runtime visibility is genuinely underbuilt for agent workflows. most monitoring is post-hoc - you see what happened in the diff, not what the agent was doing while it was doing it. curious how the sidebar handles multiple agents running in parallel - does it aggregate by agent, by file, or by session?
the bridge worker as permission enforcement is a solid pattern - the plugin can't escalate by calling APIs directly, everything goes through the bridge. the edge case I'd be curious about is plugin-to-plugin interaction. if two plugins share state through a permitted API, does the bridge enforce granular enough boundaries there, or does the trust model flatten at that layer?