Files
paseo/packages/app/src/plugins/actions.ts
T
1f5b6143d6 Enforce shared, client, and server plugin SDK boundaries (#4347)
* fix(plugins): keep React out of the server plugin host

* fix(plugins): align SDK guidance and tests with runtime boundaries

* fix(plugin): loosen the react peer to ~19.1.0

The plugin SDK pins its react peer to exactly 19.1.0, and that pin is
what a downstream `npm i -g @getpaseo/cli` resolves against. So every
user ends up with react 19.1.0 in their global node_modules, where
corporate dependency scanners flag it: the CVE-2025-55182 advisory range
covers 19.1.0 even though the vulnerability itself lives in
react-server-dom-webpack/-parcel/-turbopack, none of which the CLI
installs. The user is then left hand-patching node_modules or
uninstalling Paseo.

Widening the peer to ~19.1.0 lets a downstream install pick the latest
19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the
root override still pins.

Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5
embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React
versions" on any exact mismatch, and it is reachable from Fabric builds
too: RendererImplementation.js requires the Paper shim unconditionally
in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and
three other entry points, and react-native-gesture-handler re-exports
findNodeHandle. Bumping the app's react is therefore not safe until
react-native moves.

The published CLI tree contains no react-native, so downstream installs
are not subject to that constraint.

Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this
branch, which would have broken the mobile app.

* Enforce example import ownership including client types

* Update Nix dependency hash for plugin peer metadata

* Group plugin APIs under client and server entry trees

* Resolve plugin type dependencies through declarations

* Validate declarations for implicit plugin type imports

* Preserve optional imports and validate declaration references

* Refresh Nix hash for plugin declaration resolver

* Canonicalize plugin paths consistently on Windows

* Normalize plugin ownership paths across resolver boundaries

---------

Co-authored-by: liujin0506 <liujin0506@qq.com>
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
2026-09-07 23:42:28 +02:00

101 lines
3.6 KiB
TypeScript

import { callPluginRpc } from "@getpaseo/plugin/client/host";
import type {
PluginAgentCommandContext,
PluginCommandCapabilities,
PluginPanelLocation,
PluginWorkspaceCommandContext,
} from "@getpaseo/plugin/client";
import type { PluginClientStateSource } from "@getpaseo/plugin/client/host";
import { resolvePluginPanelOpenLocation } from "./workspace-panels/locations";
import type { PluginSurfaceRuntime } from "./surface-runtime";
import type { InstalledPlugin } from "./types";
export interface PluginNavigation {
openSettings(pluginId: string, screenId: string): void;
openSurface(pluginId: string, surfaceId: string): void;
openWorkspacePanel(pluginId: string, panelId: string, location: PluginPanelLocation): void;
openAgentPanel(
pluginId: string,
panelId: string,
agentId: string,
location: PluginPanelLocation,
): void;
}
export function createPluginCapabilities(
plugin: InstalledPlugin,
runtime: PluginSurfaceRuntime,
navigation: PluginNavigation,
): PluginCommandCapabilities {
return {
paseo: runtime.paseo,
rpc: (contract, input) => callPluginRpc(contract, runtime.invoke, input),
openSettings(screenId) {
if (!plugin.settingsScreens.some((screen) => screen.id === screenId))
throw new Error(`Plugin settings screen is unavailable: ${screenId}`);
navigation.openSettings(plugin.id, screenId);
},
openSurface(surfaceId) {
if (!plugin.surfaces.some((surface) => surface.id === surfaceId)) {
throw new Error(`Plugin surface is unavailable: ${surfaceId}`);
}
navigation.openSurface(plugin.id, surfaceId);
},
};
}
export function createPluginAgentActionContext(input: {
plugin: InstalledPlugin;
runtime: PluginSurfaceRuntime;
navigation: PluginNavigation;
state: PluginClientStateSource;
workspaceId: string;
agentId: string;
}): PluginAgentCommandContext | null {
const { plugin, runtime, navigation, state, workspaceId, agentId } = input;
const workspace = state.getWorkspace(workspaceId);
const agent = state.getAgent(agentId);
if (!workspace || !agent || agent.workspaceId !== workspace.id) return null;
return {
context: "agent",
...createPluginCapabilities(plugin, runtime, navigation),
workspace,
agent,
openPanel(panelId, options) {
const panel = plugin.workspacePanels.find((candidate) => candidate.id === panelId);
if (!panel) throw new Error(`Workspace panel is unavailable: ${panelId}`);
const location = resolvePluginPanelOpenLocation(panel, options?.location);
if (panel.context === "workspace") {
navigation.openWorkspacePanel(plugin.id, panelId, location);
return;
}
navigation.openAgentPanel(plugin.id, panelId, agent.id, location);
},
};
}
export function createPluginWorkspaceActionContext(input: {
plugin: InstalledPlugin;
runtime: PluginSurfaceRuntime;
navigation: PluginNavigation;
state: PluginClientStateSource;
workspaceId: string;
}): PluginWorkspaceCommandContext | null {
const { plugin, runtime, navigation, state, workspaceId } = input;
const workspace = state.getWorkspace(workspaceId);
if (!workspace) return null;
return {
context: "workspace",
...createPluginCapabilities(plugin, runtime, navigation),
workspace,
openPanel(panelId, options) {
const panel = plugin.workspacePanels.find(
(candidate) => candidate.id === panelId && candidate.context === "workspace",
);
if (!panel) throw new Error(`Workspace panel is unavailable: ${panelId}`);
const location = resolvePluginPanelOpenLocation(panel, options?.location);
navigation.openWorkspacePanel(plugin.id, panelId, location);
},
};
}