@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/plugins/lightweight-action.ts

@@ -2,16 +2,22 @@ import { createHash } from 'crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import type { RepositoryRecord } from '../../cli/repositories/types';
-import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
+import { controllerSystemRoot, repositoryControllerRoot } from '../../cli/repositories/controller-home';
 import { resolveTrustedNodeExecutable } from '../shared/trusted-node-executable';
 import { startLightweightInternalProcess, waitForLightweightProcess } from '../execution/process-runtime/lightweight-managed';
+import { getProcessHandle, spawnManagedProcess, waitForProcess } from '../execution/process-runtime/runtime';
+import { getProcessRecord, getProcessRequestBinding } from '../execution/process-runtime/store';
 import type { ProcessHandle } from '../execution/process-runtime/types';
+import { FORGE_INSTANCE_PROCESS_SCOPE_KEY } from '../execution/process-runtime/process-scope';
+import type { ResolvedExecutionIdentity } from '../control-plane/execution/execution-identity';
 import type { AssistantPluginActionRequest } from './types';
 
 interface LightweightPluginActionEnvelope {
   schemaVersion: 1;
   controllerHome: string;
-  repoId: string;
+  /** Legacy repository envelope coordinate; absent for ForgeInstance-scoped controller plugins. */
+  repoId?: string;
+  scope?: { kind: 'controller' } | { kind: 'repository'; repoId: string };
   request: Omit<AssistantPluginActionRequest, 'signal'>;
 }
 
@@ -28,6 +34,18 @@ function envelopeBytes(controllerHome: string, repository: RepositoryRecord, req
     schemaVersion: 1,
     controllerHome,
     repoId: repository.repoId,
+    scope: { kind: 'repository', repoId: repository.repoId },
+    request: serializableRequest,
+  };
+  return `${JSON.stringify(envelope)}\n`;
+}
+
+function controllerEnvelopeBytes(controllerHome: string, request: AssistantPluginActionRequest): string {
+  const { signal: _signal, ...serializableRequest } = request;
+  const envelope: LightweightPluginActionEnvelope = {
+    schemaVersion: 1,
+    controllerHome,
+    scope: { kind: 'controller' },
     request: serializableRequest,
   };
   return `${JSON.stringify(envelope)}\n`;
@@ -142,6 +160,194 @@ export async function startLightweightPluginAction(input: {
   return { handle, requestSha256 };
 }
 
+export async function startManagedControllerPluginAction(input: {
+  controllerHome: string;
+  request: AssistantPluginActionRequest;
+  interactiveWaitMs?: number;
+  timeoutMs: number;
+}): Promise<LightweightPluginActionStart> {
+  const scopeKey = FORGE_INSTANCE_PROCESS_SCOPE_KEY;
+  const requestToken = createHash('sha256')
+    .update(`${scopeKey}\u0000${input.request.requestId}`)
+    .digest('hex')
+    .slice(0, 24);
+  const instanceRoot = controllerSystemRoot(input.controllerHome);
+  const requestRoot = join(instanceRoot, 'plugin-action-processes');
+  const requestPath = join(requestRoot, `${requestToken}.request.json`);
+  const bytes = controllerEnvelopeBytes(input.controllerHome, input.request);
+  const requestSha256 = createHash('sha256').update(bytes).digest('hex');
+  const existingBinding = getProcessRequestBinding(input.controllerHome, scopeKey, undefined, input.request.requestId);
+  if (existingBinding) {
+    if (existsSync(requestPath)) {
+      const existingBytes = readFileSync(requestPath, 'utf8');
+      if (createHash('sha256').update(existingBytes).digest('hex') !== requestSha256) {
+        throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+      }
+    }
+    const existing = getProcessHandle(input.controllerHome, scopeKey, existingBinding.processId);
+    if (!existing) throw new Error(`PROCESS_REQUEST_INCOMPLETE: plugin request ${input.request.requestId} is bound to missing process ${existingBinding.processId}; refusing re-execution`);
+    const processRecord = getProcessRecord(input.controllerHome, scopeKey, existingBinding.processId);
+    if (processRecord?.origin?.requestSemanticFingerprint && processRecord.origin.requestSemanticFingerprint !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+    return { handle: { ...existing, deduplicated: true, requestId: input.request.requestId }, requestSha256 };
+  }
+  if (existsSync(requestPath)) {
+    const existingBytes = readFileSync(requestPath, 'utf8');
+    if (createHash('sha256').update(existingBytes).digest('hex') !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+  } else {
+    privateAtomicWrite(requestPath, bytes);
+  }
+  const invocation = resolveLightweightPluginActionRuntimeInvocation();
+  const executionIdentity: ResolvedExecutionIdentity = Object.freeze({
+    schemaVersion: 1 as const,
+    authority: 'forge_instance' as const,
+    repositoryId: scopeKey,
+    checkoutId: scopeKey,
+    canonicalRoot: instanceRoot,
+  });
+  const handle = await spawnManagedProcess({
+    controllerHome: input.controllerHome,
+    repoId: scopeKey,
+    principalId: input.request.origin.actor?.trim() || undefined,
+    executionIdentity,
+    commandId: `plugin-action:${input.request.requestId}`,
+    trustedRuntimeChild: 'plugin_action_sidecar',
+    command: {
+      kind: 'argv',
+      executable: invocation.executable,
+      args: [...invocation.argsPrefix, '--request', requestPath, '--expected-sha256', requestSha256],
+      cwd: instanceRoot,
+    },
+    interactiveWaitMs: Math.max(0, input.interactiveWaitMs ?? 750),
+    timeoutMs: input.timeoutMs,
+    maxOutputBytes: 64 * 1024,
+    origin: {
+      surface: 'mcp',
+      toolName: 'plugin_action_execute',
+      requestId: input.request.requestId,
+      requestSemanticFingerprint: requestSha256,
+      correlationId: input.request.workId,
+    },
+    signal: input.request.signal,
+  });
+  return { handle, requestSha256 };
+}
+
+export async function startManagedPluginAction(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  request: AssistantPluginActionRequest;
+  interactiveWaitMs?: number;
+  timeoutMs: number;
+}): Promise<LightweightPluginActionStart> {
+  const requestToken = createHash('sha256')
+    .update(`${input.repository.repoId}\u0000${input.request.requestId}`)
+    .digest('hex')
+    .slice(0, 24);
+  const requestRoot = join(repositoryControllerRoot(input.controllerHome, input.repository.repoId), 'plugin-action-processes');
+  const requestPath = join(requestRoot, `${requestToken}.request.json`);
+  const bytes = envelopeBytes(input.controllerHome, input.repository, input.request);
+  const requestSha256 = createHash('sha256').update(bytes).digest('hex');
+
+  const existingBinding = getProcessRequestBinding(
+    input.controllerHome,
+    input.repository.repoId,
+    input.repository.activeCheckoutId,
+    input.request.requestId,
+  );
+  if (existingBinding) {
+    if (existsSync(requestPath)) {
+      const existingBytes = readFileSync(requestPath, 'utf8');
+      const existingSha256 = createHash('sha256').update(existingBytes).digest('hex');
+      if (existingSha256 !== requestSha256) {
+        throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+      }
+    }
+    const existing = getProcessHandle(input.controllerHome, input.repository.repoId, existingBinding.processId);
+    if (!existing) {
+      throw new Error(`PROCESS_REQUEST_INCOMPLETE: plugin request ${input.request.requestId} is bound to missing process ${existingBinding.processId}; refusing re-execution`);
+    }
+    const processRecord = getProcessRecord(input.controllerHome, input.repository.repoId, existingBinding.processId);
+    if (processRecord?.origin?.requestSemanticFingerprint && processRecord.origin.requestSemanticFingerprint !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+    return { handle: { ...existing, deduplicated: true, requestId: input.request.requestId }, requestSha256 };
+  }
+
+  if (existsSync(requestPath)) {
+    const existingBytes = readFileSync(requestPath, 'utf8');
+    const existingSha256 = createHash('sha256').update(existingBytes).digest('hex');
+    if (existingSha256 !== requestSha256) {
+      throw new Error(`PROCESS_REQUEST_CONFLICT: plugin request ${input.request.requestId} already has different arguments`);
+    }
+  } else {
+    privateAtomicWrite(requestPath, bytes);
+  }
+
+  const invocation = resolveLightweightPluginActionRuntimeInvocation();
+  const executionIdentity: ResolvedExecutionIdentity = Object.freeze({
+    schemaVersion: 1 as const,
+    authority: 'ephemeral_workspace' as const,
+    repositoryId: input.repository.repoId,
+    checkoutId: input.repository.activeCheckoutId,
+    canonicalRoot: input.repository.canonicalRoot,
+    ...(input.request.workId ? { workId: input.request.workId } : {}),
+  });
+  const handle = await spawnManagedProcess({
+    controllerHome: input.controllerHome,
+    repoId: input.repository.repoId,
+    checkoutId: input.repository.activeCheckoutId,
+    executionIdentity,
+    workId: input.request.workId,
+    commandId: `plugin-action:${input.request.requestId}`,
+    trustedRuntimeChild: 'plugin_action_sidecar',
+    command: {
+      kind: 'argv',
+      executable: invocation.executable,
+      args: [
+        ...invocation.argsPrefix,
+        '--request', requestPath,
+        '--expected-sha256', requestSha256,
+      ],
+      cwd: input.repository.canonicalRoot,
+    },
+    interactiveWaitMs: Math.max(0, input.interactiveWaitMs ?? 750),
+    timeoutMs: input.timeoutMs,
+    maxOutputBytes: 64 * 1024,
+    origin: {
+      surface: 'mcp',
+      toolName: 'plugin_action_execute',
+      requestId: input.request.requestId,
+      requestSemanticFingerprint: requestSha256,
+      correlationId: input.request.workId,
+    },
+    signal: input.request.signal,
+  });
+  return { handle, requestSha256 };
+}
+
+export async function waitManagedControllerPluginAction(
+  controllerHome: string,
+  processId: string,
+  timeoutMs: number,
+  signal?: AbortSignal,
+): Promise<ProcessHandle> {
+  return waitForProcess(controllerHome, FORGE_INSTANCE_PROCESS_SCOPE_KEY, processId, { timeoutMs, signal });
+}
+
+export async function waitManagedPluginAction(
+  controllerHome: string,
+  repoId: string,
+  processId: string,
+  timeoutMs: number,
+  signal?: AbortSignal,
+): Promise<ProcessHandle> {
+  return waitForProcess(controllerHome, repoId, processId, { timeoutMs, signal });
+}
+
 export async function waitLightweightPluginAction(
   controllerHome: string,
   repoId: string,

package/src/runtime/plugins/local-system-adapter.ts

@@ -16,6 +16,7 @@ import {
 } from 'fs';
 import { dirname, extname, join, resolve } from 'path';
 import { forgeRuntimeServicePaths } from '../root/service';
+import { installWorkflowSupervisorBrowserAdapter, inspectWorkflowSupervisorBrowserAdapter } from './computer-chatgpt-browser-adapter-installer';
 import { createRecoveryConfig, loadRecoveryConfig, repairPublicTunnel } from '../standalone-recovery/core';
 import { activateRecoveryRelease, recoverySourceIdentity, stageRecoveryRelease } from '../standalone-recovery/installer';
 import { readCurrentRecoveryRelease, type RecoveryReleaseDescriptor } from '../standalone-recovery/release';
@@ -42,10 +43,6 @@ import type {
   AssistantPluginPermissionScope,
 } from './types';
 import { AssistantPluginError } from './errors';
-import {
-  classifyRepositoryCommand,
-  classifyRepositoryCommandReplay,
-} from '../../cli/repositories/command-classifier';
 import {
   assertCommandPathOperandsStayInRepository,
   assertRepositoryCommandInputAllowed,
@@ -57,7 +54,6 @@ const PLUGIN_ID = 'local_system';
 const MAX_OUTPUT_BYTES = 64 * 1024;
 const MAX_TEXT_CHARS = 100_000;
 const MAX_DIRECTORY_ENTRIES = 200;
-const TARGET_SAFE_FILESYSTEM_MUTATORS = new Set(['touch', 'mkdir', 'cp', 'mv', 'install', 'tee', 'truncate']);
 const PROJECT_SCRIPT_RUNTIMES = new Set(['node', 'bun', 'python3', 'ruby', 'bash', 'sh']);
 const AUTO_OPEN_DENIED_EXTENSIONS = new Set([
   '.command', '.sh', '.bash', '.zsh', '.fish', '.tool',
@@ -78,6 +74,8 @@ export interface LocalSystemPluginHooks {
   signalProcess?: (pid: number, signal: NodeJS.Signals) => void;
   scheduleLaunchAgentRestart?: (service: string) => { pid: number };
   upgradeStandaloneRecovery?: (controllerHome: string) => Promise<Record<string, unknown>>;
+  installWorkflowSupervisorBrowserAdapter?: typeof installWorkflowSupervisorBrowserAdapter;
+  inspectWorkflowSupervisorBrowserAdapter?: typeof inspectWorkflowSupervisorBrowserAdapter;
   repairPublicTunnel?: typeof repairPublicTunnel;
   recoverySourceIdentity?: typeof recoverySourceIdentity;
   stageRecoveryRelease?: typeof stageRecoveryRelease;
@@ -137,14 +135,6 @@ function optionalString(args: Record<string, unknown>, key: string): string | un
   return value || undefined;
 }
 
-function requiredStringArray(args: Record<string, unknown>, key: string): string[] {
-  const value = args[key];
-  if (!Array.isArray(value) || value.length === 0 || value.some((entry) => typeof entry !== 'string' || !entry.trim())) {
-    throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', `${key} must be a non-empty string array.`, { retryable: false });
-  }
-  return value.map((entry) => String(entry));
-}
-
 function optionalStringArray(args: Record<string, unknown>, key: string): string[] {
   const value = args[key];
   if (value === undefined) return [];
@@ -802,6 +792,7 @@ async function repairStandaloneRecoveryTunnel(controllerHome: string): Promise<R
 function actions(): AssistantPluginActionDescriptor[] {
   const controllerRead = [{ resource: 'repo-state' as const, mode: 'read' as const }];
   const controllerWrite = [{ resource: 'repo-state' as const, mode: 'write' as const }];
+  const providerWrite = [{ resource: 'provider-state' as const, mode: 'write' as const }];
   const targetProperties = {
     target_key: { type: 'string' },
     path: { type: 'string' },
@@ -815,6 +806,8 @@ function actions(): AssistantPluginActionDescriptor[] {
     { actionId: 'start_user_launch_agent', title: 'Start verified user LaunchAgent', description: 'Bootstrap or start one exact current-user LaunchAgent from ~/Library/LaunchAgents only after the installed plist matches the expected program identity.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { label: { type: 'string' }, expected_program_contains: { type: 'string' } }, required: ['label', 'expected_program_contains'], additionalProperties: false } },
     { actionId: 'upgrade_standalone_recovery', title: 'Upgrade standalone Recovery', description: 'Upgrade the installed standalone Recovery from its configured primary Runtime source using the existing immutable Recovery release authority. No caller source path or command is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 240_000, cancellable: false, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'repair_standalone_recovery_tunnel', title: 'Repair standalone Recovery tunnel', description: 'Repair only the installed standalone Recovery public tunnel using its existing configured tunnel identity and Recovery repair authority. No caller tunnel identity, path, executable, or command is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 60_000, cancellable: false, idempotent: true, scopes: ['local-system.process'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
+    { actionId: 'workflow_supervisor_browser_adapter_status', title: 'Workflow Supervisor browser adapter status', description: 'Inspect the Controller-owned Workflow Supervisor Chrome adapter projection and exact package-derived Native Messaging registration.', readOnly: true, risk: 'readonly', confirmation: 'none', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.browser-adapter'], resourceClaims: [], argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
+    { actionId: 'install_workflow_supervisor_browser_adapter', title: 'Install Workflow Supervisor browser adapter', description: 'Project the active immutable Runtime browser adapter into Controller-owned paths and register Native Messaging only for the extension package-derived stable id. No caller path, command, extension id, or browser profile is accepted.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: false, idempotent: true, scopes: ['local-system.browser-adapter'], resourceClaims: providerWrite, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'open_application', title: 'Open application', description: 'Open one macOS application by name or bundle id in the background without stealing foreground focus.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.open'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { app_name: { type: 'string' }, bundle_id: { type: 'string' } }, additionalProperties: false } },
     { actionId: 'list_targets', title: 'List filesystem targets', description: 'List active expiring local filesystem grants.', readOnly: true, risk: 'readonly', confirmation: 'none', defaultTimeoutMs: 10_000, cancellable: true, idempotent: true, scopes: ['local-system.files.read'], resourceClaims: controllerRead, argumentsSchema: { type: 'object', properties: {}, additionalProperties: false } },
     { actionId: 'authorize_target', title: 'Authorize filesystem target', description: 'Authorize an expiring filesystem target. By default, a path inside a Git project authorizes the whole project/repository root; use scope=directory only when intentionally granting a narrower directory.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, root_path: { type: 'string' }, scope: { type: 'string', enum: ['auto', 'project', 'directory'] }, expires_in_minutes: { type: 'number' }, reason: { type: 'string' }, access: { type: 'string', enum: ['read_only', 'read_write'] } }, required: ['target_key', 'root_path', 'reason'], additionalProperties: false } },
@@ -825,7 +818,6 @@ function actions(): AssistantPluginActionDescriptor[] {
     { actionId: 'delete_file', title: 'Delete file', description: 'Delete one exact regular file below an authorized read-write target. Arbitrary recursive or directory deletion is never exposed.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'delete-local-system-file', defaultTimeoutMs: 15_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'delete_empty_directory', title: 'Delete empty directory', description: 'Delete one exact empty directory below an authorized read-write target. Target roots and recursive directory deletion are never allowed.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'delete-local-system-empty-directory', defaultTimeoutMs: 15_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'initialize_git', title: 'Initialize local Git repository', description: 'Run only git init inside an authorized read-write target without registering it in Repository Registry.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, cwd: { type: 'string' }, initial_branch: { type: 'string' } }, required: ['target_key'], additionalProperties: false } },
-    { actionId: 'execute_command', title: 'Execute target command', description: 'Execute one bounded typed-argv command inside an authorized target without repository registration. Shell strings, target escapes, destructive/remote writes, and Git mutations other than the dedicated initialize_git action are denied.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.read', 'local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, command: { type: 'array', items: { type: 'string' } }, cwd: { type: 'string' }, max_output_bytes: { type: 'number' } }, required: ['target_key', 'command'], additionalProperties: false } },
     { actionId: 'execute_project_script', title: 'Execute verified project script', description: 'Execute one exact script below an authorized read-write target through a fixed interpreter after its SHA-256 digest and strong confirmation match. Eval flags and shell command strings are never accepted.', readOnly: false, risk: 'destructive', confirmation: 'strong_confirmation', requiredConfirmationText: 'execute-local-system-project-script', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.read', 'local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { target_key: { type: 'string' }, runtime: { type: 'string', enum: ['node', 'bun', 'python3', 'ruby', 'bash', 'sh'] }, script_path: { type: 'string' }, expected_sha256: { type: 'string' }, arguments: { type: 'array', items: { type: 'string' } }, cwd: { type: 'string' }, max_output_bytes: { type: 'number' } }, required: ['target_key', 'runtime', 'script_path', 'expected_sha256'], additionalProperties: false } },
     { actionId: 'create_directory', title: 'Create directory', description: 'Create a directory below an authorized target without leaving that root.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 15_000, cancellable: true, idempotent: true, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: targetProperties, required: ['target_key', 'path'], additionalProperties: false } },
     { actionId: 'copy_file', title: 'Copy file', description: 'Copy a file between authorized targets without overwriting.', readOnly: false, risk: 'workspace_write', confirmation: 'authorization', defaultTimeoutMs: 30_000, cancellable: true, idempotent: false, scopes: ['local-system.files.write'], resourceClaims: controllerWrite, argumentsSchema: { type: 'object', properties: { source_target_key: { type: 'string' }, source_path: { type: 'string' }, destination_target_key: { type: 'string' }, destination_path: { type: 'string' } }, required: ['source_target_key', 'source_path', 'destination_target_key', 'destination_path'], additionalProperties: false } },
@@ -859,6 +851,7 @@ function permissions(): AssistantPluginPermissionScope[] {
     { scope: 'local-system.read', mode: 'read', description: 'Read bounded local process and memory diagnostics.', granted: true, required: true },
     { scope: 'local-system.process', mode: 'write', description: 'Terminate one verified PID or control one verified current-user LaunchAgent after explicit authorization.', granted: true, required: false },
     { scope: 'local-system.open', mode: 'write', description: 'Open applications or authorized files.', granted: true, required: false },
+    { scope: 'local-system.browser-adapter', mode: 'write', description: 'Install and inspect the Controller-owned Workflow Supervisor Chrome adapter and exact Native Messaging registration.', granted: true, required: false },
     { scope: 'local-system.files.read', mode: 'read', description: 'Read files only below active target grants.', granted: true, required: false },
     { scope: 'local-system.files.write', mode: 'write', description: 'Create, copy, move, rename, or explicitly delete bounded files and empty directories below active read-write target grants.', granted: true, required: false },
   ];
@@ -870,8 +863,9 @@ function capabilities(): AssistantPluginCapability[] {
     { capabilityId: 'local-system-process-control', title: 'Verified process lifecycle', description: 'Terminate one verified PID or stop/start/restart one verified macOS user LaunchAgent without exposing arbitrary shell execution.', scopes: ['local-system.process'], actions: ['terminate_process', 'restart_user_launch_agent', 'stop_user_launch_agent', 'start_user_launch_agent'] },
     { capabilityId: 'local-system-recovery-upgrade', title: 'Managed standalone Recovery upgrade', description: 'Upgrade standalone Recovery only from its installed configured source through the immutable Recovery release and rollback authority.', scopes: ['local-system.process'], actions: ['upgrade_standalone_recovery'] },
     { capabilityId: 'local-system-recovery-tunnel-repair', title: 'Managed standalone Recovery tunnel repair', description: 'Repair only the installed Recovery public tunnel through the existing Recovery tunnel repair authority when the Recovery transport itself is unreachable.', scopes: ['local-system.process'], actions: ['repair_standalone_recovery_tunnel'] },
+    { capabilityId: 'local-system-workflow-supervisor-browser-adapter', title: 'Workflow Supervisor browser adapter', description: 'Inspect or install the stateless Chrome adapter projection used by the Goal-level Workflow Supervisor authority.', scopes: ['local-system.browser-adapter'], actions: ['workflow_supervisor_browser_adapter_status', 'install_workflow_supervisor_browser_adapter'] },
     { capabilityId: 'local-system-open', title: 'Open local applications and files', description: 'Open applications and authorized files without arbitrary shell access.', scopes: ['local-system.open'], actions: ['open_application', 'reveal_in_finder', 'open_file'] },
-    { capabilityId: 'local-system-files', title: 'Authorized local files', description: 'Use expiring target grants for bounded local file operations and typed-argv commands without repository registration.', scopes: ['local-system.files.read', 'local-system.files.write'], actions: ['list_targets', 'authorize_target', 'revoke_target', 'list_directory', 'read_text', 'write_text', 'delete_file', 'delete_empty_directory', 'initialize_git', 'execute_command', 'execute_project_script', 'create_directory', 'copy_file', 'move_file', 'rename_file'] },
+    { capabilityId: 'local-system-files', title: 'Authorized local files', description: 'Use expiring target grants for bounded local file operations without repository registration; terminal commands use the single execute_command MCP tool.', scopes: ['local-system.files.read', 'local-system.files.write'], actions: ['list_targets', 'authorize_target', 'revoke_target', 'list_directory', 'read_text', 'write_text', 'delete_file', 'delete_empty_directory', 'initialize_git', 'execute_project_script', 'create_directory', 'copy_file', 'move_file', 'rename_file'] },
   ];
 }
 
@@ -884,7 +878,7 @@ export function buildLocalSystemPluginManifest(previousRevision = 0, previousUpd
     pluginId: PLUGIN_ID,
     provider: 'local-macos',
     displayName: 'Local System Assistant',
-    pluginVersion: '1.5.1',
+    pluginVersion: '1.5.3',
     authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controllerHome:system/local-system'] },
     enabled: true,
     lifecycle: { state: currentHealth.ready ? 'enabled' : 'degraded', reason: currentHealth.ready ? 'Local system capabilities are ready.' : currentHealth.warnings[0] },
@@ -927,6 +921,8 @@ export async function executeLocalSystemPluginAction(input: AssistantPluginActio
     case 'start_user_launch_agent': return startVerifiedUserLaunchAgent(input.args.label, input.args.expected_program_contains);
     case 'upgrade_standalone_recovery': return await upgradeStandaloneRecovery(input.controllerHome);
     case 'repair_standalone_recovery_tunnel': return await repairStandaloneRecoveryTunnel(input.controllerHome);
+    case 'workflow_supervisor_browser_adapter_status': return (hooks.inspectWorkflowSupervisorBrowserAdapter ?? inspectWorkflowSupervisorBrowserAdapter)(input.controllerHome, { repository: { repoId: input.repoId, repoRoot: input.repoRoot } }) as unknown as Record<string, unknown>;
+    case 'install_workflow_supervisor_browser_adapter': return (hooks.installWorkflowSupervisorBrowserAdapter ?? installWorkflowSupervisorBrowserAdapter)(input.controllerHome, { repository: { repoId: input.repoId, repoRoot: input.repoRoot } }) as unknown as Record<string, unknown>;
     case 'open_application': {
       const appName = optionalString(input.args, 'app_name');
       const bundleId = optionalString(input.args, 'bundle_id');
@@ -1083,90 +1079,6 @@ export async function executeLocalSystemPluginAction(input: AssistantPluginActio
         return { initialized: true, targetKey: resolved.target.targetKey, workspaceId: resolved.target.workspaceId, cwd: resolved.relativePath || '.', repositoryRegistered: false, command, stdout: executed.stdout, stderr: executed.stderr };
       });
     }
-    case 'execute_command': {
-      const targetKey = requiredString(input.args, 'target_key');
-      const argv = requiredStringArray(input.args, 'command');
-      const canonical = assertRepositoryCommandInputAllowed(argv);
-      if (canonical.kind !== 'argv') {
-        throw new AssistantPluginError('LOCAL_SYSTEM_COMMAND_TYPED_ARGV_REQUIRED', 'Target commands must use typed argv and cannot use a shell string.', { retryable: false });
-      }
-      const classification = classifyRepositoryCommand(canonical);
-      if (classification.risk === 'remote_write' || classification.risk === 'destructive') {
-        throw new AssistantPluginError('LOCAL_SYSTEM_COMMAND_RISK_DENIED', `Target command risk ${classification.risk} is not supported without repository registration.`, { retryable: false });
-      }
-      const executable = canonical.executable!.split(/[\\/]/).at(-1)?.toLowerCase() ?? '';
-      if (executable === 'git' && classification.risk !== 'readonly') {
-        throw new AssistantPluginError('LOCAL_SYSTEM_GIT_MUTATION_REQUIRES_REPOSITORY', 'Git mutations require a registered repository/checkout so refs and worktree ownership remain fenced.', { retryable: false });
-      }
-      if (classification.risk === 'workspace_write') {
-        const replay = classifyRepositoryCommandReplay(canonical);
-        const boundedFilesystemMutation = TARGET_SAFE_FILESYSTEM_MUTATORS.has(executable);
-        if (!boundedFilesystemMutation && !replay.replayable) {
-          throw new AssistantPluginError(
-            'LOCAL_SYSTEM_COMMAND_REPOSITORY_REQUIRED',
-            `Target command ${executable || '<unknown>'} has unbounded or unclassified side effects; register/promote the target before executing it.`,
-            { retryable: false },
-          );
-        }
-      }
-      const operation: WorkspaceTargetOperation = classification.risk === 'readonly' ? 'read' : 'write';
-      const execute = async () => {
-        let resolved;
-        try {
-          resolved = resolveWorkspaceTargetCwd(
-            input.controllerHome,
-            targetKey,
-            requestOwnerScope(input),
-            optionalString(input.args, 'cwd') ?? '.',
-            operation,
-            currentDate(),
-          );
-        } catch (error) {
-          return rethrowTargetError(error);
-        }
-        assertCommandPathOperandsStayInRepository(canonical, resolved.path, resolved.root, []);
-        const maxOutputBytes = Math.max(1_024, Math.min(Math.trunc(Number(input.args.max_output_bytes ?? MAX_OUTPUT_BYTES)), 1024 * 1024));
-        const timeoutMs = Math.max(1_000, Math.min(Math.trunc(input.timeoutMs ?? 30_000), 30_000));
-        const executed = await runCanonicalCommand(canonical, resolved.path, timeoutMs, maxOutputBytes, { signal: input.signal });
-        if (!executed.ok) {
-          const code = executed.timedOut
-            ? 'LOCAL_SYSTEM_COMMAND_TIMED_OUT'
-            : executed.cancelled
-              ? 'LOCAL_SYSTEM_COMMAND_CANCELLED'
-              : 'LOCAL_SYSTEM_COMMAND_FAILED';
-          const message = executed.stderr.trim()
-            || executed.stdout.trim()
-            || `Target command exited with code ${executed.exitCode}.`;
-          throw new AssistantPluginError(code, bounded(message, maxOutputBytes).content, {
-            retryable: executed.timedOut,
-            details: {
-              command: argv,
-              exitCode: executed.exitCode,
-              timedOut: executed.timedOut,
-              cancelled: executed.cancelled,
-            },
-          });
-        }
-        return {
-          targetKey: resolved.target.targetKey,
-          workspaceId: resolved.target.workspaceId,
-          identityFingerprint: resolved.target.identityFingerprint,
-          repositoryRegistered: false,
-          cwd: resolved.relativePath || '.',
-          command: argv,
-          classification,
-          ok: executed.ok,
-          exitCode: executed.exitCode,
-          timedOut: executed.timedOut,
-          cancelled: executed.cancelled,
-          stdout: executed.stdout,
-          stderr: executed.stderr,
-        };
-      };
-      return operation === 'write'
-        ? await withTargetMutation(input, [targetKey], execute)
-        : await execute();
-    }
     case 'execute_project_script': {
       const targetKey = requiredString(input.args, 'target_key');
       const runtime = requiredString(input.args, 'runtime').toLowerCase();

package/src/runtime/plugins/managed-process-adapter.ts

@@ -1,14 +1,14 @@
 import { spawn, spawnSync } from 'child_process';
 import { existsSync, statSync } from 'fs';
 import { dirname, isAbsolute, resolve } from 'path';
-import { AssistantPluginError } from './errors';
+import { MAX_PLUGIN_ACTION_TIMEOUT_MS } from '../../../packages/plugin-runtime/external/index';
+import { AssistantPluginError, type AssistantPluginEffectOutcome } from './errors';
 
 export const MANAGED_PLUGIN_PROTOCOL_VERSION = 1;
 const DEFAULT_MAX_REQUEST_BYTES = 1_048_576;
 const DEFAULT_MAX_RESPONSE_BYTES = 1_048_576;
 const DEFAULT_MAX_STDERR_CHARS = 8_000;
 const DEFAULT_TIMEOUT_MS = 30_000;
-const MAX_TIMEOUT_MS = 120_000;
 
 interface ManagedPluginHandshake {
   schemaVersion: 1;
@@ -60,12 +60,14 @@ export interface ManagedPluginProcessRequest {
   actionId: string;
   input: Record<string, unknown>;
   timeoutMs?: number;
+  effectOutcomeOnTimeout?: AssistantPluginEffectOutcome;
   signal?: AbortSignal;
 }
 
-function managedError(code: string, message: string, options: { retryable?: boolean; details?: Record<string, unknown> } = {}): AssistantPluginError {
+function managedError(code: string, message: string, options: { retryable?: boolean; effectOutcome?: AssistantPluginEffectOutcome; details?: Record<string, unknown> } = {}): AssistantPluginError {
   return new AssistantPluginError(code, message, {
     retryable: options.retryable ?? true,
+    effectOutcome: options.effectOutcome,
     details: options.details,
   });
 }
@@ -73,7 +75,7 @@ function managedError(code: string, message: string, options: { retryable?: bool
 function boundedTimeout(spec: ManagedPluginProcessSpec, request: ManagedPluginProcessRequest): number {
   const requested = request.timeoutMs ?? spec.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   if (!Number.isFinite(requested)) return DEFAULT_TIMEOUT_MS;
-  return Math.min(Math.max(Math.trunc(requested), 50), MAX_TIMEOUT_MS);
+  return Math.min(Math.max(Math.trunc(requested), 50), MAX_PLUGIN_ACTION_TIMEOUT_MS);
 }
 
 function minimalEnvironment(runtimeExecutable: string): NodeJS.ProcessEnv {
@@ -257,6 +259,7 @@ export async function executeManagedPluginProcess(
     let stdoutBytes = 0;
     let stderr = '';
     let handshakeReceived = false;
+    let requestDispatched = false;
     let settled = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let killTimer: ReturnType<typeof setTimeout> | undefined;
@@ -298,6 +301,7 @@ export async function executeManagedPluginProcess(
         if (!handshakeReceived) {
           validateHandshake(parsed, spec);
           handshakeReceived = true;
+          requestDispatched = true;
           child.stdin.end(`${requestEnvelope}\n`);
           return;
         }
@@ -318,7 +322,10 @@ export async function executeManagedPluginProcess(
     };
 
     timer = setTimeout(() => {
-      fail(managedError('PLUGIN_MANAGED_PROCESS_TIMEOUT', 'Managed plugin helper timed out.', { retryable: true }));
+      fail(managedError('PLUGIN_MANAGED_PROCESS_TIMEOUT', 'Managed plugin helper timed out.', {
+        retryable: true,
+        effectOutcome: requestDispatched ? request.effectOutcomeOnTimeout : 'failed',
+      }));
     }, boundedTimeout(spec, request));
     request.signal?.addEventListener('abort', onAbort, { once: true });
 

package/src/runtime/plugins/plugin-action-sidecar.ts

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import { createHash } from 'crypto';
-import { readFileSync, rmSync } from 'fs';
+import { readFileSync, rmSync, writeFileSync } from 'fs';
 import { getRepository } from '../../cli/repositories/registry';
 import type { AssistantPluginActionRequest } from './types';
-import { submitAssistantPluginAction } from './store';
+import { submitAssistantPluginAction, submitControllerPluginAction } from './store';
 
 interface Envelope {
   schemaVersion: 1;
   controllerHome: string;
-  repoId: string;
+  repoId?: string;
+  scope?: { kind: 'controller' } | { kind: 'repository'; repoId: string };
   request: Omit<AssistantPluginActionRequest, 'signal'>;
 }
 
@@ -30,13 +31,16 @@ export async function runPluginActionSidecar(argv = process.argv.slice(2)): Prom
     }
     const envelope = JSON.parse(bytes) as Envelope;
     if (envelope.schemaVersion !== 1) throw new Error('PLUGIN_ACTION_REQUEST_VERSION_UNSUPPORTED');
-    const repository = getRepository(envelope.repoId, envelope.controllerHome);
-    const submitted = await submitAssistantPluginAction(
-      envelope.controllerHome,
-      repository,
-      envelope.request,
-    );
-    process.stdout.write(`${JSON.stringify({
+    const controllerScoped = envelope.scope?.kind === 'controller';
+    const repoId = envelope.scope?.kind === 'repository' ? envelope.scope.repoId : envelope.repoId;
+    const submitted = controllerScoped
+      ? await submitControllerPluginAction(envelope.controllerHome, envelope.request)
+      : await submitAssistantPluginAction(
+          envelope.controllerHome,
+          getRepository(repoId ?? '', envelope.controllerHome),
+          envelope.request,
+        );
+    writeFileSync(1, `${JSON.stringify({
       ok: true,
       requestId: submitted.receipt.requestId,
       receiptId: submitted.receipt.receiptId,
@@ -51,9 +55,9 @@ export async function runPluginActionSidecar(argv = process.argv.slice(2)): Prom
 const direct = typeof process.argv[1] === 'string' && process.argv[1].includes('plugin-action-sidecar');
 if (direct) {
   void runPluginActionSidecar()
-    .then((code) => { process.exitCode = code; })
+    .then((code) => { process.exit(code); })
     .catch((error) => {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exitCode = 1;
+      writeFileSync(2, `${error instanceof Error ? error.message : String(error)}\n`);
+      process.exit(1);
     });
 }

package/src/runtime/plugins/plugin-management-adapter.ts

@@ -129,7 +129,7 @@ export function buildPluginManagementManifest(previousRevision = 0, previousUpda
   return {
     schemaVersion: 1, manifestVersion: 1, revision: Math.max(1, previousRevision || 1), pluginId: PLUGIN_ID,
     provider: 'forge-controller', displayName: 'Forge Plugin Management', pluginVersion: '1.0.0',
-    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-home:plugins/external/registrations', 'controller-home:system/plugin-capability-authorizations/grants.json'] },
+    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-home:plugins/external/registrations', 'controller-home:system/authorization-grants/grants.json'] },
     enabled: true, lifecycle: { state: 'enabled', reason: 'Canonical external plugin registration authority is available.' },
     health: { state: 'ready', checkedAt: now(), ready: true, probed: true, errors: [], warnings: [] },
     permissions: permissions(), capabilities: capabilities(), actions: actions(), updatedAt: previousUpdatedAt ?? now(),