Files

T

João Salavisa bc2f310e73 feat(plugins): add plugin marketplace with curated registry and updates (#1798 )

* feat(plugins): add plugin marketplace with curated registry and updates

Discover and install plugins from inside kandev instead of only by URL/upload.

- Backend marketplace subpackage: SQLite-backed sources, catalog fetch/merge
  (dedup, install_state, degraded-source handling), and the /api/plugins/
  marketplace[/sources] API. Install reuses the existing install-by-URL pipeline.
- Frontend: Settings > Plugins gains a Browse tab (search/category/star sort),
  source management, one-click install, and an Update button on the Installed
  tab when the catalog has a newer version. Plugins may ship an icon (manifest
  `icon` -> catalog icon_url) with a letter-tile fallback.
- Registry infra: plugin-registry/ (curated plugins.yaml + schema.json) and two
  GitHub Actions (zero-dependency Node build-index.mjs -> index.json on Pages,
  daily star refresh). Ships empty at launch; the empty catalog is valid.
- Spec: docs/specs/plugins/marketplace.md. No download telemetry; stars only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): address marketplace PR review feedback

- CodeQL: stub fetch routers keyed off a path segment, not a hostname substring.
- Nullable stars end to end: a failed star lookup stays unknown (not 0) and
  sorts last, instead of decoding null -> 0 and corrupting ranking.
- Fetch marketplace sources concurrently and dedupe identical in-flight
  downloads (singleflight), so a slow source can't serialize the Browse tab.
- Register /marketplace routes before the /:id wildcard (gin tree ordering).
- Duplicate source URL returns 409 ErrDuplicateSource, not a raw SQL error.
- Browse: filter category client-side so the category dropdown never collapses.
- marketplaceInstall swallows after toasting (no unhandled promise rejection).
- Source badge keys off source_id, not a name substring.
- build-index: read block-sequence manifest categories, not just inline.
- Registry index workflow validates on pull_request; Pages deploy gated to
  push/schedule/dispatch. Spec: align package_sha256 (advisory in v1) + sort enum.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): guard catalog repo_url against javascript: href injection

repo_url comes from an untrusted index.json, so a malicious/compromised source
could set a javascript: URL that runs in the operator's session when the Repo
link is clicked (rel/target don't block it). Only render the anchor for http(s)
schemes. Adds regression tests for the scheme guard and null-star rendering.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): require https for remote sources; test oversized download

- Reject remote plain-http marketplace sources (MITM catalog-poisoning risk);
  loopback http stays allowed for local dev/e2e fixtures.
- Add the missing oversized-response assertion to TestDownloadRejectsNon200AndOversized
  so the maxIndexBytes memory bound has coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(plugins): detach source download from singleflight leader's context

Two concurrent Browse opens after a cache Refresh share one singleflight
download; if the leader's request context is canceled (it navigates away), the
waiters must not inherit that cancellation. Use context.WithoutCancel so values
are preserved but the leader can't cancel everyone; the client's 20s timeout
still bounds the download.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-19 17:10:53 +01:00

7.1 KiB

Raw Blame History

Feature Specs

Specs for kandev product features, grouped by umbrella. Each spec describes a user-invocable capability and is the source of truth for "is this feature done?"

The bar: an agent given only a spec (no source code) should be able to either reimplement the feature or test the existing system for conformance. See .agents/skills/spec/SKILL.md for the workflow and template.

Status: draft (being written) · building (in active development) · shipped (implemented, spec matches code) · archived (deprecated).

needs-upgrade in a spec's frontmatter flags template sections that the original sources did not cover and should be filled in from code (Data model, API surface, State machine, Permissions, Failure modes, Persistence guarantees). All office specs have been brought to the implementability bar; this flag is only used for newly-drafted specs that need a code-driven fill-in pass.

office/ — autonomous agent management

The office umbrella covers kandev's autonomous-agent product surface: workspaces of long-running agents that pick up tasks, coordinate via handoffs, and report through a dashboard.

Spec	Status
overview	draft
agents	draft
tasks	draft
scheduler	draft
runtime	draft
routing	draft
costs	in-progress
dashboard	draft
live-updates	draft
inbox	draft
assistant	draft
automations-settings	draft
testing	shipped

platform/ — cross-cutting capabilities

Product-wide capabilities that are not tied to a single feature area.

Spec	Status
plugins	draft
plugins — marketplace	building

tasks/ — task & workflow model

Kandev's task model: documents, execution stages, labels, blocker escalation, subtask checklists, subtree controls, and the unification with the workflow engine.

Spec	Status
documents	shipped
execution-stages	shipped
labels	shipped
model-unification	draft
without-repositories	draft
subtask-checklist	shipped
subtask-detachment	shipped
subtask-completion-trigger	draft
subtree-controls	shipped
blocked-task-escalation	draft
runtime-cleanup	draft
archive-confirmation	shipped
link-existing-task-github-issue	building
wip-limit-pull-system	building
multi-branch	shipped
quick-chat-sessions	shipped
quick-chat-repository-context	shipped
parent-child-message-interrupt	shipped

agents/ — agent governance

Roles, governance gates, and granular permissions that apply across human users and office agents.

Spec	Status
roles	shipped
governance	shipped
granular-permissions	draft

integrations/ — external service integrations

Per-workspace credentials and triage triggers for external services.

Spec	Status
slack	shipped
external-mcp	draft
gitlab-integration	shipped
jira-status-filter	shipped

workspaces/ — workspace lifecycle

Spec	Status
deletion	shipped

costs/ — cost tracking & budgets

Subscription quota tracking and per-agent cheap-model profile routing.

Spec	Status
subscription-usage	draft
cheap-model-profiles	shipped

ui/ — cross-cutting UI features

Spec	Status
ci-pr-automation	draft
comment-markdown	shipped
empty-turn-notice	shipped
acp-shell-command-output	shipped
acp-model-configuration-summary	shipped
review-file-status	building
sidebar-view-creation	shipped
slash-command-composer	shipped
settings-manual-save	shipped
mobile-task-navigation	shipped

system-page/ — operational diagnostics & maintenance UI

System pages (Radarr/Sonarr-style) for status, disk usage, database maintenance, backups, logs, updates, OSS licenses, and about.

Spec	Status
system-page	draft
storage-maintenance	building
feature-toggles	draft

Standalone

Spec	Status
workflow-cycle-guardrails	building
improve-kandev	draft
homebrew-core	draft
native-kandev-cli	draft
desktop-tauri-app	shipped
public-share-links	draft
ssh-executor	draft
cli-mode-parity	draft
workflow-settings-autosave	archived; superseded by settings-manual-save
mobile-quick-chat-topbar	building

Conventions

Spec layout. Umbrella specs live as flat .md files under the umbrella directory (docs/specs/office/agents.md). Standalone specs use a folder (docs/specs/improve-kandev/spec.md).
Plans are not specs. Implementation plans are committed under docs/plans/<feature>/ with individual sibling task files named task-<NN>-<short-slug>.md. Specs are the durable requirements; plans and task files are implementation records for the current buildout.
Bug fixes are not specs. Bugs produce a regression test plus an ADR if they encoded a new convention. See /fix skill.
Architecture decisions are not specs. ADRs live under docs/decisions/. See /record decision.

Cross-references

ADRs: ../decisions/INDEX.md
Spec workflow: .agents/skills/spec/SKILL.md
Bug-fix workflow: .agents/skills/fix/SKILL.md

7.1 KiB Raw Blame History