@rzx/ohs 1.2.21 → 1.2.22

package/dist/index.js

@@ -1154,7 +1154,7 @@ var init_runtime_config = __esm(() => {
 // ../../packages/protocol/src/plugin-apps.ts
 function readPluginAppAction(metadata) {
   try {
-    const value = record(copyPluginAppJson(metadata.pluginAppAction, PLUGIN_APP_LIMITS.argsBytes + 32 * 1024));
+    const value = record(copyPluginAppJson(metadata.pluginAppAction, PLUGIN_APP_LIMITS.maxArgsBytes + 32 * 1024));
     if (value.schemaVersion !== 1 || !["not_started", "completed", "unknown"].includes(String(value.executionState)) || !["native-tools", "mcp-server"].includes(String(value.backendKind)))
       return;
     parsePluginAppSource(value.source);
@@ -1176,7 +1176,7 @@ function readPluginAppAction(metadata) {
       "toolUseId"
     ])
       identifier(value[key]);
-    record(copyPluginAppJson(value.args, PLUGIN_APP_LIMITS.argsBytes));
+    record(copyPluginAppJson(value.args, PLUGIN_APP_LIMITS.maxArgsBytes));
     return value;
   } catch {
     return;
@@ -1285,11 +1285,11 @@ function parseClosePluginAppInput(value) {
   return { expectedRevision: revision(input.expectedRevision) };
 }
 function parsePluginAppToolRequest(value) {
-  const input = record(copyPluginAppJson(value, PLUGIN_APP_LIMITS.argsBytes + 16 * 1024));
+  const input = record(copyPluginAppJson(value, PLUGIN_APP_LIMITS.maxArgsBytes + 16 * 1024));
   fields(input, ["requestId", "expectedRevision", "toolName", "args", "source", "lease"]);
   const lease = record(input.lease);
   fields(lease, ["token", "backendGeneration"]);
-  const args = record(copyPluginAppJson(input.args, PLUGIN_APP_LIMITS.argsBytes));
+  const args = record(copyPluginAppJson(input.args, PLUGIN_APP_LIMITS.maxArgsBytes));
   return {
     requestId: identifier(input.requestId),
     expectedRevision: revision(input.expectedRevision),
@@ -1315,6 +1315,7 @@ var init_plugin_apps = __esm(() => {
     resourceBytes: 8 * 1024 * 1024,
     appDataBytes: 256 * 1024,
     argsBytes: 64 * 1024,
+    maxArgsBytes: 64 * 1024 * 1024,
     resultBytes: 1024 * 1024,
     widgetStateBytes: 32 * 1024,
     handoffBytes: 32 * 1024,
@@ -422816,6 +422817,7 @@ var init_schema_v1 = __esm(() => {
     metadata: recordType(stringType(), unknownType()).optional(),
     components: componentsSchema,
     permissions: objectType({
+      pluginData: arrayType(literalType("write")).min(1).max(1).optional(),
       filesystem: permissionListSchema.optional(),
       network: permissionListSchema.optional(),
       process: permissionListSchema.optional(),
@@ -423071,6 +423073,12 @@ async function loadNativeAppMetadata(plugin) {
       const definition = PluginAppManifestSchema.parse(JSON.parse(file.bytes.toString("utf8")));
       const resources = [];
       for (const backend of definition.backends) {
+        for (const policy of backend.toolPolicies ?? []) {
+          if (policy.authorization && !plugin.manifest.permissions?.pluginData?.includes("write"))
+            throw new Error("plugin data write not declared");
+          if (backend.kind === "native-tools" && !backend.tools.some((tool) => tool.tool === policy.tool && tool.visibility.includes("app")))
+            throw new Error("tool policy requires an exact app tool");
+        }
         if (backendIds.has(backend.id) || backendIds.size >= PLUGIN_APP_LIMITS.backendCount)
           throw new Error("duplicate backend");
         backendIds.add(backend.id);
@@ -423126,7 +423134,7 @@ async function loadNativeAppMetadata(plugin) {
     }] };
   }
 }
-var id, uri, nativeBackend, PluginAppManifestSchema;
+var id, uri, toolPolicies, nativeBackend, PluginAppManifestSchema;
 var init_apps = __esm(() => {
   init_zod();
   init_src();
@@ -423142,9 +423150,15 @@ var init_apps = __esm(() => {
       return false;
     }
   }, "resource must be an exact ui:// URI");
+  toolPolicies = arrayType(objectType({
+    tool: stringType().min(1).max(256),
+    authorization: literalType("plugin-data-write").optional(),
+    maxArgumentsBytes: numberType().int().min(1).max(PLUGIN_APP_LIMITS.maxArgsBytes).optional()
+  }).strict()).max(256).refine((items) => new Set(items.map((item) => item.tool)).size === items.length).optional();
   nativeBackend = objectType({
     id,
     kind: literalType("native-tools"),
+    toolPolicies,
     resources: arrayType(objectType({ uri, entry: stringType().min(3).refine((value) => value.startsWith("./")) }).strict()).min(1).max(32),
     tools: arrayType(objectType({
       tool: stringType().min(1).max(256),
@@ -423156,7 +423170,7 @@ var init_apps = __esm(() => {
     schemaVersion: literalType(1),
     backends: arrayType(discriminatedUnionType("kind", [
       nativeBackend,
-      objectType({ id, kind: literalType("mcp-server"), server: stringType().min(1).max(256) }).strict()
+      objectType({ id, kind: literalType("mcp-server"), server: stringType().min(1).max(256), toolPolicies }).strict()
     ])).min(1).max(PLUGIN_APP_LIMITS.backendCount),
     surfaces: arrayType(objectType({
       id,
@@ -426330,6 +426344,7 @@ var init_src14 = __esm(() => {
   init_src();
   init_src();
   init_src();
+  init_src();
 });
 
 // src/runtime-modes.ts
@@ -430182,7 +430197,9 @@ async function authorizeToolCall2({ toolUse, tool }, permissionChecker, hookExec
       executionState: "not_started"
     };
   }
-  if (decision.action === "ask") {
+  const approval = execution?.pluginAppToolApproval;
+  const approvedAppCall = !!approval && approval.runId === execution?.scope.runId && approval.toolUseId === toolUse.id && approval.binding.definition.name === toolUse.name && execution?.capabilityView?.appTools?.get(toolUse.name) === approval.binding && execution?.capabilityView?.tools.get(toolUse.name) === approval.binding && approval.argumentsJson === JSON.stringify(toolUse.input);
+  if (decision.action === "ask" && !approvedAppCall) {
     let allowed = false;
     if (execution) {
       const requestId = `permission_${randomUUID32()}`;
@@ -430198,12 +430215,12 @@ async function authorizeToolCall2({ toolUse, tool }, permissionChecker, hookExec
         type: "permission.requested",
         data: { requestId, request }
       });
-      const approval = await execution.effects.requestPermission(request, execution.scope);
+      const approval2 = await execution.effects.requestPermission(request, execution.scope);
       await execution.emit({
         type: "permission.resolved",
-        data: { requestId, decision: approval }
+        data: { requestId, decision: approval2 }
       });
-      allowed = approval.status === "approved";
+      allowed = approval2.status === "approved";
     }
     signal?.throwIfAborted();
     if (!allowed) {
@@ -430360,11 +430377,11 @@ function parsePluginAppSource2(value) {
   return { sessionId: identifier2(input.sessionId), appId: identifier2(input.appId) };
 }
 function parsePluginAppToolRequest2(value) {
-  const input = record6(copyPluginAppJson2(value, PLUGIN_APP_LIMITS2.argsBytes + 16 * 1024));
+  const input = record6(copyPluginAppJson2(value, PLUGIN_APP_LIMITS2.maxArgsBytes + 16 * 1024));
   fields2(input, ["requestId", "expectedRevision", "toolName", "args", "source", "lease"]);
   const lease = record6(input.lease);
   fields2(lease, ["token", "backendGeneration"]);
-  const args = record6(copyPluginAppJson2(input.args, PLUGIN_APP_LIMITS2.argsBytes));
+  const args = record6(copyPluginAppJson2(input.args, PLUGIN_APP_LIMITS2.maxArgsBytes));
   return {
     requestId: identifier2(input.requestId),
     expectedRevision: revision2(input.expectedRevision),
@@ -441911,6 +441928,66 @@ function readonlyMap(entries) {
   });
   return view;
 }
+function capturedAppToolPolicy(capture, name) {
+  const tool = capture.tools.get(name);
+  if (!tool)
+    throw new Error("plugin_app_tool_unavailable");
+  const declared = capture.definition.toolPolicies?.find((policy) => policy.tool === name);
+  const granted = declared?.authorization === "plugin-data-write" && capture.pluginDataWriteApproved === true && tool.ownerPluginId === capture.pluginId && isToolVisibleTo2(tool.definition, "app") && !isToolVisibleTo2(tool.definition, "model");
+  return Object.freeze({
+    confirmation: granted ? "granted" : "required",
+    maxArgumentsBytes: declared?.maxArgumentsBytes ?? PLUGIN_APP_LIMITS2.argsBytes,
+    ...granted ? { authorization: "plugin-data-write" } : {}
+  });
+}
+function captureAppToolBindings(input, names, serverId, originOnly = false) {
+  const bindings = [];
+  for (const name of names) {
+    const definition = input.toolRegistry.get(name);
+    const source = input.toolRegistry.inspect(name)?.source;
+    const owned = input.definition.kind === "native-tools" ? source?.kind === "plugin" && source.id === input.pluginId : source?.kind === "mcp" && source.id === input.definition.server;
+    if (!definition || !owned || !originOnly && !isToolVisibleTo2(definition, "app"))
+      continue;
+    bindings.push([name, Object.freeze({
+      ownerPluginId: input.pluginId,
+      definition: immutableCopy(definition),
+      source,
+      ...serverId ? { serverId } : {},
+      definitionIdentity: toolDefinitionIdentity2(definition),
+      invoke: definition.execute.bind(definition)
+    })]);
+  }
+  return readonlyMap(bindings);
+}
+function capturedBackend(input, port, tools, originTools = tools) {
+  return Object.freeze({
+    pluginId: input.pluginId,
+    pluginVersion: input.pluginVersion,
+    pluginDigest: input.pluginDigest,
+    pluginDataWriteApproved: input.pluginDataWriteApproved === true,
+    definitionDigest: input.metadata.definitionDigest,
+    definition: input.definition,
+    surfaces: Object.freeze(input.metadata.definition.surfaces.filter((surface) => surface.backend === input.definition.id)),
+    port,
+    tools,
+    originTools,
+    isCurrentTool: (name) => {
+      if (!port.isCurrent())
+        return false;
+      const captured = tools.get(name);
+      const current = captured && input.toolRegistry.get(captured.definition.name);
+      const source = captured && input.toolRegistry.inspect(captured.definition.name)?.source;
+      return !!captured && !!current && current.execute === captured.definition.execute && toolDefinitionIdentity2(current) === captured.definitionIdentity && source?.kind === captured.source?.kind && source?.id === captured.source?.id && isToolVisibleTo2(current, "app");
+    }
+  });
+}
+function immutableCopy(value) {
+  if (Array.isArray(value))
+    return Object.freeze(value.map(immutableCopy));
+  if (value && typeof value === "object")
+    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, item]) => [key, immutableCopy(item)])));
+  return value;
+}
 function identity2(app) {
   return JSON.stringify([
     app.sessionId,
@@ -441930,7 +442007,7 @@ function matches(app, capture) {
   return app.pluginId === capture.pluginId && app.pluginVersion === capture.pluginVersion && app.pluginDigest === capture.pluginDigest && app.definitionDigest === capture.definitionDigest && app.backendId === capture.definition.id && app.backendKind === capture.definition.kind && (capture.surfaces.some((s2) => s2.resourceUri === app.resourceUri) || capture.definition.kind === "native-tools" && capture.definition.resources.some((r2) => r2.uri === app.resourceUri) || [...(capture.originTools ?? capture.tools).values()].some((t2) => t2.definition.ui?.resourceUri === app.resourceUri));
 }
 function sameCapture(a2, b2) {
-  return a2.port.isCurrent() && a2.port.generation === b2.port.generation && a2.tools.size === b2.tools.size && [...a2.tools].every(([name, binding]) => {
+  return a2.port.isCurrent() && a2.port.generation === b2.port.generation && a2.pluginDataWriteApproved === b2.pluginDataWriteApproved && a2.tools.size === b2.tools.size && [...a2.tools].every(([name, binding]) => {
     const next = b2.tools.get(name);
     return !!next && next.definitionIdentity === binding.definitionIdentity && next.definition.execute === binding.definition.execute && next.ownerPluginId === binding.ownerPluginId && next.source?.id === binding.source?.id;
   });
@@ -452268,6 +452345,12 @@ async function loadNativeAppMetadata2(plugin) {
       const definition = PluginAppManifestSchema2.parse(JSON.parse(file.bytes.toString("utf8")));
       const resources = [];
       for (const backend of definition.backends) {
+        for (const policy of backend.toolPolicies ?? []) {
+          if (policy.authorization && !plugin.manifest.permissions?.pluginData?.includes("write"))
+            throw new Error("plugin data write not declared");
+          if (backend.kind === "native-tools" && !backend.tools.some((tool) => tool.tool === policy.tool && tool.visibility.includes("app")))
+            throw new Error("tool policy requires an exact app tool");
+        }
         if (backendIds.has(backend.id) || backendIds.size >= PLUGIN_APP_LIMITS2.backendCount)
           throw new Error("duplicate backend");
         backendIds.add(backend.id);
@@ -456573,53 +456656,6 @@ function toolError(message) {
     isError: true
   };
 }
-function captureAppToolBindings(input, names, serverId, originOnly = false) {
-  const bindings = [];
-  for (const name of names) {
-    const definition = input.toolRegistry.get(name);
-    const source = input.toolRegistry.inspect(name)?.source;
-    const owned = input.definition.kind === "native-tools" ? source?.kind === "plugin" && source.id === input.pluginId : source?.kind === "mcp" && source.id === input.definition.server;
-    if (!definition || !owned || !originOnly && !isToolVisibleTo2(definition, "app"))
-      continue;
-    bindings.push([name, Object.freeze({
-      ownerPluginId: input.pluginId,
-      definition: immutableCopy(definition),
-      source,
-      ...serverId ? { serverId } : {},
-      definitionIdentity: toolDefinitionIdentity2(definition),
-      invoke: definition.execute.bind(definition)
-    })]);
-  }
-  return readonlyMap(bindings);
-}
-function capturedBackend(input, port, tools, originTools = tools) {
-  return Object.freeze({
-    pluginId: input.pluginId,
-    pluginVersion: input.pluginVersion,
-    pluginDigest: input.pluginDigest,
-    definitionDigest: input.metadata.definitionDigest,
-    definition: input.definition,
-    surfaces: Object.freeze(input.metadata.definition.surfaces.filter((surface) => surface.backend === input.definition.id)),
-    port,
-    tools,
-    originTools,
-    isCurrentTool: (name) => {
-      if (!port.isCurrent())
-        return false;
-      const captured = tools.get(name);
-      const current = captured && input.toolRegistry.get(captured.definition.name);
-      const source = captured && input.toolRegistry.inspect(captured.definition.name)?.source;
-      return !!captured && !!current && current.execute === captured.definition.execute && toolDefinitionIdentity2(current) === captured.definitionIdentity && source?.kind === captured.source?.kind && source?.id === captured.source?.id && isToolVisibleTo2(current, "app");
-    }
-  });
-}
-function immutableCopy(value) {
-  if (Array.isArray(value))
-    return Object.freeze(value.map(immutableCopy));
-  if (value && typeof value === "object")
-    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, item]) => [key, immutableCopy(item)])));
-  return value;
-}
 function createNativePluginAppResourceSnapshot() {
   let active = true;
   return Object.freeze({ generation: randomUUID40(), isCurrent: () => active, revoke: () => {
@@ -456718,6 +456754,12 @@ function mcpToolResultToAppResult(original) {
     throw new Error("plugin_app_mcp_result_unavailable");
   return { result: parseMcpCallResultData2(original.mcpResult) };
 }
+function resolvePluginMcpEnvironment(env, input) {
+  return Object.fromEntries(Object.entries(env).map(([key, value]) => [
+    key,
+    value === "${VYKOR_SESSION_ID}" ? createHash222("sha256").update(input.sessionId ?? randomUUID41()).digest("hex") : value === "${VYKOR_WORKSPACE_ROOT}" ? input.cwd : value
+  ]));
+}
 async function installRuntimeIntegrations(options) {
   const { runtime } = options;
   const memory = options.memory;
@@ -456776,10 +456818,7 @@ async function installRuntimeIntegrations(options) {
   const serverOwners = new Map([...inventory.mcpServers].map(([id2, owner]) => [owner.serverName, { id: id2, ...owner }]));
   for (const [name, config2] of Object.entries(mcpServers)) {
     if (serverOwners.has(name) && config2.type === "stdio" && config2.env) {
-      mcpServers[name] = { ...config2, env: Object.fromEntries(Object.entries(config2.env).map(([key, value]) => [
-        key,
-        value === "${VYKOR_SESSION_ID}" ? createHash222("sha256").update(options.sessionId ?? randomUUID41()).digest("hex") : value
-      ])) };
+      mcpServers[name] = { ...config2, env: resolvePluginMcpEnvironment(config2.env, options) };
     }
   }
   const enabledMcpServers = filterEnabledMcpServers(mcpServers);
@@ -457041,6 +457080,7 @@ async function installRuntimeIntegrations(options) {
         pluginDigest,
         metadata,
         definition,
+        pluginDataWriteApproved: plugin.manifest.permissions?.pluginData?.includes("write") === true,
         toolRegistry: getTrustedToolCatalogue(runtime.toolRegistry)
       };
       if (definition.kind === "native-tools") {
@@ -457778,12 +457818,19 @@ var require2, __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __get
         return [...capture.tools].filter(([name]) => capture.isCurrentTool(name)).map(([name, tool]) => ({
           name,
           description: tool.definition.description,
-          inputSchema: structuredClone(tool.definition.inputSchema)
+          inputSchema: structuredClone(tool.definition.inputSchema),
+          policy: capturedAppToolPolicy(capture, name)
         }));
       },
       assertTool: async (app, request) => {
+        return (await this.host.prepareTool(app, request)).name;
+      },
+      prepareTool: async (app, request) => {
         await this.refresh(app);
-        return this.tool(app, request).definition.name;
+        const tool = this.tool(app, request), capture = this.require(app, request.lease);
+        const policy = capturedAppToolPolicy(capture, request.toolName);
+        copyPluginAppJson2(request.args, policy.maxArgumentsBytes);
+        return { name: tool.definition.name, policy };
       }
     });
   }
@@ -457885,7 +457932,7 @@ var require2, __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __get
     return tool;
   }
   async prepare(app, request, view) {
-    await this.refresh(app);
+    const prepared = await this.host.prepareTool(app, request);
     const tool = this.tool(app, request);
     const server = tool.serverId ? view.mcpServers.get(tool.serverId) : undefined;
     if (app.backendKind === "mcp-server" && (!server || server.ownerPluginId !== app.pluginId))
@@ -457900,7 +457947,7 @@ var require2, __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __get
       skills: readonlyMap([]),
       agents: readonlyMap([])
     });
-    return { name: tool.definition.name, capabilityView };
+    return { ...prepared, capabilityView, binding: tool };
   }
 }, GOAL_UPDATE_TOOL_NAME = "GoalUpdate", textSchema, object22 = (properties) => ({
   type: "object",
@@ -458510,9 +458557,14 @@ var require2, __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __get
         }
         await options.onToolEvent?.(event);
       }
-    }, "app");
+    }, "app", prepared.policy.confirmation === "granted" ? {
+      runId: options.scope.runId,
+      toolUseId: toolUse.id,
+      binding: prepared.binding,
+      argumentsJson: JSON.stringify(request.args)
+    } : undefined);
   }
-  async executeIndependentTool(toolUse, options, audience = "model") {
+  async executeIndependentTool(toolUse, options, audience = "model", pluginAppToolApproval) {
     const capabilityView = options.capabilityView;
     const controller = new AbortController;
     const signal = AbortSignal.any([controller.signal, options.scope.signal, ...options.signal ? [options.signal] : []]);
@@ -458543,6 +458595,7 @@ var require2, __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __get
           scope,
           capabilityView,
           effects: this.effects,
+          ...audience === "app" && pluginAppToolApproval ? { pluginAppToolApproval } : {},
           children: this.childManager.createController(scope, capabilityView),
           emit: options.onToolEvent ?? (async () => {}),
           takeSteeredInputs: async () => [],
@@ -466238,7 +466291,7 @@ rm -- "$1"`, WslFileOperations2 = class {
   }
 }, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodFunction2, ZodLazy2, ZodLiteral2, ZodEnum2, ZodNativeEnum2, ZodPromise2, ZodEffects2, ZodOptional2, ZodNullable2, ZodDefault2, ZodCatch2, ZodNaN2, BRAND2, ZodBranded2, ZodPipeline2, ZodReadonly2, late2, ZodFirstPartyTypeKind2, instanceOfType = (cls, params = {
   message: `Input not instance of ${cls.name}`
-}) => custom2((data) => data instanceof cls, params), stringType2, numberType2, nanType2, bigIntType2, booleanType2, dateType2, symbolType2, undefinedType2, nullType2, anyType2, unknownType2, neverType2, voidType2, arrayType2, objectType2, strictObjectType2, unionType2, discriminatedUnionType2, intersectionType2, tupleType2, recordType2, mapType2, setType2, functionType2, lazyType2, literalType2, enumType2, nativeEnumType2, promiseType2, effectsType2, optionalType2, nullableType2, preprocessType2, pipelineType2, ostring = () => stringType2().optional(), onumber = () => numberType2().optional(), oboolean = () => booleanType2().optional(), coerce, NEVER, declaredPathSchema2, toolComponentSchema2, pathListSchema2, componentsSchema2, permissionListSchema2, VykorPluginManifestV1Schema2, NativePluginPathError2, PluginFileReadError2, id2, uri2, nativeBackend2, PluginAppManifestSchema2, NATIVE_PLUGIN_COMPONENT_KINDS2, MANIFEST_RELATIVE_PATH2, eventSet2, typeSet2, PERMISSION_CATEGORIES2, deferredKinds2, _a3, NEVER2, $ZodAsyncError, $ZodEncodeError, globalConfig, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType22 = (data) => {
+}) => custom2((data) => data instanceof cls, params), stringType2, numberType2, nanType2, bigIntType2, booleanType2, dateType2, symbolType2, undefinedType2, nullType2, anyType2, unknownType2, neverType2, voidType2, arrayType2, objectType2, strictObjectType2, unionType2, discriminatedUnionType2, intersectionType2, tupleType2, recordType2, mapType2, setType2, functionType2, lazyType2, literalType2, enumType2, nativeEnumType2, promiseType2, effectsType2, optionalType2, nullableType2, preprocessType2, pipelineType2, ostring = () => stringType2().optional(), onumber = () => numberType2().optional(), oboolean = () => booleanType2().optional(), coerce, NEVER, declaredPathSchema2, toolComponentSchema2, pathListSchema2, componentsSchema2, permissionListSchema2, VykorPluginManifestV1Schema2, NativePluginPathError2, PluginFileReadError2, id2, uri2, toolPolicies2, nativeBackend2, PluginAppManifestSchema2, NATIVE_PLUGIN_COMPONENT_KINDS2, MANIFEST_RELATIVE_PATH2, eventSet2, typeSet2, PERMISSION_CATEGORIES2, deferredKinds2, _a3, NEVER2, $ZodAsyncError, $ZodEncodeError, globalConfig, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType22 = (data) => {
   const t2 = typeof data;
   switch (t2) {
     case "undefined":
@@ -470238,6 +470291,7 @@ Keep the summary concise and focused on information needed for continuing the ta
         resourceBytes: 8 * 1024 * 1024,
         appDataBytes: 256 * 1024,
         argsBytes: 64 * 1024,
+        maxArgsBytes: 64 * 1024 * 1024,
         resultBytes: 1024 * 1024,
         widgetStateBytes: 32 * 1024,
         handoffBytes: 32 * 1024,
@@ -471395,7 +471449,7 @@ ${reminder}`;
               appTools: new Map(appBinding ? [[toolUse.name, appBinding]] : []),
               delegatableTools: undefined
             }
-          } : original;
+          } : { ...original, pluginAppToolApproval: undefined };
           const toolRegistry = runToolRegistry2(this.toolRegistry, [], undefined, execution.capabilityView, options.audience);
           const signal = AbortSignal.any([
             execution.scope.signal,
@@ -507284,6 +507338,9 @@ ${INVARIANT_GUIDANCE2}`;
   });
   init_src22();
   init_src18();
+  init_src18();
+  init_src22();
+  init_src18();
   init_src22();
   init_src22();
   PluginPreparationError = class extends Error {
@@ -518761,6 +518818,7 @@ ${GREP_LIMIT_HINT2}` : "")
     metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
     components: componentsSchema2,
     permissions: external_exports.object({
+      pluginData: external_exports.array(external_exports.literal("write")).min(1).max(1).optional(),
       filesystem: permissionListSchema2.optional(),
       network: permissionListSchema2.optional(),
       process: permissionListSchema2.optional(),
@@ -518800,9 +518858,15 @@ ${GREP_LIMIT_HINT2}` : "")
       return false;
     }
   }, "resource must be an exact ui:// URI");
+  toolPolicies2 = external_exports.array(external_exports.object({
+    tool: external_exports.string().min(1).max(256),
+    authorization: external_exports.literal("plugin-data-write").optional(),
+    maxArgumentsBytes: external_exports.number().int().min(1).max(PLUGIN_APP_LIMITS2.maxArgsBytes).optional()
+  }).strict()).max(256).refine((items) => new Set(items.map((item) => item.tool)).size === items.length).optional();
   nativeBackend2 = external_exports.object({
     id: id2,
     kind: external_exports.literal("native-tools"),
+    toolPolicies: toolPolicies2,
     resources: external_exports.array(external_exports.object({ uri: uri2, entry: external_exports.string().min(3).refine((value) => value.startsWith("./")) }).strict()).min(1).max(32),
     tools: external_exports.array(external_exports.object({
       tool: external_exports.string().min(1).max(256),
@@ -518814,7 +518878,7 @@ ${GREP_LIMIT_HINT2}` : "")
     schemaVersion: external_exports.literal(1),
     backends: external_exports.array(external_exports.discriminatedUnion("kind", [
       nativeBackend2,
-      external_exports.object({ id: id2, kind: external_exports.literal("mcp-server"), server: external_exports.string().min(1).max(256) }).strict()
+      external_exports.object({ id: id2, kind: external_exports.literal("mcp-server"), server: external_exports.string().min(1).max(256), toolPolicies: toolPolicies2 }).strict()
     ])).min(1).max(PLUGIN_APP_LIMITS2.backendCount),
     surfaces: external_exports.array(external_exports.object({
       id: id2,
@@ -523089,7 +523153,6 @@ ${GREP_LIMIT_HINT2}` : "")
   init_src102();
   init_src22();
   init_src18();
-  init_src22();
   init_src18();
   McpConnectionStageError = class extends Error {
     constructor(cause) {
@@ -534297,7 +534360,7 @@ class PluginAppOperationService {
     if (session.status === "closing" || session.status === "archived" || app.status !== "open" || app.controlRevision !== revision || app.activeActionRunId !== ownerRunId)
       throw new ApplicationError(409, "应用状态或确认版本已变化");
     if (bridge.hasWork(source.sessionId) && bridge.activeRunId(source.sessionId) !== ownerRunId || !ownerRunId && this.options.store.runs.listRuns(source.sessionId).some((run) => run.status === "pending" || run.status === "running"))
-      throw new ApplicationError(409, "会话正在处理其他操作");
+      throw new PluginAppBusyError;
     return app;
   }
   async invoke(value) {
@@ -534351,7 +534414,8 @@ class PluginAppOperationService {
             kind: "tool",
             source: request.source,
             requestId: request.requestId,
-            expectedRevision: request.expectedRevision
+            expectedRevision: request.expectedRevision,
+            ...error instanceof PluginAppBusyError ? { reason: "busy" } : {}
           });
         throw error;
       }
@@ -534443,11 +534507,17 @@ class PluginAppOperationService {
     }
   }
 }
+var PluginAppBusyError;
 var init_plugin_app_operation_service = __esm(() => {
   init_dist2();
   init_src();
   init_application_error();
   init_plugin_app_admission_error();
+  PluginAppBusyError = class PluginAppBusyError extends ApplicationError {
+    constructor() {
+      super(409, "会话正在处理其他操作");
+    }
+  };
 });
 
 // ../../packages/server/src/application/session/plugin-app-operation-executor.ts
@@ -667623,7 +667693,7 @@ function createSessionPluginAppsRoutes(runtime, conversation) {
     const input = await readJson(c), from = source(c);
     return jsonResponse({ app: await runtime.mutate(from.sessionId, async () => runtime.apps.close(from, input)) });
   }).post("/:sessionId/plugin-apps/:appId/actions", async (c) => {
-    const response = await runtime.actions.invoke(fixed(c, parsePluginAppToolRequest(await readJson(c))));
+    const response = await runtime.actions.invoke(fixed(c, parsePluginAppToolRequest(await readJson(c, undefined, PLUGIN_APP_LIMITS.maxArgsBytes + 16 * 1024))));
     return jsonResponse(response, ["pending", "running"].includes(response.receipt.status) ? 202 : 200);
   }).get("/:sessionId/plugin-apps/:appId/actions/:requestId", (c) => jsonResponse(runtime.actions.read(source(c), c.req.param("requestId")))).post("/:sessionId/plugin-apps/:appId/actions/:requestId/cancel", async (c) => {
     const from = source(c);
@@ -672419,4 +672489,4 @@ program.command("doctor").description("Check environment and dependencies").acti
 });
 program.parse();
 
-//# debugId=B112561400A5182A64756E2164756E21
+//# debugId=4E50131CAB954F1F64756E2164756E21