[ackness]

Summary / 摘要

This PR lets plugins own more of the session screen without reaching past the host. Session pages can request player actions through a consented bridge. Sandboxed pages can replace the main area or the composer, and recover on their own. DM Console, Relationship Graph and Codex move into declarative session views, and plugins can ship restricted theme packs that players opt into per session. Two kernel guards close older gaps: sub-agents read the caller's visible world, and read-derived replacements are rejected when same-key data changed since the read. Each topic arrived as its own merge commit, followed by merges of fixes from a review of the whole set. Review them one merge at a time.

Consented session bridge writes

• Problem: session pages could only read, so a plugin page that wanted the player to act had to ship its own controls outside the host's consent and validation.
• Fix:
  • Pages request individually consented player actions, interaction answers, their own manual runtimes, abort and own-panel navigation. Runtime writes still go through approval, proposal validation and commit.
  • Device-local consent binds every requested capability to the complete resolved content, including each published resource. Digest asset URLs verify the actual bytes before success.
  • Ports retire on navigation, content change and revocation. Mutations and approval grants recheck the lease after credential lookup, so a late approval cannot authorize a new visit.

Sandbox surface replacement

• Problem: a plugin could add panels but not replace the story area or the input area, and a broken page had no recovery short of reloading the app.
• Fix:
  • Plugins provide independently selected main and composer pages. Host return, Stop, permissions and interaction recovery stay outside the frames, including on narrow screens and in immersive stage.
  • Ready deadlines, fixed page-error signals (uncaught errors, unhandled rejections, failed application scripts) and visible-tab heartbeats retire only the affected region, with an explicit consent-checked Retry. Normal page unload is not an error.
  • Same-session plugin refreshes keep healthy regions, their drafts and the selected page. Disabling one provider retires only its region.

Bundled session views

• SessionMessages and SessionComposer let declarative views show the public story, pending interactions and the shared composer, with current-turn choice numbering and keyboard selection.
• DM Console (new, runtime-free), Relationship Graph and Codex get dedicated plugin views. DM Mode and Spectator include DM Console; Ensemble Dialogue recommends it.

Plugin theme packs

• contributes.ui.theme publishes localized palettes, shared layout presets and CSS compiled from a closed AST allowlist. Backgrounds use content-bound public bitmap resources only.
• Players choose one pack per session on this device. Themes style narrative text and decorative content only; host recovery and "Use default appearance" stay reachable everywhere. Pending saves survive plugin refreshes, and failures fall back safely. Scene Stage ships an optional reading pack.

Stage renderer follow-ups

• Departing actors fade out and keep their loaded image throughout. Story templates can show and enlarge the speaker's portrait through CharacterAvatar.

Kernel guards

• Sub-agent world views: sub-agents read the caller's visible world at admission, including pending writes. Only successful child reads join the caller's commit dependencies.
• Read baselines: explicit reads capture content baselines, including absence. A replacement derived from them is rejected with conflict if the same key changed before commit. Payload fields cannot redirect the guard, hooks cannot erase it, and vetoing a guarded prefix rolls back the batch. Auxiliary conflicts drop only their unit; story text survives.

Smaller fixes found on the way

• Session menus (view permissions, theme selection, toolbar) stay inside the viewport on narrow screens, so revoking a page's consent is reachable on phones.
• On phones, a sandboxed main view keeps a usable minimum height when host notices (interrupted turn, missing narrator, reconnecting) stack above it; the center column scrolls instead of collapsing the page.
• Approving a plugin after it reloads imports the reloaded module, not a cached earlier one.
• The public SDK accepts aliases and removeAliases on character upserts, matching the kernel.

Type of change / 变更类型

• New feature / 新功能 (feat)
• Bug fix / Bug 修复 (fix)
• Refactor / 重构 (refactor)
• Documentation / 文档 (docs)
• Tests / 测试 (test)
• Tooling, CI, release / 工具链、CI、发布 (chore / ci)
• Performance / 性能 (perf)
• Breaking change / 破坏性变更 (BREAKING CHANGE)

Breaking changes / 破坏性变更

• Session bridge projection v2. Session pages receive public interactions with per-frame answer handles instead of raw pending blocks. Panel KV, context, jobs and the action/command/event RPC handlers are no longer exposed to session pages. Recreate bridge drafts and update projection consumers. Existing reading grants do not grant the new capabilities.
• Read evidence for pending work. Cancel or recreate unresolved suspensions, pending or retryable runtime jobs, and checkpoints or snapshots that contain earlier pending proposals.
• Sub-agent attribution. Recreate unresolved development suspensions and checkpoints when testing the new sub-agent read attribution.

No database schema change or migration is needed. Committed values, characters, sessions and appearance settings stay as they are.

Verification / 验证方式

All on the final branch head, Linux x64, Node 26.12.1, pnpm 12.14.0.

• pnpm check
• Tests of the changed packages: every workspace package suite (shared 1129, store 1039, plugin-loader 667, runtime 3128, server 3361, web 2992, and the rest) plus every bundled plugin suite
• pnpm test:pg against a throwaway PostgreSQL container (96)
• pnpm e2e:smoke (8), pnpm e2e:extensions (11), pnpm e2e twice: 187/187 both runs
• pnpm lint, pnpm schemas:generate (no diff), pnpm test:docs, pnpm test:docs:packages, docs build
• pnpm validate:plugin for the changed bundled plugins and the third-party probes
• pnpm e2e:verify
• Packaged desktop runtime and lifecycle
• macOS ZIP
• Windows ZIP and self-extracting EXE
• Dagger endpoint changes: n/a

The theme and sandbox browser specs also passed three repeats in a row. After the phone layout fix, the sandbox 360px spec passed 8/8 and the extension suite twice (22/22) with the browser pinned to two CPUs, the setup that reproduced the CI failure.

Not verified / 未验证:

• The packaged Electron GUI and restart smoke. This host runs as root with no display. Electron itself built (electron-builder --dir) but refused to start without --no-sandbox.
• pnpm e2e:verify (real-model harness) was not run. Sub-agent world views and read baselines are covered by scripted-model runtime and server tests only.

Related issue / context / 关联

Follows #475.

Docs sync / 文档同步

• docs/reference/ updated (ui-panels, ui-components, protocol, api, plugins, plugin-extensions, extension-points, hooks, tools, settings-store, theme-packages, transactions, world-model, world-time, generated schemas)
• Guides, builtin pages and recipes updated; Chinese pages mirrored under docs/en/
• Changelog fragments: session-bridge-actions, sandbox-surfaces, bundled-session-views, plugin-theme-packs, stage-renderer-followups, subagent-world-view, proposal-read-baselines, session-menu-viewport, sandbox-main-viewport, plus an update to declarative-plugins
• AGENTS.md updated: shared owns the pure theme CSS policy and its parser dependency, the loader owns files, web owns rendering

🤖 Generated with Claude Code