Files
1f5b6143d6 Enforce shared, client, and server plugin SDK boundaries (#4347)
* fix(plugins): keep React out of the server plugin host

* fix(plugins): align SDK guidance and tests with runtime boundaries

* fix(plugin): loosen the react peer to ~19.1.0

The plugin SDK pins its react peer to exactly 19.1.0, and that pin is
what a downstream `npm i -g @getpaseo/cli` resolves against. So every
user ends up with react 19.1.0 in their global node_modules, where
corporate dependency scanners flag it: the CVE-2025-55182 advisory range
covers 19.1.0 even though the vulnerability itself lives in
react-server-dom-webpack/-parcel/-turbopack, none of which the CLI
installs. The user is then left hand-patching node_modules or
uninstalling Paseo.

Widening the peer to ~19.1.0 lets a downstream install pick the latest
19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the
root override still pins.

Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5
embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React
versions" on any exact mismatch, and it is reachable from Fabric builds
too: RendererImplementation.js requires the Paper shim unconditionally
in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and
three other entry points, and react-native-gesture-handler re-exports
findNodeHandle. Bumping the app's react is therefore not safe until
react-native moves.

The published CLI tree contains no react-native, so downstream installs
are not subject to that constraint.

Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this
branch, which would have broken the mobile app.

* Enforce example import ownership including client types

* Update Nix dependency hash for plugin peer metadata

* Group plugin APIs under client and server entry trees

* Resolve plugin type dependencies through declarations

* Validate declarations for implicit plugin type imports

* Preserve optional imports and validate declaration references

* Refresh Nix hash for plugin declaration resolver

* Canonicalize plugin paths consistently on Windows

* Normalize plugin ownership paths across resolver boundaries

---------

Co-authored-by: liujin0506 <liujin0506@qq.com>
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
2026-09-07 23:42:28 +02:00

73 lines
1.8 KiB
TypeScript

import type { PluginTimelineTransformerContribution } from "@getpaseo/plugin/client";
import { z } from "zod";
import { piTaskListSchema } from "../shared/pi-tasks";
const rpivDetailsSchema = z.object({
tasks: z.array(
z
.object({
subject: z.string(),
status: z.enum(["pending", "in_progress", "completed", "deleted"]),
})
.passthrough(),
),
});
const piExampleDetailsSchema = z.object({
todos: z.array(
z
.object({
id: z.number().int().optional(),
text: z.string(),
done: z.boolean(),
})
.passthrough(),
),
});
type PiTask = z.output<typeof piTaskListSchema>["tasks"][number];
type ToolCallTransformer = PluginTimelineTransformerContribution<"tool_call">["transform"];
function replacement(tasks: PiTask[]) {
if (tasks.length === 0) return;
return {
items: [
{
type: "plugin" as const,
kind: "pi-task-list",
version: 1,
data: { tasks },
},
],
};
}
export const transformPiTodoToolCall: ToolCallTransformer = ({ item }) => {
if (item.name !== "todo" || item.detail.type !== "unknown") {
return;
}
const result = item.detail.output;
if (!result || typeof result !== "object" || Array.isArray(result)) return;
const details = Reflect.get(result, "details");
const rpiv = rpivDetailsSchema.safeParse(details);
if (rpiv.success) {
return replacement(
rpiv.data.tasks.flatMap((task): PiTask[] =>
task.status === "deleted" ? [] : [{ text: task.subject, status: task.status }],
),
);
}
const piExample = piExampleDetailsSchema.safeParse(details);
if (piExample.success) {
return replacement(
piExample.data.todos.map((todo) => ({
text: todo.text,
status: todo.done ? "completed" : "pending",
})),
);
}
};