Plugin processes: long-lived host.spawn for plugins - #731

Lets a plugin start a long-lived process it declares in its manifest, talk to it over stdin/stdout, and optionally run it as one of its own Agents2 agents. This is the plugin-layer half of running Claude Code agents on Agents2. The Claude Code plugin that uses it is the stacked PR on top.

Stacked on #693 (murderbot/agents2).

How it works

• Declared up front. A manifest lists processes under host.processes: { id, program, args? }. The plugin import preview shows them as "full user access", like host commands. At most 16 per manifest.
• ctx.host.spawn(id, options) starts one. Options are extra args, cwd (~/ expands, created if missing), env (a null value removes a variable), agent, and onStdout / onStderr callbacks. It returns { write, end, kill, exited }. Output streams over a Tauri Channel as UTF-8 text, and a character split across reads is kept whole.
• Running as an agent. With agent: <pubkey>, native checks that the agent's type belongs to the calling plugin. It then puts the agent's key, relay URL and auth tag in the environment (BUZZ_PRIVATE_KEY, NOSTR_PRIVATE_KEY, BUZZ_RELAY_URL, BUZZ_AUTH_TAG) and the bundled buzz CLI first on PATH. So the process can use buzz exactly as a harness agent does, and the key never passes through the webview. Every process starts with inherited BUZZ_* / NOSTR_* variables removed, so it never gets the app's own identity.
• Lifecycle.
  • Each process runs in its own process group. Kill sends SIGTERM to the group, then SIGKILL after 3 s. Descendants are always reaped after exit.
  • A process stops when the plugin that started it unloads, when the main webview reloads, and when its output channel is gone.
  • On app exit every group is SIGKILLed synchronously, because the async tasks never run again after RunEvent::Exit.
  • A spawn that was still in flight when the page reloaded or the plugin unloaded is refused or killed, never left orphaned.
  • A process that closes stdout and stderr but keeps running is not killed for it.
  • Only the plugin that started a process can write to it or kill it. There are at most 64 at once.
• macOS PATH. ~/.local/bin is now on the effective path, which is where the official Claude Code installer puts claude. This also applies to host commands.

FOUNDATION files (edited per baxen's direction; please review closely)

• src/plugins/api.ts: PluginManifest.host.processes.

Checks (at 825103f9)

• cargo test -p buzz-foundation passes (338). A few host_command timing tests flake when the machine is busy and pass on rerun; this PR doesn't touch them. cargo test -p buzzodz-plugins passes. Clippy is clean.
• New native tests in src-tauri/src/host_process/tests.rs:
  • stdin to stdout until close;
  • stderr and exit code;
  • only the owner can write or kill;
  • kill reaches a child that traps TERM;
  • stop_all;
  • a dropped channel stops the process;
  • split UTF-8;
  • ~ expansion;
  • a spawn from before a reload is refused;
  • a process may close its output and keep running;
  • shutdown kills a TERM-ignoring group at once.
• src/features/host/service.test.ts: spawn streams output, a plugin unload kills its processes, a process that finishes starting after its plugin unloaded is killed, and the browser refuses.
• pnpm check: typecheck and design checks pass. Biome fails only on three pre-existing noNonNullAssertion warnings in src/features/agents2/service.test.ts from feat(agents2): plugin agent types on a new Agents2 page #693.

Not done

• No sandbox: a declared process has full user access, and an agent process holds a key that can sign any kind. Agents2's kind allowlist applies only to publish from the webview.
• Windows is built for (CREATE_NO_WINDOW, no process groups) but untested.

🤖 Generated with Claude Code