Files

T

Kandev Agent c53f699714 feat: add plugin system with grpc runtime and native ui plugins

- go plugin backends ship as release tarballs (per-platform binaries, checksums) that
  kandev installs from url/upload or filesystem sideload+sync, then spawns and
  supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls)
- strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook
  plus a capability-gated host service (state, secrets, emit); author sdk in
  pkg/pluginsdk; packaging cli in cmd/plugin-pack
- native frontend bundles: window.registerKandevPlugin + registry/host loader with
  dynamic routes, nav items, slots and ws handlers; plugins settings page with
  install dialog, sync button and enable/disable/uninstall
- gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and
  integration tests plus playwright e2e against a real packaged fixture plugin

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-16 17:55:45 +01:00

2.1 KiB

Raw Blame History

id, title, status, wave, depends_on, plan

title

status

wave

depends_on

plan

task-15

Spec update + docs + full verification

pending

task-09

task-13

task-14

docs/plans/plugins/plan.md

Spec update + docs + full verification

Title

Reconcile the spec with what was built, update docs, and run the full format/typecheck/test/lint gate across backend and web.

Inputs

Spec docs/specs/plugins/spec.md (status: draft).
Implemented deltas from this plan.

Acceptance

Spec edits to docs/specs/plugins/spec.md:
- Add the ui.pages[] manifest field (key/title/path/surface) and a new "UI page proxy" subsection under API surface (GET/POST /api/plugins/{id}/ui/*, header stripping for iframe embedding).
- Narrow "Out of scope → UI extensions": iframe pages are now IN; native JS slots / registry remain OUT.
- Note tool invocation is implemented as a client + listing endpoint but NOT wired into live agent sessions yet (deferred).
- Correct the credential-storage line: api_key stored as bcrypt hash; webhook_secret stored encrypted (recoverable) because kandev must HMAC-sign outbound deliveries. Keep "returned once at registration".
- Keep marketplace / managed-runtime / process-management OUT of scope.
- Keep status: draft; add a dated note if the spec has a changelog convention.
Update docs/plans/plugins/plan.md task statuses to done.
If a public-docs surface changed, run /docs-maintainer judgment (new operator-facing /api/plugins API + settings page likely warrants a short docs/public/** page — add one if the repo documents other settings pages).

Verification (full gate)

make -C apps/backend fmt (FIRST — formatters may split lines)
make -C apps/backend typecheck test lint
make -C apps/backend build
cd apps/web && pnpm run typecheck && pnpm lint && pnpm test
cd apps/web && pnpm e2e -g "plugin"

Output contract

Report: spec sections changed, docs added, and the full verification results (paste failing output if any). This task closes the plan.

Dependencies

task-09, task-13, task-14.

2.1 KiB Raw Blame History

Spec update + docs + full verification

Title

Inputs

Acceptance

Verification (full gate)

Output contract

Dependencies

2.1 KiB

Raw Blame History