@north-light/api 0.3.589 → 0.3.591

package/dist/core/installed-plugins.js

@@ -12,8 +12,7 @@ import { CONFIG_FILE } from '../types.js';
 import { listDirs, pathExists, readJsonIfExists } from './fs-utils.js';
 import { readPluginManifest } from './manifest.js';
 import { awaitBundleSwap, bundleSwapInFlightElsewhere } from './plugin-swap-lock.js';
-import { isCloudRole, requestPersonId } from './canvas/person-state.js';
-import { materializedPluginsDir } from './scoped-state/materialized-plugins.js';
+import { isCloudRole } from './canvas/person-state.js';
 import { readCachedSettings } from './scoped-state/person-store.js';
 import { pluginsDir } from './scope.js';
 function pluginConfigForRoot(scope, root) {
@@ -41,12 +40,11 @@ function swapsToWaitOut(scopeRootPath, cfg, present) {
     return names.filter((name) => !present.has(name) && bundleSwapInFlightElsewhere(scopeRootPath, name));
 }
 export function listInstalledPluginsInRoot(scope, scopeRootPath) {
-    // A cloud-role process serves many people and holds no plugin directories of its own: it reads the bytes it materialized for the
-    // request's person, and none outside a request.
-    const person = scope === 'user' && isCloudRole() ? requestPersonId() : undefined;
-    if (scope === 'user' && isCloudRole() && person === undefined)
+    // A cloud-role process serves many people and holds no plugin directories: a node's plugin kinds come from publication rows
+    // (`appLaunchKinds`) and its plugin code from the sandbox that runs it.
+    if (scope === 'user' && isCloudRole())
         return [];
-    const dir = scope !== 'user' ? join(scopeRootPath, 'plugins') : person !== undefined ? materializedPluginsDir(person) : pluginsDir('user');
+    const dir = scope !== 'user' ? join(scopeRootPath, 'plugins') : pluginsDir('user');
     if (dir === undefined || !pathExists(dir))
         return [];
     const cfg = pluginConfigForRoot(scope, scopeRootPath);

package/dist/core/packages/eligibility.d.ts

@@ -0,0 +1,16 @@
+/** The read rule for shipped package documents: which published package apps a reader may read the documents of.
+ *  `crtr` (builtin) always; a provider when the reader's scopes hold a scope of it; a plugin on a Mac always (the local install set is the Mac's
+ *  own), on a cloud role when the reader's app has it enabled from the marketplace the publication was read from. The ceiling applies the set to
+ *  every shipped document whichever root admitted it. */
+import type { CanvasDb } from '../canvas/db.js';
+export interface EligibilityInput {
+    /** whether the reader's scopes hold a scope of the provider app with this external id (`app:<id>`) */
+    holdsProvider: (appExt: string) => boolean;
+    cloud: boolean;
+    /** the reader's app external id (`app:<id>`), null when the app has none */
+    ownExt: string | null;
+    /** the bare user id the reader acts for; null for a reader that acts for no person */
+    user: string | null;
+}
+/** Object ids of the live published package apps the reader may read the shipped documents of. */
+export declare function eligiblePackageApps(db: CanvasDb, input: EligibilityInput): Promise<string[]>;

package/dist/core/packages/eligibility.js

@@ -0,0 +1,34 @@
+import { normalizeSourceUrl } from './source-url.js';
+/** Object ids of the live published package apps the reader may read the shipped documents of. */
+export async function eligiblePackageApps(db, input) {
+    const rows = await db.prepare(`SELECT p.app, p.origin, p.source, i.external_id FROM package_publications p
+    JOIN identities i ON i.object = p.app AND i.scheme = 'app' WHERE p.withdrawn_at IS NULL`).all();
+    let installed = null;
+    const installs = async () => {
+        if (installed !== null)
+            return installed;
+        installed = new Map();
+        if (input.user === null || input.ownExt === null)
+            return installed;
+        const found = await db.prepare(`SELECT p.name, m.url FROM scope_plugins p JOIN scope_marketplaces m
+        ON m.person = p.person AND m.owner_key = p.owner_key AND m.name = p.source_marketplace
+      WHERE p.person = ? AND p.owner_key = ? AND p.enabled = 1 AND m.url IS NOT NULL`).all(`user:${input.user}`, input.ownExt);
+        for (const r of found)
+            installed.set(r.name, normalizeSourceUrl(r.url));
+        return installed;
+    };
+    const eligible = [];
+    for (const r of rows) {
+        if (r.origin === 'builtin')
+            eligible.push(r.app);
+        else if (r.origin === 'provider') {
+            if (input.holdsProvider(r.external_id))
+                eligible.push(r.app);
+        }
+        else if (!input.cloud)
+            eligible.push(r.app);
+        else if (r.source !== null && (await installs()).get(r.external_id.replace(/^app:/, '')) === r.source)
+            eligible.push(r.app);
+    }
+    return eligible;
+}

package/dist/core/packages/launch-kinds.d.ts

@@ -0,0 +1,6 @@
+/** The launch `kinds` a cloud role layers into a node's launch config: those of the plugins enabled in the node's app whose published package was
+ *  read from the marketplace the app installed it from. A cloud role holds no plugin directories, so the publication rows are the only source. */
+import type { CanvasDb } from '../canvas/db.js';
+import type { PersonSnapshot } from '../scoped-state/person-store.js';
+/** Launch kinds by plugin name for the plugins enabled in `app`, from live publication rows whose `source` is the install's marketplace. */
+export declare function appLaunchKinds(db: CanvasDb, snapshot: PersonSnapshot, app: string): Promise<Record<string, unknown>>;

package/dist/core/packages/launch-kinds.js

@@ -0,0 +1,20 @@
+import { normalizeSourceUrl } from './source-url.js';
+/** Launch kinds by plugin name for the plugins enabled in `app`, from live publication rows whose `source` is the install's marketplace. */
+export async function appLaunchKinds(db, snapshot, app) {
+    const block = snapshot.apps[app];
+    if (block === undefined)
+        return {};
+    const out = {};
+    for (const [name, entry] of Object.entries(block.plugins)) {
+        if (entry.enabled === false || entry.source_marketplace === undefined)
+            continue;
+        const url = block.marketplaces[entry.source_marketplace]?.url;
+        if (url === undefined)
+            continue;
+        const row = await db.prepare(`SELECT p.source, p.launch_kinds_json FROM package_publications p JOIN identities i ON i.object = p.app AND i.scheme = 'app'
+      WHERE i.external_id = ? AND p.origin = 'plugin' AND p.withdrawn_at IS NULL AND p.launch_kinds_json IS NOT NULL`).get(`app:${name}`);
+        if (row !== undefined && row.source === normalizeSourceUrl(url))
+            out[name] = JSON.parse(row.launch_kinds_json);
+    }
+    return out;
+}

package/dist/core/packages/source-url.d.ts

@@ -0,0 +1,3 @@
+/** A marketplace git URL as the directory normalizes it: lowercased host, no `.git` suffix, no trailing slash. A plugin package is published
+ *  with this URL as its `source`, and the read rule matches an install's marketplace URL against it. */
+export declare function normalizeSourceUrl(url: string): string;

package/dist/core/packages/source-url.js

@@ -0,0 +1,17 @@
+/** A marketplace git URL as the directory normalizes it: lowercased host, no `.git` suffix, no trailing slash. A plugin package is published
+ *  with this URL as its `source`, and the read rule matches an install's marketplace URL against it. */
+export function normalizeSourceUrl(url) {
+    const trimmed = url.trim();
+    let out;
+    try {
+        const u = new URL(trimmed);
+        u.hostname = u.hostname.toLowerCase();
+        out = u.toString();
+    }
+    catch {
+        // scp-style `git@host:owner/repo`: lowercase the host part only
+        const m = /^([^@\s]+@)?([^:/\s]+):(.+)$/.exec(trimmed);
+        out = m === null ? trimmed : `${m[1] ?? ''}${m[2].toLowerCase()}:${m[3]}`;
+    }
+    return out.replace(/\/+$/, '').replace(/\.git$/, '').replace(/\/+$/, '');
+}

package/dist/core/permissions/ceiling.d.ts

@@ -28,6 +28,9 @@ export interface Ceiling {
     /** App object ids for the `authored:` match (first-revision author rule): the caller's app and every first-party app, one whose grant holds
      *  `crtr:memory:manage:user` always. A revoked first-party grant still counts: revocation stops its calls, not who wrote the document. */
     authorApps: string[];
+    /** The read rule for shipped package documents: the published package apps (object ids) whose shipped documents the reader may read. A shipped document
+     *  (`documents.source_path` set) passes only when its owner is in this set, whichever root admitted it. Null: no read is asked, nothing is narrowed. */
+    packageApps: string[] | null;
 }
 export type Access = 'read' | 'write' | 'message';
 export interface CeilingOptions {
@@ -38,8 +41,12 @@ export interface CeilingOptions {
 export declare function personObjectIds(db: CanvasDb): Promise<string[]>;
 /** Whether `scopes` hold a provider-group scope `<provider>:<group>` of the app whose external id is `appExt`: what lets a run read that app's private objects. */
 export declare function holdsProviderGroup(scopes: readonly string[], appExt: string): boolean;
-/** The ceiling of `reader` for `access`; null for a person reader (no ceiling). */
-export declare function resolveCeiling(db: CanvasDb, reader: Reader, access: Access, options?: CeilingOptions): Promise<Ceiling | null>;
+/** The published package apps whose shipped documents `reader` may read (the read rule); null for a person reader, who reads every package. `user` is the
+ *  bare user id the reader acts for, null for a reader that acts for no person. A revoked grant (null scopes) holds no provider scope. */
+export declare function readablePackageApps(db: CanvasDb, reader: Reader, user: string | null): Promise<string[] | null>;
+/** The ceiling of `reader` for `access`; null for a person reader (no ceiling). `user` is the bare user id the reader acts for (`readerUser`), null for a
+ *  reader that acts for no person: it reads the package apps every reader reads and the providers its scopes hold, never a plugin. */
+export declare function resolveCeiling(db: CanvasDb, reader: Reader, user: string | null, access: Access, options?: CeilingOptions): Promise<Ceiling | null>;
 export interface RunPlace {
     run: string;
     isolated: boolean;

package/dist/core/permissions/ceiling.js

@@ -2,9 +2,11 @@
 // then applied inside the same query as the schema check (`ceilingFrag`). A person reader has no ceiling. Privacy (`private` per root), run
 // confinement (`place`) and the launched own-memory narrowing are all rules here; none of them is schema text.
 import { covers } from '@north-light/identity';
+import { isCloudRole } from '../canvas/person-state.js';
+import { eligiblePackageApps } from '../packages/eligibility.js';
 import { fileRoot } from '../spaces/file-root.js';
 import { FALSE, TRUE, and, f, or, raw } from './sql.js';
-const empty = (ownApp) => ({ ownApp, roots: [], namespaces: [], place: null, predicates: { allNodes: false, spaces: false }, authorApps: [] });
+const empty = (ownApp) => ({ ownApp, roots: [], namespaces: [], place: null, predicates: { allNodes: false, spaces: false }, authorApps: [], packageApps: null });
 async function externalId(db, objectId) {
     const row = await db.prepare('SELECT external_id FROM identities WHERE object = ? ORDER BY scheme LIMIT 1').get(objectId);
     return row?.external_id ?? null;
@@ -60,8 +62,17 @@ async function repoRoots(db, reader, access) {
             ids.add(c.repo.id);
     return [...ids];
 }
-/** The ceiling of `reader` for `access`; null for a person reader (no ceiling). */
-export async function resolveCeiling(db, reader, access, options = {}) {
+/** The published package apps whose shipped documents `reader` may read (the read rule); null for a person reader, who reads every package. `user` is the
+ *  bare user id the reader acts for, null for a reader that acts for no person. A revoked grant (null scopes) holds no provider scope. */
+export async function readablePackageApps(db, reader, user) {
+    if (reader.class === 'person')
+        return null;
+    const held = reader.scopes;
+    return await eligiblePackageApps(db, { holdsProvider: (ext) => held !== null && holdsProviderGroup(held, ext), cloud: isCloudRole(), ownExt: await externalId(db, reader.app.id), user });
+}
+/** The ceiling of `reader` for `access`; null for a person reader (no ceiling). `user` is the bare user id the reader acts for (`readerUser`), null for a
+ *  reader that acts for no person: it reads the package apps every reader reads and the providers its scopes hold, never a plugin. */
+export async function resolveCeiling(db, reader, user, access, options = {}) {
     if (reader.class === 'person')
         return null;
     const c = empty(reader.app.id);
@@ -90,6 +101,9 @@ export async function resolveCeiling(db, reader, access, options = {}) {
                 own(p.id, 'no-node');
         }
     }
+    // The shipped-document filter applies to every reader, a revoked grant's included: it holds no provider scope, so it reads only the package apps eligible without one.
+    if (access === 'read')
+        c.packageApps = await readablePackageApps(db, reader, user) ?? [];
     if (held === null)
         return c; // a revoked grant reaches only its own app
     c.predicates.spaces = true;
@@ -176,11 +190,9 @@ export async function resolveCeiling(db, reader, access, options = {}) {
     }
     // ---- tool-usable apps (read): their shipped documents and custom objects
     if (access === 'read') {
-        const apps = await db.prepare(`SELECT a.id FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
-      SELECT 1 FROM objects o JOIN documents d ON d.object = o.id WHERE o.owner = a.id AND o.type = 'document' AND o.deleted_at IS NULL AND d.source_path IS NOT NULL)`).all();
-        for (const a of apps)
-            if (a.id !== reader.app.id)
-                c.roots.push({ id: a.id, private: false, match: 'shipped' });
+        for (const id of c.packageApps ?? [])
+            if (id !== reader.app.id)
+                c.roots.push({ id, private: false, match: 'shipped' });
         for (const a of await db.prepare("SELECT o.id, i.external_id FROM objects o JOIN identities i ON i.object = o.id AND i.scheme = 'app' WHERE o.type = 'app' AND o.deleted_at IS NULL").all()) {
             if (a.id !== reader.app.id)
                 c.roots.push({ id: a.id, private: holdsProviderGroup(held, a.external_id), match: 'custom' });
@@ -256,7 +268,9 @@ export function ceilingFrag(c, o) {
         parts.push(raw(`(${o}.type = 'node' AND ${o}.privacy = 'public')`));
     if (c.predicates.spaces)
         parts.push(raw(`(${o}.owner IS NULL AND ${o}.type IN ('app','person','repo'))`));
-    return and([or(parts), placeFrag(c, o)]);
+    const shipped = c.packageApps === null ? TRUE
+        : f `(NOT EXISTS (SELECT 1 FROM documents sd WHERE sd.object = ${raw(o)}.id AND sd.source_path IS NOT NULL) OR ${raw(o)}.owner = ANY(${c.packageApps}::text[]))`;
+    return and([or(parts), placeFrag(c, o), shipped]);
 }
 /** Run confinement, for every object below the reader's own app regardless of the alternative that passed it (a root, an own namespace, `objects:read:node`):
  *  the nearest node of the object (below the app) must be in the reader's run, or neither it nor the reader's run is isolated. An object not

package/dist/core/permissions/evaluator.js

@@ -71,7 +71,7 @@ export async function permits(db, reader, permission, alias = 'o', options = {})
     }
     const schemaPart = cases.length === 0 ? f `(CASE WHEN ${raw(alias)}.schema_type IS NULL THEN ${builtin} ELSE FALSE END)`
         : f `(CASE WHEN ${raw(alias)}.schema_type IS NULL THEN ${builtin} ${{ sql: cases.map((c) => c.sql).join(' '), params: cases.flatMap((c) => c.params) }} ELSE FALSE END)`;
-    const ceiling = await resolveCeiling(db, ev.reader, ACCESS[permission], options);
+    const ceiling = await resolveCeiling(db, ev.reader, ev.userId, ACCESS[permission], options);
     if (ceiling === null)
         return schemaPart;
     return and([ceilingFrag(ceiling, alias), schemaPart]);

package/dist/core/providers/bundles.js

@@ -83,9 +83,8 @@ async function recordEtag(id, etag) {
     else
         atomicWriteText(etagFile(id), etag);
 }
-// Publishing a bundle's `memory/**` documents reconciles every installed user plugin. A cloud role has no per-person plugin list at grant sync
-// (outside a request), so that pass would see none installed and delete shipped documents, clear manifest kinds and revoke app tokens
-// deployment-wide. Provider documents are therefore not published on a cloud role.
+// A Mac publishes a bundle's `memory/**` documents with the rest of its local packages. A cloud role has no per-person plugin list at grant sync and holds
+// no provider document text: the directory serves each provider package and the api role's package sync publishes it. The pod-disk bundle here is for commands.
 async function reconcileProviderDocs(id) {
     if (isCloudRole())
         return;

package/dist/core/runtime/launch-target.d.ts

@@ -32,12 +32,16 @@ export declare function isLaunchKind(kind: string): boolean;
 /** Validate a kind against the same cwd/profile configuration used to build its launch.
  *  Resolution is subprocess-isolated: crtrd is single-threaded and a config read can
  *  block indefinitely on a network filesystem. */
-export declare function assertLaunchKind(kind: string, cwd?: string, profileId?: string | null): Promise<void>;
+export declare function assertLaunchKind(kind: string, cwd?: string, profileId?: string | null, 
+/** The app the kind is launched in. */
+app?: string): Promise<void>;
 /** Resolve the exact profile, kind, cwd, mode and launch recipe a create will use. */
 export declare function resolveLaunchTarget(req: CreateNodeRequest, options?: {
     readOnlyProfileSelection?: boolean;
     /** Preserve an existing caller's validation boundary before target resolution. */
-    validateKind?: (kind: string) => void | Promise<void>;
+    validateKind?: (kind: string, app: string) => void | Promise<void>;
+    /** The app the node runs in, when its caller is an app's broker or cron; else its parent's, else `app:terminal`. */
+    app?: string;
 }): Promise<ResolvedLaunchTarget>;
 /** The directory a new node is pinned to. */
 export declare function resolveNodeCwd(req: CreateNodeRequest, parent: string | undefined, _profileId: string | null, contextCwd: string): Promise<string>;

package/dist/core/runtime/launch-target.js

@@ -39,8 +39,10 @@ export function isLaunchKind(kind) {
 /** Validate a kind against the same cwd/profile configuration used to build its launch.
  *  Resolution is subprocess-isolated: crtrd is single-threaded and a config read can
  *  block indefinitely on a network filesystem. */
-export async function assertLaunchKind(kind, cwd = process.cwd(), profileId = envProfileId() || null) {
-    const kinds = Object.keys((await readMergedLaunchConfigAsync(cwd, profileId)).kinds);
+export async function assertLaunchKind(kind, cwd = process.cwd(), profileId = envProfileId() || null, 
+/** The app the kind is launched in. */
+app = 'app:terminal') {
+    const kinds = Object.keys((await readMergedLaunchConfigAsync(cwd, profileId, app)).kinds);
     if (!kinds.includes(kind)) {
         throw usage(`unknown kind: ${kind}`, { received: kind, next: `Valid kinds: ${kinds.sort().join(', ')}.` });
     }
@@ -54,10 +56,11 @@ export async function resolveLaunchTarget(req, options = {}) {
     });
     const profile = assertProfileActive(profileId);
     const kind = resolveCreateKind(req.kind, profile);
-    await options.validateKind?.(kind);
+    const app = options.app ?? (parent === undefined ? undefined : (await getNode(parent))?.grantee) ?? 'app:terminal';
+    await options.validateKind?.(kind, app);
     const cwd = await resolveNodeCwd({ ...req, kind }, parent, profileId, contextCwd);
     if (options.validateKind === undefined)
-        await assertLaunchKind(kind, cwd, profileId);
+        await assertLaunchKind(kind, cwd, profileId, app);
     const mode = (req.mode ?? 'base');
     const launch = (await buildLaunchSpecAsync(kind, mode, {
         lifecycle: req.root_lifecycle ?? (req.root === true ? 'resident' : 'terminal'),
@@ -65,6 +68,7 @@ export async function resolveLaunchTarget(req, options = {}) {
         ...(req.model !== undefined ? { model: req.model, modelOverride: true } : {}),
         cwd,
         profileId,
+        app,
     })).launch;
     return { profileId, profile, kind, mode, cwd, launch };
 }

package/dist/core/runtime/launch.d.ts

@@ -94,6 +94,9 @@ export interface LaunchBuildOptions {
      *  exactly the path that creates the user's sessions — so callers that
      *  know the node's profile must pass it explicitly (null = no profile). */
     profileId?: string | null;
+    /** The app the launched node runs in: a cloud role layers in the launch kinds of the plugins enabled in THIS app. Required by the async
+     *  builder (the only one a cloud role reaches); a launch for an existing or soon-to-exist node passes that node's own app. */
+    app?: string;
     /** Preserved intent from an existing launch recipe when rebuilding it. */
     modelIntent?: ModelIntent;
     /** Exact-consult launch: pass the captured `provider/id:thinking` spec
@@ -115,7 +118,9 @@ export declare function buildLaunchSpec(kind: string, mode: Mode, opts: LaunchBu
  * filesystem, so even an ordinary synchronous config read must never run on
  * its event loop.
  */
-export declare function buildLaunchSpecAsync(kind: string, mode: Mode, opts: LaunchBuildOptions): Promise<{
+export declare function buildLaunchSpecAsync(kind: string, mode: Mode, opts: LaunchBuildOptions & {
+    app: string;
+}): Promise<{
     launch: LaunchSpec;
     lifecycle: 'terminal' | 'resident';
 }>;
@@ -124,6 +129,8 @@ export declare function buildLaunchSpecAsync(kind: string, mode: Mode, opts: Lau
  *  failure, an uncaught exception). Exported for tests. */
 export declare function describeLaunchConfigExit(code: number | null, signal: NodeJS.Signals | null, stderr: string): string;
 export declare function readMergedLaunchConfigAsync(cwd: string, profileId: string | null, 
+/** The app the launch runs in. */
+app: string, 
 /** Test seam: the interpreter and worker script to fork with. */
 seam?: {
     execPath?: string;

package/dist/core/runtime/launch.js

@@ -12,7 +12,9 @@ import { envProfileId } from '../../shared/env.js';
 import { readMergedLaunchConfig } from '../config.js';
 import { fork } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { personId, PersonUnresolvedError, PersonOutsideRequestError } from '../canvas/person-state.js';
+import { isCloudRole, personId, PersonUnresolvedError, PersonOutsideRequestError } from '../canvas/person-state.js';
+import { openDb } from '../canvas/db.js';
+import { appLaunchKinds } from '../packages/launch-kinds.js';
 import { currentSnapshot, PersonSettingsNotLoadedError } from '../scoped-state/person-store.js';
 import { freshChildNodeExecPath, recheckChildNode } from './branded-host.js';
 import { LAUNCH_SYSTEM_PROMPT } from './launch-prompt.js';
@@ -277,7 +279,7 @@ export function buildLaunchSpec(kind, mode, opts) {
 export async function buildLaunchSpecAsync(kind, mode, opts) {
     const cwd = opts.cwd ?? process.cwd();
     const profileId = opts.profileId !== undefined ? opts.profileId : (envProfileId() || null);
-    const merged = await readMergedLaunchConfigAsync(cwd, profileId);
+    const merged = await readMergedLaunchConfigAsync(cwd, profileId, opts.app);
     return buildLaunchSpecFromMerged(kind, mode, opts, merged);
 }
 const LAUNCH_CONFIG_TIMEOUT_MS = 15_000;
@@ -293,12 +295,17 @@ export function describeLaunchConfigExit(code, signal, stderr) {
 class LaunchConfigWorkerCrash extends Error {
 }
 export async function readMergedLaunchConfigAsync(cwd, profileId, 
+/** The app the launch runs in. */
+app, 
 /** Test seam: the interpreter and worker script to fork with. */
 seam = {}) {
     const execPath = seam.execPath ?? await freshChildNodeExecPath();
     const workerPath = seam.workerPath ?? fileURLToPath(new URL('./launch-config-worker.js', import.meta.url));
+    // A cloud role holds no plugin directories: the worker gets the launch kinds of the plugins enabled in the launch's app, read here from publication rows.
+    const held = heldPersonSettings();
+    const pluginKinds = !isCloudRole() ? undefined : 'snapshot' in held ? await appLaunchKinds(await openDb(), held.snapshot, app) : {};
     try {
-        return await runLaunchConfigWorker(cwd, profileId, execPath, workerPath);
+        return await runLaunchConfigWorker(cwd, profileId, execPath, workerPath, held, pluginKinds);
     }
     catch (error) {
         if (!(error instanceof LaunchConfigWorkerCrash))
@@ -309,7 +316,7 @@ seam = {}) {
         const next = await recheckChildNode(execPath);
         if (next === execPath)
             throw error;
-        return runLaunchConfigWorker(cwd, profileId, next, workerPath);
+        return runLaunchConfigWorker(cwd, profileId, next, workerPath, held, pluginKinds);
     }
 }
 /** The calling process's person and settings snapshot, when it holds them (a process with none reads defaults, as the worker will). */
@@ -323,7 +330,7 @@ function heldPersonSettings() {
         throw error;
     }
 }
-function runLaunchConfigWorker(cwd, profileId, execPath, workerPath) {
+function runLaunchConfigWorker(cwd, profileId, execPath, workerPath, held, appPluginKinds) {
     return new Promise((resolve, reject) => {
         const child = fork(workerPath, [], {
             execPath,
@@ -332,7 +339,7 @@ function runLaunchConfigWorker(cwd, profileId, execPath, workerPath) {
         });
         let stderr = '';
         child.stderr?.setEncoding('utf8').on('data', (chunk) => { stderr = (stderr + chunk).slice(-8_192); });
-        child.send({ cwd, profileId, ...heldPersonSettings() });
+        child.send({ cwd, profileId, ...held, appPluginKinds });
         let settled = false;
         const finish = (fn) => {
             if (settled)

package/dist/core/runtime/spawn.js

@@ -313,13 +313,13 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch, afterNodeCrea
     // before node creation remains the sole authoritative race decider.
     const profileId = await resolveProfileId(opts.profile, spawner, birthCwd);
     const launchGrant = opts.run?.grant_id ?? spawnerNode?.grant_id ?? null;
+    // The identity the node will carry (a run's own, else its creator's or spawner's, else the terminal person) pays for it and picks the app it launches in.
+    const payerSource = opts.run ?? creatorNode ?? spawnerNode ?? forkSourceMeta;
     const preflightLaunch = await appPaidLaunch((await buildLaunchSpecAsync(opts.kind, mode, {
-        lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: birthCwd, profileId,
+        lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: birthCwd, profileId, app: payerSource?.grantee ?? 'app:terminal',
     })).launch, launchGrant, opts.model);
     await assertLaunchModelRegistered(requestFromLaunch(preflightLaunch), { cwd: birthCwd, profileId });
-    // The start check, before any worktree or node row exists: a refusal leaves nothing behind. The payer is the identity the
-    // node will carry (a run's own, else its creator's or spawner's, else the terminal person).
-    const payerSource = opts.run ?? creatorNode ?? spawnerNode ?? forkSourceMeta;
+    // The start check, before any worktree or node row exists: a refusal leaves nothing behind.
     await checkStart({ grantee: payerSource?.grantee ?? 'app:terminal', sub: payerSource?.sub, grant_id: payerSource?.grant_id });
     const forkSourceNodeId = forkSourceMeta?.node_id ?? null;
     let managedWorktree;
@@ -340,7 +340,7 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch, afterNodeCrea
         // which silently hid every profile-scope kind override).
         const launch = wantsWorktree
             ? await appPaidLaunch((await buildLaunchSpecAsync(opts.kind, mode, {
-                lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: spawnCwd, profileId,
+                lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: spawnCwd, profileId, app: payerSource?.grantee ?? 'app:terminal',
             })).launch, launchGrant, opts.model)
             : preflightLaunch;
         if (sandboxWorktree !== undefined)

package/dist/core/runtime/warm-pool.js

@@ -113,6 +113,7 @@ async function resolveRecipe(request) {
         ...(request.model !== null ? { model: request.model } : {}),
         cwd: request.cwd,
         profileId: request.profileId,
+        app: 'app:terminal',
     });
     return { key: warmRecipeKey(request.cwd, request.profileId, launch), launch, request };
 }

package/dist/core/scoped-state/legacy-profiles.js

@@ -42,7 +42,7 @@ export function readLegacyUserSnapshot(root) {
     for (const r of cachedStatement(db, "SELECT owner_key, name, last_updated, etag, checked_at FROM scope_plugins WHERE owner_key != 'project'").all()) {
         stateOf(r.owner_key).plugins[r.name] = { ...(r.last_updated === null ? {} : { last_updated: r.last_updated }), ...(r.etag === null ? {} : { etag: r.etag }), ...(r.checked_at === null ? {} : { checked_at: r.checked_at }) };
     }
-    return { profiles, defaults, settings, state };
+    return { profiles, defaults, settings, state, apps: {} };
 }
 /** Pre-canvas per-project memory caps (`none|name|preview`) the canvas import has not converted yet. */
 export function listLegacyProjectCaps(root) {

package/dist/core/scoped-state/person-rows.js

@@ -2,10 +2,7 @@
 // inside one transaction. Only a process that holds the database imports this (crtrd, tests); a CLI or viewer process reaches the
 // same ops over `PUT /v1/settings`. Importing this module makes the rows the process's settings transport and reloader.
 import { openDb, withCanvasWrite } from '../canvas/db.js';
-import { isCloudRole } from '../canvas/person-state.js';
-import { grantedProviderIds, isProviderBundleRow } from '../grants/mirror.js';
-import { materializePlugins } from './materialized-plugins.js';
-import { revisionOf, setPersonSnapshot, setSettingsReloader, setSettingsTransport, SettingsRevisionConflictError } from './person-store.js';
+import { appRevisionOf, revisionOf, setPersonSnapshot, setSettingsReloader, setSettingsTransport, SettingsRevisionConflictError } from './person-store.js';
 const s = (v) => (typeof v === 'string' ? v : undefined);
 export async function readSnapshotFromRows(db, person) {
     const profileRows = await db.prepare('SELECT * FROM profiles WHERE person = ? AND deleting_since IS NULL ORDER BY created_at, id').all(person);
@@ -34,6 +31,8 @@ export async function readSnapshotFromRows(db, person) {
     for (const r of await db.prepare('SELECT owner_key, raw_json FROM scope_settings WHERE person = ?').all(person))
         settings[r.owner_key] = JSON.parse(r.raw_json);
     const state = {};
+    const apps = {};
+    const appOf = (owner) => (apps[owner] ??= { plugins: {}, marketplaces: {}, revision: '' });
     const stateOf = (owner) => (state[owner] ??= { marketplaces: {}, plugins: {}, activeCanvas: null });
     for (const r of await db.prepare('SELECT owner_key, last_self_check, active_canvas FROM scope_bookkeeping WHERE person = ?').all(person)) {
         const st = stateOf(r.owner_key);
@@ -44,6 +43,10 @@ export async function readSnapshotFromRows(db, person) {
     for (const r of await db.prepare('SELECT * FROM scope_marketplaces WHERE person = ? ORDER BY owner_key, name').all(person)) {
         const owner = String(r['owner_key']);
         const name = String(r['name']);
+        if (owner.startsWith('app:')) {
+            appOf(owner).marketplaces[name] = { url: s(r['url']), ref: s(r['ref']) ?? '', installed_at: s(r['installed_at']) ?? '' };
+            continue;
+        }
         stateOf(owner).marketplaces[name] = s(r['last_updated']) === undefined ? {} : { last_updated: s(r['last_updated']) };
         if (s(r['url']) !== undefined) {
             const raw = (settings[owner] ??= {});
@@ -54,38 +57,26 @@ export async function readSnapshotFromRows(db, person) {
     for (const r of await db.prepare('SELECT * FROM scope_plugins WHERE person = ? ORDER BY owner_key, name').all(person)) {
         const owner = String(r['owner_key']);
         const name = String(r['name']);
+        if (owner.startsWith('app:')) {
+            appOf(owner).plugins[name] = { enabled: Number(r['enabled']) === 1, ...(s(r['source_marketplace']) === undefined ? {} : { source_marketplace: s(r['source_marketplace']) }), ...(s(r['version']) === undefined ? {} : { version: s(r['version']) }) };
+            continue;
+        }
         stateOf(owner).plugins[name] = { ...(s(r['last_updated']) === undefined ? {} : { last_updated: s(r['last_updated']) }), ...(s(r['etag']) === undefined ? {} : { etag: s(r['etag']) }), ...(s(r['checked_at']) === undefined ? {} : { checked_at: s(r['checked_at']) }) };
         const raw = (settings[owner] ??= {});
         const block = (raw['plugins'] ??= {});
         block[name] = { enabled: Number(r['enabled']) === 1, ...(s(r['source_marketplace']) === undefined ? {} : { source_marketplace: s(r['source_marketplace']) }), ...(s(r['version']) === undefined ? {} : { version: s(r['version']) }) };
     }
-    return { profiles, defaults, settings, state };
+    for (const block of Object.values(apps))
+        block.revision = appRevisionOf(block);
+    return { profiles, defaults, settings, state, apps };
 }
 /** Load (or reload) one person's snapshot from the rows into this process. */
 export async function loadPersonSettings(person) {
     const db = await openDb();
     const snapshot = await readSnapshotFromRows(db, person);
-    // A cloud-role process has no plugin directories: it installs the person's enabled plugins (D84) before the snapshot is usable, so
-    // a request that cannot have its plugins fails here instead of reading an empty list.
-    if (isCloudRole())
-        await materializePersonPlugins(db, person);
     setPersonSnapshot(person, snapshot);
     return snapshot;
 }
-/** Install the person's enabled user-scope plugins from their marketplaces, for the current `plugins_revision`. */
-async function materializePersonPlugins(db, person) {
-    const plugins = await db.prepare(`SELECT p.name, p.version, p.source_path, p.source_marketplace, m.url, m.ref FROM scope_plugins p
-    LEFT JOIN scope_marketplaces m ON m.person = p.person AND m.owner_key = p.owner_key AND m.name = p.source_marketplace
-    WHERE p.person = ? AND p.owner_key = 'user' AND p.enabled = 1 ORDER BY p.name`).all(person);
-    const revisionRow = await db.prepare('SELECT plugins_revision FROM person_settings WHERE person = ?').get(person);
-    const granted = await grantedProviderIds(person);
-    const installs = plugins.map((r) => ({
-        name: String(r['name']), version: s(r['version']) ?? null, sourcePath: s(r['source_path']) ?? null,
-        marketplace: s(r['source_marketplace']) === undefined ? null : { name: s(r['source_marketplace']), url: s(r['url']) ?? null, ref: s(r['ref']) ?? null },
-        providerBundle: isProviderBundleRow({ name: String(r['name']), source_marketplace: s(r['source_marketplace']) ?? null, source_path: s(r['source_path']) ?? null }, granted),
-    }));
-    await materializePlugins(person, revisionRow === undefined ? 0 : Number(revisionRow.plugins_revision), installs);
-}
 // ------------------------------------------------------------------ writing rows
 async function currentRaw(db, person, owner) {
     return (await readSnapshotFromRows(db, person)).settings[owner];
@@ -102,21 +93,21 @@ export async function applyOpsToRows(db, person, ops) {
             const { plugins, marketplaces, ...rest } = op.raw;
             const rawJson = JSON.stringify(rest);
             await db.prepare('INSERT INTO scope_settings (person, owner_key, raw_json) VALUES (?, ?, ?) ON CONFLICT (person, owner_key) DO UPDATE SET raw_json = EXCLUDED.raw_json').run(person, op.owner, rawJson);
-            const pluginBlock = (plugins ?? {});
-            const marketBlock = (marketplaces ?? {});
             const had = JSON.stringify([before?.['plugins'], before?.['marketplaces']]);
             if (had !== JSON.stringify([plugins, marketplaces]) && !(had === '[null,null]' && plugins === undefined && marketplaces === undefined))
                 pluginsChanged = true;
-            await db.prepare('DELETE FROM scope_plugins WHERE person = ? AND owner_key = ? AND NOT (name IN (SELECT jsonb_array_elements_text(?::jsonb)))').run(person, op.owner, JSON.stringify(Object.keys(pluginBlock)));
-            for (const [name, e] of Object.entries(pluginBlock)) {
-                await db.prepare(`INSERT INTO scope_plugins (person, owner_key, name, enabled, source_marketplace, version) VALUES (?, ?, ?, ?, ?, ?)
-          ON CONFLICT (person, owner_key, name) DO UPDATE SET enabled = EXCLUDED.enabled, source_marketplace = EXCLUDED.source_marketplace, version = EXCLUDED.version`).run(person, op.owner, name, e.enabled === false ? 0 : 1, e.source_marketplace ?? null, e.version ?? null);
-            }
-            await db.prepare('DELETE FROM scope_marketplaces WHERE person = ? AND owner_key = ? AND NOT (name IN (SELECT jsonb_array_elements_text(?::jsonb)))').run(person, op.owner, JSON.stringify(Object.keys(marketBlock)));
-            for (const [name, e] of Object.entries(marketBlock)) {
-                await db.prepare(`INSERT INTO scope_marketplaces (person, owner_key, name, url, ref, installed_at) VALUES (?, ?, ?, ?, ?, ?)
-          ON CONFLICT (person, owner_key, name) DO UPDATE SET url = EXCLUDED.url, ref = EXCLUDED.ref, installed_at = EXCLUDED.installed_at`).run(person, op.owner, name, e.url ?? null, e.ref ?? null, e.installed_at ?? null);
-            }
+            await writeInstallRows(db, person, op.owner, plugins ?? {}, marketplaces ?? {});
+        }
+        else if (op.op === 'app-plugins.replace') {
+            // Serialize writers of one app block (also when the block has no rows yet) before the revision is read, so two overlapping
+            // replaces cannot both pass `ifRevision`: the later one waits, re-reads the committed rows and is rejected.
+            await db.prepare('SELECT pg_advisory_xact_lock(hashtext(?))').get(`app-plugins|${person}|${op.app}`);
+            const before = (await readSnapshotFromRows(db, person)).apps[op.app];
+            if (op.ifRevision !== appRevisionOf(before))
+                throw new SettingsRevisionConflictError();
+            if (appRevisionOf(op) !== appRevisionOf(before))
+                pluginsChanged = true;
+            await writeInstallRows(db, person, op.app, op.plugins, op.marketplaces);
         }
         else if (op.op === 'state.write') {
             await db.prepare(`INSERT INTO scope_bookkeeping (person, owner_key, last_self_check, active_canvas) VALUES (?, ?, ?, ?)
@@ -158,6 +149,18 @@ export async function applyOpsToRows(db, person, ops) {
         await db.prepare('INSERT INTO person_settings (person, plugins_revision) VALUES (?, 1) ON CONFLICT (person) DO UPDATE SET plugins_revision = person_settings.plugins_revision + 1').run(person);
     await db.prepare("SELECT pg_notify('crtr_signal', ?)").get(`settings:${person}`);
 }
+async function writeInstallRows(db, person, owner, pluginBlock, marketBlock) {
+    await db.prepare('DELETE FROM scope_plugins WHERE person = ? AND owner_key = ? AND NOT (name IN (SELECT jsonb_array_elements_text(?::jsonb)))').run(person, owner, JSON.stringify(Object.keys(pluginBlock)));
+    for (const [name, e] of Object.entries(pluginBlock)) {
+        await db.prepare(`INSERT INTO scope_plugins (person, owner_key, name, enabled, source_marketplace, version) VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT (person, owner_key, name) DO UPDATE SET enabled = EXCLUDED.enabled, source_marketplace = EXCLUDED.source_marketplace, version = EXCLUDED.version`).run(person, owner, name, e.enabled === false ? 0 : 1, e.source_marketplace ?? null, e.version ?? null);
+    }
+    await db.prepare('DELETE FROM scope_marketplaces WHERE person = ? AND owner_key = ? AND NOT (name IN (SELECT jsonb_array_elements_text(?::jsonb)))').run(person, owner, JSON.stringify(Object.keys(marketBlock)));
+    for (const [name, e] of Object.entries(marketBlock)) {
+        await db.prepare(`INSERT INTO scope_marketplaces (person, owner_key, name, url, ref, installed_at) VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT (person, owner_key, name) DO UPDATE SET url = EXCLUDED.url, ref = EXCLUDED.ref, installed_at = EXCLUDED.installed_at`).run(person, owner, name, e.url ?? null, e.ref ?? null, e.installed_at ?? null);
+    }
+}
 async function replaceProjects(db, profile) {
     await db.prepare('DELETE FROM profile_projects WHERE profile_id = ?').run(profile.profileId);
     let position = 0;