@pi-harness/pi-harness 0.1.31 → 0.1.32

package/packages/api-gateway/src/index.ts

@@ -32,7 +32,8 @@ interface ApiServices {
   readonly pluginUi: PiPluginUiRegistry | undefined;
 }
 
-const loadMarketplaceStatistics = createMarketplaceStatisticsLoader();
+// The first paint waits for every console endpoint to answer, so the catalogue is sorted from whatever npm statistics are already cached and the misses are warmed in the background instead of held on to.
+const { readCached: readCachedMarketplaceStatistics } = createMarketplaceStatisticsLoader();
 
 const RUNTIME_ENTRY_NAME = "@pi-harness/core/plugins/runtime";
 
@@ -43,6 +44,8 @@ const IMPORT_BODY_LIMIT_BYTES = 16 * 1024 * 1024;
 // Retained trajectory events are replayed to every SSE client and returned by /api/session, so the array must stay bounded.
 const MAX_RETAINED_EVENTS = 2000;
 const GIT_TIMEOUT_MS = 15_000;
+const PROCESS_FAILURE_TEXT_LIMIT = 400;
+const PROCESS_TIMEOUT_MS = 120_000;
 // Mutating commands run user hooks (pre-commit, lint-staged, test suites) and may stage large trees; killing them part-way leaves index.lock and a half-finished operation behind, so they get a far more generous bound than read-only queries.
 const GIT_MUTATION_TIMEOUT_MS = 120_000;
 
@@ -95,10 +98,14 @@ function jsonSafe(value: unknown, seen = new WeakSet<object>()): unknown {
   }
 }
 
+// A plugin that contributes tools only joins on the next start, so the console remembers what it installed until then. That memory is about one particular process, and the console cannot tell a restart from a reconnect on its own, so the identity of this process rides along with the status it already polls.
+const PROCESS_STARTED_AT = new Date(Date.now() - Math.round(process.uptime() * 1000)).toISOString();
+
 function createStatus(services: ApiServices, events: readonly AgentSessionEvent[]) {
   const activeModel = services.runtime.session.model ?? services.models.model;
   const cwd = activeCwd(services);
   return {
+    processStartedAt: PROCESS_STARTED_AT,
     status: services.runtime.session.isStreaming ? "running" : "ready",
     model: activeModel.provider + "/" + activeModel.id,
     messages: services.runtime.session.messages.length,
@@ -470,11 +477,28 @@ function registerPluginPanels(context: Context, services: ApiServices): () => vo
   return () => disposers.reverse().forEach((dispose) => dispose());
 }
 
+// npm ends every failure with the path to a debug log inside its own cache, which the reader of this console has no reason to open and no easy way to reach.
+const PROCESS_FAILURE_NOISE = /^npm (error|ERR!) A complete log of this run can be found in:/u;
+
+// npm reports a failure over many lines and the whole text is shown to someone who never typed the command, so the lines are joined up to a character budget and the command itself stays on the cause for diagnostics. Node's own message is never used as the fallback: it reads `Command failed: <the whole command line>`, which is exactly what this is removing.
+function processFailureText(executable: string, stderr: string, error: ExecFileException): string {
+  const text = stderr
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter((line) => line !== "" && !PROCESS_FAILURE_NOISE.test(line))
+    .join(" ");
+  if (text === "")
+    return error.killed === true
+      ? `${executable} was stopped after ${PROCESS_TIMEOUT_MS / 1000}s`
+      : `${executable} exited with code ${error.code ?? "unknown"} and reported nothing`;
+  return text.length <= PROCESS_FAILURE_TEXT_LIMIT ? text : text.slice(0, PROCESS_FAILURE_TEXT_LIMIT) + "…";
+}
+
 function runProcess(executable: string, args: readonly string[], cwd: string): Promise<{ stdout: string; stderr: string }> {
   return new Promise((resolveProcess, rejectProcess) => {
-    execFile(executable, [...args], { cwd, timeout: 120_000, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
+    execFile(executable, [...args], { cwd, timeout: PROCESS_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
       if (error) {
-        rejectProcess(new Error(`${executable} ${args.join(" ")} failed: ${stderr || error.message}`, { cause: error }));
+        rejectProcess(new Error(processFailureText(executable, stderr, error), { cause: { command: `${executable} ${args.join(" ")}`, error } }));
         return;
       }
       resolveProcess({ stdout, stderr });
@@ -1096,7 +1120,7 @@ export default {
     });
     const disposeMarketplace = services.webServer.register({
       path: "/api/marketplace",
-      async handler(request, response) {
+      handler(request, response) {
         if (request.method !== "GET") {
           sendJson(response, 405, { error: "Method not allowed" });
           return;
@@ -1123,10 +1147,10 @@ export default {
           return;
         }
         const filtered = searchMarketplace(query, capability, category);
+        const cached = readCachedMarketplaceStatistics(MARKETPLACE_PLUGINS);
+        // Recommendation is only applied once the whole catalogue has been looked up. Scoring a half-warm cache would reorder the grid under the reader's cursor on every poll as the background lookups land, which costs more than the few seconds the first sort is delayed.
         const items =
-          sort === "recommended"
-            ? sortMarketplaceByRecommendation(attachMarketplaceStatistics(filtered, await loadMarketplaceStatistics(MARKETPLACE_PLUGINS)))
-            : filtered;
+          sort === "recommended" && cached.ready ? sortMarketplaceByRecommendation(attachMarketplaceStatistics(filtered, cached.statistics)) : filtered;
         sendJson(response, 200, {
           ...paginateMarketplace(items, page, pageSize),
           capabilities: MARKETPLACE_CAPABILITIES,

package/packages/api-gateway/src/marketplace-entries/official/agent-teams.json

@@ -13,7 +13,7 @@
     "id": "collaboration",
     "label": "会话协作"
   },
-  "capabilities": ["collaboration ledger", "tasks", "mailbox notes", "dependency graph", "cycle detection"],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["session lifecycle", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-agent-teams",

package/packages/api-gateway/src/marketplace-entries/official/anchored-standard.json

@@ -13,7 +13,7 @@
     "id": "security",
     "label": "安全"
   },
-  "capabilities": ["trajectory audit", "tool allowlist", "run anchoring"],
+  "capabilities": ["read-only"],
   "hooks": ["session events", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-anchored-standard",

package/packages/api-gateway/src/marketplace-entries/official/annotation.json

@@ -13,7 +13,7 @@
     "id": "context",
     "label": "上下文管理"
   },
-  "capabilities": ["annotations", "context"],
+  "capabilities": ["read-only"],
   "hooks": ["plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-annotation",

package/packages/api-gateway/src/marketplace-entries/official/archify.json

@@ -13,7 +13,7 @@
     "id": "developer",
     "label": "开发工具"
   },
-  "capabilities": ["architecture map", "workspace scan", "dependency map", "Mermaid"],
+  "capabilities": ["reads-files", "runs-commands"],
   "hooks": ["workspace files", "package manifest", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-archify",

package/packages/api-gateway/src/marketplace-entries/official/at-file.json

@@ -13,15 +13,7 @@
     "id": "context",
     "label": "上下文管理"
   },
-  "capabilities": [
-    "256 KiB strict UTF-8 text attachments",
-    "canonical workspace path confinement",
-    "no-follow regular-file reads",
-    "untrusted context framing",
-    "closing-tag neutralization",
-    "cancellable sequential execution",
-    "descriptor-safe normalized panel"
-  ],
+  "capabilities": ["read-only", "reads-files"],
   "hooks": ["file context tool", "workspace file read", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-at-file",

package/packages/api-gateway/src/marketplace-entries/official/auto-mode.json

@@ -13,7 +13,7 @@
     "id": "security",
     "label": "安全"
   },
-  "capabilities": ["command policy", "confirmation gate", "safe execution"],
+  "capabilities": ["reads-files", "runs-commands"],
   "hooks": ["argv execution", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-auto-mode",

package/packages/api-gateway/src/marketplace-entries/official/better-sidebar.json

@@ -13,7 +13,7 @@
     "id": "developer",
     "label": "开发工具"
   },
-  "capabilities": ["workspace overview", "Git status", "session context", "sidebar UI"],
+  "capabilities": ["session-data", "reads-files", "runs-commands"],
   "hooks": ["workspace scan", "read-only Git", "session manager", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-better-sidebar",

package/packages/api-gateway/src/marketplace-entries/official/browser-fetch.json

@@ -13,14 +13,7 @@
     "id": "web",
     "label": "网页与研究"
   },
-  "capabilities": [
-    "bounded textual HTTP fetch",
-    "DNS rebinding protection",
-    "per-hop SSRF validation",
-    "cancellable request lifecycle",
-    "bounded browser preview",
-    "validated fail-closed panel reporting"
-  ],
+  "capabilities": ["network-access"],
   "hooks": ["network request", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-browser-fetch",

package/packages/api-gateway/src/marketplace-entries/official/browser-session.json

@@ -13,14 +13,7 @@
     "id": "web",
     "label": "网页与研究"
   },
-  "capabilities": [
-    "loopback-only CDP endpoint",
-    "bounded tab discovery",
-    "navigation read click and screenshot tools",
-    "cancellable request lifecycle",
-    "bounded panel previews",
-    "validated fail-closed panel reporting"
-  ],
+  "capabilities": ["network-access"],
   "hooks": ["browser session tools", "Chrome DevTools Protocol", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-browser-session",

package/packages/api-gateway/src/marketplace-entries/official/canvas-draw.json

@@ -11,9 +11,9 @@
   "status": "verified",
   "category": {
     "id": "multimodal",
-    "label": "多模态"
+    "label": "视觉与多模态"
   },
-  "capabilities": ["Mermaid flowchart", "nodes and edges", "visual planning"],
+  "capabilities": ["read-only"],
   "hooks": ["plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-canvas-draw",

package/packages/api-gateway/src/marketplace-entries/official/change-verifier.json

@@ -13,7 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": ["verification gate", "test orchestration", "change review"],
+  "capabilities": ["read-only"],
   "hooks": ["project scripts", "Git diff", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-change-verifier",

package/packages/api-gateway/src/marketplace-entries/official/cleaner.json

@@ -13,15 +13,7 @@
     "id": "developer",
     "label": "开发工具"
   },
-  "capabilities": [
-    "strict configuration and parameters",
-    "bounded capsule inventory",
-    "display-safe capsule filtering",
-    "confirmed retention cleanup",
-    "symlink and replacement defenses",
-    "cancellable serialized cleanup",
-    "fail-closed normalized panel"
-  ],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["capsule cleanup tool", "agent capsule directory", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-cleaner",

package/packages/api-gateway/src/marketplace-entries/official/cli-notifier.json

@@ -13,7 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": ["desktop notification", "completion notice", "failure and abort notice"],
+  "capabilities": ["runs-commands"],
   "hooks": ["agent end", "compaction error", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-cli-notifier",

package/packages/api-gateway/src/marketplace-entries/official/code2skill.json

@@ -13,7 +13,7 @@
     "id": "tools",
     "label": "工具"
   },
-  "capabilities": ["bounded skill packaging", "source file preservation", "SKILL.md generation"],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["workspace files", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-code2skill",

package/packages/api-gateway/src/marketplace-entries/official/colleague-skill.json

@@ -13,7 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": ["role handoff", "acceptance criteria", "durable session context"],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["session storage", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-colleague-skill",

package/packages/api-gateway/src/marketplace-entries/official/context-doctor.json

@@ -13,14 +13,7 @@
     "id": "observability",
     "label": "可观测性"
   },
-  "capabilities": [
-    "descriptor-safe bounded context audit",
-    "pressure oversized uninspectable and tool-error diagnostics",
-    "confirmed settled-session compaction",
-    "dedicated compaction cancellation",
-    "single-flight bounded operation status",
-    "cached normalized panel"
-  ],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["context doctor tool", "session messages and usage", "Pi session lifecycle", "manual compaction", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-context-doctor",

package/packages/api-gateway/src/marketplace-entries/official/context.json

@@ -13,13 +13,7 @@
     "id": "context",
     "label": "上下文管理"
   },
-  "capabilities": [
-    "descriptor-safe bounded message composition",
-    "resilient context usage inspection",
-    "active-session lifecycle counters",
-    "cached session-aware panel",
-    "bounded normalized browser view"
-  ],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["context inspection tool", "active runtime session", "Pi session lifecycle", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-context",

package/packages/api-gateway/src/marketplace-entries/official/cordis-group.json

@@ -10,7 +10,7 @@
   "source": "official",
   "status": "verified",
   "category": { "id": "composition", "label": "组合编排" },
-  "capabilities": ["nested plugin composition", "transactional rollback", "lifecycle ownership"],
+  "capabilities": ["read-only"],
   "hooks": ["loader entry tree"],
   "profile": { "name": "@deepseek-ai/cordis-plugin-group", "group": true, "config": [] }
 }

package/packages/api-gateway/src/marketplace-entries/official/cordis-logger-console.json

@@ -10,7 +10,7 @@
   "source": "official",
   "status": "verified",
   "category": { "id": "observability", "label": "可观测性" },
-  "capabilities": ["bounded console logging", "per-logger severity filtering", "safe recent-log panel"],
+  "capabilities": ["read-only"],
   "hooks": ["Cordis logger exporter", "plugin UI"],
   "profile": { "name": "@deepseek-ai/cordis-plugin-logger-console", "config": { "levels": { "default": 2 }, "maxLength": 8192 } }
 }

package/packages/api-gateway/src/marketplace-entries/official/cordis-timer.json

@@ -10,7 +10,7 @@
   "source": "official",
   "status": "verified",
   "category": { "id": "runtime", "label": "运行时" },
-  "capabilities": ["scheduling", "lifecycle-owned cancellation", "async interval iteration", "throttle and debounce"],
+  "capabilities": ["read-only"],
   "hooks": ["Cordis timer service", "plugin UI"],
   "profile": { "name": "@deepseek-ai/cordis-plugin-timer", "config": {} }
 }

package/packages/api-gateway/src/marketplace-entries/official/cost-meter.json

@@ -13,7 +13,7 @@
     "id": "observability",
     "label": "可观测性"
   },
-  "capabilities": ["UTC daily cost ledger", "session cost snapshots", "daily budget monitoring", "bounded local persistence"],
+  "capabilities": ["session-data", "reads-files", "writes-files"],
   "hooks": ["agent end", "cost report tool", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-cost-meter",

package/packages/api-gateway/src/marketplace-entries/official/dependency-checker.json

@@ -11,17 +11,9 @@
   "status": "verified",
   "category": {
     "id": "developer",
-    "label": "开发效率"
+    "label": "开发工具"
   },
-  "capabilities": [
-    "2000-declaration local presence scan",
-    "4096-entry workspace-contained virtualenv scan",
-    "npm common-intersection conflict detection",
-    "bounded Python numeric constraint analysis",
-    "unresolved constraint and directive reporting",
-    "optional dependency reporting",
-    "descriptor-safe normalized panel"
-  ],
+  "capabilities": ["read-only", "reads-files"],
   "hooks": ["dependency check tool", "workspace manifest read", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-dependency-checker",

package/packages/api-gateway/src/marketplace-entries/official/docker-sandbox.json

@@ -13,15 +13,7 @@
     "id": "security",
     "label": "安全"
   },
-  "capabilities": [
-    "local-only image execution",
-    "no-network containers",
-    "read-only workspace by default",
-    "CPU memory and PID limits",
-    "sanitized bounded output",
-    "strict panel reporting",
-    "cancellation cleanup"
-  ],
+  "capabilities": ["reads-files", "writes-files", "runs-commands"],
   "hooks": ["sandbox execution tool", "Docker CLI", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-docker-sandbox",

package/packages/api-gateway/src/marketplace-entries/official/fail-logger.json

@@ -13,14 +13,7 @@
     "id": "observability",
     "label": "可观测性"
   },
-  "capabilities": [
-    "bounded failure aggregation",
-    "descriptor-safe event inspection",
-    "abort-aware compaction diagnostics",
-    "occurrence counting",
-    "safe diagnostic summaries",
-    "capacity visibility"
-  ],
+  "capabilities": ["read-only"],
   "hooks": ["extension error", "agent end", "compaction end", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-fail-logger",

package/packages/api-gateway/src/marketplace-entries/official/genui.json

@@ -13,7 +13,7 @@
     "id": "interface",
     "label": "界面增强"
   },
-  "capabilities": ["bounded structured cards", "typed text badge and progress blocks", "decimal progress validation", "plain-text HTML handling"],
+  "capabilities": ["read-only"],
   "hooks": ["GenUI render tool", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-genui",

package/packages/api-gateway/src/marketplace-entries/official/git-time-capsule.json

@@ -13,14 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": [
-    "byte-exact validated unstaged diff capture",
-    "exclusive no-clobber capsule publication",
-    "confirmed deterministic reverse apply",
-    "bounded 256-capsule inventory",
-    "cancellable serialized Git operations",
-    "descriptor-safe normalized panel"
-  ],
+  "capabilities": ["reads-files", "writes-files", "runs-commands"],
   "hooks": ["Git snapshot tool", "Git restore tool", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-git-time-capsule",

package/packages/api-gateway/src/marketplace-entries/official/graph-memory.json

@@ -13,7 +13,7 @@
     "id": "memory",
     "label": "记忆与上下文"
   },
-  "capabilities": ["bounded typed nodes", "validated directed relations", "ranked graph search", "atomic locked persistence"],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["graph memory tools", "local graph file", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-graph-memory",

package/packages/api-gateway/src/marketplace-entries/official/history-compressor.json

@@ -11,9 +11,9 @@
   "status": "verified",
   "category": {
     "id": "context",
-    "label": "上下文"
+    "label": "上下文管理"
   },
-  "capabilities": ["history compaction", "context budget", "automatic cleanup"],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["agent end", "context usage", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-history-compressor",

package/packages/api-gateway/src/marketplace-entries/official/hol-guard.json

@@ -11,9 +11,9 @@
   "status": "verified",
   "category": {
     "id": "security",
-    "label": "安全防护"
+    "label": "安全"
   },
-  "capabilities": ["command safety", "credential detection", "audit", "advisory"],
+  "capabilities": ["read-only"],
   "hooks": ["tool execution", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-hol-guard",

package/packages/api-gateway/src/marketplace-entries/official/i18n-pair.json

@@ -13,13 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": [
-    "collision-safe locale key parity",
-    "strict bounded workspace-only JSON reads",
-    "no-follow symbolic-link safety",
-    "stable sequential cancellable inspection",
-    "validated bounded panel reporting"
-  ],
+  "capabilities": ["read-only", "reads-files"],
   "hooks": ["i18n check tool", "workspace locale files", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-i18n-pair",

package/packages/api-gateway/src/marketplace-entries/official/image-compressor.json

@@ -11,9 +11,9 @@
   "status": "verified",
   "category": {
     "id": "multimodal",
-    "label": "多模态"
+    "label": "视觉与多模态"
   },
-  "capabilities": ["image compression", "context hygiene", "asset safety"],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["workspace files", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-image-compressor",

package/packages/api-gateway/src/marketplace-entries/official/llm-verifier.json

@@ -13,7 +13,7 @@
     "id": "testing",
     "label": "测试与质量"
   },
-  "capabilities": ["model verification", "batch verification", "evidence review", "audit history", "release confidence"],
+  "capabilities": ["model-calls"],
   "hooks": ["model runtime", "structured verdict", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-llm-verifier",

package/packages/api-gateway/src/marketplace-entries/official/mcp-client.json

@@ -11,15 +11,9 @@
   "status": "verified",
   "category": {
     "id": "tools",
-    "label": "工具集成"
+    "label": "工具"
   },
-  "capabilities": [
-    "bounded MCP stdio transport",
-    "bounded inventory pagination",
-    "tool resource and prompt bridging",
-    "persistent server lifecycle",
-    "cancellable queued requests"
-  ],
+  "capabilities": ["runs-commands"],
   "hooks": ["MCP stdio tools", "managed server lifecycle", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-mcp-client",

package/packages/api-gateway/src/marketplace-entries/official/mcp-panel.json

@@ -13,7 +13,7 @@
     "id": "tools",
     "label": "工具"
   },
-  "capabilities": ["MCP health", "tool inspection", "profile patch preview"],
+  "capabilities": ["reads-files", "writes-files", "runs-commands"],
   "hooks": ["MCP runtime", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-mcp-panel",

package/packages/api-gateway/src/marketplace-entries/official/memory.json

@@ -13,7 +13,7 @@
     "id": "memory",
     "label": "记忆与上下文"
   },
-  "capabilities": ["memory", "notes"],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["session lifecycle", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-memory",

package/packages/api-gateway/src/marketplace-entries/official/mirage-bridge.json

@@ -13,7 +13,7 @@
     "id": "tools",
     "label": "工具"
   },
-  "capabilities": ["virtual terminal", "CLI bridge", "workspace execution"],
+  "capabilities": ["runs-commands"],
   "hooks": ["Mirage CLI", "argv execution", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-mirage-bridge",

package/packages/api-gateway/src/marketplace-entries/official/mock-server.json

@@ -13,7 +13,7 @@
     "id": "tools",
     "label": "工具"
   },
-  "capabilities": ["HTTP mocks", "integration testing", "local fixtures"],
+  "capabilities": ["local-server"],
   "hooks": ["local HTTP server", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-mock-server",

package/packages/api-gateway/src/marketplace-entries/official/modlens.json

@@ -13,7 +13,7 @@
     "id": "multimodal",
     "label": "视觉与多模态"
   },
-  "capabilities": ["native vision", "OCR/layout evidence"],
+  "capabilities": ["reads-files", "writes-files", "runs-commands"],
   "hooks": ["tool execution", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-modlens",

package/packages/api-gateway/src/marketplace-entries/official/module-search.json

@@ -13,7 +13,7 @@
     "id": "discovery",
     "label": "发现与生态"
   },
-  "capabilities": ["module discovery", "symbol lookup", "source navigation"],
+  "capabilities": ["read-only", "reads-files"],
   "hooks": ["workspace files", "source scanning", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-module-search",

package/packages/api-gateway/src/marketplace-entries/official/obsidian-sync.json

@@ -13,7 +13,7 @@
     "id": "workflow",
     "label": "工作流"
   },
-  "capabilities": ["Obsidian notes", "session export", "knowledge capture"],
+  "capabilities": ["reads-files", "writes-files"],
   "hooks": ["vault path", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-obsidian-sync",

package/packages/api-gateway/src/marketplace-entries/official/openpets.json

@@ -11,15 +11,9 @@
   "status": "verified",
   "category": {
     "id": "web",
-    "label": "网页"
+    "label": "网页与研究"
   },
-  "capabilities": [
-    "bounded durable companion state",
-    "validated session recovery",
-    "descriptor-safe pet actions",
-    "session event reactions",
-    "persistence health panel"
-  ],
+  "capabilities": ["read-only", "session-data"],
   "hooks": ["session events", "pet reaction tool", "session storage", "plugin UI"],
   "profile": {
     "name": "@pi-harness/plugin-openpets",