@rho-workspace/rho 0.5.6 → 0.5.7

package/dist/extension-markets.js

@@ -0,0 +1,166 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { Ajv } from 'ajv';
+import { atomicJson, Fault, requireThat } from '@rho-workspace/plugin-contracts';
+export const marketLimits = { maxMarkets: 16, maxMarketBytes: 262144, maxMarketEntries: 128, marketTimeoutMs: 10000 };
+const text = (maxLength) => ({ type: 'string', minLength: 1, maxLength });
+const object = (properties, required = Object.keys(properties)) => ({ type: 'object', properties, required, additionalProperties: false });
+export const marketEntrySchema = object({
+    id: { ...text(96), pattern: '^[a-z0-9][a-z0-9._-]{0,95}$' }, title: text(120),
+    version: { ...text(64), pattern: '^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$' },
+    description: text(2048), source: text(1024), repository: text(2048), needs: text(2048),
+    keywords: { type: 'array', items: text(64), maxItems: 16, uniqueItems: true },
+}, ['id', 'title', 'version', 'description', 'source', 'repository', 'needs']);
+export const marketIndexSchema = object({ apiVersion: { const: 1 }, title: text(120), plugins: { type: 'array', items: marketEntrySchema } });
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const validateIndex = new Ajv({ strict: false }).compile(marketIndexSchema);
+function https(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Fault('invalid', 'Use an absolute HTTPS URL.');
+    }
+    requireThat(url.protocol === 'https:' && !url.username && !url.password && !url.search && !url.hash, 'invalid', 'Use HTTPS without credentials, a query or a fragment.');
+    return url;
+}
+function indexUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Fault('invalid', 'Use an HTTPS market index URL.');
+    }
+    const local = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    requireThat((url.protocol === 'https:' || local) && !url.username && !url.password && !url.search && !url.hash, 'invalid', 'Market indexes need HTTPS without credentials, a query or a fragment. HTTP is allowed only on localhost.');
+    return url.href;
+}
+function validateSource(entry) {
+    if (entry.source.startsWith('git+https://')) {
+        const match = /^git\+(https:\/\/[^#]+)#([a-f0-9]{40})(?::([^:]+))?$/.exec(entry.source);
+        requireThat(match, 'invalid', 'Market Git packages must select a full 40-character commit and optional package path.');
+        https(match[1]);
+        requireThat(!match[3] || (!match[3].includes('\\') && match[3].split('/').every(p => p !== '' && p !== '.' && p !== '..')), 'invalid', 'Market package paths must stay inside the Git repository.');
+    }
+    else {
+        const match = /^((?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)@(.+)$/.exec(entry.source);
+        requireThat(match && match[2] === entry.version, 'invalid', 'Market sources need a pinned Git commit or an npm package with the exact declared version.');
+    }
+    https(entry.repository);
+}
+// A configured index is a retained observation. Listing does not fetch it, and
+// its package sources are only used after a separate, local install action.
+export class ExtensionMarkets {
+    directory;
+    limits;
+    values = [];
+    constructor(directory, limits) {
+        this.directory = directory;
+        this.limits = limits;
+    }
+    async init() {
+        try {
+            this.values = JSON.parse(await fs.readFile(path.join(this.directory, 'markets.json'), 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    list() { return structuredClone(this.values); }
+    async save(values) {
+        await atomicJson(path.join(this.directory, 'markets.json'), values);
+        this.values = values;
+    }
+    async fetch(url) {
+        const response = await fetch(url, { redirect: 'error', headers: { accept: 'application/json' }, signal: AbortSignal.timeout(this.limits.marketTimeoutMs) });
+        if (!response.ok || !response.body) {
+            await response.body?.cancel();
+            throw new Fault('unavailable', `Market index returned HTTP ${response.status}.`);
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let bytes = 0;
+        try {
+            requireThat(Number(response.headers.get('content-length') ?? 0) <= this.limits.maxMarketBytes, 'limit', `Market index exceeds maxMarketBytes (${this.limits.maxMarketBytes}).`);
+            for (;;) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                bytes += chunk.value.byteLength;
+                requireThat(bytes <= this.limits.maxMarketBytes, 'limit', `Market index exceeds maxMarketBytes (${this.limits.maxMarketBytes}).`);
+                chunks.push(chunk.value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+        }
+        const raw = Buffer.concat(chunks);
+        let index;
+        try {
+            index = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw));
+        }
+        catch {
+            throw new Fault('invalid', 'Market index is not valid UTF-8 JSON.');
+        }
+        requireThat(validateIndex(index), 'invalid', 'Expected a Rho market index with apiVersion 1, title and plugin entries.');
+        requireThat(index.plugins.length <= this.limits.maxMarketEntries, 'limit', `Market index exceeds maxMarketEntries (${this.limits.maxMarketEntries}).`);
+        const seen = new Set();
+        for (const entry of index.plugins) {
+            requireThat(!seen.has(entry.id), 'invalid', 'A market index must contain one selected version per plugin id.');
+            seen.add(entry.id);
+            validateSource(entry);
+        }
+        return { title: index.title, plugins: index.plugins, digest: hash(raw) };
+    }
+    async observe(url) {
+        try {
+            return await this.fetch(url);
+        }
+        catch (error) {
+            if (error instanceof Fault)
+                throw error;
+            const reason = error.name === 'TimeoutError' || error.name === 'AbortError' ? `Market request exceeded marketTimeoutMs (${this.limits.marketTimeoutMs}).` : 'Could not read the market index. Check its URL and network connection; redirects are not followed.';
+            throw new Fault('unavailable', reason);
+        }
+    }
+    async change(input) {
+        if (input.action === 'add') {
+            const url = indexUrl(input.url), id = hash(url).slice(0, 24);
+            if (this.values.some(m => m.id === id))
+                return this.list();
+            requireThat(this.values.length < this.limits.maxMarkets, 'limit', `The maxMarkets limit (${this.limits.maxMarkets}) is reached. Existing indexes are retained.`);
+            const index = await this.observe(url), at = new Date().toISOString();
+            await this.save([...this.values, { id, url, ...index, revision: 1, fetchedAt: at, checkedAt: at, error: null }]);
+        }
+        else {
+            const current = this.values.find(m => m.id === input.id);
+            requireThat(current, 'not_found', 'Market source is no longer configured.');
+            requireThat(current.revision === input.expectedRevision, 'stale', 'Market source changed. Refresh the list before changing it.');
+            if (input.action === 'remove')
+                await this.save(this.values.filter(m => m.id !== input.id));
+            else {
+                const at = new Date().toISOString();
+                let next;
+                try {
+                    next = { ...current, ...await this.observe(current.url), revision: current.revision + 1, fetchedAt: at, checkedAt: at, error: null };
+                }
+                catch (error) {
+                    next = { ...current, revision: current.revision + 1, checkedAt: at, error: String(error.message).slice(0, 400) };
+                }
+                await this.save(this.values.map(m => m.id === input.id ? next : m));
+            }
+        }
+        return this.list();
+    }
+    select(selection, source) {
+        const market = this.values.find(m => m.id === selection.id);
+        requireThat(market && market.digest === selection.expectedDigest, 'stale', 'Market index changed or was removed. Refresh the list before installing.');
+        const entry = market.plugins.find(p => p.id === selection.pluginId);
+        requireThat(entry && entry.source === source, 'conflict', 'Selected package source does not match the retained market index.');
+        return { entry: structuredClone(entry), origin: { id: market.id, title: market.title, url: market.url, digest: market.digest, keywords: [...(entry.keywords ?? [])] } };
+    }
+}

package/dist/extensions.d.ts

@@ -1,3 +1,4 @@
+import { ExtensionMarkets, type MarketSelection, type MarketChange } from './extension-markets.js';
 export declare const extensionLimits: {
     maxPlugins: number;
     maxVersions: number;
@@ -10,6 +11,10 @@ export declare const extensionLimits: {
     maxDelegations: number;
     timeoutMs: number;
     installTimeoutMs: number;
+    maxMarkets: number;
+    maxMarketBytes: number;
+    maxMarketEntries: number;
+    marketTimeoutMs: number;
 };
 export interface ExtensionManifest {
     apiVersion: 1;
@@ -45,6 +50,13 @@ export interface InstalledExtension {
     digest: string;
     source: string;
     sourceCommit?: string;
+    market?: {
+        id: string;
+        title: string;
+        url: string;
+        digest: string;
+        keywords?: string[];
+    };
     enabled: boolean;
     installedAt: string;
     manifest: ExtensionManifest;
@@ -73,6 +85,7 @@ interface Receipt {
 export declare class Extensions {
     readonly directory: string;
     readonly limits: typeof extensionLimits;
+    readonly markets: ExtensionMarkets;
     private installed;
     private running;
     private workers;
@@ -92,6 +105,7 @@ export declare class Extensions {
             repository: string;
             needs: string;
         }[];
+        markets: import("./extension-markets.js").ExtensionMarket[];
         plugins: {
             id: string;
             name: string;
@@ -101,6 +115,13 @@ export declare class Extensions {
             digest: string;
             source: string;
             sourceCommit?: string;
+            market?: {
+                id: string;
+                title: string;
+                url: string;
+                digest: string;
+                keywords?: string[];
+            };
             enabled: boolean;
             installedAt: string;
         }[];
@@ -116,8 +137,15 @@ export declare class Extensions {
             maxDelegations: number;
             timeoutMs: number;
             installTimeoutMs: number;
+            maxMarkets: number;
+            maxMarketBytes: number;
+            maxMarketEntries: number;
+            marketTimeoutMs: number;
         };
     };
+    changeMarket(input: MarketChange): Promise<{
+        markets: import("./extension-markets.js").ExtensionMarket[];
+    }>;
     describe(id: string): InstalledExtension;
     private selected;
     private root;
@@ -137,7 +165,7 @@ export declare class Extensions {
         title: string;
         text: string;
     }>;
-    install(source: string, replace?: string, expected?: string): Promise<InstalledExtension>;
+    install(source: string, replace?: string, expected?: string, market?: MarketSelection): Promise<InstalledExtension>;
     manage(id: string, expected: string, action: 'enable' | 'disable' | 'remove'): Promise<{
         pluginId: string;
         action: "remove" | "enable" | "disable";

package/dist/extensions.js

@@ -1,11 +1,12 @@
 import { extensionDirectory } from './extension-directory.js';
+import { ExtensionMarkets, marketLimits } from './extension-markets.js';
 import * as fs from 'node:fs/promises';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fork, spawn } from 'node:child_process';
 import { Ajv } from 'ajv';
 import { atomicJson, canonical, digest, requireThat } from '@rho-workspace/plugin-contracts';
-export const extensionLimits = { maxPlugins: 32, maxVersions: 128, maxFiles: 20000, maxPackageBytes: 128 * 1024 * 1024, maxContentBytes: 512 * 1024, maxReceipts: 2000, maxResultBytes: 1024 * 1024, maxRunning: 4, maxDelegations: 32, timeoutMs: 30000, installTimeoutMs: 180000 };
+export const extensionLimits = { ...marketLimits, maxPlugins: 32, maxVersions: 128, maxFiles: 20000, maxPackageBytes: 128 * 1024 * 1024, maxContentBytes: 512 * 1024, maxReceipts: 2000, maxResultBytes: 1024 * 1024, maxRunning: 4, maxDelegations: 32, timeoutMs: 30000, installTimeoutMs: 180000 };
 const ajv = new Ajv({ strict: false, allErrors: true });
 const identifier = /^[a-z0-9][a-z0-9._-]{0,95}$/;
 const relativeFile = (v) => typeof v === 'string' && v.length < 512 && !path.isAbsolute(v) && !v.includes('\\') && v.split('/').every(p => p !== '..' && p !== '.' && p !== '');
@@ -24,6 +25,7 @@ async function command(file, args, cwd, timeout) {
 export class Extensions {
     directory;
     limits;
+    markets;
     installed = [];
     running = new Map();
     workers = new Set();
@@ -34,10 +36,12 @@ export class Extensions {
         this.limits = { ...extensionLimits, ...limits };
         for (const [key, value] of Object.entries(this.limits))
             requireThat(Number.isSafeInteger(value) && value > 0, 'invalid', `Invalid extensions.${key}.`);
+        this.markets = new ExtensionMarkets(directory, this.limits);
     }
     async init() {
         await fs.mkdir(path.join(this.directory, 'versions'), { recursive: true });
         await fs.mkdir(path.join(this.directory, 'receipts'), { recursive: true });
+        await this.markets.init();
         try {
             this.installed = JSON.parse(await fs.readFile(path.join(this.directory, 'installed.json'), 'utf8'));
         }
@@ -56,7 +60,8 @@ export class Extensions {
     close() { for (const child of this.workers)
         child.kill(); }
     serial(fn) { const next = this.mutation.then(fn, fn); this.mutation = next.catch(() => { }); return next; }
-    list() { return { directory: extensionDirectory, plugins: this.installed.map(({ manifest, ...info }) => info), limits: this.limits }; }
+    list() { return { directory: extensionDirectory, markets: this.markets.list(), plugins: this.installed.map(({ manifest, ...info }) => info), limits: this.limits }; }
+    changeMarket(input) { return this.serial(async () => ({ markets: await this.markets.change(input) })); }
     describe(id) { const value = this.installed.find(p => p.id === id); requireThat(value, 'not_found', 'Plugin is not installed.'); return structuredClone(value); }
     selected(id, expectedDigest) { const value = this.describe(id); requireThat(value.digest === expectedDigest, 'stale', 'The selected plugin changed. Read its descriptor again.'); return value; }
     root(p) { return path.join(this.directory, 'versions', p.digest, 'node_modules', p.name); }
@@ -134,8 +139,9 @@ export class Extensions {
         requireThat(entry, 'not_found', 'Plugin entry not found.');
         return { pluginId: id, packageDigest: p.digest, entryId, kind, title: entry.title, text: await fs.readFile(await this.file(this.root(p), entry.file), 'utf8') };
     }
-    install(source, replace, expected) {
+    install(source, replace, expected, market) {
         return this.serial(async () => {
+            const selection = market ? this.markets.select(market, source) : undefined;
             requireThat(!!replace === !!expected, 'invalid', 'An update needs both replace and expectedDigest.');
             if (replace)
                 this.selected(replace, expected ?? '');
@@ -181,11 +187,14 @@ export class Extensions {
                 const pkg = JSON.parse(await fs.readFile(path.join(install, 'package.json'), 'utf8')), names = Object.keys(pkg.dependencies ?? {});
                 requireThat(names.length === 1, 'invalid', 'Install exactly one plugin package.');
                 const checked = await this.check(path.join(install, 'node_modules', names[0]));
+                requireThat(!selection || (checked.manifest.id === selection.entry.id && checked.version === selection.entry.version), 'conflict', 'Package identity or version does not match the selected market entry. The installed selection was kept.');
                 requireThat(!replace || checked.manifest.id === replace, 'conflict', 'An update must keep the plugin identity.');
                 requireThat(replace || !this.installed.some(p => p.id === checked.manifest.id), 'conflict', 'Plugin is already installed. Use update with its current digest.');
                 await fs.rm(path.join(install, 'node_modules', '.package-lock.json'), { force: true });
                 const sha = await this.hash(path.join(install, 'node_modules'));
-                const selected = { id: checked.manifest.id, name: checked.name, version: checked.version, title: checked.manifest.title, description: checked.manifest.description, digest: sha, source, ...(sourceCommit ? { sourceCommit } : {}), enabled: replace ? this.describe(replace).enabled : true, installedAt: new Date().toISOString(), manifest: checked.manifest };
+                const previous = replace ? this.describe(replace) : undefined;
+                const origin = selection?.origin ?? (previous?.source === source && previous.version === checked.version ? previous.market : undefined);
+                const selected = { id: checked.manifest.id, name: checked.name, version: checked.version, title: checked.manifest.title, description: checked.manifest.description, digest: sha, source, ...(sourceCommit ? { sourceCommit } : {}), ...(origin ? { market: origin } : {}), enabled: previous?.enabled ?? true, installedAt: new Date().toISOString(), manifest: checked.manifest };
                 const destination = path.join(this.directory, 'versions', sha);
                 if (!versions.includes(sha))
                     await fs.rename(install, destination);

package/dist/external-work.d.ts

@@ -0,0 +1,22 @@
+import type { RhoOutput } from './contract.generated.js';
+import { type GraphTurn, type PathScope } from './work-graph.js';
+type Summary = RhoOutput<'agent.sessions.list'>['sessions'][number];
+type Owned = NonNullable<RhoOutput<'observation.snapshot'>['conversations']>[number];
+type Read = RhoOutput<'agent.sessions.read'>;
+export interface WorkSession {
+    id: string;
+    title: string;
+    agent: string;
+    state: string;
+    lastAt: string;
+    version: string;
+    owned?: Owned;
+    external?: Summary;
+}
+export declare const workAgent: (name: string) => string;
+export declare function workSessions(owned: readonly Owned[], outside: readonly Summary[]): WorkSession[];
+export declare function externalTurnAt(turn: Read['turns'][number], at: number | null): Read['turns'][number] | null;
+export declare function externalWork(read: Read, project: PathScope & {
+    id: string;
+}): GraphTurn[];
+export {};

package/dist/external-work.js

@@ -0,0 +1,91 @@
+import { projectPath } from './work-graph.js';
+export const workAgent = (name) => name === 'dsh' ? 'DeepSeek Harness' : name === 'codex' ? 'Codex' : name === 'claude-code' ? 'Claude Code' : name === 'acp' ? 'Agent' : name;
+// A native session continued here is one session, not an outside copy beside a Rho copy.
+// Trashed conversations do not reappear through their native records.
+export function workSessions(owned, outside) {
+    return [...owned.filter(c => !c.trashedAt).map(c => ({ id: c.conversationId, title: c.agentTitle || c.title, agent: workAgent(c.client), state: c.state, lastAt: c.lastAt, version: String(c.version), owned: c })),
+        ...outside.filter(s => !s.conversationId).map(s => ({ id: s.id, title: s.title, agent: workAgent(s.producer), state: s.state, lastAt: s.lastAt, version: [s.sourceCursor, s.lastAt, s.state].join(':'), external: s }))]
+        .sort((a, b) => b.lastAt.localeCompare(a.lastAt));
+}
+const json = (text) => { try {
+    const v = JSON.parse(text);
+    return v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+}
+catch {
+    return null;
+} };
+const bytes = (text) => new TextEncoder().encode(text).length;
+const rhoCall = (name) => name === 'kernel.run' || /^mcp__[\w.-]+__rho_call$/.test(name);
+export function externalTurnAt(turn, at) {
+    if (at === null)
+        return turn;
+    if (Date.parse(turn.at) > at)
+        return null;
+    if (turn.endedAt && Date.parse(turn.endedAt) <= at)
+        return turn;
+    return { ...turn, state: 'running', endedAt: undefined, reply: '', results: [], messages: turn.messages.filter(m => Date.parse(m.at) <= at),
+        tools: turn.tools.filter(t => Date.parse(t.at) <= at).map(t => ({ ...t, output: '', exitCode: undefined, outcome: t.outcome === 'requested' ? 'requested' : 'unknown' })) };
+}
+// A bounded tool reply can end in the middle of a cell's large plot. Only its complete,
+// identifying prefix is read in that case; no outcome or omitted output is filled in.
+function cellOf(name, detail, output) {
+    if (!rhoCall(name) || typeof detail?.code !== 'string' || !['r', 'python'].includes(detail?.language))
+        return null;
+    const cell = json(output)?.value?.cell;
+    if (cell?.changeId === detail.changeId && /^k-[a-f0-9]+$/.test(cell?.cellId))
+        return cell.cellId;
+    const prefix = /^\s*\{\s*"apiVersion"\s*:\s*"2\.0"\s*,\s*"ok"\s*:\s*true\s*,\s*"value"\s*:\s*\{\s*"cell"\s*:\s*\{\s*"cellId"\s*:\s*"(k-[a-f0-9]+)"\s*,\s*"changeId"\s*:\s*("(?:[^"\\]|\\.)*")/.exec(output);
+    return prefix && JSON.parse(prefix[2]) === detail.changeId ? prefix[1] : null;
+}
+// Presentation only: original native session/turn/call identities stay intact. This is never
+// persisted or submitted as a Rho conversation. No native action becomes a managed run.
+export function externalWork(read, project) {
+    return read.turns.map(t => {
+        const cells = [];
+        const steps = t.tools.map(tool => {
+            const input = json(tool.detail), cell = cellOf(tool.name, input, tool.output);
+            if (cell)
+                cells.push(cell);
+            const fileTool = /^(?:read|read_file|read_image|view_image|write|write_file|edit|apply_patch)$/i.test(tool.name);
+            const candidate = input?.file_path ?? input?.path ?? (fileTool ? tool.paths[0] : null);
+            const location = typeof candidate === 'string' ? projectPath(candidate, project) : null;
+            const toolName = /^(?:read_image|read_file)$/i.test(tool.name) ? 'read' : tool.name === 'write_file' ? 'write' : tool.name;
+            return { kind: 'tool', id: tool.id, at: tool.at, tool: cell ? 'mcp__rho__rho_call' : toolName,
+                // Older native projections kept the call time but not the result time. Do not
+                // invent a duration or show that result before the cut which retained it.
+                outcomeAt: t.endedAt ?? read.session.observedAt,
+                ...(cell || tool.name === 'kernel.run' ? { operation: 'kernel.run' } : {}),
+                ...(fileTool ? { detail: location ?? '' } : { detail: typeof input?.command === 'string' ? input.command : tool.detail }),
+                ...(input?.purpose && typeof input.purpose === 'string' ? { purpose: input.purpose } : {}),
+                outcome: tool.outcome === 'failed' ? 'returned' : tool.outcome, ...(tool.outcome === 'failed' ? { failed: true } : {}),
+                ...(tool.exitCode !== undefined ? { exitCode: tool.exitCode } : {}),
+                ...(tool.output ? { output: { text: tool.output, bytes: bytes(tool.output), lines: tool.output.split('\n').length, cut: t.omittedChars > 0 } } : {}) };
+        });
+        for (const m of t.messages)
+            steps.push({ kind: 'text', at: m.at, text: m.text });
+        if (t.reply)
+            steps.push({ kind: 'text', at: t.endedAt ?? read.session.lastAt, text: t.reply });
+        steps.sort((a, b) => a.at.localeCompare(b.at));
+        const turn = { id: t.id, by: read.session.producer, text: t.prompt, sentAt: t.at, startedAt: t.at, endedAt: t.endedAt ?? null,
+            state: t.state, model: null, stop: null, retry: null, result: null, problem: null, steps, omitted: t.omittedTools + t.omittedChars,
+            // This observation did not watch the disk during the turn. Today's mtime is not a
+            // historical file-change observation.
+            files: { changed: [], omitted: 0, partial: false } };
+        const results = new Map();
+        for (const r of t.results) {
+            const path = projectPath(r.path, project);
+            if (!path)
+                continue;
+            const exact = r.projectId === project.id && /^[a-f0-9]{64}$/.test(r.id ?? '') && /^[a-f0-9]{64}$/.test(r.version ?? '');
+            results.set(path, { path, at: t.endedAt ?? read.session.observedAt, ...(exact ? { resource: { id: r.id, version: r.version } } : {}) });
+        }
+        // Links in the final answer are reported results, not observations of file writes.
+        for (const m of t.reply.matchAll(/!?\[[^\]\n]*\]\((?:<([^>]+)>|([^\s)]+))\)/g)) {
+            const path = projectPath(m[1] ?? m[2], project);
+            if (path && /\.[A-Za-z0-9]{1,8}$/.test(path) && !/^[a-z][a-z0-9+.-]*:/i.test(path) && !results.has(path))
+                results.set(path, { path, at: t.endedAt ?? read.session.observedAt });
+        }
+        return { conversationId: read.session.id, conversationTitle: read.session.title, agent: workAgent(read.session.producer), turn,
+            external: true, kernelCells: cells, reportedResults: [...results.values()].slice(0, 64) };
+    });
+}

package/dist/plugin-cli.js

@@ -11,6 +11,10 @@ const help = `Independent Rho plugins (API 1)
   rho plugin check DIRECTORY
   rho plugin add SOURCE [--connection FILE]
   rho plugin list
+  rho plugin market list
+  rho plugin market add URL
+  rho plugin market refresh|remove ID
+  rho plugin market install ID PLUGIN_ID
   rho plugin update ID [--source SOURCE]
   rho plugin enable|disable|remove ID
   rho plugin dev DIRECTORY
@@ -26,7 +30,7 @@ Remove preserves project files, live sessions, receipts and retained package rev
 `;
 export async function pluginCli(args) {
     const { values, positionals } = parseArgs({ args, allowPositionals: true, options: { connection: { type: 'string' }, id: { type: 'string' }, source: { type: 'string' }, project: { type: 'string' }, input: { type: 'string' }, 'change-id': { type: 'string' }, help: { type: 'boolean' } } });
-    const [command, target, operation] = positionals;
+    const [command, target, operation, marketPlugin] = positionals;
     if (values.help || !command) {
         process.stdout.write(help);
         return;
@@ -44,7 +48,52 @@ export async function pluginCli(args) {
             'rho-plugin.json': JSON.stringify(manifest, null, 2) + '\n',
             'host.mjs': `export async function run(operation, input, context) {\n  if (operation === 'greet') return { greeting: 'Hello, ' + input.name + '!' };\n  throw new Error('Unknown operation');\n}\n`,
             'SKILL.md': `# ${id}\n\nRead extension.describe for the installed digest and operation schemas. Call greet with a name. This operation reads only. Use a stable changeId for native operations; observe extension.read after a lost reply.\n`,
-            'view.html': `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${id}</title><style>body{font:16px system-ui;margin:24px;color:#24312b}input,button{font:inherit;padding:8px}output{display:block;margin-top:16px}</style><h1>${id}</h1><form><label>Your name <input name="name" value="World" maxlength="120"></label> <button>Greet</button></form><output aria-live="polite"></output><script>document.querySelector('form').onsubmit=async e=>{e.preventDefault();const out=document.querySelector('output');try{const result=await rho.call('greet',{name:e.target.elements.name.value});out.textContent=result.value?.greeting||result.error}catch(error){out.textContent=error.message}};</script></html>\n`,
+            'view.html': `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${id}</title>
+<style>
+  :root { color-scheme: light; --ink: #202927; --muted: #68736f; --line: #e1e6e3; --well: #f3f5f5; --accent: #1e6b52; --accent-soft: #e5f1e9; --failed: #b13f38; --failed-soft: #fbeeed; }
+  * { box-sizing: border-box; }
+  body { margin: 0; padding: 20px 22px 28px; font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; color: var(--ink); background: #fff; }
+  header { display: flex; align-items: center; gap: 12px; margin-bottom: 18px; }
+  .mark { flex: none; width: 38px; height: 38px; border-radius: 10px; background: var(--accent-soft); color: var(--accent); display: grid; place-content: center; font-weight: 600; font-size: 17px; }
+  h1 { margin: 0; font-size: 17px; line-height: 1.3; font-weight: 650; }
+  header p { margin: 2px 0 0; color: var(--muted); font-size: 12.5px; }
+  form { max-width: 520px; padding: 16px 18px; border: 1px solid var(--line); border-radius: 10px; }
+  label { display: block; margin-bottom: 6px; font-size: 13px; font-weight: 500; }
+  .row { display: flex; gap: 8px; }
+  input, button { min-height: 34px; padding: 6px 12px; border: 1px solid #cbd3ce; border-radius: 7px; font: inherit; color: inherit; background: #fff; }
+  input { flex: 1; min-width: 0; }
+  button { flex: none; font-weight: 500; cursor: pointer; color: #fff; background: var(--accent); border-color: var(--accent); }
+  button:disabled { opacity: .55; cursor: default; }
+  output { display: block; margin-top: 14px; padding: 11px 14px; border-radius: 8px; background: var(--well); white-space: pre-wrap; overflow-wrap: anywhere; }
+  output:empty { display: none; }
+  output.failed { color: var(--failed); background: var(--failed-soft); }
+  .note { margin: 14px 0 0; font-size: 12px; color: var(--muted); }
+  code { font-family: ui-monospace, Menlo, Consolas, monospace; font-size: 12px; }
+</style></head>
+<body>
+<header><span class="mark" aria-hidden="true">${id.charAt(0).toUpperCase()}</span><div><h1>${id}</h1><p>An independent Rho plugin. This page calls its own <code>greet</code> operation through Rho.</p></div></header>
+<form>
+  <label for="name">Your name</label>
+  <div class="row"><input id="name" name="name" value="World" maxlength="120" required><button>Greet</button></div>
+  <output aria-live="polite"></output>
+  <p class="note">The reply comes from this package's <code>host.mjs</code> on this machine. Replace this page with your own; keep scripts and styles inline.</p>
+</form>
+<script>
+  const form = document.querySelector('form'), out = document.querySelector('output'), button = form.querySelector('button');
+  form.onsubmit = async event => {
+    event.preventDefault();
+    button.disabled = true; out.className = ''; out.textContent = 'Greeting…';
+    try {
+      const receipt = await rho.call('greet', { name: form.elements.name.value });
+      if (receipt.state !== 'completed') throw new Error(receipt.error || receipt.state);
+      out.textContent = receipt.value.greeting;
+    } catch (error) { out.className = 'failed'; out.textContent = error.message; }
+    finally { button.disabled = false; }
+  };
+</script>
+</body></html>
+`,
             'README.md': `# ${id}\n\nDevelop: \`rho plugin dev .\`\nCheck: \`rho plugin check .\`\nDistribute: \`npm pack --ignore-scripts\`, then share the tarball, Git package source or publish to your own npm namespace.\n\nSee Rho's docs/THIRD-PARTY-PLUGINS.md for the host and iframe APIs, permissions and contribution process.\n`,
         };
         for (const [file, text] of Object.entries(files))
@@ -76,7 +125,30 @@ export async function pluginCli(args) {
         return result.value;
     };
     let result;
-    if (command === 'list')
+    if (command === 'market') {
+        const catalog = await client.call('extension.list', {});
+        if (target === 'list')
+            result = catalog.markets;
+        else if (target === 'add' && operation)
+            result = await client.call('extension.market.change', { action: 'add', url: operation });
+        else if (['refresh', 'remove', 'install'].includes(target) && operation) {
+            const market = catalog.markets.find(m => m.id === operation);
+            if (!market)
+                throw new Error('Market is not configured: ' + operation);
+            if (target === 'install') {
+                const entry = market.plugins.find(p => p.id === marketPlugin);
+                if (!entry)
+                    throw new Error('Name a plugin id from this market.');
+                const previous = catalog.plugins.find(p => p.id === entry.id);
+                result = await install({ source: entry.source, market: { id: market.id, expectedDigest: market.digest, pluginId: entry.id }, ...(previous ? { replace: previous.id, expectedDigest: previous.digest } : {}) });
+            }
+            else
+                result = await client.call('extension.market.change', { action: target, id: market.id, expectedRevision: market.revision });
+        }
+        else
+            throw new Error('Use rho plugin market list|add URL|refresh ID|remove ID|install ID PLUGIN_ID.');
+    }
+    else if (command === 'list')
         result = await list();
     else if (command === 'add') {
         if (!target)

package/dist/plugin-inventory.d.ts

@@ -0,0 +1,56 @@
+import type { PluginDescriptor } from '@rho-workspace/plugin-contracts';
+export declare function packageFacts(packageName: string): Promise<{
+    version?: string;
+    cli: string[];
+}>;
+export declare function pluginListing(plugin: PluginDescriptor, facts?: {
+    cli?: string[];
+}): {
+    mcp?: {} | undefined;
+    claudeCode?: {
+        skills?: {
+            skill: string;
+            name: string;
+            description: string;
+        }[];
+        hooks?: {
+            id?: string;
+            event: string;
+            matcher: string;
+            entry: string;
+            timeoutSeconds?: number;
+        }[];
+    } | undefined;
+    cli?: string[] | undefined;
+    operations: {
+        method: string;
+        version: "2.0";
+        effect: "native" | "file" | "document" | "read" | "metadata";
+        requires: string[];
+        presentation: import("@rho-workspace/plugin-contracts").EntryPresentation | undefined;
+    }[];
+    actions: {
+        id: string;
+        version: string;
+        requires: string[];
+        presentation: import("@rho-workspace/plugin-contracts").EntryPresentation | undefined;
+    }[];
+    views: {
+        id: string;
+        version: string;
+        ui: string;
+        bindings: Record<string, string>;
+        presentation: import("@rho-workspace/plugin-contracts").EntryPresentation | undefined;
+    }[];
+    skills: {
+        id: string;
+        version: string;
+        digest: string;
+        presentation?: import("@rho-workspace/plugin-contracts").EntryPresentation;
+        intent?: string;
+        requires?: string[];
+        example?: import("@rho-workspace/plugin-contracts").SkillExample;
+        failureRecipes?: import("@rho-workspace/plugin-contracts").SkillFailureRecipe[];
+        verify?: import("@rho-workspace/plugin-contracts").SkillVerification;
+    }[];
+};

package/dist/plugin-inventory.js

@@ -0,0 +1,41 @@
+import * as fs from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+// What the installed package itself records, beside the owner's declaration: its
+// exact version and the command-line entries npm links for it. Read, not declared,
+// so a package that ships no commands lists none.
+export async function packageFacts(packageName) {
+    try {
+        let directory = path.dirname(fileURLToPath(import.meta.resolve(packageName)));
+        for (let depth = 0; depth < 4; depth++, directory = path.dirname(directory)) {
+            try {
+                const pkg = JSON.parse(await fs.readFile(path.join(directory, 'package.json'), 'utf8'));
+                if (pkg.name !== packageName)
+                    continue;
+                const bin = typeof pkg.bin === 'string' ? { [packageName.split('/').at(-1)]: pkg.bin } : pkg.bin ?? {};
+                return { version: typeof pkg.version === 'string' ? pkg.version : undefined, cli: Object.keys(bin).filter(name => /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name)).slice(0, 16) };
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+        }
+    }
+    catch { }
+    return { cli: [] };
+}
+// One descriptive projection for the live catalog and the retained build copy.
+// It contains no Skill text, executable module or grant. Reduced installations
+// can still explain the entries of an owner that is not loaded.
+export function pluginListing(plugin, facts = {}) {
+    const native = plugin.claudeCode;
+    return {
+        operations: plugin.operations.map(({ method, version, effect, requires, presentation }) => ({ method, version, effect, requires, presentation })),
+        actions: (plugin.actions ?? []).map(({ id, version, requires, presentation }) => ({ id, version, requires, presentation })),
+        views: (plugin.components ?? []).map(({ id, version, ui, bindings, presentation }) => ({ id, version, ui, bindings, presentation })),
+        skills: plugin.skills.map(({ content, ...skill }) => skill),
+        ...(facts.cli?.length ? { cli: facts.cli } : {}),
+        ...(native ? { claudeCode: native } : {}),
+        ...(plugin.agent?.mcp ? { mcp: plugin.agent.mcp } : {}),
+    };
+}