v0.202.0

v0.202.0: live plugin cards in chat and disk space back

Plugin components in chat can now show live data: the console reads it for them through a narrow, host-checked channel that never hands over the login token. Separately, every agent's checkpoint database stops growing forever. The first restart after upgrading gives the space back; on the machine that found the bug, that was about 35 GB.

Upgrade notes

• Frame components must handshake to get init. The host now loads a component frame at <frame_url>#pair=<random>.
  • The frame posts protoComponent:ready {pair} once, echoing that fragment, and gets exactly one protoComponent:init {props, theme, nonce}. There are no re-posts.
  • The frame must echo nonce on every protoComponent:read, protoComponent:send and protoComponent:openLink.
  • A frame that doesn't send ready never receives init, so existing frame components must adopt this.
  • A second load, a second or unpaired ready, or a wrong nonce revokes the frame and shows "navigated away" with a Reload button. A page that replaces the plugin page can't inherit its reads or its "Always allow" send trust.
• Artifact frames have the same protection. Each render carries its own nonce, and an artifact that navigates itself loses ask/send/openLink.
• The first start after upgrading may take a few extra seconds per bloated checkpoint DB while it's compacted once. A 34 GB file holding 85 MB took about 5 s. Turn it off with checkpoint.vacuum_legacy_on_start: false. To run it by hand with the agent stopped, use protoagent checkpoint migrate --workspace <member> (or --db <path>).
• Vega-Lite charts: legends move to the bottom and wrap, and heat maps and diverging scales now use the console palette instead of Vega's default blues.

Highlights

• register_component(..., reads=[...]) lets a plugin's chat component declare GET routes under its own /api/plugins/<id>/ (* matches one segment).
  • The console makes the authed request itself after checking the source frame, the allowlist, GET-only and the rate limits (4 per second and 2 in flight per frame), and only while the frame is visible.
  • It returns at most 256 KB of JSON, streamed with a cutoff and a 10 s timeout.
  • The bearer and headers never reach the frame, and writes still go through the confirmed send chip.
  • The first consumer is projectBoard's live board cards.
• Checkpoint DBs actually shrink now. journal_mode=WAL was being set before auto_vacuum=INCREMENTAL, which silently made every checkpoint DB auto_vacuum=NONE. Pruning deleted rows, but the file never got smaller. New DBs are created correctly, and existing ones are migrated once at startup, only when it's safe (no other process has the DB open, enough disk free, and at least half the file is free space).
• One theme source. Vega-Lite artifacts and plugin component frames now take their theme from @protolabsai/design (buildVegaConfig, themeTokenSnapshot) instead of hand-written copies.

The full list is in the changelog below.

---

What's Changed

• feat: web: FrameComponentHost theme handoff from DS embed (themeTokenSnapshot + snapshotToCss); replace consoleTheme() there (Refs protoContent#577) by @mabry1985 in #4170
• feat: artifact: vega-lite theme from DS buildVegaConfig / vegaTooltipTheme; delete hand-written theme()/isDark() (Refs protoContent#571) by @mabry1985 in #4171
• fix(checkpoint): migrate auto_vacuum=NONE checkpoint DBs at boot; create new ones INCREMENTAL by @mabry1985 in #4173
• feat(components): host-mediated read channel for frame components (reads=) (#4143) by @mabry1985 in #4172

Full Changelog: v0.201.0...v0.202.0