@yaklabs-ai/plugin-sdk 0.13.9 → 0.13.10

package/README.md

@@ -13,7 +13,7 @@ it under the name your plugin code actually imports:
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.13.9"
+    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.13.10"
   }
 }
 ```
@@ -62,7 +62,7 @@ Every tool the entrypoint registers is declared in the manifest too:
   "description": "Greets people by name.",
   "version": "0.1.0",
   "namespace": "widgets",
-  "compatibility": { "sdk": "^0.13.9" },
+  "compatibility": { "sdk": "^0.13.10" },
   "targets": {
     "kay": {
       "agent": {
@@ -139,6 +139,14 @@ sign-in names one of the plugin's auth services in `authService`; that service m
 one `delegated` scheme, which Bonsai uses to sign the person in to the server. Bonsai declares that
 scheme at runtime; the plugin's code must not declare it again.
 
+From 0.13.10 the manifest schema carries two facts Bonsai reads for its own plugins only; another
+plugin's are ignored, with a load diagnostic. An `external-cli` auth scheme's `cli` says how Bonsai
+connects a local CLI: the `binary`, the `probe` argv (a zero exit is the connection) with the CLI's
+signed-out marker (required with `login`), an optional `login` argv the CLI runs itself, the `hints` a person reads, and the
+`install` argv, which Bonsai only shows or hands to an agent session and never runs. A `kay.agent`
+auth grant on another plugin's sign-in (`google.account`) can carry a `frontDoor`: the door `id` and
+label a product is offered under, and an optional file picker.
+
 `kay-agent/host` is intentionally not published; it is Bonsai's own loading
 machinery, not an authoring API.
 

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-sdk",
-  "version": "0.13.9",
+  "version": "0.13.10",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/disclosure.d.ts

@@ -3918,18 +3918,10 @@ declare function ReturnType_2<Type extends TSchema>(type: Type, options?: TSchem
 /** Creates a deferred ReturnType action. */
 declare function ReturnTypeDeferred<Type extends TSchema>(type: Type, options?: TSchemaOptions): TReturnTypeDeferred<Type>;
 
-/**
- * ---
- * responsibility: The closed vocabulary of why a model run failed, as plain data.
- * owns:
- *   - {@link RunFailureReason}.
- * does_not_own:
- *   - Classifying a failure into a reason (`./run-failure-classifier.ts`), or the engine's
- *     run-error mapping and recovery policy (`@herd/herd-agent`).
- * ---
- */
-/** Provider-neutral factual category for a failed model run. */
-declare type RunFailureReason = "auth" | "content_blocked" | "context_overflow" | "invalid_request" | "model_disabled" | "model_unavailable" | "network" | "overloaded" | "quota_exhausted" | "rate_limit" | "safeguard_block" | "seat_unpaid" | "server_error" | "stream_interrupted" | "timeout" | "unknown";
+/** Observed cause of a failed request or interrupted run. */
+declare const RUN_FAILURE_REASONS: readonly ["auth", "cancelled", "content_blocked", "context_overflow", "invalid_request", "model_disabled", "model_unavailable", "network", "organization_unavailable", "overloaded", "quota_exhausted", "rate_limit", "runtime_interrupted", "safeguard_block", "seat_unpaid", "server_error", "sign_in_required", "stream_interrupted", "timeout", "unknown"];
+
+declare type RunFailureReason = (typeof RUN_FAILURE_REASONS)[number];
 
 declare namespace S {
     export {

package/dist/kay-agent-testing.d.ts

@@ -3829,18 +3829,10 @@ declare function ReturnType_2<Type extends TSchema>(type: Type, options?: TSchem
 /** Creates a deferred ReturnType action. */
 declare function ReturnTypeDeferred<Type extends TSchema>(type: Type, options?: TSchemaOptions): TReturnTypeDeferred<Type>;
 
-/**
- * ---
- * responsibility: The closed vocabulary of why a model run failed, as plain data.
- * owns:
- *   - {@link RunFailureReason}.
- * does_not_own:
- *   - Classifying a failure into a reason (`./run-failure-classifier.ts`), or the engine's
- *     run-error mapping and recovery policy (`@herd/herd-agent`).
- * ---
- */
-/** Provider-neutral factual category for a failed model run. */
-declare type RunFailureReason = "auth" | "content_blocked" | "context_overflow" | "invalid_request" | "model_disabled" | "model_unavailable" | "network" | "overloaded" | "quota_exhausted" | "rate_limit" | "safeguard_block" | "seat_unpaid" | "server_error" | "stream_interrupted" | "timeout" | "unknown";
+/** Observed cause of a failed request or interrupted run. */
+declare const RUN_FAILURE_REASONS: readonly ["auth", "cancelled", "content_blocked", "context_overflow", "invalid_request", "model_disabled", "model_unavailable", "network", "organization_unavailable", "overloaded", "quota_exhausted", "rate_limit", "runtime_interrupted", "safeguard_block", "seat_unpaid", "server_error", "sign_in_required", "stream_interrupted", "timeout", "unknown"];
+
+declare type RunFailureReason = (typeof RUN_FAILURE_REASONS)[number];
 
 declare namespace S {
     export {

package/dist/kay-agent.d.ts

@@ -3021,9 +3021,9 @@ declare const KayPluginManifestV1: z.ZodObject<{
                         responseSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue_3, unknown, z.core.$ZodTypeInternals<JsonValue_3, unknown>>>>;
                     }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        displayName: z.ZodOptional<z.ZodString>;
                         schemes: z.ZodArray<z.ZodString>;
                         localId: z.ZodString;
-                        displayName: z.ZodOptional<z.ZodString>;
                     }, z.core.$strict>>>;
                     dataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -3364,6 +3364,26 @@ declare const KayPluginManifestV1: z.ZodObject<{
                 localId: z.ZodString;
                 kind: z.ZodLiteral<"external-cli">;
                 scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                cli: z.ZodOptional<z.ZodObject<{
+                    binary: z.ZodString;
+                    probe: z.ZodObject<{
+                        args: z.ZodArray<z.ZodString>;
+                        timeoutMs: z.ZodOptional<z.ZodNumber>;
+                        signedOutMarker: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>;
+                    login: z.ZodOptional<z.ZodObject<{
+                        args: z.ZodArray<z.ZodString>;
+                        timeoutMs: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$strict>>;
+                    install: z.ZodOptional<z.ZodObject<{
+                        command: z.ZodString;
+                        args: z.ZodArray<z.ZodString>;
+                    }, z.core.$strict>>;
+                    hints: z.ZodObject<{
+                        install: z.ZodString;
+                        login: z.ZodString;
+                    }, z.core.$strict>;
+                }, z.core.$strict>>;
                 displayName: z.ZodOptional<z.ZodString>;
                 agentHint: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
@@ -3431,6 +3451,18 @@ declare const KayPluginManifestV1: z.ZodObject<{
                         kind: z.ZodLiteral<"record-id">;
                         recordId: z.ZodString;
                     }, z.core.$strict>], "kind">>>;
+                    frontDoor: z.ZodOptional<z.ZodObject<{
+                        id: z.ZodString;
+                        displayName: z.ZodString;
+                        resourcePicker: z.ZodOptional<z.ZodObject<{
+                            effect: z.ZodEnum<{
+                                selection: "selection";
+                                "resource-grant": "resource-grant";
+                            }>;
+                            mimeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                            successNote: z.ZodOptional<z.ZodString>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>>;
                 }, z.core.$strict>>>;
                 storage: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
@@ -3513,6 +3545,18 @@ declare const KayPluginManifestV1: z.ZodObject<{
                         kind: z.ZodLiteral<"record-id">;
                         recordId: z.ZodString;
                     }, z.core.$strict>], "kind">>>;
+                    frontDoor: z.ZodOptional<z.ZodObject<{
+                        id: z.ZodString;
+                        displayName: z.ZodString;
+                        resourcePicker: z.ZodOptional<z.ZodObject<{
+                            effect: z.ZodEnum<{
+                                selection: "selection";
+                                "resource-grant": "resource-grant";
+                            }>;
+                            mimeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                            successNote: z.ZodOptional<z.ZodString>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>>;
                 }, z.core.$strict>>>;
                 storage: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
@@ -3595,6 +3639,18 @@ declare const KayPluginManifestV1: z.ZodObject<{
                         kind: z.ZodLiteral<"record-id">;
                         recordId: z.ZodString;
                     }, z.core.$strict>], "kind">>>;
+                    frontDoor: z.ZodOptional<z.ZodObject<{
+                        id: z.ZodString;
+                        displayName: z.ZodString;
+                        resourcePicker: z.ZodOptional<z.ZodObject<{
+                            effect: z.ZodEnum<{
+                                selection: "selection";
+                                "resource-grant": "resource-grant";
+                            }>;
+                            mimeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                            successNote: z.ZodOptional<z.ZodString>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>>;
                 }, z.core.$strict>>>;
                 storage: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     kind: z.ZodEnum<{
@@ -5766,18 +5822,10 @@ declare function ReturnType_2<Type extends TSchema>(type: Type, options?: TSchem
 /** Creates a deferred ReturnType action. */
 declare function ReturnTypeDeferred<Type extends TSchema>(type: Type, options?: TSchemaOptions): TReturnTypeDeferred<Type>;
 
-/**
- * ---
- * responsibility: The closed vocabulary of why a model run failed, as plain data.
- * owns:
- *   - {@link RunFailureReason}.
- * does_not_own:
- *   - Classifying a failure into a reason (`./run-failure-classifier.ts`), or the engine's
- *     run-error mapping and recovery policy (`@herd/herd-agent`).
- * ---
- */
-/** Provider-neutral factual category for a failed model run. */
-declare type RunFailureReason = "auth" | "content_blocked" | "context_overflow" | "invalid_request" | "model_disabled" | "model_unavailable" | "network" | "overloaded" | "quota_exhausted" | "rate_limit" | "safeguard_block" | "seat_unpaid" | "server_error" | "stream_interrupted" | "timeout" | "unknown";
+/** Observed cause of a failed request or interrupted run. */
+declare const RUN_FAILURE_REASONS: readonly ["auth", "cancelled", "content_blocked", "context_overflow", "invalid_request", "model_disabled", "model_unavailable", "network", "organization_unavailable", "overloaded", "quota_exhausted", "rate_limit", "runtime_interrupted", "safeguard_block", "seat_unpaid", "server_error", "sign_in_required", "stream_interrupted", "timeout", "unknown"];
+
+declare type RunFailureReason = (typeof RUN_FAILURE_REASONS)[number];
 
 declare namespace S {
     export {

package/dist/kay-app.d.ts

@@ -7641,18 +7641,10 @@ declare function ReturnType_2<Type extends TSchema>(type: Type, options?: TSchem
 /** Creates a deferred ReturnType action. */
 declare function ReturnTypeDeferred<Type extends TSchema>(type: Type, options?: TSchemaOptions): TReturnTypeDeferred<Type>;
 
-/**
- * ---
- * responsibility: The closed vocabulary of why a model run failed, as plain data.
- * owns:
- *   - {@link RunFailureReason}.
- * does_not_own:
- *   - Classifying a failure into a reason (`./run-failure-classifier.ts`), or the engine's
- *     run-error mapping and recovery policy (`@herd/herd-agent`).
- * ---
- */
-/** Provider-neutral factual category for a failed model run. */
-declare type RunFailureReason = "auth" | "content_blocked" | "context_overflow" | "invalid_request" | "model_disabled" | "model_unavailable" | "network" | "overloaded" | "quota_exhausted" | "rate_limit" | "safeguard_block" | "seat_unpaid" | "server_error" | "stream_interrupted" | "timeout" | "unknown";
+/** Observed cause of a failed request or interrupted run. */
+declare const RUN_FAILURE_REASONS: readonly ["auth", "cancelled", "content_blocked", "context_overflow", "invalid_request", "model_disabled", "model_unavailable", "network", "organization_unavailable", "overloaded", "quota_exhausted", "rate_limit", "runtime_interrupted", "safeguard_block", "seat_unpaid", "server_error", "sign_in_required", "stream_interrupted", "timeout", "unknown"];
+
+declare type RunFailureReason = (typeof RUN_FAILURE_REASONS)[number];
 
 /**
  * A durable runtime notice: the daemon telling the HUMAN, in the transcript,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-sdk",
-  "version": "0.13.9",
+  "version": "0.13.10",
   "description": "The Kay plugin SDK — types and helpers for authoring a Kay directory plugin.",
   "author": "YakLabs",
   "type": "module",

package/skills/directory-plugin-authoring/SKILL.md

@@ -92,6 +92,12 @@ It never reads the declared files or applies the roster's rules: a missing entry
 file, an `activate()` that throws, the disclosure audit, and an id another installed plugin already
 claims all show only after enabling, in `read plugin://<id>`.
 
+Two manifest fields parse for any plugin but work for Bonsai's own plugins only (SDK 0.13.10): an
+`external-cli` scheme's `cli` (how a local CLI is probed, signed in to and installed) and an auth
+grant's `frontDoor` (a product door onto a shared sign-in). Bonsai drops either from any other
+plugin at load, with a `release-only-connect-facts-ignored` diagnostic, so do not reach for them in
+a plugin you install yourself.
+
 ## The SDK resolution contract
 
 - Plugin source imports `@bonsai/plugin-sdk/<subpath>` as a **bare specifier**