Add first-class Agent Plugin support

[phinaldoo]

Ported from phinaldoo/chatui#937 and adapted to Omlorix's current repository layout and branding.

Summary

• Add secure preview, installation, enable/disable, export, and uninstall support for portable Agent Plugin bundles.
• Group bundled Skills and remote MCP servers under one owner-scoped plugin lifecycle and runtime-enforced enable state.
• Add an accessible, responsive, fully localized Plugins experience to Workspace, plus portability and security documentation.

Why

Omlorix already supports Skills and MCP servers independently, but users had no safe way to import and manage them as a single portable Agent Plugin. This change adds that aggregate lifecycle while preserving Omlorix's existing permission, encryption, sandboxing, and data-control boundaries.

Security and compatibility

• Validate manifests and bound archive size, expansion, entry count, per-file size, and compression ratio.
• Reject path traversal, absolute and Windows paths, backslashes, NUL bytes, duplicate entries, and symlinks.
• Install plugins disabled by default and enforce both ownership and group policy during installation and at runtime.
• Support remote Streamable HTTP and SSE MCP servers; reject personal stdio/local-process definitions.
• Preserve hooks and registered app IDs as compatibility metadata without executing them. MCP-hosted apps continue through Omlorix's existing sandbox.
• Audit plugin installation, state changes, export, and uninstall operations; clean plugin metadata and bundles during hard account deletion.

User experience

Users open Workspace → Plugins, select a plugin archive, review the server-validated manifest and compatibility warnings, and choose Install disabled. The installed plugin appears as a card with enable/disable, export, homepage, and uninstall actions. The flow includes keyboard navigation, focus management, screen-reader status updates, mobile navigation, and translations for all 11 supported locales.

Port validation

• node --test frontend/js/chat/pluginsWorkspace.test.js — 4 passed
• node --check passed for changed JavaScript files.
• Python compilation, locale JSON validation, and git diff --check passed.
• Backend pytest was not available in the isolated porting environment.

Documentation

• https://developers.openai.com/plugins/build/plugins
• https://developers.openai.com/plugins/guides/security-privacy

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}