Files
1f5b6143d6 Enforce shared, client, and server plugin SDK boundaries (#4347)
* fix(plugins): keep React out of the server plugin host

* fix(plugins): align SDK guidance and tests with runtime boundaries

* fix(plugin): loosen the react peer to ~19.1.0

The plugin SDK pins its react peer to exactly 19.1.0, and that pin is
what a downstream `npm i -g @getpaseo/cli` resolves against. So every
user ends up with react 19.1.0 in their global node_modules, where
corporate dependency scanners flag it: the CVE-2025-55182 advisory range
covers 19.1.0 even though the vulnerability itself lives in
react-server-dom-webpack/-parcel/-turbopack, none of which the CLI
installs. The user is then left hand-patching node_modules or
uninstalling Paseo.

Widening the peer to ~19.1.0 lets a downstream install pick the latest
19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the
root override still pins.

Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5
embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React
versions" on any exact mismatch, and it is reachable from Fabric builds
too: RendererImplementation.js requires the Paper shim unconditionally
in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and
three other entry points, and react-native-gesture-handler re-exports
findNodeHandle. Bumping the app's react is therefore not safe until
react-native moves.

The published CLI tree contains no react-native, so downstream installs
are not subject to that constraint.

Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this
branch, which would have broken the mobile app.

* Enforce example import ownership including client types

* Update Nix dependency hash for plugin peer metadata

* Group plugin APIs under client and server entry trees

* Resolve plugin type dependencies through declarations

* Validate declarations for implicit plugin type imports

* Preserve optional imports and validate declaration references

* Refresh Nix hash for plugin declaration resolver

* Canonicalize plugin paths consistently on Windows

* Normalize plugin ownership paths across resolver boundaries

---------

Co-authored-by: liujin0506 <liujin0506@qq.com>
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
2026-09-07 23:42:28 +02:00

170 lines
5.6 KiB
TypeScript

import type { ProviderEvent } from "@getpaseo/plugin/server/provider";
import { describe, expect, it } from "vitest";
import { createDirectExampleProvider } from "./provider.js";
describe("direct provider example", () => {
it("fails steering when no turn is active without creating a turn", async () => {
const connection = await createDirectExampleProvider().connect({
versions: [1],
capabilities: ["prompt.command", "prompt.message", "prompt.steer"],
});
const events: ProviderEvent[] = [];
connection.onEvent((event) => events.push(event));
await connection.send({
type: "session.open",
requestId: "open-1",
sessionId: "session-1",
config: { cwd: "/repo", env: {}, mcpServers: {}, settings: {}, persist: false },
history: "skip",
});
const turnEventsBefore = events.filter((event) => event.type === "session.turn").length;
await connection.send({
type: "session.prompt",
sessionId: "session-1",
prompt: {
clientMessageId: "steer-1",
delivery: "steer",
input: { type: "command", name: "reset", arguments: "" },
},
});
expect(events).toContainEqual({
type: "session.prompt_result",
sessionId: "session-1",
clientMessageId: "steer-1",
result: { type: "failed", error: { message: "There is no active turn to steer" } },
});
expect(events.filter((event) => event.type === "session.turn")).toHaveLength(turnEventsBefore);
expect(events).not.toContainEqual(expect.objectContaining({ type: "session.notice" }));
await connection.close();
});
it("demonstrates settings, commands, persistence, and provider-rendered timeline items", async () => {
const connection = await createDirectExampleProvider().connect({
versions: [1],
capabilities: [
"prompt.message",
"prompt.command",
"session.configure",
"session.persistence",
"session.subsession",
"timeline.plugin",
],
});
const events: ProviderEvent[] = [];
connection.onEvent((event) => events.push(event));
await connection.send({
type: "session.open",
requestId: "open-complete",
sessionId: "session-complete",
config: {
cwd: "/repo",
env: { EXAMPLE: "1" },
systemPrompt: "Be useful",
mcpServers: {},
model: "example-1",
mode: "build",
settings: { concise: true, voice: "calm" },
providerOptions: { privateValue: 1 },
persist: true,
},
history: "skip",
});
expect(events).toContainEqual(
expect.objectContaining({
type: "session.config",
config: expect.objectContaining({
settings: expect.arrayContaining([
expect.objectContaining({ id: "concise", value: true }),
expect.objectContaining({ id: "voice", value: "calm" }),
]),
}),
}),
);
expect(events).toContainEqual(expect.objectContaining({ type: "session.commands" }));
await connection.send({
type: "session.configure",
requestId: "configure-complete",
sessionId: "session-complete",
changes: { settings: { voice: "direct" } },
});
await connection.send({
type: "session.prompt",
sessionId: "session-complete",
prompt: {
clientMessageId: "command-1",
delivery: "auto",
input: { type: "command", name: "reset", arguments: "" },
},
});
await connection.send({
type: "session.prompt",
sessionId: "session-complete",
prompt: {
clientMessageId: "message-1",
delivery: "auto",
input: { type: "message", content: [{ type: "text", text: "hello" }] },
},
});
expect(events).toContainEqual(
expect.objectContaining({
type: "session.prompt_result",
clientMessageId: "command-1",
result: { type: "completed" },
}),
);
expect(events).toContainEqual(
expect.objectContaining({
type: "timeline.item",
item: expect.objectContaining({ type: "user_message", clientMessageId: "message-1" }),
}),
);
expect(events).toContainEqual(
expect.objectContaining({
type: "timeline.item",
sessionId: "session-complete",
item: expect.objectContaining({ type: "plugin", kind: "provider-result" }),
}),
);
const child = events.find(
(event): event is Extract<ProviderEvent, { type: "session.opened" }> =>
event.type === "session.opened" && event.parentSessionId === "session-complete",
);
expect(child?.sessionId).toMatch(/^[0-9a-f-]{36}$/u);
expect(events).toContainEqual(
expect.objectContaining({
type: "timeline.item",
sessionId: child?.sessionId,
item: expect.objectContaining({ type: "plugin", kind: "provider-result" }),
}),
);
expect(events).toContainEqual(expect.objectContaining({ type: "session.persistence" }));
await connection.close();
});
it("rejects calls after the example connection closes", async () => {
const connection = await createDirectExampleProvider().connect({
versions: [1],
capabilities: ["prompt.message"],
});
await connection.close();
await expect(
connection.send({ type: "catalog", requestId: "catalog-after-close" }),
).rejects.toThrow("Provider connection is closed");
await expect(
connection.send({
type: "session.open",
requestId: "open-after-close",
sessionId: "closed-session",
config: { cwd: "/repo", env: {}, mcpServers: {}, settings: {}, persist: false },
history: "skip",
}),
).rejects.toThrow("Provider connection is closed");
});
});