Plugin architecture

PathTogether provides the host, data and authorization; a plugin receives only the capabilities required for the current task. HistoPilot is the first complete AI plugin, but the contract does not bind the platform to it.

What a PathTogether plugin is

A runnable plugin has three pieces: a manifest describing identity, versions and permissions; a UI bundle running in a sandboxed iframe; and, when needed, an independently deployed backend service. PathTogether owns installations, source checks, grants and capability APIs. It does not provide a plugin marketplace.

Two communication channels

HostBridge for browser-side viewer collaboration. The iframe uses validated request, response and event messages to inspect the viewport, request navigation, obtain a short-lived UI session or synchronize annotation changes. It cannot access the platform DOM, OpenSeadragon instance or global variables directly.

Plugin Contract for server-side capabilities. A plugin backend uses the versioned /api/plugin/v1 surface to discover capabilities, read authorized slide metadata or regions, receive events and create annotations. Tokens are short-lived and scoped to an installation, user, slide and method; the platform still rechecks current database authorization.

┌ PathTogether Web ─────────────────────────────┐
│ viewer / annotations / sharing               │
│      ↕ HostBridge                            │
│ HistoPilot UI (sandbox iframe)                │
└──────────────────────┬────────────────────────┘
                       │ same-origin gateway
┌ PathTogether API ────┴────────────────────────┐
│ auth / slide / region / annotation / events  │
└──────────────────────┬────────────────────────┘
                       │ /api/plugin/v1 + scoped token
                HistoPilot service

Who owns what

PathTogether: users, projects, slides and asset revisions, annotations, comments, shares, permissions, plugin installations and activity history;
HistoPilot: model configuration, AI sessions, messages and events, compaction, visual working sets and caches;
Accepted AI annotations: stored in PathTogether with plugin, run, model and creator provenance;
Never shared: database tables, WSI file paths, platform globals or long-lived service credentials.

Install, run and disable

An owner installs and approves the manifest and UI bundle;
The platform creates a rotatable installation credential and grants minimal permissions;
A user opens the plugin panel and establishes short-lived authorization for the task;
The backend reads regions or writes annotations only within that scope;
Disabling the installation stops new token exchanges and subsequent capability calls immediately, while manual work continues.

HistoPilot-DSH is outside this plugin chain

HistoPilot-DSH is a tool adapter for DeepSeek Harness and sits upstream of HistoPilot. It calls HistoPilot's high-level task API; it is not installed into PathTogether and does not use the PathTogether viewer HostBridge directly.