docs(plugin): remove the unused TypeScript plugin package (#739)

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bobbyjohnstx

AGENTS.md

@@ -60,7 +60,7 @@ Things that break silently if you guess wrong.
 - **SQLite is pure Go (`modernc.org/sqlite`), not cgo**: No C toolchain needed. Setting `CGO_ENABLED=1` or switching to `mattn/go-sqlite3` breaks cross-compilation.
 - **Project config walks UP the directory tree**: Config files in nested directories merge with parent configs (innermost wins). Only checking the project root ignores monorepo nested configs.
 - **Plugin system is JSON-RPC over stdin/stdout**: Plugins are standalone Go binaries spawned as child processes, not HTTP services. `pkg/plugin/` is the public SDK.
-- **`packages/` is the web UI build**: Not the Go runtime. `make embed-webapp` builds `packages/app` (with `sdk`, `ui`, `plugin`, and `tinycode`). `packages/tinycode` is six helpers under `src/core/util` that the web UI imports. The old TypeScript CLI, server, session, and PTY code is gone, along with `packages/desktop`, `packages/vscode-extension`, `packages/llm`, `packages/http-recorder`, `packages/effect-drizzle-sqlite`, and `packages/script`.
+- **`packages/` is the web UI build**: Not the Go runtime. `make embed-webapp` builds `packages/app` (with `sdk`, `ui`, and `tinycode`). `packages/tinycode` is six helpers under `src/core/util` that the web UI imports. The old TypeScript CLI, server, session, and PTY code is gone, along with `packages/desktop`, `packages/vscode-extension`, `packages/llm`, `packages/http-recorder`, `packages/effect-drizzle-sqlite`, and `packages/script`.
 - **`safego.Go()` must wrap all goroutine launches**: Bare `go func()` skips panic recovery — a panic in the goroutine crashes the process with no log. `internal/safego` adds `recover()` + `slog.Error`.
 - **Plugin tool timeout is 30s, hook timeout is 5s**: `internal/plugin/manager.go` constants. Plugins that exceed these are killed. Changing them affects all plugins and shutdown timing.
 - **`config.share` defaults to `"disabled"`**: Not a working share/publish feature in Go — no `/session/{id}/share` routes; web PTY is unsupported (`PTY_SUPPORTED=false`). Do not advertise share or the in-browser terminal as working.

CLAUDE.md

@@ -62,7 +62,7 @@ Things that break silently if you guess wrong.
 - **SQLite is pure Go (`modernc.org/sqlite`), not cgo**: No C toolchain needed. Setting `CGO_ENABLED=1` or switching to `mattn/go-sqlite3` breaks cross-compilation.
 - **Project config walks UP the directory tree**: Config files in nested directories merge with parent configs (innermost wins). Only checking the project root ignores monorepo nested configs.
 - **Plugin system is JSON-RPC over stdin/stdout**: Plugins are standalone Go binaries spawned as child processes, not HTTP services. `pkg/plugin/` is the public SDK.
-- **`packages/` is the web UI build**: Not the Go runtime. `make embed-webapp` builds `packages/app` (with `sdk`, `ui`, `plugin`, and `tinycode`). `packages/tinycode` is six helpers under `src/core/util` that the web UI imports. The old TypeScript CLI, server, session, and PTY code is gone, along with `packages/desktop`, `packages/vscode-extension`, `packages/llm`, `packages/http-recorder`, `packages/effect-drizzle-sqlite`, and `packages/script`.
+- **`packages/` is the web UI build**: Not the Go runtime. `make embed-webapp` builds `packages/app` (with `sdk`, `ui`, and `tinycode`). `packages/tinycode` is six helpers under `src/core/util` that the web UI imports. The old TypeScript CLI, server, session, and PTY code is gone, along with `packages/desktop`, `packages/vscode-extension`, `packages/llm`, `packages/http-recorder`, `packages/effect-drizzle-sqlite`, and `packages/script`.
 - **`safego.Go()` must wrap all goroutine launches**: Bare `go func()` skips panic recovery — a panic in the goroutine crashes the process with no log. `internal/safego` adds `recover()` + `slog.Error`.
 - **Plugin tool timeout is 30s, hook timeout is 5s**: `internal/plugin/manager.go` constants. Plugins that exceed these are killed. Changing them affects all plugins and shutdown timing.
 - **`config.share` defaults to `"disabled"`**: Not a working share/publish feature in Go — no `/session/{id}/share` routes; web PTY is unsupported (`PTY_SUPPORTED=false`). Do not advertise share or the in-browser terminal as working.

README.md

@@ -322,7 +322,7 @@ make embed-webapp   # Embed SolidJS web app into the binary (builds from package
 make clean          # Remove build artifacts
 ```
 
-The runtime is Go only. `packages/` is legacy TypeScript kept so `make embed-webapp` can build the web UI (`app`, `sdk`, `ui`, `tinycode`, and `plugin`). See [docs/building.md](docs/building.md) and [docs/spec/README.md](docs/spec/README.md).
+The runtime is Go only. `packages/` is legacy TypeScript kept so `make embed-webapp` can build the web UI (`app`, `sdk`, `ui`, and `tinycode`). See [docs/building.md](docs/building.md) and [docs/spec/README.md](docs/spec/README.md).
 
 ## Documentation
 

docs/architecture.md

@@ -43,7 +43,7 @@ internal/
   vcs/                Git operations
 pkg/
   plugin/             Public plugin SDK (protocol, hooks, tools)
-packages/             Legacy TypeScript for the web UI (app, sdk, ui, tinycode, plugin)
+packages/             Legacy TypeScript for the web UI (app, sdk, ui, tinycode)
 ```
 
 ---

docs/building.md

@@ -14,7 +14,7 @@
 | `cmd/plugin-*/` | Optional plugin binaries (30 plugins) |
 | `internal/` | Private application code |
 | `pkg/plugin/` | Public plugin SDK |
-| `packages/` | **Legacy TypeScript** for the optional web UI (`app`, `sdk`, `ui`, `tinycode`, `plugin`). Not the Go runtime. No Electron app or VS Code extension. |
+| `packages/` | **Legacy TypeScript** for the optional web UI (`app`, `sdk`, `ui`, `tinycode`). Not the Go runtime. No Electron app or VS Code extension. |
 
 Agent and contributor guidance for Go lives in the repo root: `AGENTS.md` and `CLAUDE.md`. See [spec/README.md](spec/README.md) for a full documentation index.
 

docs/plugin-sdk-design.md

@@ -19,6 +19,8 @@ Each plugin is a standalone binary. Tinycode spawns it, communicates via JSON-RP
 
 ## TS Plugin API Audit
 
+`@tinycode/plugin` has been removed. The table is a historical audit.
+
 The TS SDK (`@tinycode/plugin` v1.20.0) has 27 hook types, but real-world usage concentrates on ~8:
 
 | Hook | Usage | Example |

docs/spec/README.md

@@ -33,7 +33,7 @@ Use this table as the current documentation index.
 | [../plugin-sdk-design.md](../plugin-sdk-design.md), [../bubbletea-tui-design.md](../bubbletea-tui-design.md) | Design notes for decisions that shipped. Keep unless you want the history gone. |
 | [../plugin-auth-audit.md](../plugin-auth-audit.md) | September 2026 auth snapshot. |
 
-**Repository layout:** The product is the Go tree (`cmd/`, `internal/`, `pkg/`). `packages/` is legacy TypeScript kept for `make embed-webapp` (`app`, `sdk`, `ui`, `tinycode`, `plugin`). It is not the runtime. The Electron app and VS Code extension are not in the repository.
+**Repository layout:** The product is the Go tree (`cmd/`, `internal/`, `pkg/`). `packages/` is legacy TypeScript kept for `make embed-webapp` (`app`, `sdk`, `ui`, `tinycode`). It is not the runtime. The Electron app and VS Code extension are not in the repository.
 
 **Authoritative HTTP surface:** Go route tables in [02-api-routes.md](02-api-routes.md) (and `internal/server/router.go`) are the source of truth for `tinycode serve`. `packages/sdk/openapi.json` is the historical TypeScript contract and overstates share/PTY/OAuth routes that are not implemented in Go.
 

package.json

@@ -91,7 +91,6 @@
     "@ai-sdk/provider": "4.0.0",
     "@ai-sdk/provider-utils": "5.0.1",
     "@playwright/test": "^1.63.0",
-    "@tinycode/plugin": "workspace:*",
     "@tinycode/sdk": "workspace:*",
     "ai": "7.0.4",
     "diff": "9.0.0",