paseo-plugin-zcode-provider 0.2.0 → 0.3.0

package/NOTICE.md

@@ -12,7 +12,7 @@
 
 # ZCode ランタイムの配布
 
-ZCode は統合 CLI を配布していないため、このリポジトリは `zcode-runtime-v<version>` タグの GitHub Release で、統合 CLI 配布物の非公式ビルドを配布します（ADR 15）。CI が公開タグの無改変ソースを公式 `scripts/build-zcode.mjs` でビルドし、上流の `LICENSE`（Apache-2.0）、`NOTICE.md`、`THIRD-PARTY-NOTICES.md` と、出典・ビルド記録の `BUILD-INFO.json` を配布物に加えます。ソースは改変しません。第三者コンポーネントはそれぞれのライセンスに従い、上流が `third-party/inventory.json` で確認中とする項目もそのまま引き継ぎます。このビルドは ZCode・Z.ai の承認や保守を受けたものではなく、ZCode・Z.ai の商標の使用許諾も含みません。
+ZCode は統合 CLI を配布していないため、このリポジトリは `zcode-runtime-v<version>-paseo.<n>` タグの GitHub Release で、統合 CLI 配布物の非公式ビルドを配布します（ADR 15）。CI が公開タグのソースに [`patches/zcode/`](patches/zcode) のパッチを当て（ADR 19）、公式 `scripts/build-zcode.mjs` でビルドします。配布物には上流の `LICENSE`（Apache-2.0）、`NOTICE.md`、`THIRD-PARTY-NOTICES.md` と、当てたパッチそのもの（`patches/`）、出典・パッチの SHA-256・ビルド記録を収めた `BUILD-INFO.json` を加えます。パッチは Apache-2.0 で提供し、各パッチの冒頭に変更の目的と対象を記します。これは Apache-2.0 第 4 条 (b) の変更の明示にあたります。それ以前の `zcode-runtime-v3.14.3` は無改変のソースからのビルドです。第三者コンポーネントはそれぞれのライセンスに従い、上流が `third-party/inventory.json` で確認中とする項目もそのまま引き継ぎます。このビルドは ZCode・Z.ai の承認や保守を受けたものではなく、ZCode・Z.ai の商標の使用許諾も含みません。
 
 Node.js は利用者のマシンが nodejs.org の公式成果物を直接取得します。このリポジトリは Node.js を再配布しません。
 

package/README.md

@@ -8,12 +8,12 @@ This is an unofficial plugin. It is not endorsed or maintained by ZCode or Z.ai.
 
 ## Requirements
 
-| Setting        | Requirement                                                                                                  |
-| -------------- | ------------------------------------------------------------------------------------------------------------ |
-| Paseo          | 0.8.0 or later; development SDK 0.11.0-beta.5                                                                |
-| Plugin Node.js | 22.12.0 or later (the Paseo daemon's runtime)                                                                |
-| Managed setup  | darwin-arm64, linux-x64, linux-arm64, win-x64, win-arm64                                                     |
-| ZCode          | Managed: 3.14.3 with Node.js 24.21.0. Overrides: stable Server 3.14.0+ / Agent 0.16.9+ with Node.js 24.14.0+ |
+| Setting        | Requirement                                                                                                                             |
+| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| Paseo          | 0.8.0 or later; development SDK 0.11.0-beta.5                                                                                           |
+| Plugin Node.js | 22.12.0 or later (the Paseo daemon's runtime)                                                                                           |
+| Managed setup  | darwin-arm64, linux-x64, linux-arm64, win-x64, win-arm64                                                                                |
+| ZCode          | Managed: 3.14.3 (release `3.14.3-paseo.1`) with Node.js 24.21.0. Overrides: stable Server 3.14.0+ / Agent 0.16.9+ with Node.js 24.14.0+ |
 
 ## Installation
 
@@ -35,7 +35,7 @@ Open **Settings → Plugins → zcode-provider → Settings**. The screen has tw
 On the **Runtime** tab, choose **Download and install**. The screen lists every download, its SHA-256, size and license before you start. Setup runs on the machine hosting the daemon:
 
 - Node.js 24.21.0 from nodejs.org.
-- The ZCode runtime 3.14.3 from this repository's [releases](https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/tag/zcode-runtime-v3.14.3). ZCode does not publish its integrated CLI, so this is an **unofficial build** of the unmodified public source, made and verified by CI. It is not endorsed or maintained by ZCode or Z.ai.
+- The ZCode runtime 3.14.3 from this repository's [releases](https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/tag/zcode-runtime-v3.14.3-paseo.1) (`3.14.3-paseo.1`). ZCode does not publish its integrated CLI, so this is an **unofficial build** of the public source with the patches in [patches/zcode](patches/zcode) applied (ADR 19), made and verified by CI. The patches hide Computer Use and Browser Use, which cannot run here. It is not endorsed or maintained by ZCode or Z.ai.
 
 Both archives are verified against SHA-256 values pinned in the plugin and extracted to the daemon user's data directory:
 
@@ -86,7 +86,7 @@ The source baseline is `29628c9acdb81b703bbd4080c207a0e7ce5e276e` (ZCode `v3.14.
 - Native permission IDs, option values, questions and Plan approval retain their meanings. Question auto-resolution is disabled for each owned Server. Workspace hook trust is reviewed through the official CLI; it is not represented as “allow once.”
 - Each session owns its Server process and environment. Metadata requests use temporary Servers. Closing stdin gives ZCode time to clean up before process termination.
 
-The plugin uses ZCode's own skills, MCP configuration and tools. Browser/Computer Use, generic rewind, independent Paseo child agents, hook-review UI and Goal/Workflow controls are outside this migration. `prompt.output_schema`, custom system prompts and `persist:false` are unsupported. MCP `alwaysLoad` is unsupported; stdio MCP commands must be absolute paths. Provider options are unsupported: in Paseo 0.11 and later, `agents.providers.zcode.options` in Paseo's `config.json` makes sessions fail with `INVALID_CONFIGURATION`, and the `command` and `env` overrides there are not applied. Paseo does not show context usage reported before the first turn, and the plugin adds no substitute display; Coding Plan quota appears in Paseo 0.11's Usage screen (see [Coding Plan usage](#coding-plan-usage)).
+The plugin uses ZCode's own skills, MCP configuration and tools. Browser Use and Computer Use cannot run in the plugin's ZCode, even when ZCode Desktop has them enabled: the Computer Use helper accepts only the signed Desktop app, and only Desktop provides browsers. The plugin therefore hides them from the model (ADR 19); Desktop is not affected. Generic rewind, independent Paseo child agents, hook-review UI and Goal/Workflow controls are outside this migration. `prompt.output_schema`, custom system prompts and `persist:false` are unsupported. MCP `alwaysLoad` is unsupported; stdio MCP commands must be absolute paths. Provider options are unsupported: in Paseo 0.11 and later, `agents.providers.zcode.options` in Paseo's `config.json` makes sessions fail with `INVALID_CONFIGURATION`, and the `command` and `env` overrides there are not applied. Paseo does not show context usage reported before the first turn, and the plugin adds no substitute display; Coding Plan quota appears in Paseo 0.11's Usage screen (see [Coding Plan usage](#coding-plan-usage)).
 
 ## Persistence
 
@@ -108,6 +108,6 @@ For failures, report the operation, error code, structured diagnostic and versio
 
 ## Development and license
 
-See [development](docs/development.md), [verification](docs/verification.md), [remaining work](docs/todo.md), [ADR 13](docs/adr/0013-公開ソースの公式stdio-serverとv4会話状態を採用する.md) and [ADR 15](docs/adr/0015-プラグイン管理のzcodeランタイムとnode-jsを設定画面から導入する.md).
+See [development](docs/development.md), [verification](docs/verification.md), [remaining work](docs/todo.md), [ADR 13](docs/adr/0013-公開ソースの公式stdio-serverとv4会話状態を採用する.md), [ADR 15](docs/adr/0015-プラグイン管理のzcodeランタイムとnode-jsを設定画面から導入する.md) and [ADR 19](docs/adr/0019-使えない公式プラグインを隠すビルド時パッチを管理下ランタイムに当てる.md).
 
-Original code is [MIT](LICENSE). Vendored ZCode RPC/contracts retain their upstream license and provenance. The ZCode runtime releases are Apache-2.0 builds of unmodified upstream source and include ZCode's LICENSE, NOTICE.md and THIRD-PARTY-NOTICES.md; third-party components keep their own terms. Node.js is downloaded from nodejs.org, not redistributed. The icon retains Apache-2.0 attribution; the historical screenshot includes third-party UI and branding. See [NOTICE](NOTICE.md).
+Original code is [MIT](LICENSE). Vendored ZCode RPC/contracts retain their upstream license and provenance. The ZCode runtime releases are Apache-2.0 builds of the upstream source and include ZCode's LICENSE, NOTICE.md and THIRD-PARTY-NOTICES.md. Releases named `<version>-paseo.<n>` modify that source with the patches in [patches/zcode](patches/zcode) (Apache-2.0), ship them in the archive and list them in `BUILD-INFO.json`; the earlier `3.14.3` release is unmodified; third-party components keep their own terms. Node.js is downloaded from nodejs.org, not redistributed. The icon retains Apache-2.0 attribution; the historical screenshot includes third-party UI and branding. See [NOTICE](NOTICE.md).

package/client/runtime.tsx

@@ -173,7 +173,7 @@ export function RuntimeTab({ theme, layout }: PluginSurfaceProps) {
           </SettingsRow>
           <SettingsRow
             label="ZCode build"
-            hint="ZCode does not publish its CLI; CI builds the unmodified source."
+            hint="ZCode does not publish its CLI; CI builds the public source with this plugin's published patches."
           >
             <Value color={theme.colors.foreground} compact={compact}>
               Unofficial, not endorsed by ZCode or Z.ai

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo-plugin-zcode-provider",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Unofficial Paseo provider plugin for ZCode, using the official stdio Services Server of the integrated ZCode CLI.",
   "keywords": [
     "paseo",
@@ -40,8 +40,8 @@
     "test:usage-runtime": "node scripts/check-usage-runtime.mjs",
     "test:steering-runtime": "node scripts/check-steering-runtime.mjs",
     "build": "node scripts/build.mjs",
-    "format": "prettier --write index.client.tsx index.server.ts client server shared scripts test docs README.md NOTICE.md package.json tsconfig.json tsconfig.client.json vitest.config.ts paseo-plugin.json .github/workflows",
-    "format:check": "prettier --check index.client.tsx index.server.ts client server shared scripts test docs README.md NOTICE.md package.json tsconfig.json tsconfig.client.json vitest.config.ts paseo-plugin.json .github/workflows",
+    "format": "prettier --write index.client.tsx index.server.ts client server shared scripts test docs README.md NOTICE.md package.json tsconfig.json tsconfig.client.json vitest.config.ts paseo-plugin.json .github/workflows .github/actions",
+    "format:check": "prettier --check index.client.tsx index.server.ts client server shared scripts test docs README.md NOTICE.md package.json tsconfig.json tsconfig.client.json vitest.config.ts paseo-plugin.json .github/workflows .github/actions",
     "check:zcode-releases": "node scripts/check-zcode-releases.mjs",
     "check:paseo-releases": "node scripts/check-paseo-releases.mjs",
     "prepare": "node scripts/generate-build-info.mjs",
@@ -49,6 +49,7 @@
     "test:model-plan-runtime": "node scripts/check-model-plan-runtime.mjs",
     "test:e2e": "node scripts/check-e2e.mjs",
     "check:zcode-source": "node scripts/sync-zcode-source.mjs",
+    "check:zcode-patches": "node scripts/apply-zcode-patches.mjs check --source",
     "test:stdio-runtime": "node scripts/check-stdio-runtime.mjs",
     "test:native-restore": "node scripts/check-stdio-runtime.mjs --check-native-restore",
     "setup:managed-runtime": "node scripts/install-managed-runtime.mjs",

package/server/build-info.ts

@@ -1,2 +1,2 @@
 // Generated from package.json by npm prepare / prebuild.
-export const PROVIDER_VERSION = "0.2.0";
+export const PROVIDER_VERSION = "0.3.0";

package/server/host/bridge.ts

@@ -27,6 +27,7 @@ import {
 } from "../diagnostics.js";
 import type { Logger } from "../logger.js";
 import { PROVIDER_VERSION } from "../build-info.js";
+import { UNSUPPORTED_CAPABILITY_ENVIRONMENT } from "../unsupported-capabilities.js";
 
 export type SettingsChannel =
   | "oauth"
@@ -142,6 +143,7 @@ export class ZCodeHostBridge implements HostBridge {
       cwd: workspace,
       env: {
         ...runtimeEnvironment(environment),
+        ...UNSUPPORTED_CAPABILITY_ENVIRONMENT,
         ZCODE_SERVICE_AUTHORITY_MODE: "standalone-server",
         ZCODE_AGENT_SERVER_COMMAND: runtime.paths.executable,
         ZCODE_AGENT_SERVER_ARGS_JSON: JSON.stringify([

package/server/runtime/pins.ts

@@ -53,12 +53,14 @@ export const MANAGED_NODE_ARCHIVES: Readonly<
 };
 
 // Published by .github/workflows/zcode-runtime-release.yml from the pinned
-// unmodified source. The same archive serves every managed platform.
+// source with patches/zcode applied (ADR 19). The same archive serves every
+// managed platform.
 export const MANAGED_ZCODE_VERSION = "3.14.3";
+const MANAGED_ZCODE_RELEASE = `${MANAGED_ZCODE_VERSION}-paseo.1`;
 export const MANAGED_ZCODE_ARCHIVE: PinnedArchive = {
-  url: `https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/download/zcode-runtime-v${MANAGED_ZCODE_VERSION}/zcode-runtime-${MANAGED_ZCODE_VERSION}.tar.gz`,
-  sha256: "a2af414592362d226f92c105d91211e5c4f138cf985b0c86da0eb9163cb9aee7",
-  size: 79_887_659,
+  url: `https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/download/zcode-runtime-v${MANAGED_ZCODE_RELEASE}/zcode-runtime-${MANAGED_ZCODE_RELEASE}.tar.gz`,
+  sha256: "c51e4547dc804894fd7d62766ab0ce3d759948b8b56cb515528691d75a8e09f9",
+  size: 79_883_611,
 };
 
 export function managedPlatform(

package/server/session.ts

@@ -41,6 +41,7 @@ import {
 } from "./host/schemas.js";
 import type { HostBridge } from "./host/bridge.js";
 import type { Logger } from "./logger.js";
+import { UNSUPPORTED_TOOLS } from "./unsupported-capabilities.js";
 import type {
   NativePromptInput,
   NativeSessionEvent,
@@ -611,6 +612,7 @@ export class ZCodeSession {
           modelSelection: config.modelSelection,
           mode: config.mode,
           planEnabled: config.planEnabled === true,
+          toolDisallowlist: [...UNSUPPORTED_TOOLS],
           requestedDelivery: previous
             ? attachments.length
               ? "queue"

package/server/unsupported-capabilities.ts

@@ -0,0 +1,18 @@
+// Official ZCode capabilities that cannot run in the provider's standalone Server
+// (ADR 19). Computer Use needs the code-signed Desktop to start its Helper, and
+// only the Desktop host supplies browsers to Browser Use.
+export const SUPPRESSED_OFFICIAL_PLUGINS = [
+  "computer-use@zcode-plugins-official",
+  "browser-use@zcode-plugins-official",
+] as const;
+
+// Both capabilities run through this shared tool. Hiding it per turn covers
+// runtimes without the ZCode patch, such as the PASEO_ZCODE_RUNTIME override.
+export const UNSUPPORTED_TOOLS = ["mcp__node_repl__js"] as const;
+
+export const UNSUPPORTED_CAPABILITY_ENVIRONMENT = {
+  // Official switch: the Server no longer hands node_repl a Computer Use broker.
+  ZCODE_CUA_PRODUCT_HELPER: "0",
+  // Read by patches/zcode/0001-hide-suppressed-official-plugins.patch.
+  PASEO_ZCODE_SUPPRESSED_PLUGINS: SUPPRESSED_OFFICIAL_PLUGINS.join(","),
+} as const;