[jondmarien]

ELI5

A plugin's sidebar panel can now read and write that plugin's own storage.* keys. The worker can leave a log snapshot in storage; the panel can poll it. No new API verbs. Other plugins' storage stays unreachable.

What Changed

• Flipped panel: true on storage.get / storage.set / storage.delete / storage.keys in PLUGIN_HOST_API_V0 (still pluginApi major 1, still scope: 'plugin-private').
• PLUGIN_PANEL_ACTIONS, the capability gate, and the panel bridge schema all derive from that flag — no second allowlist.
• Host→panel results that exceed PANEL_MESSAGE_MAX_BYTES (64 KiB) are refused with the same invalid_request as oversized inbound requests. Worker storage may still hold up to 256 KiB; the panel cannot fetch a blob that large in one call.
• settings.* stays panel: false (Orca-1). secrets.* stays panel: false.
• Docs: docs/reference/plugin-panel-storage.md — privacy, message budget, smoke-test steps.
• Tests: host-api panel surface, controller/store isolation, inbound + outbound budget, main/relay conformance (panel_forbidden case moved to secrets.get).

This branch is stablyai/orca main fast-forwarded, then the Orca-2 change. Not opened against stablyai/orca.

Why

Issue #10 Orca-2 / §2.B: panel CSP cannot fetch plugin.log, and there is no worker→panel push. Once storage.* is panel-callable, a worker-writable / panel-readable diagnostics path exists without new verbs. Alternatives (host log tail, injected bootstrap) were not needed — the storage panel flags were the right surface.

Linked Issue

Implements Orca-2 from jondmarien/orca-discord-presence#10

Does not close that issue (it tracks Orca-1…5).

Visual Proof

N/A — host API / admission change; no renderer chrome. Behavior is covered by unit + conformance tests. Smoke-test steps for a fork build are in the reference doc.

Testing

• Automated tests added/updated
• I manually tested these changes locally (no Electron GUI in this agent; smoke steps documented)

Verified on this branch:

• pnpm tc:node — pass
• pnpm test on plugin host / panel / storage / admission / conformance / bridge-host — 28 files, 209 tests pass

pnpm test src/shared/plugins \
  src/main/plugins/plugin-host \
  src/main/plugins/plugin-panel \
  src/main/plugins/plugin-storage-store.test.ts \
  src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts

Smoke-test (fork build + Hello Orca)

Hello Orca already declares storage; the worker increments pings on Hello: Ping.

1. devPluginPaths → examples/plugins/hello-orca; approve including storage.
2. Open the Hello Orca panel. In the iframe console:

parent.postMessage(
  { type: 'orca-panel-action', requestId: 's1', action: 'storage.get', params: { key: 'pings' } },
  '*'
)

3. Run Hello: Ping, repeat storage.get — count increments without remounting the tab.
4. Panel storage.set / storage.get on diagnostics.snapshot round-trips.
5. A second plugin's panel storage.get for the same key returns { value: null }.
6. secrets.get / settings.get still return panel_forbidden.

Privacy / message budget

• Session token binds pluginId. Caller-supplied pluginId is invalid_request.
• Per-plugin storage.json; no cross-plugin path.
• Panel request and result envelopes: 64 KiB / 30 messages per 10 s.
• Do not put secrets in storage.*.

Remote / SSH / mixed versions

No new RPC opcode. Old hosts still return panel_forbidden. Storage files live on the execution host. Additive inside pluginApi 1.

Out of scope

• Upstream PR to stablyai/orca (handoff later)
• Orca-1 settings.* panel flags
• Orca-3/4/5
• chron0.discord-presence plugin changes

AI Disclosure

Implemented by Cursor Grok 4.6 (cloud agent). Superpowers: brainstorm → plan → TDD. Context7 quota was exceeded; design followed in-repo host API / admission / conformance patterns plus issue #10.

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Ensure no issues in: Security, Cross-platform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance

Checklist

• This PR is small and focused
• I explained what changed and why (including ELI5)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm typecheck (node) and targeted plugin suites pass (full pnpm lint / pnpm build left to CI)