@rynx-ai/daemon 0.1.11-beta.4 → 0.1.11-beta.6

package/dist/daemon-server.js

@@ -18,8 +18,9 @@ import { RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES, RUNTIME_BROWSER_INSPECT_SEMA
 import { RUNTIME_BROWSER_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-browser-surface";
 import { RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-emulator-surface";
 import { createDaemonRuntimeHost, createDesktopFirstSessionBrowserHost, createRunnerSessionTerminalHost, createSessionRuntimeServices, DesktopBrowserHostAbsentError, DesktopBrowserHostRegistry, DirectRuntimeConnectionHub, DirectRuntimeBrowserInspectHostError, MachineSessionService, MachineSessionServiceFailure, listRuntimeModels, RemoteRuntimeDispatcher, SessionBrowserService, SessionBrowserServiceError, SessionBrowserSurfaceCoordinator, SessionEmulatorService, startServer, startDirectRuntimeServer, } from "@rynx-ai/server";
+import { authorizeSessionPortalGrant, redeemSessionPortalTicket, } from "./session-portal-grant-store.js";
 import { APP_BROWSER_HOST_BOOTSTRAP_TYPE, AppBrowserHostSupervisor, parseAppBrowserHostLaunchConfig, } from "./app-browser-host-supervisor.js";
-import { buildControlDeps } from "./control-deps.js";
+import { buildControlDeps, listControlAgentModels } from "./control-deps.js";
 import { createBrowserArtifactManagementService } from "./browser-artifact-management.js";
 import { createDaemonBuildStatus } from "./daemon-build-status.js";
 import { MaintenanceLeaseStore } from "./maintenance-lease.js";
@@ -49,7 +50,7 @@ import { SqliteSessionResourceStore } from "./session-resource-store.js";
 import { createSessionFallbackWorkspace, discardSessionFallbackWorkspace, } from "./session-fallback-workspace.js";
 import { SessionBrowserCapabilityStore } from "./session-browser-capability-store.js";
 import { SqliteSessionEmulatorBindingStore } from "./session-emulator-binding-store.js";
-import { sessionRegistry } from "./session-meta-store.js";
+import { sessionBelongsToPlugin, sessionRegistry } from "./session-meta-store.js";
 import { sessionPendingMessageStore } from "./session-pending-message-store.js";
 import { RemoteRuntimeAccessStore } from "./remote-runtime-access-store.js";
 import { DaemonRemoteRuntimeAdmin } from "./remote-runtime-admin.js";
@@ -280,7 +281,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
         const directConfig = directHostingSupported
             ? await loadDirectConfig()
             : undefined;
-        const control = buildControlDeps();
+        const control = buildControlDeps(appConfig);
         const installationIdentity = await loadOrCreateDaemonInstallationIdentity();
         const directEncryptionIdentity = directHostingSupported
             ? await loadOrCreateDaemonDirectRuntimeEncryptionIdentity()
@@ -304,6 +305,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                 "semantic.session.interrupt.v1",
                 "semantic.session.agent-options.v1",
                 "semantic.session.launch-options.v2",
+                "semantic.session.execution-settings.v1",
                 "semantic.session.create.v1",
                 "semantic.session.fork.v1",
                 "semantic.session.message.v1",
@@ -556,14 +558,16 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
             forks: sessionForks,
             execution: {
                 runtime: sessionRuntimeServices.conversationRuntime,
-                resolve: ({ agent, provider, model, reasoningEffort, cwd }) => resolveSessionExecutionSnapshot({
+                resolve: ({ agent, provider, model, reasoningEffort, permissionPreset, cwd }) => resolveSessionExecutionSnapshot({
                     config: appConfig,
                     ...(agent ? { agentName: agent } : {}),
                     ...(provider ? { provider } : {}),
                     ...(model ? { model } : {}),
                     ...(reasoningEffort ? { reasoningEffort } : {}),
+                    ...(permissionPreset ? { permissionPreset } : {}),
                     cwd,
                 }),
+                listModels: (provider) => listControlAgentModels(appConfig, provider),
                 runner: sessionRuntimeServices.runnerManager,
             },
             workspace: {
@@ -794,6 +798,11 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                     registry: desktopBrowserHosts,
                     daemonInstanceId,
                 },
+                sessionPortalAuthorization: {
+                    redeem: redeemSessionPortalTicket,
+                    authorize: authorizeSessionPortalGrant,
+                    ownsSession: sessionBelongsToPlugin,
+                },
             });
             baseShutdown = server.shutdown.bind(server);
             if (directConfig && directEncryptionIdentity) {

package/dist/db.js

@@ -1,9 +1,11 @@
 /**
  * `~/.rynx/rynx.db` — the daemon's SQLite store. Concerns kept apart:
- *  - `plugin_installations` — source-qualified manifests, capabilities, and immutable packages.
+ *  - `plugin_installations` — source-qualified manifests and immutable packages.
  *  - `plugin_marketplaces` — catalog registrations; catalog data is never executable.
  *  - `plugin_session_launch_operations` — durable idempotency/tombstones.
  *  - `control_links` — generic, one-use links to the local session console.
+ *  - `session_portal_tickets` / `session_portal_grants` — hashed, scoped,
+ *    browser Session Portal authorization.
  *  - `runtime_pairing_claims` / `runtime_client_grants` — one-use enrollment
  *    claims and the durable client identities they issue for direct runtimes.
  *  - `runtime_targets` / `runtime_direct_routes` / `runtime_pending_enrollments`
@@ -86,7 +88,6 @@ function migrate(conn) {
       install_path   TEXT NOT NULL,
       manifest       TEXT NOT NULL,
       integrity      TEXT NOT NULL,
-      capabilities   TEXT NOT NULL,
       runtime_state  TEXT,
       runtime_error  TEXT,
       UNIQUE(marketplace_id, plugin_id)
@@ -245,6 +246,39 @@ function migrate(conn) {
     );
     CREATE INDEX IF NOT EXISTS idx_control_links_expires
       ON control_links(expires_at);
+    CREATE TABLE IF NOT EXISTS session_portal_tickets (
+      ticket_hash TEXT PRIMARY KEY,
+      plugin_id   TEXT NOT NULL,
+      scope       TEXT NOT NULL CHECK(scope IN ('plugin_sessions', 'single_session')),
+      access      TEXT NOT NULL CHECK(access IN ('read_only', 'read_write')),
+      session_id  TEXT,
+      created_at  TEXT NOT NULL,
+      expires_at  TEXT NOT NULL,
+      used_at     TEXT,
+      CHECK(
+        (scope = 'plugin_sessions' AND session_id IS NULL)
+        OR (scope = 'single_session' AND session_id IS NOT NULL)
+      )
+    );
+    CREATE INDEX IF NOT EXISTS idx_session_portal_tickets_expires
+      ON session_portal_tickets(expires_at);
+    CREATE TABLE IF NOT EXISTS session_portal_grants (
+      portal_id   TEXT PRIMARY KEY,
+      secret_hash TEXT NOT NULL,
+      plugin_id   TEXT NOT NULL,
+      scope       TEXT NOT NULL CHECK(scope IN ('plugin_sessions', 'single_session')),
+      access      TEXT NOT NULL CHECK(access IN ('read_only', 'read_write')),
+      session_id  TEXT,
+      created_at  TEXT NOT NULL,
+      expires_at  TEXT NOT NULL,
+      revoked_at  TEXT,
+      CHECK(
+        (scope = 'plugin_sessions' AND session_id IS NULL)
+        OR (scope = 'single_session' AND session_id IS NOT NULL)
+      )
+    );
+    CREATE INDEX IF NOT EXISTS idx_session_portal_grants_expires
+      ON session_portal_grants(expires_at);
     CREATE TABLE IF NOT EXISTS runtime_pairing_claims (
       claim_id                   TEXT PRIMARY KEY,
       secret_hash                TEXT NOT NULL,
@@ -308,7 +342,7 @@ function migrate(conn) {
     CREATE INDEX IF NOT EXISTS idx_runtime_pending_enrollments_expires
       ON runtime_pending_enrollments(expires_at);
   `);
-    migratePluginCapabilities(conn);
+    migratePluginCapabilityDeclarations(conn);
     migrateSessionSnapshots(conn);
     // Breaking plugin-runtime cutover: remove obsolete core-owned state.
     conn.exec(`
@@ -319,6 +353,18 @@ function migrate(conn) {
     addColumnIfMissing(conn, "sessions", "forked_from_session_id", "TEXT");
     addColumnIfMissing(conn, "plugin_session_launch_operations", "raw_request_hash", "TEXT");
 }
+/** Remove the inert permission-declaration columns left by older installations. */
+function migratePluginCapabilityDeclarations(conn) {
+    const columns = conn
+        .prepare("PRAGMA table_info(plugin_installations)")
+        .all();
+    const names = new Set(columns.map((column) => column.name));
+    for (const legacyColumn of ["capabilities", "grants"]) {
+        if (names.has(legacyColumn)) {
+            conn.exec(`ALTER TABLE plugin_installations DROP COLUMN ${legacyColumn}`);
+        }
+    }
+}
 /**
  * Breaking Session cutover: the previous rows contain mutable Agent/Provider
  * references and no immutable workspace/execution snapshots, so they cannot be
@@ -358,18 +404,6 @@ function migrateSessionSnapshots(conn) {
     `);
     }).immediate();
 }
-function migratePluginCapabilities(conn) {
-    const columns = conn
-        .prepare("PRAGMA table_info(plugin_installations)")
-        .all();
-    if (columns.some((column) => column.name === "capabilities"))
-        return;
-    if (columns.some((column) => column.name === "grants")) {
-        conn.exec("ALTER TABLE plugin_installations RENAME COLUMN grants TO capabilities");
-        return;
-    }
-    conn.exec("ALTER TABLE plugin_installations ADD COLUMN capabilities TEXT NOT NULL DEFAULT '[]'");
-}
 /** Idempotently add a column to an existing table (no-op if already present). */
 function addColumnIfMissing(conn, table, column, ddl) {
     const cols = conn.prepare(`PRAGMA table_info(${table})`).all();

package/dist/plugin-host-rpc.d.ts

@@ -1,5 +1,5 @@
 import { type AdmissionReservation, type AgentSpec, type AgentCapabilities, type AgentRuntimeId, type AgentSessionStore, type ConversationRuntime, type ResolvedExecutionSnapshot, type SessionRegistry, type SessionWorkspaceSnapshot } from "@rynx-ai/core";
-import { type PluginAgentSummary, type PluginCapability, type PluginHostEvent, type PluginResolvedSessionExecution, type PluginSessionExecutionSnapshot, type PluginSessionInteractionResolveDisposition } from "@rynx-ai/plugin-sdk";
+import { type PluginAgentSummary, type PluginHostEvent, type PluginResolvedSessionExecution, type PluginSessionExecutionSnapshot, type PluginSessionInteractionResolveDisposition } from "@rynx-ai/plugin-sdk";
 import type { SessionInteractionResolution } from "@rynx-ai/protocol";
 import { PluginRunnerError } from "@rynx-ai/plugin-runner";
 /** Leaves ample room for the RPC envelope below the runner's 1 MiB line cap. */
@@ -60,6 +60,11 @@ export interface PluginHostServices {
     }>;
     admissionOpen?: () => boolean;
     admissionReserve?: () => AdmissionReservation | undefined;
+    sessionPortal?: {
+        scheme: "http" | "https";
+        bindHost: string;
+        port: number;
+    };
 }
 export interface PluginHostRpcOptions {
     /** Manifest id returned by host.info. */
@@ -69,7 +74,6 @@ export interface PluginHostRpcOptions {
     daemonInstanceId: string;
     productVersion: string;
     cliVersion: string;
-    capabilities: readonly PluginCapability[];
     services: PluginHostServices;
     /** Canonical plugin-owned root permitted for the Workspace plugin's isolated
      * Session directory. Omitted for every other plugin. */
@@ -80,7 +84,7 @@ export interface PluginHostRpcOptions {
     disposeForceAfterMs?: number;
 }
 /**
- * One authenticated plugin's capability-gated Host RPC surface.
+ * One authenticated plugin's Host RPC surface.
  *
  * This adapter is deliberately the only place that maps public string methods
  * to trusted runtime objects. The runner receives neither this class nor its
@@ -92,7 +96,6 @@ export declare class PluginHostRpc {
     private readonly daemonInstanceId;
     private readonly productVersion;
     private readonly cliVersion;
-    private readonly capabilities;
     private readonly services;
     private readonly managedWorkspaceRoot;
     private readonly emit;
@@ -131,6 +134,7 @@ export declare class PluginHostRpc {
     private setSessionTitle;
     private resolveAgentExecution;
     private issueControlLink;
+    private issueSessionPortalLink;
     private ownedSession;
     private isOwned;
 }

package/dist/plugin-host-rpc.js

@@ -6,6 +6,7 @@ import { PLUGIN_HOST_MAX_ACTIVE_RUNS, } from "@rynx-ai/plugin-sdk";
 import { PluginRunnerError } from "@rynx-ai/plugin-runner";
 import { ensurePluginSessionLaunch, replayPluginSessionLaunch, SessionLaunchOperationConflictError, SessionLaunchOperationTargetDeletedError, } from "./session-launch-operations.js";
 import { createControlLink } from "./control-link-store.js";
+import { issueSessionPortalTicket } from "./session-portal-grant-store.js";
 const MAX_MESSAGE_LENGTH = 1_000_000;
 /** Leaves ample room for the RPC envelope below the runner's 1 MiB line cap. */
 export const MAX_PLUGIN_HOST_EVENT_BYTES = 512 * 1024;
@@ -13,31 +14,8 @@ const MAX_PLUGIN_RUN_FINAL_RESPONSE_BYTES = 64 * 1024;
 const MAX_DELTA_CHUNK_CODE_UNITS = 64 * 1024;
 const SESSION_INTERACTION_RESOLUTION_MAX_BYTES = 128 * 1024;
 const AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
-const METHOD_CAPABILITY = {
-    "installation.proof.sign": "installation.proof",
-    "agent.catalog.list": "agent.catalog.read",
-    "agent.catalog.get": "agent.catalog.read",
-    "agent.execution.resolve": "agent.catalog.read",
-    "session.ensure": "session.provision",
-    "session.run": "conversation.run",
-    "session.steer": "conversation.run",
-    "session.interrupt": "session.cancel",
-    "session.interaction.resolve": "conversation.run",
-    "session.models": "runtime.catalog.read",
-    "session.binding.get": "session.binding.read",
-    "session.binding.list": "session.binding.read",
-    "session.binding.find": "session.binding.read",
-    "session.goal.get": "session.goal.read",
-    "session.goal.set": "session.goal.write",
-    "session.goal.clear": "session.goal.write",
-    "session.fork": "session.fork",
-    "session.meta.get": "session.meta.read",
-    "session.meta.list": "session.meta.read",
-    "session.meta.setTitle": "session.meta.title.write",
-    "control.link.issue": "control-link.issue",
-};
 /**
- * One authenticated plugin's capability-gated Host RPC surface.
+ * One authenticated plugin's Host RPC surface.
  *
  * This adapter is deliberately the only place that maps public string methods
  * to trusted runtime objects. The runner receives neither this class nor its
@@ -49,7 +27,6 @@ export class PluginHostRpc {
     daemonInstanceId;
     productVersion;
     cliVersion;
-    capabilities;
     services;
     managedWorkspaceRoot;
     emit;
@@ -65,7 +42,6 @@ export class PluginHostRpc {
         this.daemonInstanceId = requiredString(options.daemonInstanceId, "daemonInstanceId", 128);
         this.productVersion = requiredString(options.productVersion, "productVersion", 128);
         this.cliVersion = requiredString(options.cliVersion, "cliVersion", 128);
-        this.capabilities = new Set(options.capabilities);
         this.services = options.services;
         this.managedWorkspaceRoot = options.managedWorkspaceRoot
             ? path.resolve(options.managedWorkspaceRoot)
@@ -89,15 +65,11 @@ export class PluginHostRpc {
                     publicKey: this.services.installationProof.publicKey,
                 },
                 protocolVersion: 1,
-                capabilities: [...this.capabilities],
+                ...(this.services.sessionPortal
+                    ? { sessionPortal: { ...this.services.sessionPortal } }
+                    : {}),
             };
         }
-        const capability = METHOD_CAPABILITY[method];
-        if (!capability)
-            throw new PluginHostCallError("METHOD_NOT_FOUND", `unknown host method: ${method}`);
-        if (!this.capabilities.has(capability)) {
-            throw new PluginHostCallError("CAPABILITY_NOT_DECLARED", `host method ${method} is missing manifest capability ${capability}`);
-        }
         try {
             switch (method) {
                 case "installation.proof.sign": {
@@ -151,6 +123,16 @@ export class PluginHostRpc {
                     return this.setSessionTitle(params);
                 case "control.link.issue":
                     return this.issueControlLink(params);
+                case "session.portal.plugin.issue": {
+                    const access = requiredSessionPortalAccess(params);
+                    return this.issueSessionPortalLink("plugin_sessions", access);
+                }
+                case "session.portal.session.issue": {
+                    const input = record(params);
+                    const sessionId = requiredSessionId(input);
+                    this.ownedSession(sessionId);
+                    return this.issueSessionPortalLink("single_session", requiredSessionPortalAccess(input), sessionId);
+                }
                 default:
                     throw new PluginHostCallError("METHOD_NOT_FOUND", `unknown host method: ${method}`);
             }
@@ -652,6 +634,17 @@ export class PluginHostRpc {
             ...(ttlSeconds === undefined ? {} : { ttlMs: ttlSeconds * 1_000 }),
         });
     }
+    issueSessionPortalLink(scope, access, sessionId) {
+        if (!this.services.sessionPortal) {
+            throw new PluginHostCallError("HOST_CALL_FAILED", "the Session Portal is not configured");
+        }
+        return issueSessionPortalTicket({
+            pluginId: this.principalId,
+            scope,
+            access,
+            ...(sessionId ? { sessionId } : {}),
+        });
+    }
     ownedSession(sessionId) {
         const session = this.services.sessionRegistry.get(sessionId);
         if (!session || !this.isOwned(session)) {
@@ -768,6 +761,12 @@ function sessionExecutionSnapshot(value) {
 function requiredSessionId(params) {
     return requiredString(record(params).sessionId, "sessionId", 512);
 }
+function requiredSessionPortalAccess(params) {
+    const access = record(params).access;
+    if (access === "read_only" || access === "read_write")
+        return access;
+    throw new PluginHostCallError("INVALID_PARAMS", "access must be read_only or read_write");
+}
 function sessionInteractionResolution(value) {
     const input = record(value);
     const keys = Object.keys(input);

package/dist/plugin-management-service.js

@@ -295,7 +295,6 @@ function toManagementItem(record, settingsAvailable = false, updateState = "unkn
         enabled: record.enabled,
         runtimeState: record.manifest.runtime ? record.runtimeState : "absent",
         ...(record.runtimeError ? { runtimeError: record.runtimeError } : {}),
-        capabilities: [...record.manifest.capabilities],
         hasSettingsUi: settingsAvailable,
         updatedAt: record.updatedAt,
     };
@@ -322,7 +321,6 @@ function toInstallPreparation(token, expiresAtMs, prepared) {
                     subdirectory: prepared.requestedSource.subdir ?? ".",
                 },
             digest: prepared.integrity,
-            capabilities: [...prepared.manifest.capabilities],
             hasRuntime: Boolean(prepared.manifest.runtime),
             hasSettingsUi: Boolean(prepared.manifest.settings),
             ...(prepared.manifest.runtime ? {

package/dist/plugin-store.js

@@ -57,11 +57,11 @@ export function upsertPlugin(rec) {
     db().prepare(`INSERT INTO plugin_installations (
        canonical_id, marketplace_id, plugin_id, source_type, requested_source,
        resolved_revision, source_fingerprint, version, enabled, installed_at,
-       updated_at, install_path, manifest, integrity, capabilities, runtime_state, runtime_error
+       updated_at, install_path, manifest, integrity, runtime_state, runtime_error
      ) VALUES (
        @canonicalId, @marketplaceId, @pluginId, @source, @requestedSource,
        @resolvedRevision, @sourceFingerprint, @version, @enabled, @now,
-       @now, @installPath, @manifest, @integrity, @capabilities, 'stopped', NULL
+       @now, @installPath, @manifest, @integrity, 'stopped', NULL
      )
      ON CONFLICT(canonical_id) DO UPDATE SET
        source_type = excluded.source_type,
@@ -74,7 +74,6 @@ export function upsertPlugin(rec) {
        install_path = excluded.install_path,
        manifest = excluded.manifest,
        integrity = excluded.integrity,
-       capabilities = excluded.capabilities,
        runtime_state = 'stopped',
        runtime_error = NULL`).run({
         canonicalId: rec.canonicalId,
@@ -90,7 +89,6 @@ export function upsertPlugin(rec) {
         installPath: rec.installPath,
         manifest: JSON.stringify(rec.manifest),
         integrity: rec.integrity,
-        capabilities: JSON.stringify(rec.manifest.capabilities),
     });
 }
 export function setPluginEnabled(identity, enabled) {

package/dist/plugin-supervisor.js

@@ -294,7 +294,6 @@ export class PluginSupervisor {
                 daemonInstanceId: this.daemonInstanceId,
                 productVersion: this.productVersion,
                 cliVersion: this.cliVersion,
-                capabilities: state.record.manifest.capabilities,
                 services: this.services,
                 ...(state.record.pluginId === "workspace"
                     && isBuiltInPluginMarketplace(state.record.marketplaceId)
@@ -324,7 +323,6 @@ export class PluginSupervisor {
                 role: "runtime",
                 dataDir,
                 cacheDir,
-                capabilities: state.record.manifest.capabilities,
                 handleHostCall: (method, params, signal) => hostRpc.call(method, params, signal),
                 onStderr: (line) => this.log({
                     level: "info",
@@ -411,7 +409,6 @@ export class PluginSupervisor {
                 daemonInstanceId: this.daemonInstanceId,
                 productVersion: this.productVersion,
                 cliVersion: this.cliVersion,
-                capabilities: state.record.manifest.capabilities,
                 services: this.services,
                 ...(state.record.pluginId === "workspace"
                     && isBuiltInPluginMarketplace(state.record.marketplaceId)
@@ -440,7 +437,6 @@ export class PluginSupervisor {
                 role: "settings",
                 dataDir,
                 cacheDir,
-                capabilities: state.record.manifest.capabilities,
                 handleHostCall: (method, params, signal) => hostRpc.call(method, params, signal),
                 onStderr: (line) => this.log({
                     level: "info",

package/dist/session-meta-store.d.ts

@@ -18,6 +18,11 @@ export declare function listSessionMetas(): StoredSessionMeta[];
 export declare function getSessionMeta(id: string): StoredSessionMeta | undefined;
 export declare function createSessionMeta(meta: StoredSessionMeta): void;
 export declare function setSessionTitle(id: string, title: string): void;
+export declare function setSessionExecution(id: string, execution: MachineSessionRecord["execution"]): void;
 export declare function removeSessionMeta(id: string): void;
 /** {@link SessionRegistry} over the same `sessions` table. */
 export declare const sessionRegistry: SessionRegistry;
+/** Generic plugin-principal ownership, including descendants forked from a
+ * plugin-created Session. Portal authorization calls this on every request so
+ * a grant cannot cross into console or another plugin's Sessions. */
+export declare function sessionBelongsToPlugin(pluginId: string, sessionId: string): boolean;

package/dist/session-meta-store.js

@@ -48,6 +48,11 @@ export function setSessionTitle(id, title) {
         .prepare("UPDATE sessions SET title = ?, updated_at = ? WHERE id = ?")
         .run(normalizeSessionTitle(title), new Date().toISOString(), id);
 }
+export function setSessionExecution(id, execution) {
+    db()
+        .prepare("UPDATE sessions SET execution = ?, updated_at = ? WHERE id = ?")
+        .run(JSON.stringify(resolvedExecutionSnapshotSchema.parse(execution)), new Date().toISOString(), id);
+}
 export function removeSessionMeta(id) {
     db().transaction(() => {
         const now = new Date().toISOString();
@@ -70,8 +75,25 @@ export const sessionRegistry = {
     get: getSessionMeta,
     list: listSessionMetas,
     setTitle: setSessionTitle,
+    setExecution: setSessionExecution,
     remove: removeSessionMeta,
 };
+/** Generic plugin-principal ownership, including descendants forked from a
+ * plugin-created Session. Portal authorization calls this on every request so
+ * a grant cannot cross into console or another plugin's Sessions. */
+export function sessionBelongsToPlugin(pluginId, sessionId) {
+    const seen = new Set();
+    let current = sessionRegistry.get(sessionId);
+    while (current && !seen.has(current.id)) {
+        if (current.source === `plugin:${pluginId}`)
+            return true;
+        seen.add(current.id);
+        current = current.forkedFromSessionId
+            ? sessionRegistry.get(current.forkedFromSessionId)
+            : undefined;
+    }
+    return false;
+}
 function rowToMeta(row) {
     return {
         id: row.id,

package/dist/session-portal-grant-store.d.ts

@@ -0,0 +1,29 @@
+export type SessionPortalScope = "plugin_sessions" | "single_session";
+export type SessionPortalAccess = "read_only" | "read_write";
+export interface SessionPortalAuthorization {
+    portalId: string;
+    pluginId: string;
+    scope: SessionPortalScope;
+    access: SessionPortalAccess;
+    sessionId?: string;
+    expiresAt: string;
+}
+/** Issue a browser handoff into the native Session workbench. The Host knows
+ * only the generic Session scope and access level; product/user policy stays in
+ * the plugin that asks for the ticket. */
+export declare function issueSessionPortalTicket(input: {
+    pluginId: string;
+    scope: SessionPortalScope;
+    access: SessionPortalAccess;
+    sessionId?: string;
+    now?: Date;
+}): {
+    path: string;
+    expiresAt: string;
+};
+/** Atomically consume a one-use ticket and mint a fixed-lifetime browser grant. */
+export declare function redeemSessionPortalTicket(ticket: string, now?: Date): (SessionPortalAuthorization & {
+    secret: string;
+}) | undefined;
+export declare function authorizeSessionPortalGrant(portalId: string, secret: string, now?: Date): SessionPortalAuthorization | undefined;
+export declare function pruneSessionPortalAuthorization(now?: Date): void;

package/dist/session-portal-grant-store.js

@@ -0,0 +1,84 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { db } from "./db.js";
+const TICKET_TTL_MS = 5 * 60 * 1_000;
+const GRANT_TTL_MS = 30 * 60 * 1_000;
+/** Issue a browser handoff into the native Session workbench. The Host knows
+ * only the generic Session scope and access level; product/user policy stays in
+ * the plugin that asks for the ticket. */
+export function issueSessionPortalTicket(input) {
+    if ((input.scope === "single_session") !== Boolean(input.sessionId)) {
+        throw new Error("single_session Portal tickets require exactly one Session id");
+    }
+    const now = input.now ?? new Date();
+    const expiresAt = new Date(now.getTime() + TICKET_TTL_MS).toISOString();
+    const ticket = randomToken();
+    pruneSessionPortalAuthorization(now);
+    db().prepare(`INSERT INTO session_portal_tickets
+       (ticket_hash, plugin_id, scope, access, session_id, created_at, expires_at, used_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, NULL)`).run(hash(ticket), input.pluginId, input.scope, input.access, input.sessionId ?? null, now.toISOString(), expiresAt);
+    return {
+        path: `/session-portal/redeem#ticket=${encodeURIComponent(ticket)}`,
+        expiresAt,
+    };
+}
+/** Atomically consume a one-use ticket and mint a fixed-lifetime browser grant. */
+export function redeemSessionPortalTicket(ticket, now = new Date()) {
+    const connection = db();
+    return connection.transaction(() => {
+        const ticketHash = hash(ticket);
+        const row = connection.prepare(`SELECT plugin_id, scope, access, session_id, expires_at, used_at
+         FROM session_portal_tickets
+        WHERE ticket_hash = ?`).get(ticketHash);
+        if (!row || row.used_at !== null || row.expires_at <= now.toISOString())
+            return undefined;
+        const consumed = connection.prepare(`UPDATE session_portal_tickets SET used_at = ?
+        WHERE ticket_hash = ? AND used_at IS NULL AND expires_at > ?`).run(now.toISOString(), ticketHash, now.toISOString());
+        if (consumed.changes !== 1)
+            return undefined;
+        const portalId = randomUUID();
+        const secret = randomToken();
+        const expiresAt = new Date(now.getTime() + GRANT_TTL_MS).toISOString();
+        connection.prepare(`INSERT INTO session_portal_grants
+         (portal_id, secret_hash, plugin_id, scope, access, session_id, created_at, expires_at, revoked_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`).run(portalId, hash(secret), row.plugin_id, row.scope, row.access, row.session_id, now.toISOString(), expiresAt);
+        return {
+            portalId,
+            secret,
+            pluginId: row.plugin_id,
+            scope: row.scope,
+            access: row.access,
+            ...(row.session_id ? { sessionId: row.session_id } : {}),
+            expiresAt,
+        };
+    })();
+}
+export function authorizeSessionPortalGrant(portalId, secret, now = new Date()) {
+    const row = db().prepare(`SELECT portal_id, secret_hash, plugin_id, scope, access, session_id, expires_at, revoked_at
+       FROM session_portal_grants
+      WHERE portal_id = ?`).get(portalId);
+    if (!row || row.revoked_at !== null || row.expires_at <= now.toISOString())
+        return undefined;
+    const actual = Buffer.from(hash(secret), "hex");
+    const expected = Buffer.from(row.secret_hash, "hex");
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        return undefined;
+    return {
+        portalId: row.portal_id,
+        pluginId: row.plugin_id,
+        scope: row.scope,
+        access: row.access,
+        ...(row.session_id ? { sessionId: row.session_id } : {}),
+        expiresAt: row.expires_at,
+    };
+}
+export function pruneSessionPortalAuthorization(now = new Date()) {
+    const connection = db();
+    connection.prepare("DELETE FROM session_portal_tickets WHERE expires_at <= ? OR used_at IS NOT NULL").run(now.toISOString());
+    connection.prepare("DELETE FROM session_portal_grants WHERE expires_at <= ? OR revoked_at IS NOT NULL").run(now.toISOString());
+}
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function hash(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}

package/dist/skills-catalog.d.ts

@@ -1,11 +1,20 @@
-import { type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
-import type { SkillDetail } from "@rynx-ai/protocol/control";
+import { type LocalSkillRuntime, type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
+import type { ControlLocalSkillCandidate, ControlLocalSkillImportResult, SkillDetail } from "@rynx-ai/protocol/control";
 export declare function listCatalogSkills(): Promise<SkillMeta[]>;
 /** Install a skill (or a repo's skills) into the catalog per a full install
  *  recipe; delegates to the core catalog layer (which also writes each skill's
  *  `.rynx-skill.json` install-info file — a catalog-only artifact). Returns
  *  the refreshed catalog. */
 export declare function installCatalogSkill(recipe: SkillInstallRecipe): Promise<SkillMeta[]>;
+export declare function scanLocalCatalogSkillCandidates(runtime: LocalSkillRuntime): Promise<ControlLocalSkillCandidate[]>;
+/**
+ * Register complete local runtime Skill bundles into the owner catalog. Every
+ * content hash gets a durable immutable artifact; the mutable catalog entry's
+ * receipt points at that artifact so old Agent specs keep their exact bytes
+ * after a later catalog update.
+ */
+export declare function importLocalCatalogSkills(runtime: LocalSkillRuntime, keys: string[]): Promise<ControlLocalSkillImportResult[]>;
+export declare function importCatalogSkillsFromArchive(filename: string, contentBase64: string): Promise<ControlLocalSkillImportResult[]>;
 /** Detail for one catalog skill: its metadata + the file tree under its dir. */
 export declare function getCatalogSkill(name: string): Promise<SkillDetail | null>;
 /** Read one text file inside a catalog skill. Path-confined to the skill dir,