Unify plugin app slot resolution and replacement hosts

[ymichael]

Summary

• centralize plugin app registrations in one collector and resolve them through typed append, customize, and replacement helpers
• route existing composer, panel-action, pending-interaction, message-directive, sidebar, and file-opener consumers through that foundation
• automatically activate replacement providers while retaining per-client Automatic, Built-in, and explicit-provider controls
• let sidebar and file-opener replacements conditionally render BB's instance-bound original component, with crash-safe fallback
• add Alpha and Beta diagnostic plugins for live replacement precedence, delegation, settings, disable, and crash testing

User-facing changes

• installing a thread-list or file-opener replacement makes it active automatically when the client is set to Automatic
• Appearance and File opener settings remain available for choosing Built-in or pinning a specific provider
• crashing replacement components fall back to BB's renderer instead of leaving the surface unavailable

Testing

• pnpm exec turbo run typecheck --filter=@bb/app --filter=@get-bb/plugin-sdk --filter=@bb/templates --filter=bb-plugin-replacement-lab-alpha --filter=bb-plugin-replacement-lab-beta
• pnpm exec turbo run test --filter=@bb/app --force — 351 files, 2,787 tests passed
• live-tested both diagnostic plugins in an isolated development instance and compared them against an origin/main instance

AGENT GENERATED: by GPT-5.6 Codex

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

I am reviewing this pull request now. It changes how BB finds and displays plugin UI slots and replacement components.

I will check security, code quality, architecture, performance, and the main replacement flow.

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

Plain-English summary

This PR gives BB one common system for plugin UI slots. It also lets plugins replace thread lists and file previews.

The shared collector removes duplicate policy code. The automatic selection and crash fallback flows work in the real app.

Findings

1. High — The sidebar owner remounts during search updates.

   OriginalThreadList changes its React component identity when the query or active index changes. React then remounts the complete ProjectList.

   This action resets local state and repeats expensive sidebar work. Keep the proxy type stable and add a mount-count test.

2. High — The file-opener owner fallback loses preview context.

   The plugin tab stores only the path and source. The owner fallback then clears line ranges and omits native preview actions.

   A delegated line link opens at the file start. A plugin crash also removes link routing, editor actions, and selection actions.

   Preserve the complete owner request or bind the real owner renderer. Test workspace, host, and thread-storage sources.

3. Medium — The plugin SDK test suite fails.

   The package adds ./internal/plugin-app-collector, but the exact export-list test does not include it.

   The SDK result was 93 passed and one failed. Add the new subpath to package-exports.test.ts.

Security and architecture

I found no additional security issue. Automatic plugin activation matches the stated product choice.

The main refactor removes duplicated slot policy. The Alpha and Beta diagnostic applications still share almost identical code.

A later cleanup can remove the legacy composer re-export and the unused message-directive resolver. These items do not block this change.

Validation

• All five requested type-check targets passed.
• Browser checks passed automatic Alpha selection, owner embedding, crash fallback, and live Beta fallback.
• The Markdown opener passed owner embedding and crash fallback checks.
• The full app suite had 2,784 passing tests and three failures.
• The changed prompt-box failure passed when run alone.
• The other two app failures occur in files outside this change.
• The final GPT-5.6 review gate confirmed these three findings.

I used a comment review only. I did not approve this pull request or request changes through GitHub.