mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-09 09:56:47 +08:00
* feat(plugins): host plugin artifacts, bind installs to immutable versions A plugin used to be a URL. The manifest was frozen at install, but the surface script was fetched from the author's server every time a panel opened, with no integrity check — so an administrator consented to a manifest while the browser ran whatever that host served that day, inside the scopes already granted. The author's uptime was our uptime, every panel open leaked the reader's IP and "who read which issue" to the author, and publishing at all required a public HTTPS domain, which is why the repo's own deploy-sentinel example never ran. The author now uploads an artifact bundle and Multica stores it: - plugin_package / plugin_package_version / plugin_package_file. A version is insert-only, and the (package_id, version) unique index is what makes immutability a database rule rather than a convention. - An installation names one version. Publishing another changes nothing for a workspace until an administrator upgrades, which is a second consent. - The bundle is validated once, at publish: the manifest parses, every file it declares is present and loadable, and a surface entry with a top-level import is refused with the line named. That failure used to surface months later in a reader's browser. - The host inlines the surface script into the document it generates, so the CSP names no remote script origin at all. `connect-src 'none'` now means it: a surface with no net: scope cannot reach anywhere, including its author. - Install-by-URL is gone rather than kept alongside. Two paths would make "is this code frozen?" depend on how the plugin was installed. - MULTICA_PLUGIN_DIR stays the development channel, but publishes an ordinary immutable version instead of being a second render path; re-publishing an unchanged version lands as `+dev.N`. Hook endpoints and MCP servers remain on the author's own infrastructure. Migration 376 drops existing installations: they name a source URL that is no longer a concept, and the code they would run was never published here. plugins_v1 has never left its feature flag and holds no production data — the same call migration 344 made. Closes MUL-6469 Co-authored-by: multica-agent <[email protected]> * fix(plugins): serialize publish/install/delete, correct the isolation claim Review of #7321 found five problems. Four are fixed here; the fifth is real, needs its own design pass, and is now tracked and described honestly in the code instead of claimed away. Migration prefix collision. main took 376 for agent_task_durable_work_dir while this branch was open, so `migration prefix 376 is reused` failed backend-tests. Rebased and renumbered the six migrations to 377-382. TOCTOU between delete and install/publish. Relationships are application-owned by repository policy, so nothing made "the version this installation names still exists" true across statements: `delete counts zero installs` -> `install reads the version` -> `delete commits` -> `install commits` left an installation whose panel 404s forever, and a publish racing a delete left a version whose package row was gone. Publish, install and delete now hold a (workspace, plugin key) advisory lock for their whole transaction, and delete counts installations inside it. Both interleavings have regression tests that reproduce the bug with the lock removed. Failed publishes moved package state. upsertPackage ran before the version transaction, so a republish that lost the unique index had already renamed the package, and a first publish that failed afterwards left a plugin with zero versions. It now runs inside the same transaction. The top-level import check was wrong in BOTH directions. It read line prefixes, so it missed ` import x` and `/* c */ import x` — and it refused a valid file whose template literal contained the word at a line start, which is ordinary in a surface that renders code samples. A refusal blocks a publish with no way around it, so that false positive was the worse half. Replaced with a scanner that skips comments and string/template literals; where it is imprecise it is imprecise safely (`/` always reads as division), so a mistake can only cost a detection, never invent one. Sandbox self-navigation is NOT fixed. `sandbox="allow-scripts"` permits `_self` navigation by design, no shipped CSP directive covers it, and contentWindow is unchanged across it — so a hostile artifact can still reach its author once and hand the replacement document the bridge port. Closing it needs an embedder frame-src policy or a handshake a navigated document cannot complete; both are decisions of their own. What lands here is damage control, labelled as such: the generated document beacons on pagehide from a listener the plugin cannot detach, and the embedder drops the bridge and unmounts the frame. The "a surface cannot reach its author" wording is removed from the SDK README and the tests. Closes MUL-6469 Refs MUL-6485 Co-authored-by: multica-agent <[email protected]> * fix(plugins): harden surface validation and error reporting * fix(migrations): renumber plugin package migrations * fix(plugins): validate classic surfaces and reset failures --------- Co-authored-by: Lambda <[email protected]> Co-authored-by: multica-agent <[email protected]>
139 lines
4.8 KiB
TypeScript
139 lines
4.8 KiB
TypeScript
import { useMutation, useQueryClient } from "@tanstack/react-query";
|
|
import { api } from "../api";
|
|
import type { PluginConfigRequest, PluginInstallRequest, PluginPreviewRequest } from "../types";
|
|
import { pluginKeys } from "./queries";
|
|
|
|
function useInvalidatePlugins(wsId: string) {
|
|
const queryClient = useQueryClient();
|
|
return () => queryClient.invalidateQueries({ queryKey: pluginKeys.all(wsId) });
|
|
}
|
|
|
|
/**
|
|
* Preview is deliberately a mutation, not a query: it is the first half of a
|
|
* consent flow the administrator started, so it must run on an explicit action
|
|
* rather than be replayed by a cache refetch.
|
|
*/
|
|
export function usePreviewPlugin(wsId: string) {
|
|
return useMutation({
|
|
mutationFn: (request: PluginPreviewRequest) => api.previewPlugin(wsId, request),
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Publishes an artifact bundle. A published version is immutable, so this only
|
|
* ever adds one — it can never change what an installed workspace is running.
|
|
*/
|
|
export function usePublishPluginPackage(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (bundle: File) => api.publishPluginPackage(wsId, bundle),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
/** The development channel: publish from MULTICA_PLUGIN_DIR instead of a zip. */
|
|
export function usePublishLocalPluginPackage(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (name: string) => api.publishLocalPluginPackage(wsId, name),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useDeletePluginPackage(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (packageId: string) => api.deletePluginPackage(wsId, packageId),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useInstallPlugin(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (request: PluginInstallRequest) => api.installPlugin(wsId, request),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useConfigurePlugin(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: ({ installationId, ...request }: PluginConfigRequest & { installationId: string }) =>
|
|
api.configurePlugin(wsId, installationId, request),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useSetPluginEnabled(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: ({ installationId, enabled }: { installationId: string; enabled: boolean }) =>
|
|
api.setPluginEnabled(wsId, installationId, enabled),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Pins the approved tool set for one `mcp` hook.
|
|
*
|
|
* `tools` is the complete set the administrator wants approved, never a delta —
|
|
* unchecking one and saving is what revokes it. An empty array withdraws the
|
|
* hook, and the next task claim stops offering it to agents.
|
|
*/
|
|
export function useApprovePluginMCPTools(wsId: string, installationId: string, hookKey: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (tools: string[]) => api.approvePluginMCPTools(wsId, installationId, hookKey, tools),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useUninstallPlugin(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (installationId: string) => api.uninstallPlugin(wsId, installationId),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Invokes a hook the user asked for.
|
|
*
|
|
* A mutation rather than a query for the same reason preview is: it performs an
|
|
* outbound call to a third-party server, and a cache refetch must never replay
|
|
* it. Whatever the hook did on the far side is not something to repeat because
|
|
* a component remounted.
|
|
*
|
|
* Deliberately does NOT invalidate on settle. A hook may have changed nothing,
|
|
* or may have written through the Action API under its own attribution — the
|
|
* caller knows which and invalidates what it actually expects to have moved.
|
|
*/
|
|
export function useInvokePluginHook() {
|
|
return useMutation({
|
|
mutationFn: ({ installationId, hookKey, ...request }: {
|
|
installationId: string;
|
|
hookKey: string;
|
|
trigger: "ui" | "manual";
|
|
issueId?: string;
|
|
input?: unknown;
|
|
}) => api.invokePluginHook(installationId, hookKey, request),
|
|
});
|
|
}
|
|
|
|
export function useRotatePluginToken(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (installationId: string) => api.rotatePluginToken(wsId, installationId),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|
|
|
|
export function useRevokePluginToken(wsId: string) {
|
|
const invalidate = useInvalidatePlugins(wsId);
|
|
return useMutation({
|
|
mutationFn: (installationId: string) => api.revokePluginToken(wsId, installationId),
|
|
onSettled: invalidate,
|
|
});
|
|
}
|