Improve plugins

master-todo.md

@@ -4,6 +4,32 @@ Living list. Newest decisions first. Check items off in the same change that lan
 
 ## Now
 
+### Plugin factory: staged workflow (reliability) — creation first
+
+**Goal:** Most reliable, repeatable create path so users struggle less. Workflow is the only orchestrator; every gate is host-enforced.
+
+**Create stages (do this next):**
+1. Validate input
+2. Fetch Agent Plugin spec from live published URL (https://agent-plugins.org/specification); disclaimer that the latest published version always preferred over any cached/bundled copy
+3. Fetch vendor/inbox docs (connectors) — same force-read pattern as today
+4. Builder draft
+5. Host package checks (SKILL.md, manifest, hash rules)
+6. Compile/trial
+7. Independent reviewer
+8. Promote or retry with structured feedback (attempt budget is workflow policy)
+
+Progressive disclosure stays for chat use; builder gets goal + forced summaries + prior feedback only.
+
+**Edit — deferred until create stages are correct:**
+- Today Plugins **Update**/`beginEdit` still starts `pluginFactoryCreate` (create-with-edit-prompt). Wire kind `pluginFactoryEdit` exists but is unused.
+- After create pipeline is solid: integrate edit into the **same** staged workflow (load prior release, ship new version). Do not leave edit on the older glued create path.
+
+- [x] Host force-fetch Agent Plugin spec before builder (prefer live latest; bundled fallback).
+- [x] Clearer create workflow stages (`validate` → `spec` → `docs` → `builder`/`review`/`trial` → `promote`) + stage-mapped failures.
+- [ ] Further split builder/review/trial into separate workflow tool steps (still one `plugin_factory_build` today; progress stages already map).
+- [ ] Structured retry feedback packet surfaced as first-class workflow events (session already retries inside the tool).
+- [ ] **Later:** real `pluginFactoryEdit` on the same staged pipeline.
+
 ### Messaging tabs vs Slack reply threads (locked)
 
 - **Conversations** (Slack channels/DMs the bot is in) are **tabs**. Show every discovered conversation. Only the selected tab loads the 100-message window.

packages/DBRepository/Sources/DBRepository/DBRepositoryAgents.swift

@@ -88,6 +88,16 @@ public extension DBRepository {
         }
     }
 
+    func deleteChatSession(applicationName: String, sessionID: String) throws {
+        try withDatabaseHandle { handle in
+            try Self.execute("""
+            DELETE FROM chat_sessions
+            WHERE application_name = \(quoted(applicationName))
+              AND session_id = \(quoted(sessionID));
+            """, on: handle)
+        }
+    }
+
     // MARK: - Agents
 
     func upsertAgentRecord(_ record: AgentRecord, applicationName: String) throws {

packages/DBRepository/Sources/DBRepository/DBRepositoryPluginFactory.swift

@@ -172,17 +172,26 @@ public extension DBRepository {
     }
 
     func deletePluginFactoryRelease(pluginID: String, version: String? = nil) throws {
-        let versionClause = version.map {
-            " AND version = \(quoted($0))"
-        } ?? ""
+        _ = try purgePlugin(pluginID: pluginID, version: version)
+    }
+
+    /// Replaces an existing version in place after a manual package edit.
+    /// The content hash must match the edited package files.
+    func replacePluginFactoryRelease(_ release: PluginFactoryRelease) throws {
+        guard release.verifyIntegrity() else {
+            throw DBRepositoryError.sqliteOperationFailed("Refusing to store a release with an invalid content hash.")
+        }
+        // Version-only row replace — do not cascade associated plugin data.
         try withDatabaseHandle { handle in
             try Self.execute(
                 """
                 DELETE FROM plugin_factory_releases
-                WHERE plugin_id = \(quoted(pluginID))\(versionClause);
+                WHERE plugin_id = \(quoted(release.pluginID))
+                  AND version = \(quoted(release.version));
                 """,
                 on: handle
             )
         }
+        try savePluginFactoryRelease(release)
     }
 }