Files
kandev/apps/web/lib/ws/client.ts
T
João Salavisa e145d48f22 feat: add plugin system with grpc runtime and native ui plugins (#1742)
* feat: add plugin system with grpc runtime and native ui plugins

- go plugin backends ship as release tarballs (per-platform binaries, checksums) that
  kandev installs from url/upload or filesystem sideload+sync, then spawns and
  supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls)
- strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook
  plus a capability-gated host service (state, secrets, emit); author sdk in
  pkg/pluginsdk; packaging cli in cmd/plugin-pack
- native frontend bundles: window.registerKandevPlugin + registry/host loader with
  dynamic routes, nav items, slots and ws handlers; plugins settings page with
  install dialog, sync button and enable/disable/uninstall
- gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and
  integration tests plus playwright e2e against a real packaged fixture plugin

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): hydrate base app context on plugin routes

Plugin-owned SPA routes classify as RouteUnknown, so the boot payload shipped
only feature flags — no workspaces, workflows, or kanban context. Native plugin
UI (e.g. host.ui.TaskCreateDialog) then had an empty store. Hydrate the same
base context as the Home route for unknown SPA routes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(plugins): expose TaskCreateDialog on host.ui

Lets a native plugin open kandev's real create-task modal (prefilled via
initialValues) instead of POSTing directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): harden filesystem/URL sinks against CodeQL findings

Add sink-level guards on the plugin trust boundary: securejoin containment on
archive extraction (zip-slip), plugin-id validation before every fs_store path,
http/https scheme validation on install-from-URL, and non-interpolated ws-handler
error logging.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address review findings (races, resource caps, lifecycle)

- serialize per-plugin startup to close a TOCTOU double-spawn race, and let a
  plugin restart after exhausting attempts
- bound plugin startup with an explicit 30s timeout
- reject backslash paths and cap decompressed bytes by actual size in pkgtar;
  only mark a package Signed when a verifier actually ran and passed
- delete plugin_state on uninstall; validate webhook keys against the manifest
  and cap webhook body size; restart an active plugin when a new version installs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): sanitize plugin-id path sinks for CodeQL

Pin the plugin id to a single path segment with filepath.Base at recordPath/
configPath and pkgtar.Remove — a barrier the taint analysis recognizes.
Behaviour-identical for valid ids (already validated by safePluginID); clears
the go/path-injection alerts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): inline plugin-id validation at path sinks for CodeQL

filepath.Base does not strip '..', so it is not a path-injection barrier. Call
the recognized safePluginID / id-pattern guard inline in Delete/GetConfig/
SetConfig and pkgtar.Remove — the same barrier that already cleared the Get sink.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address code-review findings (backend)

- add capability-gating tests for the Host RPC service (was untested)
- close a stop-during-start orphan race so Disable/Uninstall can't leave a
  supervised subprocess behind
- on failed upgrade, remove only the new version dir (not all versions + data);
  restart the prior version
- validate manifest version and reject ids ending in .config (record-file alias)
- make Deliverer.Refresh non-blocking and cancel in-flight delivery on worker stop
- clamp out-of-range webhook status, skip-and-warn corrupt records in List,
  write records atomically, semver-aware sideload version pick

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address code-review findings (frontend)

- wrap plugin routes + settings routes in a shared PluginErrorBoundary so a
  throwing plugin page shows a fallback instead of white-screening the SPA
- fix disable/re-enable in one session: keep the cached registration and
  re-run initialize instead of relying on a cached ES-module re-import
- prefix root-relative bundle/style URLs with apiBaseUrl (split-origin/Tauri)
- surface partial-install warnings via toast.warning instead of a bare success
- dedupe/remove injected style links on unload; gate PluginNavItems on the flag

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): serialize per-plugin lifecycle + guard config writes

- add a per-plugin keyed lock in Service so concurrent Enable/Disable/Install/
  Uninstall/UpdateConfig for one id are serialized (no status-machine race)
- take s.mu in SetConfig/GetConfig and write config atomically
- bound each plugin initialize() with a timeout so one hung bundle can't stall
  the rest of the boot load

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(plugins): split service_test.go to satisfy file-length lint

Move the install/URL test group into service_install_test.go; no logic change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: build and ship the e2e fixture plugin package to E2E shards

The plugin E2E specs' global-setup requires apps/backend/.build/kandev-plugin-e2e-1.0.0.tar.gz.
Build it in the E2E build job, upload it as an artifact, and download it in both
the regular and container shard jobs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 12:00:26 +01:00

589 lines
18 KiB
TypeScript

import type { BackendMessageMap, BackendMessageType } from "@/lib/types/backend";
import type { ConnectionStatus } from "@/lib/types/connection";
import { generateUUID } from "@/lib/utils";
import { createDebugLogger, isDebug } from "@/lib/debug/log";
import { dispatchToPluginWsHandlers } from "@/lib/ws/plugin-bridge";
const debugDispatch = createDebugLogger("ws:dispatch");
// High-frequency notification types we skip in the dispatch log to avoid
// drowning the console during agent streams. Filter [ws:dispatch] to see
// everything else; if you need the streaming traffic, comment this out.
const DISPATCH_LOG_DENYLIST = new Set<string>([
"session.message.added",
"session.message.updated",
"session.message.deleted",
"session.shell.output",
"session.process.output",
]);
type MessageHandler<T extends BackendMessageType> = (message: BackendMessageMap[T]) => void;
// Internal alias kept for readability — the WS client emits the same vocabulary
// the UI consumes. `disconnected` covers both "never connected" (formerly
// `idle`) and "socket closed" (formerly `closed`); `connected` replaces `open`.
type WebSocketStatus = ConnectionStatus;
export interface ReconnectOptions {
enabled?: boolean;
maxAttempts?: number;
initialDelay?: number;
maxDelay?: number;
backoffMultiplier?: number;
}
const DEFAULT_RECONNECT_OPTIONS: Required<ReconnectOptions> = {
enabled: true,
maxAttempts: 10,
initialDelay: 1000,
maxDelay: 30000,
backoffMultiplier: 1.5,
};
export class WebSocketClient {
private socket: WebSocket | null = null;
private status: WebSocketStatus = "disconnected";
private handlers = new Map<BackendMessageType, Set<MessageHandler<BackendMessageType>>>();
private pendingRequests = new Map<
string,
{
resolve: (payload: unknown) => void;
reject: (error: Error) => void;
timeout: ReturnType<typeof setTimeout>;
}
>();
private pendingQueue: string[] = [];
private reconnectOptions: Required<ReconnectOptions>;
private reconnectAttempts = 0;
private reconnectTimer: ReturnType<typeof setTimeout> | null = null;
private intentionalClose = false;
private subscriptions = new Map<string, number>();
private sessionSubscriptions = new Map<string, number>();
// Ref-counted focus signals: a session can be focused by both the task panel
// and the task details page if both are mounted. Backend wakes its workspace
// tracker into fast-poll mode while any client has focus, falling back to
// slow when the count reaches 0 (debounced server-side).
private sessionFocusCounts = new Map<string, number>();
private userSubscriptionCount = 0;
private runSubscriptions = new Map<string, number>();
private systemMetricsSubscriptionCount = 0;
constructor(
private url: string,
private onStatusChange?: (status: WebSocketStatus) => void,
reconnectOptions?: ReconnectOptions,
) {
this.reconnectOptions = { ...DEFAULT_RECONNECT_OPTIONS, ...reconnectOptions };
}
getStatus() {
return this.status;
}
connect() {
if (this.socket) return;
this.intentionalClose = false;
this.clearReconnectTimer();
this.setStatus("connecting");
this.socket = new WebSocket(this.url);
this.socket.onopen = () => {
this.reconnectAttempts = 0;
this.setStatus("connected");
this.flushQueue();
this.resubscribe();
};
this.socket.onmessage = (event) => {
const parts = (event.data as string).split("\n");
for (const part of parts) {
const trimmed = part.trim();
if (!trimmed) continue;
try {
const message = JSON.parse(trimmed) as BackendMessageMap[BackendMessageType];
this.handleParsedMessage(message);
} catch {
// Ignore parse errors for individual messages
}
}
};
this.socket.onerror = () => {
this.setStatus("error");
};
this.socket.onclose = (event) => {
this.socket = null;
this.handleDisconnect(event);
};
}
disconnect() {
this.intentionalClose = true;
this.clearReconnectTimer();
if (this.socket) {
this.socket.close();
this.socket = null;
}
this.setStatus("disconnected");
this.cleanupPendingRequests();
}
send(payload: unknown) {
const data = JSON.stringify(payload);
if (isDebug()) {
const p = payload as { action?: string; id?: string; type?: string } | null;
const action = p?.action ?? "?";
if (!DISPATCH_LOG_DENYLIST.has(action)) {
const sessionId = (p as { payload?: { session_id?: string } } | null)?.payload?.session_id;
debugDispatch("send", {
action,
id: p?.id ?? null,
type: p?.type ?? null,
sessionId: sessionId ?? null,
queued: this.status !== "connected" || !this.socket,
});
}
}
if (this.status !== "connected" || !this.socket) {
this.pendingQueue.push(data);
return;
}
this.socket.send(data);
}
request<T>(action: string, payload: unknown, timeoutMs = 5000): Promise<T> {
const id = generateUUID();
return new Promise((resolve, reject) => {
const timeout = setTimeout(() => {
this.pendingRequests.delete(id);
reject(new Error(`WebSocket request timed out: ${action}`));
}, timeoutMs);
this.pendingRequests.set(id, {
resolve: resolve as (payload: unknown) => void,
reject,
timeout,
});
this.send({ id, type: "request", action, payload });
});
}
subscribe(taskId: string) {
const currentCount = this.subscriptions.get(taskId) ?? 0;
const nextCount = currentCount + 1;
this.subscriptions.set(taskId, nextCount);
if (this.status === "connected" && nextCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "task.subscribe",
payload: { task_id: taskId },
});
}
return () => this.unsubscribe(taskId);
}
subscribeSession(sessionId: string) {
const currentCount = this.sessionSubscriptions.get(sessionId) ?? 0;
const nextCount = currentCount + 1;
this.sessionSubscriptions.set(sessionId, nextCount);
if (this.status === "connected" && nextCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "session.subscribe",
payload: { session_id: sessionId },
});
}
return () => this.unsubscribeSession(sessionId);
}
focusSession(sessionId: string) {
const currentCount = this.sessionFocusCounts.get(sessionId) ?? 0;
const nextCount = currentCount + 1;
this.sessionFocusCounts.set(sessionId, nextCount);
if (this.status === "connected" && nextCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "session.focus",
payload: { session_id: sessionId },
});
}
return () => this.unfocusSession(sessionId);
}
/**
* Re-send a `session.focus` frame for an already-focused session WITHOUT
* touching the focus ref-count. The backend's focus handler pushes a fresh
* live git-status snapshot as a side effect (see `handleSessionFocus` →
* `sendSessionData` → `appendLiveGitStatusMessage`, which forces a
* `GetGitStatusMultiFresh` query that bypasses the workspace poll cache).
*
* This is the deterministic recovery for the focus-gated polling race: the
* agent edits a file, but if the workspace is still in slow poll mode (the
* focus→fast push lost a race with agentctl startup) the next
* `session.git.event` may be up to 30s away. Components that become visible
* and need fresh diff data (the diff panel becoming the active tab) call
* this to pull the latest git status immediately.
*
* No-op when the session isn't currently focused (the regular focus frame,
* sent on 0→1, already pushed fresh data).
*/
refreshSessionData(sessionId: string) {
if (this.status !== "connected") return;
if (!this.sessionFocusCounts.get(sessionId)) return;
this.send({
id: generateUUID(),
type: "request",
action: "session.focus",
payload: { session_id: sessionId },
});
}
unfocusSession(sessionId: string) {
const currentCount = this.sessionFocusCounts.get(sessionId);
if (!currentCount) return;
const nextCount = currentCount - 1;
if (nextCount <= 0) {
this.sessionFocusCounts.delete(sessionId);
if (this.status === "connected") {
this.send({
id: generateUUID(),
type: "request",
action: "session.unfocus",
payload: { session_id: sessionId },
});
}
return;
}
this.sessionFocusCounts.set(sessionId, nextCount);
}
subscribeUser() {
this.userSubscriptionCount += 1;
if (this.status === "connected" && this.userSubscriptionCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "user.subscribe",
payload: {},
});
}
}
unsubscribe(taskId: string) {
const currentCount = this.subscriptions.get(taskId);
if (!currentCount) return;
const nextCount = currentCount - 1;
if (nextCount <= 0) {
this.subscriptions.delete(taskId);
if (this.status === "connected") {
this.send({
id: generateUUID(),
type: "request",
action: "task.unsubscribe",
payload: { task_id: taskId },
});
}
return;
}
this.subscriptions.set(taskId, nextCount);
}
unsubscribeSession(sessionId: string) {
const currentCount = this.sessionSubscriptions.get(sessionId);
if (!currentCount) {
return;
}
const nextCount = currentCount - 1;
if (nextCount <= 0) {
this.sessionSubscriptions.delete(sessionId);
if (this.status === "connected") {
this.send({
id: generateUUID(),
type: "request",
action: "session.unsubscribe",
payload: { session_id: sessionId },
});
}
return;
}
this.sessionSubscriptions.set(sessionId, nextCount);
}
/**
* Subscribe to office run-event notifications for the given run id.
* Ref-counted so multiple components can subscribe independently;
* only the first call sends `run.subscribe` over the wire, only the
* last unsubscribe sends `run.unsubscribe`. Returns an
* unsubscribe function.
*/
subscribeRun(runId: string) {
const currentCount = this.runSubscriptions.get(runId) ?? 0;
const nextCount = currentCount + 1;
this.runSubscriptions.set(runId, nextCount);
if (this.status === "connected" && nextCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "run.subscribe",
payload: { run_id: runId },
});
}
return () => this.unsubscribeRun(runId);
}
subscribeSystemMetrics() {
this.systemMetricsSubscriptionCount += 1;
if (this.status === "connected" && this.systemMetricsSubscriptionCount === 1) {
this.send({
id: generateUUID(),
type: "request",
action: "system.metrics.subscribe",
payload: {},
});
}
return () => this.unsubscribeSystemMetrics();
}
unsubscribeSystemMetrics() {
this.systemMetricsSubscriptionCount = Math.max(0, this.systemMetricsSubscriptionCount - 1);
if (this.status === "connected" && this.systemMetricsSubscriptionCount === 0) {
this.send({
id: generateUUID(),
type: "request",
action: "system.metrics.unsubscribe",
payload: {},
});
}
}
unsubscribeRun(runId: string) {
const currentCount = this.runSubscriptions.get(runId);
if (!currentCount) return;
const nextCount = currentCount - 1;
if (nextCount <= 0) {
this.runSubscriptions.delete(runId);
if (this.status === "connected") {
this.send({
id: generateUUID(),
type: "request",
action: "run.unsubscribe",
payload: { run_id: runId },
});
}
return;
}
this.runSubscriptions.set(runId, nextCount);
}
unsubscribeUser() {
this.userSubscriptionCount = Math.max(0, this.userSubscriptionCount - 1);
if (this.status === "connected" && this.userSubscriptionCount === 0) {
this.send({
id: generateUUID(),
type: "request",
action: "user.unsubscribe",
payload: {},
});
}
}
on<T extends BackendMessageType>(type: T, handler: MessageHandler<T>) {
const handlers = this.handlers.get(type) ?? new Set();
handlers.add(handler as MessageHandler<BackendMessageType>);
this.handlers.set(type, handlers);
return () => this.off(type, handler);
}
off<T extends BackendMessageType>(type: T, handler: MessageHandler<T>) {
const handlers = this.handlers.get(type);
if (!handlers) return;
handlers.delete(handler as MessageHandler<BackendMessageType>);
if (!handlers.size) {
this.handlers.delete(type);
}
}
private debugNotification(action: BackendMessageType, payload: unknown, handlerCount: number) {
if (!isDebug() || DISPATCH_LOG_DENYLIST.has(action)) return;
const payloadSessionId = (payload as { session_id?: string } | undefined)?.session_id;
debugDispatch("notification", {
action,
sessionId: payloadSessionId ?? null,
handlers: handlerCount,
});
}
private handleParsedMessage(message: BackendMessageMap[BackendMessageType]) {
const msgWithId = message as { id?: string; type: string };
if (msgWithId.type === "response" && msgWithId.id) {
if (isDebug()) debugDispatch("response", { id: msgWithId.id });
this.resolvePendingRequest(msgWithId.id, message.payload);
return;
}
if (msgWithId.type === "error" && msgWithId.id) {
if (isDebug()) debugDispatch("error-response", { id: msgWithId.id });
this.rejectPendingRequest(msgWithId.id, message.payload);
return;
}
if (message.type !== "notification") return;
const action = (message as { action?: string })?.action as BackendMessageType | undefined;
if (!action) return;
const handlers = this.handlers.get(action);
this.debugNotification(action, message.payload, handlers?.size ?? 0);
if (handlers) {
handlers.forEach((handler) => handler(message));
}
// Plugin bridge: forward the same notification to any handlers a loaded
// plugin registered for this action (registry.registerWsHandler).
dispatchToPluginWsHandlers(action, message.payload);
}
private resolvePendingRequest(msgId: string, payload: unknown) {
const pending = this.pendingRequests.get(msgId);
if (!pending) return;
clearTimeout(pending.timeout);
this.pendingRequests.delete(msgId);
pending.resolve(payload);
}
private rejectPendingRequest(msgId: string, payload: unknown) {
const pending = this.pendingRequests.get(msgId);
if (!pending) return;
clearTimeout(pending.timeout);
this.pendingRequests.delete(msgId);
const errorMessage =
typeof payload === "object" && payload && "message" in payload
? String((payload as { message?: string }).message)
: "WebSocket request failed";
pending.reject(new Error(errorMessage));
}
private handleDisconnect(event: CloseEvent) {
this.setStatus("disconnected");
// Don't reconnect if this was an intentional close
if (this.intentionalClose) {
return;
}
// Don't reconnect if reconnect is disabled
if (!this.reconnectOptions.enabled) {
return;
}
// Don't reconnect if we've exceeded max attempts
if (this.reconnectAttempts >= this.reconnectOptions.maxAttempts) {
console.warn(
`WebSocket max reconnect attempts (${this.reconnectOptions.maxAttempts}) reached`,
);
this.setStatus("error");
this.cleanupPendingRequests();
return;
}
// Calculate delay with exponential backoff
const delay = Math.min(
this.reconnectOptions.initialDelay *
Math.pow(this.reconnectOptions.backoffMultiplier, this.reconnectAttempts),
this.reconnectOptions.maxDelay,
);
this.reconnectAttempts++;
this.setStatus("reconnecting");
console.log(
`WebSocket disconnected (code: ${event.code}, reason: ${event.reason || "none"}). ` +
`Reconnecting in ${delay}ms (attempt ${this.reconnectAttempts}/${this.reconnectOptions.maxAttempts})...`,
);
this.reconnectTimer = setTimeout(() => {
this.connect();
}, delay);
}
private clearReconnectTimer() {
if (this.reconnectTimer) {
clearTimeout(this.reconnectTimer);
this.reconnectTimer = null;
}
}
private cleanupPendingRequests() {
// Reject all pending requests
this.pendingRequests.forEach(({ reject, timeout }) => {
clearTimeout(timeout);
reject(new Error("WebSocket connection closed"));
});
this.pendingRequests.clear();
}
private resubscribe() {
// Re-subscribe to all tasks after reconnection
this.subscriptions.forEach((_count, taskId) => {
this.send({
id: generateUUID(),
type: "request",
action: "task.subscribe",
payload: { task_id: taskId },
});
});
this.sessionSubscriptions.forEach((_count, sessionId) => {
this.send({
id: generateUUID(),
type: "request",
action: "session.subscribe",
payload: { session_id: sessionId },
});
});
this.sessionFocusCounts.forEach((_count, sessionId) => {
this.send({
id: generateUUID(),
type: "request",
action: "session.focus",
payload: { session_id: sessionId },
});
});
this.runSubscriptions.forEach((_count, runId) => {
this.send({
id: generateUUID(),
type: "request",
action: "run.subscribe",
payload: { run_id: runId },
});
});
if (this.userSubscriptionCount > 0) {
this.send({
id: generateUUID(),
type: "request",
action: "user.subscribe",
payload: {},
});
}
if (this.systemMetricsSubscriptionCount > 0) {
this.send({
id: generateUUID(),
type: "request",
action: "system.metrics.subscribe",
payload: {},
});
}
}
private flushQueue() {
if (!this.socket || this.status !== "connected") return;
this.pendingQueue.forEach((data) => this.socket?.send(data));
this.pendingQueue = [];
}
private setStatus(status: WebSocketStatus) {
this.status = status;
this.onStatusChange?.(status);
}
}