neoctl-web 0.1.16 → 0.1.18

package/isolation.mjs

@@ -33,7 +33,7 @@ export function sanitizeIsolatedSnapshot(value) {
 }
 
 /** Web-only identity boundary. The core receives neither credentials nor user identities. */
-export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir, configFile, memoryState = () => ({ current: null, history: [] }), cpaQuotaMonitor, pluginSettings, toolSettings }) {
+export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir, pluginManager, configFile, memoryState = () => ({ current: null, history: [] }), cpaQuotaMonitor, pluginSettings, toolSettings }) {
   const config = await loadIsolationConfig(dataRoot, configFile);
   if (!config.enabled) return {
     enabled: false,
@@ -51,14 +51,14 @@ export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir,
   const { installRuntimeRouterIdleCleanup } = await import('./runtime-router-cleanup.mjs');
   installRuntimeRouterIdleCleanup();
   const { createWorkspaceRuntimeManager } = await import('./runtime-workspaces.mjs');
-  const { createWebPluginHost } = await import('./plugins.mjs');
+  const { createPluginManager } = await import('./plugin-manager.mjs');
+  pluginManager ||= await createPluginManager({ directory: path.join(dataRoot, 'installed-plugins'), builtInDirectory: pluginDir, loadPlugins: core.loadNeoPlugins });
   const { createWebPluginSettings } = await import('./plugin-settings.mjs');
   const { createWebToolSettings } = await import('./tool-settings.mjs');
   const { createChunkUploadHandler } = await import('./chunk-uploads.mjs');
   const { workspaceFs, openWorkspaceRead, containerMode } = await import('./execution-backend.mjs');
   const globalPlugins = pluginSettings || await createWebPluginSettings(path.join(dataRoot, 'plugins.json'));
   const globalTools = toolSettings || await createWebToolSettings(path.join(dataRoot, 'tools.json'));
-  const startupPlugins = process.env.NEO_WEB_PLUGINS?.trim() || globalPlugins.globalEnabledIds();
   const users = new Map();
   let modelConfigQueue = Promise.resolve();
   const withModelConfigLock = operation => {
@@ -101,11 +101,10 @@ export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir,
     for (const key of ['NEO_DOWNLOADS_DIR', 'NEO_VIDEO_SHARE_DIR', 'NEO_XHS_ARTIFACTS_DIR']) delete pluginEnv[key];
     const settings = await createWebPluginSettings(path.join(root, 'plugins.json'));
     const tools = await createWebToolSettings(path.join(root, 'tools.json'));
-    const pluginHost = createWebPluginHost({
-      plugins: await core.loadNeoPlugins({ directories: pluginDir, appDataDir: root, env: pluginEnv }),
-      enabled: startupPlugins, locked: Boolean(process.env.NEO_WEB_PLUGINS?.trim()),
+    const pluginHost = await pluginManager.createHost({
+      enabled: process.env.NEO_WEB_PLUGINS?.trim() || globalPlugins.globalEnabledIds(), locked: Boolean(process.env.NEO_WEB_PLUGINS?.trim()),
       settings: { ...settings, globalEnabledIds: () => globalPlugins.globalEnabledIds(), setGlobalEnabled: ids => globalPlugins.setGlobalEnabled(ids) },
-    });
+    }, { appDataDir: root, env: pluginEnv });
     const manager = createWorkspaceRuntimeManager({
       projectRoot: workRoot, workspaceRoot: workRoot, registryFile: path.join(root, 'workspaces.json'),
       createRuntime: options => core.createWebRuntime({
@@ -231,7 +230,7 @@ export async function createIsolationMode({ dataRoot, workspaceRoot, pluginDir,
           const state = cpaQuotaMonitor?.getPublicState() || { config: { url: '', hasPassword: false }, quotas: [] };
           jsonReply(res, isAdmin ? state : { quotas: state.quotas }); return true;
         }
-        if (['/api/cpa-config', '/api/plugins/global', '/api/prompt-config', '/api/tools/global'].includes(url.pathname) || (isAdmin && ['/api/plugins', '/api/tools'].includes(url.pathname))) {
+        if (['/api/cpa-config', '/api/plugins/global', '/api/plugins/install', '/api/plugins/uninstall', '/api/prompt-config', '/api/tools/global'].includes(url.pathname) || (isAdmin && ['/api/plugins', '/api/tools'].includes(url.pathname))) {
           if (!isAdmin) throw httpError(403, '仅超管可修改全局配置');
           if (!['GET', 'POST'].includes(req.method)) throw httpError(405, '请求方法无效');
           if (url.pathname === '/api/cpa-config') {

package/local-resources.mjs

@@ -0,0 +1,15 @@
+// Optional host capability. Resource plugins know only this helper, not the desktop shell.
+export function createLocalResourceHeaders({ enabled = false } = {}) {
+  return (req, absolutePath) => {
+    if (!enabled || req.method !== 'HEAD' || req.headers['x-neo-resource-action'] !== 'reveal') return {};
+    const address = req.socket?.remoteAddress;
+    if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) return {};
+    if (req.headers['sec-fetch-site'] === 'cross-site') return {};
+    if (req.headers.origin) {
+      try { if (new URL(req.headers.origin).host !== req.headers.host) return {}; }
+      catch { return {}; }
+    }
+    // Percent encoding keeps Unicode and control characters out of HTTP header syntax.
+    return { 'X-Neo-Resource-Path': encodeURIComponent(absolutePath), Vary: 'X-Neo-Resource-Action' };
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoctl-web",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Neo browser workspace with an embedded agent runtime.",
   "type": "module",
   "engines": {
@@ -36,7 +36,7 @@
     "@tanstack/vue-virtual": "^3.13.36",
     "highlight.js": "^11.11.1",
     "marked": "^18.0.3",
-    "neoctl": "0.2.42",
+    "neoctl": "0.2.44",
     "streaming-markdown": "^0.2.15",
     "vue": "^3.5.13"
   },
@@ -61,7 +61,9 @@
     "chunk-uploads.mjs",
     "plugins.mjs",
     "plugin-settings.mjs",
+    "plugin-manager.mjs",
     "platform-paths.mjs",
+    "local-resources.mjs",
     "tool-settings.mjs",
     "runtime-workspaces.mjs",
     "runtime-router-cleanup.mjs",

package/plugin-manager.mjs

@@ -0,0 +1,120 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { createWebPluginHost } from './plugins.mjs';
+
+/** Trusted local plugin packages only. Code is copied to immutable, unique module URLs. */
+export async function createPluginManager({ directory, builtInDirectory, loadPlugins, onError = console.error }) {
+  const root = path.resolve(directory);
+  const indexFile = path.join(root, 'catalog.json');
+  await fs.mkdir(root, { recursive: true });
+  let state;
+  try { state = JSON.parse(await fs.readFile(indexFile, 'utf8')); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; state = { installed: {}, removed: [] }; }
+  if (!state || !state.installed || !Array.isArray(state.removed)) throw new Error('invalid plugin catalog');
+  const builtins = new Map();
+  const builtInEntries = await fs.readdir(builtInDirectory, { withFileTypes: true }).catch(error => {
+    if (error.code === 'ENOENT') return [];
+    throw error;
+  });
+  for (const entry of builtInEntries) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(builtInDirectory, entry.name);
+    try { const manifest = JSON.parse(await fs.readFile(path.join(dir, 'neo-plugin.json'), 'utf8')); builtins.set(manifest.id, dir); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+  }
+  const hosts = new Set();
+  let queue = Promise.resolve();
+  const serial = operation => { const result = queue.catch(() => {}).then(operation); queue = result; return result; };
+  function sources(value) {
+    const result = new Map([...builtins].filter(([id]) => !value.removed.includes(id)));
+    for (const [id, folder] of Object.entries(value.installed)) {
+      if (!/^[a-f0-9-]{36}$/.test(folder)) throw new Error('invalid installed plugin directory');
+      result.set(id, path.join(root, folder));
+    }
+    return result;
+  }
+  async function persist(next) {
+    const temp = `${indexFile}.${randomUUID()}.tmp`;
+    try { await fs.writeFile(temp, JSON.stringify(next, null, 2) + '\n'); await fs.rename(temp, indexFile); }
+    finally { await fs.rm(temp, { force: true }); }
+  }
+  async function load(source, context) {
+    const plugins = await loadPlugins({ directories: [], pluginDirectories: [source], ...context });
+    if (plugins.length !== 1) throw new Error('package must contain exactly one neo-plugin.json at its root');
+    return plugins[0];
+  }
+  async function publish(next) {
+    const nextSources = sources(next), prepared = [], created = [];
+    try {
+      for (const entry of hosts) {
+        const plugins = new Map();
+        for (const [id, source] of nextSources) {
+          let plugin = entry.plugins.get(id);
+          if (!plugin || plugin.sourceDir !== source) { plugin = await load(source, entry.context); created.push(plugin); }
+          if (plugin.id !== id) throw new Error(`plugin id mismatch: ${id}`);
+          plugins.set(id, plugin);
+        }
+        prepared.push({ entry, plugins, commit: entry.host.prepare([...plugins.values()]) });
+      }
+      await persist(next);
+    } catch (error) {
+      await Promise.allSettled(created.map(p => Promise.resolve().then(() => p.dispose?.())));
+      throw error;
+    }
+    const previous = state;
+    state = next;
+    const drains = prepared.map(({ entry, plugins, commit }) => { entry.plugins = plugins; return commit(); });
+    // Never wait for an active model turn in a management request. Logical removal is complete.
+    void Promise.all(drains).then(async () => {
+      const retained = new Set(Object.values(next.installed));
+      for (const folder of Object.values(previous.installed)) {
+        if (!retained.has(folder)) await fs.rm(path.join(root, folder), { recursive: true, force: true });
+      }
+    }).catch(onError);
+  }
+  const manager = {
+    createHost(options = {}, context = {}) {
+      return serial(async () => {
+        const plugins = new Map();
+        try {
+          for (const [id, source] of sources(state)) plugins.set(id, await load(source, context));
+          const host = createWebPluginHost({ ...options, plugins: [...plugins.values()], management: manager, onError });
+          hosts.add({ host, plugins, context });
+          return host;
+        } catch (error) {
+          await Promise.allSettled([...plugins.values()].map(p => Promise.resolve().then(() => p.dispose?.())));
+          throw error;
+        }
+      });
+    },
+    install(directory) {
+      return serial(async () => {
+        if (typeof directory !== 'string' || !path.isAbsolute(directory)) throw new Error('install requires an absolute trusted local package directory');
+        const source = await fs.realpath(directory);
+        const relative = path.relative(source, root);
+        if (!relative || (!relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative))) throw new Error('package cannot contain the plugin installation store');
+        const folder = randomUUID(), target = path.join(root, folder);
+        try {
+          await fs.cp(source, target, { recursive: true, filter: async file => {
+            const stat = await fs.lstat(file);
+            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory())) throw new Error('plugin packages must contain only regular files and directories, no links');
+            return true;
+          } });
+          const manifest = JSON.parse(await fs.readFile(path.join(target, 'neo-plugin.json'), 'utf8'));
+          if (!/^[a-z0-9][a-z0-9._-]*$/.test(manifest.id || '')) throw new Error('invalid plugin id');
+          if (!hosts.size) throw new Error('no plugin host is available to validate the package');
+          await publish({ installed: { ...state.installed, [manifest.id]: folder }, removed: state.removed.filter(id => id !== manifest.id) });
+        } catch (error) { await fs.rm(target, { recursive: true, force: true }); throw error; }
+      });
+    },
+    uninstall(id) {
+      return serial(async () => {
+        if (typeof id !== 'string' || !sources(state).has(id)) throw new Error(`unknown plugin: ${id}`);
+        const installed = { ...state.installed }; delete installed[id];
+        await publish({ installed, removed: [...new Set([...state.removed, id])] });
+      });
+    },
+  };
+  return manager;
+}

package/plugin-settings.mjs

@@ -9,10 +9,14 @@ export async function createWebPluginSettings(storageFile) {
     return structuredClone(state);
   }
 
-  async function update(next) {
-    state = next;
-    writeQueue = writeQueue.catch(() => undefined).then(() => writeState(storageFile, state));
-    await writeQueue;
+  function update(reduce) {
+    const operation = writeQueue.catch(() => undefined).then(async () => {
+      const next = reduce(state);
+      await writeState(storageFile, next);
+      state = next;
+    });
+    writeQueue = operation;
+    return operation;
   }
 
   return {
@@ -25,16 +29,18 @@ export async function createWebPluginSettings(storageFile) {
       return value && typeof value === 'object' ? { ...value } : {};
     },
     async setGlobalEnabled(ids) {
-      await update({ ...state, globalEnabled: [...new Set(ids)].sort() });
+      await update(current => ({ ...current, globalEnabled: [...new Set(ids)].sort() }));
     },
     async setSessionOverrides(sessionId, overrides) {
       const id = String(sessionId || '').trim();
       if (!id) throw new Error('session id is required');
-      const sessions = { ...state.sessions };
+      await update(current => {
+      const sessions = { ...current.sessions };
       const normalized = Object.fromEntries(Object.entries(overrides).filter(([, value]) => typeof value === 'boolean'));
       if (Object.keys(normalized).length) sessions[id] = normalized;
       else delete sessions[id];
-      await update({ ...state, sessions });
+      return { ...current, sessions };
+      });
     },
   };
 }

package/plugins/downloads/downloads.mjs

@@ -86,7 +86,7 @@ export function createExposeDownloadsTool(options) {
   return tool;
 }
 
-export async function serveDownload(registry, req, res, id) {
+export async function serveDownload(registry, req, res, id, helpers = {}) {
   let handle;
   try {
     const entry = await registry.get(id);
@@ -95,6 +95,7 @@ export async function serveDownload(registry, req, res, id) {
     const stat = await handle.stat();
     if (!stat.isFile()) throw Object.assign(new Error('Not a file'), { code: 'ENOENT' });
     res.writeHead(200, {
+      ...helpers.localResourceHeaders?.(req, entry.absolutePath),
       'Content-Type': 'application/octet-stream', 'Content-Length': stat.size,
       'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent(entry.filename).replace(/['()*]/g, (c) => '%' + c.charCodeAt(0).toString(16))}`,
       'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer',

package/plugins/downloads/index.mjs

@@ -11,11 +11,11 @@ export function createPlugin(context = {}) {
       name: 'Web Downloads', requiresTools: ['expose_downloads'], cacheStable: true,
       content: 'When you create, modify, export, package, or identify local files that the web user should receive as downloads, call expose_downloads with the relevant absolute paths before the final response. For every download link, copy downloads[].markdown verbatim (neoctl.resource-link.v1): never construct links or add/remove a sandbox: prefix. Only the link-to-original-absolute-path mapping is persisted, with no file copy and no directory restriction. Links do not automatically expire and expiresAt is null. If the original path is moved, deleted, or unreadable, the link stops working. Anyone with a link can download. Historical links from the old in-memory plugin cannot be restored; re-expose the original file if needed.',
     }],
-    async route(req, res, url) {
+    async route(req, res, url, helpers = {}) {
       if (!url.pathname.startsWith('/api/downloads/')) return false;
       if (!['GET', 'HEAD'].includes(req.method)) { res.writeHead(405, { Allow: 'GET, HEAD' }); res.end(); return true; }
       const id = url.pathname.slice('/api/downloads/'.length);
-      await serveDownload(registry, req, res, id);
+      await serveDownload(registry, req, res, id, helpers);
       return true;
     },
   };

package/plugins.mjs

@@ -4,108 +4,201 @@ function normalizePlugin(plugin) {
   if (!/^[a-z0-9][a-z0-9._-]*$/.test(id)) throw new Error(`invalid web plugin id: ${id || '(empty)'}`);
   if (!String(plugin.name || '').trim()) throw new Error(`web plugin ${id} is missing name`);
   if (!String(plugin.version || '').trim()) throw new Error(`web plugin ${id} is missing version`);
-  if (plugin.route !== undefined && typeof plugin.route !== 'function') throw new Error(`web plugin ${id} route must be a function`);
-  if (plugin.presentToolResult !== undefined && typeof plugin.presentToolResult !== 'function') throw new Error(`web plugin ${id} presentToolResult must be a function`);
-  return {
-    ...plugin,
-    id,
-    name: String(plugin.name).trim(),
-    version: String(plugin.version).trim(),
+  for (const key of ['route', 'presentToolResult', 'dispose']) {
+    if (plugin[key] !== undefined && typeof plugin[key] !== 'function') throw new Error(`web plugin ${id} ${key} must be a function`);
+  }
+  return { ...plugin, id, name: String(plugin.name).trim(), version: String(plugin.version).trim(),
     defaultEnabled: plugin.defaultEnabled !== false,
     tools: Array.isArray(plugin.tools) ? plugin.tools : [],
-    promptSections: Array.isArray(plugin.promptSections) ? plugin.promptSections : [],
-  };
+    promptSections: Array.isArray(plugin.promptSections) ? plugin.promptSections : [] };
 }
 
+/** Owns instances, not plugin-specific routes or storage. Published catalogs change synchronously. */
 export function createWebPluginHost(options = {}) {
-  const catalog = (options.plugins || []).map(normalizePlugin).sort((left, right) => left.id.localeCompare(right.id));
-  const ids = catalog.map((plugin) => plugin.id);
-  if (new Set(ids).size !== ids.length) throw new Error('duplicate web plugin id');
-  const enabledIds = resolveEnabledPluginIds(catalog, options.enabled);
-  const enabled = catalog.filter((plugin) => enabledIds.has(plugin.id));
-  const tools = enabled.flatMap((plugin) => plugin.tools);
-  const toolNames = tools.map((tool) => String(tool?.name || '').trim()).filter(Boolean);
-  if (new Set(toolNames).size !== toolNames.length) throw new Error('duplicate tool name across enabled web plugins');
+  let catalog = [];
+  let revision = 0;
+  const entries = new Map();
+  const reserved = new Map();
+  const retired = new Set();
+  let enabledSetting = options.enabled;
+  let mutation = Promise.resolve();
+  const report = error => (options.onError || console.error)(error);
 
-  return {
-    ids: enabled.map((plugin) => plugin.id),
-    tools,
-    promptSections: enabled.flatMap((plugin) => plugin.promptSections),
+  function enabledIds() {
+    // Shared settings make global switches immediately visible to isolated user hosts too.
+    const configured = options.locked ? enabledSetting : options.settings?.globalEnabledIds() ?? enabledSetting;
+    const value = Array.isArray(configured) ? configured.filter(id => catalog.some(p => p.id === id)) : configured;
+    return resolveEnabledPluginIds(catalog, value);
+  }
+  function active() { const ids = enabledIds(); return catalog.filter(p => ids.has(p.id)); }
+  function validate(plugins) {
+    const next = plugins.map(normalizePlugin).sort((a, b) => a.id.localeCompare(b.id));
+    if (new Set(next.map(p => p.id)).size !== next.length) throw new Error('duplicate web plugin id');
+    const names = new Set();
+    for (const plugin of next) for (const tool of plugin.tools) {
+      for (const name of [tool.name, ...(tool.aliases || [])]) {
+        if (names.has(name)) throw new Error(`duplicate tool name or alias across web plugins: ${name}`);
+        if (reserved.has(name)) throw new Error(`plugin tool conflicts with host tool: ${name}`);
+        names.add(name);
+      }
+    }
+    return next;
+  }
+  function drain(entry) {
+    if (!entry.retired || entry.leases || entry.disposal) return;
+    entry.disposal = Promise.resolve().then(() => entry.plugin.dispose?.()).catch(report).finally(() => {
+      retired.delete(entry);
+      entry.finish();
+    });
+  }
+  function lease(plugins) {
+    const owned = plugins.map(p => entries.get(p.id));
+    for (const entry of owned) entry.leases++;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      for (const entry of owned) { entry.leases--; drain(entry); }
+    };
+  }
+  function publish(next) {
+    const waits = [];
+    for (const [id, entry] of entries) {
+      if (next.some(p => p.plugin.id === id && p.source === entry.source)) continue;
+      entries.delete(id);
+      entry.retired = true;
+      retired.add(entry);
+      waits.push(entry.drained);
+      drain(entry);
+    }
+    catalog = next.map(({ source, plugin }) => {
+      if (!entries.has(plugin.id)) {
+        let finish;
+        const drained = new Promise(resolve => { finish = resolve; });
+        entries.set(plugin.id, { source, plugin, leases: 0, retired: false, drained, finish });
+      }
+      return entries.get(plugin.id).plugin;
+    });
+    revision++;
+    return Promise.all(waits);
+  }
+  const initial = options.plugins || [];
+  // Explicit startup configuration is strict; persisted removed ids are filtered when resolving.
+  if (typeof enabledSetting === 'string') resolveEnabledPluginIds(initial, enabledSetting);
+  const normalized = validate(initial);
+  publish(normalized.map(plugin => ({ plugin, source: initial.find(p => p.id === plugin.id) })));
+
+  function definitions() {
+    const enabled = enabledIds();
+    return catalog.map(plugin => ({ id: plugin.id, name: plugin.name, version: plugin.version,
+      globallyEnabled: enabled.has(plugin.id), tools: plugin.tools, promptSections: plugin.promptSections,
+      presentToolResult: plugin.presentToolResult }));
+  }
+  const host = {
+    get ids() { return active().map(p => p.id); },
+    get tools() { return active().flatMap(p => p.tools); },
+    get promptSections() { return active().flatMap(p => p.promptSections); },
+    /** Validate before any persistent commit; publication itself cannot fail. */
+    prepare(plugins) {
+      const normalized = validate(plugins);
+      const next = normalized.map(plugin => ({ plugin, source: plugins.find(p => p.id === plugin.id) }));
+      return () => publish(next);
+    },
+    reserveToolNames(names) {
+      const own = new Set(catalog.flatMap(p => p.tools.flatMap(t => [t.name, ...(t.aliases || [])])));
+      for (const name of names) if (own.has(name)) throw new Error(`plugin tool conflicts with host tool: ${name}`);
+      for (const name of names) reserved.set(name, true);
+    },
     runtimePlugins(sessionId) {
-      const overrides = options.settings?.sessionOverrides(sessionId) || {};
       return {
-        externalPlugins: catalog.map((plugin) => ({
-          id: plugin.id,
-          name: plugin.name,
-          version: plugin.version,
-          globallyEnabled: enabledIds.has(plugin.id),
-          tools: plugin.tools,
-          promptSections: plugin.promptSections,
-          presentToolResult: plugin.presentToolResult,
-        })),
-        sessionPluginOverrides: overrides,
-        persistSessionPluginOverrides: (resolvedSessionId, next) => options.settings?.setSessionOverrides(resolvedSessionId, next),
-        resolveSessionPluginOverrides: (resolvedSessionId) => options.settings?.sessionOverrides(resolvedSessionId) || {},
+        externalPlugins: definitions(),
+        resolveExternalPlugins: definitions,
+        reservePluginToolNames: names => host.reserveToolNames(names),
+        acquirePluginSnapshot(overrides = {}) {
+          const enabled = active().filter(p => overrides[p.id] !== false);
+          return { plugins: definitions(), release: lease(enabled) };
+        },
+        sessionPluginOverrides: options.settings?.sessionOverrides(sessionId) || {},
+        persistSessionPluginOverrides: (id, next) => options.settings?.setSessionOverrides(id, next),
+        resolveSessionPluginOverrides: id => options.settings?.sessionOverrides(id) || {},
       };
     },
     snapshot() {
-      const configuredIds = new Set(options.settings?.globalEnabledIds() ?? [...enabledIds]);
-      return {
-        items: catalog.map((plugin) => ({
-          id: plugin.id,
-          name: plugin.name,
-          version: plugin.version,
-          enabled: enabledIds.has(plugin.id),
-          configuredEnabled: configuredIds.has(plugin.id),
-          tools: plugin.tools.map((tool) => tool.name),
-        })),
-        restartRequired: true,
-        locked: options.locked === true,
-      };
+      const enabled = enabledIds();
+      return { revision, items: catalog.map(p => ({ id: p.id, name: p.name, version: p.version,
+        enabled: enabled.has(p.id), configuredEnabled: enabled.has(p.id), tools: p.tools.map(t => t.name) })),
+        restartRequired: false, locked: options.locked === true, installationSupported: Boolean(options.management) };
     },
     async route(req, res, url, helpers = {}) {
       if (req.method === 'GET' && url.pathname === '/api/plugins') {
-        helpers.sendJson?.(res, this.snapshot());
-        return true;
+        helpers.sendJson?.(res, host.snapshot()); return true;
       }
-      if (req.method === 'POST' && url.pathname === '/api/plugins/global') {
+      if (req.method === 'POST' && ['/api/plugins/global', '/api/plugins/install', '/api/plugins/uninstall'].includes(url.pathname)) {
+        const origin = req.headers?.origin;
+        if (req.headers?.['sec-fetch-site'] === 'cross-site' || (origin && !sameHostOrigin(origin, req.headers?.host))) {
+          helpers.sendJson?.(res, { errorCode: 'PLUGIN_ORIGIN_DENIED', error: 'cross-origin plugin management is not allowed' }, 403); return true;
+        }
         if (options.locked) {
-          helpers.sendJson?.(res, { errorCode: 'PLUGINS_LOCKED', error: 'plugins are locked by NEO_WEB_PLUGINS' }, 409);
-          return true;
+          helpers.sendJson?.(res, { errorCode: 'PLUGINS_LOCKED', error: 'plugins are locked by NEO_WEB_PLUGINS' }, 409); return true;
         }
         const body = await helpers.readJsonBody?.(req);
-        const requested = Array.isArray(body?.enabledIds) ? body.enabledIds.map(String) : [];
-        const unknown = requested.filter((id) => !ids.includes(id));
-        if (unknown.length) {
-          helpers.sendJson?.(res, { errorCode: 'PLUGIN_INVALID', error: `unknown web plugin: ${unknown.join(', ')}` }, 400);
-          return true;
-        }
-        await options.settings?.setGlobalEnabled(requested);
-        helpers.sendJson?.(res, { ok: true, enabledIds: [...new Set(requested)].sort(), restartRequired: true });
+        const operation = mutation.catch(() => {}).then(async () => {
+          if (url.pathname !== '/api/plugins/global') {
+            if (!options.management) throw new Error('plugin installation is not configured');
+            if (url.pathname.endsWith('/install')) await options.management.install(body?.directory);
+            else await options.management.uninstall(body?.id);
+          } else {
+            if (!Array.isArray(body?.enabledIds)) throw new Error('enabledIds must be an array');
+            const requested = [...resolveEnabledPluginIds(catalog, body.enabledIds)];
+            await options.settings?.setGlobalEnabled(requested);
+            enabledSetting = requested;
+            revision++;
+          }
+          return { ok: true, enabledIds: host.ids, ...host.snapshot() };
+        });
+        mutation = operation;
+        try { helpers.sendJson?.(res, await operation); }
+        catch (error) { helpers.sendJson?.(res, { errorCode: 'PLUGIN_UPDATE_FAILED', error: error.message || String(error) }, 400); }
         return true;
       }
-      for (const plugin of enabled) {
-        if (typeof plugin.route === 'function' && await plugin.route(req, res, url, helpers)) return true;
+      // Hold a lease through response finish/close, not merely through the route promise (streams).
+      for (const plugin of active()) {
+        if (entries.get(plugin.id)?.plugin !== plugin || !enabledIds().has(plugin.id) || typeof plugin.route !== 'function') continue;
+        const release = lease([plugin]);
+        let routeDone = false, responseDone = false, handled = false;
+        const finish = () => { responseDone = true; if (routeDone) release(); };
+        res.once?.('finish', finish); res.once?.('close', finish);
+        try { handled = await plugin.route(req, res, url, helpers); }
+        finally {
+          routeDone = true;
+          if (!handled || responseDone || res.writableFinished || res.destroyed || !res.once) {
+            res.off?.('finish', finish); res.off?.('close', finish); release();
+          }
+        }
+        if (handled) return true;
       }
       return false;
     },
   };
+  return host;
+}
+
+function sameHostOrigin(origin, host) {
+  try { const url = new URL(origin); return ['http:', 'https:'].includes(url.protocol) && url.host === host; }
+  catch { return false; }
 }
 
 export function resolveEnabledPluginIds(catalog, configured) {
-  const available = new Set(catalog.map((plugin) => plugin.id));
+  const available = new Set(catalog.map(plugin => plugin.id));
   if (Array.isArray(configured)) {
     const requested = configured.map(String);
-    const unknown = requested.filter((id) => !available.has(id));
+    const unknown = requested.filter(id => !available.has(id));
     if (unknown.length) throw new Error(`unknown web plugin: ${unknown.join(', ')}`);
     return new Set(requested);
   }
   const raw = configured === undefined || configured === null ? '' : String(configured).trim();
-  if (!raw) return new Set(catalog.filter((plugin) => plugin.defaultEnabled !== false).map((plugin) => plugin.id));
+  if (!raw) return new Set(catalog.filter(plugin => plugin.defaultEnabled !== false).map(plugin => plugin.id));
   if (raw.toLowerCase() === 'none') return new Set();
   if (raw.toLowerCase() === 'all') return available;
-  const requested = raw.split(',').map((id) => id.trim()).filter(Boolean);
-  const unknown = requested.filter((id) => !available.has(id));
-  if (unknown.length) throw new Error(`unknown web plugin: ${unknown.join(', ')}`);
-  return new Set(requested);
+  return resolveEnabledPluginIds(catalog, raw.split(',').map(id => id.trim()).filter(Boolean));
 }

package/server.mjs

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { createChunkUploadHandler } from './chunk-uploads.mjs';
+import { createLocalResourceHeaders } from './local-resources.mjs';
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
@@ -7,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 const { containerMode, workspaceFs, deliverUpload, verifyExecutionBackend } = await import('./execution-backend.mjs');
 await verifyExecutionBackend();
 const { coreRuntimeInfo, createWebRuntime, loadNeoPlugins, runWebServer } = await import('./core-runtime.mjs');
-const { createWebPluginHost } = await import('./plugins.mjs');
+const { createPluginManager } = await import('./plugin-manager.mjs');
 const { createWebPluginSettings } = await import('./plugin-settings.mjs');
 const { createWebToolSettings } = await import('./tool-settings.mjs');
 const { createWorkspaceRuntimeManager } = await import('./runtime-workspaces.mjs');
@@ -23,6 +24,10 @@ process.env.NEO_CLIENT_REVISION ||= `${coreRuntimeInfo.version}-${Date.now().toS
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.resolve(process.env.DIST_DIR || path.join(__dirname, 'dist'));
 const host = process.env.APP_HOST || '0.0.0.0';
+const localResourceHeaders = createLocalResourceHeaders({
+  enabled: process.env.NEO_DESKTOP_LOCAL_RESOURCES === '1' && host === '127.0.0.1'
+    && process.env.NEO_EXECUTION_BACKEND !== 'docker',
+});
 const port = Number(process.env.APP_PORT || process.env.PORT || 5173);
 const runtimeTarget = new URL(process.env.NEO_RUNTIME_TARGET || 'http://127.0.0.1:3101');
 const storage = resolveWebStorage();
@@ -40,13 +45,11 @@ const chunkUploads = createChunkUploadHandler({ uploadsDir, baseDir: __dirname,
 const pluginSettings = await createWebPluginSettings(pluginSettingsFile);
 const toolSettings = await createWebToolSettings(toolSettingsFile);
 const pluginEnv = process.env.NEO_WEB_PLUGINS;
-const pluginResources = await loadNeoPlugins({ directories: pluginDir, appDataDir: pluginDataDir });
-const pluginHost = createWebPluginHost({
-  plugins: pluginResources,
+const pluginManager = await createPluginManager({ directory: path.join(dataRoot, 'installed-plugins'), builtInDirectory: pluginDir, loadPlugins: loadNeoPlugins });
+const pluginHost = await pluginManager.createHost({
   enabled: pluginEnv?.trim() ? pluginEnv : pluginSettings.globalEnabledIds(),
-  locked: Boolean(pluginEnv?.trim()),
-  settings: pluginSettings,
-});
+  locked: Boolean(pluginEnv?.trim()), settings: pluginSettings,
+}, { appDataDir: pluginDataDir });
 const embedRuntime = process.env.NEO_EMBED_RUNTIME !== 'false';
 const cpaQuotaMonitor = createCpaQuotaMonitor({ configFile: cpaConfigFile });
 const memoryMonitor = createMemoryMonitor({
@@ -74,7 +77,7 @@ const workspaceRuntime = createWorkspaceRuntimeManager({
 });
 
 const { createIsolationMode } = await import('./isolation.mjs');
-const isolation = await createIsolationMode({ dataRoot, workspaceRoot, pluginDir, pluginSettings, toolSettings, cpaQuotaMonitor, memoryState: () => memoryMonitor.getPublicState() });
+const isolation = await createIsolationMode({ dataRoot, workspaceRoot, pluginDir, pluginManager, pluginSettings, toolSettings, cpaQuotaMonitor, memoryState: () => memoryMonitor.getPublicState() });
 
 const DEFAULT_APP_PROMPT_LIBRARY = [];
 
@@ -128,7 +131,7 @@ async function routeRequest(req, res) {
   const url = new URL(req.url || '/', 'http://localhost');
   try {
     if (await isolation.route(req, res, url)) return;
-    if (await pluginHost.route(req, res, url, { readJsonBody, sendJson })) return;
+    if (await pluginHost.route(req, res, url, { readJsonBody, sendJson, localResourceHeaders })) return;
     if (req.method === 'GET' && url.pathname === '/api/prompt-library') {
       return sendJson(res, { items: await readPromptLibrary() });
     }