feat: add trusted local plugin system

apps/mobile/src/Stack.tsx

@@ -34,6 +34,7 @@ import { ThreadRouteScreen } from "./features/threads/ThreadRouteScreen";
 import { ConnectionsRouteScreen } from "./features/connection/ConnectionsRouteScreen";
 import { ConnectionsNewRouteScreen } from "./features/connection/ConnectionsNewRouteScreen";
 import { HomeRouteScreen } from "./features/home/HomeRouteScreen";
+import { PluginUiMobileNotificationHost } from "./features/plugins/PluginUiMobileCards";
 import { AddProjectDestinationRoute } from "./features/projects/AddProjectDestinationRoute";
 import { AddProjectLocalRoute } from "./features/projects/AddProjectLocalRoute";
 import { AddProjectRepositoryRoute } from "./features/projects/AddProjectRepositoryRoute";
@@ -394,6 +395,7 @@ function RootStackLayout(props: {
   return (
     <HardwareKeyboardCommandProvider pathname={pathname}>
       <ThreadOutboxDrainWorker />
+      <PluginUiMobileNotificationHost />
       <ShowcaseCaptureCoordinator pathname={pathname} />
       <ExistingThreadSettingsRouteProvider>
         <AdaptiveWorkspaceLayout pathname={workspacePathname}>

apps/mobile/src/features/home/HomeRouteScreen.tsx

@@ -20,6 +20,7 @@ import { buildHomeProjectScopes } from "./homeThreadList";
 import { usePendingTaskListActions } from "./usePendingTaskListActions";
 import { useThreadListActions } from "./useThreadListActions";
 import { getConnectionAwareBrandHeaderOptions } from "./WorkspaceConnectionTitle";
+import { PluginUiMobileCards } from "../plugins/PluginUiMobileCards";
 
 /* ─── Route screen ───────────────────────────────────────────────────── */
 
@@ -170,6 +171,8 @@ export function HomeRouteScreen() {
           onThreadSortOrderChange={setThreadSortOrder}
         />
 
+        <PluginUiMobileCards environmentId={selectedEnvironmentId} />
+
         <HomeScreen
           catalogState={catalogState}
           environments={environments}

apps/mobile/src/features/plugins/PluginUiMobileCards.tsx

@@ -0,0 +1,137 @@
+import { useAtomValue } from "@effect/atom-react";
+import type { EnvironmentId, PluginUiCatalog, PluginUiNotification } from "@t3tools/contracts";
+import { AsyncResult } from "effect/unstable/reactivity";
+import * as Option from "effect/Option";
+import { useEffect, useRef } from "react";
+import { Alert, Pressable, ScrollView, View } from "react-native";
+
+import { AppText as Text } from "../../components/AppText";
+import { serverEnvironment } from "../../state/server";
+import { useAtomCommand } from "../../state/use-atom-command";
+import { useWorkspaceState } from "../../state/workspace";
+
+export function PluginUiMobileNotificationHost() {
+  const { environments } = useWorkspaceState();
+  return environments.map((environment) => (
+    <EnvironmentPluginUiMobileNotificationHost
+      key={environment.environmentId}
+      environmentId={environment.environmentId}
+    />
+  ));
+}
+
+function EnvironmentPluginUiMobileNotificationHost({
+  environmentId,
+}: {
+  readonly environmentId: EnvironmentId;
+}) {
+  const result = useAtomValue(
+    serverEnvironment.pluginUiNotifications({ environmentId, input: {} }),
+  );
+  const notification = Option.getOrNull(AsyncResult.value(result));
+  const shown = useRef<PluginUiNotification | null>(null);
+
+  useEffect(() => {
+    if (notification === null) return;
+    if (shown.current === notification) return;
+    shown.current = notification;
+    Alert.alert(notification.title, notification.message);
+  }, [notification]);
+
+  return null;
+}
+
+export function PluginUiMobileCards({
+  environmentId,
+}: {
+  readonly environmentId: EnvironmentId | null;
+}) {
+  if (environmentId === null) return null;
+  return <EnvironmentPluginUiMobileCards environmentId={environmentId} />;
+}
+
+function EnvironmentPluginUiMobileCards({
+  environmentId,
+}: {
+  readonly environmentId: EnvironmentId;
+}) {
+  const result = useAtomValue(serverEnvironment.pluginUi({ environmentId, input: {} }));
+  const catalog = Option.getOrNull(AsyncResult.value(result)) as PluginUiCatalog | null;
+  const invoke = useAtomCommand(serverEnvironment.invokePluginCommand, { reportFailure: false });
+  if (catalog === null) return null;
+
+  const packages = catalog.packages
+    .map((pluginPackage) => ({
+      pluginPackage,
+      cards: pluginPackage.cards.filter((card) => card.surfaces.includes("mobile")),
+      statuses: pluginPackage.statusItems.filter((item) => item.surfaces.includes("mobile")),
+    }))
+    .filter(({ cards, statuses }) => cards.length > 0 || statuses.length > 0);
+  if (packages.length === 0) return null;
+
+  return (
+    <ScrollView
+      horizontal
+      showsHorizontalScrollIndicator={false}
+      contentContainerClassName="gap-3 px-4 py-2"
+      accessibilityLabel="Plugin cards"
+    >
+      {packages.flatMap(({ pluginPackage, cards, statuses }) => [
+        ...cards.map((card) => {
+          const action = card.actionId
+            ? [...pluginPackage.composerActions, ...pluginPackage.contextualActions].find(
+                (candidate) => candidate.id === card.actionId,
+              )
+            : undefined;
+          return (
+            <Pressable
+              key={`${pluginPackage.pluginId}:${card.id}`}
+              disabled={action === undefined}
+              className="min-w-44 rounded-2xl border border-border bg-card p-4 active:opacity-70"
+              accessibilityRole={action === undefined ? "summary" : "button"}
+              accessibilityLabel={card.title}
+              onPress={
+                action === undefined
+                  ? undefined
+                  : () => {
+                      void invoke({
+                        environmentId,
+                        input: {
+                          generation: catalog.generation,
+                          id: action.commandId,
+                          context: { cardId: card.id },
+                        },
+                      }).then((outcome) => {
+                        if (outcome._tag === "Success") {
+                          Alert.alert(card.title, outcome.value.message);
+                        } else {
+                          Alert.alert("Plugin action failed");
+                        }
+                      });
+                    }
+              }
+            >
+              <Text className="text-sm font-t3-semibold text-foreground">{card.title}</Text>
+              {card.value ? (
+                <Text className="mt-1 text-2xl font-t3-bold text-foreground">{card.value}</Text>
+              ) : null}
+              {card.description ? (
+                <Text className="mt-1 text-sm text-muted-foreground">{card.description}</Text>
+              ) : null}
+            </Pressable>
+          );
+        }),
+        ...statuses.map((status) => (
+          <View
+            key={`${pluginPackage.pluginId}:${status.id}`}
+            className="min-w-36 rounded-2xl border border-border bg-card p-4"
+            accessibilityLabel={`${status.label}: ${status.value}`}
+          >
+            <Text className="text-xs text-muted-foreground">{status.label}</Text>
+            <Text className="mt-1 text-base font-t3-semibold text-foreground">{status.value}</Text>
+          </View>
+        )),
+      ])}
+    </ScrollView>
+  );
+}

apps/server/package.json

@@ -16,7 +16,7 @@
   "type": "module",
   "scripts": {
     "dev": "node --watch src/bin.ts",
-    "build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean",
+    "build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean && vp pack src/plugins/PluginWorkerRuntime.mjs --out-dir dist --no-clean",
     "start": "node dist/bin.mjs",
     "typecheck": "tsgo --noEmit",
     "test": "vp test run"
@@ -38,6 +38,7 @@
   "devDependencies": {
     "@effect/vitest": "catalog:",
     "@t3tools/contracts": "workspace:*",
+    "@t3tools/plugin-runtime": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@t3tools/tailscale": "workspace:*",
     "@t3tools/web": "workspace:*",

apps/server/src/auth/RpcAuthorization.test.ts

@@ -37,6 +37,31 @@ describe("RPC authorization scopes", () => {
     expect(requiredScopeForRpcMethod(WS_METHODS.cloudInstallRelayClient)).toBe(AuthRelayWriteScope);
   });
 
+  it("allows command discovery with read scope and invocation with operate scope", () => {
+    expect(requiredScopeForRpcMethod(WS_METHODS.pluginCommandsList)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.subscribePluginCommands)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.pluginCommandsInvoke)).toBe(
+      AuthOrchestrationOperateScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.pluginUiList)).toBe(AuthOrchestrationReadScope);
+    expect(requiredScopeForRpcMethod(WS_METHODS.subscribePluginUi)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.subscribePluginUiNotifications)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.pluginUiSettingGet)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.pluginUiSettingSet)).toBe(
+      AuthOrchestrationOperateScope,
+    );
+  });
+
   it("requires permission to operate on a thread before uploading feedback", () => {
     expect(requiredScopeForRpcMethod(WS_METHODS.providerUploadFeedback)).toBe(
       AuthOrchestrationOperateScope,

apps/server/src/auth/RpcAuthorization.ts

@@ -50,6 +50,18 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.serverReportClientActivity]: AuthOrchestrationReadScope,
   [WS_METHODS.serverReportHostPowerState]: AuthOrchestrationOperateScope,
   [WS_METHODS.serverGetBackgroundPolicy]: AuthOrchestrationReadScope,
+  [WS_METHODS.pluginCommandsList]: AuthOrchestrationReadScope,
+  [WS_METHODS.pluginCommandsInvoke]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pluginUiList]: AuthOrchestrationReadScope,
+  [WS_METHODS.pluginUiSettingGet]: AuthOrchestrationReadScope,
+  [WS_METHODS.pluginUiSettingSet]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pluginPackagesStatus]: AuthOrchestrationReadScope,
+  [WS_METHODS.pluginPackagesEnable]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pluginPackagesDisable]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pluginPackagesReload]: AuthOrchestrationOperateScope,
+  [WS_METHODS.subscribePluginCommands]: AuthOrchestrationReadScope,
+  [WS_METHODS.subscribePluginUi]: AuthOrchestrationReadScope,
+  [WS_METHODS.subscribePluginUiNotifications]: AuthOrchestrationReadScope,
   [WS_METHODS.cloudGetRelayClientStatus]: AuthRelayReadScope,
   [WS_METHODS.cloudInstallRelayClient]: AuthRelayWriteScope,
   [WS_METHODS.pullRequestsList]: AuthOrchestrationReadScope,