Module plugin_manager 

Window-scoped plugin host over the script runtime.

PluginHost owns its own ScriptManager instance — the same registry type the per-tab script system uses, kept entirely separate so a plugin can never be confused with a tab script. Discovery, per-kind process lifecycle (one supervised process per declared kind, design D5), restart supervision (manifest-declared mode — on_failure default, never, always — under the host-owned delay and crash-loop cap), action invocation, and the SetWidget text map all live here.

Land-disabled is structural (design D3): PluginHost::apply_enabled receives only the enabled set, and discovery never spawns anything by itself — a newly dropped-in plugin cannot run until the Settings layer says so.

Structs

EnabledPlugin

One plugin the host should be running (Task 4 maps config state to this).

PluginActionRow

One command-palette entry contributed by an enabled action plugin.

PluginCrashCap

A plugin whose supervisor gave up: the entry crash-looped past crate::restart::MAX_RESTART_ATTEMPTS inside the grace window (or the initial-spawn attempts did). Surfaced by the frontend as a crash-triage offer — same consent surface as a crashed pane.

PluginHost

Window-scoped plugin host: discovery cache, running processes, restart supervision, and the last SetWidget text per plugin.

WarnOnce

Deduplicates a repeating fault warning to once per condition episode.