cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/shortcut-presentation.js

@@ -0,0 +1,292 @@
+"use strict";
+var CordisXShortcutPresentation = (() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+  // src/renderer/current-user/shortcut.ts
+  var shortcut_exports = {};
+  __export(shortcut_exports, {
+    readShortcutPresentation: () => readShortcutPresentation
+  });
+
+  // src/current-user-native-pins.ts
+  var CURRENT_USER_NATIVE_PINS = Object.freeze(
+    [
+      Object.freeze({
+        appVersion: "26.903.61454",
+        buildNumber: "8378",
+        buildFlavor: "prod",
+        module: "app://-/assets/app-initial-1b87ae739476.js",
+        clientExport: "gJt"
+      }),
+      Object.freeze({
+        appVersion: "26.908.40834",
+        buildNumber: "8881",
+        buildFlavor: "prod",
+        module: "app://-/assets/app-initial-9b95fa538c62.js",
+        clientExport: "mJt"
+      }),
+      Object.freeze({
+        appVersion: "26.908.70816",
+        buildNumber: "9275",
+        buildFlavor: "prod",
+        module: "app://-/assets/app-initial-4d7ea7f81c2d.js",
+        clientExport: "mJt"
+      })
+    ]
+  );
+
+  // src/current-user-native-account.ts
+  async function readPinnedNativeAccount(capability, native, signal) {
+    signal.throwIfAborted();
+    const unavailable = (nativeAccountReason) => {
+      throw Object.assign(new Error("native account unavailable"), { nativeAccountReason });
+    };
+    let remove = () => {
+    };
+    const aborted = new Promise((_, reject) => {
+      const onAbort = () => reject(new Error("native account unavailable"));
+      signal.addEventListener("abort", onAbort, { once: true });
+      remove = () => signal.removeEventListener("abort", onAbort);
+    });
+    try {
+      const operation = (async () => {
+        if (capability !== "legacy-post") {
+          const inputs = native.TW?.accessInputs;
+          if (typeof inputs?.readAccountInfo !== "function") return unavailable("typed-input-missing");
+          let result;
+          try {
+            const invocation = inputs.readAccountInfo();
+            let released = false;
+            const release = () => {
+              if (released) return;
+              released = true;
+              const dispose = Symbol.dispose;
+              if (dispose !== void 0) {
+                const cleanup = invocation[dispose];
+                if (typeof cleanup === "function") cleanup.call(invocation);
+              }
+            };
+            signal.addEventListener("abort", release, { once: true });
+            try {
+              signal.throwIfAborted();
+              result = await invocation;
+              signal.throwIfAborted();
+            } finally {
+              signal.removeEventListener("abort", release);
+              release();
+            }
+          } catch {
+            return unavailable("typed-read-exception");
+          }
+          if (result?.status === "error") return unavailable("typed-read-error");
+          if (result?.status === "unavailable") {
+            const reason = result.reason;
+            if (typeof reason === "string" && ["retired", "connection", "identity", "unsupported-auth"].includes(reason)) {
+              return unavailable(`typed-${reason}`);
+            }
+          }
+          if (result?.status !== "ready") return unavailable("typed-not-ready");
+          return result.data;
+        }
+        const client = native.gJt?.getInstance?.();
+        if (!client?.post) return unavailable("legacy-input-missing");
+        try {
+          return (await client.post("vscode://codex/account-info", void 0, void 0, signal)).body;
+        } catch {
+          return unavailable("legacy-read-exception");
+        }
+      })();
+      const value = await Promise.race([operation, aborted]);
+      signal.throwIfAborted();
+      return value;
+    } finally {
+      remove();
+    }
+  }
+
+  // src/renderer/current-user/bitmap.ts
+  var INLINE_AVATAR = /^data:image\/(?:png|jpeg|webp);base64,(?=[A-Za-z0-9+/])(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![\s\S])/;
+  function inlineAvatar(value) {
+    return typeof value === "string" && value.length <= 65536 && INLINE_AVATAR.test(value) ? value : void 0;
+  }
+  async function canonicalAvatar(response, signal) {
+    const mediaType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    if (!response.ok || !["image/png", "image/jpeg", "image/webp", "image/gif"].includes(mediaType ?? "")) {
+      await response.body?.cancel();
+      return void 0;
+    }
+    const length = Number(response.headers.get("content-length"));
+    if (length > 1048576 || !response.body) {
+      await response.body?.cancel();
+      return void 0;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      for (; ; ) {
+        signal.throwIfAborted();
+        const next = await reader.read();
+        if (next.done) break;
+        size += next.value.byteLength;
+        if (size > 1048576) return void 0;
+        chunks.push(new Uint8Array(next.value));
+      }
+    } finally {
+      await reader.cancel().catch(() => {
+      });
+      reader.releaseLock();
+    }
+    signal.throwIfAborted();
+    const bitmap = await createImageBitmap(new Blob(chunks, { type: mediaType ?? "image/png" }), {
+      resizeWidth: 96,
+      resizeHeight: 96,
+      resizeQuality: "high"
+    });
+    try {
+      signal.throwIfAborted();
+      const canvas = new OffscreenCanvas(96, 96);
+      const context = canvas.getContext("2d");
+      if (!context) return void 0;
+      context.drawImage(bitmap, 0, 0, 96, 96);
+      const blob = await canvas.convertToBlob({ type: "image/png" });
+      if (blob.size > 49128) return void 0;
+      const bytes = new Uint8Array(await blob.arrayBuffer());
+      signal.throwIfAborted();
+      const encoded = btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(""));
+      return inlineAvatar(`data:image/png;base64,${encoded}`);
+    } finally {
+      bitmap.close();
+    }
+  }
+
+  // src/renderer/current-user/native.ts
+  var CURRENT_USER_NATIVE_PIN = CURRENT_USER_NATIVE_PINS[0];
+  var object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  function identity(value) {
+    const info = object(value);
+    return typeof info.accountId === "string" && info.accountId && typeof info.userId === "string" && info.userId ? JSON.stringify([info.accountId, info.userId]) : void 0;
+  }
+  function avatarRequest(value) {
+    if (typeof value !== "string" || value.length > 8192) return void 0;
+    try {
+      const url = new URL(value);
+      if (url.protocol !== "https:" || url.username || url.password || url.hash) return void 0;
+      const authenticated = url.hostname === "chatgpt.com" && ["/backend-api/estuary/content", "/backend-api/estuary/public_content/enc"].some((path) => url.pathname === path || url.pathname.startsWith(`${path}/`));
+      const publicImage = [
+        "cdn.oaistatic.com",
+        "images.openai.com",
+        "lh3.googleusercontent.com",
+        "files.oaiusercontent.com"
+      ].includes(url.hostname);
+      return authenticated || publicImage ? { url: url.href, authenticated } : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  async function readNativeCurrentUser(signal, load = (path) => import(
+    /* @vite-ignore */
+    path
+  )) {
+    const page = globalThis;
+    const unavailable = { status: "unavailable", reason: "host-unavailable" };
+    if (page.codexWindowType !== "electron" || page.location?.href !== "app://-/index.html") return unavailable;
+    try {
+      const pin = object(await page.electronBridge?.getSentryInitOptions?.());
+      const adapter = CURRENT_USER_NATIVE_PINS.find(
+        (candidate) => pin.appVersion === candidate.appVersion && pin.buildNumber === candidate.buildNumber && pin.buildFlavor === candidate.buildFlavor
+      );
+      if (!adapter) return unavailable;
+      const module = await load(adapter.module);
+      const native = adapter === CURRENT_USER_NATIVE_PIN ? module : {
+        gJt: module.mJt,
+        eSt: async () => void 0,
+        jKt: module.Uqt,
+        NKt: module.Gqt
+      };
+      if (!native.gJt?.getInstance || !native.eSt || !native.jKt?.safeGet || !native.NKt) return unavailable;
+      const client = native.gJt.getInstance();
+      const account = () => readPinnedNativeAccount(adapter === CURRENT_USER_NATIVE_PIN ? "legacy-post" : "typed", module, signal);
+      const before = identity(await account());
+      if (!before) return { status: "unavailable", reason: "signed-out" };
+      const [meValue, codexValue] = await Promise.all([
+        native.eSt(signal).catch(() => void 0),
+        native.jKt.safeGet("/wham/profiles/me", { signal }).catch(() => void 0)
+      ]);
+      const me = object(meValue), profile = object(object(codexValue).profile);
+      const displayName = [profile.display_name, me.name].find((value) => typeof value === "string" && value.trim());
+      const request = avatarRequest(profile.profile_picture_url ?? me.picture ?? me.profile_picture_url);
+      let avatar;
+      if (request) {
+        try {
+          avatar = await canonicalAvatar(
+            await client.fetch(request.url, {
+              headers: request.authenticated ? native.NKt() : {},
+              signal
+            }),
+            signal
+          );
+        } catch {
+        }
+      }
+      signal.throwIfAborted();
+      if (identity(await account()) !== before) return unavailable;
+      return {
+        status: "available",
+        identity: before,
+        ...displayName ? { displayName } : {},
+        ...avatar ? { avatar } : {}
+      };
+    } catch {
+      return unavailable;
+    }
+  }
+
+  // src/shortcuts/presentation.ts
+  function presentation(value) {
+    if (!value || typeof value !== "object" || value.status !== "available") {
+      return { status: "unavailable" };
+    }
+    const avatar = value.avatar;
+    return {
+      status: "available",
+      ...typeof avatar === "string" && avatar.length <= 65536 && /^data:image\/(?:png|jpeg|webp);base64,[A-Za-z0-9+/]+={0,2}$/.test(avatar) ? { avatar } : {}
+    };
+  }
+
+  // src/renderer/current-user/shortcut.ts
+  async function readShortcutPresentation() {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 2800);
+    try {
+      return await Promise.race([
+        readNativeCurrentUser(controller.signal).then((value) => presentation(value)),
+        new Promise(
+          (resolve) => controller.signal.addEventListener("abort", () => resolve({ status: "unavailable" }), { once: true })
+        )
+      ]);
+    } catch {
+      return { status: "unavailable" };
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+    }
+  }
+  return __toCommonJS(shortcut_exports);
+})();

package/dist/skills/cordisx/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: cordisx
+description: Route and complete CordisX user requests from one goal-oriented entry point. Use for installation, startup, configuration, Marketplace sources, installing or managing plugins, current CordisX documentation, experience-based Q&A, and creating, updating, debugging, or verifying a CordisX plugin. Select the relevant bundled guidance without asking the user to choose a lower-level Skill.
+---
+
+# CordisX
+
+Start from the user's goal. Route to the smallest relevant bundled Skill, then
+complete the work in the current task. Do not expose Skill selection as a
+prerequisite or create another task merely to invoke a specialist.
+
+The bundled revision and owning source for this entry are recorded in
+[version.json](version.json).
+
+## Choose guidance
+
+- For installation, startup, configuration, Marketplace sources, installed
+  plugin management, current or version-specific behavior, commands,
+  compatibility, architecture, or public contracts, read
+  [cordisx-docs](../cordisx-docs/SKILL.md).
+- For practical experience, known pitfalls, contextual tradeoffs, and
+  evidence-backed workarounds, read
+  [cordisx-qa](../cordisx-qa/SKILL.md).
+- For plugin feasibility, creation, implementation, debugging, packaging, or
+  verification, read
+  [cordisx-plugin-development](../cordisx-plugin-development/SKILL.md).
+- For a mixed request, use each relevant guide in dependency order. Resolve
+  product facts before applying experience or changing plugin code.
+
+If a referenced bundled Skill is unavailable, say which guidance is missing
+and use the owning public documentation when it is accessible. Do not pretend
+that every third-party Skill picker hides or automatically selects these
+entries; this routing behavior applies when the `cordisx` entry is invoked.
+Keep the sibling Skills normally discoverable and do not disable implicit Skill
+selection.
+
+## Preserve source roles
+
+- Treat versioned documentation and public contracts as authority for product
+  behavior. Do not turn a workaround or one user's observation into a product
+  guarantee.
+- Treat Q&A as contextual experience. State its applicability and evidence,
+  and link the governing documentation when a rule has become normative.
+- Keep repository contribution conventions separate from plugin admission.
+  A third-party plugin may use a legal unscoped package name or the publisher's
+  own scope; CordisX repository branches, scopes, approvals, and release steps
+  apply only when that repository actually owns the work.
+- Treat the user's requested goal as authorization for its normal necessary
+  steps within the active tool, repository, and Host boundaries; do not ask for
+  confirmation again at every reversible step. Do not infer unrelated grants
+  or extend the request to an App launch, upload, publication, or release.
+
+## Answer and act
+
+For an informational request, remain read-only unless the user asks for a
+change. For an installation, startup, configuration, source, or plugin-management
+request, follow the version-compatible Docs instructions and perform the normal
+steps covered by the request. Reuse available context and authorization instead
+of asking the user to repeat setup details or approve each routine step.
+
+For implementation, make the smallest supported change and select evidence
+that matches the claim. Do not launch a native App merely because CordisX is
+involved; native evidence is needed only for behavior that depends on the real
+native Host path and when launching it is authorized.
+
+Report state precisely. Keep these terms distinct:
+
+- **implemented**: the source change exists;
+- **tested**: named checks passed for the stated scope;
+- **merged**: the owning repository accepted the change;
+- **published**: a release artifact is available from its distribution source;
+- **installed**: the relevant environment contains that artifact.
+
+Do not imply a later state from an earlier one.

package/dist/skills/cordisx/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "CordisX"
+  short_description: "Route and complete CordisX requests from one entry"
+  default_prompt: "Use $cordisx to understand my CordisX goal, select the relevant bundled guidance, and complete the request without asking me to choose a lower-level Skill."

package/dist/skills/cordisx/version.json

@@ -0,0 +1,4 @@
+{
+  "version": "2026-09-20.1",
+  "source": "https://github.com/cordisx/cordisx/tree/main/skills/cordisx"
+}

package/dist/skills/cordisx-docs/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: cordisx-docs
+description: Find standard CordisX documentation for usage, configuration, supported capabilities, and versioned plugin contracts. Use when a CordisX answer or action needs an authoritative reference; practical experience belongs to cordisx-qa.
+---
+
+# CordisX Documentation
+
+Read the [task index](https://raw.githubusercontent.com/cordisx/docs/main/skills/index.md)
+and follow only the route relevant to the user's request. Fetch the linked owner
+document rather than answering product commands from memory or downloading the
+whole documentation set.
+
+- For adoption, follow the Host entry and preserve existing setup. Do not run
+  installation merely because the user asks a question.
+- For an existing plugin, use the Marketplace and the user's selected source.
+  Read that plugin's own guide for service configuration and login.
+- For practical questions, workarounds, or lessons from earlier use, consult
+  `cordisx-qa` when available. Use the owner documentation to check any product
+  claims; a reported experience does not redefine the contract.
+- For plugin implementation, use `cordisx-plugin-development` when available;
+  this Skill supplies references, not a duplicate development workflow.
+- If the user provides a private entry, read it only in the authorized context.
+  Keep private URLs, source metadata, and credentials out of public files.
+
+Read product guides, not repository maintenance rules, for end-user tasks.
+Distinguish required compatibility and runtime constraints from optional advice
+and first-party conventions. Do not require third-party developers to adopt
+CordisX's organization scope, repository layout, approval process, or release
+workflow. Consult contribution rules only when the user is contributing to that
+specific repository. If a companion Skill is unavailable, follow the relevant
+owner guide directly; do not make installing another Skill a prerequisite.
+
+Resolve relative links against the containing document's URL. A prerequisite
+already completed need not be performed again. An inaccessible link is a missing
+reference, not permission to guess endpoints or commands. Documentation on `main`
+may be newer than the installed CLI; check help and the installed release tag
+before applying version-sensitive instructions.
+
+Distinguish installation, running Host, plugin activation, permission state, and
+provider-account login. Documentation discovery does not authorize additional
+effects. Cite the source used and report what was actually verified.

package/dist/skills/cordisx-docs/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "CordisX Docs"
+  short_description: "Find standard CordisX documentation"
+  default_prompt: "Use $cordisx-docs to find the authoritative guide for my CordisX question."

package/dist/skills/cordisx-docs/upstream.json

@@ -0,0 +1,10 @@
+{
+  "repository": "https://github.com/cordisx/docs",
+  "commit": "4841581393a702e13fecd9d9993d0c082b608fc0",
+  "path": "skills/cordisx-docs",
+  "files": {
+    "SKILL.md": "sha256:fc6ce59c4fb97ef4fa13f66ab1f3cd423bf827dc57080cfc37db19ab4bc2ab10",
+    "agents/openai.yaml": "sha256:bf1757305e80c3b91bdee0795d1410c321b88bba31517f28a115a1f46f3bfce6",
+    "version.json": "sha256:6580bc014f8e4e5083a2f616d744bd20035fe3819f5fbadeb05c9ec3010aba52"
+  }
+}

package/dist/skills/cordisx-docs/version.json

@@ -0,0 +1,4 @@
+{
+  "version": "2026-09-20.1",
+  "source": "https://github.com/cordisx/docs/tree/main/skills/cordisx-docs"
+}

package/dist/skills/cordisx-feedback/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: cordisx-feedback
+description: Collect a private, bounded CordisX diagnostic bundle when the user wants to report, package, or investigate a CordisX problem, startup failure, injection issue, cleanup warning, or suspicious log sequence. Use this Skill when the user asks to prepare feedback or logs for maintainers, including when they only describe a screenshot. It creates local diagnostics for review; it never uploads or sends them without separate explicit authorization.
+---
+
+# CordisX Feedback
+
+Use `cordisx feedback` to prepare a local diagnostic bundle without collecting
+conversation content, credentials, complete configuration, or unrelated files.
+
+Reuse supplied context and ask only for a short user description, approximate
+time, or app/profile when the CLI cannot resolve them. A screenshot
+transcription is a `user_report`, never a product log.
+
+## Collect
+
+Check that the installed CLI supports `cordisx feedback`, then normally run:
+
+```bash
+cordisx feedback collect --recent --json
+```
+
+Add a bounded app/profile, time, or `--description-file` only when needed. Do
+not run `cordisx config`, scan HOME or a project, or use unbounded `cordisx
+logs`; the CLI owns selection, redaction, validation, and limits.
+
+## Preview
+
+Read the manifest summary and explain included and excluded categories, missing
+or truncated sources, selected time window and correlation confidence,
+redactions, final size, and local staging directory. A transient target-list
+fetch failure followed by ready and injected is not an injection failure;
+describe later cleanup degradation separately.
+
+## Export
+
+Only after the user asks for an archive, run:
+
+```bash
+cordisx feedback export <bundle-directory> --json
+```
+
+Show the local archive and verification result. Do not upload, message, create
+an issue, or contact a maintainer without separately explicit authorization.
+
+On failure, report the CLI's safe error. Do not substitute raw file collection,
+delete locks, restart CordisX, change config, or request broader access.

package/dist/skills/cordisx-feedback/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "CordisX Feedback"
+  short_description: "Collect private local CordisX diagnostics"
+  default_prompt: "Use $cordisx-feedback to collect and review a local, privacy-filtered CordisX feedback bundle."

package/dist/skills/cordisx-feedback/version.json

@@ -0,0 +1,4 @@
+{
+  "version": "2026-09-21.1",
+  "source": "https://github.com/cordisx/cordisx/tree/main/skills/cordisx-feedback"
+}

package/dist/skills/cordisx-plugin-development/SKILL.md

@@ -7,17 +7,32 @@ description: Assess the feasibility of a requested CordisX customization, then c
 
 Build plugins against the public CordisX contract. Keep the Host responsible for shared UI and runtime policy; keep business behavior and visual design in the owning plugin. Bundled revision and owning source are recorded in [version.json](version.json); the launching CLI deploys this complete tree by content digest.
 
+For current product facts and version compatibility, read
+[cordisx-docs](../cordisx-docs/SKILL.md). For evidence-backed user experience,
+known pitfalls, or recording a Q&A entry, read
+[cordisx-qa](../cordisx-qa/SKILL.md). Do not copy either source into this Skill.
+
 ## Read the relevant references
 
 - Assess any requested product behavior before scaffolding or editing: [feasibility-assessment.md](references/feasibility-assessment.md)
 - Choose or inspect the project shape and development loop: [project-layouts-and-development.md](references/project-layouts-and-development.md)
 - Change plugin-owned styles or CSS imports: [css-and-lifecycle.md](references/css-and-lifecycle.md)
 - Start or package a plugin: [plugin-authoring.md](references/plugin-authoring.md)
-- Add any Manager page, contribution, action, collection, or icon: [ui-system.md](references/ui-system.md)
+- Add notifications or any Manager page, contribution, action, collection, or icon: [ui-system.md](references/ui-system.md)
 - Add or change plugin configuration: [schema-configuration.md](references/schema-configuration.md)
 - Run or deliver the result: [verification.md](references/verification.md)
 - Continue work inside an already-running development session: [live-plugin-development.md](references/live-plugin-development.md)
 
+## Native plugin debugging boundary
+
+When a claim requires the CordisX-launched native Host, use the active
+environment's authorized CordisX development launch, Host injection, logs,
+permission diagnostics, and debugging mechanisms. Tool availability is not
+authorization: respect explicit user, Host, and tool restrictions, and never
+use another access path to bypass a denial. Read
+[the debugging workflow and permission boundary](references/live-plugin-development.md#choose-debugging-tools-before-accessing-the-host)
+before accessing the running Host.
+
 ## Core contract
 
 - Plugins provide manifests, localized labels, structured schemas, state, commands, icons, contribution descriptors, and React bodies in documented plugin-owned seats.
@@ -34,12 +49,12 @@ Build plugins against the public CordisX contract. Keep the Host responsible for
 2. Proceed directly for a supported plugin request. If it needs a missing CordisX or Cordis capability, do not fake it with private Host state; explain the gap and smallest public contribution path. A plugin request alone does not authorize Host-core changes or an external PR.
 3. Select the creation mode from the user's project: one standalone plugin, a dedicated multi-plugin workspace, or `.cordisx/plugins/<id>` embedded in an existing business project. Preserve an existing package-manager workspace instead of rebuilding the project around CordisX.
 4. If `CORDISX_DEV_ENTRY` is set, use that exact legacy single-plugin entry and running launch. For config-driven development, use the explicit or discovered project config and all enabled entries. Do not start a second Vite or Electron process for each plugin.
-5. When creating a plugin, infer a concise product slug and use the maintained `create-cordisx-plugin` generator in the selected mode. Keep the scaffolding command as an implementation detail unless the user asks for it.
+5. When creating a plugin, infer a concise product slug and use the maintained `create-cordisx-plugin` generator in the selected mode. A third-party package may use a legal unscoped name or a scope controlled by its publisher; do not impose CordisX repository naming or release conventions. Keep the scaffolding command as an implementation detail unless the user asks for it.
 6. Define the manifest, localized product copy, contributions, config schema, permissions, React boundaries, and lifecycle behavior. Put activation effects under Cordis ownership and keep ESM top-level evaluation free of product side effects.
 7. Keep visual choices inside Host-supported components, tokens, semantic roles, and controlled visual seats. Locate a maintained example, but do not copy generated fixtures wholesale.
-8. Add focused contract, React, and lifecycle tests before visual inspection.
-9. Run the project through `cordisx dev`. Verify automatic file updates and, when relevant, the Manager's development reload for one active local plugin.
-10. Exercise the real isolated native `app://` path for native claims; use Playground evidence only for the behavior it actually hosts.
+8. Choose focused checks for the changed behavior. Show a useful preview early; add regression tests where they catch a real contract, React, or lifecycle failure, without requiring new tests for every reversible visual edit.
+9. Run `cordisx dev` only when live development evidence is relevant and the launch is authorized. Verify automatic file updates and, when relevant, the Manager's development reload for one active local plugin.
+10. Exercise the real isolated native `app://` path only for native claims; use Playground evidence only for the behavior it actually hosts. Do not launch an App solely for prose, metadata, or static checks.
 11. For production delivery, use the generated `cordisx/vite` helper config and retain its complete indexed Vite ESM graph. Do not duplicate the production Rollup policy or flatten dynamic imports, CSS, or static assets into a hand-built single file.
 12. Report implementation, verification, limitations, and planned work separately.
 
@@ -53,4 +68,4 @@ Build plugins against the public CordisX contract. Keep the Host responsible for
 
 ## Delivery
 
-Provide exact evidence: focused tests, owner-repository gates, diff check, generated-project checks, and the relevant real runtime. A production graph check validates formal `artifact.json`, its entry, lazy chunks, CSS, and assets separately from development transport. For Vite/native work, distinguish React Fast Refresh, plugin lifecycle replacement, CordisX renderer restart, and full Electron restart. If the user is actively reviewing a running session, keep it available while validating a replacement separately.
+Provide exact evidence appropriate to the user's repository and claim: focused tests, diff checks, generated-project checks, and the relevant runtime when needed. CordisX maintainer gates are not admission requirements for third-party plugins. A production graph check validates formal `artifact.json`, its entry, lazy chunks, CSS, and assets separately from development transport. For Vite/native work, distinguish React Fast Refresh, plugin lifecycle replacement, CordisX renderer restart, and full Electron restart. Honor the active preview agreement: keep a protected review session available, or update an independent debug instance directly when the user has authorized restart/HMR. Preserve persistent data and non-target instances.

package/dist/skills/cordisx-plugin-development/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "CordisX Plugin Development"
   short_description: "Assess and build CordisX plugins in real projects"
-  default_prompt: "Use $cordisx-plugin-development to assess this request, create or update the plugin in the appropriate project shape when public capabilities support it, and verify its development and delivery boundaries."
+  default_prompt: "Use $cordisx-plugin-development to assess this request, create or update the plugin when public capabilities support it, and verify it with evidence appropriate to the requested behavior and active authorization."