fix(plugin-devkit): warn on every permission the matrix marks high

[GalaxyXieyu]

Summary

pi-plugin check names high-risk permissions in its permission.high-risk warning, but it used a hand-kept list of ten that had drifted from the permissions matrix. Twelve declarable grants that the matrix and the install dialog both mark high were never named: agent.complete, agent.extension, renderer.extension, provider.register, provider.oauth, desktop.control, project.create, session.read, session.import, session.delete.own, mcp.server.local, and mcp.server.remote. This PR takes the list from the matrix and adds a test that keeps the two equal.

Fixes #1463

Root cause

• HIGH_RISK_PERMISSIONS (packages/plugin-devkit/src/check.ts:22-38 on 779e16d9c) carried a comment saying it was kept in sync with PERMISSION_RISK in apps/desktop/src/features/plugins/model.ts. That file says in turn that it mirrors the risk column of docs/spec/07-plugins/13-plugin-permissions-matrix.md.
• Nothing read either copy back, so every permission added since (most recently renderer.extension in docs(plugins): document the renderer slot contract #1456, which updated the matrix and model.ts only) was missed.

Change

• HIGH_RISK_PERMISSIONS now lists exactly the matrix's high rows: the twelve above plus the legacy fs.write.workspace / fs.delete.workspace rows. The legacy names still get their existing permission.legacy-fs advice as well.
• The comment now points at the matrix.
• New test: it reads the matrix from the repository, collects every | \` | high |row, and requires the set to equalHIGH_RISK_PERMISSIONS`. A permission added to the matrix later fails the devkit test instead of drifting silently.
• The warning stays a warning. No check result changes from pass to fail, and pack is unaffected.

Out of scope, and raised as a question in #1463: the install dialog's own PERMISSION_RISK table disagrees with the matrix for ui.view, ui.window.appearance, ui.settings, session.read.own, session.update.own, and background.service. That is desktop code and is left for a separate change once the intended tiers are confirmed.

Production diff: +17 / −3 in check.ts; the rest is tests (+24) and spec text.

Specs / E2E docs

• docs/spec/07-plugins/10-plugin-devex.md (en + zh-CN): the high-risk warning is defined as "every permission the matrix marks high".
• 06-delivery/04-e2e-test-plan.md E2E-022C status (en + zh-CN) mentions the parity test.

Evidence

Tested commit 5bd79c034 (fix/devkit-high-risk-permissions), based on main 779e16d9c. pnpm check:pr-base passes. Environment: Linux x64, Node 22.23.

• New tests in packages/plugin-devkit/src/check.test.ts:
  • matrix parity: fails on 779e16d9c (10 entries vs 24 high rows) and passes with the fix;
  • a scaffolded plugin declaring desktop.control and session.read gets both names in permission.high-risk: fails on 779e16d9c (no warning at all) and passes with the fix.
• pnpm --filter @pi-desktop/plugin-devkit test: 51 passed (main: 49).
• CLI before and after, on examples/plugins/ui-slots-lab, which declares renderer.extension and agent.tool.register:

  main      warn permission.high-risk: ... agent.tool.register
  this PR   warn permission.high-risk: ... renderer.extension, agent.tool.register
  

  All three examples/plugins/* and both bundled plugins still check with 0 errors.
• pnpm build:js, pnpm --filter @pi-desktop/desktop typecheck, pnpm lint, node scripts/check-architecture.mjs, and pnpm check:agent-policy: pass.
• pnpm -r --if-present test: every package suite passes. The apps/desktop failures I see are the same on a branch without this change:
  • chat-error-message.test.mjs: a nested subtest is cancelled.
  • The *-user-path tests need an installed Electron binary, which this worktree did not have.
  • The timing-sensitive plugin-websocket / jev-api-key-check tests pass when run alone.
  • None of these files touches the devkit.
• pnpm docs:check (85 en/zh pairs, 559 pages): pass. git diff --check: clean.
• E2E: NOT RUN. The change is confined to the devkit CLI's static warning list and has no runtime surface in the app; the unit tests exercise it directly. Same reasoning as fix(plugin-devkit): reject package-relative theme assets at check time #944.

[muzimu217]

Verified locally on macOS (worktree off current main): pnpm --filter @pi-desktop/plugin-devkit exec vitest run check → 7/7 pass, including the new parity test.

The design is the right fix for #1463: instead of hand-adding the 12 missing entries and waiting for the next drift, a test now parses the permissions matrix's high rows and pins HIGH_RISK_PERMISSIONS to equal that set — the two lists can no longer diverge silently. The warning-message test covering desktop.control and session.read matches the issue's examples.

One non-blocking observation for a possible follow-up: this pins devkit ↔ matrix, but the install dialog's copy (PERMISSION_RISK in apps/desktop/src/features/plugins/model.ts) is still a separate list. Today the behavior lines up — the four matrix-high permissions the dialog doesn't enumerate (project.create, provider.register, session.delete.own, session.import) fall through its ?? "high" default — but background.service is dialog-high without a matrix high row, and nothing tests dialog ↔ matrix. A second parity test (or a one-line matrix touch-up) would close that seam too. Not blocking this PR.

Merge-order note: same two doc files as #1468 — whoever lands second rebases.

[vastsa]

Thanks for the permission-matrix reproducer and focused fix. I verified that the CLI warns for the matrix’s full set of high-risk permissions, the devkit tests pass (51/51), and the warning is visible in the CLI against the UI slots example. All required CI checks passed, and the PR merge ref matched the validated candidate tree. Merged.