browser/openspec/changes/implement-plugin-bridge-and-sdk/tasks.md

1. Plugin SDK and Manifest Contract

• 1.1 Extend plugin manifest schema, SDK types, and the development example with bridge action/page declarations.
• 1.2 Add SDK bridge action, request envelope, response, safe error, and permission helper types.
• 1.3 Add plugin SDK tests for request builders, local permission checks, and forbidden transport assumptions.

2. Platform Bridge Authorization

• 2.1 Add platform domain and DTO types for plugin bridge sessions, actions, requests, and authorization decisions.
• 2.2 Add platform validators that map bridge actions to required permissions and AI purposes.
• 2.3 Add platform service logic and API route for bridge action authorization.
• 2.4 Add Go tests for allowed actions, missing permissions, unsupported actions, and undeclared AI purposes.

3. Frontend Host Bridge Utilities

• 3.1 Add frontend bridge host contract/types for safe plugin page context.
• 3.2 Add frontend utilities that filter page permissions against manifest permissions and exclude secret-bearing fields.
• 3.3 Add frontend tests for safe context creation and page permission filtering.

4. Verification

• 4.1 Run plugin SDK/schema tests.
• 4.2 Run platform bridge authorization tests.
• 4.3 Run platform_web bridge utility tests.
• 4.4 Run scripts/check-structure.sh.
• 4.5 Run openspec validate implement-plugin-bridge-and-sdk --strict.
• 4.6 Record verification evidence in this task file and only then mark verification tasks complete.

Evidence

• cd platform && go test ./...: passed.
• cd plugins && npm test: passed, 1 file / 7 tests.
• cd plugins && npm run typecheck: passed.
• cd plugins && npm run validate:manifest: passed for examples/dev-game-plugin/manifest.json.
• cd platform_web && npm test: passed, 4 files / 7 tests.
• cd platform_web && npm run typecheck: passed.
• scripts/check-structure.sh: passed.
• openspec validate implement-plugin-bridge-and-sdk --strict: passed.