@moretea-labs/forge 1.6.0 → 1.7.0

package/src/runtime/plugins/desktop-operator-registration.ts

@@ -68,7 +68,7 @@ function desktopOperatorActions(): AssistantPluginActionDescriptor[] {
     {
       actionId: 'desktop_session_open',
       title: 'Open desktop session',
-      description: 'Launch or locate one application in the background and create a bounded interaction session without stealing foreground focus.',
+      description: 'Launch or locate one application and create a bounded interaction session; stays in the background by default, or explicitly activates the target when activate=true.',
       readOnly: false,
       risk: 'workspace_write',
       confirmation: 'authorization',
@@ -83,6 +83,7 @@ function desktopOperatorActions(): AssistantPluginActionDescriptor[] {
           bundle_id: { type: 'string' },
           app_name: { type: 'string' },
           launch: { type: 'boolean' },
+          activate: { type: 'boolean', description: 'Explicitly activate the target application after launch/lookup. Defaults to false.' },
         },
         anyOf: [{ required: ['bundle_id'] }, { required: ['app_name'] }],
         additionalProperties: false,
@@ -132,6 +133,11 @@ function desktopOperatorActions(): AssistantPluginActionDescriptor[] {
         properties: {
           interaction_id: { type: 'string' },
           selector: SELECTOR_SCHEMA,
+          semantic_action: {
+            type: 'string',
+            enum: ['press', 'show_menu', 'pick', 'open', 'confirm'],
+            description: 'Bounded Accessibility action supported by the trusted Desktop Operator provider; defaults to press when omitted.',
+          },
         },
         required: ['interaction_id', 'selector'],
         additionalProperties: false,
@@ -404,7 +410,7 @@ export function createDesktopOperatorRegistrationInput(
       { capabilityId: 'desktop.permissions', title: 'Desktop permissions', description: 'Request the official macOS permissions required by Desktop Operator capabilities.', scopes: ['desktop.permissions'], actions: ['desktop_permissions_request'] },
       { capabilityId: 'desktop.session', title: 'Desktop sessions', description: 'Create and close application interaction sessions.', scopes: ['desktop.session'], actions: ['desktop_session_open', 'desktop_session_close'] },
       { capabilityId: 'desktop.observe', title: 'Desktop observation', description: 'Read bounded Accessibility and window state.', scopes: ['desktop.observe'], actions: ['desktop_observe'] },
-      { capabilityId: 'desktop.interact', title: 'Desktop interaction', description: 'Press, type, send keys, and open URLs.', scopes: ['desktop.interact'], actions: ['desktop_press', 'desktop_type_text', 'desktop_key', 'desktop_open_url'] },
+      { capabilityId: 'desktop.interact', title: 'Desktop interaction', description: 'Press controls, type text, send keys, and open URLs.', scopes: ['desktop.interact'], actions: ['desktop_press', 'desktop_type_text', 'desktop_key', 'desktop_open_url'] },
       { capabilityId: 'desktop.capture', title: 'Desktop capture', description: 'Capture authorized screenshots.', scopes: ['desktop.capture'], actions: ['desktop_screenshot'] },
       { capabilityId: 'desktop.clipboard', title: 'Desktop clipboard', description: 'Read or replace plain-text clipboard content and issue explicit copy/paste in a bound session.', scopes: ['desktop.clipboard'], actions: ['desktop_clipboard_read', 'desktop_clipboard_write', 'desktop_copy', 'desktop_paste'] },
       { capabilityId: 'desktop.batch', title: 'Desktop batch', description: 'Run bounded desktop action batches.', scopes: ['desktop.batch'], actions: ['desktop_batch'] },

package/src/runtime/plugins/external-adapter.ts

@@ -1,9 +1,10 @@
+import { createHash } from 'crypto';
 import { AssistantPluginError } from './errors';
 import { getExternalPluginRegistration, listExternalPluginRegistrations, type ExternalPluginRegistration } from './external-registration';
 import { callExternalUnixSocket, probeExternalUnixSocketSync, type ExternalUnixSocketCallOptions } from './external-unix-socket';
 import { executeManagedPluginProcess, executeManagedPluginProcessSync, type ManagedPluginProcessSpec } from './managed-process-adapter';
-import { restartVerifiedUserLaunchAgent, startVerifiedUserLaunchAgent, stopVerifiedUserLaunchAgent } from './local-system-adapter';
-import type { AssistantPluginActionDescriptor, AssistantPluginAdapter, AssistantPluginCapability, AssistantPluginHealth, AssistantPluginManifest, AssistantPluginPermissionScope } from './types';
+import { activateAndVerifyFrontmostApplication, restartVerifiedUserLaunchAgent, startVerifiedUserLaunchAgent, stopVerifiedUserLaunchAgent } from './local-system-adapter';
+import type { AssistantPluginActionDescriptor, AssistantPluginAdapter, AssistantPluginAuthorizationContext, AssistantPluginCapability, AssistantPluginHealth, AssistantPluginManifest, AssistantPluginPermissionScope } from './types';
 
 interface ProviderManifest {
   id: string;
@@ -31,6 +32,7 @@ export interface ExternalPluginAdapterDependencies {
   startVerifiedUserLaunchAgent?: (label: unknown, expectedProgram: unknown) => Record<string, unknown>;
   stopVerifiedUserLaunchAgent?: (label: unknown, expectedProgram: unknown) => Record<string, unknown>;
   restartVerifiedUserLaunchAgent?: (label: unknown, expectedProgram: unknown) => Record<string, unknown>;
+  activateAndVerifyFrontmostApplication?: typeof activateAndVerifyFrontmostApplication;
   now?: () => Date;
 }
 
@@ -59,7 +61,10 @@ function parseProviderManifest(value: Record<string, unknown>, registration: Ext
   if (manifest.protocolVersion !== registration.protocolVersion) throw providerError('EXTERNAL_PLUGIN_PROTOCOL_MISMATCH', `Expected provider protocol ${registration.protocolVersion}, received ${manifest.protocolVersion || 'unknown'}.`);
   if (manifest.scope !== registration.scope) throw providerError('EXTERNAL_PLUGIN_SCOPE_MISMATCH', `Expected provider scope ${registration.scope}, received ${manifest.scope || 'unknown'}.`);
   if (manifest.provider !== registration.provider) throw providerError('EXTERNAL_PLUGIN_PROVIDER_MISMATCH', `Expected provider ${registration.provider}, received ${manifest.provider || 'unknown'}.`);
-  const missingActions = registration.actions.map((action) => action.actionId).filter((actionId) => !manifest.actions.includes(actionId));
+  const missingActions = registration.actions
+    .map((action) => action.actionId)
+    .filter((actionId) => !(registration.pluginId === 'desktop_operator' && ['desktop_pointer_click', 'desktop_foreground_pointer_click'].includes(actionId)))
+    .filter((actionId) => !manifest.actions.includes(actionId));
   if (missingActions.length > 0) throw providerError('EXTERNAL_PLUGIN_ACTION_MISMATCH', `Provider is missing registered actions: ${missingActions.join(', ')}.`);
   return manifest;
 }
@@ -189,6 +194,225 @@ async function callProvider(
   });
 }
 
+function externalProviderAuthorizationContext(registration: ExternalPluginRegistration): AssistantPluginAuthorizationContext {
+  return {
+    target: {
+      kind: 'external-provider',
+      id: registration.pluginId,
+      identityFingerprint: registration.registrationFingerprint,
+    },
+    expiresInMinutes: 30 * 24 * 60,
+  };
+}
+
+function desktopApplicationAuthorizationContext(
+  registration: ExternalPluginRegistration,
+  stableApplicationId: string,
+): AssistantPluginAuthorizationContext {
+  const normalized = stableApplicationId.trim();
+  return {
+    target: {
+      kind: 'desktop-application',
+      id: normalized,
+      identityFingerprint: createHash('sha256')
+        .update(`${registration.registrationFingerprint}\0${normalized}`)
+        .digest('hex'),
+    },
+    expiresInMinutes: 30 * 24 * 60,
+  };
+}
+
+function recordArray(value: unknown): Record<string, unknown>[] {
+  return Array.isArray(value)
+    ? value.filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry))
+    : [];
+}
+
+function firstString(record: Record<string, unknown>, ...keys: string[]): string {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return '';
+}
+
+function firstNumber(record: Record<string, unknown>, ...keys: string[]): number | undefined {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === 'number' && Number.isFinite(value)) return value;
+  }
+  return undefined;
+}
+
+function desktopSession(status: Record<string, unknown>, interactionId: string): Record<string, unknown> | undefined {
+  return recordArray(status.sessions).find((session) => firstString(session, 'interactionId', 'interaction_id') === interactionId);
+}
+
+function desktopApplicationIsActive(status: Record<string, unknown>, bundleId: string, appName: string): boolean {
+  return recordArray(status.applications).some((application) => {
+    if (application.active !== true || application.terminated === true) return false;
+    const candidateBundleId = firstString(application, 'bundle_id', 'bundleIdentifier');
+    const candidateName = firstString(application, 'name', 'appName');
+    return bundleId ? candidateBundleId === bundleId : Boolean(appName) && candidateName === appName;
+  });
+}
+
+async function openVerifiedDesktopSession(
+  registration: ExternalPluginRegistration,
+  requestId: string,
+  args: Record<string, unknown>,
+  timeoutMs: number | undefined,
+  signal: AbortSignal | undefined,
+  dependencies: ExternalPluginAdapterDependencies,
+): Promise<Record<string, unknown>> {
+  const bundleId = typeof args.bundle_id === 'string' ? args.bundle_id.trim() : '';
+  const appName = typeof args.app_name === 'string' ? args.app_name.trim() : '';
+  if (!bundleId && !appName) {
+    throw providerError('DESKTOP_ACTIVATION_TARGET_UNAVAILABLE', 'Activated desktop sessions require an exact bundle id or application name.');
+  }
+
+  let result: Record<string, unknown>;
+  let fallbackVerified = false;
+  try {
+    result = await callProvider(
+      registration,
+      requestId,
+      'desktop_session_open',
+      args,
+      timeoutMs,
+      signal,
+      dependencies,
+    );
+  } catch (error) {
+    if (!(error instanceof AssistantPluginError) || error.code !== 'APP_ACTIVATION_FAILED') throw error;
+
+    result = await callProvider(
+      registration,
+      `${requestId}:fallback-session`,
+      'desktop_session_open',
+      { ...(bundleId ? { bundle_id: bundleId } : { app_name: appName }), launch: false, activate: false },
+      timeoutMs,
+      signal,
+      dependencies,
+    );
+
+    const activateFallback = dependencies.activateAndVerifyFrontmostApplication ?? activateAndVerifyFrontmostApplication;
+    try {
+      const fallbackProof = await activateFallback({ bundleId: bundleId || undefined, appName: appName || undefined });
+      const proofBundleId = typeof fallbackProof.bundleId === 'string' ? fallbackProof.bundleId.trim() : '';
+      const proofAppName = typeof fallbackProof.appName === 'string' ? fallbackProof.appName.trim() : '';
+      const proofMatches = bundleId ? proofBundleId === bundleId : proofAppName === appName;
+      if (fallbackProof.activated !== true || fallbackProof.verified !== true || !proofMatches) {
+        throw new AssistantPluginError(
+          'DESKTOP_ACTIVATION_FALLBACK_IDENTITY_MISMATCH',
+          `Forge fallback did not prove the exact requested application ${bundleId || appName} as frontmost.`,
+          { retryable: true, details: { target: { bundleId, appName }, observed: { bundleId: proofBundleId, appName: proofAppName } } },
+        );
+      }
+      fallbackVerified = true;
+    } catch (fallbackError) {
+      if (fallbackError instanceof AssistantPluginError) {
+        throw new AssistantPluginError(
+          'DESKTOP_ACTIVATION_FALLBACK_FAILED',
+          `Desktop Operator activation failed and Forge could not independently verify ${bundleId || appName} as frontmost.`,
+          {
+            retryable: fallbackError.retryable,
+            details: {
+              providerErrorCode: error.code,
+              fallbackErrorCode: fallbackError.code,
+              fallbackErrorMessage: fallbackError.message,
+              target: bundleId || appName,
+            },
+          },
+        );
+      }
+      throw new AssistantPluginError(
+        'DESKTOP_ACTIVATION_FALLBACK_FAILED',
+        `Desktop Operator activation failed and Forge fallback failed for ${bundleId || appName}.`,
+        { retryable: true, details: { providerErrorCode: error.code, fallbackErrorMessage: String(fallbackError), target: bundleId || appName } },
+      );
+    }
+  }
+
+  if (!fallbackVerified) {
+    const activeStatus = await callProvider(
+      registration,
+      `${requestId}:active-status`,
+      'desktop_status',
+      { limit: 500 },
+      timeoutMs,
+      signal,
+      dependencies,
+    );
+    if (!desktopApplicationIsActive(activeStatus, bundleId, appName)) {
+      throw providerError('DESKTOP_ACTIVATION_NOT_CONFIRMED', `Desktop Operator did not confirm ${bundleId || appName} as the frontmost application after activation.`, true);
+    }
+  }
+  return result;
+}
+
+async function resolveExternalAuthorizationContext(
+  registration: ExternalPluginRegistration,
+  input: Parameters<NonNullable<AssistantPluginAdapter['resolveAuthorizationContext']>>[0],
+  dependencies: ExternalPluginAdapterDependencies,
+): Promise<AssistantPluginAuthorizationContext | undefined> {
+  if (EXTERNAL_PROVIDER_LIFECYCLE_ACTIONS.has(input.actionId)) {
+    return externalProviderAuthorizationContext(registration);
+  }
+  if (registration.pluginId !== 'desktop_operator') return undefined;
+  if (input.actionId === 'desktop_permissions_request') {
+    return externalProviderAuthorizationContext(registration);
+  }
+  if (input.actionId === 'desktop_session_open') {
+    const bundleId = typeof input.args.bundle_id === 'string' ? input.args.bundle_id.trim() : '';
+    return bundleId ? desktopApplicationAuthorizationContext(registration, bundleId) : undefined;
+  }
+
+  const interactionId = typeof input.args.interaction_id === 'string' ? input.args.interaction_id.trim() : '';
+  if (!interactionId) return undefined;
+
+  const providerManifest = await callProvider(
+    registration,
+    `${input.requestId}:authorization-target:manifest`,
+    'manifest',
+    {},
+    undefined,
+    input.signal,
+    dependencies,
+  );
+  parseProviderManifest(providerManifest, registration);
+  const status = await callProvider(
+    registration,
+    `${input.requestId}:authorization-target:desktop-status`,
+    'desktop_status',
+    { limit: 500 },
+    input.timeoutMs,
+    input.signal,
+    dependencies,
+  );
+  const sessions = Array.isArray(status.sessions) ? status.sessions : [];
+  const session = sessions.find((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return false;
+    const record = entry as Record<string, unknown>;
+    const id = typeof record.interactionId === 'string' ? record.interactionId : typeof record.interaction_id === 'string' ? record.interaction_id : '';
+    return id === interactionId;
+  }) as Record<string, unknown> | undefined;
+  if (!session) {
+    throw providerError('EXTERNAL_PLUGIN_AUTHORIZATION_TARGET_UNAVAILABLE', `Desktop session ${interactionId} was not found while resolving its stable authorization target.`, false);
+  }
+  const bundleId = typeof session.bundleIdentifier === 'string' ? session.bundleIdentifier.trim()
+    : typeof session.bundle_identifier === 'string' ? session.bundle_identifier.trim()
+      : '';
+  const appName = typeof session.appName === 'string' ? session.appName.trim()
+    : typeof session.app_name === 'string' ? session.app_name.trim()
+      : '';
+  const stableApplicationId = bundleId || (appName ? `name:${appName.toLowerCase()}` : '');
+  if (!stableApplicationId) {
+    throw providerError('EXTERNAL_PLUGIN_AUTHORIZATION_TARGET_UNAVAILABLE', `Desktop session ${interactionId} has no stable application identity.`, false);
+  }
+  return desktopApplicationAuthorizationContext(registration, stableApplicationId);
+}
+
 export function getExternalPluginAdapter(controllerHome: string, pluginId: string): AssistantPluginAdapter | undefined {
   const registration = getExternalPluginRegistration(controllerHome, pluginId);
   return registration ? createExternalPluginAdapter(registration) : undefined;
@@ -211,6 +435,7 @@ export function createExternalPluginAdapter(
   return {
     pluginId: registration.pluginId,
     scope: registration.scope,
+    resolveAuthorizationContext: (input) => resolveExternalAuthorizationContext(registration, input, dependencies),
     buildManifest(previousRevision = 0, previousUpdatedAt?: string): AssistantPluginManifest {
       const checkedAt = now().toISOString();
       if (!registration.enabled) {
@@ -305,6 +530,102 @@ export function createExternalPluginAdapter(
         );
         parseProviderManifest(providerManifest, registration);
       }
+      if (registration.pluginId === 'desktop_operator' && input.actionId === 'desktop_foreground_pointer_click') {
+        const sourceInteractionId = typeof input.args.interaction_id === 'string' ? input.args.interaction_id.trim() : '';
+        const requestedWindowId = typeof input.args.window_id === 'number' && Number.isInteger(input.args.window_id) ? input.args.window_id : undefined;
+        const x = typeof input.args.x === 'number' && Number.isFinite(input.args.x) ? input.args.x : undefined;
+        const y = typeof input.args.y === 'number' && Number.isFinite(input.args.y) ? input.args.y : undefined;
+        if (!sourceInteractionId || !requestedWindowId || x === undefined || y === undefined) {
+          throw providerError('DESKTOP_FOREGROUND_POINTER_ARGUMENT_INVALID', 'desktop_foreground_pointer_click requires interaction_id, window_id, x, and y.');
+        }
+
+        const sourceStatus = await callProvider(
+          registration,
+          `${input.requestId}:source-status`,
+          'desktop_status',
+          { limit: 500 },
+          input.timeoutMs,
+          input.signal,
+          dependencies,
+        );
+        const sourceSession = desktopSession(sourceStatus, sourceInteractionId);
+        if (!sourceSession) {
+          throw providerError('DESKTOP_FOREGROUND_POINTER_SESSION_NOT_FOUND', `Desktop session ${sourceInteractionId} is no longer available.`, true);
+        }
+        const bundleId = firstString(sourceSession, 'bundleIdentifier', 'bundle_id');
+        const appName = firstString(sourceSession, 'appName', 'app_name');
+        if (!bundleId && !appName) {
+          throw providerError('DESKTOP_FOREGROUND_POINTER_TARGET_UNAVAILABLE', `Desktop session ${sourceInteractionId} has no stable application identity.`);
+        }
+
+        const activation = await openVerifiedDesktopSession(
+          registration,
+          `${input.requestId}:activate`,
+          { ...(bundleId ? { bundle_id: bundleId } : { app_name: appName }), launch: false, activate: true },
+          input.timeoutMs,
+          input.signal,
+          dependencies,
+        );
+        const activationInteractionId = firstString(activation, 'interactionId', 'interaction_id');
+        if (!activationInteractionId) {
+          throw providerError('DESKTOP_ACTIVATION_SESSION_MISSING', 'Desktop Operator activated the application without returning a bound interaction session.', true);
+        }
+
+        const screenshot = await callProvider(
+          registration,
+          `${input.requestId}:screenshot`,
+          'desktop_screenshot',
+          {
+            interaction_id: activationInteractionId,
+            scope: 'window',
+            window_id: requestedWindowId,
+            ...(typeof input.args.label === 'string' && input.args.label.trim() ? { label: input.args.label.trim() } : {}),
+          },
+          input.timeoutMs,
+          input.signal,
+          dependencies,
+        );
+        const visualRevision = firstNumber(screenshot, 'visual_revision', 'visualRevision');
+        const capturedWindowId = firstNumber(screenshot, 'windowId', 'window_id') ?? requestedWindowId;
+        if (!visualRevision || !capturedWindowId) {
+          throw providerError('DESKTOP_FOREGROUND_CAPTURE_INVALID', 'Desktop Operator did not return a fresh visual revision for the foreground window.', true);
+        }
+
+        const click = await callProvider(
+          registration,
+          `${input.requestId}:click`,
+          'desktop_pointer_click',
+          {
+            interaction_id: activationInteractionId,
+            window_id: capturedWindowId,
+            visual_revision: visualRevision,
+            x,
+            y,
+          },
+          input.timeoutMs,
+          input.signal,
+          dependencies,
+        );
+        return {
+          interactionId: activationInteractionId,
+          activationVerified: true,
+          windowId: capturedWindowId,
+          visualRevision,
+          screenshot,
+          click,
+        };
+      }
+
+      if (registration.pluginId === 'desktop_operator' && input.actionId === 'desktop_session_open' && input.args.activate === true) {
+        return await openVerifiedDesktopSession(
+          registration,
+          input.requestId,
+          input.args,
+          input.timeoutMs,
+          input.signal,
+          dependencies,
+        );
+      }
       return await callProvider(
         registration,
         input.requestId,

package/src/runtime/plugins/external-unix-socket.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from 'child_process';
 import { existsSync } from 'fs';
 import { createConnection, type Socket } from 'net';
-import { dirname, isAbsolute, join } from 'path';
+import { dirname, isAbsolute, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { resolveBunExecutable } from '../shared/process-environment';
 import { AssistantPluginError } from './errors';
@@ -178,7 +178,13 @@ export async function callExternalUnixSocket(
 export function resolveExternalPluginProbeSidecarPath(
   execPath: string = process.execPath,
   moduleUrl: string = import.meta.url,
+  env: NodeJS.ProcessEnv = process.env,
 ): string {
+  const configuredReleaseRoot = env.FORGE_RELEASE_PATH?.trim();
+  if (configuredReleaseRoot) {
+    const releaseSidecar = join(resolve(configuredReleaseRoot), 'external-unix-socket-probe.cjs');
+    if (existsSync(releaseSidecar)) return releaseSidecar;
+  }
   const releaseSibling = join(dirname(execPath), 'external-unix-socket-probe.cjs');
   if (existsSync(releaseSibling)) return releaseSibling;
   const moduleSibling = fileURLToPath(new URL('./external-unix-socket-probe.cjs', moduleUrl));

package/src/runtime/plugins/first-party-registry.ts

@@ -8,6 +8,7 @@ import { iosPluginAdapter } from './ios-adapter';
 import { localSystemPluginAdapter } from './local-system-adapter';
 import { pluginManagementAdapter } from './plugin-management-adapter';
 import { resendPluginAdapter } from './resend-adapter';
+import { xiaohongshuPluginAdapter } from './xiaohongshu-publish';
 import type { AssistantPluginAdapter } from './types';
 
 const FIRST_PARTY_PLUGIN_ADAPTERS: readonly AssistantPluginAdapter[] = [
@@ -19,6 +20,7 @@ const FIRST_PARTY_PLUGIN_ADAPTERS: readonly AssistantPluginAdapter[] = [
   googleCalendarPluginAdapter,
   googleTasksPluginAdapter,
   resendPluginAdapter,
+  xiaohongshuPluginAdapter,
   localSystemPluginAdapter,
   pluginManagementAdapter,
 ];

package/src/runtime/plugins/github-adapter.ts

@@ -7,6 +7,11 @@ import {
   refreshIssueWithGitHubPlugin,
   saveGitHubPluginConfig,
 } from '../../cli/github/plugin';
+import {
+  dispatchGitHubWorkflow,
+  listGitHubWorkflowRuns,
+  listGitHubWorkflows,
+} from '../../cli/github/github';
 import type {
   AssistantPluginActionDescriptor,
   AssistantPluginActionExecutionInput,
@@ -37,6 +42,20 @@ function githubPermissions(ready: boolean, projectConfigured: boolean): Assistan
       granted: ready && projectConfigured,
       required: projectConfigured,
     },
+    {
+      scope: 'github:actions:read',
+      mode: 'read',
+      description: 'List GitHub Actions workflows and recent workflow runs.',
+      granted: ready,
+      required: false,
+    },
+    {
+      scope: 'github:actions:write',
+      mode: 'write',
+      description: 'Dispatch an explicitly named workflow_dispatch workflow.',
+      granted: ready,
+      required: false,
+    },
     {
       scope: 'controller:issues:write',
       mode: 'write',
@@ -63,6 +82,13 @@ function githubCapabilities(): AssistantPluginCapability[] {
       scopes: ['github:projects:write'],
       actions: ['configure', 'publish_issue'],
     },
+    {
+      capabilityId: 'actions-ci',
+      title: 'GitHub Actions CI',
+      description: 'List workflow definitions and runs, and dispatch an explicitly named workflow_dispatch workflow.',
+      scopes: ['github:actions:read', 'github:actions:write'],
+      actions: ['list_workflows', 'list_workflow_runs', 'dispatch_workflow'],
+    },
   ];
 }
 
@@ -144,6 +170,74 @@ function githubActions(): AssistantPluginActionDescriptor[] {
         additionalProperties: false,
       },
     },
+    {
+      actionId: 'list_workflows',
+      title: 'List GitHub Actions workflows',
+      description: 'List workflow definitions for the configured GitHub repository.',
+      readOnly: true,
+      risk: 'readonly',
+      confirmation: 'none',
+      defaultTimeoutMs: 30_000,
+      cancellable: true,
+      idempotent: true,
+      scopes: ['github:actions:read'],
+      resourceClaims: [{ resource: 'remote', mode: 'read' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: {
+          limit: { type: 'number', minimum: 1, maximum: 100 },
+          include_disabled: { type: 'boolean' },
+        },
+        additionalProperties: false,
+      },
+    },
+    {
+      actionId: 'list_workflow_runs',
+      title: 'List GitHub Actions runs',
+      description: 'List recent GitHub Actions workflow runs with optional workflow, branch, and status filters.',
+      readOnly: true,
+      risk: 'readonly',
+      confirmation: 'none',
+      defaultTimeoutMs: 30_000,
+      cancellable: true,
+      idempotent: true,
+      scopes: ['github:actions:read'],
+      resourceClaims: [{ resource: 'remote', mode: 'read' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: {
+          workflow: { type: 'string' },
+          branch: { type: 'string' },
+          status: { type: 'string' },
+          limit: { type: 'number', minimum: 1, maximum: 100 },
+          include_disabled: { type: 'boolean' },
+        },
+        additionalProperties: false,
+      },
+    },
+    {
+      actionId: 'dispatch_workflow',
+      title: 'Dispatch GitHub Actions workflow',
+      description: 'Create a workflow_dispatch event for one explicitly named workflow.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      defaultTimeoutMs: 60_000,
+      cancellable: true,
+      idempotent: false,
+      scopes: ['github:actions:write'],
+      resourceClaims: [{ resource: 'remote', mode: 'exclusive' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: {
+          workflow: { type: 'string' },
+          ref: { type: 'string' },
+          inputs: { type: 'object', additionalProperties: { type: ['string', 'number', 'boolean'] } },
+        },
+        required: ['workflow'],
+        additionalProperties: false,
+      },
+    },
     {
       actionId: 'close_issue',
       title: 'Close linked GitHub issue',
@@ -252,6 +346,37 @@ export async function executeGitHubPluginAction(input: AssistantPluginActionExec
       return { issue: publishIssueWithGitHubPlugin(input.repoRoot, String(input.args.issue_id ?? '').trim()) };
     case 'refresh_issue':
       return refreshIssueWithGitHubPlugin(input.repoRoot, String(input.args.issue_id ?? '').trim()) as Record<string, unknown>;
+    case 'list_workflows': {
+      const config = loadGitHubPluginConfig(input.repoRoot);
+      return {
+        workflows: listGitHubWorkflows(input.repoRoot, config.repository, {
+          limit: typeof input.args.limit === 'number' ? input.args.limit : undefined,
+          includeDisabled: input.args.include_disabled === true,
+        }),
+      };
+    }
+    case 'list_workflow_runs': {
+      const config = loadGitHubPluginConfig(input.repoRoot);
+      return {
+        runs: listGitHubWorkflowRuns(input.repoRoot, config.repository, {
+          workflow: typeof input.args.workflow === 'string' ? input.args.workflow : undefined,
+          branch: typeof input.args.branch === 'string' ? input.args.branch : undefined,
+          status: typeof input.args.status === 'string' ? input.args.status : undefined,
+          limit: typeof input.args.limit === 'number' ? input.args.limit : undefined,
+          includeDisabled: input.args.include_disabled === true,
+        }),
+      };
+    }
+    case 'dispatch_workflow': {
+      const config = loadGitHubPluginConfig(input.repoRoot);
+      return dispatchGitHubWorkflow(input.repoRoot, config.repository, {
+        workflow: String(input.args.workflow ?? ''),
+        ref: typeof input.args.ref === 'string' ? input.args.ref : undefined,
+        inputs: input.args.inputs && typeof input.args.inputs === 'object' && !Array.isArray(input.args.inputs)
+          ? input.args.inputs as Record<string, string | number | boolean>
+          : undefined,
+      });
+    }
     case 'close_issue':
       return { issue: closeIssueWithGitHubPlugin(input.repoRoot, String(input.args.issue_id ?? '').trim()) };
     default:

package/src/runtime/plugins/ios/agent-device-provider.ts

@@ -14,7 +14,7 @@ export interface AgentDeviceProviderIdentity {
 export interface AgentDeviceSessionContext {
   stateDir: string;
   session: string;
-  device: string;
+  device?: string;
   platform: 'ios';
   requestId: string;
   cwd: string;