e145d48f22
* feat: add plugin system with grpc runtime and native ui plugins - go plugin backends ship as release tarballs (per-platform binaries, checksums) that kandev installs from url/upload or filesystem sideload+sync, then spawns and supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls) - strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook plus a capability-gated host service (state, secrets, emit); author sdk in pkg/pluginsdk; packaging cli in cmd/plugin-pack - native frontend bundles: window.registerKandevPlugin + registry/host loader with dynamic routes, nav items, slots and ws handlers; plugins settings page with install dialog, sync button and enable/disable/uninstall - gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and integration tests plus playwright e2e against a real packaged fixture plugin Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): hydrate base app context on plugin routes Plugin-owned SPA routes classify as RouteUnknown, so the boot payload shipped only feature flags — no workspaces, workflows, or kanban context. Native plugin UI (e.g. host.ui.TaskCreateDialog) then had an empty store. Hydrate the same base context as the Home route for unknown SPA routes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugins): expose TaskCreateDialog on host.ui Lets a native plugin open kandev's real create-task modal (prefilled via initialValues) instead of POSTing directly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): harden filesystem/URL sinks against CodeQL findings Add sink-level guards on the plugin trust boundary: securejoin containment on archive extraction (zip-slip), plugin-id validation before every fs_store path, http/https scheme validation on install-from-URL, and non-interpolated ws-handler error logging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address review findings (races, resource caps, lifecycle) - serialize per-plugin startup to close a TOCTOU double-spawn race, and let a plugin restart after exhausting attempts - bound plugin startup with an explicit 30s timeout - reject backslash paths and cap decompressed bytes by actual size in pkgtar; only mark a package Signed when a verifier actually ran and passed - delete plugin_state on uninstall; validate webhook keys against the manifest and cap webhook body size; restart an active plugin when a new version installs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): sanitize plugin-id path sinks for CodeQL Pin the plugin id to a single path segment with filepath.Base at recordPath/ configPath and pkgtar.Remove — a barrier the taint analysis recognizes. Behaviour-identical for valid ids (already validated by safePluginID); clears the go/path-injection alerts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): inline plugin-id validation at path sinks for CodeQL filepath.Base does not strip '..', so it is not a path-injection barrier. Call the recognized safePluginID / id-pattern guard inline in Delete/GetConfig/ SetConfig and pkgtar.Remove — the same barrier that already cleared the Get sink. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address code-review findings (backend) - add capability-gating tests for the Host RPC service (was untested) - close a stop-during-start orphan race so Disable/Uninstall can't leave a supervised subprocess behind - on failed upgrade, remove only the new version dir (not all versions + data); restart the prior version - validate manifest version and reject ids ending in .config (record-file alias) - make Deliverer.Refresh non-blocking and cancel in-flight delivery on worker stop - clamp out-of-range webhook status, skip-and-warn corrupt records in List, write records atomically, semver-aware sideload version pick Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address code-review findings (frontend) - wrap plugin routes + settings routes in a shared PluginErrorBoundary so a throwing plugin page shows a fallback instead of white-screening the SPA - fix disable/re-enable in one session: keep the cached registration and re-run initialize instead of relying on a cached ES-module re-import - prefix root-relative bundle/style URLs with apiBaseUrl (split-origin/Tauri) - surface partial-install warnings via toast.warning instead of a bare success - dedupe/remove injected style links on unload; gate PluginNavItems on the flag Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): serialize per-plugin lifecycle + guard config writes - add a per-plugin keyed lock in Service so concurrent Enable/Disable/Install/ Uninstall/UpdateConfig for one id are serialized (no status-machine race) - take s.mu in SetConfig/GetConfig and write config atomically - bound each plugin initialize() with a timeout so one hung bundle can't stall the rest of the boot load Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(plugins): split service_test.go to satisfy file-length lint Move the install/URL test group into service_install_test.go; no logic change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: build and ship the e2e fixture plugin package to E2E shards The plugin E2E specs' global-setup requires apps/backend/.build/kandev-plugin-e2e-1.0.0.tar.gz. Build it in the E2E build job, upload it as an artifact, and download it in both the regular and container shard jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
217 lines
7.4 KiB
TypeScript
217 lines
7.4 KiB
TypeScript
"use client";
|
|
|
|
import { useState } from "react";
|
|
import { toast } from "sonner";
|
|
import type { StoreApi } from "zustand";
|
|
import { useAppStore, useAppStoreApi } from "@/components/state-provider";
|
|
import { useTheme } from "@/components/theme/app-theme";
|
|
import {
|
|
disablePlugin,
|
|
enablePlugin,
|
|
installPluginFromUrl,
|
|
installPluginUpload,
|
|
listPlugins,
|
|
syncPlugins,
|
|
uninstallPlugin,
|
|
} from "@/lib/api/domains/plugins-api";
|
|
import { toActivePlugin } from "@/lib/plugins/active-plugin";
|
|
import { buildHostApi } from "@/lib/plugins/host-api";
|
|
import { loadPlugins, unloadPlugin } from "@/lib/plugins/host";
|
|
import { summarizeSyncResult } from "@/lib/plugins/sync-summary";
|
|
import type { InstallResult } from "@/lib/api/domains/plugins-api";
|
|
import type { PluginRecord, PluginStatus, SyncError } from "@/lib/types/plugins";
|
|
import type { AppState } from "@/lib/state/store";
|
|
|
|
function withStatus(plugin: PluginRecord, status: PluginStatus): PluginRecord {
|
|
return { ...plugin, status };
|
|
}
|
|
|
|
/** Loads a plugin's UI bundle into the running app, if it declares one. */
|
|
async function loadIfActive(
|
|
record: PluginRecord,
|
|
storeApi: StoreApi<AppState>,
|
|
theme: "light" | "dark",
|
|
) {
|
|
if (record.status !== "active") return;
|
|
const active = toActivePlugin(record);
|
|
if (!active) return;
|
|
await loadPlugins([active], (pluginId) => buildHostApi(pluginId, storeApi, theme));
|
|
}
|
|
|
|
/**
|
|
* Enable/disable action wiring, per task-20's output contract: enabling a
|
|
* plugin with a UI bundle calls the task-18 runtime `loadPlugins` for just
|
|
* that plugin (no full page reload); disabling calls `unloadPlugin` to
|
|
* revoke its nav items/routes/slots immediately.
|
|
*/
|
|
function useEnableDisableActions(upsertPlugin: (p: PluginRecord) => void) {
|
|
const storeApi = useAppStoreApi();
|
|
const { resolvedTheme } = useTheme();
|
|
const [busyId, setBusyId] = useState<string | null>(null);
|
|
|
|
const handleEnable = async (plugin: PluginRecord) => {
|
|
setBusyId(plugin.id);
|
|
try {
|
|
await enablePlugin(plugin.id);
|
|
const updated = withStatus(plugin, "active");
|
|
upsertPlugin(updated);
|
|
await loadIfActive(updated, storeApi, resolvedTheme);
|
|
} catch (err) {
|
|
toast.error(err instanceof Error ? err.message : `Failed to enable ${plugin.display_name}`);
|
|
} finally {
|
|
setBusyId(null);
|
|
}
|
|
};
|
|
|
|
const handleDisable = async (plugin: PluginRecord) => {
|
|
setBusyId(plugin.id);
|
|
try {
|
|
await disablePlugin(plugin.id);
|
|
unloadPlugin(plugin.id);
|
|
upsertPlugin(withStatus(plugin, "disabled"));
|
|
} catch (err) {
|
|
toast.error(err instanceof Error ? err.message : `Failed to disable ${plugin.display_name}`);
|
|
} finally {
|
|
setBusyId(null);
|
|
}
|
|
};
|
|
|
|
return { busyId, handleEnable, handleDisable };
|
|
}
|
|
|
|
function useUninstallAction(removePlugin: (id: string) => void) {
|
|
const [uninstallTarget, setUninstallTarget] = useState<PluginRecord | null>(null);
|
|
const [uninstallBusy, setUninstallBusy] = useState(false);
|
|
|
|
const confirmUninstall = async () => {
|
|
if (!uninstallTarget) return;
|
|
const target = uninstallTarget;
|
|
setUninstallBusy(true);
|
|
try {
|
|
await uninstallPlugin(target.id);
|
|
unloadPlugin(target.id);
|
|
removePlugin(target.id);
|
|
setUninstallTarget(null);
|
|
} catch (err) {
|
|
toast.error(
|
|
err instanceof Error ? err.message : `Failed to uninstall ${target.display_name}`,
|
|
);
|
|
} finally {
|
|
setUninstallBusy(false);
|
|
}
|
|
};
|
|
|
|
return {
|
|
uninstallTarget,
|
|
uninstallBusy,
|
|
openUninstall: setUninstallTarget,
|
|
closeUninstall: () => setUninstallTarget(null),
|
|
confirmUninstall,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Install-plugin dialog wiring. Install-from-URL and upload share the same
|
|
* open/busy/error state and post-install effect: upsert the record into the
|
|
* store, and if the backend already brought it up `active` with a UI
|
|
* bundle, hot-load it into the running app (no full page reload) — same as
|
|
* the enable path.
|
|
*/
|
|
function useInstallAction(upsertPlugin: (p: PluginRecord) => void) {
|
|
const storeApi = useAppStoreApi();
|
|
const { resolvedTheme } = useTheme();
|
|
const [installOpen, setInstallOpenState] = useState(false);
|
|
const [installBusy, setInstallBusy] = useState(false);
|
|
const [installError, setInstallError] = useState<string | null>(null);
|
|
|
|
const closeInstallDialog = () => {
|
|
setInstallOpenState(false);
|
|
setInstallError(null);
|
|
};
|
|
|
|
// A partial-install warning (package installed but failed to spawn — the
|
|
// backend leaves Plugin.Status "error") must not be masked by a green
|
|
// "installed" toast, so it takes priority over the success toast.
|
|
const afterInstall = async ({ plugin, warning }: InstallResult) => {
|
|
upsertPlugin(plugin);
|
|
await loadIfActive(plugin, storeApi, resolvedTheme);
|
|
if (warning) {
|
|
toast.warning(warning);
|
|
} else {
|
|
toast.success(`${plugin.display_name} installed`);
|
|
}
|
|
closeInstallDialog();
|
|
};
|
|
|
|
const runInstall = async (install: () => Promise<InstallResult>) => {
|
|
setInstallBusy(true);
|
|
setInstallError(null);
|
|
try {
|
|
const result = await install();
|
|
await afterInstall(result);
|
|
} catch (err) {
|
|
setInstallError(err instanceof Error ? err.message : "Failed to install plugin");
|
|
} finally {
|
|
setInstallBusy(false);
|
|
}
|
|
};
|
|
|
|
return {
|
|
installOpen,
|
|
openInstall: () => setInstallOpenState(true),
|
|
setInstallOpen: (open: boolean) => (open ? setInstallOpenState(true) : closeInstallDialog()),
|
|
installBusy,
|
|
installError,
|
|
submitInstallUrl: (url: string) => runInstall(() => installPluginFromUrl(url)),
|
|
submitInstallFile: (file: File) => runInstall(() => installPluginUpload(file)),
|
|
closeInstallDialog,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Sync-button wiring: POST /api/plugins/sync, then refresh the plugin list
|
|
* via the same GET /api/plugins call usePlugins itself makes on mount, and
|
|
* summarize the result as a toast. result.errors are kept in state for an
|
|
* inline `plugins-sync-errors` region rather than only living in the toast,
|
|
* so they stay visible without depending on toast auto-dismiss timing.
|
|
*
|
|
* A sync can bring a dropped tarball plugin all the way to `active` with a
|
|
* UI bundle, but (unlike install/enable) this does not hot-load it — an
|
|
* operator can re-enable it (or reload) to pick up the bundle; wiring a
|
|
* silent hot-load here is out of scope for the sync button itself.
|
|
*/
|
|
function useSyncAction(setPlugins: (plugins: PluginRecord[]) => void) {
|
|
const [syncBusy, setSyncBusy] = useState(false);
|
|
const [syncErrors, setSyncErrors] = useState<SyncError[]>([]);
|
|
|
|
const handleSync = async () => {
|
|
setSyncBusy(true);
|
|
try {
|
|
const result = await syncPlugins();
|
|
const refreshed = await listPlugins({ cache: "no-store" });
|
|
setPlugins(refreshed);
|
|
setSyncErrors(result.errors ?? []);
|
|
toast.success(summarizeSyncResult(result));
|
|
} catch (err) {
|
|
toast.error(err instanceof Error ? err.message : "Failed to sync plugins");
|
|
} finally {
|
|
setSyncBusy(false);
|
|
}
|
|
};
|
|
|
|
return { syncBusy, syncErrors, handleSync };
|
|
}
|
|
|
|
export function usePluginActions() {
|
|
const upsertPlugin = useAppStore((s) => s.upsertPlugin);
|
|
const removePlugin = useAppStore((s) => s.removePlugin);
|
|
const setPlugins = useAppStore((s) => s.setPlugins);
|
|
|
|
const enableDisable = useEnableDisableActions(upsertPlugin);
|
|
const uninstall = useUninstallAction(removePlugin);
|
|
const install = useInstallAction(upsertPlugin);
|
|
const sync = useSyncAction(setPlugins);
|
|
|
|
return { ...enableDisable, ...uninstall, ...install, ...sync };
|
|
}
|