| 1 | // Package sidecar is the host half of Extension Protocol v1: it spawns |
| 2 | // extension sidecar processes, runs the initialize handshake, serves their |
| 3 | // Extension → Host calls (content reads, UI, provider streams), and owns |
| 4 | // their bounded shutdown and crash supervision. |
| 5 | // |
| 6 | // AUTHORIZATION INVARIANT: a sidecar may only ever be launched for a plugin |
| 7 | // package that is present in the pluginpkg installed state |
| 8 | // (<Reasonix home>/plugin-packages.json) AND currently enabled. The launch |
| 9 | // API (Manager.StartPackages) takes the pluginpkg installed state as its only |
| 10 | // input — there is no way to point it at an arbitrary binary or at a runtime |
| 11 | // declared by project config. Project configuration can declare MCP servers, |
| 12 | // hooks, and skills, but it can never declare a v1 runtime; keeping this |
| 13 | // invariant by construction is why StartPackages accepts a home directory and |
| 14 | // loads the state itself instead of accepting caller-supplied command specs. |
| 15 | // |
| 16 | // FULL-TRUST CONTRACT: a sidecar process inherits the UNFILTERED Reasonix |
| 17 | // environment (os.Environ), plus its manifest env and REASONIX_PLUGIN_ROOT / |
| 18 | // REASONIX_PLUGIN_NAME / REASONIX_PLUGIN_VERSION. Sidecars can read |
| 19 | // credentials, the session, and the workspace and can act with the user's |
| 20 | // full authority — the same contract an installed v1 runtime already accepted |
| 21 | // at install time (see pluginpkg.RuntimeTrustText). Sidecar stderr is redacted |
| 22 | // in this process layer; provider errors, structured UI, and interceptor |
| 23 | // reasons are redacted again by their host-side consumers. Ordinary |
| 24 | // provider/model content remains unchanged as product data. |
| 25 | package sidecar |
| 26 |