✨ Add Plugin contributions to REPL sessions and Sidekick - #1105

Completed independent review history

Published by the coordinator from completed independent-review receipts. This comment reports those results; it is not a new independent review or merge approval.

The public PR head is 37d3702c8bb89048c61db95f48a7cafee914faf4. The later integration commit 81e00a74e0f9def314ecdd3578f295bbd7a504ca remains local and has not been pushed to this PR. Verdicts below apply only to the stated revisions.

All reviews use the same six acceptance areas: composition, lifecycle, vocabulary, real consumer, authoring, and host observation, including the accepted amendments and repository Reviewer guide. For the integration review, Fable's original call completed with an explicit quota failure and no verdict. Repository policy required independent Astra as its replacement, with the same scope, effort and correction limits; no extra confidence stage or budget reset was added.

Resolved blocker at the public head

The initial Fable review found that a contributed component without a return schema could successfully return undefined or another non-JSON value, but the Sidekick observer parsed that value inside the journal-failure handler. This could leave an acknowledged intent without its outcome and terminate the turn instead of providing ordinary feedback.

Fable's follow-up on 37d3702c8bb89048c61db95f48a7cafee914faf4 confirmed that optional observation is derived outside the journal-failure handler, schema-free non-JSON success remains success, and the original result is settled. The focused real-owner regression observes one effect, one matching outcome without an observed value, ordinary feedback, and a completed second turn. That blocker is resolved at this exact commit. The pass does not transfer to later integration or correction commits.

Blocking finding on the local integration commit

Astra reproduced a different boundary failure at 81e00a74e0f9def314ecdd3578f295bbd7a504ca in packages/cli/src/repl/sidekick/profile.ts:

A contributed component can return a canonical live protected input binding under a declared schema. Core's validateLiveReturnValue accepts it after cleanup, but the Sidekick observer passes the live value directly to parseJson. Enumerating the protected leaf throws an ordinary Error, rather than JsonParseError, before journal.settled. The body executes once, its acknowledged intent has no matching outcome, and successful safe typed feedback is missing. The existing Core-only protected-return test does not exercise this CLI observer.

The requested correction safely projects the accepted return through its owning protected-input machinery at the feedback boundary, preserves the original selected result/live binding and cleanup, and adds a focused CLI regression. The one restricted Core/host projection member has been explicitly accepted. Implementation of this correction and independent re-review are still outstanding. No corrected commit or passing integration review is claimed.

Nonblocking observations retained

These remain nonblocking, not extra correction prerequisites:

1. Widening the shared fatalFailure classifier to include InvocationTeardownError also changes how REPL.Test classifies teardown failures.
2. installPlugins builds the full syntax table per command to admit declarations, including commands outside the REPL; narrower reuse may avoid unnecessary work.
3. Observed-call failure handling unwraps fatal aggregates earlier than necessary, making observed and unobserved failure shapes differ.
4. Plugin contribution prose is repeated across the architecture and language/REPL specifications.
5. The bounded TODO consumer adaptation removes private journal/catalog plumbing beyond prompt registration/delegation; Fable classified this as consistent with accepted requirement A4 rather than a material ambiguity.

Fable's passing follow-up also retained two minor notes: effect-only feedback uses the existing builtin-compatible bare null rendering; and a suggestion concerning the JsonParseError rethrow guard. The latter is a historical note, not evidence against Astra's subsequently reproduced ordinary-Error case.

Receipt handling and current status

The original Fable review on cd99886aab594eea1f3d8331bc9c2a83c172aa6f completed at the provider but failed response validation because its summary was 1,219 characters against a 1,200-character limit. The exact saved reply was explicitly accepted unchanged under a one-time human exception; its changes-required verdict and all findings were retained. No response retry or shared-schema change was made. Original raw SHA-256: d8f7255c89414a75c10d59850f083bd6a96dace1b12ba63af90c5e1569e54844.

The original coordination REPL later crashed before the next role dispatch. Human authorization for one recovery REPL with file-backed coordination guidance was supplied and verified. Automatic approval review nevertheless rejected both launch attempts; neither started a process, and direct confirmation requested in the task chat is pending. Publication of these already-completed results does not depend on recovery and starts no new paid review.

After correction, the new exact feedback commit requires the retained independent Astra follow-up and normal Architect/Planner feedback. Required branch checks, exact-current-main health and runner-owned test-weight remeasurement remain delivery gates. This report grants no merge approval.

PR #1105: ✨ Add Plugin contributions to REPL sessions and Sidekick

53 files, +4443 / -1825

Scope

🔴 PR has 6268 lines changed. Split into focused PRs.

🟡 6268 lines changed. PRs under 400 receive more thorough review.

🟡 53 files changed. Are all changes related?

🟡 Changes span 8 directories.

🟡 PR mixes config and source changes.

🟡 package.json changed without dependency justification.

Structural

Oxlint structural signals:

• no-unused-vars ×23: packages/cli/tests/support/headless-repl.ts, packages/core/src/expand.ts, packages/cli/src/repl/program.ts (+1)
• no-empty-function ×7: packages/cli/src/repl/sidekick/testing.ts, packages/cli/src/repl/sidekick/profile.ts, packages/core/src/secrets/inputs.ts (+4)
• no-unnecessary-type-assertion ×7: packages/cli/src/repl/sidekick/feedback.ts, packages/core/src/expand.ts, packages/core/src/execute.ts
• no-unnecessary-type-arguments ×1: packages/cli/src/repl/sidekick/owner.ts

Slop

Oxlint slop signals:

• no-inferrable-types ×2: packages/core/src/expand.ts

Static Analysis

Oxlint: 209 diagnostics across 17 files (23 rules)
Density: 0.047 violations/added-line

no-shadow (40): packages/cli/tests/support/headless-repl.ts, packages/cli/src/repl/sidekick/profile.ts, packages/core/src/secrets/inputs.ts (+4)
no-useless-default-assignment (37): packages/core/src/expand.ts, packages/cli/src/repl/program.ts
unbound-method (31): packages/cli/tests/fixtures/repl/contributed-plugin.ts, packages/cli/tests/support/mounted-repl.ts, packages/core/src/invocation-identity.ts (+5)
no-unused-vars (23): packages/cli/tests/support/headless-repl.ts, packages/core/src/expand.ts, packages/cli/src/repl/program.ts (+1)
no-floating-promises (17): packages/cli/tests/support/mounted-repl.ts, packages/cli/src/repl/program.ts, packages/cli/tests/support/plugin-program.ts
no-unsafe-type-assertion (15): packages/cli/src/repl/sidekick/feedback.ts, packages/core/src/invocation-identity.ts, packages/core/src/expand.ts (+1)
no-empty-function (7): packages/cli/src/repl/sidekick/testing.ts, packages/cli/src/repl/sidekick/profile.ts, packages/core/src/secrets/inputs.ts (+4)
no-unnecessary-type-assertion (7): packages/cli/src/repl/sidekick/feedback.ts, packages/core/src/expand.ts, packages/core/src/execute.ts
no-array-sort (5): packages/cli/src/repl/sidekick/feedback.ts, packages/core/src/secrets/inputs.ts, packages/cli/src/repl-profile.ts (+2)
consistent-function-scoping (5): packages/core/src/secrets/inputs.ts, packages/cli/tests/support/mounted-repl.ts, packages/cli/src/repl/sidekick/owner.ts (+1)
no-base-to-string (5): packages/core/src/expand.ts
consistent-return (4): packages/core/src/invocation-identity.ts, packages/core/src/execute.ts, packages/cli/src/repl/program.ts
no-inferrable-types (2): packages/core/src/expand.ts
no-duplicate-type-constituents (2): packages/core/src/execute.ts
no-unmodified-loop-condition (1): packages/cli/tests/support/headless-repl.ts
no-useless-length-check (1): packages/cli/src/repl/sidekick/testing.ts
no-useless-spread (1): packages/cli/tests/support/mounted-repl.ts
no-useless-fallback-in-spread (1): packages/core/src/expand.ts
no-underscore-dangle (1): packages/core/src/expand.ts
no-unnecessary-template-expression (1): packages/cli/src/repl/sidekick/feedback.ts
no-unnecessary-type-arguments (1): packages/cli/src/repl/sidekick/owner.ts
restrict-template-expressions (1): packages/core/src/expand.ts
no-implied-eval (1): packages/core/src/expand.ts

Correctness

No extraneous code patterns detected.

Independent review and ordinary feedback now pass on signed commit b279d04b77709afbbce92a403f73e38da5f320b5, rebased onto main 234a596186b028b50de26257e5a09e0944ad3758.

The same retained Codex Astra reviewer (gpt-6-astra/high) examined all six acceptance clauses and the accepted protected-return projection amendment. It reports the previous blocker resolved: contributed protected returns produce matched safe success feedback through the conversation's existing input owner while preserving the original live Result and binding. No blocking findings remain. The original Architect and Planner independently returned PASS on this exact head.

All seven focused command groups pass, including the real protected-return Sidekick regression, owner projection/refusal cases, lifecycle/Plugin/Core neighbors, real TODO consumer, author example and documentation. First failures and exact tested candidates remain recorded; reviewers reused that evidence and ran no confidence suites. Earlier verdicts stay attached to their historical commits, and earlier nonblocking notes retain their classification.

Required branch CI and runner-owned weight measurement are running. Merge readiness still requires those delivery gates and exact current-main health. This is a coordinator report of the retained reviews, not merge authorization.

The approved six-journey test split is published in signed commit 98d6333c13c636768ef8952d7e8f0fb6ab22ed7c.

The same retained independent Codex Astra reviewer (gpt-6-astra/high) passes all six acceptance clauses on this exact head. The original Planner also passes the bounded test-only correction. Production architecture was unchanged, so the pinned impact policy selected Planner for ordinary feedback; the earlier Architect verdict remains attached to the product commit it reviewed.

All six original Markdown journeys pass through the preserved launcher (6 tests/6 steps). Discovery, runtime-exclusion and actual-corpus partition evidence passes (11 tests/37 steps), assigning every journey exactly once under Deno, Node and Bun. The private helper preserves names, commands, permissions, fixtures, timeout and cleanup ownership. No coverage was removed and no in-shard concurrency was added. Reviewers reused the recorded evidence without confidence reruns.

The prior delivery commit passed required correctness CI, but failed timing qualification: the original six-case file occupied its own Deno shard and took 431 seconds, and all three runtime execution windows exceeded seven minutes. Repository policy therefore increments counts to Deno 22, Node 17 and Bun 10. The new file topology still requires complete runner-owned remeasurement and the five-run fixed-head timing qualification; no timing pass is claimed.

Main has separately advanced to 2da83e148b9718ae78ea90c1019648a08727c320. GitHub reports the PR has merge conflicts; the read-only preview identifies five REPL/Sidekick integration paths. That new integration is not included in this test-only correction. Current-main integration, its exact-head reviews and fresh delivery checks remain outstanding.

This is a coordinator report of completed retained reviews, not merge authorization. Historical verdicts and nonblocking classifications remain unchanged.

Coordinator report for exact signed code head 274ec7eebda3992c5e545691cd7486b785666ab0:

The retained independent Codex Astra reviewer (gpt-6-astra/high) passes all six acceptance clauses with no blocking findings. The original Architect and Planner also pass this exact commit. These are the actual retained-role verdicts, not a coordinator-issued review approval.

Astra’s prior changes_required on integration 56bbc7a is preserved: a valid entry-only Plugin Cwd inherited a built-in generated form and failed canonical capture. The bounded correction makes overridden declarations own generated selection and Sidekick descriptions. Permanent real-host regressions cover entry-only omission/refusal, paired-only execution/refusal and unchanged built-in behavior. Focused evidence passes (36 tests/161 steps plus Plugin 1 test/4 steps); first failures remain recorded.

The signed merge preserves both the feature history and pinned main 2f0ddfd; seven integration evidence groups and the clean dependency/build/interference proof pass. The earlier six-journey split and its coverage are retained.

Delivery is still pending: CI, fresh complete runner measurement, exact artifact adoption and five-run fixed-head timing qualification, plus required CI and exact current-main health. No merge approval is implied.