Files
kandev/apps/web/components/settings/plugins/use-plugin-actions.ts
T
João Salavisa e145d48f22 feat: add plugin system with grpc runtime and native ui plugins (#1742)
* feat: add plugin system with grpc runtime and native ui plugins

- go plugin backends ship as release tarballs (per-platform binaries, checksums) that
  kandev installs from url/upload or filesystem sideload+sync, then spawns and
  supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls)
- strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook
  plus a capability-gated host service (state, secrets, emit); author sdk in
  pkg/pluginsdk; packaging cli in cmd/plugin-pack
- native frontend bundles: window.registerKandevPlugin + registry/host loader with
  dynamic routes, nav items, slots and ws handlers; plugins settings page with
  install dialog, sync button and enable/disable/uninstall
- gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and
  integration tests plus playwright e2e against a real packaged fixture plugin

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): hydrate base app context on plugin routes

Plugin-owned SPA routes classify as RouteUnknown, so the boot payload shipped
only feature flags — no workspaces, workflows, or kanban context. Native plugin
UI (e.g. host.ui.TaskCreateDialog) then had an empty store. Hydrate the same
base context as the Home route for unknown SPA routes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(plugins): expose TaskCreateDialog on host.ui

Lets a native plugin open kandev's real create-task modal (prefilled via
initialValues) instead of POSTing directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): harden filesystem/URL sinks against CodeQL findings

Add sink-level guards on the plugin trust boundary: securejoin containment on
archive extraction (zip-slip), plugin-id validation before every fs_store path,
http/https scheme validation on install-from-URL, and non-interpolated ws-handler
error logging.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address review findings (races, resource caps, lifecycle)

- serialize per-plugin startup to close a TOCTOU double-spawn race, and let a
  plugin restart after exhausting attempts
- bound plugin startup with an explicit 30s timeout
- reject backslash paths and cap decompressed bytes by actual size in pkgtar;
  only mark a package Signed when a verifier actually ran and passed
- delete plugin_state on uninstall; validate webhook keys against the manifest
  and cap webhook body size; restart an active plugin when a new version installs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): sanitize plugin-id path sinks for CodeQL

Pin the plugin id to a single path segment with filepath.Base at recordPath/
configPath and pkgtar.Remove — a barrier the taint analysis recognizes.
Behaviour-identical for valid ids (already validated by safePluginID); clears
the go/path-injection alerts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): inline plugin-id validation at path sinks for CodeQL

filepath.Base does not strip '..', so it is not a path-injection barrier. Call
the recognized safePluginID / id-pattern guard inline in Delete/GetConfig/
SetConfig and pkgtar.Remove — the same barrier that already cleared the Get sink.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address code-review findings (backend)

- add capability-gating tests for the Host RPC service (was untested)
- close a stop-during-start orphan race so Disable/Uninstall can't leave a
  supervised subprocess behind
- on failed upgrade, remove only the new version dir (not all versions + data);
  restart the prior version
- validate manifest version and reject ids ending in .config (record-file alias)
- make Deliverer.Refresh non-blocking and cancel in-flight delivery on worker stop
- clamp out-of-range webhook status, skip-and-warn corrupt records in List,
  write records atomically, semver-aware sideload version pick

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address code-review findings (frontend)

- wrap plugin routes + settings routes in a shared PluginErrorBoundary so a
  throwing plugin page shows a fallback instead of white-screening the SPA
- fix disable/re-enable in one session: keep the cached registration and
  re-run initialize instead of relying on a cached ES-module re-import
- prefix root-relative bundle/style URLs with apiBaseUrl (split-origin/Tauri)
- surface partial-install warnings via toast.warning instead of a bare success
- dedupe/remove injected style links on unload; gate PluginNavItems on the flag

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): serialize per-plugin lifecycle + guard config writes

- add a per-plugin keyed lock in Service so concurrent Enable/Disable/Install/
  Uninstall/UpdateConfig for one id are serialized (no status-machine race)
- take s.mu in SetConfig/GetConfig and write config atomically
- bound each plugin initialize() with a timeout so one hung bundle can't stall
  the rest of the boot load

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(plugins): split service_test.go to satisfy file-length lint

Move the install/URL test group into service_install_test.go; no logic change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: build and ship the e2e fixture plugin package to E2E shards

The plugin E2E specs' global-setup requires apps/backend/.build/kandev-plugin-e2e-1.0.0.tar.gz.
Build it in the E2E build job, upload it as an artifact, and download it in both
the regular and container shard jobs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 12:00:26 +01:00

217 lines
7.4 KiB
TypeScript

"use client";
import { useState } from "react";
import { toast } from "sonner";
import type { StoreApi } from "zustand";
import { useAppStore, useAppStoreApi } from "@/components/state-provider";
import { useTheme } from "@/components/theme/app-theme";
import {
disablePlugin,
enablePlugin,
installPluginFromUrl,
installPluginUpload,
listPlugins,
syncPlugins,
uninstallPlugin,
} from "@/lib/api/domains/plugins-api";
import { toActivePlugin } from "@/lib/plugins/active-plugin";
import { buildHostApi } from "@/lib/plugins/host-api";
import { loadPlugins, unloadPlugin } from "@/lib/plugins/host";
import { summarizeSyncResult } from "@/lib/plugins/sync-summary";
import type { InstallResult } from "@/lib/api/domains/plugins-api";
import type { PluginRecord, PluginStatus, SyncError } from "@/lib/types/plugins";
import type { AppState } from "@/lib/state/store";
function withStatus(plugin: PluginRecord, status: PluginStatus): PluginRecord {
return { ...plugin, status };
}
/** Loads a plugin's UI bundle into the running app, if it declares one. */
async function loadIfActive(
record: PluginRecord,
storeApi: StoreApi<AppState>,
theme: "light" | "dark",
) {
if (record.status !== "active") return;
const active = toActivePlugin(record);
if (!active) return;
await loadPlugins([active], (pluginId) => buildHostApi(pluginId, storeApi, theme));
}
/**
* Enable/disable action wiring, per task-20's output contract: enabling a
* plugin with a UI bundle calls the task-18 runtime `loadPlugins` for just
* that plugin (no full page reload); disabling calls `unloadPlugin` to
* revoke its nav items/routes/slots immediately.
*/
function useEnableDisableActions(upsertPlugin: (p: PluginRecord) => void) {
const storeApi = useAppStoreApi();
const { resolvedTheme } = useTheme();
const [busyId, setBusyId] = useState<string | null>(null);
const handleEnable = async (plugin: PluginRecord) => {
setBusyId(plugin.id);
try {
await enablePlugin(plugin.id);
const updated = withStatus(plugin, "active");
upsertPlugin(updated);
await loadIfActive(updated, storeApi, resolvedTheme);
} catch (err) {
toast.error(err instanceof Error ? err.message : `Failed to enable ${plugin.display_name}`);
} finally {
setBusyId(null);
}
};
const handleDisable = async (plugin: PluginRecord) => {
setBusyId(plugin.id);
try {
await disablePlugin(plugin.id);
unloadPlugin(plugin.id);
upsertPlugin(withStatus(plugin, "disabled"));
} catch (err) {
toast.error(err instanceof Error ? err.message : `Failed to disable ${plugin.display_name}`);
} finally {
setBusyId(null);
}
};
return { busyId, handleEnable, handleDisable };
}
function useUninstallAction(removePlugin: (id: string) => void) {
const [uninstallTarget, setUninstallTarget] = useState<PluginRecord | null>(null);
const [uninstallBusy, setUninstallBusy] = useState(false);
const confirmUninstall = async () => {
if (!uninstallTarget) return;
const target = uninstallTarget;
setUninstallBusy(true);
try {
await uninstallPlugin(target.id);
unloadPlugin(target.id);
removePlugin(target.id);
setUninstallTarget(null);
} catch (err) {
toast.error(
err instanceof Error ? err.message : `Failed to uninstall ${target.display_name}`,
);
} finally {
setUninstallBusy(false);
}
};
return {
uninstallTarget,
uninstallBusy,
openUninstall: setUninstallTarget,
closeUninstall: () => setUninstallTarget(null),
confirmUninstall,
};
}
/**
* Install-plugin dialog wiring. Install-from-URL and upload share the same
* open/busy/error state and post-install effect: upsert the record into the
* store, and if the backend already brought it up `active` with a UI
* bundle, hot-load it into the running app (no full page reload) — same as
* the enable path.
*/
function useInstallAction(upsertPlugin: (p: PluginRecord) => void) {
const storeApi = useAppStoreApi();
const { resolvedTheme } = useTheme();
const [installOpen, setInstallOpenState] = useState(false);
const [installBusy, setInstallBusy] = useState(false);
const [installError, setInstallError] = useState<string | null>(null);
const closeInstallDialog = () => {
setInstallOpenState(false);
setInstallError(null);
};
// A partial-install warning (package installed but failed to spawn — the
// backend leaves Plugin.Status "error") must not be masked by a green
// "installed" toast, so it takes priority over the success toast.
const afterInstall = async ({ plugin, warning }: InstallResult) => {
upsertPlugin(plugin);
await loadIfActive(plugin, storeApi, resolvedTheme);
if (warning) {
toast.warning(warning);
} else {
toast.success(`${plugin.display_name} installed`);
}
closeInstallDialog();
};
const runInstall = async (install: () => Promise<InstallResult>) => {
setInstallBusy(true);
setInstallError(null);
try {
const result = await install();
await afterInstall(result);
} catch (err) {
setInstallError(err instanceof Error ? err.message : "Failed to install plugin");
} finally {
setInstallBusy(false);
}
};
return {
installOpen,
openInstall: () => setInstallOpenState(true),
setInstallOpen: (open: boolean) => (open ? setInstallOpenState(true) : closeInstallDialog()),
installBusy,
installError,
submitInstallUrl: (url: string) => runInstall(() => installPluginFromUrl(url)),
submitInstallFile: (file: File) => runInstall(() => installPluginUpload(file)),
closeInstallDialog,
};
}
/**
* Sync-button wiring: POST /api/plugins/sync, then refresh the plugin list
* via the same GET /api/plugins call usePlugins itself makes on mount, and
* summarize the result as a toast. result.errors are kept in state for an
* inline `plugins-sync-errors` region rather than only living in the toast,
* so they stay visible without depending on toast auto-dismiss timing.
*
* A sync can bring a dropped tarball plugin all the way to `active` with a
* UI bundle, but (unlike install/enable) this does not hot-load it — an
* operator can re-enable it (or reload) to pick up the bundle; wiring a
* silent hot-load here is out of scope for the sync button itself.
*/
function useSyncAction(setPlugins: (plugins: PluginRecord[]) => void) {
const [syncBusy, setSyncBusy] = useState(false);
const [syncErrors, setSyncErrors] = useState<SyncError[]>([]);
const handleSync = async () => {
setSyncBusy(true);
try {
const result = await syncPlugins();
const refreshed = await listPlugins({ cache: "no-store" });
setPlugins(refreshed);
setSyncErrors(result.errors ?? []);
toast.success(summarizeSyncResult(result));
} catch (err) {
toast.error(err instanceof Error ? err.message : "Failed to sync plugins");
} finally {
setSyncBusy(false);
}
};
return { syncBusy, syncErrors, handleSync };
}
export function usePluginActions() {
const upsertPlugin = useAppStore((s) => s.upsertPlugin);
const removePlugin = useAppStore((s) => s.removePlugin);
const setPlugins = useAppStore((s) => s.setPlugins);
const enableDisable = useEnableDisableActions(upsertPlugin);
const uninstall = useUninstallAction(removePlugin);
const install = useInstallAction(upsertPlugin);
const sync = useSyncAction(setPlugins);
return { ...enableDisable, ...uninstall, ...install, ...sync };
}