feat(chatcut): add v6 Canvas plugin workflow

AGENTS.md

@@ -2,14 +2,29 @@
 
 These rules apply to people and AI agents in this repository.
 
+## Repository ownership boundary
+
+- This repository is the authoritative source for concrete Convax Plugins,
+  Plugin-owned Skills, standalone Skills, and reviewed companion tools, including
+  official, default-catalog, and vendor integrations.
+- The `microvoid/convax` repository owns the generic host platform: manifest ABI,
+  validation at installation, lifecycle, runtime bridges, IPC/UI, and Registry
+  consumption. Do not copy its private implementation or create a package-specific
+  host fork here.
+- If an integration needs a missing host capability, add or revise the generic ABI
+  in `convax` and keep the concrete manifest, assets, workflow instructions, and
+  companion source in this repository. Neither repository may add runtime behavior
+  that branches on the concrete Plugin id.
+
 ## Before editing
 
 1. Read `README.md` and the relevant file in `docs/`.
 2. Name the package or external tool being changed. A package owns only files below
    its own workspace; a separately distributed tool owns only `packages/tools/<id>`.
 3. Never copy private Convax implementation code. Use only the documented manifest
-   and version-matched `convax.plugin-host/1`, `convax.plugin-host/2`,
-   `convax.plugin-host/3`, or `convax.plugin-host/4` protocol.
+   and compatibility protocol: `convax.plugin/1` through `/4` use the matching
+   `convax.plugin-host/<major>`; `convax.plugin/5` and `/6` use
+   `convax.plugin-capability/1`.
 
 ## Package rules
 
@@ -19,19 +34,31 @@ These rules apply to people and AI agents in this repository.
   `package.json`, dependency declarations, and scripts. The repository owns one
   root `bun.lock`; do not add package-local lockfiles or hard-code workspace ids in CI.
 - The contents of `package/`, not the containing directory, become the ZIP root.
-- A `convax.plugin/1` Plugin is static Web content. A `convax.plugin/2` or
-  `convax.plugin/3` package may
-  additionally declare a separately installed bare `mcp-stdio` command and
-  generation tools. Never put that executable, a server, native binary, Electron,
-  Node access, remote script, dependency tree, or install/build hook in the Plugin
-  ZIP.
+- A `convax.plugin/1` Plugin requires static Web content. `convax.plugin/2` through
+  `/6` may additionally declare a separately installed bare `mcp-stdio` command
+  for executable contributions. Any schema may opt into one explicitly authorized,
+  self-contained JavaScript ESM OpenCode Hook module through `hooks`; v2 and later
+  may be Hook-only. Never put the MCP executable, a server, native binary, Electron,
+  remote script, dependency tree, or install/build hook in the Plugin ZIP.
+- A declared `hooks` module is executable code, not inert Web content. It must be
+  one bundled, valid ESM `.js` or `.mjs` file with an exported OpenCode Plugin
+  entry. Only static `node:`/`bun:` built-in imports may remain; bundle every package
+  dependency and do not use CommonJS globals, runtime module loaders such as
+  `node:module`, or dynamic imports. Convax binds consent to its exact bytes and
+  loads a private snapshot only after an explicit install or update;
+  default/background provisioning must not authorize new Hook bytes.
 - Reviewed companion tool source may live under `packages/tools/<id>`, but it is a separate
   distributable with its own tests. Repository validation and Plugin packing never
   execute it or include it in `package/`.
-- A `convax.plugin/4` Plugin may contribute Plugin-owned Skills from independent
+- A `convax.plugin/4` or later Plugin may contribute Plugin-owned Skills from independent
   Skill workspaces. The packer injects them; do not commit a duplicate Skill below
   the Plugin `package/`. Convax lifecycle ownership is declared by the manifest and
   Registry metadata, never inferred from npm dependencies.
+- A `convax.plugin/6` `contributes.agent.mcp` declaration names one absolute HTTPS
+  remote MCP endpoint for OpenCode/the native host to connect. It is not a local
+  command or sidecar declaration. Do not put credentials, secret/dynamic headers,
+  local paths, or executable fallback behavior in it; service authentication stays
+  with the remote service and the host's standard MCP OAuth flow.
 - A published companion is declared in source metadata and emitted as a separate,
   target-specific Release asset. Its immutable Registry URL, byte size, and SHA-256
   are derived from the reviewed build output; never author them by hand.

README.md

@@ -54,13 +54,11 @@ The generated Plugin ZIP has `manifest.json` at its root. A Skill ZIP has
 `SKILL.md` at its root. No dependency install or contributor build script is run
 while validating or packing a package.
 
-New executable Tool Plugins use `convax.plugin/3` and may be headless; use
-`convax.plugin/4` when the same Plugin also owns Skills. Both schemas separate
-executable tools, model-picker entries, Agent tools, and Canvas selection actions so
-hosts can compose every Plugin without checking its id. Their ZIP still
-contains only inert package files: it declares a separately installed bare
-`mcp-stdio` command for generation and/or fixed service actions, and never embeds
-that executable, its dependencies, vendor credentials, or provider configuration. See
+Executable Tool Plugins may be headless. `convax.plugin/3` separates executable
+tools, model-picker entries, Agent tools, and Canvas selection actions;
+`convax.plugin/4` and later may also own Skills. Local executable contributions
+declare a separately installed bare `mcp-stdio` command and never embed that
+executable, its dependencies, vendor credentials, or provider configuration. See
 [`docs/plugin-authoring.md`](docs/plugin-authoring.md#declarative-tool-plugin).
 For reviewed first-party tools, the Registry publishes exact
 platform/architecture companion artifacts beside the ZIP. Convax verifies their
@@ -72,7 +70,31 @@ metadata. The verified sidecar supplies a random, Main-only loopback gateway at
 runtime; manifests and service projections never contain upstream URLs, Cookies,
 headers, or credentials.
 
-`convax.plugin/4` adds Plugin-owned Skills. A v4 Plugin declares
+A Plugin may also declare one self-contained OpenCode Hook module with `hooks`.
+Convax snapshots and fingerprints its exact JavaScript bytes during an explicit
+install or update, then lets OpenCode load that private snapshot. Hook events stay
+native to OpenCode; Convax does not add another Hook API. Because this module is
+executable Agent code rather than iframe content, default/background provisioning
+never authorizes new Hook bytes. See
+[`docs/plugin-authoring.md`](docs/plugin-authoring.md#agent-hooks).
+
+`convax.plugin/5` and `/6` use the transport-neutral
+`convax.plugin-capability/1` host contract. v5 adds Project/Canvas grants and
+generic LLM display metadata. v6 may additionally declare one HTTPS remote Agent
+MCP endpoint. Convax delegates that endpoint to OpenCode/the native MCP host,
+including standard OAuth, while the remote service retains its own account and
+authentication system. The declaration contains no local command, adapter, or
+secret. Only bounded literal non-credential headers are allowed. Concrete Plugin,
+Skill, and reviewed companion source remains in this repository rather than moving
+into the Convax host.
+
+v6 also supports Canvas sink operations: a Web node can inspect pathless metadata
+for directly connected media, while a manifest-declared local operation can bind
+its Agent references to those exact incoming edges and return a bounded text result
+without creating another Canvas node. Edge changes only refresh pending input
+metadata; external transfer still requires an explicit user action.
+
+`convax.plugin/4` and later support Plugin-owned Skills. The Plugin declares
 `contributes.skills`, and the packer injects each referenced standard Skill
 workspace into the Plugin ZIP. Convax may show that Skill in its catalog, but its
 install, update, and removal lifecycle belongs to the Plugin. The standalone Skill
@@ -125,10 +147,12 @@ Open **Settings → Skills and Plugins** in a compatible Convax build. The catal
 loaded from the public Registry above; selecting **Install Plugin** or **Install
 Skill** sends only the package id to Convax main, which downloads and validates the
 corresponding immutable Release ZIP.
-If a v2, v3, v4, or v5 Plugin declares Registry companions, the same install transaction selects
+If a v2 through v6 Plugin declares Registry companions for a local runtime, the
+same install transaction selects
 only the exact local platform/architecture artifact and verifies its immutable URL,
 byte count, and SHA-256 separately from the static ZIP.
-For v4 and v5, Plugin-owned Skills are admitted and removed in that same Plugin transaction;
+For v4 and later, Plugin-owned Skills are admitted and removed in that same Plugin
+transaction;
 they are never an independent Convax install action.
 
 The `microvoid/convax-plugins` repository, Registry, and Release assets are public
@@ -197,18 +221,29 @@ entries only.
 
 ## Trust boundary
 
-Third-party Plugin ZIPs are inert. Web surfaces are static HTML/CSS/JavaScript
+Third-party Plugin ZIPs are inert during validation and packing. Web surfaces are static HTML/CSS/JavaScript
 rendered by Convax in an iframe with exactly `sandbox="allow-scripts"`; they cannot
 contain native executables, Node/Electron code, network permissions, or a generic
-host bridge. A v2, v3, v4, or v5 Tool Plugin may name a separately installed external command.
+host bridge. A v2 through v6 Tool Plugin may name a separately installed external command.
 Convax resolves and fingerprints it during explicit Plugin install/update; that
 transaction is consent to the exact binding, so later calls do not show a separate
-command prompt. It never becomes part of the ZIP. A Registry companion is an independent immutable Release asset,
+command prompt. It never becomes part of the ZIP. A Registry companion is an
+independent immutable Release asset,
 admitted only after exact target, size, and digest verification. Every host call is
 scoped to the mounted Plugin node and checked
 against the manifest capability allowlist. Skills are instructions, not executable
 capability grants.
 
+The explicit exception is a manifest-declared `hooks` module: one bundled
+JavaScript ESM file executed as a native OpenCode Plugin. Installation consent is
+bound to its normalized manifest and exact bytes; OpenCode loads only a private
+host snapshot. It is not sandboxed, so silent default installation or background
+updates cannot authorize it.
+
+A v6 remote Agent MCP contribution is different: it names only an HTTPS endpoint
+that the native Agent host connects through its standard MCP/OAuth support. It does
+not authorize iframe networking, ship a local command, or carry credentials.
+
 ## License
 
 Repository tooling, templates, and `hello-convax` are MIT licensed. Each submitted

README.zh-CN.md

@@ -48,17 +48,33 @@ bun run pack -- --kind skill --id my-skill
 生成的插件 ZIP 在根目录包含 `manifest.json`，技能 ZIP 在根目录包含
 `SKILL.md`。校验和打包期间不会安装依赖，也不会执行投稿者提供的构建脚本。
 
-新的可执行工具插件使用 `convax.plugin/3`，也可以是无界面的；如果同一个插件还拥有 Skill，
-则使用 `convax.plugin/4`。两种 schema 都将可执行工具、模型列表、智能体工具和画布选中动作
-分开声明，使宿主无需识别插件标识即可完成组合。其 ZIP 仍然只包含惰性包文件：
-manifest 为生成能力和/或固定服务动作声明一个单独安装的裸 `mcp-stdio` 命令，但绝不
-内嵌可执行文件、依赖、厂商凭据或 provider 配置。参见
+可执行工具插件可以是无界面的。`convax.plugin/3` 将可执行工具、模型列表、智能体工具
+和画布选中动作分开声明；`convax.plugin/4` 及更高版本还可以拥有 Skill。本地可执行
+贡献通过 manifest 声明一个单独安装的裸 `mcp-stdio` 命令，但绝不内嵌可执行文件、
+依赖、厂商凭据或 provider 配置。参见
 [`docs/plugin-authoring.md`](docs/plugin-authoring.md#declarative-tool-plugin)。
 对于经过审查的第一方工具，Registry 会在 ZIP 之外发布精确到平台和架构的 companion
 工件。Convax 按字节数和 SHA-256 校验后写入宿主管理目录，因此用户无需通过 `PATH`
 手工安装 sidecar，可执行文件也始终不会进入插件包。
 
-`convax.plugin/4` 新增插件拥有的技能。v4 插件通过 `contributes.skills` 声明技能，
+插件也可以通过 `hooks` 声明一个自包含的 OpenCode Hook 模块。Convax 只会在用户明确
+安装或更新时对其 JavaScript 字节做快照和指纹绑定，再由 OpenCode 加载宿主私有快照。
+Hook 事件完全沿用 OpenCode，Convax 不会另造一套 Hook API。由于它是可执行 Agent
+代码而不是 iframe 内容，默认安装和后台更新不会静默授权新的 Hook 字节。详见
+[`docs/plugin-authoring.md`](docs/plugin-authoring.md#agent-hooks)。
+
+`convax.plugin/5` 和 `/6` 使用与传输无关的
+`convax.plugin-capability/1` 宿主契约。v5 新增 Project/Canvas 权限和通用 LLM
+展示元数据；v6 还可以声明一个 HTTPS 远程 Agent MCP 端点。Convax 将该端点和标准
+OAuth 委托给 OpenCode/原生 MCP 宿主，远程服务继续拥有自己的账号和鉴权系统。声明中
+不包含本地命令、适配层或秘密，只允许有界的非凭据字面量请求头。具体插件、Skill 和
+受审 companion 源码继续归本仓库所有，不会移入 Convax 宿主。
+
+v6 也支持画布 sink 操作：Web 节点只能查看直接连入媒体的无路径元数据；manifest
+声明的本地操作可以把 Agent 引用约束到这些精确入边，并把有界文本结果返回给 Agent，
+而不创建额外画布节点。连线变化只刷新待处理输入，任何外部传输仍需用户明确触发。
+
+`convax.plugin/4` 及更高版本支持插件拥有的技能。插件通过 `contributes.skills` 声明技能，
 打包器会把对应的标准技能 workspace 注入插件 ZIP。Convax 可以在技能列表中展示它，
 但安装、更新和卸载生命周期都归插件所有。独立技能 ZIP 仍可供 Codex 及其他兼容
 Agent Skills 的客户端使用。由于同一份源码会同时改变两个压缩包，发布插件拥有的技能时
@@ -102,9 +118,11 @@ Pet 功能插件使用 `convax.plugin-capability/1` 兼容性组合，通过 `co
 在兼容版本的 Convax 中打开“设置 → 技能与插件”。能力目录从上面的公开 Registry
 加载。点击安装插件或安装技能后，渲染进程只会把包标识传给主进程，由主进程下载并
 校验对应的不可变 Release ZIP。
-若 v2、v3、v4 或 v5 插件声明了 Registry companion，同一次安装会只选择当前平台和架构的精确工件，
+若 v2 至 v6 插件为本地 runtime 声明了 Registry companion，同一次安装会只选择当前
+平台和架构的精确工件，
 并在静态 ZIP 之外独立校验其不可变 URL、字节数和 SHA-256。
-对于 v4 和 v5，插件拥有的技能也在同一插件事务中接纳和移除，不能在 Convax 中独立安装或卸载。
+对于 v4 及更高版本，插件拥有的技能也在同一插件事务中接纳和移除，不能在 Convax 中
+独立安装或卸载。
 
 `microvoid/convax-plugins` 仓库、Registry 和 Release 资源都是公开的，不需要
 GitHub 账号或令牌。主应用仓库 `microvoid/convax` 可以继续保持私有，不会影响包安装。
@@ -167,15 +185,22 @@ Registry 条目、为 ZIP 创建来源证明并发布 GitHub Release。Pages 工
 
 ## 安全边界
 
-第三方插件 ZIP 只能包含惰性文件。Web 界面只能是静态 HTML、CSS 和 JavaScript，
+第三方插件 ZIP 在校验和打包阶段始终按惰性文件处理。Web 界面只能是静态 HTML、CSS 和 JavaScript，
 并由 Convax 放入仅带 `sandbox="allow-scripts"` 的 iframe 中运行；ZIP 不能包含原生
-可执行文件、Node/Electron 代码、网络权限或通用宿主桥接。v2、v3、v4 或 v5 工具插件可以声明一个
+可执行文件、Node/Electron 代码、网络权限或通用宿主桥接。v2 至 v6 工具插件可以声明一个
 单独安装的外部命令。Convax 会在用户明确安装或更新插件时独立解析并校验指纹；这次
 操作即表示同意运行该精确绑定，后续调用不会再弹出本地命令确认。该命令不会进入 ZIP。
 Registry companion 是独立且不可变的 Release 工件，仅在目标、大小和摘要全部精确校验后
 才会被接纳。每个宿主调用都绑定当前插件节点，并按 manifest 中声明的最小权限校验。技能只是工作流
 说明，不会授予可执行权限。
 
+唯一显式例外是 manifest 声明的 `hooks`：一个作为 OpenCode 原生 Plugin 执行的、
+已经打包成单文件的 JavaScript ESM 模块。安装授权会绑定规范化 manifest 和精确字节，
+OpenCode 只加载宿主私有快照。它不是沙箱代码，因此默认安装或后台更新不能静默授权它。
+
+v6 的远程 Agent MCP 贡献不同：它只声明一个由原生 Agent 宿主通过标准 MCP/OAuth
+能力连接的 HTTPS 端点，不会授予 iframe 网络权限，不会发布本地命令，也不会携带凭据。
+
 ## 许可证
 
 仓库工具、模板和 `hello-convax` 使用 MIT 许可证。每个投稿包都必须声明自己的许可证，