** The resolved shell config the Rust desktop chassis reads (mirrors the `ShellConfig` struct in
- * runtime-desktop/src-tauri/src/main.rs — keys are camelCase; Rust deserializes with rename_all). */
-export interface DesktopShellConfig {
-  appId: string;
-  name: string;
-  version: string;
-  title: string;
-  width: number;
-  height: number;
-  /** App's own deep-link scheme (e.g. "hellowrap"); '' when none — the Rust shell skips the
-   * `<scheme>://` loopback so an empty scheme can't spuriously match every url. */
-  urlScheme: string;
-  identifier: string;
-  /** Persist + restore window size/position across launches (default true). When false the Rust
-   * shell skips registering tauri-plugin-window-state, so the configured width/height always apply. */
-  restoreWindowState: boolean;
-  /** Append `prompt=select_account` to Google `signInWithPopup` OAuth URLs (default false) so a
-   * remembered Google session doesn't auto-sign — the user picks an account per instance. */
-  googleAccountPicker: boolean;
-  /** Launch on login via tauri-plugin-autostart (macOS LaunchAgent). Default false. The Rust shell
-   * enables the login item when true and explicitly disables it when false (so turning this off
-   * removes the item on the next launch). Works for the adhoc-signed .app (no Developer ID needed). */
-  autostart: boolean;
-  /** Path to the app's custom-handlers TS file for the Bun sidecar; '' when none (the Rust shell
-   * skips spawning the sidecar entirely). `deriveDesktopConfig` carries it through AS AUTHORED
-   * (relative to the app root); the CLI resolves it to an ABSOLUTE path before stamping
-   * `shell_config.json` (see `regenerateDesktop`), since the shell binary runs from elsewhere. */
-  handlers: string;
-  /** True when the CLI resolved a real signing identity + a macOS provisioning profile for this
-   * build (the .app will carry the aps-environment entitlement). Stamped by `build desktop` —
-   * never authored; gates the Rust shell's push capability + push.register. */
-  pushSigned: boolean;
-  /** Absolute path to the Bun binary the sidecar should be spawned with; '' until the CLI stamps it
-   * (from `process.execPath` — the exact runtime the app was built with). Needed because a
-   * GUI-launched .app inherits the launchd PATH (/usr/bin:/bin:...) which does NOT contain
-   * ~/.bun/bin, so a bare `bun` spawn fails. The Rust shell falls back to `bun` when this is
-   * missing/nonexistent. */
-  handlersRuntime: string;
-  /** Absolute path to the bun-built multiplexed plugin-host bundle (`src/plugin/host.ts`); '' when no
-   * plugins are configured (the Rust shell skips spawning the host). Stamped by `regeneratePlugins`. */
-  pluginHost: string;
-  /** Resolved + bun-built plugins the host loads at boot. Empty when none. Stamped by `regeneratePlugins`. */
-  plugins: { bundleId: string; attachTo?: string; bundlePath: string }[];
-  /** True when `modules` includes 'media' → the .app carries an NSMicrophoneUsageDescription so
-   * `getUserMedia` (voice mode) can pass macOS TCC. The WebKit-layer grant (popup_mac) is
-   * unconditional; this only adds the OS usage string an app that actually uses the mic needs. */
-  microphone: boolean;
-  /** Local-server mode. When present the Rust shell boots `command` (+`args`) in a background thread,
-   * polls `http://localhost:<port><healthPath>` until it answers, then navigates the window there
-   * (instead of the bundled dist); it kills the child on window-close. Absent → bundled-PWA load.
-   * `command`/`cwd` are resolved to ABSOLUTE by the CLI (see `regenerateDesktop`) because a
-   * GUI-launched .app has the minimal launchd PATH (no ~/.bun/bin). Empty when the app isn't a
-   * local-server app. */
-  server?: {
-    command: string;
-    args: string[];
-    cwd: string;
-    /** Stdout marker → capture the URL the server prints (dynamic port). '' when using fixed `port`. */
-    urlMarker: string;
-    /** Fixed port (used only when `urlMarker` is ''). 0 when unused. */
-    port: number;
-    https: boolean;
-    healthPath: string;
-    readyTimeoutMs: number;
-    /** PATH the child is spawned with — the CLI stamps its own (build-time) PATH so a GUI launch can
-     * still resolve neighbouring tools (bun, node) the launchd PATH omits. */
-    path: string;
-  };
-}
-
-/** Resolve the desktop shell config from an appwrap config: identity + `urlScheme` come from the
- * top-level fields, the window specifics from the `desktop` sub-shape (with lean defaults). */
-export function deriveDesktopConfig(cfg: AppwrapConfig): DesktopShellConfig {
-  const d = cfg.desktop ?? {};
-  return {
-    appId: cfg.id,
-    name: cfg.name,
-    version: cfg.version,
-    title: d.title ?? cfg.name,
-    width: d.width ?? 430,
-    height: d.height ?? 800,
-    urlScheme: cfg.urlScheme ?? '',
-    identifier: d.identifier ?? `${cfg.id}.desktop`,
-    restoreWindowState: d.restoreWindowState ?? true,
-    googleAccountPicker: d.googleAccountPicker ?? false,
-    autostart: d.autostart ?? false,
-    handlers: d.handlers ?? '',
-    pushSigned: false, // stamped by the CLI when a signing identity + macOS profile resolve — see buildDesktop
-    handlersRuntime: '', // stamped by the CLI (process.execPath) when handlers is set — see regenerateDesktop
-    pluginHost: '', // stamped by regeneratePlugins (bun-built host bundle) when plugins are configured
-    plugins: [], // stamped by regeneratePlugins (resolved + bun-built plugin bundles)
-    microphone: (cfg.modules ?? []).includes('media'),
-    // `command`/`cwd`/`path` are resolved to absolute by the CLI (regenerateDesktop); carried as authored here.
-    server: d.server
-      ? {
-          command: d.server.command,
-          args: d.server.args ?? [],
-          cwd: d.server.cwd ?? '',
-          urlMarker: d.server.urlMarker ?? '',
-          port: d.server.port ?? 0,
-          https: d.server.https ?? false,
-          healthPath: d.server.healthPath ?? '/',
-          readyTimeoutMs: d.server.readyTimeoutMs ?? 120_000,
-          path: '',
-        }
-      : undefined,
-  };
-}
-
-/** Stamp a `tauri.conf.json` template object from the resolved shell config + the (src-tauri-relative)
- * frontendDist. Pure: takes the parsed template, returns the stamped object (the CLI reads/writes). */
-export function stampTauriConf(
-  template: Record<string, unknown>,
-  shell: DesktopShellConfig,
-  frontendDist: string,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = {
-    ...template,
-    productName: shell.name,
-    version: shell.version,
-    identifier: shell.identifier,
-    build: { ...(template.build as Record<string, unknown> | undefined), frontendDist },
-  };
-  // tauri-plugin-deep-link needs its schemes declared for the desktop lane (used by the plugin's
-  // registration + the tauri bundler). We assemble the .app ourselves, but keep this in sync so the
-  // plugin config is honest. Omit entirely when the app declares no scheme.
-  if (shell.urlScheme) {
-    const plugins = { ...(template.plugins as Record<string, unknown> | undefined) };
-    plugins['deep-link'] = { desktop: { schemes: [shell.urlScheme] } };
-    out.plugins = plugins;
-  }
-  return out;
-}
-
-const xmlEscape = (s: string): string =>
-  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-
-/**
- * Generate the macOS `Contents/Info.plist` for the assembled `.app`. This is what registers the app's
- * `urlScheme` with LaunchServices (CFBundleURLTypes) so a `<scheme>://…` open reaches the running shell
- * via tauri-plugin-deep-link. `executable` = the copied Mach-O name (CFBundleExecutable must match the
- * file in `Contents/MacOS/`); `iconFile` = the `.icns` basename when an icon was generated (else omit);
- * `iconName` = the asset-catalog icon name (e.g. `AppIcon`) when an `Assets.car` was compiled — macOS 26
- * (Tahoe) resolves the Finder/Dock icon via `CFBundleIconName`+`Assets.car`, not the legacy `.icns`.
- */
-export function buildInfoPlist(
-  shell: DesktopShellConfig,
-  executable: string,
-  iconFile?: string,
-  iconName?: string,
-): string {
-  const urlTypes = shell.urlScheme
-    ? `
-	<key>CFBundleURLTypes</key>
-	<array>
-		<dict>
-			<key>CFBundleURLName</key>
-			<string>${xmlEscape(shell.identifier)}</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>${xmlEscape(shell.urlScheme)}</string>
-			</array>
-		</dict>
-	</array>`
-    : '';
-  const icon = iconFile
-    ? `
-	<key>CFBundleIconFile</key>
-	<string>${xmlEscape(iconFile)}</string>`
-    : '';
-  const iconAsset = iconName
-    ? `
-	<key>CFBundleIconName</key>
-	<string>${xmlEscape(iconName)}</string>`
-    : '';
-  // NSMicrophoneUsageDescription: required for getUserMedia (voice mode) to pass macOS TCC — without
-  // it the OS silently denies mic access (no prompt). Added only when the app declares the `media` module.
-  const mic = shell.microphone
-    ? `
-	<key>NSMicrophoneUsageDescription</key>
-	<string>${xmlEscape(shell.name)} uses the microphone for voice input.</string>`
-    : '';
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleName</key>
-	<string>${xmlEscape(shell.name)}</string>
-	<key>CFBundleDisplayName</key>
-	<string>${xmlEscape(shell.name)}</string>
-	<key>CFBundleIdentifier</key>
-	<string>${xmlEscape(shell.identifier)}</string>
-	<key>CFBundleVersion</key>
-	<string>${xmlEscape(shell.version)}</string>
-	<key>CFBundleShortVersionString</key>
-	<string>${xmlEscape(shell.version)}</string>
-	<key>CFBundleExecutable</key>
-	<string>${xmlEscape(executable)}</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>NSHighResolutionCapable</key>
-	<true/>${icon}${iconAsset}${mic}${urlTypes}
-</dict>
-</plist>
-`;
-}
-
-/**
- * Generate the macOS code-signing entitlements plist for the signed desktop lane. macOS uses the
- * PREFIXED keys (`com.apple.application-identifier`, `com.apple.developer.aps-environment`) — the
- * bare iOS spellings (`application-identifier`, `aps-environment`) are NOT valid on macOS. The
- * restricted entitlements here (app identifier + aps) only launch when backed by an embedded
- * provisioning profile, so the caller must only include `apsEnvironment` when it embeds one.
- * `apsEnvironment`: 'development' for Apple Development signing, 'production' for Developer ID.
- */
-/** A macOS provisioning profile's decoded payload (the CMS-decoded `security cms -D` plist). */
-export interface MacProfileInfo {
-  teamId?: string;
-  appId?: string;
-  expiration?: string;
-  /** The profile's OWN `com.apple.developer.aps-environment` entitlement (source of truth for the
-   * app entitlement — a cert-derived guess can claim `production` the profile doesn't back → launch kill). */
-  apsEnvironment?: string;
-  /** Base64 DER of each embedded DeveloperCertificate (whitespace-stripped). */
-  certificates: string[];
-}
-
-/** Parse a CMS-decoded `.provisionprofile` plist (XML). Pure — unit-tested. */
-export function parseMacProfile(plist: string): MacProfileInfo {
-  const teamId = plist.match(/<key>TeamIdentifier<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1];
-  const appId = plist.match(/<key>com\.apple\.application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1];
-  const expiration = plist.match(/<key>ExpirationDate<\/key>\s*<date>([^<]+)<\/date>/)?.[1];
-  const apsEnvironment = plist.match(/<key>com\.apple\.developer\.aps-environment<\/key>\s*<string>([^<]+)<\/string>/)?.[1];
-  const certBlock = plist.match(/<key>DeveloperCertificates<\/key>\s*<array>([\s\S]*?)<\/array>/)?.[1] ?? '';
-  const certificates = [...certBlock.matchAll(/<data>([\s\S]*?)<\/data>/g)].map((m) => m[1].replace(/\s+/g, ''));
-  return { teamId, appId, expiration, apsEnvironment, certificates };
-}
-
-export function buildMacEntitlements(opts: {
-  teamId: string;
-  bundleId: string;
-  apsEnvironment?: 'development' | 'production';
-}): string {
-  const aps = opts.apsEnvironment
-    ? `
-	<key>com.apple.developer.aps-environment</key>
-	<string>${xmlEscape(opts.apsEnvironment)}</string>`
-    : '';
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.application-identifier</key>
-	<string>${xmlEscape(`${opts.teamId}.${opts.bundleId}`)}</string>
-	<key>com.apple.developer.team-identifier</key>
-	<string>${xmlEscape(opts.teamId)}</string>${aps}
-</dict>
-</plist>
-`;
-}
-
-/** Result of locating a spawnable `cargo` for the desktop lane. `bin` is what to invoke (a bare
- * `cargo` when it's already on PATH, else the absolute `<home>/.cargo/bin/cargo`); `path` is the
- * (possibly augmented) PATH to hand the child so rustc/rustup neighbours resolve too. */
-export interface CargoResolution {
-  found: boolean;
-  augmented: boolean;
-  bin: string;
-  path: string;
-}
-
-/** Pure PATH resolution for `cargo` (side-effect-free — fs access is injected via `hasCargo`), so it
- * unit-tests against fixtures. If `cargo` isn't on any current PATH entry but `<home>/.cargo/bin/cargo`
- * exists (rustup's default location, commonly missing from a GUI/login shell's PATH), append that dir
- * and invoke the binary by absolute path. Returns `found:false` when it's genuinely nowhere — the
- * caller turns that into an actionable "install rust via rustup / source $HOME/.cargo/env" message
- * instead of a raw spawn ENOENT. */
-export function resolveCargoPath(opts: {
-  path: string;
-  home: string;
-  delimiter: string;
-  hasCargo: (dir: string) => boolean;
-}): CargoResolution {
-  const { path, home, delimiter, hasCargo } = opts;
-  const dirs = path.split(delimiter).filter(Boolean);
-  if (dirs.some(hasCargo)) return { found: true, augmented: false, bin: 'cargo', path };
-  const cargoBin = home ? `${home}/.cargo/bin` : '';
-  if (cargoBin && hasCargo(cargoBin)) {
-    return { found: true, augmented: true, bin: `${cargoBin}/cargo`, path: [...dirs, cargoBin].join(delimiter) };
-  }
-  return { found: false, augmented: false, bin: 'cargo', path };
-}

package/src/plugin/host.ts

@@ -1,242 +0,0 @@
-/**
- * Multiplexed plugin host — ONE Bun process hosting all configured plugins (Elya decision: multiplexed
- * for first-party). Generalizes `sidecar.rs`'s one-way NDJSON RPC to a BIDIRECTIONAL, per-window model.
- *
- * Boot: `bun host.ts --socket <path> --plugins <json>` — spawned by the Rust shell (plugin_host.rs).
- * It connects to the shell's Unix domain socket, `import()`s each plugin bundle, and:
- *   - announces `ready` (per-plugin handler methods, for the sidecar-compatible RPC path),
- *   - on a `window-created` event, fans out to each plugin whose `attachTo` matches → `onWindow(ctx)`,
- *   - marshals every `WindowCtx` call into an `op` envelope and awaits its `result`,
- *   - routes page `message` events to that window's `onMessage` subscribers,
- *   - answers `call` (handler RPC) exactly like the sidecar.
- *
- * The socket + framing live only in `main()`; `PluginHost` is transport-decoupled (a `send` sink) so
- * the routing/attach logic is unit-testable with in-memory sinks (mirrors `runHandlers`).
- */
-import type { Dispose, Envelope, PluginDef, StampedPlugin, WindowCtx, WindowIdentity } from './types';
-
-/** Reject an outstanding op after this long if the shell never sends its `result` (a native callback
- * that never fires would otherwise leak the plugin's pending promise forever). Mirrors the Rust
- * shell's CALL_TIMEOUT (plugin_host.rs, 30s) for the reverse op direction. */
-const OP_TIMEOUT_MS = 30_000;
-
-/** Resolve `attachTo` against a window identity. Config-string override wins over the def's own scope. */
-export function matchScope(def: PluginDef, override: string | undefined, win: WindowIdentity): boolean {
-  const scope = override ?? def.attachTo;
-  if (scope == null) return false; // handlers-only plugin — no per-window attach
-  if (typeof scope === 'function') return scope(win);
-  if (scope === 'all') return true;
-  if (scope === 'main') return win.id === 'main';
-  // 'browser' is a CATEGORY, not a literal id: the browser sub-windows (browser_tab.rs) whose
-  // controlled webview is labeled `<win_id>-view`. This is the safe default for remote-control.
-  // (Phase A does NOT yet emit window-created for sub-windows — browser_tab keeps its core bridging —
-  // so this matches once that emission lands in Phase B, or any window explicitly labeled `*-view`.)
-  if (scope === 'browser') return win.id.endsWith('-view');
-  return scope === win.id;
-}
-
-interface Loaded {
-  entry: StampedPlugin;
-  def: PluginDef;
-}
-
-/** Per-(plugin,window) attach state: message subscribers + the onWindow disposer. */
-interface Attach {
-  subs: Set<(msg: string) => void>;
-  dispose?: Dispose;
-}
-
-export class PluginHost {
-  private pluginsRegistry: { pluginId: string; methods: string[] }[];
-  private ops = new Map<string, { resolve: (v: unknown) => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> }>();
-  private attaches = new Map<string, Attach>(); // key: `${pluginId}\0${windowId}`
-  private opSeq = 0;
-
-  constructor(
-    private loaded: Loaded[],
-    private send: (env: Envelope) => void,
-  ) {
-    this.pluginsRegistry = loaded.map((l) => ({
-      pluginId: l.def.name,
-      methods: Object.keys(l.def.handlers ?? {}),
-    }));
-  }
-
-  /** Announce handler surfaces so the shell can route `call`s (the sidecar-compatible path). */
-  announceReady(): void {
-    this.send({ kind: 'ready', plugins: this.pluginsRegistry });
-  }
-
-  private key(pluginId: string, windowId: string): string {
-    return `${pluginId}\0${windowId}`;
-  }
-
-  /** Build the curated facade for one (plugin, window). Every method → an `op` awaiting a `result`. */
-  private makeCtx(pluginId: string, win: WindowIdentity): WindowCtx {
-    const call = <T>(method: string, params?: unknown): Promise<T> =>
-      new Promise<T>((resolve, reject) => {
-        const id = `op-${pluginId}-${++this.opSeq}`;
-        const timer = setTimeout(() => {
-          if (this.ops.delete(id)) reject(new Error(`op ${method} (${id}) timed out after ${OP_TIMEOUT_MS}ms`));
-        }, OP_TIMEOUT_MS);
-        // Don't keep the host process alive just for a pending op timer.
-        (timer as { unref?: () => void }).unref?.();
-        this.ops.set(id, { resolve: resolve as (v: unknown) => void, reject, timer });
-        this.send({ kind: 'op', id, pluginId, windowId: win.id, method, params });
-      });
-    const k = this.key(pluginId, win.id);
-    return {
-      id: win.id,
-      profileId: win.profileId,
-      url: () => call<string>('url'),
-      injectScript: (js) => call<void>('injectScript', { js }),
-      eval: <T = unknown>(js: string) => call<T>('eval', { js }),
-      navigate: (url) => call<void>('navigate', { url }),
-      back: () => call<void>('back'),
-      forward: () => call<void>('forward'),
-      reload: () => call<void>('reload'),
-      snapshot: async () => new Uint8Array(await call<number[]>('snapshot')),
-      close: () => call<void>('close'),
-      setInspectable: (on) => call<void>('setInspectable', { on }),
-      postMessage: (msg) => call<void>('postMessage', { msg }),
-      onMessage: (cb) => {
-        const a = this.attaches.get(k);
-        a?.subs.add(cb);
-        // First subscriber installs the native message handler on this window.
-        if (a && a.subs.size === 1) void call<void>('subscribeMessages');
-        return () => {
-          this.attaches.get(k)?.subs.delete(cb);
-        };
-      },
-    };
-  }
-
-  /** Dispatch one inbound envelope from the shell. */
-  async handle(env: Envelope): Promise<void> {
-    switch (env.kind) {
-      case 'result': {
-        const p = this.ops.get(env.id);
-        if (!p) return;
-        this.ops.delete(env.id);
-        clearTimeout(p.timer);
-        if (env.ok) p.resolve(env.data);
-        else p.reject(new Error(env.error?.message ?? 'op failed'));
-        return;
-      }
-      case 'call': {
-        // Handler RPC — sidecar-compatible. Method is namespaced; find the owning plugin.
-        const owner = this.loaded.find((l) => l.def.handlers && env.method in l.def.handlers);
-        const fn = owner?.def.handlers?.[env.method];
-        if (!fn) {
-          this.send({ kind: 'result', id: env.id, ok: false, error: { code: 'UNSUPPORTED', message: `${env.method} not implemented` } });
-          return;
-        }
-        try {
-          const data = await fn(env.params);
-          this.send({ kind: 'result', id: env.id, ok: true, data: data ?? null });
-        } catch (e) {
-          this.send({ kind: 'result', id: env.id, ok: false, error: { code: 'NATIVE_ERROR', message: e instanceof Error ? e.message : String(e) } });
-        }
-        return;
-      }
-      case 'event': {
-        const win: WindowIdentity = { id: env.windowId, profileId: env.params?.profileId };
-        if (env.method === 'window-created') {
-          for (const l of this.loaded) {
-            if (!matchScope(l.def, l.entry.attachTo, win)) continue;
-            const k = this.key(l.def.name, win.id);
-            if (this.attaches.has(k)) continue; // already attached
-            const attach: Attach = { subs: new Set() };
-            this.attaches.set(k, attach);
-            try {
-              const d = await l.def.onWindow?.(this.makeCtx(l.def.name, win));
-              if (typeof d === 'function') attach.dispose = d;
-            } catch (e) {
-              console.error(`[plugin-host] ${l.def.name}.onWindow(${win.id}) threw:`, e);
-            }
-          }
-        } else if (env.method === 'message') {
-          const raw = String(env.params?.raw ?? '');
-          for (const l of this.loaded) {
-            const a = this.attaches.get(this.key(l.def.name, win.id));
-            a?.subs.forEach((cb) => {
-              try { cb(raw); } catch (e) { console.error(`[plugin-host] ${l.def.name} onMessage threw:`, e); }
-            });
-          }
-        } else if (env.method === 'window-closed') {
-          for (const l of this.loaded) {
-            const k = this.key(l.def.name, win.id);
-            const a = this.attaches.get(k);
-            if (!a) continue;
-            try { a.dispose?.(); l.def.onClose?.(win); } catch (e) { console.error(`[plugin-host] ${l.def.name} onClose threw:`, e); }
-            this.attaches.delete(k);
-          }
-        }
-        return;
-      }
-      default:
-        return;
-    }
-  }
-}
-
-/** Load each stamped plugin bundle → its default-exported def. */
-async function loadPlugins(entries: StampedPlugin[]): Promise<Loaded[]> {
-  const out: Loaded[] = [];
-  for (const entry of entries) {
-    try {
-      const mod = await import(entry.bundlePath);
-      const def: PluginDef | undefined = mod.default ?? mod.plugin;
-      if (!def?.name) {
-        console.error(`[plugin-host] ${entry.bundlePath} has no default-exported plugin def — skipping`);
-        continue;
-      }
-      out.push({ entry, def });
-    } catch (e) {
-      console.error(`[plugin-host] failed to load ${entry.bundlePath}:`, e);
-    }
-  }
-  return out;
-}
-
-/** CLI entrypoint: wire the Unix-socket transport around a `PluginHost`. */
-async function main(): Promise<void> {
-  const args = process.argv.slice(2);
-  const socketPath = args[args.indexOf('--socket') + 1];
-  const pluginsArg = args[args.indexOf('--plugins') + 1];
-  if (!socketPath || !pluginsArg) {
-    console.error('[plugin-host] missing --socket or --plugins');
-    process.exit(1);
-  }
-  const entries: StampedPlugin[] = JSON.parse(pluginsArg);
-  const loaded = await loadPlugins(entries);
-
-  const net = await import('node:net');
-  const sock = net.connect(socketPath);
-  let host: PluginHost;
-  const sendLine = (env: Envelope) => sock.write(JSON.stringify(env) + '\n');
-
-  sock.on('connect', () => {
-    host = new PluginHost(loaded, sendLine);
-    host.announceReady();
-  });
-  let buf = '';
-  sock.setEncoding('utf8');
-  sock.on('data', (chunk: string) => {
-    buf += chunk;
-    let nl: number;
-    while ((nl = buf.indexOf('\n')) >= 0) {
-      const line = buf.slice(0, nl).trim();
-      buf = buf.slice(nl + 1);
-      if (line) {
-        try { void host.handle(JSON.parse(line)); }
-        catch (e) { console.error('[plugin-host] bad line:', e); }
-      }
-    }
-  });
-  sock.on('error', (e: unknown) => console.error('[plugin-host] socket error:', e));
-  sock.on('close', () => process.exit(0));
-}
-
-// Run only as an entrypoint (not when imported by tests).
-if (import.meta.main) void main();