🤖 feat: Agent Plugins install/update UX (managed installs, v1)

docs/agents/agent-skills.mdx

@@ -65,6 +65,8 @@ Enable the **Agent Plugins** experiment (Settings → Experiments) to also disco
 
 Plugin skills have the lowest precedence within their scope and are read-only. A broken plugin (or a broken skill inside one) never affects other plugins or skills. Plugins can also ship MCP servers; see [MCP servers](/config/mcp-servers#agent-plugins-servers-experiment).
 
+Global plugins can be installed from git via **Settings → Plugins** (paste a git URL or `owner/repo[@ref]`); the install preview lists every skill the plugin would contribute before anything is written.
+
 ## Skill layout
 
 A skill is a directory named after the skill:

docs/config/mcp-servers.mdx

@@ -62,6 +62,8 @@ With the **Agent Plugins** experiment enabled (Settings → Experiments), MCP se
 
 Stdio plugin servers launch with the spec's `PLUGIN_ROOT` and `PLUGIN_DATA` environment variables; per-plugin data directories live under `~/.xum/plugin-data/`.
 
+**Settings → Plugins** installs plugins from git into `~/.xum/plugins` (paste a git URL or `owner/repo[@ref]`); the exact location derives from the active Xum home (a legacy `~/.mux` home keeps working) and is shown in the section. Before anything is written, a consent preview lists the plugin's manifest, every skill, and every MCP server command line. Installs are pinned to the resolved commit; update checks compare the tracked branch or tag against the pinned commit and never auto-apply. Applying an update replaces the plugin directory wholesale — local edits to a managed plugin directory are discarded — and restarts that plugin's running MCP servers. Uninstalling removes the directory, the registry entry, and the plugin's per-workspace server overrides, but keeps `~/.xum/plugin-data/` unless you opt in to deleting it.
+
 ## Behavior
 
 - **Hot reload** — Config changes apply on your next message (no restart needed)

src/browser/App.tsx

@@ -217,6 +217,7 @@ function AppInner() {
 
   const [isMultiProjectWorkspaceModalOpen, setMultiProjectWorkspaceModalOpen] = useState(false);
   const multiProjectWorkspacesEnabled = useExperimentValue(EXPERIMENT_IDS.MULTI_PROJECT_WORKSPACES);
+  const agentPluginsEnabled = useExperimentValue(EXPERIMENT_IDS.AGENT_PLUGINS);
 
   // Left sidebar is drag-resizable (mirrors RightSidebar). Width is persisted globally;
   // collapse remains a separate toggle and the drag handle is hidden in mobile-touch overlay mode.
@@ -993,6 +994,7 @@ function AppInner() {
     onStartWorkspaceCreation: openNewWorkspaceFromPalette,
     onStartMultiProjectWorkspaceCreation: openNewMultiProjectWorkspaceFromPalette,
     multiProjectWorkspacesEnabled,
+    agentPluginsEnabled,
     onArchiveMergedWorkspacesInProject: archiveMergedWorkspacesInProjectFromPalette,
     getBranchesForProject,
     onSelectWorkspace: selectWorkspaceFromPalette,

src/browser/components/WorkspaceMCPModal/WorkspaceMCPModal.tsx

@@ -34,6 +34,10 @@ export const WorkspaceMCPModal: React.FC<WorkspaceMCPModalProps> = ({
   // State for project servers and workspace overrides
   const [servers, setServers] = useState<Record<string, MCPServerInfo>>({});
   const [overrides, setOverrides] = useState<WorkspaceMCPOverrides>({});
+  // Revision of the loaded overrides snapshot. Saves pass it back so the
+  // backend can reject stale snapshots (e.g. after a plugin uninstall pruned
+  // this workspace's plugin: keys while the dialog was open).
+  const [overridesRevision, setOverridesRevision] = useState<string | null>(null);
   const [loadingTools, setLoadingTools] = useState<Record<string, boolean>>({});
   const [loading, setLoading] = useState(false);
   const [saving, setSaving] = useState(false);
@@ -66,7 +70,8 @@ export const WorkspaceMCPModal: React.FC<WorkspaceMCPModalProps> = ({
           api.workspace.mcp.get({ workspaceId }),
         ]);
         setServers(projectServers ?? {});
-        setOverrides(workspaceOverrides ?? {});
+        setOverrides(workspaceOverrides.overrides ?? {});
+        setOverridesRevision(workspaceOverrides.revision);
       } catch (err) {
         setError(err instanceof Error ? err.message : "Failed to load MCP configuration");
       } finally {
@@ -235,11 +240,15 @@ export const WorkspaceMCPModal: React.FC<WorkspaceMCPModalProps> = ({
 
   // Save overrides
   const handleSave = useCallback(async () => {
-    if (!api) return;
+    if (!api || overridesRevision === null) return;
     setSaving(true);
     setError(null);
     try {
-      const result = await api.workspace.mcp.set({ workspaceId, overrides });
+      const result = await api.workspace.mcp.set({
+        workspaceId,
+        overrides,
+        expectedRevision: overridesRevision,
+      });
       if (!result.success) {
         setError(result.error);
       } else {
@@ -250,7 +259,7 @@ export const WorkspaceMCPModal: React.FC<WorkspaceMCPModalProps> = ({
     } finally {
       setSaving(false);
     }
-  }, [api, workspaceId, overrides, onOpenChange]);
+  }, [api, workspaceId, overrides, overridesRevision, onOpenChange]);
 
   const serverEntries = Object.entries(servers);