fix(coding): remediate ML-07 plugin authority

electron/api/coding-composition.ts

@@ -42,6 +42,10 @@ import {
 } from '../coding-plugins/registry';
 import { createDataServicePluginAdapter } from '../coding-plugins/adapters/data-service';
 import { PluginPolicyClient } from '../services/plugin-policy-client';
+import {
+  loadBundledCodingPluginDefinitionsSync,
+  resolveBundledCodingPluginRootPaths,
+} from '../coding-plugins/manifest';
 import {
   createCodingProjectPluginService,
   type CodingProjectPluginService,
@@ -88,6 +92,20 @@ export function createCodingComposition(
   options: CreateCodingCompositionOptions,
 ): CodingProductComposition {
   const getLocalProxyCredential = options.getLocalProxyCredential;
+  const bundledPluginsDir = path.join(
+    path.dirname(path.resolve(options.paths.bundledSkillsDir)),
+    'coding-plugins',
+  );
+  const pluginDefinitions = loadBundledCodingPluginDefinitionsSync(bundledPluginsDir);
+  const pluginRoots = resolveBundledCodingPluginRootPaths(bundledPluginsDir);
+  const pluginSkillSources = pluginDefinitions.flatMap((definition, index) => (
+    definition.skills.map((skill) => ({
+      id: skill.id,
+      pluginId: definition.id,
+      directory: path.join(pluginRoots[index] as string, path.dirname(skill.entryPath)),
+      entryPath: path.basename(skill.entryPath),
+    }))
+  ));
   const projectStore = options.projectStore ?? createCodingProjectStore(options.storage);
   const attachments = new CodingAttachmentStore(
     path.join(options.paths.userDataDir, 'coding-runtime', 'attachments'),
@@ -96,6 +114,7 @@ export function createCodingComposition(
     browser: options.browser,
     attachments,
     bundledSkillsDir: options.paths.bundledSkillsDir,
+    pluginSkillSources,
   });
   const extensionHost = new PiManagedExtensionHost();
   extensionHost.configureProductTools(productTools);
@@ -156,6 +175,7 @@ export function createCodingComposition(
   const dataServiceAdapter = createDataServicePluginAdapter(dataService);
   const policyClient = new PluginPolicyClient();
   const projectPlugins = createProjectPluginService({
+    knownPluginIds: pluginDefinitions.map(({ id }) => id),
     onManagedInputsChanged: async ({ projectPath }) => {
       runtime?.markResourcesStale();
       const conversations = await conversationStoreForProject(projectPath).read()
@@ -172,6 +192,7 @@ export function createCodingComposition(
     policyClient,
     projectPlugins,
     adapters: [dataServiceAdapter],
+    definitions: pluginDefinitions,
     getDurableProjectId: async (projectPath, localProjectId) => {
       const active = await projects.requireActiveRealProjectWithIdentity(projectPath);
       if (active.project.id !== localProjectId) {
@@ -195,6 +216,7 @@ export function createCodingComposition(
     projectPlugins,
     policyClient,
     adapters: [dataServiceAdapter],
+    definitions: pluginDefinitions,
   });
   const workerPool = new PiWorkerPool({
     processBudget,
@@ -269,6 +291,7 @@ export function createCodingComposition(
   const host = createCodingProductHost({
     projects,
     productTools,
+    getEnabledPluginIds: (projectPath) => projectPlugins.getEnabledPluginIds(projectPath),
     listPiCommands: (conversationId) => conversations.listLiveCommands(conversationId),
   });
   previewDataSession = createPreviewDataSessionManager({ projects });