@yaklabs-ai/plugin-protocol 0.55.14 → 0.55.15

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.55.14"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.55.15"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.55.14",
+  "version": "0.55.15",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/index.d.ts

@@ -4193,6 +4193,17 @@ export declare type GlobalContributionId = z.infer<typeof GlobalContributionId>;
 /** Whether `claims` already holds `claim`, under {@link sameClaim}. */
 export declare function hasClaim(claims: readonly PluginCapabilityClaimV1[], claim: PluginCapabilityClaimV1): boolean;
 
+/**
+ * A vendored MCP server as daemon composition hands it to the MCP host: the resolved row plus the
+ * one fact a single manifest cannot state about itself. `bundled` is stamped by composition from
+ * the shipping plugin's load origin (Bonsai ships it), never from the manifest or the plugin id, and
+ * is absent for a server a user-installed plugin ships. The MCP host trusts a server's own tool
+ * annotations only when it is present.
+ */
+export declare type HostedKayAppMcpServer = ResolvedKayAppMcpServer & {
+    readonly bundled?: true;
+};
+
 /**
  * The cookie suffix rule shared by every web-session boundary: whether `host`
  * is `domain` or a subdomain of it. Coined ONCE here - the manifest's scope
@@ -5154,8 +5165,16 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * `ResetTextPass`), which the host counts per reset (#16714). An entry carrying `pass`, read by a
  * host before 0.55.14, fails that host's parse and its reset writes the summary, as for any entry
  * it cannot use. A plugin writing `pass` declares ^0.55.14; no other plugin's range changes.
+ *
+ * 0.55.15 lets `sessions.run` and a workflow's `runAgent` continue a hidden session the same plugin
+ * minted: the optional `continueSessionId` delivers the instructions as that session's next turn
+ * and answers with that turn's outcome. A continuation may set no model, agent, tool roster,
+ * completion, cwd or label. A `rejected` outcome may carry a `code` (`continue_not_owned`,
+ * `continue_override`, `continue_busy`). Additive, but a host before 0.55.15 ignores the field and
+ * mints a new session, so a plugin that continues declares ^0.55.15. The in-repo plugins move to
+ * ^0.55.15 as the SDK's bump procedure says.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.55.14";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.55.15";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -9106,6 +9125,7 @@ export declare const PluginAgentDefinitionPermissionRule: z.ZodObject<{
         ask: "ask";
         auto: "auto";
     }>>;
+    declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 
 export declare type PluginAgentDefinitionPermissionRule = z.infer<typeof PluginAgentDefinitionPermissionRule>;
@@ -9902,6 +9922,7 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
             scheme?: string | undefined;
             resource?: string | undefined;
             mode?: "default" | "allow" | "ask" | "auto" | undefined;
+            declaredReadOnly?: true | undefined;
         }[];
         fallback: {
             effect: "allow" | "deny" | "ask";
@@ -9910,6 +9931,7 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
             scheme?: string | undefined;
             resource?: string | undefined;
             mode?: "default" | "allow" | "ask" | "auto" | undefined;
+            declaredReadOnly?: true | undefined;
         }[];
     };
 } | {
@@ -10210,6 +10232,7 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
             scheme?: string | undefined;
             resource?: string | undefined;
             mode?: "default" | "allow" | "ask" | "auto" | undefined;
+            declaredReadOnly?: true | undefined;
         }[];
         fallback: {
             effect: "allow" | "deny" | "ask";
@@ -10218,6 +10241,7 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
             scheme?: string | undefined;
             resource?: string | undefined;
             mode?: "default" | "allow" | "ask" | "auto" | undefined;
+            declaredReadOnly?: true | undefined;
         }[];
     };
 } | {
@@ -10540,6 +10564,7 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
                 ask: "ask";
                 auto: "auto";
             }>>;
+            declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
         fallback: z.ZodArray<z.ZodObject<{
             effect: z.ZodEnum<{
@@ -10557,6 +10582,7 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
                 ask: "ask";
                 auto: "auto";
             }>>;
+            declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
     }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
@@ -10904,6 +10930,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                     ask: "ask";
                     auto: "auto";
                 }>>;
+                declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
             fallback: z.ZodArray<z.ZodObject<{
                 effect: z.ZodEnum<{
@@ -10921,6 +10948,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                     ask: "ask";
                     auto: "auto";
                 }>>;
+                declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
         }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
@@ -11267,6 +11295,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                         ask: "ask";
                         auto: "auto";
                     }>>;
+                    declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
                 }, z.core.$strict>>;
                 fallback: z.ZodArray<z.ZodObject<{
                     effect: z.ZodEnum<{
@@ -11284,6 +11313,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                         ask: "ask";
                         auto: "auto";
                     }>>;
+                    declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
                 }, z.core.$strict>>;
             }, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
@@ -11664,6 +11694,7 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
                     ask: "ask";
                     auto: "auto";
                 }>>;
+                declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
             fallback: z.ZodArray<z.ZodObject<{
                 effect: z.ZodEnum<{
@@ -11681,6 +11712,7 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
                     ask: "ask";
                     auto: "auto";
                 }>>;
+                declaredReadOnly: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
         }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{

package/dist/index.js

@@ -260,8 +260,9 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.55.14";
+var KAY_PLUGIN_SDK_VERSION = "0.55.15";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.55.14",
   "0.55.13",
   "0.55.12",
   "0.55.11",
@@ -1645,7 +1646,15 @@ function createPermissionsSchemas(canonical) {
     /** Restrict to matching resources (a path glob, or a URI-shaped policy address). */
     resource: NonEmptyString3.optional(),
     /** Restrict the rule to one permission mode; omit to apply in all modes. */
-    mode: z10.enum(["default", "ask", "allow", "auto"]).optional()
+    mode: z10.enum(["default", "ask", "allow", "auto"]).optional(),
+    /**
+     * Match only a call whose target declares itself read-only and whose tool's host accepted
+     * that declaration; omit to ignore it. Today only the `mcp` tool sets it: for a tool its
+     * server annotates `readOnlyHint: true` (and not `destructiveHint: true`), when that server
+     * is connected and ships with a bundled Bonsai plugin. The call's `kind` is unchanged, so a
+     * read-only agent pairs an allow carrying this field with a fallback deny on the same tool.
+     */
+    declaredReadOnly: z10.literal(true).optional()
   });
   function stripRetiredPermissionAsks(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -1890,7 +1899,8 @@ var AGENT_PERMISSION_RULE_FIELDS = [
   "ruleKey",
   "scheme",
   "resource",
-  "mode"
+  "mode",
+  "declaredReadOnly"
 ];
 function createAuthoritySchemas(canonical) {
   const { ArtifactGenerationId: ArtifactGenerationId2, NonEmptyString: NonEmptyString3, UriScheme: UriScheme2, PluginId: PluginId2, LocalContributionId: LocalContributionId2 } = canonical ? canonicalCommonSchemas : common_exports;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.55.14",
+  "version": "0.55.15",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",