@zync-sh/plugin-sdk 2.0.0-beta.1 → 2.1.0-beta.1

package/README.md

@@ -2,16 +2,18 @@
 
 Public authoring types for Manifest v2 plugins. This package lives in the Zync repository but has its own npm version and release lifecycle.
 
-Install the prerelease as a development dependency:
+The working tree now targets API **2.1** (`2.1.0-beta.1`, not yet published). It adds `sshCommand.execute(paneInstanceId, { program, args, expectedConnectionToken? })`, requiring `ssh.command.execute` and `engines.pluginApi: "^2.1.0"`. The returned `connectionToken` must be carried into commands following a confirmation so reconnect/rebind cannot silently change their destination. Commands use the SSH account's full authority; this is not a read-only or PM2-only permission. API 2.0 hosts reject plugins requiring this addition.
+
+While API 2.1 is unpublished, install the local SDK as a development dependency:
 
 ```sh
-npm install --save-dev @zync-sh/plugin-sdk@beta
+npm install --save-dev /path/to/zync/packages/plugin-sdk
 ```
 
-To try the local package from another project, install it by path:
+The published `@beta` release is currently **2.0.0-beta.1** and does not include the 2.1 SSH command API. Once SDK 2.1 is published and the `beta` tag points to it, use:
 
 ```sh
-npm install --save-dev /path/to/zync/packages/plugin-sdk
+npm install --save-dev @zync-sh/plugin-sdk@beta
 ```
 
 Zync supplies the `zync` object when it starts a plugin worker or pane. Do not bundle an SDK runtime into the plugin.

package/RELEASE.md

@@ -9,7 +9,9 @@ Before a beta npm SDK release:
 1. Run `npm run sdk:release-check` from the Zync repository root. It checks type contracts, validator cases, the starter build, and the exact npm package contents.
 2. Run the native plugin tests and the full agent regression suite.
 3. Run `node check.mjs` in the sibling `zync-plugin-channel-examples` project to validate, sign, and verify stable and beta builds in a disposable registry.
-4. Review the exact SDK tarball, production dependency audit, license, and documentation. Publish the prerelease with the `beta` npm tag, never `latest`, and install it in a clean project to verify the CLI and exported types.
+4. Review the exact SDK tarball, production dependency audit, license, and documentation. Publish the prerelease with the `beta` npm tag and install it in a clean project to verify the CLI and exported types. Check the actual registry tags after publishing; npm initialized `latest` to the beta on this package's first release despite `--tag beta` and rejected removal of `latest`. Do not describe `latest` as stable until a stable release replaces that tag.
+
+`@zync-sh/plugin-sdk@2.0.0-beta.1` was published under `beta` on 2026-09-25. A clean npm install verified the CLI and exported runtime helpers. npm also currently resolves `latest` to this first beta; install `@beta` explicitly until stable promotion.
 
 The SDK beta is an authoring tool, not a production marketplace launch. Before promoting it to `latest` or calling the marketplace production-ready, deploy the signed test builds to a protected HTTPS staging registry. Manually verify marketplace listing, opt-in beta update, switch back to stable, permission review, and retained-version rollback in the desktop app. Record the tested Zync build, SDK version, registry version, and package digests; complete the external-plugin smoke test and independent security review. Local signing tests do not substitute for these checks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zync-sh/plugin-sdk",
-  "version": "2.0.0-beta.1",
+  "version": "2.1.0-beta.1",
   "description": "Manifest v2 authoring types and preflight validation for Zync plugins",
   "type": "module",
   "dependencies": { "semver": "^7.0.0" },

package/validate.js

@@ -18,7 +18,7 @@ export const knownPermissionIds = Object.freeze([
 ]);
 
 const knownPermissions = new Set(knownPermissionIds);
-export const pluginApiVersion = '2.0.0';
+export const pluginApiVersion = '2.1.0';
 const identifierPattern = /^[A-Za-z0-9_.-]+$/;
 const semverPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
 const contributionPermissions = {

package/worker.d.ts

@@ -69,4 +69,12 @@ export interface ZyncWorkerApi {
     list(paneInstanceId: string, relativePath?: string): Promise<PluginFileEntry[]>;
     readText(paneInstanceId: string, relativePath: string): Promise<string>;
   };
+  /** Requires ssh.command.execute. Runs with the SSH account's full authority on POSIX servers.
+   * Arguments are quoted individually; no shell expansion. One command per pane, 20s, 2 MiB output.
+   * Closing/rebinding a pane cancels the channel, not necessarily remote side effects. */
+  sshCommand: {
+    execute(paneInstanceId: string, request: { program: string; args: string[]; expectedConnectionToken?: string }): Promise<{
+      stdout: string; stderr: string; exitCode: number; connectionToken: string;
+    }>;
+  };
 }