wizards 0.1.11 → 0.2.0

package/apps/runtime/dist/plugins/loader.js

@@ -0,0 +1,277 @@
+import { existsSync, mkdirSync, watch } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { PLUGIN_TOOL_NAME } from "@engenty-wizards/shared/definition";
+import { createJiti } from "jiti";
+import { packageRoot } from "../cli/home.js";
+import { db, onTenantOpen } from "../db/client.js";
+import { env } from "../env.js";
+import { discoverPlugins } from "./discovery.js";
+import { migrateOpenTenants, migratePlugins } from "./migrations.js";
+import { announceChange, compileRoute, dropPlugin, emptyRecord, loadedPlugin, loadedPlugins, setPlugin, } from "./registry.js";
+/**
+ * Loading plugins (docs/plugins.md). A plugin's server half is TypeScript or JavaScript read
+ * from its file as it is: no build step, and a reload reads the files again. What a plugin
+ * imports of the runtime's own packages comes from the runtime's copies, wherever the plugin's
+ * file lies.
+ */
+/** What ships with this runtime, then the folders of `PLUGINS_DIR`. */
+export function pluginDirs() {
+    return [join(packageRoot, "modules"), ...env.plugins.dirs];
+}
+const own = (specifier) => fileURLToPath(import.meta.resolve(specifier));
+/** The longer name first: an alias also matches what begins with it. */
+function aliases() {
+    return {
+        "@engenty-wizards/plugin-sdk": own("@engenty-wizards/plugin-sdk"),
+        "drizzle-orm/sqlite-core": own("drizzle-orm/sqlite-core"),
+        "drizzle-orm": own("drizzle-orm"),
+        zod: own("zod"),
+    };
+}
+async function importFactory(entry) {
+    // No module cache: every load evaluates the plugin's files anew.
+    const jiti = createJiti(import.meta.url, { moduleCache: false, alias: aliases() });
+    const factory = await jiti.import(entry, { default: true });
+    if (typeof factory !== "function") {
+        throw new Error("The default export is not a function.");
+    }
+    return factory;
+}
+function apiFor(record) {
+    const { source } = record;
+    const tag = `[plugin ${source.id}]`;
+    return {
+        plugin: source.manifest,
+        resolvePath: (relative) => resolve(source.root, relative),
+        config: { get: (key) => process.env[key]?.trim() || undefined },
+        log: {
+            info: (...args) => console.log(tag, ...args),
+            warn: (...args) => console.warn(tag, ...args),
+            error: (...args) => console.error(tag, ...args),
+        },
+        server: {
+            registerHttpRoute(route) {
+                record.routes.push(compileRoute(route));
+            },
+            registerTool(tool) {
+                if (!PLUGIN_TOOL_NAME.test(tool.name)) {
+                    throw new Error(`Tool "${tool.name}": a name is lower case, digits and "_".`);
+                }
+                if (record.tools.has(tool.name)) {
+                    throw new Error(`Tool "${tool.name}" is registered twice.`);
+                }
+                record.tools.set(tool.name, tool);
+            },
+            registerMigrations(folder) {
+                record.migrations.push(resolve(source.root, folder));
+            },
+            on(event, listener) {
+                const listeners = (record.listeners[event] ?? []);
+                listeners.push(listener);
+                record.listeners[event] = listeners;
+            },
+            getTenantDb: () => db,
+            onUnload(dispose) {
+                record.disposers.push(dispose);
+            },
+        },
+    };
+}
+/** Runs what the plugin asked to have undone, the last first. */
+async function dispose(record) {
+    for (const undo of record.disposers.splice(0).reverse()) {
+        try {
+            await undo();
+        }
+        catch (err) {
+            console.error(`[plugins] ${record.source.id}: undoing failed:`, err);
+        }
+    }
+}
+async function load(source) {
+    const record = emptyRecord(source);
+    if (source.entry) {
+        try {
+            const factory = await importFactory(source.entry);
+            await factory(apiFor(record));
+        }
+        catch (err) {
+            // Half a plugin is worse than none: what it registered before it failed goes as well.
+            await dispose(record);
+            record.routes = [];
+            record.tools.clear();
+            record.listeners = {};
+            record.migrations = [];
+            record.error = err?.message || String(err);
+            console.error(`[plugins] ${source.id} did not load:`, err);
+        }
+    }
+    setPlugin(record);
+    return record;
+}
+async function unload(id) {
+    const record = dropPlugin(id);
+    if (record) {
+        await dispose(record);
+    }
+}
+let problems = [];
+/** Files and folders that look like a plugin and are none, as of the last look. */
+export function pluginProblems() {
+    return problems;
+}
+function discover() {
+    const result = discoverPlugins(pluginDirs());
+    problems = result.problems;
+    for (const problem of problems) {
+        console.error(`[plugins] ${problem.path}: ${problem.message}`);
+    }
+    return result.found;
+}
+/** One load at a time: the watcher and a person may ask for a reload at the same moment. */
+let queue = Promise.resolve();
+function inTurn(work) {
+    const next = queue.catch(() => undefined).then(work);
+    queue = next;
+    return next;
+}
+let hooked = false;
+/** At start: finds the plugins and loads each. Must run before a tenant database opens. */
+export function loadPlugins() {
+    return inTurn(async () => {
+        if (!hooked) {
+            hooked = true;
+            // A plugin whose tables cannot be made must not keep the tenant's database from opening.
+            onTenantOpen((tenantId, client) => migratePlugins(tenantId, client).catch((err) => console.error(`[plugins] tables for tenant ${tenantId}:`, err.message)));
+        }
+        const found = discover();
+        for (const source of found) {
+            await load(source);
+        }
+        if (found.length) {
+            console.log(`plugins: ${found.map((s) => s.id).join(", ")}`);
+        }
+        await migrateOpenTenants();
+        if (env.plugins.watch) {
+            watchPlugins();
+        }
+    });
+}
+/** Loads one plugin again from its files; a plugin whose files are gone unloads. */
+export function reloadPlugin(id) {
+    return inTurn(async () => {
+        const found = discover();
+        const source = found.find((s) => s.id === id);
+        await unload(id);
+        const record = source ? await load(source) : null;
+        // Its manifest may name another id now: under the old one it is gone, under the new one new.
+        await loadMissing(found);
+        await migrateOpenTenants();
+        announceChange({ id });
+        return record;
+    });
+}
+/** Loads what was found and is not loaded yet. */
+async function loadMissing(found) {
+    const missing = found.filter((source) => !loadedPlugin(source.id));
+    for (const source of missing) {
+        await load(source);
+    }
+    return missing.length > 0;
+}
+/**
+ * Looks again and leaves what is loaded alone: plugins that are new load, plugins whose files
+ * went unload.
+ */
+export function findNewPlugins() {
+    return inTurn(async () => {
+        const found = discover();
+        const gone = loadedPlugins().filter((p) => !found.some((s) => s.id === p.source.id));
+        for (const plugin of gone) {
+            await unload(plugin.source.id);
+        }
+        if ((await loadMissing(found)) || gone.length) {
+            await migrateOpenTenants();
+            announceChange({ id: null });
+        }
+    });
+}
+/** Loads every plugin anew, new ones included, and unloads what is gone. */
+export function rescanPlugins() {
+    return inTurn(async () => {
+        const found = discover();
+        for (const loaded of loadedPlugins()) {
+            await unload(loaded.source.id);
+        }
+        for (const source of found) {
+            await load(source);
+        }
+        await migrateOpenTenants();
+        announceChange({ id: null });
+    });
+}
+/** The studio half was built again: the server half stays as it is, the studio fetches the files. */
+function refreshStudioHalf(id) {
+    return inTurn(async () => {
+        const record = loadedPlugin(id);
+        const source = discover().find((s) => s.id === id);
+        if (record && source) {
+            record.source = { ...record.source, studio: source.studio, styles: source.styles };
+            announceChange({ id });
+        }
+    });
+}
+const watchers = [];
+/**
+ * Reloads a plugin when one of its files changes. `ui/` is left alone: it only counts once it
+ * is built, and a change below `dist/` is that build.
+ */
+function watchPlugins() {
+    for (const watcher of watchers.splice(0)) {
+        watcher.close();
+    }
+    const timers = new Map();
+    const soon = (key, run) => {
+        clearTimeout(timers.get(key));
+        timers.set(key, setTimeout(() => {
+            timers.delete(key);
+            run().catch((err) => console.error("[plugins]", err));
+        }, 150));
+    };
+    for (const dir of pluginDirs()) {
+        // A folder of this install's own plugins is made, so the first plugin put there is seen.
+        if (env.plugins.dirs.includes(dir)) {
+            try {
+                mkdirSync(dir, { recursive: true });
+            }
+            catch {
+                // a place that cannot be written to
+            }
+        }
+        if (!existsSync(dir)) {
+            continue;
+        }
+        const watcher = watch(dir, { recursive: true }, (_event, file) => {
+            const parts = file?.toString().split(sep) ?? [];
+            if (!parts.length || parts.includes("node_modules") || parts.some((p) => p.startsWith("."))) {
+                return;
+            }
+            const top = join(dir, parts[0]);
+            const plugin = loadedPlugins().find((p) => p.source.single ? p.source.entry === top : p.source.root === top);
+            const { id, entry } = plugin?.source ?? {};
+            if (!id) {
+                // A plugin that is new here, or what is left of one that went. The others stay loaded.
+                soon("*", findNewPlugins);
+            }
+            else if (parts[1] === "dist" && !entry?.startsWith(join(top, "dist") + sep)) {
+                soon(`${id}/studio`, () => refreshStudioHalf(id));
+            }
+            else if (parts[1] !== "ui") {
+                soon(id, () => reloadPlugin(id));
+            }
+        });
+        watcher.unref();
+        watchers.push(watcher);
+    }
+}

package/apps/runtime/dist/plugins/migrations.js

@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { openTenantClients } from "../db/client.js";
+import { loadedPlugins } from "./registry.js";
+/**
+ * A plugin's own tables. Each `.sql` file of the folders a plugin registered runs once per
+ * tenant database, in the order of the file names; `plugin_migration` records which ran. A
+ * database gets them when it opens, and the open ones get them when a plugin loads. Unloading a
+ * plugin leaves its tables and their rows where they are.
+ */
+const RECORD = `CREATE TABLE IF NOT EXISTS plugin_migration (
+  plugin TEXT NOT NULL,
+  name TEXT NOT NULL,
+  applied_at INTEGER NOT NULL,
+  PRIMARY KEY (plugin, name)
+)`;
+/** One at a time per database: a plugin that loads while a database opens must not run a file twice. */
+const queues = new Map();
+async function apply(client) {
+    const pending = loadedPlugins().filter((p) => p.migrations.length);
+    if (!pending.length) {
+        return;
+    }
+    await client.execute(RECORD);
+    const done = await client.execute("SELECT plugin, name FROM plugin_migration");
+    const ran = new Set(done.rows.map((row) => `${row.plugin}/${row.name}`));
+    for (const plugin of pending) {
+        for (const folder of plugin.migrations) {
+            const files = readdirSync(folder)
+                .filter((name) => name.endsWith(".sql"))
+                .sort();
+            for (const name of files) {
+                if (ran.has(`${plugin.source.id}/${name}`)) {
+                    continue;
+                }
+                // The file and its record go in together or not at all.
+                const tx = await client.transaction("write");
+                try {
+                    await tx.executeMultiple(readFileSync(join(folder, name), "utf8"));
+                    await tx.execute({
+                        sql: "INSERT INTO plugin_migration (plugin, name, applied_at) VALUES (?, ?, ?)",
+                        args: [plugin.source.id, name, Date.now()],
+                    });
+                    await tx.commit();
+                }
+                catch (err) {
+                    await tx.rollback().catch(() => undefined);
+                    throw new Error(`Plugin "${plugin.source.id}", ${name}: ${err.message}`);
+                }
+                finally {
+                    tx.close();
+                }
+            }
+        }
+    }
+}
+export function migratePlugins(tenantId, client) {
+    const next = (queues.get(tenantId) ?? Promise.resolve())
+        .catch(() => undefined)
+        .then(() => apply(client));
+    queues.set(tenantId, next);
+    return next;
+}
+/** After a plugin loaded: its tables for every database that is open already. */
+export async function migrateOpenTenants() {
+    for (const [tenantId, client] of await openTenantClients()) {
+        await migratePlugins(tenantId, client).catch((err) => console.error(`[plugins] tables for tenant ${tenantId}:`, err.message));
+    }
+}

package/apps/runtime/dist/plugins/registry.js

@@ -0,0 +1,105 @@
+import { createHash } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { readFileSync } from "node:fs";
+import { env } from "../env.js";
+import { managed, tenantInfo } from "../manage.js";
+const plugins = new Map();
+let generations = 0;
+export function nextGeneration() {
+    return ++generations;
+}
+export function emptyRecord(source) {
+    return {
+        source,
+        generation: nextGeneration(),
+        error: null,
+        routes: [],
+        tools: new Map(),
+        listeners: {},
+        migrations: [],
+        disposers: [],
+    };
+}
+export function setPlugin(record) {
+    plugins.set(record.source.id, record);
+}
+export function dropPlugin(id) {
+    const record = plugins.get(id);
+    plugins.delete(id);
+    return record;
+}
+export function loadedPlugin(id) {
+    return plugins.get(id);
+}
+export function loadedPlugins() {
+    return [...plugins.values()];
+}
+/** `/items/:id` as a pattern for the address below the plugin's own. */
+export function compileRoute(route) {
+    const params = [];
+    const path = route.path.startsWith("/") ? route.path : `/${route.path}`;
+    const source = path
+        .replace(/\/+$/, "")
+        .split("/")
+        .map((part) => {
+        if (part.startsWith(":")) {
+            params.push(part.slice(1));
+            return "([^/]+)";
+        }
+        return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    })
+        .join("/");
+    return { route, pattern: new RegExp(`^${source}/?$`), params };
+}
+// --- which tenant has which plugin -----------------------------------------------------
+/**
+ * The ids of the plugins a tenant has. A runtime that runs alone has every plugin it loaded.
+ * Managed, a tenant has the ones in `PLUGINS_DEFAULT` and the ones the Manage-App lists for it
+ * (`modules` of `GET /v1/tenants/:id`).
+ */
+export async function pluginIdsOf(tenantId) {
+    if (!managed) {
+        return new Set(plugins.keys());
+    }
+    const listed = await tenantInfo(tenantId)
+        .then((info) => info.modules ?? [])
+        .catch(() => []);
+    return new Set([...env.plugins.defaults, ...listed].filter((id) => plugins.has(id)));
+}
+export async function pluginsOf(tenantId) {
+    const ids = await pluginIdsOf(tenantId);
+    return loadedPlugins().filter((p) => ids.has(p.source.id));
+}
+/** The tools the tenant's plugins add, by the id a step lists them under. */
+export async function pluginToolsOf(tenantId) {
+    return (await pluginsOf(tenantId)).flatMap((plugin) => [...plugin.tools.values()].map((tool) => ({
+        id: `${plugin.source.id}.${tool.name}`,
+        title: tool.title ?? tool.name,
+        description: tool.description,
+    })));
+}
+/** The built studio half as it is on disk now; null when the plugin has none. */
+export function pluginAsset(record, kind) {
+    const file = record.source[kind];
+    if (!file) {
+        return null;
+    }
+    try {
+        return {
+            file,
+            rev: createHash("sha256").update(readFileSync(file)).digest("hex").slice(0, 12),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+const changes = new EventEmitter();
+changes.setMaxListeners(0);
+export function announceChange(change) {
+    changes.emit("change", change);
+}
+export function onPluginChange(listener) {
+    changes.on("change", listener);
+    return () => changes.off("change", listener);
+}

package/apps/runtime/dist/routes/plugins.js

@@ -0,0 +1,160 @@
+import { readFile } from "node:fs/promises";
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { managed } from "../manage.js";
+import { pluginProblems, reloadPlugin, rescanPlugins } from "../plugins/loader.js";
+import { loadedPlugin, onPluginChange, pluginAsset, pluginIdsOf, pluginsOf, } from "../plugins/registry.js";
+const admin = (user) => user.role === "owner" || user.role === "admin";
+/** Plugins change while the app runs only where it runs alone: a reload would hit every tenant. */
+const canReload = (user) => !managed && admin(user);
+function view(plugin) {
+    const script = pluginAsset(plugin, "studio");
+    const styles = pluginAsset(plugin, "styles");
+    const { id, name, version, description } = plugin.source.manifest;
+    const address = (file, rev) => `/api/studio/plugins/-/assets/${id}/${file}?rev=${rev}`;
+    return {
+        id,
+        name,
+        version,
+        description: description ?? "",
+        generation: plugin.generation,
+        /** Why the server half did not load; the plugin then adds nothing on the server. */
+        error: plugin.error,
+        script: script ? address("client.js", script.rev) : null,
+        styles: styles ? address("client.css", styles.rev) : null,
+        tools: [...plugin.tools.values()].map((tool) => ({
+            id: `${id}.${tool.name}`,
+            title: tool.title ?? tool.name,
+        })),
+    };
+}
+/** A thrown error that says how to answer: `{ status, code }`, as the runtime's own errors do. */
+function answerOf(err) {
+    const e = err;
+    return typeof e?.status === "number" &&
+        e.status >= 400 &&
+        e.status < 600 &&
+        typeof e.code === "string"
+        ? { status: e.status, body: { error: String(e.message ?? e.code), code: e.code } }
+        : null;
+}
+async function dispatch(c) {
+    const user = c.get("user");
+    const id = c.req.param("id") ?? "";
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    if (!plugin) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    const url = new URL(c.req.url);
+    const path = url.pathname.slice(url.pathname.indexOf(`/plugins/${id}`) + `/plugins/${id}`.length);
+    for (const { route, pattern, params } of plugin.routes) {
+        const match = route.method === c.req.method ? pattern.exec(path) : null;
+        if (!match) {
+            continue;
+        }
+        if (route.role === "admin" && !admin(user)) {
+            return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        }
+        const request = {
+            request: c.req.raw,
+            path: path || "/",
+            params: Object.fromEntries(params.map((name, i) => [name, decodeURIComponent(match[i + 1])])),
+            query: url.searchParams,
+            user: {
+                id: user.id,
+                tenantId: user.tenantId,
+                role: user.role,
+                name: user.name,
+                email: user.email,
+            },
+            json: async () => {
+                const text = await c.req.text();
+                return (text ? JSON.parse(text) : {});
+            },
+        };
+        try {
+            const result = await route.handler(request);
+            return result instanceof Response ? result : c.json(result ?? null);
+        }
+        catch (err) {
+            const answer = answerOf(err);
+            if (answer) {
+                return c.json(answer.body, answer.status);
+            }
+            console.error(`[plugin ${id}] ${route.method} ${path}:`, err);
+            return c.json({ error: "The plugin failed.", code: "plugin_failed" }, 500);
+        }
+    }
+    return c.json({ error: "not found", code: "not_found" }, 404);
+}
+const TYPES = {
+    "client.js": { kind: "studio", type: "text/javascript; charset=utf-8" },
+    "client.css": { kind: "styles", type: "text/css; charset=utf-8" },
+};
+export const pluginRoutes = new Hono()
+    .get("/", async (c) => {
+    const user = c.get("user");
+    return c.json({
+        plugins: (await pluginsOf(user.tenantId)).map(view),
+        canReload: canReload(user),
+        /** What looked like a plugin and is none; for the person who installs them. */
+        problems: canReload(user) ? pluginProblems() : [],
+    });
+})
+    // The built studio half. The address carries the file's revision, so it may be kept for good.
+    .get("/-/assets/:id/:file", async (c) => {
+    const user = c.get("user");
+    const file = c.req.param("file");
+    const kind = Object.hasOwn(TYPES, file) ? TYPES[file] : undefined;
+    const id = c.req.param("id");
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    const asset = plugin && kind ? pluginAsset(plugin, kind.kind) : null;
+    if (!asset || !kind) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    return c.body(new Uint8Array(await readFile(asset.file)), 200, {
+        "content-type": kind.type,
+        "cache-control": c.req.query("rev") === asset.rev ? "private, max-age=31536000, immutable" : "no-cache",
+    });
+})
+    // Says when a plugin loaded again, so an open studio takes the new one without a page load.
+    .get("/-/events", (c) => {
+    if (managed) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    return streamSSE(c, async (stream) => {
+        let closed = false;
+        const stop = onPluginChange((change) => {
+            void stream.writeSSE({ event: "change", data: JSON.stringify(change) });
+        });
+        stream.onAbort(() => {
+            closed = true;
+            stop();
+        });
+        await stream.writeSSE({ event: "ready", data: "{}" });
+        while (!closed) {
+            await stream.sleep(20_000);
+            if (!closed) {
+                await stream.writeSSE({ event: "ping", data: "{}" });
+            }
+        }
+    });
+})
+    .post("/-/reload", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    await rescanPlugins();
+    return c.json({ plugins: (await pluginsOf(c.get("user").tenantId)).map(view) });
+})
+    .post("/-/reload/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    const plugin = await reloadPlugin(c.req.param("id"));
+    return plugin
+        ? c.json({ plugin: view(plugin) })
+        : c.json({ error: "not found", code: "not_found" }, 404);
+})
+    .all("/:id", dispatch)
+    .all("/:id/*", dispatch);

package/apps/runtime/dist/services/wizards.js

@@ -1,10 +1,11 @@
-import { validateWizard, wizardSchema, } from "@engenty-wizards/shared/definition";
+import { pluginToolOf, validateWizard, wizardSchema, } from "@engenty-wizards/shared/definition";
 import { and, desc, eq, sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { applyOps, OpError } from "../authoring/ops.js";
 import { listConnectors } from "../connectors/external.js";
 import { db, schema } from "../db/client.js";
 import { env } from "../env.js";
+import { pluginToolsOf } from "../plugins/registry.js";
 import { dropLinks, putLink } from "../tenants/control.js";
 import { currentTenant } from "../tenants/tenant.js";
 import { changedSteps, emitDraftChanged } from "./draft-events.js";
@@ -98,9 +99,34 @@ async function connectorIssues(projectId, draft) {
     }
     return issues;
 }
-/** Everything wrong with a draft: its structure, its workspace files, its project's connectors. */
+/** Tools of plugins the draft's steps list that this tenant does not have. */
+async function pluginIssues(draft) {
+    const issues = [];
+    let known = null;
+    for (const step of draft.steps) {
+        for (const id of step.type === "agent" ? step.tools : []) {
+            const named = pluginToolOf(id);
+            if (!named) {
+                continue;
+            }
+            known ??= new Set((await pluginToolsOf(currentTenant())).map((tool) => tool.id));
+            if (!known.has(id)) {
+                issues.push({
+                    stepId: step.id,
+                    message: `Step "${step.id}": tool "${id}" is not available here — the plugin "${named.plugin}" is not installed or has no such tool.`,
+                });
+            }
+        }
+    }
+    return issues;
+}
+/** Everything wrong with a draft: its structure, its workspace files, its project's connectors and plugins. */
 async function checkDraft(projectId, draft, files) {
-    return [...validateWizard(draft, files), ...(await connectorIssues(projectId, draft))];
+    return [
+        ...validateWizard(draft, files),
+        ...(await connectorIssues(projectId, draft)),
+        ...(await pluginIssues(draft)),
+    ];
 }
 /** Validator issues of the draft, checked against its workspace and the project's connectors. */
 export async function draftIssues(w) {

package/apps/runtime/dist/tools/index.js

@@ -13,6 +13,7 @@ import { browserTools } from "./browser.js";
 import { connectorTools } from "./connector.js";
 import { mailTools } from "./mail.js";
 import { assertPublicUrl, safeFetch } from "./net-guard.js";
+import { pluginTools } from "./plugin.js";
 import { projectTools } from "./project.js";
 import { clip, FileKeeper } from "./shared.js";
 import { storeTools } from "./store.js";
@@ -95,6 +96,7 @@ export async function buildStepTools(step, ctx, resolved, uploads) {
     Object.assign(tools, projectTools(ctx));
     Object.assign(tools, mailTools(step, ctx, files));
     Object.assign(tools, await connectorTools(step, ctx, files));
+    Object.assign(tools, await pluginTools(step, ctx));
     const sandbox = sandboxCapabilities();
     if (allowed.has("sandbox") && sandbox) {
         const timeoutMs = (seconds) => Math.min((seconds ?? 120) * 1000, 600_000);