@ryuhq/sdk 0.2.0 → 0.2.2

package/dist/{tool-u-VR0fLF.d.cts → tool-CgzW92O_.d.cts}

@@ -278,6 +278,36 @@ interface BackgroundClient {
         process_id: string;
     }>;
 }
+/** Durable app-owned key/value state (`storage:kv` via the host bridge). */
+interface StorageClient {
+    /** Atomically replace a value when it still equals `expected`. */
+    compareAndSet(input: {
+        expected: string | null;
+        key: string;
+        namespace?: string;
+        value: string | null;
+    }): Promise<boolean>;
+    /** Delete one value. */
+    delete(input: {
+        key: string;
+        namespace?: string;
+    }): Promise<void>;
+    /** Read one value; missing keys return `null`. */
+    get(input: {
+        key: string;
+        namespace?: string;
+    }): Promise<string | null>;
+    /** List keys in an app-owned namespace. */
+    keys(input?: {
+        namespace?: string;
+    }): Promise<string[]>;
+    /** Write one string value. JSON can be encoded by the app when needed. */
+    set(input: {
+        key: string;
+        namespace?: string;
+        value: string;
+    }): Promise<void>;
+}
 /** TTS primitive — speech synthesis (`crates/ryu-tts`). */
 interface TtsClient {
     /**
@@ -330,6 +360,7 @@ interface RyuPrimitives {
     memory: MemoryClient;
     rag: RagClient;
     realtime: RealtimeClient;
+    storage: StorageClient;
     stt: SttClient;
     tts: TtsClient;
 }
@@ -393,6 +424,8 @@ interface RunnableContext {
     sessionId?: string;
     /** Signal to abort a long-running run. */
     signal?: AbortSignal;
+    /** Durable app-owned KV state, gated by the manifest's `storage:kv` grant. */
+    storage?: StorageClient;
     /** STT primitive: transcribe (`crates/ryu-stt`). */
     stt?: SttClient;
     /** TTS primitive: speak (`crates/ryu-tts`). */
@@ -472,9 +505,13 @@ interface ToolSchema {
     required?: string[];
     /** Type is always "object" for a tool's top-level input schema. */
     type: "object";
+    /** Preserve additional JSON Schema keywords for Core/MCP consumers. */
+    [key: string]: unknown;
 }
 /** Options accepted by `defineTool`. */
 interface ToolOptions<TInput extends Record<string, unknown>, TOutput> {
+    /** Optional description surfaced to models and tool discovery. */
+    description?: string;
     /** Stable unique identifier (e.g. "tool-web-search"). */
     id: string;
     /** Human-readable display name. */
@@ -514,6 +551,8 @@ interface ToolRunnable<TInput extends Record<string, unknown> = Record<string, u
      * the sandbox form is the second parameter aliased to `host`.
      */
     readonly code: string;
+    /** Optional description surfaced to models and tool discovery. */
+    readonly description?: string;
     readonly kind: "tool";
     /** JSON Schema for this tool's input — compatible with Core's ToolInfo.schema. */
     readonly schema: ToolSchema;
@@ -548,6 +587,19 @@ interface ToolRunnable<TInput extends Record<string, unknown> = Record<string, u
  * ```
  */
 declare function defineTool<TInput extends Record<string, unknown> = Record<string, unknown>, TOutput = unknown>(options: ToolOptions<TInput, TOutput>): ToolRunnable<TInput, TOutput>;
+/** Optional metadata lowered alongside a tool's executable backend. */
+interface InlineToolManifestOptions {
+    /** Marks the entry as a semantic Ryu Action. */
+    action?: boolean;
+    /** MCP-style effect annotations, for example `readOnlyHint`. */
+    annotations?: Record<string, boolean | undefined>;
+    /** Description shown in Core's unified tool catalog. */
+    description?: string;
+    /** Force the human approval gate before the tool runs. */
+    needsApproval?: boolean;
+    /** JSON Schema for the structured result. */
+    outputSchema?: Record<string, unknown>;
+}
 /**
  * Convert a {@link ToolRunnable} into a `manifest.json` `kind:"tool"` runnable that
  * ships its `run` body as Core's `inline_deno` backend. The emitted config
@@ -558,8 +610,6 @@ declare function defineTool<TInput extends Record<string, unknown> = Record<stri
  *
  * The plugin must declare the `tool:execute` grant (see `definePlugin`).
  */
-declare function inlineToolRunnable(tool: ToolRunnable, options?: {
-    description?: string;
-}): RunnableMeta;
+declare function inlineToolRunnable(tool: Pick<ToolRunnable, "code" | "description" | "id" | "name" | "schema">, options?: InlineToolManifestOptions): RunnableMeta;
 
-export { type BackgroundClient as B, type DurableClient as D, type EnginesClient as E, type GatewayClient as G, type HttpPrimitiveTransportOptions as H, type ImageClient as I, type JsonSchemaProperty as J, type MemoryClient as M, PRIMITIVE_BINDINGS as P, type RagChunk as R, type SttClient as S, type ToolRunnable as T, type BackgroundProcess as a, type MemoryItem as b, type PrimitiveBinding as c, type PrimitiveTransport as d, type RagClient as e, type RagRerankResult as f, type RealtimeClient as g, type RealtimeSubscription as h, type Runnable as i, type RunnableContext as j, type RyuPrimitives as k, type ToolOptions as l, type ToolSchema as m, type TtsClient as n, createPrimitives as o, defineTool as p, httpPrimitiveTransport as q, inlineToolRunnable as r };
+export { type BackgroundClient as B, type DurableClient as D, type EnginesClient as E, type GatewayClient as G, type HttpPrimitiveTransportOptions as H, type ImageClient as I, type JsonSchemaProperty as J, type MemoryClient as M, PRIMITIVE_BINDINGS as P, type RagChunk as R, type StorageClient as S, type ToolRunnable as T, type BackgroundProcess as a, type InlineToolManifestOptions as b, type MemoryItem as c, type PrimitiveBinding as d, type PrimitiveTransport as e, type RagClient as f, type RagRerankResult as g, type RealtimeClient as h, type RealtimeSubscription as i, type Runnable as j, type RunnableContext as k, type RyuPrimitives as l, type SttClient as m, type ToolOptions as n, type ToolSchema as o, type TtsClient as p, createPrimitives as q, defineTool as r, httpPrimitiveTransport as s, inlineToolRunnable as t };

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@ryuhq/sdk",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "description": "Ryu developer SDK: typed builders and CLI for authoring manifest.json Plugin bundles",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/amajorai/ryu"
+  },
   "main": "./dist/index.cjs",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -26,6 +30,11 @@
       "import": "./dist/agent.js",
       "require": "./dist/agent.cjs"
     },
+    "./action": {
+      "types": "./dist/action.d.ts",
+      "import": "./dist/action.js",
+      "require": "./dist/action.cjs"
+    },
     "./model": {
       "types": "./dist/model.d.ts",
       "import": "./dist/model.js",
@@ -84,11 +93,11 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@ryuhq/sdk-native": "0.2.0",
+    "@ryuhq/sdk-native": "workspace:*",
     "zod": "^4.1.13"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.4",
+    "@types/bun": "catalog:",
     "@types/node": "^22.20.1",
     "json-schema-to-typescript": "^15.0.4",
     "tsup": "^8.5.1",

package/src/agent-plugin.ts

@@ -29,7 +29,7 @@
  * is deliberately NOT a copy of the whole native manifest — that would be a second
  * source of truth with a stale-copy failure mode.
  *
- * Both `plugins-store/*` and `apps-store/*` use this one `PluginManifest` shape, so
+ * Both `plugins-store/{plugins,lsp,external_plugins}/*` and `apps-store/*` use this one `PluginManifest` shape, so
  * one converter covers both stores.
  */
 

package/src/builder.ts

@@ -16,6 +16,7 @@ import type {
 	CompanionSurface,
 	PluginManifest,
 	RunnableMeta,
+	SlashCommandContribution,
 	Surface,
 } from "./manifest.ts";
 import { PluginManifestSchema, RunnableMetaSchema } from "./manifest.ts";
@@ -325,6 +326,7 @@ export class AppBuilder {
 	private readonly _dependencies: AppDependency[] = [];
 	private readonly _requiredCapabilities: CapabilityReq[] = [];
 	private readonly _requiredGrants: string[] = [];
+	private readonly _slashCommands: SlashCommandContribution[] = [];
 	private readonly _targets: Surface[] = [];
 
 	/** Set the reverse-domain app id (e.g. `"com.example.checklist"`). */
@@ -393,6 +395,12 @@ export class AppBuilder {
 		return this;
 	}
 
+	/** Add a slash command and its optional sequential argument choices. */
+	slashCommand(command: SlashCommandContribution): this {
+		this._slashCommands.push(command);
+		return this;
+	}
+
 	/**
 	 * Declare a **plugin-to-plugin dependency** (auto-enabled, in dependency order,
 	 * before this app). `minVersion` is a MINIMUM (`"1.2.0"` = `">=1.2.0"`).
@@ -448,6 +456,7 @@ export class AppBuilder {
 			uiEntry: this._uiEntry,
 			tools: this._tools,
 			grants: this._grants,
+			slashCommands: this._slashCommands,
 			...(this._server ? { server: this._server } : {}),
 			...(this._displayMode ? { displayMode: this._displayMode } : {}),
 			...(this._mime ? { mime: this._mime } : {}),

package/src/cli-security.test.ts

@@ -0,0 +1,109 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { spawnSync } from "node:child_process";
+import {
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	rmSync,
+	symlinkSync,
+	unlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+const REPO_ROOT = join(import.meta.dir, "../../..");
+const CLI = join(import.meta.dir, "cli.ts");
+const temporaryDirectories: string[] = [];
+
+afterEach(() => {
+	for (const directory of temporaryDirectories.splice(0)) {
+		rmSync(directory, { force: true, recursive: true });
+	}
+});
+
+function temporaryPackage(): string {
+	const directory = mkdtempSync(join(tmpdir(), "ryu-sdk-pack-"));
+	temporaryDirectories.push(directory);
+	return directory;
+}
+
+function runPack(directory: string) {
+	return spawnSync(process.execPath, [CLI, "pack", directory], {
+		encoding: "utf8",
+	});
+}
+
+describe.skipIf(process.platform === "win32")(
+	"ryu pack package containment",
+	() => {
+		it("rejects external symlinks for hooks, adapters, and output styles", () => {
+			const scenarios = [
+				{
+					manifest: "plugins-store/plugins/tool-firewall/manifest.json",
+					linkedFile: "hooks/pre.js",
+					copiedFiles: ["hooks/post.js"],
+				},
+				{
+					manifest:
+						"plugins-store/external_plugins/cloudflare-browser-run/manifest.json",
+					linkedFile: "adapters/browser.navigate.js",
+					copiedFiles: [
+						"adapters/browser.screenshot.js",
+						"adapters/browser.snapshot.js",
+					],
+				},
+				{
+					manifest: "plugins-store/plugins/output-styles/manifest.json",
+					linkedFile: "output-styles/i-have-adhd.md",
+					copiedFiles: [
+						"output-styles/bro.md",
+						"output-styles/eli5.md",
+						"output-styles/explanatory.md",
+						"output-styles/gen-z.md",
+						"output-styles/learning.md",
+						"output-styles/no-ai-slop.md",
+						"output-styles/no-hype.md",
+						"output-styles/plain-technical.md",
+						"output-styles/plain-text.md",
+						"output-styles/proactive.md",
+					],
+				},
+			];
+
+			for (const scenario of scenarios) {
+				const directory = temporaryPackage();
+				const sourceRoot = dirname(join(REPO_ROOT, scenario.manifest));
+				writeFileSync(
+					join(directory, "manifest.json"),
+					readFileSync(join(REPO_ROOT, scenario.manifest))
+				);
+				for (const file of scenario.copiedFiles) {
+					mkdirSync(dirname(join(directory, file)), { recursive: true });
+					writeFileSync(
+						join(directory, file),
+						readFileSync(join(sourceRoot, file))
+					);
+				}
+				mkdirSync(dirname(join(directory, scenario.linkedFile)), {
+					recursive: true,
+				});
+				writeFileSync(
+					join(directory, scenario.linkedFile),
+					readFileSync(join(sourceRoot, scenario.linkedFile))
+				);
+				const workingResult = runPack(directory);
+				expect(workingResult.status).toBe(0);
+				unlinkSync(join(directory, scenario.linkedFile));
+
+				const external = join(dirname(directory), `${Date.now()}-outside.txt`);
+				writeFileSync(external, "private host data");
+				symlinkSync(external, join(directory, scenario.linkedFile));
+
+				const result = runPack(directory);
+				expect(result.status).toBe(1);
+				rmSync(external, { force: true });
+			}
+		});
+	}
+);

package/src/cli.ts

@@ -27,10 +27,12 @@ import {
 	existsSync,
 	mkdirSync,
 	readFileSync,
+	realpathSync,
 	rmSync,
 	writeFileSync,
+	writeSync,
 } from "node:fs";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import {
 	AGENT_PLUGIN_MANIFEST_FILE,
 	AGENT_PLUGIN_MCP_FILE,
@@ -70,7 +72,7 @@ function printUsage(): void {
 }
 
 function exitError(message: string): never {
-	process.stderr.write(`error: ${message}\n`);
+	writeSync(process.stderr.fd, `error: ${message}\n`);
 	process.exit(1);
 }
 
@@ -148,6 +150,28 @@ function loadManifest(dir: string): LoadedManifest {
 const CODE_FILE_DIRS = ["hooks", "adapters"];
 const CODE_FILE_PATH = /^(hooks|adapters)\/[A-Za-z0-9_][A-Za-z0-9._-]*\.m?js$/;
 
+function containedPackageFile(dir: string, rel: string, label: string): string {
+	let realRoot: string;
+	let realTarget: string;
+	try {
+		realRoot = realpathSync(dir);
+		realTarget = realpathSync(join(dir, rel));
+	} catch (error) {
+		exitError(`${label}: could not resolve '${rel}': ${String(error)}`);
+	}
+	const fromRoot = relative(realRoot, realTarget);
+	if (
+		fromRoot === ".." ||
+		fromRoot.startsWith(`..${sep}`) ||
+		isAbsolute(fromRoot)
+	) {
+		exitError(
+			`${label}: '${rel}' resolves outside the plugin package (${realTarget})`
+		);
+	}
+	return realTarget;
+}
+
 /**
  * Read one `code_file` and return its contents, or exit with a clear error.
  *
@@ -161,7 +185,7 @@ function readCodeFile(dir: string, rel: string, label: string): string {
 			`${label}: code_file '${rel}' must be exactly '<${CODE_FILE_DIRS.join("|")}>/<name>.js' with no traversal`
 		);
 	}
-	const path = join(dir, rel);
+	const path = containedPackageFile(dir, rel, label);
 	let body: string;
 	try {
 		body = readFileSync(path, "utf8");
@@ -275,7 +299,7 @@ function inlineOutputStyleFiles(
 		}
 		let body: string;
 		try {
-			body = readFileSync(join(dir, rel), "utf8");
+			body = readFileSync(containedPackageFile(dir, rel, label), "utf8");
 		} catch (err) {
 			exitError(`${label}: could not read file '${rel}': ${String(err)}`);
 		}
@@ -324,12 +348,12 @@ function resolveUiEntry(manifest: LoadedManifest): string | null {
 	return null;
 }
 
-// Resolve a companion's `ui_format` discriminator. `"html"` (Path B) means the
-// `ui_entry` file is ALREADY a self-contained HTML document (a
-// vite-plugin-singlefile build for a heavy app like the whiteboard) and must be
-// shipped VERBATIM as `ui_code` — NOT run through `Bun.build`, which would try to
-// bundle an HTML file as an ESM entry and fail. Anything else (absent / `"js"`) is
-// the default: `ui_entry` is an ESM module `Bun.build` bundles into `ui_code`.
+// Resolve a UI entry's format. `"html"` means the `ui_entry` file is ALREADY a
+// self-contained HTML document (a vite-plugin-singlefile build for a heavy
+// companion, or a hand-authored widget) and must be shipped VERBATIM as
+// `ui_code` — NOT run through `Bun.build`, which would try to bundle an HTML
+// file as an ESM entry and fail. Anything else (absent / `"js"`) is the default:
+// `ui_entry` is an ESM module `Bun.build` bundles into `ui_code`.
 function resolveUiFormat(manifest: LoadedManifest): "html" | "js" {
 	for (const runnable of manifest.runnables) {
 		if (runnable.kind !== "companion") {
@@ -341,6 +365,15 @@ function resolveUiFormat(manifest: LoadedManifest): "html" | "js" {
 			return "html";
 		}
 	}
+	for (const widget of manifest.contributes?.widgets ?? []) {
+		const entry = widget.ui_entry;
+		if (
+			typeof entry === "string" &&
+			entry.trim().toLowerCase().endsWith(".html")
+		) {
+			return "html";
+		}
+	}
 	return "js";
 }
 

package/src/contracts-lockstep.test.ts

@@ -9,7 +9,7 @@
  * Schema, and the generated types stay describing the same manifest:
  *
  * 1. a known-good repo manifest (apps-store/mail/manifest.json — the first
- *    fully manifest-driven app) parses with the zod `PluginManifestSchema`;
+ *    fully manifest-driven app) parses without losing any top-level wire field;
  * 2. every key the schema marks required exists in the schema, the generated
  *    TS, and the fixture;
  * 3. every top-level key the fixture uses is a key the wire model knows.
@@ -42,12 +42,26 @@ const schema = JSON.parse(readFileSync(SCHEMA_PATH, "utf8")) as {
 	properties: Record<string, unknown>;
 };
 const generatedSource = readFileSync(GENERATED_PATH, "utf8");
+const CORE_FIELDS_PREVIOUSLY_STRIPPED = [
+	"permission_levels",
+	"sidecars",
+	"stability",
+	"surfaces",
+] as const;
 
 describe("contracts lockstep (zod ↔ blessed JSON Schema ↔ generated TS)", () => {
-	test("the known-good mail manifest.json parses with the zod authoring schema", () => {
+	test("the known-good mail manifest survives the zod pack path without field loss", () => {
 		const parsed = PluginManifestSchema.parse(fixture);
 		expect(parsed.id).toBe("@ryu/mail");
 		expect(parsed.runnables.length).toBeGreaterThan(0);
+		for (const key of Object.keys(fixture)) {
+			expect(Object.hasOwn(parsed, key), key).toBe(true);
+		}
+		for (const key of CORE_FIELDS_PREVIOUSLY_STRIPPED) {
+			expect(schema.properties).toHaveProperty(key);
+			expect(fixture).toHaveProperty(key);
+			expect(parsed[key]).toEqual(fixture[key]);
+		}
 	});
 
 	test("blessed schema describes PluginManifest with the required identity keys", () => {

package/src/exports-lockstep.test.ts

@@ -57,6 +57,7 @@ describe("package exports ↔ tsup entries lockstep", () => {
 		// Each of these is referenced by real consumers (fumadocs cookbooks,
 		// examples/, the desktop host, create-ryu-app) and must never 404.
 		const documented = [
+			"action",
 			"manifest",
 			"agent",
 			"model",

package/src/generated/plugin-manifest.ts

@@ -374,7 +374,7 @@ export interface PluginManifest {
 	permission_levels?: PermissionLevel[];
 	/**
 	 * **Unified, deny-by-default runtime permission set** — the single typed
-	 * grammar (`{fs, child_process, network, tool}`) Core lowers to every sandbox
+	 * grammar (`{fs, child_process, run, network, tool}`) Core lowers to every sandbox
 	 * backend (wasmtime WASI preopens, Docker `--mount`/`--network` flags, Deno
 	 * `--allow-*` flags). Absent = **deny-all** (the default for every manifest
 	 * predating this field), so an app that declares nothing keeps today's exact
@@ -578,7 +578,8 @@ export interface CompanionSurface {
  * and reference no runnable at all (`widgets`, `views`, `dock_panels`,
  * `sidebar_sections`, `sidebar_buttons`, `settings_tabs`, `composer_controls`,
  * `chat_features`, `slash_commands`, `turn_hooks`, `tool_filters`, `lsp_servers`,
- * `message_actions`, `context_menu_items`, `agent_edit_panels`).
+ * `message_actions`, `selection_actions`, `context_menu_items`,
+ * `agent_edit_panels`).
  *
  * # Extending
  *
@@ -961,6 +962,16 @@ export interface Contributes {
 	 * Gateway policies the plugin contributes (referenced by runnable id).
 	 */
 	policies?: ContributionId[];
+	/**
+	 * Buttons the plugin contributes to the floating text-selection toolbar.
+	 * This is the bridge between enabled apps/plugins and shared chat blocks:
+	 * Core validates and tags the declaration, while the desktop owns the
+	 * rendered toolbar and dispatches the selected text. A selection action may
+	 * either name a granted `capability` or provide a host-owned `args.dispatch`
+	 * (for example, a first-party shell action such as Side Chat). Self-contained
+	 * + opaque for the same forward-compatibility reason as `message_actions`.
+	 */
+	selection_actions?: SelectionActionContribution[];
 	/**
 	 * Declarative settings tabs the plugin contributes (model pickers, text
 	 * fields bound to preference keys). Served + rendered the same way.
@@ -1720,6 +1731,49 @@ export interface PiExtensionContribution {
 	 */
 	id: string;
 }
+/**
+ * One button a plugin contributes to the floating text-selection toolbar (see
+ * [`Contributes::selection_actions`]).
+ *
+ * `capability` is optional because a host-owned renderer can use an opaque
+ * `args.dispatch` bridge instead. The desktop never executes manifest code: it
+ * only renders this label and forwards the selected text to the owning host
+ * handler.
+ */
+export interface SelectionActionContribution {
+	/**
+	 * Static renderer/dispatch arguments. The selected text is supplied by the
+	 * host at click time and is never serialized into the manifest.
+	 */
+	args?: {
+		[k: string]: unknown;
+	};
+	/**
+	 * Optional granted capability for a plugin-owned dispatch.
+	 */
+	capability?: string | null;
+	/**
+	 * Optional glyph id resolved by the shell's icon primitive.
+	 */
+	icon?: string | null;
+	/**
+	 * Stable id for this action within the plugin.
+	 */
+	id: string;
+	/**
+	 * Render mode. The current desktop renders `"button"`; this remains open
+	 * so newer shells can add a mode without making older cores reject it.
+	 */
+	kind: string;
+	/**
+	 * Accessible label shown in the selection toolbar.
+	 */
+	label: string;
+	/**
+	 * Sort position among contributed selection actions (ascending).
+	 */
+	order?: number | null;
+}
 /**
  * One **settings tab** a plugin contributes (see [`Contributes::settings_tabs`]).
  *
@@ -1848,6 +1902,13 @@ export interface SettingsFieldContribution {
  * buttons (e.g. Memory) to the owning app.
  */
 export interface SidebarButtonContribution {
+	/**
+	 * Optional mount context passed to the owning Companion when the button opens it.
+	 * The host applies this only to the button's own app surface.
+	 */
+	context?: {
+		[k: string]: unknown;
+	} | null;
 	/**
 	 * Optional glyph id resolved by the shell's Icon primitive.
 	 */
@@ -2477,6 +2538,12 @@ export interface PermissionSet {
 	 * Deno's `--allow-net` supports). See [`NetworkPermission`].
 	 */
 	network?: boolean | string[];
+	/**
+	 * Executable names sandboxed code may spawn when [`Self::child_process`] is
+	 * true. Core lowers this to Deno's scoped `--allow-run=<name,...>` list in
+	 * addition to declared capability shims. Empty grants no arbitrary binary.
+	 */
+	run?: string[];
 	/**
 	 * **Declaration-only** in v1: the registry tool ids this plugin's sandboxed
 	 * code may call through the stdio `tools.*` bridge. Tools are brokered over
@@ -2995,9 +3062,12 @@ export interface ExternalRuntimeConfig {
  */
 export interface AssetSpec {
 	/**
-	 * Destination directory relative to `~/.ryu` (e.g. `"models/hf"`); the
- * fetched file lands at `<runtime>/assets/<dest_under_runtime>/<filename>`. Must
- * be a traversal-safe relative path (no `..`, not absolute).
+	 * Destination directory relative to the runtime's `assets/` directory
+	 * (e.g. `"models/hf"`). The fetched file lands at
+	 * `<runtime>/assets/<dest_under_runtime>/<filename>`. Must be a
+	 * traversal-safe relative path (no `..`, not absolute). The old
+	 * `dest_under_ryu` spelling is accepted as a wire alias but is never
+	 * resolved against the shared Core data directory.
 	 */
 	dest_under_runtime: string;
 	/**
@@ -3229,6 +3299,13 @@ export interface RouteSpec {
 	 * webhook whose external caller cannot hold the node token).
 	 */
 	auth?: "protected" | "public";
+	/**
+	 * Optional HTTP method selector for this path (canonical uppercase such as
+	 * `GET` or `POST`). Absent preserves the legacy behavior and matches every
+	 * method. Declare one row per method when reads and writes share a path but
+	 * require different permission levels.
+	 */
+	method?: string | null;
 	/**
 	 * Path pattern for the sub-path after `/api/ext/<plugin_id>` (must start with
 	 * `/`). Supports `:param` (matches one non-empty segment) and a trailing

package/src/index.ts

@@ -43,6 +43,10 @@ export type {
 	Requires,
 	RunnableKind,
 	RunnableMeta,
+	SlashCommandArgument,
+	SlashCommandContribution,
+	SlashCommandCustomOption,
+	SlashCommandOption,
 	Surface,
 	ToolAppConfig,
 	TurnHookContribution,
@@ -59,6 +63,10 @@ export {
 	RequiresSchema,
 	RunnableKindSchema,
 	RunnableMetaSchema,
+	SlashCommandArgumentSchema,
+	SlashCommandContributionSchema,
+	SlashCommandCustomOptionSchema,
+	SlashCommandOptionSchema,
 	SurfaceSchema,
 	ToolAppConfigSchema,
 	validateManifestStrict,
@@ -107,6 +115,14 @@ export type {
 	ThemeContribution,
 } from "./plugin/ryu-plugin.ts";
 export { toDisposable } from "./plugin/ryu-plugin.ts";
+export type {
+	ActionAnnotations,
+	ActionEffect,
+	ActionManifestOptions,
+	ActionOptions,
+	ActionRunnable,
+} from "./runnable/action.ts";
+export { defineAction } from "./runnable/action.ts";
 export type {
 	AgentCard,
 	AgentManifestOptions,
@@ -140,6 +156,7 @@ export type {
 	RealtimeClient,
 	RealtimeSubscription,
 	RyuPrimitives,
+	StorageClient,
 	SttClient,
 	TtsClient,
 } from "./runnable/primitives.ts";
@@ -156,6 +173,7 @@ export type {
 export type { SkillOptions } from "./runnable/skill.ts";
 export { defineSkill } from "./runnable/skill.ts";
 export type {
+	InlineToolManifestOptions,
 	JsonSchemaProperty,
 	ToolOptions,
 	ToolRunnable,

package/src/manifest.fixtures.test.ts

@@ -17,7 +17,8 @@
  *
  * The set is read from Core's tree so a new shipped plugin is covered the moment it
  * lands, without touching this file. It spans BOTH homes: the packaged manifests
- * live in `apps-store/<x>/manifest.json` and `plugins-store/<x>/manifest.json` (Core
+ * live in `apps-store/<x>/manifest.json` and
+ * `plugins-store/{plugins,lsp,external_plugins}/<x>/manifest.json` (Core
  * `include_str!`s them from there), and only the ~13 Core-only ones remain under
  * `apps/core/src/plugin_manifest/fixtures/`. Reading just the fixtures dir would
  * still pass — on 13 files instead of 71 — so both roots are walked deliberately.
@@ -39,7 +40,12 @@ import {
 const REPO_ROOT = join(import.meta.dir, "../../..");
 const FIXTURES_DIR = join(REPO_ROOT, "apps/core/src/plugin_manifest/fixtures");
 /** The package roots whose `manifest.json` Core compiles in directly. */
-const PACKAGE_ROOTS = ["apps-store", "plugins-store"];
+const PACKAGE_ROOTS = [
+	"apps-store",
+	"plugins-store/plugins",
+	"plugins-store/lsp",
+	"plugins-store/external_plugins",
+];
 
 interface RawManifest {
 	companion?: { label?: unknown };
@@ -419,7 +425,7 @@ describe("PluginManifestSchema preserves turn_hook.match", () => {
 			// `tool-firewall` is a packaged plugin, so its manifest lives in its
 			// package directory — there is no fixture copy any more.
 			readFileSync(
-				join(REPO_ROOT, "plugins-store/tool-firewall/manifest.json"),
+				join(REPO_ROOT, "plugins-store/plugins/tool-firewall/manifest.json"),
 				"utf8"
 			)
 		);