feat: user-installed provider plugins with TypeScript support (#2642)

* feat: add user-installed provider plugins

* fix: broker owns plugin HTTP representation headers

Apply broker-owned Accept, Accept-Encoding, and Content-Type after
plugin-supplied headers so a plugin cannot relax the user-plugin
response boundary. Test transport gains configurable response headers.

* build: add reproducible sucrase bundle verification script

Regenerates and verifies Sources/CodexBarCore/Resources/Plugins/
sucrase-3.35.1.min.js from the official npm artifact (sucrase@3.35.1,
esbuild@0.25.8 pinned, IIFE browser bundle). Expected SHA-256
4d997e15b72cbc9ccf6e743c30c6eb48bf4533f6709852367b40766be5eba70b was
independently reproduced by the coordinator from the npm registry;
'check' mode fails closed on any mismatch.

* fix: gate user-plugin registry lookup for non-JavaScriptCore platforms

Linux CLI builds compile CodexBarConfig without the plugin runtime;
unknown plugin config entries are dropped with the existing warning,
matching the documented macOS-only plugin boundary.

---------

Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>

Author: steipete

CHANGELOG.md

@@ -8,6 +8,7 @@
 - Sessions: discover live pi and OMP sessions through one Pi-family scanner, with dialect-aware metadata, PID-only startup rows, and mixed-version CLI/remote support (#2529). Thanks @wdmitchelluk!
 - Kimi/GLM: distinguish Kimi Code from the regional Open Platform, bind China and international keys to their issuing hosts, and show GLM Coding Plan's 5-hour window as primary with MCP separate (#2351). Thanks @Leehow!
 - Provider plugins: declarative detail rows/charts plus bundled JavaScript conversions for OpenAI, z.ai, OpenRouter, Poe, and ClawRouter behind `CODEXBAR_JS_PROVIDERS=1`.
+- Provider plugins: install local JavaScript or TypeScript providers with manifest-driven settings and generic menu cards, approval-bound network/cookie access, and sandboxed Sucrase transpilation.
 
 ### Changed
 - Menu: move each usage window's used percentage and reset time into its title row, with all pace detail on one line (#2182). Thanks @jack24254029!

Scripts/regenerate-sucrase-bundle.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Reproducibly regenerates Sources/CodexBarCore/Resources/Plugins/sucrase-3.35.1.min.js
+# from the official npm artifact. The vendored bundle MUST match EXPECTED_SHA256;
+# review of the minified blob is by reproduction, not by reading.
+set -euo pipefail
+
+SUCRASE_VERSION="3.35.1"
+ESBUILD_VERSION="0.25.8"
+EXPECTED_SHA256="4d997e15b72cbc9ccf6e743c30c6eb48bf4533f6709852367b40766be5eba70b"
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUTPUT_FILE="${ROOT_DIR}/Sources/CodexBarCore/Resources/Plugins/sucrase-${SUCRASE_VERSION}.min.js"
+MODE="${1:-check}"
+
+WORK_DIR="$(mktemp -d /tmp/codexbar-sucrase-regen.XXXXXX)"
+trap 'rm -rf "$WORK_DIR"' EXIT
+cd "$WORK_DIR"
+
+npm init -y >/dev/null 2>&1
+npm install --ignore-scripts --no-audit --no-fund "sucrase@${SUCRASE_VERSION}" >/dev/null
+npx --yes "esbuild@${ESBUILD_VERSION}" node_modules/sucrase/dist/index.js \
+  --bundle --minify --platform=browser --format=iife --global-name=sucrase \
+  --banner:js="/*! Sucrase v${SUCRASE_VERSION} | MIT License | Copyright (c) 2012-present various contributors | https://github.com/alangpierce/sucrase */" \
+  --outfile="${WORK_DIR}/sucrase.min.js" >/dev/null 2>&1
+
+ACTUAL_SHA256="$(shasum -a 256 "${WORK_DIR}/sucrase.min.js" | awk '{print $1}')"
+if [[ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]]; then
+  echo "error: reproduced bundle hash ${ACTUAL_SHA256} does not match expected ${EXPECTED_SHA256}" >&2
+  echo "If the version or esbuild pin changed intentionally, update EXPECTED_SHA256." >&2
+  exit 1
+fi
+
+case "$MODE" in
+  check | --check)
+    VENDORED_SHA256="$(shasum -a 256 "$OUTPUT_FILE" | awk '{print $1}')"
+    if [[ "$VENDORED_SHA256" != "$EXPECTED_SHA256" ]]; then
+      echo "error: vendored bundle ${VENDORED_SHA256} does not match reproducible build ${EXPECTED_SHA256}" >&2
+      exit 1
+    fi
+    echo "ok: vendored sucrase bundle matches reproducible build (${EXPECTED_SHA256})"
+    ;;
+  write | --write)
+    cp "${WORK_DIR}/sucrase.min.js" "$OUTPUT_FILE"
+    echo "wrote ${OUTPUT_FILE} (${EXPECTED_SHA256})"
+    ;;
+  *)
+    echo "Usage: $0 [check|write]" >&2
+    exit 2
+    ;;
+esac