bc2f310e73
* feat(plugins): add plugin marketplace with curated registry and updates Discover and install plugins from inside kandev instead of only by URL/upload. - Backend marketplace subpackage: SQLite-backed sources, catalog fetch/merge (dedup, install_state, degraded-source handling), and the /api/plugins/ marketplace[/sources] API. Install reuses the existing install-by-URL pipeline. - Frontend: Settings > Plugins gains a Browse tab (search/category/star sort), source management, one-click install, and an Update button on the Installed tab when the catalog has a newer version. Plugins may ship an icon (manifest `icon` -> catalog icon_url) with a letter-tile fallback. - Registry infra: plugin-registry/ (curated plugins.yaml + schema.json) and two GitHub Actions (zero-dependency Node build-index.mjs -> index.json on Pages, daily star refresh). Ships empty at launch; the empty catalog is valid. - Spec: docs/specs/plugins/marketplace.md. No download telemetry; stars only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): address marketplace PR review feedback - CodeQL: stub fetch routers keyed off a path segment, not a hostname substring. - Nullable stars end to end: a failed star lookup stays unknown (not 0) and sorts last, instead of decoding null -> 0 and corrupting ranking. - Fetch marketplace sources concurrently and dedupe identical in-flight downloads (singleflight), so a slow source can't serialize the Browse tab. - Register /marketplace routes before the /:id wildcard (gin tree ordering). - Duplicate source URL returns 409 ErrDuplicateSource, not a raw SQL error. - Browse: filter category client-side so the category dropdown never collapses. - marketplaceInstall swallows after toasting (no unhandled promise rejection). - Source badge keys off source_id, not a name substring. - build-index: read block-sequence manifest categories, not just inline. - Registry index workflow validates on pull_request; Pages deploy gated to push/schedule/dispatch. Spec: align package_sha256 (advisory in v1) + sort enum. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): guard catalog repo_url against javascript: href injection repo_url comes from an untrusted index.json, so a malicious/compromised source could set a javascript: URL that runs in the operator's session when the Repo link is clicked (rel/target don't block it). Only render the anchor for http(s) schemes. Adds regression tests for the scheme guard and null-star rendering. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): require https for remote sources; test oversized download - Reject remote plain-http marketplace sources (MITM catalog-poisoning risk); loopback http stays allowed for local dev/e2e fixtures. - Add the missing oversized-response assertion to TestDownloadRejectsNon200AndOversized so the maxIndexBytes memory bound has coverage. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): detach source download from singleflight leader's context Two concurrent Browse opens after a cache Refresh share one singleflight download; if the leader's request context is canceled (it navigates away), the waiters must not inherit that cancellation. Use context.WithoutCancel so values are preserved but the leader can't cancel everyone; the client's 20s timeout still bounds the download. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
165 lines
4.8 KiB
TypeScript
165 lines
4.8 KiB
TypeScript
"use client";
|
|
|
|
import { IconArrowUpCircle } from "@tabler/icons-react";
|
|
import { Badge } from "@kandev/ui/badge";
|
|
import { Button } from "@kandev/ui/button";
|
|
import Link from "@/components/routing/app-link";
|
|
import { PluginStatusBadge } from "./plugin-status-badge";
|
|
import type { MarketplaceEntry, PluginRecord } from "@/lib/types/plugins";
|
|
|
|
type PluginRowProps = {
|
|
plugin: PluginRecord;
|
|
busy: boolean;
|
|
/** Set when the marketplace has a newer version than the installed one. */
|
|
update?: MarketplaceEntry;
|
|
onEnable: (plugin: PluginRecord) => void;
|
|
onDisable: (plugin: PluginRecord) => void;
|
|
onUninstall: (plugin: PluginRecord) => void;
|
|
onUpdate?: (entry: MarketplaceEntry) => void;
|
|
};
|
|
|
|
/**
|
|
* One plugin's row. Div-based (not a `<table>`) so it wraps/stacks naturally
|
|
* on narrow viewports and inside the mobile settings sheet — no separate
|
|
* mobile layout needed.
|
|
*/
|
|
export function PluginRow({
|
|
plugin,
|
|
busy,
|
|
update,
|
|
onEnable,
|
|
onDisable,
|
|
onUninstall,
|
|
onUpdate,
|
|
}: PluginRowProps) {
|
|
const canEnable = plugin.status === "disabled" || plugin.status === "registered";
|
|
const canDisable = plugin.status === "active" || plugin.status === "error";
|
|
|
|
return (
|
|
<div
|
|
data-testid={`plugin-row-${plugin.id}`}
|
|
className="rounded-lg border border-border/70 bg-background p-4 space-y-3"
|
|
>
|
|
<div className="flex flex-wrap items-start justify-between gap-3">
|
|
<div className="min-w-0 space-y-1">
|
|
<div className="flex flex-wrap items-center gap-2">
|
|
<Link
|
|
href={`/settings/plugins/${encodeURIComponent(plugin.id)}`}
|
|
data-testid={`plugin-row-link-${plugin.id}`}
|
|
className="text-sm font-medium text-foreground truncate cursor-pointer hover:underline"
|
|
>
|
|
{plugin.display_name}
|
|
</Link>
|
|
<PluginStatusBadge status={plugin.status} />
|
|
{plugin.signed === false && (
|
|
<Badge
|
|
data-testid="plugin-unsigned-badge"
|
|
variant="outline"
|
|
className="border-amber-500/40 bg-amber-500/10 text-amber-600 dark:text-amber-400 text-[11px]"
|
|
>
|
|
unsigned
|
|
</Badge>
|
|
)}
|
|
</div>
|
|
<div className="text-xs text-muted-foreground font-mono truncate">
|
|
{plugin.id} · v{plugin.version}
|
|
</div>
|
|
{plugin.description && (
|
|
<div className="text-xs text-muted-foreground">{plugin.description}</div>
|
|
)}
|
|
{plugin.categories.length > 0 && (
|
|
<div className="flex flex-wrap gap-1 pt-1">
|
|
{plugin.categories.map((category) => (
|
|
<Badge key={category} variant="secondary" className="text-[11px]">
|
|
{category}
|
|
</Badge>
|
|
))}
|
|
</div>
|
|
)}
|
|
</div>
|
|
|
|
<PluginRowActions
|
|
plugin={plugin}
|
|
busy={busy}
|
|
update={update}
|
|
canEnable={canEnable}
|
|
canDisable={canDisable}
|
|
onEnable={onEnable}
|
|
onDisable={onDisable}
|
|
onUninstall={onUninstall}
|
|
onUpdate={onUpdate}
|
|
/>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
type PluginRowActionsProps = Omit<PluginRowProps, "onEnable" | "onDisable" | "onUninstall"> & {
|
|
canEnable: boolean;
|
|
canDisable: boolean;
|
|
onEnable: (plugin: PluginRecord) => void;
|
|
onDisable: (plugin: PluginRecord) => void;
|
|
onUninstall: (plugin: PluginRecord) => void;
|
|
};
|
|
|
|
function PluginRowActions({
|
|
plugin,
|
|
busy,
|
|
update,
|
|
canEnable,
|
|
canDisable,
|
|
onEnable,
|
|
onDisable,
|
|
onUninstall,
|
|
onUpdate,
|
|
}: PluginRowActionsProps) {
|
|
return (
|
|
<div className="flex flex-wrap items-center gap-2 shrink-0">
|
|
{update && onUpdate && (
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
data-testid={`plugin-update-${plugin.id}`}
|
|
className="cursor-pointer gap-1"
|
|
disabled={busy}
|
|
onClick={() => onUpdate(update)}
|
|
>
|
|
<IconArrowUpCircle className="h-4 w-4" />
|
|
{busy ? "Updating…" : `Update to v${update.version}`}
|
|
</Button>
|
|
)}
|
|
{canEnable && (
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
className="cursor-pointer"
|
|
disabled={busy}
|
|
onClick={() => onEnable(plugin)}
|
|
>
|
|
Enable
|
|
</Button>
|
|
)}
|
|
{canDisable && (
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
className="cursor-pointer"
|
|
disabled={busy}
|
|
onClick={() => onDisable(plugin)}
|
|
>
|
|
Disable
|
|
</Button>
|
|
)}
|
|
<Button
|
|
variant="ghost"
|
|
size="sm"
|
|
className="cursor-pointer text-destructive hover:text-destructive"
|
|
disabled={busy}
|
|
onClick={() => onUninstall(plugin)}
|
|
>
|
|
Uninstall
|
|
</Button>
|
|
</div>
|
|
);
|
|
}
|