crewcode-plugin-cli 0.1.0

package/templates/plugins/README.md

@@ -0,0 +1,25 @@
+# CrewCode plugin templates and dogfood examples
+
+Use these folders as local plugin starting points. Copy one into `~/.crewcode/plugins/<plugin-id>`, refresh the Plugins page, approve it, then edit from there.
+
+## Starter templates
+
+| Template | Use when | Key files |
+| --- | --- | --- |
+| `static-panel-template` | You want a no-build HTML/CSS/JS panel. | `crewcode.plugin.json`, `panel.html`, `plugin.js`, `crewcode-plugin-api.js` |
+| `typescript-panel-template` | You want a bundled TypeScript/React panel compiled to static assets. | `src/`, `vite.config.ts`, manifest entry `compiled/src/panel.html` |
+| `mock-agent-provider` | You want to add a new agent provider shape before shell/network integration. | `contributes.agentProviders`, `runtime: mock` |
+| `company-agent-http-adapter` | You want an HTTP-backed company/local agent provider. | `runtime: http`, `server.mjs` |
+| `openai-compatible-provider` | You want an OpenAI-compatible model gateway. | `runtime: openai-compatible`, `apiKeyEnv` |
+| `github-copilot-cli-provider` | You want an exec-backed CLI agent provider. | `runtime: exec`, `terminal:spawn` |
+| `mcp-server-template` | You want to declare a local MCP server. | `contributes.mcpServers`, `server.mjs` |
+| `browser-docs-grabber` | You want a browser toolbar action. | `contributes.browserActions` |
+| `git-risk-lens` | You want a git/sidebar review lens. | `contributes.gitLenses` |
+
+## Template rules
+
+- Use `crewcode-plugin-api` as the only plugin UI API. No-build plugins vendor `crewcode-plugin-api.js`; bundled plugins import or vendor the typed source.
+- Keep plugin UI sandboxed. Do not import plugin React components into CrewCode's trusted renderer.
+- Keep `crewcode.apiVersion` pinned to a supported version, currently `"0.1"`.
+- Add only the permissions your template needs; approval and changed-permission warnings are based on the manifest permission set.
+- Treat `openContext` fields as optional. Actions opened from editor, browser, terminal, chat, git, or restored tabs provide different subsets.

package/templates/plugins/browser-docs-grabber/crewcode-plugin-api.js

@@ -0,0 +1,80 @@
+// Official CrewCode plugin browser helper. GENERATED from src/ — do not edit by hand.
+// Runs inside sandboxed plugin iframes. It never exposes Electron APIs.
+"use strict";
+(() => {
+  // src/create-api.ts
+  var CREWCODE_PLUGIN_API_VERSION = "0.1";
+  var RESERVED_NETWORK_MESSAGE = "crewcode.network.fetch is reserved in plugin API v0. Use an agentProvider runtime (http/sse-http/openai-compatible/websocket) for network access.";
+  var RESERVED_SECRETS_MESSAGE = "crewcode.secrets.get is reserved in plugin API v0. Use a provider apiKeyEnv or local CLI auth instead.";
+  function createCrewCodeApi(options = {}) {
+    var _a, _b;
+    const timeoutMs = (_a = options.timeoutMs) != null ? _a : 1e4;
+    const targetOrigin = (_b = options.targetOrigin) != null ? _b : "*";
+    const pending = /* @__PURE__ */ new Map();
+    const contextListeners = /* @__PURE__ */ new Set();
+    let seq = 0;
+    let latestContext = null;
+    const reportError = (err) => {
+      const error = err instanceof Error ? err : new Error(String(err));
+      window.parent.postMessage({ type: "crewcode:runtimeError", message: error.message, stack: error.stack }, targetOrigin);
+    };
+    window.addEventListener("error", (event) => {
+      var _a2;
+      return reportError((_a2 = event.error) != null ? _a2 : event.message);
+    });
+    window.addEventListener("unhandledrejection", (event) => reportError(event.reason));
+    const request = (method, params) => {
+      const id = `req-${++seq}`;
+      window.parent.postMessage({ type: "crewcode:request", id, method, params }, targetOrigin);
+      return new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        window.setTimeout(() => {
+          if (!pending.has(id)) return;
+          pending.delete(id);
+          reject(new Error("CrewCode plugin request timed out"));
+        }, timeoutMs);
+      });
+    };
+    window.addEventListener("message", (event) => {
+      if (event.source !== window.parent) return;
+      const msg = event.data;
+      if (!msg || typeof msg !== "object") return;
+      if (msg.type === "crewcode:context") {
+        latestContext = msg;
+        for (const listener of contextListeners) listener(latestContext);
+        return;
+      }
+      if (msg.type === "crewcode:response" && typeof msg.id === "string" && pending.has(msg.id)) {
+        const callbacks = pending.get(msg.id);
+        pending.delete(msg.id);
+        if (msg.ok) callbacks.resolve(msg.result);
+        else callbacks.reject(new Error(typeof msg.error === "string" ? msg.error : "plugin request failed"));
+      }
+    });
+    return {
+      apiVersion: CREWCODE_PLUGIN_API_VERSION,
+      request,
+      onContext(listener) {
+        contextListeners.add(listener);
+        if (latestContext) listener(latestContext);
+        return () => contextListeners.delete(listener);
+      },
+      getContext: () => latestContext,
+      workspace: {
+        listFiles: () => request("workspace:listFiles"),
+        readFile: (sub) => request("workspace:readFile", { sub }),
+        writeFile: (sub, text) => request("workspace:writeFile", { sub, text })
+      },
+      network: {
+        fetch: () => Promise.reject(new Error(RESERVED_NETWORK_MESSAGE))
+      },
+      secrets: {
+        get: () => Promise.reject(new Error(RESERVED_SECRETS_MESSAGE))
+      }
+    };
+  }
+
+  // src/browser-global.ts
+  window.createCrewCodeApi = createCrewCodeApi;
+  window.crewcode = createCrewCodeApi();
+})();

package/templates/plugins/browser-docs-grabber/crewcode.plugin.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "../../../schemas/crewcode.plugin.schema.json",
+  "id": "browser-docs-grabber",
+  "name": "Browser Docs Grabber",
+  "version": "0.1.0",
+  "description": "Dogfoods explicit browser action contributions for docs context workflows.",
+  "crewcode": { "apiVersion": "0.1" },
+  "permissions": ["browser:read"],
+  "contributes": {
+    "sidebarPanels": [{ "id": "docs", "title": "Docs Grabber", "icon": "target", "entry": "panel.html" }],
+    "browserActions": [{ "id": "open-docs-grabber", "title": "Docs Grabber", "icon": "target", "sidebarPanel": "docs", "browserContext": "selection" }]
+  }
+}

package/templates/plugins/browser-docs-grabber/panel.html

@@ -0,0 +1 @@
+<!doctype html><html><head><meta charset="utf-8"><title>Browser Docs Grabber</title><style>body{margin:0;background:#0f120f;color:#e5e7eb;font:13px Inter,system-ui;padding:16px}.mono,code{font-family:'JetBrains Mono',monospace;color:#8b9a91}.card{border:1px solid #1c2f2f;background:#121712;padding:12px;margin-top:12px}</style></head><body><div class="mono">dogfood plugin</div><h1>browser docs grabber</h1><p id="ctx">waiting for context…</p><div class="card">Opened from the browser toolbar. This tests explicit browser action placement without exposing cookies, storage, or page text automatically.</div><div class="card">Future safe path: user-selected text only via <code>browser:read</code>.</div><script src="crewcode-plugin-api.js"></script><script src="plugin.js"></script></body></html>

package/templates/plugins/browser-docs-grabber/plugin.js

@@ -0,0 +1 @@
+window.crewcode.onContext(ctx=>{document.getElementById('ctx').textContent=ctx.workspace?`${ctx.workspace.name} · ${ctx.workspace.kind}`:'no workspace'})

package/templates/plugins/codebase-graph-lite/crewcode-plugin-api.js

@@ -0,0 +1,80 @@
+// Official CrewCode plugin browser helper. GENERATED from src/ — do not edit by hand.
+// Runs inside sandboxed plugin iframes. It never exposes Electron APIs.
+"use strict";
+(() => {
+  // src/create-api.ts
+  var CREWCODE_PLUGIN_API_VERSION = "0.1";
+  var RESERVED_NETWORK_MESSAGE = "crewcode.network.fetch is reserved in plugin API v0. Use an agentProvider runtime (http/sse-http/openai-compatible/websocket) for network access.";
+  var RESERVED_SECRETS_MESSAGE = "crewcode.secrets.get is reserved in plugin API v0. Use a provider apiKeyEnv or local CLI auth instead.";
+  function createCrewCodeApi(options = {}) {
+    var _a, _b;
+    const timeoutMs = (_a = options.timeoutMs) != null ? _a : 1e4;
+    const targetOrigin = (_b = options.targetOrigin) != null ? _b : "*";
+    const pending = /* @__PURE__ */ new Map();
+    const contextListeners = /* @__PURE__ */ new Set();
+    let seq = 0;
+    let latestContext = null;
+    const reportError = (err) => {
+      const error = err instanceof Error ? err : new Error(String(err));
+      window.parent.postMessage({ type: "crewcode:runtimeError", message: error.message, stack: error.stack }, targetOrigin);
+    };
+    window.addEventListener("error", (event) => {
+      var _a2;
+      return reportError((_a2 = event.error) != null ? _a2 : event.message);
+    });
+    window.addEventListener("unhandledrejection", (event) => reportError(event.reason));
+    const request = (method, params) => {
+      const id = `req-${++seq}`;
+      window.parent.postMessage({ type: "crewcode:request", id, method, params }, targetOrigin);
+      return new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        window.setTimeout(() => {
+          if (!pending.has(id)) return;
+          pending.delete(id);
+          reject(new Error("CrewCode plugin request timed out"));
+        }, timeoutMs);
+      });
+    };
+    window.addEventListener("message", (event) => {
+      if (event.source !== window.parent) return;
+      const msg = event.data;
+      if (!msg || typeof msg !== "object") return;
+      if (msg.type === "crewcode:context") {
+        latestContext = msg;
+        for (const listener of contextListeners) listener(latestContext);
+        return;
+      }
+      if (msg.type === "crewcode:response" && typeof msg.id === "string" && pending.has(msg.id)) {
+        const callbacks = pending.get(msg.id);
+        pending.delete(msg.id);
+        if (msg.ok) callbacks.resolve(msg.result);
+        else callbacks.reject(new Error(typeof msg.error === "string" ? msg.error : "plugin request failed"));
+      }
+    });
+    return {
+      apiVersion: CREWCODE_PLUGIN_API_VERSION,
+      request,
+      onContext(listener) {
+        contextListeners.add(listener);
+        if (latestContext) listener(latestContext);
+        return () => contextListeners.delete(listener);
+      },
+      getContext: () => latestContext,
+      workspace: {
+        listFiles: () => request("workspace:listFiles"),
+        readFile: (sub) => request("workspace:readFile", { sub }),
+        writeFile: (sub, text) => request("workspace:writeFile", { sub, text })
+      },
+      network: {
+        fetch: () => Promise.reject(new Error(RESERVED_NETWORK_MESSAGE))
+      },
+      secrets: {
+        get: () => Promise.reject(new Error(RESERVED_SECRETS_MESSAGE))
+      }
+    };
+  }
+
+  // src/browser-global.ts
+  window.createCrewCodeApi = createCrewCodeApi;
+  window.crewcode = createCrewCodeApi();
+})();

package/templates/plugins/codebase-graph-lite/crewcode.plugin.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "../../../schemas/crewcode.plugin.schema.json",
+  "id": "codebase-graph-lite",
+  "name": "Codebase Graph Lite",
+  "version": "0.1.0",
+  "description": "Dogfood plugin: isolated panel that reads the workspace file list through the v0 permission gate.",
+  "author": "CrewCode",
+  "crewcode": {
+    "apiVersion": "0.1"
+  },
+  "permissions": ["workspace:read"],
+  "contributes": {
+    "tabs": [
+      {
+        "id": "main",
+        "title": "Codebase Graph Lite",
+        "icon": "grid",
+        "entry": "panel.html",
+        "singleton": true
+      }
+    ],
+    "sidebarPanels": [
+      {
+        "id": "sidebar",
+        "title": "Graph Lite",
+        "icon": "sidebar",
+        "entry": "panel.html"
+      }
+    ],
+    "statusItems": [
+      {
+        "id": "graph-ready",
+        "title": "Codebase Graph Lite",
+        "text": "graph lite",
+        "icon": "grid",
+        "sidebarPanel": "sidebar"
+      }
+    ],
+    "editorActions": [
+      {
+        "id": "show-in-graph",
+        "title": "Show in Graph Lite",
+        "icon": "grid",
+        "sidebarPanel": "sidebar"
+      }
+    ],
+    "chatActions": [
+      {
+        "id": "inspect-chat",
+        "title": "Inspect chat with Graph Lite",
+        "icon": "grid",
+        "sidebarPanel": "sidebar",
+        "messageRole": "any"
+      }
+    ]
+  }
+}

package/templates/plugins/codebase-graph-lite/panel.html

@@ -0,0 +1,53 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Codebase Graph Lite</title>
+  <style>
+    :root { color-scheme: dark; font-family: Inter, system-ui, sans-serif; background: #0f120f; color: #fafafa; }
+    body { margin: 0; background: #0f120f; }
+    main { padding: 22px; display: grid; gap: 16px; }
+    header { display: flex; align-items: baseline; justify-content: space-between; border-bottom: 1px solid #1c2f2f; padding-bottom: 12px; }
+    h1 { margin: 0; font-size: 18px; letter-spacing: -0.01em; }
+    .mono, button, code { font-family: 'JetBrains Mono', ui-monospace, monospace; }
+    .muted { color: #8a948a; font-size: 12px; }
+    button { background: #142018; border: 1px solid #1c2f2f; color: #fafafa; border-radius: 8px; padding: 7px 10px; cursor: pointer; }
+    button:hover { background: #1e3a30; }
+    .grid { display: grid; grid-template-columns: 280px 1fr; gap: 16px; min-height: 0; }
+    .panel { border: 1px solid #1c2f2f; background: #111611; border-radius: 10px; min-height: 360px; overflow: hidden; }
+    .panel h2 { margin: 0; padding: 10px 12px; font-size: 12px; border-bottom: 1px solid #1c2f2f; color: #8a948a; text-transform: uppercase; letter-spacing: .12em; }
+    ul { list-style: none; padding: 6px; margin: 0; max-height: 520px; overflow: auto; }
+    li { padding: 6px 8px; border-radius: 6px; font-size: 12px; color: #d7ddd7; cursor: pointer; }
+    li:hover, li.on { background: #1e3a30; }
+    pre { margin: 0; padding: 14px; white-space: pre-wrap; color: #d7ddd7; font-size: 12px; max-height: 520px; overflow: auto; }
+    .pill { border: 1px solid #1c2f2f; border-radius: 999px; padding: 3px 8px; color: #8a948a; font-size: 11px; }
+  </style>
+</head>
+<body>
+  <main>
+    <header>
+      <div>
+        <h1>Codebase Graph Lite</h1>
+        <div id="workspace" class="muted mono">waiting for CrewCode context…</div>
+      </div>
+      <div style="display:flex; gap:8px; align-items:center">
+        <span id="count" class="pill mono">0 files</span>
+        <button id="refresh">refresh graph</button>
+      </div>
+    </header>
+    <div class="grid">
+      <section class="panel">
+        <h2>files</h2>
+        <ul id="files"></ul>
+      </section>
+      <section class="panel">
+        <h2>preview</h2>
+        <pre id="preview">Select a file to read it through the plugin permission gate.</pre>
+      </section>
+    </div>
+  </main>
+  <script src="crewcode-plugin-api.js"></script>
+  <script src="plugin.js"></script>
+</body>
+</html>

package/templates/plugins/codebase-graph-lite/plugin.js

@@ -0,0 +1,49 @@
+let context = null
+let files = []
+
+function showError(err) {
+  document.getElementById('preview').textContent = `Error: ${err.message}`
+}
+
+function renderFiles() {
+  const list = document.getElementById('files')
+  list.innerHTML = ''
+  document.getElementById('count').textContent = `${files.length} files`
+  for (const rel of files.slice(0, 400)) {
+    const li = document.createElement('li')
+    li.textContent = rel
+    li.className = 'mono'
+    li.onclick = async () => {
+      for (const item of list.querySelectorAll('li')) item.classList.remove('on')
+      li.classList.add('on')
+      try {
+        const result = await window.crewcode.workspace.readFile(rel)
+        document.getElementById('preview').textContent = result.text.slice(0, 12000)
+      } catch (err) {
+        showError(err)
+      }
+    }
+    list.appendChild(li)
+  }
+}
+
+async function loadFiles() {
+  if (!context?.workspace) return
+  document.getElementById('preview').textContent = 'Reading workspace file list through CrewCode…'
+  const result = await window.crewcode.workspace.listFiles()
+  files = result.files || []
+  renderFiles()
+  document.getElementById('preview').textContent = files.length
+    ? 'Select a file to preview it. This panel is isolated; file reads go through CrewCode permissions.'
+    : 'No files returned.'
+}
+
+window.crewcode.onContext(next => {
+  context = next
+  document.getElementById('workspace').textContent = next.workspace
+    ? `${next.workspace.name} · ${next.workspace.kind} · permissions: ${next.permissions.join(', ') || 'none'}`
+    : `no workspace · permissions: ${next.permissions.join(', ') || 'none'}`
+  loadFiles().catch(showError)
+})
+
+document.getElementById('refresh').onclick = () => loadFiles().catch(showError)

package/templates/plugins/company-agent-http-adapter/crewcode-plugin-api.js

@@ -0,0 +1,80 @@
+// Official CrewCode plugin browser helper. GENERATED from src/ — do not edit by hand.
+// Runs inside sandboxed plugin iframes. It never exposes Electron APIs.
+"use strict";
+(() => {
+  // src/create-api.ts
+  var CREWCODE_PLUGIN_API_VERSION = "0.1";
+  var RESERVED_NETWORK_MESSAGE = "crewcode.network.fetch is reserved in plugin API v0. Use an agentProvider runtime (http/sse-http/openai-compatible/websocket) for network access.";
+  var RESERVED_SECRETS_MESSAGE = "crewcode.secrets.get is reserved in plugin API v0. Use a provider apiKeyEnv or local CLI auth instead.";
+  function createCrewCodeApi(options = {}) {
+    var _a, _b;
+    const timeoutMs = (_a = options.timeoutMs) != null ? _a : 1e4;
+    const targetOrigin = (_b = options.targetOrigin) != null ? _b : "*";
+    const pending = /* @__PURE__ */ new Map();
+    const contextListeners = /* @__PURE__ */ new Set();
+    let seq = 0;
+    let latestContext = null;
+    const reportError = (err) => {
+      const error = err instanceof Error ? err : new Error(String(err));
+      window.parent.postMessage({ type: "crewcode:runtimeError", message: error.message, stack: error.stack }, targetOrigin);
+    };
+    window.addEventListener("error", (event) => {
+      var _a2;
+      return reportError((_a2 = event.error) != null ? _a2 : event.message);
+    });
+    window.addEventListener("unhandledrejection", (event) => reportError(event.reason));
+    const request = (method, params) => {
+      const id = `req-${++seq}`;
+      window.parent.postMessage({ type: "crewcode:request", id, method, params }, targetOrigin);
+      return new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        window.setTimeout(() => {
+          if (!pending.has(id)) return;
+          pending.delete(id);
+          reject(new Error("CrewCode plugin request timed out"));
+        }, timeoutMs);
+      });
+    };
+    window.addEventListener("message", (event) => {
+      if (event.source !== window.parent) return;
+      const msg = event.data;
+      if (!msg || typeof msg !== "object") return;
+      if (msg.type === "crewcode:context") {
+        latestContext = msg;
+        for (const listener of contextListeners) listener(latestContext);
+        return;
+      }
+      if (msg.type === "crewcode:response" && typeof msg.id === "string" && pending.has(msg.id)) {
+        const callbacks = pending.get(msg.id);
+        pending.delete(msg.id);
+        if (msg.ok) callbacks.resolve(msg.result);
+        else callbacks.reject(new Error(typeof msg.error === "string" ? msg.error : "plugin request failed"));
+      }
+    });
+    return {
+      apiVersion: CREWCODE_PLUGIN_API_VERSION,
+      request,
+      onContext(listener) {
+        contextListeners.add(listener);
+        if (latestContext) listener(latestContext);
+        return () => contextListeners.delete(listener);
+      },
+      getContext: () => latestContext,
+      workspace: {
+        listFiles: () => request("workspace:listFiles"),
+        readFile: (sub) => request("workspace:readFile", { sub }),
+        writeFile: (sub, text) => request("workspace:writeFile", { sub, text })
+      },
+      network: {
+        fetch: () => Promise.reject(new Error(RESERVED_NETWORK_MESSAGE))
+      },
+      secrets: {
+        get: () => Promise.reject(new Error(RESERVED_SECRETS_MESSAGE))
+      }
+    };
+  }
+
+  // src/browser-global.ts
+  window.createCrewCodeApi = createCrewCodeApi;
+  window.crewcode = createCrewCodeApi();
+})();

package/templates/plugins/company-agent-http-adapter/crewcode.plugin.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "../../../schemas/crewcode.plugin.schema.json",
+  "id": "company-agent-http-adapter",
+  "name": "Company Agent HTTP Adapter",
+  "version": "0.1.0",
+  "description": "Template for companies to expose an internal coding agent over a CrewCode-brokered HTTP provider runtime.",
+  "crewcode": { "apiVersion": "0.1" },
+  "permissions": ["agent:provider", "network:fetch"],
+  "contributes": {
+    "tabs": [
+      { "id": "main", "title": "Company Agent HTTP", "icon": "bot", "entry": "panel.html", "singleton": true }
+    ],
+    "agentProviders": [
+      {
+        "id": "company-http",
+        "title": "Company HTTP Agent",
+        "runtime": "http",
+        "description": "POSTs prompts to a local/company-owned HTTP endpoint. Response may be plain text or JSON { text }.",
+        "endpoint": "http://localhost:8787/agent",
+        "models": ["company-default"]
+      }
+    ]
+  }
+}

package/templates/plugins/company-agent-http-adapter/panel.html

@@ -0,0 +1 @@
+<!doctype html><html><head><meta charset="utf-8"><title>Company Agent HTTP</title><style>body{margin:0;background:#0f120f;color:#e5e7eb;font:13px Inter,system-ui;padding:16px}.mono,code{font-family:'JetBrains Mono',monospace;color:#8b9a91}.card{border:1px solid #1c2f2f;background:#121712;padding:12px;margin-top:12px}pre{white-space:pre-wrap}</style></head><body><div class="mono">dogfood template</div><h1>company agent http adapter</h1><p id="ctx">waiting for context…</p><div class="card">CrewCode POSTs to <code>http://localhost:8787/agent</code> with JSON:</div><pre class="card">{ "prompt": "...", "cwd": "...", "model": "company-default", "provider": "company-agent-http-adapter:company-http" }</pre><div class="card">Return plain text or JSON like <code>{ "text": "answer" }</code>.</div><script src="crewcode-plugin-api.js"></script><script src="plugin.js"></script></body></html>

package/templates/plugins/company-agent-http-adapter/plugin.js

@@ -0,0 +1 @@
+window.crewcode.onContext(ctx=>{document.getElementById('ctx').textContent=ctx.workspace?`${ctx.workspace.name} · ${ctx.workspace.kind}`:'no workspace'})

package/templates/plugins/company-agent-http-adapter/server.mjs

@@ -0,0 +1,27 @@
+import http from 'node:http'
+
+const server = http.createServer(async (req, res) => {
+  if (req.method !== 'POST' || req.url !== '/agent') {
+    res.writeHead(404, { 'Content-Type': 'text/plain' })
+    res.end('not found')
+    return
+  }
+  let body = ''
+  for await (const chunk of req) body += chunk
+  const input = JSON.parse(body || '{}')
+  res.writeHead(200, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({
+    text: [
+      'Company HTTP Agent template response.',
+      '',
+      `cwd: ${input.cwd ?? 'unknown'}`,
+      `model: ${input.model ?? 'default'}`,
+      '',
+      `prompt length: ${String(input.prompt ?? '').length}`,
+    ].join('\n')
+  }))
+})
+
+server.listen(8787, () => {
+  console.log('company agent template listening on http://localhost:8787/agent')
+})

package/templates/plugins/git-risk-lens/crewcode-plugin-api.js

@@ -0,0 +1,80 @@
+// Official CrewCode plugin browser helper. GENERATED from src/ — do not edit by hand.
+// Runs inside sandboxed plugin iframes. It never exposes Electron APIs.
+"use strict";
+(() => {
+  // src/create-api.ts
+  var CREWCODE_PLUGIN_API_VERSION = "0.1";
+  var RESERVED_NETWORK_MESSAGE = "crewcode.network.fetch is reserved in plugin API v0. Use an agentProvider runtime (http/sse-http/openai-compatible/websocket) for network access.";
+  var RESERVED_SECRETS_MESSAGE = "crewcode.secrets.get is reserved in plugin API v0. Use a provider apiKeyEnv or local CLI auth instead.";
+  function createCrewCodeApi(options = {}) {
+    var _a, _b;
+    const timeoutMs = (_a = options.timeoutMs) != null ? _a : 1e4;
+    const targetOrigin = (_b = options.targetOrigin) != null ? _b : "*";
+    const pending = /* @__PURE__ */ new Map();
+    const contextListeners = /* @__PURE__ */ new Set();
+    let seq = 0;
+    let latestContext = null;
+    const reportError = (err) => {
+      const error = err instanceof Error ? err : new Error(String(err));
+      window.parent.postMessage({ type: "crewcode:runtimeError", message: error.message, stack: error.stack }, targetOrigin);
+    };
+    window.addEventListener("error", (event) => {
+      var _a2;
+      return reportError((_a2 = event.error) != null ? _a2 : event.message);
+    });
+    window.addEventListener("unhandledrejection", (event) => reportError(event.reason));
+    const request = (method, params) => {
+      const id = `req-${++seq}`;
+      window.parent.postMessage({ type: "crewcode:request", id, method, params }, targetOrigin);
+      return new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        window.setTimeout(() => {
+          if (!pending.has(id)) return;
+          pending.delete(id);
+          reject(new Error("CrewCode plugin request timed out"));
+        }, timeoutMs);
+      });
+    };
+    window.addEventListener("message", (event) => {
+      if (event.source !== window.parent) return;
+      const msg = event.data;
+      if (!msg || typeof msg !== "object") return;
+      if (msg.type === "crewcode:context") {
+        latestContext = msg;
+        for (const listener of contextListeners) listener(latestContext);
+        return;
+      }
+      if (msg.type === "crewcode:response" && typeof msg.id === "string" && pending.has(msg.id)) {
+        const callbacks = pending.get(msg.id);
+        pending.delete(msg.id);
+        if (msg.ok) callbacks.resolve(msg.result);
+        else callbacks.reject(new Error(typeof msg.error === "string" ? msg.error : "plugin request failed"));
+      }
+    });
+    return {
+      apiVersion: CREWCODE_PLUGIN_API_VERSION,
+      request,
+      onContext(listener) {
+        contextListeners.add(listener);
+        if (latestContext) listener(latestContext);
+        return () => contextListeners.delete(listener);
+      },
+      getContext: () => latestContext,
+      workspace: {
+        listFiles: () => request("workspace:listFiles"),
+        readFile: (sub) => request("workspace:readFile", { sub }),
+        writeFile: (sub, text) => request("workspace:writeFile", { sub, text })
+      },
+      network: {
+        fetch: () => Promise.reject(new Error(RESERVED_NETWORK_MESSAGE))
+      },
+      secrets: {
+        get: () => Promise.reject(new Error(RESERVED_SECRETS_MESSAGE))
+      }
+    };
+  }
+
+  // src/browser-global.ts
+  window.createCrewCodeApi = createCrewCodeApi;
+  window.crewcode = createCrewCodeApi();
+})();

package/templates/plugins/git-risk-lens/crewcode.plugin.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "../../../schemas/crewcode.plugin.schema.json",
+  "id": "git-risk-lens",
+  "name": "Git Risk Lens",
+  "version": "0.1.0",
+  "description": "Dogfoods a read-only git lens contribution that opens a risk review panel.",
+  "crewcode": { "apiVersion": "0.1" },
+  "permissions": ["workspace:read", "git:read"],
+  "contributes": {
+    "sidebarPanels": [{ "id": "risk", "title": "Risk Lens", "icon": "alert", "entry": "panel.html" }],
+    "gitLenses": [{ "id": "open-risk", "title": "Open Risk Lens", "icon": "alert", "sidebarPanel": "risk", "placement": "sidebar" }]
+  }
+}

package/templates/plugins/git-risk-lens/panel.html

@@ -0,0 +1 @@
+<!doctype html><html><head><meta charset="utf-8"><title>Git Risk Lens</title><style>body{margin:0;background:#0f120f;color:#e5e7eb;font:13px Inter,system-ui;padding:16px}code,.mono{font-family:'JetBrains Mono',monospace;color:#9fbfaf}.card{border:1px solid #1c2f2f;background:#121712;padding:12px;margin-top:12px}button{background:#285a48;color:#e6f0eb;border:1px solid #356b57;padding:7px 10px;font:11px 'JetBrains Mono',monospace}</style></head><body><div class="mono">dogfood plugin</div><h1>git risk lens</h1><p id="ctx">waiting for context…</p><div class="card">Read-only lens opened from the Git sidebar. Future versions can consume structured git status/diff summaries through <code>git:read</code>.</div><button id="scan">scan workspace files</button><pre id="out"></pre><script src="crewcode-plugin-api.js"></script><script src="plugin.js"></script></body></html>

package/templates/plugins/git-risk-lens/plugin.js

@@ -0,0 +1,2 @@
+window.crewcode.onContext(ctx=>{document.getElementById('ctx').textContent=ctx.workspace?`${ctx.workspace.name} · ${ctx.workspace.kind}`:'no workspace'})
+document.getElementById('scan').onclick=async()=>{const {files}=await window.crewcode.workspace.listFiles();const risky=files.filter(f=>/(auth|secret|migration|schema|\.env|lock)/i.test(f)).slice(0,40);document.getElementById('out').textContent=risky.length?risky.join('\n'):'no obvious risk filenames found'}