Bind CLI Proxy actions to exact request scopes

README.md

@@ -5,8 +5,8 @@ provider sessions plugin.
 
 ## Delivery status
 
-The standalone renderer and executable package-v9 `platform-provider` service
-are merged on `main`. The renderer uses only public Host React, UI, and
+This version contains the standalone renderer and executable package-v13
+`platform-provider` service. The renderer uses only public Host React, UI, and
 `ctx.platform` contracts. The Node service uses only the public Protocol broker
 and `ctx.platformProviders.register`; CLIProxy method declarations, response
 projection, lifecycle, and approval adaptation live here.
@@ -16,9 +16,8 @@ workspace handles, method/schema policy, configuration persistence, and the
 single Provider Fleet. The plugin receives no endpoint, credential, process,
 filesystem path, raw transport, or Fleet handle.
 
-The plugin pins Protocol `06277f9d117893a9215c991db8c0881df0f0b0f3` and
-the formal Host v2 and Codex app-server broker implementation
-`cb4d35d8e5a3632c18358ab9d9d04c4dec63e090`. The package remains `private`
+The plugin pins Protocol `c2f6f8e4bf4a638bf4627c9c567792f2fedbcfd6` and
+requires a Host with manifest/package v13 exact-request scope support. The package remains `private`
 to prevent npm publication; its manifest declares explicit local source
 distribution, and no packaged installer is available yet.
 

README.zh-Hans.md

@@ -4,7 +4,7 @@
 
 ## 交付状态
 
-独立 renderer 与可执行的 package-v9 `platform-provider` 服务已经合入 `main`。
+本版本包含独立 renderer 与可执行的 package-v13 `platform-provider` 服务。
 Renderer 只使用公开的 Host React、UI 和 `ctx.platform` 合同；Node 服务只使用
 公开 Protocol broker 与 `ctx.platformProviders.register`。CLIProxy 的方法声明、
 响应投影、生命周期和审批适配均由本仓库维护。
@@ -13,9 +13,8 @@ Host 负责 endpoint 与凭据解析、进程启动、不透明 workspace handle
 策略、配置持久化和唯一的 Provider Fleet。插件不会获得 endpoint、凭据、进程、
 文件系统路径、原始 transport 或 Fleet handle。
 
-插件精确固定 Protocol `06277f9d117893a9215c991db8c0881df0f0b0f3`，并依赖
-已正式合入的 Host v2 与 Codex app-server broker
-`cb4d35d8e5a3632c18358ab9d9d04c4dec63e090`。包继续保持 `private` 以阻止 npm
+插件精确固定 Protocol `c2f6f8e4bf4a638bf4627c9c567792f2fedbcfd6`，并要求 Host
+支持 manifest/package v13 的 exact-request scope。包继续保持 `private` 以阻止 npm
 发布；manifest 声明显式本地源码分发，目前仍未提供安装包。
 
 ## 开发

cordisx-package.json

@@ -1,6 +1,6 @@
 {
-  "$schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-package.v9.schema.json",
-  "schemaVersion": 9,
+  "$schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-package.v13.schema.json",
+  "schemaVersion": 13,
   "id": "cli-proxy-api",
   "version": "0.1.0",
   "entry": "./dist/runtime/module.js",
@@ -13,13 +13,13 @@
   "compatibility": {
     "runtimeAbi": 1,
     "protocolSchemas": [
-      "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v9.schema.json"
+      "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v13.schema.json"
     ]
   },
   "dependencies": [],
   "runtimeManifest": {
     "path": "./runtime-manifest.json",
-    "schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v9.schema.json",
-    "digest": "sha256:206164ae3566fe02a47f9aad6efac038d7531196860f03c6c156cacfd203bf0f"
+    "schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v13.schema.json",
+    "digest": "sha256:42c9c6dbcb5435b8f121d83aaf5f81252c0004587837b8d1d2bcceebdd8a69b0"
   }
 }

package.json

@@ -38,13 +38,13 @@
   },
   "devDependencies": {
     "@cordisx/eslint-config": "github:cordisx/cordisxmono#c63c2e8c2ba7e11502934a52ad2ce3734e804cdc",
-    "@cordisx/protocol": "github:cordisx/cordisx-protocol#06277f9d117893a9215c991db8c0881df0f0b0f3",
+    "@cordisx/protocol": "github:cordisx/cordisx-protocol#c2f6f8e4bf4a638bf4627c9c567792f2fedbcfd6",
     "@deepseek-ai/cordis": "4.0.1",
     "@deepseek-ai/schemastery": "3.18.1",
     "@projectwallace/stylelint-plugin": "0.7.0",
     "@typescript-eslint/parser": "8.69.0",
     "@vitejs/plugin-react": "6.1.0",
-    "cordisx": "github:cordisx/cordisx#cb4d35d8e5a3632c18358ab9d9d04c4dec63e090",
+    "cordisx": "github:cordisx/cordisx#152d55aa26527b23c5e70a752fb3f6562e944afc",
     "dprint": "0.57.1",
     "eslint": "9.39.4",
     "stylelint": "17.15.0",

runtime-manifest.json

@@ -1,6 +1,6 @@
 {
-  "$schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v9.schema.json",
-  "schemaVersion": 9,
+  "$schema": "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v13.schema.json",
+  "schemaVersion": 13,
   "id": "cli-proxy-api",
   "name": "CLIProxy Providers",
   "capabilities": [
@@ -17,27 +17,37 @@
     {
       "name": "tasks.content.read",
       "required": false,
-      "scope": {}
+      "scope": {
+        "runtime": "exact-request"
+      }
     },
     {
       "name": "tasks.create",
       "required": false,
-      "scope": {}
+      "scope": {
+        "runtime": "exact-request"
+      }
     },
     {
       "name": "tasks.control",
       "required": false,
-      "scope": {}
+      "scope": {
+        "runtime": "exact-request"
+      }
     },
     {
       "name": "turns.submit",
       "required": false,
-      "scope": {}
+      "scope": {
+        "runtime": "exact-request"
+      }
     },
     {
       "name": "turns.control",
       "required": false,
-      "scope": {}
+      "scope": {
+        "runtime": "exact-request"
+      }
     }
   ],
   "services": [

test/package-artifact.mjs

@@ -16,19 +16,29 @@ async function validator(name) {
   return ajv.getSchema(schema.$id)
 }
 
-test('publishes schema-valid v9 package and runtime manifests with an exact digest', async () => {
+test('publishes schema-valid v13 package and runtime manifests with exact request scopes', async () => {
   const [packageText, runtimeText] = await Promise.all([
     readFile(new URL('../cordisx-package.json', import.meta.url), 'utf8'),
     readFile(new URL('../runtime-manifest.json', import.meta.url), 'utf8'),
   ])
   const packageManifest = JSON.parse(packageText)
   const runtimeManifest = JSON.parse(runtimeText)
   const [validatePackage, validateRuntime] = await Promise.all([
-    validator('plugin-package.v9.schema.json'),
-    validator('plugin-manifest.v9.schema.json'),
+    validator('plugin-package.v13.schema.json'),
+    validator('plugin-manifest.v13.schema.json'),
   ])
   assert.equal(validatePackage(packageManifest), true, JSON.stringify(validatePackage.errors))
   assert.equal(validateRuntime(runtimeManifest), true, JSON.stringify(validateRuntime.errors))
+  const runtimeExact = new Set([
+    'tasks.content.read',
+    'tasks.create',
+    'tasks.control',
+    'turns.submit',
+    'turns.control',
+  ])
+  for (const capability of runtimeManifest.capabilities) {
+    assert.deepEqual(capability.scope, runtimeExact.has(capability.name) ? { runtime: 'exact-request' } : {})
+  }
   assert.equal(
     packageManifest.runtimeManifest.digest,
     `sha256:${createHash('sha256').update(runtimeText).digest('hex')}`,