@trops/dash-core 0.1.505 → 0.1.507

package/dist/electron/index.js

@@ -3,7 +3,7 @@
 var require$$0$1 = require('electron');
 var require$$1$1 = require('path');
 var require$$0$2 = require('fs');
-var require$$8$1 = require('objects-to-csv');
+var require$$9$1 = require('objects-to-csv');
 var require$$1$2 = require('readline');
 var require$$2 = require('xtreamer');
 var require$$3$1 = require('xml2js');
@@ -11,7 +11,7 @@ var require$$4 = require('JSONStream');
 var require$$5 = require('stream');
 var require$$6 = require('csv-parser');
 var require$$0$3 = require('quickjs-emscripten');
-var require$$10 = require('https');
+var require$$11 = require('https');
 var require$$0$5 = require('@modelcontextprotocol/sdk/client/index.js');
 var require$$1$3 = require('@modelcontextprotocol/sdk/client/stdio.js');
 var require$$0$4 = require('pkce-challenge');
@@ -25,16 +25,15 @@ var require$$1$4 = require('croner');
 var require$$2$3 = require('algoliasearch');
 var require$$3$3 = require('node:path');
 var require$$0$7 = require('openai');
-require('live-plugin-manager');
 var require$$0$a = require('@anthropic-ai/sdk');
 var require$$3$4 = require('crypto');
-var require$$8$2 = require('zod');
+var require$$8$1 = require('zod');
 var require$$0$8 = require('http');
 var require$$1$5 = require('http2');
 var require$$2$4 = require('node-forge');
 var require$$0$9 = require('css');
 var require$$1$6 = require('node-vibrant/node');
-var require$$0$b = require('ws');
+var require$$3$5 = require('ws');
 
 var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
 
@@ -1643,7 +1642,7 @@ var themeController_1 = themeController$5;
  */
 
 const path$j = require$$1$1;
-const fs$e = require$$0$2;
+const fs$f = require$$0$2;
 const { app: app$c } = require$$0$1;
 
 const APP_NAME = "Dashboard";
@@ -1692,8 +1691,8 @@ function readDataDirectoryFromSettings() {
       APP_NAME,
       "settings.json",
     );
-    if (!fs$e.existsSync(settingsPath)) return undefined;
-    const raw = fs$e.readFileSync(settingsPath, "utf8");
+    if (!fs$f.existsSync(settingsPath)) return undefined;
+    const raw = fs$f.readFileSync(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     const dir = settings && settings.dataDirectory;
     if (typeof dir === "string" && dir) return dir;
@@ -1726,10 +1725,10 @@ function safePath$3(requested, allowedRoots) {
   // parent chain can't trick us.
   let real = resolved;
   try {
-    real = fs$e.realpathSync(resolved);
+    real = fs$f.realpathSync(resolved);
   } catch (_e) {
     try {
-      const parent = fs$e.realpathSync(path$j.dirname(resolved));
+      const parent = fs$f.realpathSync(path$j.dirname(resolved));
       real = path$j.join(parent, path$j.basename(resolved));
     } catch (_e2) {
       // Parent doesn't exist either. Use the resolved-but-not-
@@ -1742,7 +1741,7 @@ function safePath$3(requested, allowedRoots) {
   for (const root of allowedRoots) {
     let realRoot = root;
     try {
-      if (fs$e.existsSync(root)) realRoot = fs$e.realpathSync(root);
+      if (fs$f.existsSync(root)) realRoot = fs$f.realpathSync(root);
     } catch (_e) {
       // root doesn't exist or isn't reachable — keep as-is for
       // the comparison below
@@ -1810,7 +1809,7 @@ var safePath_1 = {
  *   clearCache() → void   // test-only
  */
 
-const fs$d = require$$0$2;
+const fs$e = require$$0$2;
 const path$i = require$$1$1;
 const { app: app$b } = require$$0$1;
 
@@ -1826,9 +1825,9 @@ function grantsFilePath() {
 
 function loadFromDisk() {
   const p = grantsFilePath();
-  if (!fs$d.existsSync(p)) return {};
+  if (!fs$e.existsSync(p)) return {};
   try {
-    const raw = fs$d.readFileSync(p, "utf8");
+    const raw = fs$e.readFileSync(p, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return {};
     return parsed;
@@ -1848,9 +1847,9 @@ function writeToDisk(data) {
   const tmp = p + ".tmp";
   // Ensure parent dir exists (userData should already, but be defensive
   // for first-launch / freshly-cleared profile cases).
-  fs$d.mkdirSync(path$i.dirname(p), { recursive: true });
-  fs$d.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf8");
-  fs$d.renameSync(tmp, p);
+  fs$e.mkdirSync(path$i.dirname(p), { recursive: true });
+  fs$e.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf8");
+  fs$e.renameSync(tmp, p);
 }
 
 // Recognized origins for a persisted grant.
@@ -1935,6 +1934,12 @@ function sanitizePerms(perms) {
             ? raw.writePaths.filter((p) => typeof p === "string")
             : [],
         };
+      } else if (name === "network") {
+        domains.network = {
+          hosts: Array.isArray(raw.hosts)
+            ? raw.hosts.filter((h) => typeof h === "string")
+            : [],
+        };
       }
       // Future domains plug in here. Unknown domain names are dropped.
     }
@@ -1952,13 +1957,13 @@ function sanitizePerms(perms) {
   return out;
 }
 
-function getGrant$3(widgetId) {
+function getGrant$4(widgetId) {
   if (typeof widgetId !== "string" || !widgetId) return null;
   const all = ensureCache();
   return all[widgetId] || null;
 }
 
-function setGrant$3(widgetId, perms) {
+function setGrant$4(widgetId, perms) {
   if (typeof widgetId !== "string" || !widgetId) return false;
   const sanitized = sanitizePerms(perms);
   if (!sanitized) return false;
@@ -2039,8 +2044,8 @@ function clearCache$1() {
 }
 
 var grantedPermissions = {
-  getGrant: getGrant$3,
-  setGrant: setGrant$3,
+  getGrant: getGrant$4,
+  setGrant: setGrant$4,
   revokeGrant: revokeGrant$1,
   revokeServer: revokeServer$1,
   listAllGrants: listAllGrants$1,
@@ -2159,7 +2164,7 @@ function validateRequest(req) {
  *
  * `scope` informs the caller how to write the resulting grant.
  */
-function requestApproval$2(req, opts = {}) {
+function requestApproval$3(req, opts = {}) {
   const validation = validateRequest(req);
   if (validation) {
     return Promise.reject(new Error(validation));
@@ -2251,7 +2256,7 @@ function setupJitConsentHandlers() {
 }
 
 var jitConsent$1 = {
-  requestApproval: requestApproval$2,
+  requestApproval: requestApproval$3,
   setupJitConsentHandlers,
   _handleResponse,
   _resetForTest,
@@ -2295,8 +2300,8 @@ var jitConsent$1 = {
  * read-only entry) stay synchronous.
  */
 
-const { getGrant: getGrant$2, setGrant: setGrant$2 } = grantedPermissions;
-const { requestApproval: requestApproval$1 } = jitConsent$1;
+const { getGrant: getGrant$3, setGrant: setGrant$3 } = grantedPermissions;
+const { requestApproval: requestApproval$2 } = jitConsent$1;
 
 // Action names treated as writes. Anything not in this set is a read.
 // Conservative — when in doubt, classify as a read so write-protected
@@ -2315,7 +2320,7 @@ function isFsWriteAction(action) {
   return WRITE_ACTIONS.has(action);
 }
 
-function _isNoGrantDenial$1(reason) {
+function _isNoGrantDenial$2(reason) {
   return (
     typeof reason === "string" && /no fs permissions granted/i.test(reason)
   );
@@ -2352,7 +2357,7 @@ function gateFsCall$1({ widgetId, action, args }) {
     };
   }
 
-  const grant = getGrant$2(widgetId);
+  const grant = getGrant$3(widgetId);
   const fsPerms = grant && grant.domains && grant.domains.fs;
   if (!fsPerms) {
     return {
@@ -2453,11 +2458,11 @@ async function gateFsCallWithJit$1(req, opts = {}) {
   const initial = gateFsCall$1(req);
   if (initial.allow) return initial;
   if (!opts.enableJit) return initial;
-  if (!_isNoGrantDenial$1(initial.reason)) return initial;
+  if (!_isNoGrantDenial$2(initial.reason)) return initial;
 
   let decision;
   try {
-    decision = await requestApproval$1(
+    decision = await requestApproval$2(
       {
         widgetId: req.widgetId,
         domain: "fs",
@@ -2506,9 +2511,9 @@ async function gateFsCallWithJit$1(req, opts = {}) {
   addition.grantOrigin = "live";
 
   try {
-    const current = getGrant$2(req.widgetId);
+    const current = getGrant$3(req.widgetId);
     const merged = _mergeFsGrant(current, addition);
-    setGrant$2(req.widgetId, merged);
+    setGrant$3(req.widgetId, merged);
   } catch (e) {
     return {
       allow: false,
@@ -2528,6 +2533,232 @@ var fsGate = {
   WRITE_ACTIONS,
 };
 
+/**
+ * networkGate.js
+ *
+ * Per-widget gate for outbound-network IPC actions (Phase 3 of JIT
+ * consent). Same shape as `fsGate.js` but for hostname-based scoping.
+ *
+ * Channels currently gated by this:
+ *   - readDataFromURL (dataController)  — fetch a URL into a file
+ *   - wsConnect       (webSocketController) — open a WebSocket
+ *
+ * Channels NOT gated:
+ *   - WS_SEND/DISCONNECT/STATUS/GET_ALL — operate on already-authorized
+ *     connections, intentionally shared across widgets via the
+ *     `consumers: Set<webContentsId>` design.
+ *   - THEME_EXTRACT_FROM_URL — admin-only callers (Settings panels);
+ *     no widget caller exists in the codebase.
+ *
+ * Grant shape (under `grant.domains.network`):
+ *   {
+ *     hosts: ["api.example.com", "*", ...]
+ *   }
+ *
+ * Hostname matching:
+ *   - Exact match (case-insensitive)
+ *   - "*" wildcard in the grant matches any host (escape hatch;
+ *     surfaced in the JIT modal as "no host scope — risky")
+ *   - Subdomain wildcards ("*.example.com") are NOT supported in this
+ *     slice — deferred to a follow-up.
+ *
+ * URL parsing uses the WHATWG URL constructor. Malformed URLs deny
+ * synchronously and do NOT escalate to JIT (a JIT prompt would let a
+ * widget probe URL parser quirks, which we'd rather not).
+ *
+ * JIT escalation: when the runtime calls `gateNetworkCallWithJit` and
+ * the gate denies for "no network permissions granted", a
+ * permission-required IPC fires and the user's response is merged
+ * into the persisted grant. Other denial reasons (host not in
+ * allowlist, malformed url, missing url) stay synchronous.
+ */
+
+const { getGrant: getGrant$2, setGrant: setGrant$2 } = grantedPermissions;
+const { requestApproval: requestApproval$1 } = jitConsent$1;
+
+function _isNoGrantDenial$1(reason) {
+  return (
+    typeof reason === "string" && /no network permissions granted/i.test(reason)
+  );
+}
+
+function _hostMatches(host, allowedList) {
+  if (!Array.isArray(allowedList) || allowedList.length === 0) return false;
+  if (allowedList.includes("*")) return true;
+  const lower = host.toLowerCase();
+  return allowedList.some(
+    (h) => typeof h === "string" && h.toLowerCase() === lower,
+  );
+}
+
+function _parseHost(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Synchronous gate evaluation.
+ * @returns {{ allow: true } | { allow: false, reason: string }}
+ */
+function gateNetworkCall$2({ widgetId, action, args }) {
+  if (!widgetId) {
+    return {
+      allow: false,
+      reason: "no widgetId supplied; cannot determine network permissions",
+    };
+  }
+
+  const url = args && typeof args === "object" ? args.url : null;
+  if (typeof url !== "string" || !url) {
+    return {
+      allow: false,
+      reason:
+        "network gate: action '" +
+        action +
+        "' requires args.url (got: " +
+        JSON.stringify(url) +
+        ")",
+    };
+  }
+
+  const host = _parseHost(url);
+  if (!host) {
+    return {
+      allow: false,
+      reason: "network gate: malformed url '" + url + "'",
+    };
+  }
+
+  const grant = getGrant$2(widgetId);
+  const netPerms = grant && grant.domains && grant.domains.network;
+  if (!netPerms) {
+    return {
+      allow: false,
+      reason:
+        "widget '" +
+        widgetId +
+        "' has no network permissions granted; user must approve at runtime or in Settings → Privacy & Security",
+    };
+  }
+
+  if (_hostMatches(host, netPerms.hosts)) {
+    return { allow: true };
+  }
+  return {
+    allow: false,
+    reason:
+      "network gate: host '" +
+      host +
+      "' rejected — not in allowed hosts for widget '" +
+      widgetId +
+      "'",
+  };
+}
+
+/**
+ * Merge an approved JIT decision's grant into the widget's existing
+ * grant under domains.network. Mirrors fsGate._mergeFsGrant.
+ */
+function _mergeNetworkGrant(current, addition) {
+  const out = {
+    grantOrigin: addition.grantOrigin || current?.grantOrigin || null,
+    servers: { ...(current?.servers || {}) },
+    domains: { ...(current?.domains || {}) },
+  };
+  const additionNet = addition?.domains?.network;
+  if (additionNet) {
+    const existingNet = out.domains.network || { hosts: [] };
+    out.domains.network = {
+      hosts: [
+        ...new Set([
+          ...(existingNet.hosts || []),
+          ...(Array.isArray(additionNet.hosts) ? additionNet.hosts : []),
+        ]),
+      ],
+    };
+  }
+  return out;
+}
+
+/**
+ * Async gate that escalates "no network grant" denials to a JIT
+ * consent prompt when `opts.enableJit` is true. On approval, merges
+ * the decision's grant blob into the persisted grant and re-evaluates.
+ */
+async function gateNetworkCallWithJit$2(req, opts = {}) {
+  const initial = gateNetworkCall$2(req);
+  if (initial.allow) return initial;
+  if (!opts.enableJit) return initial;
+  if (!_isNoGrantDenial$1(initial.reason)) return initial;
+
+  let decision;
+  try {
+    decision = await requestApproval$1(
+      {
+        widgetId: req.widgetId,
+        domain: "network",
+        action: req.action,
+        args: req.args || {},
+      },
+      { timeoutMs: opts.timeoutMs },
+    );
+  } catch (e) {
+    return {
+      allow: false,
+      reason:
+        "JIT consent " +
+        (e && e.message ? e.message : "failed") +
+        "; original denial: " +
+        initial.reason,
+    };
+  }
+
+  if (!decision || decision.approve !== true) {
+    return {
+      allow: false,
+      reason:
+        "user declined JIT consent for widget '" +
+        req.widgetId +
+        "' calling network '" +
+        req.action +
+        "'",
+    };
+  }
+
+  const host = _parseHost(req.args?.url) || "*";
+  const addition =
+    decision.granted && typeof decision.granted === "object"
+      ? decision.granted
+      : {
+          grantOrigin: "live",
+          domains: { network: { hosts: [host] } },
+        };
+  addition.grantOrigin = "live";
+
+  try {
+    const current = getGrant$2(req.widgetId);
+    const merged = _mergeNetworkGrant(current, addition);
+    setGrant$2(req.widgetId, merged);
+  } catch (e) {
+    return {
+      allow: false,
+      reason:
+        "JIT consent: failed to persist network grant: " +
+        (e && e.message ? e.message : String(e)),
+    };
+  }
+
+  return gateNetworkCall$2(req);
+}
+
+var networkGate = {
+  gateNetworkCall: gateNetworkCall$2,
+  gateNetworkCallWithJit: gateNetworkCallWithJit$2,
+};
+
 /**
  * securityFlags.js
  *
@@ -2549,15 +2780,15 @@ var fsGate = {
  * settings.json IO.
  */
 
-function readEnforceFlag$2(settings) {
+function readEnforceFlag$3(settings) {
   return settings?.security?.enforceWidgetMcpPermissions !== false;
 }
 
-function readJitFlag$2(settings) {
+function readJitFlag$3(settings) {
   return settings?.security?.enableJitConsent !== false;
 }
 
-var securityFlags = { readEnforceFlag: readEnforceFlag$2, readJitFlag: readJitFlag$2 };
+var securityFlags = { readEnforceFlag: readEnforceFlag$3, readJitFlag: readJitFlag$3 };
 
 /**
  * safeJsExecutor.js
@@ -3259,27 +3490,31 @@ function requireTransform () {
 }
 
 const { app: app$a } = require$$0$1;
-var fs$c = require$$0$2;
+var fs$d = require$$0$2;
 const path$h = require$$1$1;
 const events$5 = events$8;
 const { getFileContents: getFileContents$5, writeToFile: writeToFile$2 } = file;
 const { safePath: safePath$2, getAllowedRoots: getAllowedRoots$1 } = safePath_1;
 const { gateFsCall, gateFsCallWithJit } = fsGate;
-const { readEnforceFlag: readEnforceFlag$1, readJitFlag: readJitFlag$1 } = securityFlags;
+const {
+  gateNetworkCall: gateNetworkCall$1,
+  gateNetworkCallWithJit: gateNetworkCallWithJit$1,
+} = networkGate;
+const { readEnforceFlag: readEnforceFlag$2, readJitFlag: readJitFlag$2 } = securityFlags;
 
 // Reads the enforcement + JIT flags from settings.json. Mirrors the
 // helper in mcpController. The flag is shared across MCP and fs domains
 // — see Phase 2 plan for rationale (the cosmetic rename to a
 // domain-neutral name is a separate slice).
-function _loadFlags() {
+function _loadFlags$1() {
   try {
     const settingsPath = path$h.join(
       app$a.getPath("userData"),
       appName$5,
       "settings.json",
     );
-    if (!fs$c.existsSync(settingsPath)) return null;
-    return JSON.parse(fs$c.readFileSync(settingsPath, "utf8"));
+    if (!fs$d.existsSync(settingsPath)) return null;
+    return JSON.parse(fs$d.readFileSync(settingsPath, "utf8"));
   } catch (_e) {
     return null;
   }
@@ -3293,10 +3528,10 @@ function _loadFlags() {
  * @returns {Promise<boolean>}
  */
 async function _runFsGate(win, action, widgetId, args, errorEvent) {
-  const settings = _loadFlags();
-  if (!readEnforceFlag$1(settings)) return true; // gate disabled
+  const settings = _loadFlags$1();
+  if (!readEnforceFlag$2(settings)) return true; // gate disabled
   if (!widgetId) return true; // legacy callers without widgetId — see plan
-  const gate = readJitFlag$1(settings)
+  const gate = readJitFlag$2(settings)
     ? await gateFsCallWithJit({ widgetId, action, args }, { enableJit: true })
     : gateFsCall({ widgetId, action, args });
   if (gate.allow) return true;
@@ -3309,10 +3544,34 @@ async function _runFsGate(win, action, widgetId, args, errorEvent) {
   return false;
 }
 
+/**
+ * Phase 3 network gate. Same shape as _runFsGate but for outbound
+ * URLs. Mirrors fs's "disabled / no widgetId / sync vs async" branching.
+ */
+async function _runNetworkGate$1(win, action, widgetId, args, errorEvent) {
+  const settings = _loadFlags$1();
+  if (!readEnforceFlag$2(settings)) return true;
+  if (!widgetId) return true;
+  const gate = readJitFlag$2(settings)
+    ? await gateNetworkCallWithJit$1(
+        { widgetId, action, args },
+        { enableJit: true },
+      )
+    : gateNetworkCall$1({ widgetId, action, args });
+  if (gate.allow) return true;
+  if (win && errorEvent) {
+    win.webContents.send(errorEvent, {
+      success: false,
+      message: "network permission gate: " + gate.reason,
+    });
+  }
+  return false;
+}
+
 // Convert Json to Csv
-const ObjectsToCsv = require$$8$1;
+const ObjectsToCsv = require$$9$1;
 const Transform = requireTransform();
-const https$3 = require$$10;
+const https$3 = require$$11;
 const appName$5 = "Dashboard";
 
 const dataController$1 = {
@@ -3468,7 +3727,18 @@ const dataController$1 = {
     }
   },
 
-  readDataFromURL: (win, url, toFilepath) => {
+  readDataFromURL: async (win, url, toFilepath, widgetId = null) => {
+    // Phase 3 network gate. Runs before HTTPS-protocol + safePath
+    // checks so JIT can prompt the user without leaking URL parser
+    // edge cases through error timing.
+    const gateOk = await _runNetworkGate$1(
+      win,
+      "readDataFromURL",
+      widgetId,
+      { url },
+      events$5.READ_DATA_URL_ERROR,
+    );
+    if (!gateOk) return;
     try {
       // Validate URL is https protocol only
       let parsedUrl;
@@ -3488,7 +3758,7 @@ const dataController$1 = {
       // intent, plus realpath/symlink protection.
       const resolvedFilepath = safePath$2(toFilepath, getAllowedRoots$1("data"));
 
-      const writeStream = fs$c.createWriteStream(resolvedFilepath);
+      const writeStream = fs$d.createWriteStream(resolvedFilepath);
 
       https$3
         .get(url, (resp) => {
@@ -3855,7 +4125,7 @@ var dataController_1 = dataController$1;
 
 const { app: app$9 } = require$$0$1;
 const path$g = require$$1$1;
-const fs$b = require$$0$2;
+const fs$c = require$$0$2;
 const { getFileContents: getFileContents$4, writeToFile: writeToFile$1 } = file;
 
 const configFilename$3 = "settings.json";
@@ -3863,15 +4133,15 @@ const appName$4 = "Dashboard";
 
 // Helper function to recursively copy directory
 function copyDirectory(source, destination) {
-  if (!fs$b.existsSync(destination)) {
-    fs$b.mkdirSync(destination, { recursive: true });
+  if (!fs$c.existsSync(destination)) {
+    fs$c.mkdirSync(destination, { recursive: true });
   }
 
-  const files = fs$b.readdirSync(source);
+  const files = fs$c.readdirSync(source);
   for (const file of files) {
     const srcPath = path$g.join(source, file);
     const destPath = path$g.join(destination, file);
-    const stat = fs$b.lstatSync(srcPath);
+    const stat = fs$c.lstatSync(srcPath);
 
     // Skip symlinks to prevent following links to sensitive files
     if (stat.isSymbolicLink()) {
@@ -3882,7 +4152,7 @@ function copyDirectory(source, destination) {
     if (stat.isDirectory()) {
       copyDirectory(srcPath, destPath);
     } else {
-      fs$b.copyFileSync(srcPath, destPath);
+      fs$c.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -4000,11 +4270,11 @@ const settingsController$4 = {
   setDataDirectory: (win, newPath) => {
     try {
       // Validate the path exists and is a directory
-      if (!fs$b.existsSync(newPath)) {
-        fs$b.mkdirSync(newPath, { recursive: true });
+      if (!fs$c.existsSync(newPath)) {
+        fs$c.mkdirSync(newPath, { recursive: true });
       }
 
-      const stats = fs$b.statSync(newPath);
+      const stats = fs$c.statSync(newPath);
       if (!stats.isDirectory()) {
         throw new Error("Path is not a directory");
       }
@@ -4081,12 +4351,12 @@ const settingsController$4 = {
       }
 
       // Validate paths
-      if (!fs$b.existsSync(resolvedOldPath)) {
+      if (!fs$c.existsSync(resolvedOldPath)) {
         throw new Error("Source directory does not exist");
       }
 
-      if (!fs$b.existsSync(resolvedNewPath)) {
-        fs$b.mkdirSync(resolvedNewPath, { recursive: true });
+      if (!fs$c.existsSync(resolvedNewPath)) {
+        fs$c.mkdirSync(resolvedNewPath, { recursive: true });
       }
 
       // Copy files
@@ -22440,13 +22710,13 @@ const {
   StreamableHTTPClientTransport,
 } = streamableHttp$1;
 const path$e = require$$1$1;
-const fs$a = require$$0$2;
+const fs$b = require$$0$2;
 const os$2 = require$$2$1;
 const responseCache$2 = responseCache_1;
 const { gateToolCall, gateToolCallWithJit } = permissionGate;
 const { serverKey, parseServerKey } = mcpServerKey;
 const { applyPathScopeToCredentials } = mcpScopeResolver;
-const { readEnforceFlag, readJitFlag } = securityFlags;
+const { readEnforceFlag: readEnforceFlag$1, readJitFlag: readJitFlag$1 } = securityFlags;
 const { app: app$7 } = require$$0$1;
 
 /**
@@ -22461,8 +22731,8 @@ function loadSettingsForFlags() {
       "Dashboard",
       "settings.json",
     );
-    if (!fs$a.existsSync(settingsPath)) return null;
-    const raw = fs$a.readFileSync(settingsPath, "utf8");
+    if (!fs$b.existsSync(settingsPath)) return null;
+    const raw = fs$b.readFileSync(settingsPath, "utf8");
     return JSON.parse(raw);
   } catch (_e) {
     return null;
@@ -22475,13 +22745,13 @@ function loadSettingsForFlags() {
 // confirm-on-disable dialog. See electron/utils/securityFlags.js for
 // the pinned default semantics.
 function isWidgetPermissionEnforcementEnabled() {
-  return readEnforceFlag(loadSettingsForFlags());
+  return readEnforceFlag$1(loadSettingsForFlags());
 }
 
 // JIT consent flag. **Default ON.** Same semantics as the enforcement
 // flag — explicit false to opt out, otherwise on.
 function isJitConsentEnabled() {
-  return readJitFlag(loadSettingsForFlags());
+  return readJitFlag$1(loadSettingsForFlags());
 }
 
 /**
@@ -22629,7 +22899,7 @@ function getShellPath$1() {
     fallbackDirs.push(`${home}/.nodenv/shims`);
     try {
       const nvmDir = `${home}/.nvm/versions/node`;
-      const versions = fs$a.readdirSync(nvmDir).sort();
+      const versions = fs$b.readdirSync(nvmDir).sort();
       if (versions.length > 0) {
         // Find the highest compatible version (v18/v20/v22)
         for (let i = versions.length - 1; i >= 0; i--) {
@@ -22765,15 +23035,15 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
   const credPath = tokenRefresh.credentialsPath.replace(/^~/, home);
   const keysPath = tokenRefresh.oauthKeysPath.replace(/^~/, home);
 
-  if (!fs$a.existsSync(credPath) || !fs$a.existsSync(keysPath)) {
+  if (!fs$b.existsSync(credPath) || !fs$b.existsSync(keysPath)) {
     console.log(
       "[mcpController] Token refresh skipped: credential files not found",
     );
     return;
   }
 
-  const credentials = JSON.parse(fs$a.readFileSync(credPath, "utf8"));
-  const keysFile = JSON.parse(fs$a.readFileSync(keysPath, "utf8"));
+  const credentials = JSON.parse(fs$b.readFileSync(credPath, "utf8"));
+  const keysFile = JSON.parse(fs$b.readFileSync(keysPath, "utf8"));
   const keyData = keysFile.installed || keysFile.web;
 
   if (
@@ -22798,7 +23068,7 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
 
   console.log("[mcpController] Refreshing Google OAuth token...");
 
-  const https = require$$10;
+  const https = require$$11;
   const postData = [
     `client_id=${encodeURIComponent(keyData.client_id)}`,
     `client_secret=${encodeURIComponent(keyData.client_secret)}`,
@@ -22842,7 +23112,7 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
     credentials.refresh_token = body.refresh_token;
   }
 
-  fs$a.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
+  fs$b.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
   console.log("[mcpController] Google OAuth token refreshed successfully");
 }
 
@@ -23487,13 +23757,13 @@ const mcpController$3 = {
         "mcpServerCatalog.json",
       );
 
-      if (!fs$a.existsSync(catalogPath)) {
+      if (!fs$b.existsSync(catalogPath)) {
         return {
           catalog: [],
         };
       }
 
-      const catalogData = fs$a.readFileSync(catalogPath, "utf8");
+      const catalogData = fs$b.readFileSync(catalogPath, "utf8");
       const catalog = JSON.parse(catalogData);
 
       return {
@@ -23528,11 +23798,11 @@ const mcpController$3 = {
         "knownExternalMcpServers.json",
       );
 
-      if (!fs$a.existsSync(catalogPath)) {
+      if (!fs$b.existsSync(catalogPath)) {
         return { success: true, servers: [] };
       }
 
-      const catalogData = fs$a.readFileSync(catalogPath, "utf8");
+      const catalogData = fs$b.readFileSync(catalogPath, "utf8");
       const catalog = JSON.parse(catalogData);
 
       return {
@@ -23597,8 +23867,8 @@ const mcpController$3 = {
         const destPath = to.replace(/^~/, os$2.homedir());
         const destDir = require$$1$1.dirname(destPath);
         try {
-          fs$a.mkdirSync(destDir, { recursive: true });
-          fs$a.copyFileSync(sourcePath, destPath);
+          fs$b.mkdirSync(destDir, { recursive: true });
+          fs$b.copyFileSync(sourcePath, destPath);
         } catch (err) {
           return {
             error: true,
@@ -24182,7 +24452,7 @@ function commonjsRequire(path) {
  * Runs in the Electron main process at widget install time.
  */
 
-const fs$9 = require$$0$2;
+const fs$a = require$$0$2;
 const path$d = require$$1$1;
 
 /**
@@ -24236,7 +24506,7 @@ function getEsbuildDiagnostics() {
         ? path$d.join(archDir, "esbuild.exe")
         : path$d.join(archDir, "bin", "esbuild");
     diagnostics.nativeBinaryPath = candidate;
-    diagnostics.nativeBinaryExists = fs$9.existsSync(candidate);
+    diagnostics.nativeBinaryExists = fs$a.existsSync(candidate);
   } catch (err) {
     diagnostics.archResolveError = err.message;
   }
@@ -24283,25 +24553,25 @@ async function healthCheck() {
  */
 function findWidgetsDir$2(widgetPath) {
   const direct = path$d.join(widgetPath, "widgets");
-  if (fs$9.existsSync(direct)) {
+  if (fs$a.existsSync(direct)) {
     return direct;
   }
 
   // Check configs/widgets/ (packageZip.js nests .dash.js files here)
   const configsWidgets = path$d.join(widgetPath, "configs", "widgets");
-  if (fs$9.existsSync(configsWidgets)) {
+  if (fs$a.existsSync(configsWidgets)) {
     return configsWidgets;
   }
 
   // Check configs/ directory (used by packageZip.js for distributed widgets)
   const configs = path$d.join(widgetPath, "configs");
-  if (fs$9.existsSync(configs)) {
+  if (fs$a.existsSync(configs)) {
     return configs;
   }
 
   // Check one level deeper for nested ZIP extraction
   try {
-    const entries = fs$9.readdirSync(widgetPath, { withFileTypes: true });
+    const entries = fs$a.readdirSync(widgetPath, { withFileTypes: true });
     const subdirs = entries.filter(
       (e) =>
         e.isDirectory() &&
@@ -24312,7 +24582,7 @@ function findWidgetsDir$2(widgetPath) {
 
     for (const subdir of subdirs) {
       const nested = path$d.join(widgetPath, subdir.name, "widgets");
-      if (fs$9.existsSync(nested)) {
+      if (fs$a.existsSync(nested)) {
         console.log(`[WidgetCompiler] Found nested widgets/ at ${nested}`);
         return nested;
       }
@@ -24346,7 +24616,7 @@ async function compileWidget$1(widgetPath) {
   }
 
   // Discover .dash.js config files
-  const files = fs$9.readdirSync(widgetsDir);
+  const files = fs$a.readdirSync(widgetsDir);
   const dashFiles = files.filter((f) => f.endsWith(".dash.js"));
 
   if (dashFiles.length === 0) {
@@ -24368,7 +24638,7 @@ async function compileWidget$1(widgetPath) {
     const componentName = dashFile.replace(".dash.js", "");
     const componentFile = `${componentName}.js`;
     const componentFilePath = path$d.join(widgetsDir, componentFile);
-    const hasComponent = fs$9.existsSync(componentFilePath);
+    const hasComponent = fs$a.existsSync(componentFilePath);
 
     // Import the config (always)
     imports.push(
@@ -24406,11 +24676,11 @@ async function compileWidget$1(widgetPath) {
 
   try {
     // Ensure dist/ directory exists
-    if (!fs$9.existsSync(distDir)) {
-      fs$9.mkdirSync(distDir, { recursive: true });
+    if (!fs$a.existsSync(distDir)) {
+      fs$a.mkdirSync(distDir, { recursive: true });
     }
 
-    fs$9.writeFileSync(entryPath, entryContent, "utf8");
+    fs$a.writeFileSync(entryPath, entryContent, "utf8");
 
     console.log(
       `[WidgetCompiler] Compiling ${dashFiles.length} component(s) from ${widgetPath}`,
@@ -24466,8 +24736,8 @@ async function compileWidget$1(widgetPath) {
   } finally {
     // Clean up temporary entry file
     try {
-      if (fs$9.existsSync(entryPath)) {
-        fs$9.unlinkSync(entryPath);
+      if (fs$a.existsSync(entryPath)) {
+        fs$a.unlinkSync(entryPath);
       }
     } catch (cleanupError) {
       // Non-fatal
@@ -24499,7 +24769,7 @@ var widgetCompiler$1 = {
  * Integrates with ComponentManager for automatic registration
  */
 
-const fs$8 = require$$0$2;
+const fs$9 = require$$0$2;
 const path$c = require$$1$1;
 const vm = require$$2$2;
 const { findWidgetsDir: findWidgetsDir$1 } = widgetCompiler$1;
@@ -24592,10 +24862,10 @@ class DynamicWidgetLoader {
       const componentPath = path$c.join(widgetsDir, `${componentName}.js`);
       const configPath = path$c.join(widgetsDir, `${componentName}.dash.js`);
 
-      if (!fs$8.existsSync(componentPath)) {
+      if (!fs$9.existsSync(componentPath)) {
         throw new Error(`Component file not found: ${componentPath}`);
       }
-      if (!fs$8.existsSync(configPath)) {
+      if (!fs$9.existsSync(configPath)) {
         throw new Error(`Config file not found: ${configPath}`);
       }
 
@@ -24646,7 +24916,7 @@ class DynamicWidgetLoader {
    */
   async loadConfigFile(configPath) {
     try {
-      const source = fs$8.readFileSync(configPath, "utf8");
+      const source = fs$9.readFileSync(configPath, "utf8");
 
       let exportMatch = source.match(/export\s+default\s+({[\s\S]*});?\s*$/);
 
@@ -24714,7 +24984,7 @@ class DynamicWidgetLoader {
         return [];
       }
 
-      const files = fs$8.readdirSync(widgetsDir);
+      const files = fs$9.readdirSync(widgetsDir);
       const widgets = new Set();
 
       files.forEach((file) => {
@@ -24790,7 +25060,7 @@ var dynamicWidgetLoaderExports = dynamicWidgetLoader$3.exports;
  *     Test-only. Drops the in-process cache so tests can re-read.
  */
 
-const fs$7 = require$$0$2;
+const fs$8 = require$$0$2;
 const path$b = require$$1$1;
 const os$1 = require$$2$1;
 const { app: app$6 } = require$$0$1;
@@ -24865,12 +25135,12 @@ function resolveWidgetPackagePath(widgetId) {
 function getWidgetMcpPermissions$1(widgetId) {
   if (_cache.has(widgetId)) return _cache.get(widgetId);
   const pkgPath = resolveWidgetPackagePath(widgetId);
-  if (!pkgPath || !fs$7.existsSync(pkgPath)) {
+  if (!pkgPath || !fs$8.existsSync(pkgPath)) {
     _cache.set(widgetId, null);
     return null;
   }
   try {
-    const raw = fs$7.readFileSync(pkgPath, "utf8");
+    const raw = fs$8.readFileSync(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const perms = parseManifestPermissions(pkg);
     _cache.set(widgetId, perms);
@@ -24919,7 +25189,7 @@ var widgetPermissions = {
  * (Slices 1-3) is the actual boundary.
  */
 
-const fs$6 = require$$0$2;
+const fs$7 = require$$0$2;
 const path$a = require$$1$1;
 
 const SOURCE_EXTENSIONS = new Set([
@@ -24973,7 +25243,7 @@ function readSourceFiles(dir) {
   function walk(current, relBase) {
     let entries;
     try {
-      entries = fs$6.readdirSync(current, { withFileTypes: true });
+      entries = fs$7.readdirSync(current, { withFileTypes: true });
     } catch {
       return;
     }
@@ -24990,7 +25260,7 @@ function readSourceFiles(dir) {
         try {
           result.push({
             relPath: rel,
-            source: fs$6.readFileSync(abs, "utf8"),
+            source: fs$7.readFileSync(abs, "utf8"),
           });
         } catch {
           // unreadable — skip
@@ -27147,7 +27417,7 @@ var widgetRegistryExports = widgetRegistry$1.exports;
  */
 
 const path$9 = require$$1$1;
-const fs$5 = require$$0$2;
+const fs$6 = require$$0$2;
 const os = require$$2$1;
 const { toPackageId } = packageId;
 const { getStoredToken: getStoredToken$3 } = registryAuthController$2;
@@ -27223,12 +27493,12 @@ async function fetchRegistryIndex(forceRefresh = false) {
     if (isDev()) {
       // In dev mode, try local test file first
       const testPath = getTestRegistryPath();
-      if (fs$5.existsSync(testPath)) {
+      if (fs$6.existsSync(testPath)) {
         console.log(
           "[RegistryController] Loading test registry from:",
           testPath,
         );
-        const raw = fs$5.readFileSync(testPath, "utf8");
+        const raw = fs$6.readFileSync(testPath, "utf8");
         indexData = JSON.parse(raw);
       } else {
         // Fall back to API (supports DASH_REGISTRY_URL as full-URL override)
@@ -27655,8 +27925,8 @@ async function fetchPackageSource(packageName, componentName = null) {
     let configCode = "";
     let widgetName = null;
 
-    if (fs$5.existsSync(widgetsDir)) {
-      const files = fs$5.readdirSync(widgetsDir);
+    if (fs$6.existsSync(widgetsDir)) {
+      const files = fs$6.readdirSync(widgetsDir);
       const dashFiles = files.filter((f) => f.endsWith(".dash.js"));
       const componentFiles = files.filter(
         (f) => f.endsWith(".js") && !f.endsWith(".dash.js") && f !== "index.js",
@@ -27678,7 +27948,7 @@ async function fetchPackageSource(packageName, componentName = null) {
       if (!configFile) configFile = dashFiles[0];
 
       if (configFile) {
-        configCode = fs$5.readFileSync(path$9.join(widgetsDir, configFile), "utf8");
+        configCode = fs$6.readFileSync(path$9.join(widgetsDir, configFile), "utf8");
         widgetName = configFile.replace(/\.dash\.js$/, "");
       }
 
@@ -27692,7 +27962,7 @@ async function fetchPackageSource(packageName, componentName = null) {
       if (!componentFile) componentFile = componentFiles[0];
 
       if (componentFile) {
-        componentCode = fs$5.readFileSync(
+        componentCode = fs$6.readFileSync(
           path$9.join(widgetsDir, componentFile),
           "utf8",
         );
@@ -27702,15 +27972,15 @@ async function fetchPackageSource(packageName, componentName = null) {
 
     let bundleSource = null;
     const bundlePath = path$9.join(tempDir, "dist", "index.cjs.js");
-    if (fs$5.existsSync(bundlePath)) {
-      bundleSource = fs$5.readFileSync(bundlePath, "utf8");
+    if (fs$6.existsSync(bundlePath)) {
+      bundleSource = fs$6.readFileSync(bundlePath, "utf8");
     }
 
     let dashMeta = {};
     const dashPath = path$9.join(tempDir, "dash.json");
-    if (fs$5.existsSync(dashPath)) {
+    if (fs$6.existsSync(dashPath)) {
       try {
-        dashMeta = JSON.parse(fs$5.readFileSync(dashPath, "utf8"));
+        dashMeta = JSON.parse(fs$6.readFileSync(dashPath, "utf8"));
       } catch {
         // Ignore — metadata is optional for preview
       }
@@ -27729,7 +27999,7 @@ async function fetchPackageSource(packageName, componentName = null) {
     };
   } finally {
     try {
-      fs$5.rmSync(tempDir, { recursive: true, force: true });
+      fs$6.rmSync(tempDir, { recursive: true, force: true });
     } catch (err) {
       console.warn(
         `[RegistryController] Failed to clean up preview temp dir ${tempDir}:`,
@@ -27749,7 +28019,7 @@ var registryController$3 = {
   fetchPackageSource,
 };
 
-var fs$4 = require$$0$2;
+var fs$5 = require$$0$2;
 var JSONStream = require$$4;
 const algoliasearch$1 = require$$2$3;
 const path$8 = require$$3$3;
@@ -27790,7 +28060,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
       var batchNumber = 1;
 
       // create the readStream to parse the large file (json)
-      var readStream = fs$4.createReadStream(filepath).pipe(parser);
+      var readStream = fs$5.createReadStream(filepath).pipe(parser);
 
       var batch = [];
 
@@ -27804,7 +28074,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
               // lets write to the batch file
               if (countForBatch === batchSize) {
                 // write to the batch file
-                var writeStream = fs$4.createWriteStream(
+                var writeStream = fs$5.createWriteStream(
                   batchFilepath + "/batch_" + batchNumber + ".json",
                 );
                 writeStream.write(JSON.stringify(batch));
@@ -27855,11 +28125,11 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
     return new Promise((resolve, reject) => {
       try {
         checkDirectory(directoryPath);
-        fs$4.readdir(directoryPath, (err, files) => {
+        fs$5.readdir(directoryPath, (err, files) => {
           if (err) reject(err);
           if (files) {
             files.forEach((file) => {
-              fs$4.unlinkSync(path$8.join(directoryPath, file));
+              fs$5.unlinkSync(path$8.join(directoryPath, file));
             });
             resolve();
           }
@@ -27878,7 +28148,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
   ) {
     try {
       // read the directory...
-      const files = await fs$4.readdirSync(batchFilepath);
+      const files = await fs$5.readdirSync(batchFilepath);
       let results = [];
       for (const fileIndex in files) {
         // for each file lets read the file and then push to algolia
@@ -27907,7 +28177,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
 
   async readFile(filepath) {
     return await new Promise((resolve, reject) => {
-      fs$4.readFile(filepath, "utf8", (err, data) => {
+      fs$5.readFile(filepath, "utf8", (err, data) => {
         if (err) {
           reject(err);
         }
@@ -28057,7 +28327,7 @@ var algolia = AlgoliaIndex$1;
 const algoliasearch = require$$2$3;
 const events$3 = events$8;
 const AlgoliaIndex = algolia;
-var fs$3 = require$$0$2;
+var fs$4 = require$$0$2;
 const { safePath, getAllowedRoots } = safePath_1;
 
 const algoliaController$1 = {
@@ -28166,7 +28436,7 @@ const algoliaController$1 = {
         // init the Algolia Index helper
         const a = new AlgoliaIndex(appId, apiKey, indexName);
         // create the write stream to store the hits
-        const writeStream = fs$3.createWriteStream(toFilename);
+        const writeStream = fs$4.createWriteStream(toFilename);
         writeStream.write("[");
 
         let sep = "";
@@ -28476,25 +28746,6 @@ const menuItemsController$1 = {
 
 var menuItemsController_1 = menuItemsController$1;
 
-const path$6 = require$$1$1;
-const { app: app$4 } = require$$0$1;
-
-const pluginController$1 = {
-  install: (win, packageName, filepath) => {
-    try {
-      const rootPath = path$6.join(
-        app$4.getPath("userData"),
-        "plugins",
-        packageName,
-      );
-    } catch (e) {
-      win.webContents.send("plugin-install-error", { error: e.message });
-    }
-  },
-};
-
-var pluginController_1 = pluginController$1;
-
 var mcp = {};
 
 var server$1 = {};
@@ -45747,7 +45998,7 @@ const completable_js_1 = completable;
 const uriTemplate_js_1 = uriTemplate;
 const toolNameValidation_js_1 = toolNameValidation;
 const mcp_server_js_1 = mcpServer$1;
-const zod_1 = require$$8$2;
+const zod_1 = require$$8$1;
 /**
  * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
  * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -48278,8 +48529,8 @@ streamableHttp.StreamableHTTPServerTransport = StreamableHTTPServerTransport$1;
  *   https.createServer({ key, cert }, handler);
  */
 
-const fs$2 = require$$0$2;
-const path$5 = require$$1$1;
+const fs$3 = require$$0$2;
+const path$6 = require$$1$1;
 const forge = require$$2$4;
 
 /**
@@ -48288,14 +48539,14 @@ const forge = require$$2$4;
  * @returns {{ cert: string, key: string }} PEM-encoded certificate and private key
  */
 function getOrCreateCert$1(certsDir) {
-  const certPath = path$5.join(certsDir, "cert.pem");
-  const keyPath = path$5.join(certsDir, "key.pem");
+  const certPath = path$6.join(certsDir, "cert.pem");
+  const keyPath = path$6.join(certsDir, "key.pem");
 
   // Return existing cert if valid
-  if (fs$2.existsSync(certPath) && fs$2.existsSync(keyPath)) {
+  if (fs$3.existsSync(certPath) && fs$3.existsSync(keyPath)) {
     try {
-      const cert = fs$2.readFileSync(certPath, "utf8");
-      const key = fs$2.readFileSync(keyPath, "utf8");
+      const cert = fs$3.readFileSync(certPath, "utf8");
+      const key = fs$3.readFileSync(keyPath, "utf8");
       // Verify cert is not expired
       const parsed = forge.pki.certificateFromPem(cert);
       if (parsed.validity.notAfter > new Date()) {
@@ -48361,9 +48612,9 @@ function getOrCreateCert$1(certsDir) {
   const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
 
   // Write to disk
-  fs$2.mkdirSync(certsDir, { recursive: true });
-  fs$2.writeFileSync(certPath, certPem, { mode: 0o644 });
-  fs$2.writeFileSync(keyPath, keyPem, { mode: 0o600 });
+  fs$3.mkdirSync(certsDir, { recursive: true });
+  fs$3.writeFileSync(certPath, certPem, { mode: 0o644 });
+  fs$3.writeFileSync(keyPath, keyPem, { mode: 0o600 });
 
   console.log(`[tlsCert] Certificate saved to ${certsDir}`);
 
@@ -48380,7 +48631,7 @@ var tlsCert = { getOrCreateCert: getOrCreateCert$1 };
  * for Zod schemas in tool input validation (safeParseAsync).
  */
 
-const z$1 = require$$8$2;
+const z$1 = require$$8$1;
 
 /**
  * Convert a JSON Schema property definition to a Zod v3 schema.
@@ -48473,7 +48724,7 @@ var jsonSchemaToZod_1 = { jsonSchemaToZod: jsonSchemaToZod$1, jsonSchemaProperty
  *   - Rate limiting via token bucket (60 req/min)
  */
 
-const https$1 = require$$10;
+const https$1 = require$$11;
 const { randomUUID } = require$$3$4;
 const { BrowserWindow: BrowserWindow$1 } = require$$0$1;
 const { McpServer } = mcp;
@@ -48604,7 +48855,7 @@ function registerPrompt$1(promptDef) {
   registeredPrompts.push(promptDef);
 }
 
-const z = require$$8$2;
+const z = require$$8$1;
 const { jsonSchemaToZod } = jsonSchemaToZod_1;
 
 /**
@@ -50282,7 +50533,7 @@ var themeFromUrlErrors$1 = {
 
 const css = require$$0$9;
 const { Vibrant } = require$$1$6;
-const https = require$$10;
+const https = require$$11;
 const http = require$$0$8;
 const { URL: URL$1 } = require$$4$1;
 const {
@@ -57023,8 +57274,8 @@ var dashboardConfigUtils$1 = {
  * Handles publishing packages and generating registry URLs.
  */
 
-const fs$1 = require$$0$2;
-const path$4 = require$$1$1;
+const fs$2 = require$$0$2;
+const path$5 = require$$1$1;
 const { getStoredToken: getStoredToken$2 } = registryAuthController$2;
 
 const REGISTRY_BASE_URL =
@@ -57050,14 +57301,14 @@ async function publishToRegistry$1(zipPath, manifest) {
 
   try {
     // Read the ZIP file
-    const zipBuffer = fs$1.readFileSync(zipPath);
+    const zipBuffer = fs$2.readFileSync(zipPath);
 
     // Create FormData with the ZIP and manifest
     const formData = new FormData();
     formData.append(
       "file",
       new Blob([zipBuffer], { type: "application/zip" }),
-      path$4.basename(zipPath),
+      path$5.basename(zipPath),
     );
     formData.append("manifest", JSON.stringify(manifest));
 
@@ -57299,8 +57550,8 @@ function requireWidgetPublishManifest () {
  * Mirrors dashboardConfigController patterns for ZIP creation, manifest generation,
  * and registry interaction.
  */
-const path$3 = require$$1$1;
-const { app: app$3, dialog: dialog$1 } = require$$0$1;
+const path$4 = require$$1$1;
+const { app: app$4, dialog: dialog$1 } = require$$0$1;
 const AdmZip$2 = require$$3$2;
 
 const themeController$3 = themeController_1;
@@ -57805,7 +58056,7 @@ async function installThemeFromRegistry$1(win, appId, packageName) {
       // Validate entry path (security: prevent path traversal)
       if (
         themeEntry.entryName.includes("..") ||
-        path$3.isAbsolute(themeEntry.entryName)
+        path$4.isAbsolute(themeEntry.entryName)
       ) {
         return {
           success: false,
@@ -58038,8 +58289,8 @@ var themeRegistryController$1 = {
  * applies event wiring. (Import is implemented in DASH-13.)
  */
 
-const { app: app$2, dialog } = require$$0$1;
-const path$2 = require$$1$1;
+const { app: app$3, dialog } = require$$0$1;
+const path$3 = require$$1$1;
 const AdmZip$1 = require$$3$2;
 const { getFileContents: getFileContents$1 } = file;
 const {
@@ -58088,8 +58339,8 @@ async function exportDashboardConfig$1(
 ) {
   try {
     // 1. Read workspace from workspaces.json
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -58202,8 +58453,8 @@ async function exportDashboardConfig$1(
 
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Export Dashboard as ZIP",
-      defaultPath: path$2.join(
-        app$2.getPath("desktop"),
+      defaultPath: path$3.join(
+        app$3.getPath("desktop"),
         `dashboard-${sanitizedName}.zip`,
       ),
       filters: [{ name: "ZIP Archive", extensions: ["zip"] }],
@@ -58268,7 +58519,7 @@ async function selectDashboardFile$1(win) {
 
     // Extract and validate
     const zip = new AdmZip$1(zipPath);
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -58378,7 +58629,7 @@ async function importDashboardConfig$1(
     const zip = new AdmZip$1(zipPath);
 
     // Validate ZIP entries for path traversal
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -59018,7 +59269,7 @@ async function installDashboardFromRegistry$1(
     const zip = new AdmZip$1(zipBuffer);
 
     // 3. Validate ZIP entries
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-registry-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-registry-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -59154,8 +59405,8 @@ async function collectDashboardDependencies$1(
 ) {
   try {
     // 1. Read workspace
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59433,8 +59684,8 @@ async function prepareDashboardForPublish$1(
     const { resolveNextVersion } = requireWidgetPublishManifest();
 
     // 1. Read workspace
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59711,8 +59962,8 @@ async function prepareDashboardForPublish$1(
     const sanitizedName = manifest.name;
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Save Dashboard Package for Registry",
-      defaultPath: path$2.join(
-        app$2.getPath("desktop"),
+      defaultPath: path$3.join(
+        app$3.getPath("desktop"),
         `dashboard-${sanitizedName}-v${manifest.version}.zip`,
       ),
       filters: [{ name: "ZIP Archive", extensions: ["zip"] }],
@@ -59879,8 +60130,8 @@ async function checkDashboardUpdatesForApp$1(appId) {
   const { fetchRegistryIndex } = registryController$3;
 
   try {
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59950,8 +60201,8 @@ function getProviderSetupManifest$1(appId, requiredProviders = []) {
  */
 function getDashboardPublishPreview$1(appId, workspaceId, widgetRegistry = null) {
   try {
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -60259,9 +60510,50 @@ var notificationController_1 = notificationController$2;
  *
  * Uses the `ws` package (installed in dash-electron) for WebSocket clients.
  * Multiple widgets referencing the same provider share a single socket.
+ *
+ * Phase 3 (network domain JIT) gates `connect` by hostname when a
+ * widgetId is supplied. Once a connection exists, `send` /
+ * `disconnect` / `getStatus` / `getAll` operate on the
+ * already-authorized socket and are intentionally NOT re-gated —
+ * connections are designed to be shared across widgets via the
+ * `consumers: Set` field, and re-gating sends would break that.
  */
 
-const WebSocket = require$$0$b;
+const { app: app$2 } = require$$0$1;
+const fs$1 = require$$0$2;
+const path$2 = require$$1$1;
+const WebSocket = require$$3$5;
+const {
+  gateNetworkCall,
+  gateNetworkCallWithJit,
+} = networkGate;
+const { readEnforceFlag, readJitFlag } = securityFlags;
+
+function _loadFlags() {
+  try {
+    const settingsPath = path$2.join(
+      app$2.getPath("userData"),
+      "Dashboard",
+      "settings.json",
+    );
+    if (!fs$1.existsSync(settingsPath)) return null;
+    return JSON.parse(fs$1.readFileSync(settingsPath, "utf8"));
+  } catch (_e) {
+    return null;
+  }
+}
+
+async function _runNetworkGate(action, widgetId, args) {
+  const settings = _loadFlags();
+  if (!readEnforceFlag(settings)) return { allow: true };
+  if (!widgetId) return { allow: true }; // legacy callers
+  return readJitFlag(settings)
+    ? await gateNetworkCallWithJit(
+        { widgetId, action, args },
+        { enableJit: true },
+      )
+    : gateNetworkCall({ widgetId, action, args });
+}
 
 /**
  * Active WebSocket connections
@@ -60692,7 +60984,26 @@ const webSocketController$1 = {
    * @param {object} config - { url, headers, subprotocols, credentials }
    * @returns {{ success, providerName, status } | { error, message }}
    */
-  connect: async (win, providerName, config) => {
+  connect: async (win, providerName, config, widgetId = null) => {
+    // Phase 3 network gate — fires only when an explicit widgetId is
+    // supplied. The interpolated URL (with credentials substituted) is
+    // what we actually open the socket to, so the gate uses it for
+    // hostname extraction.
+    const interpolatedForGate = config?.credentials
+      ? interpolate(config.url, config.credentials)
+      : config?.url;
+    const gateResult = await _runNetworkGate("wsConnect", widgetId, {
+      url: interpolatedForGate,
+    });
+    if (!gateResult.allow) {
+      return {
+        error: true,
+        message: "network permission gate: " + gateResult.reason,
+        providerName,
+        status: STATUS.ERROR,
+      };
+    }
+
     // 1. Already connected? Return existing connection
     const existing = activeConnections.get(providerName);
     if (existing && existing.status === STATUS.CONNECTED) {
@@ -62412,7 +62723,6 @@ const {
   saveMenuItemForApplication,
   listMenuItemsForApplication,
 } = menuItemsController_1;
-const { install: pluginInstall } = pluginController_1;
 const {
   exportDashboardConfig,
   selectDashboardFile,
@@ -62514,7 +62824,6 @@ var controller = {
   describeImage,
   saveMenuItemForApplication,
   listMenuItemsForApplication,
-  pluginInstall,
   searchIndex,
   exportDashboardConfig,
   selectDashboardFile,
@@ -62566,7 +62875,7 @@ var controller = {
   mcpDashServerController: mcpDashServerController$2,
 };
 
-const { ipcRenderer: ipcRenderer$p } = require$$0$1;
+const { ipcRenderer: ipcRenderer$o } = require$$0$1;
 const { SECURE_STORE_ENCRYPTION_CHECK } = events$8;
 /**
  * secureStoreApi
@@ -62588,7 +62897,7 @@ const { SECURE_STORE_ENCRYPTION_CHECK } = events$8;
  */
 const secureStoreApi$2 = {
   isEncryptionAvailable: () =>
-    ipcRenderer$p.invoke(SECURE_STORE_ENCRYPTION_CHECK, {}),
+    ipcRenderer$o.invoke(SECURE_STORE_ENCRYPTION_CHECK, {}),
 };
 
 var secureStoreApi_1 = secureStoreApi$2;
@@ -62599,7 +62908,7 @@ var secureStoreApi_1 = secureStoreApi$2;
  * Handle the workspace configuration file
  */
 
-const { ipcRenderer: ipcRenderer$o } = require$$0$1;
+const { ipcRenderer: ipcRenderer$n } = require$$0$1;
 const {
   WORKSPACE_LIST,
   WORKSPACE_SAVE,
@@ -62616,7 +62925,7 @@ const workspaceApi$2 = {
    */
   listWorkspacesForApplication: (appId) => {
     console.log("listWorkspacesForApplication called with appId:", appId);
-    return ipcRenderer$o.invoke(WORKSPACE_LIST, { appId });
+    return ipcRenderer$n.invoke(WORKSPACE_LIST, { appId });
   },
 
   /**
@@ -62627,7 +62936,7 @@ const workspaceApi$2 = {
    * @returns
    */
   saveWorkspaceForApplication: (appId, data) =>
-    ipcRenderer$o.invoke(WORKSPACE_SAVE, { appId, data }),
+    ipcRenderer$n.invoke(WORKSPACE_SAVE, { appId, data }),
 
   /**
    * deleteWorkspaceForApplication
@@ -62637,7 +62946,7 @@ const workspaceApi$2 = {
    * @returns
    */
   deleteWorkspaceForApplication: (appId, workspaceId) =>
-    ipcRenderer$o.invoke(WORKSPACE_DELETE, { appId, workspaceId }),
+    ipcRenderer$n.invoke(WORKSPACE_DELETE, { appId, workspaceId }),
 };
 
 var workspaceApi_1 = workspaceApi$2;
@@ -62649,13 +62958,13 @@ var workspaceApi_1 = workspaceApi$2;
  */
 
 // ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$n } = require$$0$1;
+const { ipcRenderer: ipcRenderer$m } = require$$0$1;
 
 const { LAYOUT_LIST } = events$8;
 
 const layoutApi$2 = {
   listLayoutsForApplication: (appId) =>
-    ipcRenderer$n.invoke(LAYOUT_LIST, { appId }),
+    ipcRenderer$m.invoke(LAYOUT_LIST, { appId }),
 };
 
 var layoutApi_1 = layoutApi$2;
@@ -62667,7 +62976,7 @@ var layoutApi_1 = layoutApi$2;
  */
 
 // ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$m } = require$$0$1;
+const { ipcRenderer: ipcRenderer$l } = require$$0$1;
 
 const {
   DATA_JSON_TO_CSV_FILE,
@@ -62685,7 +62994,7 @@ const {
 const dataApi$2 = {
   // convert a json array of objects to a csv string and save to file
   convertJsonToCsvFile: (appId, jsonObject, filename) =>
-    ipcRenderer$m.invoke(DATA_JSON_TO_CSV_FILE, {
+    ipcRenderer$l.invoke(DATA_JSON_TO_CSV_FILE, {
       appId,
       jsonObject,
       filename,
@@ -62693,10 +63002,10 @@ const dataApi$2 = {
 
   // convert a json array of objects to a csv string and return a string
   convertJsonToCsvString: (appId, jsonObject) =>
-    ipcRenderer$m.invoke(DATA_JSON_TO_CSV_STRING, { appId, jsonObject }),
+    ipcRenderer$l.invoke(DATA_JSON_TO_CSV_STRING, { appId, jsonObject }),
 
   parseXMLStream: (filepath, outpath, start) =>
-    ipcRenderer$m.invoke(PARSE_XML_STREAM, {
+    ipcRenderer$l.invoke(PARSE_XML_STREAM, {
       filepath,
       outpath,
       start,
@@ -62710,7 +63019,7 @@ const dataApi$2 = {
     headers = null,
     limit = null,
   ) => {
-    ipcRenderer$m.invoke(PARSE_CSV_STREAM, {
+    ipcRenderer$l.invoke(PARSE_CSV_STREAM, {
       filepath,
       outpath,
       delimiter,
@@ -62721,15 +63030,15 @@ const dataApi$2 = {
   },
 
   readLinesFromFile: (filepath, lineCount) => {
-    ipcRenderer$m.invoke(READ_LINES, { filepath, lineCount });
+    ipcRenderer$l.invoke(READ_LINES, { filepath, lineCount });
   },
 
   readJSONFromFile: (filepath, objectCount = null) => {
-    ipcRenderer$m.invoke(READ_JSON, { filepath, objectCount });
+    ipcRenderer$l.invoke(READ_JSON, { filepath, objectCount });
   },
 
-  readDataFromURL: (url, toFilepath) => {
-    ipcRenderer$m.invoke(READ_DATA_URL, { url, toFilepath });
+  readDataFromURL: (url, toFilepath, widgetId = null) => {
+    ipcRenderer$l.invoke(READ_DATA_URL, { url, toFilepath, widgetId });
   },
 
   /*
@@ -62738,7 +63047,7 @@ const dataApi$2 = {
    * @param {object} returnEmpty the return empty object
    */
   saveData: (data, filename, append, returnEmpty, widgetId = null) =>
-    ipcRenderer$m.invoke(DATA_SAVE_TO_FILE, {
+    ipcRenderer$l.invoke(DATA_SAVE_TO_FILE, {
       data,
       filename,
       append,
@@ -62756,7 +63065,7 @@ const dataApi$2 = {
    *   gates the gate itself).
    */
   readData: (filename, returnEmpty = [], widgetId = null) =>
-    ipcRenderer$m.invoke(DATA_READ_FROM_FILE, {
+    ipcRenderer$l.invoke(DATA_READ_FROM_FILE, {
       filename,
       returnEmpty,
       widgetId,
@@ -62767,7 +63076,7 @@ const dataApi$2 = {
    * @returns
    */
   transformFile: (filepath, outFilepath, mappingFunctionBody, args) => {
-    ipcRenderer$m.invoke(TRANSFORM_FILE, {
+    ipcRenderer$l.invoke(TRANSFORM_FILE, {
       filepath,
       outFilepath,
       mappingFunctionBody,
@@ -62785,7 +63094,7 @@ var dataApi_1 = dataApi$2;
  */
 
 // ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$l } = require$$0$1;
+const { ipcRenderer: ipcRenderer$k } = require$$0$1;
 
 const {
   SETTINGS_GET,
@@ -62796,14 +63105,14 @@ const {
 } = events$8;
 
 const settingsApi$2 = {
-  getSettingsForApplication: () => ipcRenderer$l.invoke(SETTINGS_GET, {}),
+  getSettingsForApplication: () => ipcRenderer$k.invoke(SETTINGS_GET, {}),
   saveSettingsForApplication: (data) =>
-    ipcRenderer$l.invoke(SETTINGS_SAVE, { data }),
-  getDataDirectory: () => ipcRenderer$l.invoke(SETTINGS_GET_DATA_DIR, {}),
+    ipcRenderer$k.invoke(SETTINGS_SAVE, { data }),
+  getDataDirectory: () => ipcRenderer$k.invoke(SETTINGS_GET_DATA_DIR, {}),
   setDataDirectory: (dataDirectory) =>
-    ipcRenderer$l.invoke(SETTINGS_SET_DATA_DIR, { dataDirectory }),
+    ipcRenderer$k.invoke(SETTINGS_SET_DATA_DIR, { dataDirectory }),
   migrateDataDirectory: (oldDirectory, newDirectory) =>
-    ipcRenderer$l.invoke(SETTINGS_MIGRATE_DATA_DIR, {
+    ipcRenderer$k.invoke(SETTINGS_MIGRATE_DATA_DIR, {
       oldDirectory,
       newDirectory,
     }),
@@ -62818,7 +63127,7 @@ var settingsApi_1 = settingsApi$2;
  * Provides file/folder chooser dialogs.
  */
 
-const { ipcRenderer: ipcRenderer$k } = require$$0$1;
+const { ipcRenderer: ipcRenderer$j } = require$$0$1;
 
 const { CHOOSE_FILE } = events$8;
 
@@ -62831,7 +63140,7 @@ const dialogApi$2 = {
    * @returns {Promise<string|null>} selected file/folder path, or null if cancelled
    */
   chooseFile: (allowFile = true, extensions = ["*"]) => {
-    return ipcRenderer$k.invoke(CHOOSE_FILE, { allowFile, extensions });
+    return ipcRenderer$j.invoke(CHOOSE_FILE, { allowFile, extensions });
   },
 
   /**
@@ -62856,7 +63165,7 @@ const dialogApi$2 = {
       typeof options.allowFile === "boolean" ? options.allowFile : allowFile;
     const resolvedExtensions = options.extensions || extensions;
 
-    const filePath = await ipcRenderer$k.invoke(CHOOSE_FILE, {
+    const filePath = await ipcRenderer$j.invoke(CHOOSE_FILE, {
       allowFile: resolvedAllowFile,
       extensions: resolvedExtensions,
     });
@@ -62883,7 +63192,7 @@ var dialogApi_1 = dialogApi$2;
  * mainApi.widgets.uninstall('Weather')
  */
 
-const { ipcRenderer: ipcRenderer$j } = require$$0$1;
+const { ipcRenderer: ipcRenderer$i } = require$$0$1;
 
 const widgetApi$2 = {
   /**
@@ -62892,7 +63201,7 @@ const widgetApi$2 = {
    */
   list: async () => {
     try {
-      return await ipcRenderer$j.invoke("widget:list");
+      return await ipcRenderer$i.invoke("widget:list");
     } catch (error) {
       console.error("[WidgetApi] Error listing widgets:", error);
       throw error;
@@ -62906,7 +63215,7 @@ const widgetApi$2 = {
    */
   get: async (widgetName) => {
     try {
-      return await ipcRenderer$j.invoke("widget:get", widgetName);
+      return await ipcRenderer$i.invoke("widget:get", widgetName);
     } catch (error) {
       console.error(`[WidgetApi] Error getting widget ${widgetName}:`, error);
       throw error;
@@ -62937,7 +63246,7 @@ const widgetApi$2 = {
       console.log(
         `[WidgetApi] Installing widget: ${widgetName} from ${downloadUrl}`,
       );
-      const config = await ipcRenderer$j.invoke(
+      const config = await ipcRenderer$i.invoke(
         "widget:install",
         widgetName,
         downloadUrl,
@@ -62977,7 +63286,7 @@ const widgetApi$2 = {
       console.log(
         `[WidgetApi] Installing local widget: ${widgetName} from ${localPath}`,
       );
-      const config = await ipcRenderer$j.invoke(
+      const config = await ipcRenderer$i.invoke(
         "widget:install-local",
         widgetName,
         localPath,
@@ -63008,7 +63317,7 @@ const widgetApi$2 = {
   loadFolder: async (folderPath) => {
     try {
       console.log(`[WidgetApi] Loading widgets from folder: ${folderPath}`);
-      const results = await ipcRenderer$j.invoke(
+      const results = await ipcRenderer$i.invoke(
         "widget:load-folder",
         folderPath,
       );
@@ -63032,7 +63341,7 @@ const widgetApi$2 = {
   uninstall: async (widgetName) => {
     try {
       console.log(`[WidgetApi] Uninstalling widget: ${widgetName}`);
-      const success = await ipcRenderer$j.invoke("widget:uninstall", widgetName);
+      const success = await ipcRenderer$i.invoke("widget:uninstall", widgetName);
       if (success) {
         console.log(`[WidgetApi] ✓ Widget ${widgetName} uninstalled`);
       } else {
@@ -63055,7 +63364,7 @@ const widgetApi$2 = {
    */
   getCachePath: async () => {
     try {
-      return await ipcRenderer$j.invoke("widget:cache-path");
+      return await ipcRenderer$i.invoke("widget:cache-path");
     } catch (error) {
       console.error("[WidgetApi] Error getting cache path:", error);
       throw error;
@@ -63069,7 +63378,7 @@ const widgetApi$2 = {
    */
   getStoragePath: async () => {
     try {
-      return await ipcRenderer$j.invoke("widget:storage-path");
+      return await ipcRenderer$i.invoke("widget:storage-path");
     } catch (error) {
       console.error("[WidgetApi] Error getting storage path:", error);
       throw error;
@@ -63086,7 +63395,7 @@ const widgetApi$2 = {
   setStoragePath: async (customPath) => {
     try {
       console.log(`[WidgetApi] Setting storage path to: ${customPath}`);
-      const result = await ipcRenderer$j.invoke(
+      const result = await ipcRenderer$i.invoke(
         "widget:set-storage-path",
         customPath,
       );
@@ -63108,7 +63417,7 @@ const widgetApi$2 = {
    */
   getComponentConfigs: async () => {
     try {
-      return await ipcRenderer$j.invoke("widget:get-component-configs");
+      return await ipcRenderer$i.invoke("widget:get-component-configs");
     } catch (error) {
       console.error("[WidgetApi] Error getting component configs:", error);
       return [];
@@ -63123,7 +63432,7 @@ const widgetApi$2 = {
    */
   readBundle: async (widgetName) => {
     try {
-      return await ipcRenderer$j.invoke("widget:read-bundle", widgetName);
+      return await ipcRenderer$i.invoke("widget:read-bundle", widgetName);
     } catch (error) {
       console.error(
         `[WidgetApi] Error reading bundle for ${widgetName}:`,
@@ -63142,7 +63451,7 @@ const widgetApi$2 = {
    */
   readSources: async (widgetName, componentName) => {
     try {
-      return await ipcRenderer$j.invoke("widget:read-sources", {
+      return await ipcRenderer$i.invoke("widget:read-sources", {
         widgetName,
         componentName,
       });
@@ -63162,7 +63471,7 @@ const widgetApi$2 = {
    */
   readAllBundles: async () => {
     try {
-      return await ipcRenderer$j.invoke("widget:read-all-bundles");
+      return await ipcRenderer$i.invoke("widget:read-all-bundles");
     } catch (error) {
       console.error("[WidgetApi] Error reading all bundles:", error);
       return [];
@@ -63182,7 +63491,7 @@ const widgetApi$2 = {
    * });
    */
   onInstalled: (callback) => {
-    ipcRenderer$j.on("widget:installed", (event, data) => {
+    ipcRenderer$i.on("widget:installed", (event, data) => {
       callback(data);
     });
   },
@@ -63199,7 +63508,7 @@ const widgetApi$2 = {
    * });
    */
   onUninstalled: (callback) => {
-    ipcRenderer$j.on("widget:uninstalled", (event, data) => {
+    ipcRenderer$i.on("widget:uninstalled", (event, data) => {
       callback(data);
     });
   },
@@ -63217,7 +63526,7 @@ const widgetApi$2 = {
    * });
    */
   onLoaded: (callback) => {
-    ipcRenderer$j.on("widgets:loaded", (event, data) => {
+    ipcRenderer$i.on("widgets:loaded", (event, data) => {
       callback(data);
     });
   },
@@ -63228,7 +63537,7 @@ const widgetApi$2 = {
    * @param {Function} callback - The callback to remove
    */
   removeInstalledListener: (callback) => {
-    ipcRenderer$j.removeListener("widget:installed", callback);
+    ipcRenderer$i.removeListener("widget:installed", callback);
   },
 
   /**
@@ -63237,7 +63546,7 @@ const widgetApi$2 = {
    * @param {Function} callback - The callback to remove
    */
   removeUninstalledListener: (callback) => {
-    ipcRenderer$j.removeListener("widget:uninstalled", callback);
+    ipcRenderer$i.removeListener("widget:uninstalled", callback);
   },
 
   /**
@@ -63246,7 +63555,7 @@ const widgetApi$2 = {
    * @param {Function} callback - The callback to remove
    */
   removeLoadedListener: (callback) => {
-    ipcRenderer$j.removeListener("widgets:loaded", callback);
+    ipcRenderer$i.removeListener("widgets:loaded", callback);
   },
 };
 
@@ -63259,7 +63568,7 @@ var widgetApi_1 = widgetApi$2;
  * Communicates with main process via IPC to handle encryption and file storage
  */
 
-const { ipcRenderer: ipcRenderer$i } = require$$0$1;
+const { ipcRenderer: ipcRenderer$h } = require$$0$1;
 const {
   PROVIDER_SAVE,
   PROVIDER_LIST,
@@ -63297,7 +63606,7 @@ const providerApi$2 = {
     // value, preserve what's on disk" from "caller explicitly unset it".
     isDefaultForType = undefined,
   ) =>
-    ipcRenderer$i.invoke(PROVIDER_SAVE, {
+    ipcRenderer$h.invoke(PROVIDER_SAVE, {
       appId,
       providerName,
       providerType,
@@ -63317,7 +63626,7 @@ const providerApi$2 = {
    * @param {String} appId - the appId specified in the dash initialization
    * @returns {Promise<Array>} Array of provider objects with name, type, credentials
    */
-  listProviders: (appId) => ipcRenderer$i.invoke(PROVIDER_LIST, { appId }),
+  listProviders: (appId) => ipcRenderer$h.invoke(PROVIDER_LIST, { appId }),
 
   /**
    * getProvider
@@ -63329,7 +63638,7 @@ const providerApi$2 = {
    * @returns {Promise<Object>} Provider object with name, type, credentials
    */
   getProvider: (appId, providerName) =>
-    ipcRenderer$i.invoke(PROVIDER_GET, { appId, providerName }),
+    ipcRenderer$h.invoke(PROVIDER_GET, { appId, providerName }),
 
   /**
    * deleteProvider
@@ -63341,7 +63650,7 @@ const providerApi$2 = {
    * @returns {Promise}
    */
   deleteProvider: (appId, providerName) =>
-    ipcRenderer$i.invoke(PROVIDER_DELETE, { appId, providerName }),
+    ipcRenderer$h.invoke(PROVIDER_DELETE, { appId, providerName }),
 
   /**
    * listProvidersForApplication
@@ -63351,14 +63660,14 @@ const providerApi$2 = {
    * @param {String} appId - the appId specified in the dash initialization
    */
   listProvidersForApplication: (appId) => {
-    ipcRenderer$i
+    ipcRenderer$h
       .invoke(PROVIDER_LIST, { appId })
       .then((result) => {
         // Emit the event for ElectronDashboardApi to listen to
-        ipcRenderer$i.send("PROVIDER_LIST_COMPLETE", result);
+        ipcRenderer$h.send("PROVIDER_LIST_COMPLETE", result);
       })
       .catch((error) => {
-        ipcRenderer$i.send("PROVIDER_LIST_ERROR", {
+        ipcRenderer$h.send("PROVIDER_LIST_ERROR", {
           error: error.message,
         });
       });
@@ -63375,7 +63684,7 @@ const providerApi$2 = {
     providerType,
     credentials,
   ) => {
-    ipcRenderer$i
+    ipcRenderer$h
       .invoke(PROVIDER_SAVE, {
         appId,
         providerName,
@@ -63383,10 +63692,10 @@ const providerApi$2 = {
         credentials,
       })
       .then((result) => {
-        ipcRenderer$i.send("PROVIDER_SAVE_COMPLETE", result);
+        ipcRenderer$h.send("PROVIDER_SAVE_COMPLETE", result);
       })
       .catch((error) => {
-        ipcRenderer$i.send("PROVIDER_SAVE_ERROR", {
+        ipcRenderer$h.send("PROVIDER_SAVE_ERROR", {
           error: error.message,
         });
       });
@@ -63398,13 +63707,13 @@ const providerApi$2 = {
    * Event-listener-based version for use with ElectronDashboardApi
    */
   getProviderForApplication: (appId, providerName) => {
-    ipcRenderer$i
+    ipcRenderer$h
       .invoke(PROVIDER_GET, { appId, providerName })
       .then((result) => {
-        ipcRenderer$i.send("PROVIDER_GET_COMPLETE", result);
+        ipcRenderer$h.send("PROVIDER_GET_COMPLETE", result);
       })
       .catch((error) => {
-        ipcRenderer$i.send("PROVIDER_GET_ERROR", {
+        ipcRenderer$h.send("PROVIDER_GET_ERROR", {
           error: error.message,
         });
       });
@@ -63416,13 +63725,13 @@ const providerApi$2 = {
    * Event-listener-based version for use with ElectronDashboardApi
    */
   deleteProviderForApplication: (appId, providerName) => {
-    ipcRenderer$i
+    ipcRenderer$h
       .invoke(PROVIDER_DELETE, { appId, providerName })
       .then((result) => {
-        ipcRenderer$i.send("PROVIDER_DELETE_COMPLETE", result);
+        ipcRenderer$h.send("PROVIDER_DELETE_COMPLETE", result);
       })
       .catch((error) => {
-        ipcRenderer$i.send("PROVIDER_DELETE_ERROR", {
+        ipcRenderer$h.send("PROVIDER_DELETE_ERROR", {
           error: error.message,
         });
       });
@@ -63438,7 +63747,7 @@ var providerApi_1 = providerApi$2;
  * Communicates with main process via IPC to manage MCP server lifecycle.
  */
 
-const { ipcRenderer: ipcRenderer$h } = require$$0$1;
+const { ipcRenderer: ipcRenderer$g } = require$$0$1;
 const {
   MCP_START_SERVER,
   MCP_STOP_SERVER,
@@ -63477,7 +63786,7 @@ const mcpApi$2 = {
     workspaceId = null,
     pathScope = null,
   ) =>
-    ipcRenderer$h.invoke(MCP_START_SERVER, {
+    ipcRenderer$g.invoke(MCP_START_SERVER, {
       serverName,
       mcpConfig,
       credentials,
@@ -63494,7 +63803,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ success, serverName } | { error, message }>}
    */
   stopServer: (serverName, workspaceId = null) =>
-    ipcRenderer$h.invoke(MCP_STOP_SERVER, { serverName, workspaceId }),
+    ipcRenderer$g.invoke(MCP_STOP_SERVER, { serverName, workspaceId }),
 
   /**
    * listTools
@@ -63505,7 +63814,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ tools } | { error, message }>}
    */
   listTools: (serverName, workspaceId = null) =>
-    ipcRenderer$h.invoke(MCP_LIST_TOOLS, { serverName, workspaceId }),
+    ipcRenderer$g.invoke(MCP_LIST_TOOLS, { serverName, workspaceId }),
 
   /**
    * callTool
@@ -63533,7 +63842,7 @@ const mcpApi$2 = {
     widgetId = null,
     workspaceId = null,
   ) =>
-    ipcRenderer$h.invoke(MCP_CALL_TOOL, {
+    ipcRenderer$g.invoke(MCP_CALL_TOOL, {
       serverName,
       toolName,
       args,
@@ -63551,7 +63860,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ resources } | { error, message }>}
    */
   listResources: (serverName, workspaceId = null) =>
-    ipcRenderer$h.invoke(MCP_LIST_RESOURCES, { serverName, workspaceId }),
+    ipcRenderer$g.invoke(MCP_LIST_RESOURCES, { serverName, workspaceId }),
 
   /**
    * readResource
@@ -63563,7 +63872,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ resource } | { error, message }>}
    */
   readResource: (serverName, uri, workspaceId = null) =>
-    ipcRenderer$h.invoke(MCP_READ_RESOURCE, { serverName, uri, workspaceId }),
+    ipcRenderer$g.invoke(MCP_READ_RESOURCE, { serverName, uri, workspaceId }),
 
   /**
    * getServerStatus
@@ -63574,7 +63883,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ status, tools, error }>}
    */
   getServerStatus: (serverName, workspaceId = null) =>
-    ipcRenderer$h.invoke(MCP_SERVER_STATUS, { serverName, workspaceId }),
+    ipcRenderer$g.invoke(MCP_SERVER_STATUS, { serverName, workspaceId }),
 
   /**
    * getCatalog
@@ -63582,7 +63891,7 @@ const mcpApi$2 = {
    *
    * @returns {Promise<{ catalog } | { error, message }>}
    */
-  getCatalog: () => ipcRenderer$h.invoke(MCP_GET_CATALOG),
+  getCatalog: () => ipcRenderer$g.invoke(MCP_GET_CATALOG),
 
   /**
    * getKnownExternalCatalog
@@ -63594,7 +63903,7 @@ const mcpApi$2 = {
    *
    * @returns {Promise<{ success, servers } | { error, message, servers }>}
    */
-  getKnownExternalCatalog: () => ipcRenderer$h.invoke(MCP_GET_KNOWN_EXTERNAL),
+  getKnownExternalCatalog: () => ipcRenderer$g.invoke(MCP_GET_KNOWN_EXTERNAL),
 
   /**
    * onInstallKnownExternalConfirm
@@ -63608,9 +63917,9 @@ const mcpApi$2 = {
    */
   onInstallKnownExternalConfirm: (callback) => {
     const handler = (_e, data) => callback(data);
-    ipcRenderer$h.on(MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM$1, handler);
+    ipcRenderer$g.on(MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM$1, handler);
     return () =>
-      ipcRenderer$h.removeListener(MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM$1, handler);
+      ipcRenderer$g.removeListener(MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM$1, handler);
   },
 
   /**
@@ -63621,7 +63930,7 @@ const mcpApi$2 = {
    * @param {{ confirmed: boolean, credentials?: object, error?: string }} result
    */
   sendInstallKnownExternalResult: (requestId, result) =>
-    ipcRenderer$h.send(MCP_INSTALL_KNOWN_EXTERNAL_RESULT$1, { requestId, result }),
+    ipcRenderer$g.send(MCP_INSTALL_KNOWN_EXTERNAL_RESULT$1, { requestId, result }),
 
   /**
    * runAuth
@@ -63633,7 +63942,7 @@ const mcpApi$2 = {
    * @returns {Promise<{ success } | { error, message }>}
    */
   runAuth: (mcpConfig, credentials, authCommand) =>
-    ipcRenderer$h.invoke(MCP_RUN_AUTH, { mcpConfig, credentials, authCommand }),
+    ipcRenderer$g.invoke(MCP_RUN_AUTH, { mcpConfig, credentials, authCommand }),
 };
 
 var mcpApi_1 = mcpApi$2;
@@ -63651,7 +63960,7 @@ var mcpApi_1 = mcpApi$2;
  * mainApi.registry.checkUpdates([{ name: "weather-widgets", version: "1.0.0" }])
  */
 
-const { ipcRenderer: ipcRenderer$g } = require$$0$1;
+const { ipcRenderer: ipcRenderer$f } = require$$0$1;
 
 const registryApi$2 = {
   /**
@@ -63661,7 +63970,7 @@ const registryApi$2 = {
    */
   fetchIndex: async (forceRefresh = false) => {
     try {
-      return await ipcRenderer$g.invoke("registry:fetch-index", forceRefresh);
+      return await ipcRenderer$f.invoke("registry:fetch-index", forceRefresh);
     } catch (error) {
       console.error("[RegistryApi] Error fetching index:", error);
       throw error;
@@ -63676,7 +63985,7 @@ const registryApi$2 = {
    */
   search: async (query = "", filters = {}) => {
     try {
-      return await ipcRenderer$g.invoke("registry:search", query, filters);
+      return await ipcRenderer$f.invoke("registry:search", query, filters);
     } catch (error) {
       console.error("[RegistryApi] Error searching registry:", error);
       throw error;
@@ -63690,7 +63999,7 @@ const registryApi$2 = {
    */
   getPackage: async (packageName) => {
     try {
-      return await ipcRenderer$g.invoke("registry:get-package", packageName);
+      return await ipcRenderer$f.invoke("registry:get-package", packageName);
     } catch (error) {
       console.error(
         `[RegistryApi] Error getting package ${packageName}:`,
@@ -63707,7 +64016,7 @@ const registryApi$2 = {
    */
   checkUpdates: async (installedWidgets = []) => {
     try {
-      return await ipcRenderer$g.invoke(
+      return await ipcRenderer$f.invoke(
         "registry:check-updates",
         installedWidgets,
       );
@@ -63725,7 +64034,7 @@ const registryApi$2 = {
    */
   searchDashboards: async (query = "", filters = {}) => {
     try {
-      return await ipcRenderer$g.invoke(
+      return await ipcRenderer$f.invoke(
         "registry:search-dashboards",
         query,
         filters,
@@ -63744,7 +64053,7 @@ const registryApi$2 = {
    */
   searchThemes: async (query = "", filters = {}) => {
     try {
-      return await ipcRenderer$g.invoke("registry:search-themes", query, filters);
+      return await ipcRenderer$f.invoke("registry:search-themes", query, filters);
     } catch (error) {
       console.error("[RegistryApi] Error searching themes:", error);
       throw error;
@@ -63766,7 +64075,7 @@ const registryApi$2 = {
    */
   publishWidget: async (appId, packageId, options = {}) => {
     try {
-      return await ipcRenderer$g.invoke("registry:publish-widget", {
+      return await ipcRenderer$f.invoke("registry:publish-widget", {
         appId,
         packageId,
         options,
@@ -63787,7 +64096,7 @@ const registryApi$2 = {
    */
   inspectWidgetPackage: async (packageId) => {
     try {
-      return await ipcRenderer$g.invoke("registry:inspect-widget-package", {
+      return await ipcRenderer$f.invoke("registry:inspect-widget-package", {
         packageId,
       });
     } catch (error) {
@@ -63808,7 +64117,7 @@ const registryApi$2 = {
    */
   scanWidgetDefaults: async (packageId) => {
     try {
-      return await ipcRenderer$g.invoke("registry:scan-widget-defaults", {
+      return await ipcRenderer$f.invoke("registry:scan-widget-defaults", {
         packageId,
       });
     } catch (error) {
@@ -63831,7 +64140,7 @@ const registryApi$2 = {
    */
   previewFetch: async (packageName, componentName = null) => {
     try {
-      return await ipcRenderer$g.invoke(
+      return await ipcRenderer$f.invoke(
         "registry:preview-fetch",
         packageName,
         componentName,
@@ -63854,7 +64163,7 @@ var registryApi_1 = registryApi$2;
  * Handle the theme configuration file
  */
 
-const { ipcRenderer: ipcRenderer$f } = require$$0$1;
+const { ipcRenderer: ipcRenderer$e } = require$$0$1;
 
 const {
   THEME_LIST,
@@ -63867,17 +64176,17 @@ const {
 
 const themeApi$2 = {
   listThemesForApplication: (appId) =>
-    ipcRenderer$f.invoke(THEME_LIST, { appId }),
+    ipcRenderer$e.invoke(THEME_LIST, { appId }),
   saveThemeForApplication: (appId, themeName, themeObject) =>
-    ipcRenderer$f.invoke(THEME_SAVE, { appId, themeName, themeObject }),
+    ipcRenderer$e.invoke(THEME_SAVE, { appId, themeName, themeObject }),
   deleteThemeForApplication: (appId, themeKey) =>
-    ipcRenderer$f.invoke(THEME_DELETE, { appId, themeKey }),
+    ipcRenderer$e.invoke(THEME_DELETE, { appId, themeKey }),
   publishTheme: (appId, themeKey, options) =>
-    ipcRenderer$f.invoke(THEME_PUBLISH, { appId, themeKey, options }),
+    ipcRenderer$e.invoke(THEME_PUBLISH, { appId, themeKey, options }),
   installThemeFromRegistry: (appId, packageName) =>
-    ipcRenderer$f.invoke(THEME_INSTALL_FROM_REGISTRY, { appId, packageName }),
+    ipcRenderer$e.invoke(THEME_INSTALL_FROM_REGISTRY, { appId, packageName }),
   getThemePublishPreview: (appId, themeKey) =>
-    ipcRenderer$f.invoke(THEME_PUBLISH_PREVIEW, { appId, themeKey }),
+    ipcRenderer$e.invoke(THEME_PUBLISH_PREVIEW, { appId, themeKey }),
 };
 
 var themeApi_1 = themeApi$2;
@@ -63889,7 +64198,7 @@ var themeApi_1 = themeApi$2;
  */
 
 // ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$e } = require$$0$1;
+const { ipcRenderer: ipcRenderer$d } = require$$0$1;
 
 const {
   ALGOLIA_LIST_INDICES,
@@ -63902,10 +64211,10 @@ const {
 
 const algoliaApi$2 = {
   listIndices: (application) =>
-    ipcRenderer$e.invoke(ALGOLIA_LIST_INDICES, application),
+    ipcRenderer$d.invoke(ALGOLIA_LIST_INDICES, application),
 
   browseObjects: (appId, apiKey, indexName) => {
-    ipcRenderer$e.invoke(ALGOLIA_BROWSE_OBJECTS, {
+    ipcRenderer$d.invoke(ALGOLIA_BROWSE_OBJECTS, {
       appId,
       apiKey,
       indexName,
@@ -63914,7 +64223,7 @@ const algoliaApi$2 = {
   },
 
   getAnalyticsForQuery: (application, indexName, query) =>
-    ipcRenderer$e.invoke(ALGOLIA_ANALYTICS_FOR_QUERY, {
+    ipcRenderer$d.invoke(ALGOLIA_ANALYTICS_FOR_QUERY, {
       application,
       indexName,
       query,
@@ -63927,7 +64236,7 @@ const algoliaApi$2 = {
     dir,
     createIfNotExists = false,
   ) =>
-    ipcRenderer$e.invoke(ALGOLIA_PARTIAL_UPDATE_OBJECTS, {
+    ipcRenderer$d.invoke(ALGOLIA_PARTIAL_UPDATE_OBJECTS, {
       appId,
       apiKey,
       indexName,
@@ -63936,7 +64245,7 @@ const algoliaApi$2 = {
     }),
 
   createBatchesFromFile: (filepath, batchFilepath, batchSize) => {
-    ipcRenderer$e.invoke(ALGOLIA_CREATE_BATCH, {
+    ipcRenderer$d.invoke(ALGOLIA_CREATE_BATCH, {
       filepath,
       batchFilepath,
       batchSize,
@@ -63944,7 +64253,7 @@ const algoliaApi$2 = {
   },
 
   browseObjectsToFile: (appId, apiKey, indexName, toFilename, query = "") => {
-    ipcRenderer$e.invoke(ALGOLIA_BROWSE_OBJECTS, {
+    ipcRenderer$d.invoke(ALGOLIA_BROWSE_OBJECTS, {
       appId,
       apiKey,
       indexName,
@@ -63954,7 +64263,7 @@ const algoliaApi$2 = {
   },
 
   search: (appId, apiKey, indexName, query = "", options = {}) =>
-    ipcRenderer$e.invoke(ALGOLIA_SEARCH, {
+    ipcRenderer$d.invoke(ALGOLIA_SEARCH, {
       appId,
       apiKey,
       indexName,
@@ -63969,14 +64278,14 @@ var algoliaApi_1 = algoliaApi$2;
  * openAI
  */
 
-const { ipcRenderer: ipcRenderer$d } = require$$0$1;
+const { ipcRenderer: ipcRenderer$c } = require$$0$1;
 
 const { OPENAI_DESCRIBE_IMAGE } = openaiEvents$1;
 
 const openaiApi$2 = {
   // convert a json array of objects to a csv string and save to file
   describeImage: (imageUrl, apiKey, prompt = "What's in this image?") =>
-    ipcRenderer$d.invoke(OPENAI_DESCRIBE_IMAGE, { imageUrl, apiKey, prompt }),
+    ipcRenderer$c.invoke(OPENAI_DESCRIBE_IMAGE, { imageUrl, apiKey, prompt }),
 };
 
 var openaiApi_1 = openaiApi$2;
@@ -63987,35 +64296,18 @@ var openaiApi_1 = openaiApi$2;
  */
 
 // ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$c } = require$$0$1;
+const { ipcRenderer: ipcRenderer$b } = require$$0$1;
 
 const { MENU_ITEMS_SAVE, MENU_ITEMS_LIST } = events$8;
 
 const menuItemsApi$2 = {
   saveMenuItem: (appId, menuItem) =>
-    ipcRenderer$c.invoke(MENU_ITEMS_SAVE, { appId, menuItem }),
-  listMenuItems: (appId) => ipcRenderer$c.invoke(MENU_ITEMS_LIST, { appId }),
+    ipcRenderer$b.invoke(MENU_ITEMS_SAVE, { appId, menuItem }),
+  listMenuItems: (appId) => ipcRenderer$b.invoke(MENU_ITEMS_LIST, { appId }),
 };
 
 var menuItemsApi_1 = menuItemsApi$2;
 
-/**
- * pluginApi.js
- *
- * Plugin management API for the renderer process.
- */
-
-// ipcRenderer that must be used to invoke the events
-const { ipcRenderer: ipcRenderer$b } = require$$0$1;
-
-const pluginApi$2 = {
-  install: (packageName, filepath) =>
-    ipcRenderer$b.invoke("plugin-install", { packageName, filepath }),
-  uninstall: (filepath) => ipcRenderer$b.invoke("plugin-uninstall", filepath),
-};
-
-var pluginApi_1 = pluginApi$2;
-
 /**
  * llmApi.js
  *
@@ -64732,8 +65024,8 @@ const webSocketApi$2 = {
    * @param {object} config { url, headers, subprotocols, credentials }
    * @returns {Promise<{ success, providerName, status } | { error, message }>}
    */
-  connect: (providerName, config) =>
-    ipcRenderer$4.invoke(WS_CONNECT, { providerName, config }),
+  connect: (providerName, config, widgetId = null) =>
+    ipcRenderer$4.invoke(WS_CONNECT, { providerName, config, widgetId }),
 
   /**
    * disconnect
@@ -66108,7 +66400,6 @@ const themeApi$1 = themeApi_1;
 const algoliaApi$1 = algoliaApi_1;
 const openaiApi$1 = openaiApi_1;
 const menuItemsApi$1 = menuItemsApi_1;
-const pluginApi$1 = pluginApi_1;
 const llmApi$1 = llmApi_1;
 const dashboardConfigApi$1 = dashboardConfigApi_1;
 const dashboardRatingsApi = dashboardRatingsApi_1;
@@ -66188,7 +66479,6 @@ function createMainApi$1(extensions = {}) {
     algolia: algoliaApi$1,
     openai: openaiApi$1,
     menuItems: menuItemsApi$1,
-    plugins: pluginApi$1,
     dashboardConfig: dashboardConfigApi$1,
     dashboardRatings: dashboardRatingsApi,
     registryAuth: registryAuthApi$1,
@@ -66241,7 +66531,6 @@ const registryController = registryController$3;
 const algoliaController = algoliaController_1;
 const openaiController = openaiController_1;
 const menuItemsController = menuItemsController_1;
-const pluginController = pluginController_1;
 const llmController = llmController_1;
 const cliController = cliController_1;
 const dashboardConfigController = dashboardConfigController$1;
@@ -66284,7 +66573,6 @@ const themeApi = themeApi_1;
 const algoliaApi = algoliaApi_1;
 const openaiApi = openaiApi_1;
 const menuItemsApi = menuItemsApi_1;
-const pluginApi = pluginApi_1;
 const llmApi = llmApi_1;
 const dashboardConfigApi = dashboardConfigApi_1;
 const registryAuthApi = registryAuthApi_1;
@@ -66346,7 +66634,6 @@ var electron = {
   algoliaController,
   openaiController,
   menuItemsController,
-  pluginController,
   llmController,
   cliController,
   dashboardConfigController,
@@ -66381,7 +66668,6 @@ var electron = {
   algoliaApi,
   openaiApi,
   menuItemsApi,
-  pluginApi,
   llmApi,
   dashboardConfigApi,
   registryAuthApi,