Skip to content

feat(plugins): add scoped V2 pluggin activation controls - #726

Open
pascalandr wants to merge 5 commits into
NeuralNomadsAI:devfrom
pascalandr:feat/plugin-controls-v2
Open

pascalandr wants to merge 5 commits into
NeuralNomadsAI:devfrom
pascalandr:feat/plugin-controls-v2

Conversation

@pascalandr

@pascalandr pascalandr commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add OpenCode V2 plugin activation controls to the Status panel with an explicit Global or Project scope before any write.
  • Keep runtime inventory separate from configured source declarations and ordered activation rules, including exact disabled IDs absent from plugin.list() so they remain reactivable.
  • Append only plugin.id / -plugin.id rules. This surface does not install, remove, update, or edit plugin options.

Safety and compatibility

  • Use the authenticated workspace connection, complete native location ownership, connection-generation fencing, the worktree deletion fence, and daemon-reported config.get() roots.
  • Translate WSL paths through the selected distro; never derive config roots from process environment, CLI debug paths, or OPENCODE_CONFIG_CONTENT.
  • Bound configuration reads to 4 MiB, require valid UTF-8 JSON/JSONC, preserve comments/source objects/options/unknown keys/BOM/formatting/permissions, detect concurrent replacement, and atomically replace the selected document.
  • Leave the generic OpenCode proxy closed to plugin/check, plugin/update, and plugin RPC mutations; expose only narrow CodeNomad read/mutation routes.
  • Fence stale UI responses, serialize mutations per location, and coalesce config.updated / plugin.updated bursts into a trailing refresh while retaining the last valid snapshot.
  • Qualify against the synchronized @opencode/client / @opencode/plugin 2.0.11 pins and the latest-stable native compatibility workflow; historical adapter evidence is not presented as a separate support promise.

UI

  • Require an explicit scope selection and show the exact target document before enabling switches.
  • Use square persistent switches and scoped styles, with runtime failures, configured-only plugins, source declarations, options, and rule precedence shown independently.
  • Add all new strings to all 10 locales.

Validation

  • npm run typecheck --workspace @neuralnomads/codenomad
  • npm run typecheck --workspace @codenomad/ui
  • npm run typecheck --workspace @neuralnomads/codenomad-electron-app
  • node --import tsx --test packages/server/src/opencode/plugin-control-document.test.ts packages/server/src/opencode/plugin-controls.test.ts packages/server/src/server/routes/plugin-controls.test.ts ÔÇö 21 passing
  • node --import tsx --test packages/ui/src/stores/plugin-controls.test.ts packages/ui/src/stores/instance-invalidation.test.ts ÔÇö 8 passing
  • node --import tsx --test packages/ui/tests/browser/plugin-controls.test.ts ÔÇö passing real Solid/full-stylesheet regression
  • node --import tsx --test --test-name-pattern="blocks global routes through a workspace" packages/server/src/server/__tests__/instance-proxy.test.ts ÔÇö proxy mutation block remains passing
  • git diff --check
  • Rendered fixture inspected at panel width; scope and switch corners resolve to 0px.

Scope note

This separate V2 implementation supersedes PR #593.

Expose runtime plugin inventory and configured sources separately in the Status panel, require an explicit Global or Project scope, and keep disabled exact IDs visible so users can safely re-enable them. The controls append ordered activation rules only and do not present package installation, updates, removal, or option editing.

Add narrow authenticated workspace routes backed by config.get and plugin.list, daemon-reported path authority, WSL host translation, location ownership, connection-generation checks, and the worktree deletion fence. Preserve JSONC comments, source objects, options, unknown keys, BOMs, formatting, and permissions through bounded conflict-checked atomic replacement; malformed documents and stale writes fail closed.

Fence UI cache responses and coalesce native config/plugin event bursts while retaining the last valid snapshot. Add complete locale coverage, square scoped styles, compatibility documentation, server/store regressions, proxy security coverage, and a real Solid browser fixture for scope, mutation, event refresh, and geometry.

Validated with server, UI, and Electron typechecks; 21 focused server tests; 7 UI store/invalidation tests; the plugin-controls Playwright regression; and the generic proxy mutation-block test.
@github-actions

Copy link
Copy Markdown

PR builds are available as GitHub Actions artifacts:

https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35504530251

Artifacts expire in 7 days.
Artifacts:

  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-electron-macos
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-electron-linux
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-tauri-windows
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-tauri-macos-arm64
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-tauri-macos
  • session-pruning-plugin-windows-latest
  • session-pruning-plugin-ubuntu-latest
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-electron-windows
  • session-pruning-plugin-macos-latest
  • pr-726-604038fc6d74ecbc1e276a38e1081d00f0ba6a4a-tauri-linux

Serialize activation mutations per instance location in the UI cache so concurrent controls cannot publish an older server response over a newer durable snapshot. Queued mutations continue after an earlier failure while passive refresh errors remain independently reported.

Refresh the plugin-control qualification notes after the dev merge moved the synchronized OpenCode client/plugin pins to 2.0.11, and distinguish historical adapter evidence from the current release support policy.

Validated with server, UI, and Electron typechecks; 21 focused server tests; 8 UI store/invalidation tests; the real plugin-controls Playwright fixture; the generic proxy refusal regression; and git diff --check.
@github-actions

Copy link
Copy Markdown

PR builds are available as GitHub Actions artifacts:

https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35512796408

Artifacts expire in 7 days.
Artifacts:

  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-tauri-macos
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-electron-windows
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-electron-linux
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-tauri-macos-arm64
  • session-pruning-plugin-macos-latest
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-electron-macos
  • session-pruning-plugin-windows-latest
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-tauri-windows
  • session-pruning-plugin-ubuntu-latest
  • pr-726-91f598bef20ae9e8b533d7a07dd3fcdda86c9b3b-tauri-linux

Bring the plugin activation controls branch onto upstream/dev at 05e9342 before producing the review build. This incorporates the managed OpenCode setup, runtime-admission, and session-history changes without altering the plugin controls' scoped mutation contract.

The merge resolved cleanly. Validation is recorded in the following documentation adjustment commit and local build results.
Reflect the upstream runtime-support split introduced by the latest dev baseline: OpenCode 2.0.7 is the demonstrated technical minimum, while 2.0.11 remains the synchronized recommended and tested target.

Clarify that plugin activation controls add no stricter version requirement and defer admission to the shared runtime-support module and compatibility evidence policy.

Validated on the merged tree with server, UI, and Electron typechecks, 21 focused server tests, 8 focused UI tests, an Electron application build, packaged-resource smoke checks, and a Windows x64 zip build.
@pascalandr pascalandr changed the title feat(plugins): add scoped V2 activation controls feat(plugins): add scoped V2 pluggin activation controls Sep 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant