kandev/docs/plans/bitbucket-plugin/task-05-dynamic-composer-reference-sources.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
05-dynamic-composer-reference-sources	Dynamic composer reference sources	completed	2	01-design-package 03-protocol-manifest-actions	plan.md	../../specs/integrations/requirements/bitbucket-plugin.md

Task 05: Dynamic composer reference sources

Intent

Bridge active manifest-declared plugin reference sources into the existing backend mentions registry, preserving host canonicalization and live authorization at search and submission.

Owned paths

• apps/backend/internal/mentions/service.go
• apps/backend/internal/mentions/types.go
• apps/backend/internal/mentions/service_test.go
• apps/backend/internal/backendapp/mentions.go
• apps/backend/internal/backendapp/mentions_test.go
• apps/backend/internal/plugins/mentions.go
• Focused plugin bridge tests under apps/backend/internal/plugins/.
• apps/web/hooks/use-entity-reference-search.test.ts
• apps/web/components/task/chat/use-entity-reference-composer.test.ts
• apps/web/components/task/chat/entity-reference-menu.test.tsx

Dependencies

Tasks 01 and 03.

Acceptance

1. Plugins dynamically register/unregister only manifest-owned (source, provider, kind) descriptors; source collisions, disabled plugins, timeouts, and cancellation have deterministic behavior.
2. Host, not plugin, constructs canonical references. Search and message submission call live plugin authorization with verified workspace and search/submission purpose.
3. Generic composer UI renders plugin pull-request groups/icons/chips without a Bitbucket frontend branch.

Verification

cd apps/backend && go test ./internal/mentions ./internal/backendapp ./internal/plugins
cd apps/web && pnpm test -- hooks/use-entity-reference-search.test.ts components/task/chat/use-entity-reference-composer.test.ts components/task/chat/entity-reference-menu.test.tsx
cd apps/web && pnpm run typecheck

Risks

Search results are untrusted presentation data. Submission reauthorization is required to prevent stale, tampered, cross-workspace, or disabled-plugin references entering message metadata.