[galligan]

Context

Plugin Studio still targeted bb 0.37 / @bb/plugin-sdk while released bb is 0.43.1 and the public SDK is @get-bb/plugin-sdk. This PR adopts that released contract so authors can typecheck, build, and inspect against the current host, and so official testing / testing/app can resolve from a clean plugin install.

Closes #117. Closes #41.

What changed

• Pin @get-bb/plugin-sdk@0.4.87 (the version shipped with bb 0.43.1, not npm latest 0.4.99) and rename imports, engines, inspection, and docs off @bb/plugin-sdk.
• Record minimumBbVersion and verifiedThroughBbVersion as 0.43.1. Isolated bb 0.36.0 still typechecks and builds Studio source, but it refuses a managed install that declares engines.bbPluginSdk ^0.4.87 (running SDK is 0.4.1), so the floor was raised rather than kept as a false promise.
• Hash git source contracts (backend-contract.ts / app-contract.ts) because desktop-v0.43.1 no longer commits packages/plugin-sdk/bundled-types/.
• Resolve official harness subpaths from the selected plugin, including a clean npm install of the packed 0.4.87 tarball. Workbench preview-mode no longer hard-forces Harness unavailable once inspection reports it available. Harness remains behavioral, not visual authority.
• Drop vendored plugins/studio/types/ and ignore regenerated copies. Native bb plugin types --check uses the published npm bundled-types.

Verification

Isolated bb-app@0.43.1 with a disposable BB_DATA_DIR (daily /Applications/bb.app and ~/.bb not used as probe evidence):

• bb --version → 0.43.1
• bb plugin types --check plugins/studio pass (SDK 0.4.87)
• Studio check pass; 75 plugin tests pass
• bb plugin build stamps SDK 0.4.87 / bb 0.43.1
• inspect reports Harness available with SDK 0.4.87
• managed path-install: install, source, reload, disable, enable, reload, remove; inventory returned to 27 builtins

Isolated bb-app@0.36.0: source types/build pass; managed npm install of packaged Studio refused (requires bb plugin SDK ^0.4.87, running SDK is 0.4.1).

Repo gates on the worktree:

• bun run format:check && bun run check && bun run test && bun run build
• bun run plugin-studio:package:test
• bun run compatibility:check --json → outcome: pass
• bun run compatibility:latest --json → status: current, latestVersion: 0.43.1

Public artifact hashes (tag desktop-v0.43.1):

• theme 5505d0036def8e9c485634f7a5b59b1087d9e71ecdbce48c563dc9dc0756b81b
• registry c1148ddb7da06da32e3e35bf9398dd4989253719b37b44276f6daf48408b6eb6 (added icon-extended, icon-registry)
• backend source contract ddab6fbf2cdf31e2986ee7f6bf6ef4883af956e6391973f02cf3e6c46be6cb4d
• app source contract c9379f666852c95654c63641aebcc46a4b596f13aa1d8090b95414e00ac85aab

Local-review JSON (scratch, not committed): standing and targeted-sdk round-1 are clean with open P0–P2 = 0.

Risk and compatibility

• Support floor is now bb 0.43.1. Older hosts cannot managed-install this SDK range.

• npm latest @get-bb/plugin-sdk is 0.4.99; this PR does not pin it.

• Adopt native bb scaffold, declaration refresh, and plugin check workflows #43: native types/build/check already work on 0.43.1; CLI wrap of bb plugin new --app and a NODE_ENV=production scaffold regression are still open. This PR does not close Adopt native bb scaffold, declaration refresh, and plugin check workflows #43.

• Daily path-installed Studio in ~/.bb was not reloaded.

• I kept native bb and @get-bb/plugin-sdk authoritative for their contracts and lifecycle.

• I added or updated focused tests where behavior changed.

• I ran the smallest relevant checks and the complete applicable gate.

• I did not include credentials, customer data, authenticated state, or local absolute paths.

Made with Cursor

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T19:10:17.112462Z	6d7e89e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d7e89e49e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6d7e89e. Configure here.}