Qiyuanqiii · Oct 7, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 7, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -689,7 +689,8 @@ jobs:
               CYBERAGENT_UI_EVIDENCE_SMOKE = "1"
               GITHUB_ACTIONS = "true"
               GIT_CONFIG_COUNT = "1"
-              GIT_CONFIG_GLOBAL = "NUL"
+              # Git for Windows 2.56/UCRT requires lowercase nul here.
+              GIT_CONFIG_GLOBAL = "nul"
               GIT_CONFIG_KEY_0 = "safe.directory"
               GIT_CONFIG_NOSYSTEM = "1"
               GIT_CONFIG_VALUE_0 = $env:GITHUB_WORKSPACE

diff --git a/docs/PROJECT_MEMORY.md b/docs/PROJECT_MEMORY.md
@@ -1,5 +1,12 @@
 # Prayu Project Memory
 
+> 2026-10-07 extension onboarding checkpoint (#276): shared Web/Desktop settings
+> stage manual MCP descriptors, import pinned Plugin ZIPs and stage/review LSP
+> configuration through Go-owned services. Backend capability flags, source/scope,
+> explicit review and actual call evidence remain distinct. LSP uses a stable
+> manager and the existing reviewed configuration format; MCP calls retain the
+> normal task and approval path. See [ADR 0168](adr/0168-extension-first-onboarding.md).
+
 > 2026-10-07 task-list checkpoint (#272): title search filters the complete matching
 > task set before stable creation-keyset pagination. A bounded Go-owned execution
 > observation travels with each list item; uncertain ownership/read failures stay

diff --git a/docs/adr/0168-extension-first-onboarding.md b/docs/adr/0168-extension-first-onboarding.md
@@ -0,0 +1,89 @@
+# ADR 0168: Operator extension onboarding through the shared control plane
+
+Status: accepted for issue #276 implementation.
+
+## Context
+
+The extension settings page could inspect and disable existing MCP servers and
+Plugins, and inspect reviewed LSP servers, but first use required leaving the
+product to prepare CLI state. Registration, review, capability discovery and a
+successful call are separate facts and must remain distinguishable in the UI.
+
+## Decision
+
+Add bounded, control-authenticated HTTP adapters to the existing Go services.
+Web and Desktop share these routes, generated OpenAPI types and settings forms.
+The extension inventory reports the entry points implemented by this process as
+`onboarding.mcp_registration`, `plugin_import` and `lsp_configuration`; a missing
+capability object in an older backend leaves the new controls unavailable.
+These booleans describe available operator actions, not execution authority.
+
+- MCP registration accepts a manual descriptor bound to an existing Workspace
+  or Run. The host assigns provenance; callers cannot impersonate an acquired
+  Plugin source. The existing durable staging operation retains descriptor
+  identity and replay behavior. Discovery approval, bounded discovery and exact
+  capability-fingerprint approval remain separate actions.
+- Plugin import accepts a ZIP of at most the existing 4 MiB archive limit plus
+  its SHA-256. The existing package service validates and stages the archive;
+  upload provenance identifies its content digest. Import does not approve or
+  activate any contribution. Unsigned package review retains explicit untrusted
+  confirmation, and enablement selects the reviewed capabilities.
+- LSP configuration stages an operator-authored descriptor for a registered
+  Workspace, including executable path and hash, arguments, language mappings
+  and bounded initialization options. Staging is inert. A separate fingerprint-
+  bound review persists the existing `code-intel-config.v1` format with host
+  review metadata. Default Web/Desktop startup reloads the managed configuration;
+  an explicitly selected configuration retains its startup precedence and is
+  read-only in settings. Editing that mode continues through the selected file
+  and CLI, avoiding a successful save into a different file that startup ignores.
+
+Workspace-only extension inventory supports setup before a Run exists. Supplying
+both a Run and Workspace requires their exact persisted relationship. Plugin
+installation remains host-scoped, and Run call audits do not leak into another
+Workspace selection. Existing CLI staging, import, review and LSP qualification
+commands remain supported.
+
+## Runtime and evidence
+
+LSP keeps one stable Go manager shared with AgentRunner and Tool Gateway. An empty
+manager starts no server and advertises no tools. Publishing reviewed configuration
+uses the manager's process ownership boundary, closes previous owned clients and
+invalidates stale query results. Persistence failure leaves the active
+configuration intact. Incomplete cleanup is an explicit unavailable state, not a
+successful activation; process ownership remains with the manager for shutdown.
+Review itself never initializes the replacement servers.
+
+Managed-file publication takes a nonblocking OS file lock before comparing the
+previous content digest and atomically replacing the file. Competing processes
+return a conflict instead of overwriting a review. The empty sidecar remains on
+disk, but the lock belongs to an open handle and is released on process exit;
+restart never needs to infer ownership from a stale PID or delete a lock marker.
+
+The explicit LSP test action rechecks the reviewed descriptor and executable
+binding, initializes only the selected server and runs a bounded read-only symbol
+query. Its response preserves Workspace, server, generation, capability, query
+and document provenance. It does not expose executable paths, arguments,
+environment, private roots or raw process output. The existing model-facing LSP
+tools continue to use their Code-surface and Workspace-read authority checks.
+
+MCP invocation continues through an ordinary task and the existing Supervisor,
+Approval and Tool Gateway path. Settings may draft that request for the operator,
+and read the durable call status, result byte count and error code afterward.
+No settings endpoint bypasses call approval or treats discovery as execution.
+Plugin enablement identifies available contributions; it is not an execution
+receipt. UI success messages name the completed step rather than claiming general
+extension readiness. Failed form submissions retain the operator's input.
+
+## Verification and rollback
+
+Use the existing MCP peer and LSP process fixtures for first setup, metadata read,
+explicit review and an actual result. Exercise registration/import replay,
+Workspace mismatch, strict input bounds, fingerprint drift, failed configuration
+publication, process cleanup, restart and unchanged CLI behavior. Generated API
+contracts, frontend interaction tests and applicable existing CI remain the gates;
+this change adds no duplicate full-suite gate or SQLite migration.
+
+Rollback removes the additive adapters and presentation while leaving MCP and
+Plugin ledger rows and the existing reviewed LSP configuration format readable by
+their CLI services. It never fabricates reviews, rewrites old protocol checksums
+or transfers process ownership to the renderer.
diff --git a/docs/architecture.md b/docs/architecture.md
@@ -141,6 +141,16 @@ explicit and outside the default bundle. See [ADR 0137](adr/0137-direct-safe-fir
 
 `code-intel-lsp.v1` adds one more Go-owned process boundary without changing that direction. An explicitly reviewed local language server communicates only through bounded stdio JSON-RPC. Go owns qualification, executable hashing, minimal environment, initialize/document synchronization, timeout/cancellation, restart, and process-tree cleanup; Tool Gateway reuses the exact `agent-code-tools.v1` Workspace-read authority. Server output is untrusted evidence and every returned URI is resolved again below the Workspace root. Capability inventory is process-local and metadata-only, so this feature adds no SQLite migration and no renderer-owned authority. The configured Server remains a real local process rather than an OS sandbox; see [Code Intelligence](code-intelligence.md).
 
+Extension onboarding adds control-authenticated adapters to those existing
+services: inert manual MCP registration, content-pinned Plugin ZIP import and
+staged LSP configuration with a separate fingerprint-bound review. Web/Desktop
+read the same process-local onboarding capabilities and safe source/scope/review
+metadata. LSP keeps one stable manager shared by HTTP and model tools and persists
+the existing operator configuration format; explicit testing returns a real
+bounded semantic query result. MCP invocation remains in the ordinary task and
+Approval path, with durable call metadata read back by settings. See
+[ADR 0168](adr/0168-extension-first-onboarding.md).
+
 The production React bundle is built by Vite but hosted only when Go receives an explicit `--ui-dir`. Go validates and snapshots the static tree before serving it from the same loopback origin as `api.v1`; `/api` remains a reserved authenticated namespace. Vite's loopback proxy is a development adapter, not a second control plane.
 
 ## Core Domain

diff --git a/docs/code-intelligence.md b/docs/code-intelligence.md
@@ -128,9 +128,21 @@ GET /api/v1/code-intel
 GET /api/v1/code-intel?workspace_id=<registered-workspace-id>
 ```
 
-响应只投影 source label/hash、语言、health、Server version、capabilities、model-visible tools、generation、capability fingerprint、有界错误和资格布尔值。它从不返回 executable、argv、环境变量、凭证、原始 Server 日志或 Workspace 内容。`GET /api/v1/capabilities` 的 `code_intel_enabled` 只说明当前进程加载了显式配置，不是模型调用授权。
+响应只投影 source label/hash、语言、health、Server version、capabilities、model-visible tools、generation、capability fingerprint、有界错误、资格布尔值与待审查/已审查配置元数据。它从不返回 executable、argv、环境变量、凭证、原始 Server 日志或 Workspace 内容。`GET /api/v1/capabilities` 的 `code_intel_enabled` 只说明当前进程提供 Go 运行时；空配置、已审查配置与实际查询成功仍是不同状态，也不授予模型调用权限。
 
-Desktop 设置页使用同一 API 显示 Server 和资格状态，不增加原生进程旁路。模型工具仍由每轮 Supervisor 使用当前 Run 和 Workspace 重新生成。
+Web/Desktop 设置页使用同一 API 显示 Server 和资格状态。未显式指定配置文件的进程还可在设置页完成首次配置：
+
+```text
+POST /api/v1/code-intel/configurations
+POST /api/v1/code-intel/configurations/{server_id}/review
+POST /api/v1/code-intel/configurations/{server_id}/test
+```
+
+这三个入口需要 Control Bearer 和现有扩展控制开关。先登记已安装程序的描述符和 SHA-256，Go 保存当前进程内的待审查草稿；按指纹明确审查后，才以现有 `code-intel-config.v1` 格式保存到应用 home 的 `code-intel.json`。默认 Web/Desktop 下次启动加载这个文件。保存不启动服务器，后续测试操作才初始化所选服务器并执行一次只读文件符号或工作区符号查询，返回有界结果、来源与截断状态。
+
+若通过参数或环境选择了显式配置，设置页保留状态读取但不提供配置写入；继续编辑所选文件并使用原 CLI 流程，或不指定该文件重启后使用设置管理。`extensions` inventory 的 `onboarding.lsp_configuration` 表示当前进程是否支持设置管理，旧后端缺少此字段时不开放操作。失败保留输入；可执行文件不可用或哈希变化需修正后重新登记、审查。待审查草稿不跨进程恢复。
+
+模型工具仍由每轮 Supervisor 使用当前 Run 和 Workspace 重新生成，复用同一个 Go manager 和原有权限检查。操作者测试不会给模型新增能力或写入权限。
 
 传入 `workspace_id` 时，Server inventory 与资格均只返回该精确 Workspace；未选择 Run 时 Desktop 才显示进程级全局 inventory。
 

diff --git a/docs/convergence/protocol-registry.md b/docs/convergence/protocol-registry.md
@@ -22,8 +22,8 @@ This document is generated from [`protocols/registry.json`](../../protocols/regi
 | [desktop-web-presentation-state](#desktop-web-presentation-state) | `projection` | Desktop and React workbench maintainers | 14 | true |
 | [docker-attach-process-session](#docker-attach-process-session) | `ephemeral` | Docker runtime transport maintainers | 1 | false |
 | [exported-evidence-and-handoff](#exported-evidence-and-handoff) | `external-durable` | Evidence, verification, report, and handoff maintainers | 35 | true |
-| [extension-package-contracts](#extension-package-contracts) | `external-durable` | Skill, Plugin, Hook, and extension maintainers | 47 | true |
-| [http-openapi-contract](#http-openapi-contract) | `external-durable` | HTTP/OpenAPI and generated-client maintainers | 113 | true |
+| [extension-package-contracts](#extension-package-contracts) | `external-durable` | Skill, Plugin, Hook, and extension maintainers | 48 | true |
+| [http-openapi-contract](#http-openapi-contract) | `external-durable` | HTTP/OpenAPI and generated-client maintainers | 114 | true |
 | [in-memory-token-session](#in-memory-token-session) | `ephemeral` | Credential and bootstrap maintainers | 1 | false |
 | [lsp-process-session](#lsp-process-session) | `ephemeral` | Code intelligence maintainers | 1 | false |
 | [mcp-interchange](#mcp-interchange) | `external-durable` | MCP client/server maintainers | 6 | true |
@@ -808,11 +808,12 @@ This document is generated from [`protocols/registry.json`](../../protocols/regi
   - `extension-package-contracts-reader` (`v1, v2`, active) at `internal/skills`
   - `plugin-installation-reader` (`v1, v2`, active) at `internal/plugins`
 
-<details><summary>47 active identifiers</summary>
+<details><summary>48 active identifiers</summary>
 
 - `agent-package-snapshot.v1`
 - `extension-control.v1`
 - `extension-inventory.v1`
+- `extension-onboarding.v1`
 - `external_skill_context.v1`
 - `external_skill_guidance.v1`
 - `external_skill_selection.v1`
@@ -873,7 +874,7 @@ This document is generated from [`protocols/registry.json`](../../protocols/regi
 - Readers:
   - `http-openapi-contract-reader` (`v0, v1, v2`, active) at `web/src/api`
 
-<details><summary>113 active identifiers</summary>
+<details><summary>114 active identifiers</summary>
 
 - `agent-code-tools.v1`
 - `agent_browser_close.v1`
@@ -886,6 +887,7 @@ This document is generated from [`protocols/registry.json`](../../protocols/regi
 - `browser_cdp_permission_policy.v1`
 - `browser_network_containment_policy.v2`
 - `browser_safe_web_readiness.v1`
+- `code-intel-configuration.v1`
 - `code-intel-lsp.v1`
 - `code_handoff.v1`
 - `command-runtime.v2`