kennel 0.2.12 → 0.2.15

package/dist/plugins/external.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, } from "node:path";
@@ -17,9 +17,6 @@ import { z } from "zod";
 const CONFIG_FILE = join("kennel", "config.json");
 const VALID_ID = /^[a-z][a-z0-9-]*$/u;
 const CORE_IDS = new Set(["agents", "notes"]);
-const KENNEL_KERNEL_SCHEMA = 2;
-const BUILD_RUNTIME = `node-${process.versions.node}`;
-const BUILD_IDENTITY = "kennel-external-kernel-v3";
 function xdgConfigHome() {
     return process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config");
 }
@@ -115,11 +112,21 @@ function splitRepositoryUrl(input) {
     const url = index === -1 ? input : input.slice(0, index);
     const requestedRef = index === -1 ? undefined : input.slice(index + 1);
     if (!url.trim())
-        throw new Error("Plugin repository URL is empty");
+        throw new Error("Plugin source is empty");
     if (requestedRef !== undefined && !requestedRef.trim())
         throw new Error("Plugin repository ref is empty");
+    if (isLocalPluginPath(url)) {
+        if (requestedRef)
+            throw new Error("Local plugin paths do not accept #ref fragments");
+        return { url: resolve(url), requestedRef: undefined, path: realpathSync(resolve(url)) };
+    }
     return { url, requestedRef };
 }
+function isLocalPluginPath(input) {
+    if (/^[a-z][a-z0-9+.-]*:/iu.test(input))
+        return false;
+    return existsSync(input) && statSync(input).isDirectory();
+}
 function resolveCommit(url, requestedRef) {
     if (!requestedRef) {
         const output = run("git", ["ls-remote", url, "HEAD"]);
@@ -158,21 +165,6 @@ function pluginRoot(repoRoot, directory) {
         throw new Error(`Missing plugin directory: ${directory}`);
     return target;
 }
-function packageExportPath(exportsValue, key) {
-    if (!exportsValue || typeof exportsValue !== "object" || Array.isArray(exportsValue))
-        return undefined;
-    const value = exportsValue[key];
-    if (typeof value === "string")
-        return value;
-    if (value && typeof value === "object" && !Array.isArray(value)) {
-        const record = value;
-        if (typeof record.import === "string")
-            return record.import;
-        if (typeof record.default === "string")
-            return record.default;
-    }
-    return undefined;
-}
 function safeRelativeFile(root, value, label) {
     if (typeof value !== "string" || !value.trim())
         throw new Error(`Missing ${label}`);
@@ -186,75 +178,108 @@ function safeRelativeFile(root, value, label) {
         throw new Error(`Missing ${label}: ${value}`);
     return target;
 }
+function entryByConvention(root, file, required) {
+    const rootCandidate = join(root, file);
+    const srcCandidate = join(root, "src", file);
+    if (existsSync(rootCandidate) && statSync(rootCandidate).isFile())
+        return rootCandidate;
+    if (existsSync(srcCandidate) && statSync(srcCandidate).isFile())
+        return srcCandidate;
+    if (!required)
+        return undefined;
+    throw new Error(`Missing required plugin entry ${file} (expected ${file} or src/${file})`);
+}
+function contentHash(root) {
+    const digest = createHash("sha256");
+    const visit = (dir) => {
+        for (const name of readdirSync(dir).sort()) {
+            if (name === ".git" || name === "node_modules")
+                continue;
+            const path = join(dir, name);
+            const rel = relative(root, path);
+            const stat = statSync(path);
+            if (stat.isDirectory()) {
+                digest.update(`dir:${rel}\0`);
+                visit(path);
+            }
+            else if (stat.isFile()) {
+                digest.update(`file:${rel}:${stat.mode}\0`);
+                digest.update(readFileSync(path));
+                digest.update("\0");
+            }
+        }
+    };
+    visit(root);
+    return digest.digest("hex");
+}
 function stringField(value, label) {
     if (typeof value !== "string" || !value.trim())
         throw new Error(`Missing ${label}`);
     return value.trim();
 }
-function kernelSourceRoot() {
-    const root = cliRoot();
-    const workspace = resolve(root, "..");
-    if (existsSync(resolve(workspace, "apps/web/vite.config.ts")))
-        return workspace;
-    const packaged = resolve(root, "kernel");
-    if (existsSync(resolve(packaged, "apps/web/vite.config.ts")))
-        return packaged;
-    throw new Error("Kennel kernel source is missing from this CLI package");
-}
-function internalSourceAliases(root = kernelSourceRoot()) {
-    const aliases = {};
-    for (const [name, path] of Object.entries({
-        "@raggle-ai/agents": "packages/agents/src",
-        "kennel-plugins": "packages/plugins/src",
-        "@raggle-ai/kennel-api": "packages/api/src",
-        "@raggle-ai/markdown": "packages/markdown/src",
-        "@raggle-ai/notes": "packages/notes/src",
-        "@raggle-ai/schemas": "packages/schemas/src",
-        "@raggle-ai/session-finding": "packages/session-finding/src",
-        "@raggle-ai/ui": "packages/ui/src",
-        "kennel-client": "packages/api-client/src",
-    })) {
-        const target = resolve(root, path);
-        if (existsSync(target))
-            aliases[name] = target;
-    }
-    return aliases;
-}
-function resolveAliasPath(target, suffix) {
-    if (!suffix)
-        return resolve(target, "index.ts");
-    const clean = suffix.replace(/^\//u, "");
-    for (const candidate of [
-        resolve(target, `${clean}.ts`),
-        resolve(target, `${clean}.tsx`),
-        resolve(target, `${clean}.js`),
-        resolve(target, clean, "index.ts"),
-        resolve(target, clean, "index.tsx"),
-        resolve(target, clean),
-    ]) {
-        if (existsSync(candidate))
-            return candidate;
-    }
-    return resolve(target, clean);
-}
-function esbuildAliasPlugin(root = kernelSourceRoot()) {
-    const sourceAliases = internalSourceAliases(root);
-    const hostPackages = ["@raggle-ai/barkdown", "@raggle-ai/scout-ui", "@tanstack/react-query", "@tanstack/react-router", "date-fns", "effect", "lucide-react", "react", "react-dom", "react/jsx-runtime", "yaml", "lexical"];
+// Specifiers the host shares with plugin browser bundles at runtime. Keep in
+// sync with pluginHostModules in apps/web/src/plugin-host-modules.ts.
+const SHARED_BROWSER_MODULES = new Set([
+    "@tanstack/react-query",
+    "kennel-plugins",
+    "kennel-plugins/client",
+    "kennel-plugins/hooks",
+    "kennel-plugins/page",
+    "kennel-plugins/subpath",
+    "kennel-plugins/types",
+    "kennel-plugins/validation",
+    "radix-ui",
+    "react",
+    "react-dom",
+    "react-dom/client",
+    "react/jsx-runtime",
+    "sonner",
+]);
+/** Stand-in for css url() references whose asset file is missing. */
+const EMPTY_ASSET_URL = "url('data:,')";
+const ASSET_LOADERS = {
+    ".gif": "file",
+    ".jpg": "file",
+    ".png": "file",
+    ".svg": "file",
+    ".webp": "file",
+    ".woff": "file",
+    ".woff2": "file",
+    ".ttf": "file",
+};
+// Bare imports resolve from the plugin first, then from the dependencies the
+// CLI installs. In browser bundles the shared host modules become runtime
+// lookups in the registry the host page provides.
+function hostResolutionPlugin(platform) {
     return {
         name: "kennel-host-resolution",
         setup(build) {
-            build.onResolve({ filter: /.*/ }, (args) => {
-                if (args.path.startsWith("node:"))
+            if (platform === "browser") {
+                build.onResolve({ filter: /.*/ }, (args) => SHARED_BROWSER_MODULES.has(args.path) ? { path: args.path, namespace: "kennel-shared" } : undefined);
+                build.onLoad({ filter: /.*/, namespace: "kennel-shared" }, (args) => ({
+                    contents: `const host = globalThis.__kennelPluginHost;
+if (!host || !host.modules[${JSON.stringify(args.path)}]) throw new Error("The Kennel host does not share ${args.path}");
+module.exports = host.modules[${JSON.stringify(args.path)}];`,
+                    loader: "js",
+                }));
+            }
+            build.onResolve({ filter: /^[^./]/ }, async (args) => {
+                if (args.pluginData?.kennelFallback || args.namespace === "kennel-shared")
                     return undefined;
-                for (const [name, target] of Object.entries(sourceAliases)) {
-                    if (args.path === name || args.path.startsWith(`${name}/`)) {
-                        return { path: resolveAliasPath(target, args.path.slice(name.length)) };
-                    }
-                }
-                if (hostPackages.some((name) => args.path === name || args.path.startsWith(`${name}/`))) {
+                const resolved = await build.resolve(args.path, {
+                    importer: args.importer,
+                    kind: args.kind,
+                    pluginData: { kennelFallback: true },
+                    resolveDir: args.resolveDir,
+                });
+                if (resolved.errors.length === 0)
+                    return resolved;
+                try {
                     return { path: fileURLToPath(import.meta.resolve(args.path)) };
                 }
-                return undefined;
+                catch {
+                    return undefined;
+                }
             });
         },
     };
@@ -262,7 +287,6 @@ function esbuildAliasPlugin(root = kernelSourceRoot()) {
 async function bundleForImport(entry, outfile, platform) {
     const esbuild = await import("esbuild");
     await esbuild.build({
-        absWorkingDir: kernelSourceRoot(),
         banner: platform === "node"
             ? { js: 'import { createRequire as __kennelCreateRequire } from "node:module"; const require = __kennelCreateRequire(import.meta.url);' }
             : undefined,
@@ -271,9 +295,11 @@ async function bundleForImport(entry, outfile, platform) {
         external: ["bun:ffi", "koffi"],
         format: "esm",
         jsx: "automatic",
+        loader: ASSET_LOADERS,
+        logLevel: "silent",
         outfile,
         platform,
-        plugins: [esbuildAliasPlugin()],
+        plugins: [hostResolutionPlugin(platform)],
         sourcemap: false,
         target: platform === "node" ? "node20" : "es2022",
     });
@@ -301,10 +327,10 @@ async function validateImports(entry) {
         const manifestModule = await import(__rewriteRelativeImportExtension(pathToFileURL(manifestOut).href));
         const serverModule = await import(__rewriteRelativeImportExtension(pathToFileURL(serverOut).href));
         const clientModule = await import(__rewriteRelativeImportExtension(pathToFileURL(clientOut).href));
-        const manifest = manifestModule[entry.entries.manifestSymbol];
-        const serverExport = serverModule[entry.entries.serverSymbol];
+        const manifest = manifestModule.default;
+        const serverExport = serverModule.default;
         const server = typeof serverExport === "function" ? serverExport({}) : serverExport;
-        const client = clientModule[entry.entries.clientSymbol];
+        const client = clientModule.default;
         assertManifest(manifest, entry.id, "manifest export");
         if (!server || typeof server !== "object" || server.id !== entry.id)
             throw new Error("server id mismatch");
@@ -314,77 +340,62 @@ async function validateImports(entry) {
             throw new Error("client id mismatch");
         if (typeof client.component !== "function")
             throw new Error("client export missing component");
-        if (entry.entries.api && entry.entries.apiSymbol) {
+        if (entry.entries.api) {
             const apiModule = await import(__rewriteRelativeImportExtension(pathToFileURL(apiOut).href));
-            if (typeof apiModule[entry.entries.apiSymbol] !== "function")
-                throw new Error("API export missing handler");
+            if (typeof apiModule.default !== "function")
+                throw new Error("API default export missing handler");
         }
     }
     finally {
         await rm(dir, { force: true, recursive: true });
     }
 }
-export async function validateExternalPlugin(inputUrl, existing = [], options = {}) {
-    const { url, requestedRef } = splitRepositoryUrl(inputUrl);
-    const commit = resolveCommit(url, requestedRef);
-    const checkoutRoot = sourceCheckout(url, commit);
+export async function validateExternalPlugin(inputUrl, options = {}) {
+    const source = splitRepositoryUrl(inputUrl);
+    const commit = source.path ? contentHash(source.path) : resolveCommit(source.url, source.requestedRef);
+    const checkoutRoot = source.path ?? sourceCheckout(source.url, commit);
     const directory = options.directory?.trim() || undefined;
     const root = pluginRoot(checkoutRoot, directory);
     const pkgPath = join(root, "package.json");
-    if (!existsSync(pkgPath))
-        throw new Error("Plugin repository has no package.json at its root");
-    const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
-    const packageName = stringField(pkg.name, "package name");
-    const metadata = pkg.kennel?.plugin;
-    if (!metadata || typeof metadata !== "object")
-        throw new Error("package.json must define kennel.plugin metadata");
-    const id = stringField(metadata.id, "plugin id");
+    const pkg = existsSync(pkgPath) ? JSON.parse(await readFile(pkgPath, "utf8")) : {};
+    const metadataPath = join(root, "kennel.plugin.json");
+    const fileMetadata = existsSync(metadataPath)
+        ? JSON.parse(await readFile(metadataPath, "utf8"))
+        : undefined;
+    const metadata = (pkg.kennel?.plugin && typeof pkg.kennel.plugin === "object"
+        ? pkg.kennel.plugin
+        : fileMetadata && typeof fileMetadata === "object"
+            ? fileMetadata
+            : undefined);
+    const id = metadata?.id === undefined ? basename(root) : stringField(metadata.id, "plugin id");
     if (!VALID_ID.test(id))
         throw new Error(`Invalid plugin id: ${id}`);
     if (CORE_IDS.has(id))
         throw new Error(`External plugin id collides with core plugin: ${id}`);
-    if (existing.some((plugin) => plugin.id === id))
-        throw new Error(`External plugin id is already installed: ${id}`);
-    const trigger = metadata.trigger === undefined ? undefined : stringField(metadata.trigger, "trigger file");
+    const packageName = typeof pkg.name === "string" && pkg.name.trim() ? pkg.name.trim() : id;
+    const trigger = metadata?.trigger === undefined ? undefined : stringField(metadata.trigger, "trigger file");
     if (trigger && (trigger.includes("/") || trigger.includes("\\") || trigger === "." || trigger === ".."))
         throw new Error(`Invalid trigger file: ${trigger}`);
-    const exportsValue = pkg.exports;
-    const client = safeRelativeFile(root, packageExportPath(exportsValue, "./client"), "./client package export");
-    const server = safeRelativeFile(root, packageExportPath(exportsValue, "./server"), "./server package export");
-    const manifest = safeRelativeFile(root, packageExportPath(exportsValue, "./manifest"), "./manifest package export");
-    const apiPath = packageExportPath(exportsValue, "./api");
-    const apiExport = apiPath
-        ? safeRelativeFile(root, apiPath, "./api package export")
-        : undefined;
-    const apiSymbol = apiExport
-        ? typeof metadata.exports?.apiSymbol === "string"
-            ? metadata.exports.apiSymbol
-            : "default"
-        : undefined;
-    const cssValue = metadata.exports?.css;
+    const client = entryByConvention(root, "client.tsx", true);
+    const server = entryByConvention(root, "server.ts", true);
+    const manifest = entryByConvention(root, "manifest.ts", true);
+    const api = entryByConvention(root, "api.ts", false);
+    const cssValue = metadata?.exports?.css;
     const css = cssValue === undefined ? undefined : safeRelativeFile(root, cssValue, "css export path");
     const entry = {
-        url,
-        ...(requestedRef ? { requestedRef } : {}),
+        url: source.url,
+        ...(source.requestedRef ? { requestedRef: source.requestedRef } : {}),
         commit,
         packageName,
         id,
         ...(directory ? { directory } : {}),
+        ...(source.path ? { path: source.path } : {}),
         ...(trigger ? { trigger } : {}),
         entries: {
             client,
-            clientSymbol: typeof metadata.exports?.clientSymbol === "string"
-                ? metadata.exports.clientSymbol
-                : "default",
             server,
-            serverSymbol: typeof metadata.exports?.serverSymbol === "string"
-                ? metadata.exports.serverSymbol
-                : "default",
             manifest,
-            manifestSymbol: typeof metadata.exports?.manifestSymbol === "string"
-                ? metadata.exports.manifestSymbol
-                : "default",
-            ...(apiExport ? { api: apiExport, apiSymbol } : {}),
+            ...(api ? { api } : {}),
             ...(css ? { css } : {}),
         },
     };
@@ -400,11 +411,16 @@ export async function installExternalPlugin(url, options = {}) {
     const externalPlugins = config.externalPlugins ?? [];
     let entry;
     try {
-        entry = await validateExternalPlugin(url, externalPlugins, options);
-        const nextPlugins = [...externalPlugins, entry];
+        entry = await validateExternalPlugin(url, options);
+        // Upsert: re-adding an installed id refreshes its pinned commit and
+        // entries, so a rerun of an install list updates every plugin.
+        const nextPlugins = [
+            ...externalPlugins.filter((plugin) => plugin.id !== entry.id),
+            entry,
+        ];
         const nextConfig = { ...config, externalPlugins: nextPlugins };
         assertUserConfig(nextConfig, path);
-        await ensureKernel(nextPlugins);
+        await ensurePluginBuild(nextPlugins);
         writeJsonAtomic(path, nextConfig);
     }
     catch (error) {
@@ -416,61 +432,60 @@ export async function installExternalPlugin(url, options = {}) {
 function cliRoot() {
     return resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 }
-function kernelPlugins(plugins) {
-    return plugins.map((plugin) => ({
-        url: plugin.url,
-        requestedRef: plugin.requestedRef ?? null,
-        packageName: plugin.packageName,
-        id: plugin.id,
-        directory: plugin.directory ?? null,
-        commit: plugin.commit,
-        trigger: plugin.trigger,
-        entries: plugin.entries,
-    }));
-}
-/** Identifies the installed plugin set, independent of the Node runtime. */
-export function hotKernelKey(plugins = readExternalPlugins()) {
+/** The compiled host web app this CLI serves. */
+export function webRoot() {
+    return resolve(cliRoot(), "web");
+}
+const BUILD_IDENTITY = "kennel-external-plugins-v1";
+function cliVersion() {
+    return JSON.parse(readFileSync(join(cliRoot(), "package.json"), "utf8")).version;
+}
+/**
+ * Identifies the installed plugin set and the host that compiled it. Reported
+ * by /api/health (as kernelKey) so a running viewer is reused only for the
+ * same plugins. "core" means no external plugins.
+ */
+export function pluginSetKey(plugins = readExternalPlugins()) {
+    if (plugins.length === 0)
+        return "core";
     return hash(JSON.stringify({
         buildIdentity: BUILD_IDENTITY,
-        schema: KENNEL_KERNEL_SCHEMA,
-        plugins: kernelPlugins(plugins),
+        cli: cliVersion(),
+        plugins: plugins.map((plugin) => ({ url: plugin.url, directory: plugin.directory ?? null, path: plugin.path ?? null, commit: plugin.commit, trigger: plugin.trigger, entries: plugin.entries })),
     }));
 }
-/** Identifies a runtime-specific static kernel cache entry. */
-export function kernelKey(plugins = readExternalPlugins()) {
-    return hash(JSON.stringify({
-        buildIdentity: BUILD_IDENTITY,
-        schema: KENNEL_KERNEL_SCHEMA,
-        runtime: BUILD_RUNTIME,
-        plugins: kernelPlugins(plugins),
-    }));
+/** Points the core runtime at a plugin build. */
+export function usePluginBuild(build) {
+    process.env.KENNEL_KERNEL_KEY = build.key;
+    process.env.KENNEL_EXTERNAL_SERVER_ENTRIES = JSON.stringify(build.serverEntries);
+    process.env.KENNEL_EXTERNAL_API_ENTRIES = JSON.stringify(build.apiEntries);
+    if (build.clientRoot)
+        process.env.KENNEL_EXTERNAL_CLIENT_ROOT = build.clientRoot;
+    else
+        delete process.env.KENNEL_EXTERNAL_CLIENT_ROOT;
 }
-function kernelRoot(key) {
-    return join(cacheRoot(), "kernels", key);
+function buildRoot(key) {
+    return join(cacheRoot(), "plugin-builds", key);
 }
-async function readKernelMarker(marker, key) {
+async function readBuildMarker(marker, key) {
     if (!existsSync(marker))
         return undefined;
     try {
-        const kernel = JSON.parse(await readFile(marker, "utf8"));
-        if (kernel.buildIdentity !== BUILD_IDENTITY ||
-            kernel.schema !== KENNEL_KERNEL_SCHEMA ||
-            kernel.runtime !== BUILD_RUNTIME ||
-            kernel.key !== key ||
-            !existsSync(resolve(kernel.webRoot, "index.html")) ||
-            !Array.isArray(kernel.serverEntries) ||
-            kernel.serverEntries.some((entry) => !entry.id || !entry.module || !entry.symbol || !existsSync(entry.module)) ||
-            !Array.isArray(kernel.apiEntries) ||
-            kernel.apiEntries.some((entry) => !entry.id || !entry.module || !entry.symbol || !existsSync(entry.module)))
+        const build = JSON.parse(await readFile(marker, "utf8"));
+        if (build.buildIdentity !== BUILD_IDENTITY ||
+            build.key !== key ||
+            !build.clientRoot ||
+            !existsSync(join(build.clientRoot, "registry.js")) ||
+            [...build.serverEntries, ...build.apiEntries].some((entry) => !existsSync(entry.module)))
             return undefined;
-        return kernel;
+        return build;
     }
     catch {
         return undefined;
     }
 }
-function acquireKernelLock(key) {
-    const locks = join(cacheRoot(), "kernels", ".locks");
+function acquireBuildLock(key) {
+    const locks = join(cacheRoot(), "plugin-builds", ".locks");
     mkdirSync(locks, { recursive: true });
     const lock = join(locks, key);
     assertUnderCache(lock);
@@ -485,7 +500,7 @@ function acquireKernelLock(key) {
             Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
         }
     }
-    throw new Error(`Timed out waiting for kernel build lock ${key}`);
+    throw new Error(`Timed out waiting for plugin build lock ${key}`);
 }
 function moveIncompleteAside(target) {
     if (!existsSync(target))
@@ -496,89 +511,165 @@ function moveIncompleteAside(target) {
     renameSync(target, broken);
     rmSync(broken, { force: true, recursive: true });
 }
-export async function prepareExternalPluginModules(temp, target = temp, plugins = readExternalPlugins()) {
-    const clientModule = join(temp, "external-plugins.tsx");
-    const serverDir = join(temp, "server");
-    mkdirSync(serverDir, { recursive: true });
-    const cssImports = plugins.map((plugin) => plugin.entries.css ? `import ${JSON.stringify(plugin.entries.css)};` : "").filter(Boolean).join("\n");
-    const clientImports = plugins.map((plugin, index) => `import { ${plugin.entries.manifestSymbol} as manifest${index} } from ${JSON.stringify(plugin.entries.manifest)};`).join("\n");
-    const clientItems = plugins.map((plugin, index) => `  { ...manifest${index}, component: lazy(async () => ({ default: (await import(${JSON.stringify(plugin.entries.client)}))[${JSON.stringify(plugin.entries.clientSymbol)}].component })) }`).join(",\n");
-    await writeFile(clientModule, `import { lazy } from "react";\nimport type { FolderPluginClient } from "kennel-plugins/client";\n${cssImports}\n${clientImports}\nexport const externalFolderPlugins: FolderPluginClient[] = [\n${clientItems}\n];\n`);
-    const serverEntries = [];
-    const apiEntries = [];
-    for (const plugin of plugins) {
-        const outfile = join(serverDir, `${plugin.id}.js`);
-        await bundleForImport(plugin.entries.server, outfile, "node");
-        serverEntries.push({ id: plugin.id, module: join(target, "server", `${plugin.id}.js`), symbol: plugin.entries.serverSymbol, trigger: plugin.trigger });
-        if (plugin.entries.api && plugin.entries.apiSymbol) {
-            const apiOutfile = join(serverDir, `${plugin.id}-api.js`);
-            await bundleForImport(plugin.entries.api, apiOutfile, "node");
-            apiEntries.push({ id: plugin.id, module: join(target, "server", `${plugin.id}-api.js`), symbol: plugin.entries.apiSymbol });
-        }
-    }
-    return { clientModule, serverEntries, apiEntries };
-}
-async function buildKernelTemp(temp, target, key, plugins) {
-    const sourceRoot = kernelSourceRoot();
-    const { clientModule, serverEntries, apiEntries } = await prepareExternalPluginModules(temp, target, plugins);
-    const vite = await import("vite");
-    const previousClientModule = process.env.KENNEL_EXTERNAL_CLIENT_MODULE;
-    const previousSourceRoot = process.env.KENNEL_KERNEL_SOURCE_ROOT;
-    const previousHostNodeModules = process.env.KENNEL_HOST_NODE_MODULES;
-    process.env.KENNEL_EXTERNAL_CLIENT_MODULE = clientModule;
-    process.env.KENNEL_KERNEL_SOURCE_ROOT = sourceRoot;
-    process.env.KENNEL_HOST_NODE_MODULES = resolve(cliRoot(), "node_modules");
+// Tailwind utilities used by the plugin source, generated with the host theme,
+// plus the plugin's own stylesheet with its url() assets.
+async function buildPluginStyles(plugin, outdir, theme) {
+    const [{ compile }, { Scanner }, esbuild] = await Promise.all([
+        import("@tailwindcss/node"),
+        import("@tailwindcss/oxide"),
+        import("esbuild"),
+    ]);
+    const source = dirname(plugin.entries.client);
+    const input = [
+        '@import "tailwindcss/theme.css" layer(theme);',
+        `@import ${JSON.stringify(theme)};`,
+        '@import "tailwindcss/utilities.css" layer(utilities);',
+        ...(plugin.entries.css ? [`@import ${JSON.stringify(plugin.entries.css)};`] : []),
+    ].join("\n");
+    const compiler = await compile(input, {
+        base: cliRoot(),
+        from: join(source, "kennel-plugin.css"),
+        onDependency: () => { },
+        shouldRewriteUrls: true,
+    });
+    const candidates = new Scanner({ sources: [{ base: source, pattern: "**/*", negated: false }] }).scan();
+    let contents = compiler.build(candidates);
+    // Tailwind rewrote url() targets relative to its base (the CLI root); esbuild
+    // resolves them relative to the stdin resolveDir (the plugin source). Re-express
+    // each rewritten target against the plugin source so bundling resolves.
+    contents = contents.replace(/url\((?:("[^"]*")|('[^']*')|([^)]*))\)/g, (entry, double, single, bare) => {
+        const quoted = double ?? single;
+        const path = (quoted ? quoted.slice(1, -1) : bare).trim();
+        if (!path || !(path.startsWith("./") || path.startsWith("../")))
+            return entry;
+        const absolute = resolve(cliRoot(), path);
+        if (!existsSync(absolute))
+            return entry;
+        const target = relative(source, absolute);
+        return quoted ? `url("${target}")` : `url(${target})`;
+    });
+    // Vendored stylesheets can reference asset files the plugin repo never committed.
+    // One missing file must not block the whole plugin build: rewrite those url()
+    // references to an empty data URL and carry on.
+    let missingAssets;
     try {
-        await vite.build({
-            configFile: resolve(sourceRoot, "apps/web/vite.config.ts"),
-            root: resolve(sourceRoot, "apps/web"),
-            build: { outDir: join(temp, "web"), emptyOutDir: true },
-            envFile: false,
-            mode: "production",
-        });
+        await esbuildStyle({ esbuild, contents, source, outdir });
     }
-    finally {
-        if (previousClientModule === undefined)
-            delete process.env.KENNEL_EXTERNAL_CLIENT_MODULE;
-        else
-            process.env.KENNEL_EXTERNAL_CLIENT_MODULE = previousClientModule;
-        if (previousSourceRoot === undefined)
-            delete process.env.KENNEL_KERNEL_SOURCE_ROOT;
-        else
-            process.env.KENNEL_KERNEL_SOURCE_ROOT = previousSourceRoot;
-        if (previousHostNodeModules === undefined)
-            delete process.env.KENNEL_HOST_NODE_MODULES;
-        else
-            process.env.KENNEL_HOST_NODE_MODULES = previousHostNodeModules;
+    catch (error) {
+        missingAssets = missingCssAssets(error);
+        if (!missingAssets?.length)
+            throw error;
+        console.error(`kennel plugin: could not bundle styles, ignoring missing css assets: ${missingAssets.join(", ")}`);
+        for (const asset of missingAssets) {
+            contents = contents.replaceAll(`url("${asset}")`, EMPTY_ASSET_URL);
+            contents = contents.replaceAll(`url('${asset}')`, EMPTY_ASSET_URL);
+            contents = contents.replaceAll(`url(${asset})`, EMPTY_ASSET_URL);
+        }
+        await esbuildStyle({ esbuild, contents, source, outdir });
     }
-    const kernel = {
-        buildIdentity: BUILD_IDENTITY,
-        schema: KENNEL_KERNEL_SCHEMA,
-        runtime: BUILD_RUNTIME,
-        key,
-        webRoot: join(target, "web"),
-        serverEntries,
-        apiEntries,
-    };
-    await writeFile(join(temp, "kernel.json"), JSON.stringify(kernel, null, 2));
-    return kernel;
+    return "plugin.css";
+}
+/** esbuild asset files a failed css bundle named as unresolvable. */
+function missingCssAssets(error) {
+    const errors = error.errors ?? [];
+    return errors
+        .map((item) => item.text ?? "")
+        .filter((text) => text.includes('Could not resolve'))
+        .map((text) => /^Could not resolve "(.+)"/.exec(text)?.[1])
+        .filter((path) => Boolean(path));
+}
+async function esbuildStyle(args) {
+    const { esbuild, contents, source, outdir } = args;
+    await esbuild.build({
+        assetNames: "assets/[name]-[hash]",
+        bundle: true,
+        loader: ASSET_LOADERS,
+        logLevel: "silent",
+        minify: true,
+        outfile: join(outdir, "plugin.css"),
+        stdin: { contents, loader: "css", resolveDir: source, sourcefile: "kennel-plugin.css" },
+    });
 }
-export async function ensureKernel(plugins = readExternalPlugins()) {
-    if (plugins.length === 0) {
-        const webRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../web");
-        return { buildIdentity: BUILD_IDENTITY, schema: KENNEL_KERNEL_SCHEMA, runtime: BUILD_RUNTIME, key: "core", webRoot, serverEntries: [], apiEntries: [] };
+// One browser bundle per plugin: shared host modules stay external, the rest
+// (and any lazily imported chunks) is compiled into the plugin's directory.
+async function buildPluginClient(plugin, outdir) {
+    const esbuild = await import("esbuild");
+    const result = await esbuild.build({
+        assetNames: "assets/[name]-[hash]",
+        bundle: true,
+        chunkNames: "chunks/[name]-[hash]",
+        define: { "process.env.NODE_ENV": '"production"' },
+        entryNames: "[name]",
+        entryPoints: { client: plugin.entries.client },
+        format: "esm",
+        jsx: "automatic",
+        loader: ASSET_LOADERS,
+        logLevel: "silent",
+        metafile: true,
+        minify: true,
+        outdir,
+        platform: "browser",
+        plugins: [hostResolutionPlugin("browser")],
+        publicPath: `/_kennel/plugins/${plugin.id}`,
+        splitting: true,
+        target: "es2022",
+    });
+    const output = Object.entries(result.metafile.outputs).find(([, value]) => value.entryPoint)?.[1];
+    return output?.cssBundle ? [relative(outdir, resolve(output.cssBundle))] : [];
+}
+async function pluginManifest(plugin, outfile) {
+    await bundleForImport(plugin.entries.manifest, outfile, "browser");
+    const manifest = (await import(__rewriteRelativeImportExtension(pathToFileURL(outfile).href))).default;
+    assertManifest(manifest, plugin.id, "manifest export");
+    return JSON.parse(JSON.stringify(manifest));
+}
+async function buildPlugins(temp, target, key, plugins, theme) {
+    const serverEntries = [];
+    const apiEntries = [];
+    const registry = [];
+    for (const plugin of plugins) {
+        const clientDir = join(temp, "client", plugin.id);
+        const clientStyles = await buildPluginClient(plugin, clientDir);
+        const styles = [await buildPluginStyles(plugin, clientDir, theme), ...clientStyles];
+        registry.push({
+            manifest: await pluginManifest(plugin, join(temp, "manifest", `${plugin.id}.js`)),
+            module: `/_kennel/plugins/${plugin.id}/client.js`,
+            styles: styles.map((style) => `/_kennel/plugins/${plugin.id}/${style}`),
+        });
+        await bundleForImport(plugin.entries.server, join(temp, "server", `${plugin.id}.js`), "node");
+        serverEntries.push({ id: plugin.id, module: join(target, "server", `${plugin.id}.js`), symbol: "default", trigger: plugin.trigger });
+        if (plugin.entries.api) {
+            await bundleForImport(plugin.entries.api, join(temp, "server", `${plugin.id}-api.js`), "node");
+            apiEntries.push({ id: plugin.id, module: join(target, "server", `${plugin.id}-api.js`), symbol: "default" });
+        }
     }
-    const key = kernelKey(plugins);
-    const target = kernelRoot(key);
+    await writeFile(join(temp, "client", "registry.js"), `export default ${JSON.stringify({ plugins: registry }, null, 2)};\n`);
+    const build = { key, clientRoot: join(target, "client"), serverEntries, apiEntries };
+    await writeFile(join(temp, "build.json"), JSON.stringify({ buildIdentity: BUILD_IDENTITY, ...build }, null, 2));
+    return build;
+}
+/**
+ * Compiles the installed external plugins once per plugin set. The host web
+ * app is never rebuilt: plugin browser modules load at runtime against the
+ * host's shared modules, and server/API modules load in the core.
+ */
+export async function ensurePluginBuild(plugins = readExternalPlugins(), options = {}) {
+    const key = pluginSetKey(plugins);
+    if (plugins.length === 0)
+        return { key, serverEntries: [], apiEntries: [] };
+    const theme = options.theme ?? join(webRoot(), "kennel-theme.css");
+    if (!existsSync(theme))
+        throw new Error(`Kennel host theme is missing: ${theme}. Build the CLI first.`);
+    const target = buildRoot(key);
     assertUnderCache(target);
-    const marker = join(target, "kernel.json");
-    const cached = await readKernelMarker(marker, key);
+    const marker = join(target, "build.json");
+    const cached = await readBuildMarker(marker, key);
     if (cached)
         return cached;
     mkdirSync(dirname(target), { recursive: true });
-    const release = acquireKernelLock(key);
+    const release = acquireBuildLock(key);
     try {
-        const afterLock = await readKernelMarker(marker, key);
+        const afterLock = await readBuildMarker(marker, key);
         if (afterLock)
             return afterLock;
         if (existsSync(target))
@@ -588,22 +679,14 @@ export async function ensureKernel(plugins = readExternalPlugins()) {
         rmSync(temp, { force: true, recursive: true });
         mkdirSync(temp, { recursive: true });
         try {
-            const kernel = await buildKernelTemp(temp, target, key, plugins);
-            if (existsSync(target)) {
-                const completed = await readKernelMarker(marker, key);
-                if (completed) {
-                    rmSync(temp, { force: true, recursive: true });
-                    return completed;
-                }
-                moveIncompleteAside(target);
-            }
+            const build = await buildPlugins(temp, target, key, plugins, theme);
             renameSync(temp, target);
-            return kernel;
+            return build;
         }
         catch (error) {
             rmSync(temp, { force: true, recursive: true });
             const message = error instanceof Error ? error.message : String(error);
-            throw new Error(`Failed to build kernel ${key}: ${message}`);
+            throw new Error(`Failed to build external plugins ${key}: ${message}`);
         }
     }
     finally {