browser/platform_web/contracts/plugin-page-bridge.md

Plugin Page Bridge Contract

Plugin page runs with safe platform context.

Host Context

• pluginId: installed plugin ID.
• routeKey: current plugin route.
• serverInstanceId: optional selected server instance.
• themeTokens: safe theme tokens.
• permissions: effective plugin permissions.

Host APIs

• api.request: platform-scoped request only.
• jobs.dispatch: authorized job dispatch.
• logs.query: historical log query and analysis windows.
• artifacts.open: artifact upload/download references.
• files.request: scoped file operation requests.
• ai.invoke: platform-mediated AI invocation.

Forbidden

The host must not expose raw auth storage, AI keys, run credentials, host paths, or storage backend credentials.