browser/openspec/changes/implement-plugin-page-bridge-execution/proposal.md

Why

The plugin SDK and authorization contract exist, but plugin pages still cannot execute real platform-mediated bridge actions from the management console. Operators need plugin UI pages to request allowed server, job, log, artifact, file, and AI capabilities through a host bridge that keeps platform auth, run sockets, host paths, and provider credentials hidden.

What Changes

• Add frontend plugin page host execution utilities for creating safe bridge sessions and dispatching bridge action requests through platform APIs.
• Add platform bridge execution routes/services that authorize each request and fan out only to existing safe platform capabilities.
• Add plugin SDK/example coverage for request envelopes and host-mediated response/error handling.
• Update plugin page documentation and tests to prove unsupported actions, missing permissions, raw paths, sockets, credentials, and raw AI keys are rejected.
• Add browser walkthrough for an embedded plugin page workflow.

Capabilities

New Capabilities

• plugin-page-bridge-execution: Executes plugin page bridge requests through the platform host and backend authorization layer without exposing unsafe internals.

Modified Capabilities

• Builds on plugin-bridge-and-sdk, config-write-and-file-dispatch, platform-mediated-ai-invocation, and artifact/log/job capabilities as they become available.

Impact

• Affects platform/, platform_web/, and plugins/.
• Adds backend DTO/service/API behavior for bridge execution, frontend bridge host transport, SDK/example tests, and documentation.
• Does not add direct plugin-to-run access, direct platform auth sharing, raw credentials, host path exposure, billing, cloud host sales, or unrelated marketplace features.