4bf3c73a15
* feat(plugins): skill resources into the existing skill table (MUL-6350 PR 4, 1/3) A plugin's skill resource becomes an ordinary row in the skill table. Not a plugin-owned copy, not a bundle, not an artifact with a digest: the previous plugin system built all of that across fourteen tables and, at the end of it, delivered one SKILL.md that this table could already hold. The only thing the platform has to remember is which installation contributed which skill, so uninstall removes exactly those and nothing a person wrote. That is one nullable column. The upsert is scoped to rows this installation owns, so a plugin claiming a name somebody already used fails the install instead of silently replacing their work — and the test asserts the human's content survives. Upgrade prunes what the new manifest no longer declares, or a renamed skill would leave its predecessor behind with nothing to attribute it to. Fresh install is now a transaction too. It was a single INSERT; skills have to land in the same commit, because an installation whose skills half-arrived is worse than one that failed — the missing half is invisible. Skill resources flip on here rather than with the rest of PR 4: nothing executes, so it does not wait for the daemon-side MCP server that the agent trigger and mcp transport still need. Co-authored-by: multica-agent <[email protected]> * feat(plugins): agent trigger — hooks as MCP tools (MUL-6350 PR 4, 2/3) The fourth call site, and the only one that is not the host deciding to call something: an agent reads a tool description and chooses. That choice is why hooks may be reached from an agent at all — the alternative, a hook that must run before or after every turn, is a third party holding the product's main loop open, and no such position exists anywhere in this design. The daemon renders the tools but does not call the plugin. A tool call goes back to Multica, which makes the signed request. Two reasons, and the second matters more: the signing secret is derived from the deployment key and putting it on every laptop running an agent would hand out a credential that can impersonate the server to every plugin backend; and routing through the server keeps the rate limit, circuit breaker, `net:` destination check and invocation record on one code path for all four triggers instead of a daemon-side copy that would drift. A failing hook is a TOOL error, not a transport error. The agent reads it, works around it, and finishes the issue — an unreachable plugin endpoint must not fail somebody's task. The server returns 200 with a status for the same reason: a non-2xx would look to the daemon like the broker itself is broken. TestPluginToolNameSeparatorCannotBeForged caught a real flaw in my first naming scheme. Sanitizing both halves and joining with an underscore is not injective — a plugin key uses `.` and `-`, both of which have to become `_`, so `a.b` and `a-b` collapse together and `a.b_` + `c` collides with `a.b` + `c`. Two plugins would have been offering the agent one tool name. The prefix now carries a short digest of the full key rather than a lossy transliteration. Co-authored-by: multica-agent <[email protected]> * feat(plugins): mcp transport with pinned tool approval (MUL-6350 PR 4, 3/3) An `mcp` hook adopts tools from an MCP server the plugin author already runs. The difference from an `http` hook is who decides the shape: an http hook declares one endpoint in a manifest an administrator read, while an MCP server decides its own tool list at runtime. So installing the plugin is not the grant — an administrator discovers the tools and pins a specific set by name and schema digest, and a tool that appears later is not adopted until approved. Approved hooks reach the daemon as ordinary remotemcp.Connection values, so the existing broker proxies them and validatePinnedRemoteMCPTools already refuses to start when an approved tool went missing or its schema drifted. No new enforcement path. Plugin connections carry a `plugin:` contribution-id prefix. They share the broker and the resolver with a workspace's own Remote MCP connections but keep their credential in the Plugin's secret storage, which a different route serves, and the contribution id is all the broker hands back at dial time. Flips TransportMCP on in HostCapabilities, completing PR 4's capability set. Co-authored-by: multica-agent <[email protected]> * test(plugins): cover mcp connection startup via the dev-origin seam The `http` transport has had MULTICA_PLUGIN_DEV_ORIGINS since the hook engine landed: an operator names exact origins, and endpoints there skip the public-internet requirement so a plugin author can develop against a server on their own machine. The `mcp` transport never got it. Two symptoms, one cause. A plugin author could not point an mcp hook at a local MCP server, and — for the same reason — the daemon's connection startup could not be reached by a test, because it validates the endpoint as public HTTPS and the repo's MCP fixture serves plain HTTP on loopback. That left the layer carrying the entire approval guarantee at 0% coverage: startTaskRemoteMCPBrokers 0.0% -> 59.5% validatePinnedRemoteMCPTools 0.0% -> 100.0% The seam is off unless the variable is set, and a test asserts that: the same loopback connection is refused when it is empty. It skips only the public-internet requirement — the net: scope still applies, and the dial-time host pin still refuses a redirect that changes host. Tests cover what the approval is for: an approved tool the server dropped, an approved tool whose schema drifted, and an optional connection that fails without failing the task. Each was verified by breaking the guard it covers. Co-authored-by: multica-agent <[email protected]> * feat(plugins): a real example plugin, and the two bugs it found examples/plugins/deploy-sentinel is an incident-response plugin: it correlates an issue with recent deploys, files rollback requests under the team's own rules (refusing deploys past a window, and reasons too short to be evidence), pages on-call on issue events, and adopts an external metrics MCP server. Four triggers, both transports, and a skill that tells an agent when to use any of it. The other examples each demonstrate one mechanism. This one was written to find out whether the mechanisms compose, and it found two things that no unit test was ever going to: 1. mcp discovery could not succeed against ANY server. DiscoverMCPHookTools passed a nil protocol-version list, and Discover checks the server's answer against that same slice — empty means nothing is acceptable. Discover now falls back to SupportedProtocolVersions() when the caller passes none. 2. A hook handler had no way to read its own configuration. The manifest's config block drives a host-rendered form, the Action API has no config endpoint, and the hook body did not carry the values — so a plugin would have had to keep a second copy on its own server. The body now carries non-secret config. Secret-typed fields are excluded; they live in a separate table and are the plugin's credentials for its own services. Also lets an mcp dev origin trust MULTICA_PLUGIN_DEV_CA, mirroring the http transport. The manifest validator requires HTTPS, so without this a local MCP server could not be developed against at all. plugin_example_test.go installs the real manifest from examples/, not a copy, so a broken example fails the build rather than rotting quietly. Migrations renumbered to 368/369 after main advanced. 362 is added to the legacy-duplicate allowlist: two PRs took that prefix within the same hour and both merged, and the ledger keys on the full stem, so renaming one would re-run it everywhere it has already applied. main is red on this today. Co-authored-by: multica-agent <[email protected]> * fix(plugins): the deploy-sentinel example servers must serve HTTPS Both .mjs servers used node:http. A hook's transport URL has to be an https:// URL or the manifest fails validation, so the example as shipped could not actually be installed against a running Multica — the README told you to set MULTICA_PLUGIN_DEV_ORIGINS to https:// origins that nothing was listening on. Found by running it: install, config, skill contribution and live MCP tool discovery all work against the real servers once they speak TLS. They read TLS_CERT / TLS_KEY and the README carries the openssl one-liner. MULTICA_PLUGIN_DEV_CA changes which certificate is trusted; it never disables verification, which is why a self-signed certificate is needed rather than plain HTTP. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>
Deploy Sentinel
A production-incident plugin. It correlates an incident issue with recent deploys, lets an agent file a rollback request under the team's own rules, pages on-call when an incident is filed, and adopts the team's existing metrics MCP server.
It exists because the other examples in this directory each demonstrate one thing. This one is the shape of a plugin somebody would actually write: four triggers, both transports, real business rules that refuse things, and a skill that teaches an agent when to use any of it.
What it contributes
| Contribution | Kind | What it demonstrates |
|---|---|---|
incident-response |
skill resource | A SKILL.md becomes an ordinary workspace skill. Uninstall removes it. |
correlate_deploys |
hook, agent + manual + ui |
One hook, three callers. The agent gets a tool; a person gets a button; the panel gets a function. |
request_rollback |
hook, agent + manual |
A write action that refuses: too old, or no written reason. |
page_oncall |
hook, event |
Fires on issue.created / issue.status_changed. Never blocks anything. |
metrics |
hook, mcp transport |
Adopts an external MCP server's tools, subject to admin approval. |
incident |
issue_panel surface |
The human view, in a sandboxed iframe with no credential. |
The part worth copying
request_rollback says no. It refuses a deploy past the configured window,
and it refuses a reason shorter than 20 characters. An agent that has to write
evidence before it can file a change request produces better change requests —
and the refusal text explains why, so the agent can act on it rather than retry
blindly. Hook handlers that only ever succeed are the easy case; this one is the
useful one.
correlate_deploys reports "nothing changed" as an answer, not as an empty
list. The skill then tells the agent that an empty result means it should stop
looking at deploys. A tool that returns [] and a tool that says "no deploys in
this window, this is unlikely to be a deploy" cost the same to write and behave
very differently in an agent's hands.
The skill and the hooks are designed together. SKILL.md names the tools and
says what order to use them in. Neither half works as well alone.
Running it locally
Two servers, both the plugin author's own. Multica never runs either.
Both serve HTTPS, because a hook's transport URL must be an https:// URL or
the manifest will not install. Make a certificate once:
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
-keyout dev-key.pem -out dev-cert.pem \
-subj "/CN=127.0.0.1" -addext "subjectAltName=IP:127.0.0.1"
# The hook endpoint. The signing secret is the whsec_… shown once when you
# issued the plugin's token in workspace settings.
MULTICA_SIGNING_SECRET=whsec_... node server/handler.mjs # :8788
# The MCP server behind the `metrics` hook.
METRICS_TOKEN=metrics-dev-token node server/metrics-mcp.mjs # :8789
Both read TLS_CERT / TLS_KEY, defaulting to dev-cert.pem / dev-key.pem
in the working directory.
Then point Multica at them. Both endpoints are on loopback, which the outbound guard refuses by design, so name them explicitly:
export MULTICA_PLUGIN_DIR=examples/plugins
export MULTICA_PLUGIN_DEV_ORIGINS=https://127.0.0.1:8788,https://127.0.0.1:8789
export MULTICA_PLUGIN_DEV_CA=/path/to/your-dev-ca.pem
Install it as local:deploy-sentinel, fill in the config form, then open the
metrics approval panel and tick the tools you want agents to reach. Nothing
under metrics is callable until you do — that is the whole difference between
the mcp transport and an http hook.
Both endpoints must be HTTPS even locally: the manifest validator requires it,
and MULTICA_PLUGIN_DEV_CA is how you get a self-signed certificate trusted.
The dev switches change which certificate is trusted and whether the address
must be public. They never disable verification, and they never widen the
net: scopes — a hook still cannot reach a host the administrator did not
approve.
Try breaking it
- Ask an agent to roll back
d-4802. It is 380 minutes old; the plugin refuses and explains why. - Ask for a rollback with the reason "broken". Refused — too short.
- Add a tool to
server/metrics-mcp.mjsand reopen the approval panel. It appears unapproved, and agents cannot call it until somebody ticks it. - Change an approved tool's
inputSchemaand restart. The agent's task starts fine, but that connection is refused: the schema no longer matches what was approved.
Tested
server/internal/handler/plugin_example_test.go installs this manifest,
not a copy, and drives it: the skill lands in the skill table, the agent tool
list contains exactly the hooks that declare the agent trigger, an agent hook
call goes out signed and comes back, and the metrics tools are discovered,
refused before approval, and pinned by schema digest after it.
The .mjs files are what you run by hand. The test uses Go servers that answer
the same contract, so CI does not need node.