refactor(desktop): one Plugins page — Capabilities → Plugins owns agent + desktop plugins, install, and the catalog

[teknium1]

Summary

Capabilities → Plugins is now the one place that shows everything extending Hermes — agent plugins for the selected profile AND desktop plugins for this app — with Install from Git and the catalog picker on the same page; Settings → Plugins is gone (old links redirect).

What was wrong

After #69446 the desktop had two plugin pages that each showed half the picture:

Page	Showed	Missing
Settings → Plugins	desktop plugins, Install from Git, a note saying "agent plugins moved to Capabilities"	agent plugins, the catalog
Capabilities → Plugins	agent plugins (profile-scoped), the catalog picker	desktop plugins, Install from Git

"What plugins do I have and where do I add more?" needed both pages and still never showed the full set at once.

Changes

• skills/plugins-tab.tsx — THE plugins surface: Agent plugins section (header carries Install from Git; installs target the scoped profile, not the active one), Desktop plugins section beneath (folder / rescan controls, agent half missing here drift chip whose repair also lands in the scoped profile), catalog picker underneath. Three sections share one label style; rows share one PluginListRow.
• skills/desktop-plugins-section.tsx — settings/plugins-settings.tsx moved and slimmed to a section (git rename, history preserved). The "agent plugins moved" pointer block is deleted, not relocated.
• Settings — plugins view removed from the nav/enum. settings/moved-tabs.ts is one table for retired tabs (mcp → server=, plugins → plugin=); /settings?tab=plugins&plugin=kanban → /skills?tab=plugins&plugin=kanban, replacing the ad-hoc MCP-only redirect.
• Command palette / settings search — plugins move from the Settings group to the Capabilities group; installed-plugin rows deep-link to /skills?tab=plugins&plugin=… (useDeepLinkHighlight now mounted on the tab).
• i18n — new skills.plugins.agentTitle/agentBlurb; dead settings.plugins.agent.* and settings.nav.plugins removed across all locales; blurbs rewritten to say what each half is ("Extend the agent for the selected profile…" / "Extend this app… same for every profile"). Capabilities nav detail now lists plugins.
• Docs — desktop.md gets a single "Capabilities → Plugins" section describing both halves + discovery; plugins.md, bot-mode.md, desktop-plugin-sdk.md, plugin READMEs and in-code pointers updated.

Validation

Check	Result
npm run check:lint (tsc ×3 + eslint whole tree)	0 errors
vitest src/app/settings src/app/skills src/app/command-palette src/i18n src/contrib	48 files, 415 passed
New invariants	moved-tabs.test.ts (retired tabs redirect with row selector; live tabs untouched) · desktop-plugins-section.test.tsx (drift chip repair targets the SCOPED profile)
Live repro (isolated native Electron + this worktree's Vite + real hermes serve, CDP-driven)	before: Settings → Plugins listed 4 desktop plugins + Install from Git and no agent list/catalog; Capabilities → Plugins listed agent plugins only. After: /skills?tab=plugins renders Agent plugins (empty state + Install from Git) → Desktop plugins (Accent Picker, Bots, Kanban, Radio with live toggles) → Plugin catalog; #/settings?tab=plugins&plugin=kanban lands on #/skills?tab=plugins with the Kanban row present; Settings nav has no Plugins entry

The catalog frame is blank in the screenshot for two unrelated reasons: the probe runs with network blackholed, and separately the live /docs/plugins?embed=picker URL is currently a poisoned 24 h Vercel edge-cache 404 (only that exact query-string key; /docs/plugins/ is 200) — purge/redeploy on the nousnet-web project fixes it, nothing in this repo.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 6a0e4b8 — refactor(desktop): one Plugins surface — Capabilities → Plug}

⚠️ Warnings

OSV vulnerability scan · View job

71 known vulnerabilities found in pinned dependencies.

• CVE-2026-83608 in package-lock.json
• CVE-2026-83608 in package-lock.json
• CVE-2026-84375 in package-lock.json
• CVE-2026-84375 in website/package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-85062 in package-lock.json
• CVE-2026-85062 in website/package-lock.json
• CVE-2026-83609 in package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-84369 in website/package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 5m13s vs 5m13s (+0.0%). 7 job(s) slower, 7 faster, 2 unchanged.

• Python tests / Run tests: +52.0s
• Python tests / e2e: -41.0s
• Docs Site / docs-site-checks: +38.0s
• Python lints / Windows footguns (blocking): +17.0s
• JS & TS checks / JS & TS checks: +13.0s