glassbox 0.19.0 → 0.20.0-beta.4

package/dist/cli.js

@@ -11937,21 +11937,21 @@ var init_to_json_schema = __esm({
 // node_modules/zod/v4/core/json-schema-processors.js
 function toJSONSchema(input, params) {
   if ("_idmap" in input) {
-    const registry2 = input;
+    const registry3 = input;
     const ctx2 = initializeContext({ ...params, processors: allProcessors });
     const defs = {};
-    for (const entry of registry2._idmap.entries()) {
+    for (const entry of registry3._idmap.entries()) {
       const [_, schema] = entry;
       process2(schema, ctx2);
     }
     const schemas = {};
     const external = {
-      registry: registry2,
+      registry: registry3,
       uri: params?.uri,
       defs
     };
     ctx2.external = external;
-    for (const entry of registry2._idmap.entries()) {
+    for (const entry of registry3._idmap.entries()) {
       const [key, schema] = entry;
       extractDefs(ctx2, schema);
       schemas[key] = finalize(ctx2, schema);
@@ -17254,6 +17254,178 @@ var init_debug = __esm({
   }
 });
 
+// src/global-config.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir } from "os";
+import { join as join4 } from "path";
+function resolveGlobalConfigDir() {
+  const override = process.env.GLASSBOX_CONFIG_DIR;
+  if (override !== void 0 && override.trim() !== "") return override;
+  return join4(homedir(), ".glassbox");
+}
+function readGlobalConfig() {
+  try {
+    if (existsSync4(GLOBAL_CONFIG_PATH)) {
+      const raw2 = JSON.parse(readFileSync3(GLOBAL_CONFIG_PATH, "utf-8"));
+      const parsed = GlobalConfigSchema.safeParse(raw2);
+      if (parsed.success) return parsed.data;
+    }
+  } catch {
+  }
+  return {};
+}
+function writeGlobalConfig(config2) {
+  mkdirSync5(GLOBAL_CONFIG_DIR, { recursive: true });
+  writeFileSync3(GLOBAL_CONFIG_PATH, JSON.stringify(config2, null, 2), "utf-8");
+  try {
+    chmodSync(GLOBAL_CONFIG_PATH, 384);
+  } catch {
+  }
+}
+function updateGlobalConfig(mutator) {
+  const cfg = readGlobalConfig();
+  const result = mutator(cfg);
+  writeGlobalConfig(result === void 0 ? cfg : result);
+}
+var GlobalConfigSchema, GLOBAL_CONFIG_DIR, GLOBAL_CONFIG_PATH;
+var init_global_config = __esm({
+  "src/global-config.ts"() {
+    "use strict";
+    init_zod();
+    GlobalConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
+    GLOBAL_CONFIG_DIR = resolveGlobalConfigDir();
+    GLOBAL_CONFIG_PATH = join4(GLOBAL_CONFIG_DIR, "config.json");
+  }
+});
+
+// src/ai/keychain.ts
+import { spawnSync as spawnSync5 } from "child_process";
+function winTargetForAccount(account) {
+  return `glassbox-${account}`;
+}
+function winCredTarget(platform) {
+  return winTargetForAccount(`${platform}-api-key`);
+}
+function getSecretFromKeychain(account) {
+  const os = process.platform;
+  try {
+    if (os === "darwin") {
+      const r = spawnSync5("security", ["find-generic-password", "-s", "glassbox", "-a", account, "-w"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+      const result = r.stdout.trim();
+      return r.status === 0 && result !== "" ? result : null;
+    }
+    if (os === "linux") {
+      const r = spawnSync5("secret-tool", ["lookup", "service", "glassbox", "account", account], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+      const result = r.stdout.trim();
+      return r.status === 0 && result !== "" ? result : null;
+    }
+    if (os === "win32") {
+      const target = winTargetForAccount(account);
+      const list = spawnSync5("cmdkey", ["/list:" + target], { encoding: "utf-8" });
+      if (list.status !== 0 || (list.stdout || "").includes("* NONE *")) return null;
+      const script = WIN_CRED_READ_PS + `Write-Output ([CredHelper]::Read('${target}'))`;
+      const r = spawnSync5("powershell", ["-NoProfile", "-Command", "-"], { input: script, encoding: "utf-8" });
+      const result = r.stdout.trim();
+      return r.status === 0 && result !== "" ? result : null;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function getKeyFromKeychain(platform) {
+  return getSecretFromKeychain(`${platform}-api-key`);
+}
+function assertSpawnOk(label, r) {
+  if (r.error) throw new Error(`${label} failed: ${r.error.message}`);
+  if (r.status !== 0) {
+    const detail = (String(r.stderr) || String(r.stdout)).trim();
+    throw new Error(`${label} failed (exit ${String(r.status)})${detail ? `: ${detail}` : ""}`);
+  }
+}
+function saveSecretToKeychain(account, value, label = "Glassbox") {
+  const os = process.platform;
+  if (os === "darwin") {
+    spawnSync5("security", ["delete-generic-password", "-s", "glassbox", "-a", account], { stdio: "pipe" });
+    assertSpawnOk("Keychain write", spawnSync5("security", ["add-generic-password", "-s", "glassbox", "-a", account, "-w", value], { encoding: "utf-8" }));
+    return;
+  }
+  if (os === "linux") {
+    assertSpawnOk("System keyring write", spawnSync5("secret-tool", ["store", `--label=${label}`, "service", "glassbox", "account", account], { input: value, encoding: "utf-8" }));
+    return;
+  }
+  if (os === "win32") {
+    const target = winTargetForAccount(account);
+    const escapedValue = value.replace(/'/g, "''");
+    const script = `cmdkey /generic:'${target}' /user:'glassbox' /pass:'${escapedValue}'`;
+    assertSpawnOk("Credential Manager write", spawnSync5("powershell", ["-NoProfile", "-Command", "-"], { input: script, encoding: "utf-8" }));
+  }
+}
+function deleteSecretFromKeychain(account) {
+  const os = process.platform;
+  try {
+    if (os === "darwin") {
+      spawnSync5("security", ["delete-generic-password", "-s", "glassbox", "-a", account], { stdio: "pipe" });
+    } else if (os === "linux") {
+      spawnSync5("secret-tool", ["clear", "service", "glassbox", "account", account], { stdio: "pipe" });
+    } else if (os === "win32") {
+      spawnSync5("powershell", ["-NoProfile", "-Command", "-"], { input: `cmdkey /delete:'${winTargetForAccount(account)}'`, encoding: "utf-8" });
+    }
+  } catch {
+  }
+}
+function saveKeyToKeychain(platform, key) {
+  saveSecretToKeychain(`${platform}-api-key`, key, "Glassbox API Key");
+}
+function isKeychainAvailable() {
+  const os = process.platform;
+  if (os === "darwin" || os === "win32") return true;
+  if (os === "linux") {
+    return spawnSync5("which", ["secret-tool"], { stdio: "pipe" }).status === 0;
+  }
+  return false;
+}
+function getKeychainLabel() {
+  const os = process.platform;
+  if (os === "darwin") return "Keychain";
+  if (os === "linux") return "System Keyring";
+  if (os === "win32") return "Credential Manager";
+  return "System Keychain";
+}
+var WIN_CRED_READ_PS;
+var init_keychain = __esm({
+  "src/ai/keychain.ts"() {
+    "use strict";
+    WIN_CRED_READ_PS = `
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public class CredHelper {
+    [DllImport("advapi32", SetLastError = true, CharSet = CharSet.Unicode)]
+    static extern bool CredRead(string t, int type, int f, out IntPtr p);
+    [DllImport("advapi32")]
+    static extern void CredFree(IntPtr p);
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    struct CRED {
+        public int Flags; public int Type; public string TargetName; public string Comment;
+        public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;
+        public int Persist; public int AttributeCount; public IntPtr Attributes;
+        public string TargetAlias; public string UserName;
+    }
+    public static string Read(string target) {
+        IntPtr ptr;
+        if (!CredRead(target, 1, 0, out ptr)) return "";
+        CRED c = (CRED)Marshal.PtrToStructure(ptr, typeof(CRED));
+        string r = Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
+        CredFree(ptr);
+        return r;
+    }
+}
+'@
+`;
+  }
+});
+
 // src/git/image-blobs.ts
 var image_blobs_exports = {};
 __export(image_blobs_exports, {
@@ -17266,33 +17438,1004 @@ import { join as join5 } from "path";
 function blobDir(dataDir) {
   return join5(dataDir, "image-blobs");
 }
-function blobName(fileId, side) {
-  return `${fileId.replace(/[^a-z0-9]/gi, "")}-${side}`;
+function blobName(fileId, side) {
+  return `${fileId.replace(/[^a-z0-9]/gi, "")}-${side}`;
+}
+function writeImageBlob(dataDir, fileId, side, bytes) {
+  if (bytes.length === 0) return;
+  const dir = blobDir(dataDir);
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync4(join5(dir, blobName(fileId, side)), bytes);
+}
+function readImageBlob(dataDir, fileId, side) {
+  const path = join5(blobDir(dataDir), blobName(fileId, side));
+  if (!existsSync5(path)) return null;
+  try {
+    return readFileSync4(path);
+  } catch {
+    return null;
+  }
+}
+function clearImageBlobs(dataDir) {
+  try {
+    rmSync3(blobDir(dataDir), { recursive: true, force: true });
+  } catch {
+  }
+}
+var init_image_blobs = __esm({
+  "src/git/image-blobs.ts"() {
+    "use strict";
+  }
+});
+
+// src/feature-flags.ts
+var PLUGINS_ENABLED;
+var init_feature_flags = __esm({
+  "src/feature-flags.ts"() {
+    "use strict";
+    PLUGINS_ENABLED = process.env.GLASSBOX_PLUGINS_DISABLED === "1" ? false : true;
+  }
+});
+
+// src/api/_runner.ts
+function currentReviewId() {
+  if (typeof document === "undefined") return "";
+  return document.body.dataset.reviewId ?? "";
+}
+async function apiCall(responseSchema, path, opts = {}) {
+  const separator = path.includes("?") ? "&" : "?";
+  const url2 = "/api" + path + separator + "reviewId=" + encodeURIComponent(currentReviewId());
+  const res = await fetch(url2, {
+    headers: { "Content-Type": "application/json" },
+    method: opts.method,
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+  });
+  const json2 = await res.json();
+  const result = responseSchema.safeParse(json2);
+  if (!result.success) {
+    const summary = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    throw new Error(`API response from ${path} failed validation: ${summary}`);
+  }
+  return result.data;
+}
+function qs(params) {
+  const entries = Object.entries(params).filter(([, v]) => v !== void 0 && v !== null);
+  if (entries.length === 0) return "";
+  const usp = new URLSearchParams();
+  for (const [k, v] of entries) usp.set(k, String(v));
+  return "?" + usp.toString();
+}
+var OkResponseSchema;
+var init_runner = __esm({
+  "src/api/_runner.ts"() {
+    "use strict";
+    init_zod();
+    OkResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
+  }
+});
+
+// src/api/project-settings.ts
+var project_settings_exports = {};
+__export(project_settings_exports, {
+  GetProjectSettingsRespSchema: () => GetProjectSettingsRespSchema,
+  ProjectSettingsSchema: () => ProjectSettingsSchema,
+  UpdateProjectSettingsReqSchema: () => UpdateProjectSettingsReqSchema,
+  UpdateProjectSettingsRespSchema: () => UpdateProjectSettingsRespSchema,
+  getProjectSettings: () => getProjectSettings,
+  updateProjectSettings: () => updateProjectSettings
+});
+async function getProjectSettings() {
+  return apiCall(GetProjectSettingsRespSchema, "/project-settings");
+}
+async function updateProjectSettings(req) {
+  return apiCall(UpdateProjectSettingsRespSchema, "/project-settings", { method: "PATCH", body: req });
+}
+var ProjectSettingsSchema, GetProjectSettingsRespSchema, UpdateProjectSettingsReqSchema, UpdateProjectSettingsRespSchema;
+var init_project_settings = __esm({
+  "src/api/project-settings.ts"() {
+    "use strict";
+    init_zod();
+    init_runner();
+    ProjectSettingsSchema = external_exports.object({
+      appName: external_exports.string().optional(),
+      /** Content-plugin ids disabled for THIS project (doc 29 FR-29.16). A plugin is
+       *  enabled unless it appears here or in the global disabled list. */
+      disabledPlugins: external_exports.array(external_exports.string()).optional(),
+      /** Per-project plugin preference values (doc 29 FR-29.12): pluginId → key → value. */
+      pluginSettings: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())).optional()
+    });
+    GetProjectSettingsRespSchema = ProjectSettingsSchema;
+    UpdateProjectSettingsReqSchema = ProjectSettingsSchema.partial();
+    UpdateProjectSettingsRespSchema = ProjectSettingsSchema;
+  }
+});
+
+// src/project-settings-store.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
+import { join as join10 } from "path";
+function settingsPath(repoRoot) {
+  return join10(repoRoot, ".glassbox", "settings.json");
+}
+function readProjectSettings(repoRoot) {
+  try {
+    const path = settingsPath(repoRoot);
+    if (existsSync10(path)) {
+      const raw2 = JSON.parse(readFileSync9(path, "utf-8"));
+      const parsed = ProjectSettingsSchema.safeParse(raw2);
+      if (parsed.success) return parsed.data;
+    }
+  } catch {
+  }
+  return {};
+}
+function updateProjectSettings2(repoRoot, mutator) {
+  const current = readProjectSettings(repoRoot);
+  const result = mutator(current);
+  const next = result === void 0 ? current : result;
+  const dir = join10(repoRoot, ".glassbox");
+  mkdirSync8(dir, { recursive: true });
+  writeFileSync9(join10(dir, "settings.json"), JSON.stringify(next, null, 2), "utf-8");
+}
+var init_project_settings_store = __esm({
+  "src/project-settings-store.ts"() {
+    "use strict";
+    init_project_settings();
+  }
+});
+
+// src/plugins/enablement.ts
+function toStringArray(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+function readGlobalDisabled() {
+  return toStringArray(readGlobalConfig().disabledPlugins);
+}
+function setGlobalDisabled(id, disabled) {
+  updateGlobalConfig((cfg) => {
+    const cur = toStringArray(cfg.disabledPlugins);
+    const next = disabled ? [.../* @__PURE__ */ new Set([...cur, id])] : cur.filter((x) => x !== id);
+    return { ...cfg, disabledPlugins: next };
+  });
+}
+function readProjectDisabled(repoRoot) {
+  return toStringArray(readProjectSettings(repoRoot).disabledPlugins);
+}
+function setProjectDisabled(repoRoot, id, disabled) {
+  updateProjectSettings2(repoRoot, (s) => {
+    const cur = toStringArray(s.disabledPlugins);
+    s.disabledPlugins = disabled ? [.../* @__PURE__ */ new Set([...cur, id])] : cur.filter((x) => x !== id);
+  });
+}
+function disabledScope(id, lists) {
+  if (lists.globalDisabled.includes(id)) return "global";
+  if (lists.projectDisabled.includes(id)) return "project";
+  return null;
+}
+function readEnablementLists(repoRoot) {
+  return { globalDisabled: readGlobalDisabled(), projectDisabled: readProjectDisabled(repoRoot) };
+}
+var init_enablement = __esm({
+  "src/plugins/enablement.ts"() {
+    "use strict";
+    init_global_config();
+    init_project_settings_store();
+  }
+});
+
+// src/plugins/manifest.ts
+function parseManifest(raw2) {
+  const parsed = PluginManifestSchema.safeParse(raw2);
+  return parsed.success ? parsed.data : null;
+}
+var ContentTypeSchema, PluginPreferenceSchema, ConfigLabelColorSchema, ConfigLayoutItemSchema, PluginRequirementSchema, PluginProvisionStepSchema, PluginInstallSchema, PluginManifestSchema;
+var init_manifest2 = __esm({
+  "src/plugins/manifest.ts"() {
+    "use strict";
+    init_zod();
+    ContentTypeSchema = external_exports.object({
+      extensions: external_exports.array(external_exports.string()).optional(),
+      mimeTypes: external_exports.array(external_exports.string()).optional()
+    }).loose();
+    PluginPreferenceSchema = external_exports.object({
+      key: external_exports.string().min(1),
+      label: external_exports.string().min(1),
+      type: external_exports.enum(["string", "number", "boolean", "select"]),
+      /** Stored as a string; the plugin coerces. */
+      default: external_exports.string().optional(),
+      description: external_exports.string().optional(),
+      /** `select` options (value === label unless an object form is used later). */
+      options: external_exports.array(external_exports.string()).optional(),
+      /** Per-project vs global storage (default global). Ignored for secrets
+       *  (always keychain). */
+      scope: external_exports.enum(["global", "project"]).optional(),
+      /** Secret prefs are stored in the OS keychain, never in config (GB-1054). */
+      secret: external_exports.boolean().optional()
+    }).loose();
+    ConfigLabelColorSchema = external_exports.enum(["default", "success", "error", "warning", "transient"]);
+    ConfigLayoutItemSchema = external_exports.lazy(
+      () => external_exports.object({
+        type: external_exports.enum(["preference", "divider", "spacer", "label", "button", "group"]),
+        key: external_exports.string().optional(),
+        id: external_exports.string().optional(),
+        text: external_exports.string().optional(),
+        color: ConfigLabelColorSchema.optional(),
+        label: external_exports.string().optional(),
+        action: external_exports.string().optional(),
+        style: external_exports.string().optional(),
+        title: external_exports.string().optional(),
+        collapsed: external_exports.boolean().optional(),
+        items: external_exports.array(ConfigLayoutItemSchema).optional()
+      }).loose()
+    );
+    PluginRequirementSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      label: external_exports.string().min(1),
+      /** Executable whose presence proves the requirement (run with `checkArgs`). */
+      command: external_exports.string().min(1),
+      /** Args for the presence check (default `['--version']`). */
+      checkArgs: external_exports.array(external_exports.string()).optional(),
+      /** Human remediation shown when the requirement is missing. */
+      hint: external_exports.string().min(1),
+      docUrl: external_exports.string().optional()
+    }).loose();
+    PluginProvisionStepSchema = external_exports.union([
+      external_exports.object({
+        kind: external_exports.literal("fetch"),
+        url: external_exports.string().min(1),
+        /** Destination filename inside the install dir. */
+        dest: external_exports.string().min(1),
+        /** Optional expected sha-256 (hex) of the downloaded bytes. */
+        sha256: external_exports.string().optional()
+      }).loose(),
+      external_exports.object({
+        kind: external_exports.literal("npm-install"),
+        packages: external_exports.array(external_exports.string().min(1)).min(1),
+        /** Requirement id whose command must be present to run this (default `npm`). */
+        requires: external_exports.string().optional(),
+        note: external_exports.string().optional()
+      }).loose()
+    ]);
+    PluginInstallSchema = external_exports.object({
+      requirements: external_exports.array(PluginRequirementSchema).optional(),
+      provision: external_exports.array(PluginProvisionStepSchema).optional(),
+      /** Fallback command to run by hand when auto-provisioning can't complete. */
+      cliHint: external_exports.string().optional()
+    }).loose();
+    PluginManifestSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      name: external_exports.string().min(1),
+      version: external_exports.string().min(1),
+      /** Entry module relative to the plugin dir; defaults to `index.js`. */
+      entry: external_exports.string().min(1).optional(),
+      description: external_exports.string().optional(),
+      author: external_exports.string().optional(),
+      /** The content types this plugin handles (informational for the UI; the
+       *  authoritative match lives in the registered renderer/differ). */
+      contentTypes: external_exports.array(ContentTypeSchema).optional(),
+      /** User-configurable preferences (doc 29 FR-29.12); rendered in Settings. */
+      preferences: external_exports.array(PluginPreferenceSchema).optional(),
+      /** Optional arrangement of the preferences into groups/dividers/labels/
+       *  buttons (doc 29 FR-29.18). Omitted → flat preference list. */
+      configLayout: external_exports.array(ConfigLayoutItemSchema).optional(),
+      /** `false` marks a **separately-installable** plugin (e.g. one with a system
+       *  requirement like Java): it's built + may ship in the bundle, but
+       *  `installBundledPlugins` does NOT auto-install it — the user opts in
+       *  (GB-1046). Defaults to auto-install (true) when omitted. */
+      autoInstall: external_exports.boolean().optional(),
+      /** How to install an opt-in plugin from the UI (doc 29 §29.2, GB-1069):
+       *  system requirements + auto-run provisioning steps. Absent → self-contained. */
+      install: PluginInstallSchema.optional()
+    }).loose();
+  }
+});
+
+// src/plugins/registry.ts
+import { extname } from "path";
+function matchSpecificity(match, input) {
+  if (match.sniff && input.bytes.length > 0) {
+    try {
+      if (match.sniff(input.bytes)) return 3;
+    } catch {
+    }
+  }
+  if (match.mimeTypes && input.mime !== void 0 && match.mimeTypes.includes(input.mime)) return 2;
+  const ext = extname(input.path).toLowerCase();
+  if (ext !== "" && match.extensions?.some((e) => e.toLowerCase() === ext) === true) return 1;
+  return 0;
+}
+function pathMatches(match, path, mime) {
+  const ext = extname(path).toLowerCase();
+  if (ext !== "" && match.extensions?.some((e) => e.toLowerCase() === ext) === true) return true;
+  if (mime !== void 0 && match.mimeTypes?.includes(mime) === true) return true;
+  return false;
+}
+function pickBest(handlers, input) {
+  let best;
+  let bestScore = 0;
+  for (const h of handlers) {
+    const spec = matchSpecificity(h.match, input);
+    if (spec === 0) continue;
+    const score = (h.priority ?? 0) * 10 + spec;
+    if (score > bestScore) {
+      bestScore = score;
+      best = h;
+    }
+  }
+  return best;
+}
+var ContentPluginRegistry;
+var init_registry = __esm({
+  "src/plugins/registry.ts"() {
+    "use strict";
+    ContentPluginRegistry = class {
+      renderers = [];
+      differs = [];
+      imageDecoders = [];
+      addRenderers(rs) {
+        if (rs) this.renderers.push(...rs);
+      }
+      addDiffers(ds) {
+        if (ds) this.differs.push(...ds);
+      }
+      addImageDecoders(ds) {
+        if (ds) this.imageDecoders.push(...ds);
+      }
+      /** The best-matching renderer for a single content blob, or undefined. */
+      findRenderer(input) {
+        return pickBest(this.renderers, input);
+      }
+      /** The best-matching differ for a pair; matching keys off the new side. */
+      findDiffer(input) {
+        return pickBest(this.differs, input.new);
+      }
+      /** The best-matching image decoder (bytes → RGBA) for a blob, or undefined. */
+      findImageDecoder(input) {
+        return pickBest(this.imageDecoders, input);
+      }
+      /** Cheap path pre-check: could any renderer/differ handle this path (by ext /
+       *  MIME)? Skips sniff so no bytes are read. */
+      mightHandleByPath(path, mime) {
+        for (const h of this.renderers) if (pathMatches(h.match, path, mime)) return true;
+        for (const h of this.differs) if (pathMatches(h.match, path, mime)) return true;
+        return false;
+      }
+      get rendererCount() {
+        return this.renderers.length;
+      }
+      get differCount() {
+        return this.differs.length;
+      }
+      get imageDecoderCount() {
+        return this.imageDecoders.length;
+      }
+    };
+  }
+});
+
+// src/plugins/settings.ts
+function secretAccount(pluginId, key) {
+  return `plugin-${pluginId}-${key}`;
+}
+function coerceSettingsMap(raw2) {
+  const out = {};
+  if (raw2 === null || typeof raw2 !== "object") return out;
+  for (const [pluginId, byKey] of Object.entries(raw2)) {
+    if (byKey === null || typeof byKey !== "object") continue;
+    const entry = {};
+    for (const [k, v] of Object.entries(byKey)) {
+      if (typeof v === "string") entry[k] = v;
+    }
+    out[pluginId] = entry;
+  }
+  return out;
+}
+function prefFor(manifest, key) {
+  return manifest.preferences?.find((p) => p.key === key);
+}
+function scopeOf(pref) {
+  return pref?.scope === "project" ? "project" : "global";
+}
+function readGlobalSettings() {
+  return coerceSettingsMap(readGlobalConfig().pluginSettings);
+}
+function readProjectSettingsMap(repoRoot) {
+  return coerceSettingsMap(readProjectSettings(repoRoot).pluginSettings);
+}
+function lookup(map2, pluginId, key) {
+  return map2[pluginId]?.[key];
+}
+function readPluginSetting(manifest, repoRoot, key) {
+  const pref = prefFor(manifest, key);
+  if (pref?.secret === true) {
+    return getSecretFromKeychain(secretAccount(manifest.id, key)) ?? pref.default ?? null;
+  }
+  const map2 = scopeOf(pref) === "project" ? readProjectSettingsMap(repoRoot) : readGlobalSettings();
+  const stored = lookup(map2, manifest.id, key);
+  if (stored !== void 0) return stored;
+  return pref?.default ?? null;
+}
+function writePluginSetting(manifest, repoRoot, key, value) {
+  const pref = prefFor(manifest, key);
+  if (pref?.secret === true) {
+    if (value === "") deleteSecretFromKeychain(secretAccount(manifest.id, key));
+    else saveSecretToKeychain(secretAccount(manifest.id, key), value, `Glassbox plugin: ${manifest.id}`);
+    return;
+  }
+  if (scopeOf(pref) === "project") {
+    updateProjectSettings2(repoRoot, (s) => {
+      const map2 = coerceSettingsMap(s.pluginSettings);
+      map2[manifest.id] = { ...map2[manifest.id], [key]: value };
+      s.pluginSettings = map2;
+    });
+  } else {
+    updateGlobalConfig((cfg) => {
+      const map2 = coerceSettingsMap(cfg.pluginSettings);
+      map2[manifest.id] = { ...map2[manifest.id], [key]: value };
+      return { ...cfg, pluginSettings: map2 };
+    });
+  }
+}
+function readPluginPreferenceDisplay(manifest, repoRoot) {
+  const values = {};
+  const secretConfigured = [];
+  for (const p of manifest.preferences ?? []) {
+    if (p.secret === true) {
+      const stored = getSecretFromKeychain(secretAccount(manifest.id, p.key));
+      if (stored !== null && stored !== "") secretConfigured.push(p.key);
+      values[p.key] = "";
+    } else {
+      values[p.key] = readPluginSetting(manifest, repoRoot, p.key) ?? "";
+    }
+  }
+  return { values, secretConfigured };
+}
+var init_settings = __esm({
+  "src/plugins/settings.ts"() {
+    "use strict";
+    init_keychain();
+    init_global_config();
+    init_project_settings_store();
+  }
+});
+
+// src/plugins/loader.ts
+import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join11 } from "path";
+import { pathToFileURL } from "url";
+function getConfigLabelOverride(pluginId, labelId) {
+  return configLabelOverrides.get(`${pluginId}:${labelId}`);
+}
+function clearConfigLabelOverrides(pluginId) {
+  const prefix = `${pluginId}:`;
+  for (const key of configLabelOverrides.keys()) {
+    if (key.startsWith(prefix)) configLabelOverrides.delete(key);
+  }
+}
+function getPluginUIElements() {
+  return Array.from(pluginUIElements.entries()).map(([pluginId, elements]) => ({ pluginId, elements }));
+}
+function clearPluginUIElements(pluginId) {
+  pluginUIElements.delete(pluginId);
+}
+function clearAllPluginUIElements() {
+  pluginUIElements.clear();
+}
+function pluginsDir() {
+  return join11(GLOBAL_CONFIG_DIR, "plugins");
+}
+function discoverPluginDirs(root = pluginsDir()) {
+  if (!existsSync11(root)) return [];
+  let entries;
+  try {
+    entries = readdirSync2(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of entries) {
+    if (name.startsWith(".")) continue;
+    const dir = join11(root, name);
+    try {
+      if (statSync3(dir).isDirectory()) out.push(dir);
+    } catch {
+    }
+  }
+  return out.sort();
+}
+function readManifest(dir) {
+  const manifestPath = join11(dir, "manifest.json");
+  if (existsSync11(manifestPath)) {
+    try {
+      return parseManifest(JSON.parse(readFileSync10(manifestPath, "utf-8")));
+    } catch {
+      return null;
+    }
+  }
+  const pkgPath = join11(dir, "package.json");
+  if (existsSync11(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+      const gb = pkg.glassbox;
+      if (gb !== null && typeof gb === "object") {
+        return parseManifest({ id: pkg.name, version: pkg.version, entry: pkg.main, ...gb });
+      }
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function makeContext(manifest, repoRoot) {
+  const id = manifest.id;
+  return {
+    log: (level, message) => {
+      const line = `[plugin:${id}] ${message}`;
+      if (level === "error") console.error(line);
+      else if (level === "warn") console.warn(line);
+      else console.log(line);
+    },
+    getSetting: (key) => Promise.resolve(readPluginSetting(manifest, repoRoot, key)),
+    setSetting: (key, value) => {
+      writePluginSetting(manifest, repoRoot, key, value);
+      return Promise.resolve();
+    },
+    updateConfigLabel: (labelId, text, color) => {
+      configLabelOverrides.set(`${id}:${labelId}`, { text, color });
+    },
+    registerUI: (elements) => {
+      pluginUIElements.set(id, elements);
+    }
+  };
+}
+async function loadPluginDir(dir, registry3, isEnabled = ALWAYS_ENABLED, repoRoot = "") {
+  const manifest = readManifest(dir);
+  if (manifest === null) {
+    return { id: dir, dir, manifest: null, status: "error", error: "invalid or missing manifest" };
+  }
+  const enablement = isEnabled(manifest.id);
+  if (enablement.disabled) {
+    return { id: manifest.id, dir, manifest, status: "disabled", disabledScope: enablement.scope };
+  }
+  try {
+    const entry = join11(dir, manifest.entry ?? "index.js");
+    if (!existsSync11(entry)) throw new Error(`entry not found: ${manifest.entry ?? "index.js"}`);
+    const mod = await import(pathToFileURL(entry).href);
+    const plugin = mod.default ?? (typeof mod.activate === "function" ? { activate: mod.activate, onAction: mod.onAction } : void 0);
+    if (plugin === void 0 || typeof plugin.activate !== "function") {
+      throw new Error("plugin exports no activate()");
+    }
+    const context = makeContext(manifest, repoRoot);
+    const registration = await plugin.activate(context) ?? void 0;
+    if (registration !== void 0) {
+      registry3.addRenderers(registration.renderers);
+      registry3.addDiffers(registration.differs);
+      registry3.addImageDecoders(registration.imageDecoders);
+    }
+    return { id: manifest.id, dir, manifest, status: "loaded", registration, instance: plugin, context };
+  } catch (e) {
+    return { id: manifest.id, dir, manifest, status: "error", error: e instanceof Error ? e.message : String(e) };
+  }
+}
+async function loadAllPlugins(root = pluginsDir(), isEnabled = ALWAYS_ENABLED, repoRoot = "") {
+  const registry3 = new ContentPluginRegistry();
+  if (!PLUGINS_ENABLED) return { registry: registry3, loaded: [] };
+  const loaded = [];
+  for (const dir of discoverPluginDirs(root)) {
+    loaded.push(await loadPluginDir(dir, registry3, isEnabled, repoRoot));
+  }
+  return { registry: registry3, loaded };
+}
+var configLabelOverrides, pluginUIElements, ALWAYS_ENABLED;
+var init_loader = __esm({
+  "src/plugins/loader.ts"() {
+    "use strict";
+    init_feature_flags();
+    init_global_config();
+    init_manifest2();
+    init_registry();
+    init_settings();
+    configLabelOverrides = /* @__PURE__ */ new Map();
+    pluginUIElements = /* @__PURE__ */ new Map();
+    ALWAYS_ENABLED = () => ({ disabled: false });
+  }
+});
+
+// src/plugins/install.ts
+import { createHash as createHash3 } from "crypto";
+import { cpSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync11, rmSync as rmSync6, statSync as statSync4, symlinkSync, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7, join as join12 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function dismissedPathFor(userDir) {
+  return join12(dirname7(userDir), DISMISSED_FILE);
+}
+function bundledPluginsDir() {
+  const override = process.env.GLASSBOX_BUNDLED_PLUGINS_DIR;
+  if (override !== void 0 && override.trim() !== "") return override;
+  const sibling = join12(dirname7(fileURLToPath2(import.meta.url)), "plugins");
+  if (existsSync12(sibling)) return sibling;
+  return join12(process.cwd(), "dist", "plugins");
+}
+function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
+  if (!existsSync12(bundledDir)) return [];
+  let entries;
+  try {
+    entries = readdirSync3(bundledDir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of entries.sort()) {
+    const dir = join12(bundledDir, name);
+    try {
+      if (!statSync4(dir).isDirectory()) continue;
+      const manifest = readManifest(dir);
+      if (manifest !== null) out.push({ dir, manifest });
+    } catch {
+    }
+  }
+  return out;
+}
+function readDismissed(userDir = pluginsDir()) {
+  try {
+    const raw2 = JSON.parse(readFileSync11(dismissedPathFor(userDir), "utf-8"));
+    return Array.isArray(raw2) ? raw2.filter((x) => typeof x === "string") : [];
+  } catch {
+    return [];
+  }
 }
-function writeImageBlob(dataDir, fileId, side, bytes) {
-  if (bytes.length === 0) return;
-  const dir = blobDir(dataDir);
-  mkdirSync6(dir, { recursive: true });
-  writeFileSync4(join5(dir, blobName(fileId, side)), bytes);
+function writeDismissed(ids, userDir) {
+  const path = dismissedPathFor(userDir);
+  mkdirSync9(dirname7(path), { recursive: true });
+  writeFileSync10(path, JSON.stringify([...new Set(ids)], null, 2), "utf-8");
 }
-function readImageBlob(dataDir, fileId, side) {
-  const path = join5(blobDir(dataDir), blobName(fileId, side));
-  if (!existsSync5(path)) return null;
+function compareVersions(a, b) {
+  const pa = a.split(".").map((p) => parseInt(p, 10) || 0);
+  const pb = b.split(".").map((p) => parseInt(p, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+function hashPluginDir(dir) {
+  const h = createHash3("sha1");
+  const walk = (d, rel) => {
+    for (const name of readdirSync3(d).sort()) {
+      const abs = join12(d, name);
+      const r = rel === "" ? name : `${rel}/${name}`;
+      if (statSync4(abs).isDirectory()) walk(abs, r);
+      else {
+        h.update(r);
+        h.update(readFileSync11(abs));
+      }
+    }
+  };
+  walk(dir, "");
+  return h.digest("hex");
+}
+function shouldInstall(src, dest, bundledVersion) {
+  if (!existsSync12(dest)) return true;
+  const destManifest = readManifest(dest);
+  const destVersion = destManifest?.version ?? "0";
+  const cmp = compareVersions(bundledVersion, destVersion);
+  if (cmp > 0) return true;
+  if (cmp < 0) return false;
   try {
-    return readFileSync4(path);
+    return hashPluginDir(src) !== hashPluginDir(dest);
+  } catch {
+    return false;
+  }
+}
+function installBundledPlugins(opts) {
+  const bundledDir = opts?.bundledDir ?? bundledPluginsDir();
+  const userDir = opts?.userDir ?? pluginsDir();
+  if (!existsSync12(bundledDir)) return;
+  const dismissed = new Set(readDismissed(userDir));
+  let entries;
+  try {
+    entries = readdirSync3(bundledDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const src = join12(bundledDir, name);
+    try {
+      if (!statSync4(src).isDirectory()) continue;
+      const manifest = readManifest(src);
+      if (manifest === null || dismissed.has(manifest.id)) continue;
+      if (manifest.autoInstall === false) continue;
+      const dest = join12(userDir, manifest.id);
+      if (!shouldInstall(src, dest, manifest.version)) continue;
+      mkdirSync9(userDir, { recursive: true });
+      rmSync6(dest, { recursive: true, force: true });
+      cpSync(src, dest, { recursive: true });
+    } catch {
+    }
+  }
+}
+function installPluginFromDisk(sourceDir, opts) {
+  const manifest = readManifest(sourceDir);
+  if (manifest === null) throw new Error("The selected folder is not a Glassbox plugin (no manifest.json).");
+  const userDir = opts?.userDir ?? pluginsDir();
+  mkdirSync9(userDir, { recursive: true });
+  const dest = join12(userDir, manifest.id);
+  rmSync6(dest, { recursive: true, force: true });
+  try {
+    symlinkSync(sourceDir, dest, "dir");
+  } catch {
+    cpSync(sourceDir, dest, { recursive: true });
+  }
+  writeDismissed(readDismissed(userDir).filter((x) => x !== manifest.id), userDir);
+  return { id: manifest.id };
+}
+function undismissPlugin(id, userDir = pluginsDir()) {
+  writeDismissed(readDismissed(userDir).filter((x) => x !== id), userDir);
+}
+function uninstallPlugin(id, opts) {
+  const userDir = opts?.userDir ?? pluginsDir();
+  rmSync6(join12(userDir, id), { recursive: true, force: true });
+  writeDismissed([...readDismissed(userDir), id], userDir);
+}
+var DISMISSED_FILE;
+var init_install = __esm({
+  "src/plugins/install.ts"() {
+    "use strict";
+    init_loader();
+    DISMISSED_FILE = "dismissed-plugins.json";
+  }
+});
+
+// src/plugins/index.ts
+var plugins_exports = {};
+__export(plugins_exports, {
+  __resetContentPluginsForTest: () => __resetContentPluginsForTest,
+  __setContentRegistryForTest: () => __setContentRegistryForTest,
+  decodeImageWithPlugin: () => decodeImageWithPlugin,
+  describeInstalledPlugins: () => describeInstalledPlugins,
+  diffContent: () => diffContent,
+  getLoadedPlugins: () => getLoadedPlugins,
+  getPluginManifest: () => getPluginManifest,
+  initContentPlugins: () => initContentPlugins,
+  listPluginUIElements: () => listPluginUIElements,
+  mightHandleFile: () => mightHandleFile,
+  notifyReviewCompleted: () => notifyReviewCompleted,
+  notifyReviewCreated: () => notifyReviewCreated,
+  persistPluginUIState: () => persistPluginUIState,
+  pluginsEnabled: () => pluginsEnabled,
+  reloadContentPlugins: () => reloadContentPlugins,
+  renderContent: () => renderContent,
+  runPluginAction: () => runPluginAction
+});
+function pluginsEnabled() {
+  return PLUGINS_ENABLED;
+}
+function enablementCheckFor(repoRoot) {
+  const lists = readEnablementLists(repoRoot);
+  return (id) => {
+    const scope = disabledScope(id, lists);
+    return scope === null ? { disabled: false } : { disabled: true, scope };
+  };
+}
+async function loadFor(repoRoot) {
+  installBundledPlugins();
+  clearAllPluginUIElements();
+  const res = await loadAllPlugins(void 0, enablementCheckFor(repoRoot), repoRoot);
+  registry2 = res.registry;
+  loadedPlugins = res.loaded;
+  currentRepoRoot = repoRoot;
+  const failed = loadedPlugins.filter((p) => p.status === "error").length;
+  const disabled = loadedPlugins.filter((p) => p.status === "disabled").length;
+  if (loadedPlugins.length > 0) {
+    const parts = [`${loadedPlugins.length - failed - disabled} loaded`];
+    if (disabled > 0) parts.push(`${disabled} disabled`);
+    if (failed > 0) parts.push(`${failed} failed`);
+    console.log(`  Content plugins: ${parts.join(", ")}.`);
+  }
+}
+async function initContentPlugins(repoRoot = "") {
+  if (initialized) return;
+  initialized = true;
+  if (!PLUGINS_ENABLED) return;
+  try {
+    await loadFor(repoRoot);
+  } catch (e) {
+    console.warn(`  Content plugins failed to load: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function reloadContentPlugins(repoRoot = currentRepoRoot) {
+  if (!PLUGINS_ENABLED) return;
+  initialized = true;
+  try {
+    await loadFor(repoRoot);
+  } catch (e) {
+    console.warn(`  Content plugins failed to reload: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+function getLoadedPlugins() {
+  return loadedPlugins;
+}
+function resolveConfigLabels(manifest) {
+  const out = {};
+  const walk = (items) => {
+    for (const item of items ?? []) {
+      if (item.type === "label" && item.id !== void 0 && item.id !== "") {
+        const override = getConfigLabelOverride(manifest.id, item.id);
+        out[item.id] = override ?? { text: item.text ?? "", color: item.color };
+      }
+      if (item.type === "group") walk(item.items);
+    }
+  };
+  walk(manifest.configLayout);
+  return out;
+}
+function describeInstalledPlugins(repoRoot) {
+  const globalDisabled = new Set(readGlobalDisabled());
+  const projectDisabled = new Set(readProjectDisabled(repoRoot));
+  return loadedPlugins.map((p) => {
+    const extensions = (p.manifest?.contentTypes ?? []).flatMap((ct) => ct.extensions ?? []);
+    const display = p.manifest ? readPluginPreferenceDisplay(p.manifest, repoRoot) : { values: {}, secretConfigured: [] };
+    return {
+      id: p.id,
+      name: p.manifest?.name ?? p.id,
+      version: p.manifest?.version ?? "0",
+      extensions,
+      status: p.status,
+      error: p.error,
+      enabled: p.status === "loaded",
+      disabledScope: p.disabledScope,
+      globalDisabled: globalDisabled.has(p.id),
+      projectDisabled: projectDisabled.has(p.id),
+      preferences: p.manifest?.preferences ?? [],
+      preferenceValues: display.values,
+      secretConfigured: display.secretConfigured,
+      configLayout: p.manifest?.configLayout,
+      configLabels: p.manifest ? resolveConfigLabels(p.manifest) : {}
+    };
+  });
+}
+function getPluginManifest(id) {
+  return loadedPlugins.find((p) => p.id === id)?.manifest ?? void 0;
+}
+async function runPluginAction(id, actionId, value) {
+  if (!PLUGINS_ENABLED) throw new Error("Plugins are disabled");
+  const loaded = loadedPlugins.find((p) => p.id === id);
+  if (loaded === void 0 || loaded.status !== "loaded" || loaded.instance === void 0 || loaded.context === void 0) {
+    throw new Error("Plugin not active");
+  }
+  if (typeof loaded.instance.onAction !== "function") {
+    throw new Error("Plugin does not handle actions");
+  }
+  return await loaded.instance.onAction(actionId, loaded.context, value);
+}
+function statefulKey(e) {
+  return e.type === "toggle" || e.type === "switch" || e.type === "segmented-control" ? e.stateKey : void 0;
+}
+function elementAction(e) {
+  return e.type === "link" ? void 0 : e.action;
+}
+function persistPluginUIState(id, actionId, value, repoRoot) {
+  const manifest = loadedPlugins.find((p) => p.id === id && p.status === "loaded")?.manifest;
+  if (manifest === null || manifest === void 0) return;
+  const group = getPluginUIElements().find((g) => g.pluginId === id);
+  const el = group?.elements.find((e) => elementAction(e) === actionId && statefulKey(e) !== void 0 && statefulKey(e) !== "");
+  const key = el ? statefulKey(el) : void 0;
+  if (key === void 0 || key === "") return;
+  try {
+    writePluginSetting(manifest, repoRoot, key, value);
+  } catch {
+  }
+}
+function toReviewHookInfo(review) {
+  return { id: review.id, repoPath: review.repo_path, repoName: review.repo_name, mode: review.mode, status: review.status };
+}
+function toAnnotationHookInfo(a) {
+  return { id: a.id, filePath: a.file_path, lineNumber: a.line_number, side: a.side, category: a.category, content: a.content };
+}
+async function notifyReviewCreated(review) {
+  if (!PLUGINS_ENABLED) return;
+  const info = toReviewHookInfo(review);
+  for (const p of loadedPlugins) {
+    const hook = p.registration?.reviewHooks?.onReviewCreated;
+    if (p.status !== "loaded" || hook === void 0 || p.context === void 0) continue;
+    try {
+      await hook(info, p.context);
+    } catch (e) {
+      console.warn(`  [plugin:${p.id}] onReviewCreated hook failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+}
+async function notifyReviewCompleted(review, annotations, exportPath) {
+  if (!PLUGINS_ENABLED) return;
+  const info = toReviewHookInfo(review);
+  const anns = annotations.map(toAnnotationHookInfo);
+  for (const p of loadedPlugins) {
+    const hook = p.registration?.reviewHooks?.onReviewCompleted;
+    if (p.status !== "loaded" || hook === void 0 || p.context === void 0) continue;
+    try {
+      await hook(info, anns, exportPath, p.context);
+    } catch (e) {
+      console.warn(`  [plugin:${p.id}] onReviewCompleted hook failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+}
+function listPluginUIElements(repoRoot = "") {
+  if (!PLUGINS_ENABLED) return [];
+  const loaded = new Map(loadedPlugins.filter((p) => p.status === "loaded").map((p) => [p.id, p]));
+  const out = [];
+  for (const { pluginId, elements } of getPluginUIElements()) {
+    const plugin = loaded.get(pluginId);
+    if (plugin === void 0) continue;
+    for (const el of elements) {
+      const key = statefulKey(el);
+      const value = key !== void 0 && key !== "" && plugin.manifest !== null ? readPluginSetting(plugin.manifest, repoRoot, key) ?? void 0 : void 0;
+      out.push({ ...el, pluginId, value });
+    }
+  }
+  return out;
+}
+function mightHandleFile(path, mime) {
+  return PLUGINS_ENABLED && registry2.mightHandleByPath(path, mime);
+}
+function usableView(view) {
+  if (view === void 0) return null;
+  const svg = typeof view.svg === "string" && view.svg !== "";
+  const html = typeof view.html === "string" && view.html !== "";
+  return svg || html ? view : null;
+}
+async function renderContent(input) {
+  if (!PLUGINS_ENABLED) return null;
+  const renderer = registry2.findRenderer(input);
+  if (renderer === void 0) return null;
+  try {
+    return usableView(await renderer.render(input));
   } catch {
     return null;
   }
 }
-function clearImageBlobs(dataDir) {
+async function decodeImageWithPlugin(bytes, path, mime) {
+  if (!PLUGINS_ENABLED) return null;
+  const decoder = registry2.findImageDecoder({ bytes, path, mime });
+  if (decoder === void 0) return null;
   try {
-    rmSync3(blobDir(dataDir), { recursive: true, force: true });
+    return await decoder.decode({ bytes, path }) ?? null;
   } catch {
+    return null;
   }
 }
-var init_image_blobs = __esm({
-  "src/git/image-blobs.ts"() {
+async function diffContent(input) {
+  if (!PLUGINS_ENABLED) return null;
+  const differ = registry2.findDiffer(input);
+  if (differ === void 0) return null;
+  try {
+    return usableView(await differ.diff(input));
+  } catch {
+    return null;
+  }
+}
+function __setContentRegistryForTest(r, loaded = []) {
+  registry2 = r;
+  loadedPlugins = loaded;
+  initialized = true;
+}
+function __resetContentPluginsForTest() {
+  registry2 = new ContentPluginRegistry();
+  loadedPlugins = [];
+  initialized = false;
+}
+var registry2, loadedPlugins, initialized, currentRepoRoot;
+var init_plugins = __esm({
+  "src/plugins/index.ts"() {
     "use strict";
+    init_feature_flags();
+    init_enablement();
+    init_install();
+    init_loader();
+    init_registry();
+    init_settings();
+    registry2 = new ContentPluginRegistry();
+    loadedPlugins = [];
+    initialized = false;
+    currentRepoRoot = "";
   }
 });
 
@@ -17449,17 +18592,17 @@ __export(difftool_discovery_exports, {
   tryAcquireStartingLock: () => tryAcquireStartingLock,
   writeDiscovery: () => writeDiscovery
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync14, readFileSync as readFileSync20, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync16, readFileSync as readFileSync22, rmSync as rmSync7, statSync as statSync7, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join19 } from "path";
+import { join as join23 } from "path";
 function difftoolHome() {
-  return join19(homedir3(), ".glassbox");
+  return join23(homedir3(), ".glassbox");
 }
 function discoveryPath(home = difftoolHome()) {
-  return join19(home, "difftool.lock");
+  return join23(home, "difftool.lock");
 }
 function startingLockPath(home = difftoolHome()) {
-  return join19(home, "difftool-starting.lock");
+  return join23(home, "difftool-starting.lock");
 }
 function parseDiscovery(raw2) {
   let parsed;
@@ -17473,35 +18616,35 @@ function parseDiscovery(raw2) {
 }
 function readDiscovery(home = difftoolHome()) {
   const path = discoveryPath(home);
-  if (!existsSync16(path)) return null;
+  if (!existsSync19(path)) return null;
   try {
-    return parseDiscovery(readFileSync20(path, "utf-8"));
+    return parseDiscovery(readFileSync22(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeDiscovery(port, home = difftoolHome()) {
-  mkdirSync14(home, { recursive: true });
-  writeFileSync14(discoveryPath(home), JSON.stringify({ port, pid: process.pid }));
+  mkdirSync16(home, { recursive: true });
+  writeFileSync16(discoveryPath(home), JSON.stringify({ port, pid: process.pid }));
 }
 function clearDiscovery(home = difftoolHome()) {
   try {
-    rmSync6(discoveryPath(home), { force: true });
+    rmSync7(discoveryPath(home), { force: true });
   } catch {
   }
 }
 function tryAcquireStartingLock(home = difftoolHome()) {
-  mkdirSync14(home, { recursive: true });
+  mkdirSync16(home, { recursive: true });
   const path = startingLockPath(home);
   try {
-    writeFileSync14(path, String(process.pid), { flag: "wx" });
+    writeFileSync16(path, String(process.pid), { flag: "wx" });
     return true;
   } catch {
     try {
-      const ageMs = Date.now() - statSync5(path).mtimeMs;
+      const ageMs = Date.now() - statSync7(path).mtimeMs;
       if (ageMs > STARTING_LOCK_STALE_MS) {
-        rmSync6(path, { force: true });
-        writeFileSync14(path, String(process.pid), { flag: "wx" });
+        rmSync7(path, { force: true });
+        writeFileSync16(path, String(process.pid), { flag: "wx" });
         return true;
       }
     } catch {
@@ -17511,7 +18654,7 @@ function tryAcquireStartingLock(home = difftoolHome()) {
 }
 function releaseStartingLock(home = difftoolHome()) {
   try {
-    rmSync6(startingLockPath(home), { force: true });
+    rmSync7(startingLockPath(home), { force: true });
   } catch {
   }
 }
@@ -21966,16 +23109,16 @@ __export(perceptual_diff_exports, {
   decodeImage: () => decodeImage,
   isIdentical: () => isIdentical
 });
-import { readFileSync as readFileSync21 } from "fs";
-import { extname as extname2 } from "path";
+import { readFileSync as readFileSync23 } from "fs";
+import { extname as extname3 } from "path";
 function decodeImage(path) {
   let buf;
   try {
-    buf = readFileSync21(path);
+    buf = readFileSync23(path);
   } catch {
     return null;
   }
-  const ext = extname2(path).toLowerCase();
+  const ext = extname3(path).toLowerCase();
   try {
     if (ext === ".png") {
       const png = import_pngjs.PNG.sync.read(buf);
@@ -21990,9 +23133,24 @@ function decodeImage(path) {
   }
   return null;
 }
-function comparePerceptual(actualPath, expectedPath) {
-  const actual = decodeImage(actualPath);
-  const expected = decodeImage(expectedPath);
+async function decodeWithFallback(path, pluginDecode) {
+  const core = decodeImage(path);
+  if (core !== null) return core;
+  let buf;
+  try {
+    buf = readFileSync23(path);
+  } catch {
+    return null;
+  }
+  try {
+    return await pluginDecode(new Uint8Array(buf), path);
+  } catch {
+    return null;
+  }
+}
+async function comparePerceptual(actualPath, expectedPath, pluginDecode = decodeImageWithPlugin) {
+  const actual = await decodeWithFallback(actualPath, pluginDecode);
+  const expected = await decodeWithFallback(expectedPath, pluginDecode);
   if (actual === null || expected === null) {
     return { scorable: false, score: null, reason: "undecodable" };
   }
@@ -22023,14 +23181,15 @@ var init_perceptual_diff = __esm({
     import_jpeg_js = __toESM(require_jpeg_js(), 1);
     init_pixelmatch();
     import_pngjs = __toESM(require_png(), 1);
+    init_plugins();
     PERCEPTUAL_THRESHOLD = 0.1;
   }
 });
 
 // src/cli.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync15, realpathSync, statSync as statSync6 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync17, realpathSync, statSync as statSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename5, join as join20, resolve as resolve12 } from "path";
+import { basename as basename5, join as join24, resolve as resolve12 } from "path";
 
 // src/cli-subcommands.ts
 import { resolve as resolve3 } from "path";
@@ -22095,160 +23254,23 @@ async function handleDifftoolRegistration(action, local, force) {
   } else {
     console.log(`Nothing to unregister at --${scope} scope (current tool: ${status.tool ?? "none"}).`);
   }
-  process.exit(0);
-}
-
-// src/cli.ts
-init_connection();
-init_queries();
-init_debug();
-
-// src/ai/config.ts
-init_zod();
-
-// src/global-config.ts
-init_zod();
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { join as join4 } from "path";
-var GlobalConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
-function resolveGlobalConfigDir() {
-  const override = process.env.GLASSBOX_CONFIG_DIR;
-  if (override !== void 0 && override.trim() !== "") return override;
-  return join4(homedir(), ".glassbox");
-}
-var GLOBAL_CONFIG_DIR = resolveGlobalConfigDir();
-var GLOBAL_CONFIG_PATH = join4(GLOBAL_CONFIG_DIR, "config.json");
-function readGlobalConfig() {
-  try {
-    if (existsSync4(GLOBAL_CONFIG_PATH)) {
-      const raw2 = JSON.parse(readFileSync3(GLOBAL_CONFIG_PATH, "utf-8"));
-      const parsed = GlobalConfigSchema.safeParse(raw2);
-      if (parsed.success) return parsed.data;
-    }
-  } catch {
-  }
-  return {};
-}
-function writeGlobalConfig(config2) {
-  mkdirSync5(GLOBAL_CONFIG_DIR, { recursive: true });
-  writeFileSync3(GLOBAL_CONFIG_PATH, JSON.stringify(config2, null, 2), "utf-8");
-  try {
-    chmodSync(GLOBAL_CONFIG_PATH, 384);
-  } catch {
-  }
-}
-function updateGlobalConfig(mutator) {
-  const cfg = readGlobalConfig();
-  const result = mutator(cfg);
-  writeGlobalConfig(result === void 0 ? cfg : result);
-}
-
-// src/ai/api-keys.ts
-import { spawnSync as spawnSync6 } from "child_process";
-
-// src/ai/keychain.ts
-import { spawnSync as spawnSync5 } from "child_process";
-var WIN_CRED_READ_PS = `
-Add-Type -TypeDefinition @'
-using System;
-using System.Runtime.InteropServices;
-public class CredHelper {
-    [DllImport("advapi32", SetLastError = true, CharSet = CharSet.Unicode)]
-    static extern bool CredRead(string t, int type, int f, out IntPtr p);
-    [DllImport("advapi32")]
-    static extern void CredFree(IntPtr p);
-    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-    struct CRED {
-        public int Flags; public int Type; public string TargetName; public string Comment;
-        public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;
-        public int Persist; public int AttributeCount; public IntPtr Attributes;
-        public string TargetAlias; public string UserName;
-    }
-    public static string Read(string target) {
-        IntPtr ptr;
-        if (!CredRead(target, 1, 0, out ptr)) return "";
-        CRED c = (CRED)Marshal.PtrToStructure(ptr, typeof(CRED));
-        string r = Marshal.PtrToStringUni(c.CredentialBlob, c.CredentialBlobSize / 2);
-        CredFree(ptr);
-        return r;
-    }
-}
-'@
-`;
-function winCredTarget(platform) {
-  return `glassbox-${platform}-api-key`;
-}
-function getKeyFromKeychain(platform) {
-  const os = process.platform;
-  const account = `${platform}-api-key`;
-  try {
-    if (os === "darwin") {
-      const r = spawnSync5("security", ["find-generic-password", "-s", "glassbox", "-a", account, "-w"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
-      const result = r.stdout.trim();
-      return r.status === 0 && result !== "" ? result : null;
-    }
-    if (os === "linux") {
-      const r = spawnSync5("secret-tool", ["lookup", "service", "glassbox", "account", account], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
-      const result = r.stdout.trim();
-      return r.status === 0 && result !== "" ? result : null;
-    }
-    if (os === "win32") {
-      const target = winCredTarget(platform);
-      const list = spawnSync5("cmdkey", ["/list:" + target], { encoding: "utf-8" });
-      if (list.status !== 0 || (list.stdout || "").includes("* NONE *")) return null;
-      const script = WIN_CRED_READ_PS + `Write-Output ([CredHelper]::Read('${target}'))`;
-      const r = spawnSync5("powershell", ["-NoProfile", "-Command", "-"], { input: script, encoding: "utf-8" });
-      const result = r.stdout.trim();
-      return r.status === 0 && result !== "" ? result : null;
-    }
-  } catch {
-    return null;
-  }
-  return null;
-}
-function assertSpawnOk(label, r) {
-  if (r.error) throw new Error(`${label} failed: ${r.error.message}`);
-  if (r.status !== 0) {
-    const detail = (String(r.stderr) || String(r.stdout)).trim();
-    throw new Error(`${label} failed (exit ${String(r.status)})${detail ? `: ${detail}` : ""}`);
-  }
-}
-function saveKeyToKeychain(platform, key) {
-  const os = process.platform;
-  const account = `${platform}-api-key`;
-  if (os === "darwin") {
-    spawnSync5("security", ["delete-generic-password", "-s", "glassbox", "-a", account], { stdio: "pipe" });
-    assertSpawnOk("Keychain write", spawnSync5("security", ["add-generic-password", "-s", "glassbox", "-a", account, "-w", key], { encoding: "utf-8" }));
-    return;
-  }
-  if (os === "linux") {
-    assertSpawnOk("System keyring write", spawnSync5("secret-tool", ["store", "--label=Glassbox API Key", "service", "glassbox", "account", account], { input: key, encoding: "utf-8" }));
-    return;
-  }
-  if (os === "win32") {
-    const target = winCredTarget(platform);
-    const escapedKey = key.replace(/'/g, "''");
-    const script = `cmdkey /generic:'${target}' /user:'glassbox' /pass:'${escapedKey}'`;
-    assertSpawnOk("Credential Manager write", spawnSync5("powershell", ["-NoProfile", "-Command", "-"], { input: script, encoding: "utf-8" }));
-  }
-}
-function isKeychainAvailable() {
-  const os = process.platform;
-  if (os === "darwin" || os === "win32") return true;
-  if (os === "linux") {
-    return spawnSync5("which", ["secret-tool"], { stdio: "pipe" }).status === 0;
-  }
-  return false;
-}
-function getKeychainLabel() {
-  const os = process.platform;
-  if (os === "darwin") return "Keychain";
-  if (os === "linux") return "System Keyring";
-  if (os === "win32") return "Credential Manager";
-  return "System Keychain";
+  process.exit(0);
 }
 
+// src/cli.ts
+init_connection();
+init_queries();
+init_debug();
+
+// src/ai/config.ts
+init_zod();
+init_global_config();
+
+// src/ai/api-keys.ts
+init_global_config();
+import { spawnSync as spawnSync6 } from "child_process";
+init_keychain();
+
 // src/ai/models.ts
 init_zod();
 var AIModelSchema = external_exports.object({
@@ -22340,6 +23362,7 @@ function resolveModelId(platform, modelId) {
 }
 
 // src/ai/api-keys.ts
+init_keychain();
 function getKeyFromEnv(platform) {
   const envName = ENV_KEY_NAMES[platform];
   return process.env[envName] ?? null;
@@ -23551,8 +24574,10 @@ function getFileDiffs(mode, cwd) {
   const diffArgs = getDiffArgs(mode);
   const rawDiff = gitOrEmpty([...diffArgs, "-U3"], repoRoot);
   const diffs = parseDiff(rawDiff);
-  if (mode.type === "uncommitted") {
-    const untracked = git(["ls-files", "--others", "--exclude-standard"], repoRoot).trim();
+  if (mode.type === "uncommitted" || mode.type === "files") {
+    const lsArgs = ["ls-files", "--others", "--exclude-standard"];
+    if (mode.type === "files") lsArgs.push("--", ...mode.patterns);
+    const untracked = git(lsArgs, repoRoot).trim();
     if (untracked) {
       for (const file2 of untracked.split("\n").filter(Boolean)) {
         if (!diffs.some((d) => d.filePath === file2)) {
@@ -23950,10 +24975,10 @@ async function updateReviewDiffs(reviewId, newDiffs, headCommit) {
 
 // src/server.ts
 import { serve } from "@hono/node-server";
-import { existsSync as existsSync13, readFileSync as readFileSync17 } from "fs";
-import { Hono as Hono20 } from "hono";
-import { dirname as dirname7, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { existsSync as existsSync16, readFileSync as readFileSync19 } from "fs";
+import { Hono as Hono21 } from "hono";
+import { dirname as dirname8, join as join20 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/channel-config.ts
 init_zod();
@@ -24053,6 +25078,11 @@ async function triggerChannel(dataDir, message) {
   }
 }
 
+// src/server.ts
+init_queries();
+init_global_config();
+init_plugins();
+
 // src/routes/ai-api.ts
 import { Hono as Hono3 } from "hono";
 
@@ -25294,39 +26324,7 @@ __export(ai_exports, {
   startAnalysis: () => startAnalysis
 });
 init_zod();
-
-// src/api/_runner.ts
-init_zod();
-var OkResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
-function currentReviewId() {
-  if (typeof document === "undefined") return "";
-  return document.body.dataset.reviewId ?? "";
-}
-async function apiCall(responseSchema, path, opts = {}) {
-  const separator = path.includes("?") ? "&" : "?";
-  const url2 = "/api" + path + separator + "reviewId=" + encodeURIComponent(currentReviewId());
-  const res = await fetch(url2, {
-    headers: { "Content-Type": "application/json" },
-    method: opts.method,
-    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
-  });
-  const json2 = await res.json();
-  const result = responseSchema.safeParse(json2);
-  if (!result.success) {
-    const summary = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-    throw new Error(`API response from ${path} failed validation: ${summary}`);
-  }
-  return result.data;
-}
-function qs(params) {
-  const entries = Object.entries(params).filter(([, v]) => v !== void 0 && v !== null);
-  if (entries.length === 0) return "";
-  const usp = new URLSearchParams();
-  for (const [k, v] of entries) usp.set(k, String(v));
-  return "?" + usp.toString();
-}
-
-// src/api/ai.ts
+init_runner();
 var KeySourceSchema = external_exports.enum(["env", "keychain", "config"]).nullable();
 var KeyStorageSchema = external_exports.enum(["keychain", "config"]);
 var GuidedReviewConfigShapeSchema = external_exports.object({
@@ -25539,6 +26537,7 @@ __export(annotations_exports, {
 });
 init_zod();
 init_schemas3();
+init_runner();
 var AnnotationCategorySchema = external_exports.enum([
   "bug",
   "fix",
@@ -25644,6 +26643,7 @@ __export(channel_exports, {
   triggerChannel: () => triggerChannel2
 });
 init_zod();
+init_runner();
 var GetChannelStatusRespSchema = external_exports.object({
   enabled: external_exports.boolean(),
   connected: external_exports.boolean()
@@ -25687,6 +26687,7 @@ __export(context_exports, {
   getContextLines: () => getContextLines
 });
 init_zod();
+init_runner();
 var ContextLineSchema = external_exports.object({
   num: external_exports.number().int(),
   content: external_exports.string()
@@ -25736,6 +26737,7 @@ __export(files_exports, {
 });
 init_zod();
 init_schemas3();
+init_runner();
 var FileStatusSchema = external_exports.enum(["pending", "reviewed"]);
 var GroundTruthMetaSchema = external_exports.object({
   label: external_exports.string().optional(),
@@ -25750,6 +26752,10 @@ var GroundTruthMetaSchema = external_exports.object({
 });
 var ListFilesRespSchema = external_exports.object({
   files: external_exports.array(ReviewFileSchema),
+  /** Ids of files a content plugin renders (doc 29, GB-1052) — the client shows
+   *  the Code/Rendered toggle and routes the Rendered view through the image
+   *  viewer for these, like an SVG file. */
+  pluginRendered: external_exports.array(external_exports.string()).optional(),
   annotationCounts: external_exports.record(external_exports.string(), external_exports.number()),
   staleCounts: external_exports.record(external_exports.string(), external_exports.number()),
   /** Keyed by review-file id; omitted/empty for non-ground-truth reviews. */
@@ -25807,6 +26813,7 @@ __export(image_exports, {
   imageUrl: () => imageUrl
 });
 init_zod();
+init_runner();
 var ImageSideSchema = external_exports.enum(["old", "new"]);
 var GetImageMetadataReqSchema = external_exports.object({ fileId: external_exports.string() });
 var GetImageMetadataRespSchema = external_exports.object({
@@ -25833,6 +26840,7 @@ __export(outline_exports, {
   getOutline: () => getOutline
 });
 init_zod();
+init_runner();
 var baseOutlineSymbol = external_exports.object({
   name: external_exports.string(),
   kind: external_exports.enum(["class", "function"]),
@@ -25868,29 +26876,8 @@ async function findSymbolDefinition(req) {
   );
 }
 
-// src/api/project-settings.ts
-var project_settings_exports = {};
-__export(project_settings_exports, {
-  GetProjectSettingsRespSchema: () => GetProjectSettingsRespSchema,
-  ProjectSettingsSchema: () => ProjectSettingsSchema,
-  UpdateProjectSettingsReqSchema: () => UpdateProjectSettingsReqSchema,
-  UpdateProjectSettingsRespSchema: () => UpdateProjectSettingsRespSchema,
-  getProjectSettings: () => getProjectSettings,
-  updateProjectSettings: () => updateProjectSettings
-});
-init_zod();
-var ProjectSettingsSchema = external_exports.object({
-  appName: external_exports.string().optional()
-});
-var GetProjectSettingsRespSchema = ProjectSettingsSchema;
-var UpdateProjectSettingsReqSchema = ProjectSettingsSchema.partial();
-var UpdateProjectSettingsRespSchema = ProjectSettingsSchema;
-async function getProjectSettings() {
-  return apiCall(GetProjectSettingsRespSchema, "/project-settings");
-}
-async function updateProjectSettings(req) {
-  return apiCall(UpdateProjectSettingsRespSchema, "/project-settings", { method: "PATCH", body: req });
-}
+// src/api/index.ts
+init_project_settings();
 
 // src/api/reviews.ts
 var reviews_exports = {};
@@ -25916,6 +26903,7 @@ __export(reviews_exports, {
 });
 init_zod();
 init_schemas3();
+init_runner();
 var ListReviewsRespSchema = external_exports.array(ReviewSchema);
 var GetCurrentReviewRespSchema = ReviewSchema.nullable();
 var OnCompleteHookResultSchema = external_exports.object({
@@ -25979,6 +26967,7 @@ __export(share_prompt_exports, {
   tickSharePrompt: () => tickSharePrompt
 });
 init_zod();
+init_runner();
 var GetSharePromptStateRespSchema = external_exports.object({
   dismissedAt: external_exports.number().nullable(),
   totalOpenMs: external_exports.number()
@@ -26006,6 +26995,7 @@ __export(system_exports, {
   openExternal: () => openExternal
 });
 init_zod();
+init_runner();
 var OpenExternalReqSchema = external_exports.object({
   // Restricted to http(s): this hands the value to the OS "open" handler, so
   // we don't want to let it launch arbitrary schemes (file:, custom apps).
@@ -26519,6 +27509,7 @@ function themeToInlineStyle(colors) {
 }
 
 // src/api/themes.ts
+init_runner();
 function buildThemeColorsSchema() {
   const shape = {};
   for (const key of THEME_VARIABLES) shape[key] = external_exports.string();
@@ -26611,11 +27602,13 @@ async function deleteTheme(req) {
 // src/api/attachments.ts
 init_zod();
 init_schemas3();
+init_runner();
 var ListAttachmentsRespSchema = external_exports.array(AttachmentSchema);
 
 // src/api/difftool.ts
 init_zod();
 init_schemas3();
+init_runner();
 var DifftoolStatusRespSchema = external_exports.object({
   tool: external_exports.string().nullable(),
   cmd: external_exports.string().nullable(),
@@ -26650,8 +27643,163 @@ var DifftoolPollRespSchema = external_exports.object({
 });
 var DifftoolEndRespSchema = external_exports.object({ ok: external_exports.literal(true) });
 
+// src/api/plugins.ts
+init_zod();
+init_runner();
+var PluginStatusSchema = external_exports.enum(["loaded", "disabled", "error"]);
+var PluginPreferenceInfoSchema = external_exports.object({
+  key: external_exports.string(),
+  label: external_exports.string(),
+  type: external_exports.enum(["string", "number", "boolean", "select"]),
+  default: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  options: external_exports.array(external_exports.string()).optional(),
+  scope: external_exports.enum(["global", "project"]).optional(),
+  secret: external_exports.boolean().optional()
+});
+var ConfigLabelColorSchema2 = external_exports.enum(["default", "success", "error", "warning", "transient"]);
+var ConfigLayoutItemSchema2 = external_exports.lazy(
+  () => external_exports.object({
+    type: external_exports.enum(["preference", "divider", "spacer", "label", "button", "group"]),
+    key: external_exports.string().optional(),
+    id: external_exports.string().optional(),
+    text: external_exports.string().optional(),
+    color: ConfigLabelColorSchema2.optional(),
+    label: external_exports.string().optional(),
+    action: external_exports.string().optional(),
+    style: external_exports.string().optional(),
+    title: external_exports.string().optional(),
+    collapsed: external_exports.boolean().optional(),
+    items: external_exports.array(ConfigLayoutItemSchema2).optional()
+  })
+);
+var PluginInfoSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: external_exports.string(),
+  /** Extensions the plugin's content types declare (informational). */
+  extensions: external_exports.array(external_exports.string()),
+  status: PluginStatusSchema,
+  error: external_exports.string().optional(),
+  /** True when active (loaded). False when disabled by either scope. */
+  enabled: external_exports.boolean(),
+  /** Which scope disables it (global wins), when disabled. */
+  disabledScope: external_exports.enum(["global", "project"]).optional(),
+  /** The two independent disable flags, so the UI can render both toggles. */
+  globalDisabled: external_exports.boolean(),
+  projectDisabled: external_exports.boolean(),
+  /** Manifest-declared preferences + their current values (doc 29 FR-29.12).
+   *  Secret values are never sent; `secretConfigured` names the secret keys that
+   *  have a stored value (GB-1054). */
+  preferences: external_exports.array(PluginPreferenceInfoSchema),
+  preferenceValues: external_exports.record(external_exports.string(), external_exports.string()),
+  secretConfigured: external_exports.array(external_exports.string()),
+  /** Optional manifest arrangement of the preferences (doc 29 FR-29.18). */
+  configLayout: external_exports.array(ConfigLayoutItemSchema2).optional(),
+  /** Effective `label`-item text/color, keyed by label id (doc 29 FR-29.18). */
+  configLabels: external_exports.record(external_exports.string(), external_exports.object({ text: external_exports.string(), color: ConfigLabelColorSchema2.optional() }))
+});
+var ListPluginsRespSchema = external_exports.object({
+  plugins: external_exports.array(PluginInfoSchema),
+  /** Set when a mutation (e.g. install-from-disk of a non-plugin folder) failed;
+   *  the list is still returned so the UI stays in sync + can show the message. */
+  error: external_exports.string().optional()
+});
+var SetPluginDisabledReqSchema = external_exports.object({
+  scope: external_exports.enum(["global", "project"]),
+  disabled: external_exports.boolean()
+});
+var InstallPluginReqSchema = external_exports.object({ path: external_exports.string().min(1) });
+var RequirementStatusSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  met: external_exports.boolean(),
+  hint: external_exports.string(),
+  docUrl: external_exports.string().optional()
+});
+var AvailablePluginSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: external_exports.string(),
+  description: external_exports.string().optional(),
+  extensions: external_exports.array(external_exports.string()),
+  requirements: external_exports.array(RequirementStatusSchema),
+  provisionNotes: external_exports.array(external_exports.string()),
+  selfContained: external_exports.boolean(),
+  cliHint: external_exports.string().optional()
+});
+var ListAvailablePluginsRespSchema = external_exports.object({ available: external_exports.array(AvailablePluginSchema) });
+var ProvisionOutcomeSchema = external_exports.object({
+  step: external_exports.string(),
+  ok: external_exports.boolean(),
+  skipped: external_exports.boolean(),
+  detail: external_exports.string()
+});
+var InstallResultSchema = external_exports.object({
+  id: external_exports.string(),
+  installed: external_exports.boolean(),
+  status: external_exports.enum(["ready", "needs-setup", "error"]),
+  requirements: external_exports.array(RequirementStatusSchema),
+  provisioned: external_exports.array(ProvisionOutcomeSchema),
+  instructions: external_exports.array(external_exports.string()),
+  error: external_exports.string().optional()
+});
+var InstallBundledPluginRespSchema = external_exports.object({
+  result: InstallResultSchema,
+  plugins: external_exports.array(PluginInfoSchema),
+  available: external_exports.array(AvailablePluginSchema)
+});
+var UninstallPluginRespSchema = ListPluginsRespSchema.extend({
+  available: external_exports.array(AvailablePluginSchema).optional()
+});
+var SetPluginPreferenceReqSchema = external_exports.object({ key: external_exports.string().min(1), value: external_exports.string() });
+var RunPluginActionReqSchema = external_exports.object({ actionId: external_exports.string().min(1), value: external_exports.string().optional() });
+var UIElementFaceSchema = external_exports.object({
+  label: external_exports.string().optional(),
+  icon: external_exports.string().optional(),
+  title: external_exports.string().optional(),
+  style: external_exports.string().optional()
+});
+var UISegmentSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string().optional(),
+  icon: external_exports.string().optional(),
+  title: external_exports.string().optional()
+});
+var PluginUIElementSchema = external_exports.object({
+  pluginId: external_exports.string(),
+  id: external_exports.string(),
+  type: external_exports.string(),
+  location: external_exports.string(),
+  label: external_exports.string().optional(),
+  icon: external_exports.string().optional(),
+  title: external_exports.string().optional(),
+  style: external_exports.string().optional(),
+  action: external_exports.string().optional(),
+  url: external_exports.string().optional(),
+  // Stateful controls (doc 30 FR-30.3): toggle/switch (`on`/`off`), segmented
+  // (`segments`/`selectionMode`); `stateKey` persists, `value` is the resolved
+  // current state the host attaches when listing.
+  on: UIElementFaceSchema.optional(),
+  off: UIElementFaceSchema.optional(),
+  onLabel: external_exports.string().optional(),
+  offLabel: external_exports.string().optional(),
+  segments: external_exports.array(UISegmentSchema).optional(),
+  selectionMode: external_exports.string().optional(),
+  stateKey: external_exports.string().optional(),
+  value: external_exports.string().optional()
+});
+var ListPluginUiRespSchema = external_exports.object({ elements: external_exports.array(PluginUIElementSchema) });
+var RunPluginActionRespSchema = ListPluginsRespSchema.extend({
+  result: external_exports.object({ message: external_exports.string().optional() }).optional()
+});
+
+// src/api/index.ts
+init_project_settings();
+
 // src/api/review-notes.ts
 init_zod();
+init_runner();
 var DiscardReviewNoteReqSchema = external_exports.object({
   guid: external_exports.string().min(1),
   /** Repo-relative source file the note is on (scopes the shard search). */
@@ -27098,7 +28246,7 @@ aiApiRoutes.route("/", aiConfigRoutes);
 aiApiRoutes.route("/", aiAnalysisRoutes);
 
 // src/routes/api.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 
 // src/routes/api/annotations.ts
 import { Hono as Hono4 } from "hono";
@@ -27108,8 +28256,8 @@ init_queries();
 init_attachment_queries();
 init_queries();
 init_schemas3();
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync9, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
+import { join as join13 } from "path";
 init_image_metadata();
 
 // src/utils/formatReviewMode.ts
@@ -27328,10 +28476,10 @@ function buildRegion(a, gt, dimsFor) {
 
 // src/export/generate.ts
 function deleteReviewExport(reviewId, repoRoot) {
-  const exportDir = join10(repoRoot, ".glassbox");
+  const exportDir = join13(repoRoot, ".glassbox");
   for (const ext of ["md", "json"]) {
-    const archivePath = join10(exportDir, `review-${reviewId}.${ext}`);
-    if (existsSync10(archivePath)) unlinkSync2(archivePath);
+    const archivePath = join13(exportDir, `review-${reviewId}.${ext}`);
+    if (existsSync13(archivePath)) unlinkSync2(archivePath);
   }
 }
 function annotationAnchorLabel(a) {
@@ -27358,8 +28506,8 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
   if (!review) throw new Error("Review not found");
   const files = await getReviewFiles(reviewId);
   const annotations = await getAnnotationsForReview(reviewId);
-  const exportDir = join10(repoRoot, ".glassbox");
-  mkdirSync8(exportDir, { recursive: true });
+  const exportDir = join13(repoRoot, ".glassbox");
+  mkdirSync10(exportDir, { recursive: true });
   const byFile = {};
   for (const a of annotations) {
     if (!(a.file_path in byFile)) byFile[a.file_path] = [];
@@ -27452,20 +28600,20 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
     resolveDims: resolveImageDims
   });
   const json2 = JSON.stringify(exportData, null, 2);
-  const archivePath = join10(exportDir, `review-${review.id}.md`);
-  writeFileSync9(archivePath, content, "utf-8");
-  writeFileSync9(join10(exportDir, `review-${review.id}.json`), json2, "utf-8");
+  const archivePath = join13(exportDir, `review-${review.id}.md`);
+  writeFileSync11(archivePath, content, "utf-8");
+  writeFileSync11(join13(exportDir, `review-${review.id}.json`), json2, "utf-8");
   if (isCurrent) {
-    const latestPath = join10(exportDir, "latest-review.md");
-    writeFileSync9(latestPath, content, "utf-8");
-    writeFileSync9(join10(exportDir, "latest-review.json"), json2, "utf-8");
+    const latestPath = join13(exportDir, "latest-review.md");
+    writeFileSync11(latestPath, content, "utf-8");
+    writeFileSync11(join13(exportDir, "latest-review.json"), json2, "utf-8");
     return latestPath;
   }
   return archivePath;
 }
 function resolveImageDims(absPath) {
   try {
-    const meta3 = extractMetadata(readFileSync9(absPath), absPath);
+    const meta3 = extractMetadata(readFileSync12(absPath), absPath);
     if (meta3.width !== null && meta3.height !== null) {
       return { width: meta3.width, height: meta3.height };
     }
@@ -27570,7 +28718,7 @@ annotationsRoutes.get("/annotations/all", async (c) => {
 init_store2();
 init_attachment_queries();
 init_queries();
-import { readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync13, statSync as statSync5 } from "fs";
 import { Hono as Hono5 } from "hono";
 
 // src/utils/mime.ts
@@ -27684,9 +28832,9 @@ attachmentsRoutes.get("/attachments/:id/raw", async (c) => {
   const attachment = await getAttachment(idParam.data);
   if (attachment === void 0) return c.text("Not found", 404);
   try {
-    const stat = statSync3(attachment.stored_path);
+    const stat = statSync5(attachment.stored_path);
     if (!stat.isFile()) return c.text("Not found", 404);
-    const bytes = readFileSync10(attachment.stored_path);
+    const bytes = readFileSync13(attachment.stored_path);
     return new Response(new Uint8Array(bytes), {
       headers: {
         "Content-Type": attachment.mime_type,
@@ -27704,7 +28852,7 @@ attachmentsRoutes.post("/attachments/:id/quicklook", async (c) => {
   const attachment = await getAttachment(idParam.data);
   if (attachment === void 0) return errorResponse(c, "Attachment not found", 404);
   try {
-    statSync3(attachment.stored_path);
+    statSync5(attachment.stored_path);
   } catch {
     return errorResponse(c, "Attachment file missing", 404);
   }
@@ -27806,6 +28954,19 @@ function groundTruthMetaByFileId(mode, files) {
   return out;
 }
 
+// src/plugins/fileView.ts
+init_plugins();
+function pluginRendersFile(filePath) {
+  return pluginsEnabled() && mightHandleFile(filePath);
+}
+async function renderPluginSvgSide(mode, filePath, oldPath, side, cwd) {
+  if (mode === null || !pluginRendersFile(filePath)) return null;
+  const source = getModeFileContent(mode, side === "old" ? oldPath : filePath, side, cwd);
+  if (source.trim() === "") return null;
+  const view = await renderContent({ bytes: new TextEncoder().encode(source), text: source, path: filePath, side });
+  return view?.svg !== void 0 && view.svg !== "" ? view.svg : null;
+}
+
 // src/routes/api/files.ts
 init_openOS();
 var filesRoutes = new Hono7();
@@ -27818,7 +28979,14 @@ filesRoutes.get("/files", async (c) => {
     getReview(reviewId)
   ]);
   const groundTruth = review ? groundTruthMetaByFileId(parseModeString(review.mode), files) : void 0;
-  return c.json({ files, annotationCounts, staleCounts, ...groundTruth ? { groundTruth } : {} });
+  const pluginRendered = files.filter((f) => pluginRendersFile(f.file_path)).map((f) => f.id);
+  return c.json({
+    files,
+    annotationCounts,
+    staleCounts,
+    ...groundTruth ? { groundTruth } : {},
+    ...pluginRendered.length > 0 ? { pluginRendered } : {}
+  });
 });
 filesRoutes.get("/files/:fileId", async (c) => {
   const fileId = requirePathParam(c, "fileId");
@@ -27880,8 +29048,8 @@ import { Hono as Hono8 } from "hono";
 
 // src/git/image.ts
 import { spawnSync as spawnSync8 } from "child_process";
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join11, resolve as resolve8 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join14, resolve as resolve8 } from "path";
 init_image_metadata();
 function getOldRef(mode) {
   switch (mode.type) {
@@ -27945,14 +29113,14 @@ function gitShowFile(ref, filePath, repoRoot) {
 }
 function readWorkingFile(filePath, repoRoot) {
   try {
-    return readFileSync11(resolve8(repoRoot, filePath));
+    return readFileSync14(resolve8(repoRoot, filePath));
   } catch {
     return null;
   }
 }
 function readDiskImage(absPath) {
   try {
-    const data = readFileSync11(absPath);
+    const data = readFileSync14(absPath);
     return { data, size: data.length };
   } catch {
     return null;
@@ -27963,7 +29131,7 @@ function groundTruthEntry(mode, filePath) {
 }
 function getOldImage(mode, filePath, oldPath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join11(directComparisonRoots(mode).rootA, oldPath ?? filePath));
+    return readDiskImage(join14(directComparisonRoots(mode).rootA, oldPath ?? filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -27983,7 +29151,7 @@ function getOldImage(mode, filePath, oldPath, repoRoot) {
 }
 function getNewImage(mode, filePath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join11(directComparisonRoots(mode).rootB, filePath));
+    return readDiskImage(join14(directComparisonRoots(mode).rootB, filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -28057,6 +29225,12 @@ imageRoutes.get("/image/:fileId/:side", async (c) => {
   const diff = parseDiffData(file2.diff_data);
   const oldPath = diff?.oldPath ?? null;
   const status = diff?.status ?? "modified";
+  if (!isImageFile(file2.file_path) && !(side === "old" && status === "added") && !(side === "new" && status === "deleted")) {
+    const svg = await renderPluginSvgSide(mode, file2.file_path, oldPath ?? file2.file_path, side, repoRoot);
+    if (svg !== null) {
+      return new Response(svg, { headers: { "Content-Type": "image/svg+xml", "Cache-Control": "no-cache" } });
+    }
+  }
   const image = resolveImageSide(
     fileIdParam.data,
     side,
@@ -28079,7 +29253,7 @@ imageRoutes.get("/image/:fileId/:side", async (c) => {
 init_queries();
 init_debug();
 import { spawnSync as spawnSync9 } from "child_process";
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { Hono as Hono9 } from "hono";
 import { resolve as resolve9 } from "path";
 
@@ -28457,7 +29631,7 @@ outlineRoutes.get("/symbol-definition", async (c) => {
         }
         let content = "";
         try {
-          content = readFileSync12(resolve9(repoRoot, filePath), "utf-8");
+          content = readFileSync15(resolve9(repoRoot, filePath), "utf-8");
         } catch {
           continue;
         }
@@ -28492,48 +29666,268 @@ function collectDefinitions(symbols, targetName, fileId, filePath, out) {
   }
 }
 
-// src/routes/api/project-settings.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
+// src/routes/api/plugins.ts
 import { Hono as Hono10 } from "hono";
-import { join as join12 } from "path";
-var projectSettingsRoutes = new Hono10();
-function readProjectSettings(repoRoot) {
-  const settingsPath = join12(repoRoot, ".glassbox", "settings.json");
+
+// src/plugins/available.ts
+init_install();
+init_loader();
+import { existsSync as existsSync14 } from "fs";
+import { join as join15 } from "path";
+
+// src/plugins/readiness.ts
+import { spawnSync as spawnSync10 } from "child_process";
+var defaultProbe = (command, args) => {
   try {
-    if (existsSync11(settingsPath)) {
-      const raw2 = JSON.parse(readFileSync13(settingsPath, "utf-8"));
-      const parsed = ProjectSettingsSchema.safeParse(raw2);
-      if (parsed.success) return parsed.data;
-    }
+    const r = spawnSync10(command, args, { stdio: "ignore", timeout: 1e4 });
+    return r.error === void 0 && r.status === 0;
   } catch {
+    return false;
   }
-  return {};
+};
+function checkRequirement(req, runProbe = defaultProbe) {
+  const met = runProbe(req.command, req.checkArgs ?? ["--version"]);
+  return { id: req.id, label: req.label, met, hint: req.hint, docUrl: req.docUrl };
 }
-function writeProjectSettings(repoRoot, settings) {
-  const dir = join12(repoRoot, ".glassbox");
-  mkdirSync9(dir, { recursive: true });
-  writeFileSync10(join12(dir, "settings.json"), JSON.stringify(settings, null, 2), "utf-8");
+function checkRequirements(reqs, runProbe = defaultProbe) {
+  return (reqs ?? []).map((r) => checkRequirement(r, runProbe));
 }
-projectSettingsRoutes.get("/project-settings", (c) => {
+function requirementMet(statuses, id) {
+  return statuses.find((s) => s.id === id)?.met ?? false;
+}
+
+// src/plugins/available.ts
+function manifestExtensions(manifest) {
+  return (manifest.contentTypes ?? []).flatMap((ct) => ct.extensions ?? []);
+}
+function provisionNotes(install) {
+  const notes = [];
+  for (const step of install?.provision ?? []) {
+    if (step.kind === "fetch") notes.push(`Downloads ${step.dest}.`);
+    else notes.push(step.note ?? `Installs ${step.packages.join(", ")}.`);
+  }
+  return notes;
+}
+function describeAvailablePlugin(manifest, runProbe) {
+  const requirements = checkRequirements(manifest.install?.requirements, runProbe);
+  const notes = provisionNotes(manifest.install);
+  return {
+    id: manifest.id,
+    name: manifest.name,
+    version: manifest.version,
+    description: manifest.description,
+    extensions: manifestExtensions(manifest),
+    requirements,
+    provisionNotes: notes,
+    selfContained: requirements.length === 0 && notes.length === 0,
+    cliHint: manifest.install?.cliHint
+  };
+}
+function listAvailablePlugins(opts) {
+  const bundledDir = opts?.bundledDir ?? bundledPluginsDir();
+  const userDir = opts?.userDir ?? pluginsDir();
+  const out = [];
+  for (const { manifest } of discoverBundledPlugins(bundledDir)) {
+    if (manifest.autoInstall !== false) continue;
+    if (existsSync14(join15(userDir, manifest.id))) continue;
+    out.push(describeAvailablePlugin(manifest, opts?.runProbe));
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/routes/api/plugins.ts
+init_enablement();
+init_plugins();
+init_install();
+
+// src/plugins/install-action.ts
+init_install();
+init_loader();
+import { spawnSync as spawnSync11 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { cpSync as cpSync2, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
+import { join as join16 } from "path";
+var defaultFetchBytes = async (url2) => {
+  const res = await fetch(url2);
+  if (!res.ok) throw new Error(`HTTP ${String(res.status)}`);
+  return new Uint8Array(await res.arrayBuffer());
+};
+var defaultRunNpmInstall = (dir, packages) => {
+  const r = spawnSync11("npm", ["install", "--no-save", "--prefix", dir, ...packages], { stdio: "ignore", timeout: 6e5 });
+  if (r.error !== void 0) return { ok: false, detail: r.error.message };
+  if (r.status !== 0) return { ok: false, detail: `npm exited ${String(r.status)}` };
+  return { ok: true, detail: "installed" };
+};
+async function runProvisionStep(step, installDir, requirements, deps) {
+  if (step.kind === "fetch") {
+    const label2 = `Download ${step.dest}`;
+    try {
+      const bytes = await deps.fetchBytes(step.url);
+      if (step.sha256 !== void 0) {
+        const got = createHash4("sha256").update(bytes).digest("hex");
+        if (got.toLowerCase() !== step.sha256.toLowerCase()) {
+          return { step: label2, ok: false, skipped: false, detail: `checksum mismatch (expected ${step.sha256})` };
+        }
+      }
+      writeFileSync12(join16(installDir, step.dest), bytes);
+      return { step: label2, ok: true, skipped: false, detail: `saved ${step.dest}` };
+    } catch (e) {
+      return { step: label2, ok: false, skipped: false, detail: e instanceof Error ? e.message : "download failed" };
+    }
+  }
+  const label = `Install ${step.packages.join(", ")}`;
+  const reqId = step.requires ?? "npm";
+  if (!requirementMet(requirements, reqId)) {
+    return { step: label, ok: false, skipped: true, detail: `${reqId} is not available` };
+  }
+  const r = deps.runNpmInstall(installDir, step.packages);
+  return { step: label, ok: r.ok, skipped: false, detail: r.detail };
+}
+function buildInstructions(manifest, requirements, provisioned) {
+  const out = [];
+  for (const r of requirements) if (!r.met) out.push(`${r.label}: ${r.hint}`);
+  for (const p of provisioned) {
+    if (p.ok) continue;
+    out.push(p.skipped ? `${p.step} was skipped \u2014 ${p.detail}.` : `${p.step} failed \u2014 ${p.detail}.`);
+  }
+  const cliHint = manifest.install?.cliHint;
+  if (out.length > 0 && cliHint !== void 0 && cliHint !== "") out.push(`Or finish from a terminal: ${cliHint}`);
+  return out;
+}
+async function installAvailablePlugin(id, deps = {}) {
+  const bundledDir = deps.bundledDir ?? bundledPluginsDir();
+  const userDir = deps.userDir ?? pluginsDir();
+  const fetchBytes = deps.fetchBytes ?? defaultFetchBytes;
+  const runNpmInstall = deps.runNpmInstall ?? defaultRunNpmInstall;
+  const bundled = discoverBundledPlugins(bundledDir).find((b) => b.manifest.id === id);
+  if (bundled === void 0) {
+    return { id, installed: false, status: "error", requirements: [], provisioned: [], instructions: [], error: "Not a bundled plugin available to install." };
+  }
+  const manifest = bundled.manifest;
+  const dest = join16(userDir, id);
+  try {
+    mkdirSync11(userDir, { recursive: true });
+    cpSync2(bundled.dir, dest, { recursive: true });
+    undismissPlugin(id, userDir);
+  } catch (e) {
+    return { id, installed: false, status: "error", requirements: [], provisioned: [], instructions: [], error: e instanceof Error ? e.message : "Copy failed." };
+  }
+  const requirements = checkRequirements(manifest.install?.requirements, deps.runProbe);
+  const provisioned = [];
+  for (const step of manifest.install?.provision ?? []) {
+    provisioned.push(await runProvisionStep(step, dest, requirements, { fetchBytes, runNpmInstall }));
+  }
+  const instructions = buildInstructions(manifest, requirements, provisioned);
+  const status = instructions.length === 0 ? "ready" : "needs-setup";
+  return { id, installed: true, status, requirements, provisioned, instructions };
+}
+
+// src/routes/api/plugins.ts
+init_loader();
+init_settings();
+var pluginsRoutes = new Hono10();
+pluginsRoutes.get("/plugins", (c) => {
+  return c.json({ plugins: describeInstalledPlugins(c.get("repoRoot")) });
+});
+pluginsRoutes.get("/plugins/ui", (c) => {
+  return c.json({ elements: listPluginUIElements(c.get("repoRoot")) });
+});
+pluginsRoutes.get("/plugins/available", (c) => {
+  return c.json({ available: listAvailablePlugins() });
+});
+pluginsRoutes.post("/plugins/:id/install-bundled", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
   const repoRoot = c.get("repoRoot");
-  return c.json(readProjectSettings(repoRoot));
+  const result = await installAvailablePlugin(id.data);
+  if (result.installed) await reloadContentPlugins(repoRoot);
+  return c.json({ result, plugins: describeInstalledPlugins(repoRoot), available: listAvailablePlugins() });
+});
+pluginsRoutes.post("/plugins/:id/disabled", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  const parsed = await parseBody(c, SetPluginDisabledReqSchema);
+  if (!parsed.ok) return parsed.response;
+  const repoRoot = c.get("repoRoot");
+  if (parsed.data.scope === "global") setGlobalDisabled(id.data, parsed.data.disabled);
+  else setProjectDisabled(repoRoot, id.data, parsed.data.disabled);
+  await reloadContentPlugins(repoRoot);
+  return c.json({ plugins: describeInstalledPlugins(repoRoot) });
+});
+pluginsRoutes.post("/plugins/install", async (c) => {
+  const parsed = await parseBody(c, InstallPluginReqSchema);
+  if (!parsed.ok) return parsed.response;
+  const repoRoot = c.get("repoRoot");
+  try {
+    installPluginFromDisk(parsed.data.path);
+  } catch (e) {
+    return c.json({ plugins: describeInstalledPlugins(repoRoot), error: e instanceof Error ? e.message : "Install failed" }, 400);
+  }
+  await reloadContentPlugins(repoRoot);
+  return c.json({ plugins: describeInstalledPlugins(repoRoot) });
+});
+pluginsRoutes.post("/plugins/:id/preferences", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  const parsed = await parseBody(c, SetPluginPreferenceReqSchema);
+  if (!parsed.ok) return parsed.response;
+  const manifest = getPluginManifest(id.data);
+  if (manifest === void 0) return c.json({ error: "Plugin not found" }, 404);
+  const repoRoot = c.get("repoRoot");
+  writePluginSetting(manifest, repoRoot, parsed.data.key, parsed.data.value);
+  await reloadContentPlugins(repoRoot);
+  return c.json({ plugins: describeInstalledPlugins(repoRoot) });
+});
+pluginsRoutes.post("/plugins/:id/action", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  const parsed = await parseBody(c, RunPluginActionReqSchema);
+  if (!parsed.ok) return parsed.response;
+  const repoRoot = c.get("repoRoot");
+  if (parsed.data.value !== void 0) persistPluginUIState(id.data, parsed.data.actionId, parsed.data.value, repoRoot);
+  let result;
+  try {
+    result = await runPluginAction(id.data, parsed.data.actionId, parsed.data.value);
+  } catch (e) {
+    return c.json({ plugins: describeInstalledPlugins(repoRoot), error: e instanceof Error ? e.message : "Action failed" }, 400);
+  }
+  return c.json({ plugins: describeInstalledPlugins(repoRoot), result: result ?? void 0 });
+});
+pluginsRoutes.delete("/plugins/:id", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  const repoRoot = c.get("repoRoot");
+  uninstallPlugin(id.data);
+  clearConfigLabelOverrides(id.data);
+  clearPluginUIElements(id.data);
+  await reloadContentPlugins(repoRoot);
+  return c.json({ plugins: describeInstalledPlugins(repoRoot), available: listAvailablePlugins() });
+});
+
+// src/routes/api/project-settings.ts
+init_project_settings();
+init_project_settings_store();
+import { Hono as Hono11 } from "hono";
+var projectSettingsRoutes = new Hono11();
+projectSettingsRoutes.get("/project-settings", (c) => {
+  return c.json(readProjectSettings(c.get("repoRoot")));
 });
 projectSettingsRoutes.patch("/project-settings", async (c) => {
   const repoRoot = c.get("repoRoot");
   const parsed = await parseBody(c, UpdateProjectSettingsReqSchema);
   if (!parsed.ok) return parsed.response;
-  const current = readProjectSettings(repoRoot);
-  if (parsed.data.appName !== void 0) current.appName = parsed.data.appName || void 0;
-  writeProjectSettings(repoRoot, current);
-  return c.json(current);
+  updateProjectSettings2(repoRoot, (s) => {
+    if (parsed.data.appName !== void 0) s.appName = parsed.data.appName || void 0;
+  });
+  return c.json(readProjectSettings(repoRoot));
 });
 
 // src/routes/api/review-notes.ts
 init_store();
-import { readFileSync as readFileSync14, statSync as statSync4 } from "fs";
-import { Hono as Hono11 } from "hono";
-import { extname, relative as relative2, resolve as resolve10 } from "path";
-var reviewNotesRoutes = new Hono11();
+import { readFileSync as readFileSync16, statSync as statSync6 } from "fs";
+import { Hono as Hono12 } from "hono";
+import { extname as extname2, relative as relative2, resolve as resolve10 } from "path";
+var reviewNotesRoutes = new Hono12();
 var ARTIFACT_SERVE_MAX_BYTES = 1e7;
 var IMAGE_CONTENT_TYPES = {
   ".png": "image/png",
@@ -28551,13 +29945,13 @@ reviewNotesRoutes.get("/review-notes/artifact", (c) => {
   const abs = resolve10(repoRoot, file2);
   const rel = relative2(repoRoot, abs);
   if (rel === "" || rel.startsWith("..") || rel.startsWith("/")) return c.text("Forbidden", 403);
-  const ext = extname(abs).toLowerCase();
+  const ext = extname2(abs).toLowerCase();
   if (!(ext in IMAGE_CONTENT_TYPES)) return c.text("Unsupported artifact type", 415);
   const contentType = IMAGE_CONTENT_TYPES[ext];
   try {
-    const stat = statSync4(abs);
+    const stat = statSync6(abs);
     if (!stat.isFile() || stat.size > ARTIFACT_SERVE_MAX_BYTES) return c.text("Not found", 404);
-    const body = readFileSync14(abs);
+    const body = readFileSync16(abs);
     return c.body(body, 200, { "Content-Type": contentType });
   } catch {
     return c.text("Not found", 404);
@@ -28574,17 +29968,17 @@ reviewNotesRoutes.delete("/review-notes/:guid", (c) => {
 
 // src/routes/api/reviews.ts
 init_queries();
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/export/on-complete-hook.ts
 import { spawn as spawn2 } from "child_process";
 import { appendFileSync } from "fs";
-import { join as join13 } from "path";
+import { join as join17 } from "path";
 function runOnCompleteHook(command, ctx) {
   if (command === null || command.trim() === "") {
     return Promise.resolve({ ran: false, ok: true, exitCode: 0 });
   }
-  const logPath = join13(ctx.repoRoot, ".glassbox", "on-complete.log");
+  const logPath = join17(ctx.repoRoot, ".glassbox", "on-complete.log");
   const log = (s) => {
     try {
       appendFileSync(logPath, s);
@@ -28636,7 +30030,8 @@ $ ${command}
 }
 
 // src/routes/api/reviews.ts
-var reviewsRoutes = new Hono12();
+init_plugins();
+var reviewsRoutes = new Hono13();
 reviewsRoutes.get("/reviews", async (c) => {
   const repoRoot = c.get("repoRoot");
   const reviews = await listReviews(repoRoot);
@@ -28660,6 +30055,13 @@ reviewsRoutes.post("/review/complete", async (c) => {
     jsonPath: exportPath.replace(/\.md$/, ".json"),
     markdownPath: exportPath
   });
+  try {
+    const completed = await getReview(reviewId);
+    if (completed !== void 0) {
+      await notifyReviewCompleted(completed, await getAnnotationsForReview(reviewId), exportPath);
+    }
+  } catch {
+  }
   return c.json({ status: "completed", exportPath, isCurrent, reviewId, hook });
 });
 reviewsRoutes.post("/review/reopen", async (c) => {
@@ -28721,8 +30123,9 @@ reviewsRoutes.post("/reviews/delete-all", async (c) => {
 
 // src/routes/api/share-prompt.ts
 init_zod();
-import { Hono as Hono13 } from "hono";
-var sharePromptRoutes = new Hono13();
+import { Hono as Hono14 } from "hono";
+init_global_config();
+var sharePromptRoutes = new Hono14();
 var SharePromptShapeSchema = external_exports.object({
   dismissedAt: external_exports.number().nullable().optional(),
   totalOpenMs: external_exports.number().optional()
@@ -28761,9 +30164,9 @@ sharePromptRoutes.post("/share-prompt/tick", async (c) => {
 });
 
 // src/routes/api/system.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 init_openOS();
-var systemRoutes = new Hono14();
+var systemRoutes = new Hono15();
 systemRoutes.post("/open-external", async (c) => {
   const parsed = await parseBody(c, OpenExternalReqSchema);
   if (!parsed.ok) return parsed.response;
@@ -28775,7 +30178,7 @@ systemRoutes.post("/open-external", async (c) => {
 });
 
 // src/routes/api.ts
-var apiRoutes = new Hono15();
+var apiRoutes = new Hono16();
 apiRoutes.route("/", reviewsRoutes);
 apiRoutes.route("/", filesRoutes);
 apiRoutes.route("/", annotationsRoutes);
@@ -28783,22 +30186,24 @@ apiRoutes.route("/", attachmentsRoutes);
 apiRoutes.route("/", outlineRoutes);
 apiRoutes.route("/", contextRoutes);
 apiRoutes.route("/", projectSettingsRoutes);
+apiRoutes.route("/", pluginsRoutes);
 apiRoutes.route("/", imageRoutes);
 apiRoutes.route("/", reviewNotesRoutes);
 apiRoutes.route("/", sharePromptRoutes);
 apiRoutes.route("/", systemRoutes);
 
 // src/routes/channel-api.ts
-import { spawnSync as spawnSync10 } from "child_process";
-import { mkdirSync as mkdirSync10 } from "fs";
-import { Hono as Hono16 } from "hono";
-import { join as join14 } from "path";
-var channelApiRoutes = new Hono16();
+import { spawnSync as spawnSync12 } from "child_process";
+import { mkdirSync as mkdirSync12 } from "fs";
+import { Hono as Hono17 } from "hono";
+import { join as join18 } from "path";
+init_global_config();
+var channelApiRoutes = new Hono17();
 channelApiRoutes.get("/status", async (c) => {
   const config2 = readGlobalConfig();
   const enabled = config2.channelEnabled === true;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join14(repoRoot, ".glassbox");
+  const dataDir = join18(repoRoot, ".glassbox");
   const connected = enabled ? await isChannelAlive(dataDir) : false;
   return c.json({ enabled, connected });
 });
@@ -28807,8 +30212,8 @@ channelApiRoutes.post("/enable", (c) => {
     config2.channelEnabled = true;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join14(repoRoot, ".glassbox");
-  mkdirSync10(dataDir, { recursive: true });
+  const dataDir = join18(repoRoot, ".glassbox");
+  mkdirSync12(dataDir, { recursive: true });
   registerChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -28817,7 +30222,7 @@ channelApiRoutes.post("/disable", (c) => {
     config2.channelEnabled = false;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join14(repoRoot, ".glassbox");
+  const dataDir = join18(repoRoot, ".glassbox");
   unregisterChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -28825,7 +30230,7 @@ channelApiRoutes.post("/trigger", async (c) => {
   const parsed = await parseBody(c, TriggerChannelReqSchema);
   if (!parsed.ok) return parsed.response;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join14(repoRoot, ".glassbox");
+  const dataDir = join18(repoRoot, ".glassbox");
   const sent = await triggerChannel(dataDir, parsed.data.message);
   if (!sent) {
     return c.json({ error: "Channel not connected" }, 503);
@@ -28834,7 +30239,7 @@ channelApiRoutes.post("/trigger", async (c) => {
 });
 channelApiRoutes.get("/claude-check", (c) => {
   try {
-    const result = spawnSync10("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
+    const result = spawnSync12("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
     if (result.status !== 0) {
       return c.json({ installed: false, version: null, meetsMinimum: false });
     }
@@ -28853,13 +30258,13 @@ channelApiRoutes.get("/claude-check", (c) => {
 });
 
 // src/routes/difftool-api.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 init_connection();
 init_queries();
 init_session();
 init_difftool();
 init_image_blobs();
-var difftoolApiRoutes = new Hono17();
+var difftoolApiRoutes = new Hono18();
 difftoolApiRoutes.get("/status", (c) => {
   return c.json(getDifftoolStatus("global"));
 });
@@ -28936,8 +30341,8 @@ difftoolApiRoutes.post("/end", (c) => {
 });
 
 // src/routes/pages.tsx
-import { readFileSync as readFileSync16 } from "fs";
-import { Hono as Hono18 } from "hono";
+import { readFileSync as readFileSync18 } from "fs";
+import { Hono as Hono19 } from "hono";
 import { resolve as resolve11 } from "path";
 
 // src/components/diffView.tsx
@@ -29728,7 +31133,28 @@ function ReviewNoteRows({ notes, repliesByNote }) {
                 /* @__PURE__ */ jsx4("button", { className: "ai-note-discard-btn", title: "Remove this note from .pr-notes/", children: "Discard" })
               ] }) : null
             ] }),
-            n.artifacts !== void 0 && n.artifacts.length > 0 ? /* @__PURE__ */ jsx4("div", { className: "ai-note-artifacts", children: n.artifacts.map((a) => a.content !== void 0 ? /* @__PURE__ */ jsxs4("details", { className: "ai-note-artifact", children: [
+            n.artifacts !== void 0 && n.artifacts.length > 0 ? /* @__PURE__ */ jsx4("div", { className: "ai-note-artifacts", children: n.artifacts.map((a) => a.renderedSvg !== void 0 ? /* @__PURE__ */ jsxs4("details", { className: "ai-note-artifact", open: true, children: [
+              /* @__PURE__ */ jsxs4("summary", { className: "ai-note-artifact-label", children: [
+                /* @__PURE__ */ jsx4(IconPaperclip, {}),
+                /* @__PURE__ */ jsx4("span", { children: a.uri })
+              ] }),
+              /* @__PURE__ */ jsx4("div", { className: "ai-note-artifact-imgwrap", children: /* @__PURE__ */ jsx4(
+                "img",
+                {
+                  className: "ai-note-artifact-img",
+                  loading: "lazy",
+                  alt: a.uri,
+                  draggable: false,
+                  src: `data:image/svg+xml;utf8,${encodeURIComponent(a.renderedSvg)}`
+                }
+              ) })
+            ] }) : a.renderedHtml !== void 0 ? /* @__PURE__ */ jsxs4("details", { className: "ai-note-artifact", open: true, children: [
+              /* @__PURE__ */ jsxs4("summary", { className: "ai-note-artifact-label", children: [
+                /* @__PURE__ */ jsx4(IconPaperclip, {}),
+                /* @__PURE__ */ jsx4("span", { children: a.uri })
+              ] }),
+              /* @__PURE__ */ jsx4("div", { className: "ai-note-artifact-rendered", children: raw(a.renderedHtml) })
+            ] }) : a.content !== void 0 ? /* @__PURE__ */ jsxs4("details", { className: "ai-note-artifact", children: [
               /* @__PURE__ */ jsxs4("summary", { className: "ai-note-artifact-label", children: [
                 /* @__PURE__ */ jsx4(IconPaperclip, {}),
                 /* @__PURE__ */ jsx4("span", { children: a.uri })
@@ -29799,9 +31225,10 @@ function AnnotationRows({ annotations }) {
 }
 
 // src/themes/config.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, readdirSync as readdirSync2, readFileSync as readFileSync15, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "fs";
-import { join as join15 } from "path";
-var THEMES_DIR = join15(GLOBAL_CONFIG_DIR, "themes");
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join19 } from "path";
+init_global_config();
+var THEMES_DIR = join19(GLOBAL_CONFIG_DIR, "themes");
 function getActiveThemeId() {
   const config2 = readGlobalConfig();
   const theme = config2.theme;
@@ -29815,13 +31242,13 @@ function setActiveThemeId(id) {
   });
 }
 function loadCustomThemes() {
-  if (!existsSync12(THEMES_DIR)) return [];
+  if (!existsSync15(THEMES_DIR)) return [];
   const themes = [];
   try {
-    const files = readdirSync2(THEMES_DIR).filter((f) => f.endsWith(".json"));
+    const files = readdirSync4(THEMES_DIR).filter((f) => f.endsWith(".json"));
     for (const file2 of files) {
       try {
-        const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync15(join15(THEMES_DIR, file2), "utf-8")));
+        const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync17(join19(THEMES_DIR, file2), "utf-8")));
         if (!parsed.success) continue;
         const d = parsed.data;
         themes.push({ id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" });
@@ -29833,21 +31260,21 @@ function loadCustomThemes() {
   return themes;
 }
 function saveCustomTheme(theme) {
-  mkdirSync11(THEMES_DIR, { recursive: true });
-  const filePath = join15(THEMES_DIR, `${theme.id}.json`);
-  writeFileSync11(filePath, JSON.stringify(theme, null, 2), "utf-8");
+  mkdirSync13(THEMES_DIR, { recursive: true });
+  const filePath = join19(THEMES_DIR, `${theme.id}.json`);
+  writeFileSync13(filePath, JSON.stringify(theme, null, 2), "utf-8");
 }
 function deleteCustomTheme(id) {
-  const filePath = join15(THEMES_DIR, `${id}.json`);
-  if (existsSync12(filePath)) {
+  const filePath = join19(THEMES_DIR, `${id}.json`);
+  if (existsSync15(filePath)) {
     unlinkSync3(filePath);
   }
 }
 function getCustomTheme(id) {
-  const filePath = join15(THEMES_DIR, `${id}.json`);
-  if (!existsSync12(filePath)) return void 0;
+  const filePath = join19(THEMES_DIR, `${id}.json`);
+  if (!existsSync15(filePath)) return void 0;
   try {
-    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync15(filePath, "utf-8")));
+    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync17(filePath, "utf-8")));
     if (!parsed.success) return void 0;
     const d = parsed.data;
     return { id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" };
@@ -29884,6 +31311,7 @@ function Layout({ title, reviewId, difftool, children }) {
       /* @__PURE__ */ jsx5("meta", { charSet: "utf-8" }),
       /* @__PURE__ */ jsx5("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
       /* @__PURE__ */ jsx5("title", { children: title }),
+      /* @__PURE__ */ jsx5("link", { rel: "icon", type: "image/svg+xml", href: "/favicon.svg" }),
       /* @__PURE__ */ jsx5("link", { rel: "stylesheet", href: "/static/styles.css" })
     ] }),
     /* @__PURE__ */ jsxs5("body", { "data-review-id": reviewId, "data-difftool": difftool === true ? "1" : void 0, children: [
@@ -30046,7 +31474,10 @@ function ReviewShell({ reviewId, review, files, annotationCounts, staleCounts, f
         /* @__PURE__ */ jsx8("div", { className: "file-filter", children: /* @__PURE__ */ jsx8("input", { type: "text", className: "file-filter-input", id: "file-filter", placeholder: "Filter files..." }) }),
         /* @__PURE__ */ jsx8(FileList, { files, annotationCounts, staleCounts }),
         /* @__PURE__ */ jsx8("div", { className: "sidebar-share", id: "sidebar-share" }),
-        /* @__PURE__ */ jsx8("div", { className: "sidebar-footer", children: footer })
+        /* @__PURE__ */ jsxs8("div", { className: "sidebar-footer", children: [
+          footer,
+          /* @__PURE__ */ jsx8("div", { className: "plugin-ui-slot", id: "plugin-ui-sidebar-footer" })
+        ] })
       ] }),
       /* @__PURE__ */ jsx8("div", { className: "sidebar-resize", id: "sidebar-resize" }),
       /* @__PURE__ */ jsxs8("main", { className: "main-content", children: [
@@ -30065,7 +31496,8 @@ function ReviewShell({ reviewId, review, files, annotationCounts, staleCounts, f
           ] }) }),
           /* @__PURE__ */ jsx8("button", { className: "nav-btn disabled", id: "nav-back-btn", disabled: true, title: "Back", children: /* @__PURE__ */ jsx8("svg", { xmlns: "http://www.w3.org/2000/svg", width: "14", height: "14", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ jsx8("path", { d: "m15 18-6-6 6-6" }) }) }),
           /* @__PURE__ */ jsx8("button", { className: "nav-btn disabled", id: "nav-forward-btn", disabled: true, title: "Forward", children: /* @__PURE__ */ jsx8("svg", { xmlns: "http://www.w3.org/2000/svg", width: "14", height: "14", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ jsx8("path", { d: "m9 18 6-6-6-6" }) }) }),
-          /* @__PURE__ */ jsx8("span", { className: "nav-file-path", id: "nav-file-path" })
+          /* @__PURE__ */ jsx8("span", { className: "nav-file-path", id: "nav-file-path" }),
+          /* @__PURE__ */ jsx8("span", { className: "plugin-ui-slot", id: "plugin-ui-header" })
         ] }),
         /* @__PURE__ */ jsx8("div", { className: "diff-container", id: "diff-container", style: "display:none" }),
         /* @__PURE__ */ jsxs8("div", { className: "diff-toolbar", id: "diff-toolbar", style: "display:none", children: [
@@ -30106,7 +31538,8 @@ function ReviewShell({ reviewId, review, files, annotationCounts, staleCounts, f
               /* @__PURE__ */ jsx8("button", { className: "image-zoom-btn", "data-zoom-action": "actual", title: "Actual size (1:1)", children: /* @__PURE__ */ jsx8(IconActualSize, {}) }),
               /* @__PURE__ */ jsx8("button", { className: "image-zoom-btn", "data-zoom-action": "in", title: "Zoom in", children: /* @__PURE__ */ jsx8(IconZoomIn, {}) })
             ] })
-          ] })
+          ] }),
+          /* @__PURE__ */ jsx8("div", { className: "plugin-ui-slot", id: "plugin-ui-diff-toolbar" })
         ] })
       ] })
     ] })
@@ -30140,6 +31573,25 @@ function svgUsesExternalFonts(svgData) {
   return /<text[\s>]/i.test(svg) || /font-family/i.test(svg) || /@font-face/i.test(svg);
 }
 
+// src/plugins/artifacts.ts
+init_plugins();
+async function renderNoteArtifacts(views) {
+  for (const view of views) {
+    for (const artifact of view.artifacts ?? []) {
+      if (artifact.isImage === true || artifact.content === void 0) continue;
+      const rendered = await renderContent({
+        bytes: new TextEncoder().encode(artifact.content),
+        text: artifact.content,
+        path: artifact.uri
+      });
+      if (rendered === null) continue;
+      if (rendered.svg !== void 0 && rendered.svg !== "") artifact.renderedSvg = rendered.svg;
+      else if (rendered.html !== void 0 && rendered.html !== "") artifact.renderedHtml = rendered.html;
+    }
+  }
+  return views;
+}
+
 // src/review-notes/reanchor.ts
 var MATCH_RADIUS = 50;
 function reanchorReviewNotes(notes, diff) {
@@ -30173,7 +31625,7 @@ function reanchorReviewNotes(notes, diff) {
 // src/routes/pages.tsx
 init_store();
 import { Fragment as Fragment2, jsx as jsx9, jsxs as jsxs9 } from "kerfjs/jsx-runtime";
-var pageRoutes = new Hono18();
+var pageRoutes = new Hono19();
 pageRoutes.get("/", async (c) => {
   const reviewId = c.get("reviewId");
   const review = await getReview(reviewId);
@@ -30202,12 +31654,14 @@ pageRoutes.get("/file/:fileId", async (c) => {
   const reviewMode = review ? parseModeString(review.mode) : null;
   const imageSideLabels = reviewMode ? groundTruthSideLabels(reviewMode) : void 0;
   const stepNav = reviewMode?.type === "ground-truth" ? groundTruthStepNav(reviewMode, file2.id, await getReviewFiles(file2.review_id)) : void 0;
-  if (view === "rendered" && isSvgFile(file2.file_path)) {
+  const isSvg = isSvgFile(file2.file_path);
+  const isPluginSvg = !isSvg && !diff.isBinary && pluginRendersFile(file2.file_path);
+  if (view === "rendered" && (isSvg || isPluginSvg)) {
     const repoRoot = c.get("repoRoot");
     let fontWarning = false;
     let svgBaseWidth = 300;
     let svgBaseHeight = 150;
-    if (reviewMode) {
+    if (isSvg && reviewMode) {
       const oldImg = diff.status !== "added" ? getOldImage(reviewMode, file2.file_path, diff.oldPath ?? null, repoRoot) : null;
       const newImg = diff.status !== "deleted" ? getNewImage(reviewMode, file2.file_path, repoRoot) : null;
       const svgData = newImg ?? oldImg;
@@ -30219,6 +31673,14 @@ pageRoutes.get("/file/:fileId", async (c) => {
       if (oldImg && svgUsesExternalFonts(oldImg.data) || newImg && svgUsesExternalFonts(newImg.data)) {
         fontWarning = true;
       }
+    } else if (isPluginSvg) {
+      const svg = await renderPluginSvgSide(reviewMode, file2.file_path, diff.oldPath ?? file2.file_path, diff.status !== "deleted" ? "new" : "old", repoRoot);
+      if (svg !== null) {
+        const dims = parseSvgDimensions(svg);
+        svgBaseWidth = dims.width;
+        svgBaseHeight = dims.height;
+        if (svgUsesExternalFonts(Buffer.from(svg))) fontWarning = true;
+      }
     }
     const html2 = /* @__PURE__ */ jsxs9("div", { className: "diff-view", "data-file-id": file2.id, "data-file-path": file2.file_path, "data-is-svg": "true", children: [
       /* @__PURE__ */ jsxs9("div", { className: "diff-header", children: [
@@ -30283,6 +31745,7 @@ pageRoutes.get("/file/:fileId", async (c) => {
   }
   const rawNotes = getDemoMode() !== null ? demoReviewNotes(file2.file_path) : loadReviewNotesForFile(c.get("repoRoot"), file2.file_path);
   const reviewNotes = reanchorReviewNotes(rawNotes, finalDiff);
+  await renderNoteArtifacts(reviewNotes);
   const html = /* @__PURE__ */ jsx9(DiffView, { file: file2, diff: finalDiff, annotations, mode, reviewNotes, imageSideLabels, stepNav });
   return c.html(html.toString());
 });
@@ -30292,7 +31755,7 @@ pageRoutes.get("/file-raw", (c) => {
   const repoRoot = c.get("repoRoot");
   let content;
   try {
-    content = readFileSync16(resolve11(repoRoot, filePath), "utf-8");
+    content = readFileSync18(resolve11(repoRoot, filePath), "utf-8");
   } catch {
     return c.text("File not found", 404);
   }
@@ -30348,8 +31811,8 @@ pageRoutes.get("/history", async (c) => {
 });
 
 // src/routes/theme-api.ts
-import { Hono as Hono19 } from "hono";
-var themeApiRoutes = new Hono19();
+import { Hono as Hono20 } from "hono";
+var themeApiRoutes = new Hono20();
 themeApiRoutes.get("/", (c) => {
   const themes = getAllThemes();
   const activeId = getActiveThemeId();
@@ -30476,7 +31939,7 @@ function tryServe(appFetch, port) {
   });
 }
 async function startServer(port, reviewId, repoRoot, options) {
-  const app = new Hono20();
+  const app = new Hono21();
   const onCompleteCommand = options?.onComplete ?? null;
   app.use("*", async (c, next) => {
     c.set("reviewId", reviewId);
@@ -30485,20 +31948,24 @@ async function startServer(port, reviewId, repoRoot, options) {
     c.set("onCompleteCommand", onCompleteCommand);
     await next();
   });
-  const selfDir = dirname7(fileURLToPath2(import.meta.url));
-  const distDir = existsSync13(join16(selfDir, "client", "styles.css")) ? join16(selfDir, "client") : join16(selfDir, "..", "dist", "client");
+  const selfDir = dirname8(fileURLToPath3(import.meta.url));
+  const distDir = existsSync16(join20(selfDir, "client", "styles.css")) ? join20(selfDir, "client") : join20(selfDir, "..", "dist", "client");
   app.get("/static/styles.css", (c) => {
-    const css = readFileSync17(join16(distDir, "styles.css"), "utf-8");
+    const css = readFileSync19(join20(distDir, "styles.css"), "utf-8");
     return c.text(css, 200, { "Content-Type": "text/css", "Cache-Control": "no-cache" });
   });
   app.get("/static/app.js", (c) => {
-    const js = readFileSync17(join16(distDir, "app.global.js"), "utf-8");
+    const js = readFileSync19(join20(distDir, "app.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/static/history.js", (c) => {
-    const js = readFileSync17(join16(distDir, "history.global.js"), "utf-8");
+    const js = readFileSync19(join20(distDir, "history.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
+  app.get("/favicon.svg", (c) => {
+    const svg = readFileSync19(join20(distDir, "favicon.svg"), "utf-8");
+    return c.body(svg, 200, { "Content-Type": "image/svg+xml", "Cache-Control": "no-cache" });
+  });
   app.get("/favicon.ico", (c) => c.body(null, 204));
   app.route("/api", apiRoutes);
   app.route("/api/ai", aiApiRoutes);
@@ -30531,10 +31998,16 @@ async function startServer(port, reviewId, repoRoot, options) {
   console.log(`
   Glassbox running at ${url2}
 `);
+  await initContentPlugins(repoRoot);
+  try {
+    const review = await getReview(reviewId);
+    if (review !== void 0) await notifyReviewCreated(review);
+  } catch {
+  }
   try {
     const globalConfig2 = readGlobalConfig();
     if (globalConfig2.channelEnabled === true) {
-      const dataDir = join16(repoRoot, ".glassbox");
+      const dataDir = join20(repoRoot, ".glassbox");
       registerChannel(dataDir);
     }
   } catch {
@@ -30549,8 +32022,8 @@ async function startServer(port, reviewId, repoRoot, options) {
 }
 
 // src/skills.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "fs";
+import { join as join21 } from "path";
 var SKILL_VERSION = 1;
 function versionHeader() {
   return `<!-- glassbox-skill-version: ${SKILL_VERSION} -->`;
@@ -30561,14 +32034,14 @@ function parseVersionHeader(content) {
   return parseInt(match[1], 10);
 }
 function updateFile(path, content) {
-  if (existsSync14(path)) {
-    const existing = readFileSync18(path, "utf-8");
+  if (existsSync17(path)) {
+    const existing = readFileSync20(path, "utf-8");
     const version2 = parseVersionHeader(existing);
     if (version2 !== null && version2 >= SKILL_VERSION) {
       return false;
     }
   }
-  writeFileSync12(path, content, "utf-8");
+  writeFileSync14(path, content, "utf-8");
   return true;
 }
 function skillBody() {
@@ -30588,8 +32061,8 @@ function skillBody() {
   ].join("\n");
 }
 function ensureClaudeSkills(cwd) {
-  const dir = join17(cwd, ".claude", "skills", "glassbox");
-  mkdirSync12(dir, { recursive: true });
+  const dir = join21(cwd, ".claude", "skills", "glassbox");
+  mkdirSync14(dir, { recursive: true });
   const content = [
     "---",
     "name: glassbox",
@@ -30601,11 +32074,11 @@ function ensureClaudeSkills(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join17(dir, "SKILL.md"), content);
+  return updateFile(join21(dir, "SKILL.md"), content);
 }
 function ensureCursorRules(cwd) {
-  const rulesDir = join17(cwd, ".cursor", "rules");
-  mkdirSync12(rulesDir, { recursive: true });
+  const rulesDir = join21(cwd, ".cursor", "rules");
+  mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
     "description: Read the latest Glassbox code review and apply all feedback annotations",
@@ -30616,11 +32089,11 @@ function ensureCursorRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join17(rulesDir, "glassbox.mdc"), content);
+  return updateFile(join21(rulesDir, "glassbox.mdc"), content);
 }
 function ensureCopilotPrompts(cwd) {
-  const promptsDir = join17(cwd, ".github", "prompts");
-  mkdirSync12(promptsDir, { recursive: true });
+  const promptsDir = join21(cwd, ".github", "prompts");
+  mkdirSync14(promptsDir, { recursive: true });
   const content = [
     "---",
     "description: Read the latest Glassbox code review and apply all feedback annotations",
@@ -30630,11 +32103,11 @@ function ensureCopilotPrompts(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join17(promptsDir, "glassbox.prompt.md"), content);
+  return updateFile(join21(promptsDir, "glassbox.prompt.md"), content);
 }
 function ensureWindsurfRules(cwd) {
-  const rulesDir = join17(cwd, ".windsurf", "rules");
-  mkdirSync12(rulesDir, { recursive: true });
+  const rulesDir = join21(cwd, ".windsurf", "rules");
+  mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
     "trigger: manual",
@@ -30645,21 +32118,21 @@ function ensureWindsurfRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join17(rulesDir, "glassbox.md"), content);
+  return updateFile(join21(rulesDir, "glassbox.md"), content);
 }
 function ensureSkills() {
   const cwd = process.cwd();
   const platforms = [];
-  if (existsSync14(join17(cwd, ".claude"))) {
+  if (existsSync17(join21(cwd, ".claude"))) {
     if (ensureClaudeSkills(cwd)) platforms.push("Claude Code");
   }
-  if (existsSync14(join17(cwd, ".cursor"))) {
+  if (existsSync17(join21(cwd, ".cursor"))) {
     if (ensureCursorRules(cwd)) platforms.push("Cursor");
   }
-  if (existsSync14(join17(cwd, ".github", "prompts")) || existsSync14(join17(cwd, ".github", "copilot-instructions.md"))) {
+  if (existsSync17(join21(cwd, ".github", "prompts")) || existsSync17(join21(cwd, ".github", "copilot-instructions.md"))) {
     if (ensureCopilotPrompts(cwd)) platforms.push("GitHub Copilot");
   }
-  if (existsSync14(join17(cwd, ".windsurf"))) {
+  if (existsSync17(join21(cwd, ".windsurf"))) {
     if (ensureWindsurfRules(cwd)) platforms.push("Windsurf");
   }
   return platforms;
@@ -30667,19 +32140,19 @@ function ensureSkills() {
 
 // src/update-check.ts
 init_zod();
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync15 } from "fs";
 import { get } from "https";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname8, join as join18 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-var DATA_DIR = join18(homedir2(), ".glassbox");
-var CHECK_FILE = join18(DATA_DIR, "last-update-check");
+import { dirname as dirname9, join as join22 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var DATA_DIR = join22(homedir2(), ".glassbox");
+var CHECK_FILE = join22(DATA_DIR, "last-update-check");
 var PACKAGE_NAME = "glassbox";
 var VersionPayloadSchema = external_exports.object({ version: external_exports.string() });
 function getCurrentVersion() {
   try {
-    const dir = dirname8(fileURLToPath3(import.meta.url));
-    const raw2 = JSON.parse(readFileSync19(join18(dir, "..", "package.json"), "utf-8"));
+    const dir = dirname9(fileURLToPath4(import.meta.url));
+    const raw2 = JSON.parse(readFileSync21(join22(dir, "..", "package.json"), "utf-8"));
     return VersionPayloadSchema.parse(raw2).version;
   } catch {
     return "0.0.0";
@@ -30687,16 +32160,16 @@ function getCurrentVersion() {
 }
 function getLastCheckDate() {
   try {
-    if (existsSync15(CHECK_FILE)) {
-      return readFileSync19(CHECK_FILE, "utf-8").trim();
+    if (existsSync18(CHECK_FILE)) {
+      return readFileSync21(CHECK_FILE, "utf-8").trim();
     }
   } catch {
   }
   return null;
 }
 function saveCheckDate() {
-  mkdirSync13(DATA_DIR, { recursive: true });
-  writeFileSync13(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
+  mkdirSync15(DATA_DIR, { recursive: true });
+  writeFileSync15(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
 }
 function isFirstUseToday() {
   const last = getLastCheckDate();
@@ -30746,7 +32219,7 @@ function detectUpgradeCommand() {
   }
   return `npm update -g ${PACKAGE_NAME}`;
 }
-function compareVersions(current, latest) {
+function compareVersions2(current, latest) {
   const a = current.split(".").map(Number);
   const b = latest.split(".").map(Number);
   for (let i = 0; i < 3; i++) {
@@ -30760,7 +32233,7 @@ async function checkForUpdates(force) {
   const current = getCurrentVersion();
   const latest = await fetchLatestVersion();
   saveCheckDate();
-  if (latest === null || compareVersions(current, latest) >= 0) return;
+  if (latest === null || compareVersions2(current, latest) >= 0) return;
   const cmd = detectUpgradeCommand();
   const updateLine = `Update available: ${current} \u2192 ${latest}`;
   const cmdLine = `Run: ${cmd}`;
@@ -31001,23 +32474,23 @@ async function main() {
     console.log("AI service test mode enabled \u2014 using mock AI responses");
   }
   if (debug) {
-    console.log(`[debug] Build timestamp: ${"2026-07-02T05:52:03.288Z"}`);
+    console.log(`[debug] Build timestamp: ${"2026-07-22T04:50:30.153Z"}`);
   }
   if (projectDir !== null) {
-    if (!existsSync17(projectDir) || !statSync6(projectDir).isDirectory()) {
+    if (!existsSync20(projectDir) || !statSync8(projectDir).isDirectory()) {
       console.error(`--project-dir is not a directory: ${projectDir}`);
       process.exit(1);
     }
     process.chdir(projectDir);
   }
   if (dataDir === null) {
-    dataDir = join20(process.cwd(), ".glassbox");
+    dataDir = join24(process.cwd(), ".glassbox");
   }
   if (difftoolServe) {
     const { initDifftoolSession: initDifftoolSession2 } = await Promise.resolve().then(() => (init_session(), session_exports));
     const { writeDiscovery: writeDiscovery2, clearDiscovery: clearDiscovery2, releaseStartingLock: releaseStartingLock2 } = await Promise.resolve().then(() => (init_difftool_discovery(), difftool_discovery_exports));
     const { clearImageBlobs: clearImageBlobs2 } = await Promise.resolve().then(() => (init_image_blobs(), image_blobs_exports));
-    mkdirSync15(dataDir, { recursive: true });
+    mkdirSync17(dataDir, { recursive: true });
     setDataDir(dataDir);
     ensureGlassboxGitignored(dataDir);
     const sessionDataDir = dataDir;
@@ -31053,13 +32526,13 @@ async function main() {
       }
       process.exit(1);
     }
-    dataDir = join20(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
+    dataDir = join24(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
     setDemoMode(demo);
     console.log(`
   DEMO MODE: ${scenario.label}
 `);
   }
-  mkdirSync15(dataDir, { recursive: true });
+  mkdirSync17(dataDir, { recursive: true });
   if (demo === null) {
     acquireLock(dataDir);
   }
@@ -31084,12 +32557,12 @@ async function main() {
   if (mode.type === "diff") {
     const { pathA, pathB } = mode;
     for (const p of [pathA, pathB]) {
-      if (!existsSync17(p)) {
+      if (!existsSync20(p)) {
         console.error(`Error: path does not exist: ${p}`);
         process.exit(1);
       }
     }
-    if (statSync6(pathA).isDirectory() !== statSync6(pathB).isDirectory()) {
+    if (statSync8(pathA).isDirectory() !== statSync8(pathB).isDirectory()) {
       console.error("Error: --diff requires two files or two folders, not a mix of both.");
       process.exit(1);
     }
@@ -31106,17 +32579,19 @@ async function main() {
     }
     for (const entry of comparisons) {
       for (const [role, p] of [["actual", entry.actualPath], ["expected", entry.expectedPath]]) {
-        if (!existsSync17(p)) {
+        if (!existsSync20(p)) {
           console.error(`Error: ${role} image does not exist: ${p}`);
           process.exit(1);
         }
       }
     }
+    const { initContentPlugins: initContentPlugins2 } = await Promise.resolve().then(() => (init_plugins(), plugins_exports));
+    await initContentPlugins2(cwd);
     const { comparePerceptual: comparePerceptual2 } = await Promise.resolve().then(() => (init_perceptual_diff(), perceptual_diff_exports));
     let identical = 0;
     let undecodable = 0;
     for (const entry of comparisons) {
-      const result = comparePerceptual2(entry.actualPath, entry.expectedPath);
+      const result = await comparePerceptual2(entry.actualPath, entry.expectedPath);
       groundTruthScores.set(entry.key, result.score);
       if (result.reason === "undecodable") undecodable++;
       else if (result.score === 0) identical++;