From 41acb6f24fda0dec3cee596faf7a86eb4745fb70 Mon Sep 17 00:00:00 2001 From: Xuepoo Date: Tue, 6 Oct 2026 03:04:43 +0800 Subject: [PATCH] [CTX-0079] docs(plugins): mark rename policy-only; label panel.* deferred --- docs/plugins/file-manager/README.md | 7 +++++-- docs/plugins/file-manager/schemas.md | 6 +++++- docs/plugins/git-panel/design.md | 5 +++-- docs/plugins/git-panel/schemas.md | 14 +++++++------- product/bundled-plugin-split-decision.md | 2 +- 5 files changed, 21 insertions(+), 13 deletions(-) diff --git a/docs/plugins/file-manager/README.md b/docs/plugins/file-manager/README.md index bf63ac5..b773401 100644 --- a/docs/plugins/file-manager/README.md +++ b/docs/plugins/file-manager/README.md @@ -32,8 +32,11 @@ first-party file-manager package. Pre-implementation ecosystem: the plugin package, manifest, and policy are implemented and tested headlessly, while the Bitty host is still landing the host-mediated filesystem bridge. Panel presentation stays deferred pending the -panel-provider contract. The package is not verified, compatible, or shipped -beyond its manifest `[compat]` ranges. +panel-provider contract (`bitty-docs` `CTX-0181`, OQ-058). `:rename` is +policy-only composition with no host filesystem mutation; host-side +rename/move/copy stays deferred pending the `fs.write:PATTERN` grant, +consistent with the file-manager candidate in the Plugin Matrix. The package +is not verified, compatible, or shipped beyond its manifest `[compat]` ranges. ## Pages diff --git a/docs/plugins/file-manager/schemas.md b/docs/plugins/file-manager/schemas.md index 2064727..8a974a1 100644 --- a/docs/plugins/file-manager/schemas.md +++ b/docs/plugins/file-manager/schemas.md @@ -35,7 +35,11 @@ process, network, clipboard, or terminal-input authority is requested. | Events | `terminal.cwd-changed`, `terminal.title-changed`, `focus.changed` | Static triggers let the host register the plugin without creating a VM; the -observation events refresh the cached snapshot-derived state. +observation events refresh the cached snapshot-derived state. `:rename` is +policy-only composition (rename preview and selection with no host filesystem +mutation); any host mutation stays deferred pending the `fs.write:PATTERN` +grant and the panel-provider contract (`bitty-docs` `CTX-0181`, OQ-058), +consistent with the file-manager candidate in the Plugin Matrix. ## Configuration keys diff --git a/docs/plugins/git-panel/design.md b/docs/plugins/git-panel/design.md index 8861463..66b5a0f 100644 --- a/docs/plugins/git-panel/design.md +++ b/docs/plugins/git-panel/design.md @@ -45,8 +45,9 @@ filtering, and declarative scene composition. ## Capability and trust boundaries -- Requests `panel.provider` and `panel.create` (back the tiled Panel Runtime - registration), `terminal.semantic-read` (gates `bitty.terminal.snapshot`, +- Requests `panel.provider` and `panel.create` (deferred candidates pending + the panel-provider contract, `bitty-docs` `CTX-0181`, OQ-058, backing the + tiled Panel Runtime registration), `terminal.semantic-read` (gates `bitty.terminal.snapshot`, the read-only cwd/title observation the panel refreshes from), `process.spawn:git` (the closed `process.spawn` family plus the `:git` parameter — only the `git` binary spawns), and `fs.read:~/projects/**` diff --git a/docs/plugins/git-panel/schemas.md b/docs/plugins/git-panel/schemas.md index 1b55d2a..c923b83 100644 --- a/docs/plugins/git-panel/schemas.md +++ b/docs/plugins/git-panel/schemas.md @@ -23,13 +23,13 @@ sidebar_order: 48 ## Capabilities -| Identifier | Scope | -| ------------------------ | ---------------------------------------------------------------------- | -| `panel.provider` | Tiled Panel Runtime registration | -| `panel.create` | Panel creation within the host-owned panel slot | -| `terminal.semantic-read` | Read-only cwd/title observation via `bitty.terminal.snapshot` | -| `process.spawn:git` | Only the `git` binary, only the seven allowlisted read-only verbs | -| `fs.read:~/projects/**` | Working-tree read scope; symlinks and devices rejected per host policy | +| Identifier | Scope | +| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | +| `panel.provider` | Tiled Panel Runtime registration — deferred candidate pending the panel-provider contract (`bitty-docs` `CTX-0181`, OQ-058) | +| `panel.create` | Panel creation within the host-owned panel slot — deferred candidate pending the panel-provider contract (`bitty-docs` `CTX-0181`, OQ-058) | +| `terminal.semantic-read` | Read-only cwd/title observation via `bitty.terminal.snapshot` | +| `process.spawn:git` | Only the `git` binary, only the seven allowlisted read-only verbs | +| `fs.read:~/projects/**` | Working-tree read scope; symlinks and devices rejected per host policy | Deny by default; unknown identifiers fail validation and there is no allow-all identifier. No ambient spawn, shell interpolation, network, diff --git a/product/bundled-plugin-split-decision.md b/product/bundled-plugin-split-decision.md index ae683a4..35c1e12 100644 --- a/product/bundled-plugin-split-decision.md +++ b/product/bundled-plugin-split-decision.md @@ -141,7 +141,7 @@ Manifest presence is not shipped behavior. | `palette` | `palette_manifest`, `bitty-runtime/src/palette.rs` (removed 2026-10-02) | `ui.overlay`, command registry | Overlay slot, declarative primitives | **Split** | Distribution + SDK | `bitty` `CTX-0397` | | `statusline` | `statusline_manifest`, `bitty-runtime/src/statusline.rs` (removed 2026-10-02) | `terminal.semantic-read`, `ui.rich` | Status-component composition | **Split** (statusline only) | Distribution + SDK | `bitty` `CTX-0398` | | `file-manager` | `file_manager_manifest` (removed 2026-09-15), `bitty-runtime/src/file_manager.rs` (removed 2026-09-15) | `terminal.semantic-read` only (observation-only); the former `panel.provider`, `panel.create`, and root-scoped `fs.read`/`fs.write` requests are removed as phantom authority and deferred | Panel Runtime, path-scoped grants | **Split** (catalog entry removed; panel presentation deferred) | Panel provider contract (presentation only) | `bitty` `CTX-0399` | -| `git-panel` | `git_panel_manifest` (removed 2026-09-15), `bitty-runtime/src/git_panel.rs` (removed 2026-09-15) | `panel.provider`, `panel.create`, `process.spawn:git`, `terminal.semantic-read`, `fs.read` | Panel Runtime, allowlisted CLI | **Split** (catalog entry removed; panel presentation deferred) | Panel provider contract (presentation only) + Layer 2 `[tools.*]` (accepted) | `bitty` `CTX-0400` | +| `git-panel` | `git_panel_manifest` (removed 2026-09-15), `bitty-runtime/src/git_panel.rs` (removed 2026-09-15) | `panel.provider`, `panel.create` (both deferred candidates pending the panel-provider contract, `bitty-docs` `CTX-0181`, OQ-058), `process.spawn:git`, `terminal.semantic-read`, `fs.read` | Panel Runtime, allowlisted CLI | **Split** (catalog entry removed; panel presentation deferred) | Panel provider contract (presentation only) + Layer 2 `[tools.*]` (accepted) | `bitty` `CTX-0400` | | `browser-panel` | `browser_panel_manifest`, `bitty-runtime/src/browser_panel.rs` | `panel.provider`, `panel.create`, `browser.embed/navigation/file-url/storage`, `terminal.semantic-read` | Native embedder, host-owned surface, untrusted web content | **Stay bundled (Core)** | Core browser mechanism + security review | `bitty` `CTX-0401` | | `ai-panel` | `ai_panel_manifest`, `bitty-runtime/src/ai_panel.rs` | `panel.provider`, `panel.create`, `agent.context.*`, `agent.memory:persist`, `mcp.invoke:*`, `ai.provider/stream/model` | Panel Runtime + `bitty-ai` mechanism | **Split later** (hybrid) | Panel provider contract + `bitty-ai` surfaces | `bitty` `CTX-0402` | | `mail-panel` | `mail_panel_manifest`, `bitty-runtime/src/mail_panel.rs` | `panel.provider`, `panel.create`, `mcp.invoke:mail.*`, `network.connect` (imap/smtp), `fs.read`/`fs.write:~/mail/**` | Panel Runtime, MCP, endpoint grants | **Split later** | Panel provider contract + credential contract | `bitty` `CTX-0403` |