feat(plugins): plugin code on the labs runtime ladder + API backfill (0194 Phase 1) - #162
Merged
Merged
Conversation
…cosystem API (0194 Phase 1)
- ecosystem/runtime.ts: runPluginCode(ladder, {code, trustTier, …}) +
ladderTierForTrust route user→sandbox (SES/QuickJS) and marketplace→app
(iframe), and reject first-party (host realm only). The ladder is a structural
port (PluginRuntimeLadder), not an @xnetjs/labs import — no plugins→labs cycle.
runPluginCode is async so a first-party rejection surfaces as a rejected
promise.
- index: backfill the public API — surface runAiPluginPipeline (Phase 2),
recommendExtensions (Phase 4), and the new runtime exports from the main
package entry (they were added to the ecosystem barrel in #149 but never
re-exported from @xnetjs/plugins).
6 new tests; plugins suite 482 green; typecheck/eslint/prettier/fallow clean.
The registry switch to this runtime + the perf benchmark remain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
Preview removed for PR #162. |
crs48
added a commit
that referenced
this pull request
Jun 18, 2026
…193/0194) (#201) The `changelog-section` required check was only added in #164, so the 0192/0193/0194 feature batch merged before it never got changelog entries. This backfills the 12 user-facing features that were missing, each dated to its merge day with its PR number and contributors: | PR | Entry | |----|-------| | #138 | A safer foundation for plugins | | #145 | One trust model across plugins and Labs | | #146 | Reliability you can see for managed hubs | | #148 | Drive your own coding agent from xNet | | #149 | AI that can act on your workspace | | #150 | Your Labs become AI tools | | #152 | Your agent can use your workspace | | #154 | AI edits, right inside the editor | | #155 | An agentic dev loop in your terminal | | #158 | Review AI edits before they apply | | #159 | Kick off agentic code tasks from xNet | | #162 | Plugins run on the Labs runtime | Skipped: PRs already covered by umbrella entries (#142 plugin ecosystem, #144 extensibility fabric, #147 automated changelog, #163 agent panel, #180 changelog gallery), internal-only changes (#139 schema authz — zero user-facing effect), and meta/test/docs PRs. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lands the runtime adapter — the last architectural Phase 1 item of exploration 0194: run user/marketplace-tier plugin code on the same labs runtime ladder, instead of a separate plugin sandbox.
runPluginCode(ladder, { code, trustTier, … })+ladderTierForTrustrouteuser→sandbox(SES/QuickJS) andmarketplace→app(iframe), and rejectfirst-party(it runs in the host realm, not the ladder).PluginRuntimeLadder), not an@xnetjs/labsimport — so there's noplugins→labscycle (labs already depends on plugins); the host passes its concrete ladder.Also backfills the public API:
runAiPluginPipeline(Phase 2) andrecommendExtensions(Phase 4) were added to the ecosystem barrel in #149 but never re-exported from@xnetjs/plugins— now surfaced, along with the new runtime exports.Gates
@xnetjs/pluginssuite 482 green;tscclean; eslint + prettier clean (prettier re-checked after eslint-fix);fallowreports no issues in 4 changed files.Remaining
The registry switch to this runtime (replacing the current sandbox path) + the perf benchmark vs the 0184 budgets — the exploration gates that on no regression, so it's its own focused change.
🤖 Generated with Claude Code