browser/openspec/changes/implement-plugin-page-bridge-execution/tasks.md

1. Platform Bridge Execution Contracts

• 1.1 Add platform domain and DTO contracts for bridge execution requests, responses, result refs, and safe errors.
• 1.2 Add validators for action support, required permissions, page route scope, server scope, payload bounds, AI purposes, and unsafe path/secret/socket content.
• 1.3 Add service methods that authorize and execute supported bridge actions through existing platform services.

2. Platform Bridge Execution API

• 2.1 Implement bridge execution route using named DTOs and service methods.
• 2.2 Map supported actions to safe service calls for server context, job dispatch, logs, artifacts, scoped files, and platform-mediated AI where available.
• 2.3 Update platform route/protocol documentation for plugin bridge execution and deferred unsupported actions.
• 2.4 Add platform tests for allowed execution, denied permissions, unsupported actions, unsafe payloads, safe errors, and no-secret responses.

3. Frontend Host Execution

• 3.1 Add centralized frontend API types/client methods for bridge execution.
• 3.2 Add plugin page host session and request dispatcher utilities that construct safe context and return typed envelopes.
• 3.3 Update plugin page host UI flow to use bridge execution utilities for embedded plugin actions.
• 3.4 Add frontend tests for session safety, permission filtering, allowed dispatch, denied dispatch, cancellation/error states, and no raw secret rendering.

4. Plugin SDK And Example

• 4.1 Extend plugin SDK helpers and example plugin page code to exercise bridge execution envelopes.
• 4.2 Add plugin tests for execution request builders, safe error parsing, and forbidden direct transport assumptions.

5. Verification

• 5.1 Run cd platform && go test ./... and record evidence.
• 5.2 Run cd platform_web && npm run typecheck && npm test && npm run build and record evidence.
• 5.3 Run cd plugins && npm run typecheck && npm test and record evidence.
• 5.4 Run browser walkthrough for plugin page bridge execution and record evidence.
• 5.5 Run scripts/check-structure.sh and record evidence.
• 5.6 Run openspec validate implement-plugin-page-bridge-execution --strict and record evidence.

Evidence

• 2026-07-06: cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./... -run TestPluginBridgeExecuteAPI -count=1 passed for bridge execution route, service mappings, safe errors, unsafe payload rejection, and no-secret response checks.
• 2026-07-06: cd platform_web && npm run typecheck passed after adding bridge execution API types/client, host dispatcher, and server detail execution panel.
• 2026-07-06: cd platform_web && npm test -- --run utils/pluginBridgeHost.test.ts api/client.test.ts passed, covering safe host context, permission filtering, allowed dispatch, unsafe/denied/cancelled states, and API client routing.
• 2026-07-06: cd plugins && npm run typecheck and cd plugins && npm test -- --run tests/manifest-validation.test.ts passed for SDK execution envelope helpers and no direct transport assumptions.
• 2026-07-06: cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./... passed.
• 2026-07-06: cd platform_web && npm run typecheck, cd platform_web && npm test, and cd platform_web && npm run build passed.
• 2026-07-06: cd plugins && npm run typecheck and cd plugins && npm test passed.
• 2026-07-06: Browser walkthrough passed using a local mock platform API plus headless Chrome: logged in, opened #/servers/server-bridge-walkthrough, switched to 插件控制, clicked 读取上下文, and verified 服务器上下文 server-bridge-walkthrough 已返回 with no forbidden fragments rendered.
• 2026-07-06: scripts/check-structure.sh passed.
• 2026-07-06: openspec validate implement-plugin-page-bridge-execution --strict passed (Change 'implement-plugin-page-bridge-execution' is valid; PostHog DNS flush warnings were non-fatal telemetry failures).