@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/plugins/google-shared.ts

@@ -6,7 +6,7 @@ import type {
 } from './types';
 import { AssistantPluginError, toAssistantPluginError } from './errors';
 import { bootstrapManagedRuntimeEnv } from '../shared/managed-env';
-import { readStoredGoogleRefreshToken } from '../safe-tooling/google-credential-store';
+import { readStoredGoogleClientSecret, readStoredGoogleRefreshToken } from '../safe-tooling/google-credential-store';
 import { readRepositoryPluginConfig, writeRepositoryPluginConfig, type RepositoryPluginConfigContext } from './config-store';
 
 export type GoogleProviderKind = 'mock' | 'google-workspace';
@@ -128,8 +128,15 @@ function refreshCredential(service: GoogleService): { name: string; value: strin
   return stored ? { name: stored.source, value: stored.token } : undefined;
 }
 
+function clientSecretCredential(service: GoogleService): { name: string; value: string } | undefined {
+  const fromEnv = firstEnv(clientSecretEnvNames(service));
+  if (fromEnv) return fromEnv;
+  const stored = readStoredGoogleClientSecret(service);
+  return stored ? { name: stored.source, value: stored.secret } : undefined;
+}
+
 function refreshCredentialsReady(service: GoogleService): boolean {
-  return Boolean(refreshCredential(service) && firstEnv(clientIdEnvNames(service)) && firstEnv(clientSecretEnvNames(service)));
+  return Boolean(refreshCredential(service) && firstEnv(clientIdEnvNames(service)));
 }
 
 export function installGoogleAccessToken(service: GoogleService, accessToken: string, expiresInSeconds = 3600, source = 'oauth'): void {
@@ -289,9 +296,9 @@ function tokenEnvNames(service: GoogleService): string[] {
 export function resolveGoogleAuth(
   service: GoogleService,
   config: GooglePluginConfig,
-  options: { repoRoot?: string } = {},
+  options: { repoRoot?: string; controllerHome?: string } = {},
 ): GoogleAuthState {
-  bootstrapManagedRuntimeEnv({ repoRoot: options.repoRoot });
+  bootstrapManagedRuntimeEnv({ repoRoot: options.repoRoot, controllerHome: options.controllerHome });
   if (config.provider === 'mock') {
     return {
       provider: 'mock', ready: true, authenticated: true, probed: true,
@@ -428,8 +435,8 @@ function serviceBaseUrl(service: GoogleService): string {
 async function refreshGoogleAccessToken(service: GoogleService, timeoutMs: number): Promise<string | undefined> {
   const refreshToken = refreshCredential(service);
   const clientId = firstEnv(clientIdEnvNames(service));
-  const clientSecret = firstEnv(clientSecretEnvNames(service));
-  if (!refreshToken || !clientId || !clientSecret) return undefined;
+  const clientSecret = clientSecretCredential(service);
+  if (!refreshToken || !clientId) return undefined;
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -437,8 +444,8 @@ async function refreshGoogleAccessToken(service: GoogleService, timeoutMs: numbe
       grant_type: 'refresh_token',
       refresh_token: refreshToken.value,
       client_id: clientId.value,
-      client_secret: clientSecret.value,
     });
+    if (clientSecret) body.set('client_secret', clientSecret.value);
     const response = await fetch('https://oauth2.googleapis.com/token', {
       method: 'POST',
       headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },

package/src/runtime/plugins/google-tasks-adapter.ts

@@ -457,7 +457,7 @@ function tasksProvider(config: GoogleTasksPluginConfig, repoRoot?: string): Task
 export function buildGoogleTasksPluginManifest(previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string, context?: AssistantPluginBuildContext): AssistantPluginManifest {
   const root = repoRoot ?? process.cwd();
   const config = loadGoogleTasksPluginConfig(root, context);
-  const auth = resolveGoogleAuth('tasks', config, { repoRoot: root });
+  const auth = resolveGoogleAuth('tasks', config, { repoRoot: root, controllerHome: context?.controllerHome });
   const state = pluginStateFromGoogleAuth(config, auth);
   return {
     schemaVersion: 1,
@@ -504,7 +504,7 @@ export async function executeGoogleTasksPluginAction(input: AssistantPluginActio
       });
       return {
         config,
-        auth: resolveGoogleAuth('tasks', config, { repoRoot: input.repoRoot }),
+        auth: resolveGoogleAuth('tasks', config, { repoRoot: input.repoRoot, controllerHome: input.controllerHome }),
       };
     }
     case 'list_tasklists':

package/src/runtime/plugins/ios-adapter.ts

@@ -345,7 +345,7 @@ function actions(): AssistantPluginActionDescriptor[] {
       description: 'Capture a simulator screenshot into controller artifact storage.',
       readOnly: false,
       risk: 'workspace_write',
-      confirmation: 'none',
+      confirmation: 'authorization',
       defaultTimeoutMs: 60_000,
       cancellable: true,
       idempotent: false,

package/src/runtime/plugins/lightweight-action.ts

@@ -2,16 +2,22 @@ import { createHash } from 'crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import type { RepositoryRecord } from '../../cli/repositories/types';
-import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
+import { controllerSystemRoot, repositoryControllerRoot } from '../../cli/repositories/controller-home';
 import { resolveTrustedNodeExecutable } from '../shared/trusted-node-executable';
 import { startLightweightInternalProcess, waitForLightweightProcess } from '../execution/process-runtime/lightweight-managed';
+import { getProcessHandle, spawnManagedProcess, waitForProcess } from '../execution/process-runtime/runtime';
+import { getProcessRecord, getProcessRequestBinding } from '../execution/process-runtime/store';
 import type { ProcessHandle } from '../execution/process-runtime/types';
+import { FORGE_INSTANCE_PROCESS_SCOPE_KEY } from '../execution/process-runtime/process-scope';
+import type { ResolvedExecutionIdentity } from '../control-plane/execution/execution-identity';
 import type { AssistantPluginActionRequest } from './types';
 
 interface LightweightPluginActionEnvelope {
   schemaVersion: 1;
   controllerHome: string;
-  repoId: string;
+  /** Legacy repository envelope coordinate; absent for ForgeInstance-scoped controller plugins. */
+  repoId?: string;
+  scope?: { kind: 'controller' } | { kind: 'repository'; repoId: string };
   request: Omit<AssistantPluginActionRequest, 'signal'>;
 }
 
@@ -28,6 +34,18 @@ function envelopeBytes(controllerHome: string, repository: RepositoryRecord, req
     schemaVersion: 1,
     controllerHome,
     repoId: repository.repoId,
+    scope: { kind: 'repository', repoId: repository.repoId },
+    request: serializableRequest,
+  };
+  return `${JSON.stringify(envelope)}\n`;
+}
+
+function controllerEnvelopeBytes(controllerHome: string, request: AssistantPluginActionRequest): string {
+  const { signal: _signal, ...serializableRequest } = request;
+  const envelope: LightweightPluginActionEnvelope = {
+    schemaVersion: 1,
+    controllerHome,
+    scope: { kind: 'controller' },
     request: serializableRequest,
   };
   return `${JSON.stringify(envelope)}\n`;
@@ -142,6 +160,194 @@ export async function startLightweightPluginAction(input: {
   return { handle, requestSha256 };
 }
 
+export async function startManagedControllerPluginAction(input: {
+  controllerHome: string;
+  request: AssistantPluginActionRequest;
+  interactiveWaitMs?: number;
+  timeoutMs: number;
+}): Promise<LightweightPluginActionStart> {
+  const scopeKey = FORGE_INSTANCE_PROCESS_SCOPE_KEY;
+  const requestToken = createHash('sha256')
+    .update(`${scopeKey}\u0000${input.request.requestId}`)
+    .digest('hex')
+    .slice(0, 24);
+  const instanceRoot = controllerSystemRoot(input.controllerHome);
+  const requestRoot = join(instanceRoot, 'plugin-action-processes');
+  const requestPath = join(requestRoot, `${requestToken}.request.json`);
+  const bytes = controllerEnvelopeBytes(input.controllerHome, input.request);
+  const requestSha256 = createHash('sha256').update(bytes).digest('hex');
+  const existingBinding = getProcessRequestBinding(input.controllerHome, scopeKey, undefined, input.request.requestId);
+  if (existingBinding) {
+    if (existsSync(requestPath)) {
+      const existingBytes = readFileSync(requestPath, 'utf8');
+      if (createHash('sha256').update(existingBytes).digest('hex') !== requestSha256) {
+        throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+      }
+    }
+    const existing = getProcessHandle(input.controllerHome, scopeKey, existingBinding.processId);
+    if (!existing) throw new Error(`PROCESS_REQUEST_INCOMPLETE: plugin request ${input.request.requestId} is bound to missing process ${existingBinding.processId}; refusing re-execution`);
+    const processRecord = getProcessRecord(input.controllerHome, scopeKey, existingBinding.processId);
+    if (processRecord?.origin?.requestSemanticFingerprint && processRecord.origin.requestSemanticFingerprint !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+    return { handle: { ...existing, deduplicated: true, requestId: input.request.requestId }, requestSha256 };
+  }
+  if (existsSync(requestPath)) {
+    const existingBytes = readFileSync(requestPath, 'utf8');
+    if (createHash('sha256').update(existingBytes).digest('hex') !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+  } else {
+    privateAtomicWrite(requestPath, bytes);
+  }
+  const invocation = resolveLightweightPluginActionRuntimeInvocation();
+  const executionIdentity: ResolvedExecutionIdentity = Object.freeze({
+    schemaVersion: 1 as const,
+    authority: 'forge_instance' as const,
+    repositoryId: scopeKey,
+    checkoutId: scopeKey,
+    canonicalRoot: instanceRoot,
+  });
+  const handle = await spawnManagedProcess({
+    controllerHome: input.controllerHome,
+    repoId: scopeKey,
+    principalId: input.request.origin.actor?.trim() || undefined,
+    executionIdentity,
+    commandId: `plugin-action:${input.request.requestId}`,
+    trustedRuntimeChild: 'plugin_action_sidecar',
+    command: {
+      kind: 'argv',
+      executable: invocation.executable,
+      args: [...invocation.argsPrefix, '--request', requestPath, '--expected-sha256', requestSha256],
+      cwd: instanceRoot,
+    },
+    interactiveWaitMs: Math.max(0, input.interactiveWaitMs ?? 750),
+    timeoutMs: input.timeoutMs,
+    maxOutputBytes: 64 * 1024,
+    origin: {
+      surface: 'mcp',
+      toolName: 'plugin_action_execute',
+      requestId: input.request.requestId,
+      requestSemanticFingerprint: requestSha256,
+      correlationId: input.request.workId,
+    },
+    signal: input.request.signal,
+  });
+  return { handle, requestSha256 };
+}
+
+export async function startManagedPluginAction(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  request: AssistantPluginActionRequest;
+  interactiveWaitMs?: number;
+  timeoutMs: number;
+}): Promise<LightweightPluginActionStart> {
+  const requestToken = createHash('sha256')
+    .update(`${input.repository.repoId}\u0000${input.request.requestId}`)
+    .digest('hex')
+    .slice(0, 24);
+  const requestRoot = join(repositoryControllerRoot(input.controllerHome, input.repository.repoId), 'plugin-action-processes');
+  const requestPath = join(requestRoot, `${requestToken}.request.json`);
+  const bytes = envelopeBytes(input.controllerHome, input.repository, input.request);
+  const requestSha256 = createHash('sha256').update(bytes).digest('hex');
+
+  const existingBinding = getProcessRequestBinding(
+    input.controllerHome,
+    input.repository.repoId,
+    input.repository.activeCheckoutId,
+    input.request.requestId,
+  );
+  if (existingBinding) {
+    if (existsSync(requestPath)) {
+      const existingBytes = readFileSync(requestPath, 'utf8');
+      const existingSha256 = createHash('sha256').update(existingBytes).digest('hex');
+      if (existingSha256 !== requestSha256) {
+        throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+      }
+    }
+    const existing = getProcessHandle(input.controllerHome, input.repository.repoId, existingBinding.processId);
+    if (!existing) {
+      throw new Error(`PROCESS_REQUEST_INCOMPLETE: plugin request ${input.request.requestId} is bound to missing process ${existingBinding.processId}; refusing re-execution`);
+    }
+    const processRecord = getProcessRecord(input.controllerHome, input.repository.repoId, existingBinding.processId);
+    if (processRecord?.origin?.requestSemanticFingerprint && processRecord.origin.requestSemanticFingerprint !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+    return { handle: { ...existing, deduplicated: true, requestId: input.request.requestId }, requestSha256 };
+  }
+
+  if (existsSync(requestPath)) {
+    const existingBytes = readFileSync(requestPath, 'utf8');
+    const existingSha256 = createHash('sha256').update(existingBytes).digest('hex');
+    if (existingSha256 !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+  } else {
+    privateAtomicWrite(requestPath, bytes);
+  }
+
+  const invocation = resolveLightweightPluginActionRuntimeInvocation();
+  const executionIdentity: ResolvedExecutionIdentity = Object.freeze({
+    schemaVersion: 1 as const,
+    authority: 'ephemeral_workspace' as const,
+    repositoryId: input.repository.repoId,
+    checkoutId: input.repository.activeCheckoutId,
+    canonicalRoot: input.repository.canonicalRoot,
+    ...(input.request.workId ? { workId: input.request.workId } : {}),
+  });
+  const handle = await spawnManagedProcess({
+    controllerHome: input.controllerHome,
+    repoId: input.repository.repoId,
+    checkoutId: input.repository.activeCheckoutId,
+    executionIdentity,
+    workId: input.request.workId,
+    commandId: `plugin-action:${input.request.requestId}`,
+    trustedRuntimeChild: 'plugin_action_sidecar',
+    command: {
+      kind: 'argv',
+      executable: invocation.executable,
+      args: [
+        ...invocation.argsPrefix,
+        '--request', requestPath,
+        '--expected-sha256', requestSha256,
+      ],
+      cwd: input.repository.canonicalRoot,
+    },
+    interactiveWaitMs: Math.max(0, input.interactiveWaitMs ?? 750),
+    timeoutMs: input.timeoutMs,
+    maxOutputBytes: 64 * 1024,
+    origin: {
+      surface: 'mcp',
+      toolName: 'plugin_action_execute',
+      requestId: input.request.requestId,
+      requestSemanticFingerprint: requestSha256,
+      correlationId: input.request.workId,
+    },
+    signal: input.request.signal,
+  });
+  return { handle, requestSha256 };
+}
+
+export async function waitManagedControllerPluginAction(
+  controllerHome: string,
+  processId: string,
+  timeoutMs: number,
+  signal?: AbortSignal,
+): Promise<ProcessHandle> {
+  return waitForProcess(controllerHome, FORGE_INSTANCE_PROCESS_SCOPE_KEY, processId, { timeoutMs, signal });
+}
+
+export async function waitManagedPluginAction(
+  controllerHome: string,
+  repoId: string,
+  processId: string,
+  timeoutMs: number,
+  signal?: AbortSignal,
+): Promise<ProcessHandle> {
+  return waitForProcess(controllerHome, repoId, processId, { timeoutMs, signal });
+}
+
 export async function waitLightweightPluginAction(
   controllerHome: string,
   repoId: string,

package/src/runtime/plugins/local-system-adapter.ts

@@ -16,6 +16,7 @@ import {
 } from 'fs';
 import { dirname, extname, join, resolve } from 'path';
 import { forgeRuntimeServicePaths } from '../root/service';
+import { installWorkflowSupervisorBrowserAdapter, inspectWorkflowSupervisorBrowserAdapter } from './computer-chatgpt-browser-adapter-installer';
 import { createRecoveryConfig, loadRecoveryConfig, repairPublicTunnel } from '../standalone-recovery/core';
 import { activateRecoveryRelease, recoverySourceIdentity, stageRecoveryRelease } from '../standalone-recovery/installer';
 import { readCurrentRecoveryRelease, type RecoveryReleaseDescriptor } from '../standalone-recovery/release';
@@ -78,6 +79,8 @@ export interface LocalSystemPluginHooks {
   signalProcess?: (pid: number, signal: NodeJS.Signals) => void;
   scheduleLaunchAgentRestart?: (service: string) => { pid: number };
   upgradeStandaloneRecovery?: (controllerHome: string) => Promise<Record<string, unknown>>;
+  installWorkflowSupervisorBrowserAdapter?: typeof installWorkflowSupervisorBrowserAdapter;
+  inspectWorkflowSupervisorBrowserAdapter?: typeof inspectWorkflowSupervisorBrowserAdapter;
   repairPublicTunnel?: typeof repairPublicTunnel;
   recoverySourceIdentity?: typeof recoverySourceIdentity;
   stageRecoveryRelease?: typeof stageRecoveryRelease;
@@ -802,6 +805,7 @@ async function repairStandaloneRecoveryTunnel(controllerHome: string): Promise<R
 function actions(): AssistantPluginActionDescriptor[] {
   const controllerRead = [{ resource: 'repo-state' as const, mode: 'read' as const }];
   const controllerWrite = [{ resource: 'repo-state' as const, mode: 'write' as const }];
+  const providerWrite = [{ resource: 'provider-state' as const, mode: 'write' as const }];
   const targetProperties = {
     target_key: { type: 'string' },
     path: { type: 'string' },
@@ -815,6 +819,8 @@ function actions(): AssistantPluginActionDescriptor[] {
     { actionId: 'start_user_launch_agent', title: 'Start verified user LaunchAgent', description: 'Bootstrap or start one exact current-user LaunchAgent from ~/Library/LaunchAgents only after the installed plist matches the expected program identity.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { label: { type: 'string' }, expected_program_contains: { type: 'string' } }, required: ['label', 'expected_program_contains'], additionalProperties: false } },
     { actionId: 'upgrade_standalone_recovery', title: 'Upgrade standalone Recovery', description: 'Upgrade the installed standalone Recovery from its configured primary Runtime source using the existing immutable Recovery release authority. No caller source path or command is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 240_000, cancellable: false, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'repair_standalone_recovery_tunnel', title: 'Repair standalone Recovery tunnel', description: 'Repair only the installed standalone Recovery public tunnel using its existing configured tunnel identity and Recovery repair authority. No caller tunnel identity, path, executable, or command is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 60_000, cancellable: false, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
+    { actionId: 'workflow_supervisor_browser_adapter_status', title: 'Workflow Supervisor browser adapter status', description: 'Inspect the Controller-owned Workflow Supervisor Chrome adapter projection and exact package-derived Native Messaging registration.', readOnly: true, risk: 'readonly', confirmation: 'none', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.browser-adapter'], resourceClaims: [], argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
+    { actionId: 'install_workflow_supervisor_browser_adapter', title: 'Install Workflow Supervisor browser adapter', description: 'Project the active immutable Runtime browser adapter into Controller-owned paths and register Native Messaging only for the extension package-derived stable id. No caller path, command, extension id, or browser profile is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: false, idempotent: true, scopes: ['local-system.browser-adapter'], resourceClaims: providerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'open_application', title: 'Open application', description: 'Open one macOS application by name or bundle id in the background without stealing foreground focus.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.open'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { app_name: { type: 'string' }, bundle_id: { type: 'string' } }, additionalProperties: false } },
     { actionId: 'list_targets', title: 'List filesystem targets', description: 'List active expiring local filesystem grants.', readOnly: true, risk: 'readonly', confirmation: 'none', defaultTimeoutMs: 10_000, cancellable: true, idempotent: true, scopes: ['local-system.files.read'], resourceClaims: controllerRead, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'authorize_target', title: 'Authorize filesystem target', description: 'Authorize an expiring filesystem target. By default, a path inside a Git project authorizes the whole project/repository root; use scope=directory only when intentionally granting a narrower directory.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, root_path: { type: 'string' }, scope: { type: 'string', enum: ['auto', 'project', 'directory'] }, expires_in_minutes: { type: 'number' }, reason: { type: 'string' }, access: { type: 'string', enum: ['read_only', 'read_write'] } }, required: ['target_key', 'root_path', 'reason'], additionalProperties: false } },
@@ -825,7 +831,7 @@ function actions(): AssistantPluginActionDescriptor[] {
     { actionId: 'delete_file', title: 'Delete file', description: 'Delete one exact regular file below an authorized read-write target. Arbitrary recursive or directory deletion is never exposed.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'delete-local-system-file', defaultTimeoutMs: 15_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'delete_empty_directory', title: 'Delete empty directory', description: 'Delete one exact empty directory below an authorized read-write target. Target roots and recursive directory deletion are never allowed.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'delete-local-system-empty-directory', defaultTimeoutMs: 15_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'initialize_git', title: 'Initialize local Git repository', description: 'Run only git init inside an authorized read-write target without registering it in Repository Registry.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, cwd: { type: 'string' }, initial_branch: { type: 'string' } }, required: ['target_key'], additionalProperties: false } },
-    { actionId: 'execute_command', title: 'Execute target command', description: 'Execute one bounded typed-argv command inside an authorized target without repository registration. Shell strings, target escapes, destructive/remote writes, and Git mutations other than the dedicated initialize_git action are denied.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.read', 'local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, command: { type: 'array', items: { type: 'string' } }, cwd: { type: 'string' }, max_output_bytes: { type: 'number' } }, required: ['target_key', 'command'], additionalProperties: false } },
+    { actionId: 'execute_command', title: 'Execute target command', description: 'Execute one bounded typed-argv command inside an authorized filesystem target. This is the narrow target-scoped alternative to broad ForgeInstance process_exec: shell strings, target escapes, destructive/remote writes, and Git mutations other than the dedicated initialize_git action are denied.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.read', 'local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, command: { type: 'array', items: { type: 'string' } }, cwd: { type: 'string' }, max_output_bytes: { type: 'number' } }, required: ['target_key', 'command'], additionalProperties: false } },
     { actionId: 'execute_project_script', title: 'Execute verified project script', description: 'Execute one exact script below an authorized read-write target through a fixed interpreter after its SHA-256 digest and strong confirmation match. Eval flags and shell command strings are never accepted.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'execute-local-system-project-script', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.read', 'local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, runtime: { type: 'string', enum: ['node', 'bun', 'python3', 'ruby', 'bash', 'sh'] }, script_path: { type: 'string' }, expected_sha256: { type: 'string' }, arguments: { type: 'array', items: { type: 'string' } }, cwd: { type: 'string' }, max_output_bytes: { type: 'number' } }, required: ['target_key', 'runtime', 'script_path', 'expected_sha256'], additionalProperties: false } },
     { actionId: 'create_directory', title: 'Create directory', description: 'Create a directory below an authorized target without leaving that root.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'copy_file', title: 'Copy file', description: 'Copy a file between authorized targets without overwriting.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { source_target_key: { type: 'string' }, source_path: { type: 'string' }, destination_target_key: { type: 'string' }, destination_path: { type: 'string' } }, required: ['source_target_key', 'source_path', 'destination_target_key', 'destination_path'], additionalProperties: false } },
@@ -859,6 +865,7 @@ function permissions(): AssistantPluginPermissionScope[] {
     { scope: 'local-system.read', mode: 'read', description: 'Read bounded local process and memory diagnostics.', granted: true, required: true },
     { scope: 'local-system.process', mode: 'write', description: 'Terminate one verified PID or control one verified current-user LaunchAgent after explicit authorization.', granted: true, required: false },
     { scope: 'local-system.open', mode: 'write', description: 'Open applications or authorized files.', granted: true, required: false },
+    { scope: 'local-system.browser-adapter', mode: 'write', description: 'Install and inspect the Controller-owned Workflow Supervisor Chrome adapter and exact Native Messaging registration.', granted: true, required: false },
     { scope: 'local-system.files.read', mode: 'read', description: 'Read files only below active target grants.', granted: true, required: false },
     { scope: 'local-system.files.write', mode: 'write', description: 'Create, copy, move, rename, or explicitly delete bounded files and empty directories below active read-write target grants.', granted: true, required: false },
   ];
@@ -870,6 +877,7 @@ function capabilities(): AssistantPluginCapability[] {
     { capabilityId: 'local-system-process-control', title: 'Verified process lifecycle', description: 'Terminate one verified PID or stop/start/restart one verified macOS user LaunchAgent without exposing arbitrary shell execution.', scopes: ['local-system.process'], actions: ['terminate_process', 'restart_user_launch_agent', 'stop_user_launch_agent', 'start_user_launch_agent'] },
     { capabilityId: 'local-system-recovery-upgrade', title: 'Managed standalone Recovery upgrade', description: 'Upgrade standalone Recovery only from its installed configured source through the immutable Recovery release and rollback authority.', scopes: ['local-system.process'], actions: ['upgrade_standalone_recovery'] },
     { capabilityId: 'local-system-recovery-tunnel-repair', title: 'Managed standalone Recovery tunnel repair', description: 'Repair only the installed Recovery public tunnel through the existing Recovery tunnel repair authority when the Recovery transport itself is unreachable.', scopes: ['local-system.process'], actions: ['repair_standalone_recovery_tunnel'] },
+    { capabilityId: 'local-system-workflow-supervisor-browser-adapter', title: 'Workflow Supervisor browser adapter', description: 'Inspect or install the stateless Chrome adapter projection used by the Goal-level Workflow Supervisor authority.', scopes: ['local-system.browser-adapter'], actions: ['workflow_supervisor_browser_adapter_status', 'install_workflow_supervisor_browser_adapter'] },
     { capabilityId: 'local-system-open', title: 'Open local applications and files', description: 'Open applications and authorized files without arbitrary shell access.', scopes: ['local-system.open'], actions: ['open_application', 'reveal_in_finder', 'open_file'] },
     { capabilityId: 'local-system-files', title: 'Authorized local files', description: 'Use expiring target grants for bounded local file operations and typed-argv commands without repository registration.', scopes: ['local-system.files.read', 'local-system.files.write'], actions: ['list_targets', 'authorize_target', 'revoke_target', 'list_directory', 'read_text', 'write_text', 'delete_file', 'delete_empty_directory', 'initialize_git', 'execute_command', 'execute_project_script', 'create_directory', 'copy_file', 'move_file', 'rename_file'] },
   ];
@@ -884,7 +892,7 @@ export function buildLocalSystemPluginManifest(previousRevision = 0, previousUpd
     pluginId: PLUGIN_ID,
     provider: 'local-macos',
     displayName: 'Local System Assistant',
-    pluginVersion: '1.5.1',
+    pluginVersion: '1.5.3',
     authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controllerHome:system/local-system'] },
     enabled: true,
     lifecycle: { state: currentHealth.ready ? 'enabled' : 'degraded', reason: currentHealth.ready ? 'Local system capabilities are ready.' : currentHealth.warnings[0] },
@@ -927,6 +935,8 @@ export async function executeLocalSystemPluginAction(input: AssistantPluginActio
     case 'start_user_launch_agent': return startVerifiedUserLaunchAgent(input.args.label, input.args.expected_program_contains);
     case 'upgrade_standalone_recovery': return await upgradeStandaloneRecovery(input.controllerHome);
     case 'repair_standalone_recovery_tunnel': return await repairStandaloneRecoveryTunnel(input.controllerHome);
+    case 'workflow_supervisor_browser_adapter_status': return (hooks.inspectWorkflowSupervisorBrowserAdapter ?? inspectWorkflowSupervisorBrowserAdapter)(input.controllerHome, { repository: { repoId: input.repoId, repoRoot: input.repoRoot } }) as unknown as Record<string, unknown>;
+    case 'install_workflow_supervisor_browser_adapter': return (hooks.installWorkflowSupervisorBrowserAdapter ?? installWorkflowSupervisorBrowserAdapter)(input.controllerHome, { repository: { repoId: input.repoId, repoRoot: input.repoRoot } }) as unknown as Record<string, unknown>;
     case 'open_application': {
       const appName = optionalString(input.args, 'app_name');
       const bundleId = optionalString(input.args, 'bundle_id');

package/src/runtime/plugins/managed-process-adapter.ts

@@ -1,14 +1,14 @@
 import { spawn, spawnSync } from 'child_process';
 import { existsSync, statSync } from 'fs';
 import { dirname, isAbsolute, resolve } from 'path';
-import { AssistantPluginError } from './errors';
+import { MAX_PLUGIN_ACTION_TIMEOUT_MS } from '../../../packages/plugin-runtime/external/index';
+import { AssistantPluginError, type AssistantPluginEffectOutcome } from './errors';
 
 export const MANAGED_PLUGIN_PROTOCOL_VERSION = 1;
 const DEFAULT_MAX_REQUEST_BYTES = 1_048_576;
 const DEFAULT_MAX_RESPONSE_BYTES = 1_048_576;
 const DEFAULT_MAX_STDERR_CHARS = 8_000;
 const DEFAULT_TIMEOUT_MS = 30_000;
-const MAX_TIMEOUT_MS = 120_000;
 
 interface ManagedPluginHandshake {
   schemaVersion: 1;
@@ -60,12 +60,14 @@ export interface ManagedPluginProcessRequest {
   actionId: string;
   input: Record<string, unknown>;
   timeoutMs?: number;
+  effectOutcomeOnTimeout?: AssistantPluginEffectOutcome;
   signal?: AbortSignal;
 }
 
-function managedError(code: string, message: string, options: { retryable?: boolean; details?: Record<string, unknown> } = {}): AssistantPluginError {
+function managedError(code: string, message: string, options: { retryable?: boolean; effectOutcome?: AssistantPluginEffectOutcome; details?: Record<string, unknown> } = {}): AssistantPluginError {
   return new AssistantPluginError(code, message, {
     retryable: options.retryable ?? true,
+    effectOutcome: options.effectOutcome,
     details: options.details,
   });
 }
@@ -73,7 +75,7 @@ function managedError(code: string, message: string, options: { retryable?: bool
 function boundedTimeout(spec: ManagedPluginProcessSpec, request: ManagedPluginProcessRequest): number {
   const requested = request.timeoutMs ?? spec.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   if (!Number.isFinite(requested)) return DEFAULT_TIMEOUT_MS;
-  return Math.min(Math.max(Math.trunc(requested), 50), MAX_TIMEOUT_MS);
+  return Math.min(Math.max(Math.trunc(requested), 50), MAX_PLUGIN_ACTION_TIMEOUT_MS);
 }
 
 function minimalEnvironment(runtimeExecutable: string): NodeJS.ProcessEnv {
@@ -257,6 +259,7 @@ export async function executeManagedPluginProcess(
     let stdoutBytes = 0;
     let stderr = '';
     let handshakeReceived = false;
+    let requestDispatched = false;
     let settled = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let killTimer: ReturnType<typeof setTimeout> | undefined;
@@ -298,6 +301,7 @@ export async function executeManagedPluginProcess(
         if (!handshakeReceived) {
           validateHandshake(parsed, spec);
           handshakeReceived = true;
+          requestDispatched = true;
           child.stdin.end(`${requestEnvelope}\n`);
           return;
         }
@@ -318,7 +322,10 @@ export async function executeManagedPluginProcess(
     };
 
     timer = setTimeout(() => {
-      fail(managedError('PLUGIN_MANAGED_PROCESS_TIMEOUT', 'Managed plugin helper timed out.', { retryable: true }));
+      fail(managedError('PLUGIN_MANAGED_PROCESS_TIMEOUT', 'Managed plugin helper timed out.', {
+        retryable: true,
+        effectOutcome: requestDispatched ? request.effectOutcomeOnTimeout : 'failed',
+      }));
     }, boundedTimeout(spec, request));
     request.signal?.addEventListener('abort', onAbort, { once: true });
 

package/src/runtime/plugins/plugin-action-sidecar.ts

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import { createHash } from 'crypto';
-import { readFileSync, rmSync } from 'fs';
+import { readFileSync, rmSync, writeFileSync } from 'fs';
 import { getRepository } from '../../cli/repositories/registry';
 import type { AssistantPluginActionRequest } from './types';
-import { submitAssistantPluginAction } from './store';
+import { submitAssistantPluginAction, submitControllerPluginAction } from './store';
 
 interface Envelope {
   schemaVersion: 1;
   controllerHome: string;
-  repoId: string;
+  repoId?: string;
+  scope?: { kind: 'controller' } | { kind: 'repository'; repoId: string };
   request: Omit<AssistantPluginActionRequest, 'signal'>;
 }
 
@@ -30,13 +31,16 @@ export async function runPluginActionSidecar(argv = process.argv.slice(2)): Prom
     }
     const envelope = JSON.parse(bytes) as Envelope;
     if (envelope.schemaVersion !== 1) throw new Error('PLUGIN_ACTION_REQUEST_VERSION_UNSUPPORTED');
-    const repository = getRepository(envelope.repoId, envelope.controllerHome);
-    const submitted = await submitAssistantPluginAction(
-      envelope.controllerHome,
-      repository,
-      envelope.request,
-    );
-    process.stdout.write(`${JSON.stringify({
+    const controllerScoped = envelope.scope?.kind === 'controller';
+    const repoId = envelope.scope?.kind === 'repository' ? envelope.scope.repoId : envelope.repoId;
+    const submitted = controllerScoped
+      ? await submitControllerPluginAction(envelope.controllerHome, envelope.request)
+      : await submitAssistantPluginAction(
+          envelope.controllerHome,
+          getRepository(repoId ?? '', envelope.controllerHome),
+          envelope.request,
+        );
+    writeFileSync(1, `${JSON.stringify({
       ok: true,
       requestId: submitted.receipt.requestId,
       receiptId: submitted.receipt.receiptId,
@@ -51,9 +55,9 @@ export async function runPluginActionSidecar(argv = process.argv.slice(2)): Prom
 const direct = typeof process.argv[1] === 'string' && process.argv[1].includes('plugin-action-sidecar');
 if (direct) {
   void runPluginActionSidecar()
-    .then((code) => { process.exitCode = code; })
+    .then((code) => { process.exit(code); })
     .catch((error) => {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exitCode = 1;
+      writeFileSync(2, `${error instanceof Error ? error.message : String(error)}\n`);
+      process.exit(1);
     });
 }

package/src/runtime/plugins/plugin-management-adapter.ts

@@ -129,7 +129,7 @@ export function buildPluginManagementManifest(previousRevision = 0, previousUpda
   return {
     schemaVersion: 1, manifestVersion: 1, revision: Math.max(1, previousRevision || 1), pluginId: PLUGIN_ID,
     provider: 'forge-controller', displayName: 'Forge Plugin Management', pluginVersion: '1.0.0',
-    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-home:plugins/external/registrations', 'controller-home:system/plugin-capability-authorizations/grants.json'] },
+    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-home:plugins/external/registrations', 'controller-home:system/authorization-grants/grants.json'] },
     enabled: true, lifecycle: { state: 'enabled', reason: 'Canonical external plugin registration authority is available.' },
     health: { state: 'ready', checkedAt: now(), ready: true, probed: true, errors: [], warnings: [] },
     permissions: permissions(), capabilities: capabilities(), actions: actions(), updatedAt: previousUpdatedAt ?? now(),