fix(plugins): draft metadata survives a remount, plugin commands follow the composer lock

Draft metadata was component state while the prompt lived in the draft store, so a composer that
remounted across the compact breakpoint kept its text and lost the plugin's choices. It now lives
in the draft store beside the prompt, is cleared when the draft is sent, and is not cleared when
the prompt is emptied. It is not persisted across app restarts.

While the New workspace composer is creating the agent, the built-in controls are disabled but
plugin controls and commands were not. They read the composer's own lock: Paseo controls render
disabled, and setPrompt, insertText and the agent commands refuse.

The options and metadata a plugin reads are frozen copies, through the same helper the timeline
projection uses. The composer control test mounted components in JSDOM, which the testing rules
ban; it now runs in the browser project.

packages/app/src/plugins/composer-items/model.test.ts

@@ -59,10 +59,11 @@ const issue = {
   resourceType: "issue",
 };
 
-function fakeAgent(context: ComposerAgent["context"]) {
+function fakeAgent(context: ComposerAgent["context"], locked = false) {
   const calls: string[] = [];
   const agent: ComposerAgent = {
     context,
+    locked,
     provider: "claude",
     model: "sonnet",
     mode: "default",
@@ -84,9 +85,10 @@ function fakeAgent(context: ComposerAgent["context"]) {
   return { agent, calls };
 }
 
-function fakeInput(initial: UserComposerAttachment[] = []) {
+function fakeInput(initial: UserComposerAttachment[] = [], locked = false) {
   const state = { text: "", attachments: initial };
   const input: ComposerInput = {
+    locked,
     textSource: { getSnapshot: () => state.text, subscribe: () => () => {} },
     setText: (text) => {
       state.text = text;
@@ -189,6 +191,46 @@ describe("toPluginComposer", () => {
     expect(state.text).toBe("ab");
   });
 
+  it("refuses every prompt and agent command while the composer is locked", async () => {
+    const { agent, calls } = fakeAgent("new-workspace", true);
+    const { input, state } = fakeInput([], true);
+    const composer = toPluginComposer({
+      plugin: installed(),
+      agent,
+      composerInput: input,
+      prompt: "",
+    });
+
+    expect(() => composer.setPrompt("a")).toThrow("The composer is locked");
+    expect(() => composer.insertText("b")).toThrow("The composer is locked");
+    await expect(composer.setProvider("codex")).rejects.toThrow("The composer is locked");
+    await expect(composer.setModel("gpt")).rejects.toThrow("The composer is locked");
+    await expect(composer.setMode("plan")).rejects.toThrow("The composer is locked");
+    await expect(composer.setThinking("high")).rejects.toThrow("The composer is locked");
+    await expect(composer.setOptions({ effort: "low" })).rejects.toThrow("The composer is locked");
+    await expect(composer.setMetadata({ flag: null })).rejects.toThrow("The composer is locked");
+    expect(state.text).toBe("");
+    expect(calls).toEqual([]);
+  });
+
+  it("hands out options and metadata a plugin cannot change", () => {
+    const { agent } = fakeAgent("draft");
+    agent.metadata = { nested: { list: [1] } };
+    const { input } = fakeInput();
+    const composer = toPluginComposer({
+      plugin: installed(),
+      agent,
+      composerInput: input,
+      prompt: "",
+    });
+
+    expect(Object.isFrozen(composer.agent.options)).toBe(true);
+    expect(Object.isFrozen(composer.agent.metadata)).toBe(true);
+    expect(Object.isFrozen((composer.agent.metadata as { nested: object }).nested)).toBe(true);
+    expect(agent.metadata).toEqual({ nested: { list: [1] } });
+    expect(Object.isFrozen(agent.metadata)).toBe(false);
+  });
+
   it("adds and removes the plugin's own attachments only", () => {
     const { agent } = fakeAgent("agent");
     const other: UserComposerAttachment = {

packages/app/src/plugins/composer-items/model.ts

@@ -4,6 +4,7 @@ import type { UserComposerAttachment } from "@/attachments/types";
 import type { ComposerAgent, ComposerInput } from "@/composer/session";
 import type { InstalledPlugin } from "../types";
 import { createPluginResourceAttachment } from "../attachments/model";
+import { cloneAndFreeze } from "../freeze";
 
 function isPluginAttachment(
   attachment: UserComposerAttachment,
@@ -19,6 +20,17 @@ function isPluginAttachment(
   );
 }
 
+const LOCKED_MESSAGE = "The composer is locked while the agent is being created.";
+
+function assertUnlocked(locked: boolean): void {
+  if (locked) throw new Error(LOCKED_MESSAGE);
+}
+
+async function whenUnlocked(agent: ComposerAgent, command: () => Promise<void>): Promise<void> {
+  assertUnlocked(agent.locked);
+  await command();
+}
+
 /**
  * What a plugin sees of the composer it sits in. `agent` and `input` are the composer's own
  * halves, so the plugin's commands reach the same models the built-in controls use.
@@ -44,11 +56,17 @@ export function toPluginComposer(input: {
       model: agent.model,
       mode: agent.mode,
       thinking: agent.thinking,
-      options: agent.options as Record<string, JsonValue>,
-      metadata: agent.metadata,
+      options: cloneAndFreeze(agent.options as Record<string, JsonValue>),
+      metadata: cloneAndFreeze(agent.metadata),
+    },
+    setPrompt: (text) => {
+      assertUnlocked(composerInput.locked);
+      composerInput.setText(text);
+    },
+    insertText: (text) => {
+      assertUnlocked(composerInput.locked);
+      composerInput.insertText(text);
     },
-    setPrompt: composerInput.setText,
-    insertText: composerInput.insertText,
     addAttachment({ sourceId, item }) {
       const source = plugin.attachmentSources.find((candidate) => candidate.id === sourceId);
       if (!source) throw new Error(`Unknown attachment source: ${sourceId}`);
@@ -72,11 +90,12 @@ export function toPluginComposer(input: {
         current.filter((candidate) => !isPluginAttachment(candidate, plugin.id, sourceId, itemId)),
       );
     },
-    setProvider: agent.setProvider,
-    setModel: agent.setModel,
-    setMode: agent.setMode,
-    setThinking: agent.setThinking,
-    setOptions: agent.setOptions,
-    setMetadata: agent.setMetadata,
+    setProvider: (provider) => whenUnlocked(agent, () => agent.setProvider(provider)),
+    setModel: (modelId) => whenUnlocked(agent, () => agent.setModel(modelId)),
+    setMode: (modeId) => whenUnlocked(agent, () => agent.setMode(modeId)),
+    setThinking: (thinkingOptionId) =>
+      whenUnlocked(agent, () => agent.setThinking(thinkingOptionId)),
+    setOptions: (patch) => whenUnlocked(agent, () => agent.setOptions(patch)),
+    setMetadata: (patch) => whenUnlocked(agent, () => agent.setMetadata(patch)),
   };
 }

packages/app/src/plugins/freeze.ts

@@ -0,0 +1,12 @@
+/** A deep copy no plugin can change. Plugins read data through it, never the host's own objects. */
+export function cloneAndFreeze<T>(value: T): T {
+  if (Array.isArray(value)) {
+    return Object.freeze(value.map((entry) => cloneAndFreeze(entry))) as T;
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.freeze(
+      Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, cloneAndFreeze(entry)])),
+    ) as T;
+  }
+  return value;
+}

packages/app/src/plugins/react-native/composer-controls.tsx

@@ -5,6 +5,7 @@ import {
   useComposerControlSurface,
   type ComposerControlItem,
 } from "@/composer/agent-controls/composer-control";
+import { useComposerLocked } from "@/composer/session";
 import { parsePluginIcon, pluginIconComponent } from "../icons";
 
 /** Icons resolve at render, so an invalid one throws to the item's boundary. */
@@ -21,12 +22,13 @@ function PluginComposerControl({
   disabled: boolean | undefined;
 }) {
   const surface = useComposerControlSurface();
+  const locked = useComposerLocked();
   const [open, setOpen] = useState(false);
   return (
     <ComposerControl
       item={item}
       surface={surface}
-      disabled={disabled}
+      disabled={disabled || locked}
       open={open}
       onOpenChange={setOpen}
     />

packages/app/src/plugins/timeline/projection.ts

@@ -1,5 +1,6 @@
 import type { AgentTimelineItem, ToolCallTimelineItem } from "@getpaseo/protocol/agent-types";
 import type { AgentToolCallData, PluginTimelineStreamItem, StreamItem } from "@/types/stream";
+import { cloneAndFreeze } from "../freeze";
 import type { TimelineItemTransform } from "./model";
 
 type AssistantPhase = "streaming" | "complete";
@@ -9,18 +10,6 @@ const projectionCache = new WeakMap<
   WeakMap<StreamItem, Partial<Record<AssistantPhase, StreamItem[]>>>
 >();
 
-function cloneAndFreeze<T>(value: T): T {
-  if (Array.isArray(value)) {
-    return Object.freeze(value.map((entry) => cloneAndFreeze(entry))) as T;
-  }
-  if (value !== null && typeof value === "object") {
-    return Object.freeze(
-      Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, cloneAndFreeze(entry)])),
-    ) as T;
-  }
-  return value;
-}
-
 function sourceToolCallTimelineItem(data: AgentToolCallData): ToolCallTimelineItem {
   const { callId, name, status, error, detail, metadata, agentMessage } = data;
   const base = {