@pi-harness/pi-harness 0.1.26 → 0.1.28

package/README.md

@@ -41,7 +41,7 @@ npm run web
 
 - A Cordis plugin tree for models, resources, sessions, tools, runtime, Web/API, and stdio.
 - A project-owned YAML profile system for enabling, configuring, grouping, and composing plugins.
-- A separately published `@pi-harness/core` package, so compatible built-in plugin fixes can ship without republishing the launcher.
+- A separately published `@pi-harness/core` package, so compatible built-in plugin fixes can ship without republishing the launcher, and a `@pi-harness/plugin-api` package carrying only the contract a plugin is written against.
 - A non-blocking update check that suggests a compatible core update. Run `npm update --global @pi-harness/pi-harness`; set `PI_HARNESS_DISABLE_UPDATE_CHECK=1` to disable checks.
 - Safe defaults: loopback-only web hosting, explicit project trust for executable resources, bounded operations, cancellation, and lifecycle rollback. The unauthenticated API also rejects requests whose `Host` header does not name the bound address and port and cross-site requests whose `Origin` does not match it, which blocks CSRF and DNS rebinding; a reverse proxy must forward the original `Host` header over plain HTTP.
 
@@ -86,7 +86,7 @@ CLI / web launcher
 
 ## Author a plugin
 
-Use the [plugin authoring guide](docs/README.reference.md#author-a-plugin) and the working [hello-plugin example](examples/plugin-hello). Treat profiles, plugin packages, and trusted project resources as executable code.
+A plugin is an ordinary Cordis plugin written against [`@pi-harness/plugin-api`](packages/plugin-api), which carries the harness service types, config helpers and bounded workspace access without the launcher. Use the [plugin authoring guide](docs/README.reference.md#author-a-plugin) and the working [hello-plugin example](examples/plugin-hello). Treat profiles, plugin packages, and trusted project resources as executable code.
 
 ## Development