@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/persistence/subagent-store.ts

@@ -0,0 +1,125 @@
+/**
+ * Persistence for subagent lifecycle records (the `subagents` table, created by
+ * migration 311).
+ *
+ * This module owns only the durable row shape and raw SQL. The mapping to and
+ * from the manager's `SubagentState` lives in `SubagentManager`, keeping this
+ * layer decoupled from the subagent domain types.
+ */
+
+import { rawAll, rawRun } from "./raw-query.js";
+
+/** A durable subagent lifecycle record (camelCase mirror of the row). */
+export interface SubagentRecord {
+  id: string;
+  parentConversationId: string;
+  conversationId: string;
+  label: string;
+  objective: string;
+  role: string;
+  isFork: boolean;
+  /** Tri-state: null when the spawner left it unset. */
+  sendResultToUser: boolean | null;
+  status: string;
+  error: string | null;
+  createdAt: number;
+  startedAt: number | null;
+  completedAt: number | null;
+  inputTokens: number;
+  outputTokens: number;
+  estimatedCost: number;
+}
+
+/** Raw row shape (snake_case, SQLite stores booleans as 0/1). */
+interface SubagentRow {
+  id: string;
+  parent_conversation_id: string;
+  conversation_id: string;
+  label: string;
+  objective: string;
+  role: string;
+  is_fork: number;
+  send_result_to_user: number | null;
+  status: string;
+  error: string | null;
+  created_at: number;
+  started_at: number | null;
+  completed_at: number | null;
+  input_tokens: number;
+  output_tokens: number;
+  estimated_cost: number;
+}
+
+function rowToRecord(r: SubagentRow): SubagentRecord {
+  return {
+    id: r.id,
+    parentConversationId: r.parent_conversation_id,
+    conversationId: r.conversation_id,
+    label: r.label,
+    objective: r.objective,
+    role: r.role,
+    isFork: r.is_fork === 1,
+    sendResultToUser:
+      r.send_result_to_user == null ? null : r.send_result_to_user === 1,
+    status: r.status,
+    error: r.error,
+    createdAt: r.created_at,
+    startedAt: r.started_at,
+    completedAt: r.completed_at,
+    inputTokens: r.input_tokens,
+    outputTokens: r.output_tokens,
+    estimatedCost: r.estimated_cost,
+  };
+}
+
+/**
+ * Insert or update a subagent record. Called on spawn and on every status
+ * transition; the conflict clause refreshes the mutable lifecycle fields while
+ * the immutable identity/config columns stay as first written.
+ */
+export function upsertSubagentRecord(rec: SubagentRecord): void {
+  rawRun(
+    "subagent:upsertRecord",
+    `INSERT INTO subagents (
+       id, parent_conversation_id, conversation_id, label, objective, role,
+       is_fork, send_result_to_user, status, error, created_at, started_at,
+       completed_at, input_tokens, output_tokens, estimated_cost
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       status = excluded.status,
+       error = excluded.error,
+       started_at = excluded.started_at,
+       completed_at = excluded.completed_at,
+       input_tokens = excluded.input_tokens,
+       output_tokens = excluded.output_tokens,
+       estimated_cost = excluded.estimated_cost`,
+    rec.id,
+    rec.parentConversationId,
+    rec.conversationId,
+    rec.label,
+    rec.objective,
+    rec.role,
+    rec.isFork ? 1 : 0,
+    rec.sendResultToUser == null ? null : rec.sendResultToUser ? 1 : 0,
+    rec.status,
+    rec.error,
+    rec.createdAt,
+    rec.startedAt,
+    rec.completedAt,
+    rec.inputTokens,
+    rec.outputTokens,
+    rec.estimatedCost,
+  );
+}
+
+/** Load every persisted subagent record. Used once at startup to rehydrate. */
+export function loadAllSubagentRecords(): SubagentRecord[] {
+  return rawAll<SubagentRow>("subagent:loadAll", `SELECT * FROM subagents`).map(
+    rowToRecord,
+  );
+}
+
+/** Delete a subagent record once the manager is fully done with it. */
+export function deleteSubagentRecord(id: string): void {
+  rawRun("subagent:deleteRecord", `DELETE FROM subagents WHERE id = ?`, id);
+}

package/src/persistence/worker-control.ts

@@ -3,262 +3,73 @@
  * OS process whose entry point is `worker.ts`.
  *
  * Both the `assistant memory worker` CLI and the daemon lifecycle (when
- * `memory.worker.enabled` is set) need to probe, spawn, and stop this process,
- * so the PID-file bookkeeping lives here in one place.
+ * `memory.worker.enabled` is set) need to probe, spawn, and stop this process.
+ * The generic PID-file mechanics live in `util/worker-process.ts`; this module
+ * binds them to the memory worker's PID path and entry point.
  */
 
-import {
-  closeSync,
-  existsSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  unlinkSync,
-} from "node:fs";
-import { dirname } from "node:path";
-
-import { getCurrentLogFilePath } from "../util/logger.js";
 import { getMemoryWorkerPidPath } from "../util/platform.js";
-
-export interface MemoryWorkerStatus {
-  status: "running" | "not_running";
-  pid?: number;
-}
-
-/** True when `err` is a Node ESRCH error ("no such process"). */
-function isEsrchError(err: unknown): boolean {
-  return (
-    !!err &&
-    typeof err === "object" &&
-    "code" in err &&
-    (err as { code?: unknown }).code === "ESRCH"
-  );
-}
-
-/**
- * Read a PID file and report liveness. A missing or malformed file reports
- * not_running; a file pointing at a dead process is cleaned up and reported as
- * not_running. Used for the worker-process PID file, whose PID is a normal
- * spawned child (never PID 1), so `process.kill(pid, 0)` liveness is reliable.
- */
-function probePidFile(path: string): MemoryWorkerStatus {
-  if (!existsSync(path)) return { status: "not_running" };
-
-  const raw = readFileSync(path, "utf-8").trim();
-  const pid = parseInt(raw, 10);
-  if (!Number.isFinite(pid) || pid <= 0) return { status: "not_running" };
-
-  try {
-    process.kill(pid, 0);
-    return { status: "running", pid };
-  } catch (err: unknown) {
-    if (isEsrchError(err)) {
-      // Stale file — clean it up.
-      try {
-        unlinkSync(path);
-      } catch {
-        // best-effort
-      }
-      return { status: "not_running" };
-    }
-    // Any other error (e.g. EPERM: the process exists but this caller may not
-    // signal it) means the process is alive. Report it running rather than
-    // letting the error escape a status probe.
-    return { status: "running", pid };
-  }
-}
+import {
+  probeWorkerPidFile,
+  spawnWorkerProcess,
+  type SpawnWorkerProcessOptions,
+  stopWorkerProcess,
+  WorkerProcessSpawnError,
+  type WorkerProcessStatus,
+} from "../util/worker-process.js";
 
 /**
  * Inspect the PID file to determine whether the worker process is alive.
  * A stale PID file (pointing at a dead process) is cleaned up and reported
  * as not_running.
  */
-export function probeMemoryWorker(): MemoryWorkerStatus {
-  return probePidFile(getMemoryWorkerPidPath());
+export function probeMemoryWorker(): WorkerProcessStatus {
+  return probeWorkerPidFile(getMemoryWorkerPidPath());
 }
 
-export class MemoryWorkerSpawnError extends Error {}
+export class MemoryWorkerSpawnError extends WorkerProcessSpawnError {}
 
 /**
- * How long {@link spawnMemoryWorkerProcess} waits for the freshly-spawned worker
- * to write its PID file before treating the spawn as failed. A cold
- * `bun run worker.ts` start — new runtime, config load, DB open —
- * routinely takes several seconds, so this is deliberately generous: a premature
- * timeout makes `assistant memory worker start` report failure for a worker that
- * is merely slow, and (because the CLI failure path leaves
- * `memory.worker.enabled` off) leaves that detached worker draining the queue
- * alongside the daemon's synchronous in-process runner — two drainers racing on
- * the same jobs.
- */
-const PID_FILE_WAIT_TIMEOUT_MS = 15_000;
-
-/** Poll interval while waiting for the worker's PID file to appear. */
-const PID_FILE_POLL_INTERVAL_MS = 100;
-
-export interface SpawnMemoryWorkerOptions {
-  /**
-   * Override how long to wait for the worker's PID file, in ms. Defaults to
-   * {@link PID_FILE_WAIT_TIMEOUT_MS}. Primarily a testing seam.
-   */
-  pidWaitTimeoutMs?: number;
-  /**
-   * Override the PID-file poll interval, in ms. Defaults to
-   * {@link PID_FILE_POLL_INTERVAL_MS}. Primarily a testing seam.
-   */
-  pidPollIntervalMs?: number;
-  /**
-   * When the wait times out while the child is still alive (a hung or very slow
-   * start), terminate that child before throwing. Callers that leave
-   * `memory.worker.enabled` off on failure — the CLI `memory worker start` —
-   * MUST set this: otherwise the detached worker keeps coming up and drains the
-   * queue behind the daemon's still-active synchronous runner. The daemon's own
-   * startup spawn leaves the flag on, so a late worker there becomes the sole
-   * drainer; it passes `false` to let that worker live.
-   */
-  terminateOnTimeout?: boolean;
-  /**
-   * Process parentage (default `true`):
-   *   - `true` — the worker is its own session leader and outlives the spawning
-   *     process. The short-lived `assistant memory worker` CLI needs this so the
-   *     worker keeps running after the command returns.
-   *   - `false` — the worker is a direct child of the spawning process. The
-   *     daemon passes this so the worker it owns appears in its process tree
-   *     (`assistant ps`) and is torn down with the daemon. It does not need to
-   *     survive daemon restarts; the daemon re-spawns it on boot.
-   * Either way the child is `unref`'d, so the spawning process never blocks on
-   * it and the worker is tracked via its PID file rather than the handle.
-   */
-  detached?: boolean;
-}
-
-type WorkerReadyOutcome = "ready" | "exited" | "timeout";
-
-/**
- * Wait for the worker to signal readiness by writing its PID file.
+ * Spawn the memory worker as a background process. If a worker is already
+ * running, returns its PID with `alreadyRunning: true` rather than spawning a
+ * second one. Throws {@link MemoryWorkerSpawnError} if the child crashes
+ * during startup or never writes its PID file within the wait window (i.e.
+ * failed to start).
  *
- *   - `"ready"`   — the PID file appeared.
- *   - `"exited"`  — the child exited first (it crashed during startup).
- *   - `"timeout"` — neither happened within `timeoutMs`.
+ * Beyond the generic option semantics documented on
+ * {@link SpawnWorkerProcessOptions}, two flags carry queue-ownership
+ * consequences specific to the memory worker:
  *
- * Polls for the PID file but also watches `exited`, so a crash-on-startup fails
- * fast instead of waiting out the whole timeout.
- */
-async function waitForWorkerPidFile(
-  pidPath: string,
-  exited: Promise<unknown> | undefined,
-  timeoutMs: number,
-  pollIntervalMs: number,
-): Promise<WorkerReadyOutcome> {
-  let childExited = false;
-  const markExited = () => {
-    childExited = true;
-  };
-  // A pending `exited` promise does not keep the event loop alive once the child
-  // is unref'd, so this floating wait won't hang the process.
-  void exited?.then(markExited, markExited);
-
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (existsSync(pidPath)) return "ready";
-    if (childExited) {
-      // The worker could write the PID file and exit in the same tick — re-check
-      // before declaring it dead.
-      return existsSync(pidPath) ? "ready" : "exited";
-    }
-    await Bun.sleep(pollIntervalMs);
-  }
-  return existsSync(pidPath) ? "ready" : "timeout";
-}
-
-/**
- * Spawn the memory worker as a background process. `opts.detached` (default
- * `true`) controls process parentage — see {@link SpawnMemoryWorkerOptions}.
- *
- * If a worker is already running, returns its PID with `alreadyRunning: true`
- * rather than spawning a second one. Throws {@link MemoryWorkerSpawnError} if
- * the child crashes during startup or never writes its PID file within the
- * wait window (i.e. failed to start).
+ *   - `terminateOnTimeout` — callers that leave `memory.worker.enabled` off
+ *     on failure (the CLI `memory worker start`) MUST set this: otherwise the
+ *     detached worker keeps coming up and drains the queue behind the
+ *     daemon's still-active synchronous runner — two drainers racing on the
+ *     same jobs. The daemon's own startup spawn leaves the flag on, so a late
+ *     worker there becomes the sole drainer; it passes `false` to let that
+ *     worker live.
+ *   - `detached` — `true` for the short-lived CLI (the worker outlives the
+ *     command); `false` for the daemon (the worker appears in `assistant ps`
+ *     and is torn down with the daemon).
  */
 export async function spawnMemoryWorkerProcess(
-  opts: SpawnMemoryWorkerOptions = {},
+  opts: SpawnWorkerProcessOptions = {},
 ): Promise<{
   pid: number;
   alreadyRunning: boolean;
 }> {
-  const pidWaitTimeoutMs = opts.pidWaitTimeoutMs ?? PID_FILE_WAIT_TIMEOUT_MS;
-  const pidPollIntervalMs = opts.pidPollIntervalMs ?? PID_FILE_POLL_INTERVAL_MS;
-  const detached = opts.detached ?? true;
-  const current = probeMemoryWorker();
-  if (current.status === "running" && current.pid != null) {
-    return { pid: current.pid, alreadyRunning: true };
-  }
-
-  const pidPath = getMemoryWorkerPidPath();
-  const entry = new URL("../jobs/worker.ts", import.meta.url);
-
-  // Pipe the worker's stderr into the same daily log file the daemon
-  // writes to. The worker's pino logger already writes there directly,
-  // but stderr captures crash traces (uncaught exceptions that bypass
-  // the catch handler) and pino's fallback output if the file logger
-  // fails to initialize. Without this, any such output is lost to
-  // /dev/null and the worker dies silently.
-  let stderrFd: number | "inherit" = "inherit";
   try {
-    const logPath = getCurrentLogFilePath();
-    mkdirSync(dirname(logPath), { recursive: true });
-    stderrFd = openSync(logPath, "a", 0o600);
-  } catch {
-    // If the log file can't be opened, inherit the parent's stderr so
-    // crash output is at least visible to the spawning process.
-  }
-
-  const child = Bun.spawn({
-    cmd: ["bun", "run", entry.pathname],
-    stdio: ["ignore", "ignore", stderrFd],
-    detached,
-  });
-
-  // Close our copy of the log fd — the child has its own.
-  if (typeof stderrFd === "number") {
-    closeSync(stderrFd);
-  }
-
-  // Unreference so the spawning process doesn't wait for the child.
-  child.unref();
-
-  // Wait for the worker to report readiness by writing its PID file (the worker
-  // writes it on startup). The child is `unref`'d, so a worker that is merely
-  // slow keeps coming up after we stop waiting.
-  const outcome = await waitForWorkerPidFile(
-    pidPath,
-    child.exited,
-    pidWaitTimeoutMs,
-    pidPollIntervalMs,
-  );
-
-  if (outcome !== "ready") {
-    // On a plain timeout the child may still be alive (hung or very slow start).
-    // Terminate it when asked so a worker we are reporting as failed cannot come
-    // up later and drain the queue behind the daemon's synchronous runner. On an
-    // early exit the child is already gone, so there is nothing to kill.
-    if (outcome === "timeout" && opts.terminateOnTimeout) {
-      try {
-        child.kill();
-      } catch {
-        // best-effort — the child may already be gone
-      }
+    return await spawnWorkerProcess({
+      pidPath: getMemoryWorkerPidPath(),
+      entry: new URL("../jobs/worker.ts", import.meta.url),
+      workerLabel: "Memory worker",
+      options: opts,
+    });
+  } catch (err) {
+    if (err instanceof WorkerProcessSpawnError) {
+      throw new MemoryWorkerSpawnError(err.message);
     }
-    throw new MemoryWorkerSpawnError(
-      outcome === "exited"
-        ? "Memory worker exited during startup before writing its PID file"
-        : `Memory worker was spawned but did not write its PID file within ${Math.round(
-            pidWaitTimeoutMs / 1000,
-          )}s`,
-    );
+    throw err;
   }
-
-  const pid = parseInt(readFileSync(pidPath, "utf-8").trim(), 10);
-  return { pid, alreadyRunning: false };
 }
 
 /**
@@ -268,10 +79,6 @@ export async function spawnMemoryWorkerProcess(
  * whether anything was stopped. Only throws if `process.kill` itself fails
  * (e.g. EPERM) — a not-running worker is a no-op.
  */
-export function stopMemoryWorkerProcess(): MemoryWorkerStatus {
-  const current = probeMemoryWorker();
-  if (current.status === "running" && current.pid != null) {
-    process.kill(current.pid, "SIGTERM");
-  }
-  return current;
+export function stopMemoryWorkerProcess(): WorkerProcessStatus {
+  return stopWorkerProcess(getMemoryWorkerPidPath());
 }

package/src/plugin-api/event-hub-facade.ts

@@ -0,0 +1,172 @@
+/**
+ * Capability-restricted view of the assistant event hub handed to workspace
+ * plugins through `@vellumai/plugin-api`.
+ *
+ * Plugins receive this facade instead of the raw {@link AssistantEventHub}
+ * singleton. It exposes only the operations a plugin legitimately needs —
+ * subscribing to runtime events, publishing non-host events, and checking for
+ * subscribers — each delegated to the one daemon hub instance so subscriptions
+ * and reads observe the same shared state.
+ *
+ * Two classes of hub method are withheld:
+ *
+ * - **`publish` of host-proxy control events** (`host_bash_*`, `host_file_*`,
+ *   `host_transfer_*`, `host_browser_*`, `host_cu_*`, `host_app_control_*`).
+ *   These drive privileged shell / file / input / browser execution on the
+ *   desktop client; the host proxies gate that execution (risk classification,
+ *   user approval, same-actor binding, pending-interaction registration) before
+ *   publishing. The facade's `publish` rejects them so an in-process plugin
+ *   cannot reach the host machine outside the sandbox.
+ *
+ * - **Methods returning live subscriber entries or mutating hub state**
+ *   (`listClients*`, `getClientById`, `disposeClient`, …). A `ClientEntry`
+ *   carries the subscriber's `callback` — a direct event-delivery primitive — so
+ *   handing one to a plugin would let it deliver a forged host event without
+ *   going through the guarded `publish` at all.
+ *
+ * `subscribe` registers the plugin as an in-process consumer only (never a
+ * device "client"), so it cannot impersonate a real client by id or receive
+ * host-capability-targeted events; its callback is handed an isolated, frozen
+ * snapshot so it cannot mutate an in-flight event a real client receives later
+ * in the same fanout.
+ *
+ * `publish` canonicalizes the caller's event (and options) to their JSON wire
+ * form — the exact representation the client receives — then deep-freezes that
+ * snapshot before checking the type and forwards it. JSON canonicalization
+ * collapses getters / Proxies to inert values and coerces boxed values (e.g.
+ * `new String("host_bash_request")`) to primitives, so the guard cannot be
+ * shown a benign type while the client acts on a host one (time-of-check vs.
+ * time-of-use). Freezing stops a subscriber from mutating the in-flight event
+ * mid-fanout (the hub delivers one object to every subscriber in turn).
+ */
+
+import type { AssistantEvent } from "../runtime/assistant-event.js";
+import {
+  type AssistantEventFilter,
+  type AssistantEventHub,
+  assistantEventHub,
+} from "../runtime/assistant-event-hub.js";
+
+/**
+ * The subset of {@link AssistantEventHub} workspace plugins may use. Picking
+ * method signatures off the class keeps the facade in sync with the hub while
+ * statically withholding everything else.
+ */
+export type PluginEventHub = Pick<
+  AssistantEventHub,
+  "subscribe" | "publish" | "hasSubscribersForEvent"
+>;
+
+/**
+ * Type prefix shared by every daemon-to-client host-proxy control event. Each
+ * host-proxy message type (`host_bash_request`, `host_file_cancel`, …) begins
+ * with it, so a prefix test covers all current and future host-proxy kinds.
+ */
+const HOST_CONTROL_EVENT_TYPE_PREFIX = "host_";
+
+/**
+ * JSON primitives pinned at module-load time — before any user plugin loads and
+ * could swap the globals. A JSON round-trip canonicalizes a published event to
+ * exactly the wire form the client receives, so the guard checks the same
+ * representation the client will act on.
+ */
+const jsonStringify: typeof JSON.stringify = JSON.stringify;
+const jsonParse: typeof JSON.parse = JSON.parse;
+
+/** Canonicalize a value to its JSON wire form. Throws if it is not serializable. */
+function wireSnapshot<T>(value: T): T {
+  return jsonParse(jsonStringify(value)) as T;
+}
+
+/**
+ * Recursively freeze a value (cycle-safe). The hub fans the same event object
+ * out to every subscriber in turn; freezing the snapshot stops a malicious
+ * subscriber — e.g. a plugin that subscribed and then calls `publish` — from
+ * mutating the in-flight event into a host request before a later host-capable
+ * client receives it.
+ */
+function deepFreeze<T>(value: T, seen: WeakSet<object> = new WeakSet()): T {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  for (const key of Object.keys(value)) {
+    deepFreeze((value as Record<string, unknown>)[key], seen);
+  }
+  return Object.freeze(value);
+}
+
+/**
+ * `String.prototype.startsWith` bound at module-load time — before any user
+ * plugin loads and could monkey-patch the prototype — so the host-prefix check
+ * cannot be neutralized by a patched method.
+ */
+const startsWith = Function.prototype.call.bind(
+  String.prototype.startsWith,
+) as (str: string, search: string) => boolean;
+
+/** The blocked event type if `event` is a host-proxy control event, else `undefined`. */
+function hostControlEventType(event: AssistantEvent): string | undefined {
+  const type: unknown = event.message?.type;
+  return typeof type === "string" &&
+    startsWith(type, HOST_CONTROL_EVENT_TYPE_PREFIX)
+    ? type
+    : undefined;
+}
+
+/** The plugin-facing event hub. See module docs. */
+export const pluginAssistantEventHub: PluginEventHub = Object.freeze({
+  subscribe: (subscriber) => {
+    // Plugins subscribe as in-process consumers only — never as device
+    // "clients" — so a plugin cannot impersonate/evict a real client by id or
+    // receive host-capability-targeted events meant for the desktop app. The
+    // filter is canonicalized to inert data so the hub never invokes a
+    // plugin-defined getter while reading `entry.filter` during fanout, and the
+    // callback is handed an isolated, frozen snapshot so it cannot mutate an
+    // in-flight event a real client receives later in the same fanout (the hub
+    // delivers one shared object to every subscriber in turn).
+    let filter: AssistantEventFilter | undefined;
+    try {
+      filter = subscriber.filter ? wireSnapshot(subscriber.filter) : undefined;
+    } catch {
+      filter = undefined;
+    }
+    return assistantEventHub.subscribe({
+      type: "process",
+      filter,
+      callback: (event) => {
+        let isolated: AssistantEvent;
+        try {
+          isolated = deepFreeze(wireSnapshot(event));
+        } catch {
+          return;
+        }
+        return subscriber.callback(isolated);
+      },
+    });
+  },
+
+  publish: async (event, options) => {
+    let snapshot: AssistantEvent;
+    let snapshotOptions: Parameters<AssistantEventHub["publish"]>[1];
+    try {
+      snapshot = deepFreeze(wireSnapshot(event));
+      snapshotOptions = options ? wireSnapshot(options) : undefined;
+    } catch {
+      throw new Error("Plugins may not publish a non-serializable event.");
+    }
+    const blockedType = hostControlEventType(snapshot);
+    if (blockedType !== undefined) {
+      throw new Error(
+        `Plugins may not publish daemon-to-client host-proxy control events (type "${blockedType}").`,
+      );
+    }
+    return assistantEventHub.publish(snapshot, snapshotOptions);
+  },
+
+  hasSubscribersForEvent: (event) =>
+    // Read the caller's `conversationId` once and pass an inert object, so the
+    // hub never reads a plugin-defined getter.
+    assistantEventHub.hasSubscribersForEvent({
+      conversationId: event?.conversationId,
+    }),
+});

package/src/plugin-api/index.ts

@@ -128,7 +128,15 @@ export type {
   AssistantEventHub,
   AssistantEventSubscription,
 } from "../runtime/assistant-event-hub.js";
-export { assistantEventHub } from "../runtime/assistant-event-hub.js";
+// The hub plugins receive is a capability-restricted facade over the daemon
+// singleton (see `event-hub-facade.ts`): plugins may `subscribe` to runtime
+// events (shared subscriber state), `publish` non-host events, and check
+// `hasSubscribersForEvent`. `publish` refuses daemon-to-client host-proxy
+// control events (`host_*`), and methods that return live subscriber callbacks
+// or mutate hub state are withheld — both would let a plugin drive privileged
+// host execution without the host proxies' approval gate.
+export type { PluginEventHub } from "./event-hub-facade.js";
+export { pluginAssistantEventHub as assistantEventHub } from "./event-hub-facade.js";
 export { getModelProfiles } from "./model-profiles.js";
 // Check whether a model or profile can process image input. Accepts a concrete
 // model id, a profile key, or a `ModelProfileInfo`; a bare string is resolved