dreampiler/kandev
1
0
Fork 0
Code Issues 47 Pull Requests Actions 89 Packages Projects Releases Wiki Activity
Files
d853b66b87d260ac4aba4ab031ea8634550adc3a
kandev/docs/plans/plugins/task-23-spec-verify.md
T
Kandev Agent c53f699714 feat: add plugin system with grpc runtime and native ui plugins 
- go plugin backends ship as release tarballs (per-platform binaries, checksums) that
  kandev installs from url/upload or filesystem sideload+sync, then spawns and
  supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls)
- strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook
  plus a capability-gated host service (state, secrets, emit); author sdk in
  pkg/pluginsdk; packaging cli in cmd/plugin-pack
- native frontend bundles: window.registerKandevPlugin + registry/host loader with
  dynamic routes, nav items, slots and ws handlers; plugins settings page with
  install dialog, sync button and enable/disable/uninstall
- gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and
  integration tests plus playwright e2e against a real packaged fixture plugin

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-16 17:55:45 +01:00

1.8 KiB
Raw Blame History

id, title, status, wave, depends_on, plan
id title status wave depends_on plan
task-23 Spec + docs update + full verification (option C) done C
task-17
task-19
task-20
task-21
task-22
docs/plans/plugins/plan.md

Spec + docs update + full verification (option C)

Title

Reconcile the spec with the native-JS-plugin model actually built and run the full gate across backend + web + e2e.

Inputs

  • docs/specs/plugins/spec.md (draft) and PLUGIN-API.md.

Acceptance

  1. Spec edits:
    • Replace the "Out of scope → UI extensions" line: native JS UI plugins are now IN (bundle loaded into SPA, registry API). Reference PLUGIN-API.md.
    • Add a "Frontend plugin runtime" section summarizing the loading model, registry surface, ui.bundle manifest field, boot-payload plugins list, and the security posture (plugin JS runs in-origin; only active operator-registered plugins load; sandboxing is future work).
    • Correct credential storage (api_key bcrypt; webhook_secret encrypted/recoverable).
    • Keep marketplace / managed-runtime / agent-session tool wiring / rate limiting / JS sandboxing OUT.
    • status: draft; dated note if the spec has a changelog convention.
  2. A short docs/public/** operator page if the repo documents settings pages (Plugins settings + how to register a plugin). Use /docs-maintainer judgment.
  3. Mark all option-C task files done; update plan statuses.

Verification (full gate)

  • make -C apps/backend fmt (FIRST)
  • make -C apps/backend typecheck test lint build
  • cd apps/web && pnpm run typecheck && pnpm lint && pnpm test
  • cd apps/web && pnpm e2e -g "plugin"

Output contract

Spec sections changed, docs added, and full verification results (paste failures). Closes the plan.

Dependencies

task-17, task-19, task-20, task-21, task-22.

Reference in New Issue View Git Blame Copy Permalink