Files
kandev/apps/web/components/settings/plugins/use-plugin-actions.ts
T
João Salavisa bc2f310e73 feat(plugins): add plugin marketplace with curated registry and updates (#1798)
* feat(plugins): add plugin marketplace with curated registry and updates

Discover and install plugins from inside kandev instead of only by URL/upload.

- Backend marketplace subpackage: SQLite-backed sources, catalog fetch/merge
  (dedup, install_state, degraded-source handling), and the /api/plugins/
  marketplace[/sources] API. Install reuses the existing install-by-URL pipeline.
- Frontend: Settings > Plugins gains a Browse tab (search/category/star sort),
  source management, one-click install, and an Update button on the Installed
  tab when the catalog has a newer version. Plugins may ship an icon (manifest
  `icon` -> catalog icon_url) with a letter-tile fallback.
- Registry infra: plugin-registry/ (curated plugins.yaml + schema.json) and two
  GitHub Actions (zero-dependency Node build-index.mjs -> index.json on Pages,
  daily star refresh). Ships empty at launch; the empty catalog is valid.
- Spec: docs/specs/plugins/marketplace.md. No download telemetry; stars only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): address marketplace PR review feedback

- CodeQL: stub fetch routers keyed off a path segment, not a hostname substring.
- Nullable stars end to end: a failed star lookup stays unknown (not 0) and
  sorts last, instead of decoding null -> 0 and corrupting ranking.
- Fetch marketplace sources concurrently and dedupe identical in-flight
  downloads (singleflight), so a slow source can't serialize the Browse tab.
- Register /marketplace routes before the /:id wildcard (gin tree ordering).
- Duplicate source URL returns 409 ErrDuplicateSource, not a raw SQL error.
- Browse: filter category client-side so the category dropdown never collapses.
- marketplaceInstall swallows after toasting (no unhandled promise rejection).
- Source badge keys off source_id, not a name substring.
- build-index: read block-sequence manifest categories, not just inline.
- Registry index workflow validates on pull_request; Pages deploy gated to
  push/schedule/dispatch. Spec: align package_sha256 (advisory in v1) + sort enum.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): guard catalog repo_url against javascript: href injection

repo_url comes from an untrusted index.json, so a malicious/compromised source
could set a javascript: URL that runs in the operator's session when the Repo
link is clicked (rel/target don't block it). Only render the anchor for http(s)
schemes. Adds regression tests for the scheme guard and null-star rendering.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): require https for remote sources; test oversized download

- Reject remote plain-http marketplace sources (MITM catalog-poisoning risk);
  loopback http stays allowed for local dev/e2e fixtures.
- Add the missing oversized-response assertion to TestDownloadRejectsNon200AndOversized
  so the maxIndexBytes memory bound has coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): detach source download from singleflight leader's context

Two concurrent Browse opens after a cache Refresh share one singleflight
download; if the leader's request context is canceled (it navigates away), the
waiters must not inherit that cancellation. Use context.WithoutCancel so values
are preserved but the leader can't cancel everyone; the client's 20s timeout
still bounds the download.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-19 17:10:53 +01:00

233 lines
8.1 KiB
TypeScript

"use client";
import { useState } from "react";
import { toast } from "sonner";
import type { StoreApi } from "zustand";
import { useAppStore, useAppStoreApi } from "@/components/state-provider";
import { useTheme } from "@/components/theme/app-theme";
import {
disablePlugin,
enablePlugin,
installPluginFromUrl,
installPluginUpload,
listPlugins,
syncPlugins,
uninstallPlugin,
} from "@/lib/api/domains/plugins-api";
import { toActivePlugin } from "@/lib/plugins/active-plugin";
import { buildHostApi } from "@/lib/plugins/host-api";
import { loadPlugins, unloadPlugin } from "@/lib/plugins/host";
import { summarizeSyncResult } from "@/lib/plugins/sync-summary";
import type { InstallResult } from "@/lib/api/domains/plugins-api";
import type { PluginRecord, PluginStatus, SyncError } from "@/lib/types/plugins";
import type { AppState } from "@/lib/state/store";
function withStatus(plugin: PluginRecord, status: PluginStatus): PluginRecord {
return { ...plugin, status };
}
/** Loads a plugin's UI bundle into the running app, if it declares one. */
async function loadIfActive(
record: PluginRecord,
storeApi: StoreApi<AppState>,
theme: "light" | "dark",
) {
if (record.status !== "active") return;
const active = toActivePlugin(record);
if (!active) return;
await loadPlugins([active], (pluginId) => buildHostApi(pluginId, storeApi, theme));
}
/**
* Enable/disable action wiring, per task-20's output contract: enabling a
* plugin with a UI bundle calls the task-18 runtime `loadPlugins` for just
* that plugin (no full page reload); disabling calls `unloadPlugin` to
* revoke its nav items/routes/slots immediately.
*/
function useEnableDisableActions(upsertPlugin: (p: PluginRecord) => void) {
const storeApi = useAppStoreApi();
const { resolvedTheme } = useTheme();
const [busyId, setBusyId] = useState<string | null>(null);
const handleEnable = async (plugin: PluginRecord) => {
setBusyId(plugin.id);
try {
await enablePlugin(plugin.id);
const updated = withStatus(plugin, "active");
upsertPlugin(updated);
await loadIfActive(updated, storeApi, resolvedTheme);
} catch (err) {
toast.error(err instanceof Error ? err.message : `Failed to enable ${plugin.display_name}`);
} finally {
setBusyId(null);
}
};
const handleDisable = async (plugin: PluginRecord) => {
setBusyId(plugin.id);
try {
await disablePlugin(plugin.id);
unloadPlugin(plugin.id);
upsertPlugin(withStatus(plugin, "disabled"));
} catch (err) {
toast.error(err instanceof Error ? err.message : `Failed to disable ${plugin.display_name}`);
} finally {
setBusyId(null);
}
};
return { busyId, handleEnable, handleDisable };
}
function useUninstallAction(removePlugin: (id: string) => void) {
const [uninstallTarget, setUninstallTarget] = useState<PluginRecord | null>(null);
const [uninstallBusy, setUninstallBusy] = useState(false);
const confirmUninstall = async () => {
if (!uninstallTarget) return;
const target = uninstallTarget;
setUninstallBusy(true);
try {
await uninstallPlugin(target.id);
unloadPlugin(target.id);
removePlugin(target.id);
setUninstallTarget(null);
} catch (err) {
toast.error(
err instanceof Error ? err.message : `Failed to uninstall ${target.display_name}`,
);
} finally {
setUninstallBusy(false);
}
};
return {
uninstallTarget,
uninstallBusy,
openUninstall: setUninstallTarget,
closeUninstall: () => setUninstallTarget(null),
confirmUninstall,
};
}
/**
* Install-plugin dialog wiring. Install-from-URL and upload share the same
* open/busy/error state and post-install effect: upsert the record into the
* store, and if the backend already brought it up `active` with a UI
* bundle, hot-load it into the running app (no full page reload) — same as
* the enable path.
*/
function useInstallAction(upsertPlugin: (p: PluginRecord) => void) {
const storeApi = useAppStoreApi();
const { resolvedTheme } = useTheme();
const [installOpen, setInstallOpenState] = useState(false);
const [installBusy, setInstallBusy] = useState(false);
const [installError, setInstallError] = useState<string | null>(null);
const closeInstallDialog = () => {
setInstallOpenState(false);
setInstallError(null);
};
// A partial-install warning (package installed but failed to spawn — the
// backend leaves Plugin.Status "error") must not be masked by a green
// "installed" toast, so it takes priority over the success toast.
const afterInstall = async ({ plugin, warning }: InstallResult) => {
upsertPlugin(plugin);
await loadIfActive(plugin, storeApi, resolvedTheme);
if (warning) {
toast.warning(warning);
} else {
toast.success(`${plugin.display_name} installed`);
}
closeInstallDialog();
};
const runInstall = async (install: () => Promise<InstallResult>) => {
setInstallBusy(true);
setInstallError(null);
try {
const result = await install();
await afterInstall(result);
} catch (err) {
setInstallError(err instanceof Error ? err.message : "Failed to install plugin");
} finally {
setInstallBusy(false);
}
};
// marketplaceInstall runs the same post-install effect as the dialog
// (upsert + hot-load if active + success toast), but surfaces failures as a
// toast rather than the dialog-scoped installError region — the Browse tab
// has no such region. It resolves even on failure (after toasting) so its
// fire-and-forget onClick callers never leak an unhandled rejection; their
// try/finally still clears per-entry busy state.
const marketplaceInstall = async (url: string) => {
try {
const result = await installPluginFromUrl(url);
await afterInstall(result);
} catch (err) {
toast.error(err instanceof Error ? err.message : "Failed to install plugin");
}
};
return {
installOpen,
openInstall: () => setInstallOpenState(true),
setInstallOpen: (open: boolean) => (open ? setInstallOpenState(true) : closeInstallDialog()),
installBusy,
installError,
submitInstallUrl: (url: string) => runInstall(() => installPluginFromUrl(url)),
submitInstallFile: (file: File) => runInstall(() => installPluginUpload(file)),
marketplaceInstall,
closeInstallDialog,
};
}
/**
* Sync-button wiring: POST /api/plugins/sync, then refresh the plugin list
* via the same GET /api/plugins call usePlugins itself makes on mount, and
* summarize the result as a toast. result.errors are kept in state for an
* inline `plugins-sync-errors` region rather than only living in the toast,
* so they stay visible without depending on toast auto-dismiss timing.
*
* A sync can bring a dropped tarball plugin all the way to `active` with a
* UI bundle, but (unlike install/enable) this does not hot-load it — an
* operator can re-enable it (or reload) to pick up the bundle; wiring a
* silent hot-load here is out of scope for the sync button itself.
*/
function useSyncAction(setPlugins: (plugins: PluginRecord[]) => void) {
const [syncBusy, setSyncBusy] = useState(false);
const [syncErrors, setSyncErrors] = useState<SyncError[]>([]);
const handleSync = async () => {
setSyncBusy(true);
try {
const result = await syncPlugins();
const refreshed = await listPlugins({ cache: "no-store" });
setPlugins(refreshed);
setSyncErrors(result.errors ?? []);
toast.success(summarizeSyncResult(result));
} catch (err) {
toast.error(err instanceof Error ? err.message : "Failed to sync plugins");
} finally {
setSyncBusy(false);
}
};
return { syncBusy, syncErrors, handleSync };
}
export function usePluginActions() {
const upsertPlugin = useAppStore((s) => s.upsertPlugin);
const removePlugin = useAppStore((s) => s.removePlugin);
const setPlugins = useAppStore((s) => s.setPlugins);
const enableDisable = useEnableDisableActions(upsertPlugin);
const uninstall = useUninstallAction(removePlugin);
const install = useInstallAction(upsertPlugin);
const sync = useSyncAction(setPlugins);
return { ...enableDisable, ...uninstall, ...install, ...sync };
}