Let plugins talk to the built-in agent

[ronald2wing]

Plugins can't use Omarchy's built-in agent, so each one rebuilds its own stack (keys, transport, security) — the exact stuff the security review warns about. It's already happening:

• cOMApilot — hand-rolled curl, keyring-stored API key, its own OpenAI/Anthropic/Ollama backends.
• omapilot — embeds a full coding-agent runtime (Pi) plus Codex/OpenCode harnesses.
  Neither uses the built-in agent, because there's nothing to call.
  Give plugins a safe way to call the user's own agent. Approve once, done.
  Two ways:
• Plugin API — a sanctioned "ask the agent" call.
• Hook the running agent — detect it's active and call its tool/CLI directly.

Catch: the agent handles auth inconsistently across entry points — the chat path works on the stored key, but a prompt command needs the key re-supplied. So plugins can't reliably reuse the agent's auth; the API route wins (the agent keeps owning the key end-to-end).

Capabilities: Chat (streaming) · JSON output · OS actions (via the agent's own prompts) · inter-plugin calls · plugin tools · permission levels ("answer only" vs. "can act").
The "ask permission, then call a service" pattern already exists. (#7922 asks for raw model calls — this asks for the full agent.)
Question: Does "confirm once, then allow" pass the Omarchy marketplace's security review?